diff --git a/NEWS b/NEWS
--- a/NEWS
+++ b/NEWS
@@ -1,16368 +1,16422 @@
 Isabelle NEWS -- history of user-relevant changes
 =================================================
 
 (Note: Isabelle/jEdit shows a tree-view of the NEWS file in Sidekick.)
 
 
 New in this Isabelle version
 ----------------------------
 
 *** General ***
 
 * Timeouts for Isabelle/ML tools are subject to system option
 "timeout_scale" --- this already used for the overall session build
 process before, and allows to adapt to slow machines. The underlying
 Timeout.apply in Isabelle/ML treats an original timeout specification 0
 as no timeout; before it meant immediate timeout. Rare INCOMPATIBILITY
 in boundary cases.
 
 * Remote provers from SystemOnTPTP (notably for Sledgehammer) are now
 managed via Isabelle/Scala instead of perl; the dependency on
 libwww-perl has been eliminated (notably on Linux). Rare
 INCOMPATIBILITY: HTTP proxy configuration now works via JVM properties
 https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/doc-files/net-properties.html
 
 * More symbol definitions for the Z Notation (Isabelle fonts and LaTeX).
 See also the group "Z Notation" in the Symbols dockable of
 Isabelle/jEdit.
 
 
 *** Isabelle/jEdit Prover IDE ***
 
 * More robust 'proof' outline for method "induct": support nested cases.
 
 
 *** Document preparation ***
 
+* Document antiquotations for ML text have been refined: "def" and "ref"
+variants support index entries, e.g. @{ML} (no entry) vs. @{ML_def}
+(bold entry) vs. @{ML_ref} (regular entry); @{ML_type} supports explicit
+type arguments for constructors (only relevant for index), e.g.
+@{ML_type \<open>'a list\<close>} vs. @{ML_type 'a \<open>list\<close>}; @{ML_op} has been renamed
+to @{ML_infix}. Minor INCOMPATIBILITY concerning name and syntax.
+
+* Option "document_logo" determines if an instance of the Isabelle logo
+should be created in the document output directory. The given string
+specifies the name of the logo variant, while "_" (underscore) refers to
+the unnamed variant. The output file name is always "isabelle_logo.pdf".
+
+* Option "document_preprocessor" specifies the name of an executable
+that is run within the document output directory, after preparing the
+document sources and before the actual build process. This allows to
+apply adhoc patches, without requiring a separate "build" script.
+
+* Option "document_build" determines the document build engine, as
+defined in Isabelle/Scala (as system service). The subsequent engines
+are provided by the Isabelle distribution:
+
+  - "lualatex" (default): use ISABELLE_LUALATEX for a standard LaTeX
+    build with optional ISABELLE_BIBTEX and ISABELLE_MAKEINDEX
+
+  - "pdflatex": as above, but use ISABELLE_PDFLATEX (legacy mode for
+    special LaTeX styles)
+
+  - "build": delegate to the executable "./build pdf"
+
+The presence of a "build" command within the document output directory
+explicitly requires document_build=build. Minor INCOMPATIBILITY, need to
+adjust session ROOT options.
+
+* The command-line tool "isabelle latex" has been discontinued,
+INCOMPATIBILITY for old document build scripts.
+
+  - Former "isabelle latex -o sty" has become obsolete: Isabelle .sty
+    files are automatically generated within the document output
+    directory.
+
+  - Former "isabelle latex -o pdf" should be replaced by
+    "$ISABELLE_LUALATEX root" or "$ISABELLE_PDFLATEX root" (without
+    quotes), according to the intended LaTeX engine.
+
+  - Former "isabelle latex -o bbl" should be replaced by
+    "$ISABELLE_BIBTEX root" (without quotes).
+
+  - Former "isabelle latex -o idx" should be replaced by
+    "$ISABELLE_MAKEINDEX root" (without quotes).
+
+* Option "document_bibliography" explicitly enables the use of bibtex;
+the default is to check the presence of root.bib, but it could have a
+different name.
+
 * Improved LaTeX typesetting of \<open>...\<close> using \guilsinglleft ...
 \guilsinglright. INCOMPATIBILITY, need to use \usepackage[T1]{fontenc}
 (which is now also the default in "isabelle mkroot").
 
 * Simplified typesetting of \<guillemotleft>...\<guillemotright> using \guillemotleft ...
 \guillemotright from \usepackage[T1]{fontenc} --- \usepackage{babel} is
 no longer required.
 
 
 *** HOL ***
 
 * Theory Multiset: dedicated predicate "multiset" is gone, use
 explict expression instead.  Minor INCOMPATIBILITY.
 
 * Theory Multiset: consolidated abbreviations Mempty, Melem, not_Melem
 to empty_mset, member_mset, not_member_mset respectively.  Minor
 INCOMPATIBILITY.
 
 * Theory Multiset: consolidated operation and fact names:
     inf_subset_mset ~> inter_mset
     sup_subset_mset ~> union_mset
     multiset_inter_def ~> inter_mset_def
     sup_subset_mset_def ~> union_mset_def
     multiset_inter_count ~> count_inter_mset
     sup_subset_mset_count ~> count_union_mset
 
 * Theory Multiset: syntax precendence for membership operations has been
 adjusted to match the corresponding precendences on sets.  Rare
 INCOMPATIBILITY.
 
 * HOL-Analysis/HOL-Probability: indexed products of discrete
 distributions, negative binomial distribution, Hoeffding's inequality,
 Chernoff bounds, Cauchy–Schwarz inequality for nn_integral, and some
 more small lemmas. Some theorems that were stated awkwardly before were
 corrected. Minor INCOMPATIBILITY.
 
 * Theorems "antisym" and "eq_iff" in class "order" have been renamed to
 "order.antisym" and "order.eq_iff", to coexist locally with "antisym"
 and "eq_iff" from locale "ordering".  INCOMPATIBILITY: significant
 potential for change can be avoided if interpretations of type class
 "order" are replaced or augmented by interpretations of locale
 "ordering".
 
 * Theorem "swap_def" now is always qualified as "Fun.swap_def".  Minor
 INCOMPATIBILITY; note that for most applications less elementary lemmas
 exists.
 
 * Dedicated session HOL-Combinatorics.  INCOMPATIBILITY: theories
 "Permutations", "List_Permutation" (formerly "Permutation"), "Stirling",
 "Multiset_Permutations", "Perm" have been moved there from session
 HOL-Library.
 
 * Theory "Permutation" in HOL-Library has been renamed to the more
 specific "List_Permutation".  Note that most notions from that
 theory are already present in theory "Permutations".  INCOMPATIBILITY.
 
 * Lemma "permutes_induct" has been given stronger
 hypotheses and named premises.  INCOMPATIBILITY.
 
 * Theory "Transposition" in HOL-Combinatorics provides elementary
 swap operation "transpose".
 
 * Combinator "Fun.swap" resolved into a mere input abbreviation
 in separate theory "Transposition" in HOL-Combinatorics.
 INCOMPATIBILITY.
 
 * Bit operations set_bit, unset_bit and flip_bit are now class
 operations.  INCOMPATIBILITY.
 
 
 *** ML ***
 
 * ML antiquotations \<^try>\<open>expr\<close> and \<^can>\<open>expr\<close> operate directly on
 the given ML expression, in contrast to functions "try" and "can" that
 modify application of a function.
 
 * ML antiquotations for conditional ML text:
 
     \<^if_linux>\<open>...\<close>
     \<^if_macos>\<open>...\<close>
     \<^if_windows>\<open>...\<close>
     \<^if_unix>\<open>...\<close>
 
 * External bash processes are always managed by Isabelle/Scala, in
 contrast to Isabelle2021 where this was only done for macOS on Apple
 Silicon.
 
 The main Isabelle/ML interface is Isabelle_System.bash_process with
 result type Process_Result.T (resembling class Process_Result in Scala);
 derived operations Isabelle_System.bash and Isabelle_System.bash_output
 provide similar functionality as before. Rare INCOMPATIBILITY due to
 subtle semantic differences:
 
   - Processes invoked from Isabelle/ML actually run in the context of
     the Java VM of Isabelle/Scala. The settings environment and current
     working directory are usually the same on both sides, but there can be
     subtle corner cases (e.g. unexpected uses of "cd" or "putenv" in ML).
 
   - Output via stdout and stderr is line-oriented: Unix vs. Windows
     line-endings are normalized towards Unix; presence or absence of a
     final newline is irrelevant. The original lines are available as
     Process_Result.out_lines/err_lines; the concatenated versions
     Process_Result.out/err *omit* a trailing newline (using
     Library.trim_line, which was occasional seen in applications before,
     but is no longer necessary).
 
   - Output needs to be plain text encoded in UTF-8: Isabelle/Scala
     recodes it temporarily as UTF-16. This works for well-formed Unicode
     text, but not for arbitrary byte strings. In such cases, the bash
     script should write tempory files, managed by Isabelle/ML operations
     like Isabelle_System.with_tmp_file to create a file name and
     File.read to retrieve its content.
 
   - Just like any other Scala function invoked from ML,
     Isabelle_System.bash_process requires a proper PIDE session context.
     This could be a regular batch session (e.g. "isabelle build"), a
     PIDE editor session (e.g. "isabelle jedit"), or headless PIDE (e.g.
     "isabelle dump" or "isabelle server"). Note that old "isabelle
     console" or raw "isabelle process" don't have that.
 
 New Process_Result.timing works as in Isabelle/Scala, based on direct
 measurements of the bash_process wrapper in C: elapsed time is always
 available, CPU time is only available on Linux and macOS, GC time is
 unavailable.
 
 * Likewise, the following Isabelle/ML system operations are run in the
 context of Isabelle/Scala:
 
   - Isabelle_System.make_directory
   - Isabelle_System.copy_dir
   - Isabelle_System.copy_file
   - Isabelle_System.copy_base_file
   - Isabelle_System.rm_tree
   - Isabelle_System.download
 
 
 *** System ***
 
 * Command-line tool "isabelle version" supports repository archives
 (without full .hg directory). More options.
 
 * Obsolete settings variable ISABELLE_PLATFORM32 has been discontinued.
 Note that only Windows supports old 32 bit executables, via settings
 variable ISABELLE_WINDOWS_PLATFORM32. Everything else should be
 ISABELLE_PLATFORM64 (generic Posix) or ISABELLE_WINDOWS_PLATFORM64
 (native Windows) or ISABELLE_APPLE_PLATFORM64 (Apple Silicon).
 
 
 
 New in Isabelle2021 (February 2021)
 -----------------------------------
 
 *** General ***
 
 * On macOS, the IsabelleXYZ.app directory layout now follows the other
 platforms, without indirection via Contents/Resources/. INCOMPATIBILITY,
 use e.g. IsabelleXYZ.app/bin/isabelle instead of former
 IsabelleXYZ.app/Isabelle/bin/isabelle or
 IsabelleXYZ.app/Isabelle/Contents/Resources/IsabelleXYZ/bin/isabelle.
 
 * HTML presentation uses rich markup produced by Isabelle/PIDE,
 resulting in more colors and links.
 
 * HTML presentation includes auxiliary files (e.g. ML) for each theory.
 
 * Proof method "subst" is confined to the original subgoal range: its
 included distinct_subgoals_tac no longer affects unrelated subgoals.
 Rare INCOMPATIBILITY.
 
 * Theory_Data extend operation is obsolete and needs to be the identity
 function; merge should be conservative and not reset to the empty value.
 Subtle INCOMPATIBILITY and change of semantics (due to
 Theory.join_theory from Isabelle2020). Special extend/merge behaviour at
 the begin of a new theory can be achieved via Theory.at_begin.
 
 
 *** Isabelle/jEdit Prover IDE ***
 
 * Improved GUI look-and-feel: the portable and scalable "FlatLaf Light"
 is used by default on all platforms (appearance similar to IntelliJ
 IDEA).
 
 * Improved markup for theory header imports: hyperlinks for theory files
 work without formal checking of content.
 
 * The prover process can download auxiliary files (e.g. 'ML_file') for
 theories with remote URL. This requires the external "curl" program.
 
 * Action "isabelle.goto-entity" (shortcut CS+d) jumps to the definition
 of the formal entity at the caret position.
 
 * The visual feedback on caret entity focus is normally restricted to
 definitions within the visible text area. The keyboard modifier "CS"
 overrides this: then all defining and referencing positions are shown.
 See also option "jedit_focus_modifier".
 
 * The jEdit status line includes widgets both for JVM and ML heap usage.
 Ongoing ML ongoing garbage collection is shown as "ML cleanup".
 
 * The Monitor dockable provides buttons to request a full garbage
 collection and sharing of live data on the ML heap. It also includes
 information about the Java Runtime system.
 
 * PIDE support for session ROOTS: markup for directories.
 
 * Update to jedit-5.6.0, the latest release. This version works properly
 on macOS by default, without the special MacOSX plugin.
 
 * Action "full-screen-mode" (shortcut F11 or S+F11) has been modified
 for better approximate window size on macOS and Linux/X11.
 
 * Improved GUI support for macOS 11.1 Big Sur: native fullscreen mode,
 but non-native look-and-feel (FlatLaf).
 
 * Hyperlinks to various file-formats (.pdf, .png, etc.) open an external
 viewer, instead of re-using the jEdit text editor.
 
 * IDE support for Naproche-SAD: Proof Checking of Natural Mathematical
 Documents. See also $NAPROCHE_HOME/examples for files with .ftl or
 .ftl.tex extension. The corresponding Naproche-SAD server process can be
 disabled by setting the system option naproche_server=false and
 restarting the Isabelle application.
 
 
 *** Document preparation ***
 
 * Keyword 'document_theories' within ROOT specifies theories from other
 sessions that should be included in the generated document source
 directory. This does not affect the generated session.tex: \input{...}
 needs to be used separately.
 
 * The standard LaTeX engine is now lualatex, according to settings
 variable ISABELLE_PDFLATEX. This is mostly upwards compatible with old
 pdflatex, but text encoding needs to conform strictly to utf8. Rare
 INCOMPATIBILITY.
 
 * Discontinued obsolete DVI format and ISABELLE_LATEX settings variable:
 document output is always PDF.
 
 * Antiquotation @{tool} refers to Isabelle command-line tools, with
 completion and formal reference to the source (external script or
 internal Scala function).
 
 * Antiquotation @{bash_function} refers to GNU bash functions that are
 checked within the Isabelle settings environment.
 
 * Antiquotations @{scala}, @{scala_object}, @{scala_type},
 @{scala_method} refer to checked Isabelle/Scala entities.
 
 
 *** Pure ***
 
 * Session Pure-Examples contains notable examples for Isabelle/Pure
 (former entries of HOL-Isar_Examples).
 
 * Named contexts (locale and class specifications, locale and class
 context blocks) allow bundle mixins for the surface context. This allows
 syntax notations to be organized within bundles conveniently. See theory
 "HOL-ex.Specifications_with_bundle_mixins" for examples and the isar-ref
 manual for syntax descriptions.
 
 * Definitions in locales produce rule which can be added as congruence
 rule to protect foundational terms during simplification.
 
 * Consolidated terminology and function signatures for nested targets:
 
   - Local_Theory.begin_nested replaces Local_Theory.open_target
 
   - Local_Theory.end_nested replaces Local_Theory.close_target
 
   - Combination of Local_Theory.begin_nested and
     Local_Theory.end_nested(_result) replaces
     Local_Theory.subtarget(_result)
 
 INCOMPATIBILITY.
 
 * Local_Theory.init replaces Generic_Target.init. Minor INCOMPATIBILITY.
 
 
 *** HOL ***
 
 * Session HOL-Examples contains notable examples for Isabelle/HOL
 (former entries of HOL-Isar_Examples, HOL-ex etc.).
 
 * An updated version of the veriT solver is now included as Isabelle
 component. It can be used in the "smt" proof method via "smt (verit)" or
 via "declare [[smt_solver = verit]]" in the context; see also session
 HOL-Word-SMT_Examples.
 
 * Zipperposition 2.0 is now included as Isabelle component for
 experimentation, e.g. in "sledgehammer [prover = zipperposition]".
 
 * Sledgehammer:
   - support veriT in proof preplay
   - take adventage of more cores in proof preplay
 
 * Updated the Metis prover underlying the "metis" proof method to
 version 2.4 (release 20180810). The new version fixes one soundness
 defect and two incompleteness defects. Very slight INCOMPATIBILITY.
 
 * Nitpick/Kodkod may be invoked directly within the running
 Isabelle/Scala session (instead of an external Java process): this
 improves reactivity and saves resources. This experimental feature is
 guarded by system option "kodkod_scala" (default: true in PIDE
 interaction, false in batch builds).
 
 * Simproc "defined_all" and rewrite rule "subst_all" perform more
 aggressive substitution with variables from assumptions.
 INCOMPATIBILITY, consider repairing proofs locally like this:
 
   supply subst_all [simp del] [[simproc del: defined_all]]
 
 * Simproc "datatype_no_proper_subterm" rewrites equalities "lhs = rhs"
 on datatypes to "False" if either side is a proper subexpression of the
 other (for any datatype with a reasonable size function).
 
 * Syntax for state monad combinators fcomp and scomp is organized in
 bundle state_combinator_syntax.  Minor INCOMPATIBILITY.
 
 * Syntax for reflected term syntax is organized in bundle term_syntax,
 discontinuing previous locale term_syntax.  Minor INCOMPATIBILITY.
 
 * New constant "power_int" for exponentiation with integer exponent,
 written as "x powi n".
 
 * Added the "at most 1" quantifier, Uniq.
 
 * For the natural numbers, "Sup {} = 0".
 
 * New constant semiring_char gives the characteristic of any type of
 class semiring_1, with the convenient notation CHAR('a). For example,
 CHAR(nat) = CHAR(int) = CHAR(real) = 0, CHAR(17) = 17.
 
 * HOL-Computational_Algebra.Polynomial: Definition and basic properties
 of algebraic integers.
 
 * Library theory "Bit_Operations" with generic bit operations.
 
 * Library theory "Signed_Division" provides operations for signed
 division, instantiated for type int.
 
 * Theory "Multiset": removed misleading notation \<Union># for sum_mset;
 replaced with \<Sum>\<^sub>#. Analogous notation for prod_mset also exists now.
 
 * New theory "HOL-Library.Word" takes over material from former session
 "HOL-Word". INCOMPATIBILITY: need to adjust imports.
 
 * Theory "HOL-Library.Word": Type word is restricted to bit strings
 consisting of at least one bit. INCOMPATIBILITY.
 
 * Theory "HOL-Library.Word": Bit operations NOT, AND, OR, XOR are based
 on generic algebraic bit operations from theory
 "HOL-Library.Bit_Operations". INCOMPATIBILITY.
 
 * Theory "HOL-Library.Word": Most operations on type word are set up for
 transfer and lifting. INCOMPATIBILITY.
 
 * Theory "HOL-Library.Word": Generic type conversions. INCOMPATIBILITY,
 sometimes additional rewrite rules must be added to applications to get
 a confluent system again.
 
 * Theory "HOL-Library.Word": Uniform polymorphic "mask" operation for
 both types int and word. INCOMPATIBILITY.
 
 * Theory "HOL-Library.Word": Syntax for signed compare operators has
 been consolidated with syntax of regular compare operators. Minor
 INCOMPATIBILITY.
 
 * Former session "HOL-Word": Various operations dealing with bit values
 represented as reversed lists of bools are separated into theory
 Reversed_Bit_Lists in session Word_Lib in the AFP. INCOMPATIBILITY.
 
 * Former session "HOL-Word": Theory "Word_Bitwise" has been moved to AFP
 entry Word_Lib as theory "Bitwise". INCOMPATIBILITY.
 
 * Former session "HOL-Word": Compound operation "bin_split" simplifies
 by default into its components "drop_bit" and "take_bit".
 INCOMPATIBILITY.
 
 * Former session "HOL-Word": Operations lsb, msb and set_bit are
 separated into theories Least_significant_bit, Most_significant_bit and
 Generic_set_bit respectively in session Word_Lib in the AFP.
 INCOMPATIBILITY.
 
 * Former session "HOL-Word": Ancient int numeral representation has been
 factored out in separate theory "Ancient_Numeral" in session Word_Lib in
 the AFP. INCOMPATIBILITY.
 
 * Former session "HOL-Word": Operations "bin_last", "bin_rest",
 "bin_nth", "bintrunc", "sbintrunc", "norm_sint", "bin_cat" and
 "max_word" are now mere input abbreviations. Minor INCOMPATIBILITY.
 
 * Former session "HOL-Word": Misc ancient material has been factored out
 into separate theories and moved to session Word_Lib in the AFP. See
 theory "Guide" there for further information. INCOMPATIBILITY.
 
 * Session HOL-TPTP: The "tptp_isabelle" and "tptp_sledgehammer" commands
 are in working order again, as opposed to outputting "GaveUp" on nearly
 all problems.
 
 * Session "HOL-Hoare": concrete syntax only for Hoare triples, not
 abstract language constructors.
 
 * Session "HOL-Hoare": now provides a total correctness logic as well.
 
 
 *** FOL ***
 
 * Added the "at most 1" quantifier, Uniq, as in HOL.
 
 * Simproc "defined_all" and rewrite rule "subst_all" have been changed
 as in HOL.
 
 
 *** ML ***
 
 * Antiquotations @{scala_function}, @{scala}, @{scala_thread} refer to
 registered Isabelle/Scala functions (of type String => String):
 invocation works via the PIDE protocol.
 
 * Path.append is available as overloaded "+" operator, similar to
 corresponding Isabelle/Scala operation.
 
 * ML statistics via an external Poly/ML process: this allows monitoring
 the runtime system while the ML program sleeps.
 
 
 *** System ***
 
 * Isabelle server allows user-defined commands via
 isabelle_scala_service.
 
 * Update/rebuild external provers on currently supported OS platforms,
 notably CVC4 1.8, E prover 2.5, SPASS 3.8ds, CSDP 6.1.1.
 
 * The command-line tool "isabelle log" prints prover messages from the
 build database of the given session, following the the order of theory
 sources, instead of erratic parallel evaluation. Consequently, the
 session log file is restricted to system messages of the overall build
 process, and thus becomes more informative.
 
 * Discontinued obsolete isabelle display tool, and DVI_VIEWER settings
 variable.
 
 * The command-line tool "isabelle logo" only outputs PDF; obsolete EPS
 (for DVI documents) has been discontinued. Former option -n has been
 turned into -o with explicit file name. Minor INCOMPATIBILITY.
 
 * The command-line tool "isabelle components" supports new options -u
 and -x to manage $ISABELLE_HOME_USER/etc/components without manual
 editing of Isabelle configuration files.
 
 * The shell function "isabelle_directory" (within etc/settings of
 components) augments the list of special directories for persistent
 symbolic path names. This improves portability of heap images and
 session databases. It used to be hard-wired for Isabelle + AFP, but
 other projects may now participate on equal terms.
 
 * The command-line tool "isabelle process" now prints output to
 stdout/stderr separately and incrementally, instead of just one bulk to
 stdout after termination. Potential INCOMPATIBILITY for external tools.
 
 * The command-line tool "isabelle console" now supports interrupts
 properly (on Linux and macOS).
 
 * Batch-builds via "isabelle build" use a PIDE session with special
 protocol: this allows to invoke Isabelle/Scala operations from
 Isabelle/ML. Big build jobs (e.g. AFP) require extra heap space for the
 java process, e.g. like this in $ISABELLE_HOME_USER/etc/settings:
 
   ISABELLE_TOOL_JAVA_OPTIONS="$ISABELLE_TOOL_JAVA_OPTIONS -Xmx8g"
 
 This includes full PIDE markup, if option "build_pide_reports" is
 enabled.
 
 * The command-line tool "isabelle build" provides option -P DIR to
 produce PDF/HTML presentation in the specified directory; -P: refers to
 the standard directory according to ISABELLE_BROWSER_INFO /
 ISABELLE_BROWSER_INFO_SYSTEM settings. Generated PDF documents are taken
 from the build database -- from this or earlier builds with option
 document=pdf.
 
 * The command-line tool "isabelle document" generates theory documents
 on the spot, using the underlying session build database (exported
 LaTeX sources or existing PDF files). INCOMPATIBILITY, the former
 "isabelle document" tool was rather different and has been discontinued.
 
 * The command-line tool "isabelle sessions" explores the structure of
 Isabelle sessions and prints result names in topological order (on
 stdout).
 
 * The Isabelle/Scala "Progress" interface changed slightly and
 "No_Progress" has been discontinued. INCOMPATIBILITY, use "new Progress"
 instead.
 
 * General support for Isabelle/Scala system services, configured via the
 shell function "isabelle_scala_service" in etc/settings (e.g. of an
 Isabelle component); see implementations of class
 Isabelle_System.Service in Isabelle/Scala. This supersedes former
 "isabelle_scala_tools" and "isabelle_file_format": minor
 INCOMPATIBILITY.
 
 * The syntax of theory load commands (for auxiliary files) is now
 specified in Isabelle/Scala, as instance of class
 isabelle.Command_Span.Load_Command registered via isabelle_scala_service
 in etc/settings. This allows more flexible schemes than just a list of
 file extensions. Minor INCOMPATIBILITY, e.g. see theory
 HOL-SPARK.SPARK_Setup to emulate the old behaviour.
 
 * JVM system property "isabelle.laf" has been discontinued; the default
 Swing look-and-feel is ""FlatLaf Light".
 
 * Isabelle/Phabricator supports Ubuntu 20.04 LTS.
 
 * Isabelle/Phabricator setup has been updated to follow ongoing
 development: libphutil has been discontinued. Minor INCOMPATIBILITY:
 existing server installations should remove libphutil from
 /usr/local/bin/isabelle-phabricator-upgrade and each installation root
 directory (e.g. /var/www/phabricator-vcs/libphutil).
 
 * Experimental support for arm64-linux platform. The reference platform
 is Raspberry Pi 4 with 8 GB RAM running Pi OS (64 bit).
 
 * Support for Apple Silicon, using mostly x86_64-darwin runtime
 translation via Rosetta 2 (e.g. Poly/ML and external provers), but also
 some native arm64-darwin executables (e.g. Java).
 
 
 
 New in Isabelle2020 (April 2020)
 --------------------------------
 
 *** General ***
 
 * Session ROOT files need to specify explicit 'directories' for import
 of theory files. Directories cannot be shared by different sessions.
 (Recall that import of theories from other sessions works via
 session-qualified theory names, together with suitable 'sessions'
 declarations in the ROOT.)
 
 * Internal derivations record dependencies on oracles and other theorems
 accurately, including the implicit type-class reasoning wrt. proven
 class relations and type arities. In particular, the formal tagging with
 "Pure.skip_proofs" of results stemming from "instance ... sorry" is now
 propagated properly to theorems depending on such type instances.
 
 * Command 'sorry' (oracle "Pure.skip_proofs") is more precise about the
 actual proposition that is assumed in the goal and proof context. This
 requires at least Proofterm.proofs = 1 to show up in theorem
 dependencies.
 
 * Command 'thm_oracles' prints all oracles used in given theorems,
 covering the full graph of transitive dependencies.
 
 * Command 'thm_deps' prints immediate theorem dependencies of the given
 facts. The former graph visualization has been discontinued, because it
 was hardly usable.
 
 * Refined treatment of proof terms, including type-class proofs for
 minor object-logics (FOL, FOLP, Sequents).
 
 * The inference kernel is now confined to one main module: structure
 Thm, without the former circular dependency on structure Axclass.
 
 * Mixfix annotations may use "' " (single quote followed by space) to
 separate delimiters (as documented in the isar-ref manual), without
 requiring an auxiliary empty block. A literal single quote needs to be
 escaped properly. Minor INCOMPATIBILITY.
 
 
 *** Isar ***
 
 * The proof method combinator (subproofs m) applies the method
 expression m consecutively to each subgoal, constructing individual
 subproofs internally. This impacts the internal construction of proof
 terms: it makes a cascade of let-expressions within the derivation tree
 and may thus improve scalability.
 
 * Attribute "trace_locales" activates tracing of locale instances during
 roundup. It replaces the diagnostic command 'print_dependencies', which
 has been discontinued.
 
 
 *** Isabelle/jEdit Prover IDE ***
 
 * Prover IDE startup is now much faster, because theory dependencies are
 no longer explored in advance. The overall session structure with its
 declarations of 'directories' is sufficient to locate theory files. Thus
 the "session focus" of option "isabelle jedit -S" has become obsolete
 (likewise for "isabelle vscode_server -S"). Existing option "-R" is both
 sufficient and more convenient to start editing a particular session.
 
 * Actions isabelle.tooltip (CS+b) and isabelle.message (CS+m) display
 tooltip message popups, corresponding to mouse hovering with/without the
 CONTROL/COMMAND key pressed.
 
 * The following actions allow to navigate errors within the current
 document snapshot:
 
   isabelle.first-error (CS+a)
   isabelle.last-error (CS+z)
   isabelle.next-error (CS+n)
   isabelle.prev-error (CS+p)
 
 * Support more brackets: \<llangle> \<rrangle> (intended for implicit argument syntax).
 
 * Action isabelle.jconsole (menu item Plugins / Isabelle / Java/VM
 Monitor) applies the jconsole tool on the running Isabelle/jEdit
 process. This allows to monitor resource usage etc.
 
 * More adequate default font sizes for Linux on HD / UHD displays:
 automatic font scaling is usually absent on Linux, in contrast to
 Windows and macOS.
 
 * The default value for the jEdit property "view.antiAlias" (menu item
 Utilities / Global Options / Text Area / Anti Aliased smooth text) is
 now "subpixel HRGB", instead of former "standard". Especially on Linux
 this often leads to faster text rendering, but can also cause problems
 with odd color shades. An alternative is to switch back to "standard"
 here, and set the following Java system property:
 
     isabelle jedit -Dsun.java2d.opengl=true
 
 This can be made persistent via JEDIT_JAVA_OPTIONS in
 $ISABELLE_HOME_USER/etc/settings. For the "Isabelle2020" desktop
 application there is a corresponding options file in the same directory.
 
 
 *** Isabelle/VSCode Prover IDE ***
 
 * Update of State and Preview panels to use new WebviewPanel API of
 VSCode.
 
 
 *** HOL ***
 
 * Improvements of the 'lift_bnf' command:
   - Add support for quotient types.
   - Generate transfer rules for the lifted map/set/rel/pred constants
     (theorems "<type>.<constant>_transfer_raw").
 
 * Term_XML.Encode/Decode.term uses compact representation of Const
 "typargs" from the given declaration environment. This also makes more
 sense for translations to lambda-calculi with explicit polymorphism.
 INCOMPATIBILITY, use Term_XML.Encode/Decode.term_raw in special
 applications.
 
 * ASCII membership syntax concerning big operators for infimum and
 supremum has been discontinued. INCOMPATIBILITY.
 
 * Removed multiplicativity assumption from class
 "normalization_semidom". Introduced various new intermediate classes
 with the multiplicativity assumption; many theorem statements
 (especially involving GCD/LCM) had to be adapted. This allows for a more
 natural instantiation of the algebraic typeclasses for e.g. Gaussian
 integers. INCOMPATIBILITY.
 
 * Clear distinction between types for bits (False / True) and Z2 (0 /
 1): theory HOL-Library.Bit has been renamed accordingly.
 INCOMPATIBILITY.
 
 * Dynamic facts "algebra_split_simps" and "field_split_simps" correspond
 to algebra_simps and field_simps but contain more aggressive rules
 potentially splitting goals; algebra_split_simps roughly replaces
 sign_simps and field_split_simps can be used instead of divide_simps.
 INCOMPATIBILITY.
 
 * Theory HOL.Complete_Lattices:
 renamed Inf_Sup -> Inf_eq_Sup and Sup_Inf -> Sup_eq_Inf
 
 * Theory HOL-Library.Monad_Syntax: infix operation "bind" (\<bind>)
 associates to the left now as is customary.
 
 * Theory HOL-Library.Ramsey: full finite Ramsey's theorem with
 multiple colours and arbitrary exponents.
 
 * Session HOL-Proofs: build faster thanks to better treatment of proof
 terms in Isabelle/Pure.
 
 * Session HOL-Word: bitwise NOT-operator has proper prefix syntax. Minor
 INCOMPATIBILITY.
 
 * Session HOL-Analysis: proof method "metric" implements a decision
 procedure for simple linear statements in metric spaces.
 
 * Session HOL-Complex_Analysis has been split off from HOL-Analysis.
 
 
 *** ML ***
 
 * Theory construction may be forked internally, the operation
 Theory.join_theory recovers a single result theory. See also the example
 in theory "HOL-ex.Join_Theory".
 
 * Antiquotation @{oracle_name} inlines a formally checked oracle name.
 
 * Minimal support for a soft-type system within the Isabelle logical
 framework (module Soft_Type_System).
 
 * Former Variable.auto_fixes has been replaced by slightly more general
 Proof_Context.augment: it is subject to an optional soft-type system of
 the underlying object-logic. Minor INCOMPATIBILITY.
 
 * More scalable Export.export using XML.tree to avoid premature string
 allocations, with convenient shortcut XML.blob. Minor INCOMPATIBILITY.
 
 * Prover IDE support for the underlying Poly/ML compiler (not the basis
 library). Open $ML_SOURCES/ROOT.ML in Isabelle/jEdit to browse the
 implementation with full markup.
 
 
 *** System ***
 
 * Standard rendering for more Isabelle symbols: \<llangle> \<rrangle> \<bbar> \<sqdot>
 
 * The command-line tool "isabelle scala_project" creates a Gradle
 project configuration for Isabelle/Scala/jEdit, to support Scala IDEs
 such as IntelliJ IDEA.
 
 * The command-line tool "isabelle phabricator_setup" facilitates
 self-hosting of the Phabricator software-development platform, with
 support for Git, Mercurial, Subversion repositories. This helps to avoid
 monoculture and to escape the gravity of centralized version control by
 Github and/or Bitbucket. For further documentation, see chapter
 "Phabricator server administration" in the "system" manual. A notable
 example installation is https://isabelle-dev.sketis.net/.
 
 * The command-line tool "isabelle hg_setup" simplifies the setup of
 Mercurial repositories, with hosting via Phabricator or SSH file server
 access.
 
 * The command-line tool "isabelle imports" has been discontinued: strict
 checking of session directories enforces session-qualified theory names
 in applications -- users are responsible to specify session ROOT entries
 properly.
 
 * The command-line tool "isabelle dump" and its underlying
 Isabelle/Scala module isabelle.Dump has become more scalable, by
 splitting sessions and supporting a base logic image. Minor
 INCOMPATIBILITY in options and parameters.
 
 * The command-line tool "isabelle build_docker" has been slightly
 improved: it is now properly documented in the "system" manual.
 
 * Isabelle/Scala support for the Linux platform (Ubuntu): packages,
 users, system services.
 
 * Isabelle/Scala support for proof terms (with full type/term
 information) in module isabelle.Term.
 
 * Isabelle/Scala: more scalable output of YXML files, e.g. relevant for
 "isabelle dump".
 
 * Theory export via Isabelle/Scala has been reworked. The former "fact"
 name space is now split into individual "thm" items: names are
 potentially indexed, such as "foo" for singleton facts, or "bar(1)",
 "bar(2)", "bar(3)" for multi-facts. Theorem dependencies are now
 exported as well: this spans an overall dependency graph of internal
 inferences; it might help to reconstruct the formal structure of theory
 libraries. See also the module isabelle.Export_Theory in Isabelle/Scala.
 
 * Theory export of structured specifications, based on internal
 declarations of Spec_Rules by packages like 'definition', 'inductive',
 'primrec', 'function'.
 
 * Old settings variables ISABELLE_PLATFORM and ISABELLE_WINDOWS_PLATFORM
 have been discontinued -- deprecated since Isabelle2018.
 
 * More complete x86_64 platform support on macOS, notably Catalina where
 old x86 has been discontinued.
 
 * Update to GHC stack 2.1.3 with stackage lts-13.19/ghc-8.6.4.
 
 * Update to OCaml Opam 2.0.6 (using ocaml 4.05.0 as before).
 
 
 
 New in Isabelle2019 (June 2019)
 -------------------------------
 
 *** General ***
 
 * The font collection "Isabelle DejaVu" is systematically derived from
 the existing "DejaVu" fonts, with variants "Sans Mono", "Sans", "Serif"
 and styles "Normal", "Bold", "Italic/Oblique", "Bold-Italic/Oblique".
 The DejaVu base fonts are retricted to well-defined Unicode ranges and
 augmented by special Isabelle symbols, taken from the former
 "IsabelleText" font (which is no longer provided separately). The line
 metrics and overall rendering quality is closer to original DejaVu.
 INCOMPATIBILITY with display configuration expecting the old
 "IsabelleText" font: use e.g. "Isabelle DejaVu Sans Mono" instead.
 
 * The Isabelle fonts render "\<inverse>" properly as superscript "-1".
 
 * Old-style inner comments (* ... *) within the term language are no
 longer supported (legacy feature in Isabelle2018).
 
 * Old-style {* verbatim *} tokens are explicitly marked as legacy
 feature and will be removed soon. Use \<open>cartouche\<close> syntax instead, e.g.
 via "isabelle update_cartouches -t" (available since Isabelle2015).
 
 * Infix operators that begin or end with a "*" are now parenthesized
 without additional spaces, e.g. "(*)" instead of "( * )". Minor
 INCOMPATIBILITY.
 
 * Mixfix annotations may use cartouches instead of old-style double
 quotes, e.g. (infixl \<open>+\<close> 60). The command-line tool "isabelle update -u
 mixfix_cartouches" allows to update existing theory sources
 automatically.
 
 * ML setup commands (e.g. 'setup', 'method_setup', 'parse_translation')
 need to provide a closed expression -- without trailing semicolon. Minor
 INCOMPATIBILITY.
 
 * Commands 'generate_file', 'export_generated_files', and
 'compile_generated_files' support a stateless (PIDE-conformant) model
 for generated sources and compiled binaries of other languages. The
 compilation process is managed in Isabelle/ML, and results exported to
 the session database for further use (e.g. with "isabelle export" or
 "isabelle build -e").
 
 
 *** Isabelle/jEdit Prover IDE ***
 
 * Fonts for the text area, gutter, GUI elements etc. use the "Isabelle
 DejaVu" collection by default, which provides uniform rendering quality
 with the usual Isabelle symbols. Line spacing no longer needs to be
 adjusted: properties for the old IsabelleText font had "Global Options /
 Text Area / Extra vertical line spacing (in pixels): -2", it now
 defaults to 1, but 0 works as well.
 
 * The jEdit File Browser is more prominent in the default GUI layout of
 Isabelle/jEdit: various virtual file-systems provide access to Isabelle
 resources, notably via "favorites:" (or "Edit Favorites").
 
 * Further markup and rendering for "plain text" (e.g. informal prose)
 and "raw text" (e.g. verbatim sources). This improves the visual
 appearance of formal comments inside the term language, or in general
 for repeated alternation of formal and informal text.
 
 * Action "isabelle-export-browser" points the File Browser to the theory
 exports of the current buffer, based on the "isabelle-export:" virtual
 file-system. The directory view needs to be reloaded manually to follow
 ongoing document processing.
 
 * Action "isabelle-session-browser" points the File Browser to session
 information, based on the "isabelle-session:" virtual file-system. Its
 entries are structured according to chapter / session names, the open
 operation is redirected to the session ROOT file.
 
 * Support for user-defined file-formats via class isabelle.File_Format
 in Isabelle/Scala (e.g. see isabelle.Bibtex.File_Format), configured via
 the shell function "isabelle_file_format" in etc/settings (e.g. of an
 Isabelle component).
 
 * System option "jedit_text_overview" allows to disable the text
 overview column.
 
 * Command-line options "-s" and "-u" of "isabelle jedit" override the
 default for system option "system_heaps" that determines the heap
 storage directory for "isabelle build". Option "-n" is now clearly
 separated from option "-s".
 
 * The Isabelle/jEdit desktop application uses the same options as
 "isabelle jedit" for its internal "isabelle build" process: the implicit
 option "-o system_heaps" (or "-s") has been discontinued. This reduces
 the potential for surprise wrt. command-line tools.
 
 * The official download of the Isabelle/jEdit application already
 contains heap images for Isabelle/HOL within its main directory: thus
 the first encounter becomes faster and more robust (e.g. when run from a
 read-only directory).
 
 * Isabelle DejaVu fonts are available with hinting by default, which is
 relevant for low-resolution displays. This may be disabled via system
 option "isabelle_fonts_hinted = false" in
 $ISABELLE_HOME_USER/etc/preferences -- it occasionally yields better
 results.
 
 * OpenJDK 11 has quite different font rendering, with better glyph
 shapes and improved sub-pixel anti-aliasing. In some situations results
 might be *worse* than Oracle Java 8, though -- a proper HiDPI / UHD
 display is recommended.
 
 * OpenJDK 11 supports GTK version 2.2 and 3 (according to system
 property jdk.gtk.version). The factory default is version 3, but
 ISABELLE_JAVA_SYSTEM_OPTIONS includes "-Djdk.gtk.version=2.2" to make
 this more conservative (as in Java 8). Depending on the GTK theme
 configuration, "-Djdk.gtk.version=3" might work better or worse.
 
 
 *** Document preparation ***
 
 * More predefined symbols: \<interleave> \<sslash> (package "stmaryrd"), \<checkmark> \<crossmark> (package
 "pifont").
 
 * High-quality blackboard-bold symbols from font "txmia" (package
 "pxfonts"): \<bbbA>\<bool>\<complex>\<bbbD>\<bbbE>\<bbbF>\<bbbG>\<bbbH>\<bbbI>\<bbbJ>\<bbbK>\<bbbL>\<bbbM>\<nat>\<bbbO>\<bbbP>\<rat>\<real>\<bbbS>\<bbbT>\<bbbU>\<bbbV>\<bbbW>\<bbbX>\<bbbY>\<int>.
 
 * Document markers are formal comments of the form \<^marker>\<open>marker_body\<close> that
 are stripped from document output: the effect is to modify the semantic
 presentation context or to emit markup to the PIDE document. Some
 predefined markers are taken from the Dublin Core Metadata Initiative,
 e.g. \<^marker>\<open>contributor arg\<close> or \<^marker>\<open>license arg\<close> and produce PIDE markup that
 can be retrieved from the document database.
 
 * Old-style command tags %name are re-interpreted as markers with
 proof-scope \<^marker>\<open>tag (proof) name\<close> and produce LaTeX environments as
 before. Potential INCOMPATIBILITY: multiple markers are composed in
 canonical order, resulting in a reversed list of tags in the
 presentation context.
 
 * Marker \<^marker>\<open>tag name\<close> does not apply to the proof of a top-level goal
 statement by default (e.g. 'theorem', 'lemma'). This is a subtle change
 of semantics wrt. old-style %name.
 
 * In Isabelle/jEdit, the string "\tag" may be completed to a "\<^marker>\<open>tag \<close>"
 template.
 
 * Document antiquotation option "cartouche" indicates if the output
 should be delimited as cartouche; this takes precedence over the
 analogous option "quotes".
 
 * Many document antiquotations are internally categorized as "embedded"
 and expect one cartouche argument, which is typically used with the
 \<^control>\<open>cartouche\<close> notation (e.g. \<^term>\<open>\<lambda>x y. x\<close>). The cartouche
 delimiters are stripped in output of the source (antiquotation option
 "source"), but it is possible to enforce delimiters via option
 "source_cartouche", e.g. @{term [source_cartouche] \<open>\<lambda>x y. x\<close>}.
 
 
 *** Isar ***
 
 * Implicit cases goal1, goal2, goal3, etc. have been discontinued
 (legacy feature since Isabelle2016).
 
 * More robust treatment of structural errors: begin/end blocks take
 precedence over goal/proof. This is particularly relevant for the
 headless PIDE session and server.
 
 * Command keywords of kind thy_decl / thy_goal may be more specifically
 fit into the traditional document model of "definition-statement-proof"
 via thy_defn / thy_stmt / thy_goal_defn / thy_goal_stmt.
 
 
 *** HOL ***
 
 * Command 'export_code' produces output as logical files within the
 theory context, as well as formal session exports that can be
 materialized via command-line tools "isabelle export" or "isabelle build
 -e" (with 'export_files' in the session ROOT). Isabelle/jEdit also
 provides a virtual file-system "isabelle-export:" that can be explored
 in the regular file-browser. A 'file_prefix' argument allows to specify
 an explicit name prefix for the target file (SML, OCaml, Scala) or
 directory (Haskell); the default is "export" with a consecutive number
 within each theory.
 
 * Command 'export_code': the 'file' argument is now legacy and will be
 removed soon: writing to the physical file-system is not well-defined in
 a reactive/parallel application like Isabelle. The empty 'file' argument
 has been discontinued already: it is superseded by the file-browser in
 Isabelle/jEdit on "isabelle-export:". Minor INCOMPATIBILITY.
 
 * Command 'code_reflect' no longer supports the 'file' argument: it has
 been superseded by 'file_prefix' for stateless file management as in
 'export_code'. Minor INCOMPATIBILITY.
 
 * Code generation for OCaml: proper strings are used for literals.
 Minor INCOMPATIBILITY.
 
 * Code generation for OCaml: Zarith supersedes Nums as library for
 proper integer arithmetic. The library is located via standard
 invocations of "ocamlfind" (via ISABELLE_OCAMLFIND settings variable).
 The environment provided by "isabelle ocaml_setup" already contains this
 tool and the required packages. Minor INCOMPATIBILITY.
 
 * Code generation for Haskell: code includes for Haskell must contain
 proper module frame, nothing is added magically any longer.
 INCOMPATIBILITY.
 
 * Code generation: slightly more conventional syntax for 'code_stmts'
 antiquotation. Minor INCOMPATIBILITY.
 
 * Theory List: the precedence of the list_update operator has changed:
 "f a [n := x]" now needs to be written "(f a)[n := x]".
 
 * The functions \<Union>, \<Inter>, \<Squnion>, \<Sqinter> (not the corresponding binding operators)
 now have the same precedence as any other prefix function symbol. Minor
 INCOMPATIBILITY.
 
 * Simplified syntax setup for big operators under image. In rare
 situations, type conversions are not inserted implicitly any longer
 and need to be given explicitly. Auxiliary abbreviations INFIMUM,
 SUPREMUM, UNION, INTER should now rarely occur in output and are just
 retained as migration auxiliary. Abbreviations MINIMUM and MAXIMUM
 are gone INCOMPATIBILITY.
 
 * The simplifier uses image_cong_simp as a congruence rule. The historic
 and not really well-formed congruence rules INF_cong*, SUP_cong*, are
 not used by default any longer. INCOMPATIBILITY; consider using declare
 image_cong_simp [cong del] in extreme situations.
 
 * INF_image and SUP_image are no default simp rules any longer.
 INCOMPATIBILITY, prefer image_comp as simp rule if needed.
 
 * Strong congruence rules (with =simp=> in the premises) for constant f
 are now uniformly called f_cong_simp, in accordance with congruence
 rules produced for mappers by the datatype package. INCOMPATIBILITY.
 
 * Retired lemma card_Union_image; use the simpler card_UN_disjoint
 instead. INCOMPATIBILITY.
 
 * Facts sum_mset.commute and prod_mset.commute have been renamed to
 sum_mset.swap and prod_mset.swap, similarly to sum.swap and prod.swap.
 INCOMPATIBILITY.
 
 * ML structure Inductive: slightly more conventional naming schema.
 Minor INCOMPATIBILITY.
 
 * ML: Various _global variants of specification tools have been removed.
 Minor INCOMPATIBILITY, prefer combinators
 Named_Target.theory_map[_result] to lift specifications to the global
 theory level.
 
 * Theory HOL-Library.Simps_Case_Conv: 'case_of_simps' now supports
 overlapping and non-exhaustive patterns and handles arbitrarily nested
 patterns. It uses on the same algorithm as HOL-Library.Code_Lazy, which
 assumes sequential left-to-right pattern matching. The generated
 equation no longer tuples the arguments on the right-hand side.
 INCOMPATIBILITY.
 
 * Theory HOL-Library.Multiset: the \<Union># operator now has the same
 precedence as any other prefix function symbol.
 
 * Theory HOL-Library.Cardinal_Notations has been discontinued in favor
 of the bundle cardinal_syntax (available in theory Main). Minor
 INCOMPATIBILITY.
 
 * Session HOL-Library and HOL-Number_Theory: Exponentiation by squaring,
 used for computing powers in class "monoid_mult" and modular
 exponentiation.
 
 * Session HOL-Computational_Algebra: Formal Laurent series and overhaul
 of Formal power series.
 
 * Session HOL-Number_Theory: More material on residue rings in
 Carmichael's function, primitive roots, more properties for "ord".
 
 * Session HOL-Analysis: Better organization and much more material
 at the level of abstract topological spaces.
 
 * Session HOL-Algebra: Free abelian groups, etc., ported from HOL Light;
  algebraic closure of a field by de Vilhena and Baillon.
 
 * Session HOL-Homology has been added. It is a port of HOL Light's
 homology library, with new proofs of "invariance of domain" and related
 results.
 
 * Session HOL-SPARK: .prv files are no longer written to the
 file-system, but exported to the session database. Results may be
 retrieved via "isabelle build -e HOL-SPARK-Examples" on the
 command-line.
 
 * Sledgehammer:
   - The URL for SystemOnTPTP, which is used by remote provers, has been
     updated.
   - The machine-learning-based filter MaSh has been optimized to take
     less time (in most cases).
 
 * SMT: reconstruction is now possible using the SMT solver veriT.
 
 * Session HOL-Word:
   * New theory More_Word as comprehensive entrance point.
   * Merged type class bitss into type class bits.
   INCOMPATIBILITY.
 
 
 *** ML ***
 
 * Command 'generate_file' allows to produce sources for other languages,
 with antiquotations in the Isabelle context (only the control-cartouche
 form). The default "cartouche" antiquotation evaluates an ML expression
 of type string and inlines the result as a string literal of the target
 language. For example, this works for Haskell as follows:
 
   generate_file "Pure.hs" = \<open>
   module Isabelle.Pure where
     allConst, impConst, eqConst :: String
     allConst = \<open>\<^const_name>\<open>Pure.all\<close>\<close>
     impConst = \<open>\<^const_name>\<open>Pure.imp\<close>\<close>
     eqConst = \<open>\<^const_name>\<open>Pure.eq\<close>\<close>
   \<close>
 
 See also commands 'export_generated_files' and 'compile_generated_files'
 to use the results.
 
 * ML evaluation (notably via command 'ML' or 'ML_file') is subject to
 option ML_environment to select a named environment, such as "Isabelle"
 for Isabelle/ML, or "SML" for official Standard ML.
 
 * ML antiquotation @{master_dir} refers to the master directory of the
 underlying theory, i.e. the directory of the theory file.
 
 * ML antiquotation @{verbatim} inlines its argument as string literal,
 preserving newlines literally. The short form \<^verbatim>\<open>abc\<close> is particularly
 useful.
 
 * Local_Theory.reset is no longer available in user space. Regular
 definitional packages should use balanced blocks of
 Local_Theory.open_target versus Local_Theory.close_target instead, or
 the Local_Theory.subtarget(_result) combinator. Rare INCOMPATIBILITY.
 
 * Original PolyML.pointerEq is retained as a convenience for tools that
 don't use Isabelle/ML (where this is called "pointer_eq").
 
 
 *** System ***
 
 * Update to OpenJDK 11: the current long-term support version of Java.
 
 * Update to Poly/ML 5.8 allows to use the native x86_64 platform without
 the full overhead of 64-bit values everywhere. This special x86_64_32
 mode provides up to 16GB ML heap, while program code and stacks are
 allocated elsewhere. Thus approx. 5 times more memory is available for
 applications compared to old x86 mode (which is no longer used by
 Isabelle). The switch to the x86_64 CPU architecture also avoids
 compatibility problems with Linux and macOS, where 32-bit applications
 are gradually phased out.
 
 * System option "checkpoint" has been discontinued: obsolete thanks to
 improved memory management in Poly/ML.
 
 * System option "system_heaps" determines where to store the session
 image of "isabelle build" (and other tools using that internally).
 Former option "-s" is superseded by option "-o system_heaps".
 INCOMPATIBILITY in command-line syntax.
 
 * Session directory $ISABELLE_HOME/src/Tools/Haskell provides some
 source modules for Isabelle tools implemented in Haskell, notably for
 Isabelle/PIDE.
 
 * The command-line tool "isabelle build -e" retrieves theory exports
 from the session build database, using 'export_files' in session ROOT
 entries.
 
 * The command-line tool "isabelle update" uses Isabelle/PIDE in
 batch-mode to update theory sources based on semantic markup produced in
 Isabelle/ML. Actual updates depend on system options that may be enabled
 via "-u OPT" (for "update_OPT"), see also $ISABELLE_HOME/etc/options
 section "Theory update". Theory sessions are specified as in "isabelle
 dump".
 
 * The command-line tool "isabelle update -u control_cartouches" changes
 antiquotations into control-symbol format (where possible): @{NAME}
 becomes \<^NAME> and @{NAME ARG} becomes \<^NAME>\<open>ARG\<close>.
 
 * Support for Isabelle command-line tools defined in Isabelle/Scala.
 Instances of class Isabelle_Scala_Tools may be configured via the shell
 function "isabelle_scala_tools" in etc/settings (e.g. of an Isabelle
 component).
 
 * Isabelle Server command "use_theories" supports "nodes_status_delay"
 for continuous output of node status information. The time interval is
 specified in seconds; a negative value means it is disabled (default).
 
 * Isabelle Server command "use_theories" terminates more robustly in the
 presence of structurally broken sources: full consolidation of theories
 is no longer required.
 
 * OCaml tools and libraries are now accesed via ISABELLE_OCAMLFIND,
 which needs to point to a suitable version of "ocamlfind" (e.g. via
 OPAM, see below). INCOMPATIBILITY: settings variables ISABELLE_OCAML and
 ISABELLE_OCAMLC are no longer supported.
 
 * Support for managed installations of Glasgow Haskell Compiler and
 OCaml via the following command-line tools:
 
   isabelle ghc_setup
   isabelle ghc_stack
 
   isabelle ocaml_setup
   isabelle ocaml_opam
 
 The global installation state is determined by the following settings
 (and corresponding directory contents):
 
   ISABELLE_STACK_ROOT
   ISABELLE_STACK_RESOLVER
   ISABELLE_GHC_VERSION
 
   ISABELLE_OPAM_ROOT
   ISABELLE_OCAML_VERSION
 
 After setup, the following Isabelle settings are automatically
 redirected (overriding existing user settings):
 
   ISABELLE_GHC
 
   ISABELLE_OCAMLFIND
 
 The old meaning of these settings as locally installed executables may
 be recovered by purging the directories ISABELLE_STACK_ROOT /
 ISABELLE_OPAM_ROOT, or by resetting these variables in
 $ISABELLE_HOME_USER/etc/settings.
 
 
 
 New in Isabelle2018 (August 2018)
 ---------------------------------
 
 *** General ***
 
 * Session-qualified theory names are mandatory: it is no longer possible
 to refer to unqualified theories from the parent session.
 INCOMPATIBILITY for old developments that have not been updated to
 Isabelle2017 yet (using the "isabelle imports" tool).
 
 * Only the most fundamental theory names are global, usually the entry
 points to major logic sessions: Pure, Main, Complex_Main, HOLCF, IFOL,
 FOL, ZF, ZFC etc. INCOMPATIBILITY, need to use qualified names for
 formerly global "HOL-Probability.Probability" and "HOL-SPARK.SPARK".
 
 * Global facts need to be closed: no free variables and no hypotheses.
 Rare INCOMPATIBILITY.
 
 * Facts stemming from locale interpretation are subject to lazy
 evaluation for improved performance. Rare INCOMPATIBILITY: errors
 stemming from interpretation morphisms might be deferred and thus
 difficult to locate; enable system option "strict_facts" temporarily to
 avoid this.
 
 * Marginal comments need to be written exclusively in the new-style form
 "\<comment> \<open>text\<close>", old ASCII variants like "-- {* ... *}" are no longer
 supported. INCOMPATIBILITY, use the command-line tool "isabelle
 update_comments" to update existing theory files.
 
 * Old-style inner comments (* ... *) within the term language are legacy
 and will be discontinued soon: use formal comments "\<comment> \<open>...\<close>" or "\<^cancel>\<open>...\<close>"
 instead.
 
 * The "op <infix-op>" syntax for infix operators has been replaced by
 "(<infix-op>)". If <infix-op> begins or ends with a "*", there needs to
 be a space between the "*" and the corresponding parenthesis.
 INCOMPATIBILITY, use the command-line tool "isabelle update_op" to
 convert theory and ML files to the new syntax. Because it is based on
 regular expression matching, the result may need a bit of manual
 postprocessing. Invoking "isabelle update_op" converts all files in the
 current directory (recursively). In case you want to exclude conversion
 of ML files (because the tool frequently also converts ML's "op"
 syntax), use option "-m".
 
 * Theory header 'abbrevs' specifications need to be separated by 'and'.
 INCOMPATIBILITY.
 
 * Command 'external_file' declares the formal dependency on the given
 file name, such that the Isabelle build process knows about it, but
 without specific Prover IDE management.
 
 * Session ROOT entries no longer allow specification of 'files'. Rare
 INCOMPATIBILITY, use command 'external_file' within a proper theory
 context.
 
 * Session root directories may be specified multiple times: each
 accessible ROOT file is processed only once. This facilitates
 specification of $ISABELLE_HOME_USER/ROOTS or command-line options like
 -d or -D for "isabelle build" and "isabelle jedit". Example:
 
   isabelle build -D '~~/src/ZF'
 
 * The command 'display_drafts' has been discontinued. INCOMPATIBILITY,
 use action "isabelle.draft" (or "print") in Isabelle/jEdit instead.
 
 * In HTML output, the Isabelle symbol "\<hyphen>" is rendered as explicit
 Unicode hyphen U+2010, to avoid unclear meaning of the old "soft hyphen"
 U+00AD. Rare INCOMPATIBILITY, e.g. copy-paste of historic Isabelle HTML
 output.
 
 
 *** Isabelle/jEdit Prover IDE ***
 
 * The command-line tool "isabelle jedit" provides more flexible options
 for session management:
 
   - option -R builds an auxiliary logic image with all theories from
     other sessions that are not already present in its parent
 
   - option -S is like -R, with a focus on the selected session and its
     descendants (this reduces startup time for big projects like AFP)
 
   - option -A specifies an alternative ancestor session for options -R
     and -S
 
   - option -i includes additional sessions into the name-space of
     theories
 
   Examples:
     isabelle jedit -R HOL-Number_Theory
     isabelle jedit -R HOL-Number_Theory -A HOL
     isabelle jedit -d '$AFP' -S Formal_SSA -A HOL
     isabelle jedit -d '$AFP' -S Formal_SSA -A HOL-Analysis
     isabelle jedit -d '$AFP' -S Formal_SSA -A HOL-Analysis -i CryptHOL
 
 * PIDE markup for session ROOT files: allows to complete session names,
 follow links to theories and document files etc.
 
 * Completion supports theory header imports, using theory base name.
 E.g. "Prob" may be completed to "HOL-Probability.Probability".
 
 * Named control symbols (without special Unicode rendering) are shown as
 bold-italic keyword. This is particularly useful for the short form of
 antiquotations with control symbol: \<^name>\<open>argument\<close>. The action
 "isabelle.antiquoted_cartouche" turns an antiquotation with 0 or 1
 arguments into this format.
 
 * Completion provides templates for named symbols with arguments,
 e.g. "\<comment> \<open>ARGUMENT\<close>" or "\<^emph>\<open>ARGUMENT\<close>".
 
 * Slightly more parallel checking, notably for high priority print
 functions (e.g. State output).
 
 * The view title is set dynamically, according to the Isabelle
 distribution and the logic session name. The user can override this via
 set-view-title (stored persistently in $JEDIT_SETTINGS/perspective.xml).
 
 * System options "spell_checker_include" and "spell_checker_exclude"
 supersede former "spell_checker_elements" to determine regions of text
 that are subject to spell-checking. Minor INCOMPATIBILITY.
 
 * Action "isabelle.preview" is able to present more file formats,
 notably bibtex database files and ML files.
 
 * Action "isabelle.draft" is similar to "isabelle.preview", but shows a
 plain-text document draft. Both are available via the menu "Plugins /
 Isabelle".
 
 * When loading text files, the Isabelle symbols encoding UTF-8-Isabelle
 is only used if there is no conflict with existing Unicode sequences in
 the file. Otherwise, the fallback encoding is plain UTF-8 and Isabelle
 symbols remain in literal \<symbol> form. This avoids accidental loss of
 Unicode content when saving the file.
 
 * Bibtex database files (.bib) are semantically checked.
 
 * Update to jedit-5.5.0, the latest release.
 
 
 *** Isabelle/VSCode Prover IDE ***
 
 * HTML preview of theories and other file-formats similar to
 Isabelle/jEdit.
 
 * Command-line tool "isabelle vscode_server" accepts the same options
 -A, -R, -S, -i for session selection as "isabelle jedit". This is
 relevant for isabelle.args configuration settings in VSCode. The former
 option -A (explore all known session files) has been discontinued: it is
 enabled by default, unless option -S is used to focus on a particular
 spot in the session structure. INCOMPATIBILITY.
 
 
 *** Document preparation ***
 
 * Formal comments work uniformly in outer syntax, inner syntax (term
 language), Isabelle/ML and some other embedded languages of Isabelle.
 See also "Document comments" in the isar-ref manual. The following forms
 are supported:
 
   - marginal text comment: \<comment> \<open>\<dots>\<close>
   - canceled source: \<^cancel>\<open>\<dots>\<close>
   - raw LaTeX: \<^latex>\<open>\<dots>\<close>
 
 * Outside of the inner theory body, the default presentation context is
 theory Pure. Thus elementary antiquotations may be used in markup
 commands (e.g. 'chapter', 'section', 'text') and formal comments.
 
 * System option "document_tags" specifies alternative command tags. This
 is occasionally useful to control the global visibility of commands via
 session options (e.g. in ROOT).
 
 * Document markup commands ('section', 'text' etc.) are implicitly
 tagged as "document" and visible by default. This avoids the application
 of option "document_tags" to these commands.
 
 * Isabelle names are mangled into LaTeX macro names to allow the full
 identifier syntax with underscore, prime, digits. This is relevant for
 antiquotations in control symbol notation, e.g. \<^const_name> becomes
 \isactrlconstUNDERSCOREname.
 
 * Document preparation with skip_proofs option now preserves the content
 more accurately: only terminal proof steps ('by' etc.) are skipped.
 
 * Document antiquotation @{theory name} requires the long
 session-qualified theory name: this is what users reading the text
 normally need to import.
 
 * Document antiquotation @{session name} checks and prints the given
 session name verbatim.
 
 * Document antiquotation @{cite} now checks the given Bibtex entries
 against the Bibtex database files -- only in batch-mode session builds.
 
 * Command-line tool "isabelle document" has been re-implemented in
 Isabelle/Scala, with simplified arguments and explicit errors from the
 latex and bibtex process. Minor INCOMPATIBILITY.
 
 * Session ROOT entry: empty 'document_files' means there is no document
 for this session. There is no need to specify options [document = false]
 anymore.
 
 
 *** Isar ***
 
 * Command 'interpret' no longer exposes resulting theorems as literal
 facts, notably for the \<open>prop\<close> notation or the "fact" proof method. This
 improves modularity of proofs and scalability of locale interpretation.
 Rare INCOMPATIBILITY, need to refer to explicitly named facts instead
 (e.g. use 'find_theorems' or 'try' to figure this out).
 
 * The old 'def' command has been discontinued (legacy since
 Isbelle2016-1). INCOMPATIBILITY, use 'define' instead -- usually with
 object-logic equality or equivalence.
 
 
 *** Pure ***
 
 * The inner syntax category "sort" now includes notation "_" for the
 dummy sort: it is effectively ignored in type-inference.
 
 * Rewrites clauses (keyword 'rewrites') were moved into the locale
 expression syntax, where they are part of locale instances. In
 interpretation commands rewrites clauses now need to occur before 'for'
 and 'defines'. Rare INCOMPATIBILITY; definitions immediately subject to
 rewriting may need to be pulled up into the surrounding theory.
 
 * For 'rewrites' clauses, if activating a locale instance fails, fall
 back to reading the clause first. This helps avoid qualification of
 locale instances where the qualifier's sole purpose is avoiding
 duplicate constant declarations.
 
 * Proof method "simp" now supports a new modifier "flip:" followed by a
 list of theorems. Each of these theorems is removed from the simpset
 (without warning if it is not there) and the symmetric version of the
 theorem (i.e. lhs and rhs exchanged) is added to the simpset. For "auto"
 and friends the modifier is "simp flip:".
 
 
 *** HOL ***
 
 * Sledgehammer: bundled version of "vampire" (for non-commercial users)
 helps to avoid fragility of "remote_vampire" service.
 
 * Clarified relationship of characters, strings and code generation:
 
   - Type "char" is now a proper datatype of 8-bit values.
 
   - Conversions "nat_of_char" and "char_of_nat" are gone; use more
     general conversions "of_char" and "char_of" with suitable type
     constraints instead.
 
   - The zero character is just written "CHR 0x00", not "0" any longer.
 
   - Type "String.literal" (for code generation) is now isomorphic to
     lists of 7-bit (ASCII) values; concrete values can be written as
     "STR ''...''" for sequences of printable characters and "STR 0x..."
     for one single ASCII code point given as hexadecimal numeral.
 
   - Type "String.literal" supports concatenation "... + ..." for all
     standard target languages.
 
   - Theory HOL-Library.Code_Char is gone; study the explanations
     concerning "String.literal" in the tutorial on code generation to
     get an idea how target-language string literals can be converted to
     HOL string values and vice versa.
 
   - Session Imperative-HOL: operation "raise" directly takes a value of
     type "String.literal" as argument, not type "string".
 
 INCOMPATIBILITY.
 
 * Code generation: Code generation takes an explicit option
 "case_insensitive" to accomodate case-insensitive file systems.
 
 * Abstract bit operations as part of Main: push_bit, take_bit, drop_bit.
 
 * New, more general, axiomatization of complete_distrib_lattice. The
 former axioms:
 
   "sup x (Inf X) = Inf (sup x ` X)" and "inf x (Sup X) = Sup (inf x ` X)"
 
 are replaced by:
 
   "Inf (Sup ` A) <= Sup (Inf ` {f ` A | f . (! Y \<in> A . f Y \<in> Y)})"
 
 The instantiations of sets and functions as complete_distrib_lattice are
 moved to Hilbert_Choice.thy because their proofs need the Hilbert choice
 operator. The dual of this property is also proved in theory
 HOL.Hilbert_Choice.
 
 * New syntax for the minimum/maximum of a function over a finite set:
 MIN x\<in>A. B and even MIN x. B (only useful for finite types), also MAX.
 
 * Clarifed theorem names:
 
   Min.antimono ~> Min.subset_imp
   Max.antimono ~> Max.subset_imp
 
 Minor INCOMPATIBILITY.
 
 * SMT module:
 
   - The 'smt_oracle' option is now necessary when using the 'smt' method
     with a solver other than Z3. INCOMPATIBILITY.
 
   - The encoding to first-order logic is now more complete in the
     presence of higher-order quantifiers. An 'smt_explicit_application'
     option has been added to control this. INCOMPATIBILITY.
 
 * Facts sum.commute(_restrict) and prod.commute(_restrict) renamed to
 sum.swap(_restrict) and prod.swap(_restrict), to avoid name clashes on
 interpretation of abstract locales. INCOMPATIBILITY.
 
 * Predicate coprime is now a real definition, not a mere abbreviation.
 INCOMPATIBILITY.
 
 * Predicate pairwise_coprime abolished, use "pairwise coprime" instead.
 INCOMPATIBILITY.
 
 * The relator rel_filter on filters has been strengthened to its
 canonical categorical definition with better properties.
 INCOMPATIBILITY.
 
 * Generalized linear algebra involving linear, span, dependent, dim
 from type class real_vector to locales module and vector_space.
 Renamed:
 
   span_inc ~> span_superset
   span_superset ~> span_base
   span_eq ~> span_eq_iff
 
 INCOMPATIBILITY.
 
 * Class linordered_semiring_1 covers zero_less_one also, ruling out
 pathologic instances. Minor INCOMPATIBILITY.
 
 * Theory HOL.List: functions "sorted_wrt" and "sorted" now compare every
 element in a list to all following elements, not just the next one.
 
 * Theory HOL.List syntax:
 
   - filter-syntax "[x <- xs. P]" is no longer output syntax, but only
     input syntax
 
   - list comprehension syntax now supports tuple patterns in "pat <- xs"
 
 * Theory Map: "empty" must now be qualified as "Map.empty".
 
 * Removed nat-int transfer machinery. Rare INCOMPATIBILITY.
 
 * Fact mod_mult_self4 (on nat) renamed to Suc_mod_mult_self3, to avoid
 clash with fact mod_mult_self4 (on more generic semirings).
 INCOMPATIBILITY.
 
 * Eliminated some theorem aliasses:
   even_times_iff ~> even_mult_iff
   mod_2_not_eq_zero_eq_one_nat ~> not_mod_2_eq_0_eq_1
   even_of_nat ~> even_int_iff
 
 INCOMPATIBILITY.
 
 * Eliminated some theorem duplicate variations:
 
   - dvd_eq_mod_eq_0_numeral can be replaced by dvd_eq_mod_eq_0
   - mod_Suc_eq_Suc_mod can be replaced by mod_Suc
   - mod_Suc_eq_Suc_mod [symmetrict] can be replaced by mod_simps
   - mod_eq_0_iff can be replaced by mod_eq_0_iff_dvd and dvd_def
   - the witness of mod_eqD can be given directly as "_ div _"
 
 INCOMPATIBILITY.
 
 * Classical setup: Assumption "m mod d = 0" (for m d :: nat) is no
 longer aggresively destroyed to "\<exists>q. m = d * q". INCOMPATIBILITY, adding
 "elim!: dvd" to classical proof methods in most situations restores
 broken proofs.
 
 * Theory HOL-Library.Conditional_Parametricity provides command
 'parametric_constant' for proving parametricity of non-recursive
 definitions. For constants that are not fully parametric the command
 will infer conditions on relations (e.g., bi_unique, bi_total, or type
 class conditions such as "respects 0") sufficient for parametricity. See
 theory HOL-ex.Conditional_Parametricity_Examples for some examples.
 
 * Theory HOL-Library.Code_Lazy provides a new preprocessor for the code
 generator to generate code for algebraic types with lazy evaluation
 semantics even in call-by-value target languages. See the theories
 HOL-ex.Code_Lazy_Demo and HOL-Codegenerator_Test.Code_Lazy_Test for some
 examples.
 
 * Theory HOL-Library.Landau_Symbols has been moved here from AFP.
 
 * Theory HOL-Library.Old_Datatype no longer provides the legacy command
 'old_datatype'. INCOMPATIBILITY.
 
 * Theory HOL-Computational_Algebra.Polynomial_Factorial does not provide
 instances of rat, real, complex as factorial rings etc. Import
 HOL-Computational_Algebra.Field_as_Ring explicitly in case of need.
 INCOMPATIBILITY.
 
 * Session HOL-Algebra: renamed (^) to [^] to avoid conflict with new
 infix/prefix notation.
 
 * Session HOL-Algebra: revamped with much new material. The set of
 isomorphisms between two groups is now denoted iso rather than iso_set.
 INCOMPATIBILITY.
 
 * Session HOL-Analysis: the Arg function now respects the same interval
 as Ln, namely (-pi,pi]; the old Arg function has been renamed Arg2pi.
 INCOMPATIBILITY.
 
 * Session HOL-Analysis: the functions zorder, zer_poly, porder and
 pol_poly have been redefined. All related lemmas have been reworked.
 INCOMPATIBILITY.
 
 * Session HOL-Analysis: infinite products, Moebius functions, the
 Riemann mapping theorem, the Vitali covering theorem,
 change-of-variables results for integration and measures.
 
 * Session HOL-Real_Asymp: proof method "real_asymp" proves asymptotics
 or real-valued functions (limits, "Big-O", etc.) automatically.
 See also ~~/src/HOL/Real_Asymp/Manual for some documentation.
 
 * Session HOL-Types_To_Sets: more tool support (unoverload_type combines
 internalize_sorts and unoverload) and larger experimental application
 (type based linear algebra transferred to linear algebra on subspaces).
 
 
 *** ML ***
 
 * Operation Export.export emits theory exports (arbitrary blobs), which
 are stored persistently in the session build database.
 
 * Command 'ML_export' exports ML toplevel bindings to the global
 bootstrap environment of the ML process. This allows ML evaluation
 without a formal theory context, e.g. in command-line tools like
 "isabelle process".
 
 
 *** System ***
 
 * Mac OS X 10.10 Yosemite is now the baseline version; Mavericks is no
 longer supported.
 
 * Linux and Windows/Cygwin is for x86_64 only, old 32bit platform
 support has been discontinued.
 
 * Java runtime is for x86_64 only. Corresponding Isabelle settings have
 been renamed to ISABELLE_TOOL_JAVA_OPTIONS and JEDIT_JAVA_OPTIONS,
 instead of former 32/64 variants. INCOMPATIBILITY.
 
 * Old settings ISABELLE_PLATFORM and ISABELLE_WINDOWS_PLATFORM should be
 phased out due to unclear preference of 32bit vs. 64bit architecture.
 Explicit GNU bash expressions are now preferred, for example (with
 quotes):
 
   #Posix executables (Unix or Cygwin), with preference for 64bit
   "${ISABELLE_PLATFORM64:-$ISABELLE_PLATFORM32}"
 
   #native Windows or Unix executables, with preference for 64bit
   "${ISABELLE_WINDOWS_PLATFORM64:-${ISABELLE_WINDOWS_PLATFORM32:-${ISABELLE_PLATFORM64:-$ISABELLE_PLATFORM32}}}"
 
   #native Windows (32bit) or Unix executables (preference for 64bit)
   "${ISABELLE_WINDOWS_PLATFORM32:-${ISABELLE_PLATFORM64:-$ISABELLE_PLATFORM32}}"
 
 * Command-line tool "isabelle build" supports new options:
   - option -B NAME: include session NAME and all descendants
   - option -S: only observe changes of sources, not heap images
   - option -f: forces a fresh build
 
 * Command-line tool "isabelle build" options -c -x -B refer to
 descendants wrt. the session parent or import graph. Subtle
 INCOMPATIBILITY: options -c -x used to refer to the session parent graph
 only.
 
 * Command-line tool "isabelle build" takes "condition" options with the
 corresponding environment values into account, when determining the
 up-to-date status of a session.
 
 * The command-line tool "dump" dumps information from the cumulative
 PIDE session database: many sessions may be loaded into a given logic
 image, results from all loaded theories are written to the output
 directory.
 
 * Command-line tool "isabelle imports -I" also reports actual session
 imports. This helps to minimize the session dependency graph.
 
 * The command-line tool "export" and 'export_files' in session ROOT
 entries retrieve theory exports from the session build database.
 
 * The command-line tools "isabelle server" and "isabelle client" provide
 access to the Isabelle Server: it supports responsive session management
 and concurrent use of theories, based on Isabelle/PIDE infrastructure.
 See also the "system" manual.
 
 * The command-line tool "isabelle update_comments" normalizes formal
 comments in outer syntax as follows: \<comment> \<open>text\<close> (whith a single space to
 approximate the appearance in document output). This is more specific
 than former "isabelle update_cartouches -c": the latter tool option has
 been discontinued.
 
 * The command-line tool "isabelle mkroot" now always produces a document
 outline: its options have been adapted accordingly. INCOMPATIBILITY.
 
 * The command-line tool "isabelle mkroot -I" initializes a Mercurial
 repository for the generated session files.
 
 * Settings ISABELLE_HEAPS + ISABELLE_BROWSER_INFO (or
 ISABELLE_HEAPS_SYSTEM + ISABELLE_BROWSER_INFO_SYSTEM in "system build
 mode") determine the directory locations of the main build artefacts --
 instead of hard-wired directories in ISABELLE_HOME_USER (or
 ISABELLE_HOME).
 
 * Settings ISABELLE_PATH and ISABELLE_OUTPUT have been discontinued:
 heap images and session databases are always stored in
 $ISABELLE_HEAPS/$ML_IDENTIFIER (command-line default) or
 $ISABELLE_HEAPS_SYSTEM/$ML_IDENTIFIER (main Isabelle application or
 "isabelle jedit -s" or "isabelle build -s").
 
 * ISABELLE_LATEX and ISABELLE_PDFLATEX now include platform-specific
 options for improved error reporting. Potential INCOMPATIBILITY with
 unusual LaTeX installations, may have to adapt these settings.
 
 * Update to Poly/ML 5.7.1 with slightly improved performance and PIDE
 markup for identifier bindings. It now uses The GNU Multiple Precision
 Arithmetic Library (libgmp) on all platforms, notably Mac OS X with
 32/64 bit.
 
 
 
 New in Isabelle2017 (October 2017)
 ----------------------------------
 
 *** General ***
 
 * Experimental support for Visual Studio Code (VSCode) as alternative
 Isabelle/PIDE front-end, see also
 https://marketplace.visualstudio.com/items?itemName=makarius.Isabelle2017
 
 VSCode is a new type of application that continues the concepts of
 "programmer's editor" and "integrated development environment" towards
 fully semantic editing and debugging -- in a relatively light-weight
 manner. Thus it fits nicely on top of the Isabelle/PIDE infrastructure.
 Technically, VSCode is based on the Electron application framework
 (Node.js + Chromium browser + V8), which is implemented in JavaScript
 and TypeScript, while Isabelle/VSCode mainly consists of Isabelle/Scala
 modules around a Language Server implementation.
 
 * Theory names are qualified by the session name that they belong to.
 This affects imports, but not the theory name space prefix (which is
 just the theory base name as before).
 
 In order to import theories from other sessions, the ROOT file format
 provides a new 'sessions' keyword. In contrast, a theory that is
 imported in the old-fashioned manner via an explicit file-system path
 belongs to the current session, and might cause theory name conflicts
 later on. Theories that are imported from other sessions are excluded
 from the current session document. The command-line tool "isabelle
 imports" helps to update theory imports.
 
 * The main theory entry points for some non-HOL sessions have changed,
 to avoid confusion with the global name "Main" of the session HOL. This
 leads to the follow renamings:
 
   CTT/Main.thy    ~>  CTT/CTT.thy
   ZF/Main.thy     ~>  ZF/ZF.thy
   ZF/Main_ZF.thy  ~>  ZF/ZF.thy
   ZF/Main_ZFC.thy ~>  ZF/ZFC.thy
   ZF/ZF.thy       ~>  ZF/ZF_Base.thy
 
 INCOMPATIBILITY.
 
 * Commands 'alias' and 'type_alias' introduce aliases for constants and
 type constructors, respectively. This allows adhoc changes to name-space
 accesses within global or local theory contexts, e.g. within a 'bundle'.
 
 * Document antiquotations @{prf} and @{full_prf} output proof terms
 (again) in the same way as commands 'prf' and 'full_prf'.
 
 * Computations generated by the code generator can be embedded directly
 into ML, alongside with @{code} antiquotations, using the following
 antiquotations:
 
   @{computation ... terms: ... datatypes: ...} :
     ((term -> term) -> 'ml option -> 'a) -> Proof.context -> term -> 'a
   @{computation_conv ... terms: ... datatypes: ...} :
     (Proof.context -> 'ml -> conv) -> Proof.context -> conv
   @{computation_check terms: ... datatypes: ...} : Proof.context -> conv
 
 See src/HOL/ex/Computations.thy,
 src/HOL/Decision_Procs/Commutative_Ring.thy and
 src/HOL/Decision_Procs/Reflective_Field.thy for examples and the
 tutorial on code generation.
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * Session-qualified theory imports allow the Prover IDE to process
 arbitrary theory hierarchies independently of the underlying logic
 session image (e.g. option "isabelle jedit -l"), but the directory
 structure needs to be known in advance (e.g. option "isabelle jedit -d"
 or a line in the file $ISABELLE_HOME_USER/ROOTS).
 
 * The PIDE document model maintains file content independently of the
 status of jEdit editor buffers. Reloading jEdit buffers no longer causes
 changes of formal document content. Theory dependencies are always
 resolved internally, without the need for corresponding editor buffers.
 The system option "jedit_auto_load" has been discontinued: it is
 effectively always enabled.
 
 * The Theories dockable provides a "Purge" button, in order to restrict
 the document model to theories that are required for open editor
 buffers.
 
 * The Theories dockable indicates the overall status of checking of each
 entry. When all forked tasks of a theory are finished, the border is
 painted with thick lines; remaining errors in this situation are
 represented by a different border color.
 
 * Automatic indentation is more careful to avoid redundant spaces in
 intermediate situations. Keywords are indented after input (via typed
 characters or completion); see also option "jedit_indent_input".
 
 * Action "isabelle.preview" opens an HTML preview of the current theory
 document in the default web browser.
 
 * Command-line invocation "isabelle jedit -R -l LOGIC" opens the ROOT
 entry of the specified logic session in the editor, while its parent is
 used for formal checking.
 
 * The main Isabelle/jEdit plugin may be restarted manually (using the
 jEdit Plugin Manager), as long as the "Isabelle Base" plugin remains
 enabled at all times.
 
 * Update to current jedit-5.4.0.
 
 
 *** Pure ***
 
 * Deleting the last code equations for a particular function using
 [code del] results in function with no equations (runtime abort) rather
 than an unimplemented function (generation time abort). Use explicit
 [[code drop:]] to enforce the latter. Minor INCOMPATIBILITY.
 
 * Proper concept of code declarations in code.ML:
   - Regular code declarations act only on the global theory level, being
     ignored with warnings if syntactically malformed.
   - Explicitly global code declarations yield errors if syntactically
     malformed.
   - Default code declarations are silently ignored if syntactically
     malformed.
 Minor INCOMPATIBILITY.
 
 * Clarified and standardized internal data bookkeeping of code
 declarations: history of serials allows to track potentially
 non-monotonous declarations appropriately. Minor INCOMPATIBILITY.
 
 
 *** HOL ***
 
 * The Nunchaku model finder is now part of "Main".
 
 * SMT module:
   - A new option, 'smt_nat_as_int', has been added to translate 'nat' to
     'int' and benefit from the SMT solver's theory reasoning. It is
     disabled by default.
   - The legacy module "src/HOL/Library/Old_SMT.thy" has been removed.
   - Several small issues have been rectified in the 'smt' command.
 
 * (Co)datatype package: The 'size_gen_o_map' lemma is no longer
 generated for datatypes with type class annotations. As a result, the
 tactic that derives it no longer fails on nested datatypes. Slight
 INCOMPATIBILITY.
 
 * Command and antiquotation "value" with modified default strategy:
 terms without free variables are always evaluated using plain evaluation
 only, with no fallback on normalization by evaluation. Minor
 INCOMPATIBILITY.
 
 * Theories "GCD" and "Binomial" are already included in "Main" (instead
 of "Complex_Main").
 
 * Constant "surj" is a full input/output abbreviation (again).
 Minor INCOMPATIBILITY.
 
 * Dropped aliasses RangeP, DomainP for Rangep, Domainp respectively.
 INCOMPATIBILITY.
 
 * Renamed ii to imaginary_unit in order to free up ii as a variable
 name. The syntax \<i> remains available. INCOMPATIBILITY.
 
 * Dropped abbreviations transP, antisymP, single_valuedP; use constants
 transp, antisymp, single_valuedp instead. INCOMPATIBILITY.
 
 * Constant "subseq" in Topological_Spaces has been removed -- it is
 subsumed by "strict_mono". Some basic lemmas specific to "subseq" have
 been renamed accordingly, e.g. "subseq_o" -> "strict_mono_o" etc.
 
 * Theory List: "sublist" renamed to "nths" in analogy with "nth", and
 "sublisteq" renamed to "subseq". Minor INCOMPATIBILITY.
 
 * Theory List: new generic function "sorted_wrt".
 
 * Named theorems mod_simps covers various congruence rules concerning
 mod, replacing former zmod_simps. INCOMPATIBILITY.
 
 * Swapped orientation of congruence rules mod_add_left_eq,
 mod_add_right_eq, mod_add_eq, mod_mult_left_eq, mod_mult_right_eq,
 mod_mult_eq, mod_minus_eq, mod_diff_left_eq, mod_diff_right_eq,
 mod_diff_eq. INCOMPATIBILITY.
 
 * Generalized some facts:
     measure_induct_rule
     measure_induct
     zminus_zmod ~> mod_minus_eq
     zdiff_zmod_left ~> mod_diff_left_eq
     zdiff_zmod_right ~> mod_diff_right_eq
     zmod_eq_dvd_iff ~> mod_eq_dvd_iff
 INCOMPATIBILITY.
 
 * Algebraic type class hierarchy of euclidean (semi)rings in HOL:
 euclidean_(semi)ring, euclidean_(semi)ring_cancel,
 unique_euclidean_(semi)ring; instantiation requires provision of a
 euclidean size.
 
 * Theory "HOL-Number_Theory.Euclidean_Algorithm" has been reworked:
   - Euclidean induction is available as rule eucl_induct.
   - Constants Euclidean_Algorithm.gcd, Euclidean_Algorithm.lcm,
     Euclidean_Algorithm.Gcd and Euclidean_Algorithm.Lcm allow
     easy instantiation of euclidean (semi)rings as GCD (semi)rings.
   - Coefficients obtained by extended euclidean algorithm are
     available as "bezout_coefficients".
 INCOMPATIBILITY.
 
 * Theory "Number_Theory.Totient" introduces basic notions about Euler's
 totient function previously hidden as solitary example in theory
 Residues. Definition changed so that "totient 1 = 1" in agreement with
 the literature. Minor INCOMPATIBILITY.
 
 * New styles in theory "HOL-Library.LaTeXsugar":
   - "dummy_pats" for printing equations with "_" on the lhs;
   - "eta_expand" for printing eta-expanded terms.
 
 * Theory "HOL-Library.Permutations": theorem bij_swap_ompose_bij has
 been renamed to bij_swap_compose_bij. INCOMPATIBILITY.
 
 * New theory "HOL-Library.Going_To_Filter" providing the "f going_to F"
 filter for describing points x such that f(x) is in the filter F.
 
 * Theory "HOL-Library.Formal_Power_Series": constants X/E/L/F have been
 renamed to fps_X/fps_exp/fps_ln/fps_hypergeo to avoid polluting the name
 space. INCOMPATIBILITY.
 
 * Theory "HOL-Library.FinFun" has been moved to AFP (again).
 INCOMPATIBILITY.
 
 * Theory "HOL-Library.FuncSet": some old and rarely used ASCII
 replacement syntax has been removed. INCOMPATIBILITY, standard syntax
 with symbols should be used instead. The subsequent commands help to
 reproduce the old forms, e.g. to simplify porting old theories:
 
 syntax (ASCII)
   "_PiE" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'b set \<Rightarrow> ('a \<Rightarrow> 'b) set"  ("(3PIE _:_./ _)" 10)
   "_Pi"  :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'b set \<Rightarrow> ('a \<Rightarrow> 'b) set"  ("(3PI _:_./ _)" 10)
   "_lam" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> ('a \<Rightarrow> 'b)"  ("(3%_:_./ _)" [0,0,3] 3)
 
 * Theory "HOL-Library.Multiset": the simprocs on subsets operators of
 multisets have been renamed:
 
   msetless_cancel_numerals ~> msetsubset_cancel
   msetle_cancel_numerals ~> msetsubset_eq_cancel
 
 INCOMPATIBILITY.
 
 * Theory "HOL-Library.Pattern_Aliases" provides input and output syntax
 for pattern aliases as known from Haskell, Scala and ML.
 
 * Theory "HOL-Library.Uprod" formalizes the type of unordered pairs.
 
 * Session HOL-Analysis: more material involving arcs, paths, covering
 spaces, innessential maps, retracts, infinite products, simplicial
 complexes. Baire Category theorem. Major results include the Jordan
 Curve Theorem and the Great Picard Theorem.
 
 * Session HOL-Algebra has been extended by additional lattice theory:
 the Knaster-Tarski fixed point theorem and Galois Connections.
 
 * Sessions HOL-Computational_Algebra and HOL-Number_Theory: new notions
 of squarefreeness, n-th powers, and prime powers.
 
 * Session "HOL-Computional_Algebra" covers many previously scattered
 theories, notably Euclidean_Algorithm, Factorial_Ring,
 Formal_Power_Series, Fraction_Field, Fundamental_Theorem_Algebra,
 Normalized_Fraction, Polynomial_FPS, Polynomial, Primes. Minor
 INCOMPATIBILITY.
 
 
 *** System ***
 
 * Isabelle/Scala: the SQL module supports access to relational
 databases, either as plain file (SQLite) or full-scale server
 (PostgreSQL via local port or remote ssh connection).
 
 * Results of "isabelle build" are recorded as SQLite database (i.e.
 "Application File Format" in the sense of
 https://www.sqlite.org/appfileformat.html). This allows systematic
 access via operations from module Sessions.Store in Isabelle/Scala.
 
 * System option "parallel_proofs" is 1 by default (instead of more
 aggressive 2). This requires less heap space and avoids burning parallel
 CPU cycles, while full subproof parallelization is enabled for repeated
 builds (according to parallel_subproofs_threshold).
 
 * System option "record_proofs" allows to change the global
 Proofterm.proofs variable for a session. Regular values are are 0, 1, 2;
 a negative value means the current state in the ML heap image remains
 unchanged.
 
 * Isabelle settings variable ISABELLE_SCALA_BUILD_OPTIONS has been
 renamed to ISABELLE_SCALAC_OPTIONS. Rare INCOMPATIBILITY.
 
 * Isabelle settings variables ISABELLE_WINDOWS_PLATFORM,
 ISABELLE_WINDOWS_PLATFORM32, ISABELLE_WINDOWS_PLATFORM64 indicate the
 native Windows platform (independently of the Cygwin installation). This
 is analogous to ISABELLE_PLATFORM, ISABELLE_PLATFORM32,
 ISABELLE_PLATFORM64.
 
 * Command-line tool "isabelle build_docker" builds a Docker image from
 the Isabelle application bundle for Linux. See also
 https://hub.docker.com/r/makarius/isabelle
 
 * Command-line tool "isabelle vscode_server" provides a Language Server
 Protocol implementation, e.g. for the Visual Studio Code editor. It
 serves as example for alternative PIDE front-ends.
 
 * Command-line tool "isabelle imports" helps to maintain theory imports
 wrt. session structure. Examples for the main Isabelle distribution:
 
   isabelle imports -I -a
   isabelle imports -U -a
   isabelle imports -U -i -a
   isabelle imports -M -a -d '~~/src/Benchmarks'
 
 
 
 New in Isabelle2016-1 (December 2016)
 -------------------------------------
 
 *** General ***
 
 * Splitter in proof methods "simp", "auto" and friends:
   - The syntax "split add" has been discontinued, use plain "split",
     INCOMPATIBILITY.
   - For situations with many conditional or case expressions, there is
     an alternative splitting strategy that can be much faster. It is
     selected by writing "split!" instead of "split". It applies safe
     introduction and elimination rules after each split rule. As a
     result the subgoal may be split into several subgoals.
 
 * Command 'bundle' provides a local theory target to define a bundle
 from the body of specification commands (such as 'declare',
 'declaration', 'notation', 'lemmas', 'lemma'). For example:
 
 bundle foo
 begin
   declare a [simp]
   declare b [intro]
 end
 
 * Command 'unbundle' is like 'include', but works within a local theory
 context. Unlike "context includes ... begin", the effect of 'unbundle'
 on the target context persists, until different declarations are given.
 
 * Simplified outer syntax: uniform category "name" includes long
 identifiers. Former "xname" / "nameref" / "name reference" has been
 discontinued.
 
 * Embedded content (e.g. the inner syntax of types, terms, props) may be
 delimited uniformly via cartouches. This works better than old-fashioned
 quotes when sub-languages are nested.
 
 * Mixfix annotations support general block properties, with syntax
 "(\<open>x=a y=b z \<dots>\<close>". Notable property names are "indent", "consistent",
 "unbreakable", "markup". The existing notation "(DIGITS" is equivalent
 to "(\<open>indent=DIGITS\<close>". The former notation "(00" for unbreakable blocks
 is superseded by "(\<open>unbreabable\<close>" --- rare INCOMPATIBILITY.
 
 * Proof method "blast" is more robust wrt. corner cases of Pure
 statements without object-logic judgment.
 
 * Commands 'prf' and 'full_prf' are somewhat more informative (again):
 proof terms are reconstructed and cleaned from administrative thm nodes.
 
 * Code generator: config option "code_timing" triggers measurements of
 different phases of code generation. See src/HOL/ex/Code_Timing.thy for
 examples.
 
 * Code generator: implicits in Scala (stemming from type class
 instances) are generated into companion object of corresponding type
 class, to resolve some situations where ambiguities may occur.
 
 * Solve direct: option "solve_direct_strict_warnings" gives explicit
 warnings for lemma statements with trivial proofs.
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * More aggressive flushing of machine-generated input, according to
 system option editor_generated_input_delay (in addition to existing
 editor_input_delay for regular user edits). This may affect overall PIDE
 reactivity and CPU usage.
 
 * Syntactic indentation according to Isabelle outer syntax. Action
 "indent-lines" (shortcut C+i) indents the current line according to
 command keywords and some command substructure. Action
 "isabelle.newline" (shortcut ENTER) indents the old and the new line
 according to command keywords only; see also option
 "jedit_indent_newline".
 
 * Semantic indentation for unstructured proof scripts ('apply' etc.) via
 number of subgoals. This requires information of ongoing document
 processing and may thus lag behind, when the user is editing too
 quickly; see also option "jedit_script_indent" and
 "jedit_script_indent_limit".
 
 * Refined folding mode "isabelle" based on Isar syntax: 'next' and 'qed'
 are treated as delimiters for fold structure; 'begin' and 'end'
 structure of theory specifications is treated as well.
 
 * Command 'proof' provides information about proof outline with cases,
 e.g. for proof methods "cases", "induct", "goal_cases".
 
 * Completion templates for commands involving "begin ... end" blocks,
 e.g. 'context', 'notepad'.
 
 * Sidekick parser "isabelle-context" shows nesting of context blocks
 according to 'begin' and 'end' structure.
 
 * Highlighting of entity def/ref positions wrt. cursor.
 
 * Action "isabelle.select-entity" (shortcut CS+ENTER) selects all
 occurrences of the formal entity at the caret position. This facilitates
 systematic renaming.
 
 * PIDE document markup works across multiple Isar commands, e.g. the
 results established at the end of a proof are properly identified in the
 theorem statement.
 
 * Cartouche abbreviations work both for " and ` to accomodate typical
 situations where old ASCII notation may be updated.
 
 * Dockable window "Symbols" also provides access to 'abbrevs' from the
 outer syntax of the current theory buffer. This provides clickable
 syntax templates, including entries with empty abbrevs name (which are
 inaccessible via keyboard completion).
 
 * IDE support for the Isabelle/Pure bootstrap process, with the
 following independent stages:
 
   src/Pure/ROOT0.ML
   src/Pure/ROOT.ML
   src/Pure/Pure.thy
   src/Pure/ML_Bootstrap.thy
 
 The ML ROOT files act like quasi-theories in the context of theory
 ML_Bootstrap: this allows continuous checking of all loaded ML files.
 The theory files are presented with a modified header to import Pure
 from the running Isabelle instance. Results from changed versions of
 each stage are *not* propagated to the next stage, and isolated from the
 actual Isabelle/Pure that runs the IDE itself. The sequential
 dependencies of the above files are only observed for batch build.
 
 * Isabelle/ML and Standard ML files are presented in Sidekick with the
 tree structure of section headings: this special comment format is
 described in "implementation" chapter 0, e.g. (*** section ***).
 
 * Additional abbreviations for syntactic completion may be specified
 within the theory header as 'abbrevs'. The theory syntax for 'keywords'
 has been simplified accordingly: optional abbrevs need to go into the
 new 'abbrevs' section.
 
 * Global abbreviations via $ISABELLE_HOME/etc/abbrevs and
 $ISABELLE_HOME_USER/etc/abbrevs are no longer supported. Minor
 INCOMPATIBILITY, use 'abbrevs' within theory header instead.
 
 * Action "isabelle.keymap-merge" asks the user to resolve pending
 Isabelle keymap changes that are in conflict with the current jEdit
 keymap; non-conflicting changes are always applied implicitly. This
 action is automatically invoked on Isabelle/jEdit startup and thus
 increases chances that users see new keyboard shortcuts when re-using
 old keymaps.
 
 * ML and document antiquotations for file-systems paths are more uniform
 and diverse:
 
   @{path NAME}   -- no file-system check
   @{file NAME}   -- check for plain file
   @{dir NAME}    -- check for directory
 
 Minor INCOMPATIBILITY, former uses of @{file} and @{file_unchecked} may
 have to be changed.
 
 
 *** Document preparation ***
 
 * New symbol \<circle>, e.g. for temporal operator.
 
 * New document and ML antiquotation @{locale} for locales, similar to
 existing antiquotation @{class}.
 
 * Mixfix annotations support delimiters like \<^control>\<open>cartouche\<close> --
 this allows special forms of document output.
 
 * Raw LaTeX output now works via \<^latex>\<open>...\<close> instead of raw control
 symbol \<^raw:...>. INCOMPATIBILITY, notably for LaTeXsugar.thy and its
 derivatives.
 
 * \<^raw:...> symbols are no longer supported.
 
 * Old 'header' command is no longer supported (legacy since
 Isabelle2015).
 
 
 *** Isar ***
 
 * Many specification elements support structured statements with 'if' /
 'for' eigen-context, e.g. 'axiomatization', 'abbreviation',
 'definition', 'inductive', 'function'.
 
 * Toplevel theorem statements support eigen-context notation with 'if' /
 'for' (in postfix), which corresponds to 'assumes' / 'fixes' in the
 traditional long statement form (in prefix). Local premises are called
 "that" or "assms", respectively. Empty premises are *not* bound in the
 context: INCOMPATIBILITY.
 
 * Command 'define' introduces a local (non-polymorphic) definition, with
 optional abstraction over local parameters. The syntax resembles
 'definition' and 'obtain'. It fits better into the Isar language than
 old 'def', which is now a legacy feature.
 
 * Command 'obtain' supports structured statements with 'if' / 'for'
 context.
 
 * Command '\<proof>' is an alias for 'sorry', with different
 typesetting. E.g. to produce proof holes in examples and documentation.
 
 * The defining position of a literal fact \<open>prop\<close> is maintained more
 carefully, and made accessible as hyperlink in the Prover IDE.
 
 * Commands 'finally' and 'ultimately' used to expose the result as
 literal fact: this accidental behaviour has been discontinued. Rare
 INCOMPATIBILITY, use more explicit means to refer to facts in Isar.
 
 * Command 'axiomatization' has become more restrictive to correspond
 better to internal axioms as singleton facts with mandatory name. Minor
 INCOMPATIBILITY.
 
 * Proof methods may refer to the main facts via the dynamic fact
 "method_facts". This is particularly useful for Eisbach method
 definitions.
 
 * Proof method "use" allows to modify the main facts of a given method
 expression, e.g.
 
   (use facts in simp)
   (use facts in \<open>simp add: ...\<close>)
 
 * The old proof method "default" has been removed (legacy since
 Isabelle2016). INCOMPATIBILITY, use "standard" instead.
 
 
 *** Pure ***
 
 * Pure provides basic versions of proof methods "simp" and "simp_all"
 that only know about meta-equality (==). Potential INCOMPATIBILITY in
 theory imports that merge Pure with e.g. Main of Isabelle/HOL: the order
 is relevant to avoid confusion of Pure.simp vs. HOL.simp.
 
 * The command 'unfolding' and proof method "unfold" include a second
 stage where given equations are passed through the attribute "abs_def"
 before rewriting. This ensures that definitions are fully expanded,
 regardless of the actual parameters that are provided. Rare
 INCOMPATIBILITY in some corner cases: use proof method (simp only:)
 instead, or declare [[unfold_abs_def = false]] in the proof context.
 
 * Type-inference improves sorts of newly introduced type variables for
 the object-logic, using its base sort (i.e. HOL.type for Isabelle/HOL).
 Thus terms like "f x" or "\<And>x. P x" without any further syntactic context
 produce x::'a::type in HOL instead of x::'a::{} in Pure. Rare
 INCOMPATIBILITY, need to provide explicit type constraints for Pure
 types where this is really intended.
 
 
 *** HOL ***
 
 * New proof method "argo" using the built-in Argo solver based on SMT
 technology. The method can be used to prove goals of quantifier-free
 propositional logic, goals based on a combination of quantifier-free
 propositional logic with equality, and goals based on a combination of
 quantifier-free propositional logic with linear real arithmetic
 including min/max/abs. See HOL/ex/Argo_Examples.thy for examples.
 
 * The new "nunchaku" command integrates the Nunchaku model finder. The
 tool is experimental. See ~~/src/HOL/Nunchaku/Nunchaku.thy for details.
 
 * Metis: The problem encoding has changed very slightly. This might
 break existing proofs. INCOMPATIBILITY.
 
 * Sledgehammer:
   - The MaSh relevance filter is now faster than before.
   - Produce syntactically correct Vampire 4.0 problem files.
 
 * (Co)datatype package:
   - New commands for defining corecursive functions and reasoning about
     them in "~~/src/HOL/Library/BNF_Corec.thy": 'corec', 'corecursive',
     'friend_of_corec', and 'corecursion_upto'; and 'corec_unique' proof
     method. See 'isabelle doc corec'.
   - The predicator :: ('a \<Rightarrow> bool) \<Rightarrow> 'a F \<Rightarrow> bool is now a first-class
     citizen in bounded natural functors.
   - 'primrec' now allows nested calls through the predicator in addition
     to the map function.
   - 'bnf' automatically discharges reflexive proof obligations.
   - 'bnf' outputs a slightly modified proof obligation expressing rel in
        terms of map and set
        (not giving a specification for rel makes this one reflexive).
   - 'bnf' outputs a new proof obligation expressing pred in terms of set
        (not giving a specification for pred makes this one reflexive).
     INCOMPATIBILITY: manual 'bnf' declarations may need adjustment.
   - Renamed lemmas:
       rel_prod_apply ~> rel_prod_inject
       pred_prod_apply ~> pred_prod_inject
     INCOMPATIBILITY.
   - The "size" plugin has been made compatible again with locales.
   - The theorems about "rel" and "set" may have a slightly different (but
     equivalent) form.
     INCOMPATIBILITY.
 
 * The 'coinductive' command produces a proper coinduction rule for
 mutual coinductive predicates. This new rule replaces the old rule,
 which exposed details of the internal fixpoint construction and was
 hard to use. INCOMPATIBILITY.
 
 * New abbreviations for negated existence (but not bounded existence):
 
   \<nexists>x. P x \<equiv> \<not> (\<exists>x. P x)
   \<nexists>!x. P x \<equiv> \<not> (\<exists>!x. P x)
 
 * The print mode "HOL" for ASCII syntax of binders "!", "?", "?!", "@"
 has been removed for output. It is retained for input only, until it is
 eliminated altogether.
 
 * The unique existence quantifier no longer provides 'binder' syntax,
 but uses syntax translations (as for bounded unique existence). Thus
 iterated quantification \<exists>!x y. P x y with its slightly confusing
 sequential meaning \<exists>!x. \<exists>!y. P x y is no longer possible. Instead,
 pattern abstraction admits simultaneous unique existence \<exists>!(x, y). P x y
 (analogous to existing notation \<exists>!(x, y)\<in>A. P x y). Potential
 INCOMPATIBILITY in rare situations.
 
 * Conventional syntax "%(). t" for unit abstractions. Slight syntactic
 INCOMPATIBILITY.
 
 * Renamed constants and corresponding theorems:
 
     setsum ~> sum
     setprod ~> prod
     listsum ~> sum_list
     listprod ~> prod_list
 
 INCOMPATIBILITY.
 
 * Sligthly more standardized theorem names:
     sgn_times ~> sgn_mult
     sgn_mult' ~> Real_Vector_Spaces.sgn_mult
     divide_zero_left ~> div_0
     zero_mod_left ~> mod_0
     divide_zero ~> div_by_0
     divide_1 ~> div_by_1
     nonzero_mult_divide_cancel_left ~> nonzero_mult_div_cancel_left
     div_mult_self1_is_id ~> nonzero_mult_div_cancel_left
     nonzero_mult_divide_cancel_right ~> nonzero_mult_div_cancel_right
     div_mult_self2_is_id ~> nonzero_mult_div_cancel_right
     is_unit_divide_mult_cancel_left ~> is_unit_div_mult_cancel_left
     is_unit_divide_mult_cancel_right ~> is_unit_div_mult_cancel_right
     mod_div_equality ~> div_mult_mod_eq
     mod_div_equality2 ~> mult_div_mod_eq
     mod_div_equality3 ~> mod_div_mult_eq
     mod_div_equality4 ~> mod_mult_div_eq
     minus_div_eq_mod ~> minus_div_mult_eq_mod
     minus_div_eq_mod2 ~> minus_mult_div_eq_mod
     minus_mod_eq_div ~> minus_mod_eq_div_mult
     minus_mod_eq_div2 ~> minus_mod_eq_mult_div
     div_mod_equality' ~> minus_mod_eq_div_mult [symmetric]
     mod_div_equality' ~> minus_div_mult_eq_mod [symmetric]
     zmod_zdiv_equality ~> mult_div_mod_eq [symmetric]
     zmod_zdiv_equality' ~> minus_div_mult_eq_mod [symmetric]
     Divides.mult_div_cancel ~> minus_mod_eq_mult_div [symmetric]
     mult_div_cancel ~> minus_mod_eq_mult_div [symmetric]
     zmult_div_cancel ~> minus_mod_eq_mult_div [symmetric]
     div_1 ~> div_by_Suc_0
     mod_1 ~> mod_by_Suc_0
 INCOMPATIBILITY.
 
 * New type class "idom_abs_sgn" specifies algebraic properties
 of sign and absolute value functions.  Type class "sgn_if" has
 disappeared.  Slight INCOMPATIBILITY.
 
 * Dedicated syntax LENGTH('a) for length of types.
 
 * Characters (type char) are modelled as finite algebraic type
 corresponding to {0..255}.
 
   - Logical representation:
     * 0 is instantiated to the ASCII zero character.
     * All other characters are represented as "Char n"
       with n being a raw numeral expression less than 256.
     * Expressions of the form "Char n" with n greater than 255
       are non-canonical.
   - Printing and parsing:
     * Printable characters are printed and parsed as "CHR ''\<dots>''"
       (as before).
     * The ASCII zero character is printed and parsed as "0".
     * All other canonical characters are printed as "CHR 0xXX"
       with XX being the hexadecimal character code.  "CHR n"
       is parsable for every numeral expression n.
     * Non-canonical characters have no special syntax and are
       printed as their logical representation.
   - Explicit conversions from and to the natural numbers are
     provided as char_of_nat, nat_of_char (as before).
   - The auxiliary nibble type has been discontinued.
 
 INCOMPATIBILITY.
 
 * Type class "div" with operation "mod" renamed to type class "modulo"
 with operation "modulo", analogously to type class "divide". This
 eliminates the need to qualify any of those names in the presence of
 infix "mod" syntax. INCOMPATIBILITY.
 
 * Statements and proofs of Knaster-Tarski fixpoint combinators lfp/gfp
 have been clarified. The fixpoint properties are lfp_fixpoint, its
 symmetric lfp_unfold (as before), and the duals for gfp. Auxiliary items
 for the proof (lfp_lemma2 etc.) are no longer exported, but can be
 easily recovered by composition with eq_refl. Minor INCOMPATIBILITY.
 
 * Constant "surj" is a mere input abbreviation, to avoid hiding an
 equation in term output. Minor INCOMPATIBILITY.
 
 * Command 'code_reflect' accepts empty constructor lists for datatypes,
 which renders those abstract effectively.
 
 * Command 'export_code' checks given constants for abstraction
 violations: a small guarantee that given constants specify a safe
 interface for the generated code.
 
 * Code generation for Scala: ambiguous implicts in class diagrams are
 spelt out explicitly.
 
 * Static evaluators (Code_Evaluation.static_* in Isabelle/ML) rely on
 explicitly provided auxiliary definitions for required type class
 dictionaries rather than half-working magic. INCOMPATIBILITY, see the
 tutorial on code generation for details.
 
 * Theory Set_Interval: substantial new theorems on indexed sums and
 products.
 
 * Locale bijection establishes convenient default simp rules such as
 "inv f (f a) = a" for total bijections.
 
 * Abstract locales semigroup, abel_semigroup, semilattice,
 semilattice_neutr, ordering, ordering_top, semilattice_order,
 semilattice_neutr_order, comm_monoid_set, semilattice_set,
 semilattice_neutr_set, semilattice_order_set,
 semilattice_order_neutr_set monoid_list, comm_monoid_list,
 comm_monoid_list_set, comm_monoid_mset, comm_monoid_fun use boldified
 syntax uniformly that does not clash with corresponding global syntax.
 INCOMPATIBILITY.
 
 * Former locale lifting_syntax is now a bundle, which is easier to
 include in a local context or theorem statement, e.g. "context includes
 lifting_syntax begin ... end". Minor INCOMPATIBILITY.
 
 * Some old / obsolete theorems have been renamed / removed, potential
 INCOMPATIBILITY.
 
   nat_less_cases  --  removed, use linorder_cases instead
   inv_image_comp  --  removed, use image_inv_f_f instead
   image_surj_f_inv_f  ~>  image_f_inv_f
 
 * Some theorems about groups and orders have been generalised from
   groups to semi-groups that are also monoids:
     le_add_same_cancel1
     le_add_same_cancel2
     less_add_same_cancel1
     less_add_same_cancel2
     add_le_same_cancel1
     add_le_same_cancel2
     add_less_same_cancel1
     add_less_same_cancel2
 
 * Some simplifications theorems about rings have been removed, since
   superseeded by a more general version:
     less_add_cancel_left_greater_zero ~> less_add_same_cancel1
     less_add_cancel_right_greater_zero ~> less_add_same_cancel2
     less_eq_add_cancel_left_greater_eq_zero ~> le_add_same_cancel1
     less_eq_add_cancel_right_greater_eq_zero ~> le_add_same_cancel2
     less_eq_add_cancel_left_less_eq_zero ~> add_le_same_cancel1
     less_eq_add_cancel_right_less_eq_zero ~> add_le_same_cancel2
     less_add_cancel_left_less_zero ~> add_less_same_cancel1
     less_add_cancel_right_less_zero ~> add_less_same_cancel2
 INCOMPATIBILITY.
 
 * Renamed split_if -> if_split and split_if_asm -> if_split_asm to
 resemble the f.split naming convention, INCOMPATIBILITY.
 
 * Added class topological_monoid.
 
 * The following theorems have been renamed:
 
   setsum_left_distrib ~> sum_distrib_right
   setsum_right_distrib ~> sum_distrib_left
 
 INCOMPATIBILITY.
 
 * Compound constants INFIMUM and SUPREMUM are mere abbreviations now.
 INCOMPATIBILITY.
 
 * "Gcd (f ` A)" and "Lcm (f ` A)" are printed with optional
 comprehension-like syntax analogously to "Inf (f ` A)" and "Sup (f `
 A)".
 
 * Class semiring_Lcd merged into semiring_Gcd. INCOMPATIBILITY.
 
 * The type class ordered_comm_monoid_add is now called
 ordered_cancel_comm_monoid_add. A new type class ordered_comm_monoid_add
 is introduced as the combination of ordered_ab_semigroup_add +
 comm_monoid_add. INCOMPATIBILITY.
 
 * Introduced the type classes canonically_ordered_comm_monoid_add and
 dioid.
 
 * Introduced the type class ordered_ab_semigroup_monoid_add_imp_le. When
 instantiating linordered_semiring_strict and ordered_ab_group_add, an
 explicit instantiation of ordered_ab_semigroup_monoid_add_imp_le might
 be required. INCOMPATIBILITY.
 
 * Dropped various legacy fact bindings, whose replacements are often
 of a more general type also:
   lcm_left_commute_nat ~> lcm.left_commute
   lcm_left_commute_int ~> lcm.left_commute
   gcd_left_commute_nat ~> gcd.left_commute
   gcd_left_commute_int ~> gcd.left_commute
   gcd_greatest_iff_nat ~> gcd_greatest_iff
   gcd_greatest_iff_int ~> gcd_greatest_iff
   coprime_dvd_mult_nat ~> coprime_dvd_mult
   coprime_dvd_mult_int ~> coprime_dvd_mult
   zpower_numeral_even ~> power_numeral_even
   gcd_mult_cancel_nat ~> gcd_mult_cancel
   gcd_mult_cancel_int ~> gcd_mult_cancel
   div_gcd_coprime_nat ~> div_gcd_coprime
   div_gcd_coprime_int ~> div_gcd_coprime
   zpower_numeral_odd ~> power_numeral_odd
   zero_less_int_conv ~> of_nat_0_less_iff
   gcd_greatest_nat ~> gcd_greatest
   gcd_greatest_int ~> gcd_greatest
   coprime_mult_nat ~> coprime_mult
   coprime_mult_int ~> coprime_mult
   lcm_commute_nat ~> lcm.commute
   lcm_commute_int ~> lcm.commute
   int_less_0_conv ~> of_nat_less_0_iff
   gcd_commute_nat ~> gcd.commute
   gcd_commute_int ~> gcd.commute
   Gcd_insert_nat ~> Gcd_insert
   Gcd_insert_int ~> Gcd_insert
   of_int_int_eq ~> of_int_of_nat_eq
   lcm_least_nat ~> lcm_least
   lcm_least_int ~> lcm_least
   lcm_assoc_nat ~> lcm.assoc
   lcm_assoc_int ~> lcm.assoc
   int_le_0_conv ~> of_nat_le_0_iff
   int_eq_0_conv ~> of_nat_eq_0_iff
   Gcd_empty_nat ~> Gcd_empty
   Gcd_empty_int ~> Gcd_empty
   gcd_assoc_nat ~> gcd.assoc
   gcd_assoc_int ~> gcd.assoc
   zero_zle_int ~> of_nat_0_le_iff
   lcm_dvd2_nat ~> dvd_lcm2
   lcm_dvd2_int ~> dvd_lcm2
   lcm_dvd1_nat ~> dvd_lcm1
   lcm_dvd1_int ~> dvd_lcm1
   gcd_zero_nat ~> gcd_eq_0_iff
   gcd_zero_int ~> gcd_eq_0_iff
   gcd_dvd2_nat ~> gcd_dvd2
   gcd_dvd2_int ~> gcd_dvd2
   gcd_dvd1_nat ~> gcd_dvd1
   gcd_dvd1_int ~> gcd_dvd1
   int_numeral ~> of_nat_numeral
   lcm_ac_nat ~> ac_simps
   lcm_ac_int ~> ac_simps
   gcd_ac_nat ~> ac_simps
   gcd_ac_int ~> ac_simps
   abs_int_eq ~> abs_of_nat
   zless_int ~> of_nat_less_iff
   zdiff_int ~> of_nat_diff
   zadd_int ~> of_nat_add
   int_mult ~> of_nat_mult
   int_Suc ~> of_nat_Suc
   inj_int ~> inj_of_nat
   int_1 ~> of_nat_1
   int_0 ~> of_nat_0
   Lcm_empty_nat ~> Lcm_empty
   Lcm_empty_int ~> Lcm_empty
   Lcm_insert_nat ~> Lcm_insert
   Lcm_insert_int ~> Lcm_insert
   comp_fun_idem_gcd_nat ~> comp_fun_idem_gcd
   comp_fun_idem_gcd_int ~> comp_fun_idem_gcd
   comp_fun_idem_lcm_nat ~> comp_fun_idem_lcm
   comp_fun_idem_lcm_int ~> comp_fun_idem_lcm
   Lcm_eq_0 ~> Lcm_eq_0_I
   Lcm0_iff ~> Lcm_0_iff
   Lcm_dvd_int ~> Lcm_least
   divides_mult_nat ~> divides_mult
   divides_mult_int ~> divides_mult
   lcm_0_nat ~> lcm_0_right
   lcm_0_int ~> lcm_0_right
   lcm_0_left_nat ~> lcm_0_left
   lcm_0_left_int ~> lcm_0_left
   dvd_gcd_D1_nat ~> dvd_gcdD1
   dvd_gcd_D1_int ~> dvd_gcdD1
   dvd_gcd_D2_nat ~> dvd_gcdD2
   dvd_gcd_D2_int ~> dvd_gcdD2
   coprime_dvd_mult_iff_nat ~> coprime_dvd_mult_iff
   coprime_dvd_mult_iff_int ~> coprime_dvd_mult_iff
   realpow_minus_mult ~> power_minus_mult
   realpow_Suc_le_self ~> power_Suc_le_self
   dvd_Gcd, dvd_Gcd_nat, dvd_Gcd_int removed in favour of Gcd_greatest
 INCOMPATIBILITY.
 
 * Renamed HOL/Quotient_Examples/FSet.thy to
 HOL/Quotient_Examples/Quotient_FSet.thy INCOMPATIBILITY.
 
 * Session HOL-Library: theory FinFun bundles "finfun_syntax" and
 "no_finfun_syntax" allow to control optional syntax in local contexts;
 this supersedes former theory FinFun_Syntax. INCOMPATIBILITY, e.g. use
 "unbundle finfun_syntax" to imitate import of
 "~~/src/HOL/Library/FinFun_Syntax".
 
 * Session HOL-Library: theory Multiset_Permutations (executably) defines
 the set of permutations of a given set or multiset, i.e. the set of all
 lists that contain every element of the carrier (multi-)set exactly
 once.
 
 * Session HOL-Library: multiset membership is now expressed using
 set_mset rather than count.
 
   - Expressions "count M a > 0" and similar simplify to membership
     by default.
 
   - Converting between "count M a = 0" and non-membership happens using
     equations count_eq_zero_iff and not_in_iff.
 
   - Rules count_inI and in_countE obtain facts of the form
     "count M a = n" from membership.
 
   - Rules count_in_diffI and in_diff_countE obtain facts of the form
     "count M a = n + count N a" from membership on difference sets.
 
 INCOMPATIBILITY.
 
 * Session HOL-Library: theory LaTeXsugar uses new-style "dummy_pats" for
 displaying equations in functional programming style --- variables
 present on the left-hand but not on the righ-hand side are replaced by
 underscores.
 
 * Session HOL-Library: theory Combinator_PER provides combinator to
 build partial equivalence relations from a predicate and an equivalence
 relation.
 
 * Session HOL-Library: theory Perm provides basic facts about almost
 everywhere fix bijections.
 
 * Session HOL-Library: theory Normalized_Fraction allows viewing an
 element of a field of fractions as a normalized fraction (i.e. a pair of
 numerator and denominator such that the two are coprime and the
 denominator is normalized wrt. unit factors).
 
 * Session HOL-NSA has been renamed to HOL-Nonstandard_Analysis.
 
 * Session HOL-Multivariate_Analysis has been renamed to HOL-Analysis.
 
 * Session HOL-Analysis: measure theory has been moved here from
 HOL-Probability. When importing HOL-Analysis some theorems need
 additional name spaces prefixes due to name clashes. INCOMPATIBILITY.
 
 * Session HOL-Analysis: more complex analysis including Cauchy's
 inequality, Liouville theorem, open mapping theorem, maximum modulus
 principle, Residue theorem, Schwarz Lemma.
 
 * Session HOL-Analysis: Theory of polyhedra: faces, extreme points,
 polytopes, and the Krein–Milman Minkowski theorem.
 
 * Session HOL-Analysis: Numerous results ported from the HOL Light
 libraries: homeomorphisms, continuous function extensions, invariance of
 domain.
 
 * Session HOL-Probability: the type of emeasure and nn_integral was
 changed from ereal to ennreal, INCOMPATIBILITY.
 
   emeasure :: 'a measure \<Rightarrow> 'a set \<Rightarrow> ennreal
   nn_integral :: 'a measure \<Rightarrow> ('a \<Rightarrow> ennreal) \<Rightarrow> ennreal
 
 * Session HOL-Probability: Code generation and QuickCheck for
 Probability Mass Functions.
 
 * Session HOL-Probability: theory Random_Permutations contains some
 theory about choosing a permutation of a set uniformly at random and
 folding over a list in random order.
 
 * Session HOL-Probability: theory SPMF formalises discrete
 subprobability distributions.
 
 * Session HOL-Library: the names of multiset theorems have been
 normalised to distinguish which ordering the theorems are about
 
     mset_less_eqI ~> mset_subset_eqI
     mset_less_insertD ~> mset_subset_insertD
     mset_less_eq_count ~> mset_subset_eq_count
     mset_less_diff_self ~> mset_subset_diff_self
     mset_le_exists_conv ~> mset_subset_eq_exists_conv
     mset_le_mono_add_right_cancel ~> mset_subset_eq_mono_add_right_cancel
     mset_le_mono_add_left_cancel ~> mset_subset_eq_mono_add_left_cancel
     mset_le_mono_add ~> mset_subset_eq_mono_add
     mset_le_add_left ~> mset_subset_eq_add_left
     mset_le_add_right ~> mset_subset_eq_add_right
     mset_le_single ~> mset_subset_eq_single
     mset_le_multiset_union_diff_commute ~> mset_subset_eq_multiset_union_diff_commute
     diff_le_self ~> diff_subset_eq_self
     mset_leD ~> mset_subset_eqD
     mset_lessD ~> mset_subsetD
     mset_le_insertD ~> mset_subset_eq_insertD
     mset_less_of_empty ~> mset_subset_of_empty
     mset_less_size ~> mset_subset_size
     wf_less_mset_rel ~> wf_subset_mset_rel
     count_le_replicate_mset_le ~> count_le_replicate_mset_subset_eq
     mset_remdups_le ~> mset_remdups_subset_eq
     ms_lesseq_impl ~> subset_eq_mset_impl
 
 Some functions have been renamed:
     ms_lesseq_impl -> subset_eq_mset_impl
 
 * HOL-Library: multisets are now ordered with the multiset ordering
     #\<subseteq># ~> \<le>
     #\<subset># ~> <
     le_multiset ~> less_eq_multiset
     less_multiset ~> le_multiset
 INCOMPATIBILITY.
 
 * Session HOL-Library: the prefix multiset_order has been discontinued:
 the theorems can be directly accessed. As a consequence, the lemmas
 "order_multiset" and "linorder_multiset" have been discontinued, and the
 interpretations "multiset_linorder" and "multiset_wellorder" have been
 replaced by instantiations. INCOMPATIBILITY.
 
 * Session HOL-Library: some theorems about the multiset ordering have
 been renamed:
 
     le_multiset_def ~> less_eq_multiset_def
     less_multiset_def ~> le_multiset_def
     less_eq_imp_le_multiset ~> subset_eq_imp_le_multiset
     mult_less_not_refl ~> mset_le_not_refl
     mult_less_trans ~> mset_le_trans
     mult_less_not_sym ~> mset_le_not_sym
     mult_less_asym ~> mset_le_asym
     mult_less_irrefl ~> mset_le_irrefl
     union_less_mono2{,1,2} ~> union_le_mono2{,1,2}
 
     le_multiset\<^sub>H\<^sub>O ~> less_eq_multiset\<^sub>H\<^sub>O
     le_multiset_total ~> less_eq_multiset_total
     less_multiset_right_total ~> subset_eq_imp_le_multiset
     le_multiset_empty_left ~> less_eq_multiset_empty_left
     le_multiset_empty_right ~> less_eq_multiset_empty_right
     less_multiset_empty_right ~> le_multiset_empty_left
     less_multiset_empty_left ~> le_multiset_empty_right
     union_less_diff_plus ~> union_le_diff_plus
     ex_gt_count_imp_less_multiset ~> ex_gt_count_imp_le_multiset
     less_multiset_plus_left_nonempty ~> le_multiset_plus_left_nonempty
     le_multiset_plus_right_nonempty ~> le_multiset_plus_right_nonempty
 INCOMPATIBILITY.
 
 * Session HOL-Library: the lemma mset_map has now the attribute [simp].
 INCOMPATIBILITY.
 
 * Session HOL-Library: some theorems about multisets have been removed.
 INCOMPATIBILITY, use the following replacements:
 
     le_multiset_plus_plus_left_iff ~> add_less_cancel_right
     less_multiset_plus_plus_left_iff ~> add_less_cancel_right
     le_multiset_plus_plus_right_iff ~> add_less_cancel_left
     less_multiset_plus_plus_right_iff ~> add_less_cancel_left
     add_eq_self_empty_iff ~> add_cancel_left_right
     mset_subset_add_bothsides ~> subset_mset.add_less_cancel_right
     mset_less_add_bothsides ~> subset_mset.add_less_cancel_right
     mset_le_add_bothsides ~> subset_mset.add_less_cancel_right
     empty_inter ~> subset_mset.inf_bot_left
     inter_empty ~> subset_mset.inf_bot_right
     empty_sup ~> subset_mset.sup_bot_left
     sup_empty ~> subset_mset.sup_bot_right
     bdd_below_multiset ~> subset_mset.bdd_above_bot
     subset_eq_empty ~> subset_mset.le_zero_eq
     le_empty ~> subset_mset.le_zero_eq
     mset_subset_empty_nonempty ~> subset_mset.zero_less_iff_neq_zero
     mset_less_empty_nonempty ~> subset_mset.zero_less_iff_neq_zero
 
 * Session HOL-Library: some typeclass constraints about multisets have
 been reduced from ordered or linordered to preorder. Multisets have the
 additional typeclasses order_bot, no_top,
 ordered_ab_semigroup_add_imp_le, ordered_cancel_comm_monoid_add,
 linordered_cancel_ab_semigroup_add, and
 ordered_ab_semigroup_monoid_add_imp_le. INCOMPATIBILITY.
 
 * Session HOL-Library: there are some new simplification rules about
 multisets, the multiset ordering, and the subset ordering on multisets.
 INCOMPATIBILITY.
 
 * Session HOL-Library: the subset ordering on multisets has now the
 interpretations ordered_ab_semigroup_monoid_add_imp_le and
 bounded_lattice_bot. INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: single has been removed in favor
 of add_mset that roughly corresponds to Set.insert. Some theorems have
 removed or changed:
 
   single_not_empty ~> add_mset_not_empty or empty_not_add_mset
   fold_mset_insert ~> fold_mset_add_mset
   image_mset_insert ~> image_mset_add_mset
   union_single_eq_diff
   multi_self_add_other_not_self
   diff_single_eq_union
 INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: some theorems have been changed
 to use add_mset instead of single:
 
   mset_add
   multi_self_add_other_not_self
   diff_single_eq_union
   union_single_eq_diff
   union_single_eq_member
   add_eq_conv_diff
   insert_noteq_member
   add_eq_conv_ex
   multi_member_split
   multiset_add_sub_el_shuffle
   mset_subset_eq_insertD
   mset_subset_insertD
   insert_subset_eq_iff
   insert_union_subset_iff
   multi_psub_of_add_self
   inter_add_left1
   inter_add_left2
   inter_add_right1
   inter_add_right2
   sup_union_left1
   sup_union_left2
   sup_union_right1
   sup_union_right2
   size_eq_Suc_imp_eq_union
   multi_nonempty_split
   mset_insort
   mset_update
   mult1I
   less_add
   mset_zip_take_Cons_drop_twice
   rel_mset_Zero
   msed_map_invL
   msed_map_invR
   msed_rel_invL
   msed_rel_invR
   le_multiset_right_total
   multiset_induct
   multiset_induct2_size
   multiset_induct2
 INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: the definitions of some
 constants have changed to use add_mset instead of adding a single
 element:
 
   image_mset
   mset
   replicate_mset
   mult1
   pred_mset
   rel_mset'
   mset_insort
 
 INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: due to the above changes, the
 attributes of some multiset theorems have been changed:
 
   insert_DiffM  [] ~> [simp]
   insert_DiffM2 [simp] ~> []
   diff_add_mset_swap [simp]
   fold_mset_add_mset [simp]
   diff_diff_add [simp] (for multisets only)
   diff_cancel [simp] ~> []
   count_single [simp] ~> []
   set_mset_single [simp] ~> []
   size_multiset_single [simp] ~> []
   size_single [simp] ~> []
   image_mset_single [simp] ~> []
   mset_subset_eq_mono_add_right_cancel [simp] ~> []
   mset_subset_eq_mono_add_left_cancel [simp] ~> []
   fold_mset_single [simp] ~> []
   subset_eq_empty [simp] ~> []
   empty_sup [simp] ~> []
   sup_empty [simp] ~> []
   inter_empty [simp] ~> []
   empty_inter [simp] ~> []
 INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: the order of the variables in
 the second cases of multiset_induct, multiset_induct2_size,
 multiset_induct2 has been changed (e.g. Add A a ~> Add a A).
 INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: there is now a simplification
 procedure on multisets. It mimics the behavior of the procedure on
 natural numbers. INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: renamed sums and products of
 multisets:
 
   msetsum ~> sum_mset
   msetprod ~> prod_mset
 
 * Session HOL-Library, theory Multiset: the notation for intersection
 and union of multisets have been changed:
 
   #\<inter> ~> \<inter>#
   #\<union> ~> \<union>#
 
 INCOMPATIBILITY.
 
 * Session HOL-Library, theory Multiset: the lemma
 one_step_implies_mult_aux on multisets has been removed, use
 one_step_implies_mult instead. INCOMPATIBILITY.
 
 * Session HOL-Library: theory Complete_Partial_Order2 provides reasoning
 support for monotonicity and continuity in chain-complete partial orders
 and about admissibility conditions for fixpoint inductions.
 
 * Session HOL-Library: theory Library/Polynomial contains also
 derivation of polynomials (formerly in Library/Poly_Deriv) but not
 gcd/lcm on polynomials over fields. This has been moved to a separate
 theory Library/Polynomial_GCD_euclidean.thy, to pave way for a possible
 future different type class instantiation for polynomials over factorial
 rings. INCOMPATIBILITY.
 
 * Session HOL-Library: theory Sublist provides function "prefixes" with
 the following renaming
 
   prefixeq -> prefix
   prefix -> strict_prefix
   suffixeq -> suffix
   suffix -> strict_suffix
 
 Added theory of longest common prefixes.
 
 * Session HOL-Number_Theory: algebraic foundation for primes:
 Generalisation of predicate "prime" and introduction of predicates
 "prime_elem", "irreducible", a "prime_factorization" function, and the
 "factorial_ring" typeclass with instance proofs for nat, int, poly. Some
 theorems now have different names, most notably "prime_def" is now
 "prime_nat_iff". INCOMPATIBILITY.
 
 * Session Old_Number_Theory has been removed, after porting remaining
 theories.
 
 * Session HOL-Types_To_Sets provides an experimental extension of
 Higher-Order Logic to allow translation of types to sets.
 
 
 *** ML ***
 
 * Integer.gcd and Integer.lcm use efficient operations from the Poly/ML
 library (notably for big integers). Subtle change of semantics:
 Integer.gcd and Integer.lcm both normalize the sign, results are never
 negative. This coincides with the definitions in HOL/GCD.thy.
 INCOMPATIBILITY.
 
 * Structure Rat for rational numbers is now an integral part of
 Isabelle/ML, with special notation @int/nat or @int for numerals (an
 abbreviation for antiquotation @{Pure.rat argument}) and ML pretty
 printing. Standard operations on type Rat.rat are provided via ad-hoc
 overloading of + - * / < <= > >= ~ abs. INCOMPATIBILITY, need to
 use + instead of +/ etc. Moreover, exception Rat.DIVZERO has been
 superseded by General.Div.
 
 * ML antiquotation @{path} is superseded by @{file}, which ensures that
 the argument is a plain file. Minor INCOMPATIBILITY.
 
 * Antiquotation @{make_string} is available during Pure bootstrap --
 with approximative output quality.
 
 * Low-level ML system structures (like PolyML and RunCall) are no longer
 exposed to Isabelle/ML user-space. Potential INCOMPATIBILITY.
 
 * The ML function "ML" provides easy access to run-time compilation.
 This is particularly useful for conditional compilation, without
 requiring separate files.
 
 * Option ML_exception_debugger controls detailed exception trace via the
 Poly/ML debugger. Relevant ML modules need to be compiled beforehand
 with ML_file_debug, or with ML_file and option ML_debugger enabled. Note
 debugger information requires consirable time and space: main
 Isabelle/HOL with full debugger support may need ML_system_64.
 
 * Local_Theory.restore has been renamed to Local_Theory.reset to
 emphasize its disruptive impact on the cumulative context, notably the
 scope of 'private' or 'qualified' names. Note that Local_Theory.reset is
 only appropriate when targets are managed, e.g. starting from a global
 theory and returning to it. Regular definitional packages should use
 balanced blocks of Local_Theory.open_target versus
 Local_Theory.close_target instead. Rare INCOMPATIBILITY.
 
 * Structure TimeLimit (originally from the SML/NJ library) has been
 replaced by structure Timeout, with slightly different signature.
 INCOMPATIBILITY.
 
 * Discontinued cd and pwd operations, which are not well-defined in a
 multi-threaded environment. Note that files are usually located
 relatively to the master directory of a theory (see also
 File.full_path). Potential INCOMPATIBILITY.
 
 * Binding.empty_atts supersedes Thm.empty_binding and
 Attrib.empty_binding. Minor INCOMPATIBILITY.
 
 
 *** System ***
 
 * SML/NJ and old versions of Poly/ML are no longer supported.
 
 * Poly/ML heaps now follow the hierarchy of sessions, and thus require
 much less disk space.
 
 * The Isabelle ML process is now managed directly by Isabelle/Scala, and
 shell scripts merely provide optional command-line access. In
 particular:
 
   . Scala module ML_Process to connect to the raw ML process,
     with interaction via stdin/stdout/stderr or in batch mode;
   . command-line tool "isabelle console" as interactive wrapper;
   . command-line tool "isabelle process" as batch mode wrapper.
 
 * The executable "isabelle_process" has been discontinued. Tools and
 prover front-ends should use ML_Process or Isabelle_Process in
 Isabelle/Scala. INCOMPATIBILITY.
 
 * New command-line tool "isabelle process" supports ML evaluation of
 literal expressions (option -e) or files (option -f) in the context of a
 given heap image. Errors lead to premature exit of the ML process with
 return code 1.
 
 * The command-line tool "isabelle build" supports option -N for cyclic
 shuffling of NUMA CPU nodes. This may help performance tuning on Linux
 servers with separate CPU/memory modules.
 
 * System option "threads" (for the size of the Isabelle/ML thread farm)
 is also passed to the underlying ML runtime system as --gcthreads,
 unless there is already a default provided via ML_OPTIONS settings.
 
 * System option "checkpoint" helps to fine-tune the global heap space
 management of isabelle build. This is relevant for big sessions that may
 exhaust the small 32-bit address space of the ML process (which is used
 by default).
 
 * System option "profiling" specifies the mode for global ML profiling
 in "isabelle build". Possible values are "time", "allocations". The
 command-line tool "isabelle profiling_report" helps to digest the
 resulting log files.
 
 * System option "ML_process_policy" specifies an optional command prefix
 for the underlying ML process, e.g. to control CPU affinity on
 multiprocessor systems. The "isabelle jedit" tool allows to override the
 implicit default via option -p.
 
 * Command-line tool "isabelle console" provides option -r to help to
 bootstrapping Isabelle/Pure interactively.
 
 * Command-line tool "isabelle yxml" has been discontinued.
 INCOMPATIBILITY, use operations from the modules "XML" and "YXML" in
 Isabelle/ML or Isabelle/Scala.
 
 * Many Isabelle tools that require a Java runtime system refer to the
 settings ISABELLE_TOOL_JAVA_OPTIONS32 / ISABELLE_TOOL_JAVA_OPTIONS64,
 depending on the underlying platform. The settings for "isabelle build"
 ISABELLE_BUILD_JAVA_OPTIONS32 / ISABELLE_BUILD_JAVA_OPTIONS64 have been
 discontinued. Potential INCOMPATIBILITY.
 
 * The Isabelle system environment always ensures that the main
 executables are found within the shell search $PATH: "isabelle" and
 "isabelle_scala_script".
 
 * Isabelle tools may consist of .scala files: the Scala compiler is
 invoked on the spot. The source needs to define some object that extends
 Isabelle_Tool.Body.
 
 * File.bash_string, File.bash_path etc. represent Isabelle/ML and
 Isabelle/Scala strings authentically within GNU bash. This is useful to
 produce robust shell scripts under program control, without worrying
 about spaces or special characters. Note that user output works via
 Path.print (ML) or Path.toString (Scala). INCOMPATIBILITY, the old (and
 less versatile) operations File.shell_quote, File.shell_path etc. have
 been discontinued.
 
 * The isabelle_java executable allows to run a Java process within the
 name space of Java and Scala components that are bundled with Isabelle,
 but without the Isabelle settings environment.
 
 * Isabelle/Scala: the SSH module supports ssh and sftp connections, for
 remote command-execution and file-system access. This resembles
 operations from module File and Isabelle_System to some extent. Note
 that Path specifications need to be resolved remotely via
 ssh.remote_path instead of File.standard_path: the implicit process
 environment is different, Isabelle settings are not available remotely.
 
 * Isabelle/Scala: the Mercurial module supports repositories via the
 regular hg command-line interface. The repositroy clone and working
 directory may reside on a local or remote file-system (via ssh
 connection).
 
 
 
 New in Isabelle2016 (February 2016)
 -----------------------------------
 
 *** General ***
 
 * Eisbach is now based on Pure instead of HOL. Objects-logics may import
 either the theory ~~/src/HOL/Eisbach/Eisbach (for HOL etc.) or
 ~~/src/HOL/Eisbach/Eisbach_Old_Appl_Syntax (for FOL, ZF etc.). Note that
 the HOL-Eisbach session located in ~~/src/HOL/Eisbach/ contains further
 examples that do require HOL.
 
 * Better resource usage on all platforms (Linux, Windows, Mac OS X) for
 both Isabelle/ML and Isabelle/Scala.  Slightly reduced heap space usage.
 
 * Former "xsymbols" syntax with Isabelle symbols is used by default,
 without any special print mode. Important ASCII replacement syntax
 remains available under print mode "ASCII", but less important syntax
 has been removed (see below).
 
 * Support for more arrow symbols, with rendering in LaTeX and Isabelle
 fonts: \<Lleftarrow> \<Rrightarrow> \<longlongleftarrow> \<longlongrightarrow> \<longlonglongleftarrow> \<longlonglongrightarrow>.
 
 * Special notation \<struct> for the first implicit 'structure' in the
 context has been discontinued. Rare INCOMPATIBILITY, use explicit
 structure name instead, notably in indexed notation with block-subscript
 (e.g. \<odot>\<^bsub>A\<^esub>).
 
 * The glyph for \<diamond> in the IsabelleText font now corresponds better to its
 counterpart \<box> as quantifier-like symbol. A small diamond is available as
 \<diamondop>; the old symbol \<struct> loses this rendering and any special
 meaning.
 
 * Syntax for formal comments "-- text" now also supports the symbolic
 form "\<comment> text". Command-line tool "isabelle update_cartouches -c" helps
 to update old sources.
 
 * Toplevel theorem statements have been simplified as follows:
 
   theorems             ~>  lemmas
   schematic_lemma      ~>  schematic_goal
   schematic_theorem    ~>  schematic_goal
   schematic_corollary  ~>  schematic_goal
 
 Command-line tool "isabelle update_theorems" updates theory sources
 accordingly.
 
 * Toplevel theorem statement 'proposition' is another alias for
 'theorem'.
 
 * The old 'defs' command has been removed (legacy since Isabelle2014).
 INCOMPATIBILITY, use regular 'definition' instead. Overloaded and/or
 deferred definitions require a surrounding 'overloading' block.
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * IDE support for the source-level debugger of Poly/ML, to work with
 Isabelle/ML and official Standard ML. Option "ML_debugger" and commands
 'ML_file_debug', 'ML_file_no_debug', 'SML_file_debug',
 'SML_file_no_debug' control compilation of sources with or without
 debugging information. The Debugger panel allows to set breakpoints (via
 context menu), step through stopped threads, evaluate local ML
 expressions etc. At least one Debugger view needs to be active to have
 any effect on the running ML program.
 
 * The State panel manages explicit proof state output, with dynamic
 auto-update according to cursor movement. Alternatively, the jEdit
 action "isabelle.update-state" (shortcut S+ENTER) triggers manual
 update.
 
 * The Output panel no longer shows proof state output by default, to
 avoid GUI overcrowding. INCOMPATIBILITY, use the State panel instead or
 enable option "editor_output_state".
 
 * The text overview column (status of errors, warnings etc.) is updated
 asynchronously, leading to much better editor reactivity. Moreover, the
 full document node content is taken into account. The width of the
 column is scaled according to the main text area font, for improved
 visibility.
 
 * The main text area no longer changes its color hue in outdated
 situations. The text overview column takes over the role to indicate
 unfinished edits in the PIDE pipeline. This avoids flashing text display
 due to ad-hoc updates by auxiliary GUI components, such as the State
 panel.
 
 * Slightly improved scheduling for urgent print tasks (e.g. command
 state output, interactive queries) wrt. long-running background tasks.
 
 * Completion of symbols via prefix of \<name> or \<^name> or \name is
 always possible, independently of the language context. It is never
 implicit: a popup will show up unconditionally.
 
 * Additional abbreviations for syntactic completion may be specified in
 $ISABELLE_HOME/etc/abbrevs and $ISABELLE_HOME_USER/etc/abbrevs, with
 support for simple templates using ASCII 007 (bell) as placeholder.
 
 * Symbols \<oplus>, \<Oplus>, \<otimes>, \<Otimes>, \<odot>, \<Odot>, \<ominus>, \<oslash> no longer provide abbreviations for
 completion like "+o", "*o", ".o" etc. -- due to conflicts with other
 ASCII syntax. INCOMPATIBILITY, use plain backslash-completion or define
 suitable abbreviations in $ISABELLE_HOME_USER/etc/abbrevs.
 
 * Action "isabelle-emph" (with keyboard shortcut C+e LEFT) controls
 emphasized text style; the effect is visible in document output, not in
 the editor.
 
 * Action "isabelle-reset" now uses keyboard shortcut C+e BACK_SPACE,
 instead of former C+e LEFT.
 
 * The command-line tool "isabelle jedit" and the isabelle.Main
 application wrapper treat the default $USER_HOME/Scratch.thy more
 uniformly, and allow the dummy file argument ":" to open an empty buffer
 instead.
 
 * New command-line tool "isabelle jedit_client" allows to connect to an
 already running Isabelle/jEdit process. This achieves the effect of
 single-instance applications seen on common GUI desktops.
 
 * The default look-and-feel for Linux is the traditional "Metal", which
 works better with GUI scaling for very high-resolution displays (e.g.
 4K). Moreover, it is generally more robust than "Nimbus".
 
 * Update to jedit-5.3.0, with improved GUI scaling and support of
 high-resolution displays (e.g. 4K).
 
 * The main Isabelle executable is managed as single-instance Desktop
 application uniformly on all platforms: Linux, Windows, Mac OS X.
 
 
 *** Document preparation ***
 
 * Commands 'paragraph' and 'subparagraph' provide additional section
 headings. Thus there are 6 levels of standard headings, as in HTML.
 
 * Command 'text_raw' has been clarified: input text is processed as in
 'text' (with antiquotations and control symbols). The key difference is
 the lack of the surrounding isabelle markup environment in output.
 
 * Text is structured in paragraphs and nested lists, using notation that
 is similar to Markdown. The control symbols for list items are as
 follows:
 
   \<^item>  itemize
   \<^enum>  enumerate
   \<^descr>  description
 
 * There is a new short form for antiquotations with a single argument
 that is a cartouche: \<^name>\<open>...\<close> is equivalent to @{name \<open>...\<close>} and
 \<open>...\<close> without control symbol is equivalent to @{cartouche \<open>...\<close>}.
 \<^name> without following cartouche is equivalent to @{name}. The
 standard Isabelle fonts provide glyphs to render important control
 symbols, e.g. "\<^verbatim>", "\<^emph>", "\<^bold>".
 
 * Antiquotations @{noindent}, @{smallskip}, @{medskip}, @{bigskip} with
 corresponding control symbols \<^noindent>, \<^smallskip>, \<^medskip>, \<^bigskip> specify spacing formally, using
 standard LaTeX macros of the same names.
 
 * Antiquotation @{cartouche} in Isabelle/Pure is the same as @{text}.
 Consequently, \<open>...\<close> without any decoration prints literal quasi-formal
 text. Command-line tool "isabelle update_cartouches -t" helps to update
 old sources, by approximative patching of the content of string and
 cartouche tokens seen in theory sources.
 
 * The @{text} antiquotation now ignores the antiquotation option
 "source". The given text content is output unconditionally, without any
 surrounding quotes etc. Subtle INCOMPATIBILITY, put quotes into the
 argument where they are really intended, e.g. @{text \<open>"foo"\<close>}. Initial
 or terminal spaces are ignored.
 
 * Antiquotations @{emph} and @{bold} output LaTeX source recursively,
 adding appropriate text style markup. These may be used in the short
 form \<^emph>\<open>...\<close> and \<^bold>\<open>...\<close>.
 
 * Document antiquotation @{footnote} outputs LaTeX source recursively,
 marked as \footnote{}. This may be used in the short form \<^footnote>\<open>...\<close>.
 
 * Antiquotation @{verbatim [display]} supports option "indent".
 
 * Antiquotation @{theory_text} prints uninterpreted theory source text
 (Isar outer syntax with command keywords etc.). This may be used in the
 short form \<^theory_text>\<open>...\<close>. @{theory_text [display]} supports option "indent".
 
 * Antiquotation @{doc ENTRY} provides a reference to the given
 documentation, with a hyperlink in the Prover IDE.
 
 * Antiquotations @{command}, @{method}, @{attribute} print checked
 entities of the Isar language.
 
 * HTML presentation uses the standard IsabelleText font and Unicode
 rendering of Isabelle symbols like Isabelle/Scala/jEdit.  The former
 print mode "HTML" loses its special meaning.
 
 
 *** Isar ***
 
 * Local goals ('have', 'show', 'hence', 'thus') allow structured rule
 statements like fixes/assumes/shows in theorem specifications, but the
 notation is postfix with keywords 'if' (or 'when') and 'for'. For
 example:
 
   have result: "C x y"
     if "A x" and "B y"
     for x :: 'a and y :: 'a
     <proof>
 
 The local assumptions are bound to the name "that". The result is
 exported from context of the statement as usual. The above roughly
 corresponds to a raw proof block like this:
 
   {
     fix x :: 'a and y :: 'a
     assume that: "A x" "B y"
     have "C x y" <proof>
   }
   note result = this
 
 The keyword 'when' may be used instead of 'if', to indicate 'presume'
 instead of 'assume' above.
 
 * Assumptions ('assume', 'presume') allow structured rule statements
 using 'if' and 'for', similar to 'have' etc. above. For example:
 
   assume result: "C x y"
     if "A x" and "B y"
     for x :: 'a and y :: 'a
 
 This assumes "\<And>x y::'a. A x \<Longrightarrow> B y \<Longrightarrow> C x y" and produces a general
 result as usual: "A ?x \<Longrightarrow> B ?y \<Longrightarrow> C ?x ?y".
 
 Vacuous quantification in assumptions is omitted, i.e. a for-context
 only effects propositions according to actual use of variables. For
 example:
 
   assume "A x" and "B y" for x and y
 
 is equivalent to:
 
   assume "\<And>x. A x" and "\<And>y. B y"
 
 * The meaning of 'show' with Pure rule statements has changed: premises
 are treated in the sense of 'assume', instead of 'presume'. This means,
 a goal like "\<And>x. A x \<Longrightarrow> B x \<Longrightarrow> C x" can be solved completely as
 follows:
 
   show "\<And>x. A x \<Longrightarrow> B x \<Longrightarrow> C x"
 
 or:
 
   show "C x" if "A x" "B x" for x
 
 Rare INCOMPATIBILITY, the old behaviour may be recovered as follows:
 
   show "C x" when "A x" "B x" for x
 
 * New command 'consider' states rules for generalized elimination and
 case splitting. This is like a toplevel statement "theorem obtains" used
 within a proof body; or like a multi-branch 'obtain' without activation
 of the local context elements yet.
 
 * Proof method "cases" allows to specify the rule as first entry of
 chained facts.  This is particularly useful with 'consider':
 
   consider (a) A | (b) B | (c) C <proof>
   then have something
   proof cases
     case a
     then show ?thesis <proof>
   next
     case b
     then show ?thesis <proof>
   next
     case c
     then show ?thesis <proof>
   qed
 
 * Command 'case' allows fact name and attribute specification like this:
 
   case a: (c xs)
   case a [attributes]: (c xs)
 
 Facts that are introduced by invoking the case context are uniformly
 qualified by "a"; the same name is used for the cumulative fact. The old
 form "case (c xs) [attributes]" is no longer supported. Rare
 INCOMPATIBILITY, need to adapt uses of case facts in exotic situations,
 and always put attributes in front.
 
 * The standard proof method of commands 'proof' and '..' is now called
 "standard" to make semantically clear what it is; the old name "default"
 is still available as legacy for some time. Documentation now explains
 '..' more accurately as "by standard" instead of "by rule".
 
 * Nesting of Isar goal structure has been clarified: the context after
 the initial backwards refinement is retained for the whole proof, within
 all its context sections (as indicated via 'next'). This is e.g.
 relevant for 'using', 'including', 'supply':
 
   have "A \<and> A" if a: A for A
     supply [simp] = a
   proof
     show A by simp
   next
     show A by simp
   qed
 
 * Command 'obtain' binds term abbreviations (via 'is' patterns) in the
 proof body as well, abstracted over relevant parameters.
 
 * Improved type-inference for theorem statement 'obtains': separate
 parameter scope for of each clause.
 
 * Term abbreviations via 'is' patterns also work for schematic
 statements: result is abstracted over unknowns.
 
 * Command 'subgoal' allows to impose some structure on backward
 refinements, to avoid proof scripts degenerating into long of 'apply'
 sequences. Further explanations and examples are given in the isar-ref
 manual.
 
 * Command 'supply' supports fact definitions during goal refinement
 ('apply' scripts).
 
 * Proof method "goal_cases" turns the current subgoals into cases within
 the context; the conclusion is bound to variable ?case in each case. For
 example:
 
 lemma "\<And>x. A x \<Longrightarrow> B x \<Longrightarrow> C x"
   and "\<And>y z. U y \<Longrightarrow> V z \<Longrightarrow> W y z"
 proof goal_cases
   case (1 x)
   then show ?case using \<open>A x\<close> \<open>B x\<close> sorry
 next
   case (2 y z)
   then show ?case using \<open>U y\<close> \<open>V z\<close> sorry
 qed
 
 lemma "\<And>x. A x \<Longrightarrow> B x \<Longrightarrow> C x"
   and "\<And>y z. U y \<Longrightarrow> V z \<Longrightarrow> W y z"
 proof goal_cases
   case prems: 1
   then show ?case using prems sorry
 next
   case prems: 2
   then show ?case using prems sorry
 qed
 
 * The undocumented feature of implicit cases goal1, goal2, goal3, etc.
 is marked as legacy, and will be removed eventually. The proof method
 "goals" achieves a similar effect within regular Isar; often it can be
 done more adequately by other means (e.g. 'consider').
 
 * The vacuous fact "TERM x" may be established "by fact" or as `TERM x`
 as well, not just "by this" or "." as before.
 
 * Method "sleep" succeeds after a real-time delay (in seconds). This is
 occasionally useful for demonstration and testing purposes.
 
 
 *** Pure ***
 
 * Qualifiers in locale expressions default to mandatory ('!') regardless
 of the command. Previously, for 'locale' and 'sublocale' the default was
 optional ('?'). The old synatx '!' has been discontinued.
 INCOMPATIBILITY, remove '!' and add '?' as required.
 
 * Keyword 'rewrites' identifies rewrite morphisms in interpretation
 commands. Previously, the keyword was 'where'. INCOMPATIBILITY.
 
 * More gentle suppression of syntax along locale morphisms while
 printing terms. Previously 'abbreviation' and 'notation' declarations
 would be suppressed for morphisms except term identity. Now
 'abbreviation' is also kept for morphims that only change the involved
 parameters, and only 'notation' is suppressed. This can be of great help
 when working with complex locale hierarchies, because proof states are
 displayed much more succinctly. It also means that only notation needs
 to be redeclared if desired, as illustrated by this example:
 
   locale struct = fixes composition :: "'a => 'a => 'a" (infixl "\<cdot>" 65)
   begin
     definition derived (infixl "\<odot>" 65) where ...
   end
 
   locale morphism =
     left: struct composition + right: struct composition'
     for composition (infix "\<cdot>" 65) and composition' (infix "\<cdot>''" 65)
   begin
     notation right.derived ("\<odot>''")
   end
 
 * Command 'global_interpretation' issues interpretations into global
 theories, with optional rewrite definitions following keyword 'defines'.
 
 * Command 'sublocale' accepts optional rewrite definitions after keyword
 'defines'.
 
 * Command 'permanent_interpretation' has been discontinued. Use
 'global_interpretation' or 'sublocale' instead. INCOMPATIBILITY.
 
 * Command 'print_definitions' prints dependencies of definitional
 specifications. This functionality used to be part of 'print_theory'.
 
 * Configuration option rule_insts_schematic has been discontinued
 (intermediate legacy feature in Isabelle2015). INCOMPATIBILITY.
 
 * Abbreviations in type classes now carry proper sort constraint. Rare
 INCOMPATIBILITY in situations where the previous misbehaviour has been
 exploited.
 
 * Refinement of user-space type system in type classes: pseudo-local
 operations behave more similar to abbreviations. Potential
 INCOMPATIBILITY in exotic situations.
 
 
 *** HOL ***
 
 * The 'typedef' command has been upgraded from a partially checked
 "axiomatization", to a full definitional specification that takes the
 global collection of overloaded constant / type definitions into
 account. Type definitions with open dependencies on overloaded
 definitions need to be specified as "typedef (overloaded)". This
 provides extra robustness in theory construction. Rare INCOMPATIBILITY.
 
 * Qualification of various formal entities in the libraries is done more
 uniformly via "context begin qualified definition ... end" instead of
 old-style "hide_const (open) ...". Consequently, both the defined
 constant and its defining fact become qualified, e.g. Option.is_none and
 Option.is_none_def. Occasional INCOMPATIBILITY in applications.
 
 * Some old and rarely used ASCII replacement syntax has been removed.
 INCOMPATIBILITY, standard syntax with symbols should be used instead.
 The subsequent commands help to reproduce the old forms, e.g. to
 simplify porting old theories:
 
   notation iff  (infixr "<->" 25)
 
   notation Times  (infixr "<*>" 80)
 
   type_notation Map.map  (infixr "~=>" 0)
   notation Map.map_comp  (infixl "o'_m" 55)
 
   type_notation FinFun.finfun ("(_ =>f /_)" [22, 21] 21)
 
   notation FuncSet.funcset  (infixr "->" 60)
   notation FuncSet.extensional_funcset  (infixr "->\<^sub>E" 60)
 
   notation Omega_Words_Fun.conc (infixr "conc" 65)
 
   notation Preorder.equiv ("op ~~")
     and Preorder.equiv ("(_/ ~~ _)" [51, 51] 50)
 
   notation (in topological_space) tendsto (infixr "--->" 55)
   notation (in topological_space) LIMSEQ ("((_)/ ----> (_))" [60, 60] 60)
   notation LIM ("((_)/ -- (_)/ --> (_))" [60, 0, 60] 60)
 
   notation NSA.approx (infixl "@=" 50)
   notation NSLIMSEQ ("((_)/ ----NS> (_))" [60, 60] 60)
   notation NSLIM ("((_)/ -- (_)/ --NS> (_))" [60, 0, 60] 60)
 
 * The alternative notation "\<Colon>" for type and sort constraints has been
 removed: in LaTeX document output it looks the same as "::".
 INCOMPATIBILITY, use plain "::" instead.
 
 * Commands 'inductive' and 'inductive_set' work better when names for
 intro rules are omitted: the "cases" and "induct" rules no longer
 declare empty case_names, but no case_names at all. This allows to use
 numbered cases in proofs, without requiring method "goal_cases".
 
 * Inductive definitions ('inductive', 'coinductive', etc.) expose
 low-level facts of the internal construction only if the option
 "inductive_internals" is enabled. This refers to the internal predicate
 definition and its monotonicity result. Rare INCOMPATIBILITY.
 
 * Recursive function definitions ('fun', 'function', 'partial_function')
 expose low-level facts of the internal construction only if the option
 "function_internals" is enabled. Its internal inductive definition is
 also subject to "inductive_internals". Rare INCOMPATIBILITY.
 
 * BNF datatypes ('datatype', 'codatatype', etc.) expose low-level facts
 of the internal construction only if the option "bnf_internals" is
 enabled. This supersedes the former option "bnf_note_all". Rare
 INCOMPATIBILITY.
 
 * Combinator to represent case distinction on products is named
 "case_prod", uniformly, discontinuing any input aliasses. Very popular
 theorem aliasses have been retained.
 
 Consolidated facts:
   PairE ~> prod.exhaust
   Pair_eq ~> prod.inject
   pair_collapse ~> prod.collapse
   Pair_fst_snd_eq ~> prod_eq_iff
   split_twice ~> prod.case_distrib
   split_weak_cong ~> prod.case_cong_weak
   split_split ~> prod.split
   split_split_asm ~> prod.split_asm
   splitI ~> case_prodI
   splitD ~> case_prodD
   splitI2 ~> case_prodI2
   splitI2' ~> case_prodI2'
   splitE ~> case_prodE
   splitE' ~> case_prodE'
   split_pair ~> case_prod_Pair
   split_eta ~> case_prod_eta
   split_comp ~> case_prod_comp
   mem_splitI ~> mem_case_prodI
   mem_splitI2 ~> mem_case_prodI2
   mem_splitE ~> mem_case_prodE
   The_split ~> The_case_prod
   cond_split_eta ~> cond_case_prod_eta
   Collect_split_in_rel_leE ~> Collect_case_prod_in_rel_leE
   Collect_split_in_rel_leI ~> Collect_case_prod_in_rel_leI
   in_rel_Collect_split_eq ~> in_rel_Collect_case_prod_eq
   Collect_split_Grp_eqD ~> Collect_case_prod_Grp_eqD
   Collect_split_Grp_inD ~> Collect_case_prod_Grp_in
   Domain_Collect_split ~> Domain_Collect_case_prod
   Image_Collect_split ~> Image_Collect_case_prod
   Range_Collect_split ~> Range_Collect_case_prod
   Eps_split ~> Eps_case_prod
   Eps_split_eq ~> Eps_case_prod_eq
   split_rsp ~> case_prod_rsp
   curry_split ~> curry_case_prod
   split_curry ~> case_prod_curry
 
 Changes in structure HOLogic:
   split_const ~> case_prod_const
   mk_split ~> mk_case_prod
   mk_psplits ~> mk_ptupleabs
   strip_psplits ~> strip_ptupleabs
 
 INCOMPATIBILITY.
 
 * The coercions to type 'real' have been reorganised. The function
 'real' is no longer overloaded, but has type 'nat => real' and
 abbreviates of_nat for that type. Also 'real_of_int :: int => real'
 abbreviates of_int for that type. Other overloaded instances of 'real'
 have been replaced by 'real_of_ereal' and 'real_of_float'.
 
 Consolidated facts (among others):
   real_of_nat_le_iff -> of_nat_le_iff
   real_of_nat_numeral of_nat_numeral
   real_of_int_zero of_int_0
   real_of_nat_zero of_nat_0
   real_of_one of_int_1
   real_of_int_add of_int_add
   real_of_nat_add of_nat_add
   real_of_int_diff of_int_diff
   real_of_nat_diff of_nat_diff
   floor_subtract floor_diff_of_int
   real_of_int_inject of_int_eq_iff
   real_of_int_gt_zero_cancel_iff of_int_0_less_iff
   real_of_int_ge_zero_cancel_iff of_int_0_le_iff
   real_of_nat_ge_zero of_nat_0_le_iff
   real_of_int_ceiling_ge le_of_int_ceiling
   ceiling_less_eq ceiling_less_iff
   ceiling_le_eq ceiling_le_iff
   less_floor_eq less_floor_iff
   floor_less_eq floor_less_iff
   floor_divide_eq_div floor_divide_of_int_eq
   real_of_int_zero_cancel of_nat_eq_0_iff
   ceiling_real_of_int ceiling_of_int
 
 INCOMPATIBILITY.
 
 * Theory Map: lemma map_of_is_SomeD was a clone of map_of_SomeD and has
 been removed. INCOMPATIBILITY.
 
 * Quickcheck setup for finite sets.
 
 * Discontinued simp_legacy_precond. Potential INCOMPATIBILITY.
 
 * Sledgehammer:
   - The MaSh relevance filter has been sped up.
   - Proof reconstruction has been improved, to minimize the incidence of
     cases where Sledgehammer gives a proof that does not work.
   - Auto Sledgehammer now minimizes and preplays the results.
   - Handle Vampire 4.0 proof output without raising exception.
   - Eliminated "MASH" environment variable. Use the "MaSh" option in
     Isabelle/jEdit instead. INCOMPATIBILITY.
   - Eliminated obsolete "blocking" option and related subcommands.
 
 * Nitpick:
   - Fixed soundness bug in translation of "finite" predicate.
   - Fixed soundness bug in "destroy_constrs" optimization.
   - Fixed soundness bug in translation of "rat" type.
   - Removed "check_potential" and "check_genuine" options.
   - Eliminated obsolete "blocking" option.
 
 * (Co)datatype package:
   - New commands "lift_bnf" and "copy_bnf" for lifting (copying) a BNF
     structure on the raw type to an abstract type defined using typedef.
   - Always generate "case_transfer" theorem.
   - For mutual types, generate slightly stronger "rel_induct",
     "rel_coinduct", and "coinduct" theorems. INCOMPATIBILITY.
   - Allow discriminators and selectors with the same name as the type
     being defined.
   - Avoid various internal name clashes (e.g., 'datatype f = f').
 
 * Transfer: new methods for interactive debugging of 'transfer' and
 'transfer_prover': 'transfer_start', 'transfer_step', 'transfer_end',
 'transfer_prover_start' and 'transfer_prover_end'.
 
 * New diagnostic command print_record for displaying record definitions.
 
 * Division on integers is bootstrapped directly from division on
 naturals and uses generic numeral algorithm for computations. Slight
 INCOMPATIBILITY, simproc numeral_divmod replaces and generalizes former
 simprocs binary_int_div and binary_int_mod
 
 * Tightened specification of class semiring_no_zero_divisors. Minor
 INCOMPATIBILITY.
 
 * Class algebraic_semidom introduces common algebraic notions of
 integral (semi)domains, particularly units. Although logically subsumed
 by fields, is is not a super class of these in order not to burden
 fields with notions that are trivial there.
 
 * Class normalization_semidom specifies canonical representants for
 equivalence classes of associated elements in an integral (semi)domain.
 This formalizes associated elements as well.
 
 * Abstract specification of gcd/lcm operations in classes semiring_gcd,
 semiring_Gcd, semiring_Lcd. Minor INCOMPATIBILITY: facts gcd_nat.commute
 and gcd_int.commute are subsumed by gcd.commute, as well as
 gcd_nat.assoc and gcd_int.assoc by gcd.assoc.
 
 * Former constants Fields.divide (_ / _) and Divides.div (_ div _) are
 logically unified to Rings.divide in syntactic type class Rings.divide,
 with infix syntax (_ div _). Infix syntax (_ / _) for field division is
 added later as abbreviation in class Fields.inverse. INCOMPATIBILITY,
 instantiations must refer to Rings.divide rather than the former
 separate constants, hence infix syntax (_ / _) is usually not available
 during instantiation.
 
 * New cancellation simprocs for boolean algebras to cancel complementary
 terms for sup and inf. For example, "sup x (sup y (- x))" simplifies to
 "top". INCOMPATIBILITY.
 
 * Class uniform_space introduces uniform spaces btw topological spaces
 and metric spaces. Minor INCOMPATIBILITY: open_<type>_def needs to be
 introduced in the form of an uniformity. Some constants are more general
 now, it may be necessary to add type class constraints.
 
   open_real_def \<leadsto> open_dist
   open_complex_def \<leadsto> open_dist
 
 * Library/Monad_Syntax: notation uses symbols \<bind> and \<then>. INCOMPATIBILITY.
 
 * Library/Multiset:
   - Renamed multiset inclusion operators:
       < ~> <#
       > ~> >#
       <= ~> <=#
       >= ~> >=#
       \<le> ~> \<le>#
       \<ge> ~> \<ge>#
     INCOMPATIBILITY.
   - Added multiset inclusion operator syntax:
       \<subset>#
       \<subseteq>#
       \<supset>#
       \<supseteq>#
   - "'a multiset" is no longer an instance of the "order",
     "ordered_ab_semigroup_add_imp_le", "ordered_cancel_comm_monoid_diff",
     "semilattice_inf", and "semilattice_sup" type classes. The theorems
     previously provided by these type classes (directly or indirectly)
     are now available through the "subset_mset" interpretation
     (e.g. add_mono ~> subset_mset.add_mono).
     INCOMPATIBILITY.
   - Renamed conversions:
       multiset_of ~> mset
       multiset_of_set ~> mset_set
       set_of ~> set_mset
     INCOMPATIBILITY
   - Renamed lemmas:
       mset_le_def ~> subseteq_mset_def
       mset_less_def ~> subset_mset_def
       less_eq_multiset.rep_eq ~> subseteq_mset_def
     INCOMPATIBILITY
   - Removed lemmas generated by lift_definition:
     less_eq_multiset.abs_eq, less_eq_multiset.rsp,
     less_eq_multiset.transfer, less_eq_multiset_def
     INCOMPATIBILITY
 
 * Library/Omega_Words_Fun: Infinite words modeled as functions nat \<Rightarrow> 'a.
 
 * Library/Bourbaki_Witt_Fixpoint: Added formalisation of the
 Bourbaki-Witt fixpoint theorem for increasing functions in
 chain-complete partial orders.
 
 * Library/Old_Recdef: discontinued obsolete 'defer_recdef' command.
 Minor INCOMPATIBILITY, use 'function' instead.
 
 * Library/Periodic_Fun: a locale that provides convenient lemmas for
 periodic functions.
 
 * Library/Formal_Power_Series: proper definition of division (with
 remainder) for formal power series; instances for Euclidean Ring and
 GCD.
 
 * HOL-Imperative_HOL: obsolete theory Legacy_Mrec has been removed.
 
 * HOL-Statespace: command 'statespace' uses mandatory qualifier for
 import of parent, as for general 'locale' expressions. INCOMPATIBILITY,
 remove '!' and add '?' as required.
 
 * HOL-Decision_Procs: The "approximation" method works with "powr"
 (exponentiation on real numbers) again.
 
 * HOL-Multivariate_Analysis: theory Cauchy_Integral_Thm with Contour
 integrals (= complex path integrals), Cauchy's integral theorem, winding
 numbers and Cauchy's integral formula, Liouville theorem, Fundamental
 Theorem of Algebra. Ported from HOL Light.
 
 * HOL-Multivariate_Analysis: topological concepts such as connected
 components, homotopic paths and the inside or outside of a set.
 
 * HOL-Multivariate_Analysis: radius of convergence of power series and
 various summability tests; Harmonic numbers and the Euler–Mascheroni
 constant; the Generalised Binomial Theorem; the complex and real
 Gamma/log-Gamma/Digamma/ Polygamma functions and their most important
 properties.
 
 * HOL-Probability: The central limit theorem based on Levy's uniqueness
 and continuity theorems, weak convergence, and characterisitc functions.
 
 * HOL-Data_Structures: new and growing session of standard data
 structures.
 
 
 *** ML ***
 
 * The following combinators for low-level profiling of the ML runtime
 system are available:
 
   profile_time          (*CPU time*)
   profile_time_thread   (*CPU time on this thread*)
   profile_allocations   (*overall heap allocations*)
 
 * Antiquotation @{undefined} or \<^undefined> inlines (raise Match).
 
 * Antiquotation @{method NAME} inlines the (checked) name of the given
 Isar proof method.
 
 * Pretty printing of Poly/ML compiler output in Isabelle has been
 improved: proper treatment of break offsets and blocks with consistent
 breaks.
 
 * The auxiliary module Pure/display.ML has been eliminated. Its
 elementary thm print operations are now in Pure/more_thm.ML and thus
 called Thm.pretty_thm, Thm.string_of_thm etc. INCOMPATIBILITY.
 
 * Simproc programming interfaces have been simplified:
 Simplifier.make_simproc and Simplifier.define_simproc supersede various
 forms of Simplifier.mk_simproc, Simplifier.simproc_global etc. Note that
 term patterns for the left-hand sides are specified with implicitly
 fixed variables, like top-level theorem statements. INCOMPATIBILITY.
 
 * Instantiation rules have been re-organized as follows:
 
   Thm.instantiate  (*low-level instantiation with named arguments*)
   Thm.instantiate' (*version with positional arguments*)
 
   Drule.infer_instantiate  (*instantiation with type inference*)
   Drule.infer_instantiate'  (*version with positional arguments*)
 
 The LHS only requires variable specifications, instead of full terms.
 Old cterm_instantiate is superseded by infer_instantiate.
 INCOMPATIBILITY, need to re-adjust some ML names and types accordingly.
 
 * Old tactic shorthands atac, rtac, etac, dtac, ftac have been
 discontinued. INCOMPATIBILITY, use regular assume_tac, resolve_tac etc.
 instead (with proper context).
 
 * Thm.instantiate (and derivatives) no longer require the LHS of the
 instantiation to be certified: plain variables are given directly.
 
 * Subgoal.SUBPROOF and Subgoal.FOCUS combinators use anonymous
 quasi-bound variables (like the Simplifier), instead of accidentally
 named local fixes. This has the potential to improve stability of proof
 tools, but can also cause INCOMPATIBILITY for tools that don't observe
 the proof context discipline.
 
 * Isar proof methods are based on a slightly more general type
 context_tactic, which allows to change the proof context dynamically
 (e.g. to update cases) and indicate explicit Seq.Error results. Former
 METHOD_CASES is superseded by CONTEXT_METHOD; further combinators are
 provided in src/Pure/Isar/method.ML for convenience. INCOMPATIBILITY.
 
 
 *** System ***
 
 * Command-line tool "isabelle console" enables print mode "ASCII".
 
 * Command-line tool "isabelle update_then" expands old Isar command
 conflations:
 
     hence  ~>  then have
     thus   ~>  then show
 
 This syntax is more orthogonal and improves readability and
 maintainability of proofs.
 
 * Global session timeout is multiplied by timeout_scale factor. This
 allows to adjust large-scale tests (e.g. AFP) to overall hardware
 performance.
 
 * Property values in etc/symbols may contain spaces, if written with the
 replacement character "␣" (Unicode point 0x2324). For example:
 
     \<star>  code: 0x0022c6  group: operator  font: Deja␣Vu␣Sans␣Mono
 
 * Java runtime environment for x86_64-windows allows to use larger heap
 space.
 
 * Java runtime options are determined separately for 32bit vs. 64bit
 platforms as follows.
 
   - Isabelle desktop application: platform-specific files that are
     associated with the main app bundle
 
   - isabelle jedit: settings
     JEDIT_JAVA_SYSTEM_OPTIONS
     JEDIT_JAVA_OPTIONS32 vs. JEDIT_JAVA_OPTIONS64
 
   - isabelle build: settings
     ISABELLE_BUILD_JAVA_OPTIONS32 vs. ISABELLE_BUILD_JAVA_OPTIONS64
 
 * Bash shell function "jvmpath" has been renamed to "platform_path": it
 is relevant both for Poly/ML and JVM processes.
 
 * Poly/ML default platform architecture may be changed from 32bit to
 64bit via system option ML_system_64. A system restart (and rebuild) is
 required after change.
 
 * Poly/ML 5.6 runs natively on x86-windows and x86_64-windows, which
 both allow larger heap space than former x86-cygwin.
 
 * Heap images are 10-15% smaller due to less wasteful persistent theory
 content (using ML type theory_id instead of theory);
 
 
 
 New in Isabelle2015 (May 2015)
 ------------------------------
 
 *** General ***
 
 * Local theory specification commands may have a 'private' or
 'qualified' modifier to restrict name space accesses to the local scope,
 as provided by some "context begin ... end" block. For example:
 
   context
   begin
 
   private definition ...
   private lemma ...
 
   qualified definition ...
   qualified lemma ...
 
   lemma ...
   theorem ...
 
   end
 
 * Command 'experiment' opens an anonymous locale context with private
 naming policy.
 
 * Command 'notepad' requires proper nesting of begin/end and its proof
 structure in the body: 'oops' is no longer supported here. Minor
 INCOMPATIBILITY, use 'sorry' instead.
 
 * Command 'named_theorems' declares a dynamic fact within the context,
 together with an attribute to maintain the content incrementally. This
 supersedes functor Named_Thms in Isabelle/ML, but with a subtle change
 of semantics due to external visual order vs. internal reverse order.
 
 * 'find_theorems': search patterns which are abstractions are
 schematically expanded before search. Search results match the naive
 expectation more closely, particularly wrt. abbreviations.
 INCOMPATIBILITY.
 
 * Commands 'method_setup' and 'attribute_setup' now work within a local
 theory context.
 
 * Outer syntax commands are managed authentically within the theory
 context, without implicit global state. Potential for accidental
 INCOMPATIBILITY, make sure that required theories are really imported.
 
 * Historical command-line terminator ";" is no longer accepted (and
 already used differently in Isar). Minor INCOMPATIBILITY, use "isabelle
 update_semicolons" to remove obsolete semicolons from old theory
 sources.
 
 * Structural composition of proof methods (meth1; meth2) in Isar
 corresponds to (tac1 THEN_ALL_NEW tac2) in ML.
 
 * The Eisbach proof method language allows to define new proof methods
 by combining existing ones with their usual syntax. The "match" proof
 method provides basic fact/term matching in addition to
 premise/conclusion matching through Subgoal.focus, and binds fact names
 from matches as well as term patterns within matches. The Isabelle
 documentation provides an entry "eisbach" for the Eisbach User Manual.
 Sources and various examples are in ~~/src/HOL/Eisbach/.
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * Improved folding mode "isabelle" based on Isar syntax. Alternatively,
 the "sidekick" mode may be used for document structure.
 
 * Extended bracket matching based on Isar language structure. System
 option jedit_structure_limit determines maximum number of lines to scan
 in the buffer.
 
 * Support for BibTeX files: context menu, context-sensitive token
 marker, SideKick parser.
 
 * Document antiquotation @{cite} provides formal markup, which is
 interpreted semi-formally based on .bib files that happen to be open in
 the editor (hyperlinks, completion etc.).
 
 * Less waste of vertical space via negative line spacing (see Global
 Options / Text Area).
 
 * Improved graphview panel with optional output of PNG or PDF, for
 display of 'thy_deps', 'class_deps' etc.
 
 * The commands 'thy_deps' and 'class_deps' allow optional bounds to
 restrict the visualized hierarchy.
 
 * Improved scheduling for asynchronous print commands (e.g. provers
 managed by the Sledgehammer panel) wrt. ongoing document processing.
 
 
 *** Document preparation ***
 
 * Document markup commands 'chapter', 'section', 'subsection',
 'subsubsection', 'text', 'txt', 'text_raw' work uniformly in any
 context, even before the initial 'theory' command. Obsolete proof
 commands 'sect', 'subsect', 'subsubsect', 'txt_raw' have been
 discontinued, use 'section', 'subsection', 'subsubsection', 'text_raw'
 instead. The old 'header' command is still retained for some time, but
 should be replaced by 'chapter', 'section' etc. (using "isabelle
 update_header"). Minor INCOMPATIBILITY.
 
 * Official support for "tt" style variants, via \isatt{...} or
 \begin{isabellett}...\end{isabellett}. The somewhat fragile \verb or
 verbatim environment of LaTeX is no longer used. This allows @{ML} etc.
 as argument to other macros (such as footnotes).
 
 * Document antiquotation @{verbatim} prints ASCII text literally in "tt"
 style.
 
 * Discontinued obsolete option "document_graph": session_graph.pdf is
 produced unconditionally for HTML browser_info and PDF-LaTeX document.
 
 * Diagnostic commands and document markup commands within a proof do not
 affect the command tag for output. Thus commands like 'thm' are subject
 to proof document structure, and no longer "stick out" accidentally.
 Commands 'text' and 'txt' merely differ in the LaTeX style, not their
 tags. Potential INCOMPATIBILITY in exotic situations.
 
 * System option "pretty_margin" is superseded by "thy_output_margin",
 which is also accessible via document antiquotation option "margin".
 Only the margin for document output may be changed, but not the global
 pretty printing: that is 76 for plain console output, and adapted
 dynamically in GUI front-ends. Implementations of document
 antiquotations need to observe the margin explicitly according to
 Thy_Output.string_of_margin. Minor INCOMPATIBILITY.
 
 * Specification of 'document_files' in the session ROOT file is
 mandatory for document preparation. The legacy mode with implicit
 copying of the document/ directory is no longer supported. Minor
 INCOMPATIBILITY.
 
 
 *** Pure ***
 
 * Proof methods with explicit instantiation ("rule_tac", "subgoal_tac"
 etc.) allow an optional context of local variables ('for' declaration):
 these variables become schematic in the instantiated theorem; this
 behaviour is analogous to 'for' in attributes "where" and "of".
 Configuration option rule_insts_schematic (default false) controls use
 of schematic variables outside the context. Minor INCOMPATIBILITY,
 declare rule_insts_schematic = true temporarily and update to use local
 variable declarations or dummy patterns instead.
 
 * Explicit instantiation via attributes "where", "of", and proof methods
 "rule_tac" with derivatives like "subgoal_tac" etc. admit dummy patterns
 ("_") that stand for anonymous local variables.
 
 * Generated schematic variables in standard format of exported facts are
 incremented to avoid material in the proof context. Rare
 INCOMPATIBILITY, explicit instantiation sometimes needs to refer to
 different index.
 
 * Lexical separation of signed and unsigned numerals: categories "num"
 and "float" are unsigned. INCOMPATIBILITY: subtle change in precedence
 of numeral signs, particularly in expressions involving infix syntax
 like "(- 1) ^ n".
 
 * Old inner token category "xnum" has been discontinued.  Potential
 INCOMPATIBILITY for exotic syntax: may use mixfix grammar with "num"
 token category instead.
 
 
 *** HOL ***
 
 * New (co)datatype package:
   - The 'datatype_new' command has been renamed 'datatype'. The old
     command of that name is now called 'old_datatype' and is provided
     by "~~/src/HOL/Library/Old_Datatype.thy". See
     'isabelle doc datatypes' for information on porting.
     INCOMPATIBILITY.
   - Renamed theorems:
       disc_corec ~> corec_disc
       disc_corec_iff ~> corec_disc_iff
       disc_exclude ~> distinct_disc
       disc_exhaust ~> exhaust_disc
       disc_map_iff ~> map_disc_iff
       sel_corec ~> corec_sel
       sel_exhaust ~> exhaust_sel
       sel_map ~> map_sel
       sel_set ~> set_sel
       sel_split ~> split_sel
       sel_split_asm ~> split_sel_asm
       strong_coinduct ~> coinduct_strong
       weak_case_cong ~> case_cong_weak
     INCOMPATIBILITY.
   - The "no_code" option to "free_constructors", "datatype_new", and
     "codatatype" has been renamed "plugins del: code".
     INCOMPATIBILITY.
   - The rules "set_empty" have been removed. They are easy
     consequences of other set rules "by auto".
     INCOMPATIBILITY.
   - The rule "set_cases" is now registered with the "[cases set]"
     attribute. This can influence the behavior of the "cases" proof
     method when more than one case rule is applicable (e.g., an
     assumption is of the form "w : set ws" and the method "cases w"
     is invoked). The solution is to specify the case rule explicitly
     (e.g. "cases w rule: widget.exhaust").
     INCOMPATIBILITY.
   - Renamed theories:
       BNF_Comp ~> BNF_Composition
       BNF_FP_Base ~> BNF_Fixpoint_Base
       BNF_GFP ~> BNF_Greatest_Fixpoint
       BNF_LFP ~> BNF_Least_Fixpoint
       BNF_Constructions_on_Wellorders ~> BNF_Wellorder_Constructions
       Cardinals/Constructions_on_Wellorders ~> Cardinals/Wellorder_Constructions
     INCOMPATIBILITY.
   - Lifting and Transfer setup for basic HOL types sum and prod (also
     option) is now performed by the BNF package. Theories Lifting_Sum,
     Lifting_Product and Lifting_Option from Main became obsolete and
     were removed. Changed definitions of the relators rel_prod and
     rel_sum (using inductive).
     INCOMPATIBILITY: use rel_prod.simps and rel_sum.simps instead
     of rel_prod_def and rel_sum_def.
     Minor INCOMPATIBILITY: (rarely used by name) transfer theorem names
     changed (e.g. map_prod_transfer ~> prod.map_transfer).
   - Parametricity theorems for map functions, relators, set functions,
     constructors, case combinators, discriminators, selectors and
     (co)recursors are automatically proved and registered as transfer
     rules.
 
 * Old datatype package:
   - The old 'datatype' command has been renamed 'old_datatype', and
     'rep_datatype' has been renamed 'old_rep_datatype'. They are
     provided by "~~/src/HOL/Library/Old_Datatype.thy". See
     'isabelle doc datatypes' for information on porting.
     INCOMPATIBILITY.
   - Renamed theorems:
       weak_case_cong ~> case_cong_weak
     INCOMPATIBILITY.
   - Renamed theory:
       ~~/src/HOL/Datatype.thy ~> ~~/src/HOL/Library/Old_Datatype.thy
     INCOMPATIBILITY.
 
 * Nitpick:
   - Fixed soundness bug related to the strict and non-strict subset
     operations.
 
 * Sledgehammer:
   - CVC4 is now included with Isabelle instead of CVC3 and run by
     default.
   - Z3 is now always enabled by default, now that it is fully open
     source. The "z3_non_commercial" option is discontinued.
   - Minimization is now always enabled by default.
     Removed sub-command:
       min
   - Proof reconstruction, both one-liners and Isar, has been
     dramatically improved.
   - Improved support for CVC4 and veriT.
 
 * Old and new SMT modules:
   - The old 'smt' method has been renamed 'old_smt' and moved to
     'src/HOL/Library/Old_SMT.thy'. It is provided for compatibility,
     until applications have been ported to use the new 'smt' method. For
     the method to work, an older version of Z3 (e.g. Z3 3.2 or 4.0) must
     be installed, and the environment variable "OLD_Z3_SOLVER" must
     point to it.
     INCOMPATIBILITY.
   - The 'smt2' method has been renamed 'smt'.
     INCOMPATIBILITY.
   - New option 'smt_reconstruction_step_timeout' to limit the
     reconstruction time of Z3 proof steps in the new 'smt' method.
   - New option 'smt_statistics' to display statistics of the new 'smt'
     method, especially runtime statistics of Z3 proof reconstruction.
 
 * Lifting: command 'lift_definition' allows to execute lifted constants
 that have as a return type a datatype containing a subtype. This
 overcomes long-time limitations in the area of code generation and
 lifting, and avoids tedious workarounds.
 
 * Command and antiquotation "value" provide different evaluation slots
 (again), where the previous strategy (NBE after ML) serves as default.
 Minor INCOMPATIBILITY.
 
 * Add NO_MATCH-simproc, allows to check for syntactic non-equality.
 
 * field_simps: Use NO_MATCH-simproc for distribution rules, to avoid
 non-termination in case of distributing a division. With this change
 field_simps is in some cases slightly less powerful, if it fails try to
 add algebra_simps, or use divide_simps. Minor INCOMPATIBILITY.
 
 * Separate class no_zero_divisors has been given up in favour of fully
 algebraic semiring_no_zero_divisors. INCOMPATIBILITY.
 
 * Class linordered_semidom really requires no zero divisors.
 INCOMPATIBILITY.
 
 * Classes division_ring, field and linordered_field always demand
 "inverse 0 = 0". Given up separate classes division_ring_inverse_zero,
 field_inverse_zero and linordered_field_inverse_zero. INCOMPATIBILITY.
 
 * Classes cancel_ab_semigroup_add / cancel_monoid_add specify explicit
 additive inverse operation. INCOMPATIBILITY.
 
 * Complex powers and square roots. The functions "ln" and "powr" are now
 overloaded for types real and complex, and 0 powr y = 0 by definition.
 INCOMPATIBILITY: type constraints may be necessary.
 
 * The functions "sin" and "cos" are now defined for any type of sort
 "{real_normed_algebra_1,banach}" type, so in particular on "real" and
 "complex" uniformly. Minor INCOMPATIBILITY: type constraints may be
 needed.
 
 * New library of properties of the complex transcendental functions sin,
 cos, tan, exp, Ln, Arctan, Arcsin, Arccos. Ported from HOL Light.
 
 * The factorial function, "fact", now has type "nat => 'a" (of a sort
 that admits numeric types including nat, int, real and complex.
 INCOMPATIBILITY: an expression such as "fact 3 = 6" may require a type
 constraint, and the combination "real (fact k)" is likely to be
 unsatisfactory. If a type conversion is still necessary, then use
 "of_nat (fact k)" or "real_of_nat (fact k)".
 
 * Removed functions "natfloor" and "natceiling", use "nat o floor" and
 "nat o ceiling" instead. A few of the lemmas have been retained and
 adapted: in their names "natfloor"/"natceiling" has been replaced by
 "nat_floor"/"nat_ceiling".
 
 * Qualified some duplicated fact names required for boostrapping the
 type class hierarchy:
   ab_add_uminus_conv_diff ~> diff_conv_add_uminus
   field_inverse_zero ~> inverse_zero
   field_divide_inverse ~> divide_inverse
   field_inverse ~> left_inverse
 Minor INCOMPATIBILITY.
 
 * Eliminated fact duplicates:
   mult_less_imp_less_right ~> mult_right_less_imp_less
   mult_less_imp_less_left ~> mult_left_less_imp_less
 Minor INCOMPATIBILITY.
 
 * Fact consolidation: even_less_0_iff is subsumed by
 double_add_less_zero_iff_single_add_less_zero (simp by default anyway).
 
 * Generalized and consolidated some theorems concerning divsibility:
   dvd_reduce ~> dvd_add_triv_right_iff
   dvd_plus_eq_right ~> dvd_add_right_iff
   dvd_plus_eq_left ~> dvd_add_left_iff
 Minor INCOMPATIBILITY.
 
 * "even" and "odd" are mere abbreviations for "2 dvd _" and "~ 2 dvd _"
 and part of theory Main.
   even_def ~> even_iff_mod_2_eq_zero
 INCOMPATIBILITY.
 
 * Lemma name consolidation: divide_Numeral1 ~> divide_numeral_1. Minor
 INCOMPATIBILITY.
 
 * Bootstrap of listsum as special case of abstract product over lists.
 Fact rename:
     listsum_def ~> listsum.eq_foldr
 INCOMPATIBILITY.
 
 * Product over lists via constant "listprod".
 
 * Theory List: renamed drop_Suc_conv_tl and nth_drop' to
 Cons_nth_drop_Suc.
 
 * New infrastructure for compiling, running, evaluating and testing
 generated code in target languages in HOL/Library/Code_Test. See
 HOL/Codegenerator_Test/Code_Test* for examples.
 
 * Library/Multiset:
   - Introduced "replicate_mset" operation.
   - Introduced alternative characterizations of the multiset ordering in
     "Library/Multiset_Order".
   - Renamed multiset ordering:
       <# ~> #<#
       <=# ~> #<=#
       \<subset># ~> #\<subset>#
       \<subseteq># ~> #\<subseteq>#
     INCOMPATIBILITY.
   - Introduced abbreviations for ill-named multiset operations:
       <#, \<subset># abbreviate < (strict subset)
       <=#, \<le>#, \<subseteq># abbreviate <= (subset or equal)
     INCOMPATIBILITY.
   - Renamed
       in_multiset_of ~> in_multiset_in_set
       Multiset.fold ~> fold_mset
       Multiset.filter ~> filter_mset
     INCOMPATIBILITY.
   - Removed mcard, is equal to size.
   - Added attributes:
       image_mset.id [simp]
       image_mset_id [simp]
       elem_multiset_of_set [simp, intro]
       comp_fun_commute_plus_mset [simp]
       comp_fun_commute.fold_mset_insert [OF comp_fun_commute_plus_mset, simp]
       in_mset_fold_plus_iff [iff]
       set_of_Union_mset [simp]
       in_Union_mset_iff [iff]
     INCOMPATIBILITY.
 
 * Library/Sum_of_Squares: simplified and improved "sos" method. Always
 use local CSDP executable, which is much faster than the NEOS server.
 The "sos_cert" functionality is invoked as "sos" with additional
 argument. Minor INCOMPATIBILITY.
 
 * HOL-Decision_Procs: New counterexample generator quickcheck
 [approximation] for inequalities of transcendental functions. Uses
 hardware floating point arithmetic to randomly discover potential
 counterexamples. Counterexamples are certified with the "approximation"
 method. See HOL/Decision_Procs/ex/Approximation_Quickcheck_Ex.thy for
 examples.
 
 * HOL-Probability: Reworked measurability prover
   - applies destructor rules repeatedly
   - removed application splitting (replaced by destructor rule)
   - added congruence rules to rewrite measure spaces under the sets
     projection
 
 * New proof method "rewrite" (in theory ~~/src/HOL/Library/Rewrite) for
 single-step rewriting with subterm selection based on patterns.
 
 
 *** ML ***
 
 * Subtle change of name space policy: undeclared entries are now
 considered inaccessible, instead of accessible via the fully-qualified
 internal name. This mainly affects Name_Space.intern (and derivatives),
 which may produce an unexpected Long_Name.hidden prefix. Note that
 contemporary applications use the strict Name_Space.check (and
 derivatives) instead, which is not affected by the change. Potential
 INCOMPATIBILITY in rare applications of Name_Space.intern.
 
 * Subtle change of error semantics of Toplevel.proof_of: regular user
 ERROR instead of internal Toplevel.UNDEF.
 
 * Basic combinators map, fold, fold_map, split_list, apply are available
 as parameterized antiquotations, e.g. @{map 4} for lists of quadruples.
 
 * Renamed "pairself" to "apply2", in accordance to @{apply 2}.
 INCOMPATIBILITY.
 
 * Former combinators NAMED_CRITICAL and CRITICAL for central critical
 sections have been discontinued, in favour of the more elementary
 Multithreading.synchronized and its high-level derivative
 Synchronized.var (which is usually sufficient in applications). Subtle
 INCOMPATIBILITY: synchronized access needs to be atomic and cannot be
 nested.
 
 * Synchronized.value (ML) is actually synchronized (as in Scala): subtle
 change of semantics with minimal potential for INCOMPATIBILITY.
 
 * The main operations to certify logical entities are Thm.ctyp_of and
 Thm.cterm_of with a local context; old-style global theory variants are
 available as Thm.global_ctyp_of and Thm.global_cterm_of.
 INCOMPATIBILITY.
 
 * Elementary operations in module Thm are no longer pervasive.
 INCOMPATIBILITY, need to use qualified Thm.prop_of, Thm.cterm_of,
 Thm.term_of etc.
 
 * Proper context for various elementary tactics: assume_tac,
 resolve_tac, eresolve_tac, dresolve_tac, forward_tac, match_tac,
 compose_tac, Splitter.split_tac etc. INCOMPATIBILITY.
 
 * Tactical PARALLEL_ALLGOALS is the most common way to refer to
 PARALLEL_GOALS.
 
 * Goal.prove_multi is superseded by the fully general Goal.prove_common,
 which also allows to specify a fork priority.
 
 * Antiquotation @{command_spec "COMMAND"} is superseded by
 @{command_keyword COMMAND} (usually without quotes and with PIDE
 markup). Minor INCOMPATIBILITY.
 
 * Cartouches within ML sources are turned into values of type
 Input.source (with formal position information).
 
 
 *** System ***
 
 * The Isabelle tool "update_cartouches" changes theory files to use
 cartouches instead of old-style {* verbatim *} or `alt_string` tokens.
 
 * The Isabelle tool "build" provides new options -X, -k, -x.
 
 * Discontinued old-fashioned "codegen" tool. Code generation can always
 be externally triggered using an appropriate ROOT file plus a
 corresponding theory. Parametrization is possible using environment
 variables, or ML snippets in the most extreme cases. Minor
 INCOMPATIBILITY.
 
 * JVM system property "isabelle.threads" determines size of Scala thread
 pool, like Isabelle system option "threads" for ML.
 
 * JVM system property "isabelle.laf" determines the default Swing
 look-and-feel, via internal class name or symbolic name as in the jEdit
 menu Global Options / Appearance.
 
 * Support for Proof General and Isar TTY loop has been discontinued.
 Minor INCOMPATIBILITY, use standard PIDE infrastructure instead.
 
 
 
 New in Isabelle2014 (August 2014)
 ---------------------------------
 
 *** General ***
 
 * Support for official Standard ML within the Isabelle context.
 Command 'SML_file' reads and evaluates the given Standard ML file.
 Toplevel bindings are stored within the theory context; the initial
 environment is restricted to the Standard ML implementation of
 Poly/ML, without the add-ons of Isabelle/ML.  Commands 'SML_import'
 and 'SML_export' allow to exchange toplevel bindings between the two
 separate environments.  See also ~~/src/Tools/SML/Examples.thy for
 some examples.
 
 * Standard tactics and proof methods such as "clarsimp", "auto" and
 "safe" now preserve equality hypotheses "x = expr" where x is a free
 variable.  Locale assumptions and chained facts containing "x"
 continue to be useful.  The new method "hypsubst_thin" and the
 configuration option "hypsubst_thin" (within the attribute name space)
 restore the previous behavior.  INCOMPATIBILITY, especially where
 induction is done after these methods or when the names of free and
 bound variables clash.  As first approximation, old proofs may be
 repaired by "using [[hypsubst_thin = true]]" in the critical spot.
 
 * More static checking of proof methods, which allows the system to
 form a closure over the concrete syntax.  Method arguments should be
 processed in the original proof context as far as possible, before
 operating on the goal state.  In any case, the standard discipline for
 subgoal-addressing needs to be observed: no subgoals or a subgoal
 number that is out of range produces an empty result sequence, not an
 exception.  Potential INCOMPATIBILITY for non-conformant tactical
 proof tools.
 
 * Lexical syntax (inner and outer) supports text cartouches with
 arbitrary nesting, and without escapes of quotes etc.  The Prover IDE
 supports input via ` (backquote).
 
 * The outer syntax categories "text" (for formal comments and document
 markup commands) and "altstring" (for literal fact references) allow
 cartouches as well, in addition to the traditional mix of quotations.
 
 * Syntax of document antiquotation @{rail} now uses \<newline> instead
 of "\\", to avoid the optical illusion of escaped backslash within
 string token.  General renovation of its syntax using text cartouches.
 Minor INCOMPATIBILITY.
 
 * Discontinued legacy_isub_isup, which was a temporary workaround for
 Isabelle/ML in Isabelle2013-1.  The prover process no longer accepts
 old identifier syntax with \<^isub> or \<^isup>.  Potential
 INCOMPATIBILITY.
 
 * Document antiquotation @{url} produces markup for the given URL,
 which results in an active hyperlink within the text.
 
 * Document antiquotation @{file_unchecked} is like @{file}, but does
 not check existence within the file-system.
 
 * Updated and extended manuals: codegen, datatypes, implementation,
 isar-ref, jedit, system.
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * Improved Document panel: simplified interaction where every single
 mouse click (re)opens document via desktop environment or as jEdit
 buffer.
 
 * Support for Navigator plugin (with toolbar buttons), with connection
 to PIDE hyperlinks.
 
 * Auxiliary files ('ML_file' etc.) are managed by the Prover IDE.
 Open text buffers take precedence over copies within the file-system.
 
 * Improved support for Isabelle/ML, with jEdit mode "isabelle-ml" for
 auxiliary ML files.
 
 * Improved syntactic and semantic completion mechanism, with simple
 templates, completion language context, name-space completion,
 file-name completion, spell-checker completion.
 
 * Refined GUI popup for completion: more robust key/mouse event
 handling and propagation to enclosing text area -- avoid loosing
 keystrokes with slow / remote graphics displays.
 
 * Completion popup supports both ENTER and TAB (default) to select an
 item, depending on Isabelle options.
 
 * Refined insertion of completion items wrt. jEdit text: multiple
 selections, rectangular selections, rectangular selection as "tall
 caret".
 
 * Integrated spell-checker for document text, comments etc. with
 completion popup and context-menu.
 
 * More general "Query" panel supersedes "Find" panel, with GUI access
 to commands 'find_theorems' and 'find_consts', as well as print
 operations for the context.  Minor incompatibility in keyboard
 shortcuts etc.: replace action isabelle-find by isabelle-query.
 
 * Search field for all output panels ("Output", "Query", "Info" etc.)
 to highlight text via regular expression.
 
 * Option "jedit_print_mode" (see also "Plugin Options / Isabelle /
 General") allows to specify additional print modes for the prover
 process, without requiring old-fashioned command-line invocation of
 "isabelle jedit -m MODE".
 
 * More support for remote files (e.g. http) using standard Java
 networking operations instead of jEdit virtual file-systems.
 
 * Empty editors buffers that are no longer required (e.g.\ via theory
 imports) are automatically removed from the document model.
 
 * Improved monitor panel.
 
 * Improved Console/Scala plugin: more uniform scala.Console output,
 more robust treatment of threads and interrupts.
 
 * Improved management of dockable windows: clarified keyboard focus
 and window placement wrt. main editor view; optional menu item to
 "Detach" a copy where this makes sense.
 
 * New Simplifier Trace panel provides an interactive view of the
 simplification process, enabled by the "simp_trace_new" attribute
 within the context.
 
 
 *** Pure ***
 
 * Low-level type-class commands 'classes', 'classrel', 'arities' have
 been discontinued to avoid the danger of non-trivial axiomatization
 that is not immediately visible.  INCOMPATIBILITY, use regular
 'instance' command with proof.  The required OFCLASS(...) theorem
 might be postulated via 'axiomatization' beforehand, or the proof
 finished trivially if the underlying class definition is made vacuous
 (without any assumptions).  See also Isabelle/ML operations
 Axclass.class_axiomatization, Axclass.classrel_axiomatization,
 Axclass.arity_axiomatization.
 
 * Basic constants of Pure use more conventional names and are always
 qualified.  Rare INCOMPATIBILITY, but with potentially serious
 consequences, notably for tools in Isabelle/ML.  The following
 renaming needs to be applied:
 
   ==             ~>  Pure.eq
   ==>            ~>  Pure.imp
   all            ~>  Pure.all
   TYPE           ~>  Pure.type
   dummy_pattern  ~>  Pure.dummy_pattern
 
 Systematic porting works by using the following theory setup on a
 *previous* Isabelle version to introduce the new name accesses for the
 old constants:
 
 setup {*
   fn thy => thy
     |> Sign.root_path
     |> Sign.const_alias (Binding.qualify true "Pure" @{binding eq}) "=="
     |> Sign.const_alias (Binding.qualify true "Pure" @{binding imp}) "==>"
     |> Sign.const_alias (Binding.qualify true "Pure" @{binding all}) "all"
     |> Sign.restore_naming thy
 *}
 
 Thus ML antiquotations like @{const_name Pure.eq} may be used already.
 Later the application is moved to the current Isabelle version, and
 the auxiliary aliases are deleted.
 
 * Attributes "where" and "of" allow an optional context of local
 variables ('for' declaration): these variables become schematic in the
 instantiated theorem.
 
 * Obsolete attribute "standard" has been discontinued (legacy since
 Isabelle2012).  Potential INCOMPATIBILITY, use explicit 'for' context
 where instantiations with schematic variables are intended (for
 declaration commands like 'lemmas' or attributes like "of").  The
 following temporary definition may help to port old applications:
 
   attribute_setup standard =
     "Scan.succeed (Thm.rule_attribute (K Drule.export_without_context))"
 
 * More thorough check of proof context for goal statements and
 attributed fact expressions (concerning background theory, declared
 hyps).  Potential INCOMPATIBILITY, tools need to observe standard
 context discipline.  See also Assumption.add_assumes and the more
 primitive Thm.assume_hyps.
 
 * Inner syntax token language allows regular quoted strings "..."
 (only makes sense in practice, if outer syntax is delimited
 differently, e.g. via cartouches).
 
 * Command 'print_term_bindings' supersedes 'print_binds' for clarity,
 but the latter is retained some time as Proof General legacy.
 
 * Code generator preprocessor: explicit control of simp tracing on a
 per-constant basis.  See attribute "code_preproc".
 
 
 *** HOL ***
 
 * Code generator: enforce case of identifiers only for strict target
 language requirements.  INCOMPATIBILITY.
 
 * Code generator: explicit proof contexts in many ML interfaces.
 INCOMPATIBILITY.
 
 * Code generator: minimize exported identifiers by default.  Minor
 INCOMPATIBILITY.
 
 * Code generation for SML and OCaml: dropped arcane "no_signatures"
 option.  Minor INCOMPATIBILITY.
 
 * "declare [[code abort: ...]]" replaces "code_abort ...".
 INCOMPATIBILITY.
 
 * "declare [[code drop: ...]]" drops all code equations associated
 with the given constants.
 
 * Code generations are provided for make, fields, extend and truncate
 operations on records.
 
 * Command and antiquotation "value" are now hardcoded against nbe and
 ML.  Minor INCOMPATIBILITY.
 
 * Renamed command 'enriched_type' to 'functor'. INCOMPATIBILITY.
 
 * The symbol "\<newline>" may be used within char or string literals
 to represent (Char Nibble0 NibbleA), i.e. ASCII newline.
 
 * Qualified String.implode and String.explode.  INCOMPATIBILITY.
 
 * Simplifier: Enhanced solver of preconditions of rewrite rules can
 now deal with conjunctions.  For help with converting proofs, the old
 behaviour of the simplifier can be restored like this: declare/using
 [[simp_legacy_precond]].  This configuration option will disappear
 again in the future.  INCOMPATIBILITY.
 
 * Simproc "finite_Collect" is no longer enabled by default, due to
 spurious crashes and other surprises.  Potential INCOMPATIBILITY.
 
 * Moved new (co)datatype package and its dependencies from session
   "HOL-BNF" to "HOL".  The commands 'bnf', 'wrap_free_constructors',
   'datatype_new', 'codatatype', 'primcorec', 'primcorecursive' are now
   part of theory "Main".
 
   Theory renamings:
     FunDef.thy ~> Fun_Def.thy (and Fun_Def_Base.thy)
     Library/Wfrec.thy ~> Wfrec.thy
     Library/Zorn.thy ~> Zorn.thy
     Cardinals/Order_Relation.thy ~> Order_Relation.thy
     Library/Order_Union.thy ~> Cardinals/Order_Union.thy
     Cardinals/Cardinal_Arithmetic_Base.thy ~> BNF_Cardinal_Arithmetic.thy
     Cardinals/Cardinal_Order_Relation_Base.thy ~> BNF_Cardinal_Order_Relation.thy
     Cardinals/Constructions_on_Wellorders_Base.thy ~> BNF_Constructions_on_Wellorders.thy
     Cardinals/Wellorder_Embedding_Base.thy ~> BNF_Wellorder_Embedding.thy
     Cardinals/Wellorder_Relation_Base.thy ~> BNF_Wellorder_Relation.thy
     BNF/Ctr_Sugar.thy ~> Ctr_Sugar.thy
     BNF/Basic_BNFs.thy ~> Basic_BNFs.thy
     BNF/BNF_Comp.thy ~> BNF_Comp.thy
     BNF/BNF_Def.thy ~> BNF_Def.thy
     BNF/BNF_FP_Base.thy ~> BNF_FP_Base.thy
     BNF/BNF_GFP.thy ~> BNF_GFP.thy
     BNF/BNF_LFP.thy ~> BNF_LFP.thy
     BNF/BNF_Util.thy ~> BNF_Util.thy
     BNF/Coinduction.thy ~> Coinduction.thy
     BNF/More_BNFs.thy ~> Library/More_BNFs.thy
     BNF/Countable_Type.thy ~> Library/Countable_Set_Type.thy
     BNF/Examples/* ~> BNF_Examples/*
 
   New theories:
     Wellorder_Extension.thy (split from Zorn.thy)
     Library/Cardinal_Notations.thy
     Library/BNF_Axomatization.thy
     BNF_Examples/Misc_Primcorec.thy
     BNF_Examples/Stream_Processor.thy
 
   Discontinued theories:
     BNF/BNF.thy
     BNF/Equiv_Relations_More.thy
 
 INCOMPATIBILITY.
 
 * New (co)datatype package:
   - Command 'primcorec' is fully implemented.
   - Command 'datatype_new' generates size functions ("size_xxx" and
     "size") as required by 'fun'.
   - BNFs are integrated with the Lifting tool and new-style
     (co)datatypes with Transfer.
   - Renamed commands:
       datatype_new_compat ~> datatype_compat
       primrec_new ~> primrec
       wrap_free_constructors ~> free_constructors
     INCOMPATIBILITY.
   - The generated constants "xxx_case" and "xxx_rec" have been renamed
     "case_xxx" and "rec_xxx" (e.g., "prod_case" ~> "case_prod").
     INCOMPATIBILITY.
   - The constant "xxx_(un)fold" and related theorems are no longer
     generated.  Use "xxx_(co)rec" or define "xxx_(un)fold" manually
     using "prim(co)rec".
     INCOMPATIBILITY.
   - No discriminators are generated for nullary constructors by
     default, eliminating the need for the odd "=:" syntax.
     INCOMPATIBILITY.
   - No discriminators or selectors are generated by default by
     "datatype_new", unless custom names are specified or the new
     "discs_sels" option is passed.
     INCOMPATIBILITY.
 
 * Old datatype package:
   - The generated theorems "xxx.cases" and "xxx.recs" have been
     renamed "xxx.case" and "xxx.rec" (e.g., "sum.cases" ->
     "sum.case").  INCOMPATIBILITY.
   - The generated constants "xxx_case", "xxx_rec", and "xxx_size" have
     been renamed "case_xxx", "rec_xxx", and "size_xxx" (e.g.,
     "prod_case" ~> "case_prod").  INCOMPATIBILITY.
 
 * The types "'a list" and "'a option", their set and map functions,
   their relators, and their selectors are now produced using the new
   BNF-based datatype package.
 
   Renamed constants:
     Option.set ~> set_option
     Option.map ~> map_option
     option_rel ~> rel_option
 
   Renamed theorems:
     set_def ~> set_rec[abs_def]
     map_def ~> map_rec[abs_def]
     Option.map_def ~> map_option_case[abs_def] (with "case_option" instead of "rec_option")
     option.recs ~> option.rec
     list_all2_def ~> list_all2_iff
     set.simps ~> set_simps (or the slightly different "list.set")
     map.simps ~> list.map
     hd.simps ~> list.sel(1)
     tl.simps ~> list.sel(2-3)
     the.simps ~> option.sel
 
 INCOMPATIBILITY.
 
 * The following map functions and relators have been renamed:
     sum_map ~> map_sum
     map_pair ~> map_prod
     prod_rel ~> rel_prod
     sum_rel ~> rel_sum
     fun_rel ~> rel_fun
     set_rel ~> rel_set
     filter_rel ~> rel_filter
     fset_rel ~> rel_fset (in "src/HOL/Library/FSet.thy")
     cset_rel ~> rel_cset (in "src/HOL/Library/Countable_Set_Type.thy")
     vset ~> rel_vset (in "src/HOL/Library/Quotient_Set.thy")
 
 INCOMPATIBILITY.
 
 * Lifting and Transfer:
   - a type variable as a raw type is supported
   - stronger reflexivity prover
   - rep_eq is always generated by lift_definition
   - setup for Lifting/Transfer is now automated for BNFs
     + holds for BNFs that do not contain a dead variable
     + relator_eq, relator_mono, relator_distr, relator_domain,
       relator_eq_onp, quot_map, transfer rules for bi_unique, bi_total,
       right_unique, right_total, left_unique, left_total are proved
       automatically
     + definition of a predicator is generated automatically
     + simplification rules for a predicator definition are proved
       automatically for datatypes
   - consolidation of the setup of Lifting/Transfer
     + property that a relator preservers reflexivity is not needed any
       more
       Minor INCOMPATIBILITY.
     + left_total and left_unique rules are now transfer rules
       (reflexivity_rule attribute not needed anymore)
       INCOMPATIBILITY.
     + Domainp does not have to be a separate assumption in
       relator_domain theorems (=> more natural statement)
       INCOMPATIBILITY.
   - registration of code equations is more robust
     Potential INCOMPATIBILITY.
   - respectfulness proof obligation is preprocessed to a more readable
     form
     Potential INCOMPATIBILITY.
   - eq_onp is always unfolded in respectfulness proof obligation
     Potential INCOMPATIBILITY.
   - unregister lifting setup for Code_Numeral.integer and
     Code_Numeral.natural
     Potential INCOMPATIBILITY.
   - Lifting.invariant -> eq_onp
     INCOMPATIBILITY.
 
 * New internal SAT solver "cdclite" that produces models and proof
 traces.  This solver replaces the internal SAT solvers "enumerate" and
 "dpll".  Applications that explicitly used one of these two SAT
 solvers should use "cdclite" instead. In addition, "cdclite" is now
 the default SAT solver for the "sat" and "satx" proof methods and
 corresponding tactics; the old default can be restored using "declare
 [[sat_solver = zchaff_with_proofs]]".  Minor INCOMPATIBILITY.
 
 * SMT module: A new version of the SMT module, temporarily called
 "SMT2", uses SMT-LIB 2 and supports recent versions of Z3 (e.g.,
 4.3). The new proof method is called "smt2". CVC3 and CVC4 are also
 supported as oracles. Yices is no longer supported, because no version
 of the solver can handle both SMT-LIB 2 and quantifiers.
 
 * Activation of Z3 now works via "z3_non_commercial" system option
 (without requiring restart), instead of former settings variable
 "Z3_NON_COMMERCIAL".  The option can be edited in Isabelle/jEdit menu
 Plugin Options / Isabelle / General.
 
 * Sledgehammer:
   - Z3 can now produce Isar proofs.
   - MaSh overhaul:
     . New SML-based learning algorithms eliminate the dependency on
       Python and increase performance and reliability.
     . MaSh and MeSh are now used by default together with the
       traditional MePo (Meng-Paulson) relevance filter. To disable
       MaSh, set the "MaSh" system option in Isabelle/jEdit Plugin
       Options / Isabelle / General to "none".
   - New option:
       smt_proofs
   - Renamed options:
       isar_compress ~> compress
       isar_try0 ~> try0
 
 INCOMPATIBILITY.
 
 * Removed solvers remote_cvc3 and remote_z3. Use cvc3 and z3 instead.
 
 * Nitpick:
   - Fixed soundness bug whereby mutually recursive datatypes could
     take infinite values.
   - Fixed soundness bug with low-level number functions such as
     "Abs_Integ" and "Rep_Integ".
   - Removed "std" option.
   - Renamed "show_datatypes" to "show_types" and "hide_datatypes" to
     "hide_types".
 
 * Metis: Removed legacy proof method 'metisFT'. Use 'metis
 (full_types)' instead. INCOMPATIBILITY.
 
 * Try0: Added 'algebra' and 'meson' to the set of proof methods.
 
 * Adjustion of INF and SUP operations:
   - Elongated constants INFI and SUPR to INFIMUM and SUPREMUM.
   - Consolidated theorem names containing INFI and SUPR: have INF and
     SUP instead uniformly.
   - More aggressive normalization of expressions involving INF and Inf
     or SUP and Sup.
   - INF_image and SUP_image do not unfold composition.
   - Dropped facts INF_comp, SUP_comp.
   - Default congruence rules strong_INF_cong and strong_SUP_cong, with
     simplifier implication in premises.  Generalize and replace former
     INT_cong, SUP_cong
 
 INCOMPATIBILITY.
 
 * SUP and INF generalized to conditionally_complete_lattice.
 
 * Swapped orientation of facts image_comp and vimage_comp:
 
   image_compose ~> image_comp [symmetric]
   image_comp ~> image_comp [symmetric]
   vimage_compose ~> vimage_comp [symmetric]
   vimage_comp ~> vimage_comp [symmetric]
 
 INCOMPATIBILITY.
 
 * Theory reorganization: split of Big_Operators.thy into
 Groups_Big.thy and Lattices_Big.thy.
 
 * Consolidated some facts about big group operators:
 
     setsum_0' ~> setsum.neutral
     setsum_0 ~> setsum.neutral_const
     setsum_addf ~> setsum.distrib
     setsum_cartesian_product ~> setsum.cartesian_product
     setsum_cases ~> setsum.If_cases
     setsum_commute ~> setsum.commute
     setsum_cong ~> setsum.cong
     setsum_delta ~> setsum.delta
     setsum_delta' ~> setsum.delta'
     setsum_diff1' ~> setsum.remove
     setsum_empty ~> setsum.empty
     setsum_infinite ~> setsum.infinite
     setsum_insert ~> setsum.insert
     setsum_inter_restrict'' ~> setsum.inter_filter
     setsum_mono_zero_cong_left ~> setsum.mono_neutral_cong_left
     setsum_mono_zero_cong_right ~> setsum.mono_neutral_cong_right
     setsum_mono_zero_left ~> setsum.mono_neutral_left
     setsum_mono_zero_right ~> setsum.mono_neutral_right
     setsum_reindex ~> setsum.reindex
     setsum_reindex_cong ~> setsum.reindex_cong
     setsum_reindex_nonzero ~> setsum.reindex_nontrivial
     setsum_restrict_set ~> setsum.inter_restrict
     setsum_Plus ~> setsum.Plus
     setsum_setsum_restrict ~> setsum.commute_restrict
     setsum_Sigma ~> setsum.Sigma
     setsum_subset_diff ~> setsum.subset_diff
     setsum_Un_disjoint ~> setsum.union_disjoint
     setsum_UN_disjoint ~> setsum.UNION_disjoint
     setsum_Un_Int ~> setsum.union_inter
     setsum_Union_disjoint ~> setsum.Union_disjoint
     setsum_UNION_zero ~> setsum.Union_comp
     setsum_Un_zero ~> setsum.union_inter_neutral
     strong_setprod_cong ~> setprod.strong_cong
     strong_setsum_cong ~> setsum.strong_cong
     setprod_1' ~> setprod.neutral
     setprod_1 ~> setprod.neutral_const
     setprod_cartesian_product ~> setprod.cartesian_product
     setprod_cong ~> setprod.cong
     setprod_delta ~> setprod.delta
     setprod_delta' ~> setprod.delta'
     setprod_empty ~> setprod.empty
     setprod_infinite ~> setprod.infinite
     setprod_insert ~> setprod.insert
     setprod_mono_one_cong_left ~> setprod.mono_neutral_cong_left
     setprod_mono_one_cong_right ~> setprod.mono_neutral_cong_right
     setprod_mono_one_left ~> setprod.mono_neutral_left
     setprod_mono_one_right ~> setprod.mono_neutral_right
     setprod_reindex ~> setprod.reindex
     setprod_reindex_cong ~> setprod.reindex_cong
     setprod_reindex_nonzero ~> setprod.reindex_nontrivial
     setprod_Sigma ~> setprod.Sigma
     setprod_subset_diff ~> setprod.subset_diff
     setprod_timesf ~> setprod.distrib
     setprod_Un2 ~> setprod.union_diff2
     setprod_Un_disjoint ~> setprod.union_disjoint
     setprod_UN_disjoint ~> setprod.UNION_disjoint
     setprod_Un_Int ~> setprod.union_inter
     setprod_Union_disjoint ~> setprod.Union_disjoint
     setprod_Un_one ~> setprod.union_inter_neutral
 
   Dropped setsum_cong2 (simple variant of setsum.cong).
   Dropped setsum_inter_restrict' (simple variant of setsum.inter_restrict)
   Dropped setsum_reindex_id, setprod_reindex_id
     (simple variants of setsum.reindex [symmetric], setprod.reindex [symmetric]).
 
 INCOMPATIBILITY.
 
 * Abolished slightly odd global lattice interpretation for min/max.
 
   Fact consolidations:
     min_max.inf_assoc ~> min.assoc
     min_max.inf_commute ~> min.commute
     min_max.inf_left_commute ~> min.left_commute
     min_max.inf_idem ~> min.idem
     min_max.inf_left_idem ~> min.left_idem
     min_max.inf_right_idem ~> min.right_idem
     min_max.sup_assoc ~> max.assoc
     min_max.sup_commute ~> max.commute
     min_max.sup_left_commute ~> max.left_commute
     min_max.sup_idem ~> max.idem
     min_max.sup_left_idem ~> max.left_idem
     min_max.sup_inf_distrib1 ~> max_min_distrib2
     min_max.sup_inf_distrib2 ~> max_min_distrib1
     min_max.inf_sup_distrib1 ~> min_max_distrib2
     min_max.inf_sup_distrib2 ~> min_max_distrib1
     min_max.distrib ~> min_max_distribs
     min_max.inf_absorb1 ~> min.absorb1
     min_max.inf_absorb2 ~> min.absorb2
     min_max.sup_absorb1 ~> max.absorb1
     min_max.sup_absorb2 ~> max.absorb2
     min_max.le_iff_inf ~> min.absorb_iff1
     min_max.le_iff_sup ~> max.absorb_iff2
     min_max.inf_le1 ~> min.cobounded1
     min_max.inf_le2 ~> min.cobounded2
     le_maxI1, min_max.sup_ge1 ~> max.cobounded1
     le_maxI2, min_max.sup_ge2 ~> max.cobounded2
     min_max.le_infI1 ~> min.coboundedI1
     min_max.le_infI2 ~> min.coboundedI2
     min_max.le_supI1 ~> max.coboundedI1
     min_max.le_supI2 ~> max.coboundedI2
     min_max.less_infI1 ~> min.strict_coboundedI1
     min_max.less_infI2 ~> min.strict_coboundedI2
     min_max.less_supI1 ~> max.strict_coboundedI1
     min_max.less_supI2 ~> max.strict_coboundedI2
     min_max.inf_mono ~> min.mono
     min_max.sup_mono ~> max.mono
     min_max.le_infI, min_max.inf_greatest ~> min.boundedI
     min_max.le_supI, min_max.sup_least ~> max.boundedI
     min_max.le_inf_iff ~> min.bounded_iff
     min_max.le_sup_iff ~> max.bounded_iff
 
 For min_max.inf_sup_aci, prefer (one of) min.commute, min.assoc,
 min.left_commute, min.left_idem, max.commute, max.assoc,
 max.left_commute, max.left_idem directly.
 
 For min_max.inf_sup_ord, prefer (one of) min.cobounded1,
 min.cobounded2, max.cobounded1m max.cobounded2 directly.
 
 For min_ac or max_ac, prefer more general collection ac_simps.
 
 INCOMPATIBILITY.
 
 * Theorem disambiguation Inf_le_Sup (on finite sets) ~>
 Inf_fin_le_Sup_fin.  INCOMPATIBILITY.
 
 * Qualified constant names Wellfounded.acc, Wellfounded.accp.
 INCOMPATIBILITY.
 
 * Fact generalization and consolidation:
     neq_one_mod_two, mod_2_not_eq_zero_eq_one_int ~> not_mod_2_eq_0_eq_1
 
 INCOMPATIBILITY.
 
 * Purely algebraic definition of even.  Fact generalization and
   consolidation:
     nat_even_iff_2_dvd, int_even_iff_2_dvd ~> even_iff_2_dvd
     even_zero_(nat|int) ~> even_zero
 
 INCOMPATIBILITY.
 
 * Abolished neg_numeral.
   - Canonical representation for minus one is "- 1".
   - Canonical representation for other negative numbers is "- (numeral _)".
   - When devising rule sets for number calculation, consider the
     following canonical cases: 0, 1, numeral _, - 1, - numeral _.
   - HOLogic.dest_number also recognizes numerals in non-canonical forms
     like "numeral One", "- numeral One", "- 0" and even "- ... - _".
   - Syntax for negative numerals is mere input syntax.
 
 INCOMPATIBILITY.
 
 * Reduced name variants for rules on associativity and commutativity:
 
     add_assoc ~> add.assoc
     add_commute ~> add.commute
     add_left_commute ~> add.left_commute
     mult_assoc ~> mult.assoc
     mult_commute ~> mult.commute
     mult_left_commute ~> mult.left_commute
     nat_add_assoc ~> add.assoc
     nat_add_commute ~> add.commute
     nat_add_left_commute ~> add.left_commute
     nat_mult_assoc ~> mult.assoc
     nat_mult_commute ~> mult.commute
     eq_assoc ~> iff_assoc
     eq_left_commute ~> iff_left_commute
 
 INCOMPATIBILITY.
 
 * Fact collections add_ac and mult_ac are considered old-fashioned.
 Prefer ac_simps instead, or specify rules
 (add|mult).(assoc|commute|left_commute) individually.
 
 * Elimination of fact duplicates:
     equals_zero_I ~> minus_unique
     diff_eq_0_iff_eq ~> right_minus_eq
     nat_infinite ~> infinite_UNIV_nat
     int_infinite ~> infinite_UNIV_int
 
 INCOMPATIBILITY.
 
 * Fact name consolidation:
     diff_def, diff_minus, ab_diff_minus ~> diff_conv_add_uminus
     minus_le_self_iff ~> neg_less_eq_nonneg
     le_minus_self_iff ~> less_eq_neg_nonpos
     neg_less_nonneg ~> neg_less_pos
     less_minus_self_iff ~> less_neg_neg [simp]
 
 INCOMPATIBILITY.
 
 * More simplification rules on unary and binary minus:
 add_diff_cancel, add_diff_cancel_left, add_le_same_cancel1,
 add_le_same_cancel2, add_less_same_cancel1, add_less_same_cancel2,
 add_minus_cancel, diff_add_cancel, le_add_same_cancel1,
 le_add_same_cancel2, less_add_same_cancel1, less_add_same_cancel2,
 minus_add_cancel, uminus_add_conv_diff.  These correspondingly have
 been taken away from fact collections algebra_simps and field_simps.
 INCOMPATIBILITY.
 
 To restore proofs, the following patterns are helpful:
 
 a) Arbitrary failing proof not involving "diff_def":
 Consider simplification with algebra_simps or field_simps.
 
 b) Lifting rules from addition to subtraction:
 Try with "using <rule for addition> of [... "- _" ...]" by simp".
 
 c) Simplification with "diff_def": just drop "diff_def".
 Consider simplification with algebra_simps or field_simps;
 or the brute way with
 "simp add: diff_conv_add_uminus del: add_uminus_conv_diff".
 
 * Introduce bdd_above and bdd_below in theory
 Conditionally_Complete_Lattices, use them instead of explicitly
 stating boundedness of sets.
 
 * ccpo.admissible quantifies only over non-empty chains to allow more
 syntax-directed proof rules; the case of the empty chain shows up as
 additional case in fixpoint induction proofs.  INCOMPATIBILITY.
 
 * Removed and renamed theorems in Series:
   summable_le         ~>  suminf_le
   suminf_le           ~>  suminf_le_const
   series_pos_le       ~>  setsum_le_suminf
   series_pos_less     ~>  setsum_less_suminf
   suminf_ge_zero      ~>  suminf_nonneg
   suminf_gt_zero      ~>  suminf_pos
   suminf_gt_zero_iff  ~>  suminf_pos_iff
   summable_sumr_LIMSEQ_suminf  ~>  summable_LIMSEQ
   suminf_0_le         ~>  suminf_nonneg [rotate]
   pos_summable        ~>  summableI_nonneg_bounded
   ratio_test          ~>  summable_ratio_test
 
   removed series_zero, replaced by sums_finite
 
   removed auxiliary lemmas:
 
     sumr_offset, sumr_offset2, sumr_offset3, sumr_offset4, sumr_group,
     half, le_Suc_ex_iff, lemma_realpow_diff_sumr,
     real_setsum_nat_ivl_bounded, summable_le2, ratio_test_lemma2,
     sumr_minus_one_realpow_zerom, sumr_one_lb_realpow_zero,
     summable_convergent_sumr_iff, sumr_diff_mult_const
 
 INCOMPATIBILITY.
 
 * Replace (F)DERIV syntax by has_derivative:
   - "(f has_derivative f') (at x within s)" replaces "FDERIV f x : s : f'"
 
   - "(f has_field_derivative f') (at x within s)" replaces "DERIV f x : s : f'"
 
   - "f differentiable at x within s" replaces "_ differentiable _ in _" syntax
 
   - removed constant isDiff
 
   - "DERIV f x : f'" and "FDERIV f x : f'" syntax is only available as
     input syntax.
 
   - "DERIV f x : s : f'" and "FDERIV f x : s : f'" syntax removed.
 
   - Renamed FDERIV_... lemmas to has_derivative_...
 
   - renamed deriv (the syntax constant used for "DERIV _ _ :> _") to DERIV
 
   - removed DERIV_intros, has_derivative_eq_intros
 
   - introduced derivative_intros and deriative_eq_intros which
     includes now rules for DERIV, has_derivative and
     has_vector_derivative.
 
   - Other renamings:
     differentiable_def        ~>  real_differentiable_def
     differentiableE           ~>  real_differentiableE
     fderiv_def                ~>  has_derivative_at
     field_fderiv_def          ~>  field_has_derivative_at
     isDiff_der                ~>  differentiable_def
     deriv_fderiv              ~>  has_field_derivative_def
     deriv_def                 ~>  DERIV_def
 
 INCOMPATIBILITY.
 
 * Include more theorems in continuous_intros. Remove the
 continuous_on_intros, isCont_intros collections, these facts are now
 in continuous_intros.
 
 * Theorems about complex numbers are now stated only using Re and Im,
 the Complex constructor is not used anymore. It is possible to use
 primcorec to defined the behaviour of a complex-valued function.
 
 Removed theorems about the Complex constructor from the simpset, they
 are available as the lemma collection legacy_Complex_simps. This
 especially removes
 
     i_complex_of_real: "ii * complex_of_real r = Complex 0 r".
 
 Instead the reverse direction is supported with
     Complex_eq: "Complex a b = a + \<i> * b"
 
 Moved csqrt from Fundamental_Algebra_Theorem to Complex.
 
   Renamings:
     Re/Im                  ~>  complex.sel
     complex_Re/Im_zero     ~>  zero_complex.sel
     complex_Re/Im_add      ~>  plus_complex.sel
     complex_Re/Im_minus    ~>  uminus_complex.sel
     complex_Re/Im_diff     ~>  minus_complex.sel
     complex_Re/Im_one      ~>  one_complex.sel
     complex_Re/Im_mult     ~>  times_complex.sel
     complex_Re/Im_inverse  ~>  inverse_complex.sel
     complex_Re/Im_scaleR   ~>  scaleR_complex.sel
     complex_Re/Im_i        ~>  ii.sel
     complex_Re/Im_cnj      ~>  cnj.sel
     Re/Im_cis              ~>  cis.sel
 
     complex_divide_def   ~>  divide_complex_def
     complex_norm_def     ~>  norm_complex_def
     cmod_def             ~>  norm_complex_de
 
   Removed theorems:
     complex_zero_def
     complex_add_def
     complex_minus_def
     complex_diff_def
     complex_one_def
     complex_mult_def
     complex_inverse_def
     complex_scaleR_def
 
 INCOMPATIBILITY.
 
 * Theory Lubs moved HOL image to HOL-Library. It is replaced by
 Conditionally_Complete_Lattices.  INCOMPATIBILITY.
 
 * HOL-Library: new theory src/HOL/Library/Tree.thy.
 
 * HOL-Library: removed theory src/HOL/Library/Kleene_Algebra.thy; it
 is subsumed by session Kleene_Algebra in AFP.
 
 * HOL-Library / theory RBT: various constants and facts are hidden;
 lifting setup is unregistered.  INCOMPATIBILITY.
 
 * HOL-Cardinals: new theory src/HOL/Cardinals/Ordinal_Arithmetic.thy.
 
 * HOL-Word: bit representations prefer type bool over type bit.
 INCOMPATIBILITY.
 
 * HOL-Word:
   - Abandoned fact collection "word_arith_alts", which is a duplicate
     of "word_arith_wis".
   - Dropped first (duplicated) element in fact collections
     "sint_word_ariths", "word_arith_alts", "uint_word_ariths",
     "uint_word_arith_bintrs".
 
 * HOL-Number_Theory:
   - consolidated the proofs of the binomial theorem
   - the function fib is again of type nat => nat and not overloaded
   - no more references to Old_Number_Theory in the HOL libraries
     (except the AFP)
 
 INCOMPATIBILITY.
 
 * HOL-Multivariate_Analysis:
   - Type class ordered_real_vector for ordered vector spaces.
   - New theory Complex_Basic_Analysis defining complex derivatives,
     holomorphic functions, etc., ported from HOL Light's canal.ml.
   - Changed order of ordered_euclidean_space to be compatible with
     pointwise ordering on products. Therefore instance of
     conditionally_complete_lattice and ordered_real_vector.
     INCOMPATIBILITY: use box instead of greaterThanLessThan or
     explicit set-comprehensions with eucl_less for other (half-)open
     intervals.
   - removed dependencies on type class ordered_euclidean_space with
     introduction of "cbox" on euclidean_space
     - renamed theorems:
         interval ~> box
         mem_interval ~> mem_box
         interval_eq_empty ~> box_eq_empty
         interval_ne_empty ~> box_ne_empty
         interval_sing(1) ~> cbox_sing
         interval_sing(2) ~> box_sing
         subset_interval_imp ~> subset_box_imp
         subset_interval ~> subset_box
         open_interval ~> open_box
         closed_interval ~> closed_cbox
         interior_closed_interval ~> interior_cbox
         bounded_closed_interval ~> bounded_cbox
         compact_interval ~> compact_cbox
         bounded_subset_closed_interval_symmetric ~> bounded_subset_cbox_symmetric
         bounded_subset_closed_interval ~> bounded_subset_cbox
         mem_interval_componentwiseI ~> mem_box_componentwiseI
         convex_box ~> convex_prod
         rel_interior_real_interval ~> rel_interior_real_box
         convex_interval ~> convex_box
         convex_hull_eq_real_interval ~> convex_hull_eq_real_cbox
         frechet_derivative_within_closed_interval ~> frechet_derivative_within_cbox
         content_closed_interval' ~> content_cbox'
         elementary_subset_interval ~> elementary_subset_box
         diameter_closed_interval ~> diameter_cbox
         frontier_closed_interval ~> frontier_cbox
         frontier_open_interval ~> frontier_box
         bounded_subset_open_interval_symmetric ~> bounded_subset_box_symmetric
         closure_open_interval ~> closure_box
         open_closed_interval_convex ~> open_cbox_convex
         open_interval_midpoint ~> box_midpoint
         content_image_affinity_interval ~> content_image_affinity_cbox
         is_interval_interval ~> is_interval_cbox + is_interval_box + is_interval_closed_interval
         bounded_interval ~> bounded_closed_interval + bounded_boxes
 
     - respective theorems for intervals over the reals:
         content_closed_interval + content_cbox
         has_integral + has_integral_real
         fine_division_exists + fine_division_exists_real
         has_integral_null + has_integral_null_real
         tagged_division_union_interval + tagged_division_union_interval_real
         has_integral_const + has_integral_const_real
         integral_const + integral_const_real
         has_integral_bound + has_integral_bound_real
         integrable_continuous + integrable_continuous_real
         integrable_subinterval + integrable_subinterval_real
         has_integral_reflect_lemma + has_integral_reflect_lemma_real
         integrable_reflect + integrable_reflect_real
         integral_reflect + integral_reflect_real
         image_affinity_interval + image_affinity_cbox
         image_smult_interval + image_smult_cbox
         integrable_const + integrable_const_ivl
         integrable_on_subinterval + integrable_on_subcbox
 
   - renamed theorems:
     derivative_linear         ~>  has_derivative_bounded_linear
     derivative_is_linear      ~>  has_derivative_linear
     bounded_linear_imp_linear ~>  bounded_linear.linear
 
 * HOL-Probability:
   - Renamed positive_integral to nn_integral:
 
     . Renamed all lemmas "*positive_integral*" to *nn_integral*"
       positive_integral_positive ~> nn_integral_nonneg
 
     . Renamed abbreviation integral\<^sup>P to integral\<^sup>N.
 
   - replaced the Lebesgue integral on real numbers by the more general
     Bochner integral for functions into a real-normed vector space.
 
     integral_zero               ~>  integral_zero / integrable_zero
     integral_minus              ~>  integral_minus / integrable_minus
     integral_add                ~>  integral_add / integrable_add
     integral_diff               ~>  integral_diff / integrable_diff
     integral_setsum             ~>  integral_setsum / integrable_setsum
     integral_multc              ~>  integral_mult_left / integrable_mult_left
     integral_cmult              ~>  integral_mult_right / integrable_mult_right
     integral_triangle_inequality~>  integral_norm_bound
     integrable_nonneg           ~>  integrableI_nonneg
     integral_positive           ~>  integral_nonneg_AE
     integrable_abs_iff          ~>  integrable_abs_cancel
     positive_integral_lim_INF   ~>  nn_integral_liminf
     lebesgue_real_affine        ~>  lborel_real_affine
     borel_integral_has_integral ~>  has_integral_lebesgue_integral
     integral_indicator          ~>
          integral_real_indicator / integrable_real_indicator
     positive_integral_fst       ~>  nn_integral_fst'
     positive_integral_fst_measurable ~> nn_integral_fst
     positive_integral_snd_measurable ~> nn_integral_snd
 
     integrable_fst_measurable   ~>
          integral_fst / integrable_fst / AE_integrable_fst
 
     integrable_snd_measurable   ~>
          integral_snd / integrable_snd / AE_integrable_snd
 
     integral_monotone_convergence  ~>
          integral_monotone_convergence / integrable_monotone_convergence
 
     integral_monotone_convergence_at_top  ~>
          integral_monotone_convergence_at_top /
          integrable_monotone_convergence_at_top
 
     has_integral_iff_positive_integral_lebesgue  ~>
          has_integral_iff_has_bochner_integral_lebesgue_nonneg
 
     lebesgue_integral_has_integral  ~>
          has_integral_integrable_lebesgue_nonneg
 
     positive_integral_lebesgue_has_integral  ~>
          integral_has_integral_lebesgue_nonneg /
          integrable_has_integral_lebesgue_nonneg
 
     lebesgue_integral_real_affine  ~>
          nn_integral_real_affine
 
     has_integral_iff_positive_integral_lborel  ~>
          integral_has_integral_nonneg / integrable_has_integral_nonneg
 
     The following theorems where removed:
 
     lebesgue_integral_nonneg
     lebesgue_integral_uminus
     lebesgue_integral_cmult
     lebesgue_integral_multc
     lebesgue_integral_cmult_nonneg
     integral_cmul_indicator
     integral_real
 
   - Formalized properties about exponentially, Erlang, and normal
     distributed random variables.
 
 * HOL-Decision_Procs: Separate command 'approximate' for approximative
 computation in src/HOL/Decision_Procs/Approximation.  Minor
 INCOMPATIBILITY.
 
 
 *** Scala ***
 
 * The signature and semantics of Document.Snapshot.cumulate_markup /
 select_markup have been clarified.  Markup is now traversed in the
 order of reports given by the prover: later markup is usually more
 specific and may override results accumulated so far.  The elements
 guard is mandatory and checked precisely.  Subtle INCOMPATIBILITY.
 
 * Substantial reworking of internal PIDE protocol communication
 channels.  INCOMPATIBILITY.
 
 
 *** ML ***
 
 * Subtle change of semantics of Thm.eq_thm: theory stamps are not
 compared (according to Thm.thm_ord), but assumed to be covered by the
 current background theory.  Thus equivalent data produced in different
 branches of the theory graph usually coincides (e.g. relevant for
 theory merge).  Note that the softer Thm.eq_thm_prop is often more
 appropriate than Thm.eq_thm.
 
 * Proper context for basic Simplifier operations: rewrite_rule,
 rewrite_goals_rule, rewrite_goals_tac etc. INCOMPATIBILITY, need to
 pass runtime Proof.context (and ensure that the simplified entity
 actually belongs to it).
 
 * Proper context discipline for read_instantiate and instantiate_tac:
 variables that are meant to become schematic need to be given as
 fixed, and are generalized by the explicit context of local variables.
 This corresponds to Isar attributes "where" and "of" with 'for'
 declaration.  INCOMPATIBILITY, also due to potential change of indices
 of schematic variables.
 
 * Moved ML_Compiler.exn_trace and other operations on exceptions to
 structure Runtime.  Minor INCOMPATIBILITY.
 
 * Discontinued old Toplevel.debug in favour of system option
 "ML_exception_trace", which may be also declared within the context
 via "declare [[ML_exception_trace = true]]".  Minor INCOMPATIBILITY.
 
 * Renamed configuration option "ML_trace" to "ML_source_trace". Minor
 INCOMPATIBILITY.
 
 * Configuration option "ML_print_depth" controls the pretty-printing
 depth of the ML compiler within the context.  The old print_depth in
 ML is still available as default_print_depth, but rarely used.  Minor
 INCOMPATIBILITY.
 
 * Toplevel function "use" refers to raw ML bootstrap environment,
 without Isar context nor antiquotations.  Potential INCOMPATIBILITY.
 Note that 'ML_file' is the canonical command to load ML files into the
 formal context.
 
 * Simplified programming interface to define ML antiquotations, see
 structure ML_Antiquotation.  Minor INCOMPATIBILITY.
 
 * ML antiquotation @{here} refers to its source position, which is
 occasionally useful for experimentation and diagnostic purposes.
 
 * ML antiquotation @{path} produces a Path.T value, similarly to
 Path.explode, but with compile-time check against the file-system and
 some PIDE markup.  Note that unlike theory source, ML does not have a
 well-defined master directory, so an absolute symbolic path
 specification is usually required, e.g. "~~/src/HOL".
 
 * ML antiquotation @{print} inlines a function to print an arbitrary
 ML value, which is occasionally useful for diagnostic or demonstration
 purposes.
 
 
 *** System ***
 
 * Proof General with its traditional helper scripts is now an optional
 Isabelle component, e.g. see ProofGeneral-4.2-2 from the Isabelle
 component repository http://isabelle.in.tum.de/components/.  Note that
 the "system" manual provides general explanations about add-on
 components, especially those that are not bundled with the release.
 
 * The raw Isabelle process executable has been renamed from
 "isabelle-process" to "isabelle_process", which conforms to common
 shell naming conventions, and allows to define a shell function within
 the Isabelle environment to avoid dynamic path lookup.  Rare
 incompatibility for old tools that do not use the ISABELLE_PROCESS
 settings variable.
 
 * Former "isabelle tty" has been superseded by "isabelle console",
 with implicit build like "isabelle jedit", and without the mostly
 obsolete Isar TTY loop.
 
 * Simplified "isabelle display" tool.  Settings variables DVI_VIEWER
 and PDF_VIEWER now refer to the actual programs, not shell
 command-lines.  Discontinued option -c: invocation may be asynchronous
 via desktop environment, without any special precautions.  Potential
 INCOMPATIBILITY with ambitious private settings.
 
 * Removed obsolete "isabelle unsymbolize".  Note that the usual format
 for email communication is the Unicode rendering of Isabelle symbols,
 as produced by Isabelle/jEdit, for example.
 
 * Removed obsolete tool "wwwfind". Similar functionality may be
 integrated into Isabelle/jEdit eventually.
 
 * Improved 'display_drafts' concerning desktop integration and
 repeated invocation in PIDE front-end: re-use single file
 $ISABELLE_HOME_USER/tmp/drafts.pdf and corresponding views.
 
 * Session ROOT specifications require explicit 'document_files' for
 robust dependencies on LaTeX sources.  Only these explicitly given
 files are copied to the document output directory, before document
 processing is started.
 
 * Windows: support for regular TeX installation (e.g. MiKTeX) instead
 of TeX Live from Cygwin.
 
 
 
 New in Isabelle2013-2 (December 2013)
 -------------------------------------
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * More robust editing of running commands with internal forks,
 e.g. non-terminating 'by' steps.
 
 * More relaxed Sledgehammer panel: avoid repeated application of query
 after edits surrounding the command location.
 
 * More status information about commands that are interrupted
 accidentally (via physical event or Poly/ML runtime system signal,
 e.g. out-of-memory).
 
 
 *** System ***
 
 * More robust termination of external processes managed by
 Isabelle/ML: support cancellation of tasks within the range of
 milliseconds, as required for PIDE document editing with automatically
 tried tools (e.g. Sledgehammer).
 
 * Reactivated Isabelle/Scala kill command for external processes on
 Mac OS X, which was accidentally broken in Isabelle2013-1 due to a
 workaround for some Debian/Ubuntu Linux versions from 2013.
 
 
 
 New in Isabelle2013-1 (November 2013)
 -------------------------------------
 
 *** General ***
 
 * Discontinued obsolete 'uses' within theory header.  Note that
 commands like 'ML_file' work without separate declaration of file
 dependencies.  Minor INCOMPATIBILITY.
 
 * Discontinued redundant 'use' command, which was superseded by
 'ML_file' in Isabelle2013.  Minor INCOMPATIBILITY.
 
 * Simplified subscripts within identifiers, using plain \<^sub>
 instead of the second copy \<^isub> and \<^isup>.  Superscripts are
 only for literal tokens within notation; explicit mixfix annotations
 for consts or fixed variables may be used as fall-back for unusual
 names.  Obsolete \<twosuperior> has been expanded to \<^sup>2 in
 Isabelle/HOL.  INCOMPATIBILITY, use "isabelle update_sub_sup" to
 standardize symbols as a starting point for further manual cleanup.
 The ML reference variable "legacy_isub_isup" may be set as temporary
 workaround, to make the prover accept a subset of the old identifier
 syntax.
 
 * Document antiquotations: term style "isub" has been renamed to
 "sub".  Minor INCOMPATIBILITY.
 
 * Uniform management of "quick_and_dirty" as system option (see also
 "isabelle options"), configuration option within the context (see also
 Config.get in Isabelle/ML), and attribute in Isabelle/Isar.  Minor
 INCOMPATIBILITY, need to use more official Isabelle means to access
 quick_and_dirty, instead of historical poking into mutable reference.
 
 * Renamed command 'print_configs' to 'print_options'.  Minor
 INCOMPATIBILITY.
 
 * Proper diagnostic command 'print_state'.  Old 'pr' (with its
 implicit change of some global references) is retained for now as
 control command, e.g. for ProofGeneral 3.7.x.
 
 * Discontinued 'print_drafts' command with its old-fashioned PS output
 and Unix command-line print spooling.  Minor INCOMPATIBILITY: use
 'display_drafts' instead and print via the regular document viewer.
 
 * Updated and extended "isar-ref" and "implementation" manual,
 eliminated old "ref" manual.
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * New manual "jedit" for Isabelle/jEdit, see isabelle doc or
 Documentation panel.
 
 * Dockable window "Documentation" provides access to Isabelle
 documentation.
 
 * Dockable window "Find" provides query operations for formal entities
 (GUI front-end to 'find_theorems' command).
 
 * Dockable window "Sledgehammer" manages asynchronous / parallel
 sledgehammer runs over existing document sources, independently of
 normal editing and checking process.
 
 * Dockable window "Timing" provides an overview of relevant command
 timing information, depending on option jedit_timing_threshold.  The
 same timing information is shown in the extended tooltip of the
 command keyword, when hovering the mouse over it while the CONTROL or
 COMMAND modifier is pressed.
 
 * Improved dockable window "Theories": Continuous checking of proof
 document (visible and required parts) may be controlled explicitly,
 using check box or shortcut "C+e ENTER".  Individual theory nodes may
 be marked explicitly as required and checked in full, using check box
 or shortcut "C+e SPACE".
 
 * Improved completion mechanism, which is now managed by the
 Isabelle/jEdit plugin instead of SideKick.  Refined table of Isabelle
 symbol abbreviations (see $ISABELLE_HOME/etc/symbols).
 
 * Standard jEdit keyboard shortcut C+b complete-word is remapped to
 isabelle.complete for explicit completion in Isabelle sources.
 INCOMPATIBILITY wrt. jEdit defaults, may have to invent new shortcuts
 to resolve conflict.
 
 * Improved support of various "minor modes" for Isabelle NEWS,
 options, session ROOT etc., with completion and SideKick tree view.
 
 * Strictly monotonic document update, without premature cancellation of
 running transactions that are still needed: avoid reset/restart of
 such command executions while editing.
 
 * Support for asynchronous print functions, as overlay to existing
 document content.
 
 * Support for automatic tools in HOL, which try to prove or disprove
 toplevel theorem statements.
 
 * Action isabelle.reset-font-size resets main text area font size
 according to Isabelle/Scala plugin option "jedit_font_reset_size" (see
 also "Plugin Options / Isabelle / General").  It can be bound to some
 keyboard shortcut by the user (e.g. C+0 and/or C+NUMPAD0).
 
 * File specifications in jEdit (e.g. file browser) may refer to
 $ISABELLE_HOME and $ISABELLE_HOME_USER on all platforms.  Discontinued
 obsolete $ISABELLE_HOME_WINDOWS variable.
 
 * Improved support for Linux look-and-feel "GTK+", see also "Utilities
 / Global Options / Appearance".
 
 * Improved support of native Mac OS X functionality via "MacOSX"
 plugin, which is now enabled by default.
 
 
 *** Pure ***
 
 * Commands 'interpretation' and 'sublocale' are now target-sensitive.
 In particular, 'interpretation' allows for non-persistent
 interpretation within "context ... begin ... end" blocks offering a
 light-weight alternative to 'sublocale'.  See "isar-ref" manual for
 details.
 
 * Improved locales diagnostic command 'print_dependencies'.
 
 * Discontinued obsolete 'axioms' command, which has been marked as
 legacy since Isabelle2009-2.  INCOMPATIBILITY, use 'axiomatization'
 instead, while observing its uniform scope for polymorphism.
 
 * Discontinued empty name bindings in 'axiomatization'.
 INCOMPATIBILITY.
 
 * System option "proofs" has been discontinued.  Instead the global
 state of Proofterm.proofs is persistently compiled into logic images
 as required, notably HOL-Proofs.  Users no longer need to change
 Proofterm.proofs dynamically.  Minor INCOMPATIBILITY.
 
 * Syntax translation functions (print_translation etc.) always depend
 on Proof.context.  Discontinued former "(advanced)" option -- this is
 now the default.  Minor INCOMPATIBILITY.
 
 * Former global reference trace_unify_fail is now available as
 configuration option "unify_trace_failure" (global context only).
 
 * SELECT_GOAL now retains the syntactic context of the overall goal
 state (schematic variables etc.).  Potential INCOMPATIBILITY in rare
 situations.
 
 
 *** HOL ***
 
 * Stronger precedence of syntax for big intersection and union on
 sets, in accordance with corresponding lattice operations.
 INCOMPATIBILITY.
 
 * Notation "{p:A. P}" now allows tuple patterns as well.
 
 * Nested case expressions are now translated in a separate check phase
 rather than during parsing. The data for case combinators is separated
 from the datatype package. The declaration attribute
 "case_translation" can be used to register new case combinators:
 
   declare [[case_translation case_combinator constructor1 ... constructorN]]
 
 * Code generator:
   - 'code_printing' unifies 'code_const' / 'code_type' / 'code_class' /
     'code_instance'.
   - 'code_identifier' declares name hints for arbitrary identifiers in
     generated code, subsuming 'code_modulename'.
 
 See the isar-ref manual for syntax diagrams, and the HOL theories for
 examples.
 
 * Attibute 'code': 'code' now declares concrete and abstract code
 equations uniformly.  Use explicit 'code equation' and 'code abstract'
 to distinguish both when desired.
 
 * Discontinued theories Code_Integer and Efficient_Nat by a more
 fine-grain stack of theories Code_Target_Int, Code_Binary_Nat,
 Code_Target_Nat and Code_Target_Numeral.  See the tutorial on code
 generation for details.  INCOMPATIBILITY.
 
 * Numeric types are mapped by default to target language numerals:
 natural (replaces former code_numeral) and integer (replaces former
 code_int).  Conversions are available as integer_of_natural /
 natural_of_integer / integer_of_nat / nat_of_integer (in HOL) and
 Code_Numeral.integer_of_natural / Code_Numeral.natural_of_integer (in
 ML).  INCOMPATIBILITY.
 
 * Function package: For mutually recursive functions f and g, separate
 cases rules f.cases and g.cases are generated instead of unusable
 f_g.cases which exposed internal sum types. Potential INCOMPATIBILITY,
 in the case that the unusable rule was used nevertheless.
 
 * Function package: For each function f, new rules f.elims are
 generated, which eliminate equalities of the form "f x = t".
 
 * New command 'fun_cases' derives ad-hoc elimination rules for
 function equations as simplified instances of f.elims, analogous to
 inductive_cases.  See ~~/src/HOL/ex/Fundefs.thy for some examples.
 
 * Lifting:
   - parametrized correspondence relations are now supported:
     + parametricity theorems for the raw term can be specified in
       the command lift_definition, which allow us to generate stronger
       transfer rules
     + setup_lifting generates stronger transfer rules if parametric
       correspondence relation can be generated
     + various new properties of the relator must be specified to support
       parametricity
     + parametricity theorem for the Quotient relation can be specified
   - setup_lifting generates domain rules for the Transfer package
   - stronger reflexivity prover of respectfulness theorems for type
     copies
   - ===> and --> are now local. The symbols can be introduced
     by interpreting the locale lifting_syntax (typically in an
     anonymous context)
   - Lifting/Transfer relevant parts of Library/Quotient_* are now in
     Main. Potential INCOMPATIBILITY
   - new commands for restoring and deleting Lifting/Transfer context:
     lifting_forget, lifting_update
   - the command print_quotmaps was renamed to print_quot_maps.
     INCOMPATIBILITY
 
 * Transfer:
   - better support for domains in Transfer: replace Domainp T
     by the actual invariant in a transferred goal
   - transfer rules can have as assumptions other transfer rules
   - Experimental support for transferring from the raw level to the
     abstract level: Transfer.transferred attribute
   - Attribute version of the transfer method: untransferred attribute
 
 * Reification and reflection:
   - Reification is now directly available in HOL-Main in structure
     "Reification".
   - Reflection now handles multiple lists with variables also.
   - The whole reflection stack has been decomposed into conversions.
 INCOMPATIBILITY.
 
 * Revised devices for recursive definitions over finite sets:
   - Only one fundamental fold combinator on finite set remains:
     Finite_Set.fold :: ('a => 'b => 'b) => 'b => 'a set => 'b
     This is now identity on infinite sets.
   - Locales ("mini packages") for fundamental definitions with
     Finite_Set.fold: folding, folding_idem.
   - Locales comm_monoid_set, semilattice_order_set and
     semilattice_neutr_order_set for big operators on sets.
     See theory Big_Operators for canonical examples.
     Note that foundational constants comm_monoid_set.F and
     semilattice_set.F correspond to former combinators fold_image
     and fold1 respectively.  These are now gone.  You may use
     those foundational constants as substitutes, but it is
     preferable to interpret the above locales accordingly.
   - Dropped class ab_semigroup_idem_mult (special case of lattice,
     no longer needed in connection with Finite_Set.fold etc.)
   - Fact renames:
       card.union_inter ~> card_Un_Int [symmetric]
       card.union_disjoint ~> card_Un_disjoint
 INCOMPATIBILITY.
 
 * Locale hierarchy for abstract orderings and (semi)lattices.
 
 * Complete_Partial_Order.admissible is defined outside the type class
 ccpo, but with mandatory prefix ccpo. Admissibility theorems lose the
 class predicate assumption or sort constraint when possible.
 INCOMPATIBILITY.
 
 * Introduce type class "conditionally_complete_lattice": Like a
 complete lattice but does not assume the existence of the top and
 bottom elements.  Allows to generalize some lemmas about reals and
 extended reals.  Removed SupInf and replaced it by the instantiation
 of conditionally_complete_lattice for real. Renamed lemmas about
 conditionally-complete lattice from Sup_... to cSup_... and from
 Inf_...  to cInf_... to avoid hidding of similar complete lattice
 lemmas.
 
 * Introduce type class linear_continuum as combination of
 conditionally-complete lattices and inner dense linorders which have
 more than one element.  INCOMPATIBILITY.
 
 * Introduced type classes order_top and order_bot. The old classes top
 and bot only contain the syntax without assumptions.  INCOMPATIBILITY:
 Rename bot -> order_bot, top -> order_top
 
 * Introduce type classes "no_top" and "no_bot" for orderings without
 top and bottom elements.
 
 * Split dense_linorder into inner_dense_order and no_top, no_bot.
 
 * Complex_Main: Unify and move various concepts from
 HOL-Multivariate_Analysis to HOL-Complex_Main.
 
  - Introduce type class (lin)order_topology and
    linear_continuum_topology.  Allows to generalize theorems about
    limits and order.  Instances are reals and extended reals.
 
  - continuous and continuos_on from Multivariate_Analysis:
    "continuous" is the continuity of a function at a filter.  "isCont"
    is now an abbrevitation: "isCont x f == continuous (at _) f".
 
    Generalized continuity lemmas from isCont to continuous on an
    arbitrary filter.
 
  - compact from Multivariate_Analysis. Use Bolzano's lemma to prove
    compactness of closed intervals on reals. Continuous functions
    attain infimum and supremum on compact sets. The inverse of a
    continuous function is continuous, when the function is continuous
    on a compact set.
 
  - connected from Multivariate_Analysis. Use it to prove the
    intermediate value theorem. Show connectedness of intervals on
    linear_continuum_topology).
 
  - first_countable_topology from Multivariate_Analysis. Is used to
    show equivalence of properties on the neighbourhood filter of x and
    on all sequences converging to x.
 
  - FDERIV: Definition of has_derivative moved to Deriv.thy. Moved
    theorems from Library/FDERIV.thy to Deriv.thy and base the
    definition of DERIV on FDERIV. Add variants of DERIV and FDERIV
    which are restricted to sets, i.e. to represent derivatives from
    left or right.
 
  - Removed the within-filter. It is replaced by the principal filter:
 
      F within X = inf F (principal X)
 
  - Introduce "at x within U" as a single constant, "at x" is now an
    abbreviation for "at x within UNIV"
 
  - Introduce named theorem collections tendsto_intros,
    continuous_intros, continuous_on_intros and FDERIV_intros. Theorems
    in tendsto_intros (or FDERIV_intros) are also available as
    tendsto_eq_intros (or FDERIV_eq_intros) where the right-hand side
    is replaced by a congruence rule. This allows to apply them as
    intro rules and then proving equivalence by the simplifier.
 
  - Restructured theories in HOL-Complex_Main:
 
    + Moved RealDef and RComplete into Real
 
    + Introduced Topological_Spaces and moved theorems about
      topological spaces, filters, limits and continuity to it
 
    + Renamed RealVector to Real_Vector_Spaces
 
    + Split Lim, SEQ, Series into Topological_Spaces,
      Real_Vector_Spaces, and Limits
 
    + Moved Ln and Log to Transcendental
 
    + Moved theorems about continuity from Deriv to Topological_Spaces
 
  - Remove various auxiliary lemmas.
 
 INCOMPATIBILITY.
 
 * Nitpick:
   - Added option "spy".
   - Reduce incidence of "too high arity" errors.
 
 * Sledgehammer:
   - Renamed option:
       isar_shrink ~> isar_compress
     INCOMPATIBILITY.
   - Added options "isar_try0", "spy".
   - Better support for "isar_proofs".
   - MaSh has been fined-tuned and now runs as a local server.
 
 * Improved support for ad hoc overloading of constants (see also
 isar-ref manual and ~~/src/HOL/ex/Adhoc_Overloading_Examples.thy).
 
 * Library/Polynomial.thy:
   - Use lifting for primitive definitions.
   - Explicit conversions from and to lists of coefficients, used for
     generated code.
   - Replaced recursion operator poly_rec by fold_coeffs.
   - Prefer pre-existing gcd operation for gcd.
   - Fact renames:
     poly_eq_iff ~> poly_eq_poly_eq_iff
     poly_ext ~> poly_eqI
     expand_poly_eq ~> poly_eq_iff
 IMCOMPATIBILITY.
 
 * New Library/Simps_Case_Conv.thy: Provides commands simps_of_case and
 case_of_simps to convert function definitions between a list of
 equations with patterns on the lhs and a single equation with case
 expressions on the rhs. See also Ex/Simps_Case_Conv_Examples.thy.
 
 * New Library/FSet.thy: type of finite sets defined as a subtype of
 sets defined by Lifting/Transfer.
 
 * Discontinued theory src/HOL/Library/Eval_Witness.  INCOMPATIBILITY.
 
 * Consolidation of library theories on product orders:
 
     Product_Lattice ~> Product_Order -- pointwise order on products
     Product_ord ~> Product_Lexorder -- lexicographic order on products
 
 INCOMPATIBILITY.
 
 * Imperative-HOL: The MREC combinator is considered legacy and no
 longer included by default. INCOMPATIBILITY, use partial_function
 instead, or import theory Legacy_Mrec as a fallback.
 
 * HOL-Algebra: Discontinued theories ~~/src/HOL/Algebra/abstract and
 ~~/src/HOL/Algebra/poly.  Existing theories should be based on
 ~~/src/HOL/Library/Polynomial instead.  The latter provides
 integration with HOL's type classes for rings.  INCOMPATIBILITY.
 
 * HOL-BNF:
   - Various improvements to BNF-based (co)datatype package, including
     new commands "primrec_new", "primcorec", and
     "datatype_new_compat", as well as documentation. See
     "datatypes.pdf" for details.
   - New "coinduction" method to avoid some boilerplate (compared to
     coinduct).
   - Renamed keywords:
     data ~> datatype_new
     codata ~> codatatype
     bnf_def ~> bnf
   - Renamed many generated theorems, including
     discs ~> disc
     map_comp' ~> map_comp
     map_id' ~> map_id
     sels ~> sel
     set_map' ~> set_map
     sets ~> set
 IMCOMPATIBILITY.
 
 
 *** ML ***
 
 * Spec_Check is a Quickcheck tool for Isabelle/ML.  The ML function
 "check_property" allows to check specifications of the form "ALL x y
 z. prop x y z".  See also ~~/src/Tools/Spec_Check/ with its
 Examples.thy in particular.
 
 * Improved printing of exception trace in Poly/ML 5.5.1, with regular
 tracing output in the command transaction context instead of physical
 stdout.  See also Toplevel.debug, Toplevel.debugging and
 ML_Compiler.exn_trace.
 
 * ML type "theory" is now immutable, without any special treatment of
 drafts or linear updates (which could lead to "stale theory" errors in
 the past).  Discontinued obsolete operations like Theory.copy,
 Theory.checkpoint, and the auxiliary type theory_ref.  Minor
 INCOMPATIBILITY.
 
 * More uniform naming of goal functions for skipped proofs:
 
     Skip_Proof.prove  ~>  Goal.prove_sorry
     Skip_Proof.prove_global  ~>  Goal.prove_sorry_global
 
 Minor INCOMPATIBILITY.
 
 * Simplifier tactics and tools use proper Proof.context instead of
 historic type simpset.  Old-style declarations like addsimps,
 addsimprocs etc. operate directly on Proof.context.  Raw type simpset
 retains its use as snapshot of the main Simplifier context, using
 simpset_of and put_simpset on Proof.context.  INCOMPATIBILITY -- port
 old tools by making them depend on (ctxt : Proof.context) instead of
 (ss : simpset), then turn (simpset_of ctxt) into ctxt.
 
 * Modifiers for classical wrappers (e.g. addWrapper, delWrapper)
 operate on Proof.context instead of claset, for uniformity with addIs,
 addEs, addDs etc. Note that claset_of and put_claset allow to manage
 clasets separately from the context.
 
 * Discontinued obsolete ML antiquotations @{claset} and @{simpset}.
 INCOMPATIBILITY, use @{context} instead.
 
 * Antiquotation @{theory_context A} is similar to @{theory A}, but
 presents the result as initial Proof.context.
 
 
 *** System ***
 
 * Discontinued obsolete isabelle usedir, mkdir, make -- superseded by
 "isabelle build" in Isabelle2013.  INCOMPATIBILITY.
 
 * Discontinued obsolete isabelle-process options -f and -u (former
 administrative aliases of option -e).  Minor INCOMPATIBILITY.
 
 * Discontinued obsolete isabelle print tool, and PRINT_COMMAND
 settings variable.
 
 * Discontinued ISABELLE_DOC_FORMAT settings variable and historic
 document formats: dvi.gz, ps, ps.gz -- the default document format is
 always pdf.
 
 * Isabelle settings variable ISABELLE_BUILD_JAVA_OPTIONS allows to
 specify global resources of the JVM process run by isabelle build.
 
 * Toplevel executable $ISABELLE_HOME/bin/isabelle_scala_script allows
 to run Isabelle/Scala source files as standalone programs.
 
 * Improved "isabelle keywords" tool (for old-style ProofGeneral
 keyword tables): use Isabelle/Scala operations, which inspect outer
 syntax without requiring to build sessions first.
 
 * Sessions may be organized via 'chapter' specifications in the ROOT
 file, which determines a two-level hierarchy of browser info.  The old
 tree-like organization via implicit sub-session relation (with its
 tendency towards erratic fluctuation of URLs) has been discontinued.
 The default chapter is called "Unsorted".  Potential INCOMPATIBILITY
 for HTML presentation of theories.
 
 
 
 New in Isabelle2013 (February 2013)
 -----------------------------------
 
 *** General ***
 
 * Theorem status about oracles and unfinished/failed future proofs is
 no longer printed by default, since it is incompatible with
 incremental / parallel checking of the persistent document model.  ML
 function Thm.peek_status may be used to inspect a snapshot of the
 ongoing evaluation process.  Note that in batch mode --- notably
 isabelle build --- the system ensures that future proofs of all
 accessible theorems in the theory context are finished (as before).
 
 * Configuration option show_markup controls direct inlining of markup
 into the printed representation of formal entities --- notably type
 and sort constraints.  This enables Prover IDE users to retrieve that
 information via tooltips in the output window, for example.
 
 * Command 'ML_file' evaluates ML text from a file directly within the
 theory, without any predeclaration via 'uses' in the theory header.
 
 * Old command 'use' command and corresponding keyword 'uses' in the
 theory header are legacy features and will be discontinued soon.
 Tools that load their additional source files may imitate the
 'ML_file' implementation, such that the system can take care of
 dependencies properly.
 
 * Discontinued obsolete method fastsimp / tactic fast_simp_tac, which
 is called fastforce / fast_force_tac already since Isabelle2011-1.
 
 * Updated and extended "isar-ref" and "implementation" manual, reduced
 remaining material in old "ref" manual.
 
 * Improved support for auxiliary contexts that indicate block structure
 for specifications.  Nesting of "context fixes ... context assumes ..."
 and "class ... context ...".
 
 * Attribute "consumes" allows a negative value as well, which is
 interpreted relatively to the total number of premises of the rule in
 the target context.  This form of declaration is stable when exported
 from a nested 'context' with additional assumptions.  It is the
 preferred form for definitional packages, notably cases/rules produced
 in HOL/inductive and HOL/function.
 
 * More informative error messages for Isar proof commands involving
 lazy enumerations (method applications etc.).
 
 * Refined 'help' command to retrieve outer syntax commands according
 to name patterns (with clickable results).
 
 
 *** Prover IDE -- Isabelle/Scala/jEdit ***
 
 * Parallel terminal proofs ('by') are enabled by default, likewise
 proofs that are built into packages like 'datatype', 'function'.  This
 allows to "run ahead" checking the theory specifications on the
 surface, while the prover is still crunching on internal
 justifications.  Unfinished / cancelled proofs are restarted as
 required to complete full proof checking eventually.
 
 * Improved output panel with tooltips, hyperlinks etc. based on the
 same Rich_Text_Area as regular Isabelle/jEdit buffers.  Activation of
 tooltips leads to some window that supports the same recursively,
 which can lead to stacks of tooltips as the semantic document content
 is explored.  ESCAPE closes the whole stack, individual windows may be
 closed separately, or detached to become independent jEdit dockables.
 
 * Improved support for commands that produce graph output: the text
 message contains a clickable area to open a new instance of the graph
 browser on demand.
 
 * More robust incremental parsing of outer syntax (partial comments,
 malformed symbols).  Changing the balance of open/close quotes and
 comment delimiters works more conveniently with unfinished situations
 that frequently occur in user interaction.
 
 * More efficient painting and improved reactivity when editing large
 files.  More scalable management of formal document content.
 
 * Smarter handling of tracing messages: prover process pauses after
 certain number of messages per command transaction, with some user
 dialog to stop or continue.  This avoids swamping the front-end with
 potentially infinite message streams.
 
 * More plugin options and preferences, based on Isabelle/Scala.  The
 jEdit plugin option panel provides access to some Isabelle/Scala
 options, including tuning parameters for editor reactivity and color
 schemes.
 
 * Dockable window "Symbols" provides some editing support for Isabelle
 symbols.
 
 * Dockable window "Monitor" shows ML runtime statistics.  Note that
 continuous display of the chart slows down the system.
 
 * Improved editing support for control styles: subscript, superscript,
 bold, reset of style -- operating on single symbols or text
 selections.  Cf. keyboard shortcuts C+e DOWN/UP/RIGHT/LEFT.
 
 * Actions isabelle.increase-font-size and isabelle.decrease-font-size
 adjust the main text area font size, and its derivatives for output,
 tooltips etc.  Cf. keyboard shortcuts C-PLUS and C-MINUS, which often
 need to be adapted to local keyboard layouts.
 
 * More reactive completion popup by default: use \t (TAB) instead of
 \n (NEWLINE) to minimize intrusion into regular flow of editing.  See
 also "Plugin Options / SideKick / General / Code Completion Options".
 
 * Implicit check and build dialog of the specified logic session
 image.  For example, HOL, HOLCF, HOL-Nominal can be produced on
 demand, without bundling big platform-dependent heap images in the
 Isabelle distribution.
 
 * Uniform Java 7 platform on Linux, Mac OS X, Windows: recent updates
 from Oracle provide better multi-platform experience.  This version is
 now bundled exclusively with Isabelle.
 
 
 *** Pure ***
 
 * Code generation for Haskell: restrict unqualified imports from
 Haskell Prelude to a small set of fundamental operations.
 
 * Command 'export_code': relative file names are interpreted
 relatively to master directory of current theory rather than the
 rather arbitrary current working directory.  INCOMPATIBILITY.
 
 * Discontinued obsolete attribute "COMP".  Potential INCOMPATIBILITY,
 use regular rule composition via "OF" / "THEN", or explicit proof
 structure instead.  Note that Isabelle/ML provides a variety of
 operators like COMP, INCR_COMP, COMP_INCR, which need to be applied
 with some care where this is really required.
 
 * Command 'typ' supports an additional variant with explicit sort
 constraint, to infer and check the most general type conforming to a
 given sort.  Example (in HOL):
 
   typ "_ * _ * bool * unit" :: finite
 
 * Command 'locale_deps' visualizes all locales and their relations as
 a Hasse diagram.
 
 
 *** HOL ***
 
 * Sledgehammer:
 
   - Added MaSh relevance filter based on machine-learning; see the
     Sledgehammer manual for details.
   - Polished Isar proofs generated with "isar_proofs" option.
   - Rationalized type encodings ("type_enc" option).
   - Renamed "kill_provers" subcommand to "kill_all".
   - Renamed options:
       isar_proof ~> isar_proofs
       isar_shrink_factor ~> isar_shrink
       max_relevant ~> max_facts
       relevance_thresholds ~> fact_thresholds
 
 * Quickcheck: added an optimisation for equality premises.  It is
 switched on by default, and can be switched off by setting the
 configuration quickcheck_optimise_equality to false.
 
 * Quotient: only one quotient can be defined by quotient_type
 INCOMPATIBILITY.
 
 * Lifting:
   - generation of an abstraction function equation in lift_definition
   - quot_del attribute
   - renamed no_abs_code -> no_code (INCOMPATIBILITY.)
 
 * Simproc "finite_Collect" rewrites set comprehensions into pointfree
 expressions.
 
 * Preprocessing of the code generator rewrites set comprehensions into
 pointfree expressions.
 
 * The SMT solver Z3 has now by default a restricted set of directly
 supported features. For the full set of features (div/mod, nonlinear
 arithmetic, datatypes/records) with potential proof reconstruction
 failures, enable the configuration option "z3_with_extensions".  Minor
 INCOMPATIBILITY.
 
 * Simplified 'typedef' specifications: historical options for implicit
 set definition and alternative name have been discontinued.  The
 former behavior of "typedef (open) t = A" is now the default, but
 written just "typedef t = A".  INCOMPATIBILITY, need to adapt theories
 accordingly.
 
 * Removed constant "chars"; prefer "Enum.enum" on type "char"
 directly.  INCOMPATIBILITY.
 
 * Moved operation product, sublists and n_lists from theory Enum to
 List.  INCOMPATIBILITY.
 
 * Theorem UN_o generalized to SUP_comp.  INCOMPATIBILITY.
 
 * Class "comm_monoid_diff" formalises properties of bounded
 subtraction, with natural numbers and multisets as typical instances.
 
 * Added combinator "Option.these" with type "'a option set => 'a set".
 
 * Theory "Transitive_Closure": renamed lemmas
 
   reflcl_tranclp -> reflclp_tranclp
   rtranclp_reflcl -> rtranclp_reflclp
 
 INCOMPATIBILITY.
 
 * Theory "Rings": renamed lemmas (in class semiring)
 
   left_distrib ~> distrib_right
   right_distrib ~> distrib_left
 
 INCOMPATIBILITY.
 
 * Generalized the definition of limits:
 
   - Introduced the predicate filterlim (LIM x F. f x :> G) which
     expresses that when the input values x converge to F then the
     output f x converges to G.
 
   - Added filters for convergence to positive (at_top) and negative
     infinity (at_bot).
 
   - Moved infinity in the norm (at_infinity) from
     Multivariate_Analysis to Complex_Main.
 
   - Removed real_tendsto_inf, it is superseded by "LIM x F. f x :>
     at_top".
 
 INCOMPATIBILITY.
 
 * Theory "Library/Option_ord" provides instantiation of option type to
 lattice type classes.
 
 * Theory "Library/Multiset": renamed
 
     constant fold_mset ~> Multiset.fold
     fact fold_mset_commute ~> fold_mset_comm
 
 INCOMPATIBILITY.
 
 * Renamed theory Library/List_Prefix to Library/Sublist, with related
 changes as follows.
 
   - Renamed constants (and related lemmas)
 
       prefix ~> prefixeq
       strict_prefix ~> prefix
 
   - Replaced constant "postfix" by "suffixeq" with swapped argument
     order (i.e., "postfix xs ys" is now "suffixeq ys xs") and dropped
     old infix syntax "xs >>= ys"; use "suffixeq ys xs" instead.
     Renamed lemmas accordingly.
 
   - Added constant "list_hembeq" for homeomorphic embedding on
     lists. Added abbreviation "sublisteq" for special case
     "list_hembeq (op =)".
 
   - Theory Library/Sublist no longer provides "order" and "bot" type
     class instances for the prefix order (merely corresponding locale
     interpretations). The type class instances are now in theory
     Library/Prefix_Order.
 
   - The sublist relation of theory Library/Sublist_Order is now based
     on "Sublist.sublisteq".  Renamed lemmas accordingly:
 
       le_list_append_le_same_iff ~> Sublist.sublisteq_append_le_same_iff
       le_list_append_mono ~> Sublist.list_hembeq_append_mono
       le_list_below_empty ~> Sublist.list_hembeq_Nil, Sublist.list_hembeq_Nil2
       le_list_Cons_EX ~> Sublist.list_hembeq_ConsD
       le_list_drop_Cons2 ~> Sublist.sublisteq_Cons2'
       le_list_drop_Cons_neq ~> Sublist.sublisteq_Cons2_neq
       le_list_drop_Cons ~> Sublist.sublisteq_Cons'
       le_list_drop_many ~> Sublist.sublisteq_drop_many
       le_list_filter_left ~> Sublist.sublisteq_filter_left
       le_list_rev_drop_many ~> Sublist.sublisteq_rev_drop_many
       le_list_rev_take_iff ~> Sublist.sublisteq_append
       le_list_same_length ~> Sublist.sublisteq_same_length
       le_list_take_many_iff ~> Sublist.sublisteq_append'
       less_eq_list.drop ~> less_eq_list_drop
       less_eq_list.induct ~> less_eq_list_induct
       not_le_list_length ~> Sublist.not_sublisteq_length
 
 INCOMPATIBILITY.
 
 * New theory Library/Countable_Set.
 
 * Theory Library/Debug and Library/Parallel provide debugging and
 parallel execution for code generated towards Isabelle/ML.
 
 * Theory Library/FuncSet: Extended support for Pi and extensional and
 introduce the extensional dependent function space "PiE". Replaced
 extensional_funcset by an abbreviation, and renamed lemmas from
 extensional_funcset to PiE as follows:
 
   extensional_empty  ~>  PiE_empty
   extensional_funcset_empty_domain  ~>  PiE_empty_domain
   extensional_funcset_empty_range  ~>  PiE_empty_range
   extensional_funcset_arb  ~>  PiE_arb
   extensional_funcset_mem  ~>  PiE_mem
   extensional_funcset_extend_domainI  ~>  PiE_fun_upd
   extensional_funcset_restrict_domain  ~>  fun_upd_in_PiE
   extensional_funcset_extend_domain_eq  ~>  PiE_insert_eq
   card_extensional_funcset  ~>  card_PiE
   finite_extensional_funcset  ~>  finite_PiE
 
 INCOMPATIBILITY.
 
 * Theory Library/FinFun: theory of almost everywhere constant
 functions (supersedes the AFP entry "Code Generation for Functions as
 Data").
 
 * Theory Library/Phantom: generic phantom type to make a type
 parameter appear in a constant's type.  This alternative to adding
 TYPE('a) as another parameter avoids unnecessary closures in generated
 code.
 
 * Theory Library/RBT_Impl: efficient construction of red-black trees
 from sorted associative lists. Merging two trees with rbt_union may
 return a structurally different tree than before.  Potential
 INCOMPATIBILITY.
 
 * Theory Library/IArray: immutable arrays with code generation.
 
 * Theory Library/Finite_Lattice: theory of finite lattices.
 
 * HOL/Multivariate_Analysis: replaced
 
   "basis :: 'a::euclidean_space => nat => real"
   "\<Chi>\<Chi> :: (nat => real) => 'a::euclidean_space"
 
 on euclidean spaces by using the inner product "_ \<bullet> _" with
 vectors from the Basis set: "\<Chi>\<Chi> i. f i" is superseded by
 "SUM i : Basis. f i * r i".
 
   With this change the following constants are also changed or removed:
 
     DIM('a) :: nat  ~>  card (Basis :: 'a set)   (is an abbreviation)
     a $$ i  ~>  inner a i  (where i : Basis)
     cart_base i  removed
     \<pi>, \<pi>'  removed
 
   Theorems about these constants where removed.
 
   Renamed lemmas:
 
     component_le_norm  ~>  Basis_le_norm
     euclidean_eq  ~>  euclidean_eq_iff
     differential_zero_maxmin_component  ~>  differential_zero_maxmin_cart
     euclidean_simps  ~>  inner_simps
     independent_basis  ~>  independent_Basis
     span_basis  ~>  span_Basis
     in_span_basis  ~>  in_span_Basis
     norm_bound_component_le  ~>  norm_boound_Basis_le
     norm_bound_component_lt  ~>  norm_boound_Basis_lt
     component_le_infnorm  ~>  Basis_le_infnorm
 
 INCOMPATIBILITY.
 
 * HOL/Probability:
 
   - Added simproc "measurable" to automatically prove measurability.
 
   - Added induction rules for sigma sets with disjoint union
     (sigma_sets_induct_disjoint) and for Borel-measurable functions
     (borel_measurable_induct).
 
   - Added the Daniell-Kolmogorov theorem (the existence the limit of a
     projective family).
 
 * HOL/Cardinals: Theories of ordinals and cardinals (supersedes the
 AFP entry "Ordinals_and_Cardinals").
 
 * HOL/BNF: New (co)datatype package based on bounded natural functors
 with support for mixed, nested recursion and interesting non-free
 datatypes.
 
 * HOL/Finite_Set and Relation: added new set and relation operations
 expressed by Finite_Set.fold.
 
 * New theory HOL/Library/RBT_Set: implementation of sets by red-black
 trees for the code generator.
 
 * HOL/Library/RBT and HOL/Library/Mapping have been converted to
 Lifting/Transfer.
 possible INCOMPATIBILITY.
 
 * HOL/Set: renamed Set.project -> Set.filter
 INCOMPATIBILITY.
 
 
 *** Document preparation ***
 
 * Dropped legacy antiquotations "term_style" and "thm_style", since
 styles may be given as arguments to "term" and "thm" already.
 Discontinued legacy styles "prem1" .. "prem19".
 
 * Default LaTeX rendering for \<euro> is now based on eurosym package,
 instead of slightly exotic babel/greek.
 
 * Document variant NAME may use different LaTeX entry point
 document/root_NAME.tex if that file exists, instead of the common
 document/root.tex.
 
 * Simplified custom document/build script, instead of old-style
 document/IsaMakefile.  Minor INCOMPATIBILITY.
 
 
 *** ML ***
 
 * The default limit for maximum number of worker threads is now 8,
 instead of 4, in correspondence to capabilities of contemporary
 hardware and Poly/ML runtime system.
 
 * Type Seq.results and related operations support embedded error
 messages within lazy enumerations, and thus allow to provide
 informative errors in the absence of any usable results.
 
 * Renamed Position.str_of to Position.here to emphasize that this is a
 formal device to inline positions into message text, but not
 necessarily printing visible text.
 
 
 *** System ***
 
 * Advanced support for Isabelle sessions and build management, see
 "system" manual for the chapter of that name, especially the "isabelle
 build" tool and its examples.  The "isabelle mkroot" tool prepares
 session root directories for use with "isabelle build", similar to
 former "isabelle mkdir" for "isabelle usedir".  Note that this affects
 document preparation as well.  INCOMPATIBILITY, isabelle usedir /
 mkdir / make are rendered obsolete.
 
 * Discontinued obsolete Isabelle/build script, it is superseded by the
 regular isabelle build tool.  For example:
 
   isabelle build -s -b HOL
 
 * Discontinued obsolete "isabelle makeall".
 
 * Discontinued obsolete IsaMakefile and ROOT.ML files from the
 Isabelle distribution, except for rudimentary src/HOL/IsaMakefile that
 provides some traditional targets that invoke "isabelle build".  Note
 that this is inefficient!  Applications of Isabelle/HOL involving
 "isabelle make" should be upgraded to use "isabelle build" directly.
 
 * The "isabelle options" tool prints Isabelle system options, as
 required for "isabelle build", for example.
 
 * The "isabelle logo" tool produces EPS and PDF format simultaneously.
 Minor INCOMPATIBILITY in command-line options.
 
 * The "isabelle install" tool has now a simpler command-line.  Minor
 INCOMPATIBILITY.
 
 * The "isabelle components" tool helps to resolve add-on components
 that are not bundled, or referenced from a bare-bones repository
 version of Isabelle.
 
 * Settings variable ISABELLE_PLATFORM_FAMILY refers to the general
 platform family: "linux", "macos", "windows".
 
 * The ML system is configured as regular component, and no longer
 picked up from some surrounding directory.  Potential INCOMPATIBILITY
 for home-made settings.
 
 * Improved ML runtime statistics (heap, threads, future tasks etc.).
 
 * Discontinued support for Poly/ML 5.2.1, which was the last version
 without exception positions and advanced ML compiler/toplevel
 configuration.
 
 * Discontinued special treatment of Proof General -- no longer guess
 PROOFGENERAL_HOME based on accidental file-system layout.  Minor
 INCOMPATIBILITY: provide PROOFGENERAL_HOME and PROOFGENERAL_OPTIONS
 settings manually, or use a Proof General version that has been
 bundled as Isabelle component.
 
 
 
 New in Isabelle2012 (May 2012)
 ------------------------------
 
 *** General ***
 
 * Prover IDE (PIDE) improvements:
 
   - more robust Sledgehammer integration (as before the sledgehammer
     command-line needs to be typed into the source buffer)
   - markup for bound variables
   - markup for types of term variables (displayed as tooltips)
   - support for user-defined Isar commands within the running session
   - improved support for Unicode outside original 16bit range
     e.g. glyph for \<A> (thanks to jEdit 4.5.1)
 
 * Forward declaration of outer syntax keywords within the theory
 header -- minor INCOMPATIBILITY for user-defined commands.  Allow new
 commands to be used in the same theory where defined.
 
 * Auxiliary contexts indicate block structure for specifications with
 additional parameters and assumptions.  Such unnamed contexts may be
 nested within other targets, like 'theory', 'locale', 'class',
 'instantiation' etc.  Results from the local context are generalized
 accordingly and applied to the enclosing target context.  Example:
 
   context
     fixes x y z :: 'a
     assumes xy: "x = y" and yz: "y = z"
   begin
 
   lemma my_trans: "x = z" using xy yz by simp
 
   end
 
   thm my_trans
 
 The most basic application is to factor-out context elements of
 several fixes/assumes/shows theorem statements, e.g. see
 ~~/src/HOL/Isar_Examples/Group_Context.thy
 
 Any other local theory specification element works within the "context
 ... begin ... end" block as well.
 
 * Bundled declarations associate attributed fact expressions with a
 given name in the context.  These may be later included in other
 contexts.  This allows to manage context extensions casually, without
 the logical dependencies of locales and locale interpretation.  See
 commands 'bundle', 'include', 'including' etc. in the isar-ref manual.
 
 * Commands 'lemmas' and 'theorems' allow local variables using 'for'
 declaration, and results are standardized before being stored.  Thus
 old-style "standard" after instantiation or composition of facts
 becomes obsolete.  Minor INCOMPATIBILITY, due to potential change of
 indices of schematic variables.
 
 * Rule attributes in local theory declarations (e.g. locale or class)
 are now statically evaluated: the resulting theorem is stored instead
 of the original expression.  INCOMPATIBILITY in rare situations, where
 the historic accident of dynamic re-evaluation in interpretations
 etc. was exploited.
 
 * New tutorial "Programming and Proving in Isabelle/HOL"
 ("prog-prove").  It completely supersedes "A Tutorial Introduction to
 Structured Isar Proofs" ("isar-overview"), which has been removed.  It
 also supersedes "Isabelle/HOL, A Proof Assistant for Higher-Order
 Logic" as the recommended beginners tutorial, but does not cover all
 of the material of that old tutorial.
 
 * Updated and extended reference manuals: "isar-ref",
 "implementation", "system"; reduced remaining material in old "ref"
 manual.
 
 
 *** Pure ***
 
 * Command 'definition' no longer exports the foundational "raw_def"
 into the user context.  Minor INCOMPATIBILITY, may use the regular
 "def" result with attribute "abs_def" to imitate the old version.
 
 * Attribute "abs_def" turns an equation of the form "f x y == t" into
 "f == %x y. t", which ensures that "simp" or "unfold" steps always
 expand it.  This also works for object-logic equality.  (Formerly
 undocumented feature.)
 
 * Sort constraints are now propagated in simultaneous statements, just
 like type constraints.  INCOMPATIBILITY in rare situations, where
 distinct sorts used to be assigned accidentally.  For example:
 
   lemma "P (x::'a::foo)" and "Q (y::'a::bar)"  -- "now illegal"
 
   lemma "P (x::'a)" and "Q (y::'a::bar)"
     -- "now uniform 'a::bar instead of default sort for first occurrence (!)"
 
 * Rule composition via attribute "OF" (or ML functions OF/MRS) is more
 tolerant against multiple unifiers, as long as the final result is
 unique.  (As before, rules are composed in canonical right-to-left
 order to accommodate newly introduced premises.)
 
 * Renamed some inner syntax categories:
 
     num ~> num_token
     xnum ~> xnum_token
     xstr ~> str_token
 
 Minor INCOMPATIBILITY.  Note that in practice "num_const" or
 "num_position" etc. are mainly used instead (which also include
 position information via constraints).
 
 * Simplified configuration options for syntax ambiguity: see
 "syntax_ambiguity_warning" and "syntax_ambiguity_limit" in isar-ref
 manual.  Minor INCOMPATIBILITY.
 
 * Discontinued configuration option "syntax_positions": atomic terms
 in parse trees are always annotated by position constraints.
 
 * Old code generator for SML and its commands 'code_module',
 'code_library', 'consts_code', 'types_code' have been discontinued.
 Use commands of the generic code generator instead.  INCOMPATIBILITY.
 
 * Redundant attribute "code_inline" has been discontinued. Use
 "code_unfold" instead.  INCOMPATIBILITY.
 
 * Dropped attribute "code_unfold_post" in favor of the its dual
 "code_abbrev", which yields a common pattern in definitions like
 
   definition [code_abbrev]: "f = t"
 
 INCOMPATIBILITY.
 
 * Obsolete 'types' command has been discontinued.  Use 'type_synonym'
 instead.  INCOMPATIBILITY.
 
 * Discontinued old "prems" fact, which used to refer to the accidental
 collection of foundational premises in the context (already marked as
 legacy since Isabelle2011).
 
 
 *** HOL ***
 
 * Type 'a set is now a proper type constructor (just as before
 Isabelle2008).  Definitions mem_def and Collect_def have disappeared.
 Non-trivial INCOMPATIBILITY.  For developments keeping predicates and
 sets separate, it is often sufficient to rephrase some set S that has
 been accidentally used as predicates by "%x. x : S", and some
 predicate P that has been accidentally used as set by "{x. P x}".
 Corresponding proofs in a first step should be pruned from any
 tinkering with former theorems mem_def and Collect_def as far as
 possible.
 
 For developments which deliberately mix predicates and sets, a
 planning step is necessary to determine what should become a predicate
 and what a set.  It can be helpful to carry out that step in
 Isabelle2011-1 before jumping right into the current release.
 
 * Code generation by default implements sets as container type rather
 than predicates.  INCOMPATIBILITY.
 
 * New type synonym 'a rel = ('a * 'a) set
 
 * The representation of numerals has changed.  Datatype "num"
 represents strictly positive binary numerals, along with functions
 "numeral :: num => 'a" and "neg_numeral :: num => 'a" to represent
 positive and negated numeric literals, respectively.  See also
 definitions in ~~/src/HOL/Num.thy.  Potential INCOMPATIBILITY, some
 user theories may require adaptations as follows:
 
   - Theorems with number_ring or number_semiring constraints: These
     classes are gone; use comm_ring_1 or comm_semiring_1 instead.
 
   - Theories defining numeric types: Remove number, number_semiring,
     and number_ring instances. Defer all theorems about numerals until
     after classes one and semigroup_add have been instantiated.
 
   - Numeral-only simp rules: Replace each rule having a "number_of v"
     pattern with two copies, one for numeral and one for neg_numeral.
 
   - Theorems about subclasses of semiring_1 or ring_1: These classes
     automatically support numerals now, so more simp rules and
     simprocs may now apply within the proof.
 
   - Definitions and theorems using old constructors Pls/Min/Bit0/Bit1:
     Redefine using other integer operations.
 
 * Transfer: New package intended to generalize the existing
 "descending" method and related theorem attributes from the Quotient
 package.  (Not all functionality is implemented yet, but future
 development will focus on Transfer as an eventual replacement for the
 corresponding parts of the Quotient package.)
 
   - transfer_rule attribute: Maintains a collection of transfer rules,
     which relate constants at two different types. Transfer rules may
     relate different type instances of the same polymorphic constant,
     or they may relate an operation on a raw type to a corresponding
     operation on an abstract type (quotient or subtype). For example:
 
     ((A ===> B) ===> list_all2 A ===> list_all2 B) map map
     (cr_int ===> cr_int ===> cr_int) (%(x,y) (u,v). (x+u, y+v)) plus_int
 
   - transfer method: Replaces a subgoal on abstract types with an
     equivalent subgoal on the corresponding raw types. Constants are
     replaced with corresponding ones according to the transfer rules.
     Goals are generalized over all free variables by default; this is
     necessary for variables whose types change, but can be overridden
     for specific variables with e.g. "transfer fixing: x y z".  The
     variant transfer' method allows replacing a subgoal with one that
     is logically stronger (rather than equivalent).
 
   - relator_eq attribute: Collects identity laws for relators of
     various type constructors, e.g. "list_all2 (op =) = (op =)".  The
     transfer method uses these lemmas to infer transfer rules for
     non-polymorphic constants on the fly.
 
   - transfer_prover method: Assists with proving a transfer rule for a
     new constant, provided the constant is defined in terms of other
     constants that already have transfer rules. It should be applied
     after unfolding the constant definitions.
 
   - HOL/ex/Transfer_Int_Nat.thy: Example theory demonstrating transfer
     from type nat to type int.
 
 * Lifting: New package intended to generalize the quotient_definition
 facility of the Quotient package; designed to work with Transfer.
 
   - lift_definition command: Defines operations on an abstract type in
     terms of a corresponding operation on a representation
     type.  Example syntax:
 
     lift_definition dlist_insert :: "'a => 'a dlist => 'a dlist"
       is List.insert
 
     Users must discharge a respectfulness proof obligation when each
     constant is defined. (For a type copy, i.e. a typedef with UNIV,
     the proof is discharged automatically.) The obligation is
     presented in a user-friendly, readable form; a respectfulness
     theorem in the standard format and a transfer rule are generated
     by the package.
 
   - Integration with code_abstype: For typedefs (e.g. subtypes
     corresponding to a datatype invariant, such as dlist),
     lift_definition generates a code certificate theorem and sets up
     code generation for each constant.
 
   - setup_lifting command: Sets up the Lifting package to work with a
     user-defined type. The user must provide either a quotient theorem
     or a type_definition theorem.  The package configures transfer
     rules for equality and quantifiers on the type, and sets up the
     lift_definition command to work with the type.
 
   - Usage examples: See Quotient_Examples/Lift_DList.thy,
     Quotient_Examples/Lift_RBT.thy, Quotient_Examples/Lift_FSet.thy,
     Word/Word.thy and Library/Float.thy.
 
 * Quotient package:
 
   - The 'quotient_type' command now supports a 'morphisms' option with
     rep and abs functions, similar to typedef.
 
   - 'quotient_type' sets up new types to work with the Lifting and
     Transfer packages, as with 'setup_lifting'.
 
   - The 'quotient_definition' command now requires the user to prove a
     respectfulness property at the point where the constant is
     defined, similar to lift_definition; INCOMPATIBILITY.
 
   - Renamed predicate 'Quotient' to 'Quotient3', and renamed theorems
     accordingly, INCOMPATIBILITY.
 
 * New diagnostic command 'find_unused_assms' to find potentially
 superfluous assumptions in theorems using Quickcheck.
 
 * Quickcheck:
 
   - Quickcheck returns variable assignments as counterexamples, which
     allows to reveal the underspecification of functions under test.
     For example, refuting "hd xs = x", it presents the variable
     assignment xs = [] and x = a1 as a counterexample, assuming that
     any property is false whenever "hd []" occurs in it.
 
     These counterexample are marked as potentially spurious, as
     Quickcheck also returns "xs = []" as a counterexample to the
     obvious theorem "hd xs = hd xs".
 
     After finding a potentially spurious counterexample, Quickcheck
     continues searching for genuine ones.
 
     By default, Quickcheck shows potentially spurious and genuine
     counterexamples. The option "genuine_only" sets quickcheck to only
     show genuine counterexamples.
 
   - The command 'quickcheck_generator' creates random and exhaustive
     value generators for a given type and operations.
 
     It generates values by using the operations as if they were
     constructors of that type.
 
   - Support for multisets.
 
   - Added "use_subtype" options.
 
   - Added "quickcheck_locale" configuration to specify how to process
     conjectures in a locale context.
 
 * Nitpick: Fixed infinite loop caused by the 'peephole_optim' option
 and affecting 'rat' and 'real'.
 
 * Sledgehammer:
   - Integrated more tightly with SPASS, as described in the ITP 2012
     paper "More SPASS with Isabelle".
   - Made it try "smt" as a fallback if "metis" fails or times out.
   - Added support for the following provers: Alt-Ergo (via Why3 and
     TFF1), iProver, iProver-Eq.
   - Sped up the minimizer.
   - Added "lam_trans", "uncurry_aliases", and "minimize" options.
   - Renamed "slicing" ("no_slicing") option to "slice" ("dont_slice").
   - Renamed "sound" option to "strict".
 
 * Metis: Added possibility to specify lambda translations scheme as a
 parenthesized argument (e.g., "by (metis (lifting) ...)").
 
 * SMT: Renamed "smt_fixed" option to "smt_read_only_certificates".
 
 * Command 'try0': Renamed from 'try_methods'. INCOMPATIBILITY.
 
 * New "case_product" attribute to generate a case rule doing multiple
 case distinctions at the same time.  E.g.
 
   list.exhaust [case_product nat.exhaust]
 
 produces a rule which can be used to perform case distinction on both
 a list and a nat.
 
 * New "eventually_elim" method as a generalized variant of the
 eventually_elim* rules.  Supports structured proofs.
 
 * Typedef with implicit set definition is considered legacy.  Use
 "typedef (open)" form instead, which will eventually become the
 default.
 
 * Record: code generation can be switched off manually with
 
   declare [[record_coden = false]]  -- "default true"
 
 * Datatype: type parameters allow explicit sort constraints.
 
 * Concrete syntax for case expressions includes constraints for source
 positions, and thus produces Prover IDE markup for its bindings.
 INCOMPATIBILITY for old-style syntax translations that augment the
 pattern notation; e.g. see src/HOL/HOLCF/One.thy for translations of
 one_case.
 
 * Clarified attribute "mono_set": pure declaration without modifying
 the result of the fact expression.
 
 * More default pred/set conversions on a couple of relation operations
 and predicates.  Added powers of predicate relations.  Consolidation
 of some relation theorems:
 
   converse_def ~> converse_unfold
   rel_comp_def ~> relcomp_unfold
   symp_def ~> (modified, use symp_def and sym_def instead)
   transp_def ~> transp_trans
   Domain_def ~> Domain_unfold
   Range_def ~> Domain_converse [symmetric]
 
 Generalized theorems INF_INT_eq, INF_INT_eq2, SUP_UN_eq, SUP_UN_eq2.
 
 See theory "Relation" for examples for making use of pred/set
 conversions by means of attributes "to_set" and "to_pred".
 
 INCOMPATIBILITY.
 
 * Renamed facts about the power operation on relations, i.e., relpow
 to match the constant's name:
 
   rel_pow_1 ~> relpow_1
   rel_pow_0_I ~> relpow_0_I
   rel_pow_Suc_I ~> relpow_Suc_I
   rel_pow_Suc_I2 ~> relpow_Suc_I2
   rel_pow_0_E ~> relpow_0_E
   rel_pow_Suc_E ~> relpow_Suc_E
   rel_pow_E ~> relpow_E
   rel_pow_Suc_D2 ~> relpow_Suc_D2
   rel_pow_Suc_E2 ~> relpow_Suc_E2
   rel_pow_Suc_D2' ~> relpow_Suc_D2'
   rel_pow_E2 ~> relpow_E2
   rel_pow_add ~> relpow_add
   rel_pow_commute ~> relpow
   rel_pow_empty ~> relpow_empty:
   rtrancl_imp_UN_rel_pow ~> rtrancl_imp_UN_relpow
   rel_pow_imp_rtrancl ~> relpow_imp_rtrancl
   rtrancl_is_UN_rel_pow ~> rtrancl_is_UN_relpow
   rtrancl_imp_rel_pow ~> rtrancl_imp_relpow
   rel_pow_fun_conv ~> relpow_fun_conv
   rel_pow_finite_bounded1 ~> relpow_finite_bounded1
   rel_pow_finite_bounded ~> relpow_finite_bounded
   rtrancl_finite_eq_rel_pow ~> rtrancl_finite_eq_relpow
   trancl_finite_eq_rel_pow ~> trancl_finite_eq_relpow
   single_valued_rel_pow ~> single_valued_relpow
 
 INCOMPATIBILITY.
 
 * Theory Relation: Consolidated constant name for relation composition
 and corresponding theorem names:
 
   - Renamed constant rel_comp to relcomp.
 
   - Dropped abbreviation pred_comp. Use relcompp instead.
 
   - Renamed theorems:
 
     rel_compI ~> relcompI
     rel_compEpair ~> relcompEpair
     rel_compE ~> relcompE
     pred_comp_rel_comp_eq ~> relcompp_relcomp_eq
     rel_comp_empty1 ~> relcomp_empty1
     rel_comp_mono ~> relcomp_mono
     rel_comp_subset_Sigma ~> relcomp_subset_Sigma
     rel_comp_distrib ~> relcomp_distrib
     rel_comp_distrib2 ~> relcomp_distrib2
     rel_comp_UNION_distrib ~> relcomp_UNION_distrib
     rel_comp_UNION_distrib2 ~> relcomp_UNION_distrib2
     single_valued_rel_comp ~> single_valued_relcomp
     rel_comp_def ~> relcomp_unfold
     converse_rel_comp ~> converse_relcomp
     pred_compI ~> relcomppI
     pred_compE ~> relcomppE
     pred_comp_bot1 ~> relcompp_bot1
     pred_comp_bot2 ~> relcompp_bot2
     transp_pred_comp_less_eq ~> transp_relcompp_less_eq
     pred_comp_mono ~> relcompp_mono
     pred_comp_distrib ~> relcompp_distrib
     pred_comp_distrib2 ~> relcompp_distrib2
     converse_pred_comp ~> converse_relcompp
 
     finite_rel_comp ~> finite_relcomp
 
     set_rel_comp ~> set_relcomp
 
 INCOMPATIBILITY.
 
 * Theory Divides: Discontinued redundant theorems about div and mod.
 INCOMPATIBILITY, use the corresponding generic theorems instead.
 
   DIVISION_BY_ZERO ~> div_by_0, mod_by_0
   zdiv_self ~> div_self
   zmod_self ~> mod_self
   zdiv_zero ~> div_0
   zmod_zero ~> mod_0
   zdiv_zmod_equality ~> div_mod_equality2
   zdiv_zmod_equality2 ~> div_mod_equality
   zmod_zdiv_trivial ~> mod_div_trivial
   zdiv_zminus_zminus ~> div_minus_minus
   zmod_zminus_zminus ~> mod_minus_minus
   zdiv_zminus2 ~> div_minus_right
   zmod_zminus2 ~> mod_minus_right
   zdiv_minus1_right ~> div_minus1_right
   zmod_minus1_right ~> mod_minus1_right
   zdvd_mult_div_cancel ~> dvd_mult_div_cancel
   zmod_zmult1_eq ~> mod_mult_right_eq
   zpower_zmod ~> power_mod
   zdvd_zmod ~> dvd_mod
   zdvd_zmod_imp_zdvd ~> dvd_mod_imp_dvd
   mod_mult_distrib ~> mult_mod_left
   mod_mult_distrib2 ~> mult_mod_right
 
 * Removed redundant theorems nat_mult_2 and nat_mult_2_right; use
 generic mult_2 and mult_2_right instead. INCOMPATIBILITY.
 
 * Finite_Set.fold now qualified.  INCOMPATIBILITY.
 
 * Consolidated theorem names concerning fold combinators:
 
   inf_INFI_fold_inf ~> inf_INF_fold_inf
   sup_SUPR_fold_sup ~> sup_SUP_fold_sup
   INFI_fold_inf ~> INF_fold_inf
   SUPR_fold_sup ~> SUP_fold_sup
   union_set ~> union_set_fold
   minus_set ~> minus_set_fold
   INFI_set_fold ~> INF_set_fold
   SUPR_set_fold ~> SUP_set_fold
   INF_code ~> INF_set_foldr
   SUP_code ~> SUP_set_foldr
   foldr.simps ~> foldr.simps (in point-free formulation)
   foldr_fold_rev ~> foldr_conv_fold
   foldl_fold ~> foldl_conv_fold
   foldr_foldr ~> foldr_conv_foldl
   foldl_foldr ~> foldl_conv_foldr
   fold_set_remdups ~> fold_set_fold_remdups
   fold_set ~> fold_set_fold
   fold1_set ~> fold1_set_fold
 
 INCOMPATIBILITY.
 
 * Dropped rarely useful theorems concerning fold combinators:
 foldl_apply, foldl_fun_comm, foldl_rev, fold_weak_invariant,
 rev_foldl_cons, fold_set_remdups, fold_set, fold_set1,
 concat_conv_foldl, foldl_weak_invariant, foldl_invariant,
 foldr_invariant, foldl_absorb0, foldl_foldr1_lemma, foldl_foldr1,
 listsum_conv_fold, listsum_foldl, sort_foldl_insort, foldl_assoc,
 foldr_conv_foldl, start_le_sum, elem_le_sum, sum_eq_0_conv.
 INCOMPATIBILITY.  For the common phrases "%xs. List.foldr plus xs 0"
 and "List.foldl plus 0", prefer "List.listsum".  Otherwise it can be
 useful to boil down "List.foldr" and "List.foldl" to "List.fold" by
 unfolding "foldr_conv_fold" and "foldl_conv_fold".
 
 * Dropped lemmas minus_set_foldr, union_set_foldr, union_coset_foldr,
 inter_coset_foldr, Inf_fin_set_foldr, Sup_fin_set_foldr,
 Min_fin_set_foldr, Max_fin_set_foldr, Inf_set_foldr, Sup_set_foldr,
 INF_set_foldr, SUP_set_foldr.  INCOMPATIBILITY.  Prefer corresponding
 lemmas over fold rather than foldr, or make use of lemmas
 fold_conv_foldr and fold_rev.
 
 * Congruence rules Option.map_cong and Option.bind_cong for recursion
 through option types.
 
 * "Transitive_Closure.ntrancl": bounded transitive closure on
 relations.
 
 * Constant "Set.not_member" now qualified.  INCOMPATIBILITY.
 
 * Theory Int: Discontinued many legacy theorems specific to type int.
 INCOMPATIBILITY, use the corresponding generic theorems instead.
 
   zminus_zminus ~> minus_minus
   zminus_0 ~> minus_zero
   zminus_zadd_distrib ~> minus_add_distrib
   zadd_commute ~> add_commute
   zadd_assoc ~> add_assoc
   zadd_left_commute ~> add_left_commute
   zadd_ac ~> add_ac
   zmult_ac ~> mult_ac
   zadd_0 ~> add_0_left
   zadd_0_right ~> add_0_right
   zadd_zminus_inverse2 ~> left_minus
   zmult_zminus ~> mult_minus_left
   zmult_commute ~> mult_commute
   zmult_assoc ~> mult_assoc
   zadd_zmult_distrib ~> left_distrib
   zadd_zmult_distrib2 ~> right_distrib
   zdiff_zmult_distrib ~> left_diff_distrib
   zdiff_zmult_distrib2 ~> right_diff_distrib
   zmult_1 ~> mult_1_left
   zmult_1_right ~> mult_1_right
   zle_refl ~> order_refl
   zle_trans ~> order_trans
   zle_antisym ~> order_antisym
   zle_linear ~> linorder_linear
   zless_linear ~> linorder_less_linear
   zadd_left_mono ~> add_left_mono
   zadd_strict_right_mono ~> add_strict_right_mono
   zadd_zless_mono ~> add_less_le_mono
   int_0_less_1 ~> zero_less_one
   int_0_neq_1 ~> zero_neq_one
   zless_le ~> less_le
   zpower_zadd_distrib ~> power_add
   zero_less_zpower_abs_iff ~> zero_less_power_abs_iff
   zero_le_zpower_abs ~> zero_le_power_abs
 
 * Theory Deriv: Renamed
 
   DERIV_nonneg_imp_nonincreasing ~> DERIV_nonneg_imp_nondecreasing
 
 * Theory Library/Multiset: Improved code generation of multisets.
 
 * Theory HOL/Library/Set_Algebras: Addition and multiplication on sets
 are expressed via type classes again. The special syntax
 \<oplus>/\<otimes> has been replaced by plain +/*. Removed constant
 setsum_set, which is now subsumed by Big_Operators.setsum.
 INCOMPATIBILITY.
 
 * Theory HOL/Library/Diagonalize has been removed. INCOMPATIBILITY,
 use theory HOL/Library/Nat_Bijection instead.
 
 * Theory HOL/Library/RBT_Impl: Backing implementation of red-black
 trees is now inside a type class context.  Names of affected
 operations and lemmas have been prefixed by rbt_.  INCOMPATIBILITY for
 theories working directly with raw red-black trees, adapt the names as
 follows:
 
   Operations:
   bulkload -> rbt_bulkload
   del_from_left -> rbt_del_from_left
   del_from_right -> rbt_del_from_right
   del -> rbt_del
   delete -> rbt_delete
   ins -> rbt_ins
   insert -> rbt_insert
   insertw -> rbt_insert_with
   insert_with_key -> rbt_insert_with_key
   map_entry -> rbt_map_entry
   lookup -> rbt_lookup
   sorted -> rbt_sorted
   tree_greater -> rbt_greater
   tree_less -> rbt_less
   tree_less_symbol -> rbt_less_symbol
   union -> rbt_union
   union_with -> rbt_union_with
   union_with_key -> rbt_union_with_key
 
   Lemmas:
   balance_left_sorted -> balance_left_rbt_sorted
   balance_left_tree_greater -> balance_left_rbt_greater
   balance_left_tree_less -> balance_left_rbt_less
   balance_right_sorted -> balance_right_rbt_sorted
   balance_right_tree_greater -> balance_right_rbt_greater
   balance_right_tree_less -> balance_right_rbt_less
   balance_sorted -> balance_rbt_sorted
   balance_tree_greater -> balance_rbt_greater
   balance_tree_less -> balance_rbt_less
   bulkload_is_rbt -> rbt_bulkload_is_rbt
   combine_sorted -> combine_rbt_sorted
   combine_tree_greater -> combine_rbt_greater
   combine_tree_less -> combine_rbt_less
   delete_in_tree -> rbt_delete_in_tree
   delete_is_rbt -> rbt_delete_is_rbt
   del_from_left_tree_greater -> rbt_del_from_left_rbt_greater
   del_from_left_tree_less -> rbt_del_from_left_rbt_less
   del_from_right_tree_greater -> rbt_del_from_right_rbt_greater
   del_from_right_tree_less -> rbt_del_from_right_rbt_less
   del_in_tree -> rbt_del_in_tree
   del_inv1_inv2 -> rbt_del_inv1_inv2
   del_sorted -> rbt_del_rbt_sorted
   del_tree_greater -> rbt_del_rbt_greater
   del_tree_less -> rbt_del_rbt_less
   dom_lookup_Branch -> dom_rbt_lookup_Branch
   entries_lookup -> entries_rbt_lookup
   finite_dom_lookup -> finite_dom_rbt_lookup
   insert_sorted -> rbt_insert_rbt_sorted
   insertw_is_rbt -> rbt_insertw_is_rbt
   insertwk_is_rbt -> rbt_insertwk_is_rbt
   insertwk_sorted -> rbt_insertwk_rbt_sorted
   insertw_sorted -> rbt_insertw_rbt_sorted
   ins_sorted -> ins_rbt_sorted
   ins_tree_greater -> ins_rbt_greater
   ins_tree_less -> ins_rbt_less
   is_rbt_sorted -> is_rbt_rbt_sorted
   lookup_balance -> rbt_lookup_balance
   lookup_bulkload -> rbt_lookup_rbt_bulkload
   lookup_delete -> rbt_lookup_rbt_delete
   lookup_Empty -> rbt_lookup_Empty
   lookup_from_in_tree -> rbt_lookup_from_in_tree
   lookup_in_tree -> rbt_lookup_in_tree
   lookup_ins -> rbt_lookup_ins
   lookup_insert -> rbt_lookup_rbt_insert
   lookup_insertw -> rbt_lookup_rbt_insertw
   lookup_insertwk -> rbt_lookup_rbt_insertwk
   lookup_keys -> rbt_lookup_keys
   lookup_map -> rbt_lookup_map
   lookup_map_entry -> rbt_lookup_rbt_map_entry
   lookup_tree_greater -> rbt_lookup_rbt_greater
   lookup_tree_less -> rbt_lookup_rbt_less
   lookup_union -> rbt_lookup_rbt_union
   map_entry_color_of -> rbt_map_entry_color_of
   map_entry_inv1 -> rbt_map_entry_inv1
   map_entry_inv2 -> rbt_map_entry_inv2
   map_entry_is_rbt -> rbt_map_entry_is_rbt
   map_entry_sorted -> rbt_map_entry_rbt_sorted
   map_entry_tree_greater -> rbt_map_entry_rbt_greater
   map_entry_tree_less -> rbt_map_entry_rbt_less
   map_tree_greater -> map_rbt_greater
   map_tree_less -> map_rbt_less
   map_sorted -> map_rbt_sorted
   paint_sorted -> paint_rbt_sorted
   paint_lookup -> paint_rbt_lookup
   paint_tree_greater -> paint_rbt_greater
   paint_tree_less -> paint_rbt_less
   sorted_entries -> rbt_sorted_entries
   tree_greater_eq_trans -> rbt_greater_eq_trans
   tree_greater_nit -> rbt_greater_nit
   tree_greater_prop -> rbt_greater_prop
   tree_greater_simps -> rbt_greater_simps
   tree_greater_trans -> rbt_greater_trans
   tree_less_eq_trans -> rbt_less_eq_trans
   tree_less_nit -> rbt_less_nit
   tree_less_prop -> rbt_less_prop
   tree_less_simps -> rbt_less_simps
   tree_less_trans -> rbt_less_trans
   tree_ord_props -> rbt_ord_props
   union_Branch -> rbt_union_Branch
   union_is_rbt -> rbt_union_is_rbt
   unionw_is_rbt -> rbt_unionw_is_rbt
   unionwk_is_rbt -> rbt_unionwk_is_rbt
   unionwk_sorted -> rbt_unionwk_rbt_sorted
 
 * Theory HOL/Library/Float: Floating point numbers are now defined as
 a subset of the real numbers.  All operations are defined using the
 lifing-framework and proofs use the transfer method.  INCOMPATIBILITY.
 
   Changed Operations:
   float_abs -> abs
   float_nprt -> nprt
   float_pprt -> pprt
   pow2 -> use powr
   round_down -> float_round_down
   round_up -> float_round_up
   scale -> exponent
 
   Removed Operations:
   ceiling_fl, lb_mult, lb_mod, ub_mult, ub_mod
 
   Renamed Lemmas:
   abs_float_def -> Float.compute_float_abs
   bitlen_ge0 -> bitlen_nonneg
   bitlen.simps -> Float.compute_bitlen
   float_components -> Float_mantissa_exponent
   float_divl.simps -> Float.compute_float_divl
   float_divr.simps -> Float.compute_float_divr
   float_eq_odd -> mult_powr_eq_mult_powr_iff
   float_power -> real_of_float_power
   lapprox_posrat_def -> Float.compute_lapprox_posrat
   lapprox_rat.simps -> Float.compute_lapprox_rat
   le_float_def' -> Float.compute_float_le
   le_float_def -> less_eq_float.rep_eq
   less_float_def' -> Float.compute_float_less
   less_float_def -> less_float.rep_eq
   normfloat_def -> Float.compute_normfloat
   normfloat_imp_odd_or_zero -> mantissa_not_dvd and mantissa_noteq_0
   normfloat -> normfloat_def
   normfloat_unique -> use normfloat_def
   number_of_float_Float -> Float.compute_float_numeral, Float.compute_float_neg_numeral
   one_float_def -> Float.compute_float_one
   plus_float_def -> Float.compute_float_plus
   rapprox_posrat_def -> Float.compute_rapprox_posrat
   rapprox_rat.simps -> Float.compute_rapprox_rat
   real_of_float_0 -> zero_float.rep_eq
   real_of_float_1 -> one_float.rep_eq
   real_of_float_abs -> abs_float.rep_eq
   real_of_float_add -> plus_float.rep_eq
   real_of_float_minus -> uminus_float.rep_eq
   real_of_float_mult -> times_float.rep_eq
   real_of_float_simp -> Float.rep_eq
   real_of_float_sub -> minus_float.rep_eq
   round_down.simps -> Float.compute_float_round_down
   round_up.simps -> Float.compute_float_round_up
   times_float_def -> Float.compute_float_times
   uminus_float_def -> Float.compute_float_uminus
   zero_float_def -> Float.compute_float_zero
 
   Lemmas not necessary anymore, use the transfer method:
   bitlen_B0, bitlen_B1, bitlen_ge1, bitlen_Min, bitlen_Pls, float_divl,
   float_divr, float_le_simp, float_less1_mantissa_bound,
   float_less_simp, float_less_zero, float_le_zero,
   float_pos_less1_e_neg, float_pos_m_pos, float_split, float_split2,
   floor_pos_exp, lapprox_posrat, lapprox_posrat_bottom, lapprox_rat,
   lapprox_rat_bottom, normalized_float, rapprox_posrat,
   rapprox_posrat_le1, rapprox_rat, real_of_float_ge0_exp,
   real_of_float_neg_exp, real_of_float_nge0_exp, round_down floor_fl,
   round_up, zero_le_float, zero_less_float
 
 * New theory HOL/Library/DAList provides an abstract type for
 association lists with distinct keys.
 
 * Session HOL/IMP: Added new theory of abstract interpretation of
 annotated commands.
 
 * Session HOL-Import: Re-implementation from scratch is faster,
 simpler, and more scalable.  Requires a proof bundle, which is
 available as an external component.  Discontinued old (and mostly
 dead) Importer for HOL4 and HOL Light.  INCOMPATIBILITY.
 
 * Session HOL-Word: Discontinued many redundant theorems specific to
 type 'a word. INCOMPATIBILITY, use the corresponding generic theorems
 instead.
 
   word_sub_alt ~> word_sub_wi
   word_add_alt ~> word_add_def
   word_mult_alt ~> word_mult_def
   word_minus_alt ~> word_minus_def
   word_0_alt ~> word_0_wi
   word_1_alt ~> word_1_wi
   word_add_0 ~> add_0_left
   word_add_0_right ~> add_0_right
   word_mult_1 ~> mult_1_left
   word_mult_1_right ~> mult_1_right
   word_add_commute ~> add_commute
   word_add_assoc ~> add_assoc
   word_add_left_commute ~> add_left_commute
   word_mult_commute ~> mult_commute
   word_mult_assoc ~> mult_assoc
   word_mult_left_commute ~> mult_left_commute
   word_left_distrib ~> left_distrib
   word_right_distrib ~> right_distrib
   word_left_minus ~> left_minus
   word_diff_0_right ~> diff_0_right
   word_diff_self ~> diff_self
   word_sub_def ~> diff_minus
   word_diff_minus ~> diff_minus
   word_add_ac ~> add_ac
   word_mult_ac ~> mult_ac
   word_plus_ac0 ~> add_0_left add_0_right add_ac
   word_times_ac1 ~> mult_1_left mult_1_right mult_ac
   word_order_trans ~> order_trans
   word_order_refl ~> order_refl
   word_order_antisym ~> order_antisym
   word_order_linear ~> linorder_linear
   lenw1_zero_neq_one ~> zero_neq_one
   word_number_of_eq ~> number_of_eq
   word_of_int_add_hom ~> wi_hom_add
   word_of_int_sub_hom ~> wi_hom_sub
   word_of_int_mult_hom ~> wi_hom_mult
   word_of_int_minus_hom ~> wi_hom_neg
   word_of_int_succ_hom ~> wi_hom_succ
   word_of_int_pred_hom ~> wi_hom_pred
   word_of_int_0_hom ~> word_0_wi
   word_of_int_1_hom ~> word_1_wi
 
 * Session HOL-Word: New proof method "word_bitwise" for splitting
 machine word equalities and inequalities into logical circuits,
 defined in HOL/Word/WordBitwise.thy.  Supports addition, subtraction,
 multiplication, shifting by constants, bitwise operators and numeric
 constants.  Requires fixed-length word types, not 'a word.  Solves
 many standard word identities outright and converts more into first
 order problems amenable to blast or similar.  See also examples in
 HOL/Word/Examples/WordExamples.thy.
 
 * Session HOL-Probability: Introduced the type "'a measure" to
 represent measures, this replaces the records 'a algebra and 'a
 measure_space.  The locales based on subset_class now have two
 locale-parameters the space \<Omega> and the set of measurable sets M.
 The product of probability spaces uses now the same constant as the
 finite product of sigma-finite measure spaces "PiM :: ('i => 'a)
 measure".  Most constants are defined now outside of locales and gain
 an additional parameter, like null_sets, almost_eventually or \<mu>'.
 Measure space constructions for distributions and densities now got
 their own constants distr and density.  Instead of using locales to
 describe measure spaces with a finite space, the measure count_space
 and point_measure is introduced.  INCOMPATIBILITY.
 
   Renamed constants:
   measure -> emeasure
   finite_measure.\<mu>' -> measure
   product_algebra_generator -> prod_algebra
   product_prob_space.emb -> prod_emb
   product_prob_space.infprod_algebra -> PiM
 
   Removed locales:
   completeable_measure_space
   finite_measure_space
   finite_prob_space
   finite_product_finite_prob_space
   finite_product_sigma_algebra
   finite_sigma_algebra
   measure_space
   pair_finite_prob_space
   pair_finite_sigma_algebra
   pair_finite_space
   pair_sigma_algebra
   product_sigma_algebra
 
   Removed constants:
   conditional_space
   distribution -> use distr measure, or distributed predicate
   image_space
   joint_distribution -> use distr measure, or distributed predicate
   pair_measure_generator
   product_prob_space.infprod_algebra -> use PiM
   subvimage
 
   Replacement theorems:
   finite_additivity_sufficient -> ring_of_sets.countably_additiveI_finite
   finite_measure.empty_measure -> measure_empty
   finite_measure.finite_continuity_from_above -> finite_measure.finite_Lim_measure_decseq
   finite_measure.finite_continuity_from_below -> finite_measure.finite_Lim_measure_incseq
   finite_measure.finite_measure_countably_subadditive -> finite_measure.finite_measure_subadditive_countably
   finite_measure.finite_measure_eq -> finite_measure.emeasure_eq_measure
   finite_measure.finite_measure -> finite_measure.emeasure_finite
   finite_measure.finite_measure_finite_singleton -> finite_measure.finite_measure_eq_setsum_singleton
   finite_measure.positive_measure' -> measure_nonneg
   finite_measure.real_measure -> finite_measure.emeasure_real
   finite_product_prob_space.finite_measure_times -> finite_product_prob_space.finite_measure_PiM_emb
   finite_product_sigma_algebra.in_P -> sets_PiM_I_finite
   finite_product_sigma_algebra.P_empty -> space_PiM_empty, sets_PiM_empty
   information_space.conditional_entropy_eq -> information_space.conditional_entropy_simple_distributed
   information_space.conditional_entropy_positive -> information_space.conditional_entropy_nonneg_simple
   information_space.conditional_mutual_information_eq_mutual_information -> information_space.conditional_mutual_information_eq_mutual_information_simple
   information_space.conditional_mutual_information_generic_positive -> information_space.conditional_mutual_information_nonneg_simple
   information_space.conditional_mutual_information_positive -> information_space.conditional_mutual_information_nonneg_simple
   information_space.entropy_commute -> information_space.entropy_commute_simple
   information_space.entropy_eq -> information_space.entropy_simple_distributed
   information_space.entropy_generic_eq -> information_space.entropy_simple_distributed
   information_space.entropy_positive -> information_space.entropy_nonneg_simple
   information_space.entropy_uniform_max -> information_space.entropy_uniform
   information_space.KL_eq_0_imp -> information_space.KL_eq_0_iff_eq
   information_space.KL_eq_0 -> information_space.KL_same_eq_0
   information_space.KL_ge_0 -> information_space.KL_nonneg
   information_space.mutual_information_eq -> information_space.mutual_information_simple_distributed
   information_space.mutual_information_positive -> information_space.mutual_information_nonneg_simple
   Int_stable_cuboids -> Int_stable_atLeastAtMost
   Int_stable_product_algebra_generator -> positive_integral
   measure_preserving -> equality "distr M N f = N" "f : measurable M N"
   measure_space.additive -> emeasure_additive
   measure_space.AE_iff_null_set -> AE_iff_null
   measure_space.almost_everywhere_def -> eventually_ae_filter
   measure_space.almost_everywhere_vimage -> AE_distrD
   measure_space.continuity_from_above -> INF_emeasure_decseq
   measure_space.continuity_from_above_Lim -> Lim_emeasure_decseq
   measure_space.continuity_from_below_Lim -> Lim_emeasure_incseq
   measure_space.continuity_from_below -> SUP_emeasure_incseq
   measure_space_density -> emeasure_density
   measure_space.density_is_absolutely_continuous -> absolutely_continuousI_density
   measure_space.integrable_vimage -> integrable_distr
   measure_space.integral_translated_density -> integral_density
   measure_space.integral_vimage -> integral_distr
   measure_space.measure_additive -> plus_emeasure
   measure_space.measure_compl -> emeasure_compl
   measure_space.measure_countable_increasing -> emeasure_countable_increasing
   measure_space.measure_countably_subadditive -> emeasure_subadditive_countably
   measure_space.measure_decseq -> decseq_emeasure
   measure_space.measure_Diff -> emeasure_Diff
   measure_space.measure_Diff_null_set -> emeasure_Diff_null_set
   measure_space.measure_eq_0 -> emeasure_eq_0
   measure_space.measure_finitely_subadditive -> emeasure_subadditive_finite
   measure_space.measure_finite_singleton -> emeasure_eq_setsum_singleton
   measure_space.measure_incseq -> incseq_emeasure
   measure_space.measure_insert -> emeasure_insert
   measure_space.measure_mono -> emeasure_mono
   measure_space.measure_not_negative -> emeasure_not_MInf
   measure_space.measure_preserving_Int_stable -> measure_eqI_generator_eq
   measure_space.measure_setsum -> setsum_emeasure
   measure_space.measure_setsum_split -> setsum_emeasure_cover
   measure_space.measure_space_vimage -> emeasure_distr
   measure_space.measure_subadditive_finite -> emeasure_subadditive_finite
   measure_space.measure_subadditive -> subadditive
   measure_space.measure_top -> emeasure_space
   measure_space.measure_UN_eq_0 -> emeasure_UN_eq_0
   measure_space.measure_Un_null_set -> emeasure_Un_null_set
   measure_space.positive_integral_translated_density -> positive_integral_density
   measure_space.positive_integral_vimage -> positive_integral_distr
   measure_space.real_continuity_from_above -> Lim_measure_decseq
   measure_space.real_continuity_from_below -> Lim_measure_incseq
   measure_space.real_measure_countably_subadditive -> measure_subadditive_countably
   measure_space.real_measure_Diff -> measure_Diff
   measure_space.real_measure_finite_Union -> measure_finite_Union
   measure_space.real_measure_setsum_singleton -> measure_eq_setsum_singleton
   measure_space.real_measure_subadditive -> measure_subadditive
   measure_space.real_measure_Union -> measure_Union
   measure_space.real_measure_UNION -> measure_UNION
   measure_space.simple_function_vimage -> simple_function_comp
   measure_space.simple_integral_vimage -> simple_integral_distr
   measure_space.simple_integral_vimage -> simple_integral_distr
   measure_unique_Int_stable -> measure_eqI_generator_eq
   measure_unique_Int_stable_vimage -> measure_eqI_generator_eq
   pair_sigma_algebra.measurable_cut_fst -> sets_Pair1
   pair_sigma_algebra.measurable_cut_snd -> sets_Pair2
   pair_sigma_algebra.measurable_pair_image_fst -> measurable_Pair1
   pair_sigma_algebra.measurable_pair_image_snd -> measurable_Pair2
   pair_sigma_algebra.measurable_product_swap -> measurable_pair_swap_iff
   pair_sigma_algebra.pair_sigma_algebra_measurable -> measurable_pair_swap
   pair_sigma_algebra.pair_sigma_algebra_swap_measurable -> measurable_pair_swap'
   pair_sigma_algebra.sets_swap -> sets_pair_swap
   pair_sigma_finite.measure_cut_measurable_fst -> pair_sigma_finite.measurable_emeasure_Pair1
   pair_sigma_finite.measure_cut_measurable_snd -> pair_sigma_finite.measurable_emeasure_Pair2
   pair_sigma_finite.measure_preserving_swap -> pair_sigma_finite.distr_pair_swap
   pair_sigma_finite.pair_measure_alt2 -> pair_sigma_finite.emeasure_pair_measure_alt2
   pair_sigma_finite.pair_measure_alt -> pair_sigma_finite.emeasure_pair_measure_alt
   pair_sigma_finite.pair_measure_times -> pair_sigma_finite.emeasure_pair_measure_Times
   prob_space.indep_distribution_eq_measure -> prob_space.indep_vars_iff_distr_eq_PiM
   prob_space.indep_var_distributionD -> prob_space.indep_var_distribution_eq
   prob_space.measure_space_1 -> prob_space.emeasure_space_1
   prob_space.prob_space_vimage -> prob_space_distr
   prob_space.random_variable_restrict -> measurable_restrict
   prob_space_unique_Int_stable -> measure_eqI_prob_space
   product_algebraE -> prod_algebraE_all
   product_algebra_generator_der -> prod_algebra_eq_finite
   product_algebra_generator_into_space -> prod_algebra_sets_into_space
   product_algebraI -> sets_PiM_I_finite
   product_measure_exists -> product_sigma_finite.sigma_finite
   product_prob_space.finite_index_eq_finite_product -> product_prob_space.sets_PiM_generator
   product_prob_space.finite_measure_infprod_emb_Pi -> product_prob_space.measure_PiM_emb
   product_prob_space.infprod_spec -> product_prob_space.emeasure_PiM_emb_not_empty
   product_prob_space.measurable_component -> measurable_component_singleton
   product_prob_space.measurable_emb -> measurable_prod_emb
   product_prob_space.measurable_into_infprod_algebra -> measurable_PiM_single
   product_prob_space.measurable_singleton_infprod -> measurable_component_singleton
   product_prob_space.measure_emb -> emeasure_prod_emb
   product_prob_space.measure_preserving_restrict -> product_prob_space.distr_restrict
   product_sigma_algebra.product_algebra_into_space -> space_closed
   product_sigma_finite.measure_fold -> product_sigma_finite.distr_merge
   product_sigma_finite.measure_preserving_component_singelton -> product_sigma_finite.distr_singleton
   product_sigma_finite.measure_preserving_merge -> product_sigma_finite.distr_merge
   sequence_space.measure_infprod -> sequence_space.measure_PiM_countable
   sets_product_algebra -> sets_PiM
   sigma_algebra.measurable_sigma -> measurable_measure_of
   sigma_finite_measure.disjoint_sigma_finite -> sigma_finite_disjoint
   sigma_finite_measure.RN_deriv_vimage -> sigma_finite_measure.RN_deriv_distr
   sigma_product_algebra_sigma_eq -> sigma_prod_algebra_sigma_eq
   space_product_algebra -> space_PiM
 
 * Session HOL-TPTP: support to parse and import TPTP problems (all
 languages) into Isabelle/HOL.
 
 
 *** FOL ***
 
 * New "case_product" attribute (see HOL).
 
 
 *** ZF ***
 
 * Greater support for structured proofs involving induction or case
 analysis.
 
 * Much greater use of mathematical symbols.
 
 * Removal of many ML theorem bindings.  INCOMPATIBILITY.
 
 
 *** ML ***
 
 * Antiquotation @{keyword "name"} produces a parser for outer syntax
 from a minor keyword introduced via theory header declaration.
 
 * Antiquotation @{command_spec "name"} produces the
 Outer_Syntax.command_spec from a major keyword introduced via theory
 header declaration; it can be passed to Outer_Syntax.command etc.
 
 * Local_Theory.define no longer hard-wires default theorem name
 "foo_def", but retains the binding as given.  If that is Binding.empty
 / Attrib.empty_binding, the result is not registered as user-level
 fact.  The Local_Theory.define_internal variant allows to specify a
 non-empty name (used for the foundation in the background theory),
 while omitting the fact binding in the user-context.  Potential
 INCOMPATIBILITY for derived definitional packages: need to specify
 naming policy for primitive definitions more explicitly.
 
 * Renamed Thm.capply to Thm.apply, and Thm.cabs to Thm.lambda in
 conformance with similar operations in structure Term and Logic.
 
 * Antiquotation @{attributes [...]} embeds attribute source
 representation into the ML text, which is particularly useful with
 declarations like Local_Theory.note.
 
 * Structure Proof_Context follows standard naming scheme.  Old
 ProofContext has been discontinued.  INCOMPATIBILITY.
 
 * Refined Local_Theory.declaration {syntax, pervasive}, with subtle
 change of semantics: update is applied to auxiliary local theory
 context as well.
 
 * Modernized some old-style infix operations:
 
   addeqcongs    ~> Simplifier.add_eqcong
   deleqcongs    ~> Simplifier.del_eqcong
   addcongs      ~> Simplifier.add_cong
   delcongs      ~> Simplifier.del_cong
   setmksimps    ~> Simplifier.set_mksimps
   setmkcong     ~> Simplifier.set_mkcong
   setmksym      ~> Simplifier.set_mksym
   setmkeqTrue   ~> Simplifier.set_mkeqTrue
   settermless   ~> Simplifier.set_termless
   setsubgoaler  ~> Simplifier.set_subgoaler
   addsplits     ~> Splitter.add_split
   delsplits     ~> Splitter.del_split
 
 
 *** System ***
 
 * USER_HOME settings variable points to cross-platform user home
 directory, which coincides with HOME on POSIX systems only.  Likewise,
 the Isabelle path specification "~" now expands to $USER_HOME, instead
 of former $HOME.  A different default for USER_HOME may be set
 explicitly in shell environment, before Isabelle settings are
 evaluated.  Minor INCOMPATIBILITY: need to adapt Isabelle path where
 the generic user home was intended.
 
 * ISABELLE_HOME_WINDOWS refers to ISABELLE_HOME in windows file name
 notation, which is useful for the jEdit file browser, for example.
 
 * ISABELLE_JDK_HOME settings variable points to JDK with javac and jar
 (not just JRE).
 
 
 
 New in Isabelle2011-1 (October 2011)
 ------------------------------------
 
 *** General ***
 
 * Improved Isabelle/jEdit Prover IDE (PIDE), which can be invoked as
 "isabelle jedit" or "ISABELLE_HOME/Isabelle" on the command line.
 
   - Management of multiple theory files directly from the editor
     buffer store -- bypassing the file-system (no requirement to save
     files for checking).
 
   - Markup of formal entities within the text buffer, with semantic
     highlighting, tooltips and hyperlinks to jump to defining source
     positions.
 
   - Improved text rendering, with sub/superscripts in the source
     buffer (including support for copy/paste wrt. output panel, HTML
     theory output and other non-Isabelle text boxes).
 
   - Refined scheduling of proof checking and printing of results,
     based on interactive editor view.  (Note: jEdit folding and
     narrowing allows to restrict buffer perspectives explicitly.)
 
   - Reduced CPU performance requirements, usable on machines with few
     cores.
 
   - Reduced memory requirements due to pruning of unused document
     versions (garbage collection).
 
 See also ~~/src/Tools/jEdit/README.html for further information,
 including some remaining limitations.
 
 * Theory loader: source files are exclusively located via the master
 directory of each theory node (where the .thy file itself resides).
 The global load path (such as src/HOL/Library) has been discontinued.
 Note that the path element ~~ may be used to reference theories in the
 Isabelle home folder -- for instance, "~~/src/HOL/Library/FuncSet".
 INCOMPATIBILITY.
 
 * Theory loader: source files are identified by content via SHA1
 digests.  Discontinued former path/modtime identification and optional
 ISABELLE_FILE_IDENT plugin scripts.
 
 * Parallelization of nested Isar proofs is subject to
 Goal.parallel_proofs_threshold (default 100).  See also isabelle
 usedir option -Q.
 
 * Name space: former unsynchronized references are now proper
 configuration options, with more conventional names:
 
   long_names   ~> names_long
   short_names  ~> names_short
   unique_names ~> names_unique
 
 Minor INCOMPATIBILITY, need to declare options in context like this:
 
   declare [[names_unique = false]]
 
 * Literal facts `prop` may contain dummy patterns, e.g. `_ = _`.  Note
 that the result needs to be unique, which means fact specifications
 may have to be refined after enriching a proof context.
 
 * Attribute "case_names" has been refined: the assumptions in each case
 can be named now by following the case name with [name1 name2 ...].
 
 * Isabelle/Isar reference manual has been updated and extended:
   - "Synopsis" provides a catalog of main Isar language concepts.
   - Formal references in syntax diagrams, via @{rail} antiquotation.
   - Updated material from classic "ref" manual, notably about
     "Classical Reasoner".
 
 
 *** HOL ***
 
 * Class bot and top require underlying partial order rather than
 preorder: uniqueness of bot and top is guaranteed.  INCOMPATIBILITY.
 
 * Class complete_lattice: generalized a couple of lemmas from sets;
 generalized theorems INF_cong and SUP_cong.  New type classes for
 complete boolean algebras and complete linear orders.  Lemmas
 Inf_less_iff, less_Sup_iff, INF_less_iff, less_SUP_iff now reside in
 class complete_linorder.
 
 Changed proposition of lemmas Inf_bool_def, Sup_bool_def, Inf_fun_def,
 Sup_fun_def, Inf_apply, Sup_apply.
 
 Removed redundant lemmas (the right hand side gives hints how to
 replace them for (metis ...), or (simp only: ...) proofs):
 
   Inf_singleton ~> Inf_insert [where A="{}", unfolded Inf_empty inf_top_right]
   Sup_singleton ~> Sup_insert [where A="{}", unfolded Sup_empty sup_bot_right]
   Inf_binary ~> Inf_insert, Inf_empty, and inf_top_right
   Sup_binary ~> Sup_insert, Sup_empty, and sup_bot_right
   Int_eq_Inter ~> Inf_insert, Inf_empty, and inf_top_right
   Un_eq_Union ~> Sup_insert, Sup_empty, and sup_bot_right
   Inter_def ~> INF_def, image_def
   Union_def ~> SUP_def, image_def
   INT_eq ~> INF_def, and image_def
   UN_eq ~> SUP_def, and image_def
   INF_subset ~> INF_superset_mono [OF _ order_refl]
 
 More consistent and comprehensive names:
 
   INTER_eq_Inter_image ~> INF_def
   UNION_eq_Union_image ~> SUP_def
   INFI_def ~> INF_def
   SUPR_def ~> SUP_def
   INF_leI ~> INF_lower
   INF_leI2 ~> INF_lower2
   le_INFI ~> INF_greatest
   le_SUPI ~> SUP_upper
   le_SUPI2 ~> SUP_upper2
   SUP_leI ~> SUP_least
   INFI_bool_eq ~> INF_bool_eq
   SUPR_bool_eq ~> SUP_bool_eq
   INFI_apply ~> INF_apply
   SUPR_apply ~> SUP_apply
   INTER_def ~> INTER_eq
   UNION_def ~> UNION_eq
 
 INCOMPATIBILITY.
 
 * Renamed theory Complete_Lattice to Complete_Lattices.
 INCOMPATIBILITY.
 
 * Theory Complete_Lattices: lemmas Inf_eq_top_iff, INF_eq_top_iff,
 INF_image, Inf_insert, INF_top, Inf_top_conv, INF_top_conv, SUP_bot,
 Sup_bot_conv, SUP_bot_conv, Sup_eq_top_iff, SUP_eq_top_iff, SUP_image,
 Sup_insert are now declared as [simp].  INCOMPATIBILITY.
 
 * Theory Lattice: lemmas compl_inf_bot, compl_le_comp_iff,
 compl_sup_top, inf_idem, inf_left_idem, inf_sup_absorb, sup_idem,
 sup_inf_absob, sup_left_idem are now declared as [simp].  Minor
 INCOMPATIBILITY.
 
 * Added syntactic classes "inf" and "sup" for the respective
 constants.  INCOMPATIBILITY: Changes in the argument order of the
 (mostly internal) locale predicates for some derived classes.
 
 * Theorem collections ball_simps and bex_simps do not contain theorems
 referring to UNION any longer; these have been moved to collection
 UN_ball_bex_simps.  INCOMPATIBILITY.
 
 * Theory Archimedean_Field: floor now is defined as parameter of a
 separate type class floor_ceiling.
 
 * Theory Finite_Set: more coherent development of fold_set locales:
 
     locale fun_left_comm ~> locale comp_fun_commute
     locale fun_left_comm_idem ~> locale comp_fun_idem
 
 Both use point-free characterization; interpretation proofs may need
 adjustment.  INCOMPATIBILITY.
 
 * Theory Limits: Type "'a net" has been renamed to "'a filter", in
 accordance with standard mathematical terminology. INCOMPATIBILITY.
 
 * Theory Complex_Main: The locale interpretations for the
 bounded_linear and bounded_bilinear locales have been removed, in
 order to reduce the number of duplicate lemmas. Users must use the
 original names for distributivity theorems, potential INCOMPATIBILITY.
 
   divide.add ~> add_divide_distrib
   divide.diff ~> diff_divide_distrib
   divide.setsum ~> setsum_divide_distrib
   mult.add_right ~> right_distrib
   mult.diff_right ~> right_diff_distrib
   mult_right.setsum ~> setsum_right_distrib
   mult_left.diff ~> left_diff_distrib
 
 * Theory Complex_Main: Several redundant theorems have been removed or
 replaced by more general versions. INCOMPATIBILITY.
 
   real_diff_def ~> minus_real_def
   real_divide_def ~> divide_real_def
   real_less_def ~> less_le
   real_abs_def ~> abs_real_def
   real_sgn_def ~> sgn_real_def
   real_mult_commute ~> mult_commute
   real_mult_assoc ~> mult_assoc
   real_mult_1 ~> mult_1_left
   real_add_mult_distrib ~> left_distrib
   real_zero_not_eq_one ~> zero_neq_one
   real_mult_inverse_left ~> left_inverse
   INVERSE_ZERO ~> inverse_zero
   real_le_refl ~> order_refl
   real_le_antisym ~> order_antisym
   real_le_trans ~> order_trans
   real_le_linear ~> linear
   real_le_eq_diff ~> le_iff_diff_le_0
   real_add_left_mono ~> add_left_mono
   real_mult_order ~> mult_pos_pos
   real_mult_less_mono2 ~> mult_strict_left_mono
   real_of_int_real_of_nat ~> real_of_int_of_nat_eq
   real_0_le_divide_iff ~> zero_le_divide_iff
   realpow_two_disj ~> power2_eq_iff
   real_squared_diff_one_factored ~> square_diff_one_factored
   realpow_two_diff ~> square_diff_square_factored
   reals_complete2 ~> complete_real
   real_sum_squared_expand ~> power2_sum
   exp_ln_eq ~> ln_unique
   expi_add ~> exp_add
   expi_zero ~> exp_zero
   lemma_DERIV_subst ~> DERIV_cong
   LIMSEQ_Zfun_iff ~> tendsto_Zfun_iff
   LIMSEQ_const ~> tendsto_const
   LIMSEQ_norm ~> tendsto_norm
   LIMSEQ_add ~> tendsto_add
   LIMSEQ_minus ~> tendsto_minus
   LIMSEQ_minus_cancel ~> tendsto_minus_cancel
   LIMSEQ_diff ~> tendsto_diff
   bounded_linear.LIMSEQ ~> bounded_linear.tendsto
   bounded_bilinear.LIMSEQ ~> bounded_bilinear.tendsto
   LIMSEQ_mult ~> tendsto_mult
   LIMSEQ_inverse ~> tendsto_inverse
   LIMSEQ_divide ~> tendsto_divide
   LIMSEQ_pow ~> tendsto_power
   LIMSEQ_setsum ~> tendsto_setsum
   LIMSEQ_setprod ~> tendsto_setprod
   LIMSEQ_norm_zero ~> tendsto_norm_zero_iff
   LIMSEQ_rabs_zero ~> tendsto_rabs_zero_iff
   LIMSEQ_imp_rabs ~> tendsto_rabs
   LIMSEQ_add_minus ~> tendsto_add [OF _ tendsto_minus]
   LIMSEQ_add_const ~> tendsto_add [OF _ tendsto_const]
   LIMSEQ_diff_const ~> tendsto_diff [OF _ tendsto_const]
   LIMSEQ_Complex ~> tendsto_Complex
   LIM_ident ~> tendsto_ident_at
   LIM_const ~> tendsto_const
   LIM_add ~> tendsto_add
   LIM_add_zero ~> tendsto_add_zero
   LIM_minus ~> tendsto_minus
   LIM_diff ~> tendsto_diff
   LIM_norm ~> tendsto_norm
   LIM_norm_zero ~> tendsto_norm_zero
   LIM_norm_zero_cancel ~> tendsto_norm_zero_cancel
   LIM_norm_zero_iff ~> tendsto_norm_zero_iff
   LIM_rabs ~> tendsto_rabs
   LIM_rabs_zero ~> tendsto_rabs_zero
   LIM_rabs_zero_cancel ~> tendsto_rabs_zero_cancel
   LIM_rabs_zero_iff ~> tendsto_rabs_zero_iff
   LIM_compose ~> tendsto_compose
   LIM_mult ~> tendsto_mult
   LIM_scaleR ~> tendsto_scaleR
   LIM_of_real ~> tendsto_of_real
   LIM_power ~> tendsto_power
   LIM_inverse ~> tendsto_inverse
   LIM_sgn ~> tendsto_sgn
   isCont_LIM_compose ~> isCont_tendsto_compose
   bounded_linear.LIM ~> bounded_linear.tendsto
   bounded_linear.LIM_zero ~> bounded_linear.tendsto_zero
   bounded_bilinear.LIM ~> bounded_bilinear.tendsto
   bounded_bilinear.LIM_prod_zero ~> bounded_bilinear.tendsto_zero
   bounded_bilinear.LIM_left_zero ~> bounded_bilinear.tendsto_left_zero
   bounded_bilinear.LIM_right_zero ~> bounded_bilinear.tendsto_right_zero
   LIM_inverse_fun ~> tendsto_inverse [OF tendsto_ident_at]
 
 * Theory Complex_Main: The definition of infinite series was
 generalized.  Now it is defined on the type class {topological_space,
 comm_monoid_add}.  Hence it is useable also for extended real numbers.
 
 * Theory Complex_Main: The complex exponential function "expi" is now
 a type-constrained abbreviation for "exp :: complex => complex"; thus
 several polymorphic lemmas about "exp" are now applicable to "expi".
 
 * Code generation:
 
   - Theory Library/Code_Char_ord provides native ordering of
     characters in the target language.
 
   - Commands code_module and code_library are legacy, use export_code
     instead.
 
   - Method "evaluation" is legacy, use method "eval" instead.
 
   - Legacy evaluator "SML" is deactivated by default.  May be
     reactivated by the following theory command:
 
       setup {* Value.add_evaluator ("SML", Codegen.eval_term) *}
 
 * Declare ext [intro] by default.  Rare INCOMPATIBILITY.
 
 * New proof method "induction" that gives induction hypotheses the
 name "IH", thus distinguishing them from further hypotheses that come
 from rule induction.  The latter are still called "hyps".  Method
 "induction" is a thin wrapper around "induct" and follows the same
 syntax.
 
 * Method "fastsimp" has been renamed to "fastforce", but "fastsimp" is
 still available as a legacy feature for some time.
 
 * Nitpick:
   - Added "need" and "total_consts" options.
   - Reintroduced "show_skolems" option by popular demand.
   - Renamed attribute: nitpick_def ~> nitpick_unfold.
     INCOMPATIBILITY.
 
 * Sledgehammer:
   - Use quasi-sound (and efficient) translations by default.
   - Added support for the following provers: E-ToFoF, LEO-II,
     Satallax, SNARK, Waldmeister, and Z3 with TPTP syntax.
   - Automatically preplay and minimize proofs before showing them if
     this can be done within reasonable time.
   - sledgehammer available_provers ~> sledgehammer supported_provers.
     INCOMPATIBILITY.
   - Added "preplay_timeout", "slicing", "type_enc", "sound",
     "max_mono_iters", and "max_new_mono_instances" options.
   - Removed "explicit_apply" and "full_types" options as well as "Full
     Types" Proof General menu item. INCOMPATIBILITY.
 
 * Metis:
   - Removed "metisF" -- use "metis" instead. INCOMPATIBILITY.
   - Obsoleted "metisFT" -- use "metis (full_types)" instead.
     INCOMPATIBILITY.
 
 * Command 'try':
   - Renamed 'try_methods' and added "simp:", "intro:", "dest:", and
     "elim:" options. INCOMPATIBILITY.
   - Introduced 'try' that not only runs 'try_methods' but also
     'solve_direct', 'sledgehammer', 'quickcheck', and 'nitpick'.
 
 * Quickcheck:
   - Added "eval" option to evaluate terms for the found counterexample
     (currently only supported by the default (exhaustive) tester).
   - Added post-processing of terms to obtain readable counterexamples
     (currently only supported by the default (exhaustive) tester).
   - New counterexample generator quickcheck[narrowing] enables
     narrowing-based testing.  Requires the Glasgow Haskell compiler
     with its installation location defined in the Isabelle settings
     environment as ISABELLE_GHC.
   - Removed quickcheck tester "SML" based on the SML code generator
     (formly in HOL/Library).
 
 * Function package: discontinued option "tailrec".  INCOMPATIBILITY,
 use 'partial_function' instead.
 
 * Theory Library/Extended_Reals replaces now the positive extended
 reals found in probability theory. This file is extended by
 Multivariate_Analysis/Extended_Real_Limits.
 
 * Theory Library/Old_Recdef: old 'recdef' package has been moved here,
 from where it must be imported explicitly if it is really required.
 INCOMPATIBILITY.
 
 * Theory Library/Wfrec: well-founded recursion combinator "wfrec" has
 been moved here.  INCOMPATIBILITY.
 
 * Theory Library/Saturated provides type of numbers with saturated
 arithmetic.
 
 * Theory Library/Product_Lattice defines a pointwise ordering for the
 product type 'a * 'b, and provides instance proofs for various order
 and lattice type classes.
 
 * Theory Library/Countable now provides the "countable_datatype" proof
 method for proving "countable" class instances for datatypes.
 
 * Theory Library/Cset_Monad allows do notation for computable sets
 (cset) via the generic monad ad-hoc overloading facility.
 
 * Library: Theories of common data structures are split into theories
 for implementation, an invariant-ensuring type, and connection to an
 abstract type. INCOMPATIBILITY.
 
   - RBT is split into RBT and RBT_Mapping.
   - AssocList is split and renamed into AList and AList_Mapping.
   - DList is split into DList_Impl, DList, and DList_Cset.
   - Cset is split into Cset and List_Cset.
 
 * Theory Library/Nat_Infinity has been renamed to
 Library/Extended_Nat, with name changes of the following types and
 constants:
 
   type inat   ~> type enat
   Fin         ~> enat
   Infty       ~> infinity (overloaded)
   iSuc        ~> eSuc
   the_Fin     ~> the_enat
 
 Every theorem name containing "inat", "Fin", "Infty", or "iSuc" has
 been renamed accordingly. INCOMPATIBILITY.
 
 * Session Multivariate_Analysis: The euclidean_space type class now
 fixes a constant "Basis :: 'a set" consisting of the standard
 orthonormal basis for the type. Users now have the option of
 quantifying over this set instead of using the "basis" function, e.g.
 "ALL x:Basis. P x" vs "ALL i<DIM('a). P (basis i)".
 
 * Session Multivariate_Analysis: Type "('a, 'b) cart" has been renamed
 to "('a, 'b) vec" (the syntax "'a ^ 'b" remains unaffected). Constants
 "Cart_nth" and "Cart_lambda" have been respectively renamed to
 "vec_nth" and "vec_lambda"; theorems mentioning those names have
 changed to match. Definition theorems for overloaded constants now use
 the standard "foo_vec_def" naming scheme. A few other theorems have
 been renamed as follows (INCOMPATIBILITY):
 
   Cart_eq          ~> vec_eq_iff
   dist_nth_le_cart ~> dist_vec_nth_le
   tendsto_vector   ~> vec_tendstoI
   Cauchy_vector    ~> vec_CauchyI
 
 * Session Multivariate_Analysis: Several duplicate theorems have been
 removed, and other theorems have been renamed or replaced with more
 general versions. INCOMPATIBILITY.
 
   finite_choice ~> finite_set_choice
   eventually_conjI ~> eventually_conj
   eventually_and ~> eventually_conj_iff
   eventually_false ~> eventually_False
   setsum_norm ~> norm_setsum
   Lim_sequentially ~> LIMSEQ_def
   Lim_ident_at ~> LIM_ident
   Lim_const ~> tendsto_const
   Lim_cmul ~> tendsto_scaleR [OF tendsto_const]
   Lim_neg ~> tendsto_minus
   Lim_add ~> tendsto_add
   Lim_sub ~> tendsto_diff
   Lim_mul ~> tendsto_scaleR
   Lim_vmul ~> tendsto_scaleR [OF _ tendsto_const]
   Lim_null_norm ~> tendsto_norm_zero_iff [symmetric]
   Lim_linear ~> bounded_linear.tendsto
   Lim_component ~> tendsto_euclidean_component
   Lim_component_cart ~> tendsto_vec_nth
   Lim_inner ~> tendsto_inner [OF tendsto_const]
   dot_lsum ~> inner_setsum_left
   dot_rsum ~> inner_setsum_right
   continuous_cmul ~> continuous_scaleR [OF continuous_const]
   continuous_neg ~> continuous_minus
   continuous_sub ~> continuous_diff
   continuous_vmul ~> continuous_scaleR [OF _ continuous_const]
   continuous_mul ~> continuous_scaleR
   continuous_inv ~> continuous_inverse
   continuous_at_within_inv ~> continuous_at_within_inverse
   continuous_at_inv ~> continuous_at_inverse
   continuous_at_norm ~> continuous_norm [OF continuous_at_id]
   continuous_at_infnorm ~> continuous_infnorm [OF continuous_at_id]
   continuous_at_component ~> continuous_component [OF continuous_at_id]
   continuous_on_neg ~> continuous_on_minus
   continuous_on_sub ~> continuous_on_diff
   continuous_on_cmul ~> continuous_on_scaleR [OF continuous_on_const]
   continuous_on_vmul ~> continuous_on_scaleR [OF _ continuous_on_const]
   continuous_on_mul ~> continuous_on_scaleR
   continuous_on_mul_real ~> continuous_on_mult
   continuous_on_inner ~> continuous_on_inner [OF continuous_on_const]
   continuous_on_norm ~> continuous_on_norm [OF continuous_on_id]
   continuous_on_inverse ~> continuous_on_inv
   uniformly_continuous_on_neg ~> uniformly_continuous_on_minus
   uniformly_continuous_on_sub ~> uniformly_continuous_on_diff
   subset_interior ~> interior_mono
   subset_closure ~> closure_mono
   closure_univ ~> closure_UNIV
   real_arch_lt ~> reals_Archimedean2
   real_arch ~> reals_Archimedean3
   real_abs_norm ~> abs_norm_cancel
   real_abs_sub_norm ~> norm_triangle_ineq3
   norm_cauchy_schwarz_abs ~> Cauchy_Schwarz_ineq2
 
 * Session HOL-Probability:
   - Caratheodory's extension lemma is now proved for ring_of_sets.
   - Infinite products of probability measures are now available.
   - Sigma closure is independent, if the generator is independent
   - Use extended reals instead of positive extended
     reals. INCOMPATIBILITY.
 
 * Session HOLCF: Discontinued legacy theorem names, INCOMPATIBILITY.
 
   expand_fun_below ~> fun_below_iff
   below_fun_ext ~> fun_belowI
   expand_cfun_eq ~> cfun_eq_iff
   ext_cfun ~> cfun_eqI
   expand_cfun_below ~> cfun_below_iff
   below_cfun_ext ~> cfun_belowI
   monofun_fun_fun ~> fun_belowD
   monofun_fun_arg ~> monofunE
   monofun_lub_fun ~> adm_monofun [THEN admD]
   cont_lub_fun ~> adm_cont [THEN admD]
   cont2cont_Rep_CFun ~> cont2cont_APP
   cont_Rep_CFun_app ~> cont_APP_app
   cont_Rep_CFun_app_app ~> cont_APP_app_app
   cont_cfun_fun ~> cont_Rep_cfun1 [THEN contE]
   cont_cfun_arg ~> cont_Rep_cfun2 [THEN contE]
   contlub_cfun ~> lub_APP [symmetric]
   contlub_LAM ~> lub_LAM [symmetric]
   thelubI ~> lub_eqI
   UU_I ~> bottomI
   lift_distinct1 ~> lift.distinct(1)
   lift_distinct2 ~> lift.distinct(2)
   Def_not_UU ~> lift.distinct(2)
   Def_inject ~> lift.inject
   below_UU_iff ~> below_bottom_iff
   eq_UU_iff ~> eq_bottom_iff
 
 
 *** Document preparation ***
 
 * Antiquotation @{rail} layouts railroad syntax diagrams, see also
 isar-ref manual, both for description and actual application of the
 same.
 
 * Antiquotation @{value} evaluates the given term and presents its
 result.
 
 * Antiquotations: term style "isub" provides ad-hoc conversion of
 variables x1, y23 into subscripted form x\<^isub>1,
 y\<^isub>2\<^isub>3.
 
 * Predefined LaTeX macros for Isabelle symbols \<bind> and \<then>
 (e.g. see ~~/src/HOL/Library/Monad_Syntax.thy).
 
 * Localized \isabellestyle switch can be used within blocks or groups
 like this:
 
   \isabellestyle{it}  %preferred default
   {\isabellestylett @{text "typewriter stuff"}}
 
 * Discontinued special treatment of hard tabulators.  Implicit
 tab-width is now defined as 1.  Potential INCOMPATIBILITY for visual
 layouts.
 
 
 *** ML ***
 
 * The inner syntax of sort/type/term/prop supports inlined YXML
 representations within quoted string tokens.  By encoding logical
 entities via Term_XML (in ML or Scala) concrete syntax can be
 bypassed, which is particularly useful for producing bits of text
 under external program control.
 
 * Antiquotations for ML and document preparation are managed as theory
 data, which requires explicit setup.
 
 * Isabelle_Process.is_active allows tools to check if the official
 process wrapper is running (Isabelle/Scala/jEdit) or the old TTY loop
 (better known as Proof General).
 
 * Structure Proof_Context follows standard naming scheme.  Old
 ProofContext is still available for some time as legacy alias.
 
 * Structure Timing provides various operations for timing; supersedes
 former start_timing/end_timing etc.
 
 * Path.print is the official way to show file-system paths to users
 (including quotes etc.).
 
 * Inner syntax: identifiers in parse trees of generic categories
 "logic", "aprop", "idt" etc. carry position information (disguised as
 type constraints).  Occasional INCOMPATIBILITY with non-compliant
 translations that choke on unexpected type constraints.  Positions can
 be stripped in ML translations via Syntax.strip_positions /
 Syntax.strip_positions_ast, or via the syntax constant
 "_strip_positions" within parse trees.  As last resort, positions can
 be disabled via the configuration option Syntax.positions, which is
 called "syntax_positions" in Isar attribute syntax.
 
 * Discontinued special status of various ML structures that contribute
 to structure Syntax (Ast, Lexicon, Mixfix, Parser, Printer etc.): less
 pervasive content, no inclusion in structure Syntax.  INCOMPATIBILITY,
 refer directly to Ast.Constant, Lexicon.is_identifier,
 Syntax_Trans.mk_binder_tr etc.
 
 * Typed print translation: discontinued show_sorts argument, which is
 already available via context of "advanced" translation.
 
 * Refined PARALLEL_GOALS tactical: degrades gracefully for schematic
 goal states; body tactic needs to address all subgoals uniformly.
 
 * Slightly more special eq_list/eq_set, with shortcut involving
 pointer equality (assumes that eq relation is reflexive).
 
 * Classical tactics use proper Proof.context instead of historic types
 claset/clasimpset.  Old-style declarations like addIs, addEs, addDs
 operate directly on Proof.context.  Raw type claset retains its use as
 snapshot of the classical context, which can be recovered via
 (put_claset HOL_cs) etc.  Type clasimpset has been discontinued.
 INCOMPATIBILITY, classical tactics and derived proof methods require
 proper Proof.context.
 
 
 *** System ***
 
 * Discontinued support for Poly/ML 5.2, which was the last version
 without proper multithreading and TimeLimit implementation.
 
 * Discontinued old lib/scripts/polyml-platform, which has been
 obsolete since Isabelle2009-2.
 
 * Various optional external tools are referenced more robustly and
 uniformly by explicit Isabelle settings as follows:
 
   ISABELLE_CSDP   (formerly CSDP_EXE)
   ISABELLE_GHC    (formerly EXEC_GHC or GHC_PATH)
   ISABELLE_OCAML  (formerly EXEC_OCAML)
   ISABELLE_SWIPL  (formerly EXEC_SWIPL)
   ISABELLE_YAP    (formerly EXEC_YAP)
 
 Note that automated detection from the file-system or search path has
 been discontinued.  INCOMPATIBILITY.
 
 * Scala layer provides JVM method invocation service for static
 methods of type (String)String, see Invoke_Scala.method in ML.  For
 example:
 
   Invoke_Scala.method "java.lang.System.getProperty" "java.home"
 
 Together with YXML.string_of_body/parse_body and XML.Encode/Decode
 this allows to pass structured values between ML and Scala.
 
 * The IsabelleText fonts includes some further glyphs to support the
 Prover IDE.  Potential INCOMPATIBILITY: users who happen to have
 installed a local copy (which is normally *not* required) need to
 delete or update it from ~~/lib/fonts/.
 
 
 
 New in Isabelle2011 (January 2011)
 ----------------------------------
 
 *** General ***
 
 * Experimental Prover IDE based on Isabelle/Scala and jEdit (see
 src/Tools/jEdit).  This also serves as IDE for Isabelle/ML, with
 useful tooltips and hyperlinks produced from its static analysis.  The
 bundled component provides an executable Isabelle tool that can be run
 like this:
 
   Isabelle2011/bin/isabelle jedit
 
 * Significantly improved Isabelle/Isar implementation manual.
 
 * System settings: ISABELLE_HOME_USER now includes ISABELLE_IDENTIFIER
 (and thus refers to something like $HOME/.isabelle/Isabelle2011),
 while the default heap location within that directory lacks that extra
 suffix.  This isolates multiple Isabelle installations from each
 other, avoiding problems with old settings in new versions.
 INCOMPATIBILITY, need to copy/upgrade old user settings manually.
 
 * Source files are always encoded as UTF-8, instead of old-fashioned
 ISO-Latin-1.  INCOMPATIBILITY.  Isabelle LaTeX documents might require
 the following package declarations:
 
   \usepackage[utf8]{inputenc}
   \usepackage{textcomp}
 
 * Explicit treatment of UTF-8 sequences as Isabelle symbols, such that
 a Unicode character is treated as a single symbol, not a sequence of
 non-ASCII bytes as before.  Since Isabelle/ML string literals may
 contain symbols without further backslash escapes, Unicode can now be
 used here as well.  Recall that Symbol.explode in ML provides a
 consistent view on symbols, while raw explode (or String.explode)
 merely give a byte-oriented representation.
 
 * Theory loader: source files are primarily located via the master
 directory of each theory node (where the .thy file itself resides).
 The global load path is still partially available as legacy feature.
 Minor INCOMPATIBILITY due to subtle change in file lookup: use
 explicit paths, relatively to the theory.
 
 * Special treatment of ML file names has been discontinued.
 Historically, optional extensions .ML or .sml were added on demand --
 at the cost of clarity of file dependencies.  Recall that Isabelle/ML
 files exclusively use the .ML extension.  Minor INCOMPATIBILITY.
 
 * Various options that affect pretty printing etc. are now properly
 handled within the context via configuration options, instead of
 unsynchronized references or print modes.  There are both ML Config.T
 entities and Isar declaration attributes to access these.
 
   ML (Config.T)                 Isar (attribute)
 
   eta_contract                  eta_contract
   show_brackets                 show_brackets
   show_sorts                    show_sorts
   show_types                    show_types
   show_question_marks           show_question_marks
   show_consts                   show_consts
   show_abbrevs                  show_abbrevs
 
   Syntax.ast_trace              syntax_ast_trace
   Syntax.ast_stat               syntax_ast_stat
   Syntax.ambiguity_level        syntax_ambiguity_level
 
   Goal_Display.goals_limit      goals_limit
   Goal_Display.show_main_goal   show_main_goal
 
   Method.rule_trace             rule_trace
 
   Thy_Output.display            thy_output_display
   Thy_Output.quotes             thy_output_quotes
   Thy_Output.indent             thy_output_indent
   Thy_Output.source             thy_output_source
   Thy_Output.break              thy_output_break
 
 Note that corresponding "..._default" references in ML may only be
 changed globally at the ROOT session setup, but *not* within a theory.
 The option "show_abbrevs" supersedes the former print mode
 "no_abbrevs" with inverted meaning.
 
 * More systematic naming of some configuration options.
 INCOMPATIBILITY.
 
   trace_simp  ~>  simp_trace
   debug_simp  ~>  simp_debug
 
 * Support for real valued configuration options, using simplistic
 floating-point notation that coincides with the inner syntax for
 float_token.
 
 * Support for real valued preferences (with approximative PGIP type):
 front-ends need to accept "pgint" values in float notation.
 INCOMPATIBILITY.
 
 * The IsabelleText font now includes Cyrillic, Hebrew, Arabic from
 DejaVu Sans.
 
 * Discontinued support for Poly/ML 5.0 and 5.1 versions.
 
 
 *** Pure ***
 
 * Command 'type_synonym' (with single argument) replaces somewhat
 outdated 'types', which is still available as legacy feature for some
 time.
 
 * Command 'nonterminal' (with 'and' separated list of arguments)
 replaces somewhat outdated 'nonterminals'.  INCOMPATIBILITY.
 
 * Command 'notepad' replaces former 'example_proof' for
 experimentation in Isar without any result.  INCOMPATIBILITY.
 
 * Locale interpretation commands 'interpret' and 'sublocale' accept
 lists of equations to map definitions in a locale to appropriate
 entities in the context of the interpretation.  The 'interpretation'
 command already provided this functionality.
 
 * Diagnostic command 'print_dependencies' prints the locale instances
 that would be activated if the specified expression was interpreted in
 the current context.  Variant "print_dependencies!" assumes a context
 without interpretations.
 
 * Diagnostic command 'print_interps' prints interpretations in proofs
 in addition to interpretations in theories.
 
 * Discontinued obsolete 'global' and 'local' commands to manipulate
 the theory name space.  Rare INCOMPATIBILITY.  The ML functions
 Sign.root_path and Sign.local_path may be applied directly where this
 feature is still required for historical reasons.
 
 * Discontinued obsolete 'constdefs' command.  INCOMPATIBILITY, use
 'definition' instead.
 
 * The "prems" fact, which refers to the accidental collection of
 foundational premises in the context, is now explicitly marked as
 legacy feature and will be discontinued soon.  Consider using "assms"
 of the head statement or reference facts by explicit names.
 
 * Document antiquotations @{class} and @{type} print classes and type
 constructors.
 
 * Document antiquotation @{file} checks file/directory entries within
 the local file system.
 
 
 *** HOL ***
 
 * Coercive subtyping: functions can be declared as coercions and type
 inference will add them as necessary upon input of a term.  Theory
 Complex_Main declares real :: nat => real and real :: int => real as
 coercions. A coercion function f is declared like this:
 
   declare [[coercion f]]
 
 To lift coercions through type constructors (e.g. from nat => real to
 nat list => real list), map functions can be declared, e.g.
 
   declare [[coercion_map map]]
 
 Currently coercion inference is activated only in theories including
 real numbers, i.e. descendants of Complex_Main.  This is controlled by
 the configuration option "coercion_enabled", e.g. it can be enabled in
 other theories like this:
 
   declare [[coercion_enabled]]
 
 * Command 'partial_function' provides basic support for recursive
 function definitions over complete partial orders.  Concrete instances
 are provided for i) the option type, ii) tail recursion on arbitrary
 types, and iii) the heap monad of Imperative_HOL.  See
 src/HOL/ex/Fundefs.thy and src/HOL/Imperative_HOL/ex/Linked_Lists.thy
 for examples.
 
 * Function package: f.psimps rules are no longer implicitly declared
 as [simp].  INCOMPATIBILITY.
 
 * Datatype package: theorems generated for executable equality (class
 "eq") carry proper names and are treated as default code equations.
 
 * Inductive package: now offers command 'inductive_simps' to
 automatically derive instantiated and simplified equations for
 inductive predicates, similar to 'inductive_cases'.
 
 * Command 'enriched_type' allows to register properties of the
 functorial structure of types.
 
 * Improved infrastructure for term evaluation using code generator
 techniques, in particular static evaluation conversions.
 
 * Code generator: Scala (2.8 or higher) has been added to the target
 languages.
 
 * Code generator: globbing constant expressions "*" and "Theory.*"
 have been replaced by the more idiomatic "_" and "Theory._".
 INCOMPATIBILITY.
 
 * Code generator: export_code without explicit file declaration prints
 to standard output.  INCOMPATIBILITY.
 
 * Code generator: do not print function definitions for case
 combinators any longer.
 
 * Code generator: simplification with rules determined with
 src/Tools/Code/code_simp.ML and method "code_simp".
 
 * Code generator for records: more idiomatic representation of record
 types.  Warning: records are not covered by ancient SML code
 generation any longer.  INCOMPATIBILITY.  In cases of need, a suitable
 rep_datatype declaration helps to succeed then:
 
   record 'a foo = ...
   ...
   rep_datatype foo_ext ...
 
 * Records: logical foundation type for records does not carry a
 '_type' suffix any longer (obsolete due to authentic syntax).
 INCOMPATIBILITY.
 
 * Quickcheck now by default uses exhaustive testing instead of random
 testing.  Random testing can be invoked by "quickcheck [random]",
 exhaustive testing by "quickcheck [exhaustive]".
 
 * Quickcheck instantiates polymorphic types with small finite
 datatypes by default. This enables a simple execution mechanism to
 handle quantifiers and function equality over the finite datatypes.
 
 * Quickcheck random generator has been renamed from "code" to
 "random".  INCOMPATIBILITY.
 
 * Quickcheck now has a configurable time limit which is set to 30
 seconds by default. This can be changed by adding [timeout = n] to the
 quickcheck command. The time limit for Auto Quickcheck is still set
 independently.
 
 * Quickcheck in locales considers interpretations of that locale for
 counter example search.
 
 * Sledgehammer:
   - Added "smt" and "remote_smt" provers based on the "smt" proof
     method. See the Sledgehammer manual for details ("isabelle doc
     sledgehammer").
   - Renamed commands:
     sledgehammer atp_info ~> sledgehammer running_provers
     sledgehammer atp_kill ~> sledgehammer kill_provers
     sledgehammer available_atps ~> sledgehammer available_provers
     INCOMPATIBILITY.
   - Renamed options:
     sledgehammer [atps = ...] ~> sledgehammer [provers = ...]
     sledgehammer [atp = ...] ~> sledgehammer [prover = ...]
     sledgehammer [timeout = 77 s] ~> sledgehammer [timeout = 77]
     (and "ms" and "min" are no longer supported)
     INCOMPATIBILITY.
 
 * Nitpick:
   - Renamed options:
     nitpick [timeout = 77 s] ~> nitpick [timeout = 77]
     nitpick [tac_timeout = 777 ms] ~> nitpick [tac_timeout = 0.777]
     INCOMPATIBILITY.
   - Added support for partial quotient types.
   - Added local versions of the "Nitpick.register_xxx" functions.
   - Added "whack" option.
   - Allow registration of quotient types as codatatypes.
   - Improved "merge_type_vars" option to merge more types.
   - Removed unsound "fast_descrs" option.
   - Added custom symmetry breaking for datatypes, making it possible to reach
     higher cardinalities.
   - Prevent the expansion of too large definitions.
 
 * Proof methods "metis" and "meson" now have configuration options
 "meson_trace", "metis_trace", and "metis_verbose" that can be enabled
 to diagnose these tools. E.g.
 
     using [[metis_trace = true]]
 
 * Auto Solve: Renamed "Auto Solve Direct".  The tool is now available
 manually as command 'solve_direct'.
 
 * The default SMT solver Z3 must be enabled explicitly (due to
 licensing issues) by setting the environment variable
 Z3_NON_COMMERCIAL in etc/settings of the component, for example.  For
 commercial applications, the SMT solver CVC3 is provided as fall-back;
 changing the SMT solver is done via the configuration option
 "smt_solver".
 
 * Remote SMT solvers need to be referred to by the "remote_" prefix,
 i.e. "remote_cvc3" and "remote_z3".
 
 * Added basic SMT support for datatypes, records, and typedefs using
 the oracle mode (no proofs).  Direct support of pairs has been dropped
 in exchange (pass theorems fst_conv snd_conv pair_collapse to the SMT
 support for a similar behavior).  Minor INCOMPATIBILITY.
 
 * Changed SMT configuration options:
   - Renamed:
     z3_proofs ~> smt_oracle (with inverted meaning)
     z3_trace_assms ~> smt_trace_used_facts
     INCOMPATIBILITY.
   - Added:
     smt_verbose
     smt_random_seed
     smt_datatypes
     smt_infer_triggers
     smt_monomorph_limit
     cvc3_options
     remote_cvc3_options
     remote_z3_options
     yices_options
 
 * Boogie output files (.b2i files) need to be declared in the theory
 header.
 
 * Simplification procedure "list_to_set_comprehension" rewrites list
 comprehensions applied to List.set to set comprehensions.  Occasional
 INCOMPATIBILITY, may be deactivated like this:
 
   declare [[simproc del: list_to_set_comprehension]]
 
 * Removed old version of primrec package.  INCOMPATIBILITY.
 
 * Removed simplifier congruence rule of "prod_case", as has for long
 been the case with "split".  INCOMPATIBILITY.
 
 * String.literal is a type, but not a datatype.  INCOMPATIBILITY.
 
 * Removed [split_format ... and ... and ...] version of
 [split_format].  Potential INCOMPATIBILITY.
 
 * Predicate "sorted" now defined inductively, with nice induction
 rules.  INCOMPATIBILITY: former sorted.simps now named sorted_simps.
 
 * Constant "contents" renamed to "the_elem", to free the generic name
 contents for other uses.  INCOMPATIBILITY.
 
 * Renamed class eq and constant eq (for code generation) to class
 equal and constant equal, plus renaming of related facts and various
 tuning.  INCOMPATIBILITY.
 
 * Dropped type classes mult_mono and mult_mono1.  INCOMPATIBILITY.
 
 * Removed output syntax "'a ~=> 'b" for "'a => 'b option".
 INCOMPATIBILITY.
 
 * Renamed theory Fset to Cset, type Fset.fset to Cset.set, in order to
 avoid confusion with finite sets.  INCOMPATIBILITY.
 
 * Abandoned locales equiv, congruent and congruent2 for equivalence
 relations.  INCOMPATIBILITY: use equivI rather than equiv_intro (same
 for congruent(2)).
 
 * Some previously unqualified names have been qualified:
 
   types
     bool ~> HOL.bool
     nat ~> Nat.nat
 
   constants
     Trueprop ~> HOL.Trueprop
     True ~> HOL.True
     False ~> HOL.False
     op & ~> HOL.conj
     op | ~> HOL.disj
     op --> ~> HOL.implies
     op = ~> HOL.eq
     Not ~> HOL.Not
     The ~> HOL.The
     All ~> HOL.All
     Ex ~> HOL.Ex
     Ex1 ~> HOL.Ex1
     Let ~> HOL.Let
     If ~> HOL.If
     Ball ~> Set.Ball
     Bex ~> Set.Bex
     Suc ~> Nat.Suc
     Pair ~> Product_Type.Pair
     fst ~> Product_Type.fst
     snd ~> Product_Type.snd
     curry ~> Product_Type.curry
     op : ~> Set.member
     Collect ~> Set.Collect
 
 INCOMPATIBILITY.
 
 * More canonical naming convention for some fundamental definitions:
 
     bot_bool_eq ~> bot_bool_def
     top_bool_eq ~> top_bool_def
     inf_bool_eq ~> inf_bool_def
     sup_bool_eq ~> sup_bool_def
     bot_fun_eq  ~> bot_fun_def
     top_fun_eq  ~> top_fun_def
     inf_fun_eq  ~> inf_fun_def
     sup_fun_eq  ~> sup_fun_def
 
 INCOMPATIBILITY.
 
 * More stylized fact names:
 
   expand_fun_eq ~> fun_eq_iff
   expand_set_eq ~> set_eq_iff
   set_ext       ~> set_eqI
   nat_number    ~> eval_nat_numeral
 
 INCOMPATIBILITY.
 
 * Refactoring of code-generation specific operations in theory List:
 
   constants
     null ~> List.null
 
   facts
     mem_iff ~> member_def
     null_empty ~> null_def
 
 INCOMPATIBILITY.  Note that these were not supposed to be used
 regularly unless for striking reasons; their main purpose was code
 generation.
 
 Various operations from the Haskell prelude are used for generating
 Haskell code.
 
 * Term "bij f" is now an abbreviation of "bij_betw f UNIV UNIV".  Term
 "surj f" is now an abbreviation of "range f = UNIV".  The theorems
 bij_def and surj_def are unchanged.  INCOMPATIBILITY.
 
 * Abolished some non-alphabetic type names: "prod" and "sum" replace
 "*" and "+" respectively.  INCOMPATIBILITY.
 
 * Name "Plus" of disjoint sum operator "<+>" is now hidden.  Write
 "Sum_Type.Plus" instead.
 
 * Constant "split" has been merged with constant "prod_case"; names of
 ML functions, facts etc. involving split have been retained so far,
 though.  INCOMPATIBILITY.
 
 * Dropped old infix syntax "_ mem _" for List.member; use "_ : set _"
 instead.  INCOMPATIBILITY.
 
 * Removed lemma "Option.is_none_none" which duplicates "is_none_def".
 INCOMPATIBILITY.
 
 * Former theory Library/Enum is now part of the HOL-Main image.
 INCOMPATIBILITY: all constants of the Enum theory now have to be
 referred to by its qualified name.
 
   enum    ~>  Enum.enum
   nlists  ~>  Enum.nlists
   product ~>  Enum.product
 
 * Theory Library/Monad_Syntax provides do-syntax for monad types.
 Syntax in Library/State_Monad has been changed to avoid ambiguities.
 INCOMPATIBILITY.
 
 * Theory Library/SetsAndFunctions has been split into
 Library/Function_Algebras and Library/Set_Algebras; canonical names
 for instance definitions for functions; various improvements.
 INCOMPATIBILITY.
 
 * Theory Library/Multiset provides stable quicksort implementation of
 sort_key.
 
 * Theory Library/Multiset: renamed empty_idemp ~> empty_neutral.
 INCOMPATIBILITY.
 
 * Session Multivariate_Analysis: introduced a type class for euclidean
 space.  Most theorems are now stated in terms of euclidean spaces
 instead of finite cartesian products.
 
   types
     real ^ 'n ~>  'a::real_vector
               ~>  'a::euclidean_space
               ~>  'a::ordered_euclidean_space
         (depends on your needs)
 
   constants
      _ $ _        ~> _ $$ _
      \<chi> x. _  ~> \<chi>\<chi> x. _
      CARD('n)     ~> DIM('a)
 
 Also note that the indices are now natural numbers and not from some
 finite type. Finite cartesian products of euclidean spaces, products
 of euclidean spaces the real and complex numbers are instantiated to
 be euclidean_spaces.  INCOMPATIBILITY.
 
 * Session Probability: introduced pextreal as positive extended real
 numbers.  Use pextreal as value for measures.  Introduce the
 Radon-Nikodym derivative, product spaces and Fubini's theorem for
 arbitrary sigma finite measures.  Introduces Lebesgue measure based on
 the integral in Multivariate Analysis.  INCOMPATIBILITY.
 
 * Session Imperative_HOL: revamped, corrected dozens of inadequacies.
 INCOMPATIBILITY.
 
 * Session SPARK (with image HOL-SPARK) provides commands to load and
 prove verification conditions generated by the SPARK Ada program
 verifier.  See also src/HOL/SPARK and src/HOL/SPARK/Examples.
 
 
 *** HOL-Algebra ***
 
 * Theorems for additive ring operations (locale abelian_monoid and
 descendants) are generated by interpretation from their multiplicative
 counterparts.  Names (in particular theorem names) have the mandatory
 qualifier 'add'.  Previous theorem names are redeclared for
 compatibility.
 
 * Structure "int_ring" is now an abbreviation (previously a
 definition).  This fits more natural with advanced interpretations.
 
 
 *** HOLCF ***
 
 * The domain package now runs in definitional mode by default: The
 former command 'new_domain' is now called 'domain'.  To use the domain
 package in its original axiomatic mode, use 'domain (unsafe)'.
 INCOMPATIBILITY.
 
 * The new class "domain" is now the default sort.  Class "predomain"
 is an unpointed version of "domain". Theories can be updated by
 replacing sort annotations as shown below.  INCOMPATIBILITY.
 
   'a::type ~> 'a::countable
   'a::cpo  ~> 'a::predomain
   'a::pcpo ~> 'a::domain
 
 * The old type class "rep" has been superseded by class "domain".
 Accordingly, users of the definitional package must remove any
 "default_sort rep" declarations.  INCOMPATIBILITY.
 
 * The domain package (definitional mode) now supports unpointed
 predomain argument types, as long as they are marked 'lazy'. (Strict
 arguments must be in class "domain".) For example, the following
 domain definition now works:
 
   domain natlist = nil | cons (lazy "nat discr") (lazy "natlist")
 
 * Theory HOLCF/Library/HOL_Cpo provides cpo and predomain class
 instances for types from main HOL: bool, nat, int, char, 'a + 'b,
 'a option, and 'a list.  Additionally, it configures fixrec and the
 domain package to work with these types.  For example:
 
   fixrec isInl :: "('a + 'b) u -> tr"
     where "isInl$(up$(Inl x)) = TT" | "isInl$(up$(Inr y)) = FF"
 
   domain V = VFun (lazy "V -> V") | VCon (lazy "nat") (lazy "V list")
 
 * The "(permissive)" option of fixrec has been replaced with a
 per-equation "(unchecked)" option. See
 src/HOL/HOLCF/Tutorial/Fixrec_ex.thy for examples. INCOMPATIBILITY.
 
 * The "bifinite" class no longer fixes a constant "approx"; the class
 now just asserts that such a function exists.  INCOMPATIBILITY.
 
 * Former type "alg_defl" has been renamed to "defl".  HOLCF no longer
 defines an embedding of type 'a defl into udom by default; instances
 of "bifinite" and "domain" classes are available in
 src/HOL/HOLCF/Library/Defl_Bifinite.thy.
 
 * The syntax "REP('a)" has been replaced with "DEFL('a)".
 
 * The predicate "directed" has been removed.  INCOMPATIBILITY.
 
 * The type class "finite_po" has been removed.  INCOMPATIBILITY.
 
 * The function "cprod_map" has been renamed to "prod_map".
 INCOMPATIBILITY.
 
 * The monadic bind operator on each powerdomain has new binder syntax
 similar to sets, e.g. "\<Union>\<sharp>x\<in>xs. t" represents
 "upper_bind\<cdot>xs\<cdot>(\<Lambda> x. t)".
 
 * The infix syntax for binary union on each powerdomain has changed
 from e.g. "+\<sharp>" to "\<union>\<sharp>", for consistency with set
 syntax.  INCOMPATIBILITY.
 
 * The constant "UU" has been renamed to "bottom".  The syntax "UU" is
 still supported as an input translation.
 
 * Renamed some theorems (the original names are also still available).
 
   expand_fun_below   ~> fun_below_iff
   below_fun_ext      ~> fun_belowI
   expand_cfun_eq     ~> cfun_eq_iff
   ext_cfun           ~> cfun_eqI
   expand_cfun_below  ~> cfun_below_iff
   below_cfun_ext     ~> cfun_belowI
   cont2cont_Rep_CFun ~> cont2cont_APP
 
 * The Abs and Rep functions for various types have changed names.
 Related theorem names have also changed to match. INCOMPATIBILITY.
 
   Rep_CFun  ~> Rep_cfun
   Abs_CFun  ~> Abs_cfun
   Rep_Sprod ~> Rep_sprod
   Abs_Sprod ~> Abs_sprod
   Rep_Ssum  ~> Rep_ssum
   Abs_Ssum  ~> Abs_ssum
 
 * Lemmas with names of the form *_defined_iff or *_strict_iff have
 been renamed to *_bottom_iff.  INCOMPATIBILITY.
 
 * Various changes to bisimulation/coinduction with domain package:
 
   - Definitions of "bisim" constants no longer mention definedness.
   - With mutual recursion, "bisim" predicate is now curried.
   - With mutual recursion, each type gets a separate coind theorem.
   - Variable names in bisim_def and coinduct rules have changed.
 
 INCOMPATIBILITY.
 
 * Case combinators generated by the domain package for type "foo" are
 now named "foo_case" instead of "foo_when".  INCOMPATIBILITY.
 
 * Several theorems have been renamed to more accurately reflect the
 names of constants and types involved.  INCOMPATIBILITY.
 
   thelub_const    ~> lub_const
   lub_const       ~> is_lub_const
   thelubI         ~> lub_eqI
   is_lub_lub      ~> is_lubD2
   lubI            ~> is_lub_lub
   unique_lub      ~> is_lub_unique
   is_ub_lub       ~> is_lub_rangeD1
   lub_bin_chain   ~> is_lub_bin_chain
   lub_fun         ~> is_lub_fun
   thelub_fun      ~> lub_fun
   thelub_cfun     ~> lub_cfun
   thelub_Pair     ~> lub_Pair
   lub_cprod       ~> is_lub_prod
   thelub_cprod    ~> lub_prod
   minimal_cprod   ~> minimal_prod
   inst_cprod_pcpo ~> inst_prod_pcpo
   UU_I            ~> bottomI
   compact_UU      ~> compact_bottom
   deflation_UU    ~> deflation_bottom
   finite_deflation_UU ~> finite_deflation_bottom
 
 * Many legacy theorem names have been discontinued.  INCOMPATIBILITY.
 
   sq_ord_less_eq_trans ~> below_eq_trans
   sq_ord_eq_less_trans ~> eq_below_trans
   refl_less            ~> below_refl
   trans_less           ~> below_trans
   antisym_less         ~> below_antisym
   antisym_less_inverse ~> po_eq_conv [THEN iffD1]
   box_less             ~> box_below
   rev_trans_less       ~> rev_below_trans
   not_less2not_eq      ~> not_below2not_eq
   less_UU_iff          ~> below_UU_iff
   flat_less_iff        ~> flat_below_iff
   adm_less             ~> adm_below
   adm_not_less         ~> adm_not_below
   adm_compact_not_less ~> adm_compact_not_below
   less_fun_def         ~> below_fun_def
   expand_fun_less      ~> fun_below_iff
   less_fun_ext         ~> fun_belowI
   less_discr_def       ~> below_discr_def
   discr_less_eq        ~> discr_below_eq
   less_unit_def        ~> below_unit_def
   less_cprod_def       ~> below_prod_def
   prod_lessI           ~> prod_belowI
   Pair_less_iff        ~> Pair_below_iff
   fst_less_iff         ~> fst_below_iff
   snd_less_iff         ~> snd_below_iff
   expand_cfun_less     ~> cfun_below_iff
   less_cfun_ext        ~> cfun_belowI
   injection_less       ~> injection_below
   less_up_def          ~> below_up_def
   not_Iup_less         ~> not_Iup_below
   Iup_less             ~> Iup_below
   up_less              ~> up_below
   Def_inject_less_eq   ~> Def_below_Def
   Def_less_is_eq       ~> Def_below_iff
   spair_less_iff       ~> spair_below_iff
   less_sprod           ~> below_sprod
   spair_less           ~> spair_below
   sfst_less_iff        ~> sfst_below_iff
   ssnd_less_iff        ~> ssnd_below_iff
   fix_least_less       ~> fix_least_below
   dist_less_one        ~> dist_below_one
   less_ONE             ~> below_ONE
   ONE_less_iff         ~> ONE_below_iff
   less_sinlD           ~> below_sinlD
   less_sinrD           ~> below_sinrD
 
 
 *** FOL and ZF ***
 
 * All constant names are now qualified internally and use proper
 identifiers, e.g. "IFOL.eq" instead of "op =".  INCOMPATIBILITY.
 
 
 *** ML ***
 
 * Antiquotation @{assert} inlines a function bool -> unit that raises
 Fail if the argument is false.  Due to inlining the source position of
 failed assertions is included in the error output.
 
 * Discontinued antiquotation @{theory_ref}, which is obsolete since ML
 text is in practice always evaluated with a stable theory checkpoint.
 Minor INCOMPATIBILITY, use (Theory.check_thy @{theory}) instead.
 
 * Antiquotation @{theory A} refers to theory A from the ancestry of
 the current context, not any accidental theory loader state as before.
 Potential INCOMPATIBILITY, subtle change in semantics.
 
 * Syntax.pretty_priority (default 0) configures the required priority
 of pretty-printed output and thus affects insertion of parentheses.
 
 * Syntax.default_root (default "any") configures the inner syntax
 category (nonterminal symbol) for parsing of terms.
 
 * Former exception Library.UnequalLengths now coincides with
 ListPair.UnequalLengths.
 
 * Renamed structure MetaSimplifier to Raw_Simplifier.  Note that the
 main functionality is provided by structure Simplifier.
 
 * Renamed raw "explode" function to "raw_explode" to emphasize its
 meaning.  Note that internally to Isabelle, Symbol.explode is used in
 almost all situations.
 
 * Discontinued obsolete function sys_error and exception SYS_ERROR.
 See implementation manual for further details on exceptions in
 Isabelle/ML.
 
 * Renamed setmp_noncritical to Unsynchronized.setmp to emphasize its
 meaning.
 
 * Renamed structure PureThy to Pure_Thy and moved most of its
 operations to structure Global_Theory, to emphasize that this is
 rarely-used global-only stuff.
 
 * Discontinued Output.debug.  Minor INCOMPATIBILITY, use plain writeln
 instead (or tracing for high-volume output).
 
 * Configuration option show_question_marks only affects regular pretty
 printing of types and terms, not raw Term.string_of_vname.
 
 * ML_Context.thm and ML_Context.thms are no longer pervasive.  Rare
 INCOMPATIBILITY, superseded by static antiquotations @{thm} and
 @{thms} for most purposes.
 
 * ML structure Unsynchronized is never opened, not even in Isar
 interaction mode as before.  Old Unsynchronized.set etc. have been
 discontinued -- use plain := instead.  This should be *rare* anyway,
 since modern tools always work via official context data, notably
 configuration options.
 
 * Parallel and asynchronous execution requires special care concerning
 interrupts.  Structure Exn provides some convenience functions that
 avoid working directly with raw Interrupt.  User code must not absorb
 interrupts -- intermediate handling (for cleanup etc.) needs to be
 followed by re-raising of the original exception.  Another common
 source of mistakes are "handle _" patterns, which make the meaning of
 the program subject to physical effects of the environment.
 
 
 
 New in Isabelle2009-2 (June 2010)
 ---------------------------------
 
 *** General ***
 
 * Authentic syntax for *all* logical entities (type classes, type
 constructors, term constants): provides simple and robust
 correspondence between formal entities and concrete syntax.  Within
 the parse tree / AST representations, "constants" are decorated by
 their category (class, type, const) and spelled out explicitly with
 their full internal name.
 
 Substantial INCOMPATIBILITY concerning low-level syntax declarations
 and translations (translation rules and translation functions in ML).
 Some hints on upgrading:
 
   - Many existing uses of 'syntax' and 'translations' can be replaced
     by more modern 'type_notation', 'notation' and 'abbreviation',
     which are independent of this issue.
 
   - 'translations' require markup within the AST; the term syntax
     provides the following special forms:
 
       CONST c   -- produces syntax version of constant c from context
       XCONST c  -- literally c, checked as constant from context
       c         -- literally c, if declared by 'syntax'
 
     Plain identifiers are treated as AST variables -- occasionally the
     system indicates accidental variables via the error "rhs contains
     extra variables".
 
     Type classes and type constructors are marked according to their
     concrete syntax.  Some old translations rules need to be written
     for the "type" category, using type constructor application
     instead of pseudo-term application of the default category
     "logic".
 
   - 'parse_translation' etc. in ML may use the following
     antiquotations:
 
       @{class_syntax c}   -- type class c within parse tree / AST
       @{term_syntax c}    -- type constructor c within parse tree / AST
       @{const_syntax c}   -- ML version of "CONST c" above
       @{syntax_const c}   -- literally c (checked wrt. 'syntax' declarations)
 
   - Literal types within 'typed_print_translations', i.e. those *not*
     represented as pseudo-terms are represented verbatim.  Use @{class
     c} or @{type_name c} here instead of the above syntax
     antiquotations.
 
 Note that old non-authentic syntax was based on unqualified base
 names, so all of the above "constant" names would coincide.  Recall
 that 'print_syntax' and ML_command "set Syntax.trace_ast" help to
 diagnose syntax problems.
 
 * Type constructors admit general mixfix syntax, not just infix.
 
 * Concrete syntax may be attached to local entities without a proof
 body, too.  This works via regular mixfix annotations for 'fix',
 'def', 'obtain' etc. or via the explicit 'write' command, which is
 similar to the 'notation' command in theory specifications.
 
 * Discontinued unnamed infix syntax (legacy feature for many years) --
 need to specify constant name and syntax separately.  Internal ML
 datatype constructors have been renamed from InfixName to Infix etc.
 Minor INCOMPATIBILITY.
 
 * Schematic theorem statements need to be explicitly markup as such,
 via commands 'schematic_lemma', 'schematic_theorem',
 'schematic_corollary'.  Thus the relevance of the proof is made
 syntactically clear, which impacts performance in a parallel or
 asynchronous interactive environment.  Minor INCOMPATIBILITY.
 
 * Use of cumulative prems via "!" in some proof methods has been
 discontinued (old legacy feature).
 
 * References 'trace_simp' and 'debug_simp' have been replaced by
 configuration options stored in the context. Enabling tracing (the
 case of debugging is similar) in proofs works via
 
   using [[trace_simp = true]]
 
 Tracing is then active for all invocations of the simplifier in
 subsequent goal refinement steps. Tracing may also still be enabled or
 disabled via the ProofGeneral settings menu.
 
 * Separate commands 'hide_class', 'hide_type', 'hide_const',
 'hide_fact' replace the former 'hide' KIND command.  Minor
 INCOMPATIBILITY.
 
 * Improved parallelism of proof term normalization: usedir -p2 -q0 is
 more efficient than combinations with -q1 or -q2.
 
 
 *** Pure ***
 
 * Proofterms record type-class reasoning explicitly, using the
 "unconstrain" operation internally.  This eliminates all sort
 constraints from a theorem and proof, introducing explicit
 OFCLASS-premises.  On the proof term level, this operation is
 automatically applied at theorem boundaries, such that closed proofs
 are always free of sort constraints.  INCOMPATIBILITY for tools that
 inspect proof terms.
 
 * Local theory specifications may depend on extra type variables that
 are not present in the result type -- arguments TYPE('a) :: 'a itself
 are added internally.  For example:
 
   definition unitary :: bool where "unitary = (ALL (x::'a) y. x = y)"
 
 * Predicates of locales introduced by classes carry a mandatory
 "class" prefix.  INCOMPATIBILITY.
 
 * Vacuous class specifications observe default sort.  INCOMPATIBILITY.
 
 * Old 'axclass' command has been discontinued.  INCOMPATIBILITY, use
 'class' instead.
 
 * Command 'code_reflect' allows to incorporate generated ML code into
 runtime environment; replaces immature code_datatype antiquotation.
 INCOMPATIBILITY.
 
 * Code generator: simple concept for abstract datatypes obeying
 invariants.
 
 * Code generator: details of internal data cache have no impact on the
 user space functionality any longer.
 
 * Methods "unfold_locales" and "intro_locales" ignore non-locale
 subgoals.  This is more appropriate for interpretations with 'where'.
 INCOMPATIBILITY.
 
 * Command 'example_proof' opens an empty proof body.  This allows to
 experiment with Isar, without producing any persistent result.
 
 * Commands 'type_notation' and 'no_type_notation' declare type syntax
 within a local theory context, with explicit checking of the
 constructors involved (in contrast to the raw 'syntax' versions).
 
 * Commands 'types' and 'typedecl' now work within a local theory
 context -- without introducing dependencies on parameters or
 assumptions, which is not possible in Isabelle/Pure.
 
 * Command 'defaultsort' has been renamed to 'default_sort', it works
 within a local theory context.  Minor INCOMPATIBILITY.
 
 
 *** HOL ***
 
 * Command 'typedef' now works within a local theory context -- without
 introducing dependencies on parameters or assumptions, which is not
 possible in Isabelle/Pure/HOL.  Note that the logical environment may
 contain multiple interpretations of local typedefs (with different
 non-emptiness proofs), even in a global theory context.
 
 * New package for quotient types.  Commands 'quotient_type' and
 'quotient_definition' may be used for defining types and constants by
 quotient constructions.  An example is the type of integers created by
 quotienting pairs of natural numbers:
 
   fun
     intrel :: "(nat * nat) => (nat * nat) => bool"
   where
     "intrel (x, y) (u, v) = (x + v = u + y)"
 
   quotient_type int = "nat * nat" / intrel
     by (auto simp add: equivp_def expand_fun_eq)
 
   quotient_definition
     "0::int" is "(0::nat, 0::nat)"
 
 The method "lifting" can be used to lift of theorems from the
 underlying "raw" type to the quotient type.  The example
 src/HOL/Quotient_Examples/FSet.thy includes such a quotient
 construction and provides a reasoning infrastructure for finite sets.
 
 * Renamed Library/Quotient.thy to Library/Quotient_Type.thy to avoid
 clash with new theory Quotient in Main HOL.
 
 * Moved the SMT binding into the main HOL session, eliminating
 separate HOL-SMT session.
 
 * List membership infix mem operation is only an input abbreviation.
 INCOMPATIBILITY.
 
 * Theory Library/Word.thy has been removed.  Use library Word/Word.thy
 for future developements; former Library/Word.thy is still present in
 the AFP entry RSAPPS.
 
 * Theorem Int.int_induct renamed to Int.int_of_nat_induct and is no
 longer shadowed.  INCOMPATIBILITY.
 
 * Dropped theorem duplicate comp_arith; use semiring_norm instead.
 INCOMPATIBILITY.
 
 * Dropped theorem RealPow.real_sq_order; use power2_le_imp_le instead.
 INCOMPATIBILITY.
 
 * Dropped normalizing_semiring etc; use the facts in semiring classes
 instead.  INCOMPATIBILITY.
 
 * Dropped several real-specific versions of lemmas about floor and
 ceiling; use the generic lemmas from theory "Archimedean_Field"
 instead.  INCOMPATIBILITY.
 
   floor_number_of_eq         ~> floor_number_of
   le_floor_eq_number_of      ~> number_of_le_floor
   le_floor_eq_zero           ~> zero_le_floor
   le_floor_eq_one            ~> one_le_floor
   floor_less_eq_number_of    ~> floor_less_number_of
   floor_less_eq_zero         ~> floor_less_zero
   floor_less_eq_one          ~> floor_less_one
   less_floor_eq_number_of    ~> number_of_less_floor
   less_floor_eq_zero         ~> zero_less_floor
   less_floor_eq_one          ~> one_less_floor
   floor_le_eq_number_of      ~> floor_le_number_of
   floor_le_eq_zero           ~> floor_le_zero
   floor_le_eq_one            ~> floor_le_one
   floor_subtract_number_of   ~> floor_diff_number_of
   floor_subtract_one         ~> floor_diff_one
   ceiling_number_of_eq       ~> ceiling_number_of
   ceiling_le_eq_number_of    ~> ceiling_le_number_of
   ceiling_le_zero_eq         ~> ceiling_le_zero
   ceiling_le_eq_one          ~> ceiling_le_one
   less_ceiling_eq_number_of  ~> number_of_less_ceiling
   less_ceiling_eq_zero       ~> zero_less_ceiling
   less_ceiling_eq_one        ~> one_less_ceiling
   ceiling_less_eq_number_of  ~> ceiling_less_number_of
   ceiling_less_eq_zero       ~> ceiling_less_zero
   ceiling_less_eq_one        ~> ceiling_less_one
   le_ceiling_eq_number_of    ~> number_of_le_ceiling
   le_ceiling_eq_zero         ~> zero_le_ceiling
   le_ceiling_eq_one          ~> one_le_ceiling
   ceiling_subtract_number_of ~> ceiling_diff_number_of
   ceiling_subtract_one       ~> ceiling_diff_one
 
 * Theory "Finite_Set": various folding_XXX locales facilitate the
 application of the various fold combinators on finite sets.
 
 * Library theory "RBT" renamed to "RBT_Impl"; new library theory "RBT"
 provides abstract red-black tree type which is backed by "RBT_Impl" as
 implementation.  INCOMPATIBILITY.
 
 * Theory Library/Coinductive_List has been removed -- superseded by
 AFP/thys/Coinductive.
 
 * Theory PReal, including the type "preal" and related operations, has
 been removed.  INCOMPATIBILITY.
 
 * Real: new development using Cauchy Sequences.
 
 * Split off theory "Big_Operators" containing setsum, setprod,
 Inf_fin, Sup_fin, Min, Max from theory Finite_Set.  INCOMPATIBILITY.
 
 * Theory "Rational" renamed to "Rat", for consistency with "Nat",
 "Int" etc.  INCOMPATIBILITY.
 
 * Constant Rat.normalize needs to be qualified.  INCOMPATIBILITY.
 
 * New set of rules "ac_simps" provides combined assoc / commute
 rewrites for all interpretations of the appropriate generic locales.
 
 * Renamed theory "OrderedGroup" to "Groups" and split theory
 "Ring_and_Field" into theories "Rings" and "Fields"; for more
 appropriate and more consistent names suitable for name prefixes
 within the HOL theories.  INCOMPATIBILITY.
 
 * Some generic constants have been put to appropriate theories:
   - less_eq, less: Orderings
   - zero, one, plus, minus, uminus, times, abs, sgn: Groups
   - inverse, divide: Rings
 INCOMPATIBILITY.
 
 * More consistent naming of type classes involving orderings (and
 lattices):
 
     lower_semilattice                   ~> semilattice_inf
     upper_semilattice                   ~> semilattice_sup
 
     dense_linear_order                  ~> dense_linorder
 
     pordered_ab_group_add               ~> ordered_ab_group_add
     pordered_ab_group_add_abs           ~> ordered_ab_group_add_abs
     pordered_ab_semigroup_add           ~> ordered_ab_semigroup_add
     pordered_ab_semigroup_add_imp_le    ~> ordered_ab_semigroup_add_imp_le
     pordered_cancel_ab_semigroup_add    ~> ordered_cancel_ab_semigroup_add
     pordered_cancel_comm_semiring       ~> ordered_cancel_comm_semiring
     pordered_cancel_semiring            ~> ordered_cancel_semiring
     pordered_comm_monoid_add            ~> ordered_comm_monoid_add
     pordered_comm_ring                  ~> ordered_comm_ring
     pordered_comm_semiring              ~> ordered_comm_semiring
     pordered_ring                       ~> ordered_ring
     pordered_ring_abs                   ~> ordered_ring_abs
     pordered_semiring                   ~> ordered_semiring
 
     ordered_ab_group_add                ~> linordered_ab_group_add
     ordered_ab_semigroup_add            ~> linordered_ab_semigroup_add
     ordered_cancel_ab_semigroup_add     ~> linordered_cancel_ab_semigroup_add
     ordered_comm_semiring_strict        ~> linordered_comm_semiring_strict
     ordered_field                       ~> linordered_field
     ordered_field_no_lb                 ~> linordered_field_no_lb
     ordered_field_no_ub                 ~> linordered_field_no_ub
     ordered_field_dense_linear_order    ~> dense_linordered_field
     ordered_idom                        ~> linordered_idom
     ordered_ring                        ~> linordered_ring
     ordered_ring_le_cancel_factor       ~> linordered_ring_le_cancel_factor
     ordered_ring_less_cancel_factor     ~> linordered_ring_less_cancel_factor
     ordered_ring_strict                 ~> linordered_ring_strict
     ordered_semidom                     ~> linordered_semidom
     ordered_semiring                    ~> linordered_semiring
     ordered_semiring_1                  ~> linordered_semiring_1
     ordered_semiring_1_strict           ~> linordered_semiring_1_strict
     ordered_semiring_strict             ~> linordered_semiring_strict
 
   The following slightly odd type classes have been moved to a
   separate theory Library/Lattice_Algebras:
 
     lordered_ab_group_add               ~> lattice_ab_group_add
     lordered_ab_group_add_abs           ~> lattice_ab_group_add_abs
     lordered_ab_group_add_meet          ~> semilattice_inf_ab_group_add
     lordered_ab_group_add_join          ~> semilattice_sup_ab_group_add
     lordered_ring                       ~> lattice_ring
 
 INCOMPATIBILITY.
 
 * Refined field classes:
   - classes division_ring_inverse_zero, field_inverse_zero,
     linordered_field_inverse_zero include rule inverse 0 = 0 --
     subsumes former division_by_zero class;
   - numerous lemmas have been ported from field to division_ring.
 INCOMPATIBILITY.
 
 * Refined algebra theorem collections:
   - dropped theorem group group_simps, use algebra_simps instead;
   - dropped theorem group ring_simps, use field_simps instead;
   - proper theorem collection field_simps subsumes former theorem
     groups field_eq_simps and field_simps;
   - dropped lemma eq_minus_self_iff which is a duplicate for
     equal_neg_zero.
 INCOMPATIBILITY.
 
 * Theory Finite_Set and List: some lemmas have been generalized from
 sets to lattices:
 
   fun_left_comm_idem_inter      ~> fun_left_comm_idem_inf
   fun_left_comm_idem_union      ~> fun_left_comm_idem_sup
   inter_Inter_fold_inter        ~> inf_Inf_fold_inf
   union_Union_fold_union        ~> sup_Sup_fold_sup
   Inter_fold_inter              ~> Inf_fold_inf
   Union_fold_union              ~> Sup_fold_sup
   inter_INTER_fold_inter        ~> inf_INFI_fold_inf
   union_UNION_fold_union        ~> sup_SUPR_fold_sup
   INTER_fold_inter              ~> INFI_fold_inf
   UNION_fold_union              ~> SUPR_fold_sup
 
 * Theory "Complete_Lattice": lemmas top_def and bot_def have been
 replaced by the more convenient lemmas Inf_empty and Sup_empty.
 Dropped lemmas Inf_insert_simp and Sup_insert_simp, which are subsumed
 by Inf_insert and Sup_insert.  Lemmas Inf_UNIV and Sup_UNIV replace
 former Inf_Univ and Sup_Univ.  Lemmas inf_top_right and sup_bot_right
 subsume inf_top and sup_bot respectively.  INCOMPATIBILITY.
 
 * Reorganized theory Multiset: swapped notation of pointwise and
 multiset order:
 
   - pointwise ordering is instance of class order with standard syntax
     <= and <;
   - multiset ordering has syntax <=# and <#; partial order properties
     are provided by means of interpretation with prefix
     multiset_order;
   - less duplication, less historical organization of sections,
     conversion from associations lists to multisets, rudimentary code
     generation;
   - use insert_DiffM2 [symmetric] instead of elem_imp_eq_diff_union,
     if needed.
 
 Renamed:
 
   multiset_eq_conv_count_eq  ~>  multiset_ext_iff
   multi_count_ext  ~>  multiset_ext
   diff_union_inverse2  ~>  diff_union_cancelR
 
 INCOMPATIBILITY.
 
 * Theory Permutation: replaced local "remove" by List.remove1.
 
 * Code generation: ML and OCaml code is decorated with signatures.
 
 * Theory List: added transpose.
 
 * Library/Nat_Bijection.thy is a collection of bijective functions
 between nat and other types, which supersedes the older libraries
 Library/Nat_Int_Bij.thy and HOLCF/NatIso.thy.  INCOMPATIBILITY.
 
   Constants:
   Nat_Int_Bij.nat2_to_nat         ~> prod_encode
   Nat_Int_Bij.nat_to_nat2         ~> prod_decode
   Nat_Int_Bij.int_to_nat_bij      ~> int_encode
   Nat_Int_Bij.nat_to_int_bij      ~> int_decode
   Countable.pair_encode           ~> prod_encode
   NatIso.prod2nat                 ~> prod_encode
   NatIso.nat2prod                 ~> prod_decode
   NatIso.sum2nat                  ~> sum_encode
   NatIso.nat2sum                  ~> sum_decode
   NatIso.list2nat                 ~> list_encode
   NatIso.nat2list                 ~> list_decode
   NatIso.set2nat                  ~> set_encode
   NatIso.nat2set                  ~> set_decode
 
   Lemmas:
   Nat_Int_Bij.bij_nat_to_int_bij  ~> bij_int_decode
   Nat_Int_Bij.nat2_to_nat_inj     ~> inj_prod_encode
   Nat_Int_Bij.nat2_to_nat_surj    ~> surj_prod_encode
   Nat_Int_Bij.nat_to_nat2_inj     ~> inj_prod_decode
   Nat_Int_Bij.nat_to_nat2_surj    ~> surj_prod_decode
   Nat_Int_Bij.i2n_n2i_id          ~> int_encode_inverse
   Nat_Int_Bij.n2i_i2n_id          ~> int_decode_inverse
   Nat_Int_Bij.surj_nat_to_int_bij ~> surj_int_encode
   Nat_Int_Bij.surj_int_to_nat_bij ~> surj_int_decode
   Nat_Int_Bij.inj_nat_to_int_bij  ~> inj_int_encode
   Nat_Int_Bij.inj_int_to_nat_bij  ~> inj_int_decode
   Nat_Int_Bij.bij_nat_to_int_bij  ~> bij_int_encode
   Nat_Int_Bij.bij_int_to_nat_bij  ~> bij_int_decode
 
 * Sledgehammer:
   - Renamed ATP commands:
     atp_info     ~> sledgehammer running_atps
     atp_kill     ~> sledgehammer kill_atps
     atp_messages ~> sledgehammer messages
     atp_minimize ~> sledgehammer minimize
     print_atps   ~> sledgehammer available_atps
     INCOMPATIBILITY.
   - Added user's manual ("isabelle doc sledgehammer").
   - Added option syntax and "sledgehammer_params" to customize
     Sledgehammer's behavior.  See the manual for details.
   - Modified the Isar proof reconstruction code so that it produces
     direct proofs rather than proofs by contradiction.  (This feature
     is still experimental.)
   - Made Isar proof reconstruction work for SPASS, remote ATPs, and in
     full-typed mode.
   - Added support for TPTP syntax for SPASS via the "spass_tptp" ATP.
 
 * Nitpick:
   - Added and implemented "binary_ints" and "bits" options.
   - Added "std" option and implemented support for nonstandard models.
   - Added and implemented "finitize" option to improve the precision
     of infinite datatypes based on a monotonicity analysis.
   - Added support for quotient types.
   - Added support for "specification" and "ax_specification"
     constructs.
   - Added support for local definitions (for "function" and
     "termination" proofs).
   - Added support for term postprocessors.
   - Optimized "Multiset.multiset" and "FinFun.finfun".
   - Improved efficiency of "destroy_constrs" optimization.
   - Fixed soundness bugs related to "destroy_constrs" optimization and
     record getters.
   - Fixed soundness bug related to higher-order constructors.
   - Fixed soundness bug when "full_descrs" is enabled.
   - Improved precision of set constructs.
   - Added "atoms" option.
   - Added cache to speed up repeated Kodkod invocations on the same
     problems.
   - Renamed "MiniSatJNI", "zChaffJNI", "BerkMinAlloy", and
     "SAT4JLight" to "MiniSat_JNI", "zChaff_JNI", "BerkMin_Alloy", and
     "SAT4J_Light".  INCOMPATIBILITY.
   - Removed "skolemize", "uncurry", "sym_break", "flatten_prop",
     "sharing_depth", and "show_skolems" options.  INCOMPATIBILITY.
   - Removed "nitpick_intro" attribute.  INCOMPATIBILITY.
 
 * Method "induct" now takes instantiations of the form t, where t is not
   a variable, as a shorthand for "x == t", where x is a fresh variable.
   If this is not intended, t has to be enclosed in parentheses.
   By default, the equalities generated by definitional instantiations
   are pre-simplified, which may cause parameters of inductive cases
   to disappear, or may even delete some of the inductive cases.
   Use "induct (no_simp)" instead of "induct" to restore the old
   behaviour. The (no_simp) option is also understood by the "cases"
   and "nominal_induct" methods, which now perform pre-simplification, too.
   INCOMPATIBILITY.
 
 
 *** HOLCF ***
 
 * Variable names in lemmas generated by the domain package have
 changed; the naming scheme is now consistent with the HOL datatype
 package.  Some proof scripts may be affected, INCOMPATIBILITY.
 
 * The domain package no longer defines the function "foo_copy" for
 recursive domain "foo".  The reach lemma is now stated directly in
 terms of "foo_take".  Lemmas and proofs that mention "foo_copy" must
 be reformulated in terms of "foo_take", INCOMPATIBILITY.
 
 * Most definedness lemmas generated by the domain package (previously
 of the form "x ~= UU ==> foo$x ~= UU") now have an if-and-only-if form
 like "foo$x = UU <-> x = UU", which works better as a simp rule.
 Proofs that used definedness lemmas as intro rules may break,
 potential INCOMPATIBILITY.
 
 * Induction and casedist rules generated by the domain package now
 declare proper case_names (one called "bottom", and one named for each
 constructor).  INCOMPATIBILITY.
 
 * For mutually-recursive domains, separate "reach" and "take_lemma"
 rules are generated for each domain, INCOMPATIBILITY.
 
   foo_bar.reach       ~> foo.reach  bar.reach
   foo_bar.take_lemmas ~> foo.take_lemma  bar.take_lemma
 
 * Some lemmas generated by the domain package have been renamed for
 consistency with the datatype package, INCOMPATIBILITY.
 
   foo.ind        ~> foo.induct
   foo.finite_ind ~> foo.finite_induct
   foo.coind      ~> foo.coinduct
   foo.casedist   ~> foo.exhaust
   foo.exhaust    ~> foo.nchotomy
 
 * For consistency with other definition packages, the fixrec package
 now generates qualified theorem names, INCOMPATIBILITY.
 
   foo_simps  ~> foo.simps
   foo_unfold ~> foo.unfold
   foo_induct ~> foo.induct
 
 * The "fixrec_simp" attribute has been removed.  The "fixrec_simp"
 method and internal fixrec proofs now use the default simpset instead.
 INCOMPATIBILITY.
 
 * The "contlub" predicate has been removed.  Proof scripts should use
 lemma contI2 in place of monocontlub2cont, INCOMPATIBILITY.
 
 * The "admw" predicate has been removed, INCOMPATIBILITY.
 
 * The constants cpair, cfst, and csnd have been removed in favor of
 Pair, fst, and snd from Isabelle/HOL, INCOMPATIBILITY.
 
 
 *** ML ***
 
 * Antiquotations for basic formal entities:
 
     @{class NAME}         -- type class
     @{class_syntax NAME}  -- syntax representation of the above
 
     @{type_name NAME}     -- logical type
     @{type_abbrev NAME}   -- type abbreviation
     @{nonterminal NAME}   -- type of concrete syntactic category
     @{type_syntax NAME}   -- syntax representation of any of the above
 
     @{const_name NAME}    -- logical constant (INCOMPATIBILITY)
     @{const_abbrev NAME}  -- abbreviated constant
     @{const_syntax NAME}  -- syntax representation of any of the above
 
 * Antiquotation @{syntax_const NAME} ensures that NAME refers to a raw
 syntax constant (cf. 'syntax' command).
 
 * Antiquotation @{make_string} inlines a function to print arbitrary
 values similar to the ML toplevel.  The result is compiler dependent
 and may fall back on "?" in certain situations.
 
 * Diagnostic commands 'ML_val' and 'ML_command' may refer to
 antiquotations @{Isar.state} and @{Isar.goal}.  This replaces impure
 Isar.state() and Isar.goal(), which belong to the old TTY loop and do
 not work with the asynchronous Isar document model.
 
 * Configuration options now admit dynamic default values, depending on
 the context or even global references.
 
 * SHA1.digest digests strings according to SHA-1 (see RFC 3174).  It
 uses an efficient external library if available (for Poly/ML).
 
 * Renamed some important ML structures, while keeping the old names
 for some time as aliases within the structure Legacy:
 
   OuterKeyword  ~>  Keyword
   OuterLex      ~>  Token
   OuterParse    ~>  Parse
   OuterSyntax   ~>  Outer_Syntax
   PrintMode     ~>  Print_Mode
   SpecParse     ~>  Parse_Spec
   ThyInfo       ~>  Thy_Info
   ThyLoad       ~>  Thy_Load
   ThyOutput     ~>  Thy_Output
   TypeInfer     ~>  Type_Infer
 
 Note that "open Legacy" simplifies porting of sources, but forgetting
 to remove it again will complicate porting again in the future.
 
 * Most operations that refer to a global context are named
 accordingly, e.g. Simplifier.global_context or
 ProofContext.init_global.  There are some situations where a global
 context actually works, but under normal circumstances one needs to
 pass the proper local context through the code!
 
 * Discontinued old TheoryDataFun with its copy/init operation -- data
 needs to be pure.  Functor Theory_Data_PP retains the traditional
 Pretty.pp argument to merge, which is absent in the standard
 Theory_Data version.
 
 * Sorts.certify_sort and derived "cert" operations for types and terms
 no longer minimize sorts.  Thus certification at the boundary of the
 inference kernel becomes invariant under addition of class relations,
 which is an important monotonicity principle.  Sorts are now minimized
 in the syntax layer only, at the boundary between the end-user and the
 system.  Subtle INCOMPATIBILITY, may have to use Sign.minimize_sort
 explicitly in rare situations.
 
 * Renamed old-style Drule.standard to Drule.export_without_context, to
 emphasize that this is in no way a standard operation.
 INCOMPATIBILITY.
 
 * Subgoal.FOCUS (and variants): resulting goal state is normalized as
 usual for resolution.  Rare INCOMPATIBILITY.
 
 * Renamed varify/unvarify operations to varify_global/unvarify_global
 to emphasize that these only work in a global situation (which is
 quite rare).
 
 * Curried take and drop in library.ML; negative length is interpreted
 as infinity (as in chop).  Subtle INCOMPATIBILITY.
 
 * Proof terms: type substitutions on proof constants now use canonical
 order of type variables.  INCOMPATIBILITY for tools working with proof
 terms.
 
 * Raw axioms/defs may no longer carry sort constraints, and raw defs
 may no longer carry premises.  User-level specifications are
 transformed accordingly by Thm.add_axiom/add_def.
 
 
 *** System ***
 
 * Discontinued special HOL_USEDIR_OPTIONS for the main HOL image;
 ISABELLE_USEDIR_OPTIONS applies uniformly to all sessions.  Note that
 proof terms are enabled unconditionally in the new HOL-Proofs image.
 
 * Discontinued old ISABELLE and ISATOOL environment settings (legacy
 feature since Isabelle2009).  Use ISABELLE_PROCESS and ISABELLE_TOOL,
 respectively.
 
 * Old lib/scripts/polyml-platform is superseded by the
 ISABELLE_PLATFORM setting variable, which defaults to the 32 bit
 variant, even on a 64 bit machine.  The following example setting
 prefers 64 bit if available:
 
   ML_PLATFORM="${ISABELLE_PLATFORM64:-$ISABELLE_PLATFORM}"
 
 * The preliminary Isabelle/jEdit application demonstrates the emerging
 Isabelle/Scala layer for advanced prover interaction and integration.
 See src/Tools/jEdit or "isabelle jedit" provided by the properly built
 component.
 
 * "IsabelleText" is a Unicode font derived from Bitstream Vera Mono
 and Bluesky TeX fonts.  It provides the usual Isabelle symbols,
 similar to the default assignment of the document preparation system
 (cf. isabellesym.sty).  The Isabelle/Scala class Isabelle_System
 provides some operations for direct access to the font without asking
 the user for manual installation.
 
 
 
 New in Isabelle2009-1 (December 2009)
 -------------------------------------
 
 *** General ***
 
 * Discontinued old form of "escaped symbols" such as \\<forall>.  Only
 one backslash should be used, even in ML sources.
 
 
 *** Pure ***
 
 * Locale interpretation propagates mixins along the locale hierarchy.
 The currently only available mixins are the equations used to map
 local definitions to terms of the target domain of an interpretation.
 
 * Reactivated diagnostic command 'print_interps'.  Use "print_interps
 loc" to print all interpretations of locale "loc" in the theory.
 Interpretations in proofs are not shown.
 
 * Thoroughly revised locales tutorial.  New section on conditional
 interpretation.
 
 * On instantiation of classes, remaining undefined class parameters
 are formally declared.  INCOMPATIBILITY.
 
 
 *** Document preparation ***
 
 * New generalized style concept for printing terms: @{foo (style) ...}
 instead of @{foo_style style ...}  (old form is still retained for
 backward compatibility).  Styles can be also applied for
 antiquotations prop, term_type and typeof.
 
 
 *** HOL ***
 
 * New proof method "smt" for a combination of first-order logic with
 equality, linear and nonlinear (natural/integer/real) arithmetic, and
 fixed-size bitvectors; there is also basic support for higher-order
 features (esp. lambda abstractions).  It is an incomplete decision
 procedure based on external SMT solvers using the oracle mechanism;
 for the SMT solver Z3, this method is proof-producing.  Certificates
 are provided to avoid calling the external solvers solely for
 re-checking proofs.  Due to a remote SMT service there is no need for
 installing SMT solvers locally.  See src/HOL/SMT.
 
 * New commands to load and prove verification conditions generated by
 the Boogie program verifier or derived systems (e.g. the Verifying C
 Compiler (VCC) or Spec#).  See src/HOL/Boogie.
 
 * New counterexample generator tool 'nitpick' based on the Kodkod
 relational model finder.  See src/HOL/Tools/Nitpick and
 src/HOL/Nitpick_Examples.
 
 * New commands 'code_pred' and 'values' to invoke the predicate
 compiler and to enumerate values of inductive predicates.
 
 * A tabled implementation of the reflexive transitive closure.
 
 * New implementation of quickcheck uses generic code generator;
 default generators are provided for all suitable HOL types, records
 and datatypes.  Old quickcheck can be re-activated importing theory
 Library/SML_Quickcheck.
 
 * New testing tool Mirabelle for automated proof tools.  Applies
 several tools and tactics like sledgehammer, metis, or quickcheck, to
 every proof step in a theory.  To be used in batch mode via the
 "mirabelle" utility.
 
 * New proof method "sos" (sum of squares) for nonlinear real
 arithmetic (originally due to John Harison). It requires theory
 Library/Sum_Of_Squares.  It is not a complete decision procedure but
 works well in practice on quantifier-free real arithmetic with +, -,
 *, ^, =, <= and <, i.e. boolean combinations of equalities and
 inequalities between polynomials.  It makes use of external
 semidefinite programming solvers.  Method "sos" generates a
 certificate that can be pasted into the proof thus avoiding the need
 to call an external tool every time the proof is checked.  See
 src/HOL/Library/Sum_Of_Squares.
 
 * New method "linarith" invokes existing linear arithmetic decision
 procedure only.
 
 * New command 'atp_minimal' reduces result produced by Sledgehammer.
 
 * New Sledgehammer option "Full Types" in Proof General settings menu.
 Causes full type information to be output to the ATPs.  This slows
 ATPs down considerably but eliminates a source of unsound "proofs"
 that fail later.
 
 * New method "metisFT": A version of metis that uses full type
 information in order to avoid failures of proof reconstruction.
 
 * New evaluator "approximate" approximates an real valued term using
 the same method as the approximation method.
 
 * Method "approximate" now supports arithmetic expressions as
 boundaries of intervals and implements interval splitting and Taylor
 series expansion.
 
 * ML antiquotation @{code_datatype} inserts definition of a datatype
 generated by the code generator; e.g. see src/HOL/Predicate.thy.
 
 * New theory SupInf of the supremum and infimum operators for sets of
 reals.
 
 * New theory Probability, which contains a development of measure
 theory, eventually leading to Lebesgue integration and probability.
 
 * Extended Multivariate Analysis to include derivation and Brouwer's
 fixpoint theorem.
 
 * Reorganization of number theory, INCOMPATIBILITY:
   - new number theory development for nat and int, in theories Divides
     and GCD as well as in new session Number_Theory
   - some constants and facts now suffixed with _nat and _int
     accordingly
   - former session NumberTheory now named Old_Number_Theory, including
     theories Legacy_GCD and Primes (prefer Number_Theory if possible)
   - moved theory Pocklington from src/HOL/Library to
     src/HOL/Old_Number_Theory
 
 * Theory GCD includes functions Gcd/GCD and Lcm/LCM for the gcd and
 lcm of finite and infinite sets. It is shown that they form a complete
 lattice.
 
 * Class semiring_div requires superclass no_zero_divisors and proof of
 div_mult_mult1; theorems div_mult_mult1, div_mult_mult2,
 div_mult_mult1_if, div_mult_mult1 and div_mult_mult2 have been
 generalized to class semiring_div, subsuming former theorems
 zdiv_zmult_zmult1, zdiv_zmult_zmult1_if, zdiv_zmult_zmult1 and
 zdiv_zmult_zmult2.  div_mult_mult1 is now [simp] by default.
 INCOMPATIBILITY.
 
 * Refinements to lattice classes and sets:
   - less default intro/elim rules in locale variant, more default
     intro/elim rules in class variant: more uniformity
   - lemma ge_sup_conv renamed to le_sup_iff, in accordance with
     le_inf_iff
   - dropped lemma alias inf_ACI for inf_aci (same for sup_ACI and
     sup_aci)
   - renamed ACI to inf_sup_aci
   - new class "boolean_algebra"
   - class "complete_lattice" moved to separate theory
     "Complete_Lattice"; corresponding constants (and abbreviations)
     renamed and with authentic syntax:
     Set.Inf ~>    Complete_Lattice.Inf
     Set.Sup ~>    Complete_Lattice.Sup
     Set.INFI ~>   Complete_Lattice.INFI
     Set.SUPR ~>   Complete_Lattice.SUPR
     Set.Inter ~>  Complete_Lattice.Inter
     Set.Union ~>  Complete_Lattice.Union
     Set.INTER ~>  Complete_Lattice.INTER
     Set.UNION ~>  Complete_Lattice.UNION
   - authentic syntax for
     Set.Pow
     Set.image
   - mere abbreviations:
     Set.empty               (for bot)
     Set.UNIV                (for top)
     Set.inter               (for inf, formerly Set.Int)
     Set.union               (for sup, formerly Set.Un)
     Complete_Lattice.Inter  (for Inf)
     Complete_Lattice.Union  (for Sup)
     Complete_Lattice.INTER  (for INFI)
     Complete_Lattice.UNION  (for SUPR)
   - object-logic definitions as far as appropriate
 
 INCOMPATIBILITY.  Care is required when theorems Int_subset_iff or
 Un_subset_iff are explicitly deleted as default simp rules; then also
 their lattice counterparts le_inf_iff and le_sup_iff have to be
 deleted to achieve the desired effect.
 
 * Rules inf_absorb1, inf_absorb2, sup_absorb1, sup_absorb2 are no simp
 rules by default any longer; the same applies to min_max.inf_absorb1
 etc.  INCOMPATIBILITY.
 
 * Rules sup_Int_eq and sup_Un_eq are no longer declared as
 pred_set_conv by default.  INCOMPATIBILITY.
 
 * Power operations on relations and functions are now one dedicated
 constant "compow" with infix syntax "^^".  Power operation on
 multiplicative monoids retains syntax "^" and is now defined generic
 in class power.  INCOMPATIBILITY.
 
 * Relation composition "R O S" now has a more standard argument order:
 "R O S = {(x, z). EX y. (x, y) : R & (y, z) : S}".  INCOMPATIBILITY,
 rewrite propositions with "S O R" --> "R O S". Proofs may occasionally
 break, since the O_assoc rule was not rewritten like this.  Fix using
 O_assoc[symmetric].  The same applies to the curried version "R OO S".
 
 * Function "Inv" is renamed to "inv_into" and function "inv" is now an
 abbreviation for "inv_into UNIV".  Lemmas are renamed accordingly.
 INCOMPATIBILITY.
 
 * Most rules produced by inductive and datatype package have mandatory
 prefixes.  INCOMPATIBILITY.
 
 * Changed "DERIV_intros" to a dynamic fact, which can be augmented by
 the attribute of the same name.  Each of the theorems in the list
 DERIV_intros assumes composition with an additional function and
 matches a variable to the derivative, which has to be solved by the
 Simplifier.  Hence (auto intro!: DERIV_intros) computes the derivative
 of most elementary terms.  Former Maclauren.DERIV_tac and
 Maclauren.deriv_tac should be replaced by (auto intro!: DERIV_intros).
 INCOMPATIBILITY.
 
 * Code generator attributes follow the usual underscore convention:
     code_unfold     replaces    code unfold
     code_post       replaces    code post
     etc.
   INCOMPATIBILITY.
 
 * Renamed methods:
     sizechange -> size_change
     induct_scheme -> induction_schema
   INCOMPATIBILITY.
 
 * Discontinued abbreviation "arbitrary" of constant "undefined".
 INCOMPATIBILITY, use "undefined" directly.
 
 * Renamed theorems:
     Suc_eq_add_numeral_1 -> Suc_eq_plus1
     Suc_eq_add_numeral_1_left -> Suc_eq_plus1_left
     Suc_plus1 -> Suc_eq_plus1
     *anti_sym -> *antisym*
     vector_less_eq_def -> vector_le_def
   INCOMPATIBILITY.
 
 * Added theorem List.map_map as [simp].  Removed List.map_compose.
 INCOMPATIBILITY.
 
 * Removed predicate "M hassize n" (<--> card M = n & finite M).
 INCOMPATIBILITY.
 
 
 *** HOLCF ***
 
 * Theory Representable defines a class "rep" of domains that are
 representable (via an ep-pair) in the universal domain type "udom".
 Instances are provided for all type constructors defined in HOLCF.
 
 * The 'new_domain' command is a purely definitional version of the
 domain package, for representable domains.  Syntax is identical to the
 old domain package.  The 'new_domain' package also supports indirect
 recursion using previously-defined type constructors.  See
 src/HOLCF/ex/New_Domain.thy for examples.
 
 * Method "fixrec_simp" unfolds one step of a fixrec-defined constant
 on the left-hand side of an equation, and then performs
 simplification.  Rewriting is done using rules declared with the
 "fixrec_simp" attribute.  The "fixrec_simp" method is intended as a
 replacement for "fixpat"; see src/HOLCF/ex/Fixrec_ex.thy for examples.
 
 * The pattern-match compiler in 'fixrec' can now handle constructors
 with HOL function types.  Pattern-match combinators for the Pair
 constructor are pre-configured.
 
 * The 'fixrec' package now produces better fixed-point induction rules
 for mutually-recursive definitions:  Induction rules have conclusions
 of the form "P foo bar" instead of "P <foo, bar>".
 
 * The constant "sq_le" (with infix syntax "<<" or "\<sqsubseteq>") has
 been renamed to "below".  The name "below" now replaces "less" in many
 theorem names.  (Legacy theorem names using "less" are still supported
 as well.)
 
 * The 'fixrec' package now supports "bottom patterns".  Bottom
 patterns can be used to generate strictness rules, or to make
 functions more strict (much like the bang-patterns supported by the
 Glasgow Haskell Compiler).  See src/HOLCF/ex/Fixrec_ex.thy for
 examples.
 
 
 *** ML ***
 
 * Support for Poly/ML 5.3.0, with improved reporting of compiler
 errors and run-time exceptions, including detailed source positions.
 
 * Structure Name_Space (formerly NameSpace) now manages uniquely
 identified entries, with some additional information such as source
 position, logical grouping etc.
 
 * Theory and context data is now introduced by the simplified and
 modernized functors Theory_Data, Proof_Data, Generic_Data.  Data needs
 to be pure, but the old TheoryDataFun for mutable data (with explicit
 copy operation) is still available for some time.
 
 * Structure Synchronized (cf. src/Pure/Concurrent/synchronized.ML)
 provides a high-level programming interface to synchronized state
 variables with atomic update.  This works via pure function
 application within a critical section -- its runtime should be as
 short as possible; beware of deadlocks if critical code is nested,
 either directly or indirectly via other synchronized variables!
 
 * Structure Unsynchronized (cf. src/Pure/ML-Systems/unsynchronized.ML)
 wraps raw ML references, explicitly indicating their non-thread-safe
 behaviour.  The Isar toplevel keeps this structure open, to
 accommodate Proof General as well as quick and dirty interactive
 experiments with references.
 
 * PARALLEL_CHOICE and PARALLEL_GOALS provide basic support for
 parallel tactical reasoning.
 
 * Tacticals Subgoal.FOCUS, Subgoal.FOCUS_PREMS, Subgoal.FOCUS_PARAMS
 are similar to SUBPROOF, but are slightly more flexible: only the
 specified parts of the subgoal are imported into the context, and the
 body tactic may introduce new subgoals and schematic variables.
 
 * Old tactical METAHYPS, which does not observe the proof context, has
 been renamed to Old_Goals.METAHYPS and awaits deletion.  Use SUBPROOF
 or Subgoal.FOCUS etc.
 
 * Renamed functor TableFun to Table, and GraphFun to Graph.  (Since
 functors have their own ML name space there is no point to mark them
 separately.)  Minor INCOMPATIBILITY.
 
 * Renamed NamedThmsFun to Named_Thms.  INCOMPATIBILITY.
 
 * Renamed several structures FooBar to Foo_Bar.  Occasional,
 INCOMPATIBILITY.
 
 * Operations of structure Skip_Proof no longer require quick_and_dirty
 mode, which avoids critical setmp.
 
 * Eliminated old Attrib.add_attributes, Method.add_methods and related
 combinators for "args".  INCOMPATIBILITY, need to use simplified
 Attrib/Method.setup introduced in Isabelle2009.
 
 * Proper context for simpset_of, claset_of, clasimpset_of.  May fall
 back on global_simpset_of, global_claset_of, global_clasimpset_of as
 last resort.  INCOMPATIBILITY.
 
 * Display.pretty_thm now requires a proper context (cf. former
 ProofContext.pretty_thm).  May fall back on Display.pretty_thm_global
 or even Display.pretty_thm_without_context as last resort.
 INCOMPATIBILITY.
 
 * Discontinued Display.pretty_ctyp/cterm etc.  INCOMPATIBILITY, use
 Syntax.pretty_typ/term directly, preferably with proper context
 instead of global theory.
 
 
 *** System ***
 
 * Further fine tuning of parallel proof checking, scales up to 8 cores
 (max. speedup factor 5.0).  See also Goal.parallel_proofs in ML and
 usedir option -q.
 
 * Support for additional "Isabelle components" via etc/components, see
 also the system manual.
 
 * The isabelle makeall tool now operates on all components with
 IsaMakefile, not just hardwired "logics".
 
 * Removed "compress" option from isabelle-process and isabelle usedir;
 this is always enabled.
 
 * Discontinued support for Poly/ML 4.x versions.
 
 * Isabelle tool "wwwfind" provides web interface for 'find_theorems'
 on a given logic image.  This requires the lighttpd webserver and is
 currently supported on Linux only.
 
 
 
 New in Isabelle2009 (April 2009)
 --------------------------------
 
 *** General ***
 
 * Simplified main Isabelle executables, with less surprises on
 case-insensitive file-systems (such as Mac OS).
 
   - The main Isabelle tool wrapper is now called "isabelle" instead of
     "isatool."
 
   - The former "isabelle" alias for "isabelle-process" has been
     removed (should rarely occur to regular users).
 
   - The former "isabelle-interface" and its alias "Isabelle" have been
     removed (interfaces are now regular Isabelle tools).
 
 Within scripts and make files, the Isabelle environment variables
 ISABELLE_TOOL and ISABELLE_PROCESS replace old ISATOOL and ISABELLE,
 respectively.  (The latter are still available as legacy feature.)
 
 The old isabelle-interface wrapper could react in confusing ways if
 the interface was uninstalled or changed otherwise.  Individual
 interface tool configuration is now more explicit, see also the
 Isabelle system manual.  In particular, Proof General is now available
 via "isabelle emacs".
 
 INCOMPATIBILITY, need to adapt derivative scripts.  Users may need to
 purge installed copies of Isabelle executables and re-run "isabelle
 install -p ...", or use symlinks.
 
 * The default for ISABELLE_HOME_USER is now ~/.isabelle instead of the
 old ~/isabelle, which was slightly non-standard and apt to cause
 surprises on case-insensitive file-systems (such as Mac OS).
 
 INCOMPATIBILITY, need to move existing ~/isabelle/etc,
 ~/isabelle/heaps, ~/isabelle/browser_info to the new place.  Special
 care is required when using older releases of Isabelle.  Note that
 ISABELLE_HOME_USER can be changed in Isabelle/etc/settings of any
 Isabelle distribution, in order to use the new ~/.isabelle uniformly.
 
 * Proofs of fully specified statements are run in parallel on
 multi-core systems.  A speedup factor of 2.5 to 3.2 can be expected on
 a regular 4-core machine, if the initial heap space is made reasonably
 large (cf. Poly/ML option -H).  (Requires Poly/ML 5.2.1 or later.)
 
 * The main reference manuals ("isar-ref", "implementation", and
 "system") have been updated and extended.  Formally checked references
 as hyperlinks are now available uniformly.
 
 
 *** Pure ***
 
 * Complete re-implementation of locales.  INCOMPATIBILITY in several
 respects.  The most important changes are listed below.  See the
 Tutorial on Locales ("locales" manual) for details.
 
 - In locale expressions, instantiation replaces renaming.  Parameters
 must be declared in a for clause.  To aid compatibility with previous
 parameter inheritance, in locale declarations, parameters that are not
 'touched' (instantiation position "_" or omitted) are implicitly added
 with their syntax at the beginning of the for clause.
 
 - Syntax from abbreviations and definitions in locales is available in
 locale expressions and context elements.  The latter is particularly
 useful in locale declarations.
 
 - More flexible mechanisms to qualify names generated by locale
 expressions.  Qualifiers (prefixes) may be specified in locale
 expressions, and can be marked as mandatory (syntax: "name!:") or
 optional (syntax "name?:").  The default depends for plain "name:"
 depends on the situation where a locale expression is used: in
 commands 'locale' and 'sublocale' prefixes are optional, in
 'interpretation' and 'interpret' prefixes are mandatory.  The old
 implicit qualifiers derived from the parameter names of a locale are
 no longer generated.
 
 - Command "sublocale l < e" replaces "interpretation l < e".  The
 instantiation clause in "interpretation" and "interpret" (square
 brackets) is no longer available.  Use locale expressions.
 
 - When converting proof scripts, mandatory qualifiers in
 'interpretation' and 'interpret' should be retained by default, even
 if this is an INCOMPATIBILITY compared to former behavior.  In the
 worst case, use the "name?:" form for non-mandatory ones.  Qualifiers
 in locale expressions range over a single locale instance only.
 
 - Dropped locale element "includes".  This is a major INCOMPATIBILITY.
 In existing theorem specifications replace the includes element by the
 respective context elements of the included locale, omitting those
 that are already present in the theorem specification.  Multiple
 assume elements of a locale should be replaced by a single one
 involving the locale predicate.  In the proof body, declarations (most
 notably theorems) may be regained by interpreting the respective
 locales in the proof context as required (command "interpret").
 
 If using "includes" in replacement of a target solely because the
 parameter types in the theorem are not as general as in the target,
 consider declaring a new locale with additional type constraints on
 the parameters (context element "constrains").
 
 - Discontinued "locale (open)".  INCOMPATIBILITY.
 
 - Locale interpretation commands no longer attempt to simplify goal.
 INCOMPATIBILITY: in rare situations the generated goal differs.  Use
 methods intro_locales and unfold_locales to clarify.
 
 - Locale interpretation commands no longer accept interpretation
 attributes.  INCOMPATIBILITY.
 
 * Class declaration: so-called "base sort" must not be given in import
 list any longer, but is inferred from the specification.  Particularly
 in HOL, write
 
     class foo = ...
 
 instead of
 
     class foo = type + ...
 
 * Class target: global versions of theorems stemming do not carry a
 parameter prefix any longer.  INCOMPATIBILITY.
 
 * Class 'instance' command no longer accepts attached definitions.
 INCOMPATIBILITY, use proper 'instantiation' target instead.
 
 * Recovered hiding of consts, which was accidentally broken in
 Isabelle2007.  Potential INCOMPATIBILITY, ``hide const c'' really
 makes c inaccessible; consider using ``hide (open) const c'' instead.
 
 * Slightly more coherent Pure syntax, with updated documentation in
 isar-ref manual.  Removed locales meta_term_syntax and
 meta_conjunction_syntax: TERM and &&& (formerly &&) are now permanent,
 INCOMPATIBILITY in rare situations.  Note that &&& should not be used
 directly in regular applications.
 
 * There is a new syntactic category "float_const" for signed decimal
 fractions (e.g. 123.45 or -123.45).
 
 * Removed exotic 'token_translation' command.  INCOMPATIBILITY, use ML
 interface with 'setup' command instead.
 
 * Command 'local_setup' is similar to 'setup', but operates on a local
 theory context.
 
 * The 'axiomatization' command now only works within a global theory
 context.  INCOMPATIBILITY.
 
 * Goal-directed proof now enforces strict proof irrelevance wrt. sort
 hypotheses.  Sorts required in the course of reasoning need to be
 covered by the constraints in the initial statement, completed by the
 type instance information of the background theory.  Non-trivial sort
 hypotheses, which rarely occur in practice, may be specified via
 vacuous propositions of the form SORT_CONSTRAINT('a::c).  For example:
 
   lemma assumes "SORT_CONSTRAINT('a::empty)" shows False ...
 
 The result contains an implicit sort hypotheses as before --
 SORT_CONSTRAINT premises are eliminated as part of the canonical rule
 normalization.
 
 * Generalized Isar history, with support for linear undo, direct state
 addressing etc.
 
 * Changed defaults for unify configuration options:
 
   unify_trace_bound = 50 (formerly 25)
   unify_search_bound = 60 (formerly 30)
 
 * Different bookkeeping for code equations (INCOMPATIBILITY):
 
   a) On theory merge, the last set of code equations for a particular
      constant is taken (in accordance with the policy applied by other
      parts of the code generator framework).
 
   b) Code equations stemming from explicit declarations (e.g. code
      attribute) gain priority over default code equations stemming
      from definition, primrec, fun etc.
 
 * Keyword 'code_exception' now named 'code_abort'.  INCOMPATIBILITY.
 
 * Unified theorem tables for both code generators.  Thus [code
 func] has disappeared and only [code] remains.  INCOMPATIBILITY.
 
 * Command 'find_consts' searches for constants based on type and name
 patterns, e.g.
 
     find_consts "_ => bool"
 
 By default, matching is against subtypes, but it may be restricted to
 the whole type.  Searching by name is possible.  Multiple queries are
 conjunctive and queries may be negated by prefixing them with a
 hyphen:
 
     find_consts strict: "_ => bool" name: "Int" -"int => int"
 
 * New 'find_theorems' criterion "solves" matches theorems that
 directly solve the current goal (modulo higher-order unification).
 
 * Auto solve feature for main theorem statements: whenever a new goal
 is stated, "find_theorems solves" is called; any theorems that could
 solve the lemma directly are listed as part of the goal state.
 Cf. associated options in Proof General Isabelle settings menu,
 enabled by default, with reasonable timeout for pathological cases of
 higher-order unification.
 
 
 *** Document preparation ***
 
 * Antiquotation @{lemma} now imitates a regular terminal proof,
 demanding keyword 'by' and supporting the full method expression
 syntax just like the Isar command 'by'.
 
 
 *** HOL ***
 
 * Integrated main parts of former image HOL-Complex with HOL.  Entry
 points Main and Complex_Main remain as before.
 
 * Logic image HOL-Plain provides a minimal HOL with the most important
 tools available (inductive, datatype, primrec, ...).  This facilitates
 experimentation and tool development.  Note that user applications
 (and library theories) should never refer to anything below theory
 Main, as before.
 
 * Logic image HOL-Main stops at theory Main, and thus facilitates
 experimentation due to shorter build times.
 
 * Logic image HOL-NSA contains theories of nonstandard analysis which
 were previously part of former HOL-Complex.  Entry point Hyperreal
 remains valid, but theories formerly using Complex_Main should now use
 new entry point Hypercomplex.
 
 * Generic ATP manager for Sledgehammer, based on ML threads instead of
 Posix processes.  Avoids potentially expensive forking of the ML
 process.  New thread-based implementation also works on non-Unix
 platforms (Cygwin).  Provers are no longer hardwired, but defined
 within the theory via plain ML wrapper functions.  Basic Sledgehammer
 commands are covered in the isar-ref manual.
 
 * Wrapper scripts for remote SystemOnTPTP service allows to use
 sledgehammer without local ATP installation (Vampire etc.). Other
 provers may be included via suitable ML wrappers, see also
 src/HOL/ATP_Linkup.thy.
 
 * ATP selection (E/Vampire/Spass) is now via Proof General's settings
 menu.
 
 * The metis method no longer fails because the theorem is too trivial
 (contains the empty clause).
 
 * The metis method now fails in the usual manner, rather than raising
 an exception, if it determines that it cannot prove the theorem.
 
 * Method "coherent" implements a prover for coherent logic (see also
 src/Tools/coherent.ML).
 
 * Constants "undefined" and "default" replace "arbitrary".  Usually
 "undefined" is the right choice to replace "arbitrary", though
 logically there is no difference.  INCOMPATIBILITY.
 
 * Command "value" now integrates different evaluation mechanisms.  The
 result of the first successful evaluation mechanism is printed.  In
 square brackets a particular named evaluation mechanisms may be
 specified (currently, [SML], [code] or [nbe]).  See further
 src/HOL/ex/Eval_Examples.thy.
 
 * Normalization by evaluation now allows non-leftlinear equations.
 Declare with attribute [code nbe].
 
 * Methods "case_tac" and "induct_tac" now refer to the very same rules
 as the structured Isar versions "cases" and "induct", cf. the
 corresponding "cases" and "induct" attributes.  Mutual induction rules
 are now presented as a list of individual projections
 (e.g. foo_bar.inducts for types foo and bar); the old format with
 explicit HOL conjunction is no longer supported.  INCOMPATIBILITY, in
 rare situations a different rule is selected --- notably nested tuple
 elimination instead of former prod.exhaust: use explicit (case_tac t
 rule: prod.exhaust) here.
 
 * Attributes "cases", "induct", "coinduct" support "del" option.
 
 * Removed fact "case_split_thm", which duplicates "case_split".
 
 * The option datatype has been moved to a new theory Option.  Renamed
 option_map to Option.map, and o2s to Option.set, INCOMPATIBILITY.
 
 * New predicate "strict_mono" classifies strict functions on partial
 orders.  With strict functions on linear orders, reasoning about
 (in)equalities is facilitated by theorems "strict_mono_eq",
 "strict_mono_less_eq" and "strict_mono_less".
 
 * Some set operations are now proper qualified constants with
 authentic syntax.  INCOMPATIBILITY:
 
     op Int ~>   Set.Int
     op Un ~>    Set.Un
     INTER ~>    Set.INTER
     UNION ~>    Set.UNION
     Inter ~>    Set.Inter
     Union ~>    Set.Union
     {} ~>       Set.empty
     UNIV ~>     Set.UNIV
 
 * Class complete_lattice with operations Inf, Sup, INFI, SUPR now in
 theory Set.
 
 * Auxiliary class "itself" has disappeared -- classes without any
 parameter are treated as expected by the 'class' command.
 
 * Leibnitz's Series for Pi and the arcus tangens and logarithm series.
 
 * Common decision procedures (Cooper, MIR, Ferrack, Approximation,
 Dense_Linear_Order) are now in directory HOL/Decision_Procs.
 
 * Theory src/HOL/Decision_Procs/Approximation provides the new proof
 method "approximation".  It proves formulas on real values by using
 interval arithmetic.  In the formulas are also the transcendental
 functions sin, cos, tan, atan, ln, exp and the constant pi are
 allowed. For examples see
 src/HOL/Descision_Procs/ex/Approximation_Ex.thy.
 
 * Theory "Reflection" now resides in HOL/Library.
 
 * Entry point to Word library now simply named "Word".
 INCOMPATIBILITY.
 
 * Made source layout more coherent with logical distribution
 structure:
 
     src/HOL/Library/RType.thy ~> src/HOL/Typerep.thy
     src/HOL/Library/Code_Message.thy ~> src/HOL/
     src/HOL/Library/GCD.thy ~> src/HOL/
     src/HOL/Library/Order_Relation.thy ~> src/HOL/
     src/HOL/Library/Parity.thy ~> src/HOL/
     src/HOL/Library/Univ_Poly.thy ~> src/HOL/
     src/HOL/Real/ContNotDenum.thy ~> src/HOL/Library/
     src/HOL/Real/Lubs.thy ~> src/HOL/
     src/HOL/Real/PReal.thy ~> src/HOL/
     src/HOL/Real/Rational.thy ~> src/HOL/
     src/HOL/Real/RComplete.thy ~> src/HOL/
     src/HOL/Real/RealDef.thy ~> src/HOL/
     src/HOL/Real/RealPow.thy ~> src/HOL/
     src/HOL/Real/Real.thy ~> src/HOL/
     src/HOL/Complex/Complex_Main.thy ~> src/HOL/
     src/HOL/Complex/Complex.thy ~> src/HOL/
     src/HOL/Complex/FrechetDeriv.thy ~> src/HOL/Library/
     src/HOL/Complex/Fundamental_Theorem_Algebra.thy ~> src/HOL/Library/
     src/HOL/Hyperreal/Deriv.thy ~> src/HOL/
     src/HOL/Hyperreal/Fact.thy ~> src/HOL/
     src/HOL/Hyperreal/Integration.thy ~> src/HOL/
     src/HOL/Hyperreal/Lim.thy ~> src/HOL/
     src/HOL/Hyperreal/Ln.thy ~> src/HOL/
     src/HOL/Hyperreal/Log.thy ~> src/HOL/
     src/HOL/Hyperreal/MacLaurin.thy ~> src/HOL/
     src/HOL/Hyperreal/NthRoot.thy ~> src/HOL/
     src/HOL/Hyperreal/Series.thy ~> src/HOL/
     src/HOL/Hyperreal/SEQ.thy ~> src/HOL/
     src/HOL/Hyperreal/Taylor.thy ~> src/HOL/
     src/HOL/Hyperreal/Transcendental.thy ~> src/HOL/
     src/HOL/Real/Float ~> src/HOL/Library/
     src/HOL/Real/HahnBanach ~> src/HOL/HahnBanach
     src/HOL/Real/RealVector.thy ~> src/HOL/
 
     src/HOL/arith_data.ML ~> src/HOL/Tools
     src/HOL/hologic.ML ~> src/HOL/Tools
     src/HOL/simpdata.ML ~> src/HOL/Tools
     src/HOL/int_arith1.ML ~> src/HOL/Tools/int_arith.ML
     src/HOL/int_factor_simprocs.ML ~> src/HOL/Tools
     src/HOL/nat_simprocs.ML ~> src/HOL/Tools
     src/HOL/Real/float_arith.ML ~> src/HOL/Tools
     src/HOL/Real/float_syntax.ML ~> src/HOL/Tools
     src/HOL/Real/rat_arith.ML ~> src/HOL/Tools
     src/HOL/Real/real_arith.ML ~> src/HOL/Tools
 
     src/HOL/Library/Array.thy ~> src/HOL/Imperative_HOL
     src/HOL/Library/Heap_Monad.thy ~> src/HOL/Imperative_HOL
     src/HOL/Library/Heap.thy ~> src/HOL/Imperative_HOL
     src/HOL/Library/Imperative_HOL.thy ~> src/HOL/Imperative_HOL
     src/HOL/Library/Ref.thy ~> src/HOL/Imperative_HOL
     src/HOL/Library/Relational.thy ~> src/HOL/Imperative_HOL
 
 * If methods "eval" and "evaluation" encounter a structured proof
 state with !!/==>, only the conclusion is evaluated to True (if
 possible), avoiding strange error messages.
 
 * Method "sizechange" automates termination proofs using (a
 modification of) the size-change principle.  Requires SAT solver.  See
 src/HOL/ex/Termination.thy for examples.
 
 * Simplifier: simproc for let expressions now unfolds if bound
 variable occurs at most once in let expression body.  INCOMPATIBILITY.
 
 * Method "arith": Linear arithmetic now ignores all inequalities when
 fast_arith_neq_limit is exceeded, instead of giving up entirely.
 
 * New attribute "arith" for facts that should always be used
 automatically by arithmetic. It is intended to be used locally in
 proofs, e.g.
 
   assumes [arith]: "x > 0"
 
 Global usage is discouraged because of possible performance impact.
 
 * New classes "top" and "bot" with corresponding operations "top" and
 "bot" in theory Orderings; instantiation of class "complete_lattice"
 requires instantiation of classes "top" and "bot".  INCOMPATIBILITY.
 
 * Changed definition lemma "less_fun_def" in order to provide an
 instance for preorders on functions; use lemma "less_le" instead.
 INCOMPATIBILITY.
 
 * Theory Orderings: class "wellorder" moved here, with explicit
 induction rule "less_induct" as assumption.  For instantiation of
 "wellorder" by means of predicate "wf", use rule wf_wellorderI.
 INCOMPATIBILITY.
 
 * Theory Orderings: added class "preorder" as superclass of "order".
 INCOMPATIBILITY: Instantiation proofs for order, linorder
 etc. slightly changed.  Some theorems named order_class.* now named
 preorder_class.*.
 
 * Theory Relation: renamed "refl" to "refl_on", "reflexive" to "refl,
 "diag" to "Id_on".
 
 * Theory Finite_Set: added a new fold combinator of type
 
   ('a => 'b => 'b) => 'b => 'a set => 'b
 
 Occasionally this is more convenient than the old fold combinator
 which is now defined in terms of the new one and renamed to
 fold_image.
 
 * Theories Ring_and_Field and OrderedGroup: The lemmas "group_simps"
 and "ring_simps" have been replaced by "algebra_simps" (which can be
 extended with further lemmas!).  At the moment both still exist but
 the former will disappear at some point.
 
 * Theory Power: Lemma power_Suc is now declared as a simp rule in
 class recpower.  Type-specific simp rules for various recpower types
 have been removed.  INCOMPATIBILITY, rename old lemmas as follows:
 
 rat_power_0    -> power_0
 rat_power_Suc  -> power_Suc
 realpow_0      -> power_0
 realpow_Suc    -> power_Suc
 complexpow_0   -> power_0
 complexpow_Suc -> power_Suc
 power_poly_0   -> power_0
 power_poly_Suc -> power_Suc
 
 * Theories Ring_and_Field and Divides: Definition of "op dvd" has been
 moved to separate class dvd in Ring_and_Field; a couple of lemmas on
 dvd has been generalized to class comm_semiring_1.  Likewise a bunch
 of lemmas from Divides has been generalized from nat to class
 semiring_div.  INCOMPATIBILITY.  This involves the following theorem
 renames resulting from duplicate elimination:
 
     dvd_def_mod ~>          dvd_eq_mod_eq_0
     zero_dvd_iff ~>         dvd_0_left_iff
     dvd_0 ~>                dvd_0_right
     DIVISION_BY_ZERO_DIV ~> div_by_0
     DIVISION_BY_ZERO_MOD ~> mod_by_0
     mult_div ~>             div_mult_self2_is_id
     mult_mod ~>             mod_mult_self2_is_0
 
 * Theory IntDiv: removed many lemmas that are instances of class-based
 generalizations (from Divides and Ring_and_Field).  INCOMPATIBILITY,
 rename old lemmas as follows:
 
 dvd_diff               -> nat_dvd_diff
 dvd_zminus_iff         -> dvd_minus_iff
 mod_add1_eq            -> mod_add_eq
 mod_mult1_eq           -> mod_mult_right_eq
 mod_mult1_eq'          -> mod_mult_left_eq
 mod_mult_distrib_mod   -> mod_mult_eq
 nat_mod_add_left_eq    -> mod_add_left_eq
 nat_mod_add_right_eq   -> mod_add_right_eq
 nat_mod_div_trivial    -> mod_div_trivial
 nat_mod_mod_trivial    -> mod_mod_trivial
 zdiv_zadd_self1        -> div_add_self1
 zdiv_zadd_self2        -> div_add_self2
 zdiv_zmult_self1       -> div_mult_self2_is_id
 zdiv_zmult_self2       -> div_mult_self1_is_id
 zdvd_triv_left         -> dvd_triv_left
 zdvd_triv_right        -> dvd_triv_right
 zdvd_zmult_cancel_disj -> dvd_mult_cancel_left
 zmod_eq0_zdvd_iff      -> dvd_eq_mod_eq_0[symmetric]
 zmod_zadd_left_eq      -> mod_add_left_eq
 zmod_zadd_right_eq     -> mod_add_right_eq
 zmod_zadd_self1        -> mod_add_self1
 zmod_zadd_self2        -> mod_add_self2
 zmod_zadd1_eq          -> mod_add_eq
 zmod_zdiff1_eq         -> mod_diff_eq
 zmod_zdvd_zmod         -> mod_mod_cancel
 zmod_zmod_cancel       -> mod_mod_cancel
 zmod_zmult_self1       -> mod_mult_self2_is_0
 zmod_zmult_self2       -> mod_mult_self1_is_0
 zmod_1                 -> mod_by_1
 zdiv_1                 -> div_by_1
 zdvd_abs1              -> abs_dvd_iff
 zdvd_abs2              -> dvd_abs_iff
 zdvd_refl              -> dvd_refl
 zdvd_trans             -> dvd_trans
 zdvd_zadd              -> dvd_add
 zdvd_zdiff             -> dvd_diff
 zdvd_zminus_iff        -> dvd_minus_iff
 zdvd_zminus2_iff       -> minus_dvd_iff
 zdvd_zmultD            -> dvd_mult_right
 zdvd_zmultD2           -> dvd_mult_left
 zdvd_zmult_mono        -> mult_dvd_mono
 zdvd_0_right           -> dvd_0_right
 zdvd_0_left            -> dvd_0_left_iff
 zdvd_1_left            -> one_dvd
 zminus_dvd_iff         -> minus_dvd_iff
 
 * Theory Rational: 'Fract k 0' now equals '0'.  INCOMPATIBILITY.
 
 * The real numbers offer decimal input syntax: 12.34 is translated
 into 1234/10^2. This translation is not reversed upon output.
 
 * Theory Library/Polynomial defines an abstract type 'a poly of
 univariate polynomials with coefficients of type 'a.  In addition to
 the standard ring operations, it also supports div and mod.  Code
 generation is also supported, using list-style constructors.
 
 * Theory Library/Inner_Product defines a class of real_inner for real
 inner product spaces, with an overloaded operation inner :: 'a => 'a
 => real.  Class real_inner is a subclass of real_normed_vector from
 theory RealVector.
 
 * Theory Library/Product_Vector provides instances for the product
 type 'a * 'b of several classes from RealVector and Inner_Product.
 Definitions of addition, subtraction, scalar multiplication, norms,
 and inner products are included.
 
 * Theory Library/Bit defines the field "bit" of integers modulo 2.  In
 addition to the field operations, numerals and case syntax are also
 supported.
 
 * Theory Library/Diagonalize provides constructive version of Cantor's
 first diagonalization argument.
 
 * Theory Library/GCD: Curried operations gcd, lcm (for nat) and zgcd,
 zlcm (for int); carried together from various gcd/lcm developements in
 the HOL Distribution.  Constants zgcd and zlcm replace former igcd and
 ilcm; corresponding theorems renamed accordingly.  INCOMPATIBILITY,
 may recover tupled syntax as follows:
 
     hide (open) const gcd
     abbreviation gcd where
       "gcd == (%(a, b). GCD.gcd a b)"
     notation (output)
       GCD.gcd ("gcd '(_, _')")
 
 The same works for lcm, zgcd, zlcm.
 
 * Theory Library/Nat_Infinity: added addition, numeral syntax and more
 instantiations for algebraic structures.  Removed some duplicate
 theorems.  Changes in simp rules.  INCOMPATIBILITY.
 
 * ML antiquotation @{code} takes a constant as argument and generates
 corresponding code in background and inserts name of the corresponding
 resulting ML value/function/datatype constructor binding in place.
 All occurrences of @{code} with a single ML block are generated
 simultaneously.  Provides a generic and safe interface for
 instrumentalizing code generation.  See
 src/HOL/Decision_Procs/Ferrack.thy for a more ambitious application.
 In future you ought to refrain from ad-hoc compiling generated SML
 code on the ML toplevel.  Note that (for technical reasons) @{code}
 cannot refer to constants for which user-defined serializations are
 set.  Refer to the corresponding ML counterpart directly in that
 cases.
 
 * Command 'rep_datatype': instead of theorem names the command now
 takes a list of terms denoting the constructors of the type to be
 represented as datatype.  The characteristic theorems have to be
 proven.  INCOMPATIBILITY.  Also observe that the following theorems
 have disappeared in favour of existing ones:
 
     unit_induct                 ~> unit.induct
     prod_induct                 ~> prod.induct
     sum_induct                  ~> sum.induct
     Suc_Suc_eq                  ~> nat.inject
     Suc_not_Zero Zero_not_Suc   ~> nat.distinct
 
 
 *** HOL-Algebra ***
 
 * New locales for orders and lattices where the equivalence relation
 is not restricted to equality.  INCOMPATIBILITY: all order and lattice
 locales use a record structure with field eq for the equivalence.
 
 * New theory of factorial domains.
 
 * Units_l_inv and Units_r_inv are now simp rules by default.
 INCOMPATIBILITY.  Simplifier proof that require deletion of l_inv
 and/or r_inv will now also require deletion of these lemmas.
 
 * Renamed the following theorems, INCOMPATIBILITY:
 
 UpperD ~> Upper_memD
 LowerD ~> Lower_memD
 least_carrier ~> least_closed
 greatest_carrier ~> greatest_closed
 greatest_Lower_above ~> greatest_Lower_below
 one_zero ~> carrier_one_zero
 one_not_zero ~> carrier_one_not_zero  (collision with assumption)
 
 
 *** HOL-Nominal ***
 
 * Nominal datatypes can now contain type-variables.
 
 * Commands 'nominal_inductive' and 'equivariance' work with local
 theory targets.
 
 * Nominal primrec can now works with local theory targets and its
 specification syntax now conforms to the general format as seen in
 'inductive' etc.
 
 * Method "perm_simp" honours the standard simplifier attributes
 (no_asm), (no_asm_use) etc.
 
 * The new predicate #* is defined like freshness, except that on the
 left hand side can be a set or list of atoms.
 
 * Experimental command 'nominal_inductive2' derives strong induction
 principles for inductive definitions.  In contrast to
 'nominal_inductive', which can only deal with a fixed number of
 binders, it can deal with arbitrary expressions standing for sets of
 atoms to be avoided.  The only inductive definition we have at the
 moment that needs this generalisation is the typing rule for Lets in
 the algorithm W:
 
  Gamma |- t1 : T1   (x,close Gamma T1)::Gamma |- t2 : T2   x#Gamma
  -----------------------------------------------------------------
          Gamma |- Let x be t1 in t2 : T2
 
 In this rule one wants to avoid all the binders that are introduced by
 "close Gamma T1".  We are looking for other examples where this
 feature might be useful.  Please let us know.
 
 
 *** HOLCF ***
 
 * Reimplemented the simplification procedure for proving continuity
 subgoals.  The new simproc is extensible; users can declare additional
 continuity introduction rules with the attribute [cont2cont].
 
 * The continuity simproc now uses a different introduction rule for
 solving continuity subgoals on terms with lambda abstractions.  In
 some rare cases the new simproc may fail to solve subgoals that the
 old one could solve, and "simp add: cont2cont_LAM" may be necessary.
 Potential INCOMPATIBILITY.
 
 * Command 'fixrec': specification syntax now conforms to the general
 format as seen in 'inductive' etc.  See src/HOLCF/ex/Fixrec_ex.thy for
 examples.  INCOMPATIBILITY.
 
 
 *** ZF ***
 
 * Proof of Zorn's Lemma for partial orders.
 
 
 *** ML ***
 
 * Multithreading for Poly/ML 5.1/5.2 is no longer supported, only for
 Poly/ML 5.2.1 or later.  Important note: the TimeLimit facility
 depends on multithreading, so timouts will not work before Poly/ML
 5.2.1!
 
 * High-level support for concurrent ML programming, see
 src/Pure/Cuncurrent.  The data-oriented model of "future values" is
 particularly convenient to organize independent functional
 computations.  The concept of "synchronized variables" provides a
 higher-order interface for components with shared state, avoiding the
 delicate details of mutexes and condition variables.  (Requires
 Poly/ML 5.2.1 or later.)
 
 * ML bindings produced via Isar commands are stored within the Isar
 context (theory or proof).  Consequently, commands like 'use' and 'ML'
 become thread-safe and work with undo as expected (concerning
 top-level bindings, not side-effects on global references).
 INCOMPATIBILITY, need to provide proper Isar context when invoking the
 compiler at runtime; really global bindings need to be given outside a
 theory.  (Requires Poly/ML 5.2 or later.)
 
 * Command 'ML_prf' is analogous to 'ML' but works within a proof
 context.  Top-level ML bindings are stored within the proof context in
 a purely sequential fashion, disregarding the nested proof structure.
 ML bindings introduced by 'ML_prf' are discarded at the end of the
 proof.  (Requires Poly/ML 5.2 or later.)
 
 * Simplified ML attribute and method setup, cf. functions Attrib.setup
 and Method.setup, as well as Isar commands 'attribute_setup' and
 'method_setup'.  INCOMPATIBILITY for 'method_setup', need to simplify
 existing code accordingly, or use plain 'setup' together with old
 Method.add_method.
 
 * Simplified ML oracle interface Thm.add_oracle promotes 'a -> cterm
 to 'a -> thm, while results are always tagged with an authentic oracle
 name.  The Isar command 'oracle' is now polymorphic, no argument type
 is specified.  INCOMPATIBILITY, need to simplify existing oracle code
 accordingly.  Note that extra performance may be gained by producing
 the cterm carefully, avoiding slow Thm.cterm_of.
 
 * Simplified interface for defining document antiquotations via
 ThyOutput.antiquotation, ThyOutput.output, and optionally
 ThyOutput.maybe_pretty_source.  INCOMPATIBILITY, need to simplify user
 antiquotations accordingly, see src/Pure/Thy/thy_output.ML for common
 examples.
 
 * More systematic treatment of long names, abstract name bindings, and
 name space operations.  Basic operations on qualified names have been
 move from structure NameSpace to Long_Name, e.g. Long_Name.base_name,
 Long_Name.append.  Old type bstring has been mostly replaced by
 abstract type binding (see structure Binding), which supports precise
 qualification by packages and local theory targets, as well as proper
 tracking of source positions.  INCOMPATIBILITY, need to wrap old
 bstring values into Binding.name, or better pass through abstract
 bindings everywhere.  See further src/Pure/General/long_name.ML,
 src/Pure/General/binding.ML and src/Pure/General/name_space.ML
 
 * Result facts (from PureThy.note_thms, ProofContext.note_thms,
 LocalTheory.note etc.) now refer to the *full* internal name, not the
 bstring as before.  INCOMPATIBILITY, not detected by ML type-checking!
 
 * Disposed old type and term read functions (Sign.read_def_typ,
 Sign.read_typ, Sign.read_def_terms, Sign.read_term,
 Thm.read_def_cterms, Thm.read_cterm etc.).  INCOMPATIBILITY, should
 use regular Syntax.read_typ, Syntax.read_term, Syntax.read_typ_global,
 Syntax.read_term_global etc.; see also OldGoals.read_term as last
 resort for legacy applications.
 
 * Disposed old declarations, tactics, tactic combinators that refer to
 the simpset or claset of an implicit theory (such as Addsimps,
 Simp_tac, SIMPSET).  INCOMPATIBILITY, should use @{simpset} etc. in
 embedded ML text, or local_simpset_of with a proper context passed as
 explicit runtime argument.
 
 * Rules and tactics that read instantiations (read_instantiate,
 res_inst_tac, thin_tac, subgoal_tac etc.) now demand a proper proof
 context, which is required for parsing and type-checking.  Moreover,
 the variables are specified as plain indexnames, not string encodings
 thereof.  INCOMPATIBILITY.
 
 * Generic Toplevel.add_hook interface allows to analyze the result of
 transactions.  E.g. see src/Pure/ProofGeneral/proof_general_pgip.ML
 for theorem dependency output of transactions resulting in a new
 theory state.
 
 * ML antiquotations: block-structured compilation context indicated by
 \<lbrace> ... \<rbrace>; additional antiquotation forms:
 
   @{binding name}                         - basic name binding
   @{let ?pat = term}                      - term abbreviation (HO matching)
   @{note name = fact}                     - fact abbreviation
   @{thm fact}                             - singleton fact (with attributes)
   @{thms fact}                            - general fact (with attributes)
   @{lemma prop by method}                 - singleton goal
   @{lemma prop by meth1 meth2}            - singleton goal
   @{lemma prop1 ... propN by method}      - general goal
   @{lemma prop1 ... propN by meth1 meth2} - general goal
   @{lemma (open) ...}                     - open derivation
 
 
 *** System ***
 
 * The Isabelle "emacs" tool provides a specific interface to invoke
 Proof General / Emacs, with more explicit failure if that is not
 installed (the old isabelle-interface script silently falls back on
 isabelle-process).  The PROOFGENERAL_HOME setting determines the
 installation location of the Proof General distribution.
 
 * Isabelle/lib/classes/Pure.jar provides basic support to integrate
 the Isabelle process into a JVM/Scala application.  See
 Isabelle/lib/jedit/plugin for a minimal example.  (The obsolete Java
 process wrapper has been discontinued.)
 
 * Added homegrown Isabelle font with unicode layout, see lib/fonts.
 
 * Various status messages (with exact source position information) are
 emitted, if proper markup print mode is enabled.  This allows
 user-interface components to provide detailed feedback on internal
 prover operations.
 
 
 
 New in Isabelle2008 (June 2008)
 -------------------------------
 
 *** General ***
 
 * The Isabelle/Isar Reference Manual (isar-ref) has been reorganized
 and updated, with formally checked references as hyperlinks.
 
 * Theory loader: use_thy (and similar operations) no longer set the
 implicit ML context, which was occasionally hard to predict and in
 conflict with concurrency.  INCOMPATIBILITY, use ML within Isar which
 provides a proper context already.
 
 * Theory loader: old-style ML proof scripts being *attached* to a thy
 file are no longer supported.  INCOMPATIBILITY, regular 'uses' and
 'use' within a theory file will do the job.
 
 * Name space merge now observes canonical order, i.e. the second space
 is inserted into the first one, while existing entries in the first
 space take precedence.  INCOMPATIBILITY in rare situations, may try to
 swap theory imports.
 
 * Syntax: symbol \<chi> is now considered a letter.  Potential
 INCOMPATIBILITY in identifier syntax etc.
 
 * Outer syntax: string tokens no longer admit escaped white space,
 which was an accidental (undocumented) feature.  INCOMPATIBILITY, use
 white space without escapes.
 
 * Outer syntax: string tokens may contain arbitrary character codes
 specified via 3 decimal digits (as in SML).  E.g. "foo\095bar" for
 "foo_bar".
 
 
 *** Pure ***
 
 * Context-dependent token translations.  Default setup reverts locally
 fixed variables, and adds hilite markup for undeclared frees.
 
 * Unused theorems can be found using the new command 'unused_thms'.
 There are three ways of invoking it:
 
 (1) unused_thms
      Only finds unused theorems in the current theory.
 
 (2) unused_thms thy_1 ... thy_n -
      Finds unused theorems in the current theory and all of its ancestors,
      excluding the theories thy_1 ... thy_n and all of their ancestors.
 
 (3) unused_thms thy_1 ... thy_n - thy'_1 ... thy'_m
      Finds unused theorems in the theories thy'_1 ... thy'_m and all of
      their ancestors, excluding the theories thy_1 ... thy_n and all of
      their ancestors.
 
 In order to increase the readability of the list produced by
 unused_thms, theorems that have been created by a particular instance
 of a theory command such as 'inductive' or 'function' are considered
 to belong to the same "group", meaning that if at least one theorem in
 this group is used, the other theorems in the same group are no longer
 reported as unused.  Moreover, if all theorems in the group are
 unused, only one theorem in the group is displayed.
 
 Note that proof objects have to be switched on in order for
 unused_thms to work properly (i.e. !proofs must be >= 1, which is
 usually the case when using Proof General with the default settings).
 
 * Authentic naming of facts disallows ad-hoc overwriting of previous
 theorems within the same name space.  INCOMPATIBILITY, need to remove
 duplicate fact bindings, or even accidental fact duplications.  Note
 that tools may maintain dynamically scoped facts systematically, using
 PureThy.add_thms_dynamic.
 
 * Command 'hide' now allows to hide from "fact" name space as well.
 
 * Eliminated destructive theorem database, simpset, claset, and
 clasimpset.  Potential INCOMPATIBILITY, really need to observe linear
 update of theories within ML code.
 
 * Eliminated theory ProtoPure and CPure, leaving just one Pure theory.
 INCOMPATIBILITY, object-logics depending on former Pure require
 additional setup PureThy.old_appl_syntax_setup; object-logics
 depending on former CPure need to refer to Pure.
 
 * Commands 'use' and 'ML' are now purely functional, operating on
 theory/local_theory.  Removed former 'ML_setup' (on theory), use 'ML'
 instead.  Added 'ML_val' as mere diagnostic replacement for 'ML'.
 INCOMPATIBILITY.
 
 * Command 'setup': discontinued implicit version with ML reference.
 
 * Instantiation target allows for simultaneous specification of class
 instance operations together with an instantiation proof.
 Type-checking phase allows to refer to class operations uniformly.
 See src/HOL/Complex/Complex.thy for an Isar example and
 src/HOL/Library/Eval.thy for an ML example.
 
 * Indexing of literal facts: be more serious about including only
 facts from the visible specification/proof context, but not the
 background context (locale etc.).  Affects `prop` notation and method
 "fact".  INCOMPATIBILITY: need to name facts explicitly in rare
 situations.
 
 * Method "cases", "induct", "coinduct": removed obsolete/undocumented
 "(open)" option, which used to expose internal bound variables to the
 proof text.
 
 * Isar statements: removed obsolete case "rule_context".
 INCOMPATIBILITY, better use explicit fixes/assumes.
 
 * Locale proofs: default proof step now includes 'unfold_locales';
 hence 'proof' without argument may be used to unfold locale
 predicates.
 
 
 *** Document preparation ***
 
 * Simplified pdfsetup.sty: color/hyperref is used unconditionally for
 both pdf and dvi (hyperlinks usually work in xdvi as well); removed
 obsolete thumbpdf setup (contemporary PDF viewers do this on the
 spot); renamed link color from "darkblue" to "linkcolor" (default
 value unchanged, can be redefined via \definecolor); no longer sets
 "a4paper" option (unnecessary or even intrusive).
 
 * Antiquotation @{lemma A method} proves proposition A by the given
 method (either a method name or a method name plus (optional) method
 arguments in parentheses) and prints A just like @{prop A}.
 
 
 *** HOL ***
 
 * New primrec package.  Specification syntax conforms in style to
 definition/function/....  No separate induction rule is provided.  The
 "primrec" command distinguishes old-style and new-style specifications
 by syntax.  The former primrec package is now named OldPrimrecPackage.
 When adjusting theories, beware: constants stemming from new-style
 primrec specifications have authentic syntax.
 
 * Metis prover is now an order of magnitude faster, and also works
 with multithreading.
 
 * Metis: the maximum number of clauses that can be produced from a
 theorem is now given by the attribute max_clauses.  Theorems that
 exceed this number are ignored, with a warning printed.
 
 * Sledgehammer no longer produces structured proofs by default. To
 enable, declare [[sledgehammer_full = true]].  Attributes
 reconstruction_modulus, reconstruction_sorts renamed
 sledgehammer_modulus, sledgehammer_sorts.  INCOMPATIBILITY.
 
 * Method "induct_scheme" derives user-specified induction rules
 from well-founded induction and completeness of patterns. This factors
 out some operations that are done internally by the function package
 and makes them available separately.  See
 src/HOL/ex/Induction_Scheme.thy for examples.
 
 * More flexible generation of measure functions for termination
 proofs: Measure functions can be declared by proving a rule of the
 form "is_measure f" and giving it the [measure_function] attribute.
 The "is_measure" predicate is logically meaningless (always true), and
 just guides the heuristic.  To find suitable measure functions, the
 termination prover sets up the goal "is_measure ?f" of the appropriate
 type and generates all solutions by Prolog-style backward proof using
 the declared rules.
 
 This setup also deals with rules like
 
   "is_measure f ==> is_measure (list_size f)"
 
 which accommodates nested datatypes that recurse through lists.
 Similar rules are predeclared for products and option types.
 
 * Turned the type of sets "'a set" into an abbreviation for "'a => bool"
 
   INCOMPATIBILITIES:
 
   - Definitions of overloaded constants on sets have to be replaced by
     definitions on => and bool.
 
   - Some definitions of overloaded operators on sets can now be proved
     using the definitions of the operators on => and bool.  Therefore,
     the following theorems have been renamed:
 
       subset_def   -> subset_eq
       psubset_def  -> psubset_eq
       set_diff_def -> set_diff_eq
       Compl_def    -> Compl_eq
       Sup_set_def  -> Sup_set_eq
       Inf_set_def  -> Inf_set_eq
       sup_set_def  -> sup_set_eq
       inf_set_def  -> inf_set_eq
 
   - Due to the incompleteness of the HO unification algorithm, some
     rules such as subst may require manual instantiation, if some of
     the unknowns in the rule is a set.
 
   - Higher order unification and forward proofs:
     The proof pattern
 
       have "P (S::'a set)" <...>
       then have "EX S. P S" ..
 
     no longer works (due to the incompleteness of the HO unification
     algorithm) and must be replaced by the pattern
 
       have "EX S. P S"
       proof
         show "P S" <...>
       qed
 
   - Calculational reasoning with subst (or similar rules):
     The proof pattern
 
       have "P (S::'a set)" <...>
       also have "S = T" <...>
       finally have "P T" .
 
     no longer works (for similar reasons as the previous example) and
     must be replaced by something like
 
       have "P (S::'a set)" <...>
       moreover have "S = T" <...>
       ultimately have "P T" by simp
 
   - Tactics or packages written in ML code:
     Code performing pattern matching on types via
 
       Type ("set", [T]) => ...
 
     must be rewritten. Moreover, functions like strip_type or
     binder_types no longer return the right value when applied to a
     type of the form
 
       T1 => ... => Tn => U => bool
 
     rather than
 
       T1 => ... => Tn => U set
 
 * Merged theories Wellfounded_Recursion, Accessible_Part and
 Wellfounded_Relations to theory Wellfounded.
 
 * Explicit class "eq" for executable equality.  INCOMPATIBILITY.
 
 * Class finite no longer treats UNIV as class parameter.  Use class
 enum from theory Library/Enum instead to achieve a similar effect.
 INCOMPATIBILITY.
 
 * Theory List: rule list_induct2 now has explicitly named cases "Nil"
 and "Cons".  INCOMPATIBILITY.
 
 * HOL (and FOL): renamed variables in rules imp_elim and swap.
 Potential INCOMPATIBILITY.
 
 * Theory Product_Type: duplicated lemmas split_Pair_apply and
 injective_fst_snd removed, use split_eta and prod_eqI instead.
 Renamed upd_fst to apfst and upd_snd to apsnd.  INCOMPATIBILITY.
 
 * Theory Nat: removed redundant lemmas that merely duplicate lemmas of
 the same name in theory Orderings:
 
   less_trans
   less_linear
   le_imp_less_or_eq
   le_less_trans
   less_le_trans
   less_not_sym
   less_asym
 
 Renamed less_imp_le to less_imp_le_nat, and less_irrefl to
 less_irrefl_nat.  Potential INCOMPATIBILITY due to more general types
 and different variable names.
 
 * Library/Option_ord.thy: Canonical order on option type.
 
 * Library/RBT.thy: Red-black trees, an efficient implementation of
 finite maps.
 
 * Library/Countable.thy: Type class for countable types.
 
 * Theory Int: The representation of numerals has changed.  The infix
 operator BIT and the bit datatype with constructors B0 and B1 have
 disappeared.  INCOMPATIBILITY, use "Int.Bit0 x" and "Int.Bit1 y" in
 place of "x BIT bit.B0" and "y BIT bit.B1", respectively.  Theorems
 involving BIT, B0, or B1 have been renamed with "Bit0" or "Bit1"
 accordingly.
 
 * Theory Nat: definition of <= and < on natural numbers no longer
 depend on well-founded relations.  INCOMPATIBILITY.  Definitions
 le_def and less_def have disappeared.  Consider lemmas not_less
 [symmetric, where ?'a = nat] and less_eq [symmetric] instead.
 
 * Theory Finite_Set: locales ACf, ACe, ACIf, ACIfSL and ACIfSLlin
 (whose purpose mainly is for various fold_set functionals) have been
 abandoned in favor of the existing algebraic classes
 ab_semigroup_mult, comm_monoid_mult, ab_semigroup_idem_mult,
 lower_semilattice (resp. upper_semilattice) and linorder.
 INCOMPATIBILITY.
 
 * Theory Transitive_Closure: induct and cases rules now declare proper
 case_names ("base" and "step").  INCOMPATIBILITY.
 
 * Theorem Inductive.lfp_ordinal_induct generalized to complete
 lattices.  The form set-specific version is available as
 Inductive.lfp_ordinal_induct_set.
 
 * Renamed theorems "power.simps" to "power_int.simps".
 INCOMPATIBILITY.
 
 * Class semiring_div provides basic abstract properties of semirings
 with division and modulo operations.  Subsumes former class dvd_mod.
 
 * Merged theories IntDef, Numeral and IntArith into unified theory
 Int.  INCOMPATIBILITY.
 
 * Theory Library/Code_Index: type "index" now represents natural
 numbers rather than integers.  INCOMPATIBILITY.
 
 * New class "uminus" with operation "uminus" (split of from class
 "minus" which now only has operation "minus", binary).
 INCOMPATIBILITY.
 
 * Constants "card", "internal_split", "option_map" now with authentic
 syntax.  INCOMPATIBILITY.
 
 * Definitions subset_def, psubset_def, set_diff_def, Compl_def,
 le_bool_def, less_bool_def, le_fun_def, less_fun_def, inf_bool_def,
 sup_bool_def, Inf_bool_def, Sup_bool_def, inf_fun_def, sup_fun_def,
 Inf_fun_def, Sup_fun_def, inf_set_def, sup_set_def, Inf_set_def,
 Sup_set_def, le_def, less_def, option_map_def now with object
 equality.  INCOMPATIBILITY.
 
 * Records. Removed K_record, and replaced it by pure lambda term
 %x. c. The simplifier setup is now more robust against eta expansion.
 INCOMPATIBILITY: in cases explicitly referring to K_record.
 
 * Library/Multiset: {#a, b, c#} abbreviates {#a#} + {#b#} + {#c#}.
 
 * Library/ListVector: new theory of arithmetic vector operations.
 
 * Library/Order_Relation: new theory of various orderings as sets of
 pairs.  Defines preorders, partial orders, linear orders and
 well-orders on sets and on types.
 
 
 *** ZF ***
 
 * Renamed some theories to allow to loading both ZF and HOL in the
 same session:
 
   Datatype  -> Datatype_ZF
   Inductive -> Inductive_ZF
   Int       -> Int_ZF
   IntDiv    -> IntDiv_ZF
   Nat       -> Nat_ZF
   List      -> List_ZF
   Main      -> Main_ZF
 
 INCOMPATIBILITY: ZF theories that import individual theories below
 Main might need to be adapted.  Regular theory Main is still
 available, as trivial extension of Main_ZF.
 
 
 *** ML ***
 
 * ML within Isar: antiquotation @{const name} or @{const
 name(typargs)} produces statically-checked Const term.
 
 * Functor NamedThmsFun: data is available to the user as dynamic fact
 (of the same name).  Removed obsolete print command.
 
 * Removed obsolete "use_legacy_bindings" function.
 
 * The ``print mode'' is now a thread-local value derived from a global
 template (the former print_mode reference), thus access becomes
 non-critical.  The global print_mode reference is for session
 management only; user-code should use print_mode_value,
 print_mode_active, PrintMode.setmp etc.  INCOMPATIBILITY.
 
 * Functions system/system_out provide a robust way to invoke external
 shell commands, with propagation of interrupts (requires Poly/ML
 5.2.1).  Do not use OS.Process.system etc. from the basis library!
 
 
 *** System ***
 
 * Default settings: PROOFGENERAL_OPTIONS no longer impose xemacs ---
 in accordance with Proof General 3.7, which prefers GNU emacs.
 
 * isatool tty runs Isabelle process with plain tty interaction;
 optional line editor may be specified via ISABELLE_LINE_EDITOR
 setting, the default settings attempt to locate "ledit" and "rlwrap".
 
 * isatool browser now works with Cygwin as well, using general
 "javapath" function defined in Isabelle process environment.
 
 * YXML notation provides a simple and efficient alternative to
 standard XML transfer syntax.  See src/Pure/General/yxml.ML and
 isatool yxml as described in the Isabelle system manual.
 
 * JVM class isabelle.IsabelleProcess (located in Isabelle/lib/classes)
 provides general wrapper for managing an Isabelle process in a robust
 fashion, with ``cooked'' output from stdin/stderr.
 
 * Rudimentary Isabelle plugin for jEdit (see Isabelle/lib/jedit),
 based on Isabelle/JVM process wrapper (see Isabelle/lib/classes).
 
 * Removed obsolete THIS_IS_ISABELLE_BUILD feature.  NB: the documented
 way of changing the user's settings is via
 ISABELLE_HOME_USER/etc/settings, which is a fully featured bash
 script.
 
 * Multithreading.max_threads := 0 refers to the number of actual CPU
 cores of the underlying machine, which is a good starting point for
 optimal performance tuning.  The corresponding usedir option -M allows
 "max" as an alias for "0".  WARNING: does not work on certain versions
 of Mac OS (with Poly/ML 5.1).
 
 * isabelle-process: non-ML sessions are run with "nice", to reduce the
 adverse effect of Isabelle flooding interactive front-ends (notably
 ProofGeneral / XEmacs).
 
 
 
 New in Isabelle2007 (November 2007)
 -----------------------------------
 
 *** General ***
 
 * More uniform information about legacy features, notably a
 warning/error of "Legacy feature: ...", depending on the state of the
 tolerate_legacy_features flag (default true). FUTURE INCOMPATIBILITY:
 legacy features will disappear eventually.
 
 * Theory syntax: the header format ``theory A = B + C:'' has been
 discontinued in favour of ``theory A imports B C begin''.  Use isatool
 fixheaders to convert existing theory files.  INCOMPATIBILITY.
 
 * Theory syntax: the old non-Isar theory file format has been
 discontinued altogether.  Note that ML proof scripts may still be used
 with Isar theories; migration is usually quite simple with the ML
 function use_legacy_bindings.  INCOMPATIBILITY.
 
 * Theory syntax: some popular names (e.g. 'class', 'declaration',
 'fun', 'help', 'if') are now keywords.  INCOMPATIBILITY, use double
 quotes.
 
 * Theory loader: be more serious about observing the static theory
 header specifications (including optional directories), but not the
 accidental file locations of previously successful loads.  The strict
 update policy of former update_thy is now already performed by
 use_thy, so the former has been removed; use_thys updates several
 theories simultaneously, just as 'imports' within a theory header
 specification, but without merging the results.  Potential
 INCOMPATIBILITY: may need to refine theory headers and commands
 ROOT.ML which depend on load order.
 
 * Theory loader: optional support for content-based file
 identification, instead of the traditional scheme of full physical
 path plus date stamp; configured by the ISABELLE_FILE_IDENT setting
 (cf. the system manual).  The new scheme allows to work with
 non-finished theories in persistent session images, such that source
 files may be moved later on without requiring reloads.
 
 * Theory loader: old-style ML proof scripts being *attached* to a thy
 file (with the same base name as the theory) are considered a legacy
 feature, which will disappear eventually. Even now, the theory loader
 no longer maintains dependencies on such files.
 
 * Syntax: the scope for resolving ambiguities via type-inference is
 now limited to individual terms, instead of whole simultaneous
 specifications as before. This greatly reduces the complexity of the
 syntax module and improves flexibility by separating parsing and
 type-checking. INCOMPATIBILITY: additional type-constraints (explicit
 'fixes' etc.) are required in rare situations.
 
 * Syntax: constants introduced by new-style packages ('definition',
 'abbreviation' etc.) are passed through the syntax module in
 ``authentic mode''. This means that associated mixfix annotations
 really stick to such constants, independently of potential name space
 ambiguities introduced later on. INCOMPATIBILITY: constants in parse
 trees are represented slightly differently, may need to adapt syntax
 translations accordingly. Use CONST marker in 'translations' and
 @{const_syntax} antiquotation in 'parse_translation' etc.
 
 * Legacy goal package: reduced interface to the bare minimum required
 to keep existing proof scripts running.  Most other user-level
 functions are now part of the OldGoals structure, which is *not* open
 by default (consider isatool expandshort before open OldGoals).
 Removed top_sg, prin, printyp, pprint_term/typ altogether, because
 these tend to cause confusion about the actual goal (!) context being
 used here, which is not necessarily the same as the_context().
 
 * Command 'find_theorems': supports "*" wild-card in "name:"
 criterion; "with_dups" option.  Certain ProofGeneral versions might
 support a specific search form (see ProofGeneral/CHANGES).
 
 * The ``prems limit'' option (cf. ProofContext.prems_limit) is now -1
 by default, which means that "prems" (and also "fixed variables") are
 suppressed from proof state output.  Note that the ProofGeneral
 settings mechanism allows to change and save options persistently, but
 older versions of Isabelle will fail to start up if a negative prems
 limit is imposed.
 
 * Local theory targets may be specified by non-nested blocks of
 ``context/locale/class ... begin'' followed by ``end''.  The body may
 contain definitions, theorems etc., including any derived mechanism
 that has been implemented on top of these primitives.  This concept
 generalizes the existing ``theorem (in ...)'' towards more versatility
 and scalability.
 
 * Proof General interface: proper undo of final 'end' command;
 discontinued Isabelle/classic mode (ML proof scripts).
 
 
 *** Document preparation ***
 
 * Added antiquotation @{theory name} which prints the given name,
 after checking that it refers to a valid ancestor theory in the
 current context.
 
 * Added antiquotations @{ML_type text} and @{ML_struct text} which
 check the given source text as ML type/structure, printing verbatim.
 
 * Added antiquotation @{abbrev "c args"} which prints the abbreviation
 "c args == rhs" given in the current context.  (Any number of
 arguments may be given on the LHS.)
 
 
 *** Pure ***
 
 * The 'class' package offers a combination of axclass and locale to
 achieve Haskell-like type classes in Isabelle.  Definitions and
 theorems within a class context produce both relative results (with
 implicit parameters according to the locale context), and polymorphic
 constants with qualified polymorphism (according to the class
 context).  Within the body context of a 'class' target, a separate
 syntax layer ("user space type system") takes care of converting
 between global polymorphic consts and internal locale representation.
 See src/HOL/ex/Classpackage.thy for examples (as well as main HOL).
 "isatool doc classes" provides a tutorial.
 
 * Generic code generator framework allows to generate executable
 code for ML and Haskell (including Isabelle classes).  A short usage
 sketch:
 
     internal compilation:
         export_code <list of constants (term syntax)> in SML
     writing SML code to a file:
         export_code <list of constants (term syntax)> in SML <filename>
     writing OCaml code to a file:
         export_code <list of constants (term syntax)> in OCaml <filename>
     writing Haskell code to a bunch of files:
         export_code <list of constants (term syntax)> in Haskell <filename>
 
     evaluating closed propositions to True/False using code generation:
         method ``eval''
 
 Reasonable default setup of framework in HOL.
 
 Theorem attributs for selecting and transforming function equations theorems:
 
     [code fun]:        select a theorem as function equation for a specific constant
     [code fun del]:    deselect a theorem as function equation for a specific constant
     [code inline]:     select an equation theorem for unfolding (inlining) in place
     [code inline del]: deselect an equation theorem for unfolding (inlining) in place
 
 User-defined serializations (target in {SML, OCaml, Haskell}):
 
     code_const <and-list of constants (term syntax)>
       {(target) <and-list of const target syntax>}+
 
     code_type <and-list of type constructors>
       {(target) <and-list of type target syntax>}+
 
     code_instance <and-list of instances>
       {(target)}+
         where instance ::= <type constructor> :: <class>
 
     code_class <and_list of classes>
       {(target) <and-list of class target syntax>}+
         where class target syntax ::= <class name> {where {<classop> == <target syntax>}+}?
 
 code_instance and code_class only are effective to target Haskell.
 
 For example usage see src/HOL/ex/Codegenerator.thy and
 src/HOL/ex/Codegenerator_Pretty.thy.  A separate tutorial on code
 generation from Isabelle/HOL theories is available via "isatool doc
 codegen".
 
 * Code generator: consts in 'consts_code' Isar commands are now
 referred to by usual term syntax (including optional type
 annotations).
 
 * Command 'no_translations' removes translation rules from theory
 syntax.
 
 * Overloaded definitions are now actually checked for acyclic
 dependencies.  The overloading scheme is slightly more general than
 that of Haskell98, although Isabelle does not demand an exact
 correspondence to type class and instance declarations.
 INCOMPATIBILITY, use ``defs (unchecked overloaded)'' to admit more
 exotic versions of overloading -- at the discretion of the user!
 
 Polymorphic constants are represented via type arguments, i.e. the
 instantiation that matches an instance against the most general
 declaration given in the signature.  For example, with the declaration
 c :: 'a => 'a => 'a, an instance c :: nat => nat => nat is represented
 as c(nat).  Overloading is essentially simultaneous structural
 recursion over such type arguments.  Incomplete specification patterns
 impose global constraints on all occurrences, e.g. c('a * 'a) on the
 LHS means that more general c('a * 'b) will be disallowed on any RHS.
 Command 'print_theory' outputs the normalized system of recursive
 equations, see section "definitions".
 
 * Configuration options are maintained within the theory or proof
 context (with name and type bool/int/string), providing a very simple
 interface to a poor-man's version of general context data.  Tools may
 declare options in ML (e.g. using Attrib.config_int) and then refer to
 these values using Config.get etc.  Users may change options via an
 associated attribute of the same name.  This form of context
 declaration works particularly well with commands 'declare' or
 'using', for example ``declare [[foo = 42]]''.  Thus it has become
 very easy to avoid global references, which would not observe Isar
 toplevel undo/redo and fail to work with multithreading.
 
 Various global ML references of Pure and HOL have been turned into
 configuration options:
 
   Unify.search_bound		unify_search_bound
   Unify.trace_bound		unify_trace_bound
   Unify.trace_simp		unify_trace_simp
   Unify.trace_types		unify_trace_types
   Simplifier.simp_depth_limit	simp_depth_limit
   Blast.depth_limit		blast_depth_limit
   DatatypeProp.dtK		datatype_distinctness_limit
   fast_arith_neq_limit  	fast_arith_neq_limit
   fast_arith_split_limit	fast_arith_split_limit
 
 * Named collections of theorems may be easily installed as context
 data using the functor NamedThmsFun (see also
 src/Pure/Tools/named_thms.ML).  The user may add or delete facts via
 attributes; there is also a toplevel print command.  This facility is
 just a common case of general context data, which is the preferred way
 for anything more complex than just a list of facts in canonical
 order.
 
 * Isar: command 'declaration' augments a local theory by generic
 declaration functions written in ML.  This enables arbitrary content
 being added to the context, depending on a morphism that tells the
 difference of the original declaration context wrt. the application
 context encountered later on.
 
 * Isar: proper interfaces for simplification procedures.  Command
 'simproc_setup' declares named simprocs (with match patterns, and body
 text in ML).  Attribute "simproc" adds/deletes simprocs in the current
 context.  ML antiquotation @{simproc name} retrieves named simprocs.
 
 * Isar: an extra pair of brackets around attribute declarations
 abbreviates a theorem reference involving an internal dummy fact,
 which will be ignored later --- only the effect of the attribute on
 the background context will persist.  This form of in-place
 declarations is particularly useful with commands like 'declare' and
 'using', for example ``have A using [[simproc a]] by simp''.
 
 * Isar: method "assumption" (and implicit closing of subproofs) now
 takes simple non-atomic goal assumptions into account: after applying
 an assumption as a rule the resulting subgoals are solved by atomic
 assumption steps.  This is particularly useful to finish 'obtain'
 goals, such as "!!x. (!!x. P x ==> thesis) ==> P x ==> thesis",
 without referring to the original premise "!!x. P x ==> thesis" in the
 Isar proof context.  POTENTIAL INCOMPATIBILITY: method "assumption" is
 more permissive.
 
 * Isar: implicit use of prems from the Isar proof context is
 considered a legacy feature.  Common applications like ``have A .''
 may be replaced by ``have A by fact'' or ``note `A`''.  In general,
 referencing facts explicitly here improves readability and
 maintainability of proof texts.
 
 * Isar: improper proof element 'guess' is like 'obtain', but derives
 the obtained context from the course of reasoning!  For example:
 
   assume "EX x y. A x & B y"   -- "any previous fact"
   then guess x and y by clarify
 
 This technique is potentially adventurous, depending on the facts and
 proof tools being involved here.
 
 * Isar: known facts from the proof context may be specified as literal
 propositions, using ASCII back-quote syntax.  This works wherever
 named facts used to be allowed so far, in proof commands, proof
 methods, attributes etc.  Literal facts are retrieved from the context
 according to unification of type and term parameters.  For example,
 provided that "A" and "A ==> B" and "!!x. P x ==> Q x" are known
 theorems in the current context, then these are valid literal facts:
 `A` and `A ==> B` and `!!x. P x ==> Q x" as well as `P a ==> Q a` etc.
 
 There is also a proof method "fact" which does the same composition
 for explicit goal states, e.g. the following proof texts coincide with
 certain special cases of literal facts:
 
   have "A" by fact                 ==  note `A`
   have "A ==> B" by fact           ==  note `A ==> B`
   have "!!x. P x ==> Q x" by fact  ==  note `!!x. P x ==> Q x`
   have "P a ==> Q a" by fact       ==  note `P a ==> Q a`
 
 * Isar: ":" (colon) is no longer a symbolic identifier character in
 outer syntax.  Thus symbolic identifiers may be used without
 additional white space in declarations like this: ``assume *: A''.
 
 * Isar: 'print_facts' prints all local facts of the current context,
 both named and unnamed ones.
 
 * Isar: 'def' now admits simultaneous definitions, e.g.:
 
   def x == "t" and y == "u"
 
 * Isar: added command 'unfolding', which is structurally similar to
 'using', but affects both the goal state and facts by unfolding given
 rewrite rules.  Thus many occurrences of the 'unfold' method or
 'unfolded' attribute may be replaced by first-class proof text.
 
 * Isar: methods 'unfold' / 'fold', attributes 'unfolded' / 'folded',
 and command 'unfolding' now all support object-level equalities
 (potentially conditional).  The underlying notion of rewrite rule is
 analogous to the 'rule_format' attribute, but *not* that of the
 Simplifier (which is usually more generous).
 
 * Isar: the new attribute [rotated n] (default n = 1) rotates the
 premises of a theorem by n. Useful in conjunction with drule.
 
 * Isar: the goal restriction operator [N] (default N = 1) evaluates a
 method expression within a sandbox consisting of the first N
 sub-goals, which need to exist.  For example, ``simp_all [3]''
 simplifies the first three sub-goals, while (rule foo, simp_all)[]
 simplifies all new goals that emerge from applying rule foo to the
 originally first one.
 
 * Isar: schematic goals are no longer restricted to higher-order
 patterns; e.g. ``lemma "?P(?x)" by (rule TrueI)'' now works as
 expected.
 
 * Isar: the conclusion of a long theorem statement is now either
 'shows' (a simultaneous conjunction, as before), or 'obtains'
 (essentially a disjunction of cases with local parameters and
 assumptions).  The latter allows to express general elimination rules
 adequately; in this notation common elimination rules look like this:
 
   lemma exE:    -- "EX x. P x ==> (!!x. P x ==> thesis) ==> thesis"
     assumes "EX x. P x"
     obtains x where "P x"
 
   lemma conjE:  -- "A & B ==> (A ==> B ==> thesis) ==> thesis"
     assumes "A & B"
     obtains A and B
 
   lemma disjE:  -- "A | B ==> (A ==> thesis) ==> (B ==> thesis) ==> thesis"
     assumes "A | B"
     obtains
       A
     | B
 
 The subsequent classical rules even refer to the formal "thesis"
 explicitly:
 
   lemma classical:     -- "(~ thesis ==> thesis) ==> thesis"
     obtains "~ thesis"
 
   lemma Peirce's_Law:  -- "((thesis ==> something) ==> thesis) ==> thesis"
     obtains "thesis ==> something"
 
 The actual proof of an 'obtains' statement is analogous to that of the
 Isar proof element 'obtain', only that there may be several cases.
 Optional case names may be specified in parentheses; these will be
 available both in the present proof and as annotations in the
 resulting rule, for later use with the 'cases' method (cf. attribute
 case_names).
 
 * Isar: the assumptions of a long theorem statement are available as
 "assms" fact in the proof context.  This is more appropriate than the
 (historical) "prems", which refers to all assumptions of the current
 context, including those from the target locale, proof body etc.
 
 * Isar: 'print_statement' prints theorems from the current theory or
 proof context in long statement form, according to the syntax of a
 top-level lemma.
 
 * Isar: 'obtain' takes an optional case name for the local context
 introduction rule (default "that").
 
 * Isar: removed obsolete 'concl is' patterns.  INCOMPATIBILITY, use
 explicit (is "_ ==> ?foo") in the rare cases where this still happens
 to occur.
 
 * Pure: syntax "CONST name" produces a fully internalized constant
 according to the current context.  This is particularly useful for
 syntax translations that should refer to internal constant
 representations independently of name spaces.
 
 * Pure: syntax constant for foo (binder "FOO ") is called "foo_binder"
 instead of "FOO ". This allows multiple binder declarations to coexist
 in the same context.  INCOMPATIBILITY.
 
 * Isar/locales: 'notation' provides a robust interface to the 'syntax'
 primitive that also works in a locale context (both for constants and
 fixed variables). Type declaration and internal syntactic representation
 of given constants retrieved from the context. Likewise, the
 'no_notation' command allows to remove given syntax annotations from the
 current context.
 
 * Isar/locales: new derived specification elements 'axiomatization',
 'definition', 'abbreviation', which support type-inference, admit
 object-level specifications (equality, equivalence).  See also the
 isar-ref manual.  Examples:
 
   axiomatization
     eq  (infix "===" 50) where
     eq_refl: "x === x" and eq_subst: "x === y ==> P x ==> P y"
 
   definition "f x y = x + y + 1"
   definition g where "g x = f x x"
 
   abbreviation
     neq  (infix "=!=" 50) where
     "x =!= y == ~ (x === y)"
 
 These specifications may be also used in a locale context.  Then the
 constants being introduced depend on certain fixed parameters, and the
 constant name is qualified by the locale base name.  An internal
 abbreviation takes care for convenient input and output, making the
 parameters implicit and using the original short name.  See also
 src/HOL/ex/Abstract_NAT.thy for an example of deriving polymorphic
 entities from a monomorphic theory.
 
 Presently, abbreviations are only available 'in' a target locale, but
 not inherited by general import expressions.  Also note that
 'abbreviation' may be used as a type-safe replacement for 'syntax' +
 'translations' in common applications.  The "no_abbrevs" print mode
 prevents folding of abbreviations in term output.
 
 Concrete syntax is attached to specified constants in internal form,
 independently of name spaces.  The parse tree representation is
 slightly different -- use 'notation' instead of raw 'syntax', and
 'translations' with explicit "CONST" markup to accommodate this.
 
 * Pure/Isar: unified syntax for new-style specification mechanisms
 (e.g.  'definition', 'abbreviation', or 'inductive' in HOL) admits
 full type inference and dummy patterns ("_").  For example:
 
   definition "K x _ = x"
 
   inductive conj for A B
   where "A ==> B ==> conj A B"
 
 * Pure: command 'print_abbrevs' prints all constant abbreviations of
 the current context.  Print mode "no_abbrevs" prevents inversion of
 abbreviations on output.
 
 * Isar/locales: improved parameter handling: use of locales "var" and
 "struct" no longer necessary; - parameter renamings are no longer
 required to be injective.  For example, this allows to define
 endomorphisms as locale endom = homom mult mult h.
 
 * Isar/locales: changed the way locales with predicates are defined.
 Instead of accumulating the specification, the imported expression is
 now an interpretation.  INCOMPATIBILITY: different normal form of
 locale expressions.  In particular, in interpretations of locales with
 predicates, goals repesenting already interpreted fragments are not
 removed automatically.  Use methods `intro_locales' and
 `unfold_locales'; see below.
 
 * Isar/locales: new methods `intro_locales' and `unfold_locales'
 provide backward reasoning on locales predicates.  The methods are
 aware of interpretations and discharge corresponding goals.
 `intro_locales' is less aggressive then `unfold_locales' and does not
 unfold predicates to assumptions.
 
 * Isar/locales: the order in which locale fragments are accumulated
 has changed.  This enables to override declarations from fragments due
 to interpretations -- for example, unwanted simp rules.
 
 * Isar/locales: interpretation in theories and proof contexts has been
 extended.  One may now specify (and prove) equations, which are
 unfolded in interpreted theorems.  This is useful for replacing
 defined concepts (constants depending on locale parameters) by
 concepts already existing in the target context.  Example:
 
   interpretation partial_order ["op <= :: [int, int] => bool"]
     where "partial_order.less (op <=) (x::int) y = (x < y)"
 
 Typically, the constant `partial_order.less' is created by a
 definition specification element in the context of locale
 partial_order.
 
 * Method "induct": improved internal context management to support
 local fixes and defines on-the-fly. Thus explicit meta-level
 connectives !!  and ==> are rarely required anymore in inductive goals
 (using object-logic connectives for this purpose has been long
 obsolete anyway). Common proof patterns are explained in
 src/HOL/Induct/Common_Patterns.thy, see also
 src/HOL/Isar_examples/Puzzle.thy and src/HOL/Lambda for realistic
 examples.
 
 * Method "induct": improved handling of simultaneous goals. Instead of
 introducing object-level conjunction, the statement is now split into
 several conclusions, while the corresponding symbolic cases are nested
 accordingly. INCOMPATIBILITY, proofs need to be structured explicitly,
 see src/HOL/Induct/Common_Patterns.thy, for example.
 
 * Method "induct": mutual induction rules are now specified as a list
 of rule sharing the same induction cases. HOL packages usually provide
 foo_bar.inducts for mutually defined items foo and bar (e.g. inductive
 predicates/sets or datatypes). INCOMPATIBILITY, users need to specify
 mutual induction rules differently, i.e. like this:
 
   (induct rule: foo_bar.inducts)
   (induct set: foo bar)
   (induct pred: foo bar)
   (induct type: foo bar)
 
 The ML function ProjectRule.projections turns old-style rules into the
 new format.
 
 * Method "coinduct": dual of induction, see
 src/HOL/Library/Coinductive_List.thy for various examples.
 
 * Method "cases", "induct", "coinduct": the ``(open)'' option is
 considered a legacy feature.
 
 * Attribute "symmetric" produces result with standardized schematic
 variables (index 0).  Potential INCOMPATIBILITY.
 
 * Simplifier: by default the simplifier trace only shows top level
 rewrites now. That is, trace_simp_depth_limit is set to 1 by
 default. Thus there is less danger of being flooded by the trace. The
 trace indicates where parts have been suppressed.
 
 * Provers/classical: removed obsolete classical version of elim_format
 attribute; classical elim/dest rules are now treated uniformly when
 manipulating the claset.
 
 * Provers/classical: stricter checks to ensure that supplied intro,
 dest and elim rules are well-formed; dest and elim rules must have at
 least one premise.
 
 * Provers/classical: attributes dest/elim/intro take an optional
 weight argument for the rule (just as the Pure versions).  Weights are
 ignored by automated tools, but determine the search order of single
 rule steps.
 
 * Syntax: input syntax now supports dummy variable binding "%_. b",
 where the body does not mention the bound variable.  Note that dummy
 patterns implicitly depend on their context of bounds, which makes
 "{_. _}" match any set comprehension as expected.  Potential
 INCOMPATIBILITY -- parse translations need to cope with syntactic
 constant "_idtdummy" in the binding position.
 
 * Syntax: removed obsolete syntactic constant "_K" and its associated
 parse translation.  INCOMPATIBILITY -- use dummy abstraction instead,
 for example "A -> B" => "Pi A (%_. B)".
 
 * Pure: 'class_deps' command visualizes the subclass relation, using
 the graph browser tool.
 
 * Pure: 'print_theory' now suppresses certain internal declarations by
 default; use '!' option for full details.
 
 
 *** HOL ***
 
 * Method "metis" proves goals by applying the Metis general-purpose
 resolution prover (see also http://gilith.com/software/metis/).
 Examples are in the directory MetisExamples.  WARNING: the
 Isabelle/HOL-Metis integration does not yet work properly with
 multi-threading.
 
 * Command 'sledgehammer' invokes external automatic theorem provers as
 background processes.  It generates calls to the "metis" method if
 successful. These can be pasted into the proof.  Users do not have to
 wait for the automatic provers to return.  WARNING: does not really
 work with multi-threading.
 
 * New "auto_quickcheck" feature tests outermost goal statements for
 potential counter-examples.  Controlled by ML references
 auto_quickcheck (default true) and auto_quickcheck_time_limit (default
 5000 milliseconds).  Fails silently if statements is outside of
 executable fragment, or any other codgenerator problem occurs.
 
 * New constant "undefined" with axiom "undefined x = undefined".
 
 * Added class "HOL.eq", allowing for code generation with polymorphic
 equality.
 
 * Some renaming of class constants due to canonical name prefixing in
 the new 'class' package:
 
     HOL.abs ~> HOL.abs_class.abs
     HOL.divide ~> HOL.divide_class.divide
     0 ~> HOL.zero_class.zero
     1 ~> HOL.one_class.one
     op + ~> HOL.plus_class.plus
     op - ~> HOL.minus_class.minus
     uminus ~> HOL.minus_class.uminus
     op * ~> HOL.times_class.times
     op < ~> HOL.ord_class.less
     op <= > HOL.ord_class.less_eq
     Nat.power ~> Power.power_class.power
     Nat.size ~> Nat.size_class.size
     Numeral.number_of ~> Numeral.number_class.number_of
     FixedPoint.Inf ~> Lattices.complete_lattice_class.Inf
     FixedPoint.Sup ~> Lattices.complete_lattice_class.Sup
     Orderings.min ~> Orderings.ord_class.min
     Orderings.max ~> Orderings.ord_class.max
     Divides.op div ~> Divides.div_class.div
     Divides.op mod ~> Divides.div_class.mod
     Divides.op dvd ~> Divides.div_class.dvd
 
 INCOMPATIBILITY.  Adaptions may be required in the following cases:
 
 a) User-defined constants using any of the names "plus", "minus",
 "times", "less" or "less_eq". The standard syntax translations for
 "+", "-" and "*" may go wrong.  INCOMPATIBILITY: use more specific
 names.
 
 b) Variables named "plus", "minus", "times", "less", "less_eq"
 INCOMPATIBILITY: use more specific names.
 
 c) Permutative equations (e.g. "a + b = b + a")
 Since the change of names also changes the order of terms, permutative
 rewrite rules may get applied in a different order. Experience shows
 that this is rarely the case (only two adaptions in the whole Isabelle
 distribution).  INCOMPATIBILITY: rewrite proofs
 
 d) ML code directly refering to constant names
 This in general only affects hand-written proof tactics, simprocs and
 so on.  INCOMPATIBILITY: grep your sourcecode and replace names.
 Consider using @{const_name} antiquotation.
 
 * New class "default" with associated constant "default".
 
 * Function "sgn" is now overloaded and available on int, real, complex
 (and other numeric types), using class "sgn".  Two possible defs of
 sgn are given as equational assumptions in the classes sgn_if and
 sgn_div_norm; ordered_idom now also inherits from sgn_if.
 INCOMPATIBILITY.
 
 * Locale "partial_order" now unified with class "order" (cf. theory
 Orderings), added parameter "less".  INCOMPATIBILITY.
 
 * Renamings in classes "order" and "linorder": facts "refl", "trans" and
 "cases" to "order_refl", "order_trans" and "linorder_cases", to avoid
 clashes with HOL "refl" and "trans".  INCOMPATIBILITY.
 
 * Classes "order" and "linorder": potential INCOMPATIBILITY due to
 changed order of proof goals in instance proofs.
 
 * The transitivity reasoner for partial and linear orders is set up
 for classes "order" and "linorder".  Instances of the reasoner are available
 in all contexts importing or interpreting the corresponding locales.
 Method "order" invokes the reasoner separately; the reasoner
 is also integrated with the Simplifier as a solver.  Diagnostic
 command 'print_orders' shows the available instances of the reasoner
 in the current context.
 
 * Localized monotonicity predicate in theory "Orderings"; integrated
 lemmas max_of_mono and min_of_mono with this predicate.
 INCOMPATIBILITY.
 
 * Formulation of theorem "dense" changed slightly due to integration
 with new class dense_linear_order.
 
 * Uniform lattice theory development in HOL.
 
     constants "meet" and "join" now named "inf" and "sup"
     constant "Meet" now named "Inf"
 
     classes "meet_semilorder" and "join_semilorder" now named
       "lower_semilattice" and "upper_semilattice"
     class "lorder" now named "lattice"
     class "comp_lat" now named "complete_lattice"
 
     Instantiation of lattice classes allows explicit definitions
     for "inf" and "sup" operations (or "Inf" and "Sup" for complete lattices).
 
   INCOMPATIBILITY.  Theorem renames:
 
     meet_left_le            ~> inf_le1
     meet_right_le           ~> inf_le2
     join_left_le            ~> sup_ge1
     join_right_le           ~> sup_ge2
     meet_join_le            ~> inf_sup_ord
     le_meetI                ~> le_infI
     join_leI                ~> le_supI
     le_meet                 ~> le_inf_iff
     le_join                 ~> ge_sup_conv
     meet_idempotent         ~> inf_idem
     join_idempotent         ~> sup_idem
     meet_comm               ~> inf_commute
     join_comm               ~> sup_commute
     meet_leI1               ~> le_infI1
     meet_leI2               ~> le_infI2
     le_joinI1               ~> le_supI1
     le_joinI2               ~> le_supI2
     meet_assoc              ~> inf_assoc
     join_assoc              ~> sup_assoc
     meet_left_comm          ~> inf_left_commute
     meet_left_idempotent    ~> inf_left_idem
     join_left_comm          ~> sup_left_commute
     join_left_idempotent    ~> sup_left_idem
     meet_aci                ~> inf_aci
     join_aci                ~> sup_aci
     le_def_meet             ~> le_iff_inf
     le_def_join             ~> le_iff_sup
     join_absorp2            ~> sup_absorb2
     join_absorp1            ~> sup_absorb1
     meet_absorp1            ~> inf_absorb1
     meet_absorp2            ~> inf_absorb2
     meet_join_absorp        ~> inf_sup_absorb
     join_meet_absorp        ~> sup_inf_absorb
     distrib_join_le         ~> distrib_sup_le
     distrib_meet_le         ~> distrib_inf_le
 
     add_meet_distrib_left   ~> add_inf_distrib_left
     add_join_distrib_left   ~> add_sup_distrib_left
     is_join_neg_meet        ~> is_join_neg_inf
     is_meet_neg_join        ~> is_meet_neg_sup
     add_meet_distrib_right  ~> add_inf_distrib_right
     add_join_distrib_right  ~> add_sup_distrib_right
     add_meet_join_distribs  ~> add_sup_inf_distribs
     join_eq_neg_meet        ~> sup_eq_neg_inf
     meet_eq_neg_join        ~> inf_eq_neg_sup
     add_eq_meet_join        ~> add_eq_inf_sup
     meet_0_imp_0            ~> inf_0_imp_0
     join_0_imp_0            ~> sup_0_imp_0
     meet_0_eq_0             ~> inf_0_eq_0
     join_0_eq_0             ~> sup_0_eq_0
     neg_meet_eq_join        ~> neg_inf_eq_sup
     neg_join_eq_meet        ~> neg_sup_eq_inf
     join_eq_if              ~> sup_eq_if
 
     mono_meet               ~> mono_inf
     mono_join               ~> mono_sup
     meet_bool_eq            ~> inf_bool_eq
     join_bool_eq            ~> sup_bool_eq
     meet_fun_eq             ~> inf_fun_eq
     join_fun_eq             ~> sup_fun_eq
     meet_set_eq             ~> inf_set_eq
     join_set_eq             ~> sup_set_eq
     meet1_iff               ~> inf1_iff
     meet2_iff               ~> inf2_iff
     meet1I                  ~> inf1I
     meet2I                  ~> inf2I
     meet1D1                 ~> inf1D1
     meet2D1                 ~> inf2D1
     meet1D2                 ~> inf1D2
     meet2D2                 ~> inf2D2
     meet1E                  ~> inf1E
     meet2E                  ~> inf2E
     join1_iff               ~> sup1_iff
     join2_iff               ~> sup2_iff
     join1I1                 ~> sup1I1
     join2I1                 ~> sup2I1
     join1I1                 ~> sup1I1
     join2I2                 ~> sup1I2
     join1CI                 ~> sup1CI
     join2CI                 ~> sup2CI
     join1E                  ~> sup1E
     join2E                  ~> sup2E
 
     is_meet_Meet            ~> is_meet_Inf
     Meet_bool_def           ~> Inf_bool_def
     Meet_fun_def            ~> Inf_fun_def
     Meet_greatest           ~> Inf_greatest
     Meet_lower              ~> Inf_lower
     Meet_set_def            ~> Inf_set_def
 
     Sup_def                 ~> Sup_Inf
     Sup_bool_eq             ~> Sup_bool_def
     Sup_fun_eq              ~> Sup_fun_def
     Sup_set_eq              ~> Sup_set_def
 
     listsp_meetI            ~> listsp_infI
     listsp_meet_eq          ~> listsp_inf_eq
 
     meet_min                ~> inf_min
     join_max                ~> sup_max
 
 * Added syntactic class "size"; overloaded constant "size" now has
 type "'a::size ==> bool"
 
 * Internal reorganisation of `size' of datatypes: size theorems
 "foo.size" are no longer subsumed by "foo.simps" (but are still
 simplification rules by default!); theorems "prod.size" now named
 "*.size".
 
 * Class "div" now inherits from class "times" rather than "type".
 INCOMPATIBILITY.
 
 * HOL/Finite_Set: "name-space" locales Lattice, Distrib_lattice,
 Linorder etc.  have disappeared; operations defined in terms of
 fold_set now are named Inf_fin, Sup_fin.  INCOMPATIBILITY.
 
 * HOL/Nat: neq0_conv no longer declared as iff.  INCOMPATIBILITY.
 
 * HOL-Word: New extensive library and type for generic, fixed size
 machine words, with arithmetic, bit-wise, shifting and rotating
 operations, reflection into int, nat, and bool lists, automation for
 linear arithmetic (by automatic reflection into nat or int), including
 lemmas on overflow and monotonicity.  Instantiated to all appropriate
 arithmetic type classes, supporting automatic simplification of
 numerals on all operations.
 
 * Library/Boolean_Algebra: locales for abstract boolean algebras.
 
 * Library/Numeral_Type: numbers as types, e.g. TYPE(32).
 
 * Code generator library theories:
   - Code_Integer represents HOL integers by big integer literals in target
     languages.
   - Code_Char represents HOL characters by character literals in target
     languages.
   - Code_Char_chr like Code_Char, but also offers treatment of character
     codes; includes Code_Integer.
   - Executable_Set allows to generate code for finite sets using lists.
   - Executable_Rat implements rational numbers as triples (sign, enumerator,
     denominator).
   - Executable_Real implements a subset of real numbers, namly those
     representable by rational numbers.
   - Efficient_Nat implements natural numbers by integers, which in general will
     result in higher efficency; pattern matching with 0/Suc is eliminated;
     includes Code_Integer.
   - Code_Index provides an additional datatype index which is mapped to
     target-language built-in integers.
   - Code_Message provides an additional datatype message_string which is isomorphic to
     strings; messages are mapped to target-language strings.
 
 * New package for inductive predicates
 
   An n-ary predicate p with m parameters z_1, ..., z_m can now be defined via
 
     inductive
       p :: "U_1 => ... => U_m => T_1 => ... => T_n => bool"
       for z_1 :: U_1 and ... and z_n :: U_m
     where
       rule_1: "... ==> p z_1 ... z_m t_1_1 ... t_1_n"
     | ...
 
   with full support for type-inference, rather than
 
     consts s :: "U_1 => ... => U_m => (T_1 * ... * T_n) set"
 
     abbreviation p :: "U_1 => ... => U_m => T_1 => ... => T_n => bool"
     where "p z_1 ... z_m x_1 ... x_n == (x_1, ..., x_n) : s z_1 ... z_m"
 
     inductive "s z_1 ... z_m"
     intros
       rule_1: "... ==> (t_1_1, ..., t_1_n) : s z_1 ... z_m"
       ...
 
   For backward compatibility, there is a wrapper allowing inductive
   sets to be defined with the new package via
 
     inductive_set
       s :: "U_1 => ... => U_m => (T_1 * ... * T_n) set"
       for z_1 :: U_1 and ... and z_n :: U_m
     where
       rule_1: "... ==> (t_1_1, ..., t_1_n) : s z_1 ... z_m"
     | ...
 
   or
 
     inductive_set
       s :: "U_1 => ... => U_m => (T_1 * ... * T_n) set"
       and p :: "U_1 => ... => U_m => T_1 => ... => T_n => bool"
       for z_1 :: U_1 and ... and z_n :: U_m
     where
       "p z_1 ... z_m x_1 ... x_n == (x_1, ..., x_n) : s z_1 ... z_m"
     | rule_1: "... ==> p z_1 ... z_m t_1_1 ... t_1_n"
     | ...
 
   if the additional syntax "p ..." is required.
 
   Numerous examples can be found in the subdirectories src/HOL/Auth,
   src/HOL/Bali, src/HOL/Induct, and src/HOL/MicroJava.
 
   INCOMPATIBILITIES:
 
   - Since declaration and definition of inductive sets or predicates
     is no longer separated, abbreviations involving the newly
     introduced sets or predicates must be specified together with the
     introduction rules after the 'where' keyword (see above), rather
     than before the actual inductive definition.
 
   - The variables in induction and elimination rules are now
     quantified in the order of their occurrence in the introduction
     rules, rather than in alphabetical order. Since this may break
     some proofs, these proofs either have to be repaired, e.g. by
     reordering the variables a_i_1 ... a_i_{k_i} in Isar 'case'
     statements of the form
 
       case (rule_i a_i_1 ... a_i_{k_i})
 
     or the old order of quantification has to be restored by explicitly adding
     meta-level quantifiers in the introduction rules, i.e.
 
       | rule_i: "!!a_i_1 ... a_i_{k_i}. ... ==> p z_1 ... z_m t_i_1 ... t_i_n"
 
   - The format of the elimination rules is now
 
       p z_1 ... z_m x_1 ... x_n ==>
         (!!a_1_1 ... a_1_{k_1}. x_1 = t_1_1 ==> ... ==> x_n = t_1_n ==> ... ==> P)
         ==> ... ==> P
 
     for predicates and
 
       (x_1, ..., x_n) : s z_1 ... z_m ==>
         (!!a_1_1 ... a_1_{k_1}. x_1 = t_1_1 ==> ... ==> x_n = t_1_n ==> ... ==> P)
         ==> ... ==> P
 
     for sets rather than
 
       x : s z_1 ... z_m ==>
         (!!a_1_1 ... a_1_{k_1}. x = (t_1_1, ..., t_1_n) ==> ... ==> P)
         ==> ... ==> P
 
     This may require terms in goals to be expanded to n-tuples
     (e.g. using case_tac or simplification with the split_paired_all
     rule) before the above elimination rule is applicable.
 
   - The elimination or case analysis rules for (mutually) inductive
     sets or predicates are now called "p_1.cases" ... "p_k.cases". The
     list of rules "p_1_..._p_k.elims" is no longer available.
 
 * New package "function"/"fun" for general recursive functions,
 supporting mutual and nested recursion, definitions in local contexts,
 more general pattern matching and partiality. See HOL/ex/Fundefs.thy
 for small examples, and the separate tutorial on the function
 package. The old recdef "package" is still available as before, but
 users are encouraged to use the new package.
 
 * Method "lexicographic_order" automatically synthesizes termination
 relations as lexicographic combinations of size measures.
 
 * Case-expressions allow arbitrary constructor-patterns (including
 "_") and take their order into account, like in functional
 programming.  Internally, this is translated into nested
 case-expressions; missing cases are added and mapped to the predefined
 constant "undefined". In complicated cases printing may no longer show
 the original input but the internal form. Lambda-abstractions allow
 the same form of pattern matching: "% pat1 => e1 | ..." is an
 abbreviation for "%x. case x of pat1 => e1 | ..." where x is a new
 variable.
 
 * IntDef: The constant "int :: nat => int" has been removed; now "int"
 is an abbreviation for "of_nat :: nat => int". The simplification
 rules for "of_nat" have been changed to work like "int" did
 previously.  Potential INCOMPATIBILITY:
   - "of_nat (Suc m)" simplifies to "1 + of_nat m" instead of "of_nat m + 1"
   - of_nat_diff and of_nat_mult are no longer default simp rules
 
 * Method "algebra" solves polynomial equations over (semi)rings using
 Groebner bases. The (semi)ring structure is defined by locales and the
 tool setup depends on that generic context. Installing the method for
 a specific type involves instantiating the locale and possibly adding
 declarations for computation on the coefficients.  The method is
 already instantiated for natural numbers and for the axiomatic class
 of idoms with numerals.  See also the paper by Chaieb and Wenzel at
 CALCULEMUS 2007 for the general principles underlying this
 architecture of context-aware proof-tools.
 
 * Method "ferrack" implements quantifier elimination over
 special-purpose dense linear orders using locales (analogous to
 "algebra"). The method is already installed for class
 {ordered_field,recpower,number_ring} which subsumes real, hyperreal,
 rat, etc.
 
 * Former constant "List.op @" now named "List.append".  Use ML
 antiquotations @{const_name List.append} or @{term " ... @ ... "} to
 circumvent possible incompatibilities when working on ML level.
 
 * primrec: missing cases mapped to "undefined" instead of "arbitrary".
 
 * New function listsum :: 'a list => 'a for arbitrary monoids.
 Special syntax: "SUM x <- xs. f x" (and latex variants)
 
 * New syntax for Haskell-like list comprehension (input only), eg.
 [(x,y). x <- xs, y <- ys, x ~= y], see also src/HOL/List.thy.
 
 * The special syntax for function "filter" has changed from [x :
 xs. P] to [x <- xs. P] to avoid an ambiguity caused by list
 comprehension syntax, and for uniformity.  INCOMPATIBILITY.
 
 * [a..b] is now defined for arbitrary linear orders.  It used to be
 defined on nat only, as an abbreviation for [a..<Suc b]
 INCOMPATIBILITY.
 
 * Renamed lemma "set_take_whileD"  to "set_takeWhileD".
 
 * New functions "sorted" and "sort" in src/HOL/List.thy.
 
 * New lemma collection field_simps (an extension of ring_simps) for
 manipulating (in)equations involving division. Multiplies with all
 denominators that can be proved to be non-zero (in equations) or
 positive/negative (in inequations).
 
 * Lemma collections ring_eq_simps, group_eq_simps and ring_distrib
 have been improved and renamed to ring_simps, group_simps and
 ring_distribs.  Removed lemmas field_xyz in theory Ring_and_Field
 because they were subsumed by lemmas xyz.  INCOMPATIBILITY.
 
 * Theory Library/Commutative_Ring: switched from recdef to function
 package; constants add, mul, pow now curried.  Infix syntax for
 algebraic operations.
 
 * Dropped redundant lemma def_imp_eq in favor of meta_eq_to_obj_eq.
 INCOMPATIBILITY.
 
 * Dropped redundant lemma if_def2 in favor of if_bool_eq_conj.
 INCOMPATIBILITY.
 
 * HOL/records: generalised field-update to take a function on the
 field rather than the new value: r(|A := x|) is translated to A_update
 (K x) r The K-combinator that is internally used is called K_record.
 INCOMPATIBILITY: Usage of the plain update functions has to be
 adapted.
 
 * Class "semiring_0" now contains annihilation axioms x * 0 = 0 and 0
 * x = 0, which are required for a semiring.  Richer structures do not
 inherit from semiring_0 anymore, because this property is a theorem
 there, not an axiom.  INCOMPATIBILITY: In instances of semiring_0,
 there is more to prove, but this is mostly trivial.
 
 * Class "recpower" is generalized to arbitrary monoids, not just
 commutative semirings.  INCOMPATIBILITY: may need to incorporate
 commutativity or semiring properties additionally.
 
 * Constant "List.list_all2" in List.thy now uses authentic syntax.
 INCOMPATIBILITY: translations containing list_all2 may go wrong,
 better use 'abbreviation'.
 
 * Renamed constant "List.op mem" to "List.member".  INCOMPATIBILITY.
 
 * Numeral syntax: type 'bin' which was a mere type copy of 'int' has
 been abandoned in favour of plain 'int'.  INCOMPATIBILITY --
 significant changes for setting up numeral syntax for types:
   - New constants Numeral.pred and Numeral.succ instead
       of former Numeral.bin_pred and Numeral.bin_succ.
   - Use integer operations instead of bin_add, bin_mult and so on.
   - Numeral simplification theorems named Numeral.numeral_simps instead of Bin_simps.
   - ML structure Bin_Simprocs now named Int_Numeral_Base_Simprocs.
 
 See src/HOL/Integ/IntArith.thy for an example setup.
 
 * Command 'normal_form' computes the normal form of a term that may
 contain free variables.  For example ``normal_form "rev [a, b, c]"''
 produces ``[b, c, a]'' (without proof).  This command is suitable for
 heavy-duty computations because the functions are compiled to ML
 first.  Correspondingly, a method "normalization" is provided.  See
 further src/HOL/ex/NormalForm.thy and src/Tools/nbe.ML.
 
 * Alternative iff syntax "A <-> B" for equality on bool (with priority
 25 like -->); output depends on the "iff" print_mode, the default is
 "A = B" (with priority 50).
 
 * Relations less (<) and less_eq (<=) are also available on type bool.
 Modified syntax to disallow nesting without explicit parentheses,
 e.g. "(x < y) < z" or "x < (y < z)", but NOT "x < y < z".  Potential
 INCOMPATIBILITY.
 
 * "LEAST x:A. P" expands to "LEAST x. x:A & P" (input only).
 
 * Relation composition operator "op O" now has precedence 75 and binds
 stronger than union and intersection. INCOMPATIBILITY.
 
 * The old set interval syntax "{m..n(}" (and relatives) has been
 removed.  Use "{m..<n}" (and relatives) instead.
 
 * In the context of the assumption "~(s = t)" the Simplifier rewrites
 "t = s" to False (by simproc "neq").  INCOMPATIBILITY, consider using
 ``declare [[simproc del: neq]]''.
 
 * Simplifier: "m dvd n" where m and n are numbers is evaluated to
 True/False.
 
 * Theorem Cons_eq_map_conv no longer declared as "simp".
 
 * Theorem setsum_mult renamed to setsum_right_distrib.
 
 * Prefer ex1I over ex_ex1I in single-step reasoning, e.g. by the
 ``rule'' method.
 
 * Reimplemented methods "sat" and "satx", with several improvements:
 goals no longer need to be stated as "<prems> ==> False", equivalences
 (i.e. "=" on type bool) are handled, variable names of the form
 "lit_<n>" are no longer reserved, significant speedup.
 
 * Methods "sat" and "satx" can now replay MiniSat proof traces.
 zChaff is still supported as well.
 
 * 'inductive' and 'datatype': provide projections of mutual rules,
 bundled as foo_bar.inducts;
 
 * Library: moved theories Parity, GCD, Binomial, Infinite_Set to
 Library.
 
 * Library: moved theory Accessible_Part to main HOL.
 
 * Library: added theory Coinductive_List of potentially infinite lists
 as greatest fixed-point.
 
 * Library: added theory AssocList which implements (finite) maps as
 association lists.
 
 * Method "evaluation" solves goals (i.e. a boolean expression)
 efficiently by compiling it to ML.  The goal is "proved" (via an
 oracle) if it evaluates to True.
 
 * Linear arithmetic now splits certain operators (e.g. min, max, abs)
 also when invoked by the simplifier.  This results in the Simplifier
 being more powerful on arithmetic goals.  INCOMPATIBILITY.
 Configuration option fast_arith_split_limit=0 recovers the old
 behavior.
 
 * Support for hex (0x20) and binary (0b1001) numerals.
 
 * New method: reify eqs (t), where eqs are equations for an
 interpretation I :: 'a list => 'b => 'c and t::'c is an optional
 parameter, computes a term s::'b and a list xs::'a list and proves the
 theorem I xs s = t. This is also known as reification or quoting. The
 resulting theorem is applied to the subgoal to substitute t with I xs
 s.  If t is omitted, the subgoal itself is reified.
 
 * New method: reflection corr_thm eqs (t). The parameters eqs and (t)
 are as explained above. corr_thm is a theorem for I vs (f t) = I vs t,
 where f is supposed to be a computable function (in the sense of code
 generattion). The method uses reify to compute s and xs as above then
 applies corr_thm and uses normalization by evaluation to "prove" f s =
 r and finally gets the theorem t = r, which is again applied to the
 subgoal. An Example is available in src/HOL/ex/ReflectionEx.thy.
 
 * Reflection: Automatic reification now handels binding, an example is
 available in src/HOL/ex/ReflectionEx.thy
 
 * HOL-Statespace: ``State Spaces: The Locale Way'' introduces a
 command 'statespace' that is similar to 'record', but introduces an
 abstract specification based on the locale infrastructure instead of
 HOL types.  This leads to extra flexibility in composing state spaces,
 in particular multiple inheritance and renaming of components.
 
 
 *** HOL-Complex ***
 
 * Hyperreal: Functions root and sqrt are now defined on negative real
 inputs so that root n (- x) = - root n x and sqrt (- x) = - sqrt x.
 Nonnegativity side conditions have been removed from many lemmas, so
 that more subgoals may now be solved by simplification; potential
 INCOMPATIBILITY.
 
 * Real: new type classes formalize real normed vector spaces and
 algebras, using new overloaded constants scaleR :: real => 'a => 'a
 and norm :: 'a => real.
 
 * Real: constant of_real :: real => 'a::real_algebra_1 injects from
 reals into other types. The overloaded constant Reals :: 'a set is now
 defined as range of_real; potential INCOMPATIBILITY.
 
 * Real: proper support for ML code generation, including 'quickcheck'.
 Reals are implemented as arbitrary precision rationals.
 
 * Hyperreal: Several constants that previously worked only for the
 reals have been generalized, so they now work over arbitrary vector
 spaces. Type annotations may need to be added in some cases; potential
 INCOMPATIBILITY.
 
   Infinitesimal  :: ('a::real_normed_vector) star set
   HFinite        :: ('a::real_normed_vector) star set
   HInfinite      :: ('a::real_normed_vector) star set
   approx         :: ('a::real_normed_vector) star => 'a star => bool
   monad          :: ('a::real_normed_vector) star => 'a star set
   galaxy         :: ('a::real_normed_vector) star => 'a star set
   (NS)LIMSEQ     :: [nat => 'a::real_normed_vector, 'a] => bool
   (NS)convergent :: (nat => 'a::real_normed_vector) => bool
   (NS)Bseq       :: (nat => 'a::real_normed_vector) => bool
   (NS)Cauchy     :: (nat => 'a::real_normed_vector) => bool
   (NS)LIM        :: ['a::real_normed_vector => 'b::real_normed_vector, 'a, 'b] => bool
   is(NS)Cont     :: ['a::real_normed_vector => 'b::real_normed_vector, 'a] => bool
   deriv          :: ['a::real_normed_field => 'a, 'a, 'a] => bool
   sgn            :: 'a::real_normed_vector => 'a
   exp            :: 'a::{recpower,real_normed_field,banach} => 'a
 
 * Complex: Some complex-specific constants are now abbreviations for
 overloaded ones: complex_of_real = of_real, cmod = norm, hcmod =
 hnorm.  Other constants have been entirely removed in favor of the
 polymorphic versions (INCOMPATIBILITY):
 
   approx        <-- capprox
   HFinite       <-- CFinite
   HInfinite     <-- CInfinite
   Infinitesimal <-- CInfinitesimal
   monad         <-- cmonad
   galaxy        <-- cgalaxy
   (NS)LIM       <-- (NS)CLIM, (NS)CRLIM
   is(NS)Cont    <-- is(NS)Contc, is(NS)contCR
   (ns)deriv     <-- (ns)cderiv
 
 
 *** HOL-Algebra ***
 
 * Formalisation of ideals and the quotient construction over rings.
 
 * Order and lattice theory no longer based on records.
 INCOMPATIBILITY.
 
 * Renamed lemmas least_carrier -> least_closed and greatest_carrier ->
 greatest_closed.  INCOMPATIBILITY.
 
 * Method algebra is now set up via an attribute.  For examples see
 Ring.thy.  INCOMPATIBILITY: the method is now weaker on combinations
 of algebraic structures.
 
 * Renamed theory CRing to Ring.
 
 
 *** HOL-Nominal ***
 
 * Substantial, yet incomplete support for nominal datatypes (binding
 structures) based on HOL-Nominal logic.  See src/HOL/Nominal and
 src/HOL/Nominal/Examples.  Prospective users should consult
 http://isabelle.in.tum.de/nominal/
 
 
 *** ML ***
 
 * ML basics: just one true type int, which coincides with IntInf.int
 (even on SML/NJ).
 
 * ML within Isar: antiquotations allow to embed statically-checked
 formal entities in the source, referring to the context available at
 compile-time.  For example:
 
 ML {* @{sort "{zero,one}"} *}
 ML {* @{typ "'a => 'b"} *}
 ML {* @{term "%x. x"} *}
 ML {* @{prop "x == y"} *}
 ML {* @{ctyp "'a => 'b"} *}
 ML {* @{cterm "%x. x"} *}
 ML {* @{cprop "x == y"} *}
 ML {* @{thm asm_rl} *}
 ML {* @{thms asm_rl} *}
 ML {* @{type_name c} *}
 ML {* @{type_syntax c} *}
 ML {* @{const_name c} *}
 ML {* @{const_syntax c} *}
 ML {* @{context} *}
 ML {* @{theory} *}
 ML {* @{theory Pure} *}
 ML {* @{theory_ref} *}
 ML {* @{theory_ref Pure} *}
 ML {* @{simpset} *}
 ML {* @{claset} *}
 ML {* @{clasimpset} *}
 
 The same works for sources being ``used'' within an Isar context.
 
 * ML in Isar: improved error reporting; extra verbosity with
 ML_Context.trace enabled.
 
 * Pure/General/table.ML: the join operations now works via exceptions
 DUP/SAME instead of type option. This is simpler in simple cases, and
 admits slightly more efficient complex applications.
 
 * Pure: 'advanced' translation functions (parse_translation etc.) now
 use Context.generic instead of just theory.
 
 * Pure: datatype Context.generic joins theory/Proof.context and
 provides some facilities for code that works in either kind of
 context, notably GenericDataFun for uniform theory and proof data.
 
 * Pure: simplified internal attribute type, which is now always
 Context.generic * thm -> Context.generic * thm. Global (theory) vs.
 local (Proof.context) attributes have been discontinued, while
 minimizing code duplication. Thm.rule_attribute and
 Thm.declaration_attribute build canonical attributes; see also structure
 Context for further operations on Context.generic, notably
 GenericDataFun. INCOMPATIBILITY, need to adapt attribute type
 declarations and definitions.
 
 * Context data interfaces (Theory/Proof/GenericDataFun): removed
 name/print, uninitialized data defaults to ad-hoc copy of empty value,
 init only required for impure data. INCOMPATIBILITY: empty really need
 to be empty (no dependencies on theory content!)
 
 * Pure/kernel: consts certification ignores sort constraints given in
 signature declarations. (This information is not relevant to the
 logic, but only for type inference.) SIGNIFICANT INTERNAL CHANGE,
 potential INCOMPATIBILITY.
 
 * Pure: axiomatic type classes are now purely definitional, with
 explicit proofs of class axioms and super class relations performed
 internally. See Pure/axclass.ML for the main internal interfaces --
 notably AxClass.define_class supercedes AxClass.add_axclass, and
 AxClass.axiomatize_class/classrel/arity supersede
 Sign.add_classes/classrel/arities.
 
 * Pure/Isar: Args/Attrib parsers operate on Context.generic --
 global/local versions on theory vs. Proof.context have been
 discontinued; Attrib.syntax and Method.syntax have been adapted
 accordingly.  INCOMPATIBILITY, need to adapt parser expressions for
 attributes, methods, etc.
 
 * Pure: several functions of signature "... -> theory -> theory * ..."
 have been reoriented to "... -> theory -> ... * theory" in order to
 allow natural usage in combination with the ||>, ||>>, |-> and
 fold_map combinators.
 
 * Pure: official theorem names (closed derivations) and additional
 comments (tags) are now strictly separate.  Name hints -- which are
 maintained as tags -- may be attached any time without affecting the
 derivation.
 
 * Pure: primitive rule lift_rule now takes goal cterm instead of an
 actual goal state (thm).  Use Thm.lift_rule (Thm.cprem_of st i) to
 achieve the old behaviour.
 
 * Pure: the "Goal" constant is now called "prop", supporting a
 slightly more general idea of ``protecting'' meta-level rule
 statements.
 
 * Pure: Logic.(un)varify only works in a global context, which is now
 enforced instead of silently assumed.  INCOMPATIBILITY, may use
 Logic.legacy_(un)varify as temporary workaround.
 
 * Pure: structure Name provides scalable operations for generating
 internal variable names, notably Name.variants etc.  This replaces
 some popular functions from term.ML:
 
   Term.variant		->  Name.variant
   Term.variantlist	->  Name.variant_list
   Term.invent_names	->  Name.invent_list
 
 Note that low-level renaming rarely occurs in new code -- operations
 from structure Variable are used instead (see below).
 
 * Pure: structure Variable provides fundamental operations for proper
 treatment of fixed/schematic variables in a context.  For example,
 Variable.import introduces fixes for schematics of given facts and
 Variable.export reverses the effect (up to renaming) -- this replaces
 various freeze_thaw operations.
 
 * Pure: structure Goal provides simple interfaces for
 init/conclude/finish and tactical prove operations (replacing former
 Tactic.prove).  Goal.prove is the canonical way to prove results
 within a given context; Goal.prove_global is a degraded version for
 theory level goals, including a global Drule.standard.  Note that
 OldGoals.prove_goalw_cterm has long been obsolete, since it is
 ill-behaved in a local proof context (e.g. with local fixes/assumes or
 in a locale context).
 
 * Pure/Syntax: generic interfaces for parsing (Syntax.parse_term etc.)
 and type checking (Syntax.check_term etc.), with common combinations
 (Syntax.read_term etc.). These supersede former Sign.read_term etc.
 which are considered legacy and await removal.
 
 * Pure/Syntax: generic interfaces for type unchecking
 (Syntax.uncheck_terms etc.) and unparsing (Syntax.unparse_term etc.),
 with common combinations (Syntax.pretty_term, Syntax.string_of_term
 etc.).  Former Sign.pretty_term, Sign.string_of_term etc. are still
 available for convenience, but refer to the very same operations using
 a mere theory instead of a full context.
 
 * Isar: simplified treatment of user-level errors, using exception
 ERROR of string uniformly.  Function error now merely raises ERROR,
 without any side effect on output channels.  The Isar toplevel takes
 care of proper display of ERROR exceptions.  ML code may use plain
 handle/can/try; cat_error may be used to concatenate errors like this:
 
   ... handle ERROR msg => cat_error msg "..."
 
 Toplevel ML code (run directly or through the Isar toplevel) may be
 embedded into the Isar toplevel with exception display/debug like
 this:
 
   Isar.toplevel (fn () => ...)
 
 INCOMPATIBILITY, removed special transform_error facilities, removed
 obsolete variants of user-level exceptions (ERROR_MESSAGE,
 Context.PROOF, ProofContext.CONTEXT, Proof.STATE, ProofHistory.FAIL)
 -- use plain ERROR instead.
 
 * Isar: theory setup now has type (theory -> theory), instead of a
 list.  INCOMPATIBILITY, may use #> to compose setup functions.
 
 * Isar: ML toplevel pretty printer for type Proof.context, subject to
 ProofContext.debug/verbose flags.
 
 * Isar: Toplevel.theory_to_proof admits transactions that modify the
 theory before entering a proof state.  Transactions now always see a
 quasi-functional intermediate checkpoint, both in interactive and
 batch mode.
 
 * Isar: simplified interfaces for outer syntax.  Renamed
 OuterSyntax.add_keywords to OuterSyntax.keywords.  Removed
 OuterSyntax.add_parsers -- this functionality is now included in
 OuterSyntax.command etc.  INCOMPATIBILITY.
 
 * Simplifier: the simpset of a running simplification process now
 contains a proof context (cf. Simplifier.the_context), which is the
 very context that the initial simpset has been retrieved from (by
 simpset_of/local_simpset_of).  Consequently, all plug-in components
 (solver, looper etc.) may depend on arbitrary proof data.
 
 * Simplifier.inherit_context inherits the proof context (plus the
 local bounds) of the current simplification process; any simproc
 etc. that calls the Simplifier recursively should do this!  Removed
 former Simplifier.inherit_bounds, which is already included here --
 INCOMPATIBILITY.  Tools based on low-level rewriting may even have to
 specify an explicit context using Simplifier.context/theory_context.
 
 * Simplifier/Classical Reasoner: more abstract interfaces
 change_simpset/claset for modifying the simpset/claset reference of a
 theory; raw versions simpset/claset_ref etc. have been discontinued --
 INCOMPATIBILITY.
 
 * Provers: more generic wrt. syntax of object-logics, avoid hardwired
 "Trueprop" etc.
 
 
 *** System ***
 
 * settings: the default heap location within ISABELLE_HOME_USER now
 includes ISABELLE_IDENTIFIER.  This simplifies use of multiple
 Isabelle installations.
 
 * isabelle-process: option -S (secure mode) disables some critical
 operations, notably runtime compilation and evaluation of ML source
 code.
 
 * Basic Isabelle mode for jEdit, see Isabelle/lib/jedit/.
 
 * Support for parallel execution, using native multicore support of
 Poly/ML 5.1.  The theory loader exploits parallelism when processing
 independent theories, according to the given theory header
 specifications. The maximum number of worker threads is specified via
 usedir option -M or the "max-threads" setting in Proof General. A
 speedup factor of 1.5--3.5 can be expected on a 4-core machine, and up
 to 6 on a 8-core machine.  User-code needs to observe certain
 guidelines for thread-safe programming, see appendix A in the Isar
 Implementation manual.
 
 
 
 New in Isabelle2005 (October 2005)
 ----------------------------------
 
 *** General ***
 
 * Theory headers: the new header syntax for Isar theories is
 
   theory <name>
   imports <theory1> ... <theoryN>
   uses <file1> ... <fileM>
   begin
 
 where the 'uses' part is optional.  The previous syntax
 
   theory <name> = <theory1> + ... + <theoryN>:
 
 will disappear in the next release.  Use isatool fixheaders to convert
 existing theory files.  Note that there is no change in ancient
 non-Isar theories now, but these will disappear soon.
 
 * Theory loader: parent theories can now also be referred to via
 relative and absolute paths.
 
 * Command 'find_theorems' searches for a list of criteria instead of a
 list of constants. Known criteria are: intro, elim, dest, name:string,
 simp:term, and any term. Criteria can be preceded by '-' to select
 theorems that do not match. Intro, elim, dest select theorems that
 match the current goal, name:s selects theorems whose fully qualified
 name contain s, and simp:term selects all simplification rules whose
 lhs match term.  Any other term is interpreted as pattern and selects
 all theorems matching the pattern. Available in ProofGeneral under
 'ProofGeneral -> Find Theorems' or C-c C-f.  Example:
 
   C-c C-f (100) "(_::nat) + _ + _" intro -name: "HOL."
 
 prints the last 100 theorems matching the pattern "(_::nat) + _ + _",
 matching the current goal as introduction rule and not having "HOL."
 in their name (i.e. not being defined in theory HOL).
 
 * Command 'thms_containing' has been discontinued in favour of
 'find_theorems'; INCOMPATIBILITY.
 
 * Communication with Proof General is now 8bit clean, which means that
 Unicode text in UTF-8 encoding may be used within theory texts (both
 formal and informal parts).  Cf. option -U of the Isabelle Proof
 General interface.  Here are some simple examples (cf. src/HOL/ex):
 
   http://isabelle.in.tum.de/library/HOL/ex/Hebrew.html
   http://isabelle.in.tum.de/library/HOL/ex/Chinese.html
 
 * Improved efficiency of the Simplifier and, to a lesser degree, the
 Classical Reasoner.  Typical big applications run around 2 times
 faster.
 
 
 *** Document preparation ***
 
 * Commands 'display_drafts' and 'print_drafts' perform simple output
 of raw sources.  Only those symbols that do not require additional
 LaTeX packages (depending on comments in isabellesym.sty) are
 displayed properly, everything else is left verbatim.  isatool display
 and isatool print are used as front ends (these are subject to the
 DVI/PDF_VIEWER and PRINT_COMMAND settings, respectively).
 
 * Command tags control specific markup of certain regions of text,
 notably folding and hiding.  Predefined tags include "theory" (for
 theory begin and end), "proof" for proof commands, and "ML" for
 commands involving ML code; the additional tags "visible" and
 "invisible" are unused by default.  Users may give explicit tag
 specifications in the text, e.g. ''by %invisible (auto)''.  The
 interpretation of tags is determined by the LaTeX job during document
 preparation: see option -V of isatool usedir, or options -n and -t of
 isatool document, or even the LaTeX macros \isakeeptag, \isafoldtag,
 \isadroptag.
 
 Several document versions may be produced at the same time via isatool
 usedir (the generated index.html will link all of them).  Typical
 specifications include ''-V document=theory,proof,ML'' to present
 theory/proof/ML parts faithfully, ''-V outline=/proof,/ML'' to fold
 proof and ML commands, and ''-V mutilated=-theory,-proof,-ML'' to omit
 these parts without any formal replacement text.  The Isabelle site
 default settings produce ''document'' and ''outline'' versions as
 specified above.
 
 * Several new antiquotations:
 
   @{term_type term} prints a term with its type annotated;
 
   @{typeof term} prints the type of a term;
 
   @{const const} is the same as @{term const}, but checks that the
   argument is a known logical constant;
 
   @{term_style style term} and @{thm_style style thm} print a term or
   theorem applying a "style" to it
 
   @{ML text}
 
 Predefined styles are 'lhs' and 'rhs' printing the lhs/rhs of
 definitions, equations, inequations etc., 'concl' printing only the
 conclusion of a meta-logical statement theorem, and 'prem1' .. 'prem19'
 to print the specified premise.  TermStyle.add_style provides an ML
 interface for introducing further styles.  See also the "LaTeX Sugar"
 document practical applications.  The ML antiquotation prints
 type-checked ML expressions verbatim.
 
 * Markup commands 'chapter', 'section', 'subsection', 'subsubsection',
 and 'text' support optional locale specification '(in loc)', which
 specifies the default context for interpreting antiquotations.  For
 example: 'text (in lattice) {* @{thm inf_assoc}*}'.
 
 * Option 'locale=NAME' of antiquotations specifies an alternative
 context interpreting the subsequent argument.  For example: @{thm
 [locale=lattice] inf_assoc}.
 
 * Proper output of proof terms (@{prf ...} and @{full_prf ...}) within
 a proof context.
 
 * Proper output of antiquotations for theory commands involving a
 proof context (such as 'locale' or 'theorem (in loc) ...').
 
 * Delimiters of outer tokens (string etc.) now produce separate LaTeX
 macros (\isachardoublequoteopen, isachardoublequoteclose etc.).
 
 * isatool usedir: new option -C (default true) controls whether option
 -D should include a copy of the original document directory; -C false
 prevents unwanted effects such as copying of administrative CVS data.
 
 
 *** Pure ***
 
 * Considerably improved version of 'constdefs' command.  Now performs
 automatic type-inference of declared constants; additional support for
 local structure declarations (cf. locales and HOL records), see also
 isar-ref manual.  Potential INCOMPATIBILITY: need to observe strictly
 sequential dependencies of definitions within a single 'constdefs'
 section; moreover, the declared name needs to be an identifier.  If
 all fails, consider to fall back on 'consts' and 'defs' separately.
 
 * Improved indexed syntax and implicit structures.  First of all,
 indexed syntax provides a notational device for subscripted
 application, using the new syntax \<^bsub>term\<^esub> for arbitrary
 expressions.  Secondly, in a local context with structure
 declarations, number indexes \<^sub>n or the empty index (default
 number 1) refer to a certain fixed variable implicitly; option
 show_structs controls printing of implicit structures.  Typical
 applications of these concepts involve record types and locales.
 
 * New command 'no_syntax' removes grammar declarations (and
 translations) resulting from the given syntax specification, which is
 interpreted in the same manner as for the 'syntax' command.
 
 * 'Advanced' translation functions (parse_translation etc.) may depend
 on the signature of the theory context being presently used for
 parsing/printing, see also isar-ref manual.
 
 * Improved 'oracle' command provides a type-safe interface to turn an
 ML expression of type theory -> T -> term into a primitive rule of
 type theory -> T -> thm (i.e. the functionality of Thm.invoke_oracle
 is already included here); see also FOL/ex/IffExample.thy;
 INCOMPATIBILITY.
 
 * axclass: name space prefix for class "c" is now "c_class" (was "c"
 before); "cI" is no longer bound, use "c.intro" instead.
 INCOMPATIBILITY.  This change avoids clashes of fact bindings for
 axclasses vs. locales.
 
 * Improved internal renaming of symbolic identifiers -- attach primes
 instead of base 26 numbers.
 
 * New flag show_question_marks controls printing of leading question
 marks in schematic variable names.
 
 * In schematic variable names, *any* symbol following \<^isub> or
 \<^isup> is now treated as part of the base name.  For example, the
 following works without printing of awkward ".0" indexes:
 
   lemma "x\<^isub>1 = x\<^isub>2 ==> x\<^isub>2 = x\<^isub>1"
     by simp
 
 * Inner syntax includes (*(*nested*) comments*).
 
 * Pretty printer now supports unbreakable blocks, specified in mixfix
 annotations as "(00...)".
 
 * Clear separation of logical types and nonterminals, where the latter
 may only occur in 'syntax' specifications or type abbreviations.
 Before that distinction was only partially implemented via type class
 "logic" vs. "{}".  Potential INCOMPATIBILITY in rare cases of improper
 use of 'types'/'consts' instead of 'nonterminals'/'syntax'.  Some very
 exotic syntax specifications may require further adaption
 (e.g. Cube/Cube.thy).
 
 * Removed obsolete type class "logic", use the top sort {} instead.
 Note that non-logical types should be declared as 'nonterminals'
 rather than 'types'.  INCOMPATIBILITY for new object-logic
 specifications.
 
 * Attributes 'induct' and 'cases': type or set names may now be
 locally fixed variables as well.
 
 * Simplifier: can now control the depth to which conditional rewriting
 is traced via the PG menu Isabelle -> Settings -> Trace Simp Depth
 Limit.
 
 * Simplifier: simplification procedures may now take the current
 simpset into account (cf. Simplifier.simproc(_i) / mk_simproc
 interface), which is very useful for calling the Simplifier
 recursively.  Minor INCOMPATIBILITY: the 'prems' argument of simprocs
 is gone -- use prems_of_ss on the simpset instead.  Moreover, the
 low-level mk_simproc no longer applies Logic.varify internally, to
 allow for use in a context of fixed variables.
 
 * thin_tac now works even if the assumption being deleted contains !!
 or ==>.  More generally, erule now works even if the major premise of
 the elimination rule contains !! or ==>.
 
 * Method 'rules' has been renamed to 'iprover'. INCOMPATIBILITY.
 
 * Reorganized bootstrapping of the Pure theories; CPure is now derived
 from Pure, which contains all common declarations already.  Both
 theories are defined via plain Isabelle/Isar .thy files.
 INCOMPATIBILITY: elements of CPure (such as the CPure.intro /
 CPure.elim / CPure.dest attributes) now appear in the Pure name space;
 use isatool fixcpure to adapt your theory and ML sources.
 
 * New syntax 'name(i-j, i-, i, ...)' for referring to specific
 selections of theorems in named facts via index ranges.
 
 * 'print_theorems': in theory mode, really print the difference
 wrt. the last state (works for interactive theory development only),
 in proof mode print all local facts (cf. 'print_facts');
 
 * 'hide': option '(open)' hides only base names.
 
 * More efficient treatment of intermediate checkpoints in interactive
 theory development.
 
 * Code generator is now invoked via code_module (incremental code
 generation) and code_library (modular code generation, ML structures
 for each theory).  INCOMPATIBILITY: new keywords 'file' and 'contains'
 must be quoted when used as identifiers.
 
 * New 'value' command for reading, evaluating and printing terms using
 the code generator.  INCOMPATIBILITY: command keyword 'value' must be
 quoted when used as identifier.
 
 
 *** Locales ***
 
 * New commands for the interpretation of locale expressions in
 theories (1), locales (2) and proof contexts (3).  These generate
 proof obligations from the expression specification.  After the
 obligations have been discharged, theorems of the expression are added
 to the theory, target locale or proof context.  The synopsis of the
 commands is a follows:
 
   (1) interpretation expr inst
   (2) interpretation target < expr
   (3) interpret expr inst
 
 Interpretation in theories and proof contexts require a parameter
 instantiation of terms from the current context.  This is applied to
 specifications and theorems of the interpreted expression.
 Interpretation in locales only permits parameter renaming through the
 locale expression.  Interpretation is smart in that interpretations
 that are active already do not occur in proof obligations, neither are
 instantiated theorems stored in duplicate.  Use 'print_interps' to
 inspect active interpretations of a particular locale.  For details,
 see the Isar Reference manual.  Examples can be found in
 HOL/Finite_Set.thy and HOL/Algebra/UnivPoly.thy.
 
 INCOMPATIBILITY: former 'instantiate' has been withdrawn, use
 'interpret' instead.
 
 * New context element 'constrains' for adding type constraints to
 parameters.
 
 * Context expressions: renaming of parameters with syntax
 redeclaration.
 
 * Locale declaration: 'includes' disallowed.
 
 * Proper static binding of attribute syntax -- i.e. types / terms /
 facts mentioned as arguments are always those of the locale definition
 context, independently of the context of later invocations.  Moreover,
 locale operations (renaming and type / term instantiation) are applied
 to attribute arguments as expected.
 
 INCOMPATIBILITY of the ML interface: always pass Attrib.src instead of
 actual attributes; rare situations may require Attrib.attribute to
 embed those attributes into Attrib.src that lack concrete syntax.
 Attribute implementations need to cooperate properly with the static
 binding mechanism.  Basic parsers Args.XXX_typ/term/prop and
 Attrib.XXX_thm etc. already do the right thing without further
 intervention.  Only unusual applications -- such as "where" or "of"
 (cf. src/Pure/Isar/attrib.ML), which process arguments depending both
 on the context and the facts involved -- may have to assign parsed
 values to argument tokens explicitly.
 
 * Changed parameter management in theorem generation for long goal
 statements with 'includes'.  INCOMPATIBILITY: produces a different
 theorem statement in rare situations.
 
 * Locale inspection command 'print_locale' omits notes elements.  Use
 'print_locale!' to have them included in the output.
 
 
 *** Provers ***
 
 * Provers/hypsubst.ML: improved version of the subst method, for
 single-step rewriting: it now works in bound variable contexts. New is
 'subst (asm)', for rewriting an assumption.  INCOMPATIBILITY: may
 rewrite a different subterm than the original subst method, which is
 still available as 'simplesubst'.
 
 * Provers/quasi.ML: new transitivity reasoners for transitivity only
 and quasi orders.
 
 * Provers/trancl.ML: new transitivity reasoner for transitive and
 reflexive-transitive closure of relations.
 
 * Provers/blast.ML: new reference depth_limit to make blast's depth
 limit (previously hard-coded with a value of 20) user-definable.
 
 * Provers/simplifier.ML has been moved to Pure, where Simplifier.setup
 is peformed already.  Object-logics merely need to finish their
 initial simpset configuration as before.  INCOMPATIBILITY.
 
 
 *** HOL ***
 
 * Symbolic syntax of Hilbert Choice Operator is now as follows:
 
   syntax (epsilon)
     "_Eps" :: "[pttrn, bool] => 'a"    ("(3\<some>_./ _)" [0, 10] 10)
 
 The symbol \<some> is displayed as the alternative epsilon of LaTeX
 and x-symbol; use option '-m epsilon' to get it actually printed.
 Moreover, the mathematically important symbolic identifier \<epsilon>
 becomes available as variable, constant etc.  INCOMPATIBILITY,
 
 * "x > y" abbreviates "y < x" and "x >= y" abbreviates "y <= x".
 Similarly for all quantifiers: "ALL x > y" etc.  The x-symbol for >=
 is \<ge>. New transitivity rules have been added to HOL/Orderings.thy to
 support corresponding Isar calculations.
 
 * "{x:A. P}" abbreviates "{x. x:A & P}", and similarly for "\<in>"
 instead of ":".
 
 * theory SetInterval: changed the syntax for open intervals:
 
   Old       New
   {..n(}    {..<n}
   {)n..}    {n<..}
   {m..n(}   {m..<n}
   {)m..n}   {m<..n}
   {)m..n(}  {m<..<n}
 
 The old syntax is still supported but will disappear in the next
 release.  For conversion use the following Emacs search and replace
 patterns (these are not perfect but work quite well):
 
   {)\([^\.]*\)\.\.  ->  {\1<\.\.}
   \.\.\([^(}]*\)(}  ->  \.\.<\1}
 
 * Theory Commutative_Ring (in Library): method comm_ring for proving
 equalities in commutative rings; method 'algebra' provides a generic
 interface.
 
 * Theory Finite_Set: changed the syntax for 'setsum', summation over
 finite sets: "setsum (%x. e) A", which used to be "\<Sum>x:A. e", is
 now either "SUM x:A. e" or "\<Sum>x \<in> A. e". The bound variable can
 be a tuple pattern.
 
 Some new syntax forms are available:
 
   "\<Sum>x | P. e"      for     "setsum (%x. e) {x. P}"
   "\<Sum>x = a..b. e"   for     "setsum (%x. e) {a..b}"
   "\<Sum>x = a..<b. e"  for     "setsum (%x. e) {a..<b}"
   "\<Sum>x < k. e"      for     "setsum (%x. e) {..<k}"
 
 The latter form "\<Sum>x < k. e" used to be based on a separate
 function "Summation", which has been discontinued.
 
 * theory Finite_Set: in structured induction proofs, the insert case
 is now 'case (insert x F)' instead of the old counterintuitive 'case
 (insert F x)'.
 
 * The 'refute' command has been extended to support a much larger
 fragment of HOL, including axiomatic type classes, constdefs and
 typedefs, inductive datatypes and recursion.
 
 * New tactics 'sat' and 'satx' to prove propositional tautologies.
 Requires zChaff with proof generation to be installed.  See
 HOL/ex/SAT_Examples.thy for examples.
 
 * Datatype induction via method 'induct' now preserves the name of the
 induction variable. For example, when proving P(xs::'a list) by
 induction on xs, the induction step is now P(xs) ==> P(a#xs) rather
 than P(list) ==> P(a#list) as previously.  Potential INCOMPATIBILITY
 in unstructured proof scripts.
 
 * Reworked implementation of records.  Improved scalability for
 records with many fields, avoiding performance problems for type
 inference. Records are no longer composed of nested field types, but
 of nested extension types. Therefore the record type only grows linear
 in the number of extensions and not in the number of fields.  The
 top-level (users) view on records is preserved.  Potential
 INCOMPATIBILITY only in strange cases, where the theory depends on the
 old record representation. The type generated for a record is called
 <record_name>_ext_type.
 
 Flag record_quick_and_dirty_sensitive can be enabled to skip the
 proofs triggered by a record definition or a simproc (if
 quick_and_dirty is enabled).  Definitions of large records can take
 quite long.
 
 New simproc record_upd_simproc for simplification of multiple record
 updates enabled by default.  Moreover, trivial updates are also
 removed: r(|x := x r|) = r.  INCOMPATIBILITY: old proofs break
 occasionally, since simplification is more powerful by default.
 
 * typedef: proper support for polymorphic sets, which contain extra
 type-variables in the term.
 
 * Simplifier: automatically reasons about transitivity chains
 involving "trancl" (r^+) and "rtrancl" (r^*) by setting up tactics
 provided by Provers/trancl.ML as additional solvers.  INCOMPATIBILITY:
 old proofs break occasionally as simplification may now solve more
 goals than previously.
 
 * Simplifier: converts x <= y into x = y if assumption y <= x is
 present.  Works for all partial orders (class "order"), in particular
 numbers and sets.  For linear orders (e.g. numbers) it treats ~ x < y
 just like y <= x.
 
 * Simplifier: new simproc for "let x = a in f x".  If a is a free or
 bound variable or a constant then the let is unfolded.  Otherwise
 first a is simplified to b, and then f b is simplified to g. If
 possible we abstract b from g arriving at "let x = b in h x",
 otherwise we unfold the let and arrive at g.  The simproc can be
 enabled/disabled by the reference use_let_simproc.  Potential
 INCOMPATIBILITY since simplification is more powerful by default.
 
 * Classical reasoning: the meson method now accepts theorems as arguments.
 
 * Prover support: pre-release of the Isabelle-ATP linkup, which runs background
 jobs to provide advice on the provability of subgoals.
 
 * Theory OrderedGroup and Ring_and_Field: various additions and
 improvements to faciliate calculations involving equalities and
 inequalities.
 
 The following theorems have been eliminated or modified
 (INCOMPATIBILITY):
 
   abs_eq             now named abs_of_nonneg
   abs_of_ge_0        now named abs_of_nonneg
   abs_minus_eq       now named abs_of_nonpos
   imp_abs_id         now named abs_of_nonneg
   imp_abs_neg_id     now named abs_of_nonpos
   mult_pos           now named mult_pos_pos
   mult_pos_le        now named mult_nonneg_nonneg
   mult_pos_neg_le    now named mult_nonneg_nonpos
   mult_pos_neg2_le   now named mult_nonneg_nonpos2
   mult_neg           now named mult_neg_neg
   mult_neg_le        now named mult_nonpos_nonpos
 
 * The following lemmas in Ring_and_Field have been added to the simplifier:
 
      zero_le_square
      not_square_less_zero
 
   The following lemmas have been deleted from Real/RealPow:
 
      realpow_zero_zero
      realpow_two
      realpow_less
      zero_le_power
      realpow_two_le
      abs_realpow_two
      realpow_two_abs
 
 * Theory Parity: added rules for simplifying exponents.
 
 * Theory List:
 
 The following theorems have been eliminated or modified
 (INCOMPATIBILITY):
 
   list_all_Nil       now named list_all.simps(1)
   list_all_Cons      now named list_all.simps(2)
   list_all_conv      now named list_all_iff
   set_mem_eq         now named mem_iff
 
 * Theories SetsAndFunctions and BigO (see HOL/Library) support
 asymptotic "big O" calculations.  See the notes in BigO.thy.
 
 
 *** HOL-Complex ***
 
 * Theory RealDef: better support for embedding natural numbers and
 integers in the reals.
 
 The following theorems have been eliminated or modified
 (INCOMPATIBILITY):
 
   exp_ge_add_one_self  now requires no hypotheses
   real_of_int_add      reversed direction of equality (use [symmetric])
   real_of_int_minus    reversed direction of equality (use [symmetric])
   real_of_int_diff     reversed direction of equality (use [symmetric])
   real_of_int_mult     reversed direction of equality (use [symmetric])
 
 * Theory RComplete: expanded support for floor and ceiling functions.
 
 * Theory Ln is new, with properties of the natural logarithm
 
 * Hyperreal: There is a new type constructor "star" for making
 nonstandard types.  The old type names are now type synonyms:
 
   hypreal = real star
   hypnat = nat star
   hcomplex = complex star
 
 * Hyperreal: Many groups of similarly-defined constants have been
 replaced by polymorphic versions (INCOMPATIBILITY):
 
   star_of <-- hypreal_of_real, hypnat_of_nat, hcomplex_of_complex
 
   starset      <-- starsetNat, starsetC
   *s*          <-- *sNat*, *sc*
   starset_n    <-- starsetNat_n, starsetC_n
   *sn*         <-- *sNatn*, *scn*
   InternalSets <-- InternalNatSets, InternalCSets
 
   starfun      <-- starfun{Nat,Nat2,C,RC,CR}
   *f*          <-- *fNat*, *fNat2*, *fc*, *fRc*, *fcR*
   starfun_n    <-- starfun{Nat,Nat2,C,RC,CR}_n
   *fn*         <-- *fNatn*, *fNat2n*, *fcn*, *fRcn*, *fcRn*
   InternalFuns <-- InternalNatFuns, InternalNatFuns2, Internal{C,RC,CR}Funs
 
 * Hyperreal: Many type-specific theorems have been removed in favor of
 theorems specific to various axiomatic type classes (INCOMPATIBILITY):
 
   add_commute <-- {hypreal,hypnat,hcomplex}_add_commute
   add_assoc   <-- {hypreal,hypnat,hcomplex}_add_assocs
   OrderedGroup.add_0 <-- {hypreal,hypnat,hcomplex}_add_zero_left
   OrderedGroup.add_0_right <-- {hypreal,hcomplex}_add_zero_right
   right_minus <-- hypreal_add_minus
   left_minus <-- {hypreal,hcomplex}_add_minus_left
   mult_commute <-- {hypreal,hypnat,hcomplex}_mult_commute
   mult_assoc <-- {hypreal,hypnat,hcomplex}_mult_assoc
   mult_1_left <-- {hypreal,hypnat}_mult_1, hcomplex_mult_one_left
   mult_1_right <-- hcomplex_mult_one_right
   mult_zero_left <-- hcomplex_mult_zero_left
   left_distrib <-- {hypreal,hypnat,hcomplex}_add_mult_distrib
   right_distrib <-- hypnat_add_mult_distrib2
   zero_neq_one <-- {hypreal,hypnat,hcomplex}_zero_not_eq_one
   right_inverse <-- hypreal_mult_inverse
   left_inverse <-- hypreal_mult_inverse_left, hcomplex_mult_inv_left
   order_refl <-- {hypreal,hypnat}_le_refl
   order_trans <-- {hypreal,hypnat}_le_trans
   order_antisym <-- {hypreal,hypnat}_le_anti_sym
   order_less_le <-- {hypreal,hypnat}_less_le
   linorder_linear <-- {hypreal,hypnat}_le_linear
   add_left_mono <-- {hypreal,hypnat}_add_left_mono
   mult_strict_left_mono <-- {hypreal,hypnat}_mult_less_mono2
   add_nonneg_nonneg <-- hypreal_le_add_order
 
 * Hyperreal: Separate theorems having to do with type-specific
 versions of constants have been merged into theorems that apply to the
 new polymorphic constants (INCOMPATIBILITY):
 
   STAR_UNIV_set <-- {STAR_real,NatStar_real,STARC_complex}_set
   STAR_empty_set <-- {STAR,NatStar,STARC}_empty_set
   STAR_Un <-- {STAR,NatStar,STARC}_Un
   STAR_Int <-- {STAR,NatStar,STARC}_Int
   STAR_Compl <-- {STAR,NatStar,STARC}_Compl
   STAR_subset <-- {STAR,NatStar,STARC}_subset
   STAR_mem <-- {STAR,NatStar,STARC}_mem
   STAR_mem_Compl <-- {STAR,STARC}_mem_Compl
   STAR_diff <-- {STAR,STARC}_diff
   STAR_star_of_image_subset <-- {STAR_hypreal_of_real, NatStar_hypreal_of_real,
     STARC_hcomplex_of_complex}_image_subset
   starset_n_Un <-- starset{Nat,C}_n_Un
   starset_n_Int <-- starset{Nat,C}_n_Int
   starset_n_Compl <-- starset{Nat,C}_n_Compl
   starset_n_diff <-- starset{Nat,C}_n_diff
   InternalSets_Un <-- Internal{Nat,C}Sets_Un
   InternalSets_Int <-- Internal{Nat,C}Sets_Int
   InternalSets_Compl <-- Internal{Nat,C}Sets_Compl
   InternalSets_diff <-- Internal{Nat,C}Sets_diff
   InternalSets_UNIV_diff <-- Internal{Nat,C}Sets_UNIV_diff
   InternalSets_starset_n <-- Internal{Nat,C}Sets_starset{Nat,C}_n
   starset_starset_n_eq <-- starset{Nat,C}_starset{Nat,C}_n_eq
   starset_n_starset <-- starset{Nat,C}_n_starset{Nat,C}
   starfun_n_starfun <-- starfun{Nat,Nat2,C,RC,CR}_n_starfun{Nat,Nat2,C,RC,CR}
   starfun <-- starfun{Nat,Nat2,C,RC,CR}
   starfun_mult <-- starfun{Nat,Nat2,C,RC,CR}_mult
   starfun_add <-- starfun{Nat,Nat2,C,RC,CR}_add
   starfun_minus <-- starfun{Nat,Nat2,C,RC,CR}_minus
   starfun_diff <-- starfun{C,RC,CR}_diff
   starfun_o <-- starfun{NatNat2,Nat2,_stafunNat,C,C_starfunRC,_starfunCR}_o
   starfun_o2 <-- starfun{NatNat2,_stafunNat,C,C_starfunRC,_starfunCR}_o2
   starfun_const_fun <-- starfun{Nat,Nat2,C,RC,CR}_const_fun
   starfun_inverse <-- starfun{Nat,C,RC,CR}_inverse
   starfun_eq <-- starfun{Nat,Nat2,C,RC,CR}_eq
   starfun_eq_iff <-- starfun{C,RC,CR}_eq_iff
   starfun_Id <-- starfunC_Id
   starfun_approx <-- starfun{Nat,CR}_approx
   starfun_capprox <-- starfun{C,RC}_capprox
   starfun_abs <-- starfunNat_rabs
   starfun_lambda_cancel <-- starfun{C,CR,RC}_lambda_cancel
   starfun_lambda_cancel2 <-- starfun{C,CR,RC}_lambda_cancel2
   starfun_mult_HFinite_approx <-- starfunCR_mult_HFinite_capprox
   starfun_mult_CFinite_capprox <-- starfun{C,RC}_mult_CFinite_capprox
   starfun_add_capprox <-- starfun{C,RC}_add_capprox
   starfun_add_approx <-- starfunCR_add_approx
   starfun_inverse_inverse <-- starfunC_inverse_inverse
   starfun_divide <-- starfun{C,CR,RC}_divide
   starfun_n <-- starfun{Nat,C}_n
   starfun_n_mult <-- starfun{Nat,C}_n_mult
   starfun_n_add <-- starfun{Nat,C}_n_add
   starfun_n_add_minus <-- starfunNat_n_add_minus
   starfun_n_const_fun <-- starfun{Nat,C}_n_const_fun
   starfun_n_minus <-- starfun{Nat,C}_n_minus
   starfun_n_eq <-- starfun{Nat,C}_n_eq
 
   star_n_add <-- {hypreal,hypnat,hcomplex}_add
   star_n_minus <-- {hypreal,hcomplex}_minus
   star_n_diff <-- {hypreal,hcomplex}_diff
   star_n_mult <-- {hypreal,hcomplex}_mult
   star_n_inverse <-- {hypreal,hcomplex}_inverse
   star_n_le <-- {hypreal,hypnat}_le
   star_n_less <-- {hypreal,hypnat}_less
   star_n_zero_num <-- {hypreal,hypnat,hcomplex}_zero_num
   star_n_one_num <-- {hypreal,hypnat,hcomplex}_one_num
   star_n_abs <-- hypreal_hrabs
   star_n_divide <-- hcomplex_divide
 
   star_of_add <-- {hypreal_of_real,hypnat_of_nat,hcomplex_of_complex}_add
   star_of_minus <-- {hypreal_of_real,hcomplex_of_complex}_minus
   star_of_diff <-- hypreal_of_real_diff
   star_of_mult <-- {hypreal_of_real,hypnat_of_nat,hcomplex_of_complex}_mult
   star_of_one <-- {hypreal_of_real,hcomplex_of_complex}_one
   star_of_zero <-- {hypreal_of_real,hypnat_of_nat,hcomplex_of_complex}_zero
   star_of_le <-- {hypreal_of_real,hypnat_of_nat}_le_iff
   star_of_less <-- {hypreal_of_real,hypnat_of_nat}_less_iff
   star_of_eq <-- {hypreal_of_real,hypnat_of_nat,hcomplex_of_complex}_eq_iff
   star_of_inverse <-- {hypreal_of_real,hcomplex_of_complex}_inverse
   star_of_divide <-- {hypreal_of_real,hcomplex_of_complex}_divide
   star_of_of_nat <-- {hypreal_of_real,hcomplex_of_complex}_of_nat
   star_of_of_int <-- {hypreal_of_real,hcomplex_of_complex}_of_int
   star_of_number_of <-- {hypreal,hcomplex}_number_of
   star_of_number_less <-- number_of_less_hypreal_of_real_iff
   star_of_number_le <-- number_of_le_hypreal_of_real_iff
   star_of_eq_number <-- hypreal_of_real_eq_number_of_iff
   star_of_less_number <-- hypreal_of_real_less_number_of_iff
   star_of_le_number <-- hypreal_of_real_le_number_of_iff
   star_of_power <-- hypreal_of_real_power
   star_of_eq_0 <-- hcomplex_of_complex_zero_iff
 
 * Hyperreal: new method "transfer" that implements the transfer
 principle of nonstandard analysis. With a subgoal that mentions
 nonstandard types like "'a star", the command "apply transfer"
 replaces it with an equivalent one that mentions only standard types.
 To be successful, all free variables must have standard types; non-
 standard variables must have explicit universal quantifiers.
 
 * Hyperreal: A theory of Taylor series.
 
 
 *** HOLCF ***
 
 * Discontinued special version of 'constdefs' (which used to support
 continuous functions) in favor of the general Pure one with full
 type-inference.
 
 * New simplification procedure for solving continuity conditions; it
 is much faster on terms with many nested lambda abstractions (cubic
 instead of exponential time).
 
 * New syntax for domain package: selector names are now optional.
 Parentheses should be omitted unless argument is lazy, for example:
 
   domain 'a stream = cons "'a" (lazy "'a stream")
 
 * New command 'fixrec' for defining recursive functions with pattern
 matching; defining multiple functions with mutual recursion is also
 supported.  Patterns may include the constants cpair, spair, up, sinl,
 sinr, or any data constructor defined by the domain package. The given
 equations are proven as rewrite rules. See HOLCF/ex/Fixrec_ex.thy for
 syntax and examples.
 
 * New commands 'cpodef' and 'pcpodef' for defining predicate subtypes
 of cpo and pcpo types. Syntax is exactly like the 'typedef' command,
 but the proof obligation additionally includes an admissibility
 requirement. The packages generate instances of class cpo or pcpo,
 with continuity and strictness theorems for Rep and Abs.
 
 * HOLCF: Many theorems have been renamed according to a more standard naming
 scheme (INCOMPATIBILITY):
 
   foo_inject:  "foo$x = foo$y ==> x = y"
   foo_eq:      "(foo$x = foo$y) = (x = y)"
   foo_less:    "(foo$x << foo$y) = (x << y)"
   foo_strict:  "foo$UU = UU"
   foo_defined: "... ==> foo$x ~= UU"
   foo_defined_iff: "(foo$x = UU) = (x = UU)"
 
 
 *** ZF ***
 
 * ZF/ex: theories Group and Ring provide examples in abstract algebra,
 including the First Isomorphism Theorem (on quotienting by the kernel
 of a homomorphism).
 
 * ZF/Simplifier: install second copy of type solver that actually
 makes use of TC rules declared to Isar proof contexts (or locales);
 the old version is still required for ML proof scripts.
 
 
 *** Cube ***
 
 * Converted to Isar theory format; use locales instead of axiomatic
 theories.
 
 
 *** ML ***
 
 * Pure/library.ML: added ##>, ##>>, #>> -- higher-order counterparts
 for ||>, ||>>, |>>,
 
 * Pure/library.ML no longer defines its own option datatype, but uses
 that of the SML basis, which has constructors NONE and SOME instead of
 None and Some, as well as exception Option.Option instead of OPTION.
 The functions the, if_none, is_some, is_none have been adapted
 accordingly, while Option.map replaces apsome.
 
 * Pure/library.ML: the exception LIST has been given up in favour of
 the standard exceptions Empty and Subscript, as well as
 Library.UnequalLengths.  Function like Library.hd and Library.tl are
 superceded by the standard hd and tl functions etc.
 
 A number of basic list functions are no longer exported to the ML
 toplevel, as they are variants of predefined functions.  The following
 suggests how one can translate existing code:
 
     rev_append xs ys = List.revAppend (xs, ys)
     nth_elem (i, xs) = List.nth (xs, i)
     last_elem xs = List.last xs
     flat xss = List.concat xss
     seq fs = List.app fs
     partition P xs = List.partition P xs
     mapfilter f xs = List.mapPartial f xs
 
 * Pure/library.ML: several combinators for linear functional
 transformations, notably reverse application and composition:
 
   x |> f                f #> g
   (x, y) |-> f          f #-> g
 
 * Pure/library.ML: introduced/changed precedence of infix operators:
 
   infix 1 |> |-> ||> ||>> |>> |>>> #> #->;
   infix 2 ?;
   infix 3 o oo ooo oooo;
   infix 4 ~~ upto downto;
 
 Maybe INCOMPATIBILITY when any of those is used in conjunction with other
 infix operators.
 
 * Pure/library.ML: natural list combinators fold, fold_rev, and
 fold_map support linear functional transformations and nesting.  For
 example:
 
   fold f [x1, ..., xN] y =
     y |> f x1 |> ... |> f xN
 
   (fold o fold) f [xs1, ..., xsN] y =
     y |> fold f xs1 |> ... |> fold f xsN
 
   fold f [x1, ..., xN] =
     f x1 #> ... #> f xN
 
   (fold o fold) f [xs1, ..., xsN] =
     fold f xs1 #> ... #> fold f xsN
 
 * Pure/library.ML: the following selectors on type 'a option are
 available:
 
   the:               'a option -> 'a  (*partial*)
   these:             'a option -> 'a  where 'a = 'b list
   the_default: 'a -> 'a option -> 'a
   the_list:          'a option -> 'a list
 
 * Pure/General: structure AList (cf. Pure/General/alist.ML) provides
 basic operations for association lists, following natural argument
 order; moreover the explicit equality predicate passed here avoids
 potentially expensive polymorphic runtime equality checks.
 The old functions may be expressed as follows:
 
   assoc = uncurry (AList.lookup (op =))
   assocs = these oo AList.lookup (op =)
   overwrite = uncurry (AList.update (op =)) o swap
 
 * Pure/General: structure AList (cf. Pure/General/alist.ML) provides
 
   val make: ('a -> 'b) -> 'a list -> ('a * 'b) list
   val find: ('a * 'b -> bool) -> ('c * 'b) list -> 'a -> 'c list
 
 replacing make_keylist and keyfilter (occassionally used)
 Naive rewrites:
 
   make_keylist = AList.make
   keyfilter = AList.find (op =)
 
 * eq_fst and eq_snd now take explicit equality parameter, thus
   avoiding eqtypes. Naive rewrites:
 
     eq_fst = eq_fst (op =)
     eq_snd = eq_snd (op =)
 
 * Removed deprecated apl and apr (rarely used).
   Naive rewrites:
 
     apl (n, op) =>>= curry op n
     apr (op, m) =>>= fn n => op (n, m)
 
 * Pure/General: structure OrdList (cf. Pure/General/ord_list.ML)
 provides a reasonably efficient light-weight implementation of sets as
 lists.
 
 * Pure/General: generic tables (cf. Pure/General/table.ML) provide a
 few new operations; existing lookup and update are now curried to
 follow natural argument order (for use with fold etc.);
 INCOMPATIBILITY, use (uncurry Symtab.lookup) etc. as last resort.
 
 * Pure/General: output via the Isabelle channels of
 writeln/warning/error etc. is now passed through Output.output, with a
 hook for arbitrary transformations depending on the print_mode
 (cf. Output.add_mode -- the first active mode that provides a output
 function wins).  Already formatted output may be embedded into further
 text via Output.raw; the result of Pretty.string_of/str_of and derived
 functions (string_of_term/cterm/thm etc.) is already marked raw to
 accommodate easy composition of diagnostic messages etc.  Programmers
 rarely need to care about Output.output or Output.raw at all, with
 some notable exceptions: Output.output is required when bypassing the
 standard channels (writeln etc.), or in token translations to produce
 properly formatted results; Output.raw is required when capturing
 already output material that will eventually be presented to the user
 a second time.  For the default print mode, both Output.output and
 Output.raw have no effect.
 
 * Pure/General: Output.time_accumulator NAME creates an operator ('a
 -> 'b) -> 'a -> 'b to measure runtime and count invocations; the
 cumulative results are displayed at the end of a batch session.
 
 * Pure/General: File.sysify_path and File.quote_sysify path have been
 replaced by File.platform_path and File.shell_path (with appropriate
 hooks).  This provides a clean interface for unusual systems where the
 internal and external process view of file names are different.
 
 * Pure: more efficient orders for basic syntactic entities: added
 fast_string_ord, fast_indexname_ord, fast_term_ord; changed sort_ord
 and typ_ord to use fast_string_ord and fast_indexname_ord (term_ord is
 NOT affected); structures Symtab, Vartab, Typtab, Termtab use the fast
 orders now -- potential INCOMPATIBILITY for code that depends on a
 particular order for Symtab.keys, Symtab.dest, etc. (consider using
 Library.sort_strings on result).
 
 * Pure/term.ML: combinators fold_atyps, fold_aterms, fold_term_types,
 fold_types traverse types/terms from left to right, observing natural
 argument order.  Supercedes previous foldl_XXX versions, add_frees,
 add_vars etc. have been adapted as well: INCOMPATIBILITY.
 
 * Pure: name spaces have been refined, with significant changes of the
 internal interfaces -- INCOMPATIBILITY.  Renamed cond_extern(_table)
 to extern(_table).  The plain name entry path is superceded by a
 general 'naming' context, which also includes the 'policy' to produce
 a fully qualified name and external accesses of a fully qualified
 name; NameSpace.extend is superceded by context dependent
 Sign.declare_name.  Several theory and proof context operations modify
 the naming context.  Especially note Theory.restore_naming and
 ProofContext.restore_naming to get back to a sane state; note that
 Theory.add_path is no longer sufficient to recover from
 Theory.absolute_path in particular.
 
 * Pure: new flags short_names (default false) and unique_names
 (default true) for controlling output of qualified names.  If
 short_names is set, names are printed unqualified.  If unique_names is
 reset, the name prefix is reduced to the minimum required to achieve
 the original result when interning again, even if there is an overlap
 with earlier declarations.
 
 * Pure/TheoryDataFun: change of the argument structure; 'prep_ext' is
 now 'extend', and 'merge' gets an additional Pretty.pp argument
 (useful for printing error messages).  INCOMPATIBILITY.
 
 * Pure: major reorganization of the theory context.  Type Sign.sg and
 Theory.theory are now identified, referring to the universal
 Context.theory (see Pure/context.ML).  Actual signature and theory
 content is managed as theory data.  The old code and interfaces were
 spread over many files and structures; the new arrangement introduces
 considerable INCOMPATIBILITY to gain more clarity:
 
   Context -- theory management operations (name, identity, inclusion,
     parents, ancestors, merge, etc.), plus generic theory data;
 
   Sign -- logical signature and syntax operations (declaring consts,
     types, etc.), plus certify/read for common entities;
 
   Theory -- logical theory operations (stating axioms, definitions,
     oracles), plus a copy of logical signature operations (consts,
     types, etc.); also a few basic management operations (Theory.copy,
     Theory.merge, etc.)
 
 The most basic sign_of operations (Theory.sign_of, Thm.sign_of_thm
 etc.) as well as the sign field in Thm.rep_thm etc. have been retained
 for convenience -- they merely return the theory.
 
 * Pure: type Type.tsig is superceded by theory in most interfaces.
 
 * Pure: the Isar proof context type is already defined early in Pure
 as Context.proof (note that ProofContext.context and Proof.context are
 aliases, where the latter is the preferred name).  This enables other
 Isabelle components to refer to that type even before Isar is present.
 
 * Pure/sign/theory: discontinued named name spaces (i.e. classK,
 typeK, constK, axiomK, oracleK), but provide explicit operations for
 any of these kinds.  For example, Sign.intern typeK is now
 Sign.intern_type, Theory.hide_space Sign.typeK is now
 Theory.hide_types.  Also note that former
 Theory.hide_classes/types/consts are now
 Theory.hide_classes_i/types_i/consts_i, while the non '_i' versions
 internalize their arguments!  INCOMPATIBILITY.
 
 * Pure: get_thm interface (of PureThy and ProofContext) expects
 datatype thmref (with constructors Name and NameSelection) instead of
 plain string -- INCOMPATIBILITY;
 
 * Pure: cases produced by proof methods specify options, where NONE
 means to remove case bindings -- INCOMPATIBILITY in
 (RAW_)METHOD_CASES.
 
 * Pure: the following operations retrieve axioms or theorems from a
 theory node or theory hierarchy, respectively:
 
   Theory.axioms_of: theory -> (string * term) list
   Theory.all_axioms_of: theory -> (string * term) list
   PureThy.thms_of: theory -> (string * thm) list
   PureThy.all_thms_of: theory -> (string * thm) list
 
 * Pure: print_tac now outputs the goal through the trace channel.
 
 * Isar toplevel: improved diagnostics, mostly for Poly/ML only.
 Reference Toplevel.debug (default false) controls detailed printing
 and tracing of low-level exceptions; Toplevel.profiling (default 0)
 controls execution profiling -- set to 1 for time and 2 for space
 (both increase the runtime).
 
 * Isar session: The initial use of ROOT.ML is now always timed,
 i.e. the log will show the actual process times, in contrast to the
 elapsed wall-clock time that the outer shell wrapper produces.
 
 * Simplifier: improved handling of bound variables (nameless
 representation, avoid allocating new strings).  Simprocs that invoke
 the Simplifier recursively should use Simplifier.inherit_bounds to
 avoid local name clashes.  Failure to do so produces warnings
 "Simplifier: renamed bound variable ..."; set Simplifier.debug_bounds
 for further details.
 
 * ML functions legacy_bindings and use_legacy_bindings produce ML fact
 bindings for all theorems stored within a given theory; this may help
 in porting non-Isar theories to Isar ones, while keeping ML proof
 scripts for the time being.
 
 * ML operator HTML.with_charset specifies the charset begin used for
 generated HTML files.  For example:
 
   HTML.with_charset "utf-8" use_thy "Hebrew";
   HTML.with_charset "utf-8" use_thy "Chinese";
 
 
 *** System ***
 
 * Allow symlinks to all proper Isabelle executables (Isabelle,
 isabelle, isatool etc.).
 
 * ISABELLE_DOC_FORMAT setting specifies preferred document format (for
 isatool doc, isatool mkdir, display_drafts etc.).
 
 * isatool usedir: option -f allows specification of the ML file to be
 used by Isabelle; default is ROOT.ML.
 
 * New isatool version outputs the version identifier of the Isabelle
 distribution being used.
 
 * HOL: new isatool dimacs2hol converts files in DIMACS CNF format
 (containing Boolean satisfiability problems) into Isabelle/HOL
 theories.
 
 
 
 New in Isabelle2004 (April 2004)
 --------------------------------
 
 *** General ***
 
 * Provers/order.ML:  new efficient reasoner for partial and linear orders.
   Replaces linorder.ML.
 
 * Pure: Greek letters (except small lambda, \<lambda>), as well as Gothic
   (\<aa>...\<zz>\<AA>...\<ZZ>), calligraphic (\<A>...\<Z>), and Euler
   (\<a>...\<z>), are now considered normal letters, and can therefore
   be used anywhere where an ASCII letter (a...zA...Z) has until
   now. COMPATIBILITY: This obviously changes the parsing of some
   terms, especially where a symbol has been used as a binder, say
   '\<Pi>x. ...', which is now a type error since \<Pi>x will be parsed
   as an identifier.  Fix it by inserting a space around former
   symbols.  Call 'isatool fixgreek' to try to fix parsing errors in
   existing theory and ML files.
 
 * Pure: Macintosh and Windows line-breaks are now allowed in theory files.
 
 * Pure: single letter sub/superscripts (\<^isub> and \<^isup>) are now
   allowed in identifiers. Similar to Greek letters \<^isub> is now considered
   a normal (but invisible) letter. For multiple letter subscripts repeat
   \<^isub> like this: x\<^isub>1\<^isub>2.
 
 * Pure: There are now sub-/superscripts that can span more than one
   character. Text between \<^bsub> and \<^esub> is set in subscript in
   ProofGeneral and LaTeX, text between \<^bsup> and \<^esup> in
   superscript. The new control characters are not identifier parts.
 
 * Pure: Control-symbols of the form \<^raw:...> will literally print the
   content of "..." to the latex file instead of \isacntrl... . The "..."
   may consist of any printable characters excluding the end bracket >.
 
 * Pure: Using new Isar command "finalconsts" (or the ML functions
   Theory.add_finals or Theory.add_finals_i) it is now possible to
   declare constants "final", which prevents their being given a definition
   later.  It is useful for constants whose behaviour is fixed axiomatically
   rather than definitionally, such as the meta-logic connectives.
 
 * Pure: 'instance' now handles general arities with general sorts
   (i.e. intersections of classes),
 
 * Presentation: generated HTML now uses a CSS style sheet to make layout
   (somewhat) independent of content. It is copied from lib/html/isabelle.css.
   It can be changed to alter the colors/layout of generated pages.
 
 
 *** Isar ***
 
 * Tactic emulation methods rule_tac, erule_tac, drule_tac, frule_tac,
   cut_tac, subgoal_tac and thin_tac:
   - Now understand static (Isar) contexts.  As a consequence, users of Isar
     locales are no longer forced to write Isar proof scripts.
     For details see Isar Reference Manual, paragraph 4.3.2: Further tactic
     emulations.
   - INCOMPATIBILITY: names of variables to be instantiated may no
     longer be enclosed in quotes.  Instead, precede variable name with `?'.
     This is consistent with the instantiation attribute "where".
 
 * Attributes "where" and "of":
   - Now take type variables of instantiated theorem into account when reading
     the instantiation string.  This fixes a bug that caused instantiated
     theorems to have too special types in some circumstances.
   - "where" permits explicit instantiations of type variables.
 
 * Calculation commands "moreover" and "also" no longer interfere with
   current facts ("this"), admitting arbitrary combinations with "then"
   and derived forms.
 
 * Locales:
   - Goal statements involving the context element "includes" no longer
     generate theorems with internal delta predicates (those ending on
     "_axioms") in the premise.
     Resolve particular premise with <locale>.intro to obtain old form.
   - Fixed bug in type inference ("unify_frozen") that prevented mix of target
     specification and "includes" elements in goal statement.
   - Rule sets <locale>.intro and <locale>.axioms no longer declared as
     [intro?] and [elim?] (respectively) by default.
   - Experimental command for instantiation of locales in proof contexts:
         instantiate <label>[<attrs>]: <loc>
     Instantiates locale <loc> and adds all its theorems to the current context
     taking into account their attributes.  Label and attrs are optional
     modifiers, like in theorem declarations.  If present, names of
     instantiated theorems are qualified with <label>, and the attributes
     <attrs> are applied after any attributes these theorems might have already.
       If the locale has assumptions, a chained fact of the form
     "<loc> t1 ... tn" is expected from which instantiations of the parameters
     are derived.  The command does not support old-style locales declared
     with "locale (open)".
       A few (very simple) examples can be found in FOL/ex/LocaleInst.thy.
 
 * HOL: Tactic emulation methods induct_tac and case_tac understand static
   (Isar) contexts.
 
 
 *** HOL ***
 
 * Proof import: new image HOL4 contains the imported library from
   the HOL4 system with about 2500 theorems. It is imported by
   replaying proof terms produced by HOL4 in Isabelle. The HOL4 image
   can be used like any other Isabelle image.  See
   HOL/Import/HOL/README for more information.
 
 * Simplifier:
   - Much improved handling of linear and partial orders.
     Reasoners for linear and partial orders are set up for type classes
     "linorder" and "order" respectively, and are added to the default simpset
     as solvers.  This means that the simplifier can build transitivity chains
     to solve goals from the assumptions.
   - INCOMPATIBILITY: old proofs break occasionally.  Typically, applications
     of blast or auto after simplification become unnecessary because the goal
     is solved by simplification already.
 
 * Numerics: new theory Ring_and_Field contains over 250 basic numerical laws,
     all proved in axiomatic type classes for semirings, rings and fields.
 
 * Numerics:
   - Numeric types (nat, int, and in HOL-Complex rat, real, complex, etc.) are
     now formalized using the Ring_and_Field theory mentioned above.
   - INCOMPATIBILITY: simplification and arithmetic behaves somewhat differently
     than before, because now they are set up once in a generic manner.
   - INCOMPATIBILITY: many type-specific arithmetic laws have gone.
     Look for the general versions in Ring_and_Field (and Power if they concern
     exponentiation).
 
 * Type "rat" of the rational numbers is now available in HOL-Complex.
 
 * Records:
   - Record types are now by default printed with their type abbreviation
     instead of the list of all field types. This can be configured via
     the reference "print_record_type_abbr".
   - Simproc "record_upd_simproc" for simplification of multiple updates added
     (not enabled by default).
   - Simproc "record_ex_sel_eq_simproc" to simplify EX x. sel r = x resp.
     EX x. x = sel r to True (not enabled by default).
   - Tactic "record_split_simp_tac" to split and simplify records added.
 
 * 'specification' command added, allowing for definition by
   specification.  There is also an 'ax_specification' command that
   introduces the new constants axiomatically.
 
 * arith(_tac) is now able to generate counterexamples for reals as well.
 
 * HOL-Algebra: new locale "ring" for non-commutative rings.
 
 * HOL-ex: InductiveInvariant_examples illustrates advanced recursive function
   definitions, thanks to Sava Krsti\'{c} and John Matthews.
 
 * HOL-Matrix: a first theory for matrices in HOL with an application of
   matrix theory to linear programming.
 
 * Unions and Intersections:
   The latex output syntax of UN and INT has been changed
   from "\Union x \in A. B" to "\Union_{x \in A} B"
   i.e. the index formulae has become a subscript.
   Similarly for "\Union x. B", and for \Inter instead of \Union.
 
 * Unions and Intersections over Intervals:
   There is new short syntax "UN i<=n. A" for "UN i:{0..n}. A". There is
   also an x-symbol version with subscripts "\<Union>\<^bsub>i <= n\<^esub>. A"
   like in normal math, and corresponding versions for < and for intersection.
 
 * HOL/List: Ordering "lexico" is renamed "lenlex" and the standard
   lexicographic dictonary ordering has been added as "lexord".
 
 * ML: the legacy theory structures Int and List have been removed. They had
   conflicted with ML Basis Library structures having the same names.
 
 * 'refute' command added to search for (finite) countermodels.  Only works
   for a fragment of HOL.  The installation of an external SAT solver is
   highly recommended.  See "HOL/Refute.thy" for details.
 
 * 'quickcheck' command: Allows to find counterexamples by evaluating
   formulae under an assignment of free variables to random values.
   In contrast to 'refute', it can deal with inductive datatypes,
   but cannot handle quantifiers. See "HOL/ex/Quickcheck_Examples.thy"
   for examples.
 
 
 *** HOLCF ***
 
 * Streams now come with concatenation and are part of the HOLCF image
 
 
 
 New in Isabelle2003 (May 2003)
 ------------------------------
 
 *** General ***
 
 * Provers/simplifier:
 
   - Completely reimplemented method simp (ML: Asm_full_simp_tac):
     Assumptions are now subject to complete mutual simplification,
     not just from left to right. The simplifier now preserves
     the order of assumptions.
 
     Potential INCOMPATIBILITY:
 
     -- simp sometimes diverges where the old version did
        not, e.g. invoking simp on the goal
 
         [| P (f x); y = x; f x = f y |] ==> Q
 
        now gives rise to the infinite reduction sequence
 
         P(f x) --(f x = f y)--> P(f y) --(y = x)--> P(f x) --(f x = f y)--> ...
 
        Using "simp (asm_lr)" (ML: Asm_lr_simp_tac) instead often solves this
        kind of problem.
 
     -- Tactics combining classical reasoner and simplification (such as auto)
        are also affected by this change, because many of them rely on
        simp. They may sometimes diverge as well or yield a different numbers
        of subgoals. Try to use e.g. force, fastsimp, or safe instead of auto
        in case of problems. Sometimes subsequent calls to the classical
        reasoner will fail because a preceeding call to the simplifier too
        eagerly simplified the goal, e.g. deleted redundant premises.
 
   - The simplifier trace now shows the names of the applied rewrite rules
 
   - You can limit the number of recursive invocations of the simplifier
     during conditional rewriting (where the simplifie tries to solve the
     conditions before applying the rewrite rule):
     ML "simp_depth_limit := n"
     where n is an integer. Thus you can force termination where previously
     the simplifier would diverge.
 
   - Accepts free variables as head terms in congruence rules.  Useful in Isar.
 
   - No longer aborts on failed congruence proof.  Instead, the
     congruence is ignored.
 
 * Pure: New generic framework for extracting programs from constructive
   proofs. See HOL/Extraction.thy for an example instantiation, as well
   as HOL/Extraction for some case studies.
 
 * Pure: The main goal of the proof state is no longer shown by default, only
 the subgoals. This behaviour is controlled by a new flag.
    PG menu: Isabelle/Isar -> Settings -> Show Main Goal
 (ML: Proof.show_main_goal).
 
 * Pure: You can find all matching introduction rules for subgoal 1, i.e. all
 rules whose conclusion matches subgoal 1:
       PG menu: Isabelle/Isar -> Show me -> matching rules
 The rules are ordered by how closely they match the subgoal.
 In particular, rules that solve a subgoal outright are displayed first
 (or rather last, the way they are printed).
 (ML: ProofGeneral.print_intros())
 
 * Pure: New flag trace_unify_fail causes unification to print
 diagnostic information (PG: in trace buffer) when it fails. This is
 useful for figuring out why single step proofs like rule, erule or
 assumption failed.
 
 * Pure: Locale specifications now produce predicate definitions
 according to the body of text (covering assumptions modulo local
 definitions); predicate "loc_axioms" covers newly introduced text,
 while "loc" is cumulative wrt. all included locale expressions; the
 latter view is presented only on export into the global theory
 context; potential INCOMPATIBILITY, use "(open)" option to fall back
 on the old view without predicates;
 
 * Pure: predefined locales "var" and "struct" are useful for sharing
 parameters (as in CASL, for example); just specify something like
 ``var x + var y + struct M'' as import;
 
 * Pure: improved thms_containing: proper indexing of facts instead of
 raw theorems; check validity of results wrt. current name space;
 include local facts of proof configuration (also covers active
 locales), cover fixed variables in index; may use "_" in term
 specification; an optional limit for the number of printed facts may
 be given (the default is 40);
 
 * Pure: disallow duplicate fact bindings within new-style theory files
 (batch-mode only);
 
 * Provers: improved induct method: assumptions introduced by case
 "foo" are split into "foo.hyps" (from the rule) and "foo.prems" (from
 the goal statement); "foo" still refers to all facts collectively;
 
 * Provers: the function blast.overloaded has been removed: all constants
 are regarded as potentially overloaded, which improves robustness in exchange
 for slight decrease in efficiency;
 
 * Provers/linorder: New generic prover for transitivity reasoning over
 linear orders.  Note: this prover is not efficient!
 
 * Isar: preview of problems to finish 'show' now produce an error
 rather than just a warning (in interactive mode);
 
 
 *** HOL ***
 
 * arith(_tac)
 
  - Produces a counter example if it cannot prove a goal.
    Note that the counter example may be spurious if the goal is not a formula
    of quantifier-free linear arithmetic.
    In ProofGeneral the counter example appears in the trace buffer.
 
  - Knows about div k and mod k where k is a numeral of type nat or int.
 
  - Calls full Presburger arithmetic (by Amine Chaieb) if quantifier-free
    linear arithmetic fails. This takes account of quantifiers and divisibility.
    Presburger arithmetic can also be called explicitly via presburger(_tac).
 
 * simp's arithmetic capabilities have been enhanced a bit: it now
 takes ~= in premises into account (by performing a case split);
 
 * simp reduces "m*(n div m) + n mod m" to n, even if the two summands
 are distributed over a sum of terms;
 
 * New tactic "trans_tac" and method "trans" instantiate
 Provers/linorder.ML for axclasses "order" and "linorder" (predicates
 "<=", "<" and "=").
 
 * function INCOMPATIBILITIES: Pi-sets have been redefined and moved from main
 HOL to Library/FuncSet; constant "Fun.op o" is now called "Fun.comp";
 
 * 'typedef' command has new option "open" to suppress the set
 definition;
 
 * functions Min and Max on finite sets have been introduced (theory
 Finite_Set);
 
 * attribute [symmetric] now works for relations as well; it turns
 (x,y) : R^-1 into (y,x) : R, and vice versa;
 
 * induct over a !!-quantified statement (say !!x1..xn):
   each "case" automatically performs "fix x1 .. xn" with exactly those names.
 
 * Map: `empty' is no longer a constant but a syntactic abbreviation for
 %x. None. Warning: empty_def now refers to the previously hidden definition
 of the empty set.
 
 * Algebra: formalization of classical algebra.  Intended as base for
 any algebraic development in Isabelle.  Currently covers group theory
 (up to Sylow's theorem) and ring theory (Universal Property of
 Univariate Polynomials).  Contributions welcome;
 
 * GroupTheory: deleted, since its material has been moved to Algebra;
 
 * Complex: new directory of the complex numbers with numeric constants,
 nonstandard complex numbers, and some complex analysis, standard and
 nonstandard (Jacques Fleuriot);
 
 * HOL-Complex: new image for analysis, replacing HOL-Real and HOL-Hyperreal;
 
 * Hyperreal: introduced Gauge integration and hyperreal logarithms (Jacques
 Fleuriot);
 
 * Real/HahnBanach: updated and adapted to locales;
 
 * NumberTheory: added Gauss's law of quadratic reciprocity (by Avigad,
 Gray and Kramer);
 
 * UNITY: added the Meier-Sanders theory of progress sets;
 
 * MicroJava: bytecode verifier and lightweight bytecode verifier
 as abstract algorithms, instantiated to the JVM;
 
 * Bali: Java source language formalization. Type system, operational
 semantics, axiomatic semantics. Supported language features:
 classes, interfaces, objects,virtual methods, static methods,
 static/instance fields, arrays, access modifiers, definite
 assignment, exceptions.
 
 
 *** ZF ***
 
 * ZF/Constructible: consistency proof for AC (Gdel's constructible
 universe, etc.);
 
 * Main ZF: virtually all theories converted to new-style format;
 
 
 *** ML ***
 
 * Pure: Tactic.prove provides sane interface for internal proofs;
 omits the infamous "standard" operation, so this is more appropriate
 than prove_goalw_cterm in many situations (e.g. in simprocs);
 
 * Pure: improved error reporting of simprocs;
 
 * Provers: Simplifier.simproc(_i) provides sane interface for setting
 up simprocs;
 
 
 *** Document preparation ***
 
 * uses \par instead of \\ for line breaks in theory text. This may
 shift some page breaks in large documents. To get the old behaviour
 use \renewcommand{\isanewline}{\mbox{}\\\mbox{}} in root.tex.
 
 * minimized dependencies of isabelle.sty and isabellesym.sty on
 other packages
 
 * \<euro> now needs package babel/greek instead of marvosym (which
 broke \Rightarrow)
 
 * normal size for \<zero>...\<nine> (uses \mathbf instead of
 textcomp package)
 
 
 
 New in Isabelle2002 (March 2002)
 --------------------------------
 
 *** Document preparation ***
 
 * greatly simplified document preparation setup, including more
 graceful interpretation of isatool usedir -i/-d/-D options, and more
 instructive isatool mkdir; users should basically be able to get
 started with "isatool mkdir HOL Test && isatool make"; alternatively,
 users may run a separate document processing stage manually like this:
 "isatool usedir -D output HOL Test && isatool document Test/output";
 
 * theory dependency graph may now be incorporated into documents;
 isatool usedir -g true will produce session_graph.eps/.pdf for use
 with \includegraphics of LaTeX;
 
 * proper spacing of consecutive markup elements, especially text
 blocks after section headings;
 
 * support bold style (for single symbols only), input syntax is like
 this: "\<^bold>\<alpha>" or "\<^bold>A";
 
 * \<bullet> is now output as bold \cdot by default, which looks much
 better in printed text;
 
 * added default LaTeX bindings for \<tturnstile> and \<TTurnstile>;
 note that these symbols are currently unavailable in Proof General /
 X-Symbol; new symbols \<zero>, \<one>, ..., \<nine>, and \<euro>;
 
 * isatool latex no longer depends on changed TEXINPUTS, instead
 isatool document copies the Isabelle style files to the target
 location;
 
 
 *** Isar ***
 
 * Pure/Provers: improved proof by cases and induction;
   - 'case' command admits impromptu naming of parameters (such as
     "case (Suc n)");
   - 'induct' method divinates rule instantiation from the inductive
     claim; no longer requires excessive ?P bindings for proper
     instantiation of cases;
   - 'induct' method properly enumerates all possibilities of set/type
     rules; as a consequence facts may be also passed through *type*
     rules without further ado;
   - 'induct' method now derives symbolic cases from the *rulified*
     rule (before it used to rulify cases stemming from the internal
     atomized version); this means that the context of a non-atomic
     statement becomes is included in the hypothesis, avoiding the
     slightly cumbersome show "PROP ?case" form;
   - 'induct' may now use elim-style induction rules without chaining
     facts, using ``missing'' premises from the goal state; this allows
     rules stemming from inductive sets to be applied in unstructured
     scripts, while still benefitting from proper handling of non-atomic
     statements; NB: major inductive premises need to be put first, all
     the rest of the goal is passed through the induction;
   - 'induct' proper support for mutual induction involving non-atomic
     rule statements (uses the new concept of simultaneous goals, see
     below);
   - append all possible rule selections, but only use the first
     success (no backtracking);
   - removed obsolete "(simplified)" and "(stripped)" options of methods;
   - undeclared rule case names default to numbers 1, 2, 3, ...;
   - added 'print_induct_rules' (covered by help item in recent Proof
     General versions);
   - moved induct/cases attributes to Pure, methods to Provers;
   - generic method setup instantiated for FOL and HOL;
 
 * Pure: support multiple simultaneous goal statements, for example
 "have a: A and b: B" (same for 'theorem' etc.); being a pure
 meta-level mechanism, this acts as if several individual goals had
 been stated separately; in particular common proof methods need to be
 repeated in order to cover all claims; note that a single elimination
 step is *not* sufficient to establish the two conjunctions, so this
 fails:
 
   assume "A & B" then have A and B ..   (*".." fails*)
 
 better use "obtain" in situations as above; alternative refer to
 multi-step methods like 'auto', 'simp_all', 'blast+' etc.;
 
 * Pure: proper integration with ``locales''; unlike the original
 version by Florian Kammller, Isar locales package high-level proof
 contexts rather than raw logical ones (e.g. we admit to include
 attributes everywhere); operations on locales include merge and
 rename; support for implicit arguments (``structures''); simultaneous
 type-inference over imports and text; see also HOL/ex/Locales.thy for
 some examples;
 
 * Pure: the following commands have been ``localized'', supporting a
 target locale specification "(in name)": 'lemma', 'theorem',
 'corollary', 'lemmas', 'theorems', 'declare'; the results will be
 stored both within the locale and at the theory level (exported and
 qualified by the locale name);
 
 * Pure: theory goals may now be specified in ``long'' form, with
 ad-hoc contexts consisting of arbitrary locale elements. for example
 ``lemma foo: fixes x assumes "A x" shows "B x"'' (local syntax and
 definitions may be given, too); the result is a meta-level rule with
 the context elements being discharged in the obvious way;
 
 * Pure: new proof command 'using' allows to augment currently used
 facts after a goal statement ('using' is syntactically analogous to
 'apply', but acts on the goal's facts only); this allows chained facts
 to be separated into parts given before and after a claim, as in
 ``from a and b have C using d and e <proof>'';
 
 * Pure: renamed "antecedent" case to "rule_context";
 
 * Pure: new 'judgment' command records explicit information about the
 object-logic embedding (used by several tools internally); no longer
 use hard-wired "Trueprop";
 
 * Pure: added 'corollary' command;
 
 * Pure: fixed 'token_translation' command;
 
 * Pure: removed obsolete 'exported' attribute;
 
 * Pure: dummy pattern "_" in is/let is now automatically lifted over
 bound variables: "ALL x. P x --> Q x" (is "ALL x. _ --> ?C x")
 supersedes more cumbersome ... (is "ALL x. _ x --> ?C x");
 
 * Pure: method 'atomize' presents local goal premises as object-level
 statements (atomic meta-level propositions); setup controlled via
 rewrite rules declarations of 'atomize' attribute; example
 application: 'induct' method with proper rule statements in improper
 proof *scripts*;
 
 * Pure: emulation of instantiation tactics (rule_tac, cut_tac, etc.)
 now consider the syntactic context of assumptions, giving a better
 chance to get type-inference of the arguments right (this is
 especially important for locales);
 
 * Pure: "sorry" no longer requires quick_and_dirty in interactive
 mode;
 
 * Pure/obtain: the formal conclusion "thesis", being marked as
 ``internal'', may no longer be reference directly in the text;
 potential INCOMPATIBILITY, may need to use "?thesis" in rare
 situations;
 
 * Pure: generic 'sym' attribute which declares a rule both as pure
 'elim?' and for the 'symmetric' operation;
 
 * Pure: marginal comments ``--'' may now occur just anywhere in the
 text; the fixed correlation with particular command syntax has been
 discontinued;
 
 * Pure: new method 'rules' is particularly well-suited for proof
 search in intuitionistic logic; a bit slower than 'blast' or 'fast',
 but often produces more compact proof terms with less detours;
 
 * Pure/Provers/classical: simplified integration with pure rule
 attributes and methods; the classical "intro?/elim?/dest?"
 declarations coincide with the pure ones; the "rule" method no longer
 includes classically swapped intros; "intro" and "elim" methods no
 longer pick rules from the context; also got rid of ML declarations
 AddXIs/AddXEs/AddXDs; all of this has some potential for
 INCOMPATIBILITY;
 
 * Provers/classical: attribute 'swapped' produces classical inversions
 of introduction rules;
 
 * Provers/simplifier: 'simplified' attribute may refer to explicit
 rules instead of full simplifier context; 'iff' attribute handles
 conditional rules;
 
 * HOL: 'typedef' now allows alternative names for Rep/Abs morphisms;
 
 * HOL: 'recdef' now fails on unfinished automated proofs, use
 "(permissive)" option to recover old behavior;
 
 * HOL: 'inductive' no longer features separate (collective) attributes
 for 'intros' (was found too confusing);
 
 * HOL: properly declared induction rules less_induct and
 wf_induct_rule;
 
 
 *** HOL ***
 
 * HOL: moved over to sane numeral syntax; the new policy is as
 follows:
 
   - 0 and 1 are polymorphic constants, which are defined on any
   numeric type (nat, int, real etc.);
 
   - 2, 3, 4, ... and -1, -2, -3, ... are polymorphic numerals, based
   binary representation internally;
 
   - type nat has special constructor Suc, and generally prefers Suc 0
   over 1::nat and Suc (Suc 0) over 2::nat;
 
 This change may cause significant problems of INCOMPATIBILITY; here
 are some hints on converting existing sources:
 
   - due to the new "num" token, "-0" and "-1" etc. are now atomic
   entities, so expressions involving "-" (unary or binary minus) need
   to be spaced properly;
 
   - existing occurrences of "1" may need to be constraint "1::nat" or
   even replaced by Suc 0; similar for old "2";
 
   - replace "#nnn" by "nnn", and "#-nnn" by "-nnn";
 
   - remove all special provisions on numerals in proofs;
 
 * HOL: simp rules nat_number expand numerals on nat to Suc/0
 representation (depends on bin_arith_simps in the default context);
 
 * HOL: symbolic syntax for x^2 (numeral 2);
 
 * HOL: the class of all HOL types is now called "type" rather than
 "term"; INCOMPATIBILITY, need to adapt references to this type class
 in axclass/classes, instance/arities, and (usually rare) occurrences
 in typings (of consts etc.); internally the class is called
 "HOL.type", ML programs should refer to HOLogic.typeS;
 
 * HOL/record package improvements:
   - new derived operations "fields" to build a partial record section,
     "extend" to promote a fixed record to a record scheme, and
     "truncate" for the reverse; cf. theorems "xxx.defs", which are *not*
     declared as simp by default;
   - shared operations ("more", "fields", etc.) now need to be always
     qualified) --- potential INCOMPATIBILITY;
   - removed "make_scheme" operations (use "make" with "extend") --
     INCOMPATIBILITY;
   - removed "more" class (simply use "term") -- INCOMPATIBILITY;
   - provides cases/induct rules for use with corresponding Isar
     methods (for concrete records, record schemes, concrete more
     parts, and schematic more parts -- in that order);
   - internal definitions directly based on a light-weight abstract
     theory of product types over typedef rather than datatype;
 
 * HOL: generic code generator for generating executable ML code from
 specifications; specific support for HOL constructs such as inductive
 datatypes and sets, as well as recursive functions; can be invoked
 via 'generate_code' theory section;
 
 * HOL: canonical cases/induct rules for n-tuples (n = 3..7);
 
 * HOL: consolidated and renamed several theories.  In particular:
         Ord.thy has been absorbed into HOL.thy
         String.thy has been absorbed into List.thy
 
 * HOL: concrete setsum syntax "\<Sum>i:A. b" == "setsum (%i. b) A"
 (beware of argument permutation!);
 
 * HOL: linorder_less_split superseded by linorder_cases;
 
 * HOL/List: "nodups" renamed to "distinct";
 
 * HOL: added "The" definite description operator; move Hilbert's "Eps"
 to peripheral theory "Hilbert_Choice"; some INCOMPATIBILITIES:
   - Ex_def has changed, now need to use some_eq_ex
 
 * HOL: made split_all_tac safe; EXISTING PROOFS MAY FAIL OR LOOP, so
 in this (rare) case use:
 
   delSWrapper "split_all_tac"
   addSbefore ("unsafe_split_all_tac", unsafe_split_all_tac)
 
 * HOL: added safe wrapper "split_conv_tac" to claset; EXISTING PROOFS
 MAY FAIL;
 
 * HOL: introduced f^n = f o ... o f; warning: due to the limits of
 Isabelle's type classes, ^ on functions and relations has too general
 a domain, namely ('a * 'b) set and 'a => 'b; this means that it may be
 necessary to attach explicit type constraints;
 
 * HOL/Relation: the prefix name of the infix "O" has been changed from
 "comp" to "rel_comp"; INCOMPATIBILITY: a few theorems have been
 renamed accordingly (eg "compI" -> "rel_compI").
 
 * HOL: syntax translations now work properly with numerals and records
 expressions;
 
 * HOL: bounded abstraction now uses syntax "%" / "\<lambda>" instead
 of "lam" -- INCOMPATIBILITY;
 
 * HOL: got rid of some global declarations (potential INCOMPATIBILITY
 for ML tools): const "()" renamed "Product_Type.Unity", type "unit"
 renamed "Product_Type.unit";
 
 * HOL: renamed rtrancl_into_rtrancl2 to converse_rtrancl_into_rtrancl
 
 * HOL: removed obsolete theorem "optionE" (use "option.exhaust", or
 the "cases" method);
 
 * HOL/GroupTheory: group theory examples including Sylow's theorem (by
 Florian Kammller);
 
 * HOL/IMP: updated and converted to new-style theory format; several
 parts turned into readable document, with proper Isar proof texts and
 some explanations (by Gerwin Klein);
 
 * HOL-Real: added Complex_Numbers (by Gertrud Bauer);
 
 * HOL-Hyperreal is now a logic image;
 
 
 *** HOLCF ***
 
 * Isar: consts/constdefs supports mixfix syntax for continuous
 operations;
 
 * Isar: domain package adapted to new-style theory format, e.g. see
 HOLCF/ex/Dnat.thy;
 
 * theory Lift: proper use of rep_datatype lift instead of ML hacks --
 potential INCOMPATIBILITY; now use plain induct_tac instead of former
 lift.induct_tac, always use UU instead of Undef;
 
 * HOLCF/IMP: updated and converted to new-style theory;
 
 
 *** ZF ***
 
 * Isar: proper integration of logic-specific tools and packages,
 including theory commands '(co)inductive', '(co)datatype',
 'rep_datatype', 'inductive_cases', as well as methods 'ind_cases',
 'induct_tac', 'case_tac', and 'typecheck' (with attribute 'TC');
 
 * theory Main no longer includes AC; for the Axiom of Choice, base
 your theory on Main_ZFC;
 
 * the integer library now covers quotients and remainders, with many
 laws relating division to addition, multiplication, etc.;
 
 * ZF/UNITY: Chandy and Misra's UNITY is now available in ZF, giving a
 typeless version of the formalism;
 
 * ZF/AC, Coind, IMP, Resid: updated and converted to new-style theory
 format;
 
 * ZF/Induct: new directory for examples of inductive definitions,
 including theory Multiset for multiset orderings; converted to
 new-style theory format;
 
 * ZF: many new theorems about lists, ordinals, etc.;
 
 
 *** General ***
 
 * Pure/kernel: meta-level proof terms (by Stefan Berghofer); reference
 variable proof controls level of detail: 0 = no proofs (only oracle
 dependencies), 1 = lemma dependencies, 2 = compact proof terms; see
 also ref manual for further ML interfaces;
 
 * Pure/axclass: removed obsolete ML interface
 goal_subclass/goal_arity;
 
 * Pure/syntax: new token syntax "num" for plain numerals (without "#"
 of "xnum"); potential INCOMPATIBILITY, since -0, -1 etc. are now
 separate tokens, so expressions involving minus need to be spaced
 properly;
 
 * Pure/syntax: support non-oriented infixes, using keyword "infix"
 rather than "infixl" or "infixr";
 
 * Pure/syntax: concrete syntax for dummy type variables admits genuine
 sort constraint specifications in type inference; e.g. "x::_::foo"
 ensures that the type of "x" is of sort "foo" (but not necessarily a
 type variable);
 
 * Pure/syntax: print modes "type_brackets" and "no_type_brackets"
 control output of nested => (types); the default behavior is
 "type_brackets";
 
 * Pure/syntax: builtin parse translation for "_constify" turns valued
 tokens into AST constants;
 
 * Pure/syntax: prefer later declarations of translations and print
 translation functions; potential INCOMPATIBILITY: need to reverse
 multiple declarations for same syntax element constant;
 
 * Pure/show_hyps reset by default (in accordance to existing Isar
 practice);
 
 * Provers/classical: renamed addaltern to addafter, addSaltern to
 addSafter;
 
 * Provers/clasimp: ``iff'' declarations now handle conditional rules
 as well;
 
 * system: tested support for MacOS X; should be able to get Isabelle +
 Proof General to work in a plain Terminal after installing Poly/ML
 (e.g. from the Isabelle distribution area) and GNU bash alone
 (e.g. from http://www.apple.com); full X11, XEmacs and X-Symbol
 support requires further installations, e.g. from
 http://fink.sourceforge.net/);
 
 * system: support Poly/ML 4.1.1 (able to manage larger heaps);
 
 * system: reduced base memory usage by Poly/ML (approx. 20 MB instead
 of 40 MB), cf. ML_OPTIONS;
 
 * system: Proof General keywords specification is now part of the
 Isabelle distribution (see etc/isar-keywords.el);
 
 * system: support for persistent Proof General sessions (refrain from
 outdating all loaded theories on startup); user may create writable
 logic images like this: ``isabelle -q HOL Test'';
 
 * system: smart selection of Isabelle process versus Isabelle
 interface, accommodates case-insensitive file systems (e.g. HFS+); may
 run both "isabelle" and "Isabelle" even if file names are badly
 damaged (executable inspects the case of the first letter of its own
 name); added separate "isabelle-process" and "isabelle-interface";
 
 * system: refrain from any attempt at filtering input streams; no
 longer support ``8bit'' encoding of old isabelle font, instead proper
 iso-latin characters may now be used; the related isatools
 "symbolinput" and "nonascii" have disappeared as well;
 
 * system: removed old "xterm" interface (the print modes "xterm" and
 "xterm_color" are still available for direct use in a suitable
 terminal);
 
 
 
 New in Isabelle99-2 (February 2001)
 -----------------------------------
 
 *** Overview of INCOMPATIBILITIES ***
 
 * HOL: please note that theories in the Library and elsewhere often use the
 new-style (Isar) format; to refer to their theorems in an ML script you must
 bind them to ML identifers by e.g.      val thm_name = thm "thm_name";
 
 * HOL: inductive package no longer splits induction rule aggressively,
 but only as far as specified by the introductions given; the old
 format may be recovered via ML function complete_split_rule or attribute
 'split_rule (complete)';
 
 * HOL: induct renamed to lfp_induct, lfp_Tarski to lfp_unfold,
 gfp_Tarski to gfp_unfold;
 
 * HOL: contrapos, contrapos2 renamed to contrapos_nn, contrapos_pp;
 
 * HOL: infix "dvd" now has priority 50 rather than 70 (because it is a
 relation); infix "^^" has been renamed "``"; infix "``" has been
 renamed "`"; "univalent" has been renamed "single_valued";
 
 * HOL/Real: "rinv" and "hrinv" replaced by overloaded "inverse"
 operation;
 
 * HOLCF: infix "`" has been renamed "$"; the symbol syntax is \<cdot>;
 
 * Isar: 'obtain' no longer declares "that" fact as simp/intro;
 
 * Isar/HOL: method 'induct' now handles non-atomic goals; as a
 consequence, it is no longer monotonic wrt. the local goal context
 (which is now passed through the inductive cases);
 
 * Document preparation: renamed standard symbols \<ll> to \<lless> and
 \<gg> to \<ggreater>;
 
 
 *** Document preparation ***
 
 * \isabellestyle{NAME} selects version of Isabelle output (currently
 available: are "it" for near math-mode best-style output, "sl" for
 slanted text style, and "tt" for plain type-writer; if no
 \isabellestyle command is given, output is according to slanted
 type-writer);
 
 * support sub/super scripts (for single symbols only), input syntax is
 like this: "A\<^sup>*" or "A\<^sup>\<star>";
 
 * some more standard symbols; see Appendix A of the system manual for
 the complete list of symbols defined in isabellesym.sty;
 
 * improved isabelle style files; more abstract symbol implementation
 (should now use \isamath{...} and \isatext{...} in custom symbol
 definitions);
 
 * antiquotation @{goals} and @{subgoals} for output of *dynamic* goals
 state; Note that presentation of goal states does not conform to
 actual human-readable proof documents.  Please do not include goal
 states into document output unless you really know what you are doing!
 
 * proper indentation of antiquoted output with proportional LaTeX
 fonts;
 
 * no_document ML operator temporarily disables LaTeX document
 generation;
 
 * isatool unsymbolize tunes sources for plain ASCII communication;
 
 
 *** Isar ***
 
 * Pure: Isar now suffers initial goal statements to contain unbound
 schematic variables (this does not conform to actual readable proof
 documents, due to unpredictable outcome and non-compositional proof
 checking); users who know what they are doing may use schematic goals
 for Prolog-style synthesis of proven results;
 
 * Pure: assumption method (an implicit finishing) now handles actual
 rules as well;
 
 * Pure: improved 'obtain' --- moved to Pure, insert "that" into
 initial goal, declare "that" only as Pure intro (only for single
 steps); the "that" rule assumption may now be involved in implicit
 finishing, thus ".." becomes a feasible for trivial obtains;
 
 * Pure: default proof step now includes 'intro_classes'; thus trivial
 instance proofs may be performed by "..";
 
 * Pure: ?thesis / ?this / "..." now work for pure meta-level
 statements as well;
 
 * Pure: more robust selection of calculational rules;
 
 * Pure: the builtin notion of 'finished' goal now includes the ==-refl
 rule (as well as the assumption rule);
 
 * Pure: 'thm_deps' command visualizes dependencies of theorems and
 lemmas, using the graph browser tool;
 
 * Pure: predict failure of "show" in interactive mode;
 
 * Pure: 'thms_containing' now takes actual terms as arguments;
 
 * HOL: improved method 'induct' --- now handles non-atomic goals
 (potential INCOMPATIBILITY); tuned error handling;
 
 * HOL: cases and induct rules now provide explicit hints about the
 number of facts to be consumed (0 for "type" and 1 for "set" rules);
 any remaining facts are inserted into the goal verbatim;
 
 * HOL: local contexts (aka cases) may now contain term bindings as
 well; the 'cases' and 'induct' methods new provide a ?case binding for
 the result to be shown in each case;
 
 * HOL: added 'recdef_tc' command;
 
 * isatool convert assists in eliminating legacy ML scripts;
 
 
 *** HOL ***
 
 * HOL/Library: a collection of generic theories to be used together
 with main HOL; the theory loader path already includes this directory
 by default; the following existing theories have been moved here:
 HOL/Induct/Multiset, HOL/Induct/Acc (as Accessible_Part), HOL/While
 (as While_Combinator), HOL/Lex/Prefix (as List_Prefix);
 
 * HOL/Unix: "Some aspects of Unix file-system security", a typical
 modelling and verification task performed in Isabelle/HOL +
 Isabelle/Isar + Isabelle document preparation (by Markus Wenzel).
 
 * HOL/Algebra: special summation operator SUM no longer exists, it has
 been replaced by setsum; infix 'assoc' now has priority 50 (like
 'dvd'); axiom 'one_not_zero' has been moved from axclass 'ring' to
 'domain', this makes the theory consistent with mathematical
 literature;
 
 * HOL basics: added overloaded operations "inverse" and "divide"
 (infix "/"), syntax for generic "abs" operation, generic summation
 operator \<Sum>;
 
 * HOL/typedef: simplified package, provide more useful rules (see also
 HOL/subset.thy);
 
 * HOL/datatype: induction rule for arbitrarily branching datatypes is
 now expressed as a proper nested rule (old-style tactic scripts may
 require atomize_strip_tac to cope with non-atomic premises);
 
 * HOL: renamed theory "Prod" to "Product_Type", renamed "split" rule
 to "split_conv" (old name still available for compatibility);
 
 * HOL: improved concrete syntax for strings (e.g. allows translation
 rules with string literals);
 
 * HOL-Real-Hyperreal: this extends HOL-Real with the hyperreals
  and Fleuriot's mechanization of analysis, including the transcendental
  functions for the reals;
 
 * HOL/Real, HOL/Hyperreal: improved arithmetic simplification;
 
 
 *** CTT ***
 
 * CTT: x-symbol support for Pi, Sigma, -->, : (membership); note that
 "lam" is displayed as TWO lambda-symbols
 
 * CTT: theory Main now available, containing everything (that is, Bool
 and Arith);
 
 
 *** General ***
 
 * Pure: the Simplifier has been implemented properly as a derived rule
 outside of the actual kernel (at last!); the overall performance
 penalty in practical applications is about 50%, while reliability of
 the Isabelle inference kernel has been greatly improved;
 
 * print modes "brackets" and "no_brackets" control output of nested =>
 (types) and ==> (props); the default behaviour is "brackets";
 
 * Provers: fast_tac (and friends) now handle actual object-logic rules
 as assumptions as well;
 
 * system: support Poly/ML 4.0;
 
 * system: isatool install handles KDE version 1 or 2;
 
 
 
 New in Isabelle99-1 (October 2000)
 ----------------------------------
 
 *** Overview of INCOMPATIBILITIES ***
 
 * HOL: simplification of natural numbers is much changed; to partly
 recover the old behaviour (e.g. to prevent n+n rewriting to #2*n)
 issue the following ML commands:
 
   Delsimprocs Nat_Numeral_Simprocs.cancel_numerals;
   Delsimprocs [Nat_Numeral_Simprocs.combine_numerals];
 
 * HOL: simplification no longer dives into case-expressions; this is
 controlled by "t.weak_case_cong" for each datatype t;
 
 * HOL: nat_less_induct renamed to less_induct;
 
 * HOL: systematic renaming of the SOME (Eps) rules, may use isatool
 fixsome to patch .thy and .ML sources automatically;
 
   select_equality  -> some_equality
   select_eq_Ex     -> some_eq_ex
   selectI2EX       -> someI2_ex
   selectI2         -> someI2
   selectI          -> someI
   select1_equality -> some1_equality
   Eps_sym_eq       -> some_sym_eq_trivial
   Eps_eq           -> some_eq_trivial
 
 * HOL: exhaust_tac on datatypes superceded by new generic case_tac;
 
 * HOL: removed obsolete theorem binding expand_if (refer to split_if
 instead);
 
 * HOL: the recursion equations generated by 'recdef' are now called
 f.simps instead of f.rules;
 
 * HOL: qed_spec_mp now also handles bounded ALL as well;
 
 * HOL: 0 is now overloaded, so the type constraint ":: nat" may
 sometimes be needed;
 
 * HOL: the constant for "f``x" is now "image" rather than "op ``";
 
 * HOL: the constant for "f-``x" is now "vimage" rather than "op -``";
 
 * HOL: the disjoint sum is now "<+>" instead of "Plus"; the cartesian
 product is now "<*>" instead of "Times"; the lexicographic product is
 now "<*lex*>" instead of "**";
 
 * HOL: theory Sexp is now in HOL/Induct examples (it used to be part
 of main HOL, but was unused); better use HOL's datatype package;
 
 * HOL: removed "symbols" syntax for constant "override" of theory Map;
 the old syntax may be recovered as follows:
 
   syntax (symbols)
     override  :: "('a ~=> 'b) => ('a ~=> 'b) => ('a ~=> 'b)"
       (infixl "\\<oplus>" 100)
 
 * HOL/Real: "rabs" replaced by overloaded "abs" function;
 
 * HOL/ML: even fewer consts are declared as global (see theories Ord,
 Lfp, Gfp, WF); this only affects ML packages that refer to const names
 internally;
 
 * HOL and ZF: syntax for quotienting wrt an equivalence relation
 changed from A/r to A//r;
 
 * ZF: new treatment of arithmetic (nat & int) may break some old
 proofs;
 
 * Isar: renamed some attributes (RS -> THEN, simplify -> simplified,
 rulify -> rule_format, elimify -> elim_format, ...);
 
 * Isar/Provers: intro/elim/dest attributes changed; renamed
 intro/intro!/intro!! flags to intro!/intro/intro? (in most cases, one
 should have to change intro!! to intro? only); replaced "delrule" by
 "rule del";
 
 * Isar/HOL: renamed "intrs" to "intros" in inductive definitions;
 
 * Provers: strengthened force_tac by using new first_best_tac;
 
 * LaTeX document preparation: several changes of isabelle.sty (see
 lib/texinputs);
 
 
 *** Document preparation ***
 
 * formal comments (text blocks etc.) in new-style theories may now
 contain antiquotations of thm/prop/term/typ/text to be presented
 according to latex print mode; concrete syntax is like this:
 @{term[show_types] "f(x) = a + x"};
 
 * isatool mkdir provides easy setup of Isabelle session directories,
 including proper document sources;
 
 * generated LaTeX sources are now deleted after successful run
 (isatool document -c); may retain a copy somewhere else via -D option
 of isatool usedir;
 
 * isatool usedir -D now lets isatool latex -o sty update the Isabelle
 style files, achieving self-contained LaTeX sources and simplifying
 LaTeX debugging;
 
 * old-style theories now produce (crude) LaTeX output as well;
 
 * browser info session directories are now self-contained (may be put
 on WWW server seperately); improved graphs of nested sessions; removed
 graph for 'all sessions';
 
 * several improvements in isabelle style files; \isabellestyle{it}
 produces fake math mode output; \isamarkupheader is now \section by
 default; see lib/texinputs/isabelle.sty etc.;
 
 
 *** Isar ***
 
 * Isar/Pure: local results and corresponding term bindings are now
 subject to Hindley-Milner polymorphism (similar to ML); this
 accommodates incremental type-inference very nicely;
 
 * Isar/Pure: new derived language element 'obtain' supports
 generalized existence reasoning;
 
 * Isar/Pure: new calculational elements 'moreover' and 'ultimately'
 support accumulation of results, without applying any rules yet;
 useful to collect intermediate results without explicit name
 references, and for use with transitivity rules with more than 2
 premises;
 
 * Isar/Pure: scalable support for case-analysis type proofs: new
 'case' language element refers to local contexts symbolically, as
 produced by certain proof methods; internally, case names are attached
 to theorems as "tags";
 
 * Isar/Pure: theory command 'hide' removes declarations from
 class/type/const name spaces;
 
 * Isar/Pure: theory command 'defs' supports option "(overloaded)" to
 indicate potential overloading;
 
 * Isar/Pure: changed syntax of local blocks from {{ }} to { };
 
 * Isar/Pure: syntax of sorts made 'inner', i.e. have to write
 "{a,b,c}" instead of {a,b,c};
 
 * Isar/Pure now provides its own version of intro/elim/dest
 attributes; useful for building new logics, but beware of confusion
 with the version in Provers/classical;
 
 * Isar/Pure: the local context of (non-atomic) goals is provided via
 case name 'antecedent';
 
 * Isar/Pure: removed obsolete 'transfer' attribute (transfer of thms
 to the current context is now done automatically);
 
 * Isar/Pure: theory command 'method_setup' provides a simple interface
 for definining proof methods in ML;
 
 * Isar/Provers: intro/elim/dest attributes changed; renamed
 intro/intro!/intro!! flags to intro!/intro/intro? (INCOMPATIBILITY, in
 most cases, one should have to change intro!! to intro? only);
 replaced "delrule" by "rule del";
 
 * Isar/Provers: new 'hypsubst' method, plain 'subst' method and
 'symmetric' attribute (the latter supercedes [RS sym]);
 
 * Isar/Provers: splitter support (via 'split' attribute and 'simp'
 method modifier); 'simp' method: 'only:' modifier removes loopers as
 well (including splits);
 
 * Isar/Provers: Simplifier and Classical methods now support all kind
 of modifiers used in the past, including 'cong', 'iff', etc.
 
 * Isar/Provers: added 'fastsimp' and 'clarsimp' methods (combination
 of Simplifier and Classical reasoner);
 
 * Isar/HOL: new proof method 'cases' and improved version of 'induct'
 now support named cases; major packages (inductive, datatype, primrec,
 recdef) support case names and properly name parameters;
 
 * Isar/HOL: new transitivity rules for substitution in inequalities --
 monotonicity conditions are extracted to be proven at end of
 calculations;
 
 * Isar/HOL: removed 'case_split' thm binding, should use 'cases' proof
 method anyway;
 
 * Isar/HOL: removed old expand_if = split_if; theorems if_splits =
 split_if split_if_asm; datatype package provides theorems foo.splits =
 foo.split foo.split_asm for each datatype;
 
 * Isar/HOL: tuned inductive package, rename "intrs" to "intros"
 (potential INCOMPATIBILITY), emulation of mk_cases feature for proof
 scripts: new 'inductive_cases' command and 'ind_cases' method; (Note:
 use "(cases (simplified))" method in proper proof texts);
 
 * Isar/HOL: added global 'arith_split' attribute for 'arith' method;
 
 * Isar: names of theorems etc. may be natural numbers as well;
 
 * Isar: 'pr' command: optional arguments for goals_limit and
 ProofContext.prems_limit; no longer prints theory contexts, but only
 proof states;
 
 * Isar: diagnostic commands 'pr', 'thm', 'prop', 'term', 'typ' admit
 additional print modes to be specified; e.g. "pr(latex)" will print
 proof state according to the Isabelle LaTeX style;
 
 * Isar: improved support for emulating tactic scripts, including proof
 methods 'rule_tac' etc., 'cut_tac', 'thin_tac', 'subgoal_tac',
 'rename_tac', 'rotate_tac', 'tactic', and 'case_tac' / 'induct_tac'
 (for HOL datatypes);
 
 * Isar: simplified (more robust) goal selection of proof methods: 1st
 goal, all goals, or explicit goal specifier (tactic emulation); thus
 'proof method scripts' have to be in depth-first order;
 
 * Isar: tuned 'let' syntax: replaced 'as' keyword by 'and';
 
 * Isar: removed 'help' command, which hasn't been too helpful anyway;
 should instead use individual commands for printing items
 (print_commands, print_methods etc.);
 
 * Isar: added 'nothing' --- the empty list of theorems;
 
 
 *** HOL ***
 
 * HOL/MicroJava: formalization of a fragment of Java, together with a
 corresponding virtual machine and a specification of its bytecode
 verifier and a lightweight bytecode verifier, including proofs of
 type-safety; by Gerwin Klein, Tobias Nipkow, David von Oheimb, and
 Cornelia Pusch (see also the homepage of project Bali at
 http://isabelle.in.tum.de/Bali/);
 
 * HOL/Algebra: new theory of rings and univariate polynomials, by
 Clemens Ballarin;
 
 * HOL/NumberTheory: fundamental Theorem of Arithmetic, Chinese
 Remainder Theorem, Fermat/Euler Theorem, Wilson's Theorem, by Thomas M
 Rasmussen;
 
 * HOL/Lattice: fundamental concepts of lattice theory and order
 structures, including duals, properties of bounds versus algebraic
 laws, lattice operations versus set-theoretic ones, the Knaster-Tarski
 Theorem for complete lattices etc.; may also serve as a demonstration
 for abstract algebraic reasoning using axiomatic type classes, and
 mathematics-style proof in Isabelle/Isar; by Markus Wenzel;
 
 * HOL/Prolog: a (bare-bones) implementation of Lambda-Prolog, by David
 von Oheimb;
 
 * HOL/IMPP: extension of IMP with local variables and mutually
 recursive procedures, by David von Oheimb;
 
 * HOL/Lambda: converted into new-style theory and document;
 
 * HOL/ex/Multiquote: example of multiple nested quotations and
 anti-quotations -- basically a generalized version of de-Bruijn
 representation; very useful in avoiding lifting of operations;
 
 * HOL/record: added general record equality rule to simpset; fixed
 select-update simplification procedure to handle extended records as
 well; admit "r" as field name;
 
 * HOL: 0 is now overloaded over the new sort "zero", allowing its use with
 other numeric types and also as the identity of groups, rings, etc.;
 
 * HOL: new axclass plus_ac0 for addition with the AC-laws and 0 as identity.
 Types nat and int belong to this axclass;
 
 * HOL: greatly improved simplification involving numerals of type nat, int, real:
    (i + #8 + j) = Suc k simplifies to  #7 + (i + j) = k
    i*j + k + j*#3*i     simplifies to  #4*(i*j) + k
   two terms #m*u and #n*u are replaced by #(m+n)*u
     (where #m, #n and u can implicitly be 1; this is simproc combine_numerals)
   and the term/formula #m*u+x ~~ #n*u+y simplifies simplifies to #(m-n)+x ~~ y
     or x ~~ #(n-m)+y, where ~~ is one of = < <= or - (simproc cancel_numerals);
 
 * HOL: meson_tac is available (previously in ex/meson.ML); it is a
 powerful prover for predicate logic but knows nothing of clasets; see
 ex/mesontest.ML and ex/mesontest2.ML for example applications;
 
 * HOL: new version of "case_tac" subsumes both boolean case split and
 "exhaust_tac" on datatypes; INCOMPATIBILITY: exhaust_tac no longer
 exists, may define val exhaust_tac = case_tac for ad-hoc portability;
 
 * HOL: simplification no longer dives into case-expressions: only the
 selector expression is simplified, but not the remaining arms; to
 enable full simplification of case-expressions for datatype t, you may
 remove t.weak_case_cong from the simpset, either globally (Delcongs
 [thm"t.weak_case_cong"];) or locally (delcongs [...]).
 
 * HOL/recdef: the recursion equations generated by 'recdef' for
 function 'f' are now called f.simps instead of f.rules; if all
 termination conditions are proved automatically, these simplification
 rules are added to the simpset, as in primrec; rules may be named
 individually as well, resulting in a separate list of theorems for
 each equation;
 
 * HOL/While is a new theory that provides a while-combinator. It
 permits the definition of tail-recursive functions without the
 provision of a termination measure. The latter is necessary once the
 invariant proof rule for while is applied.
 
 * HOL: new (overloaded) notation for the set of elements below/above
 some element: {..u}, {..u(}, {l..}, {)l..}. See theory SetInterval.
 
 * HOL: theorems impI, allI, ballI bound as "strip";
 
 * HOL: new tactic induct_thm_tac: thm -> string -> int -> tactic
 induct_tac th "x1 ... xn" expects th to have a conclusion of the form
 P v1 ... vn and abbreviates res_inst_tac [("v1","x1"),...,("vn","xn")] th;
 
 * HOL/Real: "rabs" replaced by overloaded "abs" function;
 
 * HOL: theory Sexp now in HOL/Induct examples (it used to be part of
 main HOL, but was unused);
 
 * HOL: fewer consts declared as global (e.g. have to refer to
 "Lfp.lfp" instead of "lfp" internally; affects ML packages only);
 
 * HOL: tuned AST representation of nested pairs, avoiding bogus output
 in case of overlap with user translations (e.g. judgements over
 tuples); (note that the underlying logical represenation is still
 bogus);
 
 
 *** ZF ***
 
 * ZF: simplification automatically cancels common terms in arithmetic
 expressions over nat and int;
 
 * ZF: new treatment of nat to minimize type-checking: all operators
 coerce their operands to a natural number using the function natify,
 making the algebraic laws unconditional;
 
 * ZF: as above, for int: operators coerce their operands to an integer
 using the function intify;
 
 * ZF: the integer library now contains many of the usual laws for the
 orderings, including $<=, and monotonicity laws for $+ and $*;
 
 * ZF: new example ZF/ex/NatSum to demonstrate integer arithmetic
 simplification;
 
 * FOL and ZF: AddIffs now available, giving theorems of the form P<->Q
 to the simplifier and classical reasoner simultaneously;
 
 
 *** General ***
 
 * Provers: blast_tac now handles actual object-logic rules as
 assumptions; note that auto_tac uses blast_tac internally as well;
 
 * Provers: new functions rulify/rulify_no_asm: thm -> thm for turning
 outer -->/All/Ball into ==>/!!; qed_spec_mp now uses rulify_no_asm;
 
 * Provers: delrules now handles destruct rules as well (no longer need
 explicit make_elim);
 
 * Provers: Blast_tac now warns of and ignores "weak elimination rules" e.g.
   [| inj ?f;          ?f ?x = ?f ?y; ?x = ?y ==> ?W |] ==> ?W
 use instead the strong form,
   [| inj ?f; ~ ?W ==> ?f ?x = ?f ?y; ?x = ?y ==> ?W |] ==> ?W
 in HOL, FOL and ZF the function cla_make_elim will create such rules
 from destruct-rules;
 
 * Provers: Simplifier.easy_setup provides a fast path to basic
 Simplifier setup for new object-logics;
 
 * Pure: AST translation rules no longer require constant head on LHS;
 
 * Pure: improved name spaces: ambiguous output is qualified; support
 for hiding of names;
 
 * system: smart setup of canonical ML_HOME, ISABELLE_INTERFACE, and
 XSYMBOL_HOME; no longer need to do manual configuration in most
 situations;
 
 * system: compression of ML heaps images may now be controlled via -c
 option of isabelle and isatool usedir (currently only observed by
 Poly/ML);
 
 * system: isatool installfonts may handle X-Symbol fonts as well (very
 useful for remote X11);
 
 * system: provide TAGS file for Isabelle sources;
 
 * ML: infix 'OF' is a version of 'MRS' with more appropriate argument
 order;
 
 * ML: renamed flags Syntax.trace_norm_ast to Syntax.trace_ast; global
 timing flag supersedes proof_timing and Toplevel.trace;
 
 * ML: new combinators |>> and |>>> for incremental transformations
 with secondary results (e.g. certain theory extensions):
 
 * ML: PureThy.add_defs gets additional argument to indicate potential
 overloading (usually false);
 
 * ML: PureThy.add_thms/add_axioms/add_defs now return theorems as
 results;
 
 
 
 New in Isabelle99 (October 1999)
 --------------------------------
 
 *** Overview of INCOMPATIBILITIES (see below for more details) ***
 
 * HOL: The THEN and ELSE parts of conditional expressions (if P then x else y)
 are no longer simplified.  (This allows the simplifier to unfold recursive
 functional programs.)  To restore the old behaviour, declare
 
     Delcongs [if_weak_cong];
 
 * HOL: Removed the obsolete syntax "Compl A"; use -A for set
 complement;
 
 * HOL: the predicate "inj" is now defined by translation to "inj_on";
 
 * HOL/datatype: mutual_induct_tac no longer exists --
   use induct_tac "x_1 ... x_n" instead of mutual_induct_tac ["x_1", ..., "x_n"]
 
 * HOL/typedef: fixed type inference for representing set; type
 arguments now have to occur explicitly on the rhs as type constraints;
 
 * ZF: The con_defs part of an inductive definition may no longer refer
 to constants declared in the same theory;
 
 * HOL, ZF: the function mk_cases, generated by the inductive
 definition package, has lost an argument.  To simplify its result, it
 uses the default simpset instead of a supplied list of theorems.
 
 * HOL/List: the constructors of type list are now Nil and Cons;
 
 * Simplifier: the type of the infix ML functions
         setSSolver addSSolver setSolver addSolver
 is now  simpset * solver -> simpset  where `solver' is a new abstract type
 for packaging solvers. A solver is created via
         mk_solver: string -> (thm list -> int -> tactic) -> solver
 where the string argument is only a comment.
 
 
 *** Proof tools ***
 
 * Provers/Arith/fast_lin_arith.ML contains a functor for creating a
 decision procedure for linear arithmetic. Currently it is used for
 types `nat', `int', and `real' in HOL (see below); it can, should and
 will be instantiated for other types and logics as well.
 
 * The simplifier now accepts rewrite rules with flexible heads, eg
      hom ?f ==> ?f(?x+?y) = ?f ?x + ?f ?y
   They are applied like any rule with a non-pattern lhs, i.e. by first-order
   matching.
 
 
 *** General ***
 
 * New Isabelle/Isar subsystem provides an alternative to traditional
 tactical theorem proving; together with the ProofGeneral/isar user
 interface it offers an interactive environment for developing human
 readable proof documents (Isar == Intelligible semi-automated
 reasoning); for further information see isatool doc isar-ref,
 src/HOL/Isar_examples and http://isabelle.in.tum.de/Isar/
 
 * improved and simplified presentation of theories: better HTML markup
 (including colors), graph views in several sizes; isatool usedir now
 provides a proper interface for user theories (via -P option); actual
 document preparation based on (PDF)LaTeX is available as well (for
 new-style theories only); see isatool doc system for more information;
 
 * native support for Proof General, both for classic Isabelle and
 Isabelle/Isar;
 
 * ML function thm_deps visualizes dependencies of theorems and lemmas,
 using the graph browser tool;
 
 * Isabelle manuals now also available as PDF;
 
 * theory loader rewritten from scratch (may not be fully
 bug-compatible); old loadpath variable has been replaced by show_path,
 add_path, del_path, reset_path functions; new operations such as
 update_thy, touch_thy, remove_thy, use/update_thy_only (see also
 isatool doc ref);
 
 * improved isatool install: option -k creates KDE application icon,
 option -p DIR installs standalone binaries;
 
 * added ML_PLATFORM setting (useful for cross-platform installations);
 more robust handling of platform specific ML images for SML/NJ;
 
 * the settings environment is now statically scoped, i.e. it is never
 created again in sub-processes invoked from isabelle, isatool, or
 Isabelle;
 
 * path element specification '~~' refers to '$ISABELLE_HOME';
 
 * in locales, the "assumes" and "defines" parts may be omitted if
 empty;
 
 * new print_mode "xsymbols" for extended symbol support (e.g. genuine
 long arrows);
 
 * new print_mode "HTML";
 
 * new flag show_tags controls display of tags of theorems (which are
 basically just comments that may be attached by some tools);
 
 * Isamode 2.6 requires patch to accomodate change of Isabelle font
 mode and goal output format:
 
 diff -r Isamode-2.6/elisp/isa-load.el Isamode/elisp/isa-load.el
 244c244
 <       (list (isa-getenv "ISABELLE") "-msymbols" logic-name)
 ---
 >       (list (isa-getenv "ISABELLE") "-misabelle_font" "-msymbols" logic-name)
 diff -r Isabelle-2.6/elisp/isa-proofstate.el Isamode/elisp/isa-proofstate.el
 181c181
 < (defconst proofstate-proofstart-regexp "^Level [0-9]+$"
 ---
 > (defconst proofstate-proofstart-regexp "^Level [0-9]+"
 
 * function bind_thms stores lists of theorems (cf. bind_thm);
 
 * new shorthand tactics ftac, eatac, datac, fatac;
 
 * qed (and friends) now accept "" as result name; in that case the
 theorem is not stored, but proper checks and presentation of the
 result still apply;
 
 * theorem database now also indexes constants "Trueprop", "all",
 "==>", "=="; thus thms_containing, findI etc. may retrieve more rules;
 
 
 *** HOL ***
 
 ** HOL arithmetic **
 
 * There are now decision procedures for linear arithmetic over nat and
 int:
 
 1. arith_tac copes with arbitrary formulae involving `=', `<', `<=',
 `+', `-', `Suc', `min', `max' and numerical constants; other subterms
 are treated as atomic; subformulae not involving type `nat' or `int'
 are ignored; quantified subformulae are ignored unless they are
 positive universal or negative existential. The tactic has to be
 invoked by hand and can be a little bit slow. In particular, the
 running time is exponential in the number of occurrences of `min' and
 `max', and `-' on `nat'.
 
 2. fast_arith_tac is a cut-down version of arith_tac: it only takes
 (negated) (in)equalities among the premises and the conclusion into
 account (i.e. no compound formulae) and does not know about `min' and
 `max', and `-' on `nat'. It is fast and is used automatically by the
 simplifier.
 
 NB: At the moment, these decision procedures do not cope with mixed
 nat/int formulae where the two parts interact, such as `m < n ==>
 int(m) < int(n)'.
 
 * HOL/Numeral provides a generic theory of numerals (encoded
 efficiently as bit strings); setup for types nat/int/real is in place;
 INCOMPATIBILITY: since numeral syntax is now polymorphic, rather than
 int, existing theories and proof scripts may require a few additional
 type constraints;
 
 * integer division and remainder can now be performed on constant
 arguments;
 
 * many properties of integer multiplication, division and remainder
 are now available;
 
 * An interface to the Stanford Validity Checker (SVC) is available through the
 tactic svc_tac.  Propositional tautologies and theorems of linear arithmetic
 are proved automatically.  SVC must be installed separately, and its results
 must be TAKEN ON TRUST (Isabelle does not check the proofs, but tags any
 invocation of the underlying oracle).  For SVC see
   http://verify.stanford.edu/SVC
 
 * IsaMakefile: the HOL-Real target now builds an actual image;
 
 
 ** HOL misc **
 
 * HOL/Real/HahnBanach: the Hahn-Banach theorem for real vector spaces
 (in Isabelle/Isar) -- by Gertrud Bauer;
 
 * HOL/BCV: generic model of bytecode verification, i.e. data-flow
 analysis for assembly languages with subtypes;
 
 * HOL/TLA (Lamport's Temporal Logic of Actions): major reorganization
 -- avoids syntactic ambiguities and treats state, transition, and
 temporal levels more uniformly; introduces INCOMPATIBILITIES due to
 changed syntax and (many) tactics;
 
 * HOL/inductive: Now also handles more general introduction rules such
   as "ALL y. (y, x) : r --> y : acc r ==> x : acc r"; monotonicity
   theorems are now maintained within the theory (maintained via the
   "mono" attribute);
 
 * HOL/datatype: Now also handles arbitrarily branching datatypes
   (using function types) such as
 
   datatype 'a tree = Atom 'a | Branch "nat => 'a tree"
 
 * HOL/record: record_simproc (part of the default simpset) takes care
 of selectors applied to updated records; record_split_tac is no longer
 part of the default claset; update_defs may now be removed from the
 simpset in many cases; COMPATIBILITY: old behavior achieved by
 
   claset_ref () := claset() addSWrapper record_split_wrapper;
   Delsimprocs [record_simproc]
 
 * HOL/typedef: fixed type inference for representing set; type
 arguments now have to occur explicitly on the rhs as type constraints;
 
 * HOL/recdef (TFL): 'congs' syntax now expects comma separated list of theorem
 names rather than an ML expression;
 
 * HOL/defer_recdef (TFL): like recdef but the well-founded relation can be
 supplied later.  Program schemes can be defined, such as
     "While B C s = (if B s then While B C (C s) else s)"
 where the well-founded relation can be chosen after B and C have been given.
 
 * HOL/List: the constructors of type list are now Nil and Cons;
 INCOMPATIBILITY: while [] and infix # syntax is still there, of
 course, ML tools referring to List.list.op # etc. have to be adapted;
 
 * HOL_quantifiers flag superseded by "HOL" print mode, which is
 disabled by default; run isabelle with option -m HOL to get back to
 the original Gordon/HOL-style output;
 
 * HOL/Ord.thy: new bounded quantifier syntax (input only): ALL x<y. P,
 ALL x<=y. P, EX x<y. P, EX x<=y. P;
 
 * HOL basic syntax simplified (more orthogonal): all variants of
 All/Ex now support plain / symbolic / HOL notation; plain syntax for
 Eps operator is provided as well: "SOME x. P[x]";
 
 * HOL/Sum.thy: sum_case has been moved to HOL/Datatype;
 
 * HOL/Univ.thy: infix syntax <*>, <+>, <**>, <+> eliminated and made
 thus available for user theories;
 
 * HOLCF/IOA/Sequents: renamed 'Cons' to 'Consq' to avoid clash with
 HOL/List; hardly an INCOMPATIBILITY since '>>' syntax is used all the
 time;
 
 * HOL: new tactic smp_tac: int -> int -> tactic, which applies spec
 several times and then mp;
 
 
 *** LK ***
 
 * the notation <<...>> is now available as a notation for sequences of
 formulas;
 
 * the simplifier is now installed
 
 * the axiom system has been generalized (thanks to Soren Heilmann)
 
 * the classical reasoner now has a default rule database
 
 
 *** ZF ***
 
 * new primrec section allows primitive recursive functions to be given
 directly (as in HOL) over datatypes and the natural numbers;
 
 * new tactics induct_tac and exhaust_tac for induction (or case
 analysis) over datatypes and the natural numbers;
 
 * the datatype declaration of type T now defines the recursor T_rec;
 
 * simplification automatically does freeness reasoning for datatype
 constructors;
 
 * automatic type-inference, with AddTCs command to insert new
 type-checking rules;
 
 * datatype introduction rules are now added as Safe Introduction rules
 to the claset;
 
 * the syntax "if P then x else y" is now available in addition to
 if(P,x,y);
 
 
 *** Internal programming interfaces ***
 
 * tuned simplifier trace output; new flag debug_simp;
 
 * structures Vartab / Termtab (instances of TableFun) offer efficient
 tables indexed by indexname_ord / term_ord (compatible with aconv);
 
 * AxClass.axclass_tac lost the theory argument;
 
 * tuned current_goals_markers semantics: begin / end goal avoids
 printing empty lines;
 
 * removed prs and prs_fn hook, which was broken because it did not
 include \n in its semantics, forcing writeln to add one
 uncoditionally; replaced prs_fn by writeln_fn; consider std_output:
 string -> unit if you really want to output text without newline;
 
 * Symbol.output subject to print mode; INCOMPATIBILITY: defaults to
 plain output, interface builders may have to enable 'isabelle_font'
 mode to get Isabelle font glyphs as before;
 
 * refined token_translation interface; INCOMPATIBILITY: output length
 now of type real instead of int;
 
 * theory loader actions may be traced via new ThyInfo.add_hook
 interface (see src/Pure/Thy/thy_info.ML); example application: keep
 your own database of information attached to *whole* theories -- as
 opposed to intra-theory data slots offered via TheoryDataFun;
 
 * proper handling of dangling sort hypotheses (at last!);
 Thm.strip_shyps and Drule.strip_shyps_warning take care of removing
 extra sort hypotheses that can be witnessed from the type signature;
 the force_strip_shyps flag is gone, any remaining shyps are simply
 left in the theorem (with a warning issued by strip_shyps_warning);
 
 
 
 New in Isabelle98-1 (October 1998)
 ----------------------------------
 
 *** Overview of INCOMPATIBILITIES (see below for more details) ***
 
 * several changes of automated proof tools;
 
 * HOL: major changes to the inductive and datatype packages, including
 some minor incompatibilities of theory syntax;
 
 * HOL: renamed r^-1 to 'converse' from 'inverse'; 'inj_onto' is now
 called `inj_on';
 
 * HOL: removed duplicate thms in Arith:
   less_imp_add_less  should be replaced by  trans_less_add1
   le_imp_add_le      should be replaced by  trans_le_add1
 
 * HOL: unary minus is now overloaded (new type constraints may be
 required);
 
 * HOL and ZF: unary minus for integers is now #- instead of #~.  In
 ZF, expressions such as n#-1 must be changed to n#- 1, since #-1 is
 now taken as an integer constant.
 
 * Pure: ML function 'theory_of' renamed to 'theory';
 
 
 *** Proof tools ***
 
 * Simplifier:
   1. Asm_full_simp_tac is now more aggressive.
      1. It will sometimes reorient premises if that increases their power to
         simplify.
      2. It does no longer proceed strictly from left to right but may also
         rotate premises to achieve further simplification.
      For compatibility reasons there is now Asm_lr_simp_tac which is like the
      old Asm_full_simp_tac in that it does not rotate premises.
   2. The simplifier now knows a little bit about nat-arithmetic.
 
 * Classical reasoner: wrapper mechanism for the classical reasoner now
 allows for selected deletion of wrappers, by introduction of names for
 wrapper functionals.  This implies that addbefore, addSbefore,
 addaltern, and addSaltern now take a pair (name, tactic) as argument,
 and that adding two tactics with the same name overwrites the first
 one (emitting a warning).
   type wrapper = (int -> tactic) -> (int -> tactic)
   setWrapper, setSWrapper, compWrapper and compSWrapper are replaced by
   addWrapper, addSWrapper: claset * (string * wrapper) -> claset
   delWrapper, delSWrapper: claset *  string            -> claset
   getWrapper is renamed to appWrappers, getSWrapper to appSWrappers;
 
 * Classical reasoner: addbefore/addSbefore now have APPEND/ORELSE
 semantics; addbefore now affects only the unsafe part of step_tac
 etc.; this affects addss/auto_tac/force_tac, so EXISTING PROOFS MAY
 FAIL, but proofs should be fixable easily, e.g. by replacing Auto_tac
 by Force_tac;
 
 * Classical reasoner: setwrapper to setWrapper and compwrapper to
 compWrapper; added safe wrapper (and access functions for it);
 
 * HOL/split_all_tac is now much faster and fails if there is nothing
 to split.  Some EXISTING PROOFS MAY REQUIRE ADAPTION because the order
 and the names of the automatically generated variables have changed.
 split_all_tac has moved within claset() from unsafe wrappers to safe
 wrappers, which means that !!-bound variables are split much more
 aggressively, and safe_tac and clarify_tac now split such variables.
 If this splitting is not appropriate, use delSWrapper "split_all_tac".
 Note: the same holds for record_split_tac, which does the job of
 split_all_tac for record fields.
 
 * HOL/Simplifier: Rewrite rules for case distinctions can now be added
 permanently to the default simpset using Addsplits just like
 Addsimps. They can be removed via Delsplits just like
 Delsimps. Lower-case versions are also available.
 
 * HOL/Simplifier: The rule split_if is now part of the default
 simpset. This means that the simplifier will eliminate all occurrences
 of if-then-else in the conclusion of a goal. To prevent this, you can
 either remove split_if completely from the default simpset by
 `Delsplits [split_if]' or remove it in a specific call of the
 simplifier using `... delsplits [split_if]'.  You can also add/delete
 other case splitting rules to/from the default simpset: every datatype
 generates suitable rules `split_t_case' and `split_t_case_asm' (where
 t is the name of the datatype).
 
 * Classical reasoner / Simplifier combination: new force_tac (and
 derivatives Force_tac, force) combines rewriting and classical
 reasoning (and whatever other tools) similarly to auto_tac, but is
 aimed to solve the given subgoal completely.
 
 
 *** General ***
 
 * new top-level commands `Goal' and `Goalw' that improve upon `goal'
 and `goalw': the theory is no longer needed as an explicit argument -
 the current theory context is used; assumptions are no longer returned
 at the ML-level unless one of them starts with ==> or !!; it is
 recommended to convert to these new commands using isatool fixgoal
 (backup your sources first!);
 
 * new top-level commands 'thm' and 'thms' for retrieving theorems from
 the current theory context, and 'theory' to lookup stored theories;
 
 * new theory section 'locale' for declaring constants, assumptions and
 definitions that have local scope;
 
 * new theory section 'nonterminals' for purely syntactic types;
 
 * new theory section 'setup' for generic ML setup functions
 (e.g. package initialization);
 
 * the distribution now includes Isabelle icons: see
 lib/logo/isabelle-{small,tiny}.xpm;
 
 * isatool install - install binaries with absolute references to
 ISABELLE_HOME/bin;
 
 * isatool logo -- create instances of the Isabelle logo (as EPS);
 
 * print mode 'emacs' reserved for Isamode;
 
 * support multiple print (ast) translations per constant name;
 
 * theorems involving oracles are now printed with a suffixed [!];
 
 
 *** HOL ***
 
 * there is now a tutorial on Isabelle/HOL (do 'isatool doc tutorial');
 
 * HOL/inductive package reorganized and improved: now supports mutual
 definitions such as
 
   inductive EVEN ODD
     intrs
       null "0 : EVEN"
       oddI "n : EVEN ==> Suc n : ODD"
       evenI "n : ODD ==> Suc n : EVEN"
 
 new theorem list "elims" contains an elimination rule for each of the
 recursive sets; inductive definitions now handle disjunctive premises
 correctly (also ZF);
 
 INCOMPATIBILITIES: requires Inductive as an ancestor; component
 "mutual_induct" no longer exists - the induction rule is always
 contained in "induct";
 
 
 * HOL/datatype package re-implemented and greatly improved: now
 supports mutually recursive datatypes such as
 
   datatype
     'a aexp = IF_THEN_ELSE ('a bexp) ('a aexp) ('a aexp)
             | SUM ('a aexp) ('a aexp)
             | DIFF ('a aexp) ('a aexp)
             | NUM 'a
   and
     'a bexp = LESS ('a aexp) ('a aexp)
             | AND ('a bexp) ('a bexp)
             | OR ('a bexp) ('a bexp)
 
 as well as indirectly recursive datatypes such as
 
   datatype
     ('a, 'b) term = Var 'a
                   | App 'b ((('a, 'b) term) list)
 
 The new tactic  mutual_induct_tac [<var_1>, ..., <var_n>] i  performs
 induction on mutually / indirectly recursive datatypes.
 
 Primrec equations are now stored in theory and can be accessed via
 <function_name>.simps.
 
 INCOMPATIBILITIES:
 
   - Theories using datatypes must now have theory Datatype as an
     ancestor.
   - The specific <typename>.induct_tac no longer exists - use the
     generic induct_tac instead.
   - natE has been renamed to nat.exhaust - use exhaust_tac
     instead of res_inst_tac ... natE. Note that the variable
     names in nat.exhaust differ from the names in natE, this
     may cause some "fragile" proofs to fail.
   - The theorems split_<typename>_case and split_<typename>_case_asm
     have been renamed to <typename>.split and <typename>.split_asm.
   - Since default sorts of type variables are now handled correctly,
     some datatype definitions may have to be annotated with explicit
     sort constraints.
   - Primrec definitions no longer require function name and type
     of recursive argument.
 
 Consider using isatool fixdatatype to adapt your theories and proof
 scripts to the new package (backup your sources first!).
 
 
 * HOL/record package: considerably improved implementation; now
 includes concrete syntax for record types, terms, updates; theorems
 for surjective pairing and splitting !!-bound record variables; proof
 support is as follows:
 
   1) standard conversions (selectors or updates applied to record
 constructor terms) are part of the standard simpset;
 
   2) inject equations of the form ((x, y) = (x', y')) == x=x' & y=y' are
 made part of standard simpset and claset via addIffs;
 
   3) a tactic for record field splitting (record_split_tac) is part of
 the standard claset (addSWrapper);
 
 To get a better idea about these rules you may retrieve them via
 something like 'thms "foo.simps"' or 'thms "foo.iffs"', where "foo" is
 the name of your record type.
 
 The split tactic 3) conceptually simplifies by the following rule:
 
   "(!!x. PROP ?P x) == (!!a b. PROP ?P (a, b))"
 
 Thus any record variable that is bound by meta-all will automatically
 blow up into some record constructor term, consequently the
 simplifications of 1), 2) apply.  Thus force_tac, auto_tac etc. shall
 solve record problems automatically.
 
 
 * reorganized the main HOL image: HOL/Integ and String loaded by
 default; theory Main includes everything;
 
 * automatic simplification of integer sums and comparisons, using cancellation;
 
 * added option_map_eq_Some and not_Some_eq to the default simpset and claset;
 
 * added disj_not1 = "(~P | Q) = (P --> Q)" to the default simpset;
 
 * many new identities for unions, intersections, set difference, etc.;
 
 * expand_if, expand_split, expand_sum_case and expand_nat_case are now
 called split_if, split_split, split_sum_case and split_nat_case (to go
 with add/delsplits);
 
 * HOL/Prod introduces simplification procedure unit_eq_proc rewriting
 (?x::unit) = (); this is made part of the default simpset, which COULD
 MAKE EXISTING PROOFS FAIL under rare circumstances (consider
 'Delsimprocs [unit_eq_proc];' as last resort); also note that
 unit_abs_eta_conv is added in order to counter the effect of
 unit_eq_proc on (%u::unit. f u), replacing it by f rather than by
 %u.f();
 
 * HOL/Fun INCOMPATIBILITY: `inj_onto' is now called `inj_on' (which
 makes more sense);
 
 * HOL/Set INCOMPATIBILITY: rule `equals0D' is now a well-formed destruct rule;
   It and 'sym RS equals0D' are now in the default  claset, giving automatic
   disjointness reasoning but breaking a few old proofs.
 
 * HOL/Relation INCOMPATIBILITY: renamed the relational operator r^-1
 to 'converse' from 'inverse' (for compatibility with ZF and some
 literature);
 
 * HOL/recdef can now declare non-recursive functions, with {} supplied as
 the well-founded relation;
 
 * HOL/Set INCOMPATIBILITY: the complement of set A is now written -A instead of
     Compl A.  The "Compl" syntax remains available as input syntax for this
     release ONLY.
 
 * HOL/Update: new theory of function updates:
     f(a:=b) == %x. if x=a then b else f x
 may also be iterated as in f(a:=b,c:=d,...);
 
 * HOL/Vimage: new theory for inverse image of a function, syntax f-``B;
 
 * HOL/List:
   - new function list_update written xs[i:=v] that updates the i-th
     list position. May also be iterated as in xs[i:=a,j:=b,...].
   - new function `upt' written [i..j(] which generates the list
     [i,i+1,...,j-1], i.e. the upper bound is excluded. To include the upper
     bound write [i..j], which is a shorthand for [i..j+1(].
   - new lexicographic orderings and corresponding wellfoundedness theorems.
 
 * HOL/Arith:
   - removed 'pred' (predecessor) function;
   - generalized some theorems about n-1;
   - many new laws about "div" and "mod";
   - new laws about greatest common divisors (see theory ex/Primes);
 
 * HOL/Relation: renamed the relational operator r^-1 "converse"
 instead of "inverse";
 
 * HOL/Induct/Multiset: a theory of multisets, including the wellfoundedness
   of the multiset ordering;
 
 * directory HOL/Real: a construction of the reals using Dedekind cuts
   (not included by default);
 
 * directory HOL/UNITY: Chandy and Misra's UNITY formalism;
 
 * directory HOL/Hoare: a new version of Hoare logic which permits many-sorted
   programs, i.e. different program variables may have different types.
 
 * calling (stac rew i) now fails if "rew" has no effect on the goal
   [previously, this check worked only if the rewrite rule was unconditional]
   Now rew can involve either definitions or equalities (either == or =).
 
 
 *** ZF ***
 
 * theory Main includes everything; INCOMPATIBILITY: theory ZF.thy contains
   only the theorems proved on ZF.ML;
 
 * ZF INCOMPATIBILITY: rule `equals0D' is now a well-formed destruct rule;
   It and 'sym RS equals0D' are now in the default  claset, giving automatic
   disjointness reasoning but breaking a few old proofs.
 
 * ZF/Update: new theory of function updates
     with default rewrite rule  f(x:=y) ` z = if(z=x, y, f`z)
   may also be iterated as in f(a:=b,c:=d,...);
 
 * in  let x=t in u(x), neither t nor u(x) has to be an FOL term.
 
 * calling (stac rew i) now fails if "rew" has no effect on the goal
   [previously, this check worked only if the rewrite rule was unconditional]
   Now rew can involve either definitions or equalities (either == or =).
 
 * case_tac provided for compatibility with HOL
     (like the old excluded_middle_tac, but with subgoals swapped)
 
 
 *** Internal programming interfaces ***
 
 * Pure: several new basic modules made available for general use, see
 also src/Pure/README;
 
 * improved the theory data mechanism to support encapsulation (data
 kind name replaced by private Object.kind, acting as authorization
 key); new type-safe user interface via functor TheoryDataFun; generic
 print_data function becomes basically useless;
 
 * removed global_names compatibility flag -- all theory declarations
 are qualified by default;
 
 * module Pure/Syntax now offers quote / antiquote translation
 functions (useful for Hoare logic etc. with implicit dependencies);
 see HOL/ex/Antiquote for an example use;
 
 * Simplifier now offers conversions (asm_)(full_)rewrite: simpset ->
 cterm -> thm;
 
 * new tactical CHANGED_GOAL for checking that a tactic modifies a
 subgoal;
 
 * Display.print_goals function moved to Locale.print_goals;
 
 * standard print function for goals supports current_goals_markers
 variable for marking begin of proof, end of proof, start of goal; the
 default is ("", "", ""); setting current_goals_markers := ("<proof>",
 "</proof>", "<goal>") causes SGML like tagged proof state printing,
 for example;
 
 
 
 New in Isabelle98 (January 1998)
 --------------------------------
 
 *** Overview of INCOMPATIBILITIES (see below for more details) ***
 
 * changed lexical syntax of terms / types: dots made part of long
 identifiers, e.g. "%x.x" no longer possible, should be "%x. x";
 
 * simpset (and claset) reference variable replaced by functions
 simpset / simpset_ref;
 
 * no longer supports theory aliases (via merge) and non-trivial
 implicit merge of thms' signatures;
 
 * most internal names of constants changed due to qualified names;
 
 * changed Pure/Sequence interface (see Pure/seq.ML);
 
 
 *** General Changes ***
 
 * hierachically structured name spaces (for consts, types, axms, thms
 etc.); new lexical class 'longid' (e.g. Foo.bar.x) may render much of
 old input syntactically incorrect (e.g. "%x.x"); COMPATIBILITY:
 isatool fixdots ensures space after dots (e.g. "%x. x"); set
 long_names for fully qualified output names; NOTE: ML programs
 (special tactics, packages etc.) referring to internal names may have
 to be adapted to cope with fully qualified names; in case of severe
 backward campatibility problems try setting 'global_names' at compile
 time to have enrything declared within a flat name space; one may also
 fine tune name declarations in theories via the 'global' and 'local'
 section;
 
 * reimplemented the implicit simpset and claset using the new anytype
 data filed in signatures; references simpset:simpset ref etc. are
 replaced by functions simpset:unit->simpset and
 simpset_ref:unit->simpset ref; COMPATIBILITY: use isatool fixclasimp
 to patch your ML files accordingly;
 
 * HTML output now includes theory graph data for display with Java
 applet or isatool browser; data generated automatically via isatool
 usedir (see -i option, ISABELLE_USEDIR_OPTIONS);
 
 * defs may now be conditional; improved rewrite_goals_tac to handle
 conditional equations;
 
 * defs now admits additional type arguments, using TYPE('a) syntax;
 
 * theory aliases via merge (e.g. M=A+B+C) no longer supported, always
 creates a new theory node; implicit merge of thms' signatures is
 restricted to 'trivial' ones; COMPATIBILITY: one may have to use
 transfer:theory->thm->thm in (rare) cases;
 
 * improved handling of draft signatures / theories; draft thms (and
 ctyps, cterms) are automatically promoted to real ones;
 
 * slightly changed interfaces for oracles: admit many per theory, named
 (e.g. oracle foo = mlfun), additional name argument for invoke_oracle;
 
 * print_goals: optional output of const types (set show_consts and
 show_types);
 
 * improved output of warnings (###) and errors (***);
 
 * subgoal_tac displays a warning if the new subgoal has type variables;
 
 * removed old README and Makefiles;
 
 * replaced print_goals_ref hook by print_current_goals_fn and result_error_fn;
 
 * removed obsolete init_pps and init_database;
 
 * deleted the obsolete tactical STATE, which was declared by
     fun STATE tacfun st = tacfun st st;
 
 * cd and use now support path variables, e.g. $ISABELLE_HOME, or ~
 (which abbreviates $HOME);
 
 * changed Pure/Sequence interface (see Pure/seq.ML); COMPATIBILITY:
 use isatool fixseq to adapt your ML programs (this works for fully
 qualified references to the Sequence structure only!);
 
 * use_thy no longer requires writable current directory; it always
 reloads .ML *and* .thy file, if either one is out of date;
 
 
 *** Classical Reasoner ***
 
 * Clarify_tac, clarify_tac, clarify_step_tac, Clarify_step_tac: new
 tactics that use classical reasoning to simplify a subgoal without
 splitting it into several subgoals;
 
 * Safe_tac: like safe_tac but uses the default claset;
 
 
 *** Simplifier ***
 
 * added simplification meta rules:
     (asm_)(full_)simplify: simpset -> thm -> thm;
 
 * simplifier.ML no longer part of Pure -- has to be loaded by object
 logics (again);
 
 * added prems argument to simplification procedures;
 
 * HOL, FOL, ZF: added infix function `addsplits':
   instead of `<simpset> setloop (split_tac <thms>)'
   you can simply write `<simpset> addsplits <thms>'
 
 
 *** Syntax ***
 
 * TYPE('a) syntax for type reflection terms;
 
 * no longer handles consts with name "" -- declare as 'syntax' instead;
 
 * pretty printer: changed order of mixfix annotation preference (again!);
 
 * Pure: fixed idt/idts vs. pttrn/pttrns syntactic categories;
 
 
 *** HOL ***
 
 * HOL: there is a new splitter `split_asm_tac' that can be used e.g.
   with `addloop' of the simplifier to faciliate case splitting in premises.
 
 * HOL/TLA: Stephan Merz's formalization of Lamport's Temporal Logic of Actions;
 
 * HOL/Auth: new protocol proofs including some for the Internet
   protocol TLS;
 
 * HOL/Map: new theory of `maps' a la VDM;
 
 * HOL/simplifier: simplification procedures nat_cancel_sums for
 cancelling out common nat summands from =, <, <= (in)equalities, or
 differences; simplification procedures nat_cancel_factor for
 cancelling common factor from =, <, <= (in)equalities over natural
 sums; nat_cancel contains both kinds of procedures, it is installed by
 default in Arith.thy -- this COULD MAKE EXISTING PROOFS FAIL;
 
 * HOL/simplifier: terms of the form
   `? x. P1(x) & ... & Pn(x) & x=t & Q1(x) & ... Qn(x)'  (or t=x)
   are rewritten to
   `P1(t) & ... & Pn(t) & Q1(t) & ... Qn(t)',
   and those of the form
   `! x. P1(x) & ... & Pn(x) & x=t & Q1(x) & ... Qn(x) --> R(x)'  (or t=x)
   are rewritten to
   `P1(t) & ... & Pn(t) & Q1(t) & ... Qn(t) --> R(t)',
 
 * HOL/datatype
   Each datatype `t' now comes with a theorem `split_t_case' of the form
 
   P(t_case f1 ... fn x) =
      ( (!y1 ... ym1. x = C1 y1 ... ym1 --> P(f1 y1 ... ym1)) &
         ...
        (!y1 ... ymn. x = Cn y1 ... ymn --> P(f1 y1 ... ymn))
      )
 
   and a theorem `split_t_case_asm' of the form
 
   P(t_case f1 ... fn x) =
     ~( (? y1 ... ym1. x = C1 y1 ... ym1 & ~P(f1 y1 ... ym1)) |
         ...
        (? y1 ... ymn. x = Cn y1 ... ymn & ~P(f1 y1 ... ymn))
      )
   which can be added to a simpset via `addsplits'. The existing theorems
   expand_list_case and expand_option_case have been renamed to
   split_list_case and split_option_case.
 
 * HOL/Arithmetic:
   - `pred n' is automatically converted to `n-1'.
     Users are strongly encouraged not to use `pred' any longer,
     because it will disappear altogether at some point.
   - Users are strongly encouraged to write "0 < n" rather than
     "n ~= 0". Theorems and proof tools have been modified towards this
     `standard'.
 
 * HOL/Lists:
   the function "set_of_list" has been renamed "set" (and its theorems too);
   the function "nth" now takes its arguments in the reverse order and
   has acquired the infix notation "!" as in "xs!n".
 
 * HOL/Set: UNIV is now a constant and is no longer translated to Compl{};
 
 * HOL/Set: The operator (UN x.B x) now abbreviates (UN x:UNIV. B x) and its
   specialist theorems (like UN1_I) are gone.  Similarly for (INT x.B x);
 
 * HOL/record: extensible records with schematic structural subtyping
 (single inheritance); EXPERIMENTAL version demonstrating the encoding,
 still lacks various theorems and concrete record syntax;
 
 
 *** HOLCF ***
 
 * removed "axioms" and "generated by" sections;
 
 * replaced "ops" section by extended "consts" section, which is capable of
   handling the continuous function space "->" directly;
 
 * domain package:
   . proves theorems immediately and stores them in the theory,
   . creates hierachical name space,
   . now uses normal mixfix annotations (instead of cinfix...),
   . minor changes to some names and values (for consistency),
   . e.g. cases -> casedist, dists_eq -> dist_eqs, [take_lemma] -> take_lemmas,
   . separator between mutual domain defs: changed "," to "and",
   . improved handling of sort constraints;  now they have to
     appear on the left-hand side of the equations only;
 
 * fixed LAM <x,y,zs>.b syntax;
 
 * added extended adm_tac to simplifier in HOLCF -- can now discharge
 adm (%x. P (t x)), where P is chainfinite and t continuous;
 
 
 *** FOL and ZF ***
 
 * FOL: there is a new splitter `split_asm_tac' that can be used e.g.
   with `addloop' of the simplifier to faciliate case splitting in premises.
 
 * qed_spec_mp, qed_goal_spec_mp, qed_goalw_spec_mp are available, as
 in HOL, they strip ALL and --> from proved theorems;
 
 
 
 New in Isabelle94-8 (May 1997)
 ------------------------------
 
 *** General Changes ***
 
 * new utilities to build / run / maintain Isabelle etc. (in parts
 still somewhat experimental); old Makefiles etc. still functional;
 
 * new 'Isabelle System Manual';
 
 * INSTALL text, together with ./configure and ./build scripts;
 
 * reimplemented type inference for greater efficiency, better error
 messages and clean internal interface;
 
 * prlim command for dealing with lots of subgoals (an easier way of
 setting goals_limit);
 
 
 *** Syntax ***
 
 * supports alternative (named) syntax tables (parser and pretty
 printer); internal interface is provided by add_modesyntax(_i);
 
 * Pure, FOL, ZF, HOL, HOLCF now support symbolic input and output; to
 be used in conjunction with the Isabelle symbol font; uses the
 "symbols" syntax table;
 
 * added token_translation interface (may translate name tokens in
 arbitrary ways, dependent on their type (free, bound, tfree, ...) and
 the current print_mode); IMPORTANT: user print translation functions
 are responsible for marking newly introduced bounds
 (Syntax.mark_boundT);
 
 * token translations for modes "xterm" and "xterm_color" that display
 names in bold, underline etc. or colors (which requires a color
 version of xterm);
 
 * infixes may now be declared with names independent of their syntax;
 
 * added typed_print_translation (like print_translation, but may
 access type of constant);
 
 
 *** Classical Reasoner ***
 
 Blast_tac: a new tactic!  It is often more powerful than fast_tac, but has
 some limitations.  Blast_tac...
   + ignores addss, addbefore, addafter; this restriction is intrinsic
   + ignores elimination rules that don't have the correct format
         (the conclusion MUST be a formula variable)
   + ignores types, which can make HOL proofs fail
   + rules must not require higher-order unification, e.g. apply_type in ZF
     [message "Function Var's argument not a bound variable" relates to this]
   + its proof strategy is more general but can actually be slower
 
 * substitution with equality assumptions no longer permutes other
 assumptions;
 
 * minor changes in semantics of addafter (now called addaltern); renamed
 setwrapper to setWrapper and compwrapper to compWrapper; added safe wrapper
 (and access functions for it);
 
 * improved combination of classical reasoner and simplifier:
   + functions for handling clasimpsets
   + improvement of addss: now the simplifier is called _after_ the
     safe steps.
   + safe variant of addss called addSss: uses safe simplifications
     _during_ the safe steps. It is more complete as it allows multiple
     instantiations of unknowns (e.g. with slow_tac).
 
 *** Simplifier ***
 
 * added interface for simplification procedures (functions that
 produce *proven* rewrite rules on the fly, depending on current
 redex);
 
 * ordering on terms as parameter (used for ordered rewriting);
 
 * new functions delcongs, deleqcongs, and Delcongs. richer rep_ss;
 
 * the solver is now split into a safe and an unsafe part.
 This should be invisible for the normal user, except that the
 functions setsolver and addsolver have been renamed to setSolver and
 addSolver; added safe_asm_full_simp_tac;
 
 
 *** HOL ***
 
 * a generic induction tactic `induct_tac' which works for all datatypes and
 also for type `nat';
 
 * a generic case distinction tactic `exhaust_tac' which works for all
 datatypes and also for type `nat';
 
 * each datatype comes with a function `size';
 
 * patterns in case expressions allow tuple patterns as arguments to
 constructors, for example `case x of [] => ... | (x,y,z)#ps => ...';
 
 * primrec now also works with type nat;
 
 * recdef: a new declaration form, allows general recursive functions to be
 defined in theory files.  See HOL/ex/Fib, HOL/ex/Primes, HOL/Subst/Unify.
 
 * the constant for negation has been renamed from "not" to "Not" to
 harmonize with FOL, ZF, LK, etc.;
 
 * HOL/ex/LFilter theory of a corecursive "filter" functional for
 infinite lists;
 
 * HOL/Modelcheck demonstrates invocation of model checker oracle;
 
 * HOL/ex/Ring.thy declares cring_simp, which solves equational
 problems in commutative rings, using axiomatic type classes for + and *;
 
 * more examples in HOL/MiniML and HOL/Auth;
 
 * more default rewrite rules for quantifiers, union/intersection;
 
 * a new constant `arbitrary == @x.False';
 
 * HOLCF/IOA replaces old HOL/IOA;
 
 * HOLCF changes: derived all rules and arities
   + axiomatic type classes instead of classes
   + typedef instead of faking type definitions
   + eliminated the internal constants less_fun, less_cfun, UU_fun, UU_cfun etc.
   + new axclasses cpo, chfin, flat with flat < chfin < pcpo < cpo < po
   + eliminated the types void, one, tr
   + use unit lift and bool lift (with translations) instead of one and tr
   + eliminated blift from Lift3.thy (use Def instead of blift)
   all eliminated rules are derived as theorems --> no visible changes ;
 
 
 *** ZF ***
 
 * ZF now has Fast_tac, Simp_tac and Auto_tac.  Union_iff is a now a default
 rewrite rule; this may affect some proofs.  eq_cs is gone but can be put back
 as ZF_cs addSIs [equalityI];
 
 
 
 New in Isabelle94-7 (November 96)
 ---------------------------------
 
 * allowing negative levels (as offsets) in prlev and choplev;
 
 * super-linear speedup for large simplifications;
 
 * FOL, ZF and HOL now use miniscoping: rewriting pushes
 quantifications in as far as possible (COULD MAKE EXISTING PROOFS
 FAIL); can suppress it using the command Delsimps (ex_simps @
 all_simps); De Morgan laws are also now included, by default;
 
 * improved printing of ==>  :  ~:
 
 * new object-logic "Sequents" adds linear logic, while replacing LK
 and Modal (thanks to Sara Kalvala);
 
 * HOL/Auth: correctness proofs for authentication protocols;
 
 * HOL: new auto_tac combines rewriting and classical reasoning (many
 examples on HOL/Auth);
 
 * HOL: new command AddIffs for declaring theorems of the form P=Q to
 the rewriter and classical reasoner simultaneously;
 
 * function uresult no longer returns theorems in "standard" format;
 regain previous version by: val uresult = standard o uresult;
 
 
 
 New in Isabelle94-6
 -------------------
 
 * oracles -- these establish an interface between Isabelle and trusted
 external reasoners, which may deliver results as theorems;
 
 * proof objects (in particular record all uses of oracles);
 
 * Simp_tac, Fast_tac, etc. that refer to implicit simpset / claset;
 
 * "constdefs" section in theory files;
 
 * "primrec" section (HOL) no longer requires names;
 
 * internal type "tactic" now simply "thm -> thm Sequence.seq";
 
 
 
 New in Isabelle94-5
 -------------------
 
 * reduced space requirements;
 
 * automatic HTML generation from theories;
 
 * theory files no longer require "..." (quotes) around most types;
 
 * new examples, including two proofs of the Church-Rosser theorem;
 
 * non-curried (1994) version of HOL is no longer distributed;
 
 
 
 New in Isabelle94-4
 -------------------
 
 * greatly reduced space requirements;
 
 * theory files (.thy) no longer require \...\ escapes at line breaks;
 
 * searchable theorem database (see the section "Retrieving theorems" on
 page 8 of the Reference Manual);
 
 * new examples, including Grabczewski's monumental case study of the
 Axiom of Choice;
 
 * The previous version of HOL renamed to Old_HOL;
 
 * The new version of HOL (previously called CHOL) uses a curried syntax
 for functions.  Application looks like f a b instead of f(a,b);
 
 * Mutually recursive inductive definitions finally work in HOL;
 
 * In ZF, pattern-matching on tuples is now available in all abstractions and
 translates to the operator "split";
 
 
 
 New in Isabelle94-3
 -------------------
 
 * new infix operator, addss, allowing the classical reasoner to
 perform simplification at each step of its search.  Example:
         fast_tac (cs addss ss)
 
 * a new logic, CHOL, the same as HOL, but with a curried syntax
 for functions.  Application looks like f a b instead of f(a,b).  Also pairs
 look like (a,b) instead of <a,b>;
 
 * PLEASE NOTE: CHOL will eventually replace HOL!
 
 * In CHOL, pattern-matching on tuples is now available in all abstractions.
 It translates to the operator "split".  A new theory of integers is available;
 
 * In ZF, integer numerals now denote two's-complement binary integers.
 Arithmetic operations can be performed by rewriting.  See ZF/ex/Bin.ML;
 
 * Many new examples: I/O automata, Church-Rosser theorem, equivalents
 of the Axiom of Choice;
 
 
 
 New in Isabelle94-2
 -------------------
 
 * Significantly faster resolution;
 
 * the different sections in a .thy file can now be mixed and repeated
 freely;
 
 * Database of theorems for FOL, HOL and ZF.  New
 commands including qed, qed_goal and bind_thm store theorems in the database.
 
 * Simple database queries: return a named theorem (get_thm) or all theorems of
 a given theory (thms_of), or find out what theory a theorem was proved in
 (theory_of_thm);
 
 * Bugs fixed in the inductive definition and datatype packages;
 
 * The classical reasoner provides deepen_tac and depth_tac, making FOL_dup_cs
 and HOL_dup_cs obsolete;
 
 * Syntactic ambiguities caused by the new treatment of syntax in Isabelle94-1
 have been removed;
 
 * Simpler definition of function space in ZF;
 
 * new results about cardinal and ordinal arithmetic in ZF;
 
 * 'subtype' facility in HOL for introducing new types as subsets of existing
 types;
 
 :mode=isabelle-news:wrap=hard:maxLineLen=72:
diff --git a/etc/options b/etc/options
--- a/etc/options
+++ b/etc/options
@@ -1,366 +1,374 @@
 (* :mode=isabelle-options: *)
 
 section "Document Preparation"
 
 option browser_info : bool = false
   -- "generate theory browser information"
 
 option document : string = ""
   -- "build document in given format: pdf, dvi, false"
 option document_output : string = ""
   -- "document output directory"
 option document_variants : string = "document"
   -- "alternative document variants (separated by colons)"
 option document_tags : string = ""
   -- "default command tags (separated by commas)"
+option document_bibliography : bool = false
+  -- "explicitly enable use of bibtex (default: according to presence of root.bib)"
+option document_preprocessor : string = ""
+  -- "document preprocessor: executable relative to document output directory"
+option document_build : string = "lualatex"
+  -- "document build engine (e.g. lualatex, pdflatex, build)"
+option document_logo : string = ""
+  -- "generate named instance of Isabelle logo (underscore means unnamed variant)"
 
 option thy_output_display : bool = false
   -- "indicate output as multi-line display-style material"
 option thy_output_break : bool = false
   -- "control line breaks in non-display material"
 option thy_output_cartouche : bool = false
   -- "indicate if the output should be delimited as cartouche"
 option thy_output_quotes : bool = false
   -- "indicate if the output should be delimited via double quotes"
 option thy_output_margin : int = 76
   -- "right margin / page width for printing of display material"
 option thy_output_indent : int = 0
   -- "indentation for pretty printing of display material"
 option thy_output_source : bool = false
   -- "print original source text rather than internal representation"
 option thy_output_source_cartouche : bool = false
   -- "print original source text rather than internal representation, preserve cartouches"
 option thy_output_modes : string = ""
   -- "additional print modes for document output (separated by commas)"
 
 
 section "Prover Output"
 
 option show_types : bool = false
   -- "show type constraints when printing terms"
 option show_sorts : bool = false
   -- "show sort constraints when printing types"
 option show_brackets : bool = false
   -- "show extra brackets when printing terms/types"
 option show_question_marks : bool = true
   -- "show leading question mark of schematic variables"
 
 option show_consts : bool = false
   -- "show constants with types when printing proof state"
 option show_main_goal : bool = false
   -- "show main goal when printing proof state"
 option goals_limit : int = 10
   -- "maximum number of subgoals to be printed"
 
 option names_long : bool = false
   -- "show fully qualified names"
 option names_short : bool = false
   -- "show base names only"
 option names_unique : bool = true
   -- "show partially qualified names, as required for unique name resolution"
 
 option eta_contract : bool = true
   -- "print terms in eta-contracted form"
 
 option print_mode : string = ""
   -- "additional print modes for prover output (separated by commas)"
 
 
 section "Parallel Processing and Timing"
 
 public option threads : int = 0
   -- "maximum number of worker threads for prover process (0 = hardware max.)"
 option threads_trace : int = 0
   -- "level of tracing information for multithreading"
 option threads_stack_limit : real = 0.25
   -- "maximum stack size for worker threads (in giga words, 0 = unlimited)"
 
 public option parallel_limit : int = 0
   -- "approximative limit for parallel tasks (0 = unlimited)"
 public option parallel_print : bool = true
   -- "parallel and asynchronous printing of results"
 public option parallel_proofs : int = 1
   -- "level of parallel proof checking: 0, 1, 2"
 option parallel_subproofs_threshold : real = 0.01
   -- "lower bound of timing estimate for forked nested proofs (seconds)"
 option parallel_presentation : bool = true
   -- "parallel theory presentation"
 
 option command_timing_threshold : real = 0.1
   -- "default threshold for persistent command timing (seconds)"
 
 public option timeout_scale : real = 1.0
   -- "scale factor for timeout in Isabelle/ML and session build"
 
 
 section "Detail of Proof Checking"
 
 option record_proofs : int = -1
   -- "set level of proofterm recording: 0, 1, 2, negative means unchanged"
 option quick_and_dirty : bool = false
   -- "if true then some tools will OMIT some proofs"
 option skip_proofs : bool = false
   -- "skip over proofs (implicit 'sorry')"
 option strict_facts : bool = false
   -- "force lazy facts when defined in context"
 
 
 section "Global Session Parameters"
 
 option condition : string = ""
   -- "required environment variables for subsequent theories (separated by commas)"
 
 option timeout : real = 0
   -- "timeout for session build job (seconds > 0)"
 
 option timeout_build : bool = true
   -- "observe timeout for session build"
 
 option process_output_limit : int = 100
   -- "build process output limit (in million characters, 0 = unlimited)"
 
 option process_output_tail : int = 40
   -- "build process output tail shown to user (in lines, 0 = unlimited)"
 
 option profiling : string = ""
   -- "ML profiling (possible values: time, allocations)"
 
 option system_heaps : bool = false
   -- "store session heaps in $ISABELLE_HEAPS_SYSTEM, not $ISABELLE_HEAPS"
 
 
 section "ML System"
 
 option ML_print_depth : int = 20
   -- "ML print depth for toplevel pretty-printing"
 
 public option ML_exception_trace : bool = false
   -- "ML exception trace for toplevel command execution"
 
 public option ML_exception_debugger : bool = false
   -- "ML debugger exception trace for toplevel command execution"
 
 public option ML_debugger : bool = false
   -- "ML debugger instrumentation for newly compiled code"
 
 public option ML_system_64 : bool = false
   -- "ML system for 64bit platform is used if possible (change requires restart)"
 
 public option ML_process_policy : string = ""
   -- "ML process command prefix (process policy)"
 
 
 section "PIDE Build"
 
 option pide_reports : bool = true
   -- "report PIDE markup"
 
 option build_pide_reports : bool = true
   -- "report PIDE markup in batch build"
 
 
 section "Editor Session"
 
 public option editor_load_delay : real = 0.5
   -- "delay for file load operations (new buffers etc.)"
 
 public option editor_input_delay : real = 0.2
   -- "delay for user input (text edits, cursor movement etc.)"
 
 public option editor_generated_input_delay : real = 1.0
   -- "delay for machine-generated input that may outperform user edits"
 
 public option editor_output_delay : real = 0.1
   -- "delay for prover output (markup, common messages etc.)"
 
 public option editor_consolidate_delay : real = 2.0
   -- "delay to consolidate status of command evaluation (execution forks)"
 
 public option editor_prune_delay : real = 15
   -- "delay to prune history (delete old versions)"
 
 option editor_prune_size : int = 0
   -- "retained size of pruned history (delete old versions)"
 
 public option editor_update_delay : real = 0.5
   -- "delay for physical GUI updates"
 
 public option editor_reparse_limit : int = 10000
   -- "maximum amount of reparsed text outside perspective"
 
 public option editor_tracing_messages : int = 1000
   -- "initial number of tracing messages for each command transaction (0: unbounded)"
 
 public option editor_chart_delay : real = 3.0
   -- "delay for chart repainting"
 
 public option editor_continuous_checking : bool = true
   -- "continuous checking of proof document (visible and required parts)"
 
 public option editor_output_state : bool = false
   -- "implicit output of proof state"
 
 option editor_execution_delay : real = 0.02
   -- "delay for start of execution process after document update (seconds)"
 
 option editor_syslog_limit : int = 100
   -- "maximum amount of buffered syslog messages"
 
 public option editor_presentation : bool = false
   -- "dynamic presentation while editing"
 
 
 section "Headless Session"
 
 option headless_consolidate_delay : real = 15
   -- "delay to consolidate status of command evaluation (execution forks)"
 
 option headless_prune_delay : real = 60
   -- "delay to prune history (delete old versions)"
 
 option headless_check_delay : real = 0.5
   -- "delay for theory status check during PIDE processing (seconds)"
 
 option headless_check_limit : int = 0
   -- "maximum number of theory status checks (0 = unlimited)"
 
 option headless_nodes_status_delay : real = -1
   -- "delay for overall nodes status check during PIDE processing (seconds, disabled for < 0)"
 
 option headless_watchdog_timeout : real = 600
   -- "watchdog timeout for PIDE processing of broken theories (seconds, 0 = disabled)"
 
 option headless_commit_cleanup_delay : real = 60
   -- "delay for cleanup of already imported theories (seconds, 0 = disabled)"
 
 option headless_load_limit : real = 5.0
   -- "limit in MB for loaded theory files (0 = unlimited)"
 
 
 section "Miscellaneous Tools"
 
 public option find_theorems_limit : int = 40
   -- "limit of displayed results"
 
 public option find_theorems_tactic_limit : int = 5
   -- "limit of tactic search for 'solves' criterion"
 
 
 section "Completion"
 
 public option completion_limit : int = 40
   -- "limit for completion within the formal context"
 
 public option completion_path_ignore : string = "*~:*.marks:*.orig:*.rej:.DS_Store"
   -- "glob patterns to ignore in file-system path completion (separated by colons)"
 
 
 section "Spell Checker"
 
 public option spell_checker : bool = true
   -- "enable spell-checker for prose words within document text, comments etc."
 
 public option spell_checker_dictionary : string = "en"
   -- "spell-checker dictionary name"
 
 public option spell_checker_include : string = "words,comment,comment1,comment2,comment3,ML_comment,SML_comment"
   -- "included markup elements for spell-checker (separated by commas)"
 
 public option spell_checker_exclude : string = "document_marker,antiquoted,raw_text"
   -- "excluded markup elements for spell-checker (separated by commas)"
 
 
 section "Secure Shell"
 
 option ssh_config_dir : string = "$HOME/.ssh"
   -- "SSH configuration directory"
 
 option ssh_config_file : string = "$HOME/.ssh/config"
   -- "main SSH configuration file"
 
 option ssh_identity_files : string = "$HOME/.ssh/id_dsa:$HOME/.ssh/id_ecdsa:$HOME/.ssh/id_rsa"
   -- "possible SSH identity files (separated by colons)"
 
 option ssh_compression : bool = true
   -- "enable SSH compression"
 
 option ssh_connect_timeout : real = 60
   -- "SSH connection timeout (seconds)"
 
 option ssh_alive_interval : real = 30
   -- "time interval to keep SSH server connection alive (seconds)"
 
 option ssh_alive_count_max : int = 3
   -- "maximum number of messages to keep SSH server connection alive"
 
 
 section "Phabricator"
 
 option phabricator_version_arcanist : string = "7af9846f994a8d0a1fc89af996e3ddd81f01765e"
   -- "repository version for arcanist"
 
 option phabricator_version_phabricator : string = "2afedad61c5181bb4f832cea27b9b59df19f3fd5"
   -- "repository version for phabricator"
 
 
 section "Theory Export"
 
 option export_theory : bool = false
   -- "export theory content to Isabelle/Scala"
 
 option export_standard_proofs : bool = false
   -- "export standardized proof terms to Isabelle/Scala (not scalable)"
 
 option export_proofs : bool = false
   -- "export proof terms to Isabelle/Scala"
 
 option prune_proofs : bool = false
   -- "prune proof terms after export (do not store in Isabelle/ML)"
 
 
 section "Theory update"
 
 option update_inner_syntax_cartouches : bool = false
   -- "update inner syntax (types, terms, etc.) to use cartouches"
 
 option update_mixfix_cartouches : bool = false
   -- "update mixfix templates to use cartouches instead of double quotes"
 
 option update_control_cartouches : bool = false
   -- "update antiquotations to use control symbol with cartouche argument"
 
 option update_path_cartouches : bool = false
   -- "update file-system paths to use cartouches"
 
 
 section "Build Database"
 
 option build_database_server : bool = false
 option build_database_user : string = ""
 option build_database_password : string = ""
 option build_database_name : string = ""
 option build_database_host : string = ""
 option build_database_port : int = 0
 option build_database_ssh_host : string = ""
 option build_database_ssh_user : string = ""
 option build_database_ssh_port : int = 0
 
 
 section "Build Log Database"
 
 option build_log_database_user : string = ""
 option build_log_database_password : string = ""
 option build_log_database_name : string = ""
 option build_log_database_host : string = ""
 option build_log_database_port : int = 0
 option build_log_ssh_host : string = ""
 option build_log_ssh_user : string = ""
 option build_log_ssh_port : int = 0
 option build_log_history : int = 30  -- "length of relevant history (in days)"
 option build_log_transaction_size : int = 1  -- "number of log files for each db update"
 
 
 section "Isabelle/Scala/ML system channel"
 
 option system_channel_address : string = ""
 option system_channel_password : string = ""
diff --git a/etc/settings b/etc/settings
--- a/etc/settings
+++ b/etc/settings
@@ -1,178 +1,188 @@
 # -*- shell-script -*- :mode=shellscript:
 #
 # Isabelle system settings.
 #
 # Important notes:
 #   * See the "system" manual for explanations on Isabelle settings
 #   * User settings go into $ISABELLE_HOME_USER/etc/settings
 #   * DO NOT EDIT the repository copy of this file!
 #   * DO NOT COPY this file into the $ISABELLE_HOME_USER directory!
 
 ###
 ### Isabelle/Scala
 ###
 
 ISABELLE_JAVA_SYSTEM_OPTIONS="-server -Dfile.encoding=UTF-8 -Disabelle.threads=0"
 
 ISABELLE_TOOL_JAVA_OPTIONS="-Djava.awt.headless=true -Xms512m -Xmx4g -Xss16m"
 
-ISABELLE_SCALAC_OPTIONS="-encoding UTF-8 -Wconf:cat=other-match-analysis:silent -feature -deprecation -target:11 -J-Xms512m -J-Xmx4g -J-Xss16m"
+ISABELLE_SCALAC_OPTIONS="-encoding UTF-8 -Wconf:cat=other-match-analysis:silent -feature -deprecation -target:11 -Xsource:3 -J-Xms512m -J-Xmx4g -J-Xss16m"
 
 classpath "$ISABELLE_HOME/lib/classes/Pure.jar"
 
 isabelle_scala_service 'isabelle.Tools'
 [ -d "$ISABELLE_HOME/Admin" ] && isabelle_scala_service 'isabelle.Admin_Tools'
 
 isabelle_scala_service 'isabelle.Scala_Functions'
 
 isabelle_scala_service 'isabelle.Sessions$File_Format'
 isabelle_scala_service 'isabelle.Bibtex$File_Format'
 
 isabelle_scala_service 'isabelle.ML_Statistics$Handler'
 isabelle_scala_service 'isabelle.Scala$Handler'
 isabelle_scala_service 'isabelle.Print_Operation$Handler'
 isabelle_scala_service 'isabelle.Simplifier_Trace$Handler'
 isabelle_scala_service 'isabelle.Server_Commands'
 
+isabelle_scala_service 'isabelle.Document_Build$LuaLaTeX_Engine'
+isabelle_scala_service 'isabelle.Document_Build$PDFLaTeX_Engine'
+isabelle_scala_service 'isabelle.Document_Build$Build_Engine'
+
 #paranoia settings -- avoid intrusion of alien options
 unset "_JAVA_OPTIONS"
 unset "JAVA_TOOL_OPTIONS"
 
 #paranoia settings -- avoid problems of Java/Swing versus XIM/IBus etc.
 unset XMODIFIERS
 
 
 ###
 ### Interactive sessions (cf. isabelle console)
 ###
 
 ISABELLE_LINE_EDITOR="rlwrap"
 
 
 ###
 ### Batch sessions (cf. isabelle build)
 ###
 
 ISABELLE_BUILD_OPTIONS=""
 
 
 ###
-### Document preparation (cf. isabelle latex/document)
+### Document preparation (cf. isabelle latex)
 ###
 
-ISABELLE_PDFLATEX="lualatex --file-line-error"
+if [ "$ISABELLE_PLATFORM_FAMILY" = "windows" ]; then
+  ISABELLE_PDFLATEX="pdflatex -interaction=nonstopmode -c-style-errors"
+else
+  ISABELLE_PDFLATEX="pdflatex -interaction=nonstopmode -file-line-error"
+fi
+
+ISABELLE_LUALATEX="lualatex --interaction=nonstopmode --file-line-error"
 ISABELLE_BIBTEX="bibtex"
-ISABELLE_MAKEINDEX="makeindex"
+ISABELLE_MAKEINDEX="makeindex -c -q"
 ISABELLE_EPSTOPDF="epstopdf"
 
 
 ###
 ### Misc path settings
 ###
 
 isabelle_directory '~'
 isabelle_directory '$ISABELLE_HOME_USER'
 isabelle_directory '~~'
 
 ISABELLE_COMPONENT_REPOSITORY="https://isabelle.sketis.net/components"
 ISABELLE_COMPONENTS_BASE="$USER_HOME/.isabelle/contrib"
 
 # The place for user configuration, heap files, etc.
 if [ -z "$ISABELLE_IDENTIFIER" ]; then
   ISABELLE_HOME_USER="$USER_HOME/.isabelle"
 else
   ISABELLE_HOME_USER="$USER_HOME/.isabelle/$ISABELLE_IDENTIFIER"
 fi
 
 # Where to look for isabelle tools (multiple dirs separated by ':').
 ISABELLE_TOOLS="$ISABELLE_HOME/lib/Tools"
 
 # Location for temporary files (should be on a local file system).
 ISABELLE_TMP_PREFIX="${TMPDIR:-/tmp}/isabelle-$USER"
 
 # Heap locations.
 ISABELLE_HEAPS="$ISABELLE_HOME_USER/heaps"
 ISABELLE_HEAPS_SYSTEM="$ISABELLE_HOME/heaps"
 
 # HTML browser info.
 ISABELLE_BROWSER_INFO="$ISABELLE_HOME_USER/browser_info"
 ISABELLE_BROWSER_INFO_SYSTEM="$ISABELLE_HOME/browser_info"
 
 # Site settings check -- just to make it a little bit harder to copy this file verbatim!
 [ -n "$ISABELLE_SITE_SETTINGS_PRESENT" ] && \
   { echo >&2 "### Isabelle site settings already present!  Maybe copied etc/settings in full?"; }
 ISABELLE_SITE_SETTINGS_PRESENT=true
 
 
 ###
 ### Default logic
 ###
 
 ISABELLE_LOGIC=HOL
 
 
 ###
 ### Docs and external files
 ###
 
 # Where to look for docs (multiple dirs separated by ':').
 ISABELLE_DOCS="$ISABELLE_HOME/doc"
 
 ISABELLE_DOCS_RELEASE_NOTES="~~/ANNOUNCE:~~/README:~~/NEWS:~~/COPYRIGHT:~~/CONTRIBUTORS:~~/contrib/README:~~/src/Tools/jEdit/README:~~/README_REPOSITORY"
 ISABELLE_DOCS_EXAMPLES="~~/src/HOL/Examples/Seq.thy:~~/src/HOL/Examples/Drinker.thy:~~/src/HOL/Examples/ML.thy:~~/src/HOL/Unix/Unix.thy:~~/src/Tools/SML/Examples.thy:~~/src/Pure/ROOT.ML"
 
 # "open" within desktop environment (potentially asynchronous)
 case "$ISABELLE_PLATFORM_FAMILY" in
   linux)
     ISABELLE_OPEN="xdg-open"
     ;;
   macos)
     ISABELLE_OPEN="open"
     ;;
   windows)
     ISABELLE_OPEN="cygstart"
     ;;
 esac
 
 PDF_VIEWER="$ISABELLE_OPEN"
 
 ISABELLE_EXTERNAL_FILES="bmp:eps:gif:jpeg:jpg:pdf:png:xmp"
 
 
 ###
 ### Symbol rendering
 ###
 
 ISABELLE_SYMBOLS="$ISABELLE_HOME/etc/symbols:$ISABELLE_HOME_USER/etc/symbols"
 
 
 ###
 ### OCaml
 ###
 
 ISABELLE_OPAM_ROOT="$USER_HOME/.opam"
 
 ISABELLE_OCAML_VERSION="ocaml-base-compiler.4.12.0"
 
 
 ###
 ### Haskell
 ###
 
 ISABELLE_STACK_ROOT="$USER_HOME/.stack"
 
 ISABELLE_STACK_RESOLVER="lts-17.10"
 
 ISABELLE_GHC_VERSION="ghc-8.10.4"
 
 
 ###
 ### Misc settings
 ###
 
 ISABELLE_GNUPLOT="gnuplot"
 ISABELLE_FONTFORGE="fontforge"
 
 #ISABELLE_MLTON="/usr/bin/mlton"
 #ISABELLE_SMLNJ="/usr/bin/sml"
 #ISABELLE_SWIPL="/usr/bin/swipl"
diff --git a/lib/Tools/latex b/lib/Tools/latex
deleted file mode 100755
--- a/lib/Tools/latex
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-#
-# Author: Markus Wenzel, TU Muenchen
-#
-# DESCRIPTION: run LaTeX (and related tools)
-
-
-PRG="$(basename "$0")"
-
-function usage()
-{
-  echo
-  echo "Usage: isabelle $PRG [OPTIONS] [FILE]"
-  echo
-  echo "  Options are:"
-  echo "    -o FORMAT    specify output format: pdf (default), bbl, idx, sty"
-  echo
-  echo "  Run LaTeX (and related tools) on FILE (default root.tex),"
-  echo "  producing the specified output format."
-  echo
-  exit 1
-}
-
-function fail()
-{
-  echo "$1" >&2
-  exit 2
-}
-
-
-## process command line
-
-# options
-
-OUTFORMAT=pdf
-
-while getopts "o:" OPT
-do
-  case "$OPT" in
-    o)
-      OUTFORMAT="$OPTARG"
-      ;;
-    \?)
-      usage
-      ;;
-  esac
-done
-
-shift $(($OPTIND - 1))
-
-
-# args
-
-FILE="root.tex"
-[ "$#" -ge 1 ] && { FILE="$1"; shift; }
-
-[ "$#" -ne 0 ] && usage
-
-
-## main
-
-# root file
-
-DIR="$(dirname "$FILE")"
-FILEBASE="$(basename "$FILE" .tex)"
-[ "$DIR" = . ] || FILEBASE="$DIR/$FILEBASE"
-
-function check_root () { [ -f "$FILEBASE.tex" ] || fail "Bad file '$FILE'"; }
-
-
-# operations
-
-function run_pdflatex () { $ISABELLE_PDFLATEX "\\nonstopmode\\input{$FILEBASE.tex}"; }
-function run_bibtex () {
-  $ISABELLE_BIBTEX </dev/null "$FILEBASE"
-  RC="$?"
-  if [ "$RC" -gt 0 -a -f "${FILEBASE}.blg" ]; then
-    perl -n -e 'if (m/^I (found no.*$)/) { print "bibtex $1\n"; }' "${FILEBASE}.blg" >&2
-  fi
-  return "$RC"
-}
-function run_makeindex () { $ISABELLE_MAKEINDEX </dev/null "$FILEBASE"; }
-function copy_styles ()
-{
-  for STYLEFILE in "$ISABELLE_HOME/lib/texinputs"/*.sty
-  do
-    TARGET="$DIR"/$(basename "$STYLEFILE")
-    perl -p -e 's/\$[I]d:?(?:\s)*([^\$]*)\$//g' "$STYLEFILE" > "$TARGET"
-  done
-}
-
-case "$OUTFORMAT" in
-  pdf)
-    check_root && \
-    run_pdflatex
-    RC="$?"
-    ;;
-  bbl)
-    check_root && \
-    run_bibtex
-    RC="$?"
-    ;;
-  idx)
-    check_root && \
-    run_makeindex
-    RC="$?"
-    ;;
-  sty)
-    copy_styles
-    RC="$?"
-    ;;
-  *)
-    fail "Bad output format '$OUTFORMAT'"
-    ;;
-esac
-
-exit "$RC"
diff --git a/lib/texinputs/isabelle.sty b/lib/texinputs/isabelle.sty
--- a/lib/texinputs/isabelle.sty
+++ b/lib/texinputs/isabelle.sty
@@ -1,297 +1,303 @@
 %%
 %% macros for Isabelle generated LaTeX output
 %%
 
 %%% Simple document preparation (based on theory token language and symbols)
 
 % isabelle environments
 
 \newcommand{\isabellecontext}{UNKNOWN}
 \newcommand{\setisabellecontext}[1]{\def\isabellecontext{#1}}
 
 \newcommand{\isastyle}{\UNDEF}
 \newcommand{\isastylett}{\UNDEF}
 \newcommand{\isastyleminor}{\UNDEF}
 \newcommand{\isastyleminortt}{\UNDEF}
 \newcommand{\isastylescript}{\UNDEF}
 \newcommand{\isastyletext}{\normalsize\normalfont\rmfamily}
 \newcommand{\isastyletxt}{\normalfont\rmfamily}
 \newcommand{\isastylecmt}{\normalfont\rmfamily}
 
 \newcommand{\isaspacing}{%
   \sfcode 42 1000 % .
   \sfcode 63 1000 % ?
   \sfcode 33 1000 % !
   \sfcode 58 1000 % :
   \sfcode 59 1000 % ;
   \sfcode 44 1000 % ,
 }
 
 %symbol markup -- \emph achieves decent spacing via italic corrections
 \newcommand{\isamath}[1]{\emph{$#1$}}
 \newcommand{\isatext}[1]{\emph{#1}}
 \DeclareRobustCommand{\isascriptstyle}{\def\isamath##1{##1}\def\isatext##1{\mbox{\isaspacing\isastylescript##1}}}
 \newcommand{\isactrlsub}[1]{\emph{\isascriptstyle${}\sb{#1}$}}
 \newcommand{\isactrlsup}[1]{\emph{\isascriptstyle${}\sp{#1}$}}
 \DeclareRobustCommand{\isactrlbsub}{\emph\bgroup\math{}\sb\bgroup\mbox\bgroup\isaspacing\isastylescript}
 \DeclareRobustCommand{\isactrlesub}{\egroup\egroup\endmath\egroup}
 \DeclareRobustCommand{\isactrlbsup}{\emph\bgroup\math{}\sp\bgroup\mbox\bgroup\isaspacing\isastylescript}
 \DeclareRobustCommand{\isactrlesup}{\egroup\egroup\endmath\egroup}
 \newcommand{\isactrlbold}[1]{{\bfseries\upshape\boldmath#1}}
 
 %blackboard-bold (requires font txmia from pxfonts)
 \DeclareSymbolFont{bbbfont}{U}{txmia}{m}{it}
 \SetSymbolFont{bbbfont}{bold}{U}{txmia}{bx}{it}
 \DeclareMathSymbol{\bbbA}{\mathord}{bbbfont}{129}
 \DeclareMathSymbol{\bbbB}{\mathord}{bbbfont}{130}
 \DeclareMathSymbol{\bbbC}{\mathord}{bbbfont}{131}
 \DeclareMathSymbol{\bbbD}{\mathord}{bbbfont}{132}
 \DeclareMathSymbol{\bbbE}{\mathord}{bbbfont}{133}
 \DeclareMathSymbol{\bbbF}{\mathord}{bbbfont}{134}
 \DeclareMathSymbol{\bbbG}{\mathord}{bbbfont}{135}
 \DeclareMathSymbol{\bbbH}{\mathord}{bbbfont}{136}
 \DeclareMathSymbol{\bbbI}{\mathord}{bbbfont}{137}
 \DeclareMathSymbol{\bbbJ}{\mathord}{bbbfont}{138}
 \DeclareMathSymbol{\bbbK}{\mathord}{bbbfont}{139}
 \DeclareMathSymbol{\bbbL}{\mathord}{bbbfont}{140}
 \DeclareMathSymbol{\bbbM}{\mathord}{bbbfont}{141}
 \DeclareMathSymbol{\bbbN}{\mathord}{bbbfont}{142}
 \DeclareMathSymbol{\bbbO}{\mathord}{bbbfont}{143}
 \DeclareMathSymbol{\bbbP}{\mathord}{bbbfont}{144}
 \DeclareMathSymbol{\bbbQ}{\mathord}{bbbfont}{145}
 \DeclareMathSymbol{\bbbR}{\mathord}{bbbfont}{146}
 \DeclareMathSymbol{\bbbS}{\mathord}{bbbfont}{147}
 \DeclareMathSymbol{\bbbT}{\mathord}{bbbfont}{148}
 \DeclareMathSymbol{\bbbU}{\mathord}{bbbfont}{149}
 \DeclareMathSymbol{\bbbV}{\mathord}{bbbfont}{150}
 \DeclareMathSymbol{\bbbW}{\mathord}{bbbfont}{151}
 \DeclareMathSymbol{\bbbX}{\mathord}{bbbfont}{152}
 \DeclareMathSymbol{\bbbY}{\mathord}{bbbfont}{153}
 \DeclareMathSymbol{\bbbZ}{\mathord}{bbbfont}{154}
 
 \newenvironment{isaantiq}{{\isacharat\isacharbraceleft}}{{\isacharbraceright}}
 
 \newdimen\isa@parindent\newdimen\isa@parskip
 
 \newenvironment{isabellebody}{%
 \isamarkuptrue\par%
 \isa@parindent\parindent\parindent0pt%
 \isa@parskip\parskip\parskip0pt%
 \isaspacing\isastyle}{\par}
 
 \newenvironment{isabellebodytt}{%
 \isamarkuptrue\par%
 \isa@parindent\parindent\parindent0pt%
 \isa@parskip\parskip\parskip0pt%
 \isaspacing\isastylett}{\par}
 
 \newenvironment{isabelle}
 {\begin{trivlist}\begin{isabellebody}\item\relax}
 {\end{isabellebody}\end{trivlist}}
 
 \newenvironment{isabellett}
 {\begin{trivlist}\begin{isabellebodytt}\item\relax}
 {\end{isabellebodytt}\end{trivlist}}
 
 \newcommand{\isa}[1]{\emph{\isaspacing\isastyleminor #1}}
 \newcommand{\isatt}[1]{\emph{\isaspacing\isastyleminortt #1}}
 
 \newcommand{\isaindent}[1]{\hphantom{#1}}
 \newcommand{\isanewline}{\mbox{}\par\mbox{}}
 \newcommand{\isasep}{}
 \newcommand{\isadigit}[1]{#1}
 
 \newcommand{\isachardefaults}{%
 \def\isacharbell{\isamath{\bigbox}}%requires stmaryrd
 \chardef\isacharbang=`\!%
 \chardef\isachardoublequote=`\"%
 \chardef\isachardoublequoteopen=`\"%
 \chardef\isachardoublequoteclose=`\"%
 \chardef\isacharhash=`\#%
 \chardef\isachardollar=`\$%
 \chardef\isacharpercent=`\%%
 \chardef\isacharampersand=`\&%
 \chardef\isacharprime=`\'%
 \chardef\isacharparenleft=`\(%
 \chardef\isacharparenright=`\)%
 \chardef\isacharasterisk=`\*%
 \chardef\isacharplus=`\+%
 \chardef\isacharcomma=`\,%
 \chardef\isacharminus=`\-%
 \chardef\isachardot=`\.%
 \chardef\isacharslash=`\/%
 \chardef\isacharcolon=`\:%
 \chardef\isacharsemicolon=`\;%
 \chardef\isacharless=`\<%
 \chardef\isacharequal=`\=%
 \chardef\isachargreater=`\>%
 \chardef\isacharquery=`\?%
 \chardef\isacharat=`\@%
 \chardef\isacharbrackleft=`\[%
 \chardef\isacharbackslash=`\\%
 \chardef\isacharbrackright=`\]%
 \chardef\isacharcircum=`\^%
 \chardef\isacharunderscore=`\_%
 \def\isacharunderscorekeyword{\_}%
 \chardef\isacharbackquote=`\`%
 \chardef\isacharbackquoteopen=`\`%
 \chardef\isacharbackquoteclose=`\`%
 \chardef\isacharbraceleft=`\{%
 \chardef\isacharbar=`\|%
 \chardef\isacharbraceright=`\}%
 \chardef\isachartilde=`\~%
 \def\isacharverbatimopen{\isacharbraceleft\isacharasterisk}%
 \def\isacharverbatimclose{\isacharasterisk\isacharbraceright}%
 \def\isacartoucheopen{\isatext{\guilsinglleft}}%
 \def\isacartoucheclose{\isatext{\guilsinglright}}%
 }
 
 
 % keyword and section markup
 
 \newcommand{\isakeyword}[1]
 {\emph{\normalfont\bfseries\def\isachardot{.}\def\isacharunderscore{\isacharunderscorekeyword}%
 \def\isacharbraceleft{\{}\def\isacharbraceright{\}}#1}}
 \newcommand{\isacommand}[1]{\isakeyword{#1}}
 
 \newcommand{\isakeywordcontrol}[1]
 {\emph{\normalfont\bfseries\itshape\def\isacharunderscore{\isacharunderscorekeyword}#1\,}}
 
 \newcommand{\isamarkupchapter}[1]{\chapter{#1}}
 \newcommand{\isamarkupsection}[1]{\section{#1}}
 \newcommand{\isamarkupsubsection}[1]{\subsection{#1}}
 \newcommand{\isamarkupsubsubsection}[1]{\subsubsection{#1}}
 \newcommand{\isamarkupparagraph}[1]{\paragraph{#1}}
 \newcommand{\isamarkupsubparagraph}[1]{\subparagraph{#1}}
 
 \newif\ifisamarkup
 \newcommand{\isabeginpar}{\par\ifisamarkup\relax\else\medskip\fi}
 \newcommand{\isaendpar}{\par\medskip}
 \newenvironment{isapar}{\parindent\isa@parindent\parskip\isa@parskip\isabeginpar}{\isaendpar}
 \newenvironment{isamarkuptext}{\par\isastyletext\begin{isapar}}{\end{isapar}}
 \newenvironment{isamarkuptxt}{\par\isastyletxt\begin{isapar}}{\end{isapar}}
 \newcommand{\isamarkupcmt}[1]{{\isastylecmt--- #1}}
 
 
+% index entries
+
+\newcommand{\isaindexdef}[1]{\textbf{#1}}
+\newcommand{\isaindexref}[1]{#1}
+
+
 % styles
 
 \def\isabellestyle#1{\csname isabellestyle#1\endcsname}
 
 \newcommand{\isabellestyledefault}{%
 \def\isastyle{\small\normalfont\ttfamily\slshape}%
 \def\isastylett{\small\normalfont\ttfamily}%
 \def\isastyleminor{\small\normalfont\ttfamily\slshape}%
 \def\isastyleminortt{\small\normalfont\ttfamily}%
 \def\isastylescript{\footnotesize\normalfont\ttfamily\slshape}%
 \isachardefaults%
 }
 \isabellestyledefault
 
 \newcommand{\isabellestylett}{%
 \def\isastyle{\small\normalfont\ttfamily}%
 \def\isastylett{\small\normalfont\ttfamily}%
 \def\isastyleminor{\small\normalfont\ttfamily}%
 \def\isastyleminortt{\small\normalfont\ttfamily}%
 \def\isastylescript{\footnotesize\normalfont\ttfamily}%
 \isachardefaults%
 }
 
 \newcommand{\isabellestyleit}{%
 \def\isastyle{\small\normalfont\itshape}%
 \def\isastylett{\small\normalfont\ttfamily}%
 \def\isastyleminor{\normalfont\itshape}%
 \def\isastyleminortt{\normalfont\ttfamily}%
 \def\isastylescript{\footnotesize\normalfont\itshape}%
 \isachardefaults%
 \def\isacharunderscorekeyword{\mbox{-}}%
 \def\isacharbang{\isamath{!}}%
 \def\isachardoublequote{}%
 \def\isachardoublequoteopen{}%
 \def\isachardoublequoteclose{}%
 \def\isacharhash{\isamath{\#}}%
 \def\isachardollar{\isamath{\$}}%
 \def\isacharpercent{\isamath{\%}}%
 \def\isacharampersand{\isamath{\&}}%
 \def\isacharprime{\isamath{\mskip2mu{'}\mskip-2mu}}%
 \def\isacharparenleft{\isamath{(}}%
 \def\isacharparenright{\isamath{)}}%
 \def\isacharasterisk{\isamath{*}}%
 \def\isacharplus{\isamath{+}}%
 \def\isacharcomma{\isamath{\mathord,}}%
 \def\isacharminus{\isamath{-}}%
 \def\isachardot{\isamath{\mathord.}}%
 \def\isacharslash{\isamath{/}}%
 \def\isacharcolon{\isamath{\mathord:}}%
 \def\isacharsemicolon{\isamath{\mathord;}}%
 \def\isacharless{\isamath{<}}%
 \def\isacharequal{\isamath{=}}%
 \def\isachargreater{\isamath{>}}%
 \def\isacharat{\isamath{@}}%
 \def\isacharbrackleft{\isamath{[}}%
 \def\isacharbackslash{\isamath{\backslash}}%
 \def\isacharbrackright{\isamath{]}}%
 \def\isacharunderscore{\mbox{-}}%
 \def\isacharbraceleft{\isamath{\{}}%
 \def\isacharbar{\isamath{\mid}}%
 \def\isacharbraceright{\isamath{\}}}%
 \def\isachartilde{\isamath{{}\sp{\sim}}}%
 \def\isacharbackquoteopen{\isatext{\guilsinglleft}}%
 \def\isacharbackquoteclose{\isatext{\guilsinglright}}%
 }
 
 \newcommand{\isabellestyleliteral}{%
 \isabellestyleit%
 \def\isacharunderscore{\_}%
 \def\isacharunderscorekeyword{\_}%
 \chardef\isacharbackquoteopen=`\`%
 \chardef\isacharbackquoteclose=`\`%
 }
 
 \newcommand{\isabellestyleliteralunderscore}{%
 \isabellestyleliteral%
 \def\isacharunderscore{\textunderscore}%
 \def\isacharunderscorekeyword{\textunderscore}%
 }
 
 \newcommand{\isabellestylesl}{%
 \isabellestyleit%
 \def\isastyle{\small\normalfont\slshape}%
 \def\isastylett{\small\normalfont\ttfamily}%
 \def\isastyleminor{\normalfont\slshape}%
 \def\isastyleminortt{\normalfont\ttfamily}%
 \def\isastylescript{\footnotesize\normalfont\slshape}%
 }
 
 
 % cancel text
 
 \usepackage[normalem]{ulem}
 \newcommand{\isamarkupcancel}[1]{\isa{\xout{#1}}}
 
 
 % tagged regions
 
 %plain TeX version of comment package -- much faster!
 \let\isafmtname\fmtname\def\fmtname{plain}
 \usepackage{comment}
 \let\fmtname\isafmtname
 
 \newcommand{\isafold}[1]{\emph{$\langle\mathord{\mathit{#1}}\rangle$}}
 
 \newcommand{\isakeeptag}[1]%
 {\includecomment{isadelim#1}\includecomment{isatag#1}\csarg\def{isafold#1}{}}
 \newcommand{\isadroptag}[1]%
 {\excludecomment{isadelim#1}\excludecomment{isatag#1}\csarg\def{isafold#1}{}}
 \newcommand{\isafoldtag}[1]%
 {\includecomment{isadelim#1}\excludecomment{isatag#1}\csarg\def{isafold#1}{\isafold{#1}}}
 
 \isakeeptag{document}
 \isakeeptag{theory}
 \isakeeptag{proof}
 \isakeeptag{ML}
 \isakeeptag{visible}
 \isadroptag{invisible}
 \isakeeptag{important}
 \isakeeptag{unimportant}
 
 \IfFileExists{isabelletags.sty}{\usepackage{isabelletags}}{}
diff --git a/src/Doc/Classes/document/build b/src/Doc/Classes/document/build
deleted file mode 100755
--- a/src/Doc/Classes/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo Isar
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Classes/document/root.tex b/src/Doc/Classes/document/root.tex
--- a/src/Doc/Classes/document/root.tex
+++ b/src/Doc/Classes/document/root.tex
@@ -1,46 +1,46 @@
 \documentclass[12pt,a4paper,fleqn]{article}
 \usepackage{graphicx}
 \usepackage{iman,extra,isar}
 \usepackage{isabelle,isabellesym}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 \isadroptag{theory}
 
-\title{\includegraphics[scale=0.5]{isabelle_isar}
+\title{\includegraphics[scale=0.5]{isabelle_logo}
   \\[4ex] Haskell-style type classes with Isabelle/Isar}
 \author{\emph{Florian Haftmann}}
 
 \begin{document}
 
 \maketitle
 
 \begin{abstract}
   \noindent This tutorial introduces Isar type classes, which 
   are a convenient mechanism for organizing specifications.
   Essentially, they combine an operational aspect (in the
   manner of Haskell) with a logical aspect, both managed uniformly.
 \end{abstract}
 
 \thispagestyle{empty}\clearpage
 
 \pagenumbering{roman}
 \clearfirst
 
 \input{Classes.tex}
 
 \begingroup
 \bibliographystyle{plain} \small\raggedright\frenchspacing
 \bibliography{manual}
 \endgroup
 
 \end{document}
 
 
 %%% Local Variables: 
 %%% mode: latex
 %%% TeX-master: t
 %%% End: 
diff --git a/src/Doc/Codegen/document/build b/src/Doc/Codegen/document/build
deleted file mode 100755
--- a/src/Doc/Codegen/document/build
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-# ad-hoc patching of temporary path from sources
-perl -i -pe 's/\{\\isachardollar\}ISABELLE\{\\isacharunderscore\}TMP\{\\isacharslash\}examples/examples/g' *.tex
-
-isabelle logo Isar
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
-# clean up afterwards
-rm -rf "${ISABELLE_TMP}/examples"
diff --git a/src/Doc/Codegen/document/root.tex b/src/Doc/Codegen/document/root.tex
--- a/src/Doc/Codegen/document/root.tex
+++ b/src/Doc/Codegen/document/root.tex
@@ -1,55 +1,55 @@
 
 \documentclass[12pt,a4paper,fleqn]{article}
 \usepackage[T1]{fontenc}
 \usepackage{graphicx}
 \usepackage{tikz}\usetikzlibrary{shapes}\usetikzlibrary{arrows}
 \usepackage{multirow}
 \usepackage{iman,extra,isar}
 \usepackage{isabelle,isabellesym}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 \isadroptag{theory}
 
-\title{\includegraphics[scale=0.5]{isabelle_isar}
+\title{\includegraphics[scale=0.5]{isabelle_logo}
   \\[4ex] Code generation from Isabelle/HOL theories}
 \author{\emph{Florian Haftmann with contributions from Lukas Bulwahn}}
 
 \begin{document}
 
 \maketitle
 
 \begin{abstract}
   \noindent This tutorial introduces the code generator facilities of Isabelle/HOL.
     They empower the user to turn HOL specifications into corresponding executable
     programs in the languages SML, OCaml, Haskell and Scala.
 \end{abstract}
 
 \thispagestyle{empty}\clearpage
 
 \pagenumbering{roman}
 \clearfirst
 
 \input{Introduction.tex}
 \input{Foundations.tex}
 \input{Refinement.tex}
 \input{Inductive_Predicate.tex}
 \input{Evaluation.tex}
 \input{Computations.tex}
 \input{Adaptation.tex}
 \input{Further.tex}
 
 \begingroup
 \bibliographystyle{plain} \small\raggedright\frenchspacing
 \bibliography{manual}
 \endgroup
 
 \end{document}
 
 
 %%% Local Variables: 
 %%% mode: latex
 %%% TeX-master: t
 %%% End: 
diff --git a/src/Doc/Corec/document/build b/src/Doc/Corec/document/build
deleted file mode 100755
--- a/src/Doc/Corec/document/build
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Corec/document/root.tex b/src/Doc/Corec/document/root.tex
--- a/src/Doc/Corec/document/root.tex
+++ b/src/Doc/Corec/document/root.tex
@@ -1,82 +1,82 @@
 \documentclass[12pt,a4paper]{article} % fleqn
 \usepackage[T1]{fontenc}
 \usepackage{amsfonts}
 \usepackage{amsmath}
 \usepackage{cite}
 \usepackage{enumitem}
 \usepackage{footmisc}
 \usepackage{graphicx}
 \usepackage{iman}
 \usepackage{extra}
 \usepackage{isar}
 \usepackage{isabelle}
 \usepackage{isabellesym}
 \usepackage{style}
 \usepackage{pdfsetup}
 \usepackage{railsetup}
 \usepackage{framed}
 
 \setcounter{secnumdepth}{3}
 \setcounter{tocdepth}{3}
 
 \renewcommand\_{\hbox{\textunderscore\kern-.05ex}}
 
 \newbox\boxA
 \setbox\boxA=\hbox{\ }
 \parindent=4\wd\boxA
 
 \newcommand\blankline{\vskip-.25\baselineskip}
 
 \newenvironment{indentblock}{\list{}{\setlength{\leftmargin}{\parindent}}\item[]}{\endlist}
 
 \newcommand{\keyw}[1]{\textbf{#1}}
 \newcommand{\synt}[1]{\textit{#1}}
 \newcommand{\hthm}[1]{\textbf{\textit{#1}}}
 
 %\renewcommand{\isactrlsub}[1]{\/$\sb{\mathrm{#1}}$}
 \renewcommand\isactrlsub[1]{\/$\sb{#1}$}
 \renewcommand\isadigit[1]{\/\ensuremath{\mathrm{#1}}}
 \renewcommand\isacharprime{\isamath{{'}\mskip-2mu}}
 \renewcommand\isacharunderscore{\mbox{\_}}
 \renewcommand\isacharunderscorekeyword{\mbox{\_}}
 \renewcommand\isachardoublequote{\mbox{\upshape{``}}}
 \renewcommand\isachardoublequoteopen{\mbox{\upshape{``}\kern.1ex}}
 \renewcommand\isachardoublequoteclose{\/\kern.15ex\mbox{\upshape{''}}}
 \renewcommand{\isasyminverse}{\isamath{{}^{-}}}
 
 \hyphenation{isa-belle}
 
 \isadroptag{theory}
 
-\title{%\includegraphics[scale=0.5]{isabelle_hol} \\[4ex]
+\title{%\includegraphics[scale=0.5]{isabelle_logo} \\[4ex]
 Defining Nonprimitively (Co)recursive Functions in Isabelle/HOL}
 \author{Jasmin Christian Blanchette, Aymeric Bouzy, \\
 Andreas Lochbihler, Andrei Popescu, and \\
 Dmitriy Traytel}
 
 \urlstyle{tt}
 
 \begin{document}
 
 \maketitle
 
 \begin{sloppy}
 \begin{abstract}
 \noindent
 This tutorial describes the definitional package for nonprimitively corecursive functions
 in Isabelle/HOL. The following commands are provided:
 \keyw{corec}, \keyw{corecursive}, \keyw{friend\_of\_corec}, and \keyw{coinduction\_\allowbreak upto}.
 They supplement \keyw{codatatype}, \keyw{primcorec}, and \keyw{primco\-rec\-ur\-sive}, which
 define codatatypes and primitively corecursive functions.
 \end{abstract}
 \end{sloppy}
 
 \tableofcontents
 
 \input{Corec.tex}
 
 \let\em=\sl
 \bibliography{manual}{}
 \bibliographystyle{abbrv}
 
 \end{document}
diff --git a/src/Doc/Datatypes/document/build b/src/Doc/Datatypes/document/build
deleted file mode 100755
--- a/src/Doc/Datatypes/document/build
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Datatypes/document/root.tex b/src/Doc/Datatypes/document/root.tex
--- a/src/Doc/Datatypes/document/root.tex
+++ b/src/Doc/Datatypes/document/root.tex
@@ -1,84 +1,84 @@
 \documentclass[12pt,a4paper]{article} % fleqn
 \usepackage[T1]{fontenc}
 \usepackage{amsfonts}
 \usepackage{amsmath}
 \usepackage{cite}
 \usepackage{enumitem}
 \usepackage{footmisc}
 \usepackage{graphicx}
 \usepackage{iman}
 \usepackage{extra}
 \usepackage{isar}
 \usepackage{isabelle}
 \usepackage{isabellesym}
 \usepackage{style}
 \usepackage{pdfsetup}
 \usepackage{railsetup}
 \usepackage{framed}
 
 \setcounter{secnumdepth}{3}
 \setcounter{tocdepth}{3}
 
 \renewcommand\_{\hbox{\textunderscore\kern-.05ex}}
 
 \newbox\boxA
 \setbox\boxA=\hbox{\ }
 \parindent=4\wd\boxA
 
 \newcommand\blankline{\vskip-.25\baselineskip}
 
 \newenvironment{indentblock}{\list{}{\setlength{\leftmargin}{\parindent}}\item[]}{\endlist}
 
 \newcommand{\keyw}[1]{\textbf{#1}}
 \newcommand{\synt}[1]{\textit{#1}}
 \newcommand{\hthm}[1]{\textbf{\textit{#1}}}
 
 %\renewcommand{\isactrlsub}[1]{\/$\sb{\mathrm{#1}}$}
 \renewcommand\isactrlsub[1]{\/$\sb{#1}$}
 \renewcommand\isadigit[1]{\/\ensuremath{\mathrm{#1}}}
 \renewcommand\isacharprime{\isamath{{'}\mskip-2mu}}
 \renewcommand\isacharunderscore{\mbox{\_}}
 \renewcommand\isacharunderscorekeyword{\mbox{\_}}
 \renewcommand\isachardoublequote{\mbox{\upshape{``}}}
 \renewcommand\isachardoublequoteopen{\mbox{\upshape{``}\kern.1ex}}
 \renewcommand\isachardoublequoteclose{\/\kern.15ex\mbox{\upshape{''}}}
 \renewcommand{\isasyminverse}{\isamath{{}^{-}}}
 
 \hyphenation{isa-belle}
 
 \isadroptag{theory}
 
-\title{%\includegraphics[scale=0.5]{isabelle_hol} \\[4ex]
+\title{%\includegraphics[scale=0.5]{isabelle_logo} \\[4ex]
 Defining (Co)datatypes and Primitively (Co)recursive Functions in Isabelle/HOL}
 \author{Julian Biendarra, Jasmin Blanchette, \\
 Martin Desharnais, Lorenz Panny, \\
 Andrei Popescu, and Dmitriy Traytel}
 
 \urlstyle{tt}
 
 \begin{document}
 
 \maketitle
 
 \begin{sloppy}
 \begin{abstract}
 \noindent
 This tutorial describes the definitional package for datatypes and codatatypes,
 and for primitively recursive and corecursive functions, in Isabelle/HOL. The
 following commands are provided:
 \keyw{datatype}, \keyw{datatype_\allowbreak compat}, \keyw{prim\-rec}, \keyw{co\-data\-type},
 \keyw{prim\-co\-rec}, \keyw{prim\-co\-recursive}, \keyw{bnf}, \keyw{lift_\allowbreak bnf},
 \keyw{copy_\allowbreak bnf}, \keyw{bnf_\allowbreak axiom\-atization},
 \keyw{print_\allowbreak bnfs}, and \keyw{free_\allowbreak constructors}.
 \end{abstract}
 \end{sloppy}
 
 \tableofcontents
 
 \input{Datatypes.tex}
 
 \let\em=\sl
 \bibliography{manual}{}
 \bibliographystyle{abbrv}
 
 \end{document}
diff --git a/src/Doc/Eisbach/document/build b/src/Doc/Eisbach/document/build
deleted file mode 100755
--- a/src/Doc/Eisbach/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo Eisbach
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Eisbach/document/root.tex b/src/Doc/Eisbach/document/root.tex
--- a/src/Doc/Eisbach/document/root.tex
+++ b/src/Doc/Eisbach/document/root.tex
@@ -1,87 +1,87 @@
 \documentclass[12pt,a4paper,fleqn]{report}
 \usepackage[T1]{fontenc}
 \usepackage{graphicx}
 \usepackage[refpage]{nomencl}
 \usepackage{iman,extra,isar,proof}
 \usepackage[nohyphen,strings]{underscore}
 \usepackage{isabelle}
 \usepackage{isabellesym}
 \usepackage{railsetup}
 \usepackage{supertabular}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 
 \hyphenation{Isabelle}
 \hyphenation{Eisbach}
 
 \isadroptag{theory}
-\title{\includegraphics[scale=0.5]{isabelle_eisbach}
+\title{\includegraphics[scale=0.5]{isabelle_logo}
   \\[4ex] The Eisbach User Manual}
 \author{Daniel Matichuk \\
   Makarius Wenzel \\
   Toby Murray
 }
 
 
 % Control fixmes etc.
 \newif\ifDraft \newif\ifFinal
 %\Drafttrue\Finalfalse
 \Draftfalse\Finaltrue
 
 
 \ifDraft
   \usepackage{draftcopy}
   \newcommand{\Comment}[1]{\textbf{\textsl{#1}}}
   \newenvironment{LongComment}[1] % multi-paragraph comment, argument is owner
     {\begingroup\par\noindent\slshape \textbf{Begin Comment[#1]}\par}
     {\par\noindent\textbf{End Comment}\endgroup\par}
   \newcommand{\FIXME}[1]{\textbf{\textsl{FIXME: #1}}}
   \newcommand{\TODO}[1]{\textbf{\textsl{TODO: #1}}}
 \else
   \newcommand{\Comment}[1]{\relax}
   \newenvironment{LongComment}[1]{\expandafter\comment}{\expandafter\endcomment}
   \newcommand{\FIXME}[1]{\relax}
   \newcommand{\TODO}[1]{\relax}
 \fi
 
 % This sort of command for each active author can be convenient
 \newcommand{\dan}[1]{\Comment{#1 [dan]}}
 \newcommand{\toby}[1]{\Comment{#1 [toby]}}
 \newcommand{\makarius}[1]{\Comment{#1 [makarius]}}
 
 
 \makeindex
 
 \chardef\charbackquote=`\`
 \newcommand{\backquote}{\mbox{\tt\charbackquote}}
 
 
 \begin{document}
 
 \maketitle
 
 \pagenumbering{roman}
 \chapter*{Preface}
 \input{Preface.tex}
 \tableofcontents
 \clearfirst
 
 \input{Manual.tex}
 
 \begingroup
 \tocentry{\bibname}
 \bibliographystyle{abbrv} \small\raggedright\frenchspacing
 \bibliography{manual}
 \endgroup
 
 \tocentry{\indexname}
 \printindex
 
 \end{document}
 
 
 %%% Local Variables:
 %%% mode: latex
 %%% TeX-master: t
 %%% End:
diff --git a/src/Doc/Functions/document/build b/src/Doc/Functions/document/build
deleted file mode 100755
--- a/src/Doc/Functions/document/build
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/How_to_Prove_it/document/root.tex b/src/Doc/How_to_Prove_it/document/root.tex
--- a/src/Doc/How_to_Prove_it/document/root.tex
+++ b/src/Doc/How_to_Prove_it/document/root.tex
@@ -1,43 +1,43 @@
 \documentclass[11pt,a4paper]{report}
 
 \input{prelude}
 
 \begin{document}
 
 \title{How to Prove it in Isabelle/HOL}
-%\subtitle{\includegraphics[scale=.7]{isabelle_hol}}
+%\subtitle{\includegraphics[scale=.7]{isabelle_logo}}
 \author{Tobias Nipkow}
 \maketitle
 
 
 \begin{abstract}
   How does one perform induction on the length of a list? How are numerals
   converted into \isa{Suc} terms? How does one prove equalities in rings
   and other algebraic structures?
 
   This document is a collection of practical hints and techniques for dealing
   with specific frequently occurring situations in proofs in Isabelle/HOL.
   Not arbitrary proofs but proofs that refer to material that is part of
   \isa{Main} or \isa{Complex\_Main}.
 
   This is \emph{not} an introduction to
 \begin{itemize}
 \item proofs in general; for that see mathematics or logic books.
 \item Isabelle/HOL and its proof language; for that see the tutorial
   \cite{ProgProve} or the reference manual~\cite{IsarRef}.
 \item the contents of theory \isa{Main}; for that see the overview
   \cite{Main}.
 \end{itemize}
 \end{abstract}
 
 \setcounter{tocdepth}{1}
 \tableofcontents
 
 \input{How_to_Prove_it.tex}
 
 \bibliographystyle{plain}
 \bibliography{root}
 
 %\printindex
 
 \end{document}
diff --git a/src/Doc/Implementation/Eq.thy b/src/Doc/Implementation/Eq.thy
--- a/src/Doc/Implementation/Eq.thy
+++ b/src/Doc/Implementation/Eq.thy
@@ -1,139 +1,139 @@
 (*:maxLineLen=78:*)
 
 theory Eq
 imports Base
 begin
 
 chapter \<open>Equational reasoning\<close>
 
 text \<open>
   Equality is one of the most fundamental concepts of mathematics. The
   Isabelle/Pure logic (\chref{ch:logic}) provides a builtin relation \<open>\<equiv> :: \<alpha> \<Rightarrow>
   \<alpha> \<Rightarrow> prop\<close> that expresses equality of arbitrary terms (or propositions) at
   the framework level, as expressed by certain basic inference rules
   (\secref{sec:eq-rules}).
 
   Equational reasoning means to replace equals by equals, using reflexivity
   and transitivity to form chains of replacement steps, and congruence rules
   to access sub-structures. Conversions (\secref{sec:conv}) provide a
   convenient framework to compose basic equational steps to build specific
   equational reasoning tools.
 
   Higher-order matching is able to provide suitable instantiations for giving
   equality rules, which leads to the versatile concept of \<open>\<lambda>\<close>-term rewriting
   (\secref{sec:rewriting}). Internally this is based on the general-purpose
   Simplifier engine of Isabelle, which is more specific and more efficient
   than plain conversions.
 
   Object-logics usually introduce specific notions of equality or equivalence,
   and relate it with the Pure equality. This enables to re-use the Pure tools
   for equational reasoning for particular object-logic connectives as well.
 \<close>
 
 
 section \<open>Basic equality rules \label{sec:eq-rules}\<close>
 
 text \<open>
   Isabelle/Pure uses \<open>\<equiv>\<close> for equality of arbitrary terms, which includes
   equivalence of propositions of the logical framework. The conceptual
   axiomatization of the constant \<open>\<equiv> :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> prop\<close> is given in
   \figref{fig:pure-equality}. The inference kernel presents slightly different
   equality rules, which may be understood as derived rules from this minimal
   axiomatization. The Pure theory also provides some theorems that express the
   same reasoning schemes as theorems that can be composed like object-level
   rules as explained in \secref{sec:obj-rules}.
 
   For example, \<^ML>\<open>Thm.symmetric\<close> as Pure inference is an ML function that
   maps a theorem \<open>th\<close> stating \<open>t \<equiv> u\<close> to one stating \<open>u \<equiv> t\<close>. In contrast,
   @{thm [source] Pure.symmetric} as Pure theorem expresses the same reasoning
   in declarative form. If used like \<open>th [THEN Pure.symmetric]\<close> in Isar source
   notation, it achieves a similar effect as the ML inference function,
   although the rule attribute @{attribute THEN} or ML operator \<^ML>\<open>op RS\<close>
   involve the full machinery of higher-order unification (modulo
   \<open>\<beta>\<eta>\<close>-conversion) and lifting of \<open>\<And>/\<Longrightarrow>\<close> contexts.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Thm.reflexive: "cterm -> thm"} \\
-  @{index_ML Thm.symmetric: "thm -> thm"} \\
-  @{index_ML Thm.transitive: "thm -> thm -> thm"} \\
-  @{index_ML Thm.abstract_rule: "string -> cterm -> thm -> thm"} \\
-  @{index_ML Thm.combination: "thm -> thm -> thm"} \\[0.5ex]
-  @{index_ML Thm.equal_intr: "thm -> thm -> thm"} \\
-  @{index_ML Thm.equal_elim: "thm -> thm -> thm"} \\
+  @{define_ML Thm.reflexive: "cterm -> thm"} \\
+  @{define_ML Thm.symmetric: "thm -> thm"} \\
+  @{define_ML Thm.transitive: "thm -> thm -> thm"} \\
+  @{define_ML Thm.abstract_rule: "string -> cterm -> thm -> thm"} \\
+  @{define_ML Thm.combination: "thm -> thm -> thm"} \\[0.5ex]
+  @{define_ML Thm.equal_intr: "thm -> thm -> thm"} \\
+  @{define_ML Thm.equal_elim: "thm -> thm -> thm"} \\
   \end{mldecls}
 
   See also \<^file>\<open>~~/src/Pure/thm.ML\<close> for further description of these inference
   rules, and a few more for primitive \<open>\<beta>\<close> and \<open>\<eta>\<close> conversions. Note that \<open>\<alpha>\<close>
   conversion is implicit due to the representation of terms with de-Bruijn
   indices (\secref{sec:terms}).
 \<close>
 
 
 section \<open>Conversions \label{sec:conv}\<close>
 
 text \<open>
   The classic article @{cite "paulson:1983"} introduces the concept of
   conversion for Cambridge LCF. This was historically important to implement
   all kinds of ``simplifiers'', but the Isabelle Simplifier is done quite
   differently, see @{cite \<open>\S9.3\<close> "isabelle-isar-ref"}.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_structure Conv} \\
-  @{index_ML_type conv} \\
-  @{index_ML Simplifier.asm_full_rewrite : "Proof.context -> conv"} \\
+  @{define_ML_structure Conv} \\
+  @{define_ML_type conv} \\
+  @{define_ML Simplifier.asm_full_rewrite : "Proof.context -> conv"} \\
   \end{mldecls}
 
   \<^descr> \<^ML_structure>\<open>Conv\<close> is a library of combinators to build conversions,
   over type \<^ML_type>\<open>conv\<close> (see also \<^file>\<open>~~/src/Pure/conv.ML\<close>). This is one
   of the few Isabelle/ML modules that are usually used with \<^verbatim>\<open>open\<close>: finding
   examples works by searching for ``\<^verbatim>\<open>open Conv\<close>'' instead of ``\<^verbatim>\<open>Conv.\<close>''.
 
   \<^descr> \<^ML>\<open>Simplifier.asm_full_rewrite\<close> invokes the Simplifier as a
   conversion. There are a few related operations, corresponding to the various
   modes of simplification.
 \<close>
 
 
 section \<open>Rewriting \label{sec:rewriting}\<close>
 
 text \<open>
   Rewriting normalizes a given term (theorem or goal) by replacing instances
   of given equalities \<open>t \<equiv> u\<close> in subterms. Rewriting continues until no
   rewrites are applicable to any subterm. This may be used to unfold simple
   definitions of the form \<open>f x\<^sub>1 \<dots> x\<^sub>n \<equiv> u\<close>, but is slightly more general than
   that. \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML rewrite_rule: "Proof.context -> thm list -> thm -> thm"} \\
-  @{index_ML rewrite_goals_rule: "Proof.context -> thm list -> thm -> thm"} \\
-  @{index_ML rewrite_goal_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML rewrite_goals_tac: "Proof.context -> thm list -> tactic"} \\
-  @{index_ML fold_goals_tac: "Proof.context -> thm list -> tactic"} \\
+  @{define_ML rewrite_rule: "Proof.context -> thm list -> thm -> thm"} \\
+  @{define_ML rewrite_goals_rule: "Proof.context -> thm list -> thm -> thm"} \\
+  @{define_ML rewrite_goal_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML rewrite_goals_tac: "Proof.context -> thm list -> tactic"} \\
+  @{define_ML fold_goals_tac: "Proof.context -> thm list -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>rewrite_rule\<close>~\<open>ctxt rules thm\<close> rewrites the whole theorem by the
   given rules.
 
   \<^descr> \<^ML>\<open>rewrite_goals_rule\<close>~\<open>ctxt rules thm\<close> rewrites the outer premises of
   the given theorem. Interpreting the same as a goal state
   (\secref{sec:tactical-goals}) it means to rewrite all subgoals (in the same
   manner as \<^ML>\<open>rewrite_goals_tac\<close>).
 
   \<^descr> \<^ML>\<open>rewrite_goal_tac\<close>~\<open>ctxt rules i\<close> rewrites subgoal \<open>i\<close> by the given
   rewrite rules.
 
   \<^descr> \<^ML>\<open>rewrite_goals_tac\<close>~\<open>ctxt rules\<close> rewrites all subgoals by the given
   rewrite rules.
 
   \<^descr> \<^ML>\<open>fold_goals_tac\<close>~\<open>ctxt rules\<close> essentially uses \<^ML>\<open>rewrite_goals_tac\<close>
   with the symmetric form of each member of \<open>rules\<close>, re-ordered to fold longer
   expression first. This supports to idea to fold primitive definitions that
   appear in expended form in the proof state.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Integration.thy b/src/Doc/Implementation/Integration.thy
--- a/src/Doc/Implementation/Integration.thy
+++ b/src/Doc/Implementation/Integration.thy
@@ -1,174 +1,174 @@
 (*:maxLineLen=78:*)
 
 theory Integration
 imports Base
 begin
 
 chapter \<open>System integration\<close>
 
 section \<open>Isar toplevel \label{sec:isar-toplevel}\<close>
 
 text \<open>
   The Isar \<^emph>\<open>toplevel state\<close> represents the outermost configuration that is
   transformed by a sequence of transitions (commands) within a theory body.
   This is a pure value with pure functions acting on it in a timeless and
   stateless manner. Historically, the sequence of transitions was wrapped up
   as sequential command loop, such that commands are applied one-by-one. In
   contemporary Isabelle/Isar, processing toplevel commands usually works in
   parallel in multi-threaded Isabelle/ML @{cite "Wenzel:2009" and
   "Wenzel:2013:ITP"}.
 \<close>
 
 
 subsection \<open>Toplevel state\<close>
 
 text \<open>
   The toplevel state is a disjoint sum of empty \<open>toplevel\<close>, or \<open>theory\<close>, or
   \<open>proof\<close>. The initial toplevel is empty; a theory is commenced by a @{command
   theory} header; within a theory we may use theory commands such as @{command
   definition}, or state a @{command theorem} to be proven. A proof state
   accepts a rich collection of Isar proof commands for structured proof
   composition, or unstructured proof scripts. When the proof is concluded we
   get back to the (local) theory, which is then updated by defining the
   resulting fact. Further theory declarations or theorem statements with
   proofs may follow, until we eventually conclude the theory development by
   issuing @{command end} to get back to the empty toplevel.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Toplevel.state} \\
-  @{index_ML_exception Toplevel.UNDEF} \\
-  @{index_ML Toplevel.is_toplevel: "Toplevel.state -> bool"} \\
-  @{index_ML Toplevel.theory_of: "Toplevel.state -> theory"} \\
-  @{index_ML Toplevel.proof_of: "Toplevel.state -> Proof.state"} \\
+  @{define_ML_type Toplevel.state} \\
+  @{define_ML_exception Toplevel.UNDEF} \\
+  @{define_ML Toplevel.is_toplevel: "Toplevel.state -> bool"} \\
+  @{define_ML Toplevel.theory_of: "Toplevel.state -> theory"} \\
+  @{define_ML Toplevel.proof_of: "Toplevel.state -> Proof.state"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Toplevel.state\<close> represents Isar toplevel states, which are
   normally manipulated through the concept of toplevel transitions only
   (\secref{sec:toplevel-transition}).
 
   \<^descr> \<^ML>\<open>Toplevel.UNDEF\<close> is raised for undefined toplevel operations. Many
   operations work only partially for certain cases, since \<^ML_type>\<open>Toplevel.state\<close> is a sum type.
 
   \<^descr> \<^ML>\<open>Toplevel.is_toplevel\<close>~\<open>state\<close> checks for an empty toplevel state.
 
   \<^descr> \<^ML>\<open>Toplevel.theory_of\<close>~\<open>state\<close> selects the background theory of \<open>state\<close>,
   it raises \<^ML>\<open>Toplevel.UNDEF\<close> for an empty toplevel state.
 
   \<^descr> \<^ML>\<open>Toplevel.proof_of\<close>~\<open>state\<close> selects the Isar proof state if available,
   otherwise it raises an error.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "Isar.state"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{Isar.state}\<close> refers to Isar toplevel state at that point --- as
   abstract value.
 
   This only works for diagnostic ML commands, such as @{command ML_val} or
   @{command ML_command}.
 \<close>
 
 
 subsection \<open>Toplevel transitions \label{sec:toplevel-transition}\<close>
 
 text \<open>
   An Isar toplevel transition consists of a partial function on the toplevel
   state, with additional information for diagnostics and error reporting:
   there are fields for command name, source position, and other meta-data.
 
   The operational part is represented as the sequential union of a list of
   partial functions, which are tried in turn until the first one succeeds.
   This acts like an outer case-expression for various alternative state
   transitions. For example, \<^theory_text>\<open>qed\<close> works differently for a local proofs vs.\
   the global ending of an outermost proof.
 
   Transitions are composed via transition transformers. Internally, Isar
   commands are put together from an empty transition extended by name and
   source position. It is then left to the individual command parser to turn
   the given concrete syntax into a suitable transition transformer that
   adjoins actual operations on a theory or proof state.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Toplevel.keep: "(Toplevel.state -> unit) ->
-  Toplevel.transition -> Toplevel.transition"} \\
-  @{index_ML Toplevel.theory: "(theory -> theory) ->
+  @{define_ML Toplevel.keep: "(Toplevel.state -> unit) ->
   Toplevel.transition -> Toplevel.transition"} \\
-  @{index_ML Toplevel.theory_to_proof: "(theory -> Proof.state) ->
+  @{define_ML Toplevel.theory: "(theory -> theory) ->
   Toplevel.transition -> Toplevel.transition"} \\
-  @{index_ML Toplevel.proof: "(Proof.state -> Proof.state) ->
+  @{define_ML Toplevel.theory_to_proof: "(theory -> Proof.state) ->
   Toplevel.transition -> Toplevel.transition"} \\
-  @{index_ML Toplevel.proofs: "(Proof.state -> Proof.state Seq.result Seq.seq) ->
+  @{define_ML Toplevel.proof: "(Proof.state -> Proof.state) ->
   Toplevel.transition -> Toplevel.transition"} \\
-  @{index_ML Toplevel.end_proof: "(bool -> Proof.state -> Proof.context) ->
+  @{define_ML Toplevel.proofs: "(Proof.state -> Proof.state Seq.result Seq.seq) ->
+  Toplevel.transition -> Toplevel.transition"} \\
+  @{define_ML Toplevel.end_proof: "(bool -> Proof.state -> Proof.context) ->
   Toplevel.transition -> Toplevel.transition"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Toplevel.keep\<close>~\<open>tr\<close> adjoins a diagnostic function.
 
   \<^descr> \<^ML>\<open>Toplevel.theory\<close>~\<open>tr\<close> adjoins a theory transformer.
 
   \<^descr> \<^ML>\<open>Toplevel.theory_to_proof\<close>~\<open>tr\<close> adjoins a global goal function, which
   turns a theory into a proof state. The theory may be changed before entering
   the proof; the generic Isar goal setup includes an \<^verbatim>\<open>after_qed\<close> argument
   that specifies how to apply the proven result to the enclosing context, when
   the proof is finished.
 
   \<^descr> \<^ML>\<open>Toplevel.proof\<close>~\<open>tr\<close> adjoins a deterministic proof command, with a
   singleton result.
 
   \<^descr> \<^ML>\<open>Toplevel.proofs\<close>~\<open>tr\<close> adjoins a general proof command, with zero or
   more result states (represented as a lazy list).
 
   \<^descr> \<^ML>\<open>Toplevel.end_proof\<close>~\<open>tr\<close> adjoins a concluding proof command, that
   returns the resulting theory, after applying the resulting facts to the
   target context.
 \<close>
 
 text %mlex \<open>
   The file \<^file>\<open>~~/src/HOL/Examples/Commands.thy\<close> shows some example Isar command
   definitions, with the all-important theory header declarations for outer
   syntax keywords.
 \<close>
 
 
 section \<open>Theory loader database\<close>
 
 text \<open>
   In batch mode and within dumped logic images, the theory database maintains
   a collection of theories as a directed acyclic graph. A theory may refer to
   other theories as @{keyword "imports"}, or to auxiliary files via special
   \<^emph>\<open>load commands\<close> (e.g.\ @{command ML_file}). For each theory, the base
   directory of its own theory file is called \<^emph>\<open>master directory\<close>: this is used
   as the relative location to refer to other files from that theory.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML use_thy: "string -> unit"} \\
-  @{index_ML Thy_Info.get_theory: "string -> theory"} \\
-  @{index_ML Thy_Info.remove_thy: "string -> unit"} \\
-  @{index_ML Thy_Info.register_thy: "theory -> unit"} \\
+  @{define_ML use_thy: "string -> unit"} \\
+  @{define_ML Thy_Info.get_theory: "string -> theory"} \\
+  @{define_ML Thy_Info.remove_thy: "string -> unit"} \\
+  @{define_ML Thy_Info.register_thy: "theory -> unit"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>use_thy\<close>~\<open>A\<close> ensures that theory \<open>A\<close> is fully up-to-date wrt.\ the
   external file store; outdated ancestors are reloaded on demand.
 
   \<^descr> \<^ML>\<open>Thy_Info.get_theory\<close>~\<open>A\<close> retrieves the theory value presently
   associated with name \<open>A\<close>. Note that the result might be outdated wrt.\ the
   file-system content.
 
   \<^descr> \<^ML>\<open>Thy_Info.remove_thy\<close>~\<open>A\<close> deletes theory \<open>A\<close> and all descendants from
   the theory database.
 
   \<^descr> \<^ML>\<open>Thy_Info.register_thy\<close>~\<open>text thy\<close> registers an existing theory value
   with the theory loader database and updates source version information
   according to the file store.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Isar.thy b/src/Doc/Implementation/Isar.thy
--- a/src/Doc/Implementation/Isar.thy
+++ b/src/Doc/Implementation/Isar.thy
@@ -1,547 +1,547 @@
 (*:maxLineLen=78:*)
 
 theory Isar
 imports Base
 begin
 
 chapter \<open>Isar language elements\<close>
 
 text \<open>
   The Isar proof language (see also @{cite \<open>\S2\<close> "isabelle-isar-ref"})
   consists of three main categories of language elements:
 
   \<^enum> Proof \<^emph>\<open>commands\<close> define the primary language of transactions of the
   underlying Isar/VM interpreter. Typical examples are @{command "fix"},
   @{command "assume"}, @{command "show"}, @{command "proof"}, and @{command
   "qed"}.
 
   Composing proof commands according to the rules of the Isar/VM leads to
   expressions of structured proof text, such that both the machine and the
   human reader can give it a meaning as formal reasoning.
 
   \<^enum> Proof \<^emph>\<open>methods\<close> define a secondary language of mixed forward-backward
   refinement steps involving facts and goals. Typical examples are @{method
   rule}, @{method unfold}, and @{method simp}.
 
   Methods can occur in certain well-defined parts of the Isar proof language,
   say as arguments to @{command "proof"}, @{command "qed"}, or @{command
   "by"}.
 
   \<^enum> \<^emph>\<open>Attributes\<close> define a tertiary language of small annotations to theorems
   being defined or referenced. Attributes can modify both the context and the
   theorem.
 
   Typical examples are @{attribute intro} (which affects the context), and
   @{attribute symmetric} (which affects the theorem).
 \<close>
 
 
 section \<open>Proof commands\<close>
 
 text \<open>
   A \<^emph>\<open>proof command\<close> is state transition of the Isar/VM proof interpreter.
 
   In principle, Isar proof commands could be defined in user-space as well.
   The system is built like that in the first place: one part of the commands
   are primitive, the other part is defined as derived elements. Adding to the
   genuine structured proof language requires profound understanding of the
   Isar/VM machinery, though, so this is beyond the scope of this manual.
 
   What can be done realistically is to define some diagnostic commands that
   inspect the general state of the Isar/VM, and report some feedback to the
   user. Typically this involves checking of the linguistic \<^emph>\<open>mode\<close> of a proof
   state, or peeking at the pending goals (if available).
 
   Another common application is to define a toplevel command that poses a
   problem to the user as Isar proof state and processes the final result
   relatively to the context. Thus a proof can be incorporated into the context
   of some user-space tool, without modifying the Isar proof language itself.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Proof.state} \\
-  @{index_ML Proof.assert_forward: "Proof.state -> Proof.state"} \\
-  @{index_ML Proof.assert_chain: "Proof.state -> Proof.state"} \\
-  @{index_ML Proof.assert_backward: "Proof.state -> Proof.state"} \\
-  @{index_ML Proof.simple_goal: "Proof.state -> {context: Proof.context, goal: thm}"} \\
-  @{index_ML Proof.goal: "Proof.state ->
+  @{define_ML_type Proof.state} \\
+  @{define_ML Proof.assert_forward: "Proof.state -> Proof.state"} \\
+  @{define_ML Proof.assert_chain: "Proof.state -> Proof.state"} \\
+  @{define_ML Proof.assert_backward: "Proof.state -> Proof.state"} \\
+  @{define_ML Proof.simple_goal: "Proof.state -> {context: Proof.context, goal: thm}"} \\
+  @{define_ML Proof.goal: "Proof.state ->
   {context: Proof.context, facts: thm list, goal: thm}"} \\
-  @{index_ML Proof.raw_goal: "Proof.state ->
+  @{define_ML Proof.raw_goal: "Proof.state ->
   {context: Proof.context, facts: thm list, goal: thm}"} \\
-  @{index_ML Proof.theorem: "Method.text option ->
+  @{define_ML Proof.theorem: "Method.text option ->
   (thm list list -> Proof.context -> Proof.context) ->
   (term * term list) list list -> Proof.context -> Proof.state"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Proof.state\<close> represents Isar proof states. This is a
   block-structured configuration with proof context, linguistic mode, and
   optional goal. The latter consists of goal context, goal facts
   (``\<open>using\<close>''), and tactical goal state (see \secref{sec:tactical-goals}).
 
   The general idea is that the facts shall contribute to the refinement of
   some parts of the tactical goal --- how exactly is defined by the proof
   method that is applied in that situation.
 
   \<^descr> \<^ML>\<open>Proof.assert_forward\<close>, \<^ML>\<open>Proof.assert_chain\<close>, \<^ML>\<open>Proof.assert_backward\<close> are partial identity functions that fail unless a
   certain linguistic mode is active, namely ``\<open>proof(state)\<close>'',
   ``\<open>proof(chain)\<close>'', ``\<open>proof(prove)\<close>'', respectively (using the terminology
   of @{cite "isabelle-isar-ref"}).
 
   It is advisable study the implementations of existing proof commands for
   suitable modes to be asserted.
 
   \<^descr> \<^ML>\<open>Proof.simple_goal\<close>~\<open>state\<close> returns the structured Isar goal (if
   available) in the form seen by ``simple'' methods (like @{method simp} or
   @{method blast}). The Isar goal facts are already inserted as premises into
   the subgoals, which are presented individually as in \<^ML>\<open>Proof.goal\<close>.
 
   \<^descr> \<^ML>\<open>Proof.goal\<close>~\<open>state\<close> returns the structured Isar goal (if available)
   in the form seen by regular methods (like @{method rule}). The auxiliary
   internal encoding of Pure conjunctions is split into individual subgoals as
   usual.
 
   \<^descr> \<^ML>\<open>Proof.raw_goal\<close>~\<open>state\<close> returns the structured Isar goal (if
   available) in the raw internal form seen by ``raw'' methods (like @{method
   induct}). This form is rarely appropriate for diagnostic tools; \<^ML>\<open>Proof.simple_goal\<close> or \<^ML>\<open>Proof.goal\<close> should be used in most situations.
 
   \<^descr> \<^ML>\<open>Proof.theorem\<close>~\<open>before_qed after_qed statement ctxt\<close> initializes a
   toplevel Isar proof state within a given context.
 
   The optional \<open>before_qed\<close> method is applied at the end of the proof, just
   before extracting the result (this feature is rarely used).
 
   The \<open>after_qed\<close> continuation receives the extracted result in order to apply
   it to the final context in a suitable way (e.g.\ storing named facts). Note
   that at this generic level the target context is specified as \<^ML_type>\<open>Proof.context\<close>, but the usual wrapping of toplevel proofs into command
   transactions will provide a \<^ML_type>\<open>local_theory\<close> here
   (\chref{ch:local-theory}). This affects the way how results are stored.
 
   The \<open>statement\<close> is given as a nested list of terms, each associated with
   optional @{keyword "is"} patterns as usual in the Isar source language. The
   original nested list structure over terms is turned into one over theorems
   when \<open>after_qed\<close> is invoked.
 \<close>
 
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "Isar.goal"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{Isar.goal}\<close> refers to the regular goal state (if available) of the
   current proof state managed by the Isar toplevel --- as abstract value.
 
   This only works for diagnostic ML commands, such as @{command ML_val} or
   @{command ML_command}.
 \<close>
 
 text %mlex \<open>
   The following example peeks at a certain goal configuration.
 \<close>
 
 notepad
 begin
   have A and B and C
     ML_val
      \<open>val n = Thm.nprems_of (#goal @{Isar.goal});
       \<^assert> (n = 3);\<close>
     sorry
 end
 
 text \<open>
   Here we see 3 individual subgoals in the same way as regular proof methods
   would do.
 \<close>
 
 
 section \<open>Proof methods\<close>
 
 text \<open>
   A \<open>method\<close> is a function \<open>thm\<^sup>* \<rightarrow> context * goal \<rightarrow> (context \<times> goal)\<^sup>*\<^sup>*\<close>
   that operates on the full Isar goal configuration with context, goal facts,
   and tactical goal state and enumerates possible follow-up goal states. Under
   normal circumstances, the goal context remains unchanged, but it is also
   possible to declare named extensions of the proof context (\<^emph>\<open>cases\<close>).
 
   This means a proof method is like a structurally enhanced tactic (cf.\
   \secref{sec:tactics}). The well-formedness conditions for tactics need to
   hold for methods accordingly, with the following additions.
 
   \<^item> Goal addressing is further limited either to operate uniformly on \<^emph>\<open>all\<close>
   subgoals, or specifically on the \<^emph>\<open>first\<close> subgoal.
 
   Exception: old-style tactic emulations that are embedded into the method
   space, e.g.\ @{method rule_tac}.
 
   \<^item> A non-trivial method always needs to make progress: an identical follow-up
   goal state has to be avoided.\<^footnote>\<open>This enables the user to write method
   expressions like \<open>meth\<^sup>+\<close> without looping, while the trivial do-nothing case
   can be recovered via \<open>meth\<^sup>?\<close>.\<close>
 
   Exception: trivial stuttering steps, such as ``@{method -}'' or @{method
   succeed}.
 
   \<^item> Goal facts passed to the method must not be ignored. If there is no
   sensible use of facts outside the goal state, facts should be inserted into
   the subgoals that are addressed by the method.
 
 
   \<^medskip>
   Syntactically, the language of proof methods appears as arguments to Isar
   commands like @{command "by"} or @{command apply}. User-space additions are
   reasonably easy by plugging suitable method-valued parser functions into the
   framework, using the @{command method_setup} command, for example.
 
   To get a better idea about the range of possibilities, consider the
   following Isar proof schemes. This is the general form of structured proof
   text:
 
   \<^medskip>
   \begin{tabular}{l}
   @{command from}~\<open>facts\<^sub>1\<close>~@{command have}~\<open>props\<close>~@{command using}~\<open>facts\<^sub>2\<close> \\
   @{command proof}~\<open>(initial_method)\<close> \\
   \quad\<open>body\<close> \\
   @{command qed}~\<open>(terminal_method)\<close> \\
   \end{tabular}
   \<^medskip>
 
   The goal configuration consists of \<open>facts\<^sub>1\<close> and \<open>facts\<^sub>2\<close> appended in that
   order, and various \<open>props\<close> being claimed. The \<open>initial_method\<close> is invoked
   with facts and goals together and refines the problem to something that is
   handled recursively in the proof \<open>body\<close>. The \<open>terminal_method\<close> has another
   chance to finish any remaining subgoals, but it does not see the facts of
   the initial step.
 
   \<^medskip>
   This pattern illustrates unstructured proof scripts:
 
   \<^medskip>
   \begin{tabular}{l}
   @{command have}~\<open>props\<close> \\
   \quad@{command using}~\<open>facts\<^sub>1\<close>~@{command apply}~\<open>method\<^sub>1\<close> \\
   \quad@{command apply}~\<open>method\<^sub>2\<close> \\
   \quad@{command using}~\<open>facts\<^sub>3\<close>~@{command apply}~\<open>method\<^sub>3\<close> \\
   \quad@{command done} \\
   \end{tabular}
   \<^medskip>
 
   The \<open>method\<^sub>1\<close> operates on the original claim while using \<open>facts\<^sub>1\<close>. Since
   the @{command apply} command structurally resets the facts, the \<open>method\<^sub>2\<close>
   will operate on the remaining goal state without facts. The \<open>method\<^sub>3\<close> will
   see again a collection of \<open>facts\<^sub>3\<close> that has been inserted into the script
   explicitly.
 
   \<^medskip>
   Empirically, any Isar proof method can be categorized as follows.
 
     \<^enum> \<^emph>\<open>Special method with cases\<close> with named context additions associated
     with the follow-up goal state.
 
     Example: @{method "induct"}, which is also a ``raw'' method since it
     operates on the internal representation of simultaneous claims as Pure
     conjunction (\secref{sec:logic-aux}), instead of separate subgoals
     (\secref{sec:tactical-goals}).
 
     \<^enum> \<^emph>\<open>Structured method\<close> with strong emphasis on facts outside the goal
     state.
 
     Example: @{method "rule"}, which captures the key ideas behind structured
     reasoning in Isar in its purest form.
 
     \<^enum> \<^emph>\<open>Simple method\<close> with weaker emphasis on facts, which are inserted into
     subgoals to emulate old-style tactical ``premises''.
 
     Examples: @{method "simp"}, @{method "blast"}, @{method "auto"}.
 
     \<^enum> \<^emph>\<open>Old-style tactic emulation\<close> with detailed numeric goal addressing and
     explicit references to entities of the internal goal state (which are
     otherwise invisible from proper Isar proof text). The naming convention
     \<open>foo_tac\<close> makes this special non-standard status clear.
 
     Example: @{method "rule_tac"}.
 
   When implementing proof methods, it is advisable to study existing
   implementations carefully and imitate the typical ``boiler plate'' for
   context-sensitive parsing and further combinators to wrap-up tactic
   expressions as methods.\<^footnote>\<open>Aliases or abbreviations of the standard method
   combinators should be avoided. Note that from Isabelle99 until Isabelle2009
   the system did provide various odd combinations of method syntax wrappers
   that made applications more complicated than necessary.\<close>
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Proof.method} \\
-  @{index_ML CONTEXT_METHOD: "(thm list -> context_tactic) -> Proof.method"} \\
-  @{index_ML METHOD: "(thm list -> tactic) -> Proof.method"} \\
-  @{index_ML SIMPLE_METHOD: "tactic -> Proof.method"} \\
-  @{index_ML SIMPLE_METHOD': "(int -> tactic) -> Proof.method"} \\
-  @{index_ML Method.insert_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML Method.setup: "binding -> (Proof.context -> Proof.method) context_parser ->
+  @{define_ML_type Proof.method} \\
+  @{define_ML CONTEXT_METHOD: "(thm list -> context_tactic) -> Proof.method"} \\
+  @{define_ML METHOD: "(thm list -> tactic) -> Proof.method"} \\
+  @{define_ML SIMPLE_METHOD: "tactic -> Proof.method"} \\
+  @{define_ML SIMPLE_METHOD': "(int -> tactic) -> Proof.method"} \\
+  @{define_ML Method.insert_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML Method.setup: "binding -> (Proof.context -> Proof.method) context_parser ->
   string -> theory -> theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Proof.method\<close> represents proof methods as abstract type.
 
   \<^descr> \<^ML>\<open>CONTEXT_METHOD\<close>~\<open>(fn facts => context_tactic)\<close> wraps \<open>context_tactic\<close>
   depending on goal facts as a general proof method that may change the proof
-  context dynamically. A typical operation is \<^ML>\<open>Proof_Context.update_cases\<close>, which is wrapped up as combinator @{index_ML
+  context dynamically. A typical operation is \<^ML>\<open>Proof_Context.update_cases\<close>, which is wrapped up as combinator @{define_ML
   CONTEXT_CASES} for convenience.
 
   \<^descr> \<^ML>\<open>METHOD\<close>~\<open>(fn facts => tactic)\<close> wraps \<open>tactic\<close> depending on goal facts
   as regular proof method; the goal context is passed via method syntax.
 
   \<^descr> \<^ML>\<open>SIMPLE_METHOD\<close>~\<open>tactic\<close> wraps a tactic that addresses all subgoals
   uniformly as simple proof method. Goal facts are already inserted into all
   subgoals before \<open>tactic\<close> is applied.
 
   \<^descr> \<^ML>\<open>SIMPLE_METHOD'\<close>~\<open>tactic\<close> wraps a tactic that addresses a specific
   subgoal as simple proof method that operates on subgoal 1. Goal facts are
   inserted into the subgoal then the \<open>tactic\<close> is applied.
 
   \<^descr> \<^ML>\<open>Method.insert_tac\<close>~\<open>ctxt facts i\<close> inserts \<open>facts\<close> into subgoal \<open>i\<close>.
   This is convenient to reproduce part of the \<^ML>\<open>SIMPLE_METHOD\<close> or \<^ML>\<open>SIMPLE_METHOD'\<close> wrapping within regular \<^ML>\<open>METHOD\<close>, for example.
 
   \<^descr> \<^ML>\<open>Method.setup\<close>~\<open>name parser description\<close> provides the functionality of
   the Isar command @{command method_setup} as ML function.
 \<close>
 
 text %mlex \<open>
   See also @{command method_setup} in @{cite "isabelle-isar-ref"} which
   includes some abstract examples.
 
   \<^medskip>
   The following toy examples illustrate how the goal facts and state are
   passed to proof methods. The predefined proof method called ``@{method
   tactic}'' wraps ML source of type \<^ML_type>\<open>tactic\<close> (abstracted over
   \<^ML_text>\<open>facts\<close>). This allows immediate experimentation without parsing of
   concrete syntax.
 \<close>
 
 notepad
 begin
   fix A B :: bool
   assume a: A and b: B
 
   have "A \<and> B"
     apply (tactic \<open>resolve_tac \<^context> @{thms conjI} 1\<close>)
     using a apply (tactic \<open>resolve_tac \<^context> facts 1\<close>)
     using b apply (tactic \<open>resolve_tac \<^context> facts 1\<close>)
     done
 
   have "A \<and> B"
     using a and b
     ML_val \<open>@{Isar.goal}\<close>
     apply (tactic \<open>Method.insert_tac \<^context> facts 1\<close>)
     apply (tactic \<open>(resolve_tac \<^context> @{thms conjI} THEN_ALL_NEW assume_tac \<^context>) 1\<close>)
     done
 end
 
 text \<open>
   \<^medskip>
   The next example implements a method that simplifies the first subgoal by
   rewrite rules that are given as arguments.
 \<close>
 
 method_setup my_simp =
   \<open>Attrib.thms >> (fn thms => fn ctxt =>
     SIMPLE_METHOD' (fn i =>
       CHANGED (asm_full_simp_tac
         (put_simpset HOL_basic_ss ctxt addsimps thms) i)))\<close>
   "rewrite subgoal by given rules"
 
 text \<open>
   The concrete syntax wrapping of @{command method_setup} always
   passes-through the proof context at the end of parsing, but it is not used
   in this example.
 
   The \<^ML>\<open>Attrib.thms\<close> parser produces a list of theorems from the usual Isar
   syntax involving attribute expressions etc.\ (syntax category @{syntax
   thms}) @{cite "isabelle-isar-ref"}. The resulting \<^ML_text>\<open>thms\<close> are
   added to \<^ML>\<open>HOL_basic_ss\<close> which already contains the basic Simplifier
   setup for HOL.
 
   The tactic \<^ML>\<open>asm_full_simp_tac\<close> is the one that is also used in method
   @{method simp} by default. The extra wrapping by the \<^ML>\<open>CHANGED\<close> tactical
   ensures progress of simplification: identical goal states are filtered out
   explicitly to make the raw tactic conform to standard Isar method behaviour.
 
   \<^medskip>
   Method @{method my_simp} can be used in Isar proofs like this:
 \<close>
 
 notepad
 begin
   fix a b c :: 'a
   assume a: "a = b"
   assume b: "b = c"
   have "a = c" by (my_simp a b)
 end
 
 text \<open>
   Here is a similar method that operates on all subgoals, instead of just the
   first one.\<close>
 
 method_setup my_simp_all =
   \<open>Attrib.thms >> (fn thms => fn ctxt =>
     SIMPLE_METHOD
       (CHANGED
         (ALLGOALS (asm_full_simp_tac
           (put_simpset HOL_basic_ss ctxt addsimps thms)))))\<close>
   "rewrite all subgoals by given rules"
 
 notepad
 begin
   fix a b c :: 'a
   assume a: "a = b"
   assume b: "b = c"
   have "a = c" and "c = b" by (my_simp_all a b)
 end
 
 text \<open>
   \<^medskip>
   Apart from explicit arguments, common proof methods typically work with a
   default configuration provided by the context. As a shortcut to rule
   management we use a cheap solution via the @{command named_theorems} command
   to declare a dynamic fact in the context.
 \<close>
 
 named_theorems my_simp
 
 text \<open>
   The proof method is now defined as before, but we append the explicit
   arguments and the rules from the context.
 \<close>
 
 method_setup my_simp' =
   \<open>Attrib.thms >> (fn thms => fn ctxt =>
     let
       val my_simps = Named_Theorems.get ctxt \<^named_theorems>\<open>my_simp\<close>
     in
       SIMPLE_METHOD' (fn i =>
         CHANGED (asm_full_simp_tac
           (put_simpset HOL_basic_ss ctxt
             addsimps (thms @ my_simps)) i))
     end)\<close>
   "rewrite subgoal by given rules and my_simp rules from the context"
 
 text \<open>
   \<^medskip>
   Method @{method my_simp'} can be used in Isar proofs like this:
 \<close>
 
 notepad
 begin
   fix a b c :: 'a
   assume [my_simp]: "a \<equiv> b"
   assume [my_simp]: "b \<equiv> c"
   have "a \<equiv> c" by my_simp'
 end
 
 text \<open>
   \<^medskip>
   The @{method my_simp} variants defined above are ``simple'' methods, i.e.\
   the goal facts are merely inserted as goal premises by the \<^ML>\<open>SIMPLE_METHOD'\<close> or \<^ML>\<open>SIMPLE_METHOD\<close> wrapper. For proof methods that are
   similar to the standard collection of @{method simp}, @{method blast},
   @{method fast}, @{method auto} there is little more that can be done.
 
   Note that using the primary goal facts in the same manner as the method
   arguments obtained via concrete syntax or the context does not meet the
   requirement of ``strong emphasis on facts'' of regular proof methods,
   because rewrite rules as used above can be easily ignored. A proof text
   ``@{command using}~\<open>foo\<close>~@{command "by"}~\<open>my_simp\<close>'' where \<open>foo\<close> is not used
   would deceive the reader.
 
   \<^medskip>
   The technical treatment of rules from the context requires further
   attention. Above we rebuild a fresh \<^ML_type>\<open>simpset\<close> from the arguments
   and \<^emph>\<open>all\<close> rules retrieved from the context on every invocation of the
   method. This does not scale to really large collections of rules, which
   easily emerges in the context of a big theory library, for example.
 
   This is an inherent limitation of the simplistic rule management via
   @{command named_theorems}, because it lacks tool-specific storage and
   retrieval. More realistic applications require efficient index-structures
   that organize theorems in a customized manner, such as a discrimination net
   that is indexed by the left-hand sides of rewrite rules. For variations on
   the Simplifier, re-use of the existing type \<^ML_type>\<open>simpset\<close> is adequate,
   but scalability would require it be maintained statically within the context
   data, not dynamically on each tool invocation.
 \<close>
 
 
 section \<open>Attributes \label{sec:attributes}\<close>
 
 text \<open>
   An \<^emph>\<open>attribute\<close> is a function \<open>context \<times> thm \<rightarrow> context \<times> thm\<close>, which means
   both a (generic) context and a theorem can be modified simultaneously. In
   practice this mixed form is very rare, instead attributes are presented
   either as \<^emph>\<open>declaration attribute:\<close> \<open>thm \<rightarrow> context \<rightarrow> context\<close> or \<^emph>\<open>rule
   attribute:\<close> \<open>context \<rightarrow> thm \<rightarrow> thm\<close>.
 
   Attributes can have additional arguments via concrete syntax. There is a
   collection of context-sensitive parsers for various logical entities (types,
   terms, theorems). These already take care of applying morphisms to the
   arguments when attribute expressions are moved into a different context (see
   also \secref{sec:morphisms}).
 
   When implementing declaration attributes, it is important to operate exactly
   on the variant of the generic context that is provided by the system, which
   is either global theory context or local proof context. In particular, the
   background theory of a local context must not be modified in this
   situation!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type attribute} \\
-  @{index_ML Thm.rule_attribute: "thm list ->
+  @{define_ML_type attribute} \\
+  @{define_ML Thm.rule_attribute: "thm list ->
   (Context.generic -> thm -> thm) -> attribute"} \\
-  @{index_ML Thm.declaration_attribute: "
+  @{define_ML Thm.declaration_attribute: "
   (thm -> Context.generic -> Context.generic) -> attribute"} \\
-  @{index_ML Attrib.setup: "binding -> attribute context_parser ->
+  @{define_ML Attrib.setup: "binding -> attribute context_parser ->
   string -> theory -> theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>attribute\<close> represents attributes as concrete type alias.
 
   \<^descr> \<^ML>\<open>Thm.rule_attribute\<close>~\<open>thms (fn context => rule)\<close> wraps a
   context-dependent rule (mapping on \<^ML_type>\<open>thm\<close>) as attribute.
 
   The \<open>thms\<close> are additional parameters: when forming an abstract closure, the
   system may provide dummy facts that are propagated according to strict
   evaluation discipline. In that case, \<open>rule\<close> is bypassed.
 
   \<^descr> \<^ML>\<open>Thm.declaration_attribute\<close>~\<open>(fn thm => decl)\<close> wraps a
   theorem-dependent declaration (mapping on \<^ML_type>\<open>Context.generic\<close>) as
   attribute.
 
   When forming an abstract closure, the system may provide a dummy fact as
   \<open>thm\<close>. In that case, \<open>decl\<close> is bypassed.
 
   \<^descr> \<^ML>\<open>Attrib.setup\<close>~\<open>name parser description\<close> provides the functionality of
   the Isar command @{command attribute_setup} as ML function.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def attributes} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation attributes} attributes
   \<close>
 
   \<^descr> \<open>@{attributes [\<dots>]}\<close> embeds attribute source representation into the ML
   text, which is particularly useful with declarations like \<^ML>\<open>Local_Theory.note\<close>. Attribute names are internalized at compile time, but
   the source is unevaluated. This means attributes with formal arguments
   (types, terms, theorems) may be subject to odd effects of dynamic scoping!
 \<close>
 
 text %mlex \<open>
   See also @{command attribute_setup} in @{cite "isabelle-isar-ref"} which
   includes some abstract examples.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Local_Theory.thy b/src/Doc/Implementation/Local_Theory.thy
--- a/src/Doc/Implementation/Local_Theory.thy
+++ b/src/Doc/Implementation/Local_Theory.thy
@@ -1,149 +1,149 @@
 (*:maxLineLen=78:*)
 
 theory Local_Theory
 imports Base
 begin
 
 chapter \<open>Local theory specifications \label{ch:local-theory}\<close>
 
 text \<open>
   A \<^emph>\<open>local theory\<close> combines aspects of both theory and proof context (cf.\
   \secref{sec:context}), such that definitional specifications may be given
   relatively to parameters and assumptions. A local theory is represented as a
   regular proof context, augmented by administrative data about the \<^emph>\<open>target
   context\<close>.
 
   The target is usually derived from the background theory by adding local
   \<open>\<FIX>\<close> and \<open>\<ASSUME>\<close> elements, plus suitable modifications of
   non-logical context data (e.g.\ a special type-checking discipline). Once
   initialized, the target is ready to absorb definitional primitives:
   \<open>\<DEFINE>\<close> for terms and \<open>\<NOTE>\<close> for theorems. Such definitions may get
   transformed in a target-specific way, but the programming interface hides
   such details.
 
   Isabelle/Pure provides target mechanisms for locales, type-classes,
   type-class instantiations, and general overloading. In principle, users can
   implement new targets as well, but this rather arcane discipline is beyond
   the scope of this manual. In contrast, implementing derived definitional
   packages to be used within a local theory context is quite easy: the
   interfaces are even simpler and more abstract than the underlying primitives
   for raw theories.
 
   Many definitional packages for local theories are available in Isabelle.
   Although a few old packages only work for global theories, the standard way
   of implementing definitional packages in Isabelle is via the local theory
   interface.
 \<close>
 
 
 section \<open>Definitional elements\<close>
 
 text \<open>
   There are separate elements \<open>\<DEFINE> c \<equiv> t\<close> for terms, and \<open>\<NOTE> b =
   thm\<close> for theorems. Types are treated implicitly, according to Hindley-Milner
   discipline (cf.\ \secref{sec:variables}). These definitional primitives
   essentially act like \<open>let\<close>-bindings within a local context that may already
   contain earlier \<open>let\<close>-bindings and some initial \<open>\<lambda>\<close>-bindings. Thus we gain
   \<^emph>\<open>dependent definitions\<close> that are relative to an initial axiomatic context.
   The following diagram illustrates this idea of axiomatic elements versus
   definitional elements:
 
   \begin{center}
   \begin{tabular}{|l|l|l|}
   \hline
   & \<open>\<lambda>\<close>-binding & \<open>let\<close>-binding \\
   \hline
   types & fixed \<open>\<alpha>\<close> & arbitrary \<open>\<beta>\<close> \\
   terms & \<open>\<FIX> x :: \<tau>\<close> & \<open>\<DEFINE> c \<equiv> t\<close> \\
   theorems & \<open>\<ASSUME> a: A\<close> & \<open>\<NOTE> b = \<^BG>B\<^EN>\<close> \\
   \hline
   \end{tabular}
   \end{center}
 
   A user package merely needs to produce suitable \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close>
   elements according to the application. For example, a package for inductive
   definitions might first \<open>\<DEFINE>\<close> a certain predicate as some fixed-point
   construction, then \<open>\<NOTE>\<close> a proven result about monotonicity of the
   functor involved here, and then produce further derived concepts via
   additional \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close> elements.
 
   The cumulative sequence of \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close> produced at package
   runtime is managed by the local theory infrastructure by means of an
   \<^emph>\<open>auxiliary context\<close>. Thus the system holds up the impression of working
   within a fully abstract situation with hypothetical entities: \<open>\<DEFINE> c \<equiv>
   t\<close> always results in a literal fact \<open>\<^BG>c \<equiv> t\<^EN>\<close>, where \<open>c\<close> is a
   fixed variable \<open>c\<close>. The details about global constants, name spaces etc. are
   handled internally.
 
   So the general structure of a local theory is a sandwich of three layers:
 
   \begin{center}
   \framebox{\quad auxiliary context \quad\framebox{\quad target context \quad\framebox{\quad background theory\quad}}}
   \end{center}
 
   When a definitional package is finished, the auxiliary context is reset to
   the target context. The target now holds definitions for terms and theorems
   that stem from the hypothetical \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close> elements,
   transformed by the particular target policy (see @{cite \<open>\S4--5\<close>
   "Haftmann-Wenzel:2009"} for details).
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type local_theory: Proof.context} \\
-  @{index_ML Named_Target.init: "string list -> string -> theory -> local_theory"} \\[1ex]
-  @{index_ML Local_Theory.define: "(binding * mixfix) * (Attrib.binding * term) ->
+  @{define_ML_type local_theory = Proof.context} \\
+  @{define_ML Named_Target.init: "string list -> string -> theory -> local_theory"} \\[1ex]
+  @{define_ML Local_Theory.define: "(binding * mixfix) * (Attrib.binding * term) ->
     local_theory -> (term * (string * thm)) * local_theory"} \\
-  @{index_ML Local_Theory.note: "Attrib.binding * thm list ->
+  @{define_ML Local_Theory.note: "Attrib.binding * thm list ->
     local_theory -> (string * thm list) * local_theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>local_theory\<close> represents local theories. Although this is
   merely an alias for \<^ML_type>\<open>Proof.context\<close>, it is semantically a subtype
   of the same: a \<^ML_type>\<open>local_theory\<close> holds target information as special
   context data. Subtyping means that any value \<open>lthy:\<close>~\<^ML_type>\<open>local_theory\<close>
   can be also used with operations on expecting a regular \<open>ctxt:\<close>~\<^ML_type>\<open>Proof.context\<close>.
 
   \<^descr> \<^ML>\<open>Named_Target.init\<close>~\<open>includes name thy\<close> initializes a local theory
   derived from the given background theory. An empty name refers to a \<^emph>\<open>global
   theory\<close> context, and a non-empty name refers to a @{command locale} or
   @{command class} context (a fully-qualified internal name is expected here).
   This is useful for experimentation --- normally the Isar toplevel already
   takes care to initialize the local theory context.
 
   \<^descr> \<^ML>\<open>Local_Theory.define\<close>~\<open>((b, mx), (a, rhs)) lthy\<close> defines a local
   entity according to the specification that is given relatively to the
   current \<open>lthy\<close> context. In particular the term of the RHS may refer to
   earlier local entities from the auxiliary context, or hypothetical
   parameters from the target context. The result is the newly defined term
   (which is always a fixed variable with exactly the same name as specified
   for the LHS), together with an equational theorem that states the definition
   as a hypothetical fact.
 
   Unless an explicit name binding is given for the RHS, the resulting fact
   will be called \<open>b_def\<close>. Any given attributes are applied to that same fact
   --- immediately in the auxiliary context \<^emph>\<open>and\<close> in any transformed versions
   stemming from target-specific policies or any later interpretations of
   results from the target context (think of @{command locale} and @{command
   interpretation}, for example). This means that attributes should be usually
   plain declarations such as @{attribute simp}, while non-trivial rules like
   @{attribute simplified} are better avoided.
 
   \<^descr> \<^ML>\<open>Local_Theory.note\<close>~\<open>(a, ths) lthy\<close> is analogous to \<^ML>\<open>Local_Theory.define\<close>, but defines facts instead of terms. There is also a
   slightly more general variant \<^ML>\<open>Local_Theory.notes\<close> that defines several
   facts (with attribute expressions) simultaneously.
 
   This is essentially the internal version of the @{command lemmas} command,
   or @{command declare} if an empty name binding is given.
 \<close>
 
 
 section \<open>Morphisms and declarations \label{sec:morphisms}\<close>
 
 text \<open>
   %FIXME
 
   See also @{cite "Chaieb-Wenzel:2007"}.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Logic.thy b/src/Doc/Implementation/Logic.thy
--- a/src/Doc/Implementation/Logic.thy
+++ b/src/Doc/Implementation/Logic.thy
@@ -1,1259 +1,1259 @@
 (*:maxLineLen=78:*)
 
 theory Logic
 imports Base
 begin
 
 chapter \<open>Primitive logic \label{ch:logic}\<close>
 
 text \<open>
   The logical foundations of Isabelle/Isar are that of the Pure logic, which
   has been introduced as a Natural Deduction framework in @{cite paulson700}.
   This is essentially the same logic as ``\<open>\<lambda>HOL\<close>'' in the more abstract
   setting of Pure Type Systems (PTS) @{cite "Barendregt-Geuvers:2001"},
   although there are some key differences in the specific treatment of simple
   types in Isabelle/Pure.
 
   Following type-theoretic parlance, the Pure logic consists of three levels
   of \<open>\<lambda>\<close>-calculus with corresponding arrows, \<open>\<Rightarrow>\<close> for syntactic function space
   (terms depending on terms), \<open>\<And>\<close> for universal quantification (proofs
   depending on terms), and \<open>\<Longrightarrow>\<close> for implication (proofs depending on proofs).
 
   Derivations are relative to a logical theory, which declares type
   constructors, constants, and axioms. Theory declarations support schematic
   polymorphism, which is strictly speaking outside the logic.\<^footnote>\<open>This is the
   deeper logical reason, why the theory context \<open>\<Theta>\<close> is separate from the proof
   context \<open>\<Gamma>\<close> of the core calculus: type constructors, term constants, and
   facts (proof constants) may involve arbitrary type schemes, but the type of
   a locally fixed term parameter is also fixed!\<close>
 \<close>
 
 
 section \<open>Types \label{sec:types}\<close>
 
 text \<open>
   The language of types is an uninterpreted order-sorted first-order algebra;
   types are qualified by ordered type classes.
 
   \<^medskip>
   A \<^emph>\<open>type class\<close> is an abstract syntactic entity declared in the theory
   context. The \<^emph>\<open>subclass relation\<close> \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close> is specified by stating an
   acyclic generating relation; the transitive closure is maintained
   internally. The resulting relation is an ordering: reflexive, transitive,
   and antisymmetric.
 
   A \<^emph>\<open>sort\<close> is a list of type classes written as \<open>s = {c\<^sub>1, \<dots>, c\<^sub>m}\<close>, it
   represents symbolic intersection. Notationally, the curly braces are omitted
   for singleton intersections, i.e.\ any class \<open>c\<close> may be read as a sort
   \<open>{c}\<close>. The ordering on type classes is extended to sorts according to the
   meaning of intersections: \<open>{c\<^sub>1, \<dots> c\<^sub>m} \<subseteq> {d\<^sub>1, \<dots>, d\<^sub>n}\<close> iff \<open>\<forall>j. \<exists>i. c\<^sub>i \<subseteq>
   d\<^sub>j\<close>. The empty intersection \<open>{}\<close> refers to the universal sort, which is the
   largest element wrt.\ the sort order. Thus \<open>{}\<close> represents the ``full
   sort'', not the empty one! The intersection of all (finitely many) classes
   declared in the current theory is the least element wrt.\ the sort ordering.
 
   \<^medskip>
   A \<^emph>\<open>fixed type variable\<close> is a pair of a basic name (starting with a \<open>'\<close>
   character) and a sort constraint, e.g.\ \<open>('a, s)\<close> which is usually printed
   as \<open>\<alpha>\<^sub>s\<close>. A \<^emph>\<open>schematic type variable\<close> is a pair of an indexname and a sort
   constraint, e.g.\ \<open>(('a, 0), s)\<close> which is usually printed as \<open>?\<alpha>\<^sub>s\<close>.
 
   Note that \<^emph>\<open>all\<close> syntactic components contribute to the identity of type
   variables: basic name, index, and sort constraint. The core logic handles
   type variables with the same name but different sorts as different, although
   the type-inference layer (which is outside the core) rejects anything like
   that.
 
   A \<^emph>\<open>type constructor\<close> \<open>\<kappa>\<close> is a \<open>k\<close>-ary operator on types declared in the
   theory. Type constructor application is written postfix as \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>k)\<kappa>\<close>.
   For \<open>k = 0\<close> the argument tuple is omitted, e.g.\ \<open>prop\<close> instead of \<open>()prop\<close>.
   For \<open>k = 1\<close> the parentheses are omitted, e.g.\ \<open>\<alpha> list\<close> instead of
   \<open>(\<alpha>)list\<close>. Further notation is provided for specific constructors, notably
   the right-associative infix \<open>\<alpha> \<Rightarrow> \<beta>\<close> instead of \<open>(\<alpha>, \<beta>)fun\<close>.
 
   The logical category \<^emph>\<open>type\<close> is defined inductively over type variables and
   type constructors as follows: \<open>\<tau> = \<alpha>\<^sub>s | ?\<alpha>\<^sub>s | (\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>k)\<kappa>\<close>.
 
   A \<^emph>\<open>type abbreviation\<close> is a syntactic definition \<open>(\<^vec>\<alpha>)\<kappa> = \<tau>\<close> of an
   arbitrary type expression \<open>\<tau>\<close> over variables \<open>\<^vec>\<alpha>\<close>. Type abbreviations
   appear as type constructors in the syntax, but are expanded before entering
   the logical core.
 
   A \<^emph>\<open>type arity\<close> declares the image behavior of a type constructor wrt.\ the
   algebra of sorts: \<open>\<kappa> :: (s\<^sub>1, \<dots>, s\<^sub>k)s\<close> means that \<open>(\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>k)\<kappa>\<close> is of
   sort \<open>s\<close> if every argument type \<open>\<tau>\<^sub>i\<close> is of sort \<open>s\<^sub>i\<close>. Arity declarations
   are implicitly completed, i.e.\ \<open>\<kappa> :: (\<^vec>s)c\<close> entails \<open>\<kappa> ::
   (\<^vec>s)c'\<close> for any \<open>c' \<supseteq> c\<close>.
 
   \<^medskip>
   The sort algebra is always maintained as \<^emph>\<open>coregular\<close>, which means that type
   arities are consistent with the subclass relation: for any type constructor
   \<open>\<kappa>\<close>, and classes \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close>, and arities \<open>\<kappa> :: (\<^vec>s\<^sub>1)c\<^sub>1\<close> and \<open>\<kappa> ::
   (\<^vec>s\<^sub>2)c\<^sub>2\<close> holds \<open>\<^vec>s\<^sub>1 \<subseteq> \<^vec>s\<^sub>2\<close> component-wise.
 
   The key property of a coregular order-sorted algebra is that sort
   constraints can be solved in a most general fashion: for each type
   constructor \<open>\<kappa>\<close> and sort \<open>s\<close> there is a most general vector of argument
   sorts \<open>(s\<^sub>1, \<dots>, s\<^sub>k)\<close> such that a type scheme \<open>(\<alpha>\<^bsub>s\<^sub>1\<^esub>, \<dots>, \<alpha>\<^bsub>s\<^sub>k\<^esub>)\<kappa>\<close> is of
   sort \<open>s\<close>. Consequently, type unification has most general solutions (modulo
   equivalence of sorts), so type-inference produces primary types as expected
   @{cite "nipkow-prehofer"}.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type class: string} \\
-  @{index_ML_type sort: "class list"} \\
-  @{index_ML_type arity: "string * sort list * sort"} \\
-  @{index_ML_type typ} \\
-  @{index_ML Term.map_atyps: "(typ -> typ) -> typ -> typ"} \\
-  @{index_ML Term.fold_atyps: "(typ -> 'a -> 'a) -> typ -> 'a -> 'a"} \\
+  @{define_ML_type class = string} \\
+  @{define_ML_type sort = "class list"} \\
+  @{define_ML_type arity = "string * sort list * sort"} \\
+  @{define_ML_type typ} \\
+  @{define_ML Term.map_atyps: "(typ -> typ) -> typ -> typ"} \\
+  @{define_ML Term.fold_atyps: "(typ -> 'a -> 'a) -> typ -> 'a -> 'a"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML Sign.subsort: "theory -> sort * sort -> bool"} \\
-  @{index_ML Sign.of_sort: "theory -> typ * sort -> bool"} \\
-  @{index_ML Sign.add_type: "Proof.context -> binding * int * mixfix -> theory -> theory"} \\
-  @{index_ML Sign.add_type_abbrev: "Proof.context ->
+  @{define_ML Sign.subsort: "theory -> sort * sort -> bool"} \\
+  @{define_ML Sign.of_sort: "theory -> typ * sort -> bool"} \\
+  @{define_ML Sign.add_type: "Proof.context -> binding * int * mixfix -> theory -> theory"} \\
+  @{define_ML Sign.add_type_abbrev: "Proof.context ->
   binding * string list * typ -> theory -> theory"} \\
-  @{index_ML Sign.primitive_class: "binding * class list -> theory -> theory"} \\
-  @{index_ML Sign.primitive_classrel: "class * class -> theory -> theory"} \\
-  @{index_ML Sign.primitive_arity: "arity -> theory -> theory"} \\
+  @{define_ML Sign.primitive_class: "binding * class list -> theory -> theory"} \\
+  @{define_ML Sign.primitive_classrel: "class * class -> theory -> theory"} \\
+  @{define_ML Sign.primitive_arity: "arity -> theory -> theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>class\<close> represents type classes.
 
   \<^descr> Type \<^ML_type>\<open>sort\<close> represents sorts, i.e.\ finite intersections of
   classes. The empty list \<^ML>\<open>[]: sort\<close> refers to the empty class
   intersection, i.e.\ the ``full sort''.
 
   \<^descr> Type \<^ML_type>\<open>arity\<close> represents type arities. A triple \<open>(\<kappa>, \<^vec>s, s)
   : arity\<close> represents \<open>\<kappa> :: (\<^vec>s)s\<close> as described above.
 
   \<^descr> Type \<^ML_type>\<open>typ\<close> represents types; this is a datatype with constructors
   \<^ML>\<open>TFree\<close>, \<^ML>\<open>TVar\<close>, \<^ML>\<open>Type\<close>.
 
   \<^descr> \<^ML>\<open>Term.map_atyps\<close>~\<open>f \<tau>\<close> applies the mapping \<open>f\<close> to all atomic types
   (\<^ML>\<open>TFree\<close>, \<^ML>\<open>TVar\<close>) occurring in \<open>\<tau>\<close>.
 
   \<^descr> \<^ML>\<open>Term.fold_atyps\<close>~\<open>f \<tau>\<close> iterates the operation \<open>f\<close> over all
   occurrences of atomic types (\<^ML>\<open>TFree\<close>, \<^ML>\<open>TVar\<close>) in \<open>\<tau>\<close>; the type
   structure is traversed from left to right.
 
   \<^descr> \<^ML>\<open>Sign.subsort\<close>~\<open>thy (s\<^sub>1, s\<^sub>2)\<close> tests the subsort relation \<open>s\<^sub>1 \<subseteq>
   s\<^sub>2\<close>.
 
   \<^descr> \<^ML>\<open>Sign.of_sort\<close>~\<open>thy (\<tau>, s)\<close> tests whether type \<open>\<tau>\<close> is of sort \<open>s\<close>.
 
   \<^descr> \<^ML>\<open>Sign.add_type\<close>~\<open>ctxt (\<kappa>, k, mx)\<close> declares a new type constructors \<open>\<kappa>\<close>
   with \<open>k\<close> arguments and optional mixfix syntax.
 
   \<^descr> \<^ML>\<open>Sign.add_type_abbrev\<close>~\<open>ctxt (\<kappa>, \<^vec>\<alpha>, \<tau>)\<close> defines a new type
   abbreviation \<open>(\<^vec>\<alpha>)\<kappa> = \<tau>\<close>.
 
   \<^descr> \<^ML>\<open>Sign.primitive_class\<close>~\<open>(c, [c\<^sub>1, \<dots>, c\<^sub>n])\<close> declares a new class \<open>c\<close>,
   together with class relations \<open>c \<subseteq> c\<^sub>i\<close>, for \<open>i = 1, \<dots>, n\<close>.
 
   \<^descr> \<^ML>\<open>Sign.primitive_classrel\<close>~\<open>(c\<^sub>1, c\<^sub>2)\<close> declares the class relation
   \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close>.
 
   \<^descr> \<^ML>\<open>Sign.primitive_arity\<close>~\<open>(\<kappa>, \<^vec>s, s)\<close> declares the arity \<open>\<kappa> ::
   (\<^vec>s)s\<close>.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "class"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "sort"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "type_name"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "type_abbrev"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "nonterminal"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "typ"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation class} embedded
   ;
   @@{ML_antiquotation sort} sort
   ;
   (@@{ML_antiquotation type_name} |
    @@{ML_antiquotation type_abbrev} |
    @@{ML_antiquotation nonterminal}) embedded
   ;
   @@{ML_antiquotation typ} type
   \<close>
 
   \<^descr> \<open>@{class c}\<close> inlines the internalized class \<open>c\<close> --- as \<^ML_type>\<open>string\<close>
   literal.
 
   \<^descr> \<open>@{sort s}\<close> inlines the internalized sort \<open>s\<close> --- as \<^ML_type>\<open>string
   list\<close> literal.
 
   \<^descr> \<open>@{type_name c}\<close> inlines the internalized type constructor \<open>c\<close> --- as
   \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{type_abbrev c}\<close> inlines the internalized type abbreviation \<open>c\<close> --- as
   \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{nonterminal c}\<close> inlines the internalized syntactic type~/ grammar
   nonterminal \<open>c\<close> --- as \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{typ \<tau>}\<close> inlines the internalized type \<open>\<tau>\<close> --- as constructor term for
   datatype \<^ML_type>\<open>typ\<close>.
 \<close>
 
 
 section \<open>Terms \label{sec:terms}\<close>
 
 text \<open>
   The language of terms is that of simply-typed \<open>\<lambda>\<close>-calculus with de-Bruijn
   indices for bound variables (cf.\ @{cite debruijn72} or @{cite
   "paulson-ml2"}), with the types being determined by the corresponding
   binders. In contrast, free variables and constants have an explicit name and
   type in each occurrence.
 
   \<^medskip>
   A \<^emph>\<open>bound variable\<close> is a natural number \<open>b\<close>, which accounts for the number
   of intermediate binders between the variable occurrence in the body and its
   binding position. For example, the de-Bruijn term \<open>\<lambda>\<^bsub>bool\<^esub>. \<lambda>\<^bsub>bool\<^esub>. 1 \<and> 0\<close>
   would correspond to \<open>\<lambda>x\<^bsub>bool\<^esub>. \<lambda>y\<^bsub>bool\<^esub>. x \<and> y\<close> in a named representation.
   Note that a bound variable may be represented by different de-Bruijn indices
   at different occurrences, depending on the nesting of abstractions.
 
   A \<^emph>\<open>loose variable\<close> is a bound variable that is outside the scope of local
   binders. The types (and names) for loose variables can be managed as a
   separate context, that is maintained as a stack of hypothetical binders. The
   core logic operates on closed terms, without any loose variables.
 
   A \<^emph>\<open>fixed variable\<close> is a pair of a basic name and a type, e.g.\ \<open>(x, \<tau>)\<close>
   which is usually printed \<open>x\<^sub>\<tau>\<close> here. A \<^emph>\<open>schematic variable\<close> is a pair of an
   indexname and a type, e.g.\ \<open>((x, 0), \<tau>)\<close> which is likewise printed as
   \<open>?x\<^sub>\<tau>\<close>.
 
   \<^medskip>
   A \<^emph>\<open>constant\<close> is a pair of a basic name and a type, e.g.\ \<open>(c, \<tau>)\<close> which is
   usually printed as \<open>c\<^sub>\<tau>\<close> here. Constants are declared in the context as
   polymorphic families \<open>c :: \<sigma>\<close>, meaning that all substitution instances \<open>c\<^sub>\<tau>\<close>
   for \<open>\<tau> = \<sigma>\<vartheta>\<close> are valid.
 
   The vector of \<^emph>\<open>type arguments\<close> of constant \<open>c\<^sub>\<tau>\<close> wrt.\ the declaration \<open>c
   :: \<sigma>\<close> is defined as the codomain of the matcher \<open>\<vartheta> = {?\<alpha>\<^sub>1 \<mapsto> \<tau>\<^sub>1,
   \<dots>, ?\<alpha>\<^sub>n \<mapsto> \<tau>\<^sub>n}\<close> presented in canonical order \<open>(\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>n)\<close>, corresponding
   to the left-to-right occurrences of the \<open>\<alpha>\<^sub>i\<close> in \<open>\<sigma>\<close>. Within a given theory
   context, there is a one-to-one correspondence between any constant \<open>c\<^sub>\<tau>\<close> and
   the application \<open>c(\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>n)\<close> of its type arguments. For example, with
   \<open>plus :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>\<close>, the instance \<open>plus\<^bsub>nat \<Rightarrow> nat \<Rightarrow> nat\<^esub>\<close> corresponds to
   \<open>plus(nat)\<close>.
 
   Constant declarations \<open>c :: \<sigma>\<close> may contain sort constraints for type
   variables in \<open>\<sigma>\<close>. These are observed by type-inference as expected, but
   \<^emph>\<open>ignored\<close> by the core logic. This means the primitive logic is able to
   reason with instances of polymorphic constants that the user-level
   type-checker would reject due to violation of type class restrictions.
 
   \<^medskip>
   An \<^emph>\<open>atomic term\<close> is either a variable or constant. The logical category
   \<^emph>\<open>term\<close> is defined inductively over atomic terms, with abstraction and
   application as follows: \<open>t = b | x\<^sub>\<tau> | ?x\<^sub>\<tau> | c\<^sub>\<tau> | \<lambda>\<^sub>\<tau>. t | t\<^sub>1 t\<^sub>2\<close>.
   Parsing and printing takes care of converting between an external
   representation with named bound variables. Subsequently, we shall use the
   latter notation instead of internal de-Bruijn representation.
 
   The inductive relation \<open>t :: \<tau>\<close> assigns a (unique) type to a term according
   to the structure of atomic terms, abstractions, and applications:
   \[
   \infer{\<open>a\<^sub>\<tau> :: \<tau>\<close>}{}
   \qquad
   \infer{\<open>(\<lambda>x\<^sub>\<tau>. t) :: \<tau> \<Rightarrow> \<sigma>\<close>}{\<open>t :: \<sigma>\<close>}
   \qquad
   \infer{\<open>t u :: \<sigma>\<close>}{\<open>t :: \<tau> \<Rightarrow> \<sigma>\<close> & \<open>u :: \<tau>\<close>}
   \]
   A \<^emph>\<open>well-typed term\<close> is a term that can be typed according to these rules.
 
   Typing information can be omitted: type-inference is able to reconstruct the
   most general type of a raw term, while assigning most general types to all
   of its variables and constants. Type-inference depends on a context of type
   constraints for fixed variables, and declarations for polymorphic constants.
 
   The identity of atomic terms consists both of the name and the type
   component. This means that different variables \<open>x\<^bsub>\<tau>\<^sub>1\<^esub>\<close> and \<open>x\<^bsub>\<tau>\<^sub>2\<^esub>\<close> may
   become the same after type instantiation. Type-inference rejects variables
   of the same name, but different types. In contrast, mixed instances of
   polymorphic constants occur routinely.
 
   \<^medskip>
   The \<^emph>\<open>hidden polymorphism\<close> of a term \<open>t :: \<sigma>\<close> is the set of type variables
   occurring in \<open>t\<close>, but not in its type \<open>\<sigma>\<close>. This means that the term
   implicitly depends on type arguments that are not accounted in the result
   type, i.e.\ there are different type instances \<open>t\<vartheta> :: \<sigma>\<close> and
   \<open>t\<vartheta>' :: \<sigma>\<close> with the same type. This slightly pathological
   situation notoriously demands additional care.
 
   \<^medskip>
   A \<^emph>\<open>term abbreviation\<close> is a syntactic definition \<open>c\<^sub>\<sigma> \<equiv> t\<close> of a closed term
   \<open>t\<close> of type \<open>\<sigma>\<close>, without any hidden polymorphism. A term abbreviation looks
   like a constant in the syntax, but is expanded before entering the logical
   core. Abbreviations are usually reverted when printing terms, using \<open>t \<rightarrow>
   c\<^sub>\<sigma>\<close> as rules for higher-order rewriting.
 
   \<^medskip>
   Canonical operations on \<open>\<lambda>\<close>-terms include \<open>\<alpha>\<beta>\<eta>\<close>-conversion: \<open>\<alpha>\<close>-conversion
   refers to capture-free renaming of bound variables; \<open>\<beta>\<close>-conversion contracts
   an abstraction applied to an argument term, substituting the argument in the
   body: \<open>(\<lambda>x. b)a\<close> becomes \<open>b[a/x]\<close>; \<open>\<eta>\<close>-conversion contracts vacuous
   application-abstraction: \<open>\<lambda>x. f x\<close> becomes \<open>f\<close>, provided that the bound
   variable does not occur in \<open>f\<close>.
 
   Terms are normally treated modulo \<open>\<alpha>\<close>-conversion, which is implicit in the
   de-Bruijn representation. Names for bound variables in abstractions are
   maintained separately as (meaningless) comments, mostly for parsing and
   printing. Full \<open>\<alpha>\<beta>\<eta>\<close>-conversion is commonplace in various standard
   operations (\secref{sec:obj-rules}) that are based on higher-order
   unification and matching.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type term} \\
-  @{index_ML_op "aconv": "term * term -> bool"} \\
-  @{index_ML Term.map_types: "(typ -> typ) -> term -> term"} \\
-  @{index_ML Term.fold_types: "(typ -> 'a -> 'a) -> term -> 'a -> 'a"} \\
-  @{index_ML Term.map_aterms: "(term -> term) -> term -> term"} \\
-  @{index_ML Term.fold_aterms: "(term -> 'a -> 'a) -> term -> 'a -> 'a"} \\
+  @{define_ML_type term} \\
+  @{define_ML_infix "aconv": "term * term -> bool"} \\
+  @{define_ML Term.map_types: "(typ -> typ) -> term -> term"} \\
+  @{define_ML Term.fold_types: "(typ -> 'a -> 'a) -> term -> 'a -> 'a"} \\
+  @{define_ML Term.map_aterms: "(term -> term) -> term -> term"} \\
+  @{define_ML Term.fold_aterms: "(term -> 'a -> 'a) -> term -> 'a -> 'a"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML fastype_of: "term -> typ"} \\
-  @{index_ML lambda: "term -> term -> term"} \\
-  @{index_ML betapply: "term * term -> term"} \\
-  @{index_ML incr_boundvars: "int -> term -> term"} \\
-  @{index_ML Sign.declare_const: "Proof.context ->
+  @{define_ML fastype_of: "term -> typ"} \\
+  @{define_ML lambda: "term -> term -> term"} \\
+  @{define_ML betapply: "term * term -> term"} \\
+  @{define_ML incr_boundvars: "int -> term -> term"} \\
+  @{define_ML Sign.declare_const: "Proof.context ->
   (binding * typ) * mixfix -> theory -> term * theory"} \\
-  @{index_ML Sign.add_abbrev: "string -> binding * term ->
+  @{define_ML Sign.add_abbrev: "string -> binding * term ->
   theory -> (term * term) * theory"} \\
-  @{index_ML Sign.const_typargs: "theory -> string * typ -> typ list"} \\
-  @{index_ML Sign.const_instance: "theory -> string * typ list -> typ"} \\
+  @{define_ML Sign.const_typargs: "theory -> string * typ -> typ list"} \\
+  @{define_ML Sign.const_instance: "theory -> string * typ list -> typ"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>term\<close> represents de-Bruijn terms, with comments in
   abstractions, and explicitly named free variables and constants; this is a
-  datatype with constructors @{index_ML Bound}, @{index_ML Free}, @{index_ML
-  Var}, @{index_ML Const}, @{index_ML Abs}, @{index_ML_op "$"}.
+  datatype with constructors @{define_ML Bound}, @{define_ML Free}, @{define_ML
+  Var}, @{define_ML Const}, @{define_ML Abs}, @{define_ML_infix "$"}.
 
   \<^descr> \<open>t\<close>~\<^ML_text>\<open>aconv\<close>~\<open>u\<close> checks \<open>\<alpha>\<close>-equivalence of two terms. This is the
   basic equality relation on type \<^ML_type>\<open>term\<close>; raw datatype equality
   should only be used for operations related to parsing or printing!
 
   \<^descr> \<^ML>\<open>Term.map_types\<close>~\<open>f t\<close> applies the mapping \<open>f\<close> to all types occurring
   in \<open>t\<close>.
 
   \<^descr> \<^ML>\<open>Term.fold_types\<close>~\<open>f t\<close> iterates the operation \<open>f\<close> over all
   occurrences of types in \<open>t\<close>; the term structure is traversed from left to
   right.
 
   \<^descr> \<^ML>\<open>Term.map_aterms\<close>~\<open>f t\<close> applies the mapping \<open>f\<close> to all atomic terms
   (\<^ML>\<open>Bound\<close>, \<^ML>\<open>Free\<close>, \<^ML>\<open>Var\<close>, \<^ML>\<open>Const\<close>) occurring in \<open>t\<close>.
 
   \<^descr> \<^ML>\<open>Term.fold_aterms\<close>~\<open>f t\<close> iterates the operation \<open>f\<close> over all
   occurrences of atomic terms (\<^ML>\<open>Bound\<close>, \<^ML>\<open>Free\<close>, \<^ML>\<open>Var\<close>, \<^ML>\<open>Const\<close>) in \<open>t\<close>; the term structure is traversed from left to right.
 
   \<^descr> \<^ML>\<open>fastype_of\<close>~\<open>t\<close> determines the type of a well-typed term. This
   operation is relatively slow, despite the omission of any sanity checks.
 
   \<^descr> \<^ML>\<open>lambda\<close>~\<open>a b\<close> produces an abstraction \<open>\<lambda>a. b\<close>, where occurrences of
   the atomic term \<open>a\<close> in the body \<open>b\<close> are replaced by bound variables.
 
   \<^descr> \<^ML>\<open>betapply\<close>~\<open>(t, u)\<close> produces an application \<open>t u\<close>, with topmost
   \<open>\<beta>\<close>-conversion if \<open>t\<close> is an abstraction.
 
   \<^descr> \<^ML>\<open>incr_boundvars\<close>~\<open>j\<close> increments a term's dangling bound variables by
   the offset \<open>j\<close>. This is required when moving a subterm into a context where
   it is enclosed by a different number of abstractions. Bound variables with a
   matching abstraction are unaffected.
 
   \<^descr> \<^ML>\<open>Sign.declare_const\<close>~\<open>ctxt ((c, \<sigma>), mx)\<close> declares a new constant \<open>c ::
   \<sigma>\<close> with optional mixfix syntax.
 
   \<^descr> \<^ML>\<open>Sign.add_abbrev\<close>~\<open>print_mode (c, t)\<close> introduces a new term
   abbreviation \<open>c \<equiv> t\<close>.
 
   \<^descr> \<^ML>\<open>Sign.const_typargs\<close>~\<open>thy (c, \<tau>)\<close> and \<^ML>\<open>Sign.const_instance\<close>~\<open>thy
   (c, [\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>n])\<close> convert between two representations of polymorphic
   constants: full type instance vs.\ compact type arguments form.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "const_name"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "const_abbrev"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "const"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "term"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "prop"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   (@@{ML_antiquotation const_name} |
    @@{ML_antiquotation const_abbrev}) embedded
   ;
   @@{ML_antiquotation const} ('(' (type + ',') ')')?
   ;
   @@{ML_antiquotation term} term
   ;
   @@{ML_antiquotation prop} prop
   \<close>
 
   \<^descr> \<open>@{const_name c}\<close> inlines the internalized logical constant name \<open>c\<close> ---
   as \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{const_abbrev c}\<close> inlines the internalized abbreviated constant name \<open>c\<close>
   --- as \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{const c(\<^vec>\<tau>)}\<close> inlines the internalized constant \<open>c\<close> with precise
   type instantiation in the sense of \<^ML>\<open>Sign.const_instance\<close> --- as \<^ML>\<open>Const\<close> constructor term for datatype \<^ML_type>\<open>term\<close>.
 
   \<^descr> \<open>@{term t}\<close> inlines the internalized term \<open>t\<close> --- as constructor term for
   datatype \<^ML_type>\<open>term\<close>.
 
   \<^descr> \<open>@{prop \<phi>}\<close> inlines the internalized proposition \<open>\<phi>\<close> --- as constructor
   term for datatype \<^ML_type>\<open>term\<close>.
 \<close>
 
 
 section \<open>Theorems \label{sec:thms}\<close>
 
 text \<open>
   A \<^emph>\<open>proposition\<close> is a well-typed term of type \<open>prop\<close>, a \<^emph>\<open>theorem\<close> is a
   proven proposition (depending on a context of hypotheses and the background
   theory). Primitive inferences include plain Natural Deduction rules for the
   primary connectives \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> of the framework. There is also a builtin
   notion of equality/equivalence \<open>\<equiv>\<close>.
 \<close>
 
 
 subsection \<open>Primitive connectives and rules \label{sec:prim-rules}\<close>
 
 text \<open>
   The theory \<open>Pure\<close> contains constant declarations for the primitive
   connectives \<open>\<And>\<close>, \<open>\<Longrightarrow>\<close>, and \<open>\<equiv>\<close> of the logical framework, see
   \figref{fig:pure-connectives}. The derivability judgment \<open>A\<^sub>1, \<dots>, A\<^sub>n \<turnstile> B\<close>
   is defined inductively by the primitive inferences given in
   \figref{fig:prim-rules}, with the global restriction that the hypotheses
   must \<^emph>\<open>not\<close> contain any schematic variables. The builtin equality is
   conceptually axiomatized as shown in \figref{fig:pure-equality}, although
   the implementation works directly with derived inferences.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{ll}
   \<open>all :: (\<alpha> \<Rightarrow> prop) \<Rightarrow> prop\<close> & universal quantification (binder \<open>\<And>\<close>) \\
   \<open>\<Longrightarrow> :: prop \<Rightarrow> prop \<Rightarrow> prop\<close> & implication (right associative infix) \\
   \<open>\<equiv> :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> prop\<close> & equality relation (infix) \\
   \end{tabular}
   \caption{Primitive connectives of Pure}\label{fig:pure-connectives}
   \end{center}
   \end{figure}
 
   \begin{figure}[htb]
   \begin{center}
   \[
   \infer[\<open>(axiom)\<close>]{\<open>\<turnstile> A\<close>}{\<open>A \<in> \<Theta>\<close>}
   \qquad
   \infer[\<open>(assume)\<close>]{\<open>A \<turnstile> A\<close>}{}
   \]
   \[
   \infer[\<open>(\<And>\<hyphen>intro)\<close>]{\<open>\<Gamma> \<turnstile> \<And>x. B[x]\<close>}{\<open>\<Gamma> \<turnstile> B[x]\<close> & \<open>x \<notin> \<Gamma>\<close>}
   \qquad
   \infer[\<open>(\<And>\<hyphen>elim)\<close>]{\<open>\<Gamma> \<turnstile> B[a]\<close>}{\<open>\<Gamma> \<turnstile> \<And>x. B[x]\<close>}
   \]
   \[
   \infer[\<open>(\<Longrightarrow>\<hyphen>intro)\<close>]{\<open>\<Gamma> - A \<turnstile> A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \qquad
   \infer[\<open>(\<Longrightarrow>\<hyphen>elim)\<close>]{\<open>\<Gamma>\<^sub>1 \<union> \<Gamma>\<^sub>2 \<turnstile> B\<close>}{\<open>\<Gamma>\<^sub>1 \<turnstile> A \<Longrightarrow> B\<close> & \<open>\<Gamma>\<^sub>2 \<turnstile> A\<close>}
   \]
   \caption{Primitive inferences of Pure}\label{fig:prim-rules}
   \end{center}
   \end{figure}
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{ll}
   \<open>\<turnstile> (\<lambda>x. b[x]) a \<equiv> b[a]\<close> & \<open>\<beta>\<close>-conversion \\
   \<open>\<turnstile> x \<equiv> x\<close> & reflexivity \\
   \<open>\<turnstile> x \<equiv> y \<Longrightarrow> P x \<Longrightarrow> P y\<close> & substitution \\
   \<open>\<turnstile> (\<And>x. f x \<equiv> g x) \<Longrightarrow> f \<equiv> g\<close> & extensionality \\
   \<open>\<turnstile> (A \<Longrightarrow> B) \<Longrightarrow> (B \<Longrightarrow> A) \<Longrightarrow> A \<equiv> B\<close> & logical equivalence \\
   \end{tabular}
   \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality}
   \end{center}
   \end{figure}
 
   The introduction and elimination rules for \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> are analogous to
   formation of dependently typed \<open>\<lambda>\<close>-terms representing the underlying proof
   objects. Proof terms are irrelevant in the Pure logic, though; they cannot
   occur within propositions. The system provides a runtime option to record
   explicit proof terms for primitive inferences, see also
   \secref{sec:proof-terms}. Thus all three levels of \<open>\<lambda>\<close>-calculus become
   explicit: \<open>\<Rightarrow>\<close> for terms, and \<open>\<And>/\<Longrightarrow>\<close> for proofs (cf.\ @{cite
   "Berghofer-Nipkow:2000:TPHOL"}).
 
   Observe that locally fixed parameters (as in \<open>\<And>\<hyphen>intro\<close>) need not be recorded
   in the hypotheses, because the simple syntactic types of Pure are always
   inhabitable. ``Assumptions'' \<open>x :: \<tau>\<close> for type-membership are only present
   as long as some \<open>x\<^sub>\<tau>\<close> occurs in the statement body.\<^footnote>\<open>This is the key
   difference to ``\<open>\<lambda>HOL\<close>'' in the PTS framework @{cite
   "Barendregt-Geuvers:2001"}, where hypotheses \<open>x : A\<close> are treated uniformly
   for propositions and types.\<close>
 
   \<^medskip>
   The axiomatization of a theory is implicitly closed by forming all instances
   of type and term variables: \<open>\<turnstile> A\<vartheta>\<close> holds for any substitution
   instance of an axiom \<open>\<turnstile> A\<close>. By pushing substitutions through derivations
   inductively, we also get admissible \<open>generalize\<close> and \<open>instantiate\<close> rules as
   shown in \figref{fig:subst-rules}.
 
   \begin{figure}[htb]
   \begin{center}
   \[
   \infer{\<open>\<Gamma> \<turnstile> B[?\<alpha>]\<close>}{\<open>\<Gamma> \<turnstile> B[\<alpha>]\<close> & \<open>\<alpha> \<notin> \<Gamma>\<close>}
   \quad
   \infer[\quad\<open>(generalize)\<close>]{\<open>\<Gamma> \<turnstile> B[?x]\<close>}{\<open>\<Gamma> \<turnstile> B[x]\<close> & \<open>x \<notin> \<Gamma>\<close>}
   \]
   \[
   \infer{\<open>\<Gamma> \<turnstile> B[\<tau>]\<close>}{\<open>\<Gamma> \<turnstile> B[?\<alpha>]\<close>}
   \quad
   \infer[\quad\<open>(instantiate)\<close>]{\<open>\<Gamma> \<turnstile> B[t]\<close>}{\<open>\<Gamma> \<turnstile> B[?x]\<close>}
   \]
   \caption{Admissible substitution rules}\label{fig:subst-rules}
   \end{center}
   \end{figure}
 
   Note that \<open>instantiate\<close> does not require an explicit side-condition, because
   \<open>\<Gamma>\<close> may never contain schematic variables.
 
   In principle, variables could be substituted in hypotheses as well, but this
   would disrupt the monotonicity of reasoning: deriving \<open>\<Gamma>\<vartheta> \<turnstile>
   B\<vartheta>\<close> from \<open>\<Gamma> \<turnstile> B\<close> is correct, but \<open>\<Gamma>\<vartheta> \<supseteq> \<Gamma>\<close> does not
   necessarily hold: the result belongs to a different proof context.
 
   \<^medskip> An \<^emph>\<open>oracle\<close> is a function that produces axioms on the fly. Logically,
   this is an instance of the \<open>axiom\<close> rule (\figref{fig:prim-rules}), but there
   is an operational difference. The inference kernel records oracle
   invocations within derivations of theorems by a unique tag. This also
   includes implicit type-class reasoning via the order-sorted algebra of class
   relations and type arities (see also @{command_ref instantiation} and
   @{command_ref instance}).
 
   Axiomatizations should be limited to the bare minimum, typically as part of
   the initial logical basis of an object-logic formalization. Later on,
   theories are usually developed in a strictly definitional fashion, by
   stating only certain equalities over new constants.
 
   A \<^emph>\<open>simple definition\<close> consists of a constant declaration \<open>c :: \<sigma>\<close> together
   with an axiom \<open>\<turnstile> c \<equiv> t\<close>, where \<open>t :: \<sigma>\<close> is a closed term without any hidden
   polymorphism. The RHS may depend on further defined constants, but not \<open>c\<close>
   itself. Definitions of functions may be presented as \<open>c \<^vec>x \<equiv> t\<close>
   instead of the puristic \<open>c \<equiv> \<lambda>\<^vec>x. t\<close>.
 
   An \<^emph>\<open>overloaded definition\<close> consists of a collection of axioms for the same
   constant, with zero or one equations \<open>c((\<^vec>\<alpha>)\<kappa>) \<equiv> t\<close> for each type
   constructor \<open>\<kappa>\<close> (for distinct variables \<open>\<^vec>\<alpha>\<close>). The RHS may mention
   previously defined constants as above, or arbitrary constants \<open>d(\<alpha>\<^sub>i)\<close> for
   some \<open>\<alpha>\<^sub>i\<close> projected from \<open>\<^vec>\<alpha>\<close>. Thus overloaded definitions
   essentially work by primitive recursion over the syntactic structure of a
   single type argument. See also @{cite \<open>\S4.3\<close>
   "Haftmann-Wenzel:2006:classes"}.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Logic.all: "term -> term -> term"} \\
-  @{index_ML Logic.mk_implies: "term * term -> term"} \\
-  \end{mldecls}
-  \begin{mldecls}
-  @{index_ML_type ctyp} \\
-  @{index_ML_type cterm} \\
-  @{index_ML Thm.ctyp_of: "Proof.context -> typ -> ctyp"} \\
-  @{index_ML Thm.cterm_of: "Proof.context -> term -> cterm"} \\
-  @{index_ML Thm.apply: "cterm -> cterm -> cterm"} \\
-  @{index_ML Thm.lambda: "cterm -> cterm -> cterm"} \\
-  @{index_ML Thm.all: "Proof.context -> cterm -> cterm -> cterm"} \\
-  @{index_ML Drule.mk_implies: "cterm * cterm -> cterm"} \\
+  @{define_ML Logic.all: "term -> term -> term"} \\
+  @{define_ML Logic.mk_implies: "term * term -> term"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML_type thm} \\
-  @{index_ML Thm.transfer: "theory -> thm -> thm"} \\
-  @{index_ML Thm.assume: "cterm -> thm"} \\
-  @{index_ML Thm.forall_intr: "cterm -> thm -> thm"} \\
-  @{index_ML Thm.forall_elim: "cterm -> thm -> thm"} \\
-  @{index_ML Thm.implies_intr: "cterm -> thm -> thm"} \\
-  @{index_ML Thm.implies_elim: "thm -> thm -> thm"} \\
-  @{index_ML Thm.generalize: "string list * string list -> int -> thm -> thm"} \\
-  @{index_ML Thm.instantiate: "((indexname * sort) * ctyp) list * ((indexname * typ) * cterm) list
+  @{define_ML_type ctyp} \\
+  @{define_ML_type cterm} \\
+  @{define_ML Thm.ctyp_of: "Proof.context -> typ -> ctyp"} \\
+  @{define_ML Thm.cterm_of: "Proof.context -> term -> cterm"} \\
+  @{define_ML Thm.apply: "cterm -> cterm -> cterm"} \\
+  @{define_ML Thm.lambda: "cterm -> cterm -> cterm"} \\
+  @{define_ML Thm.all: "Proof.context -> cterm -> cterm -> cterm"} \\
+  @{define_ML Drule.mk_implies: "cterm * cterm -> cterm"} \\
+  \end{mldecls}
+  \begin{mldecls}
+  @{define_ML_type thm} \\
+  @{define_ML Thm.transfer: "theory -> thm -> thm"} \\
+  @{define_ML Thm.assume: "cterm -> thm"} \\
+  @{define_ML Thm.forall_intr: "cterm -> thm -> thm"} \\
+  @{define_ML Thm.forall_elim: "cterm -> thm -> thm"} \\
+  @{define_ML Thm.implies_intr: "cterm -> thm -> thm"} \\
+  @{define_ML Thm.implies_elim: "thm -> thm -> thm"} \\
+  @{define_ML Thm.generalize: "string list * string list -> int -> thm -> thm"} \\
+  @{define_ML Thm.instantiate: "((indexname * sort) * ctyp) list * ((indexname * typ) * cterm) list
   -> thm -> thm"} \\
-  @{index_ML Thm.add_axiom: "Proof.context ->
+  @{define_ML Thm.add_axiom: "Proof.context ->
   binding * term -> theory -> (string * thm) * theory"} \\
-  @{index_ML Thm.add_oracle: "binding * ('a -> cterm) -> theory ->
+  @{define_ML Thm.add_oracle: "binding * ('a -> cterm) -> theory ->
   (string * ('a -> thm)) * theory"} \\
-  @{index_ML Thm.add_def: "Defs.context -> bool -> bool ->
+  @{define_ML Thm.add_def: "Defs.context -> bool -> bool ->
   binding * term -> theory -> (string * thm) * theory"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML Theory.add_deps: "Defs.context -> string ->
+  @{define_ML Theory.add_deps: "Defs.context -> string ->
   Defs.entry -> Defs.entry list -> theory -> theory"} \\
-  @{index_ML Thm_Deps.all_oracles: "thm list -> Proofterm.oracle list"} \\
+  @{define_ML Thm_Deps.all_oracles: "thm list -> Proofterm.oracle list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Logic.all\<close>~\<open>a B\<close> produces a Pure quantification \<open>\<And>a. B\<close>, where
   occurrences of the atomic term \<open>a\<close> in the body proposition \<open>B\<close> are replaced
   by bound variables. (See also \<^ML>\<open>lambda\<close> on terms.)
 
   \<^descr> \<^ML>\<open>Logic.mk_implies\<close>~\<open>(A, B)\<close> produces a Pure implication \<open>A \<Longrightarrow> B\<close>.
 
   \<^descr> Types \<^ML_type>\<open>ctyp\<close> and \<^ML_type>\<open>cterm\<close> represent certified types and
   terms, respectively. These are abstract datatypes that guarantee that its
   values have passed the full well-formedness (and well-typedness) checks,
   relative to the declarations of type constructors, constants etc.\ in the
   background theory. The abstract types \<^ML_type>\<open>ctyp\<close> and \<^ML_type>\<open>cterm\<close>
   are part of the same inference kernel that is mainly responsible for
   \<^ML_type>\<open>thm\<close>. Thus syntactic operations on \<^ML_type>\<open>ctyp\<close> and \<^ML_type>\<open>cterm\<close> are located in the \<^ML_structure>\<open>Thm\<close> module, even though theorems
   are not yet involved at that stage.
 
   \<^descr> \<^ML>\<open>Thm.ctyp_of\<close>~\<open>ctxt \<tau>\<close> and \<^ML>\<open>Thm.cterm_of\<close>~\<open>ctxt t\<close> explicitly
   check types and terms, respectively. This also involves some basic
   normalizations, such expansion of type and term abbreviations from the
   underlying theory context. Full re-certification is relatively slow and
   should be avoided in tight reasoning loops.
 
   \<^descr> \<^ML>\<open>Thm.apply\<close>, \<^ML>\<open>Thm.lambda\<close>, \<^ML>\<open>Thm.all\<close>, \<^ML>\<open>Drule.mk_implies\<close>
   etc.\ compose certified terms (or propositions) incrementally. This is
-  equivalent to \<^ML>\<open>Thm.cterm_of\<close> after unchecked \<^ML_op>\<open>$\<close>, \<^ML>\<open>lambda\<close>,
+  equivalent to \<^ML>\<open>Thm.cterm_of\<close> after unchecked \<^ML_infix>\<open>$\<close>, \<^ML>\<open>lambda\<close>,
   \<^ML>\<open>Logic.all\<close>, \<^ML>\<open>Logic.mk_implies\<close> etc., but there can be a big
   difference in performance when large existing entities are composed by a few
   extra constructions on top. There are separate operations to decompose
   certified terms and theorems to produce certified terms again.
 
   \<^descr> Type \<^ML_type>\<open>thm\<close> represents proven propositions. This is an abstract
   datatype that guarantees that its values have been constructed by basic
   principles of the \<^ML_structure>\<open>Thm\<close> module. Every \<^ML_type>\<open>thm\<close> value
   refers its background theory, cf.\ \secref{sec:context-theory}.
 
   \<^descr> \<^ML>\<open>Thm.transfer\<close>~\<open>thy thm\<close> transfers the given theorem to a \<^emph>\<open>larger\<close>
   theory, see also \secref{sec:context}. This formal adjustment of the
   background context has no logical significance, but is occasionally required
   for formal reasons, e.g.\ when theorems that are imported from more basic
   theories are used in the current situation.
 
   \<^descr> \<^ML>\<open>Thm.assume\<close>, \<^ML>\<open>Thm.forall_intr\<close>, \<^ML>\<open>Thm.forall_elim\<close>, \<^ML>\<open>Thm.implies_intr\<close>, and \<^ML>\<open>Thm.implies_elim\<close> correspond to the primitive
   inferences of \figref{fig:prim-rules}.
 
   \<^descr> \<^ML>\<open>Thm.generalize\<close>~\<open>(\<^vec>\<alpha>, \<^vec>x)\<close> corresponds to the
   \<open>generalize\<close> rules of \figref{fig:subst-rules}. Here collections of type and
   term variables are generalized simultaneously, specified by the given basic
   names.
 
   \<^descr> \<^ML>\<open>Thm.instantiate\<close>~\<open>(\<^vec>\<alpha>\<^sub>s, \<^vec>x\<^sub>\<tau>)\<close> corresponds to the
   \<open>instantiate\<close> rules of \figref{fig:subst-rules}. Type variables are
   substituted before term variables. Note that the types in \<open>\<^vec>x\<^sub>\<tau>\<close> refer
   to the instantiated versions.
 
   \<^descr> \<^ML>\<open>Thm.add_axiom\<close>~\<open>ctxt (name, A)\<close> declares an arbitrary proposition as
   axiom, and retrieves it as a theorem from the resulting theory, cf.\ \<open>axiom\<close>
   in \figref{fig:prim-rules}. Note that the low-level representation in the
   axiom table may differ slightly from the returned theorem.
 
   \<^descr> \<^ML>\<open>Thm.add_oracle\<close>~\<open>(binding, oracle)\<close> produces a named oracle rule,
   essentially generating arbitrary axioms on the fly, cf.\ \<open>axiom\<close> in
   \figref{fig:prim-rules}.
 
   \<^descr> \<^ML>\<open>Thm.add_def\<close>~\<open>ctxt unchecked overloaded (name, c \<^vec>x \<equiv> t)\<close>
   states a definitional axiom for an existing constant \<open>c\<close>. Dependencies are
   recorded via \<^ML>\<open>Theory.add_deps\<close>, unless the \<open>unchecked\<close> option is set.
   Note that the low-level representation in the axiom table may differ
   slightly from the returned theorem.
 
   \<^descr> \<^ML>\<open>Theory.add_deps\<close>~\<open>ctxt name c\<^sub>\<tau> \<^vec>d\<^sub>\<sigma>\<close> declares dependencies of
   a named specification for constant \<open>c\<^sub>\<tau>\<close>, relative to existing
   specifications for constants \<open>\<^vec>d\<^sub>\<sigma>\<close>. This also works for type
   constructors.
 
   \<^descr> \<^ML>\<open>Thm_Deps.all_oracles\<close>~\<open>thms\<close> returns all oracles used in the
   internal derivation of the given theorems; this covers the full graph of
   transitive dependencies. The result contains an authentic oracle name; if
   @{ML Proofterm.proofs} was at least @{ML 1} during the oracle inference, it
   also contains the position of the oracle invocation and its proposition. See
   also the command @{command_ref "thm_oracles"}.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "ctyp"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "cterm"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "cprop"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "thm"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "thms"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "lemma"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "oracle_name"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation ctyp} typ
   ;
   @@{ML_antiquotation cterm} term
   ;
   @@{ML_antiquotation cprop} prop
   ;
   @@{ML_antiquotation thm} thm
   ;
   @@{ML_antiquotation thms} thms
   ;
   @@{ML_antiquotation lemma} ('(' @'open' ')')? ((prop +) + @'and') \<newline>
     @'by' method method?
   ;
   @@{ML_antiquotation oracle_name} embedded
   \<close>
 
   \<^descr> \<open>@{ctyp \<tau>}\<close> produces a certified type wrt.\ the current background theory
   --- as abstract value of type \<^ML_type>\<open>ctyp\<close>.
 
   \<^descr> \<open>@{cterm t}\<close> and \<open>@{cprop \<phi>}\<close> produce a certified term wrt.\ the current
   background theory --- as abstract value of type \<^ML_type>\<open>cterm\<close>.
 
   \<^descr> \<open>@{thm a}\<close> produces a singleton fact --- as abstract value of type
   \<^ML_type>\<open>thm\<close>.
 
   \<^descr> \<open>@{thms a}\<close> produces a general fact --- as abstract value of type
   \<^ML_type>\<open>thm list\<close>.
 
   \<^descr> \<open>@{lemma \<phi> by meth}\<close> produces a fact that is proven on the spot according
   to the minimal proof, which imitates a terminal Isar proof. The result is an
   abstract value of type \<^ML_type>\<open>thm\<close> or \<^ML_type>\<open>thm list\<close>, depending on
   the number of propositions given here.
 
   The internal derivation object lacks a proper theorem name, but it is
   formally closed, unless the \<open>(open)\<close> option is specified (this may impact
   performance of applications with proof terms).
 
   Since ML antiquotations are always evaluated at compile-time, there is no
   run-time overhead even for non-trivial proofs. Nonetheless, the
   justification is syntactically limited to a single @{command "by"} step.
   More complex Isar proofs should be done in regular theory source, before
   compiling the corresponding ML text that uses the result.
 
   \<^descr> \<open>@{oracle_name a}\<close> inlines the internalized oracle name \<open>a\<close> --- as
   \<^ML_type>\<open>string\<close> literal.
 \<close>
 
 
 subsection \<open>Auxiliary connectives \label{sec:logic-aux}\<close>
 
 text \<open>
   Theory \<open>Pure\<close> provides a few auxiliary connectives that are defined on top
   of the primitive ones, see \figref{fig:pure-aux}. These special constants
   are useful in certain internal encodings, and are normally not directly
   exposed to the user.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{ll}
   \<open>conjunction :: prop \<Rightarrow> prop \<Rightarrow> prop\<close> & (infix \<open>&&&\<close>) \\
   \<open>\<turnstile> A &&& B \<equiv> (\<And>C. (A \<Longrightarrow> B \<Longrightarrow> C) \<Longrightarrow> C)\<close> \\[1ex]
   \<open>prop :: prop \<Rightarrow> prop\<close> & (prefix \<open>#\<close>, suppressed) \\
   \<open>#A \<equiv> A\<close> \\[1ex]
   \<open>term :: \<alpha> \<Rightarrow> prop\<close> & (prefix \<open>TERM\<close>) \\
   \<open>term x \<equiv> (\<And>A. A \<Longrightarrow> A)\<close> \\[1ex]
   \<open>type :: \<alpha> itself\<close> & (prefix \<open>TYPE\<close>) \\
   \<open>(unspecified)\<close> \\
   \end{tabular}
   \caption{Definitions of auxiliary connectives}\label{fig:pure-aux}
   \end{center}
   \end{figure}
 
   The introduction \<open>A \<Longrightarrow> B \<Longrightarrow> A &&& B\<close>, and eliminations (projections) \<open>A &&& B
   \<Longrightarrow> A\<close> and \<open>A &&& B \<Longrightarrow> B\<close> are available as derived rules. Conjunction allows to
   treat simultaneous assumptions and conclusions uniformly, e.g.\ consider \<open>A
   \<Longrightarrow> B \<Longrightarrow> C &&& D\<close>. In particular, the goal mechanism represents multiple claims
   as explicit conjunction internally, but this is refined (via backwards
   introduction) into separate sub-goals before the user commences the proof;
   the final result is projected into a list of theorems using eliminations
   (cf.\ \secref{sec:tactical-goals}).
 
   The \<open>prop\<close> marker (\<open>#\<close>) makes arbitrarily complex propositions appear as
   atomic, without changing the meaning: \<open>\<Gamma> \<turnstile> A\<close> and \<open>\<Gamma> \<turnstile> #A\<close> are
   interchangeable. See \secref{sec:tactical-goals} for specific operations.
 
   The \<open>term\<close> marker turns any well-typed term into a derivable proposition: \<open>\<turnstile>
   TERM t\<close> holds unconditionally. Although this is logically vacuous, it allows
   to treat terms and proofs uniformly, similar to a type-theoretic framework.
 
   The \<open>TYPE\<close> constructor is the canonical representative of the unspecified
   type \<open>\<alpha> itself\<close>; it essentially injects the language of types into that of
   terms. There is specific notation \<open>TYPE(\<tau>)\<close> for \<open>TYPE\<^bsub>\<tau> itself\<^esub>\<close>. Although
   being devoid of any particular meaning, the term \<open>TYPE(\<tau>)\<close> accounts for the
   type \<open>\<tau>\<close> within the term language. In particular, \<open>TYPE(\<alpha>)\<close> may be used as
   formal argument in primitive definitions, in order to circumvent hidden
   polymorphism (cf.\ \secref{sec:terms}). For example, \<open>c TYPE(\<alpha>) \<equiv> A[\<alpha>]\<close>
   defines \<open>c :: \<alpha> itself \<Rightarrow> prop\<close> in terms of a proposition \<open>A\<close> that depends on
   an additional type argument, which is essentially a predicate on types.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Conjunction.intr: "thm -> thm -> thm"} \\
-  @{index_ML Conjunction.elim: "thm -> thm * thm"} \\
-  @{index_ML Drule.mk_term: "cterm -> thm"} \\
-  @{index_ML Drule.dest_term: "thm -> cterm"} \\
-  @{index_ML Logic.mk_type: "typ -> term"} \\
-  @{index_ML Logic.dest_type: "term -> typ"} \\
+  @{define_ML Conjunction.intr: "thm -> thm -> thm"} \\
+  @{define_ML Conjunction.elim: "thm -> thm * thm"} \\
+  @{define_ML Drule.mk_term: "cterm -> thm"} \\
+  @{define_ML Drule.dest_term: "thm -> cterm"} \\
+  @{define_ML Logic.mk_type: "typ -> term"} \\
+  @{define_ML Logic.dest_type: "term -> typ"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Conjunction.intr\<close> derives \<open>A &&& B\<close> from \<open>A\<close> and \<open>B\<close>.
 
   \<^descr> \<^ML>\<open>Conjunction.elim\<close> derives \<open>A\<close> and \<open>B\<close> from \<open>A &&& B\<close>.
 
   \<^descr> \<^ML>\<open>Drule.mk_term\<close> derives \<open>TERM t\<close>.
 
   \<^descr> \<^ML>\<open>Drule.dest_term\<close> recovers term \<open>t\<close> from \<open>TERM t\<close>.
 
   \<^descr> \<^ML>\<open>Logic.mk_type\<close>~\<open>\<tau>\<close> produces the term \<open>TYPE(\<tau>)\<close>.
 
   \<^descr> \<^ML>\<open>Logic.dest_type\<close>~\<open>TYPE(\<tau>)\<close> recovers the type \<open>\<tau>\<close>.
 \<close>
 
 
 subsection \<open>Sort hypotheses\<close>
 
 text \<open>
   Type variables are decorated with sorts, as explained in \secref{sec:types}.
   This constrains type instantiation to certain ranges of types: variable
   \<open>\<alpha>\<^sub>s\<close> may only be assigned to types \<open>\<tau>\<close> that belong to sort \<open>s\<close>. Within the
   logic, sort constraints act like implicit preconditions on the result \<open>\<lparr>\<alpha>\<^sub>1
   : s\<^sub>1\<rparr>, \<dots>, \<lparr>\<alpha>\<^sub>n : s\<^sub>n\<rparr>, \<Gamma> \<turnstile> \<phi>\<close> where the type variables \<open>\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n\<close> cover
   the propositions \<open>\<Gamma>\<close>, \<open>\<phi>\<close>, as well as the proof of \<open>\<Gamma> \<turnstile> \<phi>\<close>.
 
   These \<^emph>\<open>sort hypothesis\<close> of a theorem are passed monotonically through
   further derivations. They are redundant, as long as the statement of a
   theorem still contains the type variables that are accounted here. The
   logical significance of sort hypotheses is limited to the boundary case
   where type variables disappear from the proposition, e.g.\ \<open>\<lparr>\<alpha>\<^sub>s : s\<rparr> \<turnstile> \<phi>\<close>.
   Since such dangling type variables can be renamed arbitrarily without
   changing the proposition \<open>\<phi>\<close>, the inference kernel maintains sort hypotheses
   in anonymous form \<open>s \<turnstile> \<phi>\<close>.
 
   In most practical situations, such extra sort hypotheses may be stripped in
   a final bookkeeping step, e.g.\ at the end of a proof: they are typically
   left over from intermediate reasoning with type classes that can be
   satisfied by some concrete type \<open>\<tau>\<close> of sort \<open>s\<close> to replace the hypothetical
   type variable \<open>\<alpha>\<^sub>s\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Thm.extra_shyps: "thm -> sort list"} \\
-  @{index_ML Thm.strip_shyps: "thm -> thm"} \\
+  @{define_ML Thm.extra_shyps: "thm -> sort list"} \\
+  @{define_ML Thm.strip_shyps: "thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Thm.extra_shyps\<close>~\<open>thm\<close> determines the extraneous sort hypotheses of
   the given theorem, i.e.\ the sorts that are not present within type
   variables of the statement.
 
   \<^descr> \<^ML>\<open>Thm.strip_shyps\<close>~\<open>thm\<close> removes any extraneous sort hypotheses that
   can be witnessed from the type signature.
 \<close>
 
 text %mlex \<open>
   The following artificial example demonstrates the derivation of \<^prop>\<open>False\<close> with a pending sort hypothesis involving a logically empty sort.
 \<close>
 
 class empty =
   assumes bad: "\<And>(x::'a) y. x \<noteq> y"
 
 theorem (in empty) false: False
   using bad by blast
 
 ML_val \<open>\<^assert> (Thm.extra_shyps @{thm false} = [\<^sort>\<open>empty\<close>])\<close>
 
 text \<open>
   Thanks to the inference kernel managing sort hypothesis according to their
   logical significance, this example is merely an instance of \<^emph>\<open>ex falso
   quodlibet consequitur\<close> --- not a collapse of the logical framework!
 \<close>
 
 
 section \<open>Object-level rules \label{sec:obj-rules}\<close>
 
 text \<open>
   The primitive inferences covered so far mostly serve foundational purposes.
   User-level reasoning usually works via object-level rules that are
   represented as theorems of Pure. Composition of rules involves
   \<^emph>\<open>backchaining\<close>, \<^emph>\<open>higher-order unification\<close> modulo \<open>\<alpha>\<beta>\<eta>\<close>-conversion of
   \<open>\<lambda>\<close>-terms, and so-called \<^emph>\<open>lifting\<close> of rules into a context of \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close>
   connectives. Thus the full power of higher-order Natural Deduction in
   Isabelle/Pure becomes readily available.
 \<close>
 
 
 subsection \<open>Hereditary Harrop Formulae\<close>
 
 text \<open>
   The idea of object-level rules is to model Natural Deduction inferences in
   the style of Gentzen @{cite "Gentzen:1935"}, but we allow arbitrary nesting
   similar to @{cite "Schroeder-Heister:1984"}. The most basic rule format is
   that of a \<^emph>\<open>Horn Clause\<close>:
   \[
   \infer{\<open>A\<close>}{\<open>A\<^sub>1\<close> & \<open>\<dots>\<close> & \<open>A\<^sub>n\<close>}
   \]
   where \<open>A, A\<^sub>1, \<dots>, A\<^sub>n\<close> are atomic propositions of the framework, usually of
   the form \<open>Trueprop B\<close>, where \<open>B\<close> is a (compound) object-level statement.
   This object-level inference corresponds to an iterated implication in Pure
   like this:
   \[
   \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> A\<close>
   \]
   As an example consider conjunction introduction: \<open>A \<Longrightarrow> B \<Longrightarrow> A \<and> B\<close>. Any
   parameters occurring in such rule statements are conceptionally treated as
   arbitrary:
   \[
   \<open>\<And>x\<^sub>1 \<dots> x\<^sub>m. A\<^sub>1 x\<^sub>1 \<dots> x\<^sub>m \<Longrightarrow> \<dots> A\<^sub>n x\<^sub>1 \<dots> x\<^sub>m \<Longrightarrow> A x\<^sub>1 \<dots> x\<^sub>m\<close>
   \]
 
   Nesting of rules means that the positions of \<open>A\<^sub>i\<close> may again hold compound
   rules, not just atomic propositions. Propositions of this format are called
   \<^emph>\<open>Hereditary Harrop Formulae\<close> in the literature @{cite "Miller:1991"}. Here
   we give an inductive characterization as follows:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<^bold>x\<close> & set of variables \\
   \<open>\<^bold>A\<close> & set of atomic propositions \\
   \<open>\<^bold>H  =  \<And>\<^bold>x\<^sup>*. \<^bold>H\<^sup>* \<Longrightarrow> \<^bold>A\<close> & set of Hereditary Harrop Formulas \\
   \end{tabular}
   \<^medskip>
 
   Thus we essentially impose nesting levels on propositions formed from \<open>\<And>\<close>
   and \<open>\<Longrightarrow>\<close>. At each level there is a prefix of parameters and compound
   premises, concluding an atomic proposition. Typical examples are
   \<open>\<longrightarrow>\<close>-introduction \<open>(A \<Longrightarrow> B) \<Longrightarrow> A \<longrightarrow> B\<close> or mathematical induction \<open>P 0 \<Longrightarrow> (\<And>n. P n
   \<Longrightarrow> P (Suc n)) \<Longrightarrow> P n\<close>. Even deeper nesting occurs in well-founded induction
   \<open>(\<And>x. (\<And>y. y \<prec> x \<Longrightarrow> P y) \<Longrightarrow> P x) \<Longrightarrow> P x\<close>, but this already marks the limit of
   rule complexity that is usually seen in practice.
 
   \<^medskip>
   Regular user-level inferences in Isabelle/Pure always maintain the following
   canonical form of results:
 
   \<^item> Normalization by \<open>(A \<Longrightarrow> (\<And>x. B x)) \<equiv> (\<And>x. A \<Longrightarrow> B x)\<close>, which is a theorem of
   Pure, means that quantifiers are pushed in front of implication at each
   level of nesting. The normal form is a Hereditary Harrop Formula.
 
   \<^item> The outermost prefix of parameters is represented via schematic variables:
   instead of \<open>\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> A \<^vec>x\<close> we have \<open>\<^vec>H
   ?\<^vec>x \<Longrightarrow> A ?\<^vec>x\<close>. Note that this representation looses information
   about the order of parameters, and vacuous quantifiers vanish automatically.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Simplifier.norm_hhf: "Proof.context -> thm -> thm"} \\
+  @{define_ML Simplifier.norm_hhf: "Proof.context -> thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Simplifier.norm_hhf\<close>~\<open>ctxt thm\<close> normalizes the given theorem
   according to the canonical form specified above. This is occasionally
   helpful to repair some low-level tools that do not handle Hereditary Harrop
   Formulae properly.
 \<close>
 
 
 subsection \<open>Rule composition\<close>
 
 text \<open>
   The rule calculus of Isabelle/Pure provides two main inferences: @{inference
   resolution} (i.e.\ back-chaining of rules) and @{inference assumption}
   (i.e.\ closing a branch), both modulo higher-order unification. There are
   also combined variants, notably @{inference elim_resolution} and @{inference
   dest_resolution}.
 
   To understand the all-important @{inference resolution} principle, we first
   consider raw @{inference_def composition} (modulo higher-order unification
   with substitution \<open>\<vartheta>\<close>):
   \[
   \infer[(@{inference_def composition})]{\<open>\<^vec>A\<vartheta> \<Longrightarrow> C\<vartheta>\<close>}
   {\<open>\<^vec>A \<Longrightarrow> B\<close> & \<open>B' \<Longrightarrow> C\<close> & \<open>B\<vartheta> = B'\<vartheta>\<close>}
   \]
   Here the conclusion of the first rule is unified with the premise of the
   second; the resulting rule instance inherits the premises of the first and
   conclusion of the second. Note that \<open>C\<close> can again consist of iterated
   implications. We can also permute the premises of the second rule
   back-and-forth in order to compose with \<open>B'\<close> in any position (subsequently
   we shall always refer to position 1 w.l.o.g.).
 
   In @{inference composition} the internal structure of the common part \<open>B\<close>
   and \<open>B'\<close> is not taken into account. For proper @{inference resolution} we
   require \<open>B\<close> to be atomic, and explicitly observe the structure \<open>\<And>\<^vec>x.
   \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x\<close> of the premise of the second rule. The idea
   is to adapt the first rule by ``lifting'' it into this context, by means of
   iterated application of the following inferences:
   \[
   \infer[(@{inference_def imp_lift})]{\<open>(\<^vec>H \<Longrightarrow> \<^vec>A) \<Longrightarrow> (\<^vec>H \<Longrightarrow> B)\<close>}{\<open>\<^vec>A \<Longrightarrow> B\<close>}
   \]
   \[
   \infer[(@{inference_def all_lift})]{\<open>(\<And>\<^vec>x. \<^vec>A (?\<^vec>a \<^vec>x)) \<Longrightarrow> (\<And>\<^vec>x. B (?\<^vec>a \<^vec>x))\<close>}{\<open>\<^vec>A ?\<^vec>a \<Longrightarrow> B ?\<^vec>a\<close>}
   \]
   By combining raw composition with lifting, we get full @{inference
   resolution} as follows:
   \[
   \infer[(@{inference_def resolution})]
   {\<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> \<^vec>A (?\<^vec>a \<^vec>x))\<vartheta> \<Longrightarrow> C\<vartheta>\<close>}
   {\begin{tabular}{l}
     \<open>\<^vec>A ?\<^vec>a \<Longrightarrow> B ?\<^vec>a\<close> \\
     \<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x) \<Longrightarrow> C\<close> \\
     \<open>(\<lambda>\<^vec>x. B (?\<^vec>a \<^vec>x))\<vartheta> = B'\<vartheta>\<close> \\
    \end{tabular}}
   \]
 
   Continued resolution of rules allows to back-chain a problem towards more
   and sub-problems. Branches are closed either by resolving with a rule of 0
   premises, or by producing a ``short-circuit'' within a solved situation
   (again modulo unification):
   \[
   \infer[(@{inference_def assumption})]{\<open>C\<vartheta>\<close>}
   {\<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> A \<^vec>x) \<Longrightarrow> C\<close> & \<open>A\<vartheta> = H\<^sub>i\<vartheta>\<close>~~\mbox{(for some~\<open>i\<close>)}}
   \]
 
   %FIXME @{inference_def elim_resolution}, @{inference_def dest_resolution}
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_op "RSN": "thm * (int * thm) -> thm"} \\
-  @{index_ML_op "RS": "thm * thm -> thm"} \\
+  @{define_ML_infix "RSN": "thm * (int * thm) -> thm"} \\
+  @{define_ML_infix "RS": "thm * thm -> thm"} \\
 
-  @{index_ML_op "RLN": "thm list * (int * thm list) -> thm list"} \\
-  @{index_ML_op "RL": "thm list * thm list -> thm list"} \\
+  @{define_ML_infix "RLN": "thm list * (int * thm list) -> thm list"} \\
+  @{define_ML_infix "RL": "thm list * thm list -> thm list"} \\
 
-  @{index_ML_op "MRS": "thm list * thm -> thm"} \\
-  @{index_ML_op "OF": "thm * thm list -> thm"} \\
+  @{define_ML_infix "MRS": "thm list * thm -> thm"} \\
+  @{define_ML_infix "OF": "thm * thm list -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<open>rule\<^sub>1 RSN (i, rule\<^sub>2)\<close> resolves the conclusion of \<open>rule\<^sub>1\<close> with the
   \<open>i\<close>-th premise of \<open>rule\<^sub>2\<close>, according to the @{inference resolution}
   principle explained above. Unless there is precisely one resolvent it raises
   exception \<^ML>\<open>THM\<close>.
 
   This corresponds to the rule attribute @{attribute THEN} in Isar source
   language.
 
   \<^descr> \<open>rule\<^sub>1 RS rule\<^sub>2\<close> abbreviates \<open>rule\<^sub>1 RSN (1, rule\<^sub>2)\<close>.
 
   \<^descr> \<open>rules\<^sub>1 RLN (i, rules\<^sub>2)\<close> joins lists of rules. For every \<open>rule\<^sub>1\<close> in
   \<open>rules\<^sub>1\<close> and \<open>rule\<^sub>2\<close> in \<open>rules\<^sub>2\<close>, it resolves the conclusion of \<open>rule\<^sub>1\<close>
   with the \<open>i\<close>-th premise of \<open>rule\<^sub>2\<close>, accumulating multiple results in one
   big list. Note that such strict enumerations of higher-order unifications
   can be inefficient compared to the lazy variant seen in elementary tactics
   like \<^ML>\<open>resolve_tac\<close>.
 
   \<^descr> \<open>rules\<^sub>1 RL rules\<^sub>2\<close> abbreviates \<open>rules\<^sub>1 RLN (1, rules\<^sub>2)\<close>.
 
   \<^descr> \<open>[rule\<^sub>1, \<dots>, rule\<^sub>n] MRS rule\<close> resolves \<open>rule\<^sub>i\<close> against premise \<open>i\<close> of
   \<open>rule\<close>, for \<open>i = n, \<dots>, 1\<close>. By working from right to left, newly emerging
   premises are concatenated in the result, without interfering.
 
   \<^descr> \<open>rule OF rules\<close> is an alternative notation for \<open>rules MRS rule\<close>, which
   makes rule composition look more like function application. Note that the
   argument \<open>rules\<close> need not be atomic.
 
   This corresponds to the rule attribute @{attribute OF} in Isar source
   language.
 \<close>
 
 
 section \<open>Proof terms \label{sec:proof-terms}\<close>
 
 text \<open>
   The Isabelle/Pure inference kernel can record the proof of each theorem as a
   proof term that contains all logical inferences in detail. Rule composition
   by resolution (\secref{sec:obj-rules}) and type-class reasoning is broken
   down to primitive rules of the logical framework. The proof term can be
   inspected by a separate proof-checker, for example.
 
   According to the well-known \<^emph>\<open>Curry-Howard isomorphism\<close>, a proof can be
   viewed as a \<open>\<lambda>\<close>-term. Following this idea, proofs in Isabelle are internally
   represented by a datatype similar to the one for terms described in
   \secref{sec:terms}. On top of these syntactic terms, two more layers of
   \<open>\<lambda>\<close>-calculus are added, which correspond to \<open>\<And>x :: \<alpha>. B x\<close> and \<open>A \<Longrightarrow> B\<close>
   according to the propositions-as-types principle. The resulting 3-level
   \<open>\<lambda>\<close>-calculus resembles ``\<open>\<lambda>HOL\<close>'' in the more abstract setting of Pure Type
   Systems (PTS) @{cite "Barendregt-Geuvers:2001"}, if some fine points like
   schematic polymorphism and type classes are ignored.
 
   \<^medskip>
   \<^emph>\<open>Proof abstractions\<close> of the form \<open>\<^bold>\<lambda>x :: \<alpha>. prf\<close> or \<open>\<^bold>\<lambda>p : A. prf\<close>
   correspond to introduction of \<open>\<And>\<close>/\<open>\<Longrightarrow>\<close>, and \<^emph>\<open>proof applications\<close> of the form
   \<open>p \<cdot> t\<close> or \<open>p \<bullet> q\<close> correspond to elimination of \<open>\<And>\<close>/\<open>\<Longrightarrow>\<close>. Actual types \<open>\<alpha>\<close>,
   propositions \<open>A\<close>, and terms \<open>t\<close> might be suppressed and reconstructed from
   the overall proof term.
 
   \<^medskip>
   Various atomic proofs indicate special situations within the proof
   construction as follows.
 
   A \<^emph>\<open>bound proof variable\<close> is a natural number \<open>b\<close> that acts as de-Bruijn
   index for proof term abstractions.
 
   A \<^emph>\<open>minimal proof\<close> ``\<open>?\<close>'' is a dummy proof term. This indicates some
   unrecorded part of the proof.
 
   \<open>Hyp A\<close> refers to some pending hypothesis by giving its proposition. This
   indicates an open context of implicit hypotheses, similar to loose bound
   variables or free variables within a term (\secref{sec:terms}).
 
   An \<^emph>\<open>axiom\<close> or \<^emph>\<open>oracle\<close> \<open>a : A[\<^vec>\<tau>]\<close> refers some postulated \<open>proof
   constant\<close>, which is subject to schematic polymorphism of theory content, and
   the particular type instantiation may be given explicitly. The vector of
   types \<open>\<^vec>\<tau>\<close> refers to the schematic type variables in the generic
   proposition \<open>A\<close> in canonical order.
 
   A \<^emph>\<open>proof promise\<close> \<open>a : A[\<^vec>\<tau>]\<close> is a placeholder for some proof of
   polymorphic proposition \<open>A\<close>, with explicit type instantiation as given by
   the vector \<open>\<^vec>\<tau>\<close>, as above. Unlike axioms or oracles, proof promises
   may be \<^emph>\<open>fulfilled\<close> eventually, by substituting \<open>a\<close> by some particular proof
   \<open>q\<close> at the corresponding type instance. This acts like Hindley-Milner
   \<open>let\<close>-polymorphism: a generic local proof definition may get used at
   different type instances, and is replaced by the concrete instance
   eventually.
 
   A \<^emph>\<open>named theorem\<close> wraps up some concrete proof as a closed formal entity,
   in the manner of constant definitions for proof terms. The \<^emph>\<open>proof body\<close> of
   such boxed theorems involves some digest about oracles and promises
   occurring in the original proof. This allows the inference kernel to manage
   this critical information without the full overhead of explicit proof terms.
 \<close>
 
 
 subsection \<open>Reconstructing and checking proof terms\<close>
 
 text \<open>
   Fully explicit proof terms can be large, but most of this information is
   redundant and can be reconstructed from the context. Therefore, the
   Isabelle/Pure inference kernel records only \<^emph>\<open>implicit\<close> proof terms, by
   omitting all typing information in terms, all term and type labels of proof
   abstractions, and some argument terms of applications \<open>p \<cdot> t\<close> (if possible).
 
   There are separate operations to reconstruct the full proof term later on,
   using \<^emph>\<open>higher-order pattern unification\<close> @{cite "nipkow-patterns" and
   "Berghofer-Nipkow:2000:TPHOL"}.
 
   The \<^emph>\<open>proof checker\<close> expects a fully reconstructed proof term, and can turn
   it into a theorem by replaying its primitive inferences within the kernel.
 \<close>
 
 
 subsection \<open>Concrete syntax of proof terms\<close>
 
 text \<open>
   The concrete syntax of proof terms is a slight extension of the regular
   inner syntax of Isabelle/Pure @{cite "isabelle-isar-ref"}. Its main
   syntactic category @{syntax (inner) proof} is defined as follows:
 
   \begin{center}
   \begin{supertabular}{rclr}
 
   @{syntax_def (inner) proof} & = & \<open>\<^bold>\<lambda>\<close> \<open>params\<close> \<^verbatim>\<open>.\<close> \<open>proof\<close> \\
     & \<open>|\<close> & \<open>proof\<close> \<open>\<cdot>\<close> \<open>any\<close> \\
     & \<open>|\<close> & \<open>proof\<close> \<open>\<bullet>\<close> \<open>proof\<close> \\
     & \<open>|\<close> & \<open>id  |  longid\<close> \\
   \\
 
   \<open>param\<close> & = & \<open>idt\<close> \\
     & \<open>|\<close> & \<open>idt\<close> \<^verbatim>\<open>:\<close> \<open>prop\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(\<close> \<open>param\<close> \<^verbatim>\<open>)\<close> \\
   \\
 
   \<open>params\<close> & = & \<open>param\<close> \\
     & \<open>|\<close> & \<open>param\<close> \<open>params\<close> \\
 
   \end{supertabular}
   \end{center}
 
   Implicit term arguments in partial proofs are indicated by ``\<open>_\<close>''. Type
   arguments for theorems and axioms may be specified using \<open>p \<cdot> TYPE(type)\<close>
   (they must appear before any other term argument of a theorem or axiom, but
   may be omitted altogether).
 
   \<^medskip>
   There are separate read and print operations for proof terms, in order to
   avoid conflicts with the regular term language.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type proof} \\
-  @{index_ML_type proof_body} \\
-  @{index_ML Proofterm.proofs: "int Unsynchronized.ref"} \\
-  @{index_ML Proofterm.reconstruct_proof:
+  @{define_ML_type proof} \\
+  @{define_ML_type proof_body} \\
+  @{define_ML Proofterm.proofs: "int Unsynchronized.ref"} \\
+  @{define_ML Proofterm.reconstruct_proof:
   "theory -> term -> proof -> proof"} \\
-  @{index_ML Proofterm.expand_proof: "theory ->
+  @{define_ML Proofterm.expand_proof: "theory ->
   (Proofterm.thm_header -> string option) -> proof -> proof"} \\
-  @{index_ML Proof_Checker.thm_of_proof: "theory -> proof -> thm"} \\
-  @{index_ML Proof_Syntax.read_proof: "theory -> bool -> bool -> string -> proof"} \\
-  @{index_ML Proof_Syntax.pretty_proof: "Proof.context -> proof -> Pretty.T"} \\
+  @{define_ML Proof_Checker.thm_of_proof: "theory -> proof -> thm"} \\
+  @{define_ML Proof_Syntax.read_proof: "theory -> bool -> bool -> string -> proof"} \\
+  @{define_ML Proof_Syntax.pretty_proof: "Proof.context -> proof -> Pretty.T"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>proof\<close> represents proof terms; this is a datatype with
-  constructors @{index_ML Abst}, @{index_ML AbsP}, @{index_ML_op "%"},
-  @{index_ML_op "%%"}, @{index_ML PBound}, @{index_ML MinProof}, @{index_ML
-  Hyp}, @{index_ML PAxm}, @{index_ML Oracle}, @{index_ML PThm} as explained
+  constructors @{define_ML Abst}, @{define_ML AbsP}, @{define_ML_infix "%"},
+  @{define_ML_infix "%%"}, @{define_ML PBound}, @{define_ML MinProof}, @{define_ML
+  Hyp}, @{define_ML PAxm}, @{define_ML Oracle}, @{define_ML PThm} as explained
   above. %FIXME PClass (!?)
 
   \<^descr> Type \<^ML_type>\<open>proof_body\<close> represents the nested proof information of a
   named theorem, consisting of a digest of oracles and named theorem over some
   proof term. The digest only covers the directly visible part of the proof:
   in order to get the full information, the implicit graph of nested theorems
   needs to be traversed (e.g.\ using \<^ML>\<open>Proofterm.fold_body_thms\<close>).
 
   \<^descr> \<^ML>\<open>Thm.proof_of\<close>~\<open>thm\<close> and \<^ML>\<open>Thm.proof_body_of\<close>~\<open>thm\<close> produce the
   proof term or proof body (with digest of oracles and theorems) from a given
   theorem. Note that this involves a full join of internal futures that
   fulfill pending proof promises, and thus disrupts the natural bottom-up
   construction of proofs by introducing dynamic ad-hoc dependencies. Parallel
   performance may suffer by inspecting proof terms at run-time.
 
   \<^descr> \<^ML>\<open>Proofterm.proofs\<close> specifies the detail of proof recording within
   \<^ML_type>\<open>thm\<close> values produced by the inference kernel: \<^ML>\<open>0\<close> records only
   the names of oracles, \<^ML>\<open>1\<close> records oracle names and propositions, \<^ML>\<open>2\<close>
   additionally records full proof terms. Officially named theorems that
   contribute to a result are recorded in any case.
 
   \<^descr> \<^ML>\<open>Proofterm.reconstruct_proof\<close>~\<open>thy prop prf\<close> turns the implicit
   proof term \<open>prf\<close> into a full proof of the given proposition.
 
   Reconstruction may fail if \<open>prf\<close> is not a proof of \<open>prop\<close>, or if it does not
   contain sufficient information for reconstruction. Failure may only happen
   for proofs that are constructed manually, but not for those produced
   automatically by the inference kernel.
 
   \<^descr> \<^ML>\<open>Proofterm.expand_proof\<close>~\<open>thy expand prf\<close> reconstructs and expands
   the proofs of nested theorems according to the given \<open>expand\<close> function: a
   result of @{ML \<open>SOME ""\<close>} means full expansion, @{ML \<open>SOME\<close>}~\<open>name\<close> means to
   keep the theorem node but replace its internal name, @{ML NONE} means no
   change.
 
   \<^descr> \<^ML>\<open>Proof_Checker.thm_of_proof\<close>~\<open>thy prf\<close> turns the given (full) proof
   into a theorem, by replaying it using only primitive rules of the inference
   kernel.
 
   \<^descr> \<^ML>\<open>Proof_Syntax.read_proof\<close>~\<open>thy b\<^sub>1 b\<^sub>2 s\<close> reads in a proof term. The
   Boolean flags indicate the use of sort and type information. Usually, typing
   information is left implicit and is inferred during proof reconstruction.
   %FIXME eliminate flags!?
 
   \<^descr> \<^ML>\<open>Proof_Syntax.pretty_proof\<close>~\<open>ctxt prf\<close> pretty-prints the given proof
   term.
 \<close>
 
 text %mlex \<open>
   \<^item> \<^file>\<open>~~/src/HOL/Proofs/ex/Proof_Terms.thy\<close> provides basic examples involving
   proof terms.
 
   \<^item> \<^file>\<open>~~/src/HOL/Proofs/ex/XML_Data.thy\<close> demonstrates export and import of
   proof terms via XML/ML data representation.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/ML.thy b/src/Doc/Implementation/ML.thy
--- a/src/Doc/Implementation/ML.thy
+++ b/src/Doc/Implementation/ML.thy
@@ -1,2211 +1,2211 @@
 (*:maxLineLen=78:*)
 
 theory "ML"
 imports Base
 begin
 
 chapter \<open>Isabelle/ML\<close>
 
 text \<open>
   Isabelle/ML is best understood as a certain culture based on Standard ML.
   Thus it is not a new programming language, but a certain way to use SML at
   an advanced level within the Isabelle environment. This covers a variety of
   aspects that are geared towards an efficient and robust platform for
   applications of formal logic with fully foundational proof construction ---
   according to the well-known \<^emph>\<open>LCF principle\<close>. There is specific
   infrastructure with library modules to address the needs of this difficult
   task. For example, the raw parallel programming model of Poly/ML is
   presented as considerably more abstract concept of \<^emph>\<open>futures\<close>, which is then
   used to augment the inference kernel, Isar theory and proof interpreter, and
   PIDE document management.
 
   The main aspects of Isabelle/ML are introduced below. These first-hand
   explanations should help to understand how proper Isabelle/ML is to be read
   and written, and to get access to the wealth of experience that is expressed
   in the source text and its history of changes.\<^footnote>\<open>See
   \<^url>\<open>https://isabelle.in.tum.de/repos/isabelle\<close> for the full Mercurial history.
   There are symbolic tags to refer to official Isabelle releases, as opposed
   to arbitrary \<^emph>\<open>tip\<close> versions that merely reflect snapshots that are never
   really up-to-date.\<close>
 \<close>
 
 
 section \<open>Style and orthography\<close>
 
 text \<open>
   The sources of Isabelle/Isar are optimized for \<^emph>\<open>readability\<close> and
   \<^emph>\<open>maintainability\<close>. The main purpose is to tell an informed reader what is
   really going on and how things really work. This is a non-trivial aim, but
   it is supported by a certain style of writing Isabelle/ML that has emerged
   from long years of system development.\<^footnote>\<open>See also the interesting style guide
   for OCaml \<^url>\<open>https://caml.inria.fr/resources/doc/guides/guidelines.en.html\<close>
   which shares many of our means and ends.\<close>
 
   The main principle behind any coding style is \<^emph>\<open>consistency\<close>. For a single
   author of a small program this merely means ``choose your style and stick to
   it''. A complex project like Isabelle, with long years of development and
   different contributors, requires more standardization. A coding style that
   is changed every few years or with every new contributor is no style at all,
   because consistency is quickly lost. Global consistency is hard to achieve,
   though. Nonetheless, one should always strive at least for local consistency
   of modules and sub-systems, without deviating from some general principles
   how to write Isabelle/ML.
 
   In a sense, good coding style is like an \<^emph>\<open>orthography\<close> for the sources: it
   helps to read quickly over the text and see through the main points, without
   getting distracted by accidental presentation of free-style code.
 \<close>
 
 
 subsection \<open>Header and sectioning\<close>
 
 text \<open>
   Isabelle source files have a certain standardized header format (with
   precise spacing) that follows ancient traditions reaching back to the
   earliest versions of the system by Larry Paulson. See
   \<^file>\<open>~~/src/Pure/thm.ML\<close>, for example.
 
   The header includes at least \<^verbatim>\<open>Title\<close> and \<^verbatim>\<open>Author\<close> entries, followed by a
   prose description of the purpose of the module. The latter can range from a
   single line to several paragraphs of explanations.
 
   The rest of the file is divided into chapters, sections, subsections,
   subsubsections, paragraphs etc.\ using a simple layout via ML comments as
   follows.
 
   @{verbatim [display]
 \<open>  (**** chapter ****)
  
   (*** section ***)
 
   (** subsection **)
 
   (* subsubsection *)
 
   (*short paragraph*)
 
   (*
     long paragraph,
     with more text
   *)\<close>}
 
   As in regular typography, there is some extra space \<^emph>\<open>before\<close> section
   headings that are adjacent to plain text, but not other headings as in the
   example above.
 
   \<^medskip>
   The precise wording of the prose text given in these headings is chosen
   carefully to introduce the main theme of the subsequent formal ML text.
 \<close>
 
 
 subsection \<open>Naming conventions\<close>
 
 text \<open>
   Since ML is the primary medium to express the meaning of the source text,
   naming of ML entities requires special care.
 \<close>
 
 paragraph \<open>Notation.\<close>
 text \<open>
   A name consists of 1--3 \<^emph>\<open>words\<close> (rarely 4, but not more) that are separated
   by underscore. There are three variants concerning upper or lower case
   letters, which are used for certain ML categories as follows:
 
   \<^medskip>
   \begin{tabular}{lll}
   variant & example & ML categories \\\hline
   lower-case & \<^ML_text>\<open>foo_bar\<close> & values, types, record fields \\
   capitalized & \<^ML_text>\<open>Foo_Bar\<close> & datatype constructors, structures, functors \\
   upper-case & \<^ML_text>\<open>FOO_BAR\<close> & special values, exception constructors, signatures \\
   \end{tabular}
   \<^medskip>
 
   For historical reasons, many capitalized names omit underscores, e.g.\
   old-style \<^ML_text>\<open>FooBar\<close> instead of \<^ML_text>\<open>Foo_Bar\<close>. Genuine
   mixed-case names are \<^emph>\<open>not\<close> used, because clear division of words is
   essential for readability.\<^footnote>\<open>Camel-case was invented to workaround the lack
   of underscore in some early non-ASCII character sets. Later it became
   habitual in some language communities that are now strong in numbers.\<close>
 
   A single (capital) character does not count as ``word'' in this respect:
   some Isabelle/ML names are suffixed by extra markers like this: \<^ML_text>\<open>foo_barT\<close>.
 
   Name variants are produced by adding 1--3 primes, e.g.\ \<^ML_text>\<open>foo'\<close>,
   \<^ML_text>\<open>foo''\<close>, or \<^ML_text>\<open>foo'''\<close>, but not \<^ML_text>\<open>foo''''\<close> or more.
   Decimal digits scale better to larger numbers, e.g.\ \<^ML_text>\<open>foo0\<close>,
   \<^ML_text>\<open>foo1\<close>, \<^ML_text>\<open>foo42\<close>.
 \<close>
 
 paragraph \<open>Scopes.\<close>
 text \<open>
   Apart from very basic library modules, ML structures are not ``opened'', but
   names are referenced with explicit qualification, as in \<^ML>\<open>Syntax.string_of_term\<close> for example. When devising names for structures and
   their components it is important to aim at eye-catching compositions of both
   parts, because this is how they are seen in the sources and documentation.
   For the same reasons, aliases of well-known library functions should be
   avoided.
 
   Local names of function abstraction or case/let bindings are typically
   shorter, sometimes using only rudiments of ``words'', while still avoiding
   cryptic shorthands. An auxiliary function called \<^ML_text>\<open>helper\<close>,
   \<^ML_text>\<open>aux\<close>, or \<^ML_text>\<open>f\<close> is considered bad style.
 
   Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun print_foo ctxt foo =
     let
       fun print t = ... Syntax.string_of_term ctxt t ...
     in ... end;
 
 
   (* RIGHT *)
 
   fun print_foo ctxt foo =
     let
       val string_of_term = Syntax.string_of_term ctxt;
       fun print t = ... string_of_term t ...
     in ... end;
 
 
   (* WRONG *)
 
   val string_of_term = Syntax.string_of_term;
 
   fun print_foo ctxt foo =
     let
       fun aux t = ... string_of_term ctxt t ...
     in ... end;\<close>}
 \<close>
 
 paragraph \<open>Specific conventions.\<close>
 text \<open>
   Here are some specific name forms that occur frequently in the sources.
 
   \<^item> A function that maps \<^ML_text>\<open>foo\<close> to \<^ML_text>\<open>bar\<close> is called \<^ML_text>\<open>foo_to_bar\<close> or \<^ML_text>\<open>bar_of_foo\<close> (never \<^ML_text>\<open>foo2bar\<close>, nor
   \<^ML_text>\<open>bar_from_foo\<close>, nor \<^ML_text>\<open>bar_for_foo\<close>, nor \<^ML_text>\<open>bar4foo\<close>).
 
   \<^item> The name component \<^ML_text>\<open>legacy\<close> means that the operation is about to
   be discontinued soon.
 
   \<^item> The name component \<^ML_text>\<open>global\<close> means that this works with the
   background theory instead of the regular local context
   (\secref{sec:context}), sometimes for historical reasons, sometimes due a
   genuine lack of locality of the concept involved, sometimes as a fall-back
   for the lack of a proper context in the application code. Whenever there is
   a non-global variant available, the application should be migrated to use it
   with a proper local context.
 
   \<^item> Variables of the main context types of the Isabelle/Isar framework
   (\secref{sec:context} and \chref{ch:local-theory}) have firm naming
   conventions as follows:
 
     \<^item> theories are called \<^ML_text>\<open>thy\<close>, rarely \<^ML_text>\<open>theory\<close>
     (never \<^ML_text>\<open>thry\<close>)
 
     \<^item> proof contexts are called \<^ML_text>\<open>ctxt\<close>, rarely \<^ML_text>\<open>context\<close> (never \<^ML_text>\<open>ctx\<close>)
 
     \<^item> generic contexts are called \<^ML_text>\<open>context\<close>
 
     \<^item> local theories are called \<^ML_text>\<open>lthy\<close>, except for local
     theories that are treated as proof context (which is a semantic
     super-type)
 
   Variations with primed or decimal numbers are always possible, as well as
   semantic prefixes like \<^ML_text>\<open>foo_thy\<close> or \<^ML_text>\<open>bar_ctxt\<close>, but the
   base conventions above need to be preserved. This allows to emphasize their
   data flow via plain regular expressions in the text editor.
 
   \<^item> The main logical entities (\secref{ch:logic}) have established naming
   convention as follows:
 
     \<^item> sorts are called \<^ML_text>\<open>S\<close>
 
     \<^item> types are called \<^ML_text>\<open>T\<close>, \<^ML_text>\<open>U\<close>, or \<^ML_text>\<open>ty\<close> (never
     \<^ML_text>\<open>t\<close>)
 
     \<^item> terms are called \<^ML_text>\<open>t\<close>, \<^ML_text>\<open>u\<close>, or \<^ML_text>\<open>tm\<close> (never
     \<^ML_text>\<open>trm\<close>)
 
     \<^item> certified types are called \<^ML_text>\<open>cT\<close>, rarely \<^ML_text>\<open>T\<close>, with
     variants as for types
 
     \<^item> certified terms are called \<^ML_text>\<open>ct\<close>, rarely \<^ML_text>\<open>t\<close>, with
     variants as for terms (never \<^ML_text>\<open>ctrm\<close>)
 
     \<^item> theorems are called \<^ML_text>\<open>th\<close>, or \<^ML_text>\<open>thm\<close>
 
   Proper semantic names override these conventions completely. For example,
   the left-hand side of an equation (as a term) can be called \<^ML_text>\<open>lhs\<close>
   (not \<^ML_text>\<open>lhs_tm\<close>). Or a term that is known to be a variable can be
   called \<^ML_text>\<open>v\<close> or \<^ML_text>\<open>x\<close>.
 
   \<^item> Tactics (\secref{sec:tactics}) are sufficiently important to have specific
   naming conventions. The name of a basic tactic definition always has a
   \<^ML_text>\<open>_tac\<close> suffix, the subgoal index (if applicable) is always called
   \<^ML_text>\<open>i\<close>, and the goal state (if made explicit) is usually called
   \<^ML_text>\<open>st\<close> instead of the somewhat misleading \<^ML_text>\<open>thm\<close>. Any other
   arguments are given before the latter two, and the general context is given
   first. Example:
 
   @{verbatim [display] \<open>  fun my_tac ctxt arg1 arg2 i st = ...\<close>}
 
   Note that the goal state \<^ML_text>\<open>st\<close> above is rarely made explicit, if
   tactic combinators (tacticals) are used as usual.
 
   A tactic that requires a proof context needs to make that explicit as seen
   in the \<^verbatim>\<open>ctxt\<close> argument above. Do not refer to the background theory of
   \<^verbatim>\<open>st\<close> -- it is not a proper context, but merely a formal certificate.
 \<close>
 
 
 subsection \<open>General source layout\<close>
 
 text \<open>
   The general Isabelle/ML source layout imitates regular type-setting
   conventions, augmented by the requirements for deeply nested expressions
   that are commonplace in functional programming.
 \<close>
 
 paragraph \<open>Line length\<close>
 text \<open>
   is limited to 80 characters according to ancient standards, but we allow as
   much as 100 characters (not more).\<^footnote>\<open>Readability requires to keep the
   beginning of a line in view while watching its end. Modern wide-screen
   displays do not change the way how the human brain works. Sources also need
   to be printable on plain paper with reasonable font-size.\<close> The extra 20
   characters acknowledge the space requirements due to qualified library
   references in Isabelle/ML.
 \<close>
 
 paragraph \<open>White-space\<close>
 text \<open>
   is used to emphasize the structure of expressions, following mostly standard
   conventions for mathematical typesetting, as can be seen in plain {\TeX} or
   {\LaTeX}. This defines positioning of spaces for parentheses, punctuation,
   and infixes as illustrated here:
 
   @{verbatim [display]
 \<open>  val x = y + z * (a + b);
   val pair = (a, b);
   val record = {foo = 1, bar = 2};\<close>}
 
   Lines are normally broken \<^emph>\<open>after\<close> an infix operator or punctuation
   character. For example:
 
   @{verbatim [display]
 \<open>
   val x =
     a +
     b +
     c;
 
   val tuple =
    (a,
     b,
     c);
 \<close>}
 
   Some special infixes (e.g.\ \<^ML_text>\<open>|>\<close>) work better at the start of the
   line, but punctuation is always at the end.
 
   Function application follows the tradition of \<open>\<lambda>\<close>-calculus, not informal
   mathematics. For example: \<^ML_text>\<open>f a b\<close> for a curried function, or
   \<^ML_text>\<open>g (a, b)\<close> for a tupled function. Note that the space between
   \<^ML_text>\<open>g\<close> and the pair \<^ML_text>\<open>(a, b)\<close> follows the important
   principle of \<^emph>\<open>compositionality\<close>: the layout of \<^ML_text>\<open>g p\<close> does not
   change when \<^ML_text>\<open>p\<close> is refined to the concrete pair \<^ML_text>\<open>(a,
   b)\<close>.
 \<close>
 
 paragraph \<open>Indentation\<close>
 text \<open>
   uses plain spaces, never hard tabulators.\<^footnote>\<open>Tabulators were invented to move
   the carriage of a type-writer to certain predefined positions. In software
   they could be used as a primitive run-length compression of consecutive
   spaces, but the precise result would depend on non-standardized text editor
   configuration.\<close>
 
   Each level of nesting is indented by 2 spaces, sometimes 1, very rarely 4,
   never 8 or any other odd number.
 
   Indentation follows a simple logical format that only depends on the nesting
   depth, not the accidental length of the text that initiates a level of
   nesting. Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   if b then
     expr1_part1
     expr1_part2
   else
     expr2_part1
     expr2_part2
 
 
   (* WRONG *)
 
   if b then expr1_part1
             expr1_part2
   else expr2_part1
        expr2_part2\<close>}
 
   The second form has many problems: it assumes a fixed-width font when
   viewing the sources, it uses more space on the line and thus makes it hard
   to observe its strict length limit (working against \<^emph>\<open>readability\<close>), it
   requires extra editing to adapt the layout to changes of the initial text
   (working against \<^emph>\<open>maintainability\<close>) etc.
 
   \<^medskip>
   For similar reasons, any kind of two-dimensional or tabular layouts,
   ASCII-art with lines or boxes of asterisks etc.\ should be avoided.
 \<close>
 
 paragraph \<open>Complex expressions\<close>
 text \<open>
   that consist of multi-clausal function definitions, \<^ML_text>\<open>handle\<close>,
   \<^ML_text>\<open>case\<close>, \<^ML_text>\<open>let\<close> (and combinations) require special
   attention. The syntax of Standard ML is quite ambitious and admits a lot of
   variance that can distort the meaning of the text.
 
   Multiple clauses of \<^ML_text>\<open>fun\<close>, \<^ML_text>\<open>fn\<close>, \<^ML_text>\<open>handle\<close>,
   \<^ML_text>\<open>case\<close> get extra indentation to indicate the nesting clearly.
   Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun foo p1 =
         expr1
     | foo p2 =
         expr2
 
 
   (* WRONG *)
 
   fun foo p1 =
     expr1
     | foo p2 =
     expr2\<close>}
 
   Body expressions consisting of \<^ML_text>\<open>case\<close> or \<^ML_text>\<open>let\<close> require
   care to maintain compositionality, to prevent loss of logical indentation
   where it is especially important to see the structure of the text. Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun foo p1 =
         (case e of
           q1 => ...
         | q2 => ...)
     | foo p2 =
         let
           ...
         in
           ...
         end
 
 
   (* WRONG *)
 
   fun foo p1 = case e of
       q1 => ...
     | q2 => ...
     | foo p2 =
     let
       ...
     in
       ...
     end\<close>}
 
   Extra parentheses around \<^ML_text>\<open>case\<close> expressions are optional, but help
   to analyse the nesting based on character matching in the text editor.
 
   \<^medskip>
   There are two main exceptions to the overall principle of compositionality
   in the layout of complex expressions.
 
   \<^enum> \<^ML_text>\<open>if\<close> expressions are iterated as if ML had multi-branch
   conditionals, e.g.
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   if b1 then e1
   else if b2 then e2
   else e3\<close>}
 
   \<^enum> \<^ML_text>\<open>fn\<close> abstractions are often layed-out as if they would lack any
   structure by themselves. This traditional form is motivated by the
   possibility to shift function arguments back and forth wrt.\ additional
   combinators. Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun foo x y = fold (fn z =>
     expr)\<close>}
 
   Here the visual appearance is that of three arguments \<^ML_text>\<open>x\<close>,
   \<^ML_text>\<open>y\<close>, \<^ML_text>\<open>z\<close> in a row.
 
 
   Such weakly structured layout should be use with great care. Here are some
   counter-examples involving \<^ML_text>\<open>let\<close> expressions:
 
   @{verbatim [display]
 \<open>  (* WRONG *)
 
   fun foo x = let
       val y = ...
     in ... end
 
 
   (* WRONG *)
 
   fun foo x = let
     val y = ...
   in ... end
 
 
   (* WRONG *)
 
   fun foo x =
   let
     val y = ...
   in ... end
 
 
   (* WRONG *)
 
   fun foo x =
     let
       val y = ...
     in
       ... end\<close>}
 
   \<^medskip>
   In general the source layout is meant to emphasize the structure of complex
   language expressions, not to pretend that SML had a completely different
   syntax (say that of Haskell, Scala, Java).
 \<close>
 
 
 section \<open>ML embedded into Isabelle/Isar\<close>
 
 text \<open>
   ML and Isar are intertwined via an open-ended bootstrap process that
   provides more and more programming facilities and logical content in an
   alternating manner. Bootstrapping starts from the raw environment of
   existing implementations of Standard ML (mainly Poly/ML).
 
   Isabelle/Pure marks the point where the raw ML toplevel is superseded by
   Isabelle/ML within the Isar theory and proof language, with a uniform
   context for arbitrary ML values (see also \secref{sec:context}). This formal
   environment holds ML compiler bindings, logical entities, and many other
   things.
 
   Object-logics like Isabelle/HOL are built within the Isabelle/ML/Isar
   environment by introducing suitable theories with associated ML modules,
   either inlined within \<^verbatim>\<open>.thy\<close> files, or as separate \<^verbatim>\<open>.ML\<close> files that are
   loading from some theory. Thus Isabelle/HOL is defined as a regular
   user-space application within the Isabelle framework. Further add-on tools
   can be implemented in ML within the Isar context in the same manner: ML is
   part of the standard repertoire of Isabelle, and there is no distinction
   between ``users'' and ``developers'' in this respect.
 \<close>
 
 
 subsection \<open>Isar ML commands\<close>
 
 text \<open>
   The primary Isar source language provides facilities to ``open a window'' to
   the underlying ML compiler. Especially see the Isar commands @{command_ref
   "ML_file"} and @{command_ref "ML"}: both work the same way, but the source
   text is provided differently, via a file vs.\ inlined, respectively. Apart
   from embedding ML into the main theory definition like that, there are many
   more commands that refer to ML source, such as @{command_ref setup} or
   @{command_ref declaration}. Even more fine-grained embedding of ML into Isar
   is encountered in the proof method @{method_ref tactic}, which refines the
   pending goal state via a given expression of type \<^ML_type>\<open>tactic\<close>.
 \<close>
 
 text %mlex \<open>
   The following artificial example demonstrates some ML toplevel declarations
   within the implicit Isar theory context. This is regular functional
   programming without referring to logical entities yet.
 \<close>
 
 ML \<open>
   fun factorial 0 = 1
     | factorial n = n * factorial (n - 1)
 \<close>
 
 text \<open>
   Here the ML environment is already managed by Isabelle, i.e.\ the \<^ML>\<open>factorial\<close> function is not yet accessible in the preceding paragraph, nor in
   a different theory that is independent from the current one in the import
   hierarchy.
 
   Removing the above ML declaration from the source text will remove any trace
   of this definition, as expected. The Isabelle/ML toplevel environment is
   managed in a \<^emph>\<open>stateless\<close> way: in contrast to the raw ML toplevel, there are
   no global side-effects involved here.\<^footnote>\<open>Such a stateless compilation
   environment is also a prerequisite for robust parallel compilation within
   independent nodes of the implicit theory development graph.\<close>
 
   \<^medskip>
   The next example shows how to embed ML into Isar proofs, using @{command_ref
   "ML_prf"} instead of @{command_ref "ML"}. As illustrated below, the effect
   on the ML environment is local to the whole proof body, but ignoring the
   block structure.
 \<close>
 
 notepad
 begin
   ML_prf %"ML" \<open>val a = 1\<close>
   {
     ML_prf %"ML" \<open>val b = a + 1\<close>
   } \<comment> \<open>Isar block structure ignored by ML environment\<close>
   ML_prf %"ML" \<open>val c = b + 1\<close>
 end
 
 text \<open>
   By side-stepping the normal scoping rules for Isar proof blocks, embedded ML
   code can refer to the different contexts and manipulate corresponding
   entities, e.g.\ export a fact from a block context.
 
   \<^medskip>
   Two further ML commands are useful in certain situations: @{command_ref
   ML_val} and @{command_ref ML_command} are \<^emph>\<open>diagnostic\<close> in the sense that
   there is no effect on the underlying environment, and can thus be used
   anywhere. The examples below produce long strings of digits by invoking \<^ML>\<open>factorial\<close>: @{command ML_val} takes care of printing the ML toplevel result,
   but @{command ML_command} is silent so we produce an explicit output
   message.
 \<close>
 
 ML_val \<open>factorial 100\<close>
 ML_command \<open>writeln (string_of_int (factorial 100))\<close>
 
 notepad
 begin
   ML_val \<open>factorial 100\<close>
   ML_command \<open>writeln (string_of_int (factorial 100))\<close>
 end
 
 
 subsection \<open>Compile-time context\<close>
 
 text \<open>
   Whenever the ML compiler is invoked within Isabelle/Isar, the formal context
   is passed as a thread-local reference variable. Thus ML code may access the
   theory context during compilation, by reading or writing the (local) theory
   under construction. Note that such direct access to the compile-time context
   is rare. In practice it is typically done via some derived ML functions
   instead.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Context.the_generic_context: "unit -> Context.generic"} \\
-  @{index_ML "Context.>>": "(Context.generic -> Context.generic) -> unit"} \\
-  @{index_ML ML_Thms.bind_thms: "string * thm list -> unit"} \\
-  @{index_ML ML_Thms.bind_thm: "string * thm -> unit"} \\
+  @{define_ML Context.the_generic_context: "unit -> Context.generic"} \\
+  @{define_ML "Context.>>": "(Context.generic -> Context.generic) -> unit"} \\
+  @{define_ML ML_Thms.bind_thms: "string * thm list -> unit"} \\
+  @{define_ML ML_Thms.bind_thm: "string * thm -> unit"} \\
   \end{mldecls}
 
     \<^descr> \<^ML>\<open>Context.the_generic_context ()\<close> refers to the theory context of
     the ML toplevel --- at compile time. ML code needs to take care to refer to
     \<^ML>\<open>Context.the_generic_context ()\<close> correctly. Recall that evaluation
     of a function body is delayed until actual run-time.
 
     \<^descr> \<^ML>\<open>Context.>>\<close>~\<open>f\<close> applies context transformation \<open>f\<close> to the implicit
     context of the ML toplevel.
 
     \<^descr> \<^ML>\<open>ML_Thms.bind_thms\<close>~\<open>(name, thms)\<close> stores a list of theorems produced
     in ML both in the (global) theory context and the ML toplevel, associating
     it with the provided name.
 
     \<^descr> \<^ML>\<open>ML_Thms.bind_thm\<close> is similar to \<^ML>\<open>ML_Thms.bind_thms\<close> but refers to
     a singleton fact.
 
   It is important to note that the above functions are really restricted to
   the compile time, even though the ML compiler is invoked at run-time. The
   majority of ML code either uses static antiquotations
   (\secref{sec:ML-antiq}) or refers to the theory or proof context at
   run-time, by explicit functional abstraction.
 \<close>
 
 
 subsection \<open>Antiquotations \label{sec:ML-antiq}\<close>
 
 text \<open>
   A very important consequence of embedding ML into Isar is the concept of
   \<^emph>\<open>ML antiquotation\<close>. The standard token language of ML is augmented by
   special syntactic entities of the following form:
 
   \<^rail>\<open>
   @{syntax_def antiquote}: '@{' name args '}'
   \<close>
 
   Here @{syntax name} and @{syntax args} are outer syntax categories, as
   defined in @{cite "isabelle-isar-ref"}.
 
   \<^medskip>
   A regular antiquotation \<open>@{name args}\<close> processes its arguments by the usual
   means of the Isar source language, and produces corresponding ML source
   text, either as literal \<^emph>\<open>inline\<close> text (e.g.\ \<open>@{term t}\<close>) or abstract
   \<^emph>\<open>value\<close> (e.g. \<open>@{thm th}\<close>). This pre-compilation scheme allows to refer to
   formal entities in a robust manner, with proper static scoping and with some
   degree of logical checking of small portions of the code.
 \<close>
 
 
 subsection \<open>Printing ML values\<close>
 
 text \<open>
   The ML compiler knows about the structure of values according to their
   static type, and can print them in the manner of its toplevel, although the
   details are non-portable. The antiquotations @{ML_antiquotation_def
   "make_string"} and @{ML_antiquotation_def "print"} provide a quasi-portable
   way to refer to this potential capability of the underlying ML system in
   generic Isabelle/ML sources.
 
   This is occasionally useful for diagnostic or demonstration purposes. Note
   that production-quality tools require proper user-level error messages,
   avoiding raw ML values in the output.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "make_string"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "print"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation make_string}
   ;
   @@{ML_antiquotation print} embedded?
   \<close>
 
   \<^descr> \<open>@{make_string}\<close> inlines a function to print arbitrary values similar to
   the ML toplevel. The result is compiler dependent and may fall back on "?"
   in certain situations. The value of configuration option @{attribute_ref
   ML_print_depth} determines further details of output.
 
   \<^descr> \<open>@{print f}\<close> uses the ML function \<open>f: string -> unit\<close> to output the result
   of \<open>@{make_string}\<close> above, together with the source position of the
   antiquotation. The default output function is \<^ML>\<open>writeln\<close>.
 \<close>
 
 text %mlex \<open>
   The following artificial examples show how to produce adhoc output of ML
   values for debugging purposes.
 \<close>
 
 ML_val \<open>
   val x = 42;
   val y = true;
 
   writeln (\<^make_string> {x = x, y = y});
 
   \<^print> {x = x, y = y};
   \<^print>\<open>tracing\<close> {x = x, y = y};
 \<close>
 
 
 section \<open>Canonical argument order \label{sec:canonical-argument-order}\<close>
 
 text \<open>
   Standard ML is a language in the tradition of \<open>\<lambda>\<close>-calculus and
   \<^emph>\<open>higher-order functional programming\<close>, similar to OCaml, Haskell, or
   Isabelle/Pure and HOL as logical languages. Getting acquainted with the
   native style of representing functions in that setting can save a lot of
   extra boiler-plate of redundant shuffling of arguments, auxiliary
   abstractions etc.
 
   Functions are usually \<^emph>\<open>curried\<close>: the idea of turning arguments of type
   \<open>\<tau>\<^sub>i\<close> (for \<open>i \<in> {1, \<dots> n}\<close>) into a result of type \<open>\<tau>\<close> is represented by the
   iterated function space \<open>\<tau>\<^sub>1 \<rightarrow> \<dots> \<rightarrow> \<tau>\<^sub>n \<rightarrow> \<tau>\<close>. This is isomorphic to the
   well-known encoding via tuples \<open>\<tau>\<^sub>1 \<times> \<dots> \<times> \<tau>\<^sub>n \<rightarrow> \<tau>\<close>, but the curried version
   fits more smoothly into the basic calculus.\<^footnote>\<open>The difference is even more
   significant in HOL, because the redundant tuple structure needs to be
   accommodated extraneous proof steps.\<close>
 
   Currying gives some flexibility due to \<^emph>\<open>partial application\<close>. A function
   \<open>f: \<tau>\<^sub>1 \<rightarrow> \<tau>\<^sub>2 \<rightarrow> \<tau>\<close> can be applied to \<open>x: \<tau>\<^sub>1\<close> and the remaining \<open>(f x): \<tau>\<^sub>2
   \<rightarrow> \<tau>\<close> passed to another function etc. How well this works in practice depends
   on the order of arguments. In the worst case, arguments are arranged
   erratically, and using a function in a certain situation always requires
   some glue code. Thus we would get exponentially many opportunities to
   decorate the code with meaningless permutations of arguments.
 
   This can be avoided by \<^emph>\<open>canonical argument order\<close>, which observes certain
   standard patterns and minimizes adhoc permutations in their application. In
   Isabelle/ML, large portions of text can be written without auxiliary
   operations like \<open>swap: \<alpha> \<times> \<beta> \<rightarrow> \<beta> \<times> \<alpha>\<close> or \<open>C: (\<alpha> \<rightarrow> \<beta> \<rightarrow> \<gamma>) \<rightarrow> (\<beta> \<rightarrow> \<alpha> \<rightarrow> \<gamma>)\<close> (the
   latter is not present in the Isabelle/ML library).
 
   \<^medskip>
   The main idea is that arguments that vary less are moved further to the left
   than those that vary more. Two particularly important categories of
   functions are \<^emph>\<open>selectors\<close> and \<^emph>\<open>updates\<close>.
 
   The subsequent scheme is based on a hypothetical set-like container of type
   \<open>\<beta>\<close> that manages elements of type \<open>\<alpha>\<close>. Both the names and types of the
   associated operations are canonical for Isabelle/ML.
 
   \begin{center}
   \begin{tabular}{ll}
   kind & canonical name and type \\\hline
   selector & \<open>member: \<beta> \<rightarrow> \<alpha> \<rightarrow> bool\<close> \\
   update & \<open>insert: \<alpha> \<rightarrow> \<beta> \<rightarrow> \<beta>\<close> \\
   \end{tabular}
   \end{center}
 
   Given a container \<open>B: \<beta>\<close>, the partially applied \<open>member B\<close> is a predicate
   over elements \<open>\<alpha> \<rightarrow> bool\<close>, and thus represents the intended denotation
   directly. It is customary to pass the abstract predicate to further
   operations, not the concrete container. The argument order makes it easy to
   use other combinators: \<open>forall (member B) list\<close> will check a list of
   elements for membership in \<open>B\<close> etc. Often the explicit \<open>list\<close> is pointless
   and can be contracted to \<open>forall (member B)\<close> to get directly a predicate
   again.
 
   In contrast, an update operation varies the container, so it moves to the
   right: \<open>insert a\<close> is a function \<open>\<beta> \<rightarrow> \<beta>\<close> to insert a value \<open>a\<close>. These can be
   composed naturally as \<open>insert c \<circ> insert b \<circ> insert a\<close>. The slightly awkward
   inversion of the composition order is due to conventional mathematical
   notation, which can be easily amended as explained below.
 \<close>
 
 
 subsection \<open>Forward application and composition\<close>
 
 text \<open>
   Regular function application and infix notation works best for relatively
   deeply structured expressions, e.g.\ \<open>h (f x y + g z)\<close>. The important
   special case of \<^emph>\<open>linear transformation\<close> applies a cascade of functions \<open>f\<^sub>n
   (\<dots> (f\<^sub>1 x))\<close>. This becomes hard to read and maintain if the functions are
   themselves given as complex expressions. The notation can be significantly
   improved by introducing \<^emph>\<open>forward\<close> versions of application and composition
   as follows:
 
   \<^medskip>
   \begin{tabular}{lll}
   \<open>x |> f\<close> & \<open>\<equiv>\<close> & \<open>f x\<close> \\
   \<open>(f #> g) x\<close> & \<open>\<equiv>\<close> & \<open>x |> f |> g\<close> \\
   \end{tabular}
   \<^medskip>
 
   This enables to write conveniently \<open>x |> f\<^sub>1 |> \<dots> |> f\<^sub>n\<close> or \<open>f\<^sub>1 #> \<dots> #>
   f\<^sub>n\<close> for its functional abstraction over \<open>x\<close>.
 
   \<^medskip>
   There is an additional set of combinators to accommodate multiple results
   (via pairs) that are passed on as multiple arguments (via currying).
 
   \<^medskip>
   \begin{tabular}{lll}
   \<open>(x, y) |-> f\<close> & \<open>\<equiv>\<close> & \<open>f x y\<close> \\
   \<open>(f #-> g) x\<close> & \<open>\<equiv>\<close> & \<open>x |> f |-> g\<close> \\
   \end{tabular}
   \<^medskip>
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_op "|> ": "'a * ('a -> 'b) -> 'b"} \\
-  @{index_ML_op "|-> ": "('c * 'a) * ('c -> 'a -> 'b) -> 'b"} \\
-  @{index_ML_op "#> ": "('a -> 'b) * ('b -> 'c) -> 'a -> 'c"} \\
-  @{index_ML_op "#-> ": "('a -> 'c * 'b) * ('c -> 'b -> 'd) -> 'a -> 'd"} \\
+  @{define_ML_infix "|>" : "'a * ('a -> 'b) -> 'b"} \\
+  @{define_ML_infix "|->" : "('c * 'a) * ('c -> 'a -> 'b) -> 'b"} \\
+  @{define_ML_infix "#>" : "('a -> 'b) * ('b -> 'c) -> 'a -> 'c"} \\
+  @{define_ML_infix "#->" : "('a -> 'c * 'b) * ('c -> 'b -> 'd) -> 'a -> 'd"} \\
   \end{mldecls}
 \<close>
 
 
 subsection \<open>Canonical iteration\<close>
 
 text \<open>
   As explained above, a function \<open>f: \<alpha> \<rightarrow> \<beta> \<rightarrow> \<beta>\<close> can be understood as update on
   a configuration of type \<open>\<beta>\<close>, parameterized by an argument of type \<open>\<alpha>\<close>. Given
   \<open>a: \<alpha>\<close> the partial application \<open>(f a): \<beta> \<rightarrow> \<beta>\<close> operates homogeneously on \<open>\<beta>\<close>.
   This can be iterated naturally over a list of parameters \<open>[a\<^sub>1, \<dots>, a\<^sub>n]\<close> as
   \<open>f a\<^sub>1 #> \<dots> #> f a\<^sub>n\<close>. The latter expression is again a function \<open>\<beta> \<rightarrow> \<beta>\<close>. It
   can be applied to an initial configuration \<open>b: \<beta>\<close> to start the iteration
   over the given list of arguments: each \<open>a\<close> in \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> is applied
   consecutively by updating a cumulative configuration.
 
   The \<open>fold\<close> combinator in Isabelle/ML lifts a function \<open>f\<close> as above to its
   iterated version over a list of arguments. Lifting can be repeated, e.g.\
   \<open>(fold \<circ> fold) f\<close> iterates over a list of lists as expected.
 
   The variant \<open>fold_rev\<close> works inside-out over the list of arguments, such
   that \<open>fold_rev f \<equiv> fold f \<circ> rev\<close> holds.
 
   The \<open>fold_map\<close> combinator essentially performs \<open>fold\<close> and \<open>map\<close>
   simultaneously: each application of \<open>f\<close> produces an updated configuration
   together with a side-result; the iteration collects all such side-results as
   a separate list.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML fold: "('a -> 'b -> 'b) -> 'a list -> 'b -> 'b"} \\
-  @{index_ML fold_rev: "('a -> 'b -> 'b) -> 'a list -> 'b -> 'b"} \\
-  @{index_ML fold_map: "('a -> 'b -> 'c * 'b) -> 'a list -> 'b -> 'c list * 'b"} \\
+  @{define_ML fold: "('a -> 'b -> 'b) -> 'a list -> 'b -> 'b"} \\
+  @{define_ML fold_rev: "('a -> 'b -> 'b) -> 'a list -> 'b -> 'b"} \\
+  @{define_ML fold_map: "('a -> 'b -> 'c * 'b) -> 'a list -> 'b -> 'c list * 'b"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>fold\<close>~\<open>f\<close> lifts the parametrized update function \<open>f\<close> to a list of
   parameters.
 
   \<^descr> \<^ML>\<open>fold_rev\<close>~\<open>f\<close> is similar to \<^ML>\<open>fold\<close>~\<open>f\<close>, but works inside-out, as
   if the list would be reversed.
 
   \<^descr> \<^ML>\<open>fold_map\<close>~\<open>f\<close> lifts the parametrized update function \<open>f\<close> (with
   side-result) to a list of parameters and cumulative side-results.
 
 
   \begin{warn}
   The literature on functional programming provides a confusing multitude of
   combinators called \<open>foldl\<close>, \<open>foldr\<close> etc. SML97 provides its own variations
   as \<^ML>\<open>List.foldl\<close> and \<^ML>\<open>List.foldr\<close>, while the classic Isabelle library
   also has the historic \<^ML>\<open>Library.foldl\<close> and \<^ML>\<open>Library.foldr\<close>. To avoid
   unnecessary complication, all these historical versions should be ignored,
   and the canonical \<^ML>\<open>fold\<close> (or \<^ML>\<open>fold_rev\<close>) used exclusively.
   \end{warn}
 \<close>
 
 text %mlex \<open>
   The following example shows how to fill a text buffer incrementally by
   adding strings, either individually or from a given list.
 \<close>
 
 ML_val \<open>
   val s =
     Buffer.empty
     |> Buffer.add "digits: "
     |> fold (Buffer.add o string_of_int) (0 upto 9)
     |> Buffer.content;
 
   \<^assert> (s = "digits: 0123456789");
 \<close>
 
 text \<open>
   Note how \<^ML>\<open>fold (Buffer.add o string_of_int)\<close> above saves an extra \<^ML>\<open>map\<close> over the given list. This kind of peephole optimization reduces both
   the code size and the tree structures in memory (``deforestation''), but it
   requires some practice to read and write fluently.
 
   \<^medskip>
   The next example elaborates the idea of canonical iteration, demonstrating
   fast accumulation of tree content using a text buffer.
 \<close>
 
 ML \<open>
   datatype tree = Text of string | Elem of string * tree list;
 
   fun slow_content (Text txt) = txt
     | slow_content (Elem (name, ts)) =
         "<" ^ name ^ ">" ^
         implode (map slow_content ts) ^
         "</" ^ name ^ ">"
 
   fun add_content (Text txt) = Buffer.add txt
     | add_content (Elem (name, ts)) =
         Buffer.add ("<" ^ name ^ ">") #>
         fold add_content ts #>
         Buffer.add ("</" ^ name ^ ">");
 
   fun fast_content tree =
     Buffer.empty |> add_content tree |> Buffer.content;
 \<close>
 
 text \<open>
   The slowness of \<^ML>\<open>slow_content\<close> is due to the \<^ML>\<open>implode\<close> of the
   recursive results, because it copies previously produced strings again and
   again.
 
   The incremental \<^ML>\<open>add_content\<close> avoids this by operating on a buffer that
   is passed through in a linear fashion. Using \<^ML_text>\<open>#>\<close> and contraction
   over the actual buffer argument saves some additional boiler-plate. Of
   course, the two \<^ML>\<open>Buffer.add\<close> invocations with concatenated strings
   could have been split into smaller parts, but this would have obfuscated the
   source without making a big difference in performance. Here we have done
   some peephole-optimization for the sake of readability.
 
   Another benefit of \<^ML>\<open>add_content\<close> is its ``open'' form as a function on
   buffers that can be continued in further linear transformations, folding
   etc. Thus it is more compositional than the naive \<^ML>\<open>slow_content\<close>. As
   realistic example, compare the old-style
   \<^ML>\<open>Term.maxidx_of_term: term -> int\<close> with the newer \<^ML>\<open>Term.maxidx_term: term -> int -> int\<close> in Isabelle/Pure.
 
   Note that \<^ML>\<open>fast_content\<close> above is only defined as example. In many
   practical situations, it is customary to provide the incremental \<^ML>\<open>add_content\<close> only and leave the initialization and termination to the
   concrete application to the user.
 \<close>
 
 
 section \<open>Message output channels \label{sec:message-channels}\<close>
 
 text \<open>
   Isabelle provides output channels for different kinds of messages: regular
   output, high-volume tracing information, warnings, and errors.
 
   Depending on the user interface involved, these messages may appear in
   different text styles or colours. The standard output for batch sessions
   prefixes each line of warnings by \<^verbatim>\<open>###\<close> and errors by \<^verbatim>\<open>***\<close>, but leaves
   anything else unchanged. The message body may contain further markup and
   formatting, which is routinely used in the Prover IDE @{cite
   "isabelle-jedit"}.
 
   Messages are associated with the transaction context of the running Isar
   command. This enables the front-end to manage commands and resulting
   messages together. For example, after deleting a command from a given theory
   document version, the corresponding message output can be retracted from the
   display.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML writeln: "string -> unit"} \\
-  @{index_ML tracing: "string -> unit"} \\
-  @{index_ML warning: "string -> unit"} \\
-  @{index_ML error: "string -> 'a"} % FIXME Output.error_message (!?) \\
+  @{define_ML writeln: "string -> unit"} \\
+  @{define_ML tracing: "string -> unit"} \\
+  @{define_ML warning: "string -> unit"} \\
+  @{define_ML error: "string -> 'a"} % FIXME Output.error_message (!?) \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>writeln\<close>~\<open>text\<close> outputs \<open>text\<close> as regular message. This is the
   primary message output operation of Isabelle and should be used by default.
 
   \<^descr> \<^ML>\<open>tracing\<close>~\<open>text\<close> outputs \<open>text\<close> as special tracing message, indicating
   potential high-volume output to the front-end (hundreds or thousands of
   messages issued by a single command). The idea is to allow the
   user-interface to downgrade the quality of message display to achieve higher
   throughput.
 
   Note that the user might have to take special actions to see tracing output,
   e.g.\ switch to a different output window. So this channel should not be
   used for regular output.
 
   \<^descr> \<^ML>\<open>warning\<close>~\<open>text\<close> outputs \<open>text\<close> as warning, which typically means some
   extra emphasis on the front-end side (color highlighting, icons, etc.).
 
   \<^descr> \<^ML>\<open>error\<close>~\<open>text\<close> raises exception \<^ML>\<open>ERROR\<close>~\<open>text\<close> and thus lets the
   Isar toplevel print \<open>text\<close> on the error channel, which typically means some
   extra emphasis on the front-end side (color highlighting, icons, etc.).
 
   This assumes that the exception is not handled before the command
   terminates. Handling exception \<^ML>\<open>ERROR\<close>~\<open>text\<close> is a perfectly legal
   alternative: it means that the error is absorbed without any message output.
 
   \begin{warn}
   The actual error channel is accessed via \<^ML>\<open>Output.error_message\<close>, but
   this is normally not used directly in user code.
   \end{warn}
 
 
   \begin{warn}
   Regular Isabelle/ML code should output messages exclusively by the official
   channels. Using raw I/O on \<^emph>\<open>stdout\<close> or \<^emph>\<open>stderr\<close> instead (e.g.\ via \<^ML>\<open>TextIO.output\<close>) is apt to cause problems in the presence of parallel and
   asynchronous processing of Isabelle theories. Such raw output might be
   displayed by the front-end in some system console log, with a low chance
   that the user will ever see it. Moreover, as a genuine side-effect on global
   process channels, there is no proper way to retract output when Isar command
   transactions are reset by the system.
   \end{warn}
 
   \begin{warn}
   The message channels should be used in a message-oriented manner. This means
   that multi-line output that logically belongs together is issued by a single
   invocation of \<^ML>\<open>writeln\<close> etc.\ with the functional concatenation of all
   message constituents.
   \end{warn}
 \<close>
 
 text %mlex \<open>
   The following example demonstrates a multi-line warning. Note that in some
   situations the user sees only the first line, so the most important point
   should be made first.
 \<close>
 
 ML_command \<open>
   warning (cat_lines
    ["Beware the Jabberwock, my son!",
     "The jaws that bite, the claws that catch!",
     "Beware the Jubjub Bird, and shun",
     "The frumious Bandersnatch!"]);
 \<close>
 
 text \<open>
   \<^medskip>
   An alternative is to make a paragraph of freely-floating words as follows.
 \<close>
 
 ML_command \<open>
   warning (Pretty.string_of (Pretty.para
     "Beware the Jabberwock, my son! \
     \The jaws that bite, the claws that catch! \
     \Beware the Jubjub Bird, and shun \
     \The frumious Bandersnatch!"))
 \<close>
 
 text \<open>
   This has advantages with variable window / popup sizes, but might make it
   harder to search for message content systematically, e.g.\ by other tools or
   by humans expecting the ``verse'' of a formal message in a fixed layout.
 \<close>
 
 
 section \<open>Exceptions \label{sec:exceptions}\<close>
 
 text \<open>
   The Standard ML semantics of strict functional evaluation together with
   exceptions is rather well defined, but some delicate points need to be
   observed to avoid that ML programs go wrong despite static type-checking.
   Exceptions in Isabelle/ML are subsequently categorized as follows.
 \<close>
 
 paragraph \<open>Regular user errors.\<close>
 text \<open>
   These are meant to provide informative feedback about malformed input etc.
 
   The \<^emph>\<open>error\<close> function raises the corresponding \<^ML>\<open>ERROR\<close> exception, with a
   plain text message as argument. \<^ML>\<open>ERROR\<close> exceptions can be handled
   internally, in order to be ignored, turned into other exceptions, or
   cascaded by appending messages. If the corresponding Isabelle/Isar command
   terminates with an \<^ML>\<open>ERROR\<close> exception state, the system will print the
   result on the error channel (see \secref{sec:message-channels}).
 
   It is considered bad style to refer to internal function names or values in
   ML source notation in user error messages. Do not use \<open>@{make_string}\<close> nor
   \<open>@{here}\<close>!
 
   Grammatical correctness of error messages can be improved by \<^emph>\<open>omitting\<close>
   final punctuation: messages are often concatenated or put into a larger
   context (e.g.\ augmented with source position). Note that punctuation after
   formal entities (types, terms, theorems) is particularly prone to user
   confusion.
 \<close>
 
 paragraph \<open>Program failures.\<close>
 text \<open>
   There is a handful of standard exceptions that indicate general failure
   situations, or failures of core operations on logical entities (types,
   terms, theorems, theories, see \chref{ch:logic}).
 
   These exceptions indicate a genuine breakdown of the program, so the main
   purpose is to determine quickly what has happened where. Traditionally, the
   (short) exception message would include the name of an ML function, although
   this is no longer necessary, because the ML runtime system attaches detailed
   source position stemming from the corresponding \<^ML_text>\<open>raise\<close> keyword.
 
   \<^medskip>
   User modules can always introduce their own custom exceptions locally, e.g.\
   to organize internal failures robustly without overlapping with existing
   exceptions. Exceptions that are exposed in module signatures require extra
   care, though, and should \<^emph>\<open>not\<close> be introduced by default. Surprise by users
   of a module can be often minimized by using plain user errors instead.
 \<close>
 
 paragraph \<open>Interrupts.\<close>
 text \<open>
   These indicate arbitrary system events: both the ML runtime system and the
   Isabelle/ML infrastructure signal various exceptional situations by raising
   the special \<^ML>\<open>Exn.Interrupt\<close> exception in user code.
 
   This is the one and only way that physical events can intrude an Isabelle/ML
   program. Such an interrupt can mean out-of-memory, stack overflow, timeout,
   internal signaling of threads, or a POSIX process signal. An Isabelle/ML
   program that intercepts interrupts becomes dependent on physical effects of
   the environment. Even worse, exception handling patterns that are too
   general by accident, e.g.\ by misspelled exception constructors, will cover
   interrupts unintentionally and thus render the program semantics
   ill-defined.
 
   Note that the Interrupt exception dates back to the original SML90 language
   definition. It was excluded from the SML97 version to avoid its malign
   impact on ML program semantics, but without providing a viable alternative.
   Isabelle/ML recovers physical interruptibility (which is an indispensable
   tool to implement managed evaluation of command transactions), but requires
   user code to be strictly transparent wrt.\ interrupts.
 
   \begin{warn}
   Isabelle/ML user code needs to terminate promptly on interruption, without
   guessing at its meaning to the system infrastructure. Temporary handling of
   interrupts for cleanup of global resources etc.\ needs to be followed
   immediately by re-raising of the original exception.
   \end{warn}
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML try: "('a -> 'b) -> 'a -> 'b option"} \\
-  @{index_ML can: "('a -> 'b) -> 'a -> bool"} \\
-  @{index_ML_exception ERROR: string} \\
-  @{index_ML_exception Fail: string} \\
-  @{index_ML Exn.is_interrupt: "exn -> bool"} \\
-  @{index_ML Exn.reraise: "exn -> 'a"} \\
-  @{index_ML Runtime.exn_trace: "(unit -> 'a) -> 'a"} \\
+  @{define_ML try: "('a -> 'b) -> 'a -> 'b option"} \\
+  @{define_ML can: "('a -> 'b) -> 'a -> bool"} \\
+  @{define_ML_exception ERROR of string} \\
+  @{define_ML_exception Fail of string} \\
+  @{define_ML Exn.is_interrupt: "exn -> bool"} \\
+  @{define_ML Exn.reraise: "exn -> 'a"} \\
+  @{define_ML Runtime.exn_trace: "(unit -> 'a) -> 'a"} \\
   \end{mldecls}
 
   \<^rail>\<open>
     (@@{ML_antiquotation try} | @@{ML_antiquotation can}) embedded
   \<close>
 
   \<^descr> \<^ML>\<open>try\<close>~\<open>f x\<close> makes the partiality of evaluating \<open>f x\<close> explicit via the
   option datatype. Interrupts are \<^emph>\<open>not\<close> handled here, i.e.\ this form serves
   as safe replacement for the \<^emph>\<open>unsafe\<close> version \<^ML_text>\<open>(SOME\<close>~\<open>f
   x\<close>~\<^ML_text>\<open>handle _ => NONE)\<close> that is occasionally seen in books about
   SML97, but not in Isabelle/ML.
 
   \<^descr> \<^ML>\<open>can\<close> is similar to \<^ML>\<open>try\<close> with more abstract result.
 
   \<^descr> \<^ML>\<open>ERROR\<close>~\<open>msg\<close> represents user errors; this exception is normally
   raised indirectly via the \<^ML>\<open>error\<close> function (see
   \secref{sec:message-channels}).
 
   \<^descr> \<^ML>\<open>Fail\<close>~\<open>msg\<close> represents general program failures.
 
   \<^descr> \<^ML>\<open>Exn.is_interrupt\<close> identifies interrupts robustly, without mentioning
   concrete exception constructors in user code. Handled interrupts need to be
   re-raised promptly!
 
   \<^descr> \<^ML>\<open>Exn.reraise\<close>~\<open>exn\<close> raises exception \<open>exn\<close> while preserving its implicit
   position information (if possible, depending on the ML platform).
 
   \<^descr> \<^ML>\<open>Runtime.exn_trace\<close>~\<^ML_text>\<open>(fn () =>\<close>~\<open>e\<close>\<^ML_text>\<open>)\<close> evaluates
   expression \<open>e\<close> while printing a full trace of its stack of nested exceptions
   (if possible, depending on the ML platform).
 
   Inserting \<^ML>\<open>Runtime.exn_trace\<close> into ML code temporarily is useful for
   debugging, but not suitable for production code.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "try"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "can"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "assert"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "undefined"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{try}\<close> and \<open>{can}\<close> are similar to the corresponding functions, but the
   argument is taken directly as ML expression: functional abstraction and
   application is done implicitly.
 
   \<^descr> \<open>@{assert}\<close> inlines a function \<^ML_type>\<open>bool -> unit\<close> that raises
   \<^ML>\<open>Fail\<close> if the argument is \<^ML>\<open>false\<close>. Due to inlining the source
   position of failed assertions is included in the error output.
 
   \<^descr> \<open>@{undefined}\<close> inlines \<^verbatim>\<open>raise\<close>~\<^ML>\<open>Match\<close>, i.e.\ the ML program
   behaves as in some function application of an undefined case.
 \<close>
 
 text %mlex \<open>
   We define a total version of division: any failures are swept under the
   carpet and mapped to a default value. Thus division-by-zero becomes 0, but
   there could be other exceptions like overflow that produce the same result
   (for unbounded integers this does not happen).
 \<close>
 
 ML \<open>
   fun div_total x y = \<^try>\<open>x div y\<close> |> the_default 0;
 
   \<^assert> (div_total 1 0 = 0);
 \<close>
 
 text \<open>
   The ML function \<^ML>\<open>undefined\<close> is defined in \<^file>\<open>~~/src/Pure/library.ML\<close>
   as follows:
 \<close>
 
 ML \<open>fun undefined _ = raise Match\<close>
 
 text \<open>
   \<^medskip>
   The following variant uses the antiquotation @{ML_antiquotation undefined}
   instead:
 \<close>
 
 ML \<open>fun undefined _ = \<^undefined>\<close>
 
 text \<open>
   \<^medskip>
   Here is the same, using control-symbol notation for the antiquotation, with
   special rendering of \<^verbatim>\<open>\<^undefined>\<close>:
 \<close>
 
 ML \<open>fun undefined _ = \<^undefined>\<close>
 
 text \<open>
   \<^medskip> Semantically, all forms are equivalent to a function definition
   without any clauses, but that is syntactically not allowed in ML.
 \<close>
 
 
 section \<open>Strings of symbols \label{sec:symbols}\<close>
 
 text \<open>
   A \<^emph>\<open>symbol\<close> constitutes the smallest textual unit in Isabelle/ML --- raw ML
   characters are normally not encountered at all. Isabelle strings consist of
   a sequence of symbols, represented as a packed string or an exploded list of
   strings. Each symbol is in itself a small string, which has either one of
   the following forms:
 
     \<^enum> a single ASCII character ``\<open>c\<close>'', for example ``\<^verbatim>\<open>a\<close>'',
 
     \<^enum> a codepoint according to UTF-8 (non-ASCII byte sequence),
 
     \<^enum> a regular symbol ``\<^verbatim>\<open>\<ident>\<close>'', for example ``\<^verbatim>\<open>\<alpha>\<close>'',
 
     \<^enum> a control symbol ``\<^verbatim>\<open>\<^ident>\<close>'', for example ``\<^verbatim>\<open>\<^bold>\<close>'',
 
   The \<open>ident\<close> syntax for symbol names is \<open>letter (letter | digit)\<^sup>*\<close>, where
   \<open>letter = A..Za..z\<close> and \<open>digit = 0..9\<close>. There are infinitely many regular
   symbols and control symbols, but a fixed collection of standard symbols is
   treated specifically. For example, ``\<^verbatim>\<open>\<alpha>\<close>'' is classified as a letter, which
   means it may occur within regular Isabelle identifiers.
 
   The character set underlying Isabelle symbols is 7-bit ASCII, but 8-bit
   character sequences are passed-through unchanged. Unicode/UCS data in UTF-8
   encoding is processed in a non-strict fashion, such that well-formed code
   sequences are recognized accordingly. Unicode provides its own collection of
   mathematical symbols, but within the core Isabelle/ML world there is no link
   to the standard collection of Isabelle regular symbols.
 
   \<^medskip>
   Output of Isabelle symbols depends on the print mode. For example, the
   standard {\LaTeX} setup of the Isabelle document preparation system would
   present ``\<^verbatim>\<open>\<alpha>\<close>'' as \<open>\<alpha>\<close>, and ``\<^verbatim>\<open>\<^bold>\<alpha>\<close>'' as \<open>\<^bold>\<alpha>\<close>. On-screen rendering usually
   works by mapping a finite subset of Isabelle symbols to suitable Unicode
   characters.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type "Symbol.symbol": string} \\
-  @{index_ML Symbol.explode: "string -> Symbol.symbol list"} \\
-  @{index_ML Symbol.is_letter: "Symbol.symbol -> bool"} \\
-  @{index_ML Symbol.is_digit: "Symbol.symbol -> bool"} \\
-  @{index_ML Symbol.is_quasi: "Symbol.symbol -> bool"} \\
-  @{index_ML Symbol.is_blank: "Symbol.symbol -> bool"} \\
+  @{define_ML_type Symbol.symbol = string} \\
+  @{define_ML Symbol.explode: "string -> Symbol.symbol list"} \\
+  @{define_ML Symbol.is_letter: "Symbol.symbol -> bool"} \\
+  @{define_ML Symbol.is_digit: "Symbol.symbol -> bool"} \\
+  @{define_ML Symbol.is_quasi: "Symbol.symbol -> bool"} \\
+  @{define_ML Symbol.is_blank: "Symbol.symbol -> bool"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML_type "Symbol.sym"} \\
-  @{index_ML Symbol.decode: "Symbol.symbol -> Symbol.sym"} \\
+  @{define_ML_type "Symbol.sym"} \\
+  @{define_ML Symbol.decode: "Symbol.symbol -> Symbol.sym"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Symbol.symbol\<close> represents individual Isabelle symbols.
 
   \<^descr> \<^ML>\<open>Symbol.explode\<close>~\<open>str\<close> produces a symbol list from the packed form.
   This function supersedes \<^ML>\<open>String.explode\<close> for virtually all purposes
   of manipulating text in Isabelle!\<^footnote>\<open>The runtime overhead for exploded strings
   is mainly that of the list structure: individual symbols that happen to be a
   singleton string do not require extra memory in Poly/ML.\<close>
 
   \<^descr> \<^ML>\<open>Symbol.is_letter\<close>, \<^ML>\<open>Symbol.is_digit\<close>, \<^ML>\<open>Symbol.is_quasi\<close>, \<^ML>\<open>Symbol.is_blank\<close> classify standard symbols
   according to fixed syntactic conventions of Isabelle, cf.\ @{cite
   "isabelle-isar-ref"}.
 
   \<^descr> Type \<^ML_type>\<open>Symbol.sym\<close> is a concrete datatype that represents the
   different kinds of symbols explicitly, with constructors \<^ML>\<open>Symbol.Char\<close>, \<^ML>\<open>Symbol.UTF8\<close>, \<^ML>\<open>Symbol.Sym\<close>, \<^ML>\<open>Symbol.Control\<close>, \<^ML>\<open>Symbol.Malformed\<close>.
 
   \<^descr> \<^ML>\<open>Symbol.decode\<close> converts the string representation of a symbol into
   the datatype version.
 \<close>
 
 paragraph \<open>Historical note.\<close>
 text \<open>
   In the original SML90 standard the primitive ML type \<^ML_type>\<open>char\<close> did not
   exists, and \<^ML_text>\<open>explode: string -> string list\<close> produced a list of
   singleton strings like \<^ML>\<open>raw_explode: string -> string list\<close> in
   Isabelle/ML today. When SML97 came out, Isabelle did not adopt its somewhat
   anachronistic 8-bit or 16-bit characters, but the idea of exploding a string
   into a list of small strings was extended to ``symbols'' as explained above.
   Thus Isabelle sources can refer to an infinite store of user-defined
   symbols, without having to worry about the multitude of Unicode encodings
   that have emerged over the years.
 \<close>
 
 
 section \<open>Basic data types\<close>
 
 text \<open>
   The basis library proposal of SML97 needs to be treated with caution. Many
   of its operations simply do not fit with important Isabelle/ML conventions
   (like ``canonical argument order'', see
   \secref{sec:canonical-argument-order}), others cause problems with the
   parallel evaluation model of Isabelle/ML (such as \<^ML>\<open>TextIO.print\<close> or \<^ML>\<open>OS.Process.system\<close>).
 
   Subsequently we give a brief overview of important operations on basic ML
   data types.
 \<close>
 
 
 subsection \<open>Characters\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type char} \\
+  @{define_ML_type char} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>char\<close> is \<^emph>\<open>not\<close> used. The smallest textual unit in Isabelle
   is represented as a ``symbol'' (see \secref{sec:symbols}).
 \<close>
 
 
 subsection \<open>Strings\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type string} \\
+  @{define_ML_type string} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>string\<close> represents immutable vectors of 8-bit characters.
   There are operations in SML to convert back and forth to actual byte
   vectors, which are seldom used.
 
   This historically important raw text representation is used for
   Isabelle-specific purposes with the following implicit substructures packed
   into the string content:
 
     \<^enum> sequence of Isabelle symbols (see also \secref{sec:symbols}), with \<^ML>\<open>Symbol.explode\<close> as key operation;
   
     \<^enum> XML tree structure via YXML (see also @{cite "isabelle-system"}), with
     \<^ML>\<open>YXML.parse_body\<close> as key operation.
 
   Note that Isabelle/ML string literals may refer Isabelle symbols like
   ``\<^verbatim>\<open>\<alpha>\<close>'' natively, \<^emph>\<open>without\<close> escaping the backslash. This is a consequence
   of Isabelle treating all source text as strings of symbols, instead of raw
   characters.
 \<close>
 
 text %mlex \<open>
   The subsequent example illustrates the difference of physical addressing of
   bytes versus logical addressing of symbols in Isabelle strings.
 \<close>
 
 ML_val \<open>
   val s = "\<A>";
 
   \<^assert> (length (Symbol.explode s) = 1);
   \<^assert> (size s = 4);
 \<close>
 
 text \<open>
   Note that in Unicode renderings of the symbol \<open>\<A>\<close>, variations of encodings
   like UTF-8 or UTF-16 pose delicate questions about the multi-byte
   representations of its codepoint, which is outside of the 16-bit address
   space of the original Unicode standard from the 1990-ies. In Isabelle/ML it
   is just ``\<^verbatim>\<open>\<A>\<close>'' literally, using plain ASCII characters beyond any
   doubts.
 \<close>
 
 
 subsection \<open>Integers\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type int} \\
+  @{define_ML_type int} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>int\<close> represents regular mathematical integers, which are
   \<^emph>\<open>unbounded\<close>. Overflow is treated properly, but should never happen in
   practice.\<^footnote>\<open>The size limit for integer bit patterns in memory is 64\,MB for
   32-bit Poly/ML, and much higher for 64-bit systems.\<close>
 
   Structure \<^ML_structure>\<open>IntInf\<close> of SML97 is obsolete and superseded by
   \<^ML_structure>\<open>Int\<close>. Structure \<^ML_structure>\<open>Integer\<close> in
   \<^file>\<open>~~/src/Pure/General/integer.ML\<close> provides some additional operations.
 \<close>
 
 
 subsection \<open>Rational numbers\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Rat.rat} \\
+  @{define_ML_type Rat.rat} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Rat.rat\<close> represents rational numbers, based on the
   unbounded integers of Poly/ML.
 
   Literal rationals may be written with special antiquotation syntax
   \<^verbatim>\<open>@\<close>\<open>int\<close>\<^verbatim>\<open>/\<close>\<open>nat\<close> or \<^verbatim>\<open>@\<close>\<open>int\<close> (without any white space). For example
   \<^verbatim>\<open>@~1/4\<close> or \<^verbatim>\<open>@10\<close>. The ML toplevel pretty printer uses the same format.
 
   Standard operations are provided via ad-hoc overloading of \<^verbatim>\<open>+\<close>, \<^verbatim>\<open>-\<close>, \<^verbatim>\<open>*\<close>,
   \<^verbatim>\<open>/\<close>, etc.
 \<close>
 
 
 subsection \<open>Time\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Time.time} \\
-  @{index_ML seconds: "real -> Time.time"} \\
+  @{define_ML_type Time.time} \\
+  @{define_ML seconds: "real -> Time.time"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Time.time\<close> represents time abstractly according to the
   SML97 basis library definition. This is adequate for internal ML operations,
   but awkward in concrete time specifications.
 
   \<^descr> \<^ML>\<open>seconds\<close>~\<open>s\<close> turns the concrete scalar \<open>s\<close> (measured in seconds) into
   an abstract time value. Floating point numbers are easy to use as
   configuration options in the context (see \secref{sec:config-options}) or
   system options that are maintained externally.
 \<close>
 
 
 subsection \<open>Options\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Option.map: "('a -> 'b) -> 'a option -> 'b option"} \\
-  @{index_ML is_some: "'a option -> bool"} \\
-  @{index_ML is_none: "'a option -> bool"} \\
-  @{index_ML the: "'a option -> 'a"} \\
-  @{index_ML these: "'a list option -> 'a list"} \\
-  @{index_ML the_list: "'a option -> 'a list"} \\
-  @{index_ML the_default: "'a -> 'a option -> 'a"} \\
+  @{define_ML Option.map: "('a -> 'b) -> 'a option -> 'b option"} \\
+  @{define_ML is_some: "'a option -> bool"} \\
+  @{define_ML is_none: "'a option -> bool"} \\
+  @{define_ML the: "'a option -> 'a"} \\
+  @{define_ML these: "'a list option -> 'a list"} \\
+  @{define_ML the_list: "'a option -> 'a list"} \\
+  @{define_ML the_default: "'a -> 'a option -> 'a"} \\
   \end{mldecls}
 \<close>
 
 text \<open>
   Apart from \<^ML>\<open>Option.map\<close> most other operations defined in structure
   \<^ML_structure>\<open>Option\<close> are alien to Isabelle/ML and never used. The
   operations shown above are defined in \<^file>\<open>~~/src/Pure/General/basics.ML\<close>.
 \<close>
 
 
 subsection \<open>Lists\<close>
 
 text \<open>
   Lists are ubiquitous in ML as simple and light-weight ``collections'' for
   many everyday programming tasks. Isabelle/ML provides important additions
   and improvements over operations that are predefined in the SML97 library.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML cons: "'a -> 'a list -> 'a list"} \\
-  @{index_ML member: "('b * 'a -> bool) -> 'a list -> 'b -> bool"} \\
-  @{index_ML insert: "('a * 'a -> bool) -> 'a -> 'a list -> 'a list"} \\
-  @{index_ML remove: "('b * 'a -> bool) -> 'b -> 'a list -> 'a list"} \\
-  @{index_ML update: "('a * 'a -> bool) -> 'a -> 'a list -> 'a list"} \\
+  @{define_ML cons: "'a -> 'a list -> 'a list"} \\
+  @{define_ML member: "('b * 'a -> bool) -> 'a list -> 'b -> bool"} \\
+  @{define_ML insert: "('a * 'a -> bool) -> 'a -> 'a list -> 'a list"} \\
+  @{define_ML remove: "('b * 'a -> bool) -> 'b -> 'a list -> 'a list"} \\
+  @{define_ML update: "('a * 'a -> bool) -> 'a -> 'a list -> 'a list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>cons\<close>~\<open>x xs\<close> evaluates to \<open>x :: xs\<close>.
 
   Tupled infix operators are a historical accident in Standard ML. The curried
   \<^ML>\<open>cons\<close> amends this, but it should be only used when partial application
   is required.
 
   \<^descr> \<^ML>\<open>member\<close>, \<^ML>\<open>insert\<close>, \<^ML>\<open>remove\<close>, \<^ML>\<open>update\<close> treat lists as a
   set-like container that maintains the order of elements. See
   \<^file>\<open>~~/src/Pure/library.ML\<close> for the full specifications (written in ML).
   There are some further derived operations like \<^ML>\<open>union\<close> or \<^ML>\<open>inter\<close>.
 
   Note that \<^ML>\<open>insert\<close> is conservative about elements that are already a
   \<^ML>\<open>member\<close> of the list, while \<^ML>\<open>update\<close> ensures that the latest entry
   is always put in front. The latter discipline is often more appropriate in
   declarations of context data (\secref{sec:context-data}) that are issued by
   the user in Isar source: later declarations take precedence over earlier
   ones. \<close>
 
 text %mlex \<open>
   Using canonical \<^ML>\<open>fold\<close> together with \<^ML>\<open>cons\<close> (or similar standard
   operations) alternates the orientation of data. The is quite natural and
   should not be altered forcible by inserting extra applications of \<^ML>\<open>rev\<close>.
   The alternative \<^ML>\<open>fold_rev\<close> can be used in the few situations, where
   alternation should be prevented.
 \<close>
 
 ML_val \<open>
   val items = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
 
   val list1 = fold cons items [];
   \<^assert> (list1 = rev items);
 
   val list2 = fold_rev cons items [];
   \<^assert> (list2 = items);
 \<close>
 
 text \<open>
   The subsequent example demonstrates how to \<^emph>\<open>merge\<close> two lists in a natural
   way.
 \<close>
 
 ML_val \<open>
   fun merge_lists eq (xs, ys) = fold_rev (insert eq) ys xs;
 \<close>
 
 text \<open>
   Here the first list is treated conservatively: only the new elements from
   the second list are inserted. The inside-out order of insertion via \<^ML>\<open>fold_rev\<close> attempts to preserve the order of elements in the result.
 
   This way of merging lists is typical for context data
   (\secref{sec:context-data}). See also \<^ML>\<open>merge\<close> as defined in
   \<^file>\<open>~~/src/Pure/library.ML\<close>.
 \<close>
 
 
 subsection \<open>Association lists\<close>
 
 text \<open>
   The operations for association lists interpret a concrete list of pairs as a
   finite function from keys to values. Redundant representations with multiple
   occurrences of the same key are implicitly normalized: lookup and update
   only take the first occurrence into account.
 \<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML AList.lookup: "('a * 'b -> bool) -> ('b * 'c) list -> 'a -> 'c option"} \\
-  @{index_ML AList.defined: "('a * 'b -> bool) -> ('b * 'c) list -> 'a -> bool"} \\
-  @{index_ML AList.update: "('a * 'a -> bool) -> 'a * 'b -> ('a * 'b) list -> ('a * 'b) list"} \\
+  @{define_ML AList.lookup: "('a * 'b -> bool) -> ('b * 'c) list -> 'a -> 'c option"} \\
+  @{define_ML AList.defined: "('a * 'b -> bool) -> ('b * 'c) list -> 'a -> bool"} \\
+  @{define_ML AList.update: "('a * 'a -> bool) -> 'a * 'b -> ('a * 'b) list -> ('a * 'b) list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>AList.lookup\<close>, \<^ML>\<open>AList.defined\<close>, \<^ML>\<open>AList.update\<close> implement the
   main ``framework operations'' for mappings in Isabelle/ML, following
   standard conventions for their names and types.
 
   Note that a function called \<^verbatim>\<open>lookup\<close> is obliged to express its partiality
   via an explicit option element. There is no choice to raise an exception,
   without changing the name to something like \<open>the_element\<close> or \<open>get\<close>.
 
   The \<open>defined\<close> operation is essentially a contraction of \<^ML>\<open>is_some\<close> and
   \<^verbatim>\<open>lookup\<close>, but this is sufficiently frequent to justify its independent
   existence. This also gives the implementation some opportunity for peep-hole
   optimization.
 
 
   Association lists are adequate as simple implementation of finite mappings
   in many practical situations. A more advanced table structure is defined in
   \<^file>\<open>~~/src/Pure/General/table.ML\<close>; that version scales easily to thousands or
   millions of elements.
 \<close>
 
 
 subsection \<open>Unsynchronized references\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type "'a Unsynchronized.ref"} \\
-  @{index_ML Unsynchronized.ref: "'a -> 'a Unsynchronized.ref"} \\
-  @{index_ML "!": "'a Unsynchronized.ref -> 'a"} \\
-  @{index_ML_op ":=": "'a Unsynchronized.ref * 'a -> unit"} \\
+  @{define_ML_type 'a "Unsynchronized.ref"} \\
+  @{define_ML Unsynchronized.ref: "'a -> 'a Unsynchronized.ref"} \\
+  @{define_ML "!": "'a Unsynchronized.ref -> 'a"} \\
+  @{define_ML_infix ":=" : "'a Unsynchronized.ref * 'a -> unit"} \\
   \end{mldecls}
 \<close>
 
 text \<open>
   Due to ubiquitous parallelism in Isabelle/ML (see also
   \secref{sec:multi-threading}), the mutable reference cells of Standard ML
   are notorious for causing problems. In a highly parallel system, both
   correctness \<^emph>\<open>and\<close> performance are easily degraded when using mutable data.
 
   The unwieldy name of \<^ML>\<open>Unsynchronized.ref\<close> for the constructor for
   references in Isabelle/ML emphasizes the inconveniences caused by
-  mutability. Existing operations \<^ML>\<open>!\<close> and \<^ML_op>\<open>:=\<close> are unchanged,
+  mutability. Existing operations \<^ML>\<open>!\<close> and \<^ML_infix>\<open>:=\<close> are unchanged,
   but should be used with special precautions, say in a strictly local
   situation that is guaranteed to be restricted to sequential evaluation ---
   now and in the future.
 
   \begin{warn}
   Never \<^ML_text>\<open>open Unsynchronized\<close>, not even in a local scope!
   Pretending that mutable state is no problem is a very bad idea.
   \end{warn}
 \<close>
 
 
 section \<open>Thread-safe programming \label{sec:multi-threading}\<close>
 
 text \<open>
   Multi-threaded execution has become an everyday reality in Isabelle since
   Poly/ML 5.2.1 and Isabelle2008. Isabelle/ML provides implicit and explicit
   parallelism by default, and there is no way for user-space tools to ``opt
   out''. ML programs that are purely functional, output messages only via the
   official channels (\secref{sec:message-channels}), and do not intercept
   interrupts (\secref{sec:exceptions}) can participate in the multi-threaded
   environment immediately without further ado.
 
   More ambitious tools with more fine-grained interaction with the environment
   need to observe the principles explained below.
 \<close>
 
 
 subsection \<open>Multi-threading with shared memory\<close>
 
 text \<open>
   Multiple threads help to organize advanced operations of the system, such as
   real-time conditions on command transactions, sub-components with explicit
   communication, general asynchronous interaction etc. Moreover, parallel
   evaluation is a prerequisite to make adequate use of the CPU resources that
   are available on multi-core systems.\<^footnote>\<open>Multi-core computing does not mean
   that there are ``spare cycles'' to be wasted. It means that the continued
   exponential speedup of CPU performance due to ``Moore's Law'' follows
   different rules: clock frequency has reached its peak around 2005, and
   applications need to be parallelized in order to avoid a perceived loss of
   performance. See also @{cite "Sutter:2005"}.\<close>
 
   Isabelle/Isar exploits the inherent structure of theories and proofs to
   support \<^emph>\<open>implicit parallelism\<close> to a large extent. LCF-style theorem proving
   provides almost ideal conditions for that, see also @{cite "Wenzel:2009"}.
   This means, significant parts of theory and proof checking is parallelized
   by default. In Isabelle2013, a maximum speedup-factor of 3.5 on 4 cores and
   6.5 on 8 cores can be expected @{cite "Wenzel:2013:ITP"}.
 
   \<^medskip>
   ML threads lack the memory protection of separate processes, and operate
   concurrently on shared heap memory. This has the advantage that results of
   independent computations are directly available to other threads: abstract
   values can be passed without copying or awkward serialization that is
   typically required for separate processes.
 
   To make shared-memory multi-threading work robustly and efficiently, some
   programming guidelines need to be observed. While the ML system is
   responsible to maintain basic integrity of the representation of ML values
   in memory, the application programmer needs to ensure that multi-threaded
   execution does not break the intended semantics.
 
   \begin{warn}
   To participate in implicit parallelism, tools need to be thread-safe. A
   single ill-behaved tool can affect the stability and performance of the
   whole system.
   \end{warn}
 
   Apart from observing the principles of thread-safeness passively, advanced
   tools may also exploit parallelism actively, e.g.\ by using library
   functions for parallel list operations (\secref{sec:parlist}).
 
   \begin{warn}
   Parallel computing resources are managed centrally by the Isabelle/ML
   infrastructure. User programs should not fork their own ML threads to
   perform heavy computations.
   \end{warn}
 \<close>
 
 
 subsection \<open>Critical shared resources\<close>
 
 text \<open>
   Thread-safeness is mainly concerned about concurrent read/write access to
   shared resources, which are outside the purely functional world of ML. This
   covers the following in particular.
 
     \<^item> Global references (or arrays), i.e.\ mutable memory cells that persist
     over several invocations of associated operations.\<^footnote>\<open>This is independent of
     the visibility of such mutable values in the toplevel scope.\<close>
 
     \<^item> Global state of the running Isabelle/ML process, i.e.\ raw I/O channels,
     environment variables, current working directory.
 
     \<^item> Writable resources in the file-system that are shared among different
     threads or external processes.
 
   Isabelle/ML provides various mechanisms to avoid critical shared resources
   in most situations. As last resort there are some mechanisms for explicit
   synchronization. The following guidelines help to make Isabelle/ML programs
   work smoothly in a concurrent environment.
 
   \<^item> Avoid global references altogether. Isabelle/Isar maintains a uniform
   context that incorporates arbitrary data declared by user programs
   (\secref{sec:context-data}). This context is passed as plain value and user
   tools can get/map their own data in a purely functional manner.
   Configuration options within the context (\secref{sec:config-options})
   provide simple drop-in replacements for historic reference variables.
 
   \<^item> Keep components with local state information re-entrant. Instead of poking
   initial values into (private) global references, a new state record can be
   created on each invocation, and passed through any auxiliary functions of
   the component. The state record contain mutable references in special
   situations, without requiring any synchronization, as long as each
   invocation gets its own copy and the tool itself is single-threaded.
 
   \<^item> Avoid raw output on \<open>stdout\<close> or \<open>stderr\<close>. The Poly/ML library is
   thread-safe for each individual output operation, but the ordering of
   parallel invocations is arbitrary. This means raw output will appear on some
   system console with unpredictable interleaving of atomic chunks.
 
   Note that this does not affect regular message output channels
   (\secref{sec:message-channels}). An official message id is associated with
   the command transaction from where it originates, independently of other
   transactions. This means each running Isar command has effectively its own
   set of message channels, and interleaving can only happen when commands use
   parallelism internally (and only at message boundaries).
 
   \<^item> Treat environment variables and the current working directory of the
   running process as read-only.
 
   \<^item> Restrict writing to the file-system to unique temporary files. Isabelle
   already provides a temporary directory that is unique for the running
   process, and there is a centralized source of unique serial numbers in
   Isabelle/ML. Thus temporary files that are passed to to some external
   process will be always disjoint, and thus thread-safe.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML File.tmp_path: "Path.T -> Path.T"} \\
-  @{index_ML serial_string: "unit -> string"} \\
+  @{define_ML File.tmp_path: "Path.T -> Path.T"} \\
+  @{define_ML serial_string: "unit -> string"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>File.tmp_path\<close>~\<open>path\<close> relocates the base component of \<open>path\<close> into the
   unique temporary directory of the running Isabelle/ML process.
 
   \<^descr> \<^ML>\<open>serial_string\<close>~\<open>()\<close> creates a new serial number that is unique over
   the runtime of the Isabelle/ML process.
 \<close>
 
 text %mlex \<open>
   The following example shows how to create unique temporary file names.
 \<close>
 
 ML_val \<open>
   val tmp1 = File.tmp_path (Path.basic ("foo" ^ serial_string ()));
   val tmp2 = File.tmp_path (Path.basic ("foo" ^ serial_string ()));
   \<^assert> (tmp1 <> tmp2);
 \<close>
 
 
 subsection \<open>Explicit synchronization\<close>
 
 text \<open>
   Isabelle/ML provides explicit synchronization for mutable variables over
   immutable data, which may be updated atomically and exclusively. This
   addresses the rare situations where mutable shared resources are really
   required. Synchronization in Isabelle/ML is based on primitives of Poly/ML,
   which have been adapted to the specific assumptions of the concurrent
   Isabelle environment. User code should not break this abstraction, but stay
   within the confines of concurrent Isabelle/ML.
 
   A \<^emph>\<open>synchronized variable\<close> is an explicit state component associated with
   mechanisms for locking and signaling. There are operations to await a
   condition, change the state, and signal the change to all other waiting
   threads. Synchronized access to the state variable is \<^emph>\<open>not\<close> re-entrant:
   direct or indirect nesting within the same thread will cause a deadlock!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type "'a Synchronized.var"} \\
-  @{index_ML Synchronized.var: "string -> 'a -> 'a Synchronized.var"} \\
-  @{index_ML Synchronized.guarded_access: "'a Synchronized.var ->
+  @{define_ML_type 'a "Synchronized.var"} \\
+  @{define_ML Synchronized.var: "string -> 'a -> 'a Synchronized.var"} \\
+  @{define_ML Synchronized.guarded_access: "'a Synchronized.var ->
   ('a -> ('b * 'a) option) -> 'b"} \\
   \end{mldecls}
 
     \<^descr> Type \<^ML_type>\<open>'a Synchronized.var\<close> represents synchronized variables
     with state of type \<^ML_type>\<open>'a\<close>.
 
     \<^descr> \<^ML>\<open>Synchronized.var\<close>~\<open>name x\<close> creates a synchronized variable that is
     initialized with value \<open>x\<close>. The \<open>name\<close> is used for tracing.
 
     \<^descr> \<^ML>\<open>Synchronized.guarded_access\<close>~\<open>var f\<close> lets the function \<open>f\<close> operate
     within a critical section on the state \<open>x\<close> as follows: if \<open>f x\<close> produces
     \<^ML>\<open>NONE\<close>, it continues to wait on the internal condition variable,
     expecting that some other thread will eventually change the content in a
     suitable manner; if \<open>f x\<close> produces \<^ML>\<open>SOME\<close>~\<open>(y, x')\<close> it is satisfied and
     assigns the new state value \<open>x'\<close>, broadcasts a signal to all waiting threads
     on the associated condition variable, and returns the result \<open>y\<close>.
 
   There are some further variants of the \<^ML>\<open>Synchronized.guarded_access\<close>
   combinator, see \<^file>\<open>~~/src/Pure/Concurrent/synchronized.ML\<close> for details.
 \<close>
 
 text %mlex \<open>
   The following example implements a counter that produces positive integers
   that are unique over the runtime of the Isabelle process:
 \<close>
 
 ML_val \<open>
   local
     val counter = Synchronized.var "counter" 0;
   in
     fun next () =
       Synchronized.guarded_access counter
         (fn i =>
           let val j = i + 1
           in SOME (j, j) end);
   end;
 
   val a = next ();
   val b = next ();
   \<^assert> (a <> b);
 \<close>
 
 text \<open>
   \<^medskip>
   See \<^file>\<open>~~/src/Pure/Concurrent/mailbox.ML\<close> how to implement a mailbox as
   synchronized variable over a purely functional list.
 \<close>
 
 
 section \<open>Managed evaluation\<close>
 
 text \<open>
   Execution of Standard ML follows the model of strict functional evaluation
   with optional exceptions. Evaluation happens whenever some function is
   applied to (sufficiently many) arguments. The result is either an explicit
   value or an implicit exception.
 
   \<^emph>\<open>Managed evaluation\<close> in Isabelle/ML organizes expressions and results to
   control certain physical side-conditions, to say more specifically when and
   how evaluation happens. For example, the Isabelle/ML library supports lazy
   evaluation with memoing, parallel evaluation via futures, asynchronous
   evaluation via promises, evaluation with time limit etc.
 
   \<^medskip>
   An \<^emph>\<open>unevaluated expression\<close> is represented either as unit abstraction
   \<^verbatim>\<open>fn () => a\<close> of type \<^verbatim>\<open>unit -> 'a\<close> or as regular function \<^verbatim>\<open>fn a => b\<close> of
   type \<^verbatim>\<open>'a -> 'b\<close>. Both forms occur routinely, and special care is required
   to tell them apart --- the static type-system of SML is only of limited help
   here.
 
   The first form is more intuitive: some combinator \<^verbatim>\<open>(unit -> 'a) -> 'a\<close>
   applies the given function to \<^verbatim>\<open>()\<close> to initiate the postponed evaluation
   process. The second form is more flexible: some combinator
   \<^verbatim>\<open>('a -> 'b) -> 'a -> 'b\<close> acts like a modified form of function application;
   several such combinators may be cascaded to modify a given function, before
   it is ultimately applied to some argument.
 
   \<^medskip>
   \<^emph>\<open>Reified results\<close> make the disjoint sum of regular values versions
   exceptional situations explicit as ML datatype: \<open>'a result = Res of 'a | Exn
   of exn\<close>. This is typically used for administrative purposes, to store the
   overall outcome of an evaluation process.
 
   \<^emph>\<open>Parallel exceptions\<close> aggregate reified results, such that multiple
   exceptions are digested as a collection in canonical form that identifies
   exceptions according to their original occurrence. This is particular
   important for parallel evaluation via futures \secref{sec:futures}, which
   are organized as acyclic graph of evaluations that depend on other
   evaluations: exceptions stemming from shared sub-graphs are exposed exactly
   once and in the order of their original occurrence (e.g.\ when printed at
   the toplevel). Interrupt counts as neutral element here: it is treated as
   minimal information about some canceled evaluation process, and is absorbed
   by the presence of regular program exceptions.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type "'a Exn.result"} \\
-  @{index_ML Exn.capture: "('a -> 'b) -> 'a -> 'b Exn.result"} \\
-  @{index_ML Exn.interruptible_capture: "('a -> 'b) -> 'a -> 'b Exn.result"} \\
-  @{index_ML Exn.release: "'a Exn.result -> 'a"} \\
-  @{index_ML Par_Exn.release_all: "'a Exn.result list -> 'a list"} \\
-  @{index_ML Par_Exn.release_first: "'a Exn.result list -> 'a list"} \\
+  @{define_ML_type 'a "Exn.result"} \\
+  @{define_ML Exn.capture: "('a -> 'b) -> 'a -> 'b Exn.result"} \\
+  @{define_ML Exn.interruptible_capture: "('a -> 'b) -> 'a -> 'b Exn.result"} \\
+  @{define_ML Exn.release: "'a Exn.result -> 'a"} \\
+  @{define_ML Par_Exn.release_all: "'a Exn.result list -> 'a list"} \\
+  @{define_ML Par_Exn.release_first: "'a Exn.result list -> 'a list"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>'a Exn.result\<close> represents the disjoint sum of ML results
   explicitly, with constructor \<^ML>\<open>Exn.Res\<close> for regular values and \<^ML>\<open>Exn.Exn\<close> for exceptions.
 
   \<^descr> \<^ML>\<open>Exn.capture\<close>~\<open>f x\<close> manages the evaluation of \<open>f x\<close> such that
   exceptions are made explicit as \<^ML>\<open>Exn.Exn\<close>. Note that this includes
   physical interrupts (see also \secref{sec:exceptions}), so the same
   precautions apply to user code: interrupts must not be absorbed
   accidentally!
 
   \<^descr> \<^ML>\<open>Exn.interruptible_capture\<close> is similar to \<^ML>\<open>Exn.capture\<close>, but
   interrupts are immediately re-raised as required for user code.
 
   \<^descr> \<^ML>\<open>Exn.release\<close>~\<open>result\<close> releases the original runtime result, exposing
   its regular value or raising the reified exception.
 
   \<^descr> \<^ML>\<open>Par_Exn.release_all\<close>~\<open>results\<close> combines results that were produced
   independently (e.g.\ by parallel evaluation). If all results are regular
   values, that list is returned. Otherwise, the collection of all exceptions
   is raised, wrapped-up as collective parallel exception. Note that the latter
   prevents access to individual exceptions by conventional \<^verbatim>\<open>handle\<close> of ML.
 
   \<^descr> \<^ML>\<open>Par_Exn.release_first\<close> is similar to \<^ML>\<open>Par_Exn.release_all\<close>, but
   only the first (meaningful) exception that has occurred in the original
   evaluation process is raised again, the others are ignored. That single
   exception may get handled by conventional means in ML.
 \<close>
 
 
 subsection \<open>Parallel skeletons \label{sec:parlist}\<close>
 
 text \<open>
   Algorithmic skeletons are combinators that operate on lists in parallel, in
   the manner of well-known \<open>map\<close>, \<open>exists\<close>, \<open>forall\<close> etc. Management of
   futures (\secref{sec:futures}) and their results as reified exceptions is
   wrapped up into simple programming interfaces that resemble the sequential
   versions.
 
   What remains is the application-specific problem to present expressions with
   suitable \<^emph>\<open>granularity\<close>: each list element corresponds to one evaluation
   task. If the granularity is too coarse, the available CPUs are not
   saturated. If it is too fine-grained, CPU cycles are wasted due to the
   overhead of organizing parallel processing. In the worst case, parallel
   performance will be less than the sequential counterpart!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Par_List.map: "('a -> 'b) -> 'a list -> 'b list"} \\
-  @{index_ML Par_List.get_some: "('a -> 'b option) -> 'a list -> 'b option"} \\
+  @{define_ML Par_List.map: "('a -> 'b) -> 'a list -> 'b list"} \\
+  @{define_ML Par_List.get_some: "('a -> 'b option) -> 'a list -> 'b option"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Par_List.map\<close>~\<open>f [x\<^sub>1, \<dots>, x\<^sub>n]\<close> is like \<^ML>\<open>map\<close>~\<open>f [x\<^sub>1, \<dots>,
   x\<^sub>n]\<close>, but the evaluation of \<open>f x\<^sub>i\<close> for \<open>i = 1, \<dots>, n\<close> is performed in
   parallel.
 
   An exception in any \<open>f x\<^sub>i\<close> cancels the overall evaluation process. The
   final result is produced via \<^ML>\<open>Par_Exn.release_first\<close> as explained above,
   which means the first program exception that happened to occur in the
   parallel evaluation is propagated, and all other failures are ignored.
 
   \<^descr> \<^ML>\<open>Par_List.get_some\<close>~\<open>f [x\<^sub>1, \<dots>, x\<^sub>n]\<close> produces some \<open>f x\<^sub>i\<close> that is of
   the form \<open>SOME y\<^sub>i\<close>, if that exists, otherwise \<open>NONE\<close>. Thus it is similar to
   \<^ML>\<open>Library.get_first\<close>, but subject to a non-deterministic parallel choice
   process. The first successful result cancels the overall evaluation process;
   other exceptions are propagated as for \<^ML>\<open>Par_List.map\<close>.
 
   This generic parallel choice combinator is the basis for derived forms, such
   as \<^ML>\<open>Par_List.find_some\<close>, \<^ML>\<open>Par_List.exists\<close>, \<^ML>\<open>Par_List.forall\<close>.
 \<close>
 
 text %mlex \<open>
   Subsequently, the Ackermann function is evaluated in parallel for some
   ranges of arguments.
 \<close>
 
 ML_val \<open>
   fun ackermann 0 n = n + 1
     | ackermann m 0 = ackermann (m - 1) 1
     | ackermann m n = ackermann (m - 1) (ackermann m (n - 1));
 
   Par_List.map (ackermann 2) (500 upto 1000);
   Par_List.map (ackermann 3) (5 upto 10);
 \<close>
 
 
 subsection \<open>Lazy evaluation\<close>
 
 text \<open>
   Classic lazy evaluation works via the \<open>lazy\<close>~/ \<open>force\<close> pair of operations:
   \<open>lazy\<close> to wrap an unevaluated expression, and \<open>force\<close> to evaluate it once
   and store its result persistently. Later invocations of \<open>force\<close> retrieve the
   stored result without another evaluation. Isabelle/ML refines this idea to
   accommodate the aspects of multi-threading, synchronous program exceptions
   and asynchronous interrupts.
 
   The first thread that invokes \<open>force\<close> on an unfinished lazy value changes
   its state into a \<^emph>\<open>promise\<close> of the eventual result and starts evaluating it.
   Any other threads that \<open>force\<close> the same lazy value in the meantime need to
   wait for it to finish, by producing a regular result or program exception.
   If the evaluation attempt is interrupted, this event is propagated to all
   waiting threads and the lazy value is reset to its original state.
 
   This means a lazy value is completely evaluated at most once, in a
   thread-safe manner. There might be multiple interrupted evaluation attempts,
   and multiple receivers of intermediate interrupt events. Interrupts are
   \<^emph>\<open>not\<close> made persistent: later evaluation attempts start again from the
   original expression.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type "'a lazy"} \\
-  @{index_ML Lazy.lazy: "(unit -> 'a) -> 'a lazy"} \\
-  @{index_ML Lazy.value: "'a -> 'a lazy"} \\
-  @{index_ML Lazy.force: "'a lazy -> 'a"} \\
+  @{define_ML_type 'a "lazy"} \\
+  @{define_ML Lazy.lazy: "(unit -> 'a) -> 'a lazy"} \\
+  @{define_ML Lazy.value: "'a -> 'a lazy"} \\
+  @{define_ML Lazy.force: "'a lazy -> 'a"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>'a lazy\<close> represents lazy values over type \<^verbatim>\<open>'a\<close>.
 
   \<^descr> \<^ML>\<open>Lazy.lazy\<close>~\<open>(fn () => e)\<close> wraps the unevaluated expression \<open>e\<close> as
   unfinished lazy value.
 
   \<^descr> \<^ML>\<open>Lazy.value\<close>~\<open>a\<close> wraps the value \<open>a\<close> as finished lazy value. When
   forced, it returns \<open>a\<close> without any further evaluation.
 
   There is very low overhead for this proforma wrapping of strict values as
   lazy values.
 
   \<^descr> \<^ML>\<open>Lazy.force\<close>~\<open>x\<close> produces the result of the lazy value in a
   thread-safe manner as explained above. Thus it may cause the current thread
   to wait on a pending evaluation attempt by another thread.
 \<close>
 
 
 subsection \<open>Futures \label{sec:futures}\<close>
 
 text \<open>
   Futures help to organize parallel execution in a value-oriented manner, with
   \<open>fork\<close>~/ \<open>join\<close> as the main pair of operations, and some further variants;
   see also @{cite "Wenzel:2009" and "Wenzel:2013:ITP"}. Unlike lazy values,
   futures are evaluated strictly and spontaneously on separate worker threads.
   Futures may be canceled, which leads to interrupts on running evaluation
   attempts, and forces structurally related futures to fail for all time;
   already finished futures remain unchanged. Exceptions between related
   futures are propagated as well, and turned into parallel exceptions (see
   above).
 
   Technically, a future is a single-assignment variable together with a
   \<^emph>\<open>task\<close> that serves administrative purposes, notably within the \<^emph>\<open>task
   queue\<close> where new futures are registered for eventual evaluation and the
   worker threads retrieve their work.
 
   The pool of worker threads is limited, in correlation with the number of
   physical cores on the machine. Note that allocation of runtime resources may
   be distorted either if workers yield CPU time (e.g.\ via system sleep or
   wait operations), or if non-worker threads contend for significant runtime
   resources independently. There is a limited number of replacement worker
   threads that get activated in certain explicit wait conditions, after a
   timeout.
 
   \<^medskip>
   Each future task belongs to some \<^emph>\<open>task group\<close>, which represents the
   hierarchic structure of related tasks, together with the exception status a
   that point. By default, the task group of a newly created future is a new
   sub-group of the presently running one, but it is also possible to indicate
   different group layouts under program control.
 
   Cancellation of futures actually refers to the corresponding task group and
   all its sub-groups. Thus interrupts are propagated down the group hierarchy.
   Regular program exceptions are treated likewise: failure of the evaluation
   of some future task affects its own group and all sub-groups. Given a
   particular task group, its \<^emph>\<open>group status\<close> cumulates all relevant exceptions
   according to its position within the group hierarchy. Interrupted tasks that
   lack regular result information, will pick up parallel exceptions from the
   cumulative group status.
 
   \<^medskip>
   A \<^emph>\<open>passive future\<close> or \<^emph>\<open>promise\<close> is a future with slightly different
   evaluation policies: there is only a single-assignment variable and some
   expression to evaluate for the \<^emph>\<open>failed\<close> case (e.g.\ to clean up resources
   when canceled). A regular result is produced by external means, using a
   separate \<^emph>\<open>fulfill\<close> operation.
 
   Promises are managed in the same task queue, so regular futures may depend
   on them. This allows a form of reactive programming, where some promises are
   used as minimal elements (or guards) within the future dependency graph:
   when these promises are fulfilled the evaluation of subsequent futures
   starts spontaneously, according to their own inter-dependencies.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type "'a future"} \\
-  @{index_ML Future.fork: "(unit -> 'a) -> 'a future"} \\
-  @{index_ML Future.forks: "Future.params -> (unit -> 'a) list -> 'a future list"} \\
-  @{index_ML Future.join: "'a future -> 'a"} \\
-  @{index_ML Future.joins: "'a future list -> 'a list"} \\
-  @{index_ML Future.value: "'a -> 'a future"} \\
-  @{index_ML Future.map: "('a -> 'b) -> 'a future -> 'b future"} \\
-  @{index_ML Future.cancel: "'a future -> unit"} \\
-  @{index_ML Future.cancel_group: "Future.group -> unit"} \\[0.5ex]
-  @{index_ML Future.promise: "(unit -> unit) -> 'a future"} \\
-  @{index_ML Future.fulfill: "'a future -> 'a -> unit"} \\
+  @{define_ML_type 'a "future"} \\
+  @{define_ML Future.fork: "(unit -> 'a) -> 'a future"} \\
+  @{define_ML Future.forks: "Future.params -> (unit -> 'a) list -> 'a future list"} \\
+  @{define_ML Future.join: "'a future -> 'a"} \\
+  @{define_ML Future.joins: "'a future list -> 'a list"} \\
+  @{define_ML Future.value: "'a -> 'a future"} \\
+  @{define_ML Future.map: "('a -> 'b) -> 'a future -> 'b future"} \\
+  @{define_ML Future.cancel: "'a future -> unit"} \\
+  @{define_ML Future.cancel_group: "Future.group -> unit"} \\[0.5ex]
+  @{define_ML Future.promise: "(unit -> unit) -> 'a future"} \\
+  @{define_ML Future.fulfill: "'a future -> 'a -> unit"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>'a future\<close> represents future values over type \<^verbatim>\<open>'a\<close>.
 
   \<^descr> \<^ML>\<open>Future.fork\<close>~\<open>(fn () => e)\<close> registers the unevaluated expression \<open>e\<close>
   as unfinished future value, to be evaluated eventually on the parallel
   worker-thread farm. This is a shorthand for \<^ML>\<open>Future.forks\<close> below, with
   default parameters and a single expression.
 
   \<^descr> \<^ML>\<open>Future.forks\<close>~\<open>params exprs\<close> is the general interface to fork several
   futures simultaneously. The \<open>params\<close> consist of the following fields:
 
     \<^item> \<open>name : string\<close> (default \<^ML>\<open>""\<close>) specifies a common name for the
     tasks of the forked futures, which serves diagnostic purposes.
 
     \<^item> \<open>group : Future.group option\<close> (default \<^ML>\<open>NONE\<close>) specifies an optional
     task group for the forked futures. \<^ML>\<open>NONE\<close> means that a new sub-group
     of the current worker-thread task context is created. If this is not a
     worker thread, the group will be a new root in the group hierarchy.
 
     \<^item> \<open>deps : Future.task list\<close> (default \<^ML>\<open>[]\<close>) specifies dependencies on
     other future tasks, i.e.\ the adjacency relation in the global task queue.
     Dependencies on already finished tasks are ignored.
 
     \<^item> \<open>pri : int\<close> (default \<^ML>\<open>0\<close>) specifies a priority within the task
     queue.
 
     Typically there is only little deviation from the default priority \<^ML>\<open>0\<close>. As a rule of thumb, \<^ML>\<open>~1\<close> means ``low priority" and \<^ML>\<open>1\<close> means
     ``high priority''.
 
     Note that the task priority only affects the position in the queue, not
     the thread priority. When a worker thread picks up a task for processing,
     it runs with the normal thread priority to the end (or until canceled).
     Higher priority tasks that are queued later need to wait until this (or
     another) worker thread becomes free again.
 
     \<^item> \<open>interrupts : bool\<close> (default \<^ML>\<open>true\<close>) tells whether the worker thread
     that processes the corresponding task is initially put into interruptible
     state. This state may change again while running, by modifying the thread
     attributes.
 
     With interrupts disabled, a running future task cannot be canceled. It is
     the responsibility of the programmer that this special state is retained
     only briefly.
 
   \<^descr> \<^ML>\<open>Future.join\<close>~\<open>x\<close> retrieves the value of an already finished future,
   which may lead to an exception, according to the result of its previous
   evaluation.
 
   For an unfinished future there are several cases depending on the role of
   the current thread and the status of the future. A non-worker thread waits
   passively until the future is eventually evaluated. A worker thread
   temporarily changes its task context and takes over the responsibility to
   evaluate the future expression on the spot. The latter is done in a
   thread-safe manner: other threads that intend to join the same future need
   to wait until the ongoing evaluation is finished.
 
   Note that excessive use of dynamic dependencies of futures by adhoc joining
   may lead to bad utilization of CPU cores, due to threads waiting on other
   threads to finish required futures. The future task farm has a limited
   amount of replacement threads that continue working on unrelated tasks after
   some timeout.
 
   Whenever possible, static dependencies of futures should be specified
   explicitly when forked (see \<open>deps\<close> above). Thus the evaluation can work from
   the bottom up, without join conflicts and wait states.
 
   \<^descr> \<^ML>\<open>Future.joins\<close>~\<open>xs\<close> joins the given list of futures simultaneously,
   which is more efficient than \<^ML>\<open>map Future.join\<close>~\<open>xs\<close>.
 
   Based on the dependency graph of tasks, the current thread takes over the
   responsibility to evaluate future expressions that are required for the main
   result, working from the bottom up. Waiting on future results that are
   presently evaluated on other threads only happens as last resort, when no
   other unfinished futures are left over.
 
   \<^descr> \<^ML>\<open>Future.value\<close>~\<open>a\<close> wraps the value \<open>a\<close> as finished future value,
   bypassing the worker-thread farm. When joined, it returns \<open>a\<close> without any
   further evaluation.
 
   There is very low overhead for this proforma wrapping of strict values as
   futures.
 
   \<^descr> \<^ML>\<open>Future.map\<close>~\<open>f x\<close> is a fast-path implementation of \<^ML>\<open>Future.fork\<close>~\<open>(fn () => f (\<close>\<^ML>\<open>Future.join\<close>~\<open>x))\<close>, which avoids the full
   overhead of the task queue and worker-thread farm as far as possible. The
   function \<open>f\<close> is supposed to be some trivial post-processing or projection of
   the future result.
 
   \<^descr> \<^ML>\<open>Future.cancel\<close>~\<open>x\<close> cancels the task group of the given future, using
   \<^ML>\<open>Future.cancel_group\<close> below.
 
   \<^descr> \<^ML>\<open>Future.cancel_group\<close>~\<open>group\<close> cancels all tasks of the given task
   group for all time. Threads that are presently processing a task of the
   given group are interrupted: it may take some time until they are actually
   terminated. Tasks that are queued but not yet processed are dequeued and
   forced into interrupted state. Since the task group is itself invalidated,
   any further attempt to fork a future that belongs to it will yield a
   canceled result as well.
 
   \<^descr> \<^ML>\<open>Future.promise\<close>~\<open>abort\<close> registers a passive future with the given
   \<open>abort\<close> operation: it is invoked when the future task group is canceled.
 
   \<^descr> \<^ML>\<open>Future.fulfill\<close>~\<open>x a\<close> finishes the passive future \<open>x\<close> by the given
   value \<open>a\<close>. If the promise has already been canceled, the attempt to fulfill
   it causes an exception.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Prelim.thy b/src/Doc/Implementation/Prelim.thy
--- a/src/Doc/Implementation/Prelim.thy
+++ b/src/Doc/Implementation/Prelim.thy
@@ -1,974 +1,974 @@
 (*:maxLineLen=78:*)
 
 theory Prelim
 imports Base
 begin
 
 chapter \<open>Preliminaries\<close>
 
 section \<open>Contexts \label{sec:context}\<close>
 
 text \<open>
   A logical context represents the background that is required for formulating
   statements and composing proofs. It acts as a medium to produce formal
   content, depending on earlier material (declarations, results etc.).
 
   For example, derivations within the Isabelle/Pure logic can be described as
   a judgment \<open>\<Gamma> \<turnstile>\<^sub>\<Theta> \<phi>\<close>, which means that a proposition \<open>\<phi>\<close> is derivable from
   hypotheses \<open>\<Gamma>\<close> within the theory \<open>\<Theta>\<close>. There are logical reasons for keeping
   \<open>\<Theta>\<close> and \<open>\<Gamma>\<close> separate: theories can be liberal about supporting type
   constructors and schematic polymorphism of constants and axioms, while the
   inner calculus of \<open>\<Gamma> \<turnstile> \<phi>\<close> is strictly limited to Simple Type Theory (with
   fixed type variables in the assumptions).
 
   \<^medskip>
   Contexts and derivations are linked by the following key principles:
 
   \<^item> Transfer: monotonicity of derivations admits results to be transferred
   into a \<^emph>\<open>larger\<close> context, i.e.\ \<open>\<Gamma> \<turnstile>\<^sub>\<Theta> \<phi>\<close> implies \<open>\<Gamma>' \<turnstile>\<^sub>\<Theta>\<^sub>' \<phi>\<close> for contexts
   \<open>\<Theta>' \<supseteq> \<Theta>\<close> and \<open>\<Gamma>' \<supseteq> \<Gamma>\<close>.
 
   \<^item> Export: discharge of hypotheses admits results to be exported into a
   \<^emph>\<open>smaller\<close> context, i.e.\ \<open>\<Gamma>' \<turnstile>\<^sub>\<Theta> \<phi>\<close> implies \<open>\<Gamma> \<turnstile>\<^sub>\<Theta> \<Delta> \<Longrightarrow> \<phi>\<close> where \<open>\<Gamma>' \<supseteq> \<Gamma>\<close>
   and \<open>\<Delta> = \<Gamma>' - \<Gamma>\<close>. Note that \<open>\<Theta>\<close> remains unchanged here, only the \<open>\<Gamma>\<close> part is
   affected.
 
 
   \<^medskip>
   By modeling the main characteristics of the primitive \<open>\<Theta>\<close> and \<open>\<Gamma>\<close> above, and
   abstracting over any particular logical content, we arrive at the
   fundamental notions of \<^emph>\<open>theory context\<close> and \<^emph>\<open>proof context\<close> in
   Isabelle/Isar. These implement a certain policy to manage arbitrary
   \<^emph>\<open>context data\<close>. There is a strongly-typed mechanism to declare new kinds of
   data at compile time.
 
   The internal bootstrap process of Isabelle/Pure eventually reaches a stage
   where certain data slots provide the logical content of \<open>\<Theta>\<close> and \<open>\<Gamma>\<close> sketched
   above, but this does not stop there! Various additional data slots support
   all kinds of mechanisms that are not necessarily part of the core logic.
 
   For example, there would be data for canonical introduction and elimination
   rules for arbitrary operators (depending on the object-logic and
   application), which enables users to perform standard proof steps implicitly
   (cf.\ the \<open>rule\<close> method @{cite "isabelle-isar-ref"}).
 
   \<^medskip>
   Thus Isabelle/Isar is able to bring forth more and more concepts
   successively. In particular, an object-logic like Isabelle/HOL continues the
   Isabelle/Pure setup by adding specific components for automated reasoning
   (classical reasoner, tableau prover, structured induction etc.) and derived
   specification mechanisms (inductive predicates, recursive functions etc.).
   All of this is ultimately based on the generic data management by theory and
   proof contexts introduced here.
 \<close>
 
 
 subsection \<open>Theory context \label{sec:context-theory}\<close>
 
 text \<open>
   A \<^emph>\<open>theory\<close> is a data container with explicit name and unique identifier.
   Theories are related by a (nominal) sub-theory relation, which corresponds
   to the dependency graph of the original construction; each theory is derived
   from a certain sub-graph of ancestor theories. To this end, the system
   maintains a set of symbolic ``identification stamps'' within each theory.
 
   The \<open>begin\<close> operation starts a new theory by importing several parent
   theories (with merged contents) and entering a special mode of nameless
   incremental updates, until the final \<open>end\<close> operation is performed.
 
   \<^medskip>
   The example in \figref{fig:ex-theory} below shows a theory graph derived
   from \<open>Pure\<close>, with theory \<open>Length\<close> importing \<open>Nat\<close> and \<open>List\<close>. The body of
   \<open>Length\<close> consists of a sequence of updates, resulting in locally a linear
   sub-theory relation for each intermediate step.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{rcccl}
         &            & \<open>Pure\<close> \\
         &            & \<open>\<down>\<close> \\
         &            & \<open>FOL\<close> \\
         & $\swarrow$ &              & $\searrow$ & \\
   \<open>Nat\<close> &    &              &            & \<open>List\<close> \\
         & $\searrow$ &              & $\swarrow$ \\
         &            & \<open>Length\<close> \\
         &            & \multicolumn{3}{l}{~~@{keyword "begin"}} \\
         &            & $\vdots$~~ \\
         &            & \multicolumn{3}{l}{~~@{command "end"}} \\
   \end{tabular}
   \caption{A theory definition depending on ancestors}\label{fig:ex-theory}
   \end{center}
   \end{figure}
 
   \<^medskip>
   Derived formal entities may retain a reference to the background theory in
   order to indicate the formal context from which they were produced. This
   provides an immutable certificate of the background theory.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type theory} \\
-  @{index_ML Context.eq_thy: "theory * theory -> bool"} \\
-  @{index_ML Context.subthy: "theory * theory -> bool"} \\
-  @{index_ML Theory.begin_theory: "string * Position.T -> theory list -> theory"} \\
-  @{index_ML Theory.parents_of: "theory -> theory list"} \\
-  @{index_ML Theory.ancestors_of: "theory -> theory list"} \\
+  @{define_ML_type theory} \\
+  @{define_ML Context.eq_thy: "theory * theory -> bool"} \\
+  @{define_ML Context.subthy: "theory * theory -> bool"} \\
+  @{define_ML Theory.begin_theory: "string * Position.T -> theory list -> theory"} \\
+  @{define_ML Theory.parents_of: "theory -> theory list"} \\
+  @{define_ML Theory.ancestors_of: "theory -> theory list"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>theory\<close> represents theory contexts.
 
   \<^descr> \<^ML>\<open>Context.eq_thy\<close>~\<open>(thy\<^sub>1, thy\<^sub>2)\<close> check strict identity of two
   theories.
 
   \<^descr> \<^ML>\<open>Context.subthy\<close>~\<open>(thy\<^sub>1, thy\<^sub>2)\<close> compares theories according to the
   intrinsic graph structure of the construction. This sub-theory relation is a
   nominal approximation of inclusion (\<open>\<subseteq>\<close>) of the corresponding content
   (according to the semantics of the ML modules that implement the data).
 
   \<^descr> \<^ML>\<open>Theory.begin_theory\<close>~\<open>name parents\<close> constructs a new theory based
   on the given parents. This ML function is normally not invoked directly.
 
   \<^descr> \<^ML>\<open>Theory.parents_of\<close>~\<open>thy\<close> returns the direct ancestors of \<open>thy\<close>.
 
   \<^descr> \<^ML>\<open>Theory.ancestors_of\<close>~\<open>thy\<close> returns all ancestors of \<open>thy\<close> (not
   including \<open>thy\<close> itself).
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "theory"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "theory_context"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation theory} embedded?
   ;
   @@{ML_antiquotation theory_context} embedded
   \<close>
 
   \<^descr> \<open>@{theory}\<close> refers to the background theory of the current context --- as
   abstract value.
 
   \<^descr> \<open>@{theory A}\<close> refers to an explicitly named ancestor theory \<open>A\<close> of the
   background theory of the current context --- as abstract value.
 
   \<^descr> \<open>@{theory_context A}\<close> is similar to \<open>@{theory A}\<close>, but presents the result
   as initial \<^ML_type>\<open>Proof.context\<close> (see also \<^ML>\<open>Proof_Context.init_global\<close>).
 \<close>
 
 
 subsection \<open>Proof context \label{sec:context-proof}\<close>
 
 text \<open>
   A proof context is a container for pure data that refers to the theory from
   which it is derived. The \<open>init\<close> operation creates a proof context from a
   given theory. There is an explicit \<open>transfer\<close> operation to force
   resynchronization with updates to the background theory -- this is rarely
   required in practice.
 
   Entities derived in a proof context need to record logical requirements
   explicitly, since there is no separate context identification or symbolic
   inclusion as for theories. For example, hypotheses used in primitive
   derivations (cf.\ \secref{sec:thms}) are recorded separately within the
   sequent \<open>\<Gamma> \<turnstile> \<phi>\<close>, just to make double sure. Results could still leak into an
   alien proof context due to programming errors, but Isabelle/Isar includes
   some extra validity checks in critical positions, notably at the end of a
   sub-proof.
 
   Proof contexts may be manipulated arbitrarily, although the common
   discipline is to follow block structure as a mental model: a given context
   is extended consecutively, and results are exported back into the original
   context. Note that an Isar proof state models block-structured reasoning
   explicitly, using a stack of proof contexts internally. For various
   technical reasons, the background theory of an Isar proof state must not be
   changed while the proof is still under construction!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Proof.context} \\
-  @{index_ML Proof_Context.init_global: "theory -> Proof.context"} \\
-  @{index_ML Proof_Context.theory_of: "Proof.context -> theory"} \\
-  @{index_ML Proof_Context.transfer: "theory -> Proof.context -> Proof.context"} \\
+  @{define_ML_type Proof.context} \\
+  @{define_ML Proof_Context.init_global: "theory -> Proof.context"} \\
+  @{define_ML Proof_Context.theory_of: "Proof.context -> theory"} \\
+  @{define_ML Proof_Context.transfer: "theory -> Proof.context -> Proof.context"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Proof.context\<close> represents proof contexts.
 
   \<^descr> \<^ML>\<open>Proof_Context.init_global\<close>~\<open>thy\<close> produces a proof context derived
   from \<open>thy\<close>, initializing all data.
 
   \<^descr> \<^ML>\<open>Proof_Context.theory_of\<close>~\<open>ctxt\<close> selects the background theory from
   \<open>ctxt\<close>.
 
   \<^descr> \<^ML>\<open>Proof_Context.transfer\<close>~\<open>thy ctxt\<close> promotes the background theory of
   \<open>ctxt\<close> to the super theory \<open>thy\<close>.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "context"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{context}\<close> refers to \<^emph>\<open>the\<close> context at compile-time --- as abstract
   value. Independently of (local) theory or proof mode, this always produces a
   meaningful result.
 
   This is probably the most common antiquotation in interactive
   experimentation with ML inside Isar.
 \<close>
 
 
 subsection \<open>Generic contexts \label{sec:generic-context}\<close>
 
 text \<open>
   A generic context is the disjoint sum of either a theory or proof context.
   Occasionally, this enables uniform treatment of generic context data,
   typically extra-logical information. Operations on generic contexts include
   the usual injections, partial selections, and combinators for lifting
   operations on either component of the disjoint sum.
 
   Moreover, there are total operations \<open>theory_of\<close> and \<open>proof_of\<close> to convert a
   generic context into either kind: a theory can always be selected from the
   sum, while a proof context might have to be constructed by an ad-hoc \<open>init\<close>
   operation, which incurs a small runtime overhead.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Context.generic} \\
-  @{index_ML Context.theory_of: "Context.generic -> theory"} \\
-  @{index_ML Context.proof_of: "Context.generic -> Proof.context"} \\
+  @{define_ML_type Context.generic} \\
+  @{define_ML Context.theory_of: "Context.generic -> theory"} \\
+  @{define_ML Context.proof_of: "Context.generic -> Proof.context"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Context.generic\<close> is the direct sum of \<^ML_type>\<open>theory\<close>
   and \<^ML_type>\<open>Proof.context\<close>, with the datatype constructors \<^ML>\<open>Context.Theory\<close> and \<^ML>\<open>Context.Proof\<close>.
 
   \<^descr> \<^ML>\<open>Context.theory_of\<close>~\<open>context\<close> always produces a theory from the
   generic \<open>context\<close>, using \<^ML>\<open>Proof_Context.theory_of\<close> as required.
 
   \<^descr> \<^ML>\<open>Context.proof_of\<close>~\<open>context\<close> always produces a proof context from the
   generic \<open>context\<close>, using \<^ML>\<open>Proof_Context.init_global\<close> as required (note
   that this re-initializes the context data with each invocation).
 \<close>
 
 
 subsection \<open>Context data \label{sec:context-data}\<close>
 
 text \<open>
   The main purpose of theory and proof contexts is to manage arbitrary (pure)
   data. New data types can be declared incrementally at compile time. There
   are separate declaration mechanisms for any of the three kinds of contexts:
   theory, proof, generic.
 \<close>
 
 paragraph \<open>Theory data\<close>
 text \<open>declarations need to implement the following ML signature:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<type> T\<close> & representing type \\
   \<open>\<val> empty: T\<close> & empty default value \\
   \<open>\<val> extend: T \<rightarrow> T\<close> & obsolete (identity function) \\
   \<open>\<val> merge: T \<times> T \<rightarrow> T\<close> & merge data \\
   \end{tabular}
   \<^medskip>
 
   The \<open>empty\<close> value acts as initial default for \<^emph>\<open>any\<close> theory that does not
   declare actual data content; \<open>extend\<close> is obsolete: it needs to be the
   identity function.
 
   The \<open>merge\<close> operation needs to join the data from two theories in a
   conservative manner. The standard scheme for \<open>merge (data\<^sub>1, data\<^sub>2)\<close>
   inserts those parts of \<open>data\<^sub>2\<close> into \<open>data\<^sub>1\<close> that are not yet present,
   while keeping the general order of things. The \<^ML>\<open>Library.merge\<close>
   function on plain lists may serve as canonical template. Particularly note
   that shared parts of the data must not be duplicated by naive concatenation,
   or a theory graph that resembles a chain of diamonds would cause an
   exponential blowup!
 
   Sometimes, the data consists of a single item that cannot be ``merged'' in a
   sensible manner. Then the standard scheme degenerates to the projection to
   \<open>data\<^sub>1\<close>, ignoring \<open>data\<^sub>2\<close> outright.
 \<close>
 
 paragraph \<open>Proof context data\<close>
 text \<open>declarations need to implement the following ML signature:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<type> T\<close> & representing type \\
   \<open>\<val> init: theory \<rightarrow> T\<close> & produce initial value \\
   \end{tabular}
   \<^medskip>
 
   The \<open>init\<close> operation is supposed to produce a pure value from the given
   background theory and should be somehow ``immediate''. Whenever a proof
   context is initialized, which happens frequently, the the system invokes the
   \<open>init\<close> operation of \<^emph>\<open>all\<close> theory data slots ever declared. This also means
   that one needs to be economic about the total number of proof data
   declarations in the system, i.e.\ each ML module should declare at most one,
   sometimes two data slots for its internal use. Repeated data declarations to
   simulate a record type should be avoided!
 \<close>
 
 paragraph \<open>Generic data\<close>
 text \<open>
   provides a hybrid interface for both theory and proof data. The \<open>init\<close>
   operation for proof contexts is predefined to select the current data value
   from the background theory.
 
   \<^bigskip>
   Any of the above data declarations over type \<open>T\<close> result in an ML structure
   with the following signature:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>get: context \<rightarrow> T\<close> \\
   \<open>put: T \<rightarrow> context \<rightarrow> context\<close> \\
   \<open>map: (T \<rightarrow> T) \<rightarrow> context \<rightarrow> context\<close> \\
   \end{tabular}
   \<^medskip>
 
   These other operations provide exclusive access for the particular kind of
   context (theory, proof, or generic context). This interface observes the ML
   discipline for types and scopes: there is no other way to access the
   corresponding data slot of a context. By keeping these operations private,
   an Isabelle/ML module may maintain abstract values authentically.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_functor Theory_Data} \\
-  @{index_ML_functor Proof_Data} \\
-  @{index_ML_functor Generic_Data} \\
+  @{define_ML_functor Theory_Data} \\
+  @{define_ML_functor Proof_Data} \\
+  @{define_ML_functor Generic_Data} \\
   \end{mldecls}
 
   \<^descr> \<^ML_functor>\<open>Theory_Data\<close>\<open>(spec)\<close> declares data for type \<^ML_type>\<open>theory\<close>
   according to the specification provided as argument structure. The resulting
   structure provides data init and access operations as described above.
 
   \<^descr> \<^ML_functor>\<open>Proof_Data\<close>\<open>(spec)\<close> is analogous to \<^ML_functor>\<open>Theory_Data\<close>
   for type \<^ML_type>\<open>Proof.context\<close>.
 
   \<^descr> \<^ML_functor>\<open>Generic_Data\<close>\<open>(spec)\<close> is analogous to \<^ML_functor>\<open>Theory_Data\<close> for type \<^ML_type>\<open>Context.generic\<close>. \<close>
 
 text %mlex \<open>
   The following artificial example demonstrates theory data: we maintain a set
   of terms that are supposed to be wellformed wrt.\ the enclosing theory. The
   public interface is as follows:
 \<close>
 
 ML \<open>
   signature WELLFORMED_TERMS =
   sig
     val get: theory -> term list
     val add: term -> theory -> theory
   end;
 \<close>
 
 text \<open>
   The implementation uses private theory data internally, and only exposes an
   operation that involves explicit argument checking wrt.\ the given theory.
 \<close>
 
 ML \<open>
   structure Wellformed_Terms: WELLFORMED_TERMS =
   struct
 
   structure Terms = Theory_Data
   (
     type T = term Ord_List.T;
     val empty = [];
     val extend = I;
     fun merge (ts1, ts2) =
       Ord_List.union Term_Ord.fast_term_ord ts1 ts2;
   );
 
   val get = Terms.get;
 
   fun add raw_t thy =
     let
       val t = Sign.cert_term thy raw_t;
     in
       Terms.map (Ord_List.insert Term_Ord.fast_term_ord t) thy
     end;
 
   end;
 \<close>
 
 text \<open>
   Type \<^ML_type>\<open>term Ord_List.T\<close> is used for reasonably efficient
   representation of a set of terms: all operations are linear in the number of
   stored elements. Here we assume that users of this module do not care about
   the declaration order, since that data structure forces its own arrangement
   of elements.
 
   Observe how the \<^ML_text>\<open>merge\<close> operation joins the data slots of the two
   constituents: \<^ML>\<open>Ord_List.union\<close> prevents duplication of common data from
   different branches, thus avoiding the danger of exponential blowup. Plain
   list append etc.\ must never be used for theory data merges!
 
   \<^medskip>
   Our intended invariant is achieved as follows:
 
     \<^enum> \<^ML>\<open>Wellformed_Terms.add\<close> only admits terms that have passed the \<^ML>\<open>Sign.cert_term\<close> check of the given theory at that point.
   
     \<^enum> Wellformedness in the sense of \<^ML>\<open>Sign.cert_term\<close> is monotonic wrt.\
     the sub-theory relation. So our data can move upwards in the hierarchy
     (via extension or merges), and maintain wellformedness without further
     checks.
 
   Note that all basic operations of the inference kernel (which includes \<^ML>\<open>Sign.cert_term\<close>) observe this monotonicity principle, but other user-space
   tools don't. For example, fully-featured type-inference via \<^ML>\<open>Syntax.check_term\<close> (cf.\ \secref{sec:term-check}) is not necessarily
   monotonic wrt.\ the background theory, since constraints of term constants
   can be modified by later declarations, for example.
 
   In most cases, user-space context data does not have to take such invariants
   too seriously. The situation is different in the implementation of the
   inference kernel itself, which uses the very same data mechanisms for types,
   constants, axioms etc.
 \<close>
 
 
 subsection \<open>Configuration options \label{sec:config-options}\<close>
 
 text \<open>
   A \<^emph>\<open>configuration option\<close> is a named optional value of some basic type
   (Boolean, integer, string) that is stored in the context. It is a simple
   application of general context data (\secref{sec:context-data}) that is
   sufficiently common to justify customized setup, which includes some
   concrete declarations for end-users using existing notation for attributes
   (cf.\ \secref{sec:attributes}).
 
   For example, the predefined configuration option @{attribute show_types}
   controls output of explicit type constraints for variables in printed terms
   (cf.\ \secref{sec:read-print}). Its value can be modified within Isar text
   like this:
 \<close>
 
 experiment
 begin
 
 declare [[show_types = false]]
   \<comment> \<open>declaration within (local) theory context\<close>
 
 notepad
 begin
   note [[show_types = true]]
     \<comment> \<open>declaration within proof (forward mode)\<close>
   term x
 
   have "x = x"
     using [[show_types = false]]
       \<comment> \<open>declaration within proof (backward mode)\<close>
     ..
 end
 
 end
 
 text \<open>
   Configuration options that are not set explicitly hold a default value that
   can depend on the application context. This allows to retrieve the value
   from another slot within the context, or fall back on a global preference
   mechanism, for example.
 
   The operations to declare configuration options and get/map their values are
   modeled as direct replacements for historic global references, only that the
   context is made explicit. This allows easy configuration of tools, without
   relying on the execution order as required for old-style mutable
   references.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Config.get: "Proof.context -> 'a Config.T -> 'a"} \\
-  @{index_ML Config.map: "'a Config.T -> ('a -> 'a) -> Proof.context -> Proof.context"} \\
-  @{index_ML Attrib.setup_config_bool: "binding -> (Context.generic -> bool) ->
+  @{define_ML Config.get: "Proof.context -> 'a Config.T -> 'a"} \\
+  @{define_ML Config.map: "'a Config.T -> ('a -> 'a) -> Proof.context -> Proof.context"} \\
+  @{define_ML Attrib.setup_config_bool: "binding -> (Context.generic -> bool) ->
   bool Config.T"} \\
-  @{index_ML Attrib.setup_config_int: "binding -> (Context.generic -> int) ->
+  @{define_ML Attrib.setup_config_int: "binding -> (Context.generic -> int) ->
   int Config.T"} \\
-  @{index_ML Attrib.setup_config_real: "binding -> (Context.generic -> real) ->
+  @{define_ML Attrib.setup_config_real: "binding -> (Context.generic -> real) ->
   real Config.T"} \\
-  @{index_ML Attrib.setup_config_string: "binding -> (Context.generic -> string) ->
+  @{define_ML Attrib.setup_config_string: "binding -> (Context.generic -> string) ->
   string Config.T"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Config.get\<close>~\<open>ctxt config\<close> gets the value of \<open>config\<close> in the given
   context.
 
   \<^descr> \<^ML>\<open>Config.map\<close>~\<open>config f ctxt\<close> updates the context by updating the value
   of \<open>config\<close>.
 
   \<^descr> \<open>config =\<close>~\<^ML>\<open>Attrib.setup_config_bool\<close>~\<open>name default\<close> creates a named
   configuration option of type \<^ML_type>\<open>bool\<close>, with the given \<open>default\<close>
   depending on the application context. The resulting \<open>config\<close> can be used to
   get/map its value in a given context. There is an implicit update of the
   background theory that registers the option as attribute with some concrete
   syntax.
 
   \<^descr> \<^ML>\<open>Attrib.config_int\<close>, \<^ML>\<open>Attrib.config_real\<close>, and \<^ML>\<open>Attrib.config_string\<close> work like \<^ML>\<open>Attrib.config_bool\<close>, but for types
   \<^ML_type>\<open>int\<close> and \<^ML_type>\<open>string\<close>, respectively.
 \<close>
 
 text %mlex \<open>
   The following example shows how to declare and use a Boolean configuration
   option called \<open>my_flag\<close> with constant default value \<^ML>\<open>false\<close>.
 \<close>
 
 ML \<open>
   val my_flag =
     Attrib.setup_config_bool \<^binding>\<open>my_flag\<close> (K false)
 \<close>
 
 text \<open>
   Now the user can refer to @{attribute my_flag} in declarations, while ML
   tools can retrieve the current value from the context via \<^ML>\<open>Config.get\<close>.
 \<close>
 
 ML_val \<open>\<^assert> (Config.get \<^context> my_flag = false)\<close>
 
 declare [[my_flag = true]]
 
 ML_val \<open>\<^assert> (Config.get \<^context> my_flag = true)\<close>
 
 notepad
 begin
   {
     note [[my_flag = false]]
     ML_val \<open>\<^assert> (Config.get \<^context> my_flag = false)\<close>
   }
   ML_val \<open>\<^assert> (Config.get \<^context> my_flag = true)\<close>
 end
 
 text \<open>
   Here is another example involving ML type \<^ML_type>\<open>real\<close> (floating-point
   numbers).
 \<close>
 
 ML \<open>
   val airspeed_velocity =
     Attrib.setup_config_real \<^binding>\<open>airspeed_velocity\<close> (K 0.0)
 \<close>
 
 declare [[airspeed_velocity = 10]]
 declare [[airspeed_velocity = 9.9]]
 
 
 section \<open>Names \label{sec:names}\<close>
 
 text \<open>
   In principle, a name is just a string, but there are various conventions for
   representing additional structure. For example, ``\<open>Foo.bar.baz\<close>'' is
   considered as a long name consisting of qualifier \<open>Foo.bar\<close> and base name
   \<open>baz\<close>. The individual constituents of a name may have further substructure,
   e.g.\ the string ``\<^verbatim>\<open>\<alpha>\<close>'' encodes as a single symbol (\secref{sec:symbols}).
 
   \<^medskip>
   Subsequently, we shall introduce specific categories of names. Roughly
   speaking these correspond to logical entities as follows:
 
   \<^item> Basic names (\secref{sec:basic-name}): free and bound variables.
 
   \<^item> Indexed names (\secref{sec:indexname}): schematic variables.
 
   \<^item> Long names (\secref{sec:long-name}): constants of any kind (type
   constructors, term constants, other concepts defined in user space). Such
   entities are typically managed via name spaces (\secref{sec:name-space}).
 \<close>
 
 
 subsection \<open>Basic names \label{sec:basic-name}\<close>
 
 text \<open>
   A \<^emph>\<open>basic name\<close> essentially consists of a single Isabelle identifier. There
   are conventions to mark separate classes of basic names, by attaching a
   suffix of underscores: one underscore means \<^emph>\<open>internal name\<close>, two
   underscores means \<^emph>\<open>Skolem name\<close>, three underscores means \<^emph>\<open>internal Skolem
   name\<close>.
 
   For example, the basic name \<open>foo\<close> has the internal version \<open>foo_\<close>, with
   Skolem versions \<open>foo__\<close> and \<open>foo___\<close>, respectively.
 
   These special versions provide copies of the basic name space, apart from
   anything that normally appears in the user text. For example, system
   generated variables in Isar proof contexts are usually marked as internal,
   which prevents mysterious names like \<open>xaa\<close> to appear in human-readable text.
 
   \<^medskip>
   Manipulating binding scopes often requires on-the-fly renamings. A \<^emph>\<open>name
   context\<close> contains a collection of already used names. The \<open>declare\<close>
   operation adds names to the context.
 
   The \<open>invents\<close> operation derives a number of fresh names from a given
   starting point. For example, the first three names derived from \<open>a\<close> are \<open>a\<close>,
   \<open>b\<close>, \<open>c\<close>.
 
   The \<open>variants\<close> operation produces fresh names by incrementing tentative
   names as base-26 numbers (with digits \<open>a..z\<close>) until all clashes are
   resolved. For example, name \<open>foo\<close> results in variants \<open>fooa\<close>, \<open>foob\<close>,
   \<open>fooc\<close>, \dots, \<open>fooaa\<close>, \<open>fooab\<close> etc.; each renaming step picks the next
   unused variant from this sequence.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Name.internal: "string -> string"} \\
-  @{index_ML Name.skolem: "string -> string"} \\
+  @{define_ML Name.internal: "string -> string"} \\
+  @{define_ML Name.skolem: "string -> string"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML_type Name.context} \\
-  @{index_ML Name.context: Name.context} \\
-  @{index_ML Name.declare: "string -> Name.context -> Name.context"} \\
-  @{index_ML Name.invent: "Name.context -> string -> int -> string list"} \\
-  @{index_ML Name.variant: "string -> Name.context -> string * Name.context"} \\
+  @{define_ML_type Name.context} \\
+  @{define_ML Name.context: Name.context} \\
+  @{define_ML Name.declare: "string -> Name.context -> Name.context"} \\
+  @{define_ML Name.invent: "Name.context -> string -> int -> string list"} \\
+  @{define_ML Name.variant: "string -> Name.context -> string * Name.context"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML Variable.names_of: "Proof.context -> Name.context"} \\
+  @{define_ML Variable.names_of: "Proof.context -> Name.context"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Name.internal\<close>~\<open>name\<close> produces an internal name by adding one
   underscore.
 
   \<^descr> \<^ML>\<open>Name.skolem\<close>~\<open>name\<close> produces a Skolem name by adding two underscores.
 
   \<^descr> Type \<^ML_type>\<open>Name.context\<close> represents the context of already used names;
   the initial value is \<^ML>\<open>Name.context\<close>.
 
   \<^descr> \<^ML>\<open>Name.declare\<close>~\<open>name\<close> enters a used name into the context.
 
   \<^descr> \<^ML>\<open>Name.invent\<close>~\<open>context name n\<close> produces \<open>n\<close> fresh names derived from
   \<open>name\<close>.
 
   \<^descr> \<^ML>\<open>Name.variant\<close>~\<open>name context\<close> produces a fresh variant of \<open>name\<close>; the
   result is declared to the context.
 
   \<^descr> \<^ML>\<open>Variable.names_of\<close>~\<open>ctxt\<close> retrieves the context of declared type and
   term variable names. Projecting a proof context down to a primitive name
   context is occasionally useful when invoking lower-level operations. Regular
   management of ``fresh variables'' is done by suitable operations of
   structure \<^ML_structure>\<open>Variable\<close>, which is also able to provide an
   official status of ``locally fixed variable'' within the logical environment
   (cf.\ \secref{sec:variables}).
 \<close>
 
 text %mlex \<open>
   The following simple examples demonstrate how to produce fresh names from
   the initial \<^ML>\<open>Name.context\<close>.
 \<close>
 
 ML_val \<open>
   val list1 = Name.invent Name.context "a" 5;
   \<^assert> (list1 = ["a", "b", "c", "d", "e"]);
 
   val list2 =
     #1 (fold_map Name.variant ["x", "x", "a", "a", "'a", "'a"] Name.context);
   \<^assert> (list2 = ["x", "xa", "a", "aa", "'a", "'aa"]);
 \<close>
 
 text \<open>
   \<^medskip>
   The same works relatively to the formal context as follows.\<close>
 
 experiment fixes a b c :: 'a
 begin
 
 ML_val \<open>
   val names = Variable.names_of \<^context>;
 
   val list1 = Name.invent names "a" 5;
   \<^assert> (list1 = ["d", "e", "f", "g", "h"]);
 
   val list2 =
     #1 (fold_map Name.variant ["x", "x", "a", "a", "'a", "'a"] names);
   \<^assert> (list2 = ["x", "xa", "aa", "ab", "'aa", "'ab"]);
 \<close>
 
 end
 
 
 subsection \<open>Indexed names \label{sec:indexname}\<close>
 
 text \<open>
   An \<^emph>\<open>indexed name\<close> (or \<open>indexname\<close>) is a pair of a basic name and a natural
   number. This representation allows efficient renaming by incrementing the
   second component only. The canonical way to rename two collections of
   indexnames apart from each other is this: determine the maximum index
   \<open>maxidx\<close> of the first collection, then increment all indexes of the second
   collection by \<open>maxidx + 1\<close>; the maximum index of an empty collection is
   \<open>-1\<close>.
 
   Occasionally, basic names are injected into the same pair type of indexed
   names: then \<open>(x, -1)\<close> is used to encode the basic name \<open>x\<close>.
 
   \<^medskip>
   Isabelle syntax observes the following rules for representing an indexname
   \<open>(x, i)\<close> as a packed string:
 
     \<^item> \<open>?x\<close> if \<open>x\<close> does not end with a digit and \<open>i = 0\<close>,
 
     \<^item> \<open>?xi\<close> if \<open>x\<close> does not end with a digit,
 
     \<^item> \<open>?x.i\<close> otherwise.
 
   Indexnames may acquire large index numbers after several maxidx shifts have
   been applied. Results are usually normalized towards \<open>0\<close> at certain
   checkpoints, notably at the end of a proof. This works by producing variants
   of the corresponding basic name components. For example, the collection
   \<open>?x1, ?x7, ?x42\<close> becomes \<open>?x, ?xa, ?xb\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type indexname: "string * int"} \\
+  @{define_ML_type indexname = "string * int"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>indexname\<close> represents indexed names. This is an
   abbreviation for \<^ML_type>\<open>string * int\<close>. The second component is usually
   non-negative, except for situations where \<open>(x, -1)\<close> is used to inject basic
   names into this type. Other negative indexes should not be used.
 \<close>
 
 
 subsection \<open>Long names \label{sec:long-name}\<close>
 
 text \<open>
   A \<^emph>\<open>long name\<close> consists of a sequence of non-empty name components. The
   packed representation uses a dot as separator, as in ``\<open>A.b.c\<close>''. The last
   component is called \<^emph>\<open>base name\<close>, the remaining prefix is called
   \<^emph>\<open>qualifier\<close> (which may be empty). The qualifier can be understood as the
   access path to the named entity while passing through some nested
   block-structure, although our free-form long names do not really enforce any
   strict discipline.
 
   For example, an item named ``\<open>A.b.c\<close>'' may be understood as a local entity
   \<open>c\<close>, within a local structure \<open>b\<close>, within a global structure \<open>A\<close>. In
   practice, long names usually represent 1--3 levels of qualification. User ML
   code should not make any assumptions about the particular structure of long
   names!
 
   The empty name is commonly used as an indication of unnamed entities, or
   entities that are not entered into the corresponding name space, whenever
   this makes any sense. The basic operations on long names map empty names
   again to empty names.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Long_Name.base_name: "string -> string"} \\
-  @{index_ML Long_Name.qualifier: "string -> string"} \\
-  @{index_ML Long_Name.append: "string -> string -> string"} \\
-  @{index_ML Long_Name.implode: "string list -> string"} \\
-  @{index_ML Long_Name.explode: "string -> string list"} \\
+  @{define_ML Long_Name.base_name: "string -> string"} \\
+  @{define_ML Long_Name.qualifier: "string -> string"} \\
+  @{define_ML Long_Name.append: "string -> string -> string"} \\
+  @{define_ML Long_Name.implode: "string list -> string"} \\
+  @{define_ML Long_Name.explode: "string -> string list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Long_Name.base_name\<close>~\<open>name\<close> returns the base name of a long name.
 
   \<^descr> \<^ML>\<open>Long_Name.qualifier\<close>~\<open>name\<close> returns the qualifier of a long name.
 
   \<^descr> \<^ML>\<open>Long_Name.append\<close>~\<open>name\<^sub>1 name\<^sub>2\<close> appends two long names.
 
   \<^descr> \<^ML>\<open>Long_Name.implode\<close>~\<open>names\<close> and \<^ML>\<open>Long_Name.explode\<close>~\<open>name\<close> convert
   between the packed string representation and the explicit list form of long
   names.
 \<close>
 
 
 subsection \<open>Name spaces \label{sec:name-space}\<close>
 
 text \<open>
   A \<open>name space\<close> manages a collection of long names, together with a mapping
   between partially qualified external names and fully qualified internal
   names (in both directions). Note that the corresponding \<open>intern\<close> and
   \<open>extern\<close> operations are mostly used for parsing and printing only! The
   \<open>declare\<close> operation augments a name space according to the accesses
   determined by a given binding, and a naming policy from the context.
 
   \<^medskip>
   A \<open>binding\<close> specifies details about the prospective long name of a newly
   introduced formal entity. It consists of a base name, prefixes for
   qualification (separate ones for system infrastructure and user-space
   mechanisms), a slot for the original source position, and some additional
   flags.
 
   \<^medskip>
   A \<open>naming\<close> provides some additional details for producing a long name from a
   binding. Normally, the naming is implicit in the theory or proof context.
   The \<open>full\<close> operation (and its variants for different context types) produces
   a fully qualified internal name to be entered into a name space. The main
   equation of this ``chemical reaction'' when binding new entities in a
   context is as follows:
 
   \<^medskip>
   \begin{tabular}{l}
   \<open>binding + naming \<longrightarrow> long name + name space accesses\<close>
   \end{tabular}
 
   \<^bigskip>
   As a general principle, there is a separate name space for each kind of
   formal entity, e.g.\ fact, logical constant, type constructor, type class.
   It is usually clear from the occurrence in concrete syntax (or from the
   scope) which kind of entity a name refers to. For example, the very same
   name \<open>c\<close> may be used uniformly for a constant, type constructor, and type
   class.
 
   There are common schemes to name derived entities systematically according
   to the name of the main logical entity involved, e.g.\ fact \<open>c.intro\<close> for a
   canonical introduction rule related to constant \<open>c\<close>. This technique of
   mapping names from one space into another requires some care in order to
   avoid conflicts. In particular, theorem names derived from a type
   constructor or type class should get an additional suffix in addition to the
   usual qualification. This leads to the following conventions for derived
   names:
 
   \<^medskip>
   \begin{tabular}{ll}
   logical entity & fact name \\\hline
   constant \<open>c\<close> & \<open>c.intro\<close> \\
   type \<open>c\<close> & \<open>c_type.intro\<close> \\
   class \<open>c\<close> & \<open>c_class.intro\<close> \\
   \end{tabular}
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type binding} \\
-  @{index_ML Binding.empty: binding} \\
-  @{index_ML Binding.name: "string -> binding"} \\
-  @{index_ML Binding.qualify: "bool -> string -> binding -> binding"} \\
-  @{index_ML Binding.prefix: "bool -> string -> binding -> binding"} \\
-  @{index_ML Binding.concealed: "binding -> binding"} \\
-  @{index_ML Binding.print: "binding -> string"} \\
+  @{define_ML_type binding} \\
+  @{define_ML Binding.empty: binding} \\
+  @{define_ML Binding.name: "string -> binding"} \\
+  @{define_ML Binding.qualify: "bool -> string -> binding -> binding"} \\
+  @{define_ML Binding.prefix: "bool -> string -> binding -> binding"} \\
+  @{define_ML Binding.concealed: "binding -> binding"} \\
+  @{define_ML Binding.print: "binding -> string"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML_type Name_Space.naming} \\
-  @{index_ML Name_Space.global_naming: Name_Space.naming} \\
-  @{index_ML Name_Space.add_path: "string -> Name_Space.naming -> Name_Space.naming"} \\
-  @{index_ML Name_Space.full_name: "Name_Space.naming -> binding -> string"} \\
+  @{define_ML_type Name_Space.naming} \\
+  @{define_ML Name_Space.global_naming: Name_Space.naming} \\
+  @{define_ML Name_Space.add_path: "string -> Name_Space.naming -> Name_Space.naming"} \\
+  @{define_ML Name_Space.full_name: "Name_Space.naming -> binding -> string"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML_type Name_Space.T} \\
-  @{index_ML Name_Space.empty: "string -> Name_Space.T"} \\
-  @{index_ML Name_Space.merge: "Name_Space.T * Name_Space.T -> Name_Space.T"} \\
-  @{index_ML Name_Space.declare: "Context.generic -> bool ->
+  @{define_ML_type Name_Space.T} \\
+  @{define_ML Name_Space.empty: "string -> Name_Space.T"} \\
+  @{define_ML Name_Space.merge: "Name_Space.T * Name_Space.T -> Name_Space.T"} \\
+  @{define_ML Name_Space.declare: "Context.generic -> bool ->
   binding -> Name_Space.T -> string * Name_Space.T"} \\
-  @{index_ML Name_Space.intern: "Name_Space.T -> string -> string"} \\
-  @{index_ML Name_Space.extern: "Proof.context -> Name_Space.T -> string -> string"} \\
-  @{index_ML Name_Space.is_concealed: "Name_Space.T -> string -> bool"}
+  @{define_ML Name_Space.intern: "Name_Space.T -> string -> string"} \\
+  @{define_ML Name_Space.extern: "Proof.context -> Name_Space.T -> string -> string"} \\
+  @{define_ML Name_Space.is_concealed: "Name_Space.T -> string -> bool"}
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>binding\<close> represents the abstract concept of name bindings.
 
   \<^descr> \<^ML>\<open>Binding.empty\<close> is the empty binding.
 
   \<^descr> \<^ML>\<open>Binding.name\<close>~\<open>name\<close> produces a binding with base name \<open>name\<close>. Note
   that this lacks proper source position information; see also the ML
   antiquotation @{ML_antiquotation binding}.
 
   \<^descr> \<^ML>\<open>Binding.qualify\<close>~\<open>mandatory name binding\<close> prefixes qualifier \<open>name\<close>
   to \<open>binding\<close>. The \<open>mandatory\<close> flag tells if this name component always needs
   to be given in name space accesses --- this is mostly \<open>false\<close> in practice.
   Note that this part of qualification is typically used in derived
   specification mechanisms.
 
   \<^descr> \<^ML>\<open>Binding.prefix\<close> is similar to \<^ML>\<open>Binding.qualify\<close>, but affects the
   system prefix. This part of extra qualification is typically used in the
   infrastructure for modular specifications, notably ``local theory targets''
   (see also \chref{ch:local-theory}).
 
   \<^descr> \<^ML>\<open>Binding.concealed\<close>~\<open>binding\<close> indicates that the binding shall refer
   to an entity that serves foundational purposes only. This flag helps to mark
   implementation details of specification mechanism etc. Other tools should
   not depend on the particulars of concealed entities (cf.\ \<^ML>\<open>Name_Space.is_concealed\<close>).
 
   \<^descr> \<^ML>\<open>Binding.print\<close>~\<open>binding\<close> produces a string representation for
   human-readable output, together with some formal markup that might get used
   in GUI front-ends, for example.
 
   \<^descr> Type \<^ML_type>\<open>Name_Space.naming\<close> represents the abstract concept of a
   naming policy.
 
   \<^descr> \<^ML>\<open>Name_Space.global_naming\<close> is the default naming policy: it is global
   and lacks any path prefix. In a regular theory context this is augmented by
   a path prefix consisting of the theory name.
 
   \<^descr> \<^ML>\<open>Name_Space.add_path\<close>~\<open>path naming\<close> augments the naming policy by
   extending its path component.
 
   \<^descr> \<^ML>\<open>Name_Space.full_name\<close>~\<open>naming binding\<close> turns a name binding (usually
   a basic name) into the fully qualified internal name, according to the given
   naming policy.
 
   \<^descr> Type \<^ML_type>\<open>Name_Space.T\<close> represents name spaces.
 
   \<^descr> \<^ML>\<open>Name_Space.empty\<close>~\<open>kind\<close> and \<^ML>\<open>Name_Space.merge\<close>~\<open>(space\<^sub>1,
   space\<^sub>2)\<close> are the canonical operations for maintaining name spaces according
   to theory data management (\secref{sec:context-data}); \<open>kind\<close> is a formal
   comment to characterize the purpose of a name space.
 
   \<^descr> \<^ML>\<open>Name_Space.declare\<close>~\<open>context strict binding space\<close> enters a name
   binding as fully qualified internal name into the name space, using the
   naming of the context.
 
   \<^descr> \<^ML>\<open>Name_Space.intern\<close>~\<open>space name\<close> internalizes a (partially qualified)
   external name.
 
   This operation is mostly for parsing! Note that fully qualified names
   stemming from declarations are produced via \<^ML>\<open>Name_Space.full_name\<close> and
   \<^ML>\<open>Name_Space.declare\<close> (or their derivatives for \<^ML_type>\<open>theory\<close> and
   \<^ML_type>\<open>Proof.context\<close>).
 
   \<^descr> \<^ML>\<open>Name_Space.extern\<close>~\<open>ctxt space name\<close> externalizes a (fully qualified)
   internal name.
 
   This operation is mostly for printing! User code should not rely on the
   precise result too much.
 
   \<^descr> \<^ML>\<open>Name_Space.is_concealed\<close>~\<open>space name\<close> indicates whether \<open>name\<close> refers
   to a strictly private entity that other tools are supposed to ignore!
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "binding"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation binding} embedded
   \<close>
 
   \<^descr> \<open>@{binding name}\<close> produces a binding with base name \<open>name\<close> and the source
   position taken from the concrete syntax of this antiquotation. In many
   situations this is more appropriate than the more basic \<^ML>\<open>Binding.name\<close>
   function.
 \<close>
 
 text %mlex \<open>
   The following example yields the source position of some concrete binding
   inlined into the text:
 \<close>
 
 ML_val \<open>Binding.pos_of \<^binding>\<open>here\<close>\<close>
 
 text \<open>
   \<^medskip>
   That position can be also printed in a message as follows:
 \<close>
 
 ML_command
   \<open>writeln
     ("Look here" ^ Position.here (Binding.pos_of \<^binding>\<open>here\<close>))\<close>
 
 text \<open>
   This illustrates a key virtue of formalized bindings as opposed to raw
   specifications of base names: the system can use this additional information
   for feedback given to the user (error messages etc.).
 
   \<^medskip>
   The following example refers to its source position directly, which is
   occasionally useful for experimentation and diagnostic purposes:
 \<close>
 
 ML_command \<open>warning ("Look here" ^ Position.here \<^here>)\<close>
 
 end
diff --git a/src/Doc/Implementation/Proof.thy b/src/Doc/Implementation/Proof.thy
--- a/src/Doc/Implementation/Proof.thy
+++ b/src/Doc/Implementation/Proof.thy
@@ -1,473 +1,473 @@
 (*:maxLineLen=78:*)
 
 theory Proof
 imports Base
 begin
 
 chapter \<open>Structured proofs\<close>
 
 section \<open>Variables \label{sec:variables}\<close>
 
 text \<open>
   Any variable that is not explicitly bound by \<open>\<lambda>\<close>-abstraction is considered
   as ``free''. Logically, free variables act like outermost universal
   quantification at the sequent level: \<open>A\<^sub>1(x), \<dots>, A\<^sub>n(x) \<turnstile> B(x)\<close> means that
   the result holds \<^emph>\<open>for all\<close> values of \<open>x\<close>. Free variables for terms (not
   types) can be fully internalized into the logic: \<open>\<turnstile> B(x)\<close> and \<open>\<turnstile> \<And>x. B(x)\<close>
   are interchangeable, provided that \<open>x\<close> does not occur elsewhere in the
   context. Inspecting \<open>\<turnstile> \<And>x. B(x)\<close> more closely, we see that inside the
   quantifier, \<open>x\<close> is essentially ``arbitrary, but fixed'', while from outside
   it appears as a place-holder for instantiation (thanks to \<open>\<And>\<close> elimination).
 
   The Pure logic represents the idea of variables being either inside or
   outside the current scope by providing separate syntactic categories for
   \<^emph>\<open>fixed variables\<close> (e.g.\ \<open>x\<close>) vs.\ \<^emph>\<open>schematic variables\<close> (e.g.\ \<open>?x\<close>).
   Incidently, a universal result \<open>\<turnstile> \<And>x. B(x)\<close> has the HHF normal form \<open>\<turnstile>
   B(?x)\<close>, which represents its generality without requiring an explicit
   quantifier. The same principle works for type variables: \<open>\<turnstile> B(?\<alpha>)\<close>
   represents the idea of ``\<open>\<turnstile> \<forall>\<alpha>. B(\<alpha>)\<close>'' without demanding a truly
   polymorphic framework.
 
   \<^medskip>
   Additional care is required to treat type variables in a way that
   facilitates type-inference. In principle, term variables depend on type
   variables, which means that type variables would have to be declared first.
   For example, a raw type-theoretic framework would demand the context to be
   constructed in stages as follows: \<open>\<Gamma> = \<alpha>: type, x: \<alpha>, a: A(x\<^sub>\<alpha>)\<close>.
 
   We allow a slightly less formalistic mode of operation: term variables \<open>x\<close>
   are fixed without specifying a type yet (essentially \<^emph>\<open>all\<close> potential
   occurrences of some instance \<open>x\<^sub>\<tau>\<close> are fixed); the first occurrence of \<open>x\<close>
   within a specific term assigns its most general type, which is then
   maintained consistently in the context. The above example becomes \<open>\<Gamma> = x:
   term, \<alpha>: type, A(x\<^sub>\<alpha>)\<close>, where type \<open>\<alpha>\<close> is fixed \<^emph>\<open>after\<close> term \<open>x\<close>, and the
   constraint \<open>x :: \<alpha>\<close> is an implicit consequence of the occurrence of \<open>x\<^sub>\<alpha>\<close> in
   the subsequent proposition.
 
   This twist of dependencies is also accommodated by the reverse operation of
   exporting results from a context: a type variable \<open>\<alpha>\<close> is considered fixed as
   long as it occurs in some fixed term variable of the context. For example,
   exporting \<open>x: term, \<alpha>: type \<turnstile> x\<^sub>\<alpha> \<equiv> x\<^sub>\<alpha>\<close> produces in the first step \<open>x: term
   \<turnstile> x\<^sub>\<alpha> \<equiv> x\<^sub>\<alpha>\<close> for fixed \<open>\<alpha>\<close>, and only in the second step \<open>\<turnstile> ?x\<^sub>?\<^sub>\<alpha> \<equiv> ?x\<^sub>?\<^sub>\<alpha>\<close>
   for schematic \<open>?x\<close> and \<open>?\<alpha>\<close>. The following Isar source text illustrates this
   scenario.
 \<close>
 
 notepad
 begin
   {
     fix x  \<comment> \<open>all potential occurrences of some \<open>x::\<tau>\<close> are fixed\<close>
     {
       have "x::'a \<equiv> x"  \<comment> \<open>implicit type assignment by concrete occurrence\<close>
         by (rule reflexive)
     }
     thm this  \<comment> \<open>result still with fixed type \<open>'a\<close>\<close>
   }
   thm this  \<comment> \<open>fully general result for arbitrary \<open>?x::?'a\<close>\<close>
 end
 
 text \<open>
   The Isabelle/Isar proof context manages the details of term vs.\ type
   variables, with high-level principles for moving the frontier between fixed
   and schematic variables.
 
   The \<open>add_fixes\<close> operation explicitly declares fixed variables; the
   \<open>declare_term\<close> operation absorbs a term into a context by fixing new type
   variables and adding syntactic constraints.
 
   The \<open>export\<close> operation is able to perform the main work of generalizing term
   and type variables as sketched above, assuming that fixing variables and
   terms have been declared properly.
 
   There \<open>import\<close> operation makes a generalized fact a genuine part of the
   context, by inventing fixed variables for the schematic ones. The effect can
   be reversed by using \<open>export\<close> later, potentially with an extended context;
   the result is equivalent to the original modulo renaming of schematic
   variables.
 
   The \<open>focus\<close> operation provides a variant of \<open>import\<close> for nested propositions
   (with explicit quantification): \<open>\<And>x\<^sub>1 \<dots> x\<^sub>n. B(x\<^sub>1, \<dots>, x\<^sub>n)\<close> is decomposed
   by inventing fixed variables \<open>x\<^sub>1, \<dots>, x\<^sub>n\<close> for the body.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Variable.add_fixes: "
-  string list -> Proof.context -> string list * Proof.context"} \\
-  @{index_ML Variable.variant_fixes: "
+  @{define_ML Variable.add_fixes: "
   string list -> Proof.context -> string list * Proof.context"} \\
-  @{index_ML Variable.declare_term: "term -> Proof.context -> Proof.context"} \\
-  @{index_ML Variable.declare_constraints: "term -> Proof.context -> Proof.context"} \\
-  @{index_ML Variable.export: "Proof.context -> Proof.context -> thm list -> thm list"} \\
-  @{index_ML Variable.polymorphic: "Proof.context -> term list -> term list"} \\
-  @{index_ML Variable.import: "bool -> thm list -> Proof.context ->
+  @{define_ML Variable.variant_fixes: "
+  string list -> Proof.context -> string list * Proof.context"} \\
+  @{define_ML Variable.declare_term: "term -> Proof.context -> Proof.context"} \\
+  @{define_ML Variable.declare_constraints: "term -> Proof.context -> Proof.context"} \\
+  @{define_ML Variable.export: "Proof.context -> Proof.context -> thm list -> thm list"} \\
+  @{define_ML Variable.polymorphic: "Proof.context -> term list -> term list"} \\
+  @{define_ML Variable.import: "bool -> thm list -> Proof.context ->
   ((((indexname * sort) * ctyp) list * ((indexname * typ) * cterm) list) * thm list)
     * Proof.context"} \\
-  @{index_ML Variable.focus: "binding list option -> term -> Proof.context ->
+  @{define_ML Variable.focus: "binding list option -> term -> Proof.context ->
   ((string * (string * typ)) list * term) * Proof.context"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Variable.add_fixes\<close>~\<open>xs ctxt\<close> fixes term variables \<open>xs\<close>, returning
   the resulting internal names. By default, the internal representation
   coincides with the external one, which also means that the given variables
   must not be fixed already. There is a different policy within a local proof
   body: the given names are just hints for newly invented Skolem variables.
 
   \<^descr> \<^ML>\<open>Variable.variant_fixes\<close> is similar to \<^ML>\<open>Variable.add_fixes\<close>, but
   always produces fresh variants of the given names.
 
   \<^descr> \<^ML>\<open>Variable.declare_term\<close>~\<open>t ctxt\<close> declares term \<open>t\<close> to belong to the
   context. This automatically fixes new type variables, but not term
   variables. Syntactic constraints for type and term variables are declared
   uniformly, though.
 
   \<^descr> \<^ML>\<open>Variable.declare_constraints\<close>~\<open>t ctxt\<close> declares syntactic constraints
   from term \<open>t\<close>, without making it part of the context yet.
 
   \<^descr> \<^ML>\<open>Variable.export\<close>~\<open>inner outer thms\<close> generalizes fixed type and term
   variables in \<open>thms\<close> according to the difference of the \<open>inner\<close> and \<open>outer\<close>
   context, following the principles sketched above.
 
   \<^descr> \<^ML>\<open>Variable.polymorphic\<close>~\<open>ctxt ts\<close> generalizes type variables in \<open>ts\<close> as
   far as possible, even those occurring in fixed term variables. The default
   policy of type-inference is to fix newly introduced type variables, which is
   essentially reversed with \<^ML>\<open>Variable.polymorphic\<close>: here the given terms
   are detached from the context as far as possible.
 
   \<^descr> \<^ML>\<open>Variable.import\<close>~\<open>open thms ctxt\<close> invents fixed type and term
   variables for the schematic ones occurring in \<open>thms\<close>. The \<open>open\<close> flag
   indicates whether the fixed names should be accessible to the user,
   otherwise newly introduced names are marked as ``internal''
   (\secref{sec:names}).
 
   \<^descr> \<^ML>\<open>Variable.focus\<close>~\<open>bindings B\<close> decomposes the outermost \<open>\<And>\<close> prefix of
   proposition \<open>B\<close>, using the given name bindings.
 \<close>
 
 text %mlex \<open>
   The following example shows how to work with fixed term and type parameters
   and with type-inference.
 \<close>
 
 ML_val \<open>
   (*static compile-time context -- for testing only*)
   val ctxt0 = \<^context>;
 
   (*locally fixed parameters -- no type assignment yet*)
   val ([x, y], ctxt1) = ctxt0 |> Variable.add_fixes ["x", "y"];
 
   (*t1: most general fixed type; t1': most general arbitrary type*)
   val t1 = Syntax.read_term ctxt1 "x";
   val t1' = singleton (Variable.polymorphic ctxt1) t1;
 
   (*term u enforces specific type assignment*)
   val u = Syntax.read_term ctxt1 "(x::nat) \<equiv> y";
 
   (*official declaration of u -- propagates constraints etc.*)
   val ctxt2 = ctxt1 |> Variable.declare_term u;
   val t2 = Syntax.read_term ctxt2 "x";  (*x::nat is enforced*)
 \<close>
 
 text \<open>
   In the above example, the starting context is derived from the toplevel
   theory, which means that fixed variables are internalized literally: \<open>x\<close> is
   mapped again to \<open>x\<close>, and attempting to fix it again in the subsequent
   context is an error. Alternatively, fixed parameters can be renamed
   explicitly as follows:
 \<close>
 
 ML_val \<open>
   val ctxt0 = \<^context>;
   val ([x1, x2, x3], ctxt1) =
     ctxt0 |> Variable.variant_fixes ["x", "x", "x"];
 \<close>
 
 text \<open>
   The following ML code can now work with the invented names of \<open>x1\<close>, \<open>x2\<close>,
   \<open>x3\<close>, without depending on the details on the system policy for introducing
   these variants. Recall that within a proof body the system always invents
   fresh ``Skolem constants'', e.g.\ as follows:
 \<close>
 
 notepad
 begin
   ML_prf %"ML"
    \<open>val ctxt0 = \<^context>;
 
     val ([x1], ctxt1) = ctxt0 |> Variable.add_fixes ["x"];
     val ([x2], ctxt2) = ctxt1 |> Variable.add_fixes ["x"];
     val ([x3], ctxt3) = ctxt2 |> Variable.add_fixes ["x"];
 
     val ([y1, y2], ctxt4) =
       ctxt3 |> Variable.variant_fixes ["y", "y"];\<close>
 end
 
 text \<open>
   In this situation \<^ML>\<open>Variable.add_fixes\<close> and \<^ML>\<open>Variable.variant_fixes\<close>
   are very similar, but identical name proposals given in a row are only
   accepted by the second version.
 \<close>
 
 
 section \<open>Assumptions \label{sec:assumptions}\<close>
 
 text \<open>
   An \<^emph>\<open>assumption\<close> is a proposition that it is postulated in the current
   context. Local conclusions may use assumptions as additional facts, but this
   imposes implicit hypotheses that weaken the overall statement.
 
   Assumptions are restricted to fixed non-schematic statements, i.e.\ all
   generality needs to be expressed by explicit quantifiers. Nevertheless, the
   result will be in HHF normal form with outermost quantifiers stripped. For
   example, by assuming \<open>\<And>x :: \<alpha>. P x\<close> we get \<open>\<And>x :: \<alpha>. P x \<turnstile> P ?x\<close> for
   schematic \<open>?x\<close> of fixed type \<open>\<alpha>\<close>. Local derivations accumulate more and more
   explicit references to hypotheses: \<open>A\<^sub>1, \<dots>, A\<^sub>n \<turnstile> B\<close> where \<open>A\<^sub>1, \<dots>, A\<^sub>n\<close>
   needs to be covered by the assumptions of the current context.
 
   \<^medskip>
   The \<open>add_assms\<close> operation augments the context by local assumptions, which
   are parameterized by an arbitrary \<open>export\<close> rule (see below).
 
   The \<open>export\<close> operation moves facts from a (larger) inner context into a
   (smaller) outer context, by discharging the difference of the assumptions as
   specified by the associated export rules. Note that the discharged portion
   is determined by the difference of contexts, not the facts being exported!
   There is a separate flag to indicate a goal context, where the result is
   meant to refine an enclosing sub-goal of a structured proof state.
 
   \<^medskip>
   The most basic export rule discharges assumptions directly by means of the
   \<open>\<Longrightarrow>\<close> introduction rule:
   \[
   \infer[(\<open>\<Longrightarrow>\<hyphen>intro\<close>)]{\<open>\<Gamma> - A \<turnstile> A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \]
 
   The variant for goal refinements marks the newly introduced premises, which
   causes the canonical Isar goal refinement scheme to enforce unification with
   local premises within the goal:
   \[
   \infer[(\<open>#\<Longrightarrow>\<hyphen>intro\<close>)]{\<open>\<Gamma> - A \<turnstile> #A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \]
 
   \<^medskip>
   Alternative versions of assumptions may perform arbitrary transformations on
   export, as long as the corresponding portion of hypotheses is removed from
   the given facts. For example, a local definition works by fixing \<open>x\<close> and
   assuming \<open>x \<equiv> t\<close>, with the following export rule to reverse the effect:
   \[
   \infer[(\<open>\<equiv>\<hyphen>expand\<close>)]{\<open>\<Gamma> - (x \<equiv> t) \<turnstile> B t\<close>}{\<open>\<Gamma> \<turnstile> B x\<close>}
   \]
   This works, because the assumption \<open>x \<equiv> t\<close> was introduced in a context with
   \<open>x\<close> being fresh, so \<open>x\<close> does not occur in \<open>\<Gamma>\<close> here.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type Assumption.export} \\
-  @{index_ML Assumption.assume: "Proof.context -> cterm -> thm"} \\
-  @{index_ML Assumption.add_assms:
+  @{define_ML_type Assumption.export} \\
+  @{define_ML Assumption.assume: "Proof.context -> cterm -> thm"} \\
+  @{define_ML Assumption.add_assms:
     "Assumption.export ->
   cterm list -> Proof.context -> thm list * Proof.context"} \\
-  @{index_ML Assumption.add_assumes: "
+  @{define_ML Assumption.add_assumes: "
   cterm list -> Proof.context -> thm list * Proof.context"} \\
-  @{index_ML Assumption.export: "bool -> Proof.context -> Proof.context -> thm -> thm"} \\
+  @{define_ML Assumption.export: "bool -> Proof.context -> Proof.context -> thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Assumption.export\<close> represents arbitrary export rules, which
   is any function of type \<^ML_type>\<open>bool -> cterm list -> thm -> thm\<close>, where
   the \<^ML_type>\<open>bool\<close> indicates goal mode, and the \<^ML_type>\<open>cterm list\<close>
   the collection of assumptions to be discharged simultaneously.
 
   \<^descr> \<^ML>\<open>Assumption.assume\<close>~\<open>ctxt A\<close> turns proposition \<open>A\<close> into a primitive
   assumption \<open>A \<turnstile> A'\<close>, where the conclusion \<open>A'\<close> is in HHF normal form.
 
   \<^descr> \<^ML>\<open>Assumption.add_assms\<close>~\<open>r As\<close> augments the context by assumptions \<open>As\<close>
   with export rule \<open>r\<close>. The resulting facts are hypothetical theorems as
   produced by the raw \<^ML>\<open>Assumption.assume\<close>.
 
   \<^descr> \<^ML>\<open>Assumption.add_assumes\<close>~\<open>As\<close> is a special case of \<^ML>\<open>Assumption.add_assms\<close> where the export rule performs \<open>\<Longrightarrow>\<hyphen>intro\<close> or
   \<open>#\<Longrightarrow>\<hyphen>intro\<close>, depending on goal mode.
 
   \<^descr> \<^ML>\<open>Assumption.export\<close>~\<open>is_goal inner outer thm\<close> exports result \<open>thm\<close>
   from the the \<open>inner\<close> context back into the \<open>outer\<close> one; \<open>is_goal = true\<close>
   means this is a goal context. The result is in HHF normal form. Note that
   \<^ML>\<open>Proof_Context.export\<close> combines \<^ML>\<open>Variable.export\<close> and \<^ML>\<open>Assumption.export\<close> in the canonical way.
 \<close>
 
 text %mlex \<open>
   The following example demonstrates how rules can be derived by building up a
   context of assumptions first, and exporting some local fact afterwards. We
   refer to \<^theory>\<open>Pure\<close> equality here for testing purposes.
 \<close>
 
 ML_val \<open>
   (*static compile-time context -- for testing only*)
   val ctxt0 = \<^context>;
 
   val ([eq], ctxt1) =
     ctxt0 |> Assumption.add_assumes [\<^cprop>\<open>x \<equiv> y\<close>];
   val eq' = Thm.symmetric eq;
 
   (*back to original context -- discharges assumption*)
   val r = Assumption.export false ctxt1 ctxt0 eq';
 \<close>
 
 text \<open>
   Note that the variables of the resulting rule are not generalized. This
   would have required to fix them properly in the context beforehand, and
   export wrt.\ variables afterwards (cf.\ \<^ML>\<open>Variable.export\<close> or the
   combined \<^ML>\<open>Proof_Context.export\<close>).
 \<close>
 
 
 section \<open>Structured goals and results \label{sec:struct-goals}\<close>
 
 text \<open>
   Local results are established by monotonic reasoning from facts within a
   context. This allows common combinations of theorems, e.g.\ via \<open>\<And>/\<Longrightarrow>\<close>
   elimination, resolution rules, or equational reasoning, see
   \secref{sec:thms}. Unaccounted context manipulations should be avoided,
   notably raw \<open>\<And>/\<Longrightarrow>\<close> introduction or ad-hoc references to free variables or
   assumptions not present in the proof context.
 
   \<^medskip>
   The \<open>SUBPROOF\<close> combinator allows to structure a tactical proof recursively
   by decomposing a selected sub-goal: \<open>(\<And>x. A(x) \<Longrightarrow> B(x)) \<Longrightarrow> \<dots>\<close> is turned into
   \<open>B(x) \<Longrightarrow> \<dots>\<close> after fixing \<open>x\<close> and assuming \<open>A(x)\<close>. This means the tactic needs
   to solve the conclusion, but may use the premise as a local fact, for
   locally fixed variables.
 
   The family of \<open>FOCUS\<close> combinators is similar to \<open>SUBPROOF\<close>, but allows to
   retain schematic variables and pending subgoals in the resulting goal state.
 
   The \<open>prove\<close> operation provides an interface for structured backwards
   reasoning under program control, with some explicit sanity checks of the
   result. The goal context can be augmented by additional fixed variables
   (cf.\ \secref{sec:variables}) and assumptions (cf.\
   \secref{sec:assumptions}), which will be available as local facts during the
   proof and discharged into implications in the result. Type and term
   variables are generalized as usual, according to the context.
 
   The \<open>obtain\<close> operation produces results by eliminating existing facts by
   means of a given tactic. This acts like a dual conclusion: the proof
   demonstrates that the context may be augmented by parameters and
   assumptions, without affecting any conclusions that do not mention these
   parameters. See also @{cite "isabelle-isar-ref"} for the user-level
   @{command obtain} and @{command guess} elements. Final results, which may
   not refer to the parameters in the conclusion, need to exported explicitly
   into the original context.\<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML SUBPROOF: "(Subgoal.focus -> tactic) ->
-  Proof.context -> int -> tactic"} \\
-  @{index_ML Subgoal.FOCUS: "(Subgoal.focus -> tactic) ->
-  Proof.context -> int -> tactic"} \\
-  @{index_ML Subgoal.FOCUS_PREMS: "(Subgoal.focus -> tactic) ->
+  @{define_ML SUBPROOF: "(Subgoal.focus -> tactic) ->
   Proof.context -> int -> tactic"} \\
-  @{index_ML Subgoal.FOCUS_PARAMS: "(Subgoal.focus -> tactic) ->
+  @{define_ML Subgoal.FOCUS: "(Subgoal.focus -> tactic) ->
   Proof.context -> int -> tactic"} \\
-  @{index_ML Subgoal.focus: "Proof.context -> int -> binding list option ->
+  @{define_ML Subgoal.FOCUS_PREMS: "(Subgoal.focus -> tactic) ->
+  Proof.context -> int -> tactic"} \\
+  @{define_ML Subgoal.FOCUS_PARAMS: "(Subgoal.focus -> tactic) ->
+  Proof.context -> int -> tactic"} \\
+  @{define_ML Subgoal.focus: "Proof.context -> int -> binding list option ->
   thm -> Subgoal.focus * thm"} \\
-  @{index_ML Subgoal.focus_prems: "Proof.context -> int -> binding list option ->
+  @{define_ML Subgoal.focus_prems: "Proof.context -> int -> binding list option ->
   thm -> Subgoal.focus * thm"} \\
-  @{index_ML Subgoal.focus_params: "Proof.context -> int -> binding list option ->
+  @{define_ML Subgoal.focus_params: "Proof.context -> int -> binding list option ->
   thm -> Subgoal.focus * thm"} \\
   \end{mldecls}
 
   \begin{mldecls}
-  @{index_ML Goal.prove: "Proof.context -> string list -> term list -> term ->
+  @{define_ML Goal.prove: "Proof.context -> string list -> term list -> term ->
   ({prems: thm list, context: Proof.context} -> tactic) -> thm"} \\
-  @{index_ML Goal.prove_common: "Proof.context -> int option ->
+  @{define_ML Goal.prove_common: "Proof.context -> int option ->
   string list -> term list -> term list ->
   ({prems: thm list, context: Proof.context} -> tactic) -> thm list"} \\
   \end{mldecls}
   \begin{mldecls}
-  @{index_ML Obtain.result: "(Proof.context -> tactic) -> thm list ->
+  @{define_ML Obtain.result: "(Proof.context -> tactic) -> thm list ->
   Proof.context -> ((string * cterm) list * thm list) * Proof.context"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>SUBPROOF\<close>~\<open>tac ctxt i\<close> decomposes the structure of the specified
   sub-goal, producing an extended context and a reduced goal, which needs to
   be solved by the given tactic. All schematic parameters of the goal are
   imported into the context as fixed ones, which may not be instantiated in
   the sub-proof.
 
   \<^descr> \<^ML>\<open>Subgoal.FOCUS\<close>, \<^ML>\<open>Subgoal.FOCUS_PREMS\<close>, and \<^ML>\<open>Subgoal.FOCUS_PARAMS\<close> are similar to \<^ML>\<open>SUBPROOF\<close>, but are slightly more
   flexible: only the specified parts of the subgoal are imported into the
   context, and the body tactic may introduce new subgoals and schematic
   variables.
 
   \<^descr> \<^ML>\<open>Subgoal.focus\<close>, \<^ML>\<open>Subgoal.focus_prems\<close>, \<^ML>\<open>Subgoal.focus_params\<close>
   extract the focus information from a goal state in the same way as the
   corresponding tacticals above. This is occasionally useful to experiment
   without writing actual tactics yet.
 
   \<^descr> \<^ML>\<open>Goal.prove\<close>~\<open>ctxt xs As C tac\<close> states goal \<open>C\<close> in the context
   augmented by fixed variables \<open>xs\<close> and assumptions \<open>As\<close>, and applies tactic
   \<open>tac\<close> to solve it. The latter may depend on the local assumptions being
   presented as facts. The result is in HHF normal form.
 
   \<^descr> \<^ML>\<open>Goal.prove_common\<close>~\<open>ctxt fork_pri\<close> is the common form to state and
   prove a simultaneous goal statement, where \<^ML>\<open>Goal.prove\<close> is a convenient
   shorthand that is most frequently used in applications.
 
   The given list of simultaneous conclusions is encoded in the goal state by
   means of Pure conjunction: \<^ML>\<open>Goal.conjunction_tac\<close> will turn this into a
   collection of individual subgoals, but note that the original multi-goal
   state is usually required for advanced induction.
 
   It is possible to provide an optional priority for a forked proof, typically
   \<^ML>\<open>SOME ~1\<close>, while \<^ML>\<open>NONE\<close> means the proof is immediate (sequential)
   as for \<^ML>\<open>Goal.prove\<close>. Note that a forked proof does not exhibit any
   failures in the usual way via exceptions in ML, but accumulates error
   situations under the execution id of the running transaction. Thus the
   system is able to expose error messages ultimately to the end-user, even
   though the subsequent ML code misses them.
 
   \<^descr> \<^ML>\<open>Obtain.result\<close>~\<open>tac thms ctxt\<close> eliminates the given facts using a
   tactic, which results in additional fixed variables and assumptions in the
   context. Final results need to be exported explicitly.
 \<close>
 
 text %mlex \<open>
   The following minimal example illustrates how to access the focus
   information of a structured goal state.
 \<close>
 
 notepad
 begin
   fix A B C :: "'a \<Rightarrow> bool"
 
   have "\<And>x. A x \<Longrightarrow> B x \<Longrightarrow> C x"
     ML_val
      \<open>val {goal, context = goal_ctxt, ...} = @{Isar.goal};
       val (focus as {params, asms, concl, ...}, goal') =
         Subgoal.focus goal_ctxt 1 (SOME [\<^binding>\<open>x\<close>]) goal;
       val [A, B] = #prems focus;
       val [(_, x)] = #params focus;\<close>
     sorry
 end
 
 text \<open>
   \<^medskip>
   The next example demonstrates forward-elimination in a local context, using
   \<^ML>\<open>Obtain.result\<close>.
 \<close>
 
 notepad
 begin
   assume ex: "\<exists>x. B x"
 
   ML_prf %"ML"
    \<open>val ctxt0 = \<^context>;
     val (([(_, x)], [B]), ctxt1) = ctxt0
       |> Obtain.result (fn _ => eresolve_tac ctxt0 @{thms exE} 1) [@{thm ex}];\<close>
   ML_prf %"ML"
    \<open>singleton (Proof_Context.export ctxt1 ctxt0) @{thm refl};\<close>
   ML_prf %"ML"
    \<open>Proof_Context.export ctxt1 ctxt0 [Thm.reflexive x]
       handle ERROR msg => (warning msg; []);\<close>
 end
 
 end
diff --git a/src/Doc/Implementation/Syntax.thy b/src/Doc/Implementation/Syntax.thy
--- a/src/Doc/Implementation/Syntax.thy
+++ b/src/Doc/Implementation/Syntax.thy
@@ -1,259 +1,259 @@
 (*:maxLineLen=78:*)
 
 theory Syntax
 imports Base
 begin
 
 chapter \<open>Concrete syntax and type-checking\<close>
 
 text \<open>
   Pure \<open>\<lambda>\<close>-calculus as introduced in \chref{ch:logic} is an adequate
   foundation for logical languages --- in the tradition of \<^emph>\<open>higher-order
   abstract syntax\<close> --- but end-users require additional means for reading and
   printing of terms and types. This important add-on outside the logical core
   is called \<^emph>\<open>inner syntax\<close> in Isabelle jargon, as opposed to the \<^emph>\<open>outer
   syntax\<close> of the theory and proof language @{cite "isabelle-isar-ref"}.
 
   For example, according to @{cite church40} quantifiers are represented as
   higher-order constants \<open>All :: ('a \<Rightarrow> bool) \<Rightarrow> bool\<close> such that \<open>All (\<lambda>x::'a. B
   x)\<close> faithfully represents the idea that is displayed in Isabelle as \<open>\<forall>x::'a.
   B x\<close> via @{keyword "binder"} notation. Moreover, type-inference in the style
   of Hindley-Milner @{cite hindleymilner} (and extensions) enables users to
   write \<open>\<forall>x. B x\<close> concisely, when the type \<open>'a\<close> is already clear from the
   context.\<^footnote>\<open>Type-inference taken to the extreme can easily confuse users.
   Beginners often stumble over unexpectedly general types inferred by the
   system.\<close>
 
   \<^medskip>
   The main inner syntax operations are \<^emph>\<open>read\<close> for parsing together with
   type-checking, and \<^emph>\<open>pretty\<close> for formatted output. See also
   \secref{sec:read-print}.
 
   Furthermore, the input and output syntax layers are sub-divided into
   separate phases for \<^emph>\<open>concrete syntax\<close> versus \<^emph>\<open>abstract syntax\<close>, see also
   \secref{sec:parse-unparse} and \secref{sec:term-check}, respectively. This
   results in the following decomposition of the main operations:
 
     \<^item> \<open>read = parse; check\<close>
 
     \<^item> \<open>pretty = uncheck; unparse\<close>
 
   For example, some specification package might thus intercept syntax
   processing at a well-defined stage after \<open>parse\<close>, to a augment the resulting
   pre-term before full type-reconstruction is performed by \<open>check\<close>. Note that
   the formal status of bound variables, versus free variables, versus
   constants must not be changed between these phases.
 
   \<^medskip>
   In general, \<open>check\<close> and \<open>uncheck\<close> operate simultaneously on a list of terms.
   This is particular important for type-checking, to reconstruct types for
   several terms of the same context and scope. In contrast, \<open>parse\<close> and
   \<open>unparse\<close> operate separately on single terms.
 
   There are analogous operations to read and print types, with the same
   sub-division into phases.
 \<close>
 
 
 section \<open>Reading and pretty printing \label{sec:read-print}\<close>
 
 text \<open>
   Read and print operations are roughly dual to each other, such that for the
   user \<open>s' = pretty (read s)\<close> looks similar to the original source text \<open>s\<close>,
   but the details depend on many side-conditions. There are also explicit
   options to control the removal of type information in the output. The
   default configuration routinely looses information, so \<open>t' = read (pretty
   t)\<close> might fail, or produce a differently typed term, or a completely
   different term in the face of syntactic overloading.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Syntax.read_typs: "Proof.context -> string list -> typ list"} \\
-  @{index_ML Syntax.read_terms: "Proof.context -> string list -> term list"} \\
-  @{index_ML Syntax.read_props: "Proof.context -> string list -> term list"} \\[0.5ex]
-  @{index_ML Syntax.read_typ: "Proof.context -> string -> typ"} \\
-  @{index_ML Syntax.read_term: "Proof.context -> string -> term"} \\
-  @{index_ML Syntax.read_prop: "Proof.context -> string -> term"} \\[0.5ex]
-  @{index_ML Syntax.pretty_typ: "Proof.context -> typ -> Pretty.T"} \\
-  @{index_ML Syntax.pretty_term: "Proof.context -> term -> Pretty.T"} \\
-  @{index_ML Syntax.string_of_typ: "Proof.context -> typ -> string"} \\
-  @{index_ML Syntax.string_of_term: "Proof.context -> term -> string"} \\
+  @{define_ML Syntax.read_typs: "Proof.context -> string list -> typ list"} \\
+  @{define_ML Syntax.read_terms: "Proof.context -> string list -> term list"} \\
+  @{define_ML Syntax.read_props: "Proof.context -> string list -> term list"} \\[0.5ex]
+  @{define_ML Syntax.read_typ: "Proof.context -> string -> typ"} \\
+  @{define_ML Syntax.read_term: "Proof.context -> string -> term"} \\
+  @{define_ML Syntax.read_prop: "Proof.context -> string -> term"} \\[0.5ex]
+  @{define_ML Syntax.pretty_typ: "Proof.context -> typ -> Pretty.T"} \\
+  @{define_ML Syntax.pretty_term: "Proof.context -> term -> Pretty.T"} \\
+  @{define_ML Syntax.string_of_typ: "Proof.context -> typ -> string"} \\
+  @{define_ML Syntax.string_of_term: "Proof.context -> term -> string"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Syntax.read_typs\<close>~\<open>ctxt strs\<close> parses and checks a simultaneous list
   of source strings as types of the logic.
 
   \<^descr> \<^ML>\<open>Syntax.read_terms\<close>~\<open>ctxt strs\<close> parses and checks a simultaneous list
   of source strings as terms of the logic. Type-reconstruction puts all parsed
   terms into the same scope: types of free variables ultimately need to
   coincide.
 
   If particular type-constraints are required for some of the arguments, the
   read operations needs to be split into its parse and check phases. Then it
   is possible to use \<^ML>\<open>Type.constraint\<close> on the intermediate pre-terms
   (\secref{sec:term-check}).
 
   \<^descr> \<^ML>\<open>Syntax.read_props\<close>~\<open>ctxt strs\<close> parses and checks a simultaneous list
   of source strings as terms of the logic, with an implicit type-constraint
   for each argument to enforce type \<^typ>\<open>prop\<close>; this also affects the inner
   syntax for parsing. The remaining type-reconstruction works as for \<^ML>\<open>Syntax.read_terms\<close>.
 
   \<^descr> \<^ML>\<open>Syntax.read_typ\<close>, \<^ML>\<open>Syntax.read_term\<close>, \<^ML>\<open>Syntax.read_prop\<close> are
   like the simultaneous versions, but operate on a single argument only. This
   convenient shorthand is adequate in situations where a single item in its
   own scope is processed. Do not use \<^ML>\<open>map o Syntax.read_term\<close> where \<^ML>\<open>Syntax.read_terms\<close> is actually intended!
 
   \<^descr> \<^ML>\<open>Syntax.pretty_typ\<close>~\<open>ctxt T\<close> and \<^ML>\<open>Syntax.pretty_term\<close>~\<open>ctxt t\<close>
   uncheck and pretty-print the given type or term, respectively. Although the
   uncheck phase acts on a simultaneous list as well, this is rarely used in
   practice, so only the singleton case is provided as combined pretty
   operation. There is no distinction of term vs.\ proposition.
 
   \<^descr> \<^ML>\<open>Syntax.string_of_typ\<close> and \<^ML>\<open>Syntax.string_of_term\<close> are convenient
   compositions of \<^ML>\<open>Syntax.pretty_typ\<close> and \<^ML>\<open>Syntax.pretty_term\<close> with
   \<^ML>\<open>Pretty.string_of\<close> for output. The result may be concatenated with other
   strings, as long as there is no further formatting and line-breaking
   involved.
 
 
   \<^ML>\<open>Syntax.read_term\<close>, \<^ML>\<open>Syntax.read_prop\<close>, and \<^ML>\<open>Syntax.string_of_term\<close> are the most important operations in practice.
 
   \<^medskip>
   Note that the string values that are passed in and out are annotated by the
   system, to carry further markup that is relevant for the Prover IDE @{cite
   "isabelle-jedit"}. User code should neither compose its own input strings,
   nor try to analyze the output strings. Conceptually this is an abstract
   datatype, encoded as concrete string for historical reasons.
 
   The standard way to provide the required position markup for input works via
   the outer syntax parser wrapper \<^ML>\<open>Parse.inner_syntax\<close>, which is already
   part of \<^ML>\<open>Parse.typ\<close>, \<^ML>\<open>Parse.term\<close>, \<^ML>\<open>Parse.prop\<close>. So a string
   obtained from one of the latter may be directly passed to the corresponding
   read operation: this yields PIDE markup of the input and precise positions
   for warning and error messages.
 \<close>
 
 
 section \<open>Parsing and unparsing \label{sec:parse-unparse}\<close>
 
 text \<open>
   Parsing and unparsing converts between actual source text and a certain
   \<^emph>\<open>pre-term\<close> format, where all bindings and scopes are already resolved
   faithfully. Thus the names of free variables or constants are determined in
   the sense of the logical context, but type information might be still
   missing. Pre-terms support an explicit language of \<^emph>\<open>type constraints\<close> that
   may be augmented by user code to guide the later \<^emph>\<open>check\<close> phase.
 
   Actual parsing is based on traditional lexical analysis and Earley parsing
   for arbitrary context-free grammars. The user can specify the grammar
   declaratively via mixfix annotations. Moreover, there are \<^emph>\<open>syntax
   translations\<close> that can be augmented by the user, either declaratively via
   @{command translations} or programmatically via @{command
   parse_translation}, @{command print_translation} @{cite
   "isabelle-isar-ref"}. The final scope-resolution is performed by the system,
   according to name spaces for types, term variables and constants determined
   by the context.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Syntax.parse_typ: "Proof.context -> string -> typ"} \\
-  @{index_ML Syntax.parse_term: "Proof.context -> string -> term"} \\
-  @{index_ML Syntax.parse_prop: "Proof.context -> string -> term"} \\[0.5ex]
-  @{index_ML Syntax.unparse_typ: "Proof.context -> typ -> Pretty.T"} \\
-  @{index_ML Syntax.unparse_term: "Proof.context -> term -> Pretty.T"} \\
+  @{define_ML Syntax.parse_typ: "Proof.context -> string -> typ"} \\
+  @{define_ML Syntax.parse_term: "Proof.context -> string -> term"} \\
+  @{define_ML Syntax.parse_prop: "Proof.context -> string -> term"} \\[0.5ex]
+  @{define_ML Syntax.unparse_typ: "Proof.context -> typ -> Pretty.T"} \\
+  @{define_ML Syntax.unparse_term: "Proof.context -> term -> Pretty.T"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Syntax.parse_typ\<close>~\<open>ctxt str\<close> parses a source string as pre-type that
   is ready to be used with subsequent check operations.
 
   \<^descr> \<^ML>\<open>Syntax.parse_term\<close>~\<open>ctxt str\<close> parses a source string as pre-term that
   is ready to be used with subsequent check operations.
 
   \<^descr> \<^ML>\<open>Syntax.parse_prop\<close>~\<open>ctxt str\<close> parses a source string as pre-term that
   is ready to be used with subsequent check operations. The inner syntax
   category is \<^typ>\<open>prop\<close> and a suitable type-constraint is included to ensure
   that this information is observed in subsequent type reconstruction.
 
   \<^descr> \<^ML>\<open>Syntax.unparse_typ\<close>~\<open>ctxt T\<close> unparses a type after uncheck
   operations, to turn it into a pretty tree.
 
   \<^descr> \<^ML>\<open>Syntax.unparse_term\<close>~\<open>ctxt T\<close> unparses a term after uncheck
   operations, to turn it into a pretty tree. There is no distinction for
   propositions here.
 
 
   These operations always operate on a single item; use the combinator \<^ML>\<open>map\<close> to apply them to a list.
 \<close>
 
 
 section \<open>Checking and unchecking \label{sec:term-check}\<close>
 
 text \<open>
   These operations define the transition from pre-terms and fully-annotated
   terms in the sense of the logical core (\chref{ch:logic}).
 
   The \<^emph>\<open>check\<close> phase is meant to subsume a variety of mechanisms in the manner
   of ``type-inference'' or ``type-reconstruction'' or ``type-improvement'',
   not just type-checking in the narrow sense. The \<^emph>\<open>uncheck\<close> phase is roughly
   dual, it prunes type-information before pretty printing.
 
   A typical add-on for the check/uncheck syntax layer is the @{command
   abbreviation} mechanism @{cite "isabelle-isar-ref"}. Here the user specifies
   syntactic definitions that are managed by the system as polymorphic \<open>let\<close>
   bindings. These are expanded during the \<open>check\<close> phase, and contracted during
   the \<open>uncheck\<close> phase, without affecting the type-assignment of the given
   terms.
 
   \<^medskip>
   The precise meaning of type checking depends on the context --- additional
   check/uncheck modules might be defined in user space.
 
   For example, the @{command class} command defines a context where \<open>check\<close>
   treats certain type instances of overloaded constants according to the
   ``dictionary construction'' of its logical foundation. This involves ``type
   improvement'' (specialization of slightly too general types) and replacement
   by certain locale parameters. See also @{cite "Haftmann-Wenzel:2009"}.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Syntax.check_typs: "Proof.context -> typ list -> typ list"} \\
-  @{index_ML Syntax.check_terms: "Proof.context -> term list -> term list"} \\
-  @{index_ML Syntax.check_props: "Proof.context -> term list -> term list"} \\[0.5ex]
-  @{index_ML Syntax.uncheck_typs: "Proof.context -> typ list -> typ list"} \\
-  @{index_ML Syntax.uncheck_terms: "Proof.context -> term list -> term list"} \\
+  @{define_ML Syntax.check_typs: "Proof.context -> typ list -> typ list"} \\
+  @{define_ML Syntax.check_terms: "Proof.context -> term list -> term list"} \\
+  @{define_ML Syntax.check_props: "Proof.context -> term list -> term list"} \\[0.5ex]
+  @{define_ML Syntax.uncheck_typs: "Proof.context -> typ list -> typ list"} \\
+  @{define_ML Syntax.uncheck_terms: "Proof.context -> term list -> term list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Syntax.check_typs\<close>~\<open>ctxt Ts\<close> checks a simultaneous list of pre-types
   as types of the logic. Typically, this involves normalization of type
   synonyms.
 
   \<^descr> \<^ML>\<open>Syntax.check_terms\<close>~\<open>ctxt ts\<close> checks a simultaneous list of pre-terms
   as terms of the logic. Typically, this involves type-inference and
   normalization term abbreviations. The types within the given terms are
   treated in the same way as for \<^ML>\<open>Syntax.check_typs\<close>.
 
   Applications sometimes need to check several types and terms together. The
   standard approach uses \<^ML>\<open>Logic.mk_type\<close> to embed the language of types
   into that of terms; all arguments are appended into one list of terms that
   is checked; afterwards the type arguments are recovered with \<^ML>\<open>Logic.dest_type\<close>.
 
   \<^descr> \<^ML>\<open>Syntax.check_props\<close>~\<open>ctxt ts\<close> checks a simultaneous list of pre-terms
   as terms of the logic, such that all terms are constrained by type \<^typ>\<open>prop\<close>. The remaining check operation works as \<^ML>\<open>Syntax.check_terms\<close>
   above.
 
   \<^descr> \<^ML>\<open>Syntax.uncheck_typs\<close>~\<open>ctxt Ts\<close> unchecks a simultaneous list of types
   of the logic, in preparation of pretty printing.
 
   \<^descr> \<^ML>\<open>Syntax.uncheck_terms\<close>~\<open>ctxt ts\<close> unchecks a simultaneous list of terms
   of the logic, in preparation of pretty printing. There is no distinction for
   propositions here.
 
 
   These operations always operate simultaneously on a list; use the combinator
   \<^ML>\<open>singleton\<close> to apply them to a single item.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Tactic.thy b/src/Doc/Implementation/Tactic.thy
--- a/src/Doc/Implementation/Tactic.thy
+++ b/src/Doc/Implementation/Tactic.thy
@@ -1,817 +1,817 @@
 (*:maxLineLen=78:*)
 
 theory Tactic
 imports Base
 begin
 
 chapter \<open>Tactical reasoning\<close>
 
 text \<open>
   Tactical reasoning works by refining an initial claim in a backwards
   fashion, until a solved form is reached. A \<open>goal\<close> consists of several
   subgoals that need to be solved in order to achieve the main statement; zero
   subgoals means that the proof may be finished. A \<open>tactic\<close> is a refinement
   operation that maps a goal to a lazy sequence of potential successors. A
   \<open>tactical\<close> is a combinator for composing tactics.
 \<close>
 
 
 section \<open>Goals \label{sec:tactical-goals}\<close>
 
 text \<open>
   Isabelle/Pure represents a goal as a theorem stating that the subgoals imply
   the main goal: \<open>A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> C\<close>. The outermost goal structure is that of
   a Horn Clause: i.e.\ an iterated implication without any quantifiers\<^footnote>\<open>Recall
   that outermost \<open>\<And>x. \<phi>[x]\<close> is always represented via schematic variables in
   the body: \<open>\<phi>[?x]\<close>. These variables may get instantiated during the course of
   reasoning.\<close>. For \<open>n = 0\<close> a goal is called ``solved''.
 
   The structure of each subgoal \<open>A\<^sub>i\<close> is that of a general Hereditary Harrop
   Formula \<open>\<And>x\<^sub>1 \<dots> \<And>x\<^sub>k. H\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> H\<^sub>m \<Longrightarrow> B\<close>. Here \<open>x\<^sub>1, \<dots>, x\<^sub>k\<close> are goal
   parameters, i.e.\ arbitrary-but-fixed entities of certain types, and \<open>H\<^sub>1,
   \<dots>, H\<^sub>m\<close> are goal hypotheses, i.e.\ facts that may be assumed locally.
   Together, this forms the goal context of the conclusion \<open>B\<close> to be
   established. The goal hypotheses may be again arbitrary Hereditary Harrop
   Formulas, although the level of nesting rarely exceeds 1--2 in practice.
 
   The main conclusion \<open>C\<close> is internally marked as a protected proposition,
   which is represented explicitly by the notation \<open>#C\<close> here. This ensures that
   the decomposition into subgoals and main conclusion is well-defined for
   arbitrarily structured claims.
 
   \<^medskip>
   Basic goal management is performed via the following Isabelle/Pure rules:
 
   \[
   \infer[\<open>(init)\<close>]{\<open>C \<Longrightarrow> #C\<close>}{} \qquad
   \infer[\<open>(finish)\<close>]{\<open>C\<close>}{\<open>#C\<close>}
   \]
 
   \<^medskip>
   The following low-level variants admit general reasoning with protected
   propositions:
 
   \[
   \infer[\<open>(protect n)\<close>]{\<open>A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> #C\<close>}{\<open>A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> C\<close>}
   \]
   \[
   \infer[\<open>(conclude)\<close>]{\<open>A \<Longrightarrow> \<dots> \<Longrightarrow> C\<close>}{\<open>A \<Longrightarrow> \<dots> \<Longrightarrow> #C\<close>}
   \]
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Goal.init: "cterm -> thm"} \\
-  @{index_ML Goal.finish: "Proof.context -> thm -> thm"} \\
-  @{index_ML Goal.protect: "int -> thm -> thm"} \\
-  @{index_ML Goal.conclude: "thm -> thm"} \\
+  @{define_ML Goal.init: "cterm -> thm"} \\
+  @{define_ML Goal.finish: "Proof.context -> thm -> thm"} \\
+  @{define_ML Goal.protect: "int -> thm -> thm"} \\
+  @{define_ML Goal.conclude: "thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Goal.init\<close>~\<open>C\<close> initializes a tactical goal from the well-formed
   proposition \<open>C\<close>.
 
   \<^descr> \<^ML>\<open>Goal.finish\<close>~\<open>ctxt thm\<close> checks whether theorem \<open>thm\<close> is a solved
   goal (no subgoals), and concludes the result by removing the goal
   protection. The context is only required for printing error messages.
 
   \<^descr> \<^ML>\<open>Goal.protect\<close>~\<open>n thm\<close> protects the statement of theorem \<open>thm\<close>. The
   parameter \<open>n\<close> indicates the number of premises to be retained.
 
   \<^descr> \<^ML>\<open>Goal.conclude\<close>~\<open>thm\<close> removes the goal protection, even if there are
   pending subgoals.
 \<close>
 
 
 section \<open>Tactics\label{sec:tactics}\<close>
 
 text \<open>
   A \<open>tactic\<close> is a function \<open>goal \<rightarrow> goal\<^sup>*\<^sup>*\<close> that maps a given goal state
   (represented as a theorem, cf.\ \secref{sec:tactical-goals}) to a lazy
   sequence of potential successor states. The underlying sequence
   implementation is lazy both in head and tail, and is purely functional in
   \<^emph>\<open>not\<close> supporting memoing.\<^footnote>\<open>The lack of memoing and the strict nature of ML
   requires some care when working with low-level sequence operations, to avoid
   duplicate or premature evaluation of results. It also means that modified
   runtime behavior, such as timeout, is very hard to achieve for general
   tactics.\<close>
 
   An \<^emph>\<open>empty result sequence\<close> means that the tactic has failed: in a compound
   tactic expression other tactics might be tried instead, or the whole
   refinement step might fail outright, producing a toplevel error message in
   the end. When implementing tactics from scratch, one should take care to
   observe the basic protocol of mapping regular error conditions to an empty
   result; only serious faults should emerge as exceptions.
 
   By enumerating \<^emph>\<open>multiple results\<close>, a tactic can easily express the
   potential outcome of an internal search process. There are also combinators
   for building proof tools that involve search systematically, see also
   \secref{sec:tacticals}.
 
   \<^medskip>
   As explained before, a goal state essentially consists of a list of subgoals
   that imply the main goal (conclusion). Tactics may operate on all subgoals
   or on a particularly specified subgoal, but must not change the main
   conclusion (apart from instantiating schematic goal variables).
 
   Tactics with explicit \<^emph>\<open>subgoal addressing\<close> are of the form \<open>int \<rightarrow> tactic\<close>
   and may be applied to a particular subgoal (counting from 1). If the subgoal
   number is out of range, the tactic should fail with an empty result
   sequence, but must not raise an exception!
 
   Operating on a particular subgoal means to replace it by an interval of zero
   or more subgoals in the same place; other subgoals must not be affected,
   apart from instantiating schematic variables ranging over the whole goal
   state.
 
   A common pattern of composing tactics with subgoal addressing is to try the
   first one, and then the second one only if the subgoal has not been solved
   yet. Special care is required here to avoid bumping into unrelated subgoals
   that happen to come after the original subgoal. Assuming that there is only
   a single initial subgoal is a very common error when implementing tactics!
 
   Tactics with internal subgoal addressing should expose the subgoal index as
   \<open>int\<close> argument in full generality; a hardwired subgoal 1 is not acceptable.
   
   \<^medskip>
   The main well-formedness conditions for proper tactics are summarized as
   follows.
 
     \<^item> General tactic failure is indicated by an empty result, only serious
     faults may produce an exception.
 
     \<^item> The main conclusion must not be changed, apart from instantiating
     schematic variables.
 
     \<^item> A tactic operates either uniformly on all subgoals, or specifically on a
     selected subgoal (without bumping into unrelated subgoals).
 
     \<^item> Range errors in subgoal addressing produce an empty result.
 
   Some of these conditions are checked by higher-level goal infrastructure
   (\secref{sec:struct-goals}); others are not checked explicitly, and
   violating them merely results in ill-behaved tactics experienced by the user
   (e.g.\ tactics that insist in being applicable only to singleton goals, or
   prevent composition via standard tacticals such as \<^ML>\<open>REPEAT\<close>).
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_type tactic: "thm -> thm Seq.seq"} \\
-  @{index_ML no_tac: tactic} \\
-  @{index_ML all_tac: tactic} \\
-  @{index_ML print_tac: "Proof.context -> string -> tactic"} \\[1ex]
-  @{index_ML PRIMITIVE: "(thm -> thm) -> tactic"} \\[1ex]
-  @{index_ML SUBGOAL: "(term * int -> tactic) -> int -> tactic"} \\
-  @{index_ML CSUBGOAL: "(cterm * int -> tactic) -> int -> tactic"} \\
-  @{index_ML SELECT_GOAL: "tactic -> int -> tactic"} \\
-  @{index_ML PREFER_GOAL: "tactic -> int -> tactic"} \\
+  @{define_ML_type tactic = "thm -> thm Seq.seq"} \\
+  @{define_ML no_tac: tactic} \\
+  @{define_ML all_tac: tactic} \\
+  @{define_ML print_tac: "Proof.context -> string -> tactic"} \\[1ex]
+  @{define_ML PRIMITIVE: "(thm -> thm) -> tactic"} \\[1ex]
+  @{define_ML SUBGOAL: "(term * int -> tactic) -> int -> tactic"} \\
+  @{define_ML CSUBGOAL: "(cterm * int -> tactic) -> int -> tactic"} \\
+  @{define_ML SELECT_GOAL: "tactic -> int -> tactic"} \\
+  @{define_ML PREFER_GOAL: "tactic -> int -> tactic"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>tactic\<close> represents tactics. The well-formedness conditions
   described above need to be observed. See also \<^file>\<open>~~/src/Pure/General/seq.ML\<close>
   for the underlying implementation of lazy sequences.
 
   \<^descr> Type \<^ML_type>\<open>int -> tactic\<close> represents tactics with explicit subgoal
   addressing, with well-formedness conditions as described above.
 
   \<^descr> \<^ML>\<open>no_tac\<close> is a tactic that always fails, returning the empty sequence.
 
   \<^descr> \<^ML>\<open>all_tac\<close> is a tactic that always succeeds, returning a singleton
   sequence with unchanged goal state.
 
   \<^descr> \<^ML>\<open>print_tac\<close>~\<open>ctxt message\<close> is like \<^ML>\<open>all_tac\<close>, but prints a message
   together with the goal state on the tracing channel.
 
   \<^descr> \<^ML>\<open>PRIMITIVE\<close>~\<open>rule\<close> turns a primitive inference rule into a tactic with
   unique result. Exception \<^ML>\<open>THM\<close> is considered a regular tactic failure
   and produces an empty result; other exceptions are passed through.
 
   \<^descr> \<^ML>\<open>SUBGOAL\<close>~\<open>(fn (subgoal, i) => tactic)\<close> is the most basic form to
   produce a tactic with subgoal addressing. The given abstraction over the
   subgoal term and subgoal number allows to peek at the relevant information
   of the full goal state. The subgoal range is checked as required above.
 
   \<^descr> \<^ML>\<open>CSUBGOAL\<close> is similar to \<^ML>\<open>SUBGOAL\<close>, but passes the subgoal as
   \<^ML_type>\<open>cterm\<close> instead of raw \<^ML_type>\<open>term\<close>. This avoids expensive
   re-certification in situations where the subgoal is used directly for
   primitive inferences.
 
   \<^descr> \<^ML>\<open>SELECT_GOAL\<close>~\<open>tac i\<close> confines a tactic to the specified subgoal \<open>i\<close>.
   This rearranges subgoals and the main goal protection
   (\secref{sec:tactical-goals}), while retaining the syntactic context of the
   overall goal state (concerning schematic variables etc.).
 
   \<^descr> \<^ML>\<open>PREFER_GOAL\<close>~\<open>tac i\<close> rearranges subgoals to put \<open>i\<close> in front. This is
   similar to \<^ML>\<open>SELECT_GOAL\<close>, but without changing the main goal protection.
 \<close>
 
 
 subsection \<open>Resolution and assumption tactics \label{sec:resolve-assume-tac}\<close>
 
 text \<open>
   \<^emph>\<open>Resolution\<close> is the most basic mechanism for refining a subgoal using a
   theorem as object-level rule. \<^emph>\<open>Elim-resolution\<close> is particularly suited for
   elimination rules: it resolves with a rule, proves its first premise by
   assumption, and finally deletes that assumption from any new subgoals.
   \<^emph>\<open>Destruct-resolution\<close> is like elim-resolution, but the given destruction
   rules are first turned into canonical elimination format.
   \<^emph>\<open>Forward-resolution\<close> is like destruct-resolution, but without deleting the
   selected assumption. The \<open>r/e/d/f\<close> naming convention is maintained for
   several different kinds of resolution rules and tactics.
 
   Assumption tactics close a subgoal by unifying some of its premises against
   its conclusion.
 
   \<^medskip>
   All the tactics in this section operate on a subgoal designated by a
   positive integer. Other subgoals might be affected indirectly, due to
   instantiation of schematic variables.
 
   There are various sources of non-determinism, the tactic result sequence
   enumerates all possibilities of the following choices (if applicable):
 
     \<^enum> selecting one of the rules given as argument to the tactic;
 
     \<^enum> selecting a subgoal premise to eliminate, unifying it against the first
     premise of the rule;
 
     \<^enum> unifying the conclusion of the subgoal to the conclusion of the rule.
 
   Recall that higher-order unification may produce multiple results that are
   enumerated here.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML resolve_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML eresolve_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML dresolve_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML forward_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML biresolve_tac: "Proof.context -> (bool * thm) list -> int -> tactic"} \\[1ex]
-  @{index_ML assume_tac: "Proof.context -> int -> tactic"} \\
-  @{index_ML eq_assume_tac: "int -> tactic"} \\[1ex]
-  @{index_ML match_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML ematch_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML dmatch_tac: "Proof.context -> thm list -> int -> tactic"} \\
-  @{index_ML bimatch_tac: "Proof.context -> (bool * thm) list -> int -> tactic"} \\
+  @{define_ML resolve_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML eresolve_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML dresolve_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML forward_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML biresolve_tac: "Proof.context -> (bool * thm) list -> int -> tactic"} \\[1ex]
+  @{define_ML assume_tac: "Proof.context -> int -> tactic"} \\
+  @{define_ML eq_assume_tac: "int -> tactic"} \\[1ex]
+  @{define_ML match_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML ematch_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML dmatch_tac: "Proof.context -> thm list -> int -> tactic"} \\
+  @{define_ML bimatch_tac: "Proof.context -> (bool * thm) list -> int -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>resolve_tac\<close>~\<open>ctxt thms i\<close> refines the goal state using the given
   theorems, which should normally be introduction rules. The tactic resolves a
   rule's conclusion with subgoal \<open>i\<close>, replacing it by the corresponding
   versions of the rule's premises.
 
   \<^descr> \<^ML>\<open>eresolve_tac\<close>~\<open>ctxt thms i\<close> performs elim-resolution with the given
   theorems, which are normally be elimination rules.
 
   Note that \<^ML_text>\<open>eresolve_tac ctxt [asm_rl]\<close> is equivalent to \<^ML_text>\<open>assume_tac ctxt\<close>, which facilitates mixing of assumption steps with
   genuine eliminations.
 
   \<^descr> \<^ML>\<open>dresolve_tac\<close>~\<open>ctxt thms i\<close> performs destruct-resolution with the
   given theorems, which should normally be destruction rules. This replaces an
   assumption by the result of applying one of the rules.
 
   \<^descr> \<^ML>\<open>forward_tac\<close> is like \<^ML>\<open>dresolve_tac\<close> except that the selected
   assumption is not deleted. It applies a rule to an assumption, adding the
   result as a new assumption.
 
   \<^descr> \<^ML>\<open>biresolve_tac\<close>~\<open>ctxt brls i\<close> refines the proof state by resolution or
   elim-resolution on each rule, as indicated by its flag. It affects subgoal
   \<open>i\<close> of the proof state.
 
   For each pair \<open>(flag, rule)\<close>, it applies resolution if the flag is \<open>false\<close>
   and elim-resolution if the flag is \<open>true\<close>. A single tactic call handles a
   mixture of introduction and elimination rules, which is useful to organize
   the search process systematically in proof tools.
 
   \<^descr> \<^ML>\<open>assume_tac\<close>~\<open>ctxt i\<close> attempts to solve subgoal \<open>i\<close> by assumption
   (modulo higher-order unification).
 
   \<^descr> \<^ML>\<open>eq_assume_tac\<close> is similar to \<^ML>\<open>assume_tac\<close>, but checks only for
   immediate \<open>\<alpha>\<close>-convertibility instead of using unification. It succeeds (with
   a unique next state) if one of the assumptions is equal to the subgoal's
   conclusion. Since it does not instantiate variables, it cannot make other
   subgoals unprovable.
 
   \<^descr> \<^ML>\<open>match_tac\<close>, \<^ML>\<open>ematch_tac\<close>, \<^ML>\<open>dmatch_tac\<close>, and \<^ML>\<open>bimatch_tac\<close>
   are similar to \<^ML>\<open>resolve_tac\<close>, \<^ML>\<open>eresolve_tac\<close>, \<^ML>\<open>dresolve_tac\<close>,
   and \<^ML>\<open>biresolve_tac\<close>, respectively, but do not instantiate schematic
   variables in the goal state.\<^footnote>\<open>Strictly speaking, matching means to treat the
   unknowns in the goal state as constants, but these tactics merely discard
   unifiers that would update the goal state. In rare situations (where the
   conclusion and goal state have flexible terms at the same position), the
   tactic will fail even though an acceptable unifier exists.\<close> These tactics
   were written for a specific application within the classical reasoner.
 
   Flexible subgoals are not updated at will, but are left alone.
 \<close>
 
 
 subsection \<open>Explicit instantiation within a subgoal context\<close>
 
 text \<open>
   The main resolution tactics (\secref{sec:resolve-assume-tac}) use
   higher-order unification, which works well in many practical situations
   despite its daunting theoretical properties. Nonetheless, there are
   important problem classes where unguided higher-order unification is not so
   useful. This typically involves rules like universal elimination,
   existential introduction, or equational substitution. Here the unification
   problem involves fully flexible \<open>?P ?x\<close> schemes, which are hard to manage
   without further hints.
 
   By providing a (small) rigid term for \<open>?x\<close> explicitly, the remaining
   unification problem is to assign a (large) term to \<open>?P\<close>, according to the
   shape of the given subgoal. This is sufficiently well-behaved in most
   practical situations.
 
   \<^medskip>
   Isabelle provides separate versions of the standard \<open>r/e/d/f\<close> resolution
   tactics that allow to provide explicit instantiations of unknowns of the
   given rule, wrt.\ terms that refer to the implicit context of the selected
   subgoal.
 
   An instantiation consists of a list of pairs of the form \<open>(?x, t)\<close>, where
   \<open>?x\<close> is a schematic variable occurring in the given rule, and \<open>t\<close> is a term
   from the current proof context, augmented by the local goal parameters of
   the selected subgoal; cf.\ the \<open>focus\<close> operation described in
   \secref{sec:variables}.
 
   Entering the syntactic context of a subgoal is a brittle operation, because
   its exact form is somewhat accidental, and the choice of bound variable
   names depends on the presence of other local and global names. Explicit
   renaming of subgoal parameters prior to explicit instantiation might help to
   achieve a bit more robustness.
 
   Type instantiations may be given as well, via pairs like \<open>(?'a, \<tau>)\<close>. Type
   instantiations are distinguished from term instantiations by the syntactic
   form of the schematic variable. Types are instantiated before terms are.
   Since term instantiation already performs simple type-inference, so explicit
   type instantiations are seldom necessary.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML Rule_Insts.res_inst_tac: "Proof.context ->
-    ((indexname * Position.T) * string) list -> (binding * string option * mixfix) list ->
-    thm -> int -> tactic"} \\
-  @{index_ML Rule_Insts.eres_inst_tac: "Proof.context ->
+  @{define_ML Rule_Insts.res_inst_tac: "Proof.context ->
     ((indexname * Position.T) * string) list -> (binding * string option * mixfix) list ->
     thm -> int -> tactic"} \\
-  @{index_ML Rule_Insts.dres_inst_tac: "Proof.context ->
+  @{define_ML Rule_Insts.eres_inst_tac: "Proof.context ->
     ((indexname * Position.T) * string) list -> (binding * string option * mixfix) list ->
     thm -> int -> tactic"} \\
-  @{index_ML Rule_Insts.forw_inst_tac: "Proof.context ->
+  @{define_ML Rule_Insts.dres_inst_tac: "Proof.context ->
     ((indexname * Position.T) * string) list -> (binding * string option * mixfix) list ->
     thm -> int -> tactic"} \\
-  @{index_ML Rule_Insts.subgoal_tac: "Proof.context -> string ->
+  @{define_ML Rule_Insts.forw_inst_tac: "Proof.context ->
+    ((indexname * Position.T) * string) list -> (binding * string option * mixfix) list ->
+    thm -> int -> tactic"} \\
+  @{define_ML Rule_Insts.subgoal_tac: "Proof.context -> string ->
     (binding * string option * mixfix) list -> int -> tactic"} \\
-  @{index_ML Rule_Insts.thin_tac: "Proof.context -> string ->
+  @{define_ML Rule_Insts.thin_tac: "Proof.context -> string ->
     (binding * string option * mixfix) list -> int -> tactic"} \\
-  @{index_ML rename_tac: "string list -> int -> tactic"} \\
+  @{define_ML rename_tac: "string list -> int -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Rule_Insts.res_inst_tac\<close>~\<open>ctxt insts thm i\<close> instantiates the rule
   \<open>thm\<close> with the instantiations \<open>insts\<close>, as described above, and then performs
   resolution on subgoal \<open>i\<close>.
   
   \<^descr> \<^ML>\<open>Rule_Insts.eres_inst_tac\<close> is like \<^ML>\<open>Rule_Insts.res_inst_tac\<close>, but
   performs elim-resolution.
 
   \<^descr> \<^ML>\<open>Rule_Insts.dres_inst_tac\<close> is like \<^ML>\<open>Rule_Insts.res_inst_tac\<close>, but
   performs destruct-resolution.
 
   \<^descr> \<^ML>\<open>Rule_Insts.forw_inst_tac\<close> is like \<^ML>\<open>Rule_Insts.dres_inst_tac\<close>
   except that the selected assumption is not deleted.
 
   \<^descr> \<^ML>\<open>Rule_Insts.subgoal_tac\<close>~\<open>ctxt \<phi> i\<close> adds the proposition \<open>\<phi>\<close> as local
   premise to subgoal \<open>i\<close>, and poses the same as a new subgoal \<open>i + 1\<close> (in the
   original context).
 
   \<^descr> \<^ML>\<open>Rule_Insts.thin_tac\<close>~\<open>ctxt \<phi> i\<close> deletes the specified premise from
   subgoal \<open>i\<close>. Note that \<open>\<phi>\<close> may contain schematic variables, to abbreviate
   the intended proposition; the first matching subgoal premise will be
   deleted. Removing useless premises from a subgoal increases its readability
   and can make search tactics run faster.
 
   \<^descr> \<^ML>\<open>rename_tac\<close>~\<open>names i\<close> renames the innermost parameters of subgoal \<open>i\<close>
   according to the provided \<open>names\<close> (which need to be distinct identifiers).
 
 
   For historical reasons, the above instantiation tactics take unparsed string
   arguments, which makes them hard to use in general ML code. The slightly
   more advanced \<^ML>\<open>Subgoal.FOCUS\<close> combinator of \secref{sec:struct-goals}
   allows to refer to internal goal structure with explicit context management.
 \<close>
 
 
 subsection \<open>Rearranging goal states\<close>
 
 text \<open>
   In rare situations there is a need to rearrange goal states: either the
   overall collection of subgoals, or the local structure of a subgoal. Various
   administrative tactics allow to operate on the concrete presentation these
   conceptual sets of formulae.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML rotate_tac: "int -> int -> tactic"} \\
-  @{index_ML distinct_subgoals_tac: tactic} \\
-  @{index_ML flexflex_tac: "Proof.context -> tactic"} \\
+  @{define_ML rotate_tac: "int -> int -> tactic"} \\
+  @{define_ML distinct_subgoals_tac: tactic} \\
+  @{define_ML flexflex_tac: "Proof.context -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>rotate_tac\<close>~\<open>n i\<close> rotates the premises of subgoal \<open>i\<close> by \<open>n\<close>
   positions: from right to left if \<open>n\<close> is positive, and from left to right if
   \<open>n\<close> is negative.
 
   \<^descr> \<^ML>\<open>distinct_subgoals_tac\<close> removes duplicate subgoals from a proof state.
   This is potentially inefficient.
 
   \<^descr> \<^ML>\<open>flexflex_tac\<close> removes all flex-flex pairs from the proof state by
   applying the trivial unifier. This drastic step loses information. It is
   already part of the Isar infrastructure for facts resulting from goals, and
   rarely needs to be invoked manually.
 
   Flex-flex constraints arise from difficult cases of higher-order
   unification. To prevent this, use \<^ML>\<open>Rule_Insts.res_inst_tac\<close> to
   instantiate some variables in a rule. Normally flex-flex constraints can be
   ignored; they often disappear as unknowns get instantiated.
 \<close>
 
 
 subsection \<open>Raw composition: resolution without lifting\<close>
 
 text \<open>
   Raw composition of two rules means resolving them without prior lifting or
   renaming of unknowns. This low-level operation, which underlies the
   resolution tactics, may occasionally be useful for special effects.
   Schematic variables are not renamed by default, so beware of clashes!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML compose_tac: "Proof.context -> (bool * thm * int) -> int -> tactic"} \\
-  @{index_ML Drule.compose: "thm * int * thm -> thm"} \\
-  @{index_ML_op COMP: "thm * thm -> thm"} \\
+  @{define_ML compose_tac: "Proof.context -> (bool * thm * int) -> int -> tactic"} \\
+  @{define_ML Drule.compose: "thm * int * thm -> thm"} \\
+  @{define_ML_infix COMP: "thm * thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>compose_tac\<close>~\<open>ctxt (flag, rule, m) i\<close> refines subgoal \<open>i\<close> using
   \<open>rule\<close>, without lifting. The \<open>rule\<close> is taken to have the form \<open>\<psi>\<^sub>1 \<Longrightarrow> \<dots> \<psi>\<^sub>m \<Longrightarrow>
   \<psi>\<close>, where \<open>\<psi>\<close> need not be atomic; thus \<open>m\<close> determines the number of new
   subgoals. If \<open>flag\<close> is \<open>true\<close> then it performs elim-resolution --- it solves
   the first premise of \<open>rule\<close> by assumption and deletes that assumption.
 
   \<^descr> \<^ML>\<open>Drule.compose\<close>~\<open>(thm\<^sub>1, i, thm\<^sub>2)\<close> uses \<open>thm\<^sub>1\<close>, regarded as an
   atomic formula, to solve premise \<open>i\<close> of \<open>thm\<^sub>2\<close>. Let \<open>thm\<^sub>1\<close> and \<open>thm\<^sub>2\<close> be
   \<open>\<psi>\<close> and \<open>\<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> \<phi>\<close>. The unique \<open>s\<close> that unifies \<open>\<psi>\<close> and \<open>\<phi>\<^sub>i\<close> yields
   the theorem \<open>(\<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>i\<^sub>-\<^sub>1 \<Longrightarrow> \<phi>\<^sub>i\<^sub>+\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> \<phi>)s\<close>. Multiple results are
   considered as error (exception \<^ML>\<open>THM\<close>).
 
   \<^descr> \<open>thm\<^sub>1 COMP thm\<^sub>2\<close> is the same as \<open>Drule.compose (thm\<^sub>1, 1, thm\<^sub>2)\<close>.
 
 
   \begin{warn}
   These low-level operations are stepping outside the structure imposed by
   regular rule resolution. Used without understanding of the consequences,
   they may produce results that cause problems with standard rules and tactics
   later on.
   \end{warn}
 \<close>
 
 
 section \<open>Tacticals \label{sec:tacticals}\<close>
 
 text \<open>
   A \<^emph>\<open>tactical\<close> is a functional combinator for building up complex tactics
   from simpler ones. Common tacticals perform sequential composition,
   disjunctive choice, iteration, or goal addressing. Various search strategies
   may be expressed via tacticals.
 \<close>
 
 
 subsection \<open>Combining tactics\<close>
 
 text \<open>
   Sequential composition and alternative choices are the most basic ways to
   combine tactics, similarly to ``\<^verbatim>\<open>,\<close>'' and ``\<^verbatim>\<open>|\<close>'' in Isar method notation.
-  This corresponds to \<^ML_op>\<open>THEN\<close> and \<^ML_op>\<open>ORELSE\<close> in ML, but there
+  This corresponds to \<^ML_infix>\<open>THEN\<close> and \<^ML_infix>\<open>ORELSE\<close> in ML, but there
   are further possibilities for fine-tuning alternation of tactics such as
-  \<^ML_op>\<open>APPEND\<close>. Further details become visible in ML due to explicit
+  \<^ML_infix>\<open>APPEND\<close>. Further details become visible in ML due to explicit
   subgoal addressing.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML_op "THEN": "tactic * tactic -> tactic"} \\
-  @{index_ML_op "ORELSE": "tactic * tactic -> tactic"} \\
-  @{index_ML_op "APPEND": "tactic * tactic -> tactic"} \\
-  @{index_ML "EVERY": "tactic list -> tactic"} \\
-  @{index_ML "FIRST": "tactic list -> tactic"} \\[0.5ex]
+  @{define_ML_infix "THEN": "tactic * tactic -> tactic"} \\
+  @{define_ML_infix "ORELSE": "tactic * tactic -> tactic"} \\
+  @{define_ML_infix "APPEND": "tactic * tactic -> tactic"} \\
+  @{define_ML "EVERY": "tactic list -> tactic"} \\
+  @{define_ML "FIRST": "tactic list -> tactic"} \\[0.5ex]
 
-  @{index_ML_op "THEN'": "('a -> tactic) * ('a -> tactic) -> 'a -> tactic"} \\
-  @{index_ML_op "ORELSE'": "('a -> tactic) * ('a -> tactic) -> 'a -> tactic"} \\
-  @{index_ML_op "APPEND'": "('a -> tactic) * ('a -> tactic) -> 'a -> tactic"} \\
-  @{index_ML "EVERY'": "('a -> tactic) list -> 'a -> tactic"} \\
-  @{index_ML "FIRST'": "('a -> tactic) list -> 'a -> tactic"} \\
+  @{define_ML_infix "THEN'": "('a -> tactic) * ('a -> tactic) -> 'a -> tactic"} \\
+  @{define_ML_infix "ORELSE'": "('a -> tactic) * ('a -> tactic) -> 'a -> tactic"} \\
+  @{define_ML_infix "APPEND'": "('a -> tactic) * ('a -> tactic) -> 'a -> tactic"} \\
+  @{define_ML "EVERY'": "('a -> tactic) list -> 'a -> tactic"} \\
+  @{define_ML "FIRST'": "('a -> tactic) list -> 'a -> tactic"} \\
   \end{mldecls}
 
-  \<^descr> \<open>tac\<^sub>1\<close>~\<^ML_op>\<open>THEN\<close>~\<open>tac\<^sub>2\<close> is the sequential composition of \<open>tac\<^sub>1\<close> and
+  \<^descr> \<open>tac\<^sub>1\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>tac\<^sub>2\<close> is the sequential composition of \<open>tac\<^sub>1\<close> and
   \<open>tac\<^sub>2\<close>. Applied to a goal state, it returns all states reachable in two
   steps by applying \<open>tac\<^sub>1\<close> followed by \<open>tac\<^sub>2\<close>. First, it applies \<open>tac\<^sub>1\<close> to
   the goal state, getting a sequence of possible next states; then, it applies
   \<open>tac\<^sub>2\<close> to each of these and concatenates the results to produce again one
   flat sequence of states.
 
-  \<^descr> \<open>tac\<^sub>1\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>tac\<^sub>2\<close> makes a choice between \<open>tac\<^sub>1\<close> and
+  \<^descr> \<open>tac\<^sub>1\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>tac\<^sub>2\<close> makes a choice between \<open>tac\<^sub>1\<close> and
   \<open>tac\<^sub>2\<close>. Applied to a state, it tries \<open>tac\<^sub>1\<close> and returns the result if
   non-empty; if \<open>tac\<^sub>1\<close> fails then it uses \<open>tac\<^sub>2\<close>. This is a deterministic
   choice: if \<open>tac\<^sub>1\<close> succeeds then \<open>tac\<^sub>2\<close> is excluded from the result.
 
-  \<^descr> \<open>tac\<^sub>1\<close>~\<^ML_op>\<open>APPEND\<close>~\<open>tac\<^sub>2\<close> concatenates the possible results of
-  \<open>tac\<^sub>1\<close> and \<open>tac\<^sub>2\<close>. Unlike \<^ML_op>\<open>ORELSE\<close> there is \<^emph>\<open>no commitment\<close> to
-  either tactic, so \<^ML_op>\<open>APPEND\<close> helps to avoid incompleteness during
+  \<^descr> \<open>tac\<^sub>1\<close>~\<^ML_infix>\<open>APPEND\<close>~\<open>tac\<^sub>2\<close> concatenates the possible results of
+  \<open>tac\<^sub>1\<close> and \<open>tac\<^sub>2\<close>. Unlike \<^ML_infix>\<open>ORELSE\<close> there is \<^emph>\<open>no commitment\<close> to
+  either tactic, so \<^ML_infix>\<open>APPEND\<close> helps to avoid incompleteness during
   search, at the cost of potential inefficiencies.
 
-  \<^descr> \<^ML>\<open>EVERY\<close>~\<open>[tac\<^sub>1, \<dots>, tac\<^sub>n]\<close> abbreviates \<open>tac\<^sub>1\<close>~\<^ML_op>\<open>THEN\<close>~\<open>\<dots>\<close>~\<^ML_op>\<open>THEN\<close>~\<open>tac\<^sub>n\<close>. Note that \<^ML>\<open>EVERY []\<close> is the same as
+  \<^descr> \<^ML>\<open>EVERY\<close>~\<open>[tac\<^sub>1, \<dots>, tac\<^sub>n]\<close> abbreviates \<open>tac\<^sub>1\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>\<dots>\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>tac\<^sub>n\<close>. Note that \<^ML>\<open>EVERY []\<close> is the same as
   \<^ML>\<open>all_tac\<close>: it always succeeds.
 
-  \<^descr> \<^ML>\<open>FIRST\<close>~\<open>[tac\<^sub>1, \<dots>, tac\<^sub>n]\<close> abbreviates \<open>tac\<^sub>1\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>\<dots>\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>tac\<^sub>n\<close>. Note that \<^ML>\<open>FIRST []\<close> is the
+  \<^descr> \<^ML>\<open>FIRST\<close>~\<open>[tac\<^sub>1, \<dots>, tac\<^sub>n]\<close> abbreviates \<open>tac\<^sub>1\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>\<dots>\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>tac\<^sub>n\<close>. Note that \<^ML>\<open>FIRST []\<close> is the
   same as \<^ML>\<open>no_tac\<close>: it always fails.
 
-  \<^descr> \<^ML_op>\<open>THEN'\<close> is the lifted version of \<^ML_op>\<open>THEN\<close>, for tactics
-  with explicit subgoal addressing. So \<open>(tac\<^sub>1\<close>~\<^ML_op>\<open>THEN'\<close>~\<open>tac\<^sub>2) i\<close> is
-  the same as \<open>(tac\<^sub>1 i\<close>~\<^ML_op>\<open>THEN\<close>~\<open>tac\<^sub>2 i)\<close>.
+  \<^descr> \<^ML_infix>\<open>THEN'\<close> is the lifted version of \<^ML_infix>\<open>THEN\<close>, for tactics
+  with explicit subgoal addressing. So \<open>(tac\<^sub>1\<close>~\<^ML_infix>\<open>THEN'\<close>~\<open>tac\<^sub>2) i\<close> is
+  the same as \<open>(tac\<^sub>1 i\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>tac\<^sub>2 i)\<close>.
 
   The other primed tacticals work analogously.
 \<close>
 
 
 subsection \<open>Repetition tacticals\<close>
 
 text \<open>
   These tacticals provide further control over repetition of tactics, beyond
   the stylized forms of ``\<^verbatim>\<open>?\<close>'' and ``\<^verbatim>\<open>+\<close>'' in Isar method expressions.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML "TRY": "tactic -> tactic"} \\
-  @{index_ML "REPEAT": "tactic -> tactic"} \\
-  @{index_ML "REPEAT1": "tactic -> tactic"} \\
-  @{index_ML "REPEAT_DETERM": "tactic -> tactic"} \\
-  @{index_ML "REPEAT_DETERM_N": "int -> tactic -> tactic"} \\
+  @{define_ML "TRY": "tactic -> tactic"} \\
+  @{define_ML "REPEAT": "tactic -> tactic"} \\
+  @{define_ML "REPEAT1": "tactic -> tactic"} \\
+  @{define_ML "REPEAT_DETERM": "tactic -> tactic"} \\
+  @{define_ML "REPEAT_DETERM_N": "int -> tactic -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>TRY\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state and returns the resulting
   sequence, if non-empty; otherwise it returns the original state. Thus, it
   applies \<open>tac\<close> at most once.
 
   Note that for tactics with subgoal addressing, the combinator can be applied
-  via functional composition: \<^ML>\<open>TRY\<close>~\<^ML_op>\<open>o\<close>~\<open>tac\<close>. There is no need
+  via functional composition: \<^ML>\<open>TRY\<close>~\<^ML_infix>\<open>o\<close>~\<open>tac\<close>. There is no need
   for \<^verbatim>\<open>TRY'\<close>.
 
   \<^descr> \<^ML>\<open>REPEAT\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state and, recursively, to
   each element of the resulting sequence. The resulting sequence consists of
   those states that make \<open>tac\<close> fail. Thus, it applies \<open>tac\<close> as many times as
   possible (including zero times), and allows backtracking over each
   invocation of \<open>tac\<close>. \<^ML>\<open>REPEAT\<close> is more general than \<^ML>\<open>REPEAT_DETERM\<close>,
   but requires more space.
 
   \<^descr> \<^ML>\<open>REPEAT1\<close>~\<open>tac\<close> is like \<^ML>\<open>REPEAT\<close>~\<open>tac\<close> but it always applies \<open>tac\<close>
   at least once, failing if this is impossible.
 
   \<^descr> \<^ML>\<open>REPEAT_DETERM\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state and,
   recursively, to the head of the resulting sequence. It returns the first
   state to make \<open>tac\<close> fail. It is deterministic, discarding alternative
   outcomes.
 
   \<^descr> \<^ML>\<open>REPEAT_DETERM_N\<close>~\<open>n tac\<close> is like \<^ML>\<open>REPEAT_DETERM\<close>~\<open>tac\<close> but the
   number of repetitions is bound by \<open>n\<close> (where \<^ML>\<open>~1\<close> means \<open>\<infinity>\<close>).
 \<close>
 
 text %mlex \<open>
   The basic tactics and tacticals considered above follow some algebraic laws:
 
-  \<^item> \<^ML>\<open>all_tac\<close> is the identity element of the tactical \<^ML_op>\<open>THEN\<close>.
+  \<^item> \<^ML>\<open>all_tac\<close> is the identity element of the tactical \<^ML_infix>\<open>THEN\<close>.
 
-  \<^item> \<^ML>\<open>no_tac\<close> is the identity element of \<^ML_op>\<open>ORELSE\<close> and \<^ML_op>\<open>APPEND\<close>. Also, it is a zero element for \<^ML_op>\<open>THEN\<close>, which means that
-  \<open>tac\<close>~\<^ML_op>\<open>THEN\<close>~\<^ML>\<open>no_tac\<close> is equivalent to \<^ML>\<open>no_tac\<close>.
+  \<^item> \<^ML>\<open>no_tac\<close> is the identity element of \<^ML_infix>\<open>ORELSE\<close> and \<^ML_infix>\<open>APPEND\<close>. Also, it is a zero element for \<^ML_infix>\<open>THEN\<close>, which means that
+  \<open>tac\<close>~\<^ML_infix>\<open>THEN\<close>~\<^ML>\<open>no_tac\<close> is equivalent to \<^ML>\<open>no_tac\<close>.
 
   \<^item> \<^ML>\<open>TRY\<close> and \<^ML>\<open>REPEAT\<close> can be expressed as (recursive) functions over
   more basic combinators (ignoring some internal implementation tricks):
 \<close>
 
 ML \<open>
   fun TRY tac = tac ORELSE all_tac;
   fun REPEAT tac st = ((tac THEN REPEAT tac) ORELSE all_tac) st;
 \<close>
 
 text \<open>
-  If \<open>tac\<close> can return multiple outcomes then so can \<^ML>\<open>REPEAT\<close>~\<open>tac\<close>. \<^ML>\<open>REPEAT\<close> uses \<^ML_op>\<open>ORELSE\<close> and not \<^ML_op>\<open>APPEND\<close>, it applies \<open>tac\<close>
+  If \<open>tac\<close> can return multiple outcomes then so can \<^ML>\<open>REPEAT\<close>~\<open>tac\<close>. \<^ML>\<open>REPEAT\<close> uses \<^ML_infix>\<open>ORELSE\<close> and not \<^ML_infix>\<open>APPEND\<close>, it applies \<open>tac\<close>
   as many times as possible in each outcome.
 
   \begin{warn}
   Note the explicit abstraction over the goal state in the ML definition of
   \<^ML>\<open>REPEAT\<close>. Recursive tacticals must be coded in this awkward fashion to
   avoid infinite recursion of eager functional evaluation in Standard ML. The
   following attempt would make \<^ML>\<open>REPEAT\<close>~\<open>tac\<close> loop:
   \end{warn}
 \<close>
 
 ML_val \<open>
   (*BAD -- does not terminate!*)
   fun REPEAT tac = (tac THEN REPEAT tac) ORELSE all_tac;
 \<close>
 
 
 subsection \<open>Applying tactics to subgoal ranges\<close>
 
 text \<open>
   Tactics with explicit subgoal addressing \<^ML_type>\<open>int -> tactic\<close> can be
   used together with tacticals that act like ``subgoal quantifiers'': guided
   by success of the body tactic a certain range of subgoals is covered. Thus
   the body tactic is applied to \<^emph>\<open>all\<close> subgoals, \<^emph>\<open>some\<close> subgoal etc.
 
   Suppose that the goal state has \<open>n \<ge> 0\<close> subgoals. Many of these tacticals
   address subgoal ranges counting downwards from \<open>n\<close> towards \<open>1\<close>. This has the
   fortunate effect that newly emerging subgoals are concatenated in the
   result, without interfering each other. Nonetheless, there might be
   situations where a different order is desired.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
-  @{index_ML ALLGOALS: "(int -> tactic) -> tactic"} \\
-  @{index_ML SOMEGOAL: "(int -> tactic) -> tactic"} \\
-  @{index_ML FIRSTGOAL: "(int -> tactic) -> tactic"} \\
-  @{index_ML HEADGOAL: "(int -> tactic) -> tactic"} \\
-  @{index_ML REPEAT_SOME: "(int -> tactic) -> tactic"} \\
-  @{index_ML REPEAT_FIRST: "(int -> tactic) -> tactic"} \\
-  @{index_ML RANGE: "(int -> tactic) list -> int -> tactic"} \\
+  @{define_ML ALLGOALS: "(int -> tactic) -> tactic"} \\
+  @{define_ML SOMEGOAL: "(int -> tactic) -> tactic"} \\
+  @{define_ML FIRSTGOAL: "(int -> tactic) -> tactic"} \\
+  @{define_ML HEADGOAL: "(int -> tactic) -> tactic"} \\
+  @{define_ML REPEAT_SOME: "(int -> tactic) -> tactic"} \\
+  @{define_ML REPEAT_FIRST: "(int -> tactic) -> tactic"} \\
+  @{define_ML RANGE: "(int -> tactic) list -> int -> tactic"} \\
   \end{mldecls}
 
-  \<^descr> \<^ML>\<open>ALLGOALS\<close>~\<open>tac\<close> is equivalent to \<open>tac n\<close>~\<^ML_op>\<open>THEN\<close>~\<open>\<dots>\<close>~\<^ML_op>\<open>THEN\<close>~\<open>tac 1\<close>. It applies the \<open>tac\<close> to all the subgoals, counting downwards.
+  \<^descr> \<^ML>\<open>ALLGOALS\<close>~\<open>tac\<close> is equivalent to \<open>tac n\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>\<dots>\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>tac 1\<close>. It applies the \<open>tac\<close> to all the subgoals, counting downwards.
 
-  \<^descr> \<^ML>\<open>SOMEGOAL\<close>~\<open>tac\<close> is equivalent to \<open>tac n\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>\<dots>\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>tac 1\<close>. It applies \<open>tac\<close> to one subgoal, counting downwards.
+  \<^descr> \<^ML>\<open>SOMEGOAL\<close>~\<open>tac\<close> is equivalent to \<open>tac n\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>\<dots>\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>tac 1\<close>. It applies \<open>tac\<close> to one subgoal, counting downwards.
 
-  \<^descr> \<^ML>\<open>FIRSTGOAL\<close>~\<open>tac\<close> is equivalent to \<open>tac 1\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>\<dots>\<close>~\<^ML_op>\<open>ORELSE\<close>~\<open>tac n\<close>. It applies \<open>tac\<close> to one subgoal, counting upwards.
+  \<^descr> \<^ML>\<open>FIRSTGOAL\<close>~\<open>tac\<close> is equivalent to \<open>tac 1\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>\<dots>\<close>~\<^ML_infix>\<open>ORELSE\<close>~\<open>tac n\<close>. It applies \<open>tac\<close> to one subgoal, counting upwards.
 
   \<^descr> \<^ML>\<open>HEADGOAL\<close>~\<open>tac\<close> is equivalent to \<open>tac 1\<close>. It applies \<open>tac\<close>
   unconditionally to the first subgoal.
 
   \<^descr> \<^ML>\<open>REPEAT_SOME\<close>~\<open>tac\<close> applies \<open>tac\<close> once or more to a subgoal, counting
   downwards.
 
   \<^descr> \<^ML>\<open>REPEAT_FIRST\<close>~\<open>tac\<close> applies \<open>tac\<close> once or more to a subgoal, counting
   upwards.
 
   \<^descr> \<^ML>\<open>RANGE\<close>~\<open>[tac\<^sub>1, \<dots>, tac\<^sub>k] i\<close> is equivalent to \<open>tac\<^sub>k (i + k -
-  1)\<close>~\<^ML_op>\<open>THEN\<close>~\<open>\<dots>\<close>~\<^ML_op>\<open>THEN\<close>~\<open>tac\<^sub>1 i\<close>. It applies the given list of
+  1)\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>\<dots>\<close>~\<^ML_infix>\<open>THEN\<close>~\<open>tac\<^sub>1 i\<close>. It applies the given list of
   tactics to the corresponding range of subgoals, counting downwards.
 \<close>
 
 
 subsection \<open>Control and search tacticals\<close>
 
 text \<open>
   A predicate on theorems \<^ML_type>\<open>thm -> bool\<close> can test whether a goal
   state enjoys some desirable property --- such as having no subgoals. Tactics
   that search for satisfactory goal states are easy to express. The main
   search procedures, depth-first, breadth-first and best-first, are provided
   as tacticals. They generate the search tree by repeatedly applying a given
   tactic.
 \<close>
 
 
 text %mlref ""
 
 subsubsection \<open>Filtering a tactic's results\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML FILTER: "(thm -> bool) -> tactic -> tactic"} \\
-  @{index_ML CHANGED: "tactic -> tactic"} \\
+  @{define_ML FILTER: "(thm -> bool) -> tactic -> tactic"} \\
+  @{define_ML CHANGED: "tactic -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>FILTER\<close>~\<open>sat tac\<close> applies \<open>tac\<close> to the goal state and returns a
   sequence consisting of those result goal states that are satisfactory in the
   sense of \<open>sat\<close>.
 
   \<^descr> \<^ML>\<open>CHANGED\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state and returns precisely
   those states that differ from the original state (according to \<^ML>\<open>Thm.eq_thm\<close>). Thus \<^ML>\<open>CHANGED\<close>~\<open>tac\<close> always has some effect on the state.
 \<close>
 
 
 subsubsection \<open>Depth-first search\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML DEPTH_FIRST: "(thm -> bool) -> tactic -> tactic"} \\
-  @{index_ML DEPTH_SOLVE: "tactic -> tactic"} \\
-  @{index_ML DEPTH_SOLVE_1: "tactic -> tactic"} \\
+  @{define_ML DEPTH_FIRST: "(thm -> bool) -> tactic -> tactic"} \\
+  @{define_ML DEPTH_SOLVE: "tactic -> tactic"} \\
+  @{define_ML DEPTH_SOLVE_1: "tactic -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>DEPTH_FIRST\<close>~\<open>sat tac\<close> returns the goal state if \<open>sat\<close> returns true.
   Otherwise it applies \<open>tac\<close>, then recursively searches from each element of
   the resulting sequence. The code uses a stack for efficiency, in effect
-  applying \<open>tac\<close>~\<^ML_op>\<open>THEN\<close>~\<^ML>\<open>DEPTH_FIRST\<close>~\<open>sat tac\<close> to the state.
+  applying \<open>tac\<close>~\<^ML_infix>\<open>THEN\<close>~\<^ML>\<open>DEPTH_FIRST\<close>~\<open>sat tac\<close> to the state.
 
   \<^descr> \<^ML>\<open>DEPTH_SOLVE\<close>\<open>tac\<close> uses \<^ML>\<open>DEPTH_FIRST\<close> to search for states having
   no subgoals.
 
   \<^descr> \<^ML>\<open>DEPTH_SOLVE_1\<close>~\<open>tac\<close> uses \<^ML>\<open>DEPTH_FIRST\<close> to search for states
   having fewer subgoals than the given state. Thus, it insists upon solving at
   least one subgoal.
 \<close>
 
 
 subsubsection \<open>Other search strategies\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML BREADTH_FIRST: "(thm -> bool) -> tactic -> tactic"} \\
-  @{index_ML BEST_FIRST: "(thm -> bool) * (thm -> int) -> tactic -> tactic"} \\
-  @{index_ML THEN_BEST_FIRST: "tactic -> (thm -> bool) * (thm -> int) -> tactic -> tactic"} \\
+  @{define_ML BREADTH_FIRST: "(thm -> bool) -> tactic -> tactic"} \\
+  @{define_ML BEST_FIRST: "(thm -> bool) * (thm -> int) -> tactic -> tactic"} \\
+  @{define_ML THEN_BEST_FIRST: "tactic -> (thm -> bool) * (thm -> int) -> tactic -> tactic"} \\
   \end{mldecls}
 
   These search strategies will find a solution if one exists. However, they do
   not enumerate all solutions; they terminate after the first satisfactory
   result from \<open>tac\<close>.
 
   \<^descr> \<^ML>\<open>BREADTH_FIRST\<close>~\<open>sat tac\<close> uses breadth-first search to find states for
   which \<open>sat\<close> is true. For most applications, it is too slow.
 
   \<^descr> \<^ML>\<open>BEST_FIRST\<close>~\<open>(sat, dist) tac\<close> does a heuristic search, using \<open>dist\<close>
   to estimate the distance from a satisfactory state (in the sense of \<open>sat\<close>).
   It maintains a list of states ordered by distance. It applies \<open>tac\<close> to the
   head of this list; if the result contains any satisfactory states, then it
   returns them. Otherwise, \<^ML>\<open>BEST_FIRST\<close> adds the new states to the list,
   and continues.
 
   The distance function is typically \<^ML>\<open>size_of_thm\<close>, which computes the
   size of the state. The smaller the state, the fewer and simpler subgoals it
   has.
 
   \<^descr> \<^ML>\<open>THEN_BEST_FIRST\<close>~\<open>tac\<^sub>0 (sat, dist) tac\<close> is like \<^ML>\<open>BEST_FIRST\<close>,
   except that the priority queue initially contains the result of applying
   \<open>tac\<^sub>0\<close> to the goal state. This tactical permits separate tactics for
   starting the search and continuing the search.
 \<close>
 
 
 subsubsection \<open>Auxiliary tacticals for searching\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML COND: "(thm -> bool) -> tactic -> tactic -> tactic"} \\
-  @{index_ML IF_UNSOLVED: "tactic -> tactic"} \\
-  @{index_ML SOLVE: "tactic -> tactic"} \\
-  @{index_ML DETERM: "tactic -> tactic"} \\
+  @{define_ML COND: "(thm -> bool) -> tactic -> tactic -> tactic"} \\
+  @{define_ML IF_UNSOLVED: "tactic -> tactic"} \\
+  @{define_ML SOLVE: "tactic -> tactic"} \\
+  @{define_ML DETERM: "tactic -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>COND\<close>~\<open>sat tac\<^sub>1 tac\<^sub>2\<close> applies \<open>tac\<^sub>1\<close> to the goal state if it
   satisfies predicate \<open>sat\<close>, and applies \<open>tac\<^sub>2\<close>. It is a conditional tactical
   in that only one of \<open>tac\<^sub>1\<close> and \<open>tac\<^sub>2\<close> is applied to a goal state. However,
   both \<open>tac\<^sub>1\<close> and \<open>tac\<^sub>2\<close> are evaluated because ML uses eager evaluation.
 
   \<^descr> \<^ML>\<open>IF_UNSOLVED\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state if it has any
   subgoals, and simply returns the goal state otherwise. Many common tactics,
   such as \<^ML>\<open>resolve_tac\<close>, fail if applied to a goal state that has no
   subgoals.
 
   \<^descr> \<^ML>\<open>SOLVE\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state and then fails iff there
   are subgoals left.
 
   \<^descr> \<^ML>\<open>DETERM\<close>~\<open>tac\<close> applies \<open>tac\<close> to the goal state and returns the head of
   the resulting sequence. \<^ML>\<open>DETERM\<close> limits the search space by making its
   argument deterministic.
 \<close>
 
 
 subsubsection \<open>Predicates and functions useful for searching\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML has_fewer_prems: "int -> thm -> bool"} \\
-  @{index_ML Thm.eq_thm: "thm * thm -> bool"} \\
-  @{index_ML Thm.eq_thm_prop: "thm * thm -> bool"} \\
-  @{index_ML size_of_thm: "thm -> int"} \\
+  @{define_ML has_fewer_prems: "int -> thm -> bool"} \\
+  @{define_ML Thm.eq_thm: "thm * thm -> bool"} \\
+  @{define_ML Thm.eq_thm_prop: "thm * thm -> bool"} \\
+  @{define_ML size_of_thm: "thm -> int"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>has_fewer_prems\<close>~\<open>n thm\<close> reports whether \<open>thm\<close> has fewer than \<open>n\<close>
   premises.
 
   \<^descr> \<^ML>\<open>Thm.eq_thm\<close>~\<open>(thm\<^sub>1, thm\<^sub>2)\<close> reports whether \<open>thm\<^sub>1\<close> and \<open>thm\<^sub>2\<close> are
   equal. Both theorems must have the same conclusions, the same set of
   hypotheses, and the same set of sort hypotheses. Names of bound variables
   are ignored as usual.
 
   \<^descr> \<^ML>\<open>Thm.eq_thm_prop\<close>~\<open>(thm\<^sub>1, thm\<^sub>2)\<close> reports whether the propositions of
   \<open>thm\<^sub>1\<close> and \<open>thm\<^sub>2\<close> are equal. Names of bound variables are ignored.
 
   \<^descr> \<^ML>\<open>size_of_thm\<close>~\<open>thm\<close> computes the size of \<open>thm\<close>, namely the number of
   variables, constants and abstractions in its conclusion. It may serve as a
   distance function for \<^ML>\<open>BEST_FIRST\<close>.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/document/build b/src/Doc/Implementation/document/build
deleted file mode 100755
--- a/src/Doc/Implementation/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo Isar
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Implementation/document/root.tex b/src/Doc/Implementation/document/root.tex
--- a/src/Doc/Implementation/document/root.tex
+++ b/src/Doc/Implementation/document/root.tex
@@ -1,124 +1,124 @@
 \documentclass[12pt,a4paper,fleqn]{report}
 \usepackage[T1]{fontenc}
 \usepackage{graphicx}
 \usepackage[refpage]{nomencl}
 \usepackage{iman,extra,isar,proof}
 \usepackage[nohyphen,strings]{underscore}
 \usepackage{isabelle}
 \usepackage{isabellesym}
 \usepackage{railsetup}
 \usepackage{supertabular}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 
 \isadroptag{theory}
-\title{\includegraphics[scale=0.5]{isabelle_isar}
+\title{\includegraphics[scale=0.5]{isabelle_logo}
   \\[4ex] The Isabelle/Isar Implementation}
 \author{\emph{Makarius Wenzel}  \\[3ex]
   With Contributions by
   Stefan Berghofer, \\
   Florian Haftmann
   and Larry Paulson
 }
 
 \makeindex
 
 
 \begin{document}
 
 \maketitle
 
 \begin{abstract}
   We describe the key concepts underlying the Isabelle/Isar
   implementation, including ML references for the most important
   functions.  The aim is to give some insight into the overall system
   architecture, and provide clues on implementing applications within
   this framework.
 \end{abstract}
 
 \vspace*{2.5cm}
 \begin{quote}
 
   {\small\em Isabelle was not designed; it evolved.  Not everyone
     likes this idea.  Specification experts rightly abhor
     trial-and-error programming.  They suggest that no one should
     write a program without first writing a complete formal
     specification. But university departments are not software houses.
     Programs like Isabelle are not products: when they have served
     their purpose, they are discarded.}
 
   Lawrence C. Paulson, ``Isabelle: The Next 700 Theorem Provers''
 
   \vspace*{1cm}
 
   {\small\em As I did 20 years ago, I still fervently believe that the
     only way to make software secure, reliable, and fast is to make it
     small.  Fight features.}
 
   Andrew S. Tanenbaum
 
   \vspace*{1cm}
 
   {\small\em One thing that UNIX does not need is more features. It is
     successful in part because it has a small number of good ideas
     that work well together. Merely adding features does not make it
     easier for users to do things --- it just makes the manual
     thicker. The right solution in the right place is always more
     effective than haphazard hacking.}
 
   Rob Pike and Brian W. Kernighan
 
   \vspace*{1cm}
 
   {\small\em If you look at software today, through the lens of the
     history of engineering, it's certainly engineering of a sort--but
     it's the kind of engineering that people without the concept of
     the arch did. Most software today is very much like an Egyptian
     pyramid with millions of bricks piled on top of each other, with
     no structural integrity, but just done by brute force and
     thousands of slaves.}
 
   Alan Kay
 
 \end{quote}
 
 \thispagestyle{empty}\clearpage
 
 \pagenumbering{roman}
 \tableofcontents
 \listoffigures
 \clearfirst
 
 \setcounter{chapter}{-1}
 
 \input{ML.tex}
 \input{Prelim.tex}
 \input{Logic.tex}
 \input{Syntax.tex}
 \input{Tactic.tex}
 \input{Eq.tex}
 \input{Proof.tex}
 \input{Isar.tex}
 \input{Local_Theory.tex}
 \input{Integration.tex}
 
 \begingroup
 \tocentry{\bibname}
 \bibliographystyle{abbrv} \small\raggedright\frenchspacing
 \bibliography{manual}
 \endgroup
 
 \tocentry{\indexname}
 \printindex
 
 \end{document}
 
 
 %%% Local Variables:
 %%% mode: latex
 %%% TeX-master: t
 %%% End:
diff --git a/src/Doc/Intro/document/build b/src/Doc/Intro/document/build
--- a/src/Doc/Intro/document/build
+++ b/src/Doc/Intro/document/build
@@ -1,10 +1,19 @@
 #!/usr/bin/env bash
 
 set -e
 
-FORMAT="$1"
-VARIANT="$2"
+$ISABELLE_LUALATEX root
 
-isabelle logo
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
+if [ -f manual.bib -o -f root.bib ]
+then
+  $ISABELLE_BIBTEX root
+  $ISABELLE_LUALATEX root
+fi
 
+$ISABELLE_LUALATEX root
+
+if [ -f root.idx ]
+then
+  "$ISABELLE_HOME/src/Doc/sedindex" root
+  $ISABELLE_LUALATEX root
+fi
diff --git a/src/Doc/Intro/document/root.tex b/src/Doc/Intro/document/root.tex
--- a/src/Doc/Intro/document/root.tex
+++ b/src/Doc/Intro/document/root.tex
@@ -1,154 +1,154 @@
 \documentclass[12pt,a4paper]{article}
 \usepackage{graphicx,iman,extra,ttbox,proof,pdfsetup}
 
 %% run    bibtex intro         to prepare bibliography
 %% run    ../sedindex intro    to prepare index file
 %prth *(\(.*\));          \1;      
 %{\\out \(.*\)}          {\\out val it = "\1" : thm}
 
-\title{\includegraphics[scale=0.5]{isabelle} \\[4ex] Old Introduction to Isabelle}   
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex] Old Introduction to Isabelle}   
 \author{{\em Lawrence C. Paulson}\\
         Computer Laboratory \\ University of Cambridge \\
         \texttt{lcp@cl.cam.ac.uk}\\[3ex] 
         With Contributions by Tobias Nipkow and Markus Wenzel
 }
 \makeindex
 
 \underscoreoff
 
 \setcounter{secnumdepth}{2} \setcounter{tocdepth}{2}
 
 \sloppy
 \binperiod     %%%treat . like a binary operator
 
 \newcommand\qeq{\stackrel{?}{\equiv}}  %for disagreement pairs in unification
 \newcommand{\nand}{\mathbin{\lnot\&}} 
 \newcommand{\xor}{\mathbin{\#}}
 
 \pagenumbering{roman} 
 \begin{document}
 \pagestyle{empty}
 \begin{titlepage}
 \maketitle 
 \emph{Note}: this document is part of the earlier Isabelle documentation, 
 which is largely superseded by the Isabelle/HOL
 \emph{Tutorial}~\cite{isa-tutorial}. It describes the old-style theory 
 syntax and shows how to conduct proofs using the 
 ML top level. This style of interaction is largely obsolete:
 most Isabelle proofs are now written using the Isar 
 language and the Proof General interface. However, this paper contains valuable 
 information that is not available elsewhere. Its examples are based 
 on first-order logic rather than higher-order logic.
 
 \thispagestyle{empty}
 \vfill
 {\small Copyright \copyright{} \number\year{} by Lawrence C. Paulson}
 \end{titlepage}
 
 \pagestyle{headings}
 \part*{Preface}
 \index{Isabelle!overview} \index{Isabelle!object-logics supported}
 Isabelle~\cite{paulson-natural,paulson-found,paulson700} is a generic theorem
 prover.  It has been instantiated to support reasoning in several
 object-logics:
 \begin{itemize}
 \item first-order logic, constructive and classical versions
 \item higher-order logic, similar to that of Gordon's {\sc
 hol}~\cite{mgordon-hol}
 \item Zermelo-Fraenkel set theory~\cite{suppes72}
 \item an extensional version of Martin-L\"of's Type Theory~\cite{nordstrom90}
 \item the classical first-order sequent calculus, {\sc lk}
 \item the modal logics $T$, $S4$, and $S43$
 \item the Logic for Computable Functions~\cite{paulson87}
 \end{itemize}
 A logic's syntax and inference rules are specified declaratively; this
 allows single-step proof construction.  Isabelle provides control
 structures for expressing search procedures.  Isabelle also provides
 several generic tools, such as simplifiers and classical theorem provers,
 which can be applied to object-logics.
 
 Isabelle is a large system, but beginners can get by with a small
 repertoire of commands and a basic knowledge of how Isabelle works.  
 The Isabelle/HOL \emph{Tutorial}~\cite{isa-tutorial} describes how to get started. Advanced Isabelle users will benefit from some
 knowledge of Standard~\ML{}, because Isabelle is written in \ML{};
 \index{ML}
 if you are prepared to writing \ML{}
 code, you can get Isabelle to do almost anything.  My book
 on~\ML{}~\cite{paulson-ml2} covers much material connected with Isabelle,
 including a simple theorem prover.  Users must be familiar with logic as
 used in computer science; there are many good
 texts~\cite{galton90,reeves90}.
 
 \index{LCF}
 {\sc lcf}, developed by Robin Milner and colleagues~\cite{mgordon79}, is an
 ancestor of {\sc hol}, Nuprl, and several other systems.  Isabelle borrows
 ideas from {\sc lcf}: formulae are~\ML{} values; theorems belong to an
 abstract type; tactics and tacticals support backward proof.  But {\sc lcf}
 represents object-level rules by functions, while Isabelle represents them
 by terms.  You may find my other writings~\cite{paulson87,paulson-handbook}
 helpful in understanding the relationship between {\sc lcf} and Isabelle.
 
 \index{Isabelle!release history} Isabelle was first distributed in 1986.
 The 1987 version introduced a higher-order meta-logic with an improved
 treatment of quantifiers.  The 1988 version added limited polymorphism and
 support for natural deduction.  The 1989 version included a parser and
 pretty printer generator.  The 1992 version introduced type classes, to
 support many-sorted and higher-order logics.  The 1994 version introduced
 greater support for theories.  The most important recent change is the
 introduction of the Isar proof language, thanks to Markus Wenzel.  
 Isabelle is still under
 development and will continue to change.
 
 \subsubsection*{Overview} 
 This manual consists of three parts.  Part~I discusses the Isabelle's
 foundations.  Part~II, presents simple on-line sessions, starting with
 forward proof.  It also covers basic tactics and tacticals, and some
 commands for invoking them.  Part~III contains further examples for users
 with a bit of experience.  It explains how to derive rules define theories,
 and concludes with an extended example: a Prolog interpreter.
 
 Isabelle's Reference Manual and Object-Logics manual contain more details.
 They assume familiarity with the concepts presented here.
 
 
 \subsubsection*{Acknowledgements} 
 Tobias Nipkow contributed most of the section on defining theories.
 Stefan Berghofer, Sara Kalvala and Viktor Kuncak suggested improvements.
 
 Tobias Nipkow has made immense contributions to Isabelle, including the parser
 generator, type classes, and the simplifier.  Carsten Clasohm and Markus
 Wenzel made major contributions; Sonia Mahjoub and Karin Nimmermann also
 helped.  Isabelle was developed using Dave Matthews's Standard~{\sc ml}
 compiler, Poly/{\sc ml}.  Many people have contributed to Isabelle's standard
 object-logics, including Martin Coen, Philippe de Groote, Philippe No\"el.
 The research has been funded by the EPSRC (grants GR/G53279, GR/H40570,
 GR/K57381, GR/K77051, GR/M75440) and by ESPRIT (projects 3245: Logical
 Frameworks, and 6453: Types), and by the DFG Schwerpunktprogramm
 \emph{Deduktion}.
 
 \newpage
 \pagestyle{plain} \tableofcontents 
 \newpage
 
 \newfont{\sanssi}{cmssi12}
 \vspace*{2.5cm}
 \begin{quote}
 \raggedleft
 {\sanssi
 You can only find truth with logic\\
 if you have already found truth without it.}\\
 \bigskip
 
 G.K. Chesterton, {\em The Man who was Orthodox}
 \end{quote}
 
 \clearfirst  \pagestyle{headings}
 \input{foundations}
 \input{getting}
 \input{advanced}
 
 \bibliographystyle{plain} \small\raggedright\frenchspacing
 \bibliography{manual}
 
 \printindex
 \end{document}
diff --git a/src/Doc/Isar_Ref/Document_Preparation.thy b/src/Doc/Isar_Ref/Document_Preparation.thy
--- a/src/Doc/Isar_Ref/Document_Preparation.thy
+++ b/src/Doc/Isar_Ref/Document_Preparation.thy
@@ -1,700 +1,724 @@
 (*:maxLineLen=78:*)
 
 theory Document_Preparation
   imports Main Base
 begin
 
 chapter \<open>Document preparation \label{ch:document-prep}\<close>
 
 text \<open>
   Isabelle/Isar provides a simple document preparation system based on
   {PDF-\LaTeX}, with support for hyperlinks and bookmarks within that format.
   This allows to produce papers, books, theses etc.\ from Isabelle theory
   sources.
 
   {\LaTeX} output is generated while processing a \<^emph>\<open>session\<close> in batch mode, as
   explained in the \<^emph>\<open>The Isabelle System Manual\<close> @{cite "isabelle-system"}.
   The main Isabelle tools to get started with document preparation are
   @{tool_ref mkroot} and @{tool_ref build}.
 
   The classic Isabelle/HOL tutorial @{cite "isabelle-hol-book"} also explains
   some aspects of theory presentation.
 \<close>
 
 
 section \<open>Markup commands \label{sec:markup}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "chapter"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "section"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "subsection"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "subsubsection"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "paragraph"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "subparagraph"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "text"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "txt"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "text_raw"} & : & \<open>any \<rightarrow> any\<close> \\
   \end{matharray}
 
   Markup commands provide a structured way to insert text into the document
   generated from a theory. Each markup command takes a single @{syntax text}
   argument, which is passed as argument to a corresponding {\LaTeX} macro. The
   default macros provided by \<^file>\<open>~~/lib/texinputs/isabelle.sty\<close> can be
   redefined according to the needs of the underlying document and {\LaTeX}
   styles.
 
   Note that formal comments (\secref{sec:comments}) are similar to markup
   commands, but have a different status within Isabelle/Isar syntax.
 
   \<^rail>\<open>
     (@@{command chapter} | @@{command section} | @@{command subsection} |
       @@{command subsubsection} | @@{command paragraph} | @@{command subparagraph})
       @{syntax text} ';'? |
     (@@{command text} | @@{command txt} | @@{command text_raw}) @{syntax text}
   \<close>
 
     \<^descr> @{command chapter}, @{command section}, @{command subsection} etc.\ mark
     section headings within the theory source. This works in any context, even
     before the initial @{command theory} command. The corresponding {\LaTeX}
     macros are \<^verbatim>\<open>\isamarkupchapter\<close>, \<^verbatim>\<open>\isamarkupsection\<close>,
     \<^verbatim>\<open>\isamarkupsubsection\<close> etc.\
 
     \<^descr> @{command text} and @{command txt} specify paragraphs of plain text.
     This corresponds to a {\LaTeX} environment \<^verbatim>\<open>\begin{isamarkuptext}\<close> \<open>\<dots>\<close>
     \<^verbatim>\<open>\end{isamarkuptext}\<close> etc.
 
     \<^descr> @{command text_raw} is similar to @{command text}, but without any
     surrounding markup environment. This allows to inject arbitrary {\LaTeX}
     source into the generated document.
 
   All text passed to any of the above markup commands may refer to formal
   entities via \<^emph>\<open>document antiquotations\<close>, see also \secref{sec:antiq}. These
   are interpreted in the present theory or proof context.
 
   \<^medskip>
   The proof markup commands closely resemble those for theory specifications,
   but have a different formal status and produce different {\LaTeX} macros.
 \<close>
 
 
 section \<open>Document antiquotations \label{sec:antiq}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{antiquotation_def "theory"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "thm"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "lemma"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "prop"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "term"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def term_type} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def typeof} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def const} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def abbrev} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def typ} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def type} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def class} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def locale} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "text"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def goals} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def subgoals} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def prf} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def full_prf} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_text} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML} & : & \<open>antiquotation\<close> \\
-    @{antiquotation_def ML_op} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_def} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_ref} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_infix} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_infix_def} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_infix_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_type} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_type_def} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_type_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_structure} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_structure_def} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_structure_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_functor} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_functor_def} & : & \<open>antiquotation\<close> \\
+    @{antiquotation_def ML_functor_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def emph} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def bold} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def verbatim} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def bash_function} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def system_option} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def session} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "file"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "url"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "cite"} & : & \<open>antiquotation\<close> \\
     @{command_def "print_antiquotations"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   The overall content of an Isabelle/Isar theory may alternate between formal
   and informal text. The main body consists of formal specification and proof
   commands, interspersed with markup commands (\secref{sec:markup}) or
   document comments (\secref{sec:comments}). The argument of markup commands
   quotes informal text to be printed in the resulting document, but may again
   refer to formal entities via \<^emph>\<open>document antiquotations\<close>.
 
   For example, embedding \<^verbatim>\<open>@{term [show_types] "f x = a + x"}\<close>
   within a text block makes
   \isa{{\isacharparenleft}f{\isasymColon}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isacharparenleft}x{\isasymColon}{\isacharprime}a{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}a{\isasymColon}{\isacharprime}a{\isacharparenright}\ {\isacharplus}\ x} appear in the final {\LaTeX} document.
 
   Antiquotations usually spare the author tedious typing of logical entities
   in full detail. Even more importantly, some degree of consistency-checking
   between the main body of formal text and its informal explanation is
   achieved, since terms and types appearing in antiquotations are checked
   within the current theory or proof context.
 
   \<^medskip>
   Antiquotations are in general written as
   \<^verbatim>\<open>@{\<close>\<open>name\<close>~\<^verbatim>\<open>[\<close>\<open>options\<close>\<^verbatim>\<open>]\<close>~\<open>arguments\<close>\<^verbatim>\<open>}\<close>. The short form
   \<^verbatim>\<open>\\<close>\<^verbatim>\<open><^\<close>\<open>name\<close>\<^verbatim>\<open>>\<close>\<open>\<open>argument_content\<close>\<close> (without surrounding \<^verbatim>\<open>@{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>)
   works for a single argument that is a cartouche. A cartouche without special
   decoration is equivalent to \<^verbatim>\<open>\<^cartouche>\<close>\<open>\<open>argument_content\<close>\<close>, which is
   equivalent to \<^verbatim>\<open>@{cartouche\<close>~\<open>\<open>argument_content\<close>\<close>\<^verbatim>\<open>}\<close>. The special name
   @{antiquotation_def cartouche} is defined in the context: Isabelle/Pure
   introduces that as an alias to @{antiquotation_ref text} (see below).
   Consequently, \<open>\<open>foo_bar + baz \<le> bazar\<close>\<close> prints literal quasi-formal text
   (unchecked). A control symbol \<^verbatim>\<open>\\<close>\<^verbatim>\<open><^\<close>\<open>name\<close>\<^verbatim>\<open>>\<close> within the body text, but
   without a subsequent cartouche, is equivalent to \<^verbatim>\<open>@{\<close>\<open>name\<close>\<^verbatim>\<open>}\<close>.
 
   \begingroup
   \def\isasymcontrolstart{\isatt{\isacharbackslash\isacharless\isacharcircum}}
   \<^rail>\<open>
     @{syntax_def antiquotation}:
       '@{' antiquotation_body '}' |
       '\<controlstart>' @{syntax_ref name} '>' @{syntax_ref cartouche} |
       @{syntax_ref cartouche}
     ;
     options: '[' (option * ',') ']'
     ;
     option: @{syntax name} | @{syntax name} '=' @{syntax name}
     ;
   \<close>
   \endgroup
 
   Note that the syntax of antiquotations may \<^emph>\<open>not\<close> include source comments
   \<^verbatim>\<open>(*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*)\<close> nor verbatim text \<^verbatim>\<open>{*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*}\<close>.
 
   %% FIXME less monolithic presentation, move to individual sections!?
   \<^rail>\<open>
     @{syntax_def antiquotation_body}:
       (@@{antiquotation text} | @@{antiquotation cartouche} | @@{antiquotation theory_text})
         options @{syntax text} |
       @@{antiquotation theory} options @{syntax embedded} |
       @@{antiquotation thm} options styles @{syntax thms} |
       @@{antiquotation lemma} options @{syntax prop} @'by' @{syntax method} @{syntax method}? |
       @@{antiquotation prop} options styles @{syntax prop} |
       @@{antiquotation term} options styles @{syntax term} |
       @@{antiquotation (HOL) value} options styles @{syntax term} |
       @@{antiquotation term_type} options styles @{syntax term} |
       @@{antiquotation typeof} options styles @{syntax term} |
       @@{antiquotation const} options @{syntax term} |
       @@{antiquotation abbrev} options @{syntax term} |
       @@{antiquotation typ} options @{syntax type} |
       @@{antiquotation type} options @{syntax embedded} |
       @@{antiquotation class} options @{syntax embedded} |
       @@{antiquotation locale} options @{syntax embedded} |
       (@@{antiquotation command} | @@{antiquotation method} | @@{antiquotation attribute})
         options @{syntax name}
     ;
     @{syntax antiquotation}:
       @@{antiquotation goals} options |
       @@{antiquotation subgoals} options |
       @@{antiquotation prf} options @{syntax thms} |
       @@{antiquotation full_prf} options @{syntax thms} |
+      @@{antiquotation ML_text} options @{syntax text} |
       @@{antiquotation ML} options @{syntax text} |
-      @@{antiquotation ML_op} options @{syntax text} |
-      @@{antiquotation ML_type} options @{syntax text} |
+      @@{antiquotation ML_infix} options @{syntax text} |
+      @@{antiquotation ML_type} options @{syntax typeargs} @{syntax text} |
       @@{antiquotation ML_structure} options @{syntax text} |
       @@{antiquotation ML_functor} options @{syntax text} |
       @@{antiquotation emph} options @{syntax text} |
       @@{antiquotation bold} options @{syntax text} |
       @@{antiquotation verbatim} options @{syntax text} |
       @@{antiquotation bash_function} options @{syntax embedded} |
       @@{antiquotation system_option} options @{syntax embedded} |
       @@{antiquotation session} options @{syntax embedded} |
       @@{antiquotation path} options @{syntax embedded} |
       @@{antiquotation "file"} options @{syntax name} |
       @@{antiquotation dir} options @{syntax name} |
       @@{antiquotation url} options @{syntax embedded} |
       @@{antiquotation cite} options @{syntax cartouche}? (@{syntax name} + @'and')
     ;
     styles: '(' (style + ',') ')'
     ;
     style: (@{syntax name} +)
     ;
     @@{command print_antiquotations} ('!'?)
   \<close>
 
   \<^descr> \<open>@{text s}\<close> prints uninterpreted source text \<open>s\<close>, i.e.\ inner syntax. This
   is particularly useful to print portions of text according to the Isabelle
   document style, without demanding well-formedness, e.g.\ small pieces of
   terms that should not be parsed or type-checked yet.
 
   It is also possible to write this in the short form \<open>\<open>s\<close>\<close> without any
   further decoration.
 
   \<^descr> \<open>@{theory_text s}\<close> prints uninterpreted theory source text \<open>s\<close>, i.e.\
   outer syntax with command keywords and other tokens.
 
   \<^descr> \<open>@{theory A}\<close> prints the session-qualified theory name \<open>A\<close>, which is
   guaranteed to refer to a valid ancestor theory in the current context.
 
   \<^descr> \<open>@{thm a\<^sub>1 \<dots> a\<^sub>n}\<close> prints theorems \<open>a\<^sub>1 \<dots> a\<^sub>n\<close>. Full fact expressions are
   allowed here, including attributes (\secref{sec:syn-att}).
 
   \<^descr> \<open>@{prop \<phi>}\<close> prints a well-typed proposition \<open>\<phi>\<close>.
 
   \<^descr> \<open>@{lemma \<phi> by m}\<close> proves a well-typed proposition \<open>\<phi>\<close> by method \<open>m\<close> and
   prints the original \<open>\<phi>\<close>.
 
   \<^descr> \<open>@{term t}\<close> prints a well-typed term \<open>t\<close>.
   
   \<^descr> \<open>@{value t}\<close> evaluates a term \<open>t\<close> and prints its result, see also
   @{command_ref (HOL) value}.
 
   \<^descr> \<open>@{term_type t}\<close> prints a well-typed term \<open>t\<close> annotated with its type.
 
   \<^descr> \<open>@{typeof t}\<close> prints the type of a well-typed term \<open>t\<close>.
 
   \<^descr> \<open>@{const c}\<close> prints a logical or syntactic constant \<open>c\<close>.
   
   \<^descr> \<open>@{abbrev c x\<^sub>1 \<dots> x\<^sub>n}\<close> prints a constant abbreviation \<open>c x\<^sub>1 \<dots> x\<^sub>n \<equiv> rhs\<close>
   as defined in the current context.
 
   \<^descr> \<open>@{typ \<tau>}\<close> prints a well-formed type \<open>\<tau>\<close>.
 
   \<^descr> \<open>@{type \<kappa>}\<close> prints a (logical or syntactic) type constructor \<open>\<kappa>\<close>.
 
   \<^descr> \<open>@{class c}\<close> prints a class \<open>c\<close>.
 
   \<^descr> \<open>@{locale c}\<close> prints a locale \<open>c\<close>.
 
   \<^descr> \<open>@{command name}\<close>, \<open>@{method name}\<close>, \<open>@{attribute name}\<close> print checked
   entities of the Isar language.
 
   \<^descr> \<open>@{goals}\<close> prints the current \<^emph>\<open>dynamic\<close> goal state. This is mainly for
   support of tactic-emulation scripts within Isar. Presentation of goal states
   does not conform to the idea of human-readable proof documents!
 
   When explaining proofs in detail it is usually better to spell out the
   reasoning via proper Isar proof commands, instead of peeking at the internal
   machine configuration.
   
   \<^descr> \<open>@{subgoals}\<close> is similar to \<open>@{goals}\<close>, but does not print the main goal.
   
   \<^descr> \<open>@{prf a\<^sub>1 \<dots> a\<^sub>n}\<close> prints the (compact) proof terms corresponding to the
   theorems \<open>a\<^sub>1 \<dots> a\<^sub>n\<close>. Note that this requires proof terms to be switched on
   for the current logic session.
   
   \<^descr> \<open>@{full_prf a\<^sub>1 \<dots> a\<^sub>n}\<close> is like \<open>@{prf a\<^sub>1 \<dots> a\<^sub>n}\<close>, but prints the full
   proof terms, i.e.\ also displays information omitted in the compact proof
   term, which is denoted by ``\<open>_\<close>'' placeholders there.
-  
-  \<^descr> \<open>@{ML s}\<close>, \<open>@{ML_op s}\<close>, \<open>@{ML_type s}\<close>, \<open>@{ML_structure s}\<close>, and
+
+  \<^descr> \<open>@{ML_text s}\<close> prints ML text verbatim: only the token language is
+  checked.
+
+  \<^descr> \<open>@{ML s}\<close>, \<open>@{ML_infix s}\<close>, \<open>@{ML_type s}\<close>, \<open>@{ML_structure s}\<close>, and
   \<open>@{ML_functor s}\<close> check text \<open>s\<close> as ML value, infix operator, type,
-  structure, and functor respectively. The source is printed verbatim.
+  exception, structure, and functor respectively. The source is printed
+  verbatim. The variants \<open>@{ML_def s}\<close> and \<open>@{ML_ref s}\<close> etc. maintain the
+  document index: ``def'' means to make a bold entry, ``ref'' means to make a
+  regular entry.
+
+  There are two forms for type constructors, with or without separate type
+  arguments: this impacts only the index entry. For example, \<open>@{ML_type_ref
+  \<open>'a list\<close>}\<close> makes an entry literally for ``\<open>'a list\<close>'' (sorted under the
+  letter ``a''), but \<open>@{ML_type_ref 'a \<open>list\<close>}\<close> makes an entry for the
+  constructor name ``\<open>list\<close>''.
 
   \<^descr> \<open>@{emph s}\<close> prints document source recursively, with {\LaTeX} markup
   \<^verbatim>\<open>\emph{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>.
 
   \<^descr> \<open>@{bold s}\<close> prints document source recursively, with {\LaTeX} markup
   \<^verbatim>\<open>\textbf{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>.
 
   \<^descr> \<open>@{verbatim s}\<close> prints uninterpreted source text literally as ASCII
   characters, using some type-writer font style.
 
   \<^descr> \<open>@{bash_function name}\<close> prints the given GNU bash function verbatim. The
   name is checked wrt.\ the Isabelle system environment @{cite
   "isabelle-system"}.
 
   \<^descr> \<open>@{system_option name}\<close> prints the given system option verbatim. The name
   is checked wrt.\ cumulative \<^verbatim>\<open>etc/options\<close> of all Isabelle components,
   notably \<^file>\<open>~~/etc/options\<close>.
 
   \<^descr> \<open>@{session name}\<close> prints given session name verbatim. The name is checked
   wrt.\ the dependencies of the current session.
 
   \<^descr> \<open>@{path name}\<close> prints the file-system path name verbatim.
 
   \<^descr> \<open>@{file name}\<close> is like \<open>@{path name}\<close>, but ensures that \<open>name\<close> refers to a
   plain file.
 
   \<^descr> \<open>@{dir name}\<close> is like \<open>@{path name}\<close>, but ensures that \<open>name\<close> refers to a
   directory.
 
   \<^descr> \<open>@{url name}\<close> produces markup for the given URL, which results in an
   active hyperlink within the text.
 
   \<^descr> \<open>@{cite name}\<close> produces a citation \<^verbatim>\<open>\cite{name}\<close> in {\LaTeX}, where the
   name refers to some Bib{\TeX} database entry. This is only checked in
   batch-mode session builds.
 
   The variant \<open>@{cite \<open>opt\<close> name}\<close> produces \<^verbatim>\<open>\cite[opt]{name}\<close> with some
   free-form optional argument. Multiple names are output with commas, e.g.
   \<open>@{cite foo \<AND> bar}\<close> becomes \<^verbatim>\<open>\cite{foo,bar}\<close>.
 
   The {\LaTeX} macro name is determined by the antiquotation option
   @{antiquotation_option_def cite_macro}, or the configuration option
   @{attribute cite_macro} in the context. For example, \<open>@{cite [cite_macro =
   nocite] foobar}\<close> produces \<^verbatim>\<open>\nocite{foobar}\<close>.
 
   \<^descr> @{command "print_antiquotations"} prints all document antiquotations that
   are defined in the current context; the ``\<open>!\<close>'' option indicates extra
   verbosity.
 \<close>
 
 
 subsection \<open>Styled antiquotations\<close>
 
 text \<open>
   The antiquotations \<open>thm\<close>, \<open>prop\<close> and \<open>term\<close> admit an extra \<^emph>\<open>style\<close>
   specification to modify the printed result. A style is specified by a name
   with a possibly empty number of arguments; multiple styles can be sequenced
   with commas. The following standard styles are available:
 
   \<^descr> \<open>lhs\<close> extracts the first argument of any application form with at least
   two arguments --- typically meta-level or object-level equality, or any
   other binary relation.
   
   \<^descr> \<open>rhs\<close> is like \<open>lhs\<close>, but extracts the second argument.
   
   \<^descr> \<open>concl\<close> extracts the conclusion \<open>C\<close> from a rule in Horn-clause normal form
   \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> C\<close>.
   
   \<^descr> \<open>prem\<close> \<open>n\<close> extract premise number \<open>n\<close> from from a rule in Horn-clause
   normal form \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> C\<close>.
 \<close>
 
 
 subsection \<open>General options\<close>
 
 text \<open>
   The following options are available to tune the printed output of
   antiquotations. Note that many of these coincide with system and
   configuration options of the same names.
 
     \<^descr> @{antiquotation_option_def show_types}~\<open>= bool\<close> and
     @{antiquotation_option_def show_sorts}~\<open>= bool\<close> control printing of
     explicit type and sort constraints.
 
     \<^descr> @{antiquotation_option_def show_structs}~\<open>= bool\<close> controls printing of
     implicit structures.
 
     \<^descr> @{antiquotation_option_def show_abbrevs}~\<open>= bool\<close> controls folding of
     abbreviations.
 
     \<^descr> @{antiquotation_option_def names_long}~\<open>= bool\<close> forces names of types
     and constants etc.\ to be printed in their fully qualified internal form.
 
     \<^descr> @{antiquotation_option_def names_short}~\<open>= bool\<close> forces names of types
     and constants etc.\ to be printed unqualified. Note that internalizing the
     output again in the current context may well yield a different result.
 
     \<^descr> @{antiquotation_option_def names_unique}~\<open>= bool\<close> determines whether the
     printed version of qualified names should be made sufficiently long to
     avoid overlap with names declared further back. Set to \<open>false\<close> for more
     concise output.
 
     \<^descr> @{antiquotation_option_def eta_contract}~\<open>= bool\<close> prints terms in
     \<open>\<eta>\<close>-contracted form.
 
     \<^descr> @{antiquotation_option_def display}~\<open>= bool\<close> indicates if the text is to
     be output as multi-line ``display material'', rather than a small piece of
     text without line breaks (which is the default).
 
     In this mode the embedded entities are printed in the same style as the
     main theory text.
 
     \<^descr> @{antiquotation_option_def break}~\<open>= bool\<close> controls line breaks in
     non-display material.
 
     \<^descr> @{antiquotation_option_def cartouche}~\<open>= bool\<close> indicates if the output
     should be delimited as cartouche.
 
     \<^descr> @{antiquotation_option_def quotes}~\<open>= bool\<close> indicates if the output
     should be delimited via double quotes (option @{antiquotation_option
     cartouche} takes precedence). Note that the Isabelle {\LaTeX} styles may
     suppress quotes on their own account.
 
     \<^descr> @{antiquotation_option_def mode}~\<open>= name\<close> adds \<open>name\<close> to the print mode
     to be used for presentation. Note that the standard setup for {\LaTeX}
     output is already present by default, with mode ``\<open>latex\<close>''.
 
     \<^descr> @{antiquotation_option_def margin}~\<open>= nat\<close> and
     @{antiquotation_option_def indent}~\<open>= nat\<close> change the margin or
     indentation for pretty printing of display material.
 
     \<^descr> @{antiquotation_option_def goals_limit}~\<open>= nat\<close> determines the maximum
     number of subgoals to be printed (for goal-based antiquotation).
 
     \<^descr> @{antiquotation_option_def source}~\<open>= bool\<close> prints the original source
     text of the antiquotation arguments, rather than its internal
     representation. Note that formal checking of @{antiquotation "thm"},
     @{antiquotation "term"}, etc. is still enabled; use the @{antiquotation
     "text"} antiquotation for unchecked output.
 
     Regular \<open>term\<close> and \<open>typ\<close> antiquotations with \<open>source = false\<close> involve a
     full round-trip from the original source to an internalized logical entity
     back to a source form, according to the syntax of the current context.
     Thus the printed output is not under direct control of the author, it may
     even fluctuate a bit as the underlying theory is changed later on.
 
     In contrast, @{antiquotation_option source}~\<open>= true\<close> admits direct
     printing of the given source text, with the desirable well-formedness
     check in the background, but without modification of the printed text.
 
     Cartouche delimiters of the argument are stripped for antiquotations that
     are internally categorized as ``embedded''.
 
     \<^descr> @{antiquotation_option_def source_cartouche} is like
     @{antiquotation_option source}, but cartouche delimiters are always
     preserved in the output.
 
   For Boolean flags, ``\<open>name = true\<close>'' may be abbreviated as ``\<open>name\<close>''. All
   of the above flags are disabled by default, unless changed specifically for
   a logic session in the corresponding \<^verbatim>\<open>ROOT\<close> file.
 \<close>
 
 
 section \<open>Markdown-like text structure\<close>
 
 text \<open>
   The markup commands @{command_ref text}, @{command_ref txt}, @{command_ref
   text_raw} (\secref{sec:markup}) consist of plain text. Its internal
   structure consists of paragraphs and (nested) lists, using special Isabelle
   symbols and some rules for indentation and blank lines. This quasi-visual
   format resembles \<^emph>\<open>Markdown\<close>\<^footnote>\<open>\<^url>\<open>http://commonmark.org\<close>\<close>, but the full
   complexity of that notation is avoided.
 
   This is a summary of the main principles of minimal Markdown in Isabelle:
 
     \<^item> List items start with the following markers
       \<^descr>[itemize:] \<^verbatim>\<open>\<^item>\<close>
       \<^descr>[enumerate:] \<^verbatim>\<open>\<^enum>\<close>
       \<^descr>[description:] \<^verbatim>\<open>\<^descr>\<close>
 
     \<^item> Adjacent list items with same indentation and same marker are grouped
     into a single list.
 
     \<^item> Singleton blank lines separate paragraphs.
 
     \<^item> Multiple blank lines escape from the current list hierarchy.
 
   Notable differences to official Markdown:
 
     \<^item> Indentation of list items needs to match exactly.
 
     \<^item> Indentation is unlimited (official Markdown interprets four spaces as
     block quote).
 
     \<^item> List items always consist of paragraphs --- there is no notion of
     ``tight'' list.
 
     \<^item> Section headings are expressed via Isar document markup commands
     (\secref{sec:markup}).
 
     \<^item> URLs, font styles, other special content is expressed via antiquotations
     (\secref{sec:antiq}), usually with proper nesting of sub-languages via
     text cartouches.
 \<close>
 
 
 section \<open>Document markers and command tags \label{sec:document-markers}\<close>
 
 text \<open>
   \emph{Document markers} are formal comments of the form \<open>\<^marker>\<open>marker_body\<close>\<close>
   (using the control symbol \<^verbatim>\<open>\<^marker>\<close>) and may occur anywhere within the
   outer syntax of a command: the inner syntax of a marker body resembles that
   for attributes (\secref{sec:syn-att}). In contrast, \emph{Command tags} may
   only occur after a command keyword and are treated as special markers as
   explained below.
 
   \<^rail>\<open>
     @{syntax_def marker}: '\<^marker>' @{syntax cartouche}
     ;
     @{syntax_def marker_body}: (@{syntax name} @{syntax args} * ',')
     ;
     @{syntax_def tags}: tag*
     ;
     tag: '%' (@{syntax short_ident} | @{syntax string})
   \<close>
 
   Document markers are stripped from the document output, but surrounding
   white-space is preserved: e.g.\ a marker at the end of a line does not
   affect the subsequent line break. Markers operate within the semantic
   presentation context of a command, and may modify it to change the overall
   appearance of a command span (e.g.\ by adding tags).
 
   Each document marker has its own syntax defined in the theory context; the
   following markers are predefined in Isabelle/Pure:
 
   \<^rail>\<open>
     (@@{document_marker_def title} |
      @@{document_marker_def creator} |
      @@{document_marker_def contributor} |
      @@{document_marker_def date} |
      @@{document_marker_def license} |
      @@{document_marker_def description}) @{syntax embedded}
     ;
     @@{document_marker_def tag} (scope?) @{syntax name}
     ;
     scope: '(' ('proof' | 'command') ')'
   \<close>
 
     \<^descr> \<open>\<^marker>\<open>title arg\<close>\<close>, \<open>\<^marker>\<open>creator arg\<close>\<close>, \<open>\<^marker>\<open>contributor arg\<close>\<close>, \<open>\<^marker>\<open>date arg\<close>\<close>,
     \<open>\<^marker>\<open>license arg\<close>\<close>, and \<open>\<^marker>\<open>description arg\<close>\<close> produce markup in the PIDE
     document, without any immediate effect on typesetting. This vocabulary is
     taken from the Dublin Core Metadata
     Initiative\<^footnote>\<open>\<^url>\<open>https://www.dublincore.org/specifications/dublin-core/dcmi-terms\<close>\<close>.
     The argument is an uninterpreted string, except for @{document_marker
     description}, which consists of words that are subject to spell-checking.
 
     \<^descr> \<open>\<^marker>\<open>tag name\<close>\<close> updates the list of command tags in the presentation
     context: later declarations take precedence, so \<open>\<^marker>\<open>tag a, tag b, tag c\<close>\<close>
     produces a reversed list. The default tags are given by the original
     \<^theory_text>\<open>keywords\<close> declaration of a command, and the system option
     @{system_option_ref document_tags}.
 
     The optional \<open>scope\<close> tells how far the tagging is applied to subsequent
     proof structure: ``\<^theory_text>\<open>("proof")\<close>'' means it applies to the following proof
     text, and ``\<^theory_text>\<open>(command)\<close>'' means it only applies to the current command.
     The default within a proof body is ``\<^theory_text>\<open>("proof")\<close>'', but for toplevel goal
     statements it is ``\<^theory_text>\<open>(command)\<close>''. Thus a \<open>tag\<close> marker for \<^theory_text>\<open>theorem\<close>,
     \<^theory_text>\<open>lemma\<close> etc. does \emph{not} affect its proof by default.
 
     An old-style command tag \<^verbatim>\<open>%\<close>\<open>name\<close> is treated like a document marker
     \<open>\<^marker>\<open>tag (proof) name\<close>\<close>: the list of command tags precedes the list of
     document markers. The head of the resulting tags in the presentation
     context is turned into {\LaTeX} environments to modify the type-setting.
     The following tags are pre-declared for certain classes of commands, and
     serve as default markup for certain kinds of commands:
 
     \<^medskip>
     \begin{tabular}{ll}
       \<open>document\<close> & document markup commands \\
       \<open>theory\<close> & theory begin/end \\
       \<open>proof\<close> & all proof commands \\
       \<open>ML\<close> & all commands involving ML code \\
     \end{tabular}
     \<^medskip>
 
   The Isabelle document preparation system @{cite "isabelle-system"} allows
   tagged command regions to be presented specifically, e.g.\ to fold proof
   texts, or drop parts of the text completely.
 
   For example ``\<^theory_text>\<open>by auto\<close>~\<open>\<^marker>\<open>tag invisible\<close>\<close>'' causes that piece of proof to
   be treated as \<open>invisible\<close> instead of \<open>proof\<close> (the default), which may be
   shown or hidden depending on the document setup. In contrast, ``\<^theory_text>\<open>by
   auto\<close>~\<open>\<^marker>\<open>tag visible\<close>\<close>'' forces this text to be shown invariably.
 
   Explicit tag specifications within a proof apply to all subsequent commands
   of the same level of nesting. For example, ``\<^theory_text>\<open>proof\<close>~\<open>\<^marker>\<open>tag invisible\<close>
   \<dots>\<close>~\<^theory_text>\<open>qed\<close>'' forces the whole sub-proof to be typeset as \<open>visible\<close> (unless
   some of its parts are tagged differently).
 
   \<^medskip>
   Command tags merely produce certain markup environments for type-setting.
   The meaning of these is determined by {\LaTeX} macros, as defined in
   \<^file>\<open>~~/lib/texinputs/isabelle.sty\<close> or by the document author. The Isabelle
   document preparation tools also provide some high-level options to specify
   the meaning of arbitrary tags to ``keep'', ``drop'', or ``fold'' the
   corresponding parts of the text. Logic sessions may also specify ``document
   versions'', where given tags are interpreted in some particular way. Again
   see @{cite "isabelle-system"} for further details.
 \<close>
 
 
 section \<open>Railroad diagrams\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{antiquotation_def "rail"} & : & \<open>antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     'rail' @{syntax text}
   \<close>
 
   The @{antiquotation rail} antiquotation allows to include syntax diagrams
   into Isabelle documents. {\LaTeX} requires the style file
   \<^file>\<open>~~/lib/texinputs/railsetup.sty\<close>, which can be used via
   \<^verbatim>\<open>\usepackage{railsetup}\<close> in \<^verbatim>\<open>root.tex\<close>, for example.
 
   The rail specification language is quoted here as Isabelle @{syntax string}
   or text @{syntax "cartouche"}; it has its own grammar given below.
 
   \begingroup
   \def\isasymnewline{\isatt{\isacharbackslash\isacharless newline\isachargreater}}
   \<^rail>\<open>
   rule? + ';'
   ;
   rule: ((identifier | @{syntax antiquotation}) ':')? body
   ;
   body: concatenation + '|'
   ;
   concatenation: ((atom '?'?) +) (('*' | '+') atom?)?
   ;
   atom: '(' body? ')' | identifier |
     '@'? (string | @{syntax antiquotation}) |
     '\<newline>'
   \<close>
   \endgroup
 
   The lexical syntax of \<open>identifier\<close> coincides with that of @{syntax
   short_ident} in regular Isabelle syntax, but \<open>string\<close> uses single quotes
   instead of double quotes of the standard @{syntax string} category.
 
   Each \<open>rule\<close> defines a formal language (with optional name), using a notation
   that is similar to EBNF or regular expressions with recursion. The meaning
   and visual appearance of these rail language elements is illustrated by the
   following representative examples.
 
   \<^item> Empty \<^verbatim>\<open>()\<close>
 
   \<^rail>\<open>()\<close>
 
   \<^item> Nonterminal \<^verbatim>\<open>A\<close>
 
   \<^rail>\<open>A\<close>
 
   \<^item> Nonterminal via Isabelle antiquotation \<^verbatim>\<open>@{syntax method}\<close>
 
   \<^rail>\<open>@{syntax method}\<close>
 
   \<^item> Terminal \<^verbatim>\<open>'xyz'\<close>
 
   \<^rail>\<open>'xyz'\<close>
 
   \<^item> Terminal in keyword style \<^verbatim>\<open>@'xyz'\<close>
 
   \<^rail>\<open>@'xyz'\<close>
 
   \<^item> Terminal via Isabelle antiquotation \<^verbatim>\<open>@@{method rule}\<close>
 
   \<^rail>\<open>@@{method rule}\<close>
 
   \<^item> Concatenation \<^verbatim>\<open>A B C\<close>
 
   \<^rail>\<open>A B C\<close>
 
   \<^item> Newline inside concatenation \<^verbatim>\<open>A B C \<newline> D E F\<close>
 
   \<^rail>\<open>A B C \<newline> D E F\<close>
 
   \<^item> Variants \<^verbatim>\<open>A | B | C\<close>
 
   \<^rail>\<open>A | B | C\<close>
 
   \<^item> Option \<^verbatim>\<open>A ?\<close>
 
   \<^rail>\<open>A ?\<close>
 
   \<^item> Repetition \<^verbatim>\<open>A *\<close>
 
   \<^rail>\<open>A *\<close>
 
   \<^item> Repetition with separator \<^verbatim>\<open>A * sep\<close>
 
   \<^rail>\<open>A * sep\<close>
 
   \<^item> Strict repetition \<^verbatim>\<open>A +\<close>
 
   \<^rail>\<open>A +\<close>
 
   \<^item> Strict repetition with separator \<^verbatim>\<open>A + sep\<close>
 
   \<^rail>\<open>A + sep\<close>
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Generic.thy b/src/Doc/Isar_Ref/Generic.thy
--- a/src/Doc/Isar_Ref/Generic.thy
+++ b/src/Doc/Isar_Ref/Generic.thy
@@ -1,1827 +1,1827 @@
 (*:maxLineLen=78:*)
 
 theory Generic
 imports Main Base
 begin
 
 chapter \<open>Generic tools and packages \label{ch:gen-tools}\<close>
 
 section \<open>Configuration options \label{sec:config}\<close>
 
 text \<open>
   Isabelle/Pure maintains a record of named configuration options within the
   theory or proof context, with values of type \<^ML_type>\<open>bool\<close>, \<^ML_type>\<open>int\<close>, \<^ML_type>\<open>real\<close>, or \<^ML_type>\<open>string\<close>. Tools may declare options in
   ML, and then refer to these values (relative to the context). Thus global
   reference variables are easily avoided. The user may change the value of a
   configuration option by means of an associated attribute of the same name.
   This form of context declaration works particularly well with commands such
   as @{command "declare"} or @{command "using"} like this:
 \<close>
 
 (*<*)experiment begin(*>*)
 declare [[show_main_goal = false]]
 
 notepad
 begin
   note [[show_main_goal = true]]
 end
 (*<*)end(*>*)
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "print_options"} & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command print_options} ('!'?)
     ;
     @{syntax name} ('=' ('true' | 'false' | @{syntax int} | @{syntax float} | @{syntax name}))?
   \<close>
 
   \<^descr> @{command "print_options"} prints the available configuration options,
   with names, types, and current values; the ``\<open>!\<close>'' option indicates extra
   verbosity.
   
   \<^descr> \<open>name = value\<close> as an attribute expression modifies the named option, with
   the syntax of the value depending on the option's type. For \<^ML_type>\<open>bool\<close>
   the default value is \<open>true\<close>. Any attempt to change a global option in a
   local context is ignored.
 \<close>
 
 
 section \<open>Basic proof tools\<close>
 
 subsection \<open>Miscellaneous methods and attributes \label{sec:misc-meth-att}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def unfold} & : & \<open>method\<close> \\
     @{method_def fold} & : & \<open>method\<close> \\
     @{method_def insert} & : & \<open>method\<close> \\[0.5ex]
     @{method_def erule}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def drule}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def frule}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def intro} & : & \<open>method\<close> \\
     @{method_def elim} & : & \<open>method\<close> \\
     @{method_def fail} & : & \<open>method\<close> \\
     @{method_def succeed} & : & \<open>method\<close> \\
     @{method_def sleep} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{method fold} | @@{method unfold} | @@{method insert}) @{syntax thms}
     ;
     (@@{method erule} | @@{method drule} | @@{method frule})
       ('(' @{syntax nat} ')')? @{syntax thms}
     ;
     (@@{method intro} | @@{method elim}) @{syntax thms}?
     ;
     @@{method sleep} @{syntax real}
   \<close>
 
   \<^descr> @{method unfold}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> and @{method fold}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> expand (or
   fold back) the given definitions throughout all goals; any chained facts
   provided are inserted into the goal and subject to rewriting as well.
 
   Unfolding works in two stages: first, the given equations are used directly
   for rewriting; second, the equations are passed through the attribute
   @{attribute_ref abs_def} before rewriting --- to ensure that definitions are
   fully expanded, regardless of the actual parameters that are provided.
 
   \<^descr> @{method insert}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> inserts theorems as facts into all goals of
   the proof state. Note that current facts indicated for forward chaining are
   ignored.
 
   \<^descr> @{method erule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close>, @{method drule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close>, and @{method
   frule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> are similar to the basic @{method rule} method (see
   \secref{sec:pure-meth-att}), but apply rules by elim-resolution,
   destruct-resolution, and forward-resolution, respectively @{cite
   "isabelle-implementation"}. The optional natural number argument (default 0)
   specifies additional assumption steps to be performed here.
 
   Note that these methods are improper ones, mainly serving for
   experimentation and tactic script emulation. Different modes of basic rule
   application are usually expressed in Isar at the proof language level,
   rather than via implicit proof state manipulations. For example, a proper
   single-step elimination would be done using the plain @{method rule} method,
   with forward chaining of current facts.
 
   \<^descr> @{method intro} and @{method elim} repeatedly refine some goal by intro-
   or elim-resolution, after having inserted any chained facts. Exactly the
   rules given as arguments are taken into account; this allows fine-tuned
   decomposition of a proof problem, in contrast to common automated tools.
 
   \<^descr> @{method fail} yields an empty result sequence; it is the identity of the
   ``\<open>|\<close>'' method combinator (cf.\ \secref{sec:proof-meth}).
 
   \<^descr> @{method succeed} yields a single (unchanged) result; it is the identity
   of the ``\<open>,\<close>'' method combinator (cf.\ \secref{sec:proof-meth}).
 
   \<^descr> @{method sleep}~\<open>s\<close> succeeds after a real-time delay of \<open>s\<close> seconds. This
   is occasionally useful for demonstration and testing purposes.
 
 
   \begin{matharray}{rcl}
     @{attribute_def tagged} & : & \<open>attribute\<close> \\
     @{attribute_def untagged} & : & \<open>attribute\<close> \\[0.5ex]
     @{attribute_def THEN} & : & \<open>attribute\<close> \\
     @{attribute_def unfolded} & : & \<open>attribute\<close> \\
     @{attribute_def folded} & : & \<open>attribute\<close> \\
     @{attribute_def abs_def} & : & \<open>attribute\<close> \\[0.5ex]
     @{attribute_def rotated} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) elim_format} & : & \<open>attribute\<close> \\
     @{attribute_def no_vars}\<open>\<^sup>*\<close> & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute tagged} @{syntax name} @{syntax name}
     ;
     @@{attribute untagged} @{syntax name}
     ;
     @@{attribute THEN} ('[' @{syntax nat} ']')? @{syntax thm}
     ;
     (@@{attribute unfolded} | @@{attribute folded}) @{syntax thms}
     ;
     @@{attribute rotated} @{syntax int}?
   \<close>
 
   \<^descr> @{attribute tagged}~\<open>name value\<close> and @{attribute untagged}~\<open>name\<close> add and
   remove \<^emph>\<open>tags\<close> of some theorem. Tags may be any list of string pairs that
   serve as formal comment. The first string is considered the tag name, the
   second its value. Note that @{attribute untagged} removes any tags of the
   same name.
 
   \<^descr> @{attribute THEN}~\<open>a\<close> composes rules by resolution; it resolves with the
   first premise of \<open>a\<close> (an alternative position may be also specified). See
-  also \<^ML_op>\<open>RS\<close> in @{cite "isabelle-implementation"}.
+  also \<^ML_infix>\<open>RS\<close> in @{cite "isabelle-implementation"}.
   
   \<^descr> @{attribute unfolded}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> and @{attribute folded}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close>
   expand and fold back again the given definitions throughout a rule.
 
   \<^descr> @{attribute abs_def} turns an equation of the form \<^prop>\<open>f x y \<equiv> t\<close>
   into \<^prop>\<open>f \<equiv> \<lambda>x y. t\<close>, which ensures that @{method simp} steps always
   expand it. This also works for object-logic equality.
 
   \<^descr> @{attribute rotated}~\<open>n\<close> rotate the premises of a theorem by \<open>n\<close> (default
   1).
 
   \<^descr> @{attribute (Pure) elim_format} turns a destruction rule into elimination
   rule format, by resolving with the rule \<^prop>\<open>PROP A \<Longrightarrow> (PROP A \<Longrightarrow> PROP B) \<Longrightarrow>
   PROP B\<close>.
   
   Note that the Classical Reasoner (\secref{sec:classical}) provides its own
   version of this operation.
 
   \<^descr> @{attribute no_vars} replaces schematic variables by free ones; this is
   mainly for tuning output of pretty printed theorems.
 \<close>
 
 
 subsection \<open>Low-level equational reasoning\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def subst} & : & \<open>method\<close> \\
     @{method_def hypsubst} & : & \<open>method\<close> \\
     @{method_def split} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method subst} ('(' 'asm' ')')? \<newline> ('(' (@{syntax nat}+) ')')? @{syntax thm}
     ;
     @@{method split} @{syntax thms}
   \<close>
 
   These methods provide low-level facilities for equational reasoning that are
   intended for specialized applications only. Normally, single step
   calculations would be performed in a structured text (see also
   \secref{sec:calculation}), while the Simplifier methods provide the
   canonical way for automated normalization (see \secref{sec:simplifier}).
 
   \<^descr> @{method subst}~\<open>eq\<close> performs a single substitution step using rule \<open>eq\<close>,
   which may be either a meta or object equality.
 
   \<^descr> @{method subst}~\<open>(asm) eq\<close> substitutes in an assumption.
 
   \<^descr> @{method subst}~\<open>(i \<dots> j) eq\<close> performs several substitutions in the
   conclusion. The numbers \<open>i\<close> to \<open>j\<close> indicate the positions to substitute at.
   Positions are ordered from the top of the term tree moving down from left to
   right. For example, in \<open>(a + b) + (c + d)\<close> there are three positions where
   commutativity of \<open>+\<close> is applicable: 1 refers to \<open>a + b\<close>, 2 to the whole
   term, and 3 to \<open>c + d\<close>.
 
   If the positions in the list \<open>(i \<dots> j)\<close> are non-overlapping (e.g.\ \<open>(2 3)\<close> in
   \<open>(a + b) + (c + d)\<close>) you may assume all substitutions are performed
   simultaneously. Otherwise the behaviour of \<open>subst\<close> is not specified.
 
   \<^descr> @{method subst}~\<open>(asm) (i \<dots> j) eq\<close> performs the substitutions in the
   assumptions. The positions refer to the assumptions in order from left to
   right. For example, given in a goal of the form \<open>P (a + b) \<Longrightarrow> P (c + d) \<Longrightarrow> \<dots>\<close>,
   position 1 of commutativity of \<open>+\<close> is the subterm \<open>a + b\<close> and position 2 is
   the subterm \<open>c + d\<close>.
 
   \<^descr> @{method hypsubst} performs substitution using some assumption; this only
   works for equations of the form \<open>x = t\<close> where \<open>x\<close> is a free or bound
   variable.
 
   \<^descr> @{method split}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> performs single-step case splitting using the
   given rules. Splitting is performed in the conclusion or some assumption of
   the subgoal, depending of the structure of the rule.
   
   Note that the @{method simp} method already involves repeated application of
   split rules as declared in the current context, using @{attribute split},
   for example.
 \<close>
 
 
 section \<open>The Simplifier \label{sec:simplifier}\<close>
 
 text \<open>
   The Simplifier performs conditional and unconditional rewriting and uses
   contextual information: rule declarations in the background theory or local
   proof context are taken into account, as well as chained facts and subgoal
   premises (``local assumptions''). There are several general hooks that allow
   to modify the simplification strategy, or incorporate other proof tools that
   solve sub-problems, produce rewrite rules on demand etc.
 
   The rewriting strategy is always strictly bottom up, except for congruence
   rules, which are applied while descending into a term. Conditions in
   conditional rewrite rules are solved recursively before the rewrite rule is
   applied.
 
   The default Simplifier setup of major object logics (HOL, HOLCF, FOL, ZF)
   makes the Simplifier ready for immediate use, without engaging into the
   internal structures. Thus it serves as general-purpose proof tool with the
   main focus on equational reasoning, and a bit more than that.
 \<close>
 
 
 subsection \<open>Simplification methods \label{sec:simp-meth}\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{method_def simp} & : & \<open>method\<close> \\
     @{method_def simp_all} & : & \<open>method\<close> \\
     \<open>Pure.\<close>@{method_def (Pure) simp} & : & \<open>method\<close> \\
     \<open>Pure.\<close>@{method_def (Pure) simp_all} & : & \<open>method\<close> \\
     @{attribute_def simp_depth_limit} & : & \<open>attribute\<close> & default \<open>100\<close> \\
   \end{tabular}
   \<^medskip>
 
   \<^rail>\<open>
     (@@{method simp} | @@{method simp_all}) opt? (@{syntax simpmod} * )
     ;
 
     opt: '(' ('no_asm' | 'no_asm_simp' | 'no_asm_use' | 'asm_lr' ) ')'
     ;
     @{syntax_def simpmod}: ('add' | 'del' | 'flip' | 'only' |
       'split' (() | '!' | 'del') | 'cong' (() | 'add' | 'del'))
     ':' @{syntax thms}
   \<close>
 
   \<^descr> @{method simp} invokes the Simplifier on the first subgoal, after
   inserting chained facts as additional goal premises; further rule
   declarations may be included via \<open>(simp add: facts)\<close>. The proof method fails
   if the subgoal remains unchanged after simplification.
 
   Note that the original goal premises and chained facts are subject to
   simplification themselves, while declarations via \<open>add\<close>/\<open>del\<close> merely follow
   the policies of the object-logic to extract rewrite rules from theorems,
   without further simplification. This may lead to slightly different behavior
   in either case, which might be required precisely like that in some boundary
   situations to perform the intended simplification step!
 
   \<^medskip>
 Modifier \<open>flip\<close> deletes the following theorems from the simpset and adds
 their symmetric version (i.e.\ lhs and rhs exchanged). No warning is shown
 if the original theorem was not present.
 
   \<^medskip>
   The \<open>only\<close> modifier first removes all other rewrite rules, looper tactics
   (including split rules), congruence rules, and then behaves like \<open>add\<close>.
   Implicit solvers remain, which means that trivial rules like reflexivity or
   introduction of \<open>True\<close> are available to solve the simplified subgoals, but
   also non-trivial tools like linear arithmetic in HOL. The latter may lead to
   some surprise of the meaning of ``only'' in Isabelle/HOL compared to
   English!
 
   \<^medskip>
   The \<open>split\<close> modifiers add or delete rules for the Splitter (see also
   \secref{sec:simp-strategies} on the looper). This works only if the
   Simplifier method has been properly setup to include the Splitter (all major
   object logics such HOL, HOLCF, FOL, ZF do this already).
   The \<open>!\<close> option causes the split rules to be used aggressively:
   after each application of a split rule in the conclusion, the \<open>safe\<close>
   tactic of the classical reasoner (see \secref{sec:classical:partial})
   is applied to the new goal. The net effect is that the goal is split into
   the different cases. This option can speed up simplification of goals
   with many nested conditional or case expressions significantly.
 
   There is also a separate @{method_ref split} method available for
   single-step case splitting. The effect of repeatedly applying \<open>(split thms)\<close>
   can be imitated by ``\<open>(simp only: split: thms)\<close>''.
 
   \<^medskip>
   The \<open>cong\<close> modifiers add or delete Simplifier congruence rules (see also
   \secref{sec:simp-rules}); the default is to add.
 
   \<^descr> @{method simp_all} is similar to @{method simp}, but acts on all goals,
   working backwards from the last to the first one as usual in Isabelle.\<^footnote>\<open>The
   order is irrelevant for goals without schematic variables, so simplification
   might actually be performed in parallel here.\<close>
 
   Chained facts are inserted into all subgoals, before the simplification
   process starts. Further rule declarations are the same as for @{method
   simp}.
 
   The proof method fails if all subgoals remain unchanged after
   simplification.
 
   \<^descr> @{attribute simp_depth_limit} limits the number of recursive invocations
   of the Simplifier during conditional rewriting.
 
 
   By default the Simplifier methods above take local assumptions fully into
   account, using equational assumptions in the subsequent normalization
   process, or simplifying assumptions themselves. Further options allow to
   fine-tune the behavior of the Simplifier in this respect, corresponding to a
   variety of ML tactics as follows.\<^footnote>\<open>Unlike the corresponding Isar proof
   methods, the ML tactics do not insist in changing the goal state.\<close>
 
   \begin{center}
   \small
   \begin{tabular}{|l|l|p{0.3\textwidth}|}
   \hline
   Isar method & ML tactic & behavior \\\hline
 
   \<open>(simp (no_asm))\<close> & \<^ML>\<open>simp_tac\<close> & assumptions are ignored completely
   \\\hline
 
   \<open>(simp (no_asm_simp))\<close> & \<^ML>\<open>asm_simp_tac\<close> & assumptions are used in the
   simplification of the conclusion but are not themselves simplified \\\hline
 
   \<open>(simp (no_asm_use))\<close> & \<^ML>\<open>full_simp_tac\<close> & assumptions are simplified but
   are not used in the simplification of each other or the conclusion \\\hline
 
   \<open>(simp)\<close> & \<^ML>\<open>asm_full_simp_tac\<close> & assumptions are used in the
   simplification of the conclusion and to simplify other assumptions \\\hline
 
   \<open>(simp (asm_lr))\<close> & \<^ML>\<open>asm_lr_simp_tac\<close> & compatibility mode: an
   assumption is only used for simplifying assumptions which are to the right
   of it \\\hline
 
   \end{tabular}
   \end{center}
 
   \<^medskip>
   In Isabelle/Pure, proof methods @{method (Pure) simp} and @{method (Pure)
   simp_all} only know about meta-equality \<open>\<equiv>\<close>. Any new object-logic needs to
   re-define these methods via \<^ML>\<open>Simplifier.method_setup\<close> in ML:
   Isabelle/FOL or Isabelle/HOL may serve as blue-prints.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   We consider basic algebraic simplifications in Isabelle/HOL. The rather
   trivial goal \<^prop>\<open>0 + (x + 0) = x + 0 + 0\<close> looks like a good candidate
   to be solved by a single call of @{method simp}:
 \<close>
 
 lemma "0 + (x + 0) = x + 0 + 0" apply simp? oops
 
 text \<open>
   The above attempt \<^emph>\<open>fails\<close>, because \<^term>\<open>0\<close> and \<^term>\<open>(+)\<close> in the
   HOL library are declared as generic type class operations, without stating
   any algebraic laws yet. More specific types are required to get access to
   certain standard simplifications of the theory context, e.g.\ like this:\<close>
 
 lemma fixes x :: nat shows "0 + (x + 0) = x + 0 + 0" by simp
 lemma fixes x :: int shows "0 + (x + 0) = x + 0 + 0" by simp
 lemma fixes x :: "'a :: monoid_add" shows "0 + (x + 0) = x + 0 + 0" by simp
 
 text \<open>
   \<^medskip>
   In many cases, assumptions of a subgoal are also needed in the
   simplification process. For example:
 \<close>
 
 lemma fixes x :: nat shows "x = 0 \<Longrightarrow> x + x = 0" by simp
 lemma fixes x :: nat assumes "x = 0" shows "x + x = 0" apply simp oops
 lemma fixes x :: nat assumes "x = 0" shows "x + x = 0" using assms by simp
 
 text \<open>
   As seen above, local assumptions that shall contribute to simplification
   need to be part of the subgoal already, or indicated explicitly for use by
   the subsequent method invocation. Both too little or too much information
   can make simplification fail, for different reasons.
 
   In the next example the malicious assumption \<^prop>\<open>\<And>x::nat. f x = g (f (g
   x))\<close> does not contribute to solve the problem, but makes the default
   @{method simp} method loop: the rewrite rule \<open>f ?x \<equiv> g (f (g ?x))\<close> extracted
   from the assumption does not terminate. The Simplifier notices certain
   simple forms of nontermination, but not this one. The problem can be solved
   nonetheless, by ignoring assumptions via special options as explained
   before:
 \<close>
 
 lemma "(\<And>x::nat. f x = g (f (g x))) \<Longrightarrow> f 0 = f 0 + 0"
   by (simp (no_asm))
 
 text \<open>
   The latter form is typical for long unstructured proof scripts, where the
   control over the goal content is limited. In structured proofs it is usually
   better to avoid pushing too many facts into the goal state in the first
   place. Assumptions in the Isar proof context do not intrude the reasoning if
   not used explicitly. This is illustrated for a toplevel statement and a
   local proof body as follows:
 \<close>
 
 lemma
   assumes "\<And>x::nat. f x = g (f (g x))"
   shows "f 0 = f 0 + 0" by simp
 
 notepad
 begin
   assume "\<And>x::nat. f x = g (f (g x))"
   have "f 0 = f 0 + 0" by simp
 end
 
 text \<open>
   \<^medskip>
   Because assumptions may simplify each other, there can be very subtle cases
   of nontermination. For example, the regular @{method simp} method applied to
   \<^prop>\<open>P (f x) \<Longrightarrow> y = x \<Longrightarrow> f x = f y \<Longrightarrow> Q\<close> gives rise to the infinite
   reduction sequence
   \[
   \<open>P (f x)\<close> \stackrel{\<open>f x \<equiv> f y\<close>}{\longmapsto}
   \<open>P (f y)\<close> \stackrel{\<open>y \<equiv> x\<close>}{\longmapsto}
   \<open>P (f x)\<close> \stackrel{\<open>f x \<equiv> f y\<close>}{\longmapsto} \cdots
   \]
   whereas applying the same to \<^prop>\<open>y = x \<Longrightarrow> f x = f y \<Longrightarrow> P (f x) \<Longrightarrow> Q\<close>
   terminates (without solving the goal):
 \<close>
 
 lemma "y = x \<Longrightarrow> f x = f y \<Longrightarrow> P (f x) \<Longrightarrow> Q"
   apply simp
   oops
 
 text \<open>
   See also \secref{sec:simp-trace} for options to enable Simplifier trace
   mode, which often helps to diagnose problems with rewrite systems.
 \<close>
 
 
 subsection \<open>Declaring rules \label{sec:simp-rules}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{attribute_def simp} & : & \<open>attribute\<close> \\
     @{attribute_def split} & : & \<open>attribute\<close> \\
     @{attribute_def cong} & : & \<open>attribute\<close> \\
     @{command_def "print_simpset"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{attribute simp} | @@{attribute cong}) (() | 'add' | 'del') |
     @@{attribute split} (() | '!' | 'del')
     ;
     @@{command print_simpset} ('!'?)
   \<close>
 
   \<^descr> @{attribute simp} declares rewrite rules, by adding or deleting them from
   the simpset within the theory or proof context. Rewrite rules are theorems
   expressing some form of equality, for example:
 
   \<open>Suc ?m + ?n = ?m + Suc ?n\<close> \\
   \<open>?P \<and> ?P \<longleftrightarrow> ?P\<close> \\
   \<open>?A \<union> ?B \<equiv> {x. x \<in> ?A \<or> x \<in> ?B}\<close>
 
   \<^medskip>
   Conditional rewrites such as \<open>?m < ?n \<Longrightarrow> ?m div ?n = 0\<close> are also permitted;
   the conditions can be arbitrary formulas.
 
   \<^medskip>
   Internally, all rewrite rules are translated into Pure equalities, theorems
   with conclusion \<open>lhs \<equiv> rhs\<close>. The simpset contains a function for extracting
   equalities from arbitrary theorems, which is usually installed when the
   object-logic is configured initially. For example, \<open>\<not> ?x \<in> {}\<close> could be
   turned into \<open>?x \<in> {} \<equiv> False\<close>. Theorems that are declared as @{attribute
   simp} and local assumptions within a goal are treated uniformly in this
   respect.
 
   The Simplifier accepts the following formats for the \<open>lhs\<close> term:
 
     \<^enum> First-order patterns, considering the sublanguage of application of
     constant operators to variable operands, without \<open>\<lambda>\<close>-abstractions or
     functional variables. For example:
 
     \<open>(?x + ?y) + ?z \<equiv> ?x + (?y + ?z)\<close> \\
     \<open>f (f ?x ?y) ?z \<equiv> f ?x (f ?y ?z)\<close>
 
     \<^enum> Higher-order patterns in the sense of @{cite "nipkow-patterns"}. These
     are terms in \<open>\<beta>\<close>-normal form (this will always be the case unless you have
     done something strange) where each occurrence of an unknown is of the form
     \<open>?F x\<^sub>1 \<dots> x\<^sub>n\<close>, where the \<open>x\<^sub>i\<close> are distinct bound variables.
 
     For example, \<open>(\<forall>x. ?P x \<and> ?Q x) \<equiv> (\<forall>x. ?P x) \<and> (\<forall>x. ?Q x)\<close> or its
     symmetric form, since the \<open>rhs\<close> is also a higher-order pattern.
 
     \<^enum> Physical first-order patterns over raw \<open>\<lambda>\<close>-term structure without
     \<open>\<alpha>\<beta>\<eta>\<close>-equality; abstractions and bound variables are treated like
     quasi-constant term material.
 
     For example, the rule \<open>?f ?x \<in> range ?f = True\<close> rewrites the term \<open>g a \<in>
     range g\<close> to \<open>True\<close>, but will fail to match \<open>g (h b) \<in> range (\<lambda>x. g (h
     x))\<close>. However, offending subterms (in our case \<open>?f ?x\<close>, which is not a
     pattern) can be replaced by adding new variables and conditions like this:
     \<open>?y = ?f ?x \<Longrightarrow> ?y \<in> range ?f = True\<close> is acceptable as a conditional rewrite
     rule of the second category since conditions can be arbitrary terms.
 
   \<^descr> @{attribute split} declares case split rules.
 
   \<^descr> @{attribute cong} declares congruence rules to the Simplifier context.
 
   Congruence rules are equalities of the form @{text [display]
   "\<dots> \<Longrightarrow> f ?x\<^sub>1 \<dots> ?x\<^sub>n = f ?y\<^sub>1 \<dots> ?y\<^sub>n"}
 
   This controls the simplification of the arguments of \<open>f\<close>. For example, some
   arguments can be simplified under additional assumptions:
   @{text [display]
     "?P\<^sub>1 \<longleftrightarrow> ?Q\<^sub>1 \<Longrightarrow>
     (?Q\<^sub>1 \<Longrightarrow> ?P\<^sub>2 \<longleftrightarrow> ?Q\<^sub>2) \<Longrightarrow>
     (?P\<^sub>1 \<longrightarrow> ?P\<^sub>2) \<longleftrightarrow> (?Q\<^sub>1 \<longrightarrow> ?Q\<^sub>2)"}
 
   Given this rule, the Simplifier assumes \<open>?Q\<^sub>1\<close> and extracts rewrite rules
   from it when simplifying \<open>?P\<^sub>2\<close>. Such local assumptions are effective for
   rewriting formulae such as \<open>x = 0 \<longrightarrow> y + x = y\<close>.
 
   %FIXME
   %The local assumptions are also provided as theorems to the solver;
   %see \secref{sec:simp-solver} below.
 
   \<^medskip>
   The following congruence rule for bounded quantifiers also supplies
   contextual information --- about the bound variable: @{text [display]
   "(?A = ?B) \<Longrightarrow>
     (\<And>x. x \<in> ?B \<Longrightarrow> ?P x \<longleftrightarrow> ?Q x) \<Longrightarrow>
     (\<forall>x \<in> ?A. ?P x) \<longleftrightarrow> (\<forall>x \<in> ?B. ?Q x)"}
 
   \<^medskip>
   This congruence rule for conditional expressions can supply contextual
   information for simplifying the arms: @{text [display]
   "?p = ?q \<Longrightarrow>
     (?q \<Longrightarrow> ?a = ?c) \<Longrightarrow>
     (\<not> ?q \<Longrightarrow> ?b = ?d) \<Longrightarrow>
     (if ?p then ?a else ?b) = (if ?q then ?c else ?d)"}
 
   A congruence rule can also \<^emph>\<open>prevent\<close> simplification of some arguments. Here
   is an alternative congruence rule for conditional expressions that conforms
   to non-strict functional evaluation: @{text [display]
   "?p = ?q \<Longrightarrow>
     (if ?p then ?a else ?b) = (if ?q then ?a else ?b)"}
 
   Only the first argument is simplified; the others remain unchanged. This can
   make simplification much faster, but may require an extra case split over
   the condition \<open>?q\<close> to prove the goal.
 
   \<^descr> @{command "print_simpset"} prints the collection of rules declared to the
   Simplifier, which is also known as ``simpset'' internally; the ``\<open>!\<close>''
   option indicates extra verbosity.
 
   The implicit simpset of the theory context is propagated monotonically
   through the theory hierarchy: forming a new theory, the union of the
   simpsets of its imports are taken as starting point. Also note that
   definitional packages like @{command "datatype"}, @{command "primrec"},
   @{command "fun"} routinely declare Simplifier rules to the target context,
   while plain @{command "definition"} is an exception in \<^emph>\<open>not\<close> declaring
   anything.
 
   \<^medskip>
   It is up the user to manipulate the current simpset further by explicitly
   adding or deleting theorems as simplification rules, or installing other
   tools via simplification procedures (\secref{sec:simproc}). Good simpsets
   are hard to design. Rules that obviously simplify, like \<open>?n + 0 \<equiv> ?n\<close> are
   good candidates for the implicit simpset, unless a special non-normalizing
   behavior of certain operations is intended. More specific rules (such as
   distributive laws, which duplicate subterms) should be added only for
   specific proof steps. Conversely, sometimes a rule needs to be deleted just
   for some part of a proof. The need of frequent additions or deletions may
   indicate a poorly designed simpset.
 
   \begin{warn}
   The union of simpsets from theory imports (as described above) is not always
   a good starting point for the new theory. If some ancestors have deleted
   simplification rules because they are no longer wanted, while others have
   left those rules in, then the union will contain the unwanted rules, and
   thus have to be deleted again in the theory body.
   \end{warn}
 \<close>
 
 
 subsection \<open>Ordered rewriting with permutative rules\<close>
 
 text \<open>
   A rewrite rule is \<^emph>\<open>permutative\<close> if the left-hand side and right-hand side
   are the equal up to renaming of variables. The most common permutative rule
   is commutativity: \<open>?x + ?y = ?y + ?x\<close>. Other examples include \<open>(?x - ?y) -
   ?z = (?x - ?z) - ?y\<close> in arithmetic and \<open>insert ?x (insert ?y ?A) = insert ?y
   (insert ?x ?A)\<close> for sets. Such rules are common enough to merit special
   attention.
 
   Because ordinary rewriting loops given such rules, the Simplifier employs a
   special strategy, called \<^emph>\<open>ordered rewriting\<close>. Permutative rules are
   detected and only applied if the rewriting step decreases the redex wrt.\ a
   given term ordering. For example, commutativity rewrites \<open>b + a\<close> to \<open>a + b\<close>,
   but then stops, because the redex cannot be decreased further in the sense
   of the term ordering.
 
   The default is lexicographic ordering of term structure, but this could be
-  also changed locally for special applications via @{index_ML
+  also changed locally for special applications via @{define_ML
   Simplifier.set_term_ord} in Isabelle/ML.
 
   \<^medskip>
   Permutative rewrite rules are declared to the Simplifier just like other
   rewrite rules. Their special status is recognized automatically, and their
   application is guarded by the term ordering accordingly.
 \<close>
 
 
 subsubsection \<open>Rewriting with AC operators\<close>
 
 text \<open>
   Ordered rewriting is particularly effective in the case of
   associative-commutative operators. (Associativity by itself is not
   permutative.) When dealing with an AC-operator \<open>f\<close>, keep the following
   points in mind:
 
     \<^item> The associative law must always be oriented from left to right, namely
     \<open>f (f x y) z = f x (f y z)\<close>. The opposite orientation, if used with
     commutativity, leads to looping in conjunction with the standard term
     order.
 
     \<^item> To complete your set of rewrite rules, you must add not just
     associativity (A) and commutativity (C) but also a derived rule
     \<^emph>\<open>left-commutativity\<close> (LC): \<open>f x (f y z) = f y (f x z)\<close>.
 
   Ordered rewriting with the combination of A, C, and LC sorts a term
   lexicographically --- the rewriting engine imitates bubble-sort.
 \<close>
 
 experiment
   fixes f :: "'a \<Rightarrow> 'a \<Rightarrow> 'a"  (infix "\<bullet>" 60)
   assumes assoc: "(x \<bullet> y) \<bullet> z = x \<bullet> (y \<bullet> z)"
   assumes commute: "x \<bullet> y = y \<bullet> x"
 begin
 
 lemma left_commute: "x \<bullet> (y \<bullet> z) = y \<bullet> (x \<bullet> z)"
 proof -
   have "(x \<bullet> y) \<bullet> z = (y \<bullet> x) \<bullet> z" by (simp only: commute)
   then show ?thesis by (simp only: assoc)
 qed
 
 lemmas AC_rules = assoc commute left_commute
 
 text \<open>
   Thus the Simplifier is able to establish equalities with arbitrary
   permutations of subterms, by normalizing to a common standard form. For
   example:
 \<close>
 
 lemma "(b \<bullet> c) \<bullet> a = xxx"
   apply (simp only: AC_rules)
   txt \<open>\<^subgoals>\<close>
   oops
 
 lemma "(b \<bullet> c) \<bullet> a = a \<bullet> (b \<bullet> c)" by (simp only: AC_rules)
 lemma "(b \<bullet> c) \<bullet> a = c \<bullet> (b \<bullet> a)" by (simp only: AC_rules)
 lemma "(b \<bullet> c) \<bullet> a = (c \<bullet> b) \<bullet> a" by (simp only: AC_rules)
 
 end
 
 text \<open>
   Martin and Nipkow @{cite "martin-nipkow"} discuss the theory and give many
   examples; other algebraic structures are amenable to ordered rewriting, such
   as Boolean rings. The Boyer-Moore theorem prover @{cite bm88book} also
   employs ordered rewriting.
 \<close>
 
 
 subsubsection \<open>Re-orienting equalities\<close>
 
 text \<open>Another application of ordered rewriting uses the derived rule
   @{thm [source] eq_commute}: @{thm [source = false] eq_commute} to
   reverse equations.
 
   This is occasionally useful to re-orient local assumptions according
   to the term ordering, when other built-in mechanisms of
   reorientation and mutual simplification fail to apply.\<close>
 
 
 subsection \<open>Simplifier tracing and debugging \label{sec:simp-trace}\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def simp_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def simp_trace_depth_limit} & : & \<open>attribute\<close> & default \<open>1\<close> \\
     @{attribute_def simp_debug} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def simp_trace_new} & : & \<open>attribute\<close> \\
     @{attribute_def simp_break} & : & \<open>attribute\<close> \\
   \end{tabular}
   \<^medskip>
 
   \<^rail>\<open>
     @@{attribute simp_trace_new} ('interactive')? \<newline>
       ('mode' '=' ('full' | 'normal'))? \<newline>
       ('depth' '=' @{syntax nat})?
     ;
 
     @@{attribute simp_break} (@{syntax term}*)
   \<close>
 
   These attributes and configurations options control various aspects of
   Simplifier tracing and debugging.
 
   \<^descr> @{attribute simp_trace} makes the Simplifier output internal operations.
   This includes rewrite steps, but also bookkeeping like modifications of the
   simpset.
 
   \<^descr> @{attribute simp_trace_depth_limit} limits the effect of @{attribute
   simp_trace} to the given depth of recursive Simplifier invocations (when
   solving conditions of rewrite rules).
 
   \<^descr> @{attribute simp_debug} makes the Simplifier output some extra information
   about internal operations. This includes any attempted invocation of
   simplification procedures.
 
   \<^descr> @{attribute simp_trace_new} controls Simplifier tracing within
   Isabelle/PIDE applications, notably Isabelle/jEdit @{cite "isabelle-jedit"}.
   This provides a hierarchical representation of the rewriting steps performed
   by the Simplifier.
 
   Users can configure the behaviour by specifying breakpoints, verbosity and
   enabling or disabling the interactive mode. In normal verbosity (the
   default), only rule applications matching a breakpoint will be shown to the
   user. In full verbosity, all rule applications will be logged. Interactive
   mode interrupts the normal flow of the Simplifier and defers the decision
   how to continue to the user via some GUI dialog.
 
   \<^descr> @{attribute simp_break} declares term or theorem breakpoints for
   @{attribute simp_trace_new} as described above. Term breakpoints are
   patterns which are checked for matches on the redex of a rule application.
   Theorem breakpoints trigger when the corresponding theorem is applied in a
   rewrite step. For example:
 \<close>
 
 (*<*)experiment begin(*>*)
 declare conjI [simp_break]
 declare [[simp_break "?x \<and> ?y"]]
 (*<*)end(*>*)
 
 
 subsection \<open>Simplification procedures \label{sec:simproc}\<close>
 
 text \<open>
   Simplification procedures are ML functions that produce proven rewrite rules
   on demand. They are associated with higher-order patterns that approximate
   the left-hand sides of equations. The Simplifier first matches the current
   redex against one of the LHS patterns; if this succeeds, the corresponding
   ML function is invoked, passing the Simplifier context and redex term. Thus
   rules may be specifically fashioned for particular situations, resulting in
   a more powerful mechanism than term rewriting by a fixed set of rules.
 
   Any successful result needs to be a (possibly conditional) rewrite rule \<open>t \<equiv>
   u\<close> that is applicable to the current redex. The rule will be applied just as
   any ordinary rewrite rule. It is expected to be already in \<^emph>\<open>internal form\<close>,
   bypassing the automatic preprocessing of object-level equivalences.
 
   \begin{matharray}{rcl}
     @{command_def "simproc_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     simproc & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command simproc_setup} @{syntax name} '(' (@{syntax term} + '|') ')' '='
       @{syntax text};
 
     @@{attribute simproc} (('add' ':')? | 'del' ':') (@{syntax name}+)
   \<close>
 
   \<^descr> @{command "simproc_setup"} defines a named simplification procedure that
   is invoked by the Simplifier whenever any of the given term patterns match
   the current redex. The implementation, which is provided as ML source text,
   needs to be of type
   \<^ML_type>\<open>morphism -> Proof.context -> cterm -> thm option\<close>, where the
   \<^ML_type>\<open>cterm\<close> represents the current redex \<open>r\<close> and the result is supposed
   to be some proven rewrite rule \<open>r \<equiv> r'\<close> (or a generalized version), or \<^ML>\<open>NONE\<close> to indicate failure. The \<^ML_type>\<open>Proof.context\<close> argument holds the
   full context of the current Simplifier invocation. The \<^ML_type>\<open>morphism\<close>
   informs about the difference of the original compilation context wrt.\ the
   one of the actual application later on.
 
   Morphisms are only relevant for simprocs that are defined within a local
   target context, e.g.\ in a locale.
 
   \<^descr> \<open>simproc add: name\<close> and \<open>simproc del: name\<close> add or delete named simprocs
   to the current Simplifier context. The default is to add a simproc. Note
   that @{command "simproc_setup"} already adds the new simproc to the
   subsequent context.
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 text \<open>
   The following simplification procedure for @{thm [source = false,
   show_types] unit_eq} in HOL performs fine-grained control over rule
   application, beyond higher-order pattern matching. Declaring @{thm unit_eq}
   as @{attribute simp} directly would make the Simplifier loop! Note that a
   version of this simplification procedure is already active in Isabelle/HOL.
 \<close>
 
 (*<*)experiment begin(*>*)
 simproc_setup unit ("x::unit") =
   \<open>fn _ => fn _ => fn ct =>
     if HOLogic.is_unit (Thm.term_of ct) then NONE
     else SOME (mk_meta_eq @{thm unit_eq})\<close>
 (*<*)end(*>*)
 
 text \<open>
   Since the Simplifier applies simplification procedures frequently, it is
   important to make the failure check in ML reasonably fast.\<close>
 
 
 subsection \<open>Configurable Simplifier strategies \label{sec:simp-strategies}\<close>
 
 text \<open>
   The core term-rewriting engine of the Simplifier is normally used in
   combination with some add-on components that modify the strategy and allow
   to integrate other non-Simplifier proof tools. These may be reconfigured in
   ML as explained below. Even if the default strategies of object-logics like
   Isabelle/HOL are used unchanged, it helps to understand how the standard
   Simplifier strategies work.\<close>
 
 
 subsubsection \<open>The subgoaler\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML Simplifier.set_subgoaler: "(Proof.context -> int -> tactic) ->
+  @{define_ML Simplifier.set_subgoaler: "(Proof.context -> int -> tactic) ->
   Proof.context -> Proof.context"} \\
-  @{index_ML Simplifier.prems_of: "Proof.context -> thm list"} \\
+  @{define_ML Simplifier.prems_of: "Proof.context -> thm list"} \\
   \end{mldecls}
 
   The subgoaler is the tactic used to solve subgoals arising out of
   conditional rewrite rules or congruence rules. The default should be
   simplification itself. In rare situations, this strategy may need to be
   changed. For example, if the premise of a conditional rule is an instance of
   its conclusion, as in \<open>Suc ?m < ?n \<Longrightarrow> ?m < ?n\<close>, the default strategy could
   loop. % FIXME !??
 
     \<^descr> \<^ML>\<open>Simplifier.set_subgoaler\<close>~\<open>tac ctxt\<close> sets the subgoaler of the
     context to \<open>tac\<close>. The tactic will be applied to the context of the running
     Simplifier instance.
 
     \<^descr> \<^ML>\<open>Simplifier.prems_of\<close>~\<open>ctxt\<close> retrieves the current set of premises
     from the context. This may be non-empty only if the Simplifier has been
     told to utilize local assumptions in the first place (cf.\ the options in
     \secref{sec:simp-meth}).
 
   As an example, consider the following alternative subgoaler:
 \<close>
 
 ML_val \<open>
   fun subgoaler_tac ctxt =
     assume_tac ctxt ORELSE'
     resolve_tac ctxt (Simplifier.prems_of ctxt) ORELSE'
     asm_simp_tac ctxt
 \<close>
 
 text \<open>
   This tactic first tries to solve the subgoal by assumption or by resolving
   with with one of the premises, calling simplification only if that fails.\<close>
 
 
 subsubsection \<open>The solver\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML_type solver} \\
-  @{index_ML Simplifier.mk_solver: "string ->
+  @{define_ML_type solver} \\
+  @{define_ML Simplifier.mk_solver: "string ->
   (Proof.context -> int -> tactic) -> solver"} \\
-  @{index_ML_op setSolver: "Proof.context * solver -> Proof.context"} \\
-  @{index_ML_op addSolver: "Proof.context * solver -> Proof.context"} \\
-  @{index_ML_op setSSolver: "Proof.context * solver -> Proof.context"} \\
-  @{index_ML_op addSSolver: "Proof.context * solver -> Proof.context"} \\
+  @{define_ML_infix setSolver: "Proof.context * solver -> Proof.context"} \\
+  @{define_ML_infix addSolver: "Proof.context * solver -> Proof.context"} \\
+  @{define_ML_infix setSSolver: "Proof.context * solver -> Proof.context"} \\
+  @{define_ML_infix addSSolver: "Proof.context * solver -> Proof.context"} \\
   \end{mldecls}
 
   A solver is a tactic that attempts to solve a subgoal after simplification.
   Its core functionality is to prove trivial subgoals such as \<^prop>\<open>True\<close>
   and \<open>t = t\<close>, but object-logics might be more ambitious. For example,
   Isabelle/HOL performs a restricted version of linear arithmetic here.
 
   Solvers are packaged up in abstract type \<^ML_type>\<open>solver\<close>, with \<^ML>\<open>Simplifier.mk_solver\<close> as the only operation to create a solver.
 
   \<^medskip>
   Rewriting does not instantiate unknowns. For example, rewriting alone cannot
   prove \<open>a \<in> ?A\<close> since this requires instantiating \<open>?A\<close>. The solver, however,
   is an arbitrary tactic and may instantiate unknowns as it pleases. This is
   the only way the Simplifier can handle a conditional rewrite rule whose
   condition contains extra variables. When a simplification tactic is to be
   combined with other provers, especially with the Classical Reasoner, it is
   important whether it can be considered safe or not. For this reason a
   simpset contains two solvers: safe and unsafe.
 
   The standard simplification strategy solely uses the unsafe solver, which is
   appropriate in most cases. For special applications where the simplification
   process is not allowed to instantiate unknowns within the goal,
   simplification starts with the safe solver, but may still apply the ordinary
   unsafe one in nested simplifications for conditional rules or congruences.
   Note that in this way the overall tactic is not totally safe: it may
   instantiate unknowns that appear also in other subgoals.
 
   \<^descr> \<^ML>\<open>Simplifier.mk_solver\<close>~\<open>name tac\<close> turns \<open>tac\<close> into a solver; the
   \<open>name\<close> is only attached as a comment and has no further significance.
 
   \<^descr> \<open>ctxt setSSolver solver\<close> installs \<open>solver\<close> as the safe solver of \<open>ctxt\<close>.
 
   \<^descr> \<open>ctxt addSSolver solver\<close> adds \<open>solver\<close> as an additional safe solver; it
   will be tried after the solvers which had already been present in \<open>ctxt\<close>.
 
   \<^descr> \<open>ctxt setSolver solver\<close> installs \<open>solver\<close> as the unsafe solver of \<open>ctxt\<close>.
 
   \<^descr> \<open>ctxt addSolver solver\<close> adds \<open>solver\<close> as an additional unsafe solver; it
   will be tried after the solvers which had already been present in \<open>ctxt\<close>.
 
 
   \<^medskip>
   The solver tactic is invoked with the context of the running Simplifier.
   Further operations may be used to retrieve relevant information, such as the
   list of local Simplifier premises via \<^ML>\<open>Simplifier.prems_of\<close> --- this
   list may be non-empty only if the Simplifier runs in a mode that utilizes
   local assumptions (see also \secref{sec:simp-meth}). The solver is also
   presented the full goal including its assumptions in any case. Thus it can
   use these (e.g.\ by calling \<^ML>\<open>assume_tac\<close>), even if the Simplifier proper
   happens to ignore local premises at the moment.
 
   \<^medskip>
   As explained before, the subgoaler is also used to solve the premises of
   congruence rules. These are usually of the form \<open>s = ?x\<close>, where \<open>s\<close> needs to
   be simplified and \<open>?x\<close> needs to be instantiated with the result. Typically,
   the subgoaler will invoke the Simplifier at some point, which will
   eventually call the solver. For this reason, solver tactics must be prepared
   to solve goals of the form \<open>t = ?x\<close>, usually by reflexivity. In particular,
   reflexivity should be tried before any of the fancy automated proof tools.
 
   It may even happen that due to simplification the subgoal is no longer an
   equality. For example, \<open>False \<longleftrightarrow> ?Q\<close> could be rewritten to \<open>\<not> ?Q\<close>. To cover
   this case, the solver could try resolving with the theorem \<open>\<not> False\<close> of the
   object-logic.
 
   \<^medskip>
   \begin{warn}
   If a premise of a congruence rule cannot be proved, then the congruence is
   ignored. This should only happen if the rule is \<^emph>\<open>conditional\<close> --- that is,
   contains premises not of the form \<open>t = ?x\<close>. Otherwise it indicates that some
   congruence rule, or possibly the subgoaler or solver, is faulty.
   \end{warn}
 \<close>
 
 
 subsubsection \<open>The looper\<close>
 
 text \<open>
   \begin{mldecls}
-  @{index_ML_op setloop: "Proof.context *
+  @{define_ML_infix setloop: "Proof.context *
   (Proof.context -> int -> tactic) -> Proof.context"} \\
-  @{index_ML_op addloop: "Proof.context *
+  @{define_ML_infix addloop: "Proof.context *
   (string * (Proof.context -> int -> tactic))
   -> Proof.context"} \\
-  @{index_ML_op delloop: "Proof.context * string -> Proof.context"} \\
-  @{index_ML Splitter.add_split: "thm -> Proof.context -> Proof.context"} \\
-  @{index_ML Splitter.add_split: "thm -> Proof.context -> Proof.context"} \\
-  @{index_ML Splitter.add_split_bang: "
+  @{define_ML_infix delloop: "Proof.context * string -> Proof.context"} \\
+  @{define_ML Splitter.add_split: "thm -> Proof.context -> Proof.context"} \\
+  @{define_ML Splitter.add_split: "thm -> Proof.context -> Proof.context"} \\
+  @{define_ML Splitter.add_split_bang: "
   thm -> Proof.context -> Proof.context"} \\
-  @{index_ML Splitter.del_split: "thm -> Proof.context -> Proof.context"} \\
+  @{define_ML Splitter.del_split: "thm -> Proof.context -> Proof.context"} \\
   \end{mldecls}
 
   The looper is a list of tactics that are applied after simplification, in
   case the solver failed to solve the simplified goal. If the looper succeeds,
   the simplification process is started all over again. Each of the subgoals
   generated by the looper is attacked in turn, in reverse order.
 
   A typical looper is \<^emph>\<open>case splitting\<close>: the expansion of a conditional.
   Another possibility is to apply an elimination rule on the assumptions. More
   adventurous loopers could start an induction.
 
     \<^descr> \<open>ctxt setloop tac\<close> installs \<open>tac\<close> as the only looper tactic of \<open>ctxt\<close>.
 
     \<^descr> \<open>ctxt addloop (name, tac)\<close> adds \<open>tac\<close> as an additional looper tactic
     with name \<open>name\<close>, which is significant for managing the collection of
     loopers. The tactic will be tried after the looper tactics that had
     already been present in \<open>ctxt\<close>.
 
     \<^descr> \<open>ctxt delloop name\<close> deletes the looper tactic that was associated with
     \<open>name\<close> from \<open>ctxt\<close>.
 
     \<^descr> \<^ML>\<open>Splitter.add_split\<close>~\<open>thm ctxt\<close> adds split tactic
     for \<open>thm\<close> as additional looper tactic of \<open>ctxt\<close>
     (overwriting previous split tactic for the same constant).
 
     \<^descr> \<^ML>\<open>Splitter.add_split_bang\<close>~\<open>thm ctxt\<close> adds aggressive
     (see \S\ref{sec:simp-meth})
     split tactic for \<open>thm\<close> as additional looper tactic of \<open>ctxt\<close>
     (overwriting previous split tactic for the same constant).
 
     \<^descr> \<^ML>\<open>Splitter.del_split\<close>~\<open>thm ctxt\<close> deletes the split tactic
     corresponding to \<open>thm\<close> from the looper tactics of \<open>ctxt\<close>.
 
   The splitter replaces applications of a given function; the right-hand side
   of the replacement can be anything. For example, here is a splitting rule
   for conditional expressions:
 
   @{text [display] "?P (if ?Q ?x ?y) \<longleftrightarrow> (?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y)"}
 
   Another example is the elimination operator for Cartesian products (which
   happens to be called \<^const>\<open>case_prod\<close> in Isabelle/HOL:
 
   @{text [display] "?P (case_prod ?f ?p) \<longleftrightarrow> (\<forall>a b. ?p = (a, b) \<longrightarrow> ?P (f a b))"}
 
   For technical reasons, there is a distinction between case splitting in the
   conclusion and in the premises of a subgoal. The former is done by \<^ML>\<open>Splitter.split_tac\<close> with rules like @{thm [source] if_split} or @{thm
   [source] option.split}, which do not split the subgoal, while the latter is
   done by \<^ML>\<open>Splitter.split_asm_tac\<close> with rules like @{thm [source]
   if_split_asm} or @{thm [source] option.split_asm}, which split the subgoal.
   The function \<^ML>\<open>Splitter.add_split\<close> automatically takes care of which
   tactic to call, analyzing the form of the rules given as argument; it is the
   same operation behind \<open>split\<close> attribute or method modifier syntax in the
   Isar source language.
 
   Case splits should be allowed only when necessary; they are expensive and
   hard to control. Case-splitting on if-expressions in the conclusion is
   usually beneficial, so it is enabled by default in Isabelle/HOL and
   Isabelle/FOL/ZF.
 
   \begin{warn}
   With \<^ML>\<open>Splitter.split_asm_tac\<close> as looper component, the Simplifier may
   split subgoals! This might cause unexpected problems in tactic expressions
   that silently assume 0 or 1 subgoals after simplification.
   \end{warn}
 \<close>
 
 
 subsection \<open>Forward simplification \label{sec:simp-forward}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{attribute_def simplified} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute simplified} opt? @{syntax thms}?
     ;
 
     opt: '(' ('no_asm' | 'no_asm_simp' | 'no_asm_use') ')'
   \<close>
 
   \<^descr> @{attribute simplified}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> causes a theorem to be simplified,
   either by exactly the specified rules \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close>, or the implicit
   Simplifier context if no arguments are given. The result is fully simplified
   by default, including assumptions and conclusion; the options \<open>no_asm\<close> etc.\
   tune the Simplifier in the same way as the for the \<open>simp\<close> method.
 
   Note that forward simplification restricts the Simplifier to its most basic
   operation of term rewriting; solver and looper tactics
   (\secref{sec:simp-strategies}) are \<^emph>\<open>not\<close> involved here. The @{attribute
   simplified} attribute should be only rarely required under normal
   circumstances.
 \<close>
 
 
 section \<open>The Classical Reasoner \label{sec:classical}\<close>
 
 subsection \<open>Basic concepts\<close>
 
 text \<open>Although Isabelle is generic, many users will be working in
   some extension of classical first-order logic.  Isabelle/ZF is built
   upon theory FOL, while Isabelle/HOL conceptually contains
   first-order logic as a fragment.  Theorem-proving in predicate logic
   is undecidable, but many automated strategies have been developed to
   assist in this task.
 
   Isabelle's classical reasoner is a generic package that accepts
   certain information about a logic and delivers a suite of automatic
   proof tools, based on rules that are classified and declared in the
   context.  These proof procedures are slow and simplistic compared
   with high-end automated theorem provers, but they can save
   considerable time and effort in practice.  They can prove theorems
   such as Pelletier's @{cite pelletier86} problems 40 and 41 in a few
   milliseconds (including full proof reconstruction):\<close>
 
 lemma "(\<exists>y. \<forall>x. F x y \<longleftrightarrow> F x x) \<longrightarrow> \<not> (\<forall>x. \<exists>y. \<forall>z. F z y \<longleftrightarrow> \<not> F z x)"
   by blast
 
 lemma "(\<forall>z. \<exists>y. \<forall>x. f x y \<longleftrightarrow> f x z \<and> \<not> f x x) \<longrightarrow> \<not> (\<exists>z. \<forall>x. f x z)"
   by blast
 
 text \<open>The proof tools are generic.  They are not restricted to
   first-order logic, and have been heavily used in the development of
   the Isabelle/HOL library and applications.  The tactics can be
   traced, and their components can be called directly; in this manner,
   any proof can be viewed interactively.\<close>
 
 
 subsubsection \<open>The sequent calculus\<close>
 
 text \<open>Isabelle supports natural deduction, which is easy to use for
   interactive proof.  But natural deduction does not easily lend
   itself to automation, and has a bias towards intuitionism.  For
   certain proofs in classical logic, it can not be called natural.
   The \<^emph>\<open>sequent calculus\<close>, a generalization of natural deduction,
   is easier to automate.
 
   A \<^bold>\<open>sequent\<close> has the form \<open>\<Gamma> \<turnstile> \<Delta>\<close>, where \<open>\<Gamma>\<close>
   and \<open>\<Delta>\<close> are sets of formulae.\<^footnote>\<open>For first-order
   logic, sequents can equivalently be made from lists or multisets of
   formulae.\<close> The sequent \<open>P\<^sub>1, \<dots>, P\<^sub>m \<turnstile> Q\<^sub>1, \<dots>, Q\<^sub>n\<close> is
   \<^bold>\<open>valid\<close> if \<open>P\<^sub>1 \<and> \<dots> \<and> P\<^sub>m\<close> implies \<open>Q\<^sub>1 \<or> \<dots> \<or>
   Q\<^sub>n\<close>.  Thus \<open>P\<^sub>1, \<dots>, P\<^sub>m\<close> represent assumptions, each of which
   is true, while \<open>Q\<^sub>1, \<dots>, Q\<^sub>n\<close> represent alternative goals.  A
   sequent is \<^bold>\<open>basic\<close> if its left and right sides have a common
   formula, as in \<open>P, Q \<turnstile> Q, R\<close>; basic sequents are trivially
   valid.
 
   Sequent rules are classified as \<^bold>\<open>right\<close> or \<^bold>\<open>left\<close>,
   indicating which side of the \<open>\<turnstile>\<close> symbol they operate on.
   Rules that operate on the right side are analogous to natural
   deduction's introduction rules, and left rules are analogous to
   elimination rules.  The sequent calculus analogue of \<open>(\<longrightarrow>I)\<close>
   is the rule
   \[
   \infer[\<open>(\<longrightarrow>R)\<close>]{\<open>\<Gamma> \<turnstile> \<Delta>, P \<longrightarrow> Q\<close>}{\<open>P, \<Gamma> \<turnstile> \<Delta>, Q\<close>}
   \]
   Applying the rule backwards, this breaks down some implication on
   the right side of a sequent; \<open>\<Gamma>\<close> and \<open>\<Delta>\<close> stand for
   the sets of formulae that are unaffected by the inference.  The
   analogue of the pair \<open>(\<or>I1)\<close> and \<open>(\<or>I2)\<close> is the
   single rule
   \[
   \infer[\<open>(\<or>R)\<close>]{\<open>\<Gamma> \<turnstile> \<Delta>, P \<or> Q\<close>}{\<open>\<Gamma> \<turnstile> \<Delta>, P, Q\<close>}
   \]
   This breaks down some disjunction on the right side, replacing it by
   both disjuncts.  Thus, the sequent calculus is a kind of
   multiple-conclusion logic.
 
   To illustrate the use of multiple formulae on the right, let us
   prove the classical theorem \<open>(P \<longrightarrow> Q) \<or> (Q \<longrightarrow> P)\<close>.  Working
   backwards, we reduce this formula to a basic sequent:
   \[
   \infer[\<open>(\<or>R)\<close>]{\<open>\<turnstile> (P \<longrightarrow> Q) \<or> (Q \<longrightarrow> P)\<close>}
     {\infer[\<open>(\<longrightarrow>R)\<close>]{\<open>\<turnstile> (P \<longrightarrow> Q), (Q \<longrightarrow> P)\<close>}
       {\infer[\<open>(\<longrightarrow>R)\<close>]{\<open>P \<turnstile> Q, (Q \<longrightarrow> P)\<close>}
         {\<open>P, Q \<turnstile> Q, P\<close>}}}
   \]
 
   This example is typical of the sequent calculus: start with the
   desired theorem and apply rules backwards in a fairly arbitrary
   manner.  This yields a surprisingly effective proof procedure.
   Quantifiers add only few complications, since Isabelle handles
   parameters and schematic variables.  See @{cite \<open>Chapter 10\<close>
   "paulson-ml2"} for further discussion.\<close>
 
 
 subsubsection \<open>Simulating sequents by natural deduction\<close>
 
 text \<open>Isabelle can represent sequents directly, as in the
   object-logic LK.  But natural deduction is easier to work with, and
   most object-logics employ it.  Fortunately, we can simulate the
   sequent \<open>P\<^sub>1, \<dots>, P\<^sub>m \<turnstile> Q\<^sub>1, \<dots>, Q\<^sub>n\<close> by the Isabelle formula
   \<open>P\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> P\<^sub>m \<Longrightarrow> \<not> Q\<^sub>2 \<Longrightarrow> ... \<Longrightarrow> \<not> Q\<^sub>n \<Longrightarrow> Q\<^sub>1\<close> where the order of
   the assumptions and the choice of \<open>Q\<^sub>1\<close> are arbitrary.
   Elim-resolution plays a key role in simulating sequent proofs.
 
   We can easily handle reasoning on the left.  Elim-resolution with
   the rules \<open>(\<or>E)\<close>, \<open>(\<bottom>E)\<close> and \<open>(\<exists>E)\<close> achieves
   a similar effect as the corresponding sequent rules.  For the other
   connectives, we use sequent-style elimination rules instead of
   destruction rules such as \<open>(\<and>E1, 2)\<close> and \<open>(\<forall>E)\<close>.
   But note that the rule \<open>(\<not>L)\<close> has no effect under our
   representation of sequents!
   \[
   \infer[\<open>(\<not>L)\<close>]{\<open>\<not> P, \<Gamma> \<turnstile> \<Delta>\<close>}{\<open>\<Gamma> \<turnstile> \<Delta>, P\<close>}
   \]
 
   What about reasoning on the right?  Introduction rules can only
   affect the formula in the conclusion, namely \<open>Q\<^sub>1\<close>.  The
   other right-side formulae are represented as negated assumptions,
   \<open>\<not> Q\<^sub>2, \<dots>, \<not> Q\<^sub>n\<close>.  In order to operate on one of these, it
   must first be exchanged with \<open>Q\<^sub>1\<close>.  Elim-resolution with the
   \<open>swap\<close> rule has this effect: \<open>\<not> P \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> R\<close>
 
   To ensure that swaps occur only when necessary, each introduction
   rule is converted into a swapped form: it is resolved with the
   second premise of \<open>(swap)\<close>.  The swapped form of \<open>(\<and>I)\<close>, which might be called \<open>(\<not>\<and>E)\<close>, is
   @{text [display] "\<not> (P \<and> Q) \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> (\<not> R \<Longrightarrow> Q) \<Longrightarrow> R"}
 
   Similarly, the swapped form of \<open>(\<longrightarrow>I)\<close> is
   @{text [display] "\<not> (P \<longrightarrow> Q) \<Longrightarrow> (\<not> R \<Longrightarrow> P \<Longrightarrow> Q) \<Longrightarrow> R"}
 
   Swapped introduction rules are applied using elim-resolution, which
   deletes the negated formula.  Our representation of sequents also
   requires the use of ordinary introduction rules.  If we had no
   regard for readability of intermediate goal states, we could treat
   the right side more uniformly by representing sequents as @{text
   [display] "P\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> P\<^sub>m \<Longrightarrow> \<not> Q\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> \<not> Q\<^sub>n \<Longrightarrow> \<bottom>"}
 \<close>
 
 
 subsubsection \<open>Extra rules for the sequent calculus\<close>
 
 text \<open>As mentioned, destruction rules such as \<open>(\<and>E1, 2)\<close> and
   \<open>(\<forall>E)\<close> must be replaced by sequent-style elimination rules.
   In addition, we need rules to embody the classical equivalence
   between \<open>P \<longrightarrow> Q\<close> and \<open>\<not> P \<or> Q\<close>.  The introduction
   rules \<open>(\<or>I1, 2)\<close> are replaced by a rule that simulates
   \<open>(\<or>R)\<close>: @{text [display] "(\<not> Q \<Longrightarrow> P) \<Longrightarrow> P \<or> Q"}
 
   The destruction rule \<open>(\<longrightarrow>E)\<close> is replaced by @{text [display]
   "(P \<longrightarrow> Q) \<Longrightarrow> (\<not> P \<Longrightarrow> R) \<Longrightarrow> (Q \<Longrightarrow> R) \<Longrightarrow> R"}
 
   Quantifier replication also requires special rules.  In classical
   logic, \<open>\<exists>x. P x\<close> is equivalent to \<open>\<not> (\<forall>x. \<not> P x)\<close>;
   the rules \<open>(\<exists>R)\<close> and \<open>(\<forall>L)\<close> are dual:
   \[
   \infer[\<open>(\<exists>R)\<close>]{\<open>\<Gamma> \<turnstile> \<Delta>, \<exists>x. P x\<close>}{\<open>\<Gamma> \<turnstile> \<Delta>, \<exists>x. P x, P t\<close>}
   \qquad
   \infer[\<open>(\<forall>L)\<close>]{\<open>\<forall>x. P x, \<Gamma> \<turnstile> \<Delta>\<close>}{\<open>P t, \<forall>x. P x, \<Gamma> \<turnstile> \<Delta>\<close>}
   \]
   Thus both kinds of quantifier may be replicated.  Theorems requiring
   multiple uses of a universal formula are easy to invent; consider
   @{text [display] "(\<forall>x. P x \<longrightarrow> P (f x)) \<and> P a \<longrightarrow> P (f\<^sup>n a)"} for any
   \<open>n > 1\<close>.  Natural examples of the multiple use of an
   existential formula are rare; a standard one is \<open>\<exists>x. \<forall>y. P x
   \<longrightarrow> P y\<close>.
 
   Forgoing quantifier replication loses completeness, but gains
   decidability, since the search space becomes finite.  Many useful
   theorems can be proved without replication, and the search generally
   delivers its verdict in a reasonable time.  To adopt this approach,
   represent the sequent rules \<open>(\<exists>R)\<close>, \<open>(\<exists>L)\<close> and
   \<open>(\<forall>R)\<close> by \<open>(\<exists>I)\<close>, \<open>(\<exists>E)\<close> and \<open>(\<forall>I)\<close>,
   respectively, and put \<open>(\<forall>E)\<close> into elimination form: @{text
   [display] "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> Q) \<Longrightarrow> Q"}
 
   Elim-resolution with this rule will delete the universal formula
   after a single use.  To replicate universal quantifiers, replace the
   rule by @{text [display] "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> \<forall>x. P x \<Longrightarrow> Q) \<Longrightarrow> Q"}
 
   To replicate existential quantifiers, replace \<open>(\<exists>I)\<close> by
   @{text [display] "(\<not> (\<exists>x. P x) \<Longrightarrow> P t) \<Longrightarrow> \<exists>x. P x"}
 
   All introduction rules mentioned above are also useful in swapped
   form.
 
   Replication makes the search space infinite; we must apply the rules
   with care.  The classical reasoner distinguishes between safe and
   unsafe rules, applying the latter only when there is no alternative.
   Depth-first search may well go down a blind alley; best-first search
   is better behaved in an infinite search space.  However, quantifier
   replication is too expensive to prove any but the simplest theorems.
 \<close>
 
 
 subsection \<open>Rule declarations\<close>
 
 text \<open>The proof tools of the Classical Reasoner depend on
   collections of rules declared in the context, which are classified
   as introduction, elimination or destruction and as \<^emph>\<open>safe\<close> or
   \<^emph>\<open>unsafe\<close>.  In general, safe rules can be attempted blindly,
   while unsafe rules must be used with care.  A safe rule must never
   reduce a provable goal to an unprovable set of subgoals.
 
   The rule \<open>P \<Longrightarrow> P \<or> Q\<close> is unsafe because it reduces \<open>P
   \<or> Q\<close> to \<open>P\<close>, which might turn out as premature choice of an
   unprovable subgoal.  Any rule whose premises contain new unknowns is
   unsafe. The elimination rule \<open>\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> Q) \<Longrightarrow> Q\<close> is
   unsafe, since it is applied via elim-resolution, which discards the
   assumption \<open>\<forall>x. P x\<close> and replaces it by the weaker
   assumption \<open>P t\<close>.  The rule \<open>P t \<Longrightarrow> \<exists>x. P x\<close> is
   unsafe for similar reasons.  The quantifier duplication rule \<open>\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> \<forall>x. P x \<Longrightarrow> Q) \<Longrightarrow> Q\<close> is unsafe in a different sense:
   since it keeps the assumption \<open>\<forall>x. P x\<close>, it is prone to
   looping.  In classical first-order logic, all rules are safe except
   those mentioned above.
 
   The safe~/ unsafe distinction is vague, and may be regarded merely
   as a way of giving some rules priority over others.  One could argue
   that \<open>(\<or>E)\<close> is unsafe, because repeated application of it
   could generate exponentially many subgoals.  Induction rules are
   unsafe because inductive proofs are difficult to set up
   automatically.  Any inference that instantiates an unknown
   in the proof state is unsafe --- thus matching must be used, rather than
   unification.  Even proof by assumption is unsafe if it instantiates
   unknowns shared with other subgoals.
 
   \begin{matharray}{rcl}
     @{command_def "print_claset"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def intro} & : & \<open>attribute\<close> \\
     @{attribute_def elim} & : & \<open>attribute\<close> \\
     @{attribute_def dest} & : & \<open>attribute\<close> \\
     @{attribute_def rule} & : & \<open>attribute\<close> \\
     @{attribute_def iff} & : & \<open>attribute\<close> \\
     @{attribute_def swapped} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{attribute intro} | @@{attribute elim} | @@{attribute dest}) ('!' | () | '?') @{syntax nat}?
     ;
     @@{attribute rule} 'del'
     ;
     @@{attribute iff} (((() | 'add') '?'?) | 'del')
   \<close>
 
   \<^descr> @{command "print_claset"} prints the collection of rules
   declared to the Classical Reasoner, i.e.\ the \<^ML_type>\<open>claset\<close>
   within the context.
 
   \<^descr> @{attribute intro}, @{attribute elim}, and @{attribute dest}
   declare introduction, elimination, and destruction rules,
   respectively.  By default, rules are considered as \<^emph>\<open>unsafe\<close>
   (i.e.\ not applied blindly without backtracking), while ``\<open>!\<close>'' classifies as \<^emph>\<open>safe\<close>.  Rule declarations marked by
   ``\<open>?\<close>'' coincide with those of Isabelle/Pure, cf.\
   \secref{sec:pure-meth-att} (i.e.\ are only applied in single steps
   of the @{method rule} method).  The optional natural number
   specifies an explicit weight argument, which is ignored by the
   automated reasoning tools, but determines the search order of single
   rule steps.
 
   Introduction rules are those that can be applied using ordinary
   resolution.  Their swapped forms are generated internally, which
   will be applied using elim-resolution.  Elimination rules are
   applied using elim-resolution.  Rules are sorted by the number of
   new subgoals they will yield; rules that generate the fewest
   subgoals will be tried first.  Otherwise, later declarations take
   precedence over earlier ones.
 
   Rules already present in the context with the same classification
   are ignored.  A warning is printed if the rule has already been
   added with some other classification, but the rule is added anyway
   as requested.
 
   \<^descr> @{attribute rule}~\<open>del\<close> deletes all occurrences of a
   rule from the classical context, regardless of its classification as
   introduction~/ elimination~/ destruction and safe~/ unsafe.
 
   \<^descr> @{attribute iff} declares logical equivalences to the
   Simplifier and the Classical reasoner at the same time.
   Non-conditional rules result in a safe introduction and elimination
   pair; conditional ones are considered unsafe.  Rules with negative
   conclusion are automatically inverted (using \<open>\<not>\<close>-elimination
   internally).
 
   The ``\<open>?\<close>'' version of @{attribute iff} declares rules to
   the Isabelle/Pure context only, and omits the Simplifier
   declaration.
 
   \<^descr> @{attribute swapped} turns an introduction rule into an
   elimination, by resolving with the classical swap principle \<open>\<not> P \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> R\<close> in the second position.  This is mainly for
   illustrative purposes: the Classical Reasoner already swaps rules
   internally as explained above.
 \<close>
 
 
 subsection \<open>Structured methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def rule} & : & \<open>method\<close> \\
     @{method_def contradiction} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method rule} @{syntax thms}?
   \<close>
 
   \<^descr> @{method rule} as offered by the Classical Reasoner is a
   refinement over the Pure one (see \secref{sec:pure-meth-att}).  Both
   versions work the same, but the classical version observes the
   classical rule context in addition to that of Isabelle/Pure.
 
   Common object logics (HOL, ZF, etc.) declare a rich collection of
   classical rules (even if these would qualify as intuitionistic
   ones), but only few declarations to the rule context of
   Isabelle/Pure (\secref{sec:pure-meth-att}).
 
   \<^descr> @{method contradiction} solves some goal by contradiction,
   deriving any result from both \<open>\<not> A\<close> and \<open>A\<close>.  Chained
   facts, which are guaranteed to participate, may appear in either
   order.
 \<close>
 
 
 subsection \<open>Fully automated methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def blast} & : & \<open>method\<close> \\
     @{method_def auto} & : & \<open>method\<close> \\
     @{method_def force} & : & \<open>method\<close> \\
     @{method_def fast} & : & \<open>method\<close> \\
     @{method_def slow} & : & \<open>method\<close> \\
     @{method_def best} & : & \<open>method\<close> \\
     @{method_def fastforce} & : & \<open>method\<close> \\
     @{method_def slowsimp} & : & \<open>method\<close> \\
     @{method_def bestsimp} & : & \<open>method\<close> \\
     @{method_def deepen} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method blast} @{syntax nat}? (@{syntax clamod} * )
     ;
     @@{method auto} (@{syntax nat} @{syntax nat})? (@{syntax clasimpmod} * )
     ;
     @@{method force} (@{syntax clasimpmod} * )
     ;
     (@@{method fast} | @@{method slow} | @@{method best}) (@{syntax clamod} * )
     ;
     (@@{method fastforce} | @@{method slowsimp} | @@{method bestsimp})
       (@{syntax clasimpmod} * )
     ;
     @@{method deepen} (@{syntax nat} ?) (@{syntax clamod} * )
     ;
     @{syntax_def clamod}:
       (('intro' | 'elim' | 'dest') ('!' | () | '?') | 'del') ':' @{syntax thms}
     ;
     @{syntax_def clasimpmod}: ('simp' (() | 'add' | 'del' | 'only') |
       'cong' (() | 'add' | 'del') |
       'split' (() | '!' | 'del') |
       'iff' (((() | 'add') '?'?) | 'del') |
       (('intro' | 'elim' | 'dest') ('!' | () | '?') | 'del')) ':' @{syntax thms}
   \<close>
 
   \<^descr> @{method blast} is a separate classical tableau prover that
   uses the same classical rule declarations as explained before.
 
   Proof search is coded directly in ML using special data structures.
   A successful proof is then reconstructed using regular Isabelle
   inferences.  It is faster and more powerful than the other classical
   reasoning tools, but has major limitations too.
 
     \<^item> It does not use the classical wrapper tacticals, such as the
     integration with the Simplifier of @{method fastforce}.
 
     \<^item> It does not perform higher-order unification, as needed by the
     rule @{thm [source=false] rangeI} in HOL.  There are often
     alternatives to such rules, for example @{thm [source=false]
     range_eqI}.
 
     \<^item> Function variables may only be applied to parameters of the
     subgoal.  (This restriction arises because the prover does not use
     higher-order unification.)  If other function variables are present
     then the prover will fail with the message
     @{verbatim [display] \<open>Function unknown's argument not a bound variable\<close>}
 
     \<^item> Its proof strategy is more general than @{method fast} but can
     be slower.  If @{method blast} fails or seems to be running forever,
     try @{method fast} and the other proof tools described below.
 
   The optional integer argument specifies a bound for the number of
   unsafe steps used in a proof.  By default, @{method blast} starts
   with a bound of 0 and increases it successively to 20.  In contrast,
   \<open>(blast lim)\<close> tries to prove the goal using a search bound
   of \<open>lim\<close>.  Sometimes a slow proof using @{method blast} can
   be made much faster by supplying the successful search bound to this
   proof method instead.
 
   \<^descr> @{method auto} combines classical reasoning with
   simplification.  It is intended for situations where there are a lot
   of mostly trivial subgoals; it proves all the easy ones, leaving the
   ones it cannot prove.  Occasionally, attempting to prove the hard
   ones may take a long time.
 
   The optional depth arguments in \<open>(auto m n)\<close> refer to its
   builtin classical reasoning procedures: \<open>m\<close> (default 4) is for
   @{method blast}, which is tried first, and \<open>n\<close> (default 2) is
   for a slower but more general alternative that also takes wrappers
   into account.
 
   \<^descr> @{method force} is intended to prove the first subgoal
   completely, using many fancy proof tools and performing a rather
   exhaustive search.  As a result, proof attempts may take rather long
   or diverge easily.
 
   \<^descr> @{method fast}, @{method best}, @{method slow} attempt to
   prove the first subgoal using sequent-style reasoning as explained
   before.  Unlike @{method blast}, they construct proofs directly in
   Isabelle.
 
   There is a difference in search strategy and back-tracking: @{method
   fast} uses depth-first search and @{method best} uses best-first
   search (guided by a heuristic function: normally the total size of
   the proof state).
 
   Method @{method slow} is like @{method fast}, but conducts a broader
   search: it may, when backtracking from a failed proof attempt, undo
   even the step of proving a subgoal by assumption.
 
   \<^descr> @{method fastforce}, @{method slowsimp}, @{method bestsimp}
   are like @{method fast}, @{method slow}, @{method best},
   respectively, but use the Simplifier as additional wrapper. The name
   @{method fastforce}, reflects the behaviour of this popular method
   better without requiring an understanding of its implementation.
 
   \<^descr> @{method deepen} works by exhaustive search up to a certain
   depth.  The start depth is 4 (unless specified explicitly), and the
   depth is increased iteratively up to 10.  Unsafe rules are modified
   to preserve the formula they act on, so that it be used repeatedly.
   This method can prove more goals than @{method fast}, but is much
   slower, for example if the assumptions have many universal
   quantifiers.
 
 
   Any of the above methods support additional modifiers of the context
   of classical (and simplifier) rules, but the ones related to the
   Simplifier are explicitly prefixed by \<open>simp\<close> here.  The
   semantics of these ad-hoc rule declarations is analogous to the
   attributes given before.  Facts provided by forward chaining are
   inserted into the goal before commencing proof search.
 \<close>
 
 
 subsection \<open>Partially automated methods\label{sec:classical:partial}\<close>
 
 text \<open>These proof methods may help in situations when the
   fully-automated tools fail.  The result is a simpler subgoal that
   can be tackled by other means, such as by manual instantiation of
   quantifiers.
 
   \begin{matharray}{rcl}
     @{method_def safe} & : & \<open>method\<close> \\
     @{method_def clarify} & : & \<open>method\<close> \\
     @{method_def clarsimp} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{method safe} | @@{method clarify}) (@{syntax clamod} * )
     ;
     @@{method clarsimp} (@{syntax clasimpmod} * )
   \<close>
 
   \<^descr> @{method safe} repeatedly performs safe steps on all subgoals.
   It is deterministic, with at most one outcome.
 
   \<^descr> @{method clarify} performs a series of safe steps without
   splitting subgoals; see also @{method clarify_step}.
 
   \<^descr> @{method clarsimp} acts like @{method clarify}, but also does
   simplification.  Note that if the Simplifier context includes a
   splitter for the premises, the subgoal may still be split.
 \<close>
 
 
 subsection \<open>Single-step tactics\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def safe_step} & : & \<open>method\<close> \\
     @{method_def inst_step} & : & \<open>method\<close> \\
     @{method_def step} & : & \<open>method\<close> \\
     @{method_def slow_step} & : & \<open>method\<close> \\
     @{method_def clarify_step} & : &  \<open>method\<close> \\
   \end{matharray}
 
   These are the primitive tactics behind the automated proof methods
   of the Classical Reasoner.  By calling them yourself, you can
   execute these procedures one step at a time.
 
   \<^descr> @{method safe_step} performs a safe step on the first subgoal.
   The safe wrapper tacticals are applied to a tactic that may include
   proof by assumption or Modus Ponens (taking care not to instantiate
   unknowns), or substitution.
 
   \<^descr> @{method inst_step} is like @{method safe_step}, but allows
   unknowns to be instantiated.
 
   \<^descr> @{method step} is the basic step of the proof procedure, it
   operates on the first subgoal.  The unsafe wrapper tacticals are
   applied to a tactic that tries @{method safe}, @{method inst_step},
   or applies an unsafe rule from the context.
 
   \<^descr> @{method slow_step} resembles @{method step}, but allows
   backtracking between using safe rules with instantiation (@{method
   inst_step}) and using unsafe rules.  The resulting search space is
   larger.
 
   \<^descr> @{method clarify_step} performs a safe step on the first
   subgoal; no splitting step is applied.  For example, the subgoal
   \<open>A \<and> B\<close> is left as a conjunction.  Proof by assumption,
   Modus Ponens, etc., may be performed provided they do not
   instantiate unknowns.  Assumptions of the form \<open>x = t\<close> may
   be eliminated.  The safe wrapper tactical is applied.
 \<close>
 
 
 subsection \<open>Modifying the search step\<close>
 
 text \<open>
   \begin{mldecls}
-    @{index_ML_type wrapper: "(int -> tactic) -> (int -> tactic)"} \\[0.5ex]
-    @{index_ML_op addSWrapper: "Proof.context *
+    @{define_ML_type wrapper = "(int -> tactic) -> (int -> tactic)"} \\[0.5ex]
+    @{define_ML_infix addSWrapper: "Proof.context *
   (string * (Proof.context -> wrapper)) -> Proof.context"} \\
-    @{index_ML_op addSbefore: "Proof.context *
-  (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
-    @{index_ML_op addSafter: "Proof.context *
+    @{define_ML_infix addSbefore: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
-    @{index_ML_op delSWrapper: "Proof.context * string -> Proof.context"} \\[0.5ex]
-    @{index_ML_op addWrapper: "Proof.context *
-  (string * (Proof.context -> wrapper)) -> Proof.context"} \\
-    @{index_ML_op addbefore: "Proof.context *
+    @{define_ML_infix addSafter: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
-    @{index_ML_op addafter: "Proof.context *
+    @{define_ML_infix delSWrapper: "Proof.context * string -> Proof.context"} \\[0.5ex]
+    @{define_ML_infix addWrapper: "Proof.context *
+  (string * (Proof.context -> wrapper)) -> Proof.context"} \\
+    @{define_ML_infix addbefore: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
-    @{index_ML_op delWrapper: "Proof.context * string -> Proof.context"} \\[0.5ex]
-    @{index_ML addSss: "Proof.context -> Proof.context"} \\
-    @{index_ML addss: "Proof.context -> Proof.context"} \\
+    @{define_ML_infix addafter: "Proof.context *
+  (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
+    @{define_ML_infix delWrapper: "Proof.context * string -> Proof.context"} \\[0.5ex]
+    @{define_ML addSss: "Proof.context -> Proof.context"} \\
+    @{define_ML addss: "Proof.context -> Proof.context"} \\
   \end{mldecls}
 
   The proof strategy of the Classical Reasoner is simple.  Perform as
   many safe inferences as possible; or else, apply certain safe rules,
   allowing instantiation of unknowns; or else, apply an unsafe rule.
   The tactics also eliminate assumptions of the form \<open>x = t\<close>
   by substitution if they have been set up to do so.  They may perform
   a form of Modus Ponens: if there are assumptions \<open>P \<longrightarrow> Q\<close> and
   \<open>P\<close>, then replace \<open>P \<longrightarrow> Q\<close> by \<open>Q\<close>.
 
   The classical reasoning tools --- except @{method blast} --- allow
   to modify this basic proof strategy by applying two lists of
   arbitrary \<^emph>\<open>wrapper tacticals\<close> to it.  The first wrapper list,
   which is considered to contain safe wrappers only, affects @{method
   safe_step} and all the tactics that call it.  The second one, which
   may contain unsafe wrappers, affects the unsafe parts of @{method
   step}, @{method slow_step}, and the tactics that call them.  A
   wrapper transforms each step of the search, for example by
   attempting other tactics before or after the original step tactic.
   All members of a wrapper list are applied in turn to the respective
   step tactic.
 
   Initially the two wrapper lists are empty, which means no
   modification of the step tactics. Safe and unsafe wrappers are added
   to the context with the functions given below, supplying them with
   wrapper names.  These names may be used to selectively delete
   wrappers.
 
   \<^descr> \<open>ctxt addSWrapper (name, wrapper)\<close> adds a new wrapper,
   which should yield a safe tactic, to modify the existing safe step
   tactic.
 
   \<^descr> \<open>ctxt addSbefore (name, tac)\<close> adds the given tactic as a
   safe wrapper, such that it is tried \<^emph>\<open>before\<close> each safe step of
   the search.
 
   \<^descr> \<open>ctxt addSafter (name, tac)\<close> adds the given tactic as a
   safe wrapper, such that it is tried when a safe step of the search
   would fail.
 
   \<^descr> \<open>ctxt delSWrapper name\<close> deletes the safe wrapper with
   the given name.
 
   \<^descr> \<open>ctxt addWrapper (name, wrapper)\<close> adds a new wrapper to
   modify the existing (unsafe) step tactic.
 
   \<^descr> \<open>ctxt addbefore (name, tac)\<close> adds the given tactic as an
   unsafe wrapper, such that it its result is concatenated
   \<^emph>\<open>before\<close> the result of each unsafe step.
 
   \<^descr> \<open>ctxt addafter (name, tac)\<close> adds the given tactic as an
   unsafe wrapper, such that it its result is concatenated \<^emph>\<open>after\<close>
   the result of each unsafe step.
 
   \<^descr> \<open>ctxt delWrapper name\<close> deletes the unsafe wrapper with
   the given name.
 
   \<^descr> \<open>addSss\<close> adds the simpset of the context to its
   classical set. The assumptions and goal will be simplified, in a
   rather safe way, after each safe step of the search.
 
   \<^descr> \<open>addss\<close> adds the simpset of the context to its
   classical set. The assumptions and goal will be simplified, before
   the each unsafe step of the search.
 \<close>
 
 
 section \<open>Object-logic setup \label{sec:object-logic}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "judgment"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{method_def atomize} & : & \<open>method\<close> \\
     @{attribute_def atomize} & : & \<open>attribute\<close> \\
     @{attribute_def rule_format} & : & \<open>attribute\<close> \\
     @{attribute_def rulify} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   The very starting point for any Isabelle object-logic is a ``truth
   judgment'' that links object-level statements to the meta-logic
   (with its minimal language of \<open>prop\<close> that covers universal
   quantification \<open>\<And>\<close> and implication \<open>\<Longrightarrow>\<close>).
 
   Common object-logics are sufficiently expressive to internalize rule
   statements over \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> within their own
   language.  This is useful in certain situations where a rule needs
   to be viewed as an atomic statement from the meta-level perspective,
   e.g.\ \<open>\<And>x. x \<in> A \<Longrightarrow> P x\<close> versus \<open>\<forall>x \<in> A. P x\<close>.
 
   From the following language elements, only the @{method atomize}
   method and @{attribute rule_format} attribute are occasionally
   required by end-users, the rest is for those who need to setup their
   own object-logic.  In the latter case existing formulations of
   Isabelle/FOL or Isabelle/HOL may be taken as realistic examples.
 
   Generic tools may refer to the information provided by object-logic
   declarations internally.
 
   \<^rail>\<open>
     @@{command judgment} @{syntax name} '::' @{syntax type} @{syntax mixfix}?
     ;
     @@{attribute atomize} ('(' 'full' ')')?
     ;
     @@{attribute rule_format} ('(' 'noasm' ')')?
   \<close>
 
   \<^descr> @{command "judgment"}~\<open>c :: \<sigma> (mx)\<close> declares constant
   \<open>c\<close> as the truth judgment of the current object-logic.  Its
   type \<open>\<sigma>\<close> should specify a coercion of the category of
   object-level propositions to \<open>prop\<close> of the Pure meta-logic;
   the mixfix annotation \<open>(mx)\<close> would typically just link the
   object language (internally of syntactic category \<open>logic\<close>)
   with that of \<open>prop\<close>.  Only one @{command "judgment"}
   declaration may be given in any theory development.
   
   \<^descr> @{method atomize} (as a method) rewrites any non-atomic
   premises of a sub-goal, using the meta-level equations declared via
   @{attribute atomize} (as an attribute) beforehand.  As a result,
   heavily nested goals become amenable to fundamental operations such
   as resolution (cf.\ the @{method (Pure) rule} method).  Giving the ``\<open>(full)\<close>'' option here means to turn the whole subgoal into an
   object-statement (if possible), including the outermost parameters
   and assumptions as well.
 
   A typical collection of @{attribute atomize} rules for a particular
   object-logic would provide an internalization for each of the
   connectives of \<open>\<And>\<close>, \<open>\<Longrightarrow>\<close>, and \<open>\<equiv>\<close>.
   Meta-level conjunction should be covered as well (this is
   particularly important for locales, see \secref{sec:locale}).
 
   \<^descr> @{attribute rule_format} rewrites a theorem by the equalities
   declared as @{attribute rulify} rules in the current object-logic.
   By default, the result is fully normalized, including assumptions
   and conclusions at any depth.  The \<open>(no_asm)\<close> option
   restricts the transformation to the conclusion of a rule.
 
   In common object-logics (HOL, FOL, ZF), the effect of @{attribute
   rule_format} is to replace (bounded) universal quantification
   (\<open>\<forall>\<close>) and implication (\<open>\<longrightarrow>\<close>) by the corresponding
   rule statements over \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close>.
 \<close>
 
 
 section \<open>Tracing higher-order unification\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def unify_trace_simp} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def unify_trace_types} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def unify_trace_bound} & : & \<open>attribute\<close> & default \<open>50\<close> \\
     @{attribute_def unify_search_bound} & : & \<open>attribute\<close> & default \<open>60\<close> \\
   \end{tabular}
   \<^medskip>
 
   Higher-order unification works well in most practical situations,
   but sometimes needs extra care to identify problems.  These tracing
   options may help.
 
   \<^descr> @{attribute unify_trace_simp} controls tracing of the
   simplification phase of higher-order unification.
 
   \<^descr> @{attribute unify_trace_types} controls warnings of
   incompleteness, when unification is not considering all possible
   instantiations of schematic type variables.
 
   \<^descr> @{attribute unify_trace_bound} determines the depth where
   unification starts to print tracing information once it reaches
   depth; 0 for full tracing.  At the default value, tracing
   information is almost never printed in practice.
 
   \<^descr> @{attribute unify_search_bound} prevents unification from
   searching past the given depth.  Because of this bound, higher-order
   unification cannot return an infinite sequence, though it can return
   an exponentially long one.  The search rarely approaches the default
   value in practice.  If the search is cut off, unification prints a
   warning ``Unification bound exceeded''.
 
 
   \begin{warn}
   Options for unification cannot be modified in a local context.  Only
   the global theory content is taken into account.
   \end{warn}
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Inner_Syntax.thy b/src/Doc/Isar_Ref/Inner_Syntax.thy
--- a/src/Doc/Isar_Ref/Inner_Syntax.thy
+++ b/src/Doc/Isar_Ref/Inner_Syntax.thy
@@ -1,1531 +1,1531 @@
 (*:maxLineLen=78:*)
 
 theory Inner_Syntax
   imports Main Base
 begin
 
 chapter \<open>Inner syntax --- the term language \label{ch:inner-syntax}\<close>
 
 text \<open>
   The inner syntax of Isabelle provides concrete notation for the main
   entities of the logical framework, notably \<open>\<lambda>\<close>-terms with types and type
   classes. Applications may either extend existing syntactic categories by
   additional notation, or define new sub-languages that are linked to the
   standard term language via some explicit markers. For example \<^verbatim>\<open>FOO\<close>~\<open>foo\<close>
   could embed the syntax corresponding for some user-defined nonterminal \<open>foo\<close>
   --- within the bounds of the given lexical syntax of Isabelle/Pure.
 
   The most basic way to specify concrete syntax for logical entities works via
   mixfix annotations (\secref{sec:mixfix}), which may be usually given as part
   of the original declaration or via explicit notation commands later on
   (\secref{sec:notation}). This already covers many needs of concrete syntax
   without having to understand the full complexity of inner syntax layers.
 
   Further details of the syntax engine involves the classical distinction of
   lexical language versus context-free grammar (see \secref{sec:pure-syntax}),
   and various mechanisms for \<^emph>\<open>syntax transformations\<close> (see
   \secref{sec:syntax-transformations}).
 \<close>
 
 
 section \<open>Printing logical entities\<close>
 
 subsection \<open>Diagnostic commands \label{sec:print-diag}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "typ"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "term"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "prop"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "thm"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "prf"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "full_prf"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_state"}\<open>\<^sup>*\<close> & : & \<open>any \<rightarrow>\<close> \\
   \end{matharray}
 
   These diagnostic commands assist interactive development by printing
   internal logical entities in a human-readable fashion.
 
   \<^rail>\<open>
     @@{command typ} @{syntax modes}? @{syntax type} ('::' @{syntax sort})?
     ;
     @@{command term} @{syntax modes}? @{syntax term}
     ;
     @@{command prop} @{syntax modes}? @{syntax prop}
     ;
     @@{command thm} @{syntax modes}? @{syntax thms}
     ;
     ( @@{command prf} | @@{command full_prf} ) @{syntax modes}? @{syntax thms}?
     ;
     @@{command print_state} @{syntax modes}?
     ;
     @{syntax_def modes}: '(' (@{syntax name} + ) ')'
   \<close>
 
   \<^descr> @{command "typ"}~\<open>\<tau>\<close> reads and prints a type expression according to the
   current context.
 
   \<^descr> @{command "typ"}~\<open>\<tau> :: s\<close> uses type-inference to determine the most
   general way to make \<open>\<tau>\<close> conform to sort \<open>s\<close>. For concrete \<open>\<tau>\<close> this checks if
   the type belongs to that sort. Dummy type parameters ``\<open>_\<close>'' (underscore)
   are assigned to fresh type variables with most general sorts, according the
   the principles of type-inference.
 
     \<^descr> @{command "term"}~\<open>t\<close> and @{command "prop"}~\<open>\<phi>\<close> read, type-check and
     print terms or propositions according to the current theory or proof
     context; the inferred type of \<open>t\<close> is output as well. Note that these
     commands are also useful in inspecting the current environment of term
     abbreviations.
 
     \<^descr> @{command "thm"}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> retrieves theorems from the current theory
     or proof context. Note that any attributes included in the theorem
     specifications are applied to a temporary context derived from the current
     theory or proof; the result is discarded, i.e.\ attributes involved in
     \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> do not have any permanent effect.
 
     \<^descr> @{command "prf"} displays the (compact) proof term of the current proof
     state (if present), or of the given theorems. Note that this requires an
     underlying logic image with proof terms enabled, e.g. \<open>HOL-Proofs\<close>.
 
     \<^descr> @{command "full_prf"} is like @{command "prf"}, but displays the full
     proof term, i.e.\ also displays information omitted in the compact proof
     term, which is denoted by ``\<open>_\<close>'' placeholders there.
 
     \<^descr> @{command "print_state"} prints the current proof state (if present),
     including current facts and goals.
 
   All of the diagnostic commands above admit a list of \<open>modes\<close> to be
   specified, which is appended to the current print mode; see also
   \secref{sec:print-modes}. Thus the output behavior may be modified according
   particular print mode features. For example, @{command
   "print_state"}~\<open>(latex)\<close> prints the current proof state with mathematical
   symbols and special characters represented in {\LaTeX} source, according to
   the Isabelle style @{cite "isabelle-system"}.
 
   Note that antiquotations (cf.\ \secref{sec:antiq}) provide a more systematic
   way to include formal items into the printed text document.
 \<close>
 
 
 subsection \<open>Details of printed content\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def show_markup} & : & \<open>attribute\<close> \\
     @{attribute_def show_types} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_sorts} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_consts} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_abbrevs} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def show_brackets} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def names_long} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def names_short} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def names_unique} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def eta_contract} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def goals_limit} & : & \<open>attribute\<close> & default \<open>10\<close> \\
     @{attribute_def show_main_goal} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_hyps} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_tags} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_question_marks} & : & \<open>attribute\<close> & default \<open>true\<close> \\
   \end{tabular}
   \<^medskip>
 
   These configuration options control the detail of information that is
   displayed for types, terms, theorems, goals etc. See also
   \secref{sec:config}.
 
   \<^descr> @{attribute show_markup} controls direct inlining of markup into the
   printed representation of formal entities --- notably type and sort
   constraints. This enables Prover IDE users to retrieve that information via
   tooltips or popups while hovering with the mouse over the output window, for
   example. Consequently, this option is enabled by default for Isabelle/jEdit.
 
   \<^descr> @{attribute show_types} and @{attribute show_sorts} control printing of
   type constraints for term variables, and sort constraints for type
   variables. By default, neither of these are shown in output. If @{attribute
   show_sorts} is enabled, types are always shown as well. In Isabelle/jEdit,
   manual setting of these options is normally not required thanks to
   @{attribute show_markup} above.
 
   Note that displaying types and sorts may explain why a polymorphic inference
   rule fails to resolve with some goal, or why a rewrite rule does not apply
   as expected.
 
   \<^descr> @{attribute show_consts} controls printing of types of constants when
   displaying a goal state.
 
   Note that the output can be enormous, because polymorphic constants often
   occur at several different type instances.
 
   \<^descr> @{attribute show_abbrevs} controls folding of constant abbreviations.
 
   \<^descr> @{attribute show_brackets} controls bracketing in pretty printed output.
   If enabled, all sub-expressions of the pretty printing tree will be
   parenthesized, even if this produces malformed term syntax! This crude way
   of showing the internal structure of pretty printed entities may
   occasionally help to diagnose problems with operator priorities, for
   example.
 
   \<^descr> @{attribute names_long}, @{attribute names_short}, and @{attribute
   names_unique} control the way of printing fully qualified internal names in
   external form. See also \secref{sec:antiq} for the document antiquotation
   options of the same names.
 
   \<^descr> @{attribute eta_contract} controls \<open>\<eta>\<close>-contracted printing of terms.
 
   The \<open>\<eta>\<close>-contraction law asserts \<^prop>\<open>(\<lambda>x. f x) \<equiv> f\<close>, provided \<open>x\<close> is not
   free in \<open>f\<close>. It asserts \<^emph>\<open>extensionality\<close> of functions: \<^prop>\<open>f \<equiv> g\<close> if
   \<^prop>\<open>f x \<equiv> g x\<close> for all \<open>x\<close>. Higher-order unification frequently puts
   terms into a fully \<open>\<eta>\<close>-expanded form. For example, if \<open>F\<close> has type \<open>(\<tau> \<Rightarrow> \<tau>)
   \<Rightarrow> \<tau>\<close> then its expanded form is \<^term>\<open>\<lambda>h. F (\<lambda>x. h x)\<close>.
 
   Enabling @{attribute eta_contract} makes Isabelle perform \<open>\<eta>\<close>-contractions
   before printing, so that \<^term>\<open>\<lambda>h. F (\<lambda>x. h x)\<close> appears simply as \<open>F\<close>.
 
   Note that the distinction between a term and its \<open>\<eta>\<close>-expanded form
   occasionally matters. While higher-order resolution and rewriting operate
   modulo \<open>\<alpha>\<beta>\<eta>\<close>-conversion, some other tools might look at terms more
   discretely.
 
   \<^descr> @{attribute goals_limit} controls the maximum number of subgoals to be
   printed.
 
   \<^descr> @{attribute show_main_goal} controls whether the main result to be proven
   should be displayed. This information might be relevant for schematic goals,
   to inspect the current claim that has been synthesized so far.
 
   \<^descr> @{attribute show_hyps} controls printing of implicit hypotheses of local
   facts. Normally, only those hypotheses are displayed that are \<^emph>\<open>not\<close> covered
   by the assumptions of the current context: this situation indicates a fault
   in some tool being used.
 
   By enabling @{attribute show_hyps}, output of \<^emph>\<open>all\<close> hypotheses can be
   enforced, which is occasionally useful for diagnostic purposes.
 
   \<^descr> @{attribute show_tags} controls printing of extra annotations within
   theorems, such as internal position information, or the case names being
   attached by the attribute @{attribute case_names}.
 
   Note that the @{attribute tagged} and @{attribute untagged} attributes
   provide low-level access to the collection of tags associated with a
   theorem.
 
   \<^descr> @{attribute show_question_marks} controls printing of question marks for
   schematic variables, such as \<open>?x\<close>. Only the leading question mark is
   affected, the remaining text is unchanged (including proper markup for
   schematic variables that might be relevant for user interfaces).
 \<close>
 
 
 subsection \<open>Alternative print modes \label{sec:print-modes}\<close>
 
 text \<open>
   \begin{mldecls}
-    @{index_ML print_mode_value: "unit -> string list"} \\
-    @{index_ML Print_Mode.with_modes: "string list -> ('a -> 'b) -> 'a -> 'b"} \\
+    @{define_ML print_mode_value: "unit -> string list"} \\
+    @{define_ML Print_Mode.with_modes: "string list -> ('a -> 'b) -> 'a -> 'b"} \\
   \end{mldecls}
 
   The \<^emph>\<open>print mode\<close> facility allows to modify various operations for printing.
   Commands like @{command typ}, @{command term}, @{command thm} (see
   \secref{sec:print-diag}) take additional print modes as optional argument.
   The underlying ML operations are as follows.
 
     \<^descr> \<^ML>\<open>print_mode_value ()\<close> yields the list of currently active print
     mode names. This should be understood as symbolic representation of
     certain individual features for printing (with precedence from left to
     right).
 
     \<^descr> \<^ML>\<open>Print_Mode.with_modes\<close>~\<open>modes f x\<close> evaluates \<open>f x\<close> in an execution
     context where the print mode is prepended by the given \<open>modes\<close>. This
     provides a thread-safe way to augment print modes. It is also monotonic in
     the set of mode names: it retains the default print mode that certain
     user-interfaces might have installed for their proper functioning!
 
   \<^medskip>
   The pretty printer for inner syntax maintains alternative mixfix productions
   for any print mode name invented by the user, say in commands like @{command
   notation} or @{command abbreviation}. Mode names can be arbitrary, but the
   following ones have a specific meaning by convention:
 
     \<^item> \<^verbatim>\<open>""\<close> (the empty string): default mode; implicitly active as last
     element in the list of modes.
 
     \<^item> \<^verbatim>\<open>input\<close>: dummy print mode that is never active; may be used to specify
     notation that is only available for input.
 
     \<^item> \<^verbatim>\<open>internal\<close> dummy print mode that is never active; used internally in
     Isabelle/Pure.
 
     \<^item> \<^verbatim>\<open>ASCII\<close>: prefer ASCII art over mathematical symbols.
 
     \<^item> \<^verbatim>\<open>latex\<close>: additional mode that is active in {\LaTeX} document
     preparation of Isabelle theory sources; allows to provide alternative
     output notation.
 \<close>
 
 
 section \<open>Mixfix annotations \label{sec:mixfix}\<close>
 
 text \<open>
   Mixfix annotations specify concrete \<^emph>\<open>inner syntax\<close> of Isabelle types and
   terms. Locally fixed parameters in toplevel theorem statements, locale and
   class specifications also admit mixfix annotations in a fairly uniform
   manner. A mixfix annotation describes the concrete syntax, the translation
   to abstract syntax, and the pretty printing. Special case annotations
   provide a simple means of specifying infix operators and binders.
 
   Isabelle mixfix syntax is inspired by {\OBJ} @{cite OBJ}. It allows to
   specify any context-free priority grammar, which is more general than the
   fixity declarations of ML and Prolog.
 
   \<^rail>\<open>
     @{syntax_def mixfix}: '('
       (@{syntax template} prios? @{syntax nat}? |
         (@'infix' | @'infixl' | @'infixr') @{syntax template} @{syntax nat} |
         @'binder' @{syntax template} prio? @{syntax nat} |
         @'structure') ')'
     ;
     @{syntax template}: (string | cartouche)
     ;
     prios: '[' (@{syntax nat} + ',') ']'
     ;
     prio: '[' @{syntax nat} ']'
   \<close>
 
   The mixfix \<open>template\<close> may include literal text, spacing, blocks, and
   arguments (denoted by ``\<open>_\<close>''); the special symbol ``\<^verbatim>\<open>\<index>\<close>'' (printed as
   ``\<open>\<index>\<close>'') represents an index argument that specifies an implicit @{keyword
   "structure"} reference (see also \secref{sec:locale}). Only locally fixed
   variables may be declared as @{keyword "structure"}.
 
   Infix and binder declarations provide common abbreviations for particular
   mixfix declarations. So in practice, mixfix templates mostly degenerate to
   literal text for concrete syntax, such as ``\<^verbatim>\<open>++\<close>'' for an infix symbol.
 \<close>
 
 
 subsection \<open>The general mixfix form\<close>
 
 text \<open>
   In full generality, mixfix declarations work as follows. Suppose a constant
   \<open>c :: \<tau>\<^sub>1 \<Rightarrow> \<dots> \<tau>\<^sub>n \<Rightarrow> \<tau>\<close> is annotated by \<open>(mixfix [p\<^sub>1, \<dots>, p\<^sub>n] p)\<close>, where
   \<open>mixfix\<close> is a string \<open>d\<^sub>0 _ d\<^sub>1 _ \<dots> _ d\<^sub>n\<close> consisting of delimiters that
   surround argument positions as indicated by underscores.
 
   Altogether this determines a production for a context-free priority grammar,
   where for each argument \<open>i\<close> the syntactic category is determined by \<open>\<tau>\<^sub>i\<close>
   (with priority \<open>p\<^sub>i\<close>), and the result category is determined from \<open>\<tau>\<close> (with
   priority \<open>p\<close>). Priority specifications are optional, with default 0 for
   arguments and 1000 for the result.\<^footnote>\<open>Omitting priorities is prone to
   syntactic ambiguities unless the delimiter tokens determine fully bracketed
   notation, as in \<open>if _ then _ else _ fi\<close>.\<close>
 
   Since \<open>\<tau>\<close> may be again a function type, the constant type scheme may have
   more argument positions than the mixfix pattern. Printing a nested
   application \<open>c t\<^sub>1 \<dots> t\<^sub>m\<close> for \<open>m > n\<close> works by attaching concrete notation
   only to the innermost part, essentially by printing \<open>(c t\<^sub>1 \<dots> t\<^sub>n) \<dots> t\<^sub>m\<close>
   instead. If a term has fewer arguments than specified in the mixfix
   template, the concrete syntax is ignored.
 
   \<^medskip>
   A mixfix template may also contain additional directives for pretty
   printing, notably spaces, blocks, and breaks. The general template format is
   a sequence over any of the following entities.
 
   \<^descr> \<open>d\<close> is a delimiter, namely a non-empty sequence delimiter items of the
   following form:
     \<^enum> a control symbol followed by a cartouche
     \<^enum> a single symbol, excluding the following special characters:
       \<^medskip>
       \begin{tabular}{ll}
         \<^verbatim>\<open>'\<close> & single quote \\
         \<^verbatim>\<open>_\<close> & underscore \\
         \<open>\<index>\<close> & index symbol \\
         \<^verbatim>\<open>(\<close> & open parenthesis \\
         \<^verbatim>\<open>)\<close> & close parenthesis \\
         \<^verbatim>\<open>/\<close> & slash \\
         \<open>\<open> \<close>\<close> & cartouche delimiters \\
       \end{tabular}
       \<^medskip>
 
   \<^descr> \<^verbatim>\<open>'\<close> escapes the special meaning of these meta-characters, producing a
   literal version of the following character, unless that is a blank.
 
   A single quote followed by a blank separates delimiters, without affecting
   printing, but input tokens may have additional white space here.
 
   \<^descr> \<^verbatim>\<open>_\<close> is an argument position, which stands for a certain syntactic
   category in the underlying grammar.
 
   \<^descr> \<open>\<index>\<close> is an indexed argument position; this is the place where implicit
   structure arguments can be attached.
 
   \<^descr> \<open>s\<close> is a non-empty sequence of spaces for printing. This and the following
   specifications do not affect parsing at all.
 
   \<^descr> \<^verbatim>\<open>(\<close>\<open>n\<close> opens a pretty printing block. The optional natural number
   specifies the block indentation, i.e. how much spaces to add when a line
   break occurs within the block. The default indentation is 0.
 
   \<^descr> \<^verbatim>\<open>(\<close>\<open>\<open>properties\<close>\<close> opens a pretty printing block, with properties
   specified within the given text cartouche. The syntax and semantics of
   the category @{syntax_ref mixfix_properties} is described below.
 
   \<^descr> \<^verbatim>\<open>)\<close> closes a pretty printing block.
 
   \<^descr> \<^verbatim>\<open>//\<close> forces a line break.
 
   \<^descr> \<^verbatim>\<open>/\<close>\<open>s\<close> allows a line break. Here \<open>s\<close> stands for the string of spaces
   (zero or more) right after the slash. These spaces are printed if the break
   is \<^emph>\<open>not\<close> taken.
 
 
   \<^medskip>
   Block properties allow more control over the details of pretty-printed
   output. The concrete syntax is defined as follows.
 
   \<^rail>\<open>
     @{syntax_def "mixfix_properties"}: (entry *)
     ;
     entry: atom ('=' atom)?
     ;
     atom: @{syntax short_ident} | @{syntax int} | @{syntax float} | @{syntax cartouche}
   \<close>
 
   Each @{syntax entry} is a name-value pair: if the value is omitted, it
   defaults to \<^verbatim>\<open>true\<close> (intended for Boolean properties). The following
   standard block properties are supported:
 
     \<^item> \<open>indent\<close> (natural number): the block indentation --- the same as for the
     simple syntax without block properties.
 
     \<^item> \<open>consistent\<close> (Boolean): this block has consistent breaks (if one break
     is taken, all breaks are taken).
 
     \<^item> \<open>unbreakable\<close> (Boolean): all possible breaks of the block are disabled
     (turned into spaces).
 
     \<^item> \<open>markup\<close> (string): the optional name of the markup node. If this is
     provided, all remaining properties are turned into its XML attributes.
     This allows to specify free-form PIDE markup, e.g.\ for specialized
     output.
 
   \<^medskip>
   Note that the general idea of pretty printing with blocks and breaks is
   described in @{cite "paulson-ml2"}; it goes back to @{cite "Oppen:1980"}.
 \<close>
 
 
 subsection \<open>Infixes\<close>
 
 text \<open>
   Infix operators are specified by convenient short forms that abbreviate
   general mixfix annotations as follows:
 
   \begin{center}
   \begin{tabular}{lll}
 
   \<^verbatim>\<open>(\<close>@{keyword_def "infix"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>"\<close> \<open>p\<close>\<^verbatim>\<open>)\<close>
   & \<open>\<mapsto>\<close> &
   \<^verbatim>\<open>("(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)" [\<close>\<open>p + 1\<close>\<^verbatim>\<open>,\<close>~\<open>p + 1\<close>\<^verbatim>\<open>]\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close> \\
   \<^verbatim>\<open>(\<close>@{keyword_def "infixl"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>"\<close> \<open>p\<close>\<^verbatim>\<open>)\<close>
   & \<open>\<mapsto>\<close> &
   \<^verbatim>\<open>("(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)" [\<close>\<open>p\<close>\<^verbatim>\<open>,\<close>~\<open>p + 1\<close>\<^verbatim>\<open>]\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close> \\
   \<^verbatim>\<open>(\<close>@{keyword_def "infixr"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>"\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close>
   & \<open>\<mapsto>\<close> &
   \<^verbatim>\<open>("(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)" [\<close>\<open>p + 1\<close>\<^verbatim>\<open>,\<close>~\<open>p\<close>\<^verbatim>\<open>]\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close> \\
 
   \end{tabular}
   \end{center}
 
   The mixfix template \<^verbatim>\<open>"(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)"\<close> specifies two argument positions;
   the delimiter is preceded by a space and followed by a space or line break;
   the entire phrase is a pretty printing block.
 
   The alternative notation \<^verbatim>\<open>(\<close>\<open>sy\<close>\<^verbatim>\<open>)\<close> is introduced in addition. Thus any
   infix operator may be written in prefix form (as in Haskell), independently of
   the number of arguments.
 \<close>
 
 
 subsection \<open>Binders\<close>
 
 text \<open>
   A \<^emph>\<open>binder\<close> is a variable-binding construct such as a quantifier. The idea
   to formalize \<open>\<forall>x. b\<close> as \<open>All (\<lambda>x. b)\<close> for \<open>All :: ('a \<Rightarrow> bool) \<Rightarrow> bool\<close>
   already goes back to @{cite church40}. Isabelle declarations of certain
   higher-order operators may be annotated with @{keyword_def "binder"}
   annotations as follows:
 
   \begin{center}
   \<open>c ::\<close>~\<^verbatim>\<open>"\<close>\<open>(\<tau>\<^sub>1 \<Rightarrow> \<tau>\<^sub>2) \<Rightarrow> \<tau>\<^sub>3\<close>\<^verbatim>\<open>"  (\<close>@{keyword "binder"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>" [\<close>\<open>p\<close>\<^verbatim>\<open>]\<close>~\<open>q\<close>\<^verbatim>\<open>)\<close>
   \end{center}
 
   This introduces concrete binder syntax \<open>sy x. b\<close>, where \<open>x\<close> is a bound
   variable of type \<open>\<tau>\<^sub>1\<close>, the body \<open>b\<close> has type \<open>\<tau>\<^sub>2\<close> and the whole term has
   type \<open>\<tau>\<^sub>3\<close>. The optional integer \<open>p\<close> specifies the syntactic priority of the
   body; the default is \<open>q\<close>, which is also the priority of the whole construct.
 
   Internally, the binder syntax is expanded to something like this:
   \begin{center}
   \<open>c_binder ::\<close>~\<^verbatim>\<open>"\<close>\<open>idts \<Rightarrow> \<tau>\<^sub>2 \<Rightarrow> \<tau>\<^sub>3\<close>\<^verbatim>\<open>"  ("(3\<close>\<open>sy\<close>\<^verbatim>\<open>_./ _)" [0,\<close>~\<open>p\<close>\<^verbatim>\<open>]\<close>~\<open>q\<close>\<^verbatim>\<open>)\<close>
   \end{center}
 
   Here @{syntax (inner) idts} is the nonterminal symbol for a list of
   identifiers with optional type constraints (see also
   \secref{sec:pure-grammar}). The mixfix template \<^verbatim>\<open>"(3\<close>\<open>sy\<close>\<^verbatim>\<open>_./ _)"\<close> defines
   argument positions for the bound identifiers and the body, separated by a
   dot with optional line break; the entire phrase is a pretty printing block
   of indentation level 3. Note that there is no extra space after \<open>sy\<close>, so it
   needs to be included user specification if the binder syntax ends with a
   token that may be continued by an identifier token at the start of @{syntax
   (inner) idts}.
 
   Furthermore, a syntax translation to transforms \<open>c_binder x\<^sub>1 \<dots> x\<^sub>n b\<close> into
   iterated application \<open>c (\<lambda>x\<^sub>1. \<dots> c (\<lambda>x\<^sub>n. b)\<dots>)\<close>. This works in both
   directions, for parsing and printing.
 \<close>
 
 
 section \<open>Explicit notation \label{sec:notation}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "type_notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "no_type_notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "no_notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "write"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   Commands that introduce new logical entities (terms or types) usually allow
   to provide mixfix annotations on the spot, which is convenient for default
   notation. Nonetheless, the syntax may be modified later on by declarations
   for explicit notation. This allows to add or delete mixfix annotations for
   of existing logical entities within the current context.
 
   \<^rail>\<open>
     (@@{command type_notation} | @@{command no_type_notation}) @{syntax mode}? \<newline>
       (@{syntax name} @{syntax mixfix} + @'and')
     ;
     (@@{command notation} | @@{command no_notation}) @{syntax mode}? \<newline>
       (@{syntax name} @{syntax mixfix} + @'and')
     ;
     @@{command write} @{syntax mode}? (@{syntax name} @{syntax mixfix} + @'and')
   \<close>
 
   \<^descr> @{command "type_notation"}~\<open>c (mx)\<close> associates mixfix syntax with an
   existing type constructor. The arity of the constructor is retrieved from
   the context.
 
   \<^descr> @{command "no_type_notation"} is similar to @{command "type_notation"},
   but removes the specified syntax annotation from the present context.
 
   \<^descr> @{command "notation"}~\<open>c (mx)\<close> associates mixfix syntax with an existing
   constant or fixed variable. The type declaration of the given entity is
   retrieved from the context.
 
   \<^descr> @{command "no_notation"} is similar to @{command "notation"}, but removes
   the specified syntax annotation from the present context.
 
   \<^descr> @{command "write"} is similar to @{command "notation"}, but works within
   an Isar proof body.
 \<close>
 
 
 section \<open>The Pure syntax \label{sec:pure-syntax}\<close>
 
 subsection \<open>Lexical matters \label{sec:inner-lex}\<close>
 
 text \<open>
   The inner lexical syntax vaguely resembles the outer one
   (\secref{sec:outer-lex}), but some details are different. There are two main
   categories of inner syntax tokens:
 
   \<^enum> \<^emph>\<open>delimiters\<close> --- the literal tokens occurring in productions of the given
   priority grammar (cf.\ \secref{sec:priority-grammar});
 
   \<^enum> \<^emph>\<open>named tokens\<close> --- various categories of identifiers etc.
 
 
   Delimiters override named tokens and may thus render certain identifiers
   inaccessible. Sometimes the logical context admits alternative ways to refer
   to the same entity, potentially via qualified names.
 
   \<^medskip>
   The categories for named tokens are defined once and for all as follows,
   reusing some categories of the outer token syntax (\secref{sec:outer-lex}).
 
   \begin{center}
   \begin{supertabular}{rcl}
     @{syntax_def (inner) id} & = & @{syntax_ref short_ident} \\
     @{syntax_def (inner) longid} & = & @{syntax_ref long_ident} \\
     @{syntax_def (inner) var} & = & @{syntax_ref var} \\
     @{syntax_def (inner) tid} & = & @{syntax_ref type_ident} \\
     @{syntax_def (inner) tvar} & = & @{syntax_ref type_var} \\
     @{syntax_def (inner) num_token} & = & @{syntax_ref nat} \\
     @{syntax_def (inner) float_token} & = & @{syntax_ref nat}\<^verbatim>\<open>.\<close>@{syntax_ref nat} \\
     @{syntax_def (inner) str_token} & = & \<^verbatim>\<open>''\<close> \<open>\<dots>\<close> \<^verbatim>\<open>''\<close> \\
     @{syntax_def (inner) string_token} & = & \<^verbatim>\<open>"\<close> \<open>\<dots>\<close> \<^verbatim>\<open>"\<close> \\
     @{syntax_def (inner) cartouche} & = & \<^verbatim>\<open>\<open>\<close> \<open>\<dots>\<close> \<^verbatim>\<open>\<close>\<close> \\
   \end{supertabular}
   \end{center}
 
   The token categories @{syntax (inner) num_token}, @{syntax (inner)
   float_token}, @{syntax (inner) str_token}, @{syntax (inner) string_token},
   and @{syntax (inner) cartouche} are not used in Pure. Object-logics may
   implement numerals and string literals by adding appropriate syntax
   declarations, together with some translation functions (e.g.\ see
   \<^file>\<open>~~/src/HOL/Tools/string_syntax.ML\<close>).
 
   The derived categories @{syntax_def (inner) num_const}, and @{syntax_def
   (inner) float_const}, provide robust access to the respective tokens: the
   syntax tree holds a syntactic constant instead of a free variable.
 
   Formal document comments (\secref{sec:comments}) may be also used within the
   inner syntax.
 \<close>
 
 
 subsection \<open>Priority grammars \label{sec:priority-grammar}\<close>
 
 text \<open>
   A context-free grammar consists of a set of \<^emph>\<open>terminal symbols\<close>, a set of
   \<^emph>\<open>nonterminal symbols\<close> and a set of \<^emph>\<open>productions\<close>. Productions have the
   form \<open>A = \<gamma>\<close>, where \<open>A\<close> is a nonterminal and \<open>\<gamma>\<close> is a string of terminals
   and nonterminals. One designated nonterminal is called the \<^emph>\<open>root symbol\<close>.
   The language defined by the grammar consists of all strings of terminals
   that can be derived from the root symbol by applying productions as rewrite
   rules.
 
   The standard Isabelle parser for inner syntax uses a \<^emph>\<open>priority grammar\<close>.
   Each nonterminal is decorated by an integer priority: \<open>A\<^sup>(\<^sup>p\<^sup>)\<close>. In a
   derivation, \<open>A\<^sup>(\<^sup>p\<^sup>)\<close> may be rewritten using a production \<open>A\<^sup>(\<^sup>q\<^sup>) = \<gamma>\<close> only
   if \<open>p \<le> q\<close>. Any priority grammar can be translated into a normal
   context-free grammar by introducing new nonterminals and productions.
 
   \<^medskip>
   Formally, a set of context free productions \<open>G\<close> induces a derivation
   relation \<open>\<longrightarrow>\<^sub>G\<close> as follows. Let \<open>\<alpha>\<close> and \<open>\<beta>\<close> denote strings of terminal or
   nonterminal symbols. Then \<open>\<alpha> A\<^sup>(\<^sup>p\<^sup>) \<beta> \<longrightarrow>\<^sub>G \<alpha> \<gamma> \<beta>\<close> holds if and only if \<open>G\<close>
   contains some production \<open>A\<^sup>(\<^sup>q\<^sup>) = \<gamma>\<close> for \<open>p \<le> q\<close>.
 
   \<^medskip>
   The following grammar for arithmetic expressions demonstrates how binding
   power and associativity of operators can be enforced by priorities.
 
   \begin{center}
   \begin{tabular}{rclr}
   \<open>A\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>=\<close> & \<^verbatim>\<open>(\<close> \<open>A\<^sup>(\<^sup>0\<^sup>)\<close> \<^verbatim>\<open>)\<close> \\
   \<open>A\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>=\<close> & \<^verbatim>\<open>0\<close> \\
   \<open>A\<^sup>(\<^sup>0\<^sup>)\<close> & \<open>=\<close> & \<open>A\<^sup>(\<^sup>0\<^sup>)\<close> \<^verbatim>\<open>+\<close> \<open>A\<^sup>(\<^sup>1\<^sup>)\<close> \\
   \<open>A\<^sup>(\<^sup>2\<^sup>)\<close> & \<open>=\<close> & \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>*\<close> \<open>A\<^sup>(\<^sup>2\<^sup>)\<close> \\
   \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>=\<close> & \<^verbatim>\<open>-\<close> \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> \\
   \end{tabular}
   \end{center}
   The choice of priorities determines that \<^verbatim>\<open>-\<close> binds tighter than \<^verbatim>\<open>*\<close>, which
   binds tighter than \<^verbatim>\<open>+\<close>. Furthermore \<^verbatim>\<open>+\<close> associates to the left and \<^verbatim>\<open>*\<close> to
   the right.
 
   \<^medskip>
   For clarity, grammars obey these conventions:
 
     \<^item> All priorities must lie between 0 and 1000.
 
     \<^item> Priority 0 on the right-hand side and priority 1000 on the left-hand
     side may be omitted.
 
     \<^item> The production \<open>A\<^sup>(\<^sup>p\<^sup>) = \<alpha>\<close> is written as \<open>A = \<alpha> (p)\<close>, i.e.\ the
     priority of the left-hand side actually appears in a column on the far
     right.
 
     \<^item> Alternatives are separated by \<open>|\<close>.
 
     \<^item> Repetition is indicated by dots \<open>(\<dots>)\<close> in an informal but obvious way.
 
   Using these conventions, the example grammar specification above
   takes the form:
   \begin{center}
   \begin{tabular}{rclc}
     \<open>A\<close> & \<open>=\<close> & \<^verbatim>\<open>(\<close> \<open>A\<close> \<^verbatim>\<open>)\<close> \\
               & \<open>|\<close> & \<^verbatim>\<open>0\<close> & \qquad\qquad \\
               & \<open>|\<close> & \<open>A\<close> \<^verbatim>\<open>+\<close> \<open>A\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(0)\<close> \\
               & \<open>|\<close> & \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>*\<close> \<open>A\<^sup>(\<^sup>2\<^sup>)\<close> & \<open>(2)\<close> \\
               & \<open>|\<close> & \<^verbatim>\<open>-\<close> \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(3)\<close> \\
   \end{tabular}
   \end{center}
 \<close>
 
 
 subsection \<open>The Pure grammar \label{sec:pure-grammar}\<close>
 
 text \<open>
   The priority grammar of the \<open>Pure\<close> theory is defined approximately like
   this:
 
   \begin{center}
   \begin{supertabular}{rclr}
 
   @{syntax_def (inner) any} & = & \<open>prop  |  logic\<close> \\\\
 
   @{syntax_def (inner) prop} & = & \<^verbatim>\<open>(\<close> \<open>prop\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>4\<^sup>)\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>==\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(2)\<close> \\
     & \<open>|\<close> & \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> \<open>\<equiv>\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(2)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>&&&\<close> \<open>prop\<^sup>(\<^sup>2\<^sup>)\<close> & \<open>(2)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>2\<^sup>)\<close> \<^verbatim>\<open>==>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>2\<^sup>)\<close> \<open>\<Longrightarrow>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>[|\<close> \<open>prop\<close> \<^verbatim>\<open>;\<close> \<open>\<dots>\<close> \<^verbatim>\<open>;\<close> \<open>prop\<close> \<^verbatim>\<open>|]\<close> \<^verbatim>\<open>==>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<open>\<lbrakk>\<close> \<open>prop\<close> \<^verbatim>\<open>;\<close> \<open>\<dots>\<close> \<^verbatim>\<open>;\<close> \<open>prop\<close> \<open>\<rbrakk>\<close> \<open>\<Longrightarrow>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>!!\<close> \<open>idts\<close> \<^verbatim>\<open>.\<close> \<open>prop\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<open>\<And>\<close> \<open>idts\<close> \<^verbatim>\<open>.\<close> \<open>prop\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>OFCLASS\<close> \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>logic\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>SORT_CONSTRAINT\<close> \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>TERM\<close> \<open>logic\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>PROP\<close> \<open>aprop\<close> \\\\
 
   @{syntax_def (inner) aprop} & = & \<^verbatim>\<open>(\<close> \<open>aprop\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>id  |  longid  |  var  |\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>...\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>CONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>CONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>XCONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>XCONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<open>logic\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)  any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) \<dots> any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>(999)\<close> \\\\
 
   @{syntax_def (inner) logic} & = & \<^verbatim>\<open>(\<close> \<open>logic\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>logic\<^sup>(\<^sup>4\<^sup>)\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<open>id  |  longid  |  var  |\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>...\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>CONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>CONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>XCONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>XCONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<open>logic\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)  any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) \<dots> any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>(999)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>%\<close> \<open>pttrns\<close> \<^verbatim>\<open>.\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<open>\<lambda>\<close> \<open>pttrns\<close> \<^verbatim>\<open>.\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(==)\<close>~~\<open>|\<close>~~\<^verbatim>\<open>(\<close>\<open>\<equiv>\<close>\<^verbatim>\<open>)\<close>~~\<open>|\<close>~~\<^verbatim>\<open>(&&&)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(==>)\<close>~~\<open>|\<close>~~\<^verbatim>\<open>(\<close>\<open>\<Longrightarrow>\<close>\<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>TYPE\<close> \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \\\\
 
   @{syntax_def (inner) idt} & = & \<^verbatim>\<open>(\<close> \<open>idt\<close> \<^verbatim>\<open>)\<close>~~\<open>|  id  |\<close>~~\<^verbatim>\<open>_\<close> \\
     & \<open>|\<close> & \<open>id\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>_\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(0)\<close> \\\\
 
   @{syntax_def (inner) index} & = & \<^verbatim>\<open>\<^bsub>\<close> \<open>logic\<^sup>(\<^sup>0\<^sup>)\<close> \<^verbatim>\<open>\<^esub>\<close>~~\<open>|  |  \<index>\<close> \\\\
 
   @{syntax_def (inner) idts} & = & \<open>idt  |  idt\<^sup>(\<^sup>1\<^sup>) idts\<close> & \<open>(0)\<close> \\\\
 
   @{syntax_def (inner) pttrn} & = & \<open>idt\<close> \\\\
 
   @{syntax_def (inner) pttrns} & = & \<open>pttrn  |  pttrn\<^sup>(\<^sup>1\<^sup>) pttrns\<close> & \<open>(0)\<close> \\\\
 
   @{syntax_def (inner) type} & = & \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>tid  |  tvar  |\<close>~~\<^verbatim>\<open>_\<close> \\
     & \<open>|\<close> & \<open>tid\<close> \<^verbatim>\<open>::\<close> \<open>sort  |  tvar\<close>~~\<^verbatim>\<open>::\<close> \<open>sort  |\<close>~~\<^verbatim>\<open>_\<close> \<^verbatim>\<open>::\<close> \<open>sort\<close> \\
     & \<open>|\<close> & \<open>type_name  |  type\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) type_name\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \<open>type_name\<close> \\
     & \<open>|\<close> & \<open>type\<^sup>(\<^sup>1\<^sup>)\<close> \<^verbatim>\<open>=>\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<open>type\<^sup>(\<^sup>1\<^sup>)\<close> \<open>\<Rightarrow>\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>[\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> \<open>type\<close> \<^verbatim>\<open>]\<close> \<^verbatim>\<open>=>\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>[\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> \<open>type\<close> \<^verbatim>\<open>]\<close> \<open>\<Rightarrow>\<close> \<open>type\<close> & \<open>(0)\<close> \\
   @{syntax_def (inner) type_name} & = & \<open>id  |  longid\<close> \\\\
 
   @{syntax_def (inner) sort} & = & @{syntax class_name}~~\<open>|\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>{}\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>{\<close> @{syntax class_name} \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> @{syntax class_name} \<^verbatim>\<open>}\<close> \\
   @{syntax_def (inner) class_name} & = & \<open>id  |  longid\<close> \\
   \end{supertabular}
   \end{center}
 
   \<^medskip>
   Here literal terminals are printed \<^verbatim>\<open>verbatim\<close>; see also
   \secref{sec:inner-lex} for further token categories of the inner syntax. The
   meaning of the nonterminals defined by the above grammar is as follows:
 
   \<^descr> @{syntax_ref (inner) any} denotes any term.
 
   \<^descr> @{syntax_ref (inner) prop} denotes meta-level propositions, which are
   terms of type \<^typ>\<open>prop\<close>. The syntax of such formulae of the meta-logic is
   carefully distinguished from usual conventions for object-logics. In
   particular, plain \<open>\<lambda>\<close>-term notation is \<^emph>\<open>not\<close> recognized as @{syntax (inner)
   prop}.
 
   \<^descr> @{syntax_ref (inner) aprop} denotes atomic propositions, which are
   embedded into regular @{syntax (inner) prop} by means of an explicit \<^verbatim>\<open>PROP\<close>
   token.
 
   Terms of type \<^typ>\<open>prop\<close> with non-constant head, e.g.\ a plain variable,
   are printed in this form. Constants that yield type \<^typ>\<open>prop\<close> are expected
   to provide their own concrete syntax; otherwise the printed version will
   appear like @{syntax (inner) logic} and cannot be parsed again as @{syntax
   (inner) prop}.
 
   \<^descr> @{syntax_ref (inner) logic} denotes arbitrary terms of a logical type,
   excluding type \<^typ>\<open>prop\<close>. This is the main syntactic category of
   object-logic entities, covering plain \<open>\<lambda>\<close>-term notation (variables,
   abstraction, application), plus anything defined by the user.
 
   When specifying notation for logical entities, all logical types (excluding
   \<^typ>\<open>prop\<close>) are \<^emph>\<open>collapsed\<close> to this single category of @{syntax (inner)
   logic}.
 
   \<^descr> @{syntax_ref (inner) index} denotes an optional index term for indexed
   syntax. If omitted, it refers to the first @{keyword_ref "structure"}
   variable in the context. The special dummy ``\<open>\<index>\<close>'' serves as pattern
   variable in mixfix annotations that introduce indexed notation.
 
   \<^descr> @{syntax_ref (inner) idt} denotes identifiers, possibly constrained by
   types.
 
   \<^descr> @{syntax_ref (inner) idts} denotes a sequence of @{syntax_ref (inner)
   idt}. This is the most basic category for variables in iterated binders,
   such as \<open>\<lambda>\<close> or \<open>\<And>\<close>.
 
   \<^descr> @{syntax_ref (inner) pttrn} and @{syntax_ref (inner) pttrns} denote
   patterns for abstraction, cases bindings etc. In Pure, these categories
   start as a merely copy of @{syntax (inner) idt} and @{syntax (inner) idts},
   respectively. Object-logics may add additional productions for binding
   forms.
 
   \<^descr> @{syntax_ref (inner) type} denotes types of the meta-logic.
 
   \<^descr> @{syntax_ref (inner) sort} denotes meta-level sorts.
 
 
   Here are some further explanations of certain syntax features.
 
   \<^item> In @{syntax (inner) idts}, note that \<open>x :: nat y\<close> is parsed as \<open>x :: (nat
   y)\<close>, treating \<open>y\<close> like a type constructor applied to \<open>nat\<close>. To avoid this
   interpretation, write \<open>(x :: nat) y\<close> with explicit parentheses.
 
   \<^item> Similarly, \<open>x :: nat y :: nat\<close> is parsed as \<open>x :: (nat y :: nat)\<close>. The
   correct form is \<open>(x :: nat) (y :: nat)\<close>, or \<open>(x :: nat) y :: nat\<close> if \<open>y\<close> is
   last in the sequence of identifiers.
 
   \<^item> Type constraints for terms bind very weakly. For example, \<open>x < y :: nat\<close>
   is normally parsed as \<open>(x < y) :: nat\<close>, unless \<open><\<close> has a very low priority,
   in which case the input is likely to be ambiguous. The correct form is \<open>x <
   (y :: nat)\<close>.
 
   \<^item> Dummy variables (written as underscore) may occur in different
   roles.
 
     \<^descr> A sort ``\<open>_\<close>'' refers to a vacuous constraint for type variables, which
     is effectively ignored in type-inference.
 
     \<^descr> A type ``\<open>_\<close>'' or ``\<open>_ :: sort\<close>'' acts like an anonymous inference
     parameter, which is filled-in according to the most general type produced
     by the type-checking phase.
 
     \<^descr> A bound ``\<open>_\<close>'' refers to a vacuous abstraction, where the body does not
     refer to the binding introduced here. As in the term \<^term>\<open>\<lambda>x _. x\<close>,
     which is \<open>\<alpha>\<close>-equivalent to \<open>\<lambda>x y. x\<close>.
 
     \<^descr> A free ``\<open>_\<close>'' refers to an implicit outer binding. Higher definitional
     packages usually allow forms like \<open>f x _ = x\<close>.
 
     \<^descr> A schematic ``\<open>_\<close>'' (within a term pattern, see \secref{sec:term-decls})
     refers to an anonymous variable that is implicitly abstracted over its
     context of locally bound variables. For example, this allows pattern
     matching of \<open>{x. f x = g x}\<close> against \<open>{x. _ = _}\<close>, or even \<open>{_. _ = _}\<close> by
     using both bound and schematic dummies.
 
   \<^descr> The three literal dots ``\<^verbatim>\<open>...\<close>'' may be also written as ellipsis symbol
   \<^verbatim>\<open>\<dots>\<close>. In both cases this refers to a special schematic variable, which is
   bound in the context. This special term abbreviation works nicely with
   calculational reasoning (\secref{sec:calculation}).
 
   \<^descr> \<^verbatim>\<open>CONST\<close> ensures that the given identifier is treated as constant term,
   and passed through the parse tree in fully internalized form. This is
   particularly relevant for translation rules (\secref{sec:syn-trans}),
   notably on the RHS.
 
   \<^descr> \<^verbatim>\<open>XCONST\<close> is similar to \<^verbatim>\<open>CONST\<close>, but retains the constant name as given.
   This is only relevant to translation rules (\secref{sec:syn-trans}), notably
   on the LHS.
 \<close>
 
 
 subsection \<open>Inspecting the syntax\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_syntax"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^descr> @{command "print_syntax"} prints the inner syntax of the current context.
   The output can be quite large; the most important sections are explained
   below.
 
     \<^descr> \<open>lexicon\<close> lists the delimiters of the inner token language; see
     \secref{sec:inner-lex}.
 
     \<^descr> \<open>productions\<close> lists the productions of the underlying priority grammar;
     see \secref{sec:priority-grammar}.
 
     Many productions have an extra \<open>\<dots> \<^bold>\<Rightarrow> name\<close>. These names later become the
     heads of parse trees; they also guide the pretty printer.
 
     Productions without such parse tree names are called \<^emph>\<open>copy productions\<close>.
     Their right-hand side must have exactly one nonterminal symbol (or named
     token). The parser does not create a new parse tree node for copy
     productions, but simply returns the parse tree of the right-hand symbol.
 
     If the right-hand side of a copy production consists of a single
     nonterminal without any delimiters, then it is called a \<^emph>\<open>chain
     production\<close>. Chain productions act as abbreviations: conceptually, they
     are removed from the grammar by adding new productions. Priority
     information attached to chain productions is ignored.
 
     \<^descr> \<open>print modes\<close> lists the alternative print modes provided by this
     grammar; see \secref{sec:print-modes}.
 
     \<^descr> \<open>parse_rules\<close> and \<open>print_rules\<close> relate to syntax translations (macros);
     see \secref{sec:syn-trans}.
 
     \<^descr> \<open>parse_ast_translation\<close> and \<open>print_ast_translation\<close> list sets of
     constants that invoke translation functions for abstract syntax trees,
     which are only required in very special situations; see
     \secref{sec:tr-funs}.
 
     \<^descr> \<open>parse_translation\<close> and \<open>print_translation\<close> list the sets of constants
     that invoke regular translation functions; see \secref{sec:tr-funs}.
 \<close>
 
 
 subsection \<open>Ambiguity of parsed expressions\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def syntax_ambiguity_warning} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def syntax_ambiguity_limit} & : & \<open>attribute\<close> & default \<open>10\<close> \\
   \end{tabular}
 
   Depending on the grammar and the given input, parsing may be ambiguous.
   Isabelle lets the Earley parser enumerate all possible parse trees, and then
   tries to make the best out of the situation. Terms that cannot be
   type-checked are filtered out, which often leads to a unique result in the
   end. Unlike regular type reconstruction, which is applied to the whole
   collection of input terms simultaneously, the filtering stage only treats
   each given term in isolation. Filtering is also not attempted for individual
   types or raw ASTs (as required for @{command translations}).
 
   Certain warning or error messages are printed, depending on the situation
   and the given configuration options. Parsing ultimately fails, if multiple
   results remain after the filtering phase.
 
   \<^descr> @{attribute syntax_ambiguity_warning} controls output of explicit warning
   messages about syntax ambiguity.
 
   \<^descr> @{attribute syntax_ambiguity_limit} determines the number of resulting
   parse trees that are shown as part of the printed message in case of an
   ambiguity.
 \<close>
 
 
 section \<open>Syntax transformations \label{sec:syntax-transformations}\<close>
 
 text \<open>
   The inner syntax engine of Isabelle provides separate mechanisms to
   transform parse trees either via rewrite systems on first-order ASTs
   (\secref{sec:syn-trans}), or ML functions on ASTs or syntactic \<open>\<lambda>\<close>-terms
   (\secref{sec:tr-funs}). This works both for parsing and printing, as
   outlined in \figref{fig:parse-print}.
 
   \begin{figure}[htbp]
   \begin{center}
   \begin{tabular}{cl}
   string          & \\
   \<open>\<down>\<close>     & lexer + parser \\
   parse tree      & \\
   \<open>\<down>\<close>     & parse AST translation \\
   AST             & \\
   \<open>\<down>\<close>     & AST rewriting (macros) \\
   AST             & \\
   \<open>\<down>\<close>     & parse translation \\
   --- pre-term ---    & \\
   \<open>\<down>\<close>     & print translation \\
   AST             & \\
   \<open>\<down>\<close>     & AST rewriting (macros) \\
   AST             & \\
   \<open>\<down>\<close>     & print AST translation \\
   string          &
   \end{tabular}
   \end{center}
   \caption{Parsing and printing with translations}\label{fig:parse-print}
   \end{figure}
 
   These intermediate syntax tree formats eventually lead to a pre-term with
   all names and binding scopes resolved, but most type information still
   missing. Explicit type constraints might be given by the user, or implicit
   position information by the system --- both need to be passed-through
   carefully by syntax transformations.
 
   Pre-terms are further processed by the so-called \<^emph>\<open>check\<close> and \<^emph>\<open>uncheck\<close>
   phases that are intertwined with type-inference (see also @{cite
   "isabelle-implementation"}). The latter allows to operate on higher-order
   abstract syntax with proper binding and type information already available.
 
   As a rule of thumb, anything that manipulates bindings of variables or
   constants needs to be implemented as syntax transformation (see below).
   Anything else is better done via check/uncheck: a prominent example
   application is the @{command abbreviation} concept of Isabelle/Pure.
 \<close>
 
 
 subsection \<open>Abstract syntax trees \label{sec:ast}\<close>
 
 text \<open>
   The ML datatype \<^ML_type>\<open>Ast.ast\<close> explicitly represents the intermediate
   AST format that is used for syntax rewriting (\secref{sec:syn-trans}). It is
   defined in ML as follows:
   @{verbatim [display]
 \<open>datatype ast =
   Constant of string |
   Variable of string |
   Appl of ast list\<close>}
 
   An AST is either an atom (constant or variable) or a list of (at least two)
   subtrees. Occasional diagnostic output of ASTs uses notation that resembles
   S-expression of LISP. Constant atoms are shown as quoted strings, variable
   atoms as non-quoted strings and applications as a parenthesized list of
   subtrees. For example, the AST
   @{ML [display] \<open>Ast.Appl [Ast.Constant "_abs", Ast.Variable "x", Ast.Variable "t"]\<close>}
   is pretty-printed as \<^verbatim>\<open>("_abs" x t)\<close>. Note that \<^verbatim>\<open>()\<close> and \<^verbatim>\<open>(x)\<close> are
   excluded as ASTs, because they have too few subtrees.
 
   \<^medskip>
   AST application is merely a pro-forma mechanism to indicate certain
   syntactic structures. Thus \<^verbatim>\<open>(c a b)\<close> could mean either term application or
   type application, depending on the syntactic context.
 
   Nested application like \<^verbatim>\<open>(("_abs" x t) u)\<close> is also possible, but ASTs are
   definitely first-order: the syntax constant \<^verbatim>\<open>"_abs"\<close> does not bind the \<^verbatim>\<open>x\<close>
   in any way. Proper bindings are introduced in later stages of the term
   syntax, where \<^verbatim>\<open>("_abs" x t)\<close> becomes an \<^ML>\<open>Abs\<close> node and occurrences of
   \<^verbatim>\<open>x\<close> in \<^verbatim>\<open>t\<close> are replaced by bound variables (represented as de-Bruijn
   indices).
 \<close>
 
 
 subsubsection \<open>AST constants versus variables\<close>
 
 text \<open>
   Depending on the situation --- input syntax, output syntax, translation
   patterns --- the distinction of atomic ASTs as \<^ML>\<open>Ast.Constant\<close> versus
   \<^ML>\<open>Ast.Variable\<close> serves slightly different purposes.
 
   Input syntax of a term such as \<open>f a b = c\<close> does not yet indicate the scopes
   of atomic entities \<open>f, a, b, c\<close>: they could be global constants or local
   variables, even bound ones depending on the context of the term. \<^ML>\<open>Ast.Variable\<close> leaves this choice still open: later syntax layers (or
   translation functions) may capture such a variable to determine its role
   specifically, to make it a constant, bound variable, free variable etc. In
   contrast, syntax translations that introduce already known constants would
   rather do it via \<^ML>\<open>Ast.Constant\<close> to prevent accidental re-interpretation
   later on.
 
   Output syntax turns term constants into \<^ML>\<open>Ast.Constant\<close> and variables
   (free or schematic) into \<^ML>\<open>Ast.Variable\<close>. This information is precise
   when printing fully formal \<open>\<lambda>\<close>-terms.
 
   \<^medskip>
   AST translation patterns (\secref{sec:syn-trans}) that represent terms
   cannot distinguish constants and variables syntactically. Explicit
   indication of \<open>CONST c\<close> inside the term language is required, unless \<open>c\<close> is
   known as special \<^emph>\<open>syntax constant\<close> (see also @{command syntax}). It is also
   possible to use @{command syntax} declarations (without mixfix annotation)
   to enforce that certain unqualified names are always treated as constant
   within the syntax machinery.
 
   The situation is simpler for ASTs that represent types or sorts, since the
   concrete syntax already distinguishes type variables from type constants
   (constructors). So \<open>('a, 'b) foo\<close> corresponds to an AST application of some
   constant for \<open>foo\<close> and variable arguments for \<open>'a\<close> and \<open>'b\<close>. Note that the
   postfix application is merely a feature of the concrete syntax, while in the
   AST the constructor occurs in head position.
 \<close>
 
 
 subsubsection \<open>Authentic syntax names\<close>
 
 text \<open>
   Naming constant entities within ASTs is another delicate issue. Unqualified
   names are resolved in the name space tables in the last stage of parsing,
   after all translations have been applied. Since syntax transformations do
   not know about this later name resolution, there can be surprises in
   boundary cases.
 
   \<^emph>\<open>Authentic syntax names\<close> for \<^ML>\<open>Ast.Constant\<close> avoid this problem: the
   fully-qualified constant name with a special prefix for its formal category
   (\<open>class\<close>, \<open>type\<close>, \<open>const\<close>, \<open>fixed\<close>) represents the information faithfully
   within the untyped AST format. Accidental overlap with free or bound
   variables is excluded as well. Authentic syntax names work implicitly in the
   following situations:
 
     \<^item> Input of term constants (or fixed variables) that are introduced by
     concrete syntax via @{command notation}: the correspondence of a
     particular grammar production to some known term entity is preserved.
 
     \<^item> Input of type constants (constructors) and type classes --- thanks to
     explicit syntactic distinction independently on the context.
 
     \<^item> Output of term constants, type constants, type classes --- this
     information is already available from the internal term to be printed.
 
   In other words, syntax transformations that operate on input terms written
   as prefix applications are difficult to make robust. Luckily, this case
   rarely occurs in practice, because syntax forms to be translated usually
   correspond to some concrete notation.
 \<close>
 
 
 subsection \<open>Raw syntax and translations \label{sec:syn-trans}\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{command_def "nonterminal"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "syntax"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "no_syntax"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "translations"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "no_translations"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{attribute_def syntax_ast_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def syntax_ast_stats} & : & \<open>attribute\<close> & default \<open>false\<close> \\
   \end{tabular}
   \<^medskip>
 
   Unlike mixfix notation for existing formal entities (\secref{sec:notation}),
   raw syntax declarations provide full access to the priority grammar of the
   inner syntax, without any sanity checks. This includes additional syntactic
   categories (via @{command nonterminal}) and free-form grammar productions
   (via @{command syntax}). Additional syntax translations (or macros, via
   @{command translations}) are required to turn resulting parse trees into
   proper representations of formal entities again.
 
   \<^rail>\<open>
     @@{command nonterminal} (@{syntax name} + @'and')
     ;
     (@@{command syntax} | @@{command no_syntax}) @{syntax mode}? (constdecl +)
     ;
     (@@{command translations} | @@{command no_translations})
       (transpat ('==' | '=>' | '<=' | '\<rightleftharpoons>' | '\<rightharpoonup>' | '\<leftharpoondown>') transpat +)
     ;
 
     constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?
     ;
     mode: ('(' ( @{syntax name} | @'output' | @{syntax name} @'output' ) ')')
     ;
     transpat: ('(' @{syntax name} ')')? @{syntax string}
   \<close>
 
   \<^descr> @{command "nonterminal"}~\<open>c\<close> declares a type constructor \<open>c\<close> (without
   arguments) to act as purely syntactic type: a nonterminal symbol of the
   inner syntax.
 
   \<^descr> @{command "syntax"}~\<open>(mode) c :: \<sigma> (mx)\<close> augments the priority grammar and
   the pretty printer table for the given print mode (default \<^verbatim>\<open>""\<close>). An
   optional keyword @{keyword_ref "output"} means that only the pretty printer
   table is affected.
 
   Following \secref{sec:mixfix}, the mixfix annotation \<open>mx = template ps q\<close>
   together with type \<open>\<sigma> = \<tau>\<^sub>1 \<Rightarrow> \<dots> \<tau>\<^sub>n \<Rightarrow> \<tau>\<close> and specify a grammar production.
   The \<open>template\<close> contains delimiter tokens that surround \<open>n\<close> argument
   positions (\<^verbatim>\<open>_\<close>). The latter correspond to nonterminal symbols \<open>A\<^sub>i\<close> derived
   from the argument types \<open>\<tau>\<^sub>i\<close> as follows:
 
     \<^item> \<open>prop\<close> if \<open>\<tau>\<^sub>i = prop\<close>
 
     \<^item> \<open>logic\<close> if \<open>\<tau>\<^sub>i = (\<dots>)\<kappa>\<close> for logical type constructor \<open>\<kappa> \<noteq> prop\<close>
 
     \<^item> \<open>any\<close> if \<open>\<tau>\<^sub>i = \<alpha>\<close> for type variables
 
     \<^item> \<open>\<kappa>\<close> if \<open>\<tau>\<^sub>i = \<kappa>\<close> for nonterminal \<open>\<kappa>\<close> (syntactic type constructor)
 
   Each \<open>A\<^sub>i\<close> is decorated by priority \<open>p\<^sub>i\<close> from the given list \<open>ps\<close>; missing
   priorities default to 0.
 
   The resulting nonterminal of the production is determined similarly from
   type \<open>\<tau>\<close>, with priority \<open>q\<close> and default 1000.
 
   \<^medskip>
   Parsing via this production produces parse trees \<open>t\<^sub>1, \<dots>, t\<^sub>n\<close> for the
   argument slots. The resulting parse tree is composed as \<open>c t\<^sub>1 \<dots> t\<^sub>n\<close>, by
   using the syntax constant \<open>c\<close> of the syntax declaration.
 
   Such syntactic constants are invented on the spot, without formal check
   wrt.\ existing declarations. It is conventional to use plain identifiers
   prefixed by a single underscore (e.g.\ \<open>_foobar\<close>). Names should be chosen
   with care, to avoid clashes with other syntax declarations.
 
   \<^medskip>
   The special case of copy production is specified by \<open>c =\<close>~\<^verbatim>\<open>""\<close> (empty
   string). It means that the resulting parse tree \<open>t\<close> is copied directly,
   without any further decoration.
 
   \<^descr> @{command "no_syntax"}~\<open>(mode) decls\<close> removes grammar declarations (and
   translations) resulting from \<open>decls\<close>, which are interpreted in the same
   manner as for @{command "syntax"} above.
 
   \<^descr> @{command "translations"}~\<open>rules\<close> specifies syntactic translation rules
   (i.e.\ macros) as first-order rewrite rules on ASTs (\secref{sec:ast}). The
   theory context maintains two independent lists translation rules: parse
   rules (\<^verbatim>\<open>=>\<close> or \<open>\<rightharpoonup>\<close>) and print rules (\<^verbatim>\<open><=\<close> or \<open>\<leftharpoondown>\<close>). For convenience, both
   can be specified simultaneously as parse~/ print rules (\<^verbatim>\<open>==\<close> or \<open>\<rightleftharpoons>\<close>).
 
   Translation patterns may be prefixed by the syntactic category to be used
   for parsing; the default is \<open>logic\<close> which means that regular term syntax is
   used. Both sides of the syntax translation rule undergo parsing and parse
   AST translations \secref{sec:tr-funs}, in order to perform some fundamental
   normalization like \<open>\<lambda>x y. b \<leadsto> \<lambda>x. \<lambda>y. b\<close>, but other AST translation rules
   are \<^emph>\<open>not\<close> applied recursively here.
 
   When processing AST patterns, the inner syntax lexer runs in a different
   mode that allows identifiers to start with underscore. This accommodates the
   usual naming convention for auxiliary syntax constants --- those that do not
   have a logical counter part --- by allowing to specify arbitrary AST
   applications within the term syntax, independently of the corresponding
   concrete syntax.
 
   Atomic ASTs are distinguished as \<^ML>\<open>Ast.Constant\<close> versus \<^ML>\<open>Ast.Variable\<close> as follows: a qualified name or syntax constant declared via
   @{command syntax}, or parse tree head of concrete notation becomes \<^ML>\<open>Ast.Constant\<close>, anything else \<^ML>\<open>Ast.Variable\<close>. Note that \<open>CONST\<close> and
   \<open>XCONST\<close> within the term language (\secref{sec:pure-grammar}) allow to
   enforce treatment as constants.
 
   AST rewrite rules \<open>(lhs, rhs)\<close> need to obey the following side-conditions:
 
     \<^item> Rules must be left linear: \<open>lhs\<close> must not contain repeated
     variables.\<^footnote>\<open>The deeper reason for this is that AST equality is not
     well-defined: different occurrences of the ``same'' AST could be decorated
     differently by accidental type-constraints or source position information,
     for example.\<close>
 
     \<^item> Every variable in \<open>rhs\<close> must also occur in \<open>lhs\<close>.
 
   \<^descr> @{command "no_translations"}~\<open>rules\<close> removes syntactic translation rules,
   which are interpreted in the same manner as for @{command "translations"}
   above.
 
   \<^descr> @{attribute syntax_ast_trace} and @{attribute syntax_ast_stats} control
   diagnostic output in the AST normalization process, when translation rules
   are applied to concrete input or output.
 
 
   Raw syntax and translations provides a slightly more low-level access to the
   grammar and the form of resulting parse trees. It is often possible to avoid
   this untyped macro mechanism, and use type-safe @{command abbreviation} or
   @{command notation} instead. Some important situations where @{command
   syntax} and @{command translations} are really need are as follows:
 
   \<^item> Iterated replacement via recursive @{command translations}. For example,
   consider list enumeration \<^term>\<open>[a, b, c, d]\<close> as defined in theory
   \<^theory>\<open>HOL.List\<close>.
 
   \<^item> Change of binding status of variables: anything beyond the built-in
   @{keyword "binder"} mixfix annotation requires explicit syntax translations.
   For example, consider the set comprehension syntax \<^term>\<open>{x. P}\<close> as
   defined in theory \<^theory>\<open>HOL.Set\<close>.
 \<close>
 
 
 subsubsection \<open>Applying translation rules\<close>
 
 text \<open>
   As a term is being parsed or printed, an AST is generated as an intermediate
   form according to \figref{fig:parse-print}. The AST is normalized by
   applying translation rules in the manner of a first-order term rewriting
   system. We first examine how a single rule is applied.
 
   Let \<open>t\<close> be the abstract syntax tree to be normalized and \<open>(lhs, rhs)\<close> some
   translation rule. A subtree \<open>u\<close> of \<open>t\<close> is called \<^emph>\<open>redex\<close> if it is an
   instance of \<open>lhs\<close>; in this case the pattern \<open>lhs\<close> is said to match the
   object \<open>u\<close>. A redex matched by \<open>lhs\<close> may be replaced by the corresponding
   instance of \<open>rhs\<close>, thus \<^emph>\<open>rewriting\<close> the AST \<open>t\<close>. Matching requires some
   notion of \<^emph>\<open>place-holders\<close> in rule patterns: \<^ML>\<open>Ast.Variable\<close> serves this
   purpose.
 
   More precisely, the matching of the object \<open>u\<close> against the pattern \<open>lhs\<close> is
   performed as follows:
 
     \<^item> Objects of the form \<^ML>\<open>Ast.Variable\<close>~\<open>x\<close> or \<^ML>\<open>Ast.Constant\<close>~\<open>x\<close> are
     matched by pattern \<^ML>\<open>Ast.Constant\<close>~\<open>x\<close>. Thus all atomic ASTs in the
     object are treated as (potential) constants, and a successful match makes
     them actual constants even before name space resolution (see also
     \secref{sec:ast}).
 
     \<^item> Object \<open>u\<close> is matched by pattern \<^ML>\<open>Ast.Variable\<close>~\<open>x\<close>, binding \<open>x\<close> to
     \<open>u\<close>.
 
     \<^item> Object \<^ML>\<open>Ast.Appl\<close>~\<open>us\<close> is matched by \<^ML>\<open>Ast.Appl\<close>~\<open>ts\<close> if \<open>us\<close> and
     \<open>ts\<close> have the same length and each corresponding subtree matches.
 
     \<^item> In every other case, matching fails.
 
   A successful match yields a substitution that is applied to \<open>rhs\<close>,
   generating the instance that replaces \<open>u\<close>.
 
   Normalizing an AST involves repeatedly applying translation rules until none
   are applicable. This works yoyo-like: top-down, bottom-up, top-down, etc. At
   each subtree position, rules are chosen in order of appearance in the theory
   definitions.
 
   The configuration options @{attribute syntax_ast_trace} and @{attribute
   syntax_ast_stats} might help to understand this process and diagnose
   problems.
 
   \begin{warn}
   If syntax translation rules work incorrectly, the output of @{command_ref
   print_syntax} with its \<^emph>\<open>rules\<close> sections reveals the actual internal forms
   of AST pattern, without potentially confusing concrete syntax. Recall that
   AST constants appear as quoted strings and variables without quotes.
   \end{warn}
 
   \begin{warn}
   If @{attribute_ref eta_contract} is set to \<open>true\<close>, terms will be
   \<open>\<eta>\<close>-contracted \<^emph>\<open>before\<close> the AST rewriter sees them. Thus some abstraction
   nodes needed for print rules to match may vanish. For example, \<open>Ball A (\<lambda>x.
   P x)\<close> would contract to \<open>Ball A P\<close> and the standard print rule would fail to
   apply. This problem can be avoided by hand-written ML translation functions
   (see also \secref{sec:tr-funs}), which is in fact the same mechanism used in
   built-in @{keyword "binder"} declarations.
   \end{warn}
 \<close>
 
 
 subsection \<open>Syntax translation functions \label{sec:tr-funs}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "parse_ast_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "parse_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "print_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "typed_print_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "print_ast_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{ML_antiquotation_def "class_syntax"} & : & \<open>ML antiquotation\<close> \\
     @{ML_antiquotation_def "type_syntax"} & : & \<open>ML antiquotation\<close> \\
     @{ML_antiquotation_def "const_syntax"} & : & \<open>ML antiquotation\<close> \\
     @{ML_antiquotation_def "syntax_const"} & : & \<open>ML antiquotation\<close> \\
   \end{matharray}
 
   Syntax translation functions written in ML admit almost arbitrary
   manipulations of inner syntax, at the expense of some complexity and
   obscurity in the implementation.
 
   \<^rail>\<open>
   ( @@{command parse_ast_translation} | @@{command parse_translation} |
     @@{command print_translation} | @@{command typed_print_translation} |
     @@{command print_ast_translation}) @{syntax text}
   ;
   (@@{ML_antiquotation class_syntax} |
    @@{ML_antiquotation type_syntax} |
    @@{ML_antiquotation const_syntax} |
    @@{ML_antiquotation syntax_const}) embedded
   \<close>
 
   \<^descr> @{command parse_translation} etc. declare syntax translation functions to
   the theory. Any of these commands have a single @{syntax text} argument that
   refers to an ML expression of appropriate type as follows:
 
   \<^medskip>
   {\footnotesize
   \begin{tabular}{l}
   @{command parse_ast_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> Ast.ast list -> Ast.ast)) list\<close> \\
   @{command parse_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> term list -> term)) list\<close> \\
   @{command print_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> term list -> term)) list\<close> \\
   @{command typed_print_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> typ -> term list -> term)) list\<close> \\
   @{command print_ast_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> Ast.ast list -> Ast.ast)) list\<close> \\
   \end{tabular}}
   \<^medskip>
 
   The argument list consists of \<open>(c, tr)\<close> pairs, where \<open>c\<close> is the syntax name
   of the formal entity involved, and \<open>tr\<close> a function that translates a syntax
   form \<open>c args\<close> into \<open>tr ctxt args\<close> (depending on the context). The
   Isabelle/ML naming convention for parse translations is \<open>c_tr\<close> and for print
   translations \<open>c_tr'\<close>.
 
   The @{command_ref print_syntax} command displays the sets of names
   associated with the translation functions of a theory under
   \<open>parse_ast_translation\<close> etc.
 
   \<^descr> \<open>@{class_syntax c}\<close>, \<open>@{type_syntax c}\<close>, \<open>@{const_syntax c}\<close> inline the
   authentic syntax name of the given formal entities into the ML source. This
   is the fully-qualified logical name prefixed by a special marker to indicate
   its kind: thus different logical name spaces are properly distinguished
   within parse trees.
 
   \<^descr> \<open>@{const_syntax c}\<close> inlines the name \<open>c\<close> of the given syntax constant,
   having checked that it has been declared via some @{command syntax} commands
   within the theory context. Note that the usual naming convention makes
   syntax constants start with underscore, to reduce the chance of accidental
   clashes with other names occurring in parse trees (unqualified constants
   etc.).
 \<close>
 
 
 subsubsection \<open>The translation strategy\<close>
 
 text \<open>
   The different kinds of translation functions are invoked during the
   transformations between parse trees, ASTs and syntactic terms (cf.\
   \figref{fig:parse-print}). Whenever a combination of the form \<open>c x\<^sub>1 \<dots> x\<^sub>n\<close>
   is encountered, and a translation function \<open>f\<close> of appropriate kind is
   declared for \<open>c\<close>, the result is produced by evaluation of \<open>f [x\<^sub>1, \<dots>, x\<^sub>n]\<close>
   in ML.
 
   For AST translations, the arguments \<open>x\<^sub>1, \<dots>, x\<^sub>n\<close> are ASTs. A combination
   has the form \<^ML>\<open>Ast.Constant\<close>~\<open>c\<close> or \<^ML>\<open>Ast.Appl\<close>~\<open>[\<close>\<^ML>\<open>Ast.Constant\<close>~\<open>c, x\<^sub>1, \<dots>, x\<^sub>n]\<close>. For term translations, the arguments are
   terms and a combination has the form \<^ML>\<open>Const\<close>~\<open>(c, \<tau>)\<close> or \<^ML>\<open>Const\<close>~\<open>(c, \<tau>) $ x\<^sub>1 $ \<dots> $ x\<^sub>n\<close>. Terms allow more sophisticated
   transformations than ASTs do, typically involving abstractions and bound
   variables. \<^emph>\<open>Typed\<close> print translations may even peek at the type \<open>\<tau>\<close> of the
   constant they are invoked on, although some information might have been
   suppressed for term output already.
 
   Regardless of whether they act on ASTs or terms, translation functions
   called during the parsing process differ from those for printing in their
   overall behaviour:
 
     \<^descr>[Parse translations] are applied bottom-up. The arguments are already in
     translated form. The translations must not fail; exceptions trigger an
     error message. There may be at most one function associated with any
     syntactic name.
 
     \<^descr>[Print translations] are applied top-down. They are supplied with
     arguments that are partly still in internal form. The result again
     undergoes translation; therefore a print translation should not introduce
     as head the very constant that invoked it. The function may raise
     exception \<^ML>\<open>Match\<close> to indicate failure; in this event it has no effect.
     Multiple functions associated with some syntactic name are tried in the
     order of declaration in the theory.
 
   Only constant atoms --- constructor \<^ML>\<open>Ast.Constant\<close> for ASTs and \<^ML>\<open>Const\<close> for terms --- can invoke translation functions. This means that parse
   translations can only be associated with parse tree heads of concrete
   syntax, or syntactic constants introduced via other translations. For plain
   identifiers within the term language, the status of constant versus variable
   is not yet know during parsing. This is in contrast to print translations,
   where constants are explicitly known from the given term in its fully
   internal form.
 \<close>
 
 
 subsection \<open>Built-in syntax transformations\<close>
 
 text \<open>
   Here are some further details of the main syntax transformation phases of
   \figref{fig:parse-print}.
 \<close>
 
 
 subsubsection \<open>Transforming parse trees to ASTs\<close>
 
 text \<open>
   The parse tree is the raw output of the parser. It is transformed into an
   AST according to some basic scheme that may be augmented by AST translation
   functions as explained in \secref{sec:tr-funs}.
 
   The parse tree is constructed by nesting the right-hand sides of the
   productions used to recognize the input. Such parse trees are simply lists
   of tokens and constituent parse trees, the latter representing the
   nonterminals of the productions. Ignoring AST translation functions, parse
   trees are transformed to ASTs by stripping out delimiters and copy
   productions, while retaining some source position information from input
   tokens.
 
   The Pure syntax provides predefined AST translations to make the basic
   \<open>\<lambda>\<close>-term structure more apparent within the (first-order) AST
   representation, and thus facilitate the use of @{command translations} (see
   also \secref{sec:syn-trans}). This covers ordinary term application, type
   application, nested abstraction, iterated meta implications and function
   types. The effect is illustrated on some representative input strings is as
   follows:
 
   \begin{center}
   \begin{tabular}{ll}
   input source & AST \\
   \hline
   \<open>f x y z\<close> & \<^verbatim>\<open>(f x y z)\<close> \\
   \<open>'a ty\<close> & \<^verbatim>\<open>(ty 'a)\<close> \\
   \<open>('a, 'b)ty\<close> & \<^verbatim>\<open>(ty 'a 'b)\<close> \\
   \<open>\<lambda>x y z. t\<close> & \<^verbatim>\<open>("_abs" x ("_abs" y ("_abs" z t)))\<close> \\
   \<open>\<lambda>x :: 'a. t\<close> & \<^verbatim>\<open>("_abs" ("_constrain" x 'a) t)\<close> \\
   \<open>\<lbrakk>P; Q; R\<rbrakk> \<Longrightarrow> S\<close> & \<^verbatim>\<open>("Pure.imp" P ("Pure.imp" Q ("Pure.imp" R S)))\<close> \\
    \<open>['a, 'b, 'c] \<Rightarrow> 'd\<close> & \<^verbatim>\<open>("fun" 'a ("fun" 'b ("fun" 'c 'd)))\<close> \\
   \end{tabular}
   \end{center}
 
   Note that type and sort constraints may occur in further places ---
   translations need to be ready to cope with them. The built-in syntax
   transformation from parse trees to ASTs insert additional constraints that
   represent source positions.
 \<close>
 
 
 subsubsection \<open>Transforming ASTs to terms\<close>
 
 text \<open>
   After application of macros (\secref{sec:syn-trans}), the AST is transformed
   into a term. This term still lacks proper type information, but it might
   contain some constraints consisting of applications with head \<^verbatim>\<open>_constrain\<close>,
   where the second argument is a type encoded as a pre-term within the syntax.
   Type inference later introduces correct types, or indicates type errors in
   the input.
 
   Ignoring parse translations, ASTs are transformed to terms by mapping AST
   constants to term constants, AST variables to term variables or constants
   (according to the name space), and AST applications to iterated term
   applications.
 
   The outcome is still a first-order term. Proper abstractions and bound
   variables are introduced by parse translations associated with certain
   syntax constants. Thus \<^verbatim>\<open>("_abs" x x)\<close> eventually becomes a de-Bruijn term
   \<^verbatim>\<open>Abs ("x", _, Bound 0)\<close>.
 \<close>
 
 
 subsubsection \<open>Printing of terms\<close>
 
 text \<open>
   The output phase is essentially the inverse of the input phase. Terms are
   translated via abstract syntax trees into pretty-printed text.
 
   Ignoring print translations, the transformation maps term constants,
   variables and applications to the corresponding constructs on ASTs.
   Abstractions are mapped to applications of the special constant \<^verbatim>\<open>_abs\<close> as
   seen before. Type constraints are represented via special \<^verbatim>\<open>_constrain\<close>
   forms, according to various policies of type annotation determined
   elsewhere. Sort constraints of type variables are handled in a similar
   fashion.
 
   After application of macros (\secref{sec:syn-trans}), the AST is finally
   pretty-printed. The built-in print AST translations reverse the
   corresponding parse AST translations.
 
   \<^medskip>
   For the actual printing process, the priority grammar
   (\secref{sec:priority-grammar}) plays a vital role: productions are used as
   templates for pretty printing, with argument slots stemming from
   nonterminals, and syntactic sugar stemming from literal tokens.
 
   Each AST application with constant head \<open>c\<close> and arguments \<open>t\<^sub>1\<close>, \dots,
   \<open>t\<^sub>n\<close> (for \<open>n = 0\<close> the AST is just the constant \<open>c\<close> itself) is printed
   according to the first grammar production of result name \<open>c\<close>. The required
   syntax priority of the argument slot is given by its nonterminal \<open>A\<^sup>(\<^sup>p\<^sup>)\<close>.
   The argument \<open>t\<^sub>i\<close> that corresponds to the position of \<open>A\<^sup>(\<^sup>p\<^sup>)\<close> is printed
   recursively, and then put in parentheses \<^emph>\<open>if\<close> its priority \<open>p\<close> requires
   this. The resulting output is concatenated with the syntactic sugar
   according to the grammar production.
 
   If an AST application \<open>(c x\<^sub>1 \<dots> x\<^sub>m)\<close> has more arguments than the
   corresponding production, it is first split into \<open>((c x\<^sub>1 \<dots> x\<^sub>n) x\<^sub>n\<^sub>+\<^sub>1 \<dots>
   x\<^sub>m)\<close> and then printed recursively as above.
 
   Applications with too few arguments or with non-constant head or without a
   corresponding production are printed in prefix-form like \<open>f t\<^sub>1 \<dots> t\<^sub>n\<close> for
   terms.
 
   Multiple productions associated with some name \<open>c\<close> are tried in order of
   appearance within the grammar. An occurrence of some AST variable \<open>x\<close> is
   printed as \<open>x\<close> outright.
 
   \<^medskip>
   White space is \<^emph>\<open>not\<close> inserted automatically. If blanks (or breaks) are
   required to separate tokens, they need to be specified in the mixfix
   declaration (\secref{sec:mixfix}).
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Outer_Syntax.thy b/src/Doc/Isar_Ref/Outer_Syntax.thy
--- a/src/Doc/Isar_Ref/Outer_Syntax.thy
+++ b/src/Doc/Isar_Ref/Outer_Syntax.thy
@@ -1,603 +1,607 @@
 (*:maxLineLen=78:*)
 
 theory Outer_Syntax
   imports Main Base
 begin
 
 chapter \<open>Outer syntax --- the theory language \label{ch:outer-syntax}\<close>
 
 text \<open>
   The rather generic framework of Isabelle/Isar syntax emerges from three main
   syntactic categories: \<^emph>\<open>commands\<close> of the top-level Isar engine (covering
   theory and proof elements), \<^emph>\<open>methods\<close> for general goal refinements
   (analogous to traditional ``tactics''), and \<^emph>\<open>attributes\<close> for operations on
   facts (within a certain context). Subsequently we give a reference of basic
   syntactic entities underlying Isabelle/Isar syntax in a bottom-up manner.
   Concrete theory and proof language elements will be introduced later on.
 
   \<^medskip>
   In order to get started with writing well-formed Isabelle/Isar documents,
   the most important aspect to be noted is the difference of \<^emph>\<open>inner\<close> versus
   \<^emph>\<open>outer\<close> syntax. Inner syntax is that of Isabelle types and terms of the
   logic, while outer syntax is that of Isabelle/Isar theory sources
   (specifications and proofs). As a general rule, inner syntax entities may
   occur only as \<^emph>\<open>atomic entities\<close> within outer syntax. For example, the
   string \<^verbatim>\<open>"x + y"\<close> and identifier \<^verbatim>\<open>z\<close> are legal term specifications within a
   theory, while \<^verbatim>\<open>x + y\<close> without quotes is not.
 
   Printed theory documents usually omit quotes to gain readability (this is a
   matter of {\LaTeX} macro setup, say via \<^verbatim>\<open>\isabellestyle\<close>, see also @{cite
   "isabelle-system"}). Experienced users of Isabelle/Isar may easily
   reconstruct the lost technical information, while mere readers need not care
   about quotes at all.
 \<close>
 
 
 section \<open>Commands\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_commands"}\<open>\<^sup>*\<close> & : & \<open>any \<rightarrow>\<close> \\
     @{command_def "help"}\<open>\<^sup>*\<close> & : & \<open>any \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command help} (@{syntax name} * )
   \<close>
 
   \<^descr> @{command "print_commands"} prints all outer syntax keywords
   and commands.
 
   \<^descr> @{command "help"}~\<open>pats\<close> retrieves outer syntax
   commands according to the specified name patterns.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Some common diagnostic commands are retrieved like this (according to usual
   naming conventions):
 \<close>
 
 help "print"
 help "find"
 
 
 section \<open>Lexical matters \label{sec:outer-lex}\<close>
 
 text \<open>
   The outer lexical syntax consists of three main categories of syntax tokens:
 
     \<^enum> \<^emph>\<open>major keywords\<close> --- the command names that are available
     in the present logic session;
 
     \<^enum> \<^emph>\<open>minor keywords\<close> --- additional literal tokens required
     by the syntax of commands;
 
     \<^enum> \<^emph>\<open>named tokens\<close> --- various categories of identifiers etc.
 
   Major keywords and minor keywords are guaranteed to be disjoint. This helps
   user-interfaces to determine the overall structure of a theory text, without
   knowing the full details of command syntax. Internally, there is some
   additional information about the kind of major keywords, which approximates
   the command type (theory command, proof command etc.).
 
   Keywords override named tokens. For example, the presence of a command
   called \<^verbatim>\<open>term\<close> inhibits the identifier \<^verbatim>\<open>term\<close>, but the string \<^verbatim>\<open>"term"\<close> can
   be used instead. By convention, the outer syntax always allows quoted
   strings in addition to identifiers, wherever a named entity is expected.
 
   When tokenizing a given input sequence, the lexer repeatedly takes the
   longest prefix of the input that forms a valid token. Spaces, tabs, newlines
   and formfeeds between tokens serve as explicit separators.
 
   \<^medskip>
   The categories for named tokens are defined once and for all as follows.
 
   \begin{center}
   \begin{supertabular}{rcl}
     @{syntax_def short_ident} & = & \<open>letter (subscript\<^sup>? quasiletter)\<^sup>*\<close> \\
     @{syntax_def long_ident} & = & \<open>short_ident(\<close>\<^verbatim>\<open>.\<close>\<open>short_ident)\<^sup>+\<close> \\
     @{syntax_def sym_ident} & = & \<open>sym\<^sup>+  |\<close>~~\<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>short_ident\<close>\<^verbatim>\<open>>\<close> \\
     @{syntax_def nat} & = & \<open>digit\<^sup>+\<close> \\
     @{syntax_def float} & = & @{syntax_ref nat}\<^verbatim>\<open>.\<close>@{syntax_ref nat}~~\<open>|\<close>~~\<^verbatim>\<open>-\<close>@{syntax_ref nat}\<^verbatim>\<open>.\<close>@{syntax_ref nat} \\
     @{syntax_def term_var} & = & \<^verbatim>\<open>?\<close>\<open>short_ident  |\<close>~~\<^verbatim>\<open>?\<close>\<open>short_ident\<close>\<^verbatim>\<open>.\<close>\<open>nat\<close> \\
     @{syntax_def type_ident} & = & \<^verbatim>\<open>'\<close>\<open>short_ident\<close> \\
     @{syntax_def type_var} & = & \<^verbatim>\<open>?\<close>\<open>type_ident  |\<close>~~\<^verbatim>\<open>?\<close>\<open>type_ident\<close>\<^verbatim>\<open>.\<close>\<open>nat\<close> \\
     @{syntax_def string} & = & \<^verbatim>\<open>"\<close> \<open>\<dots>\<close> \<^verbatim>\<open>"\<close> \\
     @{syntax_def altstring} & = & \<^verbatim>\<open>`\<close> \<open>\<dots>\<close> \<^verbatim>\<open>`\<close> \\
     @{syntax_def cartouche} & = & \<^verbatim>\<open>\<open>\<close> \<open>\<dots>\<close> \<^verbatim>\<open>\<close>\<close> \\
     @{syntax_def verbatim} & = & \<^verbatim>\<open>{*\<close> \<open>\<dots>\<close> \<^verbatim>\<open>*}\<close> \\[1ex]
 
     \<open>letter\<close> & = & \<open>latin  |\<close>~~\<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>latin\<close>\<^verbatim>\<open>>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>latin latin\<close>\<^verbatim>\<open>>\<close>~~\<open>|  greek  |\<close> \\
     \<open>subscript\<close> & = & \<^verbatim>\<open>\<^sub>\<close> \\
     \<open>quasiletter\<close> & = & \<open>letter  |  digit  |\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>'\<close> \\
     \<open>latin\<close> & = & \<^verbatim>\<open>a\<close>~~\<open>| \<dots> |\<close>~~\<^verbatim>\<open>z\<close>~~\<open>|\<close>~~\<^verbatim>\<open>A\<close>~~\<open>|  \<dots> |\<close>~~\<^verbatim>\<open>Z\<close> \\
     \<open>digit\<close> & = & \<^verbatim>\<open>0\<close>~~\<open>|  \<dots> |\<close>~~\<^verbatim>\<open>9\<close> \\
     \<open>sym\<close> & = & \<^verbatim>\<open>!\<close>~~\<open>|\<close>~~\<^verbatim>\<open>#\<close>~~\<open>|\<close>~~\<^verbatim>\<open>$\<close>~~\<open>|\<close>~~\<^verbatim>\<open>%\<close>~~\<open>|\<close>~~\<^verbatim>\<open>&\<close>~~\<open>|\<close>~~\<^verbatim>\<open>*\<close>~~\<open>|\<close>~~\<^verbatim>\<open>+\<close>~~\<open>|\<close>~~\<^verbatim>\<open>-\<close>~~\<open>|\<close>~~\<^verbatim>\<open>/\<close>~~\<open>|\<close> \\
     & & \<^verbatim>\<open><\<close>~~\<open>|\<close>~~\<^verbatim>\<open>=\<close>~~\<open>|\<close>~~\<^verbatim>\<open>>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>?\<close>~~\<open>|\<close>~~\<^verbatim>\<open>@\<close>~~\<open>|\<close>~~\<^verbatim>\<open>^\<close>~~\<open>|\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>|\<close>~~\<open>|\<close>~~\<^verbatim>\<open>~\<close> \\
     \<open>greek\<close> & = & \<^verbatim>\<open>\<alpha>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<beta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<gamma>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<delta>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<epsilon>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<zeta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<eta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<theta>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<iota>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<kappa>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<mu>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<nu>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<xi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<pi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<rho>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<sigma>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<tau>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<upsilon>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<phi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<chi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<psi>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<omega>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Gamma>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Delta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Theta>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<Lambda>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Xi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Pi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Sigma>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<Upsilon>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Phi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Psi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Omega>\<close> \\
   \end{supertabular}
   \end{center}
 
   A @{syntax_ref term_var} or @{syntax_ref type_var} describes an unknown,
   which is internally a pair of base name and index (ML type \<^ML_type>\<open>indexname\<close>). These components are either separated by a dot as in \<open>?x.1\<close> or
   \<open>?x7.3\<close> or run together as in \<open>?x1\<close>. The latter form is possible if the base
   name does not end with digits. If the index is 0, it may be dropped
   altogether: \<open>?x\<close> and \<open>?x0\<close> and \<open>?x.0\<close> all refer to the same unknown, with
   basename \<open>x\<close> and index 0.
 
   The syntax of @{syntax_ref string} admits any characters, including
   newlines; ``\<^verbatim>\<open>"\<close>'' (double-quote) and ``\<^verbatim>\<open>\\<close>'' (backslash) need to be
   escaped by a backslash; arbitrary character codes may be specified as
   ``\<^verbatim>\<open>\\<close>\<open>ddd\<close>'', with three decimal digits. Alternative strings according to
   @{syntax_ref altstring} are analogous, using single back-quotes instead.
 
   The body of @{syntax_ref verbatim} may consist of any text not containing
   ``\<^verbatim>\<open>*}\<close>''; this allows to include quotes without further escapes, but there
   is no way to escape ``\<^verbatim>\<open>*}\<close>''. Cartouches do not have this limitation.
 
   A @{syntax_ref cartouche} consists of arbitrary text, with properly balanced
   blocks of ``@{verbatim "\<open>"}~\<open>\<dots>\<close>~@{verbatim "\<close>"}''. Note that the rendering
   of cartouche delimiters is usually like this: ``\<open>\<open> \<dots> \<close>\<close>''.
 
   Source comments take the form \<^verbatim>\<open>(*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*)\<close> and may be nested: the text is
   removed after lexical analysis of the input and thus not suitable for
   documentation. The Isar syntax also provides proper \<^emph>\<open>document comments\<close>
   that are considered as part of the text (see \secref{sec:comments}).
 
   Common mathematical symbols such as \<open>\<forall>\<close> are represented in Isabelle as \<^verbatim>\<open>\<forall>\<close>.
   There are infinitely many Isabelle symbols like this, although proper
   presentation is left to front-end tools such as {\LaTeX} or Isabelle/jEdit.
   A list of predefined Isabelle symbols that work well with these tools is
   given in \appref{app:symbols}. Note that \<^verbatim>\<open>\<lambda>\<close> does not belong to the
   \<open>letter\<close> category, since it is already used differently in the Pure term
   language.
 \<close>
 
 
 section \<open>Common syntax entities\<close>
 
 text \<open>
   We now introduce several basic syntactic entities, such as names, terms, and
   theorem specifications, which are factored out of the actual Isar language
   elements to be described later.
 \<close>
 
 
 subsection \<open>Names\<close>
 
 text \<open>
   Entity @{syntax name} usually refers to any name of types, constants,
   theorems etc.\ Quoted strings provide an escape for non-identifier names or
   those ruled out by outer syntax keywords (e.g.\ quoted \<^verbatim>\<open>"let"\<close>).
 
   \<^rail>\<open>
     @{syntax_def name}: @{syntax short_ident} | @{syntax long_ident} |
       @{syntax sym_ident} | @{syntax nat} | @{syntax string}
     ;
     @{syntax_def par_name}: '(' @{syntax name} ')'
   \<close>
 
   A @{syntax_def system_name} is like @{syntax name}, but it excludes
   white-space characters and needs to conform to file-name notation. Name
   components that are special on Windows (e.g.\ \<^verbatim>\<open>CON\<close>, \<^verbatim>\<open>PRN\<close>, \<^verbatim>\<open>AUX\<close>) are
   excluded on all platforms.
 \<close>
 
 
 subsection \<open>Numbers\<close>
 
 text \<open>
   The outer lexical syntax (\secref{sec:outer-lex}) admits natural numbers and
   floating point numbers. These are combined as @{syntax int} and @{syntax
   real} as follows.
 
   \<^rail>\<open>
     @{syntax_def int}: @{syntax nat} | '-' @{syntax nat}
     ;
     @{syntax_def real}: @{syntax float} | @{syntax int}
   \<close>
 
   Note that there is an overlap with the category @{syntax name}, which also
   includes @{syntax nat}.
 \<close>
 
 
 subsection \<open>Embedded content\<close>
 
 text \<open>
   Entity @{syntax embedded} refers to content of other languages: cartouches
   allow arbitrary nesting of sub-languages that respect the recursive
   balancing of cartouche delimiters. Quoted strings are possible as well, but
   require escaped quotes when nested. As a shortcut, tokens that appear as
   plain identifiers in the outer language may be used as inner language
   content without delimiters.
 
   \<^rail>\<open>
     @{syntax_def embedded}: @{syntax cartouche} | @{syntax string} |
       @{syntax short_ident} | @{syntax long_ident} | @{syntax sym_ident} |
       @{syntax term_var} | @{syntax type_ident} | @{syntax type_var} | @{syntax nat}
   \<close>
 \<close>
 
 
 subsection \<open>Document text\<close>
 
 text \<open>
   A chunk of document @{syntax text} is usually given as @{syntax cartouche}
   \<open>\<open>\<dots>\<close>\<close> or @{syntax verbatim}, i.e.\ enclosed in \<^verbatim>\<open>{*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*}\<close>. For
   convenience, any of the smaller text unit that conforms to @{syntax name} is
   admitted as well.
 
   \<^rail>\<open>
     @{syntax_def text}: @{syntax embedded} | @{syntax verbatim}
   \<close>
 
   Typical uses are document markup commands, like \<^theory_text>\<open>chapter\<close>, \<^theory_text>\<open>section\<close> etc.
   (\secref{sec:markup}).
 \<close>
 
 
 subsection \<open>Document comments \label{sec:comments}\<close>
 
 text \<open>
   Formal comments are an integral part of the document, but are logically void
   and removed from the resulting theory or term content. The output of
   document preparation (\chref{ch:document-prep}) supports various styles,
   according to the following kinds of comments.
 
     \<^item> Marginal comment of the form \<^verbatim>\<open>\<comment>\<close>~\<open>\<open>text\<close>\<close> or \<open>\<comment>\<close>~\<open>\<open>text\<close>\<close>, usually with
     a single space between the comment symbol and the argument cartouche. The
     given argument is typeset as regular text, with formal antiquotations
     (\secref{sec:antiq}).
 
     \<^item> Canceled text of the form \<^verbatim>\<open>\<^cancel>\<close>\<open>\<open>text\<close>\<close> (no white space between the
     control symbol and the argument cartouche). The argument is typeset as
     formal Isabelle source and overlaid with a ``strike-through'' pattern,
     e.g. \<^theory_text>\<open>\<^cancel>\<open>bad\<close>\<close>.
 
     \<^item> Raw {\LaTeX} source of the form \<^verbatim>\<open>\<^latex>\<close>\<open>\<open>argument\<close>\<close> (no white space
     between the control symbol and the argument cartouche). This allows to
     augment the generated {\TeX} source arbitrarily, without any sanity
     checks!
 
   These formal comments work uniformly in outer syntax, inner syntax (term
   language), Isabelle/ML, and some other embedded languages of Isabelle.
 \<close>
 
 
 subsection \<open>Type classes, sorts and arities\<close>
 
 text \<open>
   Classes are specified by plain names. Sorts have a very simple inner syntax,
   which is either a single class name \<open>c\<close> or a list \<open>{c\<^sub>1, \<dots>, c\<^sub>n}\<close> referring
   to the intersection of these classes. The syntax of type arities is given
   directly at the outer level.
 
   \<^rail>\<open>
     @{syntax_def classdecl}: @{syntax name} (('<' | '\<subseteq>') (@{syntax name} + ','))?
     ;
     @{syntax_def sort}: @{syntax embedded}
     ;
     @{syntax_def arity}: ('(' (@{syntax sort} + ',') ')')? @{syntax sort}
   \<close>
 \<close>
 
 
 subsection \<open>Types and terms \label{sec:types-terms}\<close>
 
 text \<open>
   The actual inner Isabelle syntax, that of types and terms of the logic, is
   far too sophisticated in order to be modelled explicitly at the outer theory
   level. Basically, any such entity has to be quoted to turn it into a single
   token (the parsing and type-checking is performed internally later). For
   convenience, a slightly more liberal convention is adopted: quotes may be
   omitted for any type or term that is already atomic at the outer level. For
   example, one may just write \<^verbatim>\<open>x\<close> instead of quoted \<^verbatim>\<open>"x"\<close>. Note that
   symbolic identifiers (e.g.\ \<^verbatim>\<open>++\<close> or \<open>\<forall>\<close> are available as well, provided
   these have not been superseded by commands or other keywords already (such
   as \<^verbatim>\<open>=\<close> or \<^verbatim>\<open>+\<close>).
 
   \<^rail>\<open>
     @{syntax_def type}: @{syntax embedded}
     ;
     @{syntax_def term}: @{syntax embedded}
     ;
     @{syntax_def prop}: @{syntax embedded}
   \<close>
 
   Positional instantiations are specified as a sequence of terms, or the
   placeholder ``\<open>_\<close>'' (underscore), which means to skip a position.
 
   \<^rail>\<open>
     @{syntax_def inst}: '_' | @{syntax term}
     ;
     @{syntax_def insts}: (@{syntax inst} *)
   \<close>
 
   Named instantiations are specified as pairs of assignments \<open>v = t\<close>, which
   refer to schematic variables in some theorem that is instantiated. Both type
   and terms instantiations are admitted, and distinguished by the usual syntax
   of variable names.
 
   \<^rail>\<open>
     @{syntax_def named_inst}: variable '=' (type | term)
     ;
     @{syntax_def named_insts}: (named_inst @'and' +)
     ;
     variable: @{syntax name} | @{syntax term_var} | @{syntax type_ident} | @{syntax type_var}
   \<close>
 
   Type declarations and definitions usually refer to @{syntax typespec} on the
   left-hand side. This models basic type constructor application at the outer
   syntax level. Note that only plain postfix notation is available here, but
   no infixes.
 
   \<^rail>\<open>
-    @{syntax_def typespec}:
-      (() | @{syntax type_ident} | '(' ( @{syntax type_ident} + ',' ) ')') @{syntax name}
+    @{syntax_def typeargs}:
+      (() | @{syntax type_ident} | '(' ( @{syntax type_ident} + ',' ) ')')
     ;
-    @{syntax_def typespec_sorts}:
+    @{syntax_def typeargs_sorts}:
       (() | (@{syntax type_ident} ('::' @{syntax sort})?) |
-        '(' ( (@{syntax type_ident} ('::' @{syntax sort})?) + ',' ) ')') @{syntax name}
+        '(' ( (@{syntax type_ident} ('::' @{syntax sort})?) + ',' ) ')')
+    ;
+    @{syntax_def typespec}: @{syntax typeargs} @{syntax name}
+    ;
+    @{syntax_def typespec_sorts}: @{syntax typeargs_sorts} @{syntax name}
   \<close>
 \<close>
 
 
 subsection \<open>Term patterns and declarations \label{sec:term-decls}\<close>
 
 text \<open>
   Wherever explicit propositions (or term fragments) occur in a proof text,
   casual binding of schematic term variables may be given specified via
   patterns of the form ``\<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close>''. This works both for @{syntax
   term} and @{syntax prop}.
 
   \<^rail>\<open>
     @{syntax_def term_pat}: '(' (@'is' @{syntax term} +) ')'
     ;
     @{syntax_def prop_pat}: '(' (@'is' @{syntax prop} +) ')'
   \<close>
 
   \<^medskip>
   Declarations of local variables \<open>x :: \<tau>\<close> and logical propositions \<open>a : \<phi>\<close>
   represent different views on the same principle of introducing a local
   scope. In practice, one may usually omit the typing of @{syntax vars} (due
   to type-inference), and the naming of propositions (due to implicit
   references of current facts). In any case, Isar proof elements usually admit
   to introduce multiple such items simultaneously.
 
   \<^rail>\<open>
     @{syntax_def vars}:
       (((@{syntax name} +) ('::' @{syntax type})? |
         @{syntax name} ('::' @{syntax type})? @{syntax mixfix}) + @'and')
     ;
     @{syntax_def props}: @{syntax thmdecl}? (@{syntax prop} @{syntax prop_pat}? +)
     ;
     @{syntax_def props'}: (@{syntax prop} @{syntax prop_pat}? +)
   \<close>
 
   The treatment of multiple declarations corresponds to the complementary
   focus of @{syntax vars} versus @{syntax props}. In ``\<open>x\<^sub>1 \<dots> x\<^sub>n :: \<tau>\<close>'' the
   typing refers to all variables, while in \<open>a: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> the naming refers to
   all propositions collectively. Isar language elements that refer to @{syntax
   vars} or @{syntax props} typically admit separate typings or namings via
   another level of iteration, with explicit @{keyword_ref "and"} separators;
   e.g.\ see @{command "fix"} and @{command "assume"} in
   \secref{sec:proof-context}.
 \<close>
 
 
 subsection \<open>Attributes and theorems \label{sec:syn-att}\<close>
 
 text \<open>
   Attributes have their own ``semi-inner'' syntax, in the sense that input
   conforming to @{syntax args} below is parsed by the attribute a second time.
   The attribute argument specifications may be any sequence of atomic entities
   (identifiers, strings etc.), or properly bracketed argument lists. Below
   @{syntax atom} refers to any atomic entity, including any @{syntax keyword}
   conforming to @{syntax sym_ident}.
 
   \<^rail>\<open>
     @{syntax_def atom}: @{syntax name} | @{syntax type_ident} |
       @{syntax type_var} | @{syntax term_var} | @{syntax nat} | @{syntax float} |
       @{syntax keyword} | @{syntax cartouche}
     ;
     arg: @{syntax atom} | '(' @{syntax args} ')' | '[' @{syntax args} ']'
     ;
     @{syntax_def args}: arg *
     ;
     @{syntax_def attributes}: '[' (@{syntax name} @{syntax args} * ',') ']'
   \<close>
 
   Theorem specifications come in several flavors: @{syntax axmdecl} and
   @{syntax thmdecl} usually refer to axioms, assumptions or results of goal
   statements, while @{syntax thmdef} collects lists of existing theorems.
   Existing theorems are given by @{syntax thm} and @{syntax thms}, the
   former requires an actual singleton result.
 
   There are three forms of theorem references:
 
     \<^enum> named facts \<open>a\<close>,
 
     \<^enum> selections from named facts \<open>a(i)\<close> or \<open>a(j - k)\<close>,
 
     \<^enum> literal fact propositions using token syntax @{syntax_ref altstring}
     \<^verbatim>\<open>`\<close>\<open>\<phi>\<close>\<^verbatim>\<open>`\<close> or @{syntax_ref cartouche}
     \<open>\<open>\<phi>\<close>\<close> (see also method @{method_ref fact}).
 
   Any kind of theorem specification may include lists of attributes both on
   the left and right hand sides; attributes are applied to any immediately
   preceding fact. If names are omitted, the theorems are not stored within the
   theorem database of the theory or proof context, but any given attributes
   are applied nonetheless.
 
   An extra pair of brackets around attributes (like ``\<open>[[simproc a]]\<close>'')
   abbreviates a theorem reference involving an internal dummy fact, which will
   be ignored later on. So only the effect of the attribute on the background
   context will persist. This form of in-place declarations is particularly
   useful with commands like @{command "declare"} and @{command "using"}.
 
   \<^rail>\<open>
     @{syntax_def axmdecl}: @{syntax name} @{syntax attributes}? ':'
     ;
     @{syntax_def thmbind}:
       @{syntax name} @{syntax attributes} | @{syntax name} | @{syntax attributes}
     ;
     @{syntax_def thmdecl}: thmbind ':'
     ;
     @{syntax_def thmdef}: thmbind '='
     ;
     @{syntax_def thm}:
       (@{syntax name} selection? | @{syntax altstring} | @{syntax cartouche})
         @{syntax attributes}? |
       '[' @{syntax attributes} ']'
     ;
     @{syntax_def thms}: @{syntax thm} +
     ;
     selection: '(' ((@{syntax nat} | @{syntax nat} '-' @{syntax nat}?) + ',') ')'
   \<close>
 \<close>
 
 
 subsection \<open>Structured specifications\<close>
 
 text \<open>
   Structured specifications use propositions with explicit notation for the
   ``eigen-context'' to describe rule structure: \<open>\<And>x. A x \<Longrightarrow> \<dots> \<Longrightarrow> B x\<close> is
   expressed as \<^theory_text>\<open>B x if A x and \<dots> for x\<close>. It is also possible to use dummy
   terms ``\<open>_\<close>'' (underscore) to refer to locally fixed variables anonymously.
 
   Multiple specifications are delimited by ``\<open>|\<close>'' to emphasize separate
   cases: each with its own scope of inferred types for free variables.
 
 
   \<^rail>\<open>
     @{syntax_def for_fixes}: (@'for' @{syntax vars})?
     ;
     @{syntax_def multi_specs}: (@{syntax structured_spec} + '|')
     ;
     @{syntax_def structured_spec}:
       @{syntax thmdecl}? @{syntax prop} @{syntax spec_prems} @{syntax for_fixes}
     ;
     @{syntax_def spec_prems}: (@'if' ((@{syntax prop}+) + @'and'))?
     ;
     @{syntax_def specification}: @{syntax vars} @'where' @{syntax multi_specs}
   \<close>
 \<close>
 
 
 section \<open>Diagnostic commands\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_theory"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_definitions"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_methods"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_attributes"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_theorems"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "find_theorems"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "find_consts"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "thm_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "unused_thms"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_facts"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_term_bindings"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{command print_theory} |
       @@{command print_definitions} |
       @@{command print_methods} |
       @@{command print_attributes} |
       @@{command print_theorems} |
       @@{command print_facts}) ('!'?)
     ;
     @@{command find_theorems} ('(' @{syntax nat}? 'with_dups'? ')')? \<newline> (thm_criterion*)
     ;
     thm_criterion: ('-'?) ('name' ':' @{syntax name} | 'intro' | 'elim' | 'dest' |
       'solves' | 'simp' ':' @{syntax term} | @{syntax term})
     ;
     @@{command find_consts} (const_criterion*)
     ;
     const_criterion: ('-'?)
       ('name' ':' @{syntax name} | 'strict' ':' @{syntax type} | @{syntax type})
     ;
     @@{command thm_deps} @{syntax thmrefs}
     ;
     @@{command unused_thms} ((@{syntax name} +) '-' (@{syntax name} * ))?
   \<close>
 
   These commands print certain parts of the theory and proof context. Note
   that there are some further ones available, such as for the set of rules
   declared for simplifications.
 
   \<^descr> @{command "print_theory"} prints the main logical content of the
   background theory; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_definitions"} prints dependencies of definitional
   specifications within the background theory, which may be constants
   (\secref{sec:term-definitions}, \secref{sec:overloading}) or types
   (\secref{sec:types-pure}, \secref{sec:hol-typedef}); the ``\<open>!\<close>'' option
   indicates extra verbosity.
 
   \<^descr> @{command "print_methods"} prints all proof methods available in the
   current theory context; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_attributes"} prints all attributes available in the
   current theory context; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_theorems"} prints theorems of the background theory
   resulting from the last command; the ``\<open>!\<close>'' option indicates extra
   verbosity.
 
   \<^descr> @{command "print_facts"} prints all local facts of the current context,
   both named and unnamed ones; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_term_bindings"} prints all term bindings that are present
   in the context.
 
   \<^descr> @{command "find_theorems"}~\<open>criteria\<close> retrieves facts from the theory or
   proof context matching all of given search criteria. The criterion \<open>name: p\<close>
   selects all theorems whose fully qualified name matches pattern \<open>p\<close>, which
   may contain ``\<open>*\<close>'' wildcards. The criteria \<open>intro\<close>, \<open>elim\<close>, and \<open>dest\<close>
   select theorems that match the current goal as introduction, elimination or
   destruction rules, respectively. The criterion \<open>solves\<close> returns all rules
   that would directly solve the current goal. The criterion \<open>simp: t\<close> selects
   all rewrite rules whose left-hand side matches the given term. The criterion
   term \<open>t\<close> selects all theorems that contain the pattern \<open>t\<close> -- as usual,
   patterns may contain occurrences of the dummy ``\<open>_\<close>'', schematic variables,
   and type constraints.
 
   Criteria can be preceded by ``\<open>-\<close>'' to select theorems that do \<^emph>\<open>not\<close> match.
   Note that giving the empty list of criteria yields \<^emph>\<open>all\<close> currently known
   facts. An optional limit for the number of printed facts may be given; the
   default is 40. By default, duplicates are removed from the search result.
   Use \<open>with_dups\<close> to display duplicates.
 
   \<^descr> @{command "find_consts"}~\<open>criteria\<close> prints all constants whose type meets
   all of the given criteria. The criterion \<open>strict: ty\<close> is met by any type
   that matches the type pattern \<open>ty\<close>. Patterns may contain both the dummy type
   ``\<open>_\<close>'' and sort constraints. The criterion \<open>ty\<close> is similar, but it also
   matches against subtypes. The criterion \<open>name: p\<close> and the prefix ``\<open>-\<close>''
   function as described for @{command "find_theorems"}.
 
   \<^descr> @{command "thm_deps"}~\<open>thms\<close> prints immediate theorem dependencies, i.e.\
   the union of all theorems that are used directly to prove the argument
   facts, without going deeper into the dependency graph.
 
   \<^descr> @{command "unused_thms"}~\<open>A\<^sub>1 \<dots> A\<^sub>m - B\<^sub>1 \<dots> B\<^sub>n\<close> displays all theorems
   that are proved in theories \<open>B\<^sub>1 \<dots> B\<^sub>n\<close> or their parents but not in \<open>A\<^sub>1 \<dots>
   A\<^sub>m\<close> or their parents and that are never used. If \<open>n\<close> is \<open>0\<close>, the end of the
   range of theories defaults to the current theory. If no range is specified,
   only the unused theorems in the current theory are displayed.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Proof.thy b/src/Doc/Isar_Ref/Proof.thy
--- a/src/Doc/Isar_Ref/Proof.thy
+++ b/src/Doc/Isar_Ref/Proof.thy
@@ -1,1440 +1,1440 @@
 (*:maxLineLen=78:*)
 
 theory Proof
   imports Main Base
 begin
 
 chapter \<open>Proofs \label{ch:proofs}\<close>
 
 text \<open>
   Proof commands perform transitions of Isar/VM machine configurations, which
   are block-structured, consisting of a stack of nodes with three main
   components: logical proof context, current facts, and open goals. Isar/VM
   transitions are typed according to the following three different modes of
   operation:
 
     \<^descr> \<open>proof(prove)\<close> means that a new goal has just been stated that is now to
     be \<^emph>\<open>proven\<close>; the next command may refine it by some proof method, and
     enter a sub-proof to establish the actual result.
 
     \<^descr> \<open>proof(state)\<close> is like a nested theory mode: the context may be
     augmented by \<^emph>\<open>stating\<close> additional assumptions, intermediate results etc.
 
     \<^descr> \<open>proof(chain)\<close> is intermediate between \<open>proof(state)\<close> and
     \<open>proof(prove)\<close>: existing facts (i.e.\ the contents of the special
     @{fact_ref this} register) have been just picked up in order to be used
     when refining the goal claimed next.
 
   The proof mode indicator may be understood as an instruction to the writer,
   telling what kind of operation may be performed next. The corresponding
   typings of proof commands restricts the shape of well-formed proof texts to
   particular command sequences. So dynamic arrangements of commands eventually
   turn out as static texts of a certain structure.
 
   \Appref{ap:refcard} gives a simplified grammar of the (extensible) language
   emerging that way from the different types of proof commands. The main ideas
   of the overall Isar framework are explained in \chref{ch:isar-framework}.
 \<close>
 
 
 section \<open>Proof structure\<close>
 
 subsection \<open>Formal notepad\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "notepad"} & : & \<open>local_theory \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command notepad} @'begin'
     ;
     @@{command end}
   \<close>
 
   \<^descr> @{command "notepad"}~@{keyword "begin"} opens a proof state without any
   goal statement. This allows to experiment with Isar, without producing any
   persistent result. The notepad is closed by @{command "end"}.
 \<close>
 
 
 subsection \<open>Blocks\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "next"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "{"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "}"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   While Isar is inherently block-structured, opening and closing blocks is
   mostly handled rather casually, with little explicit user-intervention. Any
   local goal statement automatically opens \<^emph>\<open>two\<close> internal blocks, which are
   closed again when concluding the sub-proof (by @{command "qed"} etc.).
   Sections of different context within a sub-proof may be switched via
   @{command "next"}, which is just a single block-close followed by block-open
   again. The effect of @{command "next"} is to reset the local proof context;
   there is no goal focus involved here!
 
   For slightly more advanced applications, there are explicit block
   parentheses as well. These typically achieve a stronger forward style of
   reasoning.
 
   \<^descr> @{command "next"} switches to a fresh block within a sub-proof, resetting
   the local context to the initial one.
 
   \<^descr> @{command "{"} and @{command "}"} explicitly open and close blocks. Any
   current facts pass through ``@{command "{"}'' unchanged, while ``@{command
   "}"}'' causes any result to be \<^emph>\<open>exported\<close> into the enclosing context. Thus
   fixed variables are generalized, assumptions discharged, and local
   definitions unfolded (cf.\ \secref{sec:proof-context}). There is no
   difference of @{command "assume"} and @{command "presume"} in this mode of
   forward reasoning --- in contrast to plain backward reasoning with the
   result exported at @{command "show"} time.
 \<close>
 
 
 subsection \<open>Omitting proofs\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "oops"} & : & \<open>proof \<rightarrow> local_theory | theory\<close> \\
   \end{matharray}
 
   The @{command "oops"} command discontinues the current proof attempt, while
   considering the partial proof text as properly processed. This is
   conceptually quite different from ``faking'' actual proofs via @{command_ref
   "sorry"} (see \secref{sec:proof-steps}): @{command "oops"} does not observe
   the proof structure at all, but goes back right to the theory level.
   Furthermore, @{command "oops"} does not produce any result theorem --- there
   is no intended claim to be able to complete the proof in any way.
 
   A typical application of @{command "oops"} is to explain Isar proofs
   \<^emph>\<open>within\<close> the system itself, in conjunction with the document preparation
   tools of Isabelle described in \chref{ch:document-prep}. Thus partial or
   even wrong proof attempts can be discussed in a logically sound manner. Note
   that the Isabelle {\LaTeX} macros can be easily adapted to print something
   like ``\<open>\<dots>\<close>'' instead of the keyword ``@{command "oops"}''.
 \<close>
 
 
 section \<open>Statements\<close>
 
 subsection \<open>Context elements \label{sec:proof-context}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "fix"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "assume"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "presume"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "define"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   The logical proof context consists of fixed variables and assumptions. The
   former closely correspond to Skolem constants, or meta-level universal
   quantification as provided by the Isabelle/Pure logical framework.
   Introducing some \<^emph>\<open>arbitrary, but fixed\<close> variable via ``@{command
   "fix"}~\<open>x\<close>'' results in a local value that may be used in the subsequent
   proof as any other variable or constant. Furthermore, any result \<open>\<turnstile> \<phi>[x]\<close>
   exported from the context will be universally closed wrt.\ \<open>x\<close> at the
   outermost level: \<open>\<turnstile> \<And>x. \<phi>[x]\<close> (this is expressed in normal form using
   Isabelle's meta-variables).
 
   Similarly, introducing some assumption \<open>\<chi>\<close> has two effects. On the one hand,
   a local theorem is created that may be used as a fact in subsequent proof
   steps. On the other hand, any result \<open>\<chi> \<turnstile> \<phi>\<close> exported from the context
   becomes conditional wrt.\ the assumption: \<open>\<turnstile> \<chi> \<Longrightarrow> \<phi>\<close>. Thus, solving an
   enclosing goal using such a result would basically introduce a new subgoal
   stemming from the assumption. How this situation is handled depends on the
   version of assumption command used: while @{command "assume"} insists on
   solving the subgoal by unification with some premise of the goal, @{command
   "presume"} leaves the subgoal unchanged in order to be proved later by the
   user.
 
   Local definitions, introduced by ``\<^theory_text>\<open>define x where x = t\<close>'', are achieved
   by combining ``@{command "fix"}~\<open>x\<close>'' with another version of assumption
   that causes any hypothetical equation \<open>x \<equiv> t\<close> to be eliminated by the
   reflexivity rule. Thus, exporting some result \<open>x \<equiv> t \<turnstile> \<phi>[x]\<close> yields \<open>\<turnstile>
   \<phi>[t]\<close>.
 
   \<^rail>\<open>
     @@{command fix} @{syntax vars}
     ;
     (@@{command assume} | @@{command presume}) concl prems @{syntax for_fixes}
     ;
     concl: (@{syntax props} + @'and')
     ;
     prems: (@'if' (@{syntax props'} + @'and'))?
     ;
     @@{command define} @{syntax vars} @'where'
       (@{syntax props} + @'and') @{syntax for_fixes}
   \<close>
 
   \<^descr> @{command "fix"}~\<open>x\<close> introduces a local variable \<open>x\<close> that is \<^emph>\<open>arbitrary,
   but fixed\<close>.
 
   \<^descr> @{command "assume"}~\<open>a: \<phi>\<close> and @{command "presume"}~\<open>a: \<phi>\<close> introduce a
   local fact \<open>\<phi> \<turnstile> \<phi>\<close> by assumption. Subsequent results applied to an enclosing
   goal (e.g.\ by @{command_ref "show"}) are handled as follows: @{command
   "assume"} expects to be able to unify with existing premises in the goal,
   while @{command "presume"} leaves \<open>\<phi>\<close> as new subgoals.
 
   Several lists of assumptions may be given (separated by @{keyword_ref
   "and"}; the resulting list of current facts consists of all of these
   concatenated.
 
   A structured assumption like \<^theory_text>\<open>assume "B x" if "A x" for x\<close> is equivalent to
   \<^theory_text>\<open>assume "\<And>x. A x \<Longrightarrow> B x"\<close>, but vacuous quantification is avoided: a
   for-context only effects propositions according to actual use of variables.
 
   \<^descr> \<^theory_text>\<open>define x where "x = t"\<close> introduces a local (non-polymorphic) definition.
   In results that are exported from the context, \<open>x\<close> is replaced by \<open>t\<close>.
 
   Internally, equational assumptions are added to the context in Pure form,
   using \<open>x \<equiv> t\<close> instead of \<open>x = t\<close> or \<open>x \<longleftrightarrow> t\<close> from the object-logic. When
   exporting results from the context, \<open>x\<close> is generalized and the assumption
   discharged by reflexivity, causing the replacement by \<open>t\<close>.
 
   The default name for the definitional fact is \<open>x_def\<close>. Several simultaneous
   definitions may be given as well, with a collective default name.
 
   \<^medskip>
   It is also possible to abstract over local parameters as follows: \<^theory_text>\<open>define f
   :: "'a \<Rightarrow> 'b" where "f x = t" for x :: 'a\<close>.
 \<close>
 
 
 subsection \<open>Term abbreviations \label{sec:term-abbrev}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "let"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{keyword_def "is"} & : & syntax \\
   \end{matharray}
 
   Abbreviations may be either bound by explicit @{command "let"}~\<open>p \<equiv> t\<close>
   statements, or by annotating assumptions or goal statements with a list of
   patterns ``\<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close>''. In both cases, higher-order matching is
   invoked to bind extra-logical term variables, which may be either named
   schematic variables of the form \<open>?x\<close>, or nameless dummies ``@{variable _}''
   (underscore). Note that in the @{command "let"} form the patterns occur on
   the left-hand side, while the @{keyword "is"} patterns are in postfix
   position.
 
   Polymorphism of term bindings is handled in Hindley-Milner style, similar to
   ML. Type variables referring to local assumptions or open goal statements
   are \<^emph>\<open>fixed\<close>, while those of finished results or bound by @{command "let"}
   may occur in \<^emph>\<open>arbitrary\<close> instances later. Even though actual polymorphism
   should be rarely used in practice, this mechanism is essential to achieve
   proper incremental type-inference, as the user proceeds to build up the Isar
   proof text from left to right.
 
   \<^medskip>
   Term abbreviations are quite different from local definitions as introduced
   via @{command "define"} (see \secref{sec:proof-context}). The latter are
   visible within the logic as actual equations, while abbreviations disappear
   during the input process just after type checking. Also note that @{command
   "define"} does not support polymorphism.
 
   \<^rail>\<open>
     @@{command let} ((@{syntax term} + @'and') '=' @{syntax term} + @'and')
   \<close>
 
   The syntax of @{keyword "is"} patterns follows @{syntax term_pat} or
   @{syntax prop_pat} (see \secref{sec:term-decls}).
 
     \<^descr> \<^theory_text>\<open>let p\<^sub>1 = t\<^sub>1 and \<dots> p\<^sub>n = t\<^sub>n\<close> binds any text variables in patterns
     \<open>p\<^sub>1, \<dots>, p\<^sub>n\<close> by simultaneous higher-order matching against terms \<open>t\<^sub>1, \<dots>,
     t\<^sub>n\<close>.
 
     \<^descr> \<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close> resembles @{command "let"}, but matches \<open>p\<^sub>1, \<dots>, p\<^sub>n\<close>
     against the preceding statement. Also note that @{keyword "is"} is not a
     separate command, but part of others (such as @{command "assume"},
     @{command "have"} etc.).
 
   Some \<^emph>\<open>implicit\<close> term abbreviations\index{term abbreviations} for goals and
   facts are available as well. For any open goal, @{variable_ref thesis}
   refers to its object-level statement, abstracted over any meta-level
   parameters (if present). Likewise, @{variable_ref this} is bound for fact
   statements resulting from assumptions or finished goals. In case @{variable
   this} refers to an object-logic statement that is an application \<open>f t\<close>, then
   \<open>t\<close> is bound to the special text variable ``@{variable "\<dots>"}'' (three dots).
   The canonical application of this convenience are calculational proofs (see
   \secref{sec:calculation}).
 \<close>
 
 
 subsection \<open>Facts and forward chaining \label{sec:proof-facts}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "note"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "then"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "from"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "with"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "using"} & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{command_def "unfolding"} & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{method_def "use"} & : & \<open>method\<close> \\
     @{fact_def "method_facts"} & : & \<open>fact\<close> \\
   \end{matharray}
 
   New facts are established either by assumption or proof of local statements.
   Any fact will usually be involved in further proofs, either as explicit
   arguments of proof methods, or when forward chaining towards the next goal
   via @{command "then"} (and variants); @{command "from"} and @{command
   "with"} are composite forms involving @{command "note"}. The @{command
   "using"} elements augments the collection of used facts \<^emph>\<open>after\<close> a goal has
   been stated. Note that the special theorem name @{fact_ref this} refers to
   the most recently established facts, but only \<^emph>\<open>before\<close> issuing a follow-up
   claim.
 
   \<^rail>\<open>
     @@{command note} (@{syntax thmdef}? @{syntax thms} + @'and')
     ;
     (@@{command from} | @@{command with} | @@{command using} | @@{command unfolding})
       (@{syntax thms} + @'and')
     ;
     @{method use} @{syntax thms} @'in' @{syntax method}
   \<close>
 
   \<^descr> @{command "note"}~\<open>a = b\<^sub>1 \<dots> b\<^sub>n\<close> recalls existing facts \<open>b\<^sub>1, \<dots>, b\<^sub>n\<close>,
   binding the result as \<open>a\<close>. Note that attributes may be involved as well,
   both on the left and right hand sides.
 
   \<^descr> @{command "then"} indicates forward chaining by the current facts in order
   to establish the goal to be claimed next. The initial proof method invoked
   to refine that will be offered the facts to do ``anything appropriate'' (see
   also \secref{sec:proof-steps}). For example, method @{method (Pure) rule}
   (see \secref{sec:pure-meth-att}) would typically do an elimination rather
   than an introduction. Automatic methods usually insert the facts into the
   goal state before operation. This provides a simple scheme to control
   relevance of facts in automated proof search.
 
   \<^descr> @{command "from"}~\<open>b\<close> abbreviates ``@{command "note"}~\<open>b\<close>~@{command
   "then"}''; thus @{command "then"} is equivalent to ``@{command
   "from"}~\<open>this\<close>''.
 
   \<^descr> @{command "with"}~\<open>b\<^sub>1 \<dots> b\<^sub>n\<close> abbreviates ``@{command "from"}~\<open>b\<^sub>1 \<dots> b\<^sub>n
   \<AND> this\<close>''; thus the forward chaining is from earlier facts together
   with the current ones.
 
   \<^descr> @{command "using"}~\<open>b\<^sub>1 \<dots> b\<^sub>n\<close> augments the facts to be used by a
   subsequent refinement step (such as @{command_ref "apply"} or @{command_ref
   "proof"}).
 
   \<^descr> @{command "unfolding"}~\<open>b\<^sub>1 \<dots> b\<^sub>n\<close> is structurally similar to @{command
   "using"}, but unfolds definitional equations \<open>b\<^sub>1 \<dots> b\<^sub>n\<close> throughout the goal
   state and facts. See also the proof method @{method_ref unfold}.
 
   \<^descr> \<^theory_text>\<open>(use b\<^sub>1 \<dots> b\<^sub>n in method)\<close> uses the facts in the given method
   expression. The facts provided by the proof state (via @{command "using"}
   etc.) are ignored, but it is possible to refer to @{fact method_facts}
   explicitly.
 
   \<^descr> @{fact method_facts} is a dynamic fact that refers to the currently used
   facts of the goal state.
 
 
   Forward chaining with an empty list of theorems is the same as not chaining
   at all. Thus ``@{command "from"}~\<open>nothing\<close>'' has no effect apart from
   entering \<open>prove(chain)\<close> mode, since @{fact_ref nothing} is bound to the
   empty list of theorems.
 
   Basic proof methods (such as @{method_ref (Pure) rule}) expect multiple
   facts to be given in their proper order, corresponding to a prefix of the
   premises of the rule involved. Note that positions may be easily skipped
   using something like @{command "from"}~\<open>_ \<AND> a \<AND> b\<close>, for example.
   This involves the trivial rule \<open>PROP \<psi> \<Longrightarrow> PROP \<psi>\<close>, which is bound in
   Isabelle/Pure as ``@{fact_ref "_"}'' (underscore).
 
   Automated methods (such as @{method simp} or @{method auto}) just insert any
   given facts before their usual operation. Depending on the kind of procedure
   involved, the order of facts is less significant here.
 \<close>
 
 
 subsection \<open>Goals \label{sec:goals}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "lemma"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "theorem"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "corollary"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "proposition"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "schematic_goal"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "have"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "show"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "hence"} & : & \<open>proof(state) \<rightarrow> proof(prove)\<close> \\
     @{command_def "thus"} & : & \<open>proof(state) \<rightarrow> proof(prove)\<close> \\
     @{command_def "print_statement"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   From a theory context, proof mode is entered by an initial goal command such
   as @{command "lemma"}. Within a proof context, new claims may be introduced
   locally; there are variants to interact with the overall proof structure
   specifically, such as @{command have} or @{command show}.
 
   Goals may consist of multiple statements, resulting in a list of facts
   eventually. A pending multi-goal is internally represented as a meta-level
   conjunction (\<open>&&&\<close>), which is usually split into the corresponding number of
   sub-goals prior to an initial method application, via @{command_ref "proof"}
   (\secref{sec:proof-steps}) or @{command_ref "apply"}
   (\secref{sec:tactic-commands}). The @{method_ref induct} method covered in
   \secref{sec:cases-induct} acts on multiple claims simultaneously.
 
   Claims at the theory level may be either in short or long form. A short goal
   merely consists of several simultaneous propositions (often just one). A
   long goal includes an explicit context specification for the subsequent
   conclusion, involving local parameters and assumptions. Here the role of
   each part of the statement is explicitly marked by separate keywords (see
   also \secref{sec:locale}); the local assumptions being introduced here are
   available as @{fact_ref assms} in the proof. Moreover, there are two kinds
   of conclusions: @{element_def "shows"} states several simultaneous
   propositions (essentially a big conjunction), while @{element_def "obtains"}
   claims several simultaneous simultaneous contexts of (essentially a big
   disjunction of eliminated parameters and assumptions, cf.\
   \secref{sec:obtain}).
 
   \<^rail>\<open>
     (@@{command lemma} | @@{command theorem} | @@{command corollary} |
      @@{command proposition} | @@{command schematic_goal})
       (long_statement | short_statement)
     ;
     (@@{command have} | @@{command show} | @@{command hence} | @@{command thus})
       stmt cond_stmt @{syntax for_fixes}
     ;
     @@{command print_statement} @{syntax modes}? @{syntax thms}
     ;
 
     stmt: (@{syntax props} + @'and')
     ;
     cond_stmt: ((@'if' | @'when') stmt)?
     ;
     short_statement: stmt (@'if' stmt)? @{syntax for_fixes}
     ;
     long_statement: @{syntax thmdecl}? context conclusion
     ;
     context: (@{syntax_ref "includes"}?) (@{syntax context_elem} *)
     ;
     conclusion: @'shows' stmt | @'obtains' @{syntax obtain_clauses}
     ;
     @{syntax_def obtain_clauses}: (@{syntax par_name}? obtain_case + '|')
     ;
     @{syntax_def obtain_case}: @{syntax vars} @'where'
       (@{syntax thmdecl}? (@{syntax prop}+) + @'and')
   \<close>
 
   \<^descr> @{command "lemma"}~\<open>a: \<phi>\<close> enters proof mode with \<open>\<phi>\<close> as main goal,
   eventually resulting in some fact \<open>\<turnstile> \<phi>\<close> to be put back into the target
   context.
 
   A @{syntax long_statement} may build up an initial proof context for the
   subsequent claim, potentially including local definitions and syntax; see
   also @{syntax "includes"} in \secref{sec:bundle} and @{syntax context_elem}
   in \secref{sec:locale}.
 
   A @{syntax short_statement} consists of propositions as conclusion, with an
   option context of premises and parameters, via \<^verbatim>\<open>if\<close>/\<^verbatim>\<open>for\<close> in postfix
   notation, corresponding to \<^verbatim>\<open>assumes\<close>/\<^verbatim>\<open>fixes\<close> in the long prefix notation.
 
   Local premises (if present) are called ``\<open>assms\<close>'' for @{syntax
   long_statement}, and ``\<open>that\<close>'' for @{syntax short_statement}.
 
   \<^descr> @{command "theorem"}, @{command "corollary"}, and @{command "proposition"}
   are the same as @{command "lemma"}. The different command names merely serve
   as a formal comment in the theory source.
 
   \<^descr> @{command "schematic_goal"} is similar to @{command "theorem"}, but allows
   the statement to contain unbound schematic variables.
 
   Under normal circumstances, an Isar proof text needs to specify claims
   explicitly. Schematic goals are more like goals in Prolog, where certain
   results are synthesized in the course of reasoning. With schematic
   statements, the inherent compositionality of Isar proofs is lost, which also
   impacts performance, because proof checking is forced into sequential mode.
 
   \<^descr> @{command "have"}~\<open>a: \<phi>\<close> claims a local goal, eventually resulting in a
   fact within the current logical context. This operation is completely
   independent of any pending sub-goals of an enclosing goal statements, so
   @{command "have"} may be freely used for experimental exploration of
   potential results within a proof body.
 
   \<^descr> @{command "show"}~\<open>a: \<phi>\<close> is like @{command "have"}~\<open>a: \<phi>\<close> plus a second
   stage to refine some pending sub-goal for each one of the finished result,
   after having been exported into the corresponding context (at the head of
   the sub-proof of this @{command "show"} command).
 
   To accommodate interactive debugging, resulting rules are printed before
   being applied internally. Even more, interactive execution of @{command
   "show"} predicts potential failure and displays the resulting error as a
   warning beforehand. Watch out for the following message:
   @{verbatim [display] \<open>Local statement fails to refine any pending goal\<close>}
 
   \<^descr> @{command "hence"} expands to ``@{command "then"}~@{command "have"}'' and
   @{command "thus"} expands to ``@{command "then"}~@{command "show"}''. These
   conflations are left-over from early history of Isar. The expanded syntax is
   more orthogonal and improves readability and maintainability of proofs.
 
   \<^descr> @{command "print_statement"}~\<open>a\<close> prints facts from the current theory or
   proof context in long statement form, according to the syntax for @{command
   "lemma"} given above.
 
 
   Any goal statement causes some term abbreviations (such as @{variable_ref
   "?thesis"}) to be bound automatically, see also \secref{sec:term-abbrev}.
 
   Structured goal statements involving @{keyword_ref "if"} or @{keyword_ref
   "when"} define the special fact @{fact_ref that} to refer to these
   assumptions in the proof body. The user may provide separate names according
   to the syntax of the statement.
 \<close>
 
 
 section \<open>Calculational reasoning \label{sec:calculation}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "also"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "finally"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "moreover"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "ultimately"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "print_trans_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute trans} & : & \<open>attribute\<close> \\
     @{attribute sym} & : & \<open>attribute\<close> \\
     @{attribute symmetric} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   Calculational proof is forward reasoning with implicit application of
   transitivity rules (such those of \<open>=\<close>, \<open>\<le>\<close>, \<open><\<close>). Isabelle/Isar maintains an
   auxiliary fact register @{fact_ref calculation} for accumulating results
   obtained by transitivity composed with the current result. Command @{command
   "also"} updates @{fact calculation} involving @{fact this}, while @{command
   "finally"} exhibits the final @{fact calculation} by forward chaining
   towards the next goal statement. Both commands require valid current facts,
   i.e.\ may occur only after commands that produce theorems such as @{command
   "assume"}, @{command "note"}, or some finished proof of @{command "have"},
   @{command "show"} etc. The @{command "moreover"} and @{command "ultimately"}
   commands are similar to @{command "also"} and @{command "finally"}, but only
   collect further results in @{fact calculation} without applying any rules
   yet.
 
   Also note that the implicit term abbreviation ``\<open>\<dots>\<close>'' has its canonical
   application with calculational proofs. It refers to the argument of the
   preceding statement. (The argument of a curried infix expression happens to
   be its right-hand side.)
 
   Isabelle/Isar calculations are implicitly subject to block structure in the
   sense that new threads of calculational reasoning are commenced for any new
   block (as opened by a local goal, for example). This means that, apart from
   being able to nest calculations, there is no separate \<^emph>\<open>begin-calculation\<close>
   command required.
 
   \<^medskip>
   The Isar calculation proof commands may be defined as follows:\<^footnote>\<open>We suppress
   internal bookkeeping such as proper handling of block-structure.\<close>
 
   \begin{matharray}{rcl}
     @{command "also"}\<open>\<^sub>0\<close> & \equiv & @{command "note"}~\<open>calculation = this\<close> \\
     @{command "also"}\<open>\<^sub>n\<^sub>+\<^sub>1\<close> & \equiv & @{command "note"}~\<open>calculation = trans [OF calculation this]\<close> \\[0.5ex]
     @{command "finally"} & \equiv & @{command "also"}~@{command "from"}~\<open>calculation\<close> \\[0.5ex]
     @{command "moreover"} & \equiv & @{command "note"}~\<open>calculation = calculation this\<close> \\
     @{command "ultimately"} & \equiv & @{command "moreover"}~@{command "from"}~\<open>calculation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{command also} | @@{command finally}) ('(' @{syntax thms} ')')?
     ;
     @@{attribute trans} (() | 'add' | 'del')
   \<close>
 
   \<^descr> @{command "also"}~\<open>(a\<^sub>1 \<dots> a\<^sub>n)\<close> maintains the auxiliary @{fact
   calculation} register as follows. The first occurrence of @{command "also"}
   in some calculational thread initializes @{fact calculation} by @{fact
   this}. Any subsequent @{command "also"} on the same level of block-structure
   updates @{fact calculation} by some transitivity rule applied to @{fact
   calculation} and @{fact this} (in that order). Transitivity rules are picked
   from the current context, unless alternative rules are given as explicit
   arguments.
 
   \<^descr> @{command "finally"}~\<open>(a\<^sub>1 \<dots> a\<^sub>n)\<close> maintains @{fact calculation} in the
   same way as @{command "also"} and then concludes the current calculational
   thread. The final result is exhibited as fact for forward chaining towards
   the next goal. Basically, @{command "finally"} abbreviates @{command
   "also"}~@{command "from"}~@{fact calculation}. Typical idioms for concluding
   calculational proofs are ``@{command "finally"}~@{command
   "show"}~\<open>?thesis\<close>~@{command "."}'' and ``@{command "finally"}~@{command
   "have"}~\<open>\<phi>\<close>~@{command "."}''.
 
   \<^descr> @{command "moreover"} and @{command "ultimately"} are analogous to
   @{command "also"} and @{command "finally"}, but collect results only,
   without applying rules.
 
   \<^descr> @{command "print_trans_rules"} prints the list of transitivity rules (for
   calculational commands @{command "also"} and @{command "finally"}) and
   symmetry rules (for the @{attribute symmetric} operation and single step
   elimination patters) of the current context.
 
   \<^descr> @{attribute trans} declares theorems as transitivity rules.
 
   \<^descr> @{attribute sym} declares symmetry rules, as well as @{attribute
   "Pure.elim"}\<open>?\<close> rules.
 
   \<^descr> @{attribute symmetric} resolves a theorem with some rule declared as
   @{attribute sym} in the current context. For example, ``@{command
   "assume"}~\<open>[symmetric]: x = y\<close>'' produces a swapped fact derived from that
   assumption.
 
   In structured proof texts it is often more appropriate to use an explicit
   single-step elimination proof, such as ``@{command "assume"}~\<open>x =
   y\<close>~@{command "then"}~@{command "have"}~\<open>y = x\<close>~@{command ".."}''.
 \<close>
 
 
 section \<open>Refinement steps\<close>
 
 subsection \<open>Proof method expressions \label{sec:proof-meth}\<close>
 
 text \<open>
   Proof methods are either basic ones, or expressions composed of methods via
   ``\<^verbatim>\<open>,\<close>'' (sequential composition), ``\<^verbatim>\<open>;\<close>'' (structural composition),
   ``\<^verbatim>\<open>|\<close>'' (alternative choices), ``\<^verbatim>\<open>?\<close>'' (try), ``\<^verbatim>\<open>+\<close>'' (repeat at least
   once), ``\<^verbatim>\<open>[\<close>\<open>n\<close>\<^verbatim>\<open>]\<close>'' (restriction to first \<open>n\<close> subgoals). In practice,
   proof methods are usually just a comma separated list of @{syntax
   name}~@{syntax args} specifications. Note that parentheses may be dropped
   for single method specifications (with no arguments). The syntactic
   precedence of method combinators is \<^verbatim>\<open>|\<close> \<^verbatim>\<open>;\<close> \<^verbatim>\<open>,\<close> \<^verbatim>\<open>[]\<close> \<^verbatim>\<open>+\<close> \<^verbatim>\<open>?\<close> (from low
   to high).
 
   \<^rail>\<open>
     @{syntax_def method}:
       (@{syntax name} | '(' methods ')') (() | '?' | '+' | '[' @{syntax nat}? ']')
     ;
     methods: (@{syntax name} @{syntax args} | @{syntax method}) + (',' | ';' | '|')
   \<close>
 
   Regular Isar proof methods do \<^emph>\<open>not\<close> admit direct goal addressing, but refer
   to the first subgoal or to all subgoals uniformly. Nonetheless, the
   subsequent mechanisms allow to imitate the effect of subgoal addressing that
   is known from ML tactics.
 
   \<^medskip>
   Goal \<^emph>\<open>restriction\<close> means the proof state is wrapped-up in a way that
   certain subgoals are exposed, and other subgoals are ``parked'' elsewhere.
   Thus a proof method has no other chance than to operate on the subgoals that
   are presently exposed.
 
   Structural composition ``\<open>m\<^sub>1\<close>\<^verbatim>\<open>;\<close>~\<open>m\<^sub>2\<close>'' means that method \<open>m\<^sub>1\<close> is
   applied with restriction to the first subgoal, then \<open>m\<^sub>2\<close> is applied
   consecutively with restriction to each subgoal that has newly emerged due to
-  \<open>m\<^sub>1\<close>. This is analogous to the tactic combinator \<^ML_op>\<open>THEN_ALL_NEW\<close> in
+  \<open>m\<^sub>1\<close>. This is analogous to the tactic combinator \<^ML_infix>\<open>THEN_ALL_NEW\<close> in
   Isabelle/ML, see also @{cite "isabelle-implementation"}. For example, \<open>(rule
   r; blast)\<close> applies rule \<open>r\<close> and then solves all new subgoals by \<open>blast\<close>.
 
   Moreover, the explicit goal restriction operator ``\<open>[n]\<close>'' exposes only the
   first \<open>n\<close> subgoals (which need to exist), with default \<open>n = 1\<close>. For example,
   the method expression ``\<open>simp_all[3]\<close>'' simplifies the first three subgoals,
   while ``\<open>(rule r, simp_all)[]\<close>'' simplifies all new goals that emerge from
   applying rule \<open>r\<close> to the originally first one.
 
   \<^medskip>
   Improper methods, notably tactic emulations, offer low-level goal addressing
   as explicit argument to the individual tactic being involved. Here ``\<open>[!]\<close>''
   refers to all goals, and ``\<open>[n-]\<close>'' to all goals starting from \<open>n\<close>.
 
   \<^rail>\<open>
     @{syntax_def goal_spec}:
       '[' (@{syntax nat} '-' @{syntax nat} | @{syntax nat} '-' | @{syntax nat} | '!' ) ']'
   \<close>
 \<close>
 
 
 subsection \<open>Initial and terminal proof steps \label{sec:proof-steps}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "proof"} & : & \<open>proof(prove) \<rightarrow> proof(state)\<close> \\
     @{command_def "qed"} & : & \<open>proof(state) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "by"} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def ".."} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "."} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "sorry"} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{method_def standard} & : & \<open>method\<close> \\
   \end{matharray}
 
   Arbitrary goal refinement via tactics is considered harmful. Structured
   proof composition in Isar admits proof methods to be invoked in two places
   only.
 
     \<^enum> An \<^emph>\<open>initial\<close> refinement step @{command_ref "proof"}~\<open>m\<^sub>1\<close> reduces a
     newly stated goal to a number of sub-goals that are to be solved later.
     Facts are passed to \<open>m\<^sub>1\<close> for forward chaining, if so indicated by
     \<open>proof(chain)\<close> mode.
 
     \<^enum> A \<^emph>\<open>terminal\<close> conclusion step @{command_ref "qed"}~\<open>m\<^sub>2\<close> is intended to
     solve remaining goals. No facts are passed to \<open>m\<^sub>2\<close>.
 
   The only other (proper) way to affect pending goals in a proof body is by
   @{command_ref "show"}, which involves an explicit statement of what is to be
   solved eventually. Thus we avoid the fundamental problem of unstructured
   tactic scripts that consist of numerous consecutive goal transformations,
   with invisible effects.
 
   \<^medskip>
   As a general rule of thumb for good proof style, initial proof methods
   should either solve the goal completely, or constitute some well-understood
   reduction to new sub-goals. Arbitrary automatic proof tools that are prone
   leave a large number of badly structured sub-goals are no help in continuing
   the proof document in an intelligible manner.
 
   Unless given explicitly by the user, the default initial method is @{method
   standard}, which subsumes at least @{method_ref (Pure) rule} or its
   classical variant @{method_ref (HOL) rule}. These methods apply a single
   standard elimination or introduction rule according to the topmost logical
   connective involved. There is no separate default terminal method. Any
   remaining goals are always solved by assumption in the very last step.
 
   \<^rail>\<open>
     @@{command proof} method?
     ;
     @@{command qed} method?
     ;
     @@{command "by"} method method?
     ;
     (@@{command "."} | @@{command ".."} | @@{command sorry})
   \<close>
 
   \<^descr> @{command "proof"}~\<open>m\<^sub>1\<close> refines the goal by proof method \<open>m\<^sub>1\<close>; facts for
   forward chaining are passed if so indicated by \<open>proof(chain)\<close> mode.
 
   \<^descr> @{command "qed"}~\<open>m\<^sub>2\<close> refines any remaining goals by proof method \<open>m\<^sub>2\<close>
   and concludes the sub-proof by assumption. If the goal had been \<open>show\<close>, some
   pending sub-goal is solved as well by the rule resulting from the result
   \<^emph>\<open>exported\<close> into the enclosing goal context. Thus \<open>qed\<close> may fail for two
   reasons: either \<open>m\<^sub>2\<close> fails, or the resulting rule does not fit to any
   pending goal\<^footnote>\<open>This includes any additional ``strong'' assumptions as
   introduced by @{command "assume"}.\<close> of the enclosing context. Debugging such
   a situation might involve temporarily changing @{command "show"} into
   @{command "have"}, or weakening the local context by replacing occurrences
   of @{command "assume"} by @{command "presume"}.
 
   \<^descr> @{command "by"}~\<open>m\<^sub>1 m\<^sub>2\<close> is a \<^emph>\<open>terminal proof\<close>\index{proof!terminal}; it
   abbreviates @{command "proof"}~\<open>m\<^sub>1\<close>~@{command "qed"}~\<open>m\<^sub>2\<close>, but with
   backtracking across both methods. Debugging an unsuccessful @{command
   "by"}~\<open>m\<^sub>1 m\<^sub>2\<close> command can be done by expanding its definition; in many
   cases @{command "proof"}~\<open>m\<^sub>1\<close> (or even \<open>apply\<close>~\<open>m\<^sub>1\<close>) is already sufficient
   to see the problem.
 
   \<^descr> ``@{command ".."}'' is a \<^emph>\<open>standard proof\<close>\index{proof!standard}; it
   abbreviates @{command "by"}~\<open>standard\<close>.
 
   \<^descr> ``@{command "."}'' is a \<^emph>\<open>trivial proof\<close>\index{proof!trivial}; it
   abbreviates @{command "by"}~\<open>this\<close>.
 
   \<^descr> @{command "sorry"} is a \<^emph>\<open>fake proof\<close>\index{proof!fake} pretending to
   solve the pending claim without further ado. This only works in interactive
   development, or if the @{attribute quick_and_dirty} is enabled. Facts
   emerging from fake proofs are not the real thing. Internally, the derivation
   object is tainted by an oracle invocation, which may be inspected via the
   command @{command "thm_oracles"} (\secref{sec:oracles}).
 
   The most important application of @{command "sorry"} is to support
   experimentation and top-down proof development.
 
   \<^descr> @{method standard} refers to the default refinement step of some Isar
   language elements (notably @{command proof} and ``@{command ".."}''). It is
   \<^emph>\<open>dynamically scoped\<close>, so the behaviour depends on the application
   environment.
 
   In Isabelle/Pure, @{method standard} performs elementary introduction~/
   elimination steps (@{method_ref (Pure) rule}), introduction of type classes
   (@{method_ref intro_classes}) and locales (@{method_ref intro_locales}).
 
   In Isabelle/HOL, @{method standard} also takes classical rules into account
   (cf.\ \secref{sec:classical}).
 \<close>
 
 
 subsection \<open>Fundamental methods and attributes \label{sec:pure-meth-att}\<close>
 
 text \<open>
   The following proof methods and attributes refer to basic logical operations
   of Isar. Further methods and attributes are provided by several generic and
   object-logic specific tools and packages (see \chref{ch:gen-tools} and
   \partref{part:hol}).
 
   \begin{matharray}{rcl}
     @{command_def "print_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\[0.5ex]
     @{method_def "-"} & : & \<open>method\<close> \\
     @{method_def "goal_cases"} & : & \<open>method\<close> \\
     @{method_def "subproofs"} & : & \<open>method\<close> \\
     @{method_def "fact"} & : & \<open>method\<close> \\
     @{method_def "assumption"} & : & \<open>method\<close> \\
     @{method_def "this"} & : & \<open>method\<close> \\
     @{method_def (Pure) "rule"} & : & \<open>method\<close> \\
     @{attribute_def (Pure) "intro"} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) "elim"} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) "dest"} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) "rule"} & : & \<open>attribute\<close> \\[0.5ex]
     @{attribute_def "OF"} & : & \<open>attribute\<close> \\
     @{attribute_def "of"} & : & \<open>attribute\<close> \\
     @{attribute_def "where"} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method goal_cases} (@{syntax name}*)
     ;
     @@{method subproofs} @{syntax method}
     ;
     @@{method fact} @{syntax thms}?
     ;
     @@{method (Pure) rule} @{syntax thms}?
     ;
     rulemod: ('intro' | 'elim' | 'dest')
       ((('!' | () | '?') @{syntax nat}?) | 'del') ':' @{syntax thms}
     ;
     (@@{attribute intro} | @@{attribute elim} | @@{attribute dest})
       ('!' | () | '?') @{syntax nat}?
     ;
     @@{attribute (Pure) rule} 'del'
     ;
     @@{attribute OF} @{syntax thms}
     ;
     @@{attribute of} @{syntax insts} ('concl' ':' @{syntax insts})? @{syntax for_fixes}
     ;
     @@{attribute "where"} @{syntax named_insts} @{syntax for_fixes}
   \<close>
 
   \<^descr> @{command "print_rules"} prints rules declared via attributes @{attribute
   (Pure) intro}, @{attribute (Pure) elim}, @{attribute (Pure) dest} of
   Isabelle/Pure.
 
   See also the analogous @{command "print_claset"} command for similar rule
   declarations of the classical reasoner (\secref{sec:classical}).
 
   \<^descr> ``@{method "-"}'' (minus) inserts the forward chaining facts as premises
   into the goal, and nothing else.
 
   Note that command @{command_ref "proof"} without any method actually
   performs a single reduction step using the @{method_ref (Pure) rule} method;
   thus a plain \<^emph>\<open>do-nothing\<close> proof step would be ``@{command "proof"}~\<open>-\<close>''
   rather than @{command "proof"} alone.
 
   \<^descr> @{method "goal_cases"}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> turns the current subgoals into cases
   within the context (see also \secref{sec:cases-induct}). The specified case
   names are used if present; otherwise cases are numbered starting from 1.
 
   Invoking cases in the subsequent proof body via the @{command_ref case}
   command will @{command fix} goal parameters, @{command assume} goal
   premises, and @{command let} variable @{variable_ref ?case} refer to the
   conclusion.
 
   \<^descr> @{method "subproofs"}~\<open>m\<close> applies the method expression \<open>m\<close> consecutively
   to each subgoal, constructing individual subproofs internally (analogous to
   ``\<^theory_text>\<open>show goal by m\<close>'' for each subgoal of the proof state). Search
   alternatives of \<open>m\<close> are truncated: the method is forced to be deterministic.
   This method combinator impacts the internal construction of proof terms: it
   makes a cascade of let-expressions within the derivation tree and may thus
   improve scalability.
 
   \<^descr> @{method "fact"}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> composes some fact from \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> (or
   implicitly from the current proof context) modulo unification of schematic
   type and term variables. The rule structure is not taken into account, i.e.\
   meta-level implication is considered atomic. This is the same principle
   underlying literal facts (cf.\ \secref{sec:syn-att}): ``@{command
   "have"}~\<open>\<phi>\<close>~@{command "by"}~\<open>fact\<close>'' is equivalent to ``@{command
   "note"}~\<^verbatim>\<open>`\<close>\<open>\<phi>\<close>\<^verbatim>\<open>`\<close>'' provided that \<open>\<turnstile> \<phi>\<close> is an instance of some known \<open>\<turnstile> \<phi>\<close>
   in the proof context.
 
   \<^descr> @{method assumption} solves some goal by a single assumption step. All
   given facts are guaranteed to participate in the refinement; this means
   there may be only 0 or 1 in the first place. Recall that @{command "qed"}
   (\secref{sec:proof-steps}) already concludes any remaining sub-goals by
   assumption, so structured proofs usually need not quote the @{method
   assumption} method at all.
 
   \<^descr> @{method this} applies all of the current facts directly as rules. Recall
   that ``@{command "."}'' (dot) abbreviates ``@{command "by"}~\<open>this\<close>''.
 
   \<^descr> @{method (Pure) rule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> applies some rule given as argument in
   backward manner; facts are used to reduce the rule before applying it to the
   goal. Thus @{method (Pure) rule} without facts is plain introduction, while
   with facts it becomes elimination.
 
   When no arguments are given, the @{method (Pure) rule} method tries to pick
   appropriate rules automatically, as declared in the current context using
   the @{attribute (Pure) intro}, @{attribute (Pure) elim}, @{attribute (Pure)
   dest} attributes (see below). This is included in the standard behaviour of
   @{command "proof"} and ``@{command ".."}'' (double-dot) steps (see
   \secref{sec:proof-steps}).
 
   \<^descr> @{attribute (Pure) intro}, @{attribute (Pure) elim}, and @{attribute
   (Pure) dest} declare introduction, elimination, and destruct rules, to be
   used with method @{method (Pure) rule}, and similar tools. Note that the
   latter will ignore rules declared with ``\<open>?\<close>'', while ``\<open>!\<close>'' are used most
   aggressively.
 
   The classical reasoner (see \secref{sec:classical}) introduces its own
   variants of these attributes; use qualified names to access the present
   versions of Isabelle/Pure, i.e.\ @{attribute (Pure) "Pure.intro"}.
 
   \<^descr> @{attribute (Pure) rule}~\<open>del\<close> undeclares introduction, elimination, or
   destruct rules.
 
   \<^descr> @{attribute OF}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> applies some theorem to all of the given rules
   \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> in canonical right-to-left order, which means that premises
   stemming from the \<open>a\<^sub>i\<close> emerge in parallel in the result, without
   interfering with each other. In many practical situations, the \<open>a\<^sub>i\<close> do not
   have premises themselves, so \<open>rule [OF a\<^sub>1 \<dots> a\<^sub>n]\<close> can be actually read as
   functional application (modulo unification).
 
   Argument positions may be effectively skipped by using ``\<open>_\<close>'' (underscore),
   which refers to the propositional identity rule in the Pure theory.
 
   \<^descr> @{attribute of}~\<open>t\<^sub>1 \<dots> t\<^sub>n\<close> performs positional instantiation of term
   variables. The terms \<open>t\<^sub>1, \<dots>, t\<^sub>n\<close> are substituted for any schematic
   variables occurring in a theorem from left to right; ``\<open>_\<close>'' (underscore)
   indicates to skip a position. Arguments following a ``\<open>concl:\<close>''
   specification refer to positions of the conclusion of a rule.
 
   An optional context of local variables \<open>\<FOR> x\<^sub>1 \<dots> x\<^sub>m\<close> may be specified:
   the instantiated theorem is exported, and these variables become schematic
   (usually with some shifting of indices).
 
   \<^descr> @{attribute "where"}~\<open>x\<^sub>1 = t\<^sub>1 \<AND> \<dots> x\<^sub>n = t\<^sub>n\<close> performs named
   instantiation of schematic type and term variables occurring in a theorem.
   Schematic variables have to be specified on the left-hand side (e.g.\
   \<open>?x1.3\<close>). The question mark may be omitted if the variable name is a plain
   identifier without index. As type instantiations are inferred from term
   instantiations, explicit type instantiations are seldom necessary.
 
   An optional context of local variables \<open>\<FOR> x\<^sub>1 \<dots> x\<^sub>m\<close> may be specified
   as for @{attribute "of"} above.
 \<close>
 
 
 subsection \<open>Defining proof methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "method_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command method_setup} @{syntax name} '=' @{syntax text} @{syntax text}?
   \<close>
 
   \<^descr> @{command "method_setup"}~\<open>name = text description\<close> defines a proof method
   in the current context. The given \<open>text\<close> has to be an ML expression of type
   \<^ML_type>\<open>(Proof.context -> Proof.method) context_parser\<close>, cf.\ basic
   parsers defined in structure \<^ML_structure>\<open>Args\<close> and \<^ML_structure>\<open>Attrib\<close>. There are also combinators like \<^ML>\<open>METHOD\<close> and \<^ML>\<open>SIMPLE_METHOD\<close> to turn certain tactic forms into official proof methods; the
   primed versions refer to tactics with explicit goal addressing.
 
   Here are some example method definitions:
 \<close>
 
 (*<*)experiment begin(*>*)
   method_setup my_method1 =
     \<open>Scan.succeed (K (SIMPLE_METHOD' (fn i: int => no_tac)))\<close>
     "my first method (without any arguments)"
 
   method_setup my_method2 =
     \<open>Scan.succeed (fn ctxt: Proof.context =>
       SIMPLE_METHOD' (fn i: int => no_tac))\<close>
     "my second method (with context)"
 
   method_setup my_method3 =
     \<open>Attrib.thms >> (fn thms: thm list => fn ctxt: Proof.context =>
       SIMPLE_METHOD' (fn i: int => no_tac))\<close>
     "my third method (with theorem arguments and context)"
 (*<*)end(*>*)
 
 
 section \<open>Proof by cases and induction \label{sec:cases-induct}\<close>
 
 subsection \<open>Rule contexts\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "case"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "print_cases"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def case_names} & : & \<open>attribute\<close> \\
     @{attribute_def case_conclusion} & : & \<open>attribute\<close> \\
     @{attribute_def params} & : & \<open>attribute\<close> \\
     @{attribute_def consumes} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   The puristic way to build up Isar proof contexts is by explicit language
   elements like @{command "fix"}, @{command "assume"}, @{command "let"} (see
   \secref{sec:proof-context}). This is adequate for plain natural deduction,
   but easily becomes unwieldy in concrete verification tasks, which typically
   involve big induction rules with several cases.
 
   The @{command "case"} command provides a shorthand to refer to a local
   context symbolically: certain proof methods provide an environment of named
   ``cases'' of the form \<open>c: x\<^sub>1, \<dots>, x\<^sub>m, \<phi>\<^sub>1, \<dots>, \<phi>\<^sub>n\<close>; the effect of
   ``@{command "case"}~\<open>c\<close>'' is then equivalent to ``@{command "fix"}~\<open>x\<^sub>1 \<dots>
   x\<^sub>m\<close>~@{command "assume"}~\<open>c: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close>''. Term bindings may be covered as
   well, notably @{variable ?case} for the main conclusion.
 
   By default, the ``terminology'' \<open>x\<^sub>1, \<dots>, x\<^sub>m\<close> of a case value is marked as
   hidden, i.e.\ there is no way to refer to such parameters in the subsequent
   proof text. After all, original rule parameters stem from somewhere outside
   of the current proof text. By using the explicit form ``@{command
   "case"}~\<open>(c y\<^sub>1 \<dots> y\<^sub>m)\<close>'' instead, the proof author is able to chose local
   names that fit nicely into the current context.
 
   \<^medskip>
   It is important to note that proper use of @{command "case"} does not
   provide means to peek at the current goal state, which is not directly
   observable in Isar! Nonetheless, goal refinement commands do provide named
   cases \<open>goal\<^sub>i\<close> for each subgoal \<open>i = 1, \<dots>, n\<close> of the resulting goal state.
   Using this extra feature requires great care, because some bits of the
   internal tactical machinery intrude the proof text. In particular, parameter
   names stemming from the left-over of automated reasoning tools are usually
   quite unpredictable.
 
   Under normal circumstances, the text of cases emerge from standard
   elimination or induction rules, which in turn are derived from previous
   theory specifications in a canonical way (say from @{command "inductive"}
   definitions).
 
   \<^medskip>
   Proper cases are only available if both the proof method and the rules
   involved support this. By using appropriate attributes, case names,
   conclusions, and parameters may be also declared by hand. Thus variant
   versions of rules that have been derived manually become ready to use in
   advanced case analysis later.
 
   \<^rail>\<open>
     @@{command case} @{syntax thmdecl}? (name | '(' name (('_' | @{syntax name}) *) ')')
     ;
     @@{attribute case_names} ((@{syntax name} ( '[' (('_' | @{syntax name}) *) ']' ) ? ) +)
     ;
     @@{attribute case_conclusion} @{syntax name} (@{syntax name} * )
     ;
     @@{attribute params} ((@{syntax name} * ) + @'and')
     ;
     @@{attribute consumes} @{syntax int}?
   \<close>
 
   \<^descr> @{command "case"}~\<open>a: (c x\<^sub>1 \<dots> x\<^sub>m)\<close> invokes a named local context \<open>c:
   x\<^sub>1, \<dots>, x\<^sub>m, \<phi>\<^sub>1, \<dots>, \<phi>\<^sub>m\<close>, as provided by an appropriate proof method (such
   as @{method_ref cases} and @{method_ref induct}). The command ``@{command
   "case"}~\<open>a: (c x\<^sub>1 \<dots> x\<^sub>m)\<close>'' abbreviates ``@{command "fix"}~\<open>x\<^sub>1 \<dots>
   x\<^sub>m\<close>~@{command "assume"}~\<open>a.c: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close>''. Each local fact is qualified by
   the prefix \<open>a\<close>, and all such facts are collectively bound to the name \<open>a\<close>.
 
   The fact name is specification \<open>a\<close> is optional, the default is to re-use
   \<open>c\<close>. So @{command "case"}~\<open>(c x\<^sub>1 \<dots> x\<^sub>m)\<close> is the same as @{command
   "case"}~\<open>c: (c x\<^sub>1 \<dots> x\<^sub>m)\<close>.
 
   \<^descr> @{command "print_cases"} prints all local contexts of the current state,
   using Isar proof language notation.
 
   \<^descr> @{attribute case_names}~\<open>c\<^sub>1 \<dots> c\<^sub>k\<close> declares names for the local contexts
   of premises of a theorem; \<open>c\<^sub>1, \<dots>, c\<^sub>k\<close> refers to the \<^emph>\<open>prefix\<close> of the list
   of premises. Each of the cases \<open>c\<^sub>i\<close> can be of the form \<open>c[h\<^sub>1 \<dots> h\<^sub>n]\<close> where
   the \<open>h\<^sub>1 \<dots> h\<^sub>n\<close> are the names of the hypotheses in case \<open>c\<^sub>i\<close> from left to
   right.
 
   \<^descr> @{attribute case_conclusion}~\<open>c d\<^sub>1 \<dots> d\<^sub>k\<close> declares names for the
   conclusions of a named premise \<open>c\<close>; here \<open>d\<^sub>1, \<dots>, d\<^sub>k\<close> refers to the prefix
   of arguments of a logical formula built by nesting a binary connective
   (e.g.\ \<open>\<or>\<close>).
 
   Note that proof methods such as @{method induct} and @{method coinduct}
   already provide a default name for the conclusion as a whole. The need to
   name subformulas only arises with cases that split into several sub-cases,
   as in common co-induction rules.
 
   \<^descr> @{attribute params}~\<open>p\<^sub>1 \<dots> p\<^sub>m \<AND> \<dots> q\<^sub>1 \<dots> q\<^sub>n\<close> renames the innermost
   parameters of premises \<open>1, \<dots>, n\<close> of some theorem. An empty list of names may
   be given to skip positions, leaving the present parameters unchanged.
 
   Note that the default usage of case rules does \<^emph>\<open>not\<close> directly expose
   parameters to the proof context.
 
   \<^descr> @{attribute consumes}~\<open>n\<close> declares the number of ``major premises'' of a
   rule, i.e.\ the number of facts to be consumed when it is applied by an
   appropriate proof method. The default value of @{attribute consumes} is \<open>n =
   1\<close>, which is appropriate for the usual kind of cases and induction rules for
   inductive sets (cf.\ \secref{sec:hol-inductive}). Rules without any
   @{attribute consumes} declaration given are treated as if @{attribute
   consumes}~\<open>0\<close> had been specified.
 
   A negative \<open>n\<close> is interpreted relatively to the total number of premises of
   the rule in the target context. Thus its absolute value specifies the
   remaining number of premises, after subtracting the prefix of major premises
   as indicated above. This form of declaration has the technical advantage of
   being stable under more morphisms, notably those that export the result from
   a nested @{command_ref context} with additional assumptions.
 
   Note that explicit @{attribute consumes} declarations are only rarely
   needed; this is already taken care of automatically by the higher-level
   @{attribute cases}, @{attribute induct}, and @{attribute coinduct}
   declarations.
 \<close>
 
 
 subsection \<open>Proof methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def cases} & : & \<open>method\<close> \\
     @{method_def induct} & : & \<open>method\<close> \\
     @{method_def induction} & : & \<open>method\<close> \\
     @{method_def coinduct} & : & \<open>method\<close> \\
   \end{matharray}
 
   The @{method cases}, @{method induct}, @{method induction}, and @{method
   coinduct} methods provide a uniform interface to common proof techniques
   over datatypes, inductive predicates (or sets), recursive functions etc. The
   corresponding rules may be specified and instantiated in a casual manner.
   Furthermore, these methods provide named local contexts that may be invoked
   via the @{command "case"} proof command within the subsequent proof text.
   This accommodates compact proof texts even when reasoning about large
   specifications.
 
   The @{method induct} method also provides some infrastructure to work with
   structured statements (either using explicit meta-level connectives, or
   including facts and parameters separately). This avoids cumbersome encoding
   of ``strengthened'' inductive statements within the object-logic.
 
   Method @{method induction} differs from @{method induct} only in the names
   of the facts in the local context invoked by the @{command "case"} command.
 
   \<^rail>\<open>
     @@{method cases} ('(' 'no_simp' ')')? \<newline>
       (@{syntax insts} * @'and') rule?
     ;
     (@@{method induct} | @@{method induction})
       ('(' 'no_simp' ')')? (definsts * @'and') \<newline> arbitrary? taking? rule?
     ;
     @@{method coinduct} @{syntax insts} taking rule?
     ;
 
     rule: ('type' | 'pred' | 'set') ':' (@{syntax name} +) | 'rule' ':' (@{syntax thm} +)
     ;
     definst: @{syntax name} ('==' | '\<equiv>') @{syntax term} | '(' @{syntax term} ')' | @{syntax inst}
     ;
     definsts: ( definst * )
     ;
     arbitrary: 'arbitrary' ':' ((@{syntax term} * ) @'and' +)
     ;
     taking: 'taking' ':' @{syntax insts}
   \<close>
 
   \<^descr> @{method cases}~\<open>insts R\<close> applies method @{method rule} with an
   appropriate case distinction theorem, instantiated to the subjects \<open>insts\<close>.
   Symbolic case names are bound according to the rule's local contexts.
 
   The rule is determined as follows, according to the facts and arguments
   passed to the @{method cases} method:
 
   \<^medskip>
   \begin{tabular}{llll}
     facts           &                 & arguments   & rule \\\hline
     \<open>\<turnstile> R\<close>   & @{method cases} &             & implicit rule \<open>R\<close> \\
                     & @{method cases} &             & classical case split \\
                     & @{method cases} & \<open>t\<close>   & datatype exhaustion (type of \<open>t\<close>) \\
     \<open>\<turnstile> A t\<close> & @{method cases} & \<open>\<dots>\<close> & inductive predicate/set elimination (of \<open>A\<close>) \\
     \<open>\<dots>\<close>     & @{method cases} & \<open>\<dots> rule: R\<close> & explicit rule \<open>R\<close> \\
   \end{tabular}
   \<^medskip>
 
   Several instantiations may be given, referring to the \<^emph>\<open>suffix\<close> of premises
   of the case rule; within each premise, the \<^emph>\<open>prefix\<close> of variables is
   instantiated. In most situations, only a single term needs to be specified;
   this refers to the first variable of the last premise (it is usually the
   same for all cases). The \<open>(no_simp)\<close> option can be used to disable
   pre-simplification of cases (see the description of @{method induct} below
   for details).
 
   \<^descr> @{method induct}~\<open>insts R\<close> and @{method induction}~\<open>insts R\<close> are analogous
   to the @{method cases} method, but refer to induction rules, which are
   determined as follows:
 
   \<^medskip>
   \begin{tabular}{llll}
     facts   &                  & arguments     & rule \\\hline
             & @{method induct} & \<open>P x\<close>         & datatype induction (type of \<open>x\<close>) \\
     \<open>\<turnstile> A x\<close> & @{method induct} & \<open>\<dots>\<close>          & predicate/set induction (of \<open>A\<close>) \\
     \<open>\<dots>\<close>    & @{method induct} & \<open>\<dots> rule: R\<close>  & explicit rule \<open>R\<close> \\
   \end{tabular}
   \<^medskip>
 
   Several instantiations may be given, each referring to some part of a mutual
   inductive definition or datatype --- only related partial induction rules
   may be used together, though. Any of the lists of terms \<open>P, x, \<dots>\<close> refers to
   the \<^emph>\<open>suffix\<close> of variables present in the induction rule. This enables the
   writer to specify only induction variables, or both predicates and
   variables, for example.
 
   Instantiations may be definitional: equations \<open>x \<equiv> t\<close> introduce local
   definitions, which are inserted into the claim and discharged after applying
   the induction rule. Equalities reappear in the inductive cases, but have
   been transformed according to the induction principle being involved here.
   In order to achieve practically useful induction hypotheses, some variables
   occurring in \<open>t\<close> need to generalized (see below). Instantiations of
   the form \<open>t\<close>, where \<open>t\<close> is not a variable, are taken as a shorthand for \<open>x \<equiv>
   t\<close>, where \<open>x\<close> is a fresh variable. If this is not intended, \<open>t\<close> has to be
   enclosed in parentheses. By default, the equalities generated by
   definitional instantiations are pre-simplified using a specific set of
   rules, usually consisting of distinctness and injectivity theorems for
   datatypes. This pre-simplification may cause some of the parameters of an
   inductive case to disappear, or may even completely delete some of the
   inductive cases, if one of the equalities occurring in their premises can be
   simplified to \<open>False\<close>. The \<open>(no_simp)\<close> option can be used to disable
   pre-simplification. Additional rules to be used in pre-simplification can be
   declared using the @{attribute_def induct_simp} attribute.
 
   The optional ``\<open>arbitrary: x\<^sub>1 \<dots> x\<^sub>m\<close>'' specification generalizes variables
   \<open>x\<^sub>1, \<dots>, x\<^sub>m\<close> of the original goal before applying induction. It is possible
   to separate variables by ``\<open>and\<close>'' to generalize in goals other than
   the first. Thus induction hypotheses may become sufficiently general to get
   the proof through. Together with definitional instantiations, one may
   effectively perform induction over expressions of a certain structure.
 
   The optional ``\<open>taking: t\<^sub>1 \<dots> t\<^sub>n\<close>'' specification provides additional
   instantiations of a prefix of pending variables in the rule. Such schematic
   induction rules rarely occur in practice, though.
 
   \<^descr> @{method coinduct}~\<open>inst R\<close> is analogous to the @{method induct} method,
   but refers to coinduction rules, which are determined as follows:
 
   \<^medskip>
   \begin{tabular}{llll}
     goal  &                    & arguments & rule \\\hline
           & @{method coinduct} & \<open>x\<close> & type coinduction (type of \<open>x\<close>) \\
     \<open>A x\<close> & @{method coinduct} & \<open>\<dots>\<close> & predicate/set coinduction (of \<open>A\<close>) \\
     \<open>\<dots>\<close>   & @{method coinduct} & \<open>\<dots> rule: R\<close> & explicit rule \<open>R\<close> \\
   \end{tabular}
   \<^medskip>
 
   Coinduction is the dual of induction. Induction essentially eliminates \<open>A x\<close>
   towards a generic result \<open>P x\<close>, while coinduction introduces \<open>A x\<close> starting
   with \<open>B x\<close>, for a suitable ``bisimulation'' \<open>B\<close>. The cases of a coinduct
   rule are typically named after the predicates or sets being covered, while
   the conclusions consist of several alternatives being named after the
   individual destructor patterns.
 
   The given instantiation refers to the \<^emph>\<open>suffix\<close> of variables occurring in
   the rule's major premise, or conclusion if unavailable. An additional
   ``\<open>taking: t\<^sub>1 \<dots> t\<^sub>n\<close>'' specification may be required in order to specify
   the bisimulation to be used in the coinduction step.
 
 
   Above methods produce named local contexts, as determined by the
   instantiated rule as given in the text. Beyond that, the @{method induct}
   and @{method coinduct} methods guess further instantiations from the goal
   specification itself. Any persisting unresolved schematic variables of the
   resulting rule will render the the corresponding case invalid. The term
   binding @{variable ?case} for the conclusion will be provided with each
   case, provided that term is fully specified.
 
   The @{command "print_cases"} command prints all named cases present in the
   current proof state.
 
   \<^medskip>
   Despite the additional infrastructure, both @{method cases} and @{method
   coinduct} merely apply a certain rule, after instantiation, while conforming
   due to the usual way of monotonic natural deduction: the context of a
   structured statement \<open>\<And>x\<^sub>1 \<dots> x\<^sub>m. \<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> \<dots>\<close> reappears unchanged after
   the case split.
 
   The @{method induct} method is fundamentally different in this respect: the
   meta-level structure is passed through the ``recursive'' course involved in
   the induction. Thus the original statement is basically replaced by separate
   copies, corresponding to the induction hypotheses and conclusion; the
   original goal context is no longer available. Thus local assumptions, fixed
   parameters and definitions effectively participate in the inductive
   rephrasing of the original statement.
 
   In @{method induct} proofs, local assumptions introduced by cases are split
   into two different kinds: \<open>hyps\<close> stemming from the rule and \<open>prems\<close> from the
   goal statement. This is reflected in the extracted cases accordingly, so
   invoking ``@{command "case"}~\<open>c\<close>'' will provide separate facts \<open>c.hyps\<close> and
   \<open>c.prems\<close>, as well as fact \<open>c\<close> to hold the all-inclusive list.
 
   In @{method induction} proofs, local assumptions introduced by cases are
   split into three different kinds: \<open>IH\<close>, the induction hypotheses, \<open>hyps\<close>,
   the remaining hypotheses stemming from the rule, and \<open>prems\<close>, the
   assumptions from the goal statement. The names are \<open>c.IH\<close>, \<open>c.hyps\<close> and
   \<open>c.prems\<close>, as above.
 
   \<^medskip>
   Facts presented to either method are consumed according to the number of
   ``major premises'' of the rule involved, which is usually 0 for plain cases
   and induction rules of datatypes etc.\ and 1 for rules of inductive
   predicates or sets and the like. The remaining facts are inserted into the
   goal verbatim before the actual \<open>cases\<close>, \<open>induct\<close>, or \<open>coinduct\<close> rule is
   applied.
 \<close>
 
 
 subsection \<open>Declaring rules\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_induct_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def cases} & : & \<open>attribute\<close> \\
     @{attribute_def induct} & : & \<open>attribute\<close> \\
     @{attribute_def coinduct} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute cases} spec
     ;
     @@{attribute induct} spec
     ;
     @@{attribute coinduct} spec
     ;
 
     spec: (('type' | 'pred' | 'set') ':' @{syntax name}) | 'del'
   \<close>
 
   \<^descr> @{command "print_induct_rules"} prints cases and induct rules for
   predicates (or sets) and types of the current context.
 
   \<^descr> @{attribute cases}, @{attribute induct}, and @{attribute coinduct} (as
   attributes) declare rules for reasoning about (co)inductive predicates (or
   sets) and types, using the corresponding methods of the same name. Certain
   definitional packages of object-logics usually declare emerging cases and
   induction rules as expected, so users rarely need to intervene.
 
   Rules may be deleted via the \<open>del\<close> specification, which covers all of the
   \<open>type\<close>/\<open>pred\<close>/\<open>set\<close> sub-categories simultaneously. For example, @{attribute
   cases}~\<open>del\<close> removes any @{attribute cases} rules declared for some type,
   predicate, or set.
 
   Manual rule declarations usually refer to the @{attribute case_names} and
   @{attribute params} attributes to adjust names of cases and parameters of a
   rule; the @{attribute consumes} declaration is taken care of automatically:
   @{attribute consumes}~\<open>0\<close> is specified for ``type'' rules and @{attribute
   consumes}~\<open>1\<close> for ``predicate'' / ``set'' rules.
 \<close>
 
 
 section \<open>Generalized elimination and case splitting \label{sec:obtain}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "consider"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "obtain"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "guess"}\<open>\<^sup>*\<close> & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
   \end{matharray}
 
   Generalized elimination means that hypothetical parameters and premises may
   be introduced in the current context, potentially with a split into cases.
   This works by virtue of a locally proven rule that establishes the soundness
   of this temporary context extension. As representative examples, one may
   think of standard rules from Isabelle/HOL like this:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<exists>x. B x \<Longrightarrow> (\<And>x. B x \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\
   \<open>A \<and> B \<Longrightarrow> (A \<Longrightarrow> B \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\
   \<open>A \<or> B \<Longrightarrow> (A \<Longrightarrow> thesis) \<Longrightarrow> (B \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\
   \end{tabular}
   \<^medskip>
 
   In general, these particular rules and connectives need to get involved at
   all: this concept works directly in Isabelle/Pure via Isar commands defined
   below. In particular, the logic of elimination and case splitting is
   delegated to an Isar proof, which often involves automated tools.
 
   \<^rail>\<open>
     @@{command consider} @{syntax obtain_clauses}
     ;
     @@{command obtain} @{syntax par_name}? @{syntax vars} \<newline>
       @'where' concl prems @{syntax for_fixes}
     ;
     concl: (@{syntax props} + @'and')
     ;
     prems: (@'if' (@{syntax props'} + @'and'))?
     ;
     @@{command guess} @{syntax vars}
   \<close>
 
   \<^descr> @{command consider}~\<open>(a) \<^vec>x \<WHERE> \<^vec>A \<^vec>x | (b)
   \<^vec>y \<WHERE> \<^vec>B \<^vec>y | \<dots>\<close> states a rule for case splitting
   into separate subgoals, such that each case involves new parameters and
   premises. After the proof is finished, the resulting rule may be used
   directly with the @{method cases} proof method (\secref{sec:cases-induct}),
   in order to perform actual case-splitting of the proof text via @{command
   case} and @{command next} as usual.
 
   Optional names in round parentheses refer to case names: in the proof of the
   rule this is a fact name, in the resulting rule it is used as annotation
   with the @{attribute_ref case_names} attribute.
 
   \<^medskip>
   Formally, the command @{command consider} is defined as derived Isar
   language element as follows:
 
   \begin{matharray}{l}
     @{command "consider"}~\<open>(a) \<^vec>x \<WHERE> \<^vec>A \<^vec>x | (b) \<^vec>y \<WHERE> \<^vec>B \<^vec>y | \<dots> \<equiv>\<close> \\[1ex]
     \quad @{command "have"}~\<open>[case_names a b \<dots>]: thesis\<close> \\
     \qquad \<open>\<IF> a [Pure.intro?]: \<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis\<close> \\
     \qquad \<open>\<AND> b [Pure.intro?]: \<And>\<^vec>y. \<^vec>B \<^vec>y \<Longrightarrow> thesis\<close> \\
     \qquad \<open>\<AND> \<dots>\<close> \\
     \qquad \<open>\<FOR> thesis\<close> \\
     \qquad @{command "apply"}~\<open>(insert a b \<dots>)\<close> \\
   \end{matharray}
 
   See also \secref{sec:goals} for @{keyword "obtains"} in toplevel goal
   statements, as well as @{command print_statement} to print existing rules in
   a similar format.
 
   \<^descr> @{command obtain}~\<open>\<^vec>x \<WHERE> \<^vec>A \<^vec>x\<close> states a
   generalized elimination rule with exactly one case. After the proof is
   finished, it is activated for the subsequent proof text: the context is
   augmented via @{command fix}~\<open>\<^vec>x\<close> @{command assume}~\<open>\<^vec>A
   \<^vec>x\<close>, with special provisions to export later results by discharging
   these assumptions again.
 
   Note that according to the parameter scopes within the elimination rule,
   results \<^emph>\<open>must not\<close> refer to hypothetical parameters; otherwise the export
   will fail! This restriction conforms to the usual manner of existential
   reasoning in Natural Deduction.
 
   \<^medskip>
   Formally, the command @{command obtain} is defined as derived Isar language
   element as follows, using an instrumented variant of @{command assume}:
 
   \begin{matharray}{l}
     @{command "obtain"}~\<open>\<^vec>x \<WHERE> a: \<^vec>A \<^vec>x  \<langle>proof\<rangle> \<equiv>\<close> \\[1ex]
     \quad @{command "have"}~\<open>thesis\<close> \\
     \qquad \<open>\<IF> that [Pure.intro?]: \<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis\<close> \\
     \qquad \<open>\<FOR> thesis\<close> \\
     \qquad @{command "apply"}~\<open>(insert that)\<close> \\
     \qquad \<open>\<langle>proof\<rangle>\<close> \\
     \quad @{command "fix"}~\<open>\<^vec>x\<close>~@{command "assume"}\<open>\<^sup>* a: \<^vec>A \<^vec>x\<close> \\
   \end{matharray}
 
   \<^descr> @{command guess} is similar to @{command obtain}, but it derives the
   obtained context elements from the course of tactical reasoning in the
   proof. Thus it can considerably obscure the proof: it is classified as
   \<^emph>\<open>improper\<close>.
 
   A proof with @{command guess} starts with a fixed goal \<open>thesis\<close>. The
   subsequent refinement steps may turn this to anything of the form
   \<open>\<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis\<close>, but without splitting into new
   subgoals. The final goal state is then used as reduction rule for the obtain
   pattern described above. Obtained parameters \<open>\<^vec>x\<close> are marked as
   internal by default, and thus inaccessible in the proof text. The variable
   names and type constraints given as arguments for @{command "guess"} specify
   a prefix of accessible parameters.
 
 
   In the proof of @{command consider} and @{command obtain} the local premises
   are always bound to the fact name @{fact_ref that}, according to structured
   Isar statements involving @{keyword_ref "if"} (\secref{sec:goals}).
 
   Facts that are established by @{command "obtain"} and @{command "guess"} may
   not be polymorphic: any type-variables occurring here are fixed in the
   present context. This is a natural consequence of the role of @{command fix}
   and @{command assume} in these constructs.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Spec.thy b/src/Doc/Isar_Ref/Spec.thy
--- a/src/Doc/Isar_Ref/Spec.thy
+++ b/src/Doc/Isar_Ref/Spec.thy
@@ -1,1532 +1,1535 @@
 (*:maxLineLen=78:*)
 
 theory Spec
   imports Main Base
 begin
 
 chapter \<open>Specifications\<close>
 
 text \<open>
   The Isabelle/Isar theory format integrates specifications and proofs, with
   support for interactive development by continuous document editing. There is
   a separate document preparation system (see \chref{ch:document-prep}), for
   typesetting formal developments together with informal text. The resulting
   hyper-linked PDF documents can be used both for WWW presentation and printed
   copies.
 
   The Isar proof language (see \chref{ch:proofs}) is embedded into the theory
   language as a proper sub-language. Proof mode is entered by stating some
   \<^theory_text>\<open>theorem\<close> or \<^theory_text>\<open>lemma\<close> at the theory level, and left again with the final
   conclusion (e.g.\ via \<^theory_text>\<open>qed\<close>).
 \<close>
 
 
 section \<open>Defining theories \label{sec:begin-thy}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "theory"} & : & \<open>toplevel \<rightarrow> theory\<close> \\
     @{command_def (global) "end"} & : & \<open>theory \<rightarrow> toplevel\<close> \\
     @{command_def "thy_deps"}\<open>\<^sup>*\<close> & : & \<open>theory \<rightarrow>\<close> \\
   \end{matharray}
 
   Isabelle/Isar theories are defined via theory files, which consist of an
   outermost sequence of definition--statement--proof elements. Some
   definitions are self-sufficient (e.g.\ \<^theory_text>\<open>fun\<close> in Isabelle/HOL), with
   foundational proofs performed internally. Other definitions require an
   explicit proof as justification (e.g.\ \<^theory_text>\<open>function\<close> and \<^theory_text>\<open>termination\<close> in
   Isabelle/HOL). Plain statements like \<^theory_text>\<open>theorem\<close> or \<^theory_text>\<open>lemma\<close> are merely a
   special case of that, defining a theorem from a given proposition and its
   proof.
 
   The theory body may be sub-structured by means of \<^emph>\<open>local theory targets\<close>,
   such as \<^theory_text>\<open>locale\<close> and \<^theory_text>\<open>class\<close>. It is also possible to use \<^theory_text>\<open>context begin \<dots>
   end\<close> blocks to delimited a local theory context: a \<^emph>\<open>named context\<close> to
   augment a locale or class specification, or an \<^emph>\<open>unnamed context\<close> to refer
   to local parameters and assumptions that are discharged later. See
   \secref{sec:target} for more details.
 
   \<^medskip>
   A theory is commenced by the \<^theory_text>\<open>theory\<close> command, which indicates imports of
   previous theories, according to an acyclic foundational order. Before the
   initial \<^theory_text>\<open>theory\<close> command, there may be optional document header material
   (like \<^theory_text>\<open>section\<close> or \<^theory_text>\<open>text\<close>, see \secref{sec:markup}). The document header
   is outside of the formal theory context, though.
 
   A theory is concluded by a final @{command (global) "end"} command, one that
   does not belong to a local theory target. No further commands may follow
   such a global @{command (global) "end"}.
 
   \<^rail>\<open>
     @@{command theory} @{syntax system_name}
       @'imports' (@{syntax system_name} +) \<newline>
       keywords? abbrevs? @'begin'
     ;
     keywords: @'keywords' (keyword_decls + @'and')
     ;
     keyword_decls: (@{syntax string} +) ('::' @{syntax name} @{syntax tags})?
     ;
     abbrevs: @'abbrevs' (((text+) '=' (text+)) + @'and')
     ;
     @@{command thy_deps} (thy_bounds thy_bounds?)?
     ;
     thy_bounds: @{syntax name} | '(' (@{syntax name} + @'|') ')'
   \<close>
 
   \<^descr> \<^theory_text>\<open>theory A imports B\<^sub>1 \<dots> B\<^sub>n begin\<close> starts a new theory \<open>A\<close> based on the
   merge of existing theories \<open>B\<^sub>1 \<dots> B\<^sub>n\<close>. Due to the possibility to import
   more than one ancestor, the resulting theory structure of an Isabelle
   session forms a directed acyclic graph (DAG). Isabelle takes care that
   sources contributing to the development graph are always up-to-date: changed
   files are automatically rechecked whenever a theory header specification is
   processed.
 
   Empty imports are only allowed in the bootstrap process of the special
   theory \<^theory>\<open>Pure\<close>, which is the start of any other formal development
   based on Isabelle. Regular user theories usually refer to some more complex
   entry point, such as theory \<^theory>\<open>Main\<close> in Isabelle/HOL.
 
   The @{keyword_def "keywords"} specification declares outer syntax
   (\chref{ch:outer-syntax}) that is introduced in this theory later on (rare
   in end-user applications). Both minor keywords and major keywords of the
   Isar command language need to be specified, in order to make parsing of
   proof documents work properly. Command keywords need to be classified
   according to their structural role in the formal text. Examples may be seen
   in Isabelle/HOL sources itself, such as @{keyword "keywords"}~\<^verbatim>\<open>"typedef"\<close>
   \<open>:: thy_goal_defn\<close> or @{keyword "keywords"}~\<^verbatim>\<open>"datatype"\<close> \<open>:: thy_defn\<close> for
   theory-level definitions with and without proof, respectively. Additional
   @{syntax tags} provide defaults for document preparation
   (\secref{sec:document-markers}).
 
   The @{keyword_def "abbrevs"} specification declares additional abbreviations
   for syntactic completion. The default for a new keyword is just its name,
   but completion may be avoided by defining @{keyword "abbrevs"} with empty
   text.
 
   \<^descr> @{command (global) "end"} concludes the current theory definition. Note
   that some other commands, e.g.\ local theory targets \<^theory_text>\<open>locale\<close> or \<^theory_text>\<open>class\<close>
   may involve a \<^theory_text>\<open>begin\<close> that needs to be matched by @{command (local) "end"},
   according to the usual rules for nested blocks.
 
   \<^descr> \<^theory_text>\<open>thy_deps\<close> visualizes the theory hierarchy as a directed acyclic graph.
   By default, all imported theories are shown. This may be restricted by
   specifying bounds wrt. the theory inclusion relation.
 \<close>
 
 
 section \<open>Local theory targets \label{sec:target}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "context"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def (local) "end"} & : & \<open>local_theory \<rightarrow> theory\<close> \\
     @{keyword_def "private"} \\
     @{keyword_def "qualified"} \\
   \end{matharray}
 
   A local theory target is a specification context that is managed separately
   within the enclosing theory. Contexts may introduce parameters (fixed
   variables) and assumptions (hypotheses). Definitions and theorems depending
   on the context may be added incrementally later on.
 
   \<^emph>\<open>Named contexts\<close> refer to locales (cf.\ \secref{sec:locale}) or type
   classes (cf.\ \secref{sec:class}); the name ``\<open>-\<close>'' signifies the global
   theory context.
 
   \<^emph>\<open>Unnamed contexts\<close> may introduce additional parameters and assumptions, and
   results produced in the context are generalized accordingly. Such auxiliary
   contexts may be nested within other targets, like \<^theory_text>\<open>locale\<close>, \<^theory_text>\<open>class\<close>,
   \<^theory_text>\<open>instantiation\<close>, \<^theory_text>\<open>overloading\<close>.
 
   \<^rail>\<open>
     @@{command context} @{syntax name} @{syntax_ref "opening"}? @'begin'
     ;
     @@{command context} @{syntax_ref "includes"}? (@{syntax context_elem} * ) @'begin'
     ;
     @{syntax_def target}: '(' @'in' @{syntax name} ')'
   \<close>
 
   \<^descr> \<^theory_text>\<open>context c bundles begin\<close> opens a named context, by recommencing an existing
   locale or class \<open>c\<close>. Note that locale and class definitions allow to include
   the \<^theory_text>\<open>begin\<close> keyword as well, in order to continue the local theory
   immediately after the initial specification.  Optionally given
   \<open>bundles\<close> only take effect in the surface context within the \<^theory_text>\<open>begin\<close> /
   \<^theory_text>\<open>end\<close> block.
 
   \<^descr> \<^theory_text>\<open>context bundles elements begin\<close> opens an unnamed context, by extending
   the enclosing global or local theory target by the given declaration bundles
   (\secref{sec:bundle}) and context elements (\<^theory_text>\<open>fixes\<close>, \<^theory_text>\<open>assumes\<close> etc.). This
   means any results stemming from definitions and proofs in the extended
   context will be exported into the enclosing target by lifting over extra
   parameters and premises.
 
   \<^descr> @{command (local) "end"} concludes the current local theory, according to
   the nesting of contexts. Note that a global @{command (global) "end"} has a
   different meaning: it concludes the theory itself (\secref{sec:begin-thy}).
 
   \<^descr> \<^theory_text>\<open>private\<close> or \<^theory_text>\<open>qualified\<close> may be given as modifiers before any local
   theory command. This restricts name space accesses to the local scope, as
   determined by the enclosing \<^theory_text>\<open>context begin \<dots> end\<close> block. Outside its scope,
   a \<^theory_text>\<open>private\<close> name is inaccessible, and a \<^theory_text>\<open>qualified\<close> name is only
   accessible with some qualification.
 
   Neither a global \<^theory_text>\<open>theory\<close> nor a \<^theory_text>\<open>locale\<close> target provides a local scope by
   itself: an extra unnamed context is required to use \<^theory_text>\<open>private\<close> or
   \<^theory_text>\<open>qualified\<close> here.
 
   \<^descr> \<open>(\<close>@{keyword_def "in"}~\<open>c)\<close> given after any local theory command specifies
   an immediate target, e.g.\ ``\<^theory_text>\<open>definition (in c)\<close>'' or
   ``\<^theory_text>\<open>theorem (in c)\<close>''. This works both in a local or global theory context;
   the current target context will be suspended for this command only. Note
   that ``\<^theory_text>\<open>(in -)\<close>'' will always produce a global result independently of the
   current target context.
 
 
   Any specification element that operates on \<open>local_theory\<close> according to this
   manual implicitly allows the above target syntax \<^theory_text>\<open>(in c)\<close>, but individual
   syntax diagrams omit that aspect for clarity.
 
   \<^medskip>
   The exact meaning of results produced within a local theory context depends
   on the underlying target infrastructure (locale, type class etc.). The
   general idea is as follows, considering a context named \<open>c\<close> with parameter
   \<open>x\<close> and assumption \<open>A[x]\<close>.
 
   Definitions are exported by introducing a global version with additional
   arguments; a syntactic abbreviation links the long form with the abstract
   version of the target context. For example, \<open>a \<equiv> t[x]\<close> becomes \<open>c.a ?x \<equiv>
   t[?x]\<close> at the theory level (for arbitrary \<open>?x\<close>), together with a local
   abbreviation \<open>a \<equiv> c.a x\<close> in the target context (for the fixed parameter
   \<open>x\<close>).
 
   Theorems are exported by discharging the assumptions and generalizing the
   parameters of the context. For example, \<open>a: B[x]\<close> becomes \<open>c.a: A[?x] \<Longrightarrow>
   B[?x]\<close>, again for arbitrary \<open>?x\<close>.
 \<close>
 
 
 section \<open>Bundled declarations \label{sec:bundle}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "bundle"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command "bundle"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_bundles"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "include"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "including"} & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{keyword_def "includes"} & : & syntax \\
   \end{matharray}
 
   The outer syntax of fact expressions (\secref{sec:syn-att}) involves
   theorems and attributes, which are evaluated in the context and applied to
   it. Attributes may declare theorems to the context, as in \<open>this_rule [intro]
   that_rule [elim]\<close> for example. Configuration options (\secref{sec:config})
   are special declaration attributes that operate on the context without a
   theorem, as in \<open>[[show_types = false]]\<close> for example.
 
   Expressions of this form may be defined as \<^emph>\<open>bundled declarations\<close> in the
   context, and included in other situations later on. Including declaration
   bundles augments a local context casually without logical dependencies,
   which is in contrast to locales and locale interpretation
   (\secref{sec:locale}).
 
   \<^rail>\<open>
     @@{command bundle} @{syntax name}
       ( '=' @{syntax thms} @{syntax for_fixes} | @'begin')
     ;
     @@{command print_bundles} ('!'?)
     ;
     (@@{command include} | @@{command including}) (@{syntax name}+)
     ;
     @{syntax_def "includes"}: @'includes' (@{syntax name}+)
     ;
     @{syntax_def "opening"}: @'opening' (@{syntax name}+)
     ;
     @@{command unbundle} (@{syntax name}+)
   \<close>
 
   \<^descr> \<^theory_text>\<open>bundle b = decls\<close> defines a bundle of declarations in the current
   context. The RHS is similar to the one of the \<^theory_text>\<open>declare\<close> command. Bundles
   defined in local theory targets are subject to transformations via
   morphisms, when moved into different application contexts; this works
   analogously to any other local theory specification.
 
   \<^descr> \<^theory_text>\<open>bundle b begin body end\<close> defines a bundle of declarations from the
   \<open>body\<close> of local theory specifications. It may consist of commands that are
   technically equivalent to \<^theory_text>\<open>declare\<close> or \<^theory_text>\<open>declaration\<close>, which also includes
   \<^theory_text>\<open>notation\<close>, for example. Named fact declarations like ``\<^theory_text>\<open>lemmas a [simp] =
   b\<close>'' or ``\<^theory_text>\<open>lemma a [simp]: B \<proof>\<close>'' are also admitted, but the name
   bindings are not recorded in the bundle.
 
   \<^descr> \<^theory_text>\<open>print_bundles\<close> prints the named bundles that are available in the
   current context; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> \<^theory_text>\<open>include b\<^sub>1 \<dots> b\<^sub>n\<close> activates the declarations from the given bundles
   in a proof body (forward mode). This is analogous to \<^theory_text>\<open>note\<close>
   (\secref{sec:proof-facts}) with the expanded bundles.
 
   \<^descr> \<^theory_text>\<open>including b\<^sub>1 \<dots> b\<^sub>n\<close> is similar to \<^theory_text>\<open>include\<close>, but works in proof refinement
   (backward mode). This is analogous to \<^theory_text>\<open>using\<close> (\secref{sec:proof-facts})
   with the expanded bundles.
 
   \<^descr> \<^theory_text>\<open>includes b\<^sub>1 \<dots> b\<^sub>n\<close> is similar to \<^theory_text>\<open>include\<close>, but applies to a
   confined specification context: unnamed \<^theory_text>\<open>context\<close>s and
   long statements of \<^theory_text>\<open>theorem\<close>.
 
   \<^descr> \<^theory_text>\<open>opening b\<^sub>1 \<dots> b\<^sub>n\<close> is similar to \<^theory_text>\<open>includes\<close>, but applies to
   a named specification context: \<^theory_text>\<open>locale\<close>s, \<^theory_text>\<open>class\<close>es and
   named \<^theory_text>\<open>context\<close>s. The effect is confined to the surface context within the
   specification block itself and the corresponding \<^theory_text>\<open>begin\<close> / \<^theory_text>\<open>end\<close> block.
 
   \<^descr> \<^theory_text>\<open>unbundle b\<^sub>1 \<dots> b\<^sub>n\<close> activates the declarations from the given bundles in
   the current local theory context. This is analogous to \<^theory_text>\<open>lemmas\<close>
   (\secref{sec:theorems}) with the expanded bundles.
 
 
   Here is an artificial example of bundling various configuration options:
 \<close>
 
 (*<*)experiment begin(*>*)
 bundle trace = [[simp_trace, linarith_trace, metis_trace, smt_trace]]
 
 lemma "x = x"
   including trace by metis
 (*<*)end(*>*)
 
 
 section \<open>Term definitions \label{sec:term-definitions}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "definition"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{attribute_def "defn"} & : & \<open>attribute\<close> \\
     @{command_def "print_defn_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "abbreviation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_abbrevs"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   Term definitions may either happen within the logic (as equational axioms of
   a certain form (see also \secref{sec:overloading}), or outside of it as
   rewrite system on abstract syntax. The second form is called
   ``abbreviation''.
 
   \<^rail>\<open>
     @@{command definition} decl? definition
     ;
     @@{command abbreviation} @{syntax mode}? decl? abbreviation
     ;
     @@{command print_abbrevs} ('!'?)
     ;
     decl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}? @'where'
     ;
     definition: @{syntax thmdecl}? @{syntax prop}
       @{syntax spec_prems} @{syntax for_fixes}
     ;
     abbreviation: @{syntax prop} @{syntax for_fixes}
   \<close>
 
   \<^descr> \<^theory_text>\<open>definition c where eq\<close> produces an internal definition \<open>c \<equiv> t\<close> according
   to the specification given as \<open>eq\<close>, which is then turned into a proven fact.
   The given proposition may deviate from internal meta-level equality
   according to the rewrite rules declared as @{attribute defn} by the
   object-logic. This usually covers object-level equality \<open>x = y\<close> and
   equivalence \<open>A \<longleftrightarrow> B\<close>. End-users normally need not change the @{attribute
   defn} setup.
 
   Definitions may be presented with explicit arguments on the LHS, as well as
   additional conditions, e.g.\ \<open>f x y = t\<close> instead of \<open>f \<equiv> \<lambda>x y. t\<close> and \<open>y \<noteq> 0
   \<Longrightarrow> g x y = u\<close> instead of an unrestricted \<open>g \<equiv> \<lambda>x y. u\<close>.
 
   \<^descr> \<^theory_text>\<open>print_defn_rules\<close> prints the definitional rewrite rules declared via
   @{attribute defn} in the current context.
 
   \<^descr> \<^theory_text>\<open>abbreviation c where eq\<close> introduces a syntactic constant which is
   associated with a certain term according to the meta-level equality \<open>eq\<close>.
 
   Abbreviations participate in the usual type-inference process, but are
   expanded before the logic ever sees them. Pretty printing of terms involves
   higher-order rewriting with rules stemming from reverted abbreviations. This
   needs some care to avoid overlapping or looping syntactic replacements!
 
   The optional \<open>mode\<close> specification restricts output to a particular print
   mode; using ``\<open>input\<close>'' here achieves the effect of one-way abbreviations.
   The mode may also include an ``\<^theory_text>\<open>output\<close>'' qualifier that affects the
   concrete syntax declared for abbreviations, cf.\ \<^theory_text>\<open>syntax\<close> in
   \secref{sec:syn-trans}.
 
   \<^descr> \<^theory_text>\<open>print_abbrevs\<close> prints all constant abbreviations of the current context;
   the ``\<open>!\<close>'' option indicates extra verbosity.
 \<close>
 
 
 section \<open>Axiomatizations \label{sec:axiomatizations}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "axiomatization"} & : & \<open>theory \<rightarrow> theory\<close> & (axiomatic!) \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command axiomatization} @{syntax vars}? (@'where' axiomatization)?
     ;
     axiomatization: (@{syntax thmdecl} @{syntax prop} + @'and')
       @{syntax spec_prems} @{syntax for_fixes}
   \<close>
 
   \<^descr> \<^theory_text>\<open>axiomatization c\<^sub>1 \<dots> c\<^sub>m where \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> introduces several constants
   simultaneously and states axiomatic properties for these. The constants are
   marked as being specified once and for all, which prevents additional
   specifications for the same constants later on, but it is always possible to
   emit axiomatizations without referring to particular constants. Note that
   lack of precise dependency tracking of axiomatizations may disrupt the
   well-formedness of an otherwise definitional theory.
 
   Axiomatization is restricted to a global theory context: support for local
   theory targets \secref{sec:target} would introduce an extra dimension of
   uncertainty what the written specifications really are, and make it
   infeasible to argue why they are correct.
 
   Axiomatic specifications are required when declaring a new logical system
   within Isabelle/Pure, but in an application environment like Isabelle/HOL
   the user normally stays within definitional mechanisms provided by the logic
   and its libraries.
 \<close>
 
 
 section \<open>Generic declarations\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "declaration"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "syntax_declaration"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "declare"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   Arbitrary operations on the background context may be wrapped-up as generic
   declaration elements. Since the underlying concept of local theories may be
   subject to later re-interpretation, there is an additional dependency on a
   morphism that tells the difference of the original declaration context wrt.\
   the application context encountered later on. A fact declaration is an
   important special case: it consists of a theorem which is applied to the
   context by means of an attribute.
 
   \<^rail>\<open>
     (@@{command declaration} | @@{command syntax_declaration})
       ('(' @'pervasive' ')')? \<newline> @{syntax text}
     ;
     @@{command declare} (@{syntax thms} + @'and')
   \<close>
 
   \<^descr> \<^theory_text>\<open>declaration d\<close> adds the declaration function \<open>d\<close> of ML type \<^ML_type>\<open>declaration\<close>, to the current local theory under construction. In later
   application contexts, the function is transformed according to the morphisms
   being involved in the interpretation hierarchy.
 
   If the \<^theory_text>\<open>(pervasive)\<close> option is given, the corresponding declaration is
   applied to all possible contexts involved, including the global background
   theory.
 
   \<^descr> \<^theory_text>\<open>syntax_declaration\<close> is similar to \<^theory_text>\<open>declaration\<close>, but is meant to affect
   only ``syntactic'' tools by convention (such as notation and type-checking
   information).
 
   \<^descr> \<^theory_text>\<open>declare thms\<close> declares theorems to the current local theory context. No
   theorem binding is involved here, unlike \<^theory_text>\<open>lemmas\<close> (cf.\
   \secref{sec:theorems}), so \<^theory_text>\<open>declare\<close> only has the effect of applying
   attributes as included in the theorem specification.
 \<close>
 
 
 section \<open>Locales \label{sec:locale}\<close>
 
 text \<open>
   A locale is a functor that maps parameters (including implicit type
   parameters) and a specification to a list of declarations. The syntax of
   locales is modeled after the Isar proof context commands (cf.\
   \secref{sec:proof-context}).
 
   Locale hierarchies are supported by maintaining a graph of dependencies
   between locale instances in the global theory. Dependencies may be
   introduced through import (where a locale is defined as sublocale of the
   imported instances) or by proving that an existing locale is a sublocale of
   one or several locale instances.
 
   A locale may be opened with the purpose of appending to its list of
   declarations (cf.\ \secref{sec:target}). When opening a locale declarations
   from all dependencies are collected and are presented as a local theory. In
   this process, which is called \<^emph>\<open>roundup\<close>, redundant locale instances are
   omitted. A locale instance is redundant if it is subsumed by an instance
   encountered earlier. A more detailed description of this process is
   available elsewhere @{cite Ballarin2014}.
 \<close>
 
 
 subsection \<open>Locale expressions \label{sec:locale-expr}\<close>
 
 text \<open>
   A \<^emph>\<open>locale expression\<close> denotes a context composed of instances of existing
   locales. The context consists of the declaration elements from the locale
   instances. Redundant locale instances are omitted according to roundup.
 
   \<^rail>\<open>
     @{syntax_def locale_expr}: (instance + '+') @{syntax for_fixes}
     ;
     instance: (qualifier ':')? @{syntax name} (pos_insts | named_insts) \<newline>
       rewrites?
     ;
     qualifier: @{syntax name} ('?')?
     ;
     pos_insts: ('_' | @{syntax term})*
     ;
     named_insts: @'where' (@{syntax name} '=' @{syntax term} + @'and')
     ;
     rewrites: @'rewrites' (@{syntax thmdecl}? @{syntax prop} + @'and')
   \<close>
 
   A locale instance consists of a reference to a locale and either positional
   or named parameter instantiations optionally followed by rewrites clauses.
   Identical instantiations (that is, those
   that instantiate a parameter by itself) may be omitted. The notation ``\<open>_\<close>''
   enables to omit the instantiation for a parameter inside a positional
   instantiation.
 
   Terms in instantiations are from the context the locale expressions is
   declared in. Local names may be added to this context with the optional
   \<^theory_text>\<open>for\<close> clause. This is useful for shadowing names bound in outer contexts,
   and for declaring syntax. In addition, syntax declarations from one instance
   are effective when parsing subsequent instances of the same expression.
 
   Instances have an optional qualifier which applies to names in declarations.
   Names include local definitions and theorem names. If present, the qualifier
   itself is either mandatory (default) or non-mandatory (when followed by
   ``\<^verbatim>\<open>?\<close>''). Non-mandatory means that the qualifier may be omitted on input.
   Qualifiers only affect name spaces; they play no role in determining whether
   one locale instance subsumes another.
 
   Rewrite clauses amend instances with equations that act as rewrite rules.
   This is particularly useful for changing concepts introduced through
   definitions. Rewrite clauses are available only in interpretation commands
   (see \secref{sec:locale-interpretation} below) and must be proved the user.
 \<close>
 
 
 subsection \<open>Locale declarations\<close>
 
 text \<open>
   \begin{tabular}{rcl}
     @{command_def "locale"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "experiment"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_locale"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_locales"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "locale_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{tabular}
 
-  \indexisarelem{fixes}\indexisarelem{constrains}\indexisarelem{assumes}
-  \indexisarelem{defines}\indexisarelem{notes}
+  @{index_ref \<open>\<^theory_text>\<open>fixes\<close> (element)\<close>}
+  @{index_ref \<open>\<^theory_text>\<open>constrains\<close> (element)\<close>}
+  @{index_ref \<open>\<^theory_text>\<open>assumes\<close> (element)\<close>}
+  @{index_ref \<open>\<^theory_text>\<open>defines\<close> (element)\<close>}
+  @{index_ref \<open>\<^theory_text>\<open>notes\<close> (element)\<close>}
   \<^rail>\<open>
     @@{command locale} @{syntax name} ('=' @{syntax locale})? @'begin'?
     ;
     @@{command experiment} (@{syntax context_elem}*) @'begin'
     ;
     @@{command print_locale} '!'? @{syntax name}
     ;
     @@{command print_locales} ('!'?)
     ;
     @{syntax_def locale}: @{syntax context_elem}+ |
       @{syntax_ref "opening"} ('+' (@{syntax context_elem}+))? |
       @{syntax locale_expr} @{syntax_ref "opening"}? ('+' (@{syntax context_elem}+))?
     ;
     @{syntax_def context_elem}:
       @'fixes' @{syntax vars} |
       @'constrains' (@{syntax name} '::' @{syntax type} + @'and') |
       @'assumes' (@{syntax props} + @'and') |
       @'defines' (@{syntax thmdecl}? @{syntax prop} @{syntax prop_pat}? + @'and') |
       @'notes' (@{syntax thmdef}? @{syntax thms} + @'and')
   \<close>
 
   \<^descr> \<^theory_text>\<open>locale loc = import opening bundles + body\<close> defines a new locale \<open>loc\<close>
   as a context consisting of a certain view of existing locales (\<open>import\<close>) plus some
   additional elements (\<open>body\<close>) with declaration \<open>bundles\<close> enriching the context
   of the command itself. All \<open>import\<close>, \<open>bundles\<close> and \<open>body\<close> are optional; the
   degenerate form \<^theory_text>\<open>locale loc\<close> defines an empty locale, which may still be
   useful to collect declarations of facts later on. Type-inference on locale
   expressions automatically takes care of the most general typing that the
   combined context elements may acquire.
 
   The \<open>import\<close> consists of a locale expression; see \secref{sec:locale-expr}
   above. Its \<^theory_text>\<open>for\<close> clause defines the parameters of \<open>import\<close>. These are
   parameters of the defined locale. Locale parameters whose instantiation is
   omitted automatically extend the (possibly empty) \<^theory_text>\<open>for\<close> clause: they are
   inserted at its beginning. This means that these parameters may be referred
   to from within the expression and also in the subsequent context elements
   and provides a notational convenience for the inheritance of parameters in
   locale declarations.
 
   Declarations from \<open>bundles\<close>, see \secref{sec:bundle}, are effective in the
   entire command including a subsequent \<^theory_text>\<open>begin\<close> / \<^theory_text>\<open>end\<close> block, but they do
   not contribute to the declarations stored in the locale.
 
   The \<open>body\<close> consists of context elements:
 
     \<^descr> @{element "fixes"}~\<open>x :: \<tau> (mx)\<close> declares a local parameter of type \<open>\<tau>\<close>
     and mixfix annotation \<open>mx\<close> (both are optional). The special syntax
     declaration ``\<open>(\<close>@{keyword_ref "structure"}\<open>)\<close>'' means that \<open>x\<close> may be
     referenced implicitly in this context.
 
     \<^descr> @{element "constrains"}~\<open>x :: \<tau>\<close> introduces a type constraint \<open>\<tau>\<close> on the
     local parameter \<open>x\<close>. This element is deprecated. The type constraint
     should be introduced in the \<^theory_text>\<open>for\<close> clause or the relevant @{element
     "fixes"} element.
 
     \<^descr> @{element "assumes"}~\<open>a: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> introduces local premises, similar
     to \<^theory_text>\<open>assume\<close> within a proof (cf.\ \secref{sec:proof-context}).
 
     \<^descr> @{element "defines"}~\<open>a: x \<equiv> t\<close> defines a previously declared parameter.
     This is similar to \<^theory_text>\<open>define\<close> within a proof (cf.\
     \secref{sec:proof-context}), but @{element "defines"} is restricted to
     Pure equalities and the defined variable needs to be declared beforehand
     via @{element "fixes"}. The left-hand side of the equation may have
     additional arguments, e.g.\ ``@{element "defines"}~\<open>f x\<^sub>1 \<dots> x\<^sub>n \<equiv> t\<close>'',
     which need to be free in the context.
 
     \<^descr> @{element "notes"}~\<open>a = b\<^sub>1 \<dots> b\<^sub>n\<close> reconsiders facts within a local
     context. Most notably, this may include arbitrary declarations in any
     attribute specifications included here, e.g.\ a local @{attribute simp}
     rule.
 
   Both @{element "assumes"} and @{element "defines"} elements contribute to
   the locale specification. When defining an operation derived from the
   parameters, \<^theory_text>\<open>definition\<close> (\secref{sec:term-definitions}) is usually more
   appropriate.
 
   Note that ``\<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close>'' patterns given in the syntax of @{element
   "assumes"} and @{element "defines"} above are illegal in locale definitions.
   In the long goal format of \secref{sec:goals}, term bindings may be included
   as expected, though.
 
   \<^medskip>
   Locale specifications are ``closed up'' by turning the given text into a
   predicate definition \<open>loc_axioms\<close> and deriving the original assumptions as
   local lemmas (modulo local definitions). The predicate statement covers only
   the newly specified assumptions, omitting the content of included locale
   expressions. The full cumulative view is only provided on export, involving
   another predicate \<open>loc\<close> that refers to the complete specification text.
 
   In any case, the predicate arguments are those locale parameters that
   actually occur in the respective piece of text. Also these predicates
   operate at the meta-level in theory, but the locale packages attempts to
   internalize statements according to the object-logic setup (e.g.\ replacing
   \<open>\<And>\<close> by \<open>\<forall>\<close>, and \<open>\<Longrightarrow>\<close> by \<open>\<longrightarrow>\<close> in HOL; see also \secref{sec:object-logic}).
   Separate introduction rules \<open>loc_axioms.intro\<close> and \<open>loc.intro\<close> are provided
   as well.
 
   \<^descr> \<^theory_text>\<open>experiment body begin\<close> opens an anonymous locale context with private
   naming policy. Specifications in its body are inaccessible from outside.
   This is useful to perform experiments, without polluting the name space.
 
   \<^descr> \<^theory_text>\<open>print_locale "locale"\<close> prints the contents of the named locale. The
   command omits @{element "notes"} elements by default. Use \<^theory_text>\<open>print_locale!\<close>
   to have them included.
 
   \<^descr> \<^theory_text>\<open>print_locales\<close> prints the names of all locales of the current theory;
   the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> \<^theory_text>\<open>locale_deps\<close> visualizes all locales and their relations as a Hasse
   diagram. This includes locales defined as type classes (\secref{sec:class}).
 \<close>
 
 
 subsection \<open>Locale interpretation \label{sec:locale-interpretation}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command "interpretation"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "interpret"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "global_interpretation"} & : & \<open>theory | local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "sublocale"} & : & \<open>theory | local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "print_interps"}\<open>\<^sup>*\<close> & :  & \<open>context \<rightarrow>\<close> \\
     @{method_def intro_locales} & : & \<open>method\<close> \\
     @{method_def unfold_locales} & : & \<open>method\<close> \\
     @{attribute_def trace_locales} & : & \mbox{\<open>attribute\<close> \quad default \<open>false\<close>} \\
   \end{matharray}
 
   Locales may be instantiated, and the resulting instantiated declarations
   added to the current context. This requires proof (of the instantiated
   specification) and is called \<^emph>\<open>locale interpretation\<close>. Interpretation is
   possible within arbitrary local theories (\<^theory_text>\<open>interpretation\<close>), within proof
   bodies (\<^theory_text>\<open>interpret\<close>), into global theories (\<^theory_text>\<open>global_interpretation\<close>) and
   into locales (\<^theory_text>\<open>sublocale\<close>).
 
   \<^rail>\<open>
     @@{command interpretation} @{syntax locale_expr}
     ;
     @@{command interpret} @{syntax locale_expr}
     ;
     @@{command global_interpretation} @{syntax locale_expr} definitions?
     ;
     @@{command sublocale} (@{syntax name} ('<' | '\<subseteq>'))? @{syntax locale_expr} \<newline>
       definitions?
     ;
     @@{command print_interps} @{syntax name}
     ;
 
     definitions: @'defines' (@{syntax thmdecl}? @{syntax name} \<newline>
       @{syntax mixfix}? '=' @{syntax term} + @'and');
   \<close>
 
   The core of each interpretation command is a locale expression \<open>expr\<close>; the
   command generates proof obligations for the instantiated specifications.
   Once these are discharged by the user, instantiated declarations (in
   particular, facts) are added to the context in a post-processing phase, in a
   manner specific to each command.
 
   Interpretation commands are aware of interpretations that are already
   active: post-processing is achieved through a variant of roundup that takes
   interpretations of the current global or local theory into account. In order
   to simplify the proof obligations according to existing interpretations use
   methods @{method intro_locales} or @{method unfold_locales}.
 
   Rewrites clauses \<^theory_text>\<open>rewrites eqns\<close> occur within expressions. They amend the
   morphism through which a locale instance is interpreted with rewrite rules,
   also called rewrite morphisms. This is particularly useful for interpreting
   concepts introduced through definitions. The equations must be proved the
   user. To enable syntax of the instantiated locale within the equation, while
   reading a locale expression, equations of a locale instance are read in a
   temporary context where the instance is already activated. If activation
   fails, typically due to duplicate constant declarations, processing falls
   back to reading the equation first.
 
   Given definitions \<open>defs\<close> produce corresponding definitions in the local
   theory's underlying target \<^emph>\<open>and\<close> amend the morphism with rewrite rules
   stemming from the symmetric of those definitions. Hence these need not be
   proved explicitly the user. Such rewrite definitions are a even more useful
   device for interpreting concepts introduced through definitions, but they
   are only supported for interpretation commands operating in a local theory
   whose implementing target actually supports this.  Note that despite
   the suggestive \<^theory_text>\<open>and\<close> connective, \<open>defs\<close>
   are processed sequentially without mutual recursion.
 
   \<^descr> \<^theory_text>\<open>interpretation expr\<close> interprets \<open>expr\<close> into a local theory
   such that its lifetime is limited to the current context block (e.g. a
   locale or unnamed context). At the closing @{command end} of the block the
   interpretation and its declarations disappear. Hence facts based on
   interpretation can be established without creating permanent links to the
   interpreted locale instances, as would be the case with @{command
   sublocale}.
 
   When used on the level of a global theory, there is no end of a current
   context block, hence \<^theory_text>\<open>interpretation\<close> behaves identically to
   \<^theory_text>\<open>global_interpretation\<close> then.
 
   \<^descr> \<^theory_text>\<open>interpret expr\<close> interprets \<open>expr\<close> into a proof context:
   the interpretation and its declarations disappear when closing the current
   proof block. Note that for \<^theory_text>\<open>interpret\<close> the \<open>eqns\<close> should be explicitly
   universally quantified.
 
   \<^descr> \<^theory_text>\<open>global_interpretation expr defines defs\<close> interprets \<open>expr\<close>
   into a global theory.
 
   When adding declarations to locales, interpreted versions of these
   declarations are added to the global theory for all interpretations in the
   global theory as well. That is, interpretations into global theories
   dynamically participate in any declarations added to locales.
 
   Free variables in the interpreted expression are allowed. They are turned
   into schematic variables in the generated declarations. In order to use a
   free variable whose name is already bound in the context --- for example,
   because a constant of that name exists --- add it to the \<^theory_text>\<open>for\<close> clause.
 
   \<^descr> \<^theory_text>\<open>sublocale name \<subseteq> expr defines defs\<close> interprets \<open>expr\<close>
   into the locale \<open>name\<close>. A proof that the specification of \<open>name\<close> implies the
   specification of \<open>expr\<close> is required. As in the localized version of the
   theorem command, the proof is in the context of \<open>name\<close>. After the proof
   obligation has been discharged, the locale hierarchy is changed as if \<open>name\<close>
   imported \<open>expr\<close> (hence the name \<^theory_text>\<open>sublocale\<close>). When the context of \<open>name\<close> is
   subsequently entered, traversing the locale hierarchy will involve the
   locale instances of \<open>expr\<close>, and their declarations will be added to the
   context. This makes \<^theory_text>\<open>sublocale\<close> dynamic: extensions of a locale that is
   instantiated in \<open>expr\<close> may take place after the \<^theory_text>\<open>sublocale\<close> declaration and
   still become available in the context. Circular \<^theory_text>\<open>sublocale\<close> declarations
   are allowed as long as they do not lead to infinite chains.
 
   If interpretations of \<open>name\<close> exist in the current global theory, the command
   adds interpretations for \<open>expr\<close> as well, with the same qualifier, although
   only for fragments of \<open>expr\<close> that are not interpreted in the theory already.
 
   Rewrites clauses in the expression or rewrite definitions \<open>defs\<close> can help break
   infinite chains induced by circular \<^theory_text>\<open>sublocale\<close> declarations.
 
   In a named context block the \<^theory_text>\<open>sublocale\<close> command may also be used, but the
   locale argument must be omitted. The command then refers to the locale (or
   class) target of the context block.
 
   \<^descr> \<^theory_text>\<open>print_interps name\<close> lists all interpretations of locale \<open>name\<close> in the
   current theory or proof context, including those due to a combination of an
   \<^theory_text>\<open>interpretation\<close> or \<^theory_text>\<open>interpret\<close> and one or several \<^theory_text>\<open>sublocale\<close>
   declarations.
 
   \<^descr> @{method intro_locales} and @{method unfold_locales} repeatedly expand all
   introduction rules of locale predicates of the theory. While @{method
   intro_locales} only applies the \<open>loc.intro\<close> introduction rules and therefore
   does not descend to assumptions, @{method unfold_locales} is more aggressive
   and applies \<open>loc_axioms.intro\<close> as well. Both methods are aware of locale
   specifications entailed by the context, both from target statements, and
   from interpretations (see below). New goals that are entailed by the current
   context are discharged automatically.
 
   While @{method unfold_locales} is part of the default method for \<^theory_text>\<open>proof\<close>
   and often invoked ``behind the scenes'', @{method intro_locales} helps
   understand which proof obligations originated from which locale instances.
   The latter method is useful while developing proofs but rare in finished
   developments.
 
   \<^descr> @{attribute trace_locales}, when set to \<open>true\<close>, prints the locale
   instances activated during roundup. Use this when locale commands yield
   obscure errors or for understanding local theories created by complex locale
   hierarchies.
 
   \begin{warn}
     If a global theory inherits declarations (body elements) for a locale from
     one parent and an interpretation of that locale from another parent, the
     interpretation will not be applied to the declarations.
   \end{warn}
 
   \begin{warn}
     Since attributes are applied to interpreted theorems, interpretation may
     modify the context of common proof tools, e.g.\ the Simplifier or
     Classical Reasoner. As the behaviour of such tools is \<^emph>\<open>not\<close> stable under
     interpretation morphisms, manual declarations might have to be added to
     the target context of the interpretation to revert such declarations.
   \end{warn}
 
   \begin{warn}
     An interpretation in a local theory or proof context may subsume previous
     interpretations. This happens if the same specification fragment is
     interpreted twice and the instantiation of the second interpretation is
     more general than the interpretation of the first. The locale package does
     not attempt to remove subsumed interpretations.
   \end{warn}
 
   \begin{warn}
     While \<^theory_text>\<open>interpretation (in c) \<dots>\<close> is admissible, it is not useful since
     its result is discarded immediately.
   \end{warn}
 \<close>
 
 
 section \<open>Classes \label{sec:class}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "class"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "instantiation"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "instance"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command "instance"} & : & \<open>theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "subclass"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_classes"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "class_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{method_def intro_classes} & : & \<open>method\<close> \\
   \end{matharray}
 
   A class is a particular locale with \<^emph>\<open>exactly one\<close> type variable \<open>\<alpha>\<close>. Beyond
   the underlying locale, a corresponding type class is established which is
   interpreted logically as axiomatic type class @{cite "Wenzel:1997:TPHOL"}
   whose logical content are the assumptions of the locale. Thus, classes
   provide the full generality of locales combined with the commodity of type
   classes (notably type-inference). See @{cite "isabelle-classes"} for a short
   tutorial.
 
   \<^rail>\<open>
     @@{command class} class_spec @'begin'?
     ;
     class_spec: @{syntax name} '='
       ((@{syntax name} @{syntax_ref "opening"}? '+' (@{syntax context_elem}+)) |
         @{syntax name} @{syntax_ref "opening"}? |
         @{syntax_ref "opening"}? '+' (@{syntax context_elem}+))
     ;
     @@{command instantiation} (@{syntax name} + @'and') '::' @{syntax arity} @'begin'
     ;
     @@{command instance} (() | (@{syntax name} + @'and') '::' @{syntax arity} |
       @{syntax name} ('<' | '\<subseteq>') @{syntax name} )
     ;
     @@{command subclass} @{syntax name}
     ;
     @@{command class_deps} (class_bounds class_bounds?)?
     ;
     class_bounds: @{syntax sort} | '(' (@{syntax sort} + @'|') ')'
   \<close>
 
   \<^descr> \<^theory_text>\<open>class c = superclasses bundles + body\<close> defines a new class \<open>c\<close>, inheriting from
   \<open>superclasses\<close>. This introduces a locale \<open>c\<close> with import of all locales
   \<open>superclasses\<close>.
 
   Any @{element "fixes"} in \<open>body\<close> are lifted to the global theory level
   (\<^emph>\<open>class operations\<close> \<open>f\<^sub>1, \<dots>, f\<^sub>n\<close> of class \<open>c\<close>), mapping the local type
   parameter \<open>\<alpha>\<close> to a schematic type variable \<open>?\<alpha> :: c\<close>.
 
   Likewise, @{element "assumes"} in \<open>body\<close> are also lifted, mapping each local
   parameter \<open>f :: \<tau>[\<alpha>]\<close> to its corresponding global constant \<open>f :: \<tau>[?\<alpha> ::
   c]\<close>. The corresponding introduction rule is provided as
   \<open>c_class_axioms.intro\<close>. This rule should be rarely needed directly --- the
   @{method intro_classes} method takes care of the details of class membership
   proofs.
 
   Optionally given \<open>bundles\<close> take effect in the surface context within the
   \<open>body\<close> and the potentially following \<^theory_text>\<open>begin\<close> / \<^theory_text>\<open>end\<close> block.
 
   \<^descr> \<^theory_text>\<open>instantiation t :: (s\<^sub>1, \<dots>, s\<^sub>n)s begin\<close> opens a target (cf.\
   \secref{sec:target}) which allows to specify class operations \<open>f\<^sub>1, \<dots>, f\<^sub>n\<close>
   corresponding to sort \<open>s\<close> at the particular type instance \<open>(\<alpha>\<^sub>1 :: s\<^sub>1, \<dots>,
   \<alpha>\<^sub>n :: s\<^sub>n) t\<close>. A plain \<^theory_text>\<open>instance\<close> command in the target body poses a goal
   stating these type arities. The target is concluded by an @{command_ref
   (local) "end"} command.
 
   Note that a list of simultaneous type constructors may be given; this
   corresponds nicely to mutually recursive type definitions, e.g.\ in
   Isabelle/HOL.
 
   \<^descr> \<^theory_text>\<open>instance\<close> in an instantiation target body sets up a goal stating the
   type arities claimed at the opening \<^theory_text>\<open>instantiation\<close>. The proof would
   usually proceed by @{method intro_classes}, and then establish the
   characteristic theorems of the type classes involved. After finishing the
   proof, the background theory will be augmented by the proven type arities.
 
   On the theory level, \<^theory_text>\<open>instance t :: (s\<^sub>1, \<dots>, s\<^sub>n)s\<close> provides a convenient
   way to instantiate a type class with no need to specify operations: one can
   continue with the instantiation proof immediately.
 
   \<^descr> \<^theory_text>\<open>subclass c\<close> in a class context for class \<open>d\<close> sets up a goal stating that
   class \<open>c\<close> is logically contained in class \<open>d\<close>. After finishing the proof,
   class \<open>d\<close> is proven to be subclass \<open>c\<close> and the locale \<open>c\<close> is interpreted
   into \<open>d\<close> simultaneously.
 
   A weakened form of this is available through a further variant of @{command
   instance}: \<^theory_text>\<open>instance c\<^sub>1 \<subseteq> c\<^sub>2\<close> opens a proof that class \<open>c\<^sub>2\<close> implies
   \<open>c\<^sub>1\<close> without reference to the underlying locales; this is useful if the
   properties to prove the logical connection are not sufficient on the locale
   level but on the theory level.
 
   \<^descr> \<^theory_text>\<open>print_classes\<close> prints all classes in the current theory.
 
   \<^descr> \<^theory_text>\<open>class_deps\<close> visualizes classes and their subclass relations as a
   directed acyclic graph. By default, all classes from the current theory
   context are show. This may be restricted by optional bounds as follows:
   \<^theory_text>\<open>class_deps upper\<close> or \<^theory_text>\<open>class_deps upper lower\<close>. A class is visualized, iff
   it is a subclass of some sort from \<open>upper\<close> and a superclass of some sort
   from \<open>lower\<close>.
 
   \<^descr> @{method intro_classes} repeatedly expands all class introduction rules of
   this theory. Note that this method usually needs not be named explicitly, as
   it is already included in the default proof step (e.g.\ of \<^theory_text>\<open>proof\<close>). In
   particular, instantiation of trivial (syntactic) classes may be performed by
   a single ``\<^theory_text>\<open>..\<close>'' proof step.
 \<close>
 
 
 subsection \<open>The class target\<close>
 
 text \<open>
   %FIXME check
 
   A named context may refer to a locale (cf.\ \secref{sec:target}). If this
   locale is also a class \<open>c\<close>, apart from the common locale target behaviour
   the following happens.
 
     \<^item> Local constant declarations \<open>g[\<alpha>]\<close> referring to the local type parameter
     \<open>\<alpha>\<close> and local parameters \<open>f[\<alpha>]\<close> are accompanied by theory-level constants
     \<open>g[?\<alpha> :: c]\<close> referring to theory-level class operations \<open>f[?\<alpha> :: c]\<close>.
 
     \<^item> Local theorem bindings are lifted as are assumptions.
 
     \<^item> Local syntax refers to local operations \<open>g[\<alpha>]\<close> and global operations
     \<open>g[?\<alpha> :: c]\<close> uniformly. Type inference resolves ambiguities. In rare
     cases, manual type annotations are needed.
 \<close>
 
 
 subsection \<open>Co-regularity of type classes and arities\<close>
 
 text \<open>
   The class relation together with the collection of type-constructor arities
   must obey the principle of \<^emph>\<open>co-regularity\<close> as defined below.
 
   \<^medskip>
   For the subsequent formulation of co-regularity we assume that the class
   relation is closed by transitivity and reflexivity. Moreover the collection
   of arities \<open>t :: (\<^vec>s)c\<close> is completed such that \<open>t :: (\<^vec>s)c\<close> and
   \<open>c \<subseteq> c'\<close> implies \<open>t :: (\<^vec>s)c'\<close> for all such declarations.
 
   Treating sorts as finite sets of classes (meaning the intersection), the
   class relation \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close> is extended to sorts as follows:
   \[
     \<open>s\<^sub>1 \<subseteq> s\<^sub>2 \<equiv> \<forall>c\<^sub>2 \<in> s\<^sub>2. \<exists>c\<^sub>1 \<in> s\<^sub>1. c\<^sub>1 \<subseteq> c\<^sub>2\<close>
   \]
 
   This relation on sorts is further extended to tuples of sorts (of the same
   length) in the component-wise way.
 
   \<^medskip>
   Co-regularity of the class relation together with the arities relation
   means:
   \[
     \<open>t :: (\<^vec>s\<^sub>1)c\<^sub>1 \<Longrightarrow> t :: (\<^vec>s\<^sub>2)c\<^sub>2 \<Longrightarrow> c\<^sub>1 \<subseteq> c\<^sub>2 \<Longrightarrow> \<^vec>s\<^sub>1 \<subseteq> \<^vec>s\<^sub>2\<close>
   \]
   for all such arities. In other words, whenever the result classes of some
   type-constructor arities are related, then the argument sorts need to be
   related in the same way.
 
   \<^medskip>
   Co-regularity is a very fundamental property of the order-sorted algebra of
   types. For example, it entails principal types and most general unifiers,
   e.g.\ see @{cite "nipkow-prehofer"}.
 \<close>
 
 
 section \<open>Overloaded constant definitions \label{sec:overloading}\<close>
 
 text \<open>
   Definitions essentially express abbreviations within the logic. The simplest
   form of a definition is \<open>c :: \<sigma> \<equiv> t\<close>, where \<open>c\<close> is a new constant and \<open>t\<close> is
   a closed term that does not mention \<open>c\<close>. Moreover, so-called \<^emph>\<open>hidden
   polymorphism\<close> is excluded: all type variables in \<open>t\<close> need to occur in its
   type \<open>\<sigma>\<close>.
 
   \<^emph>\<open>Overloading\<close> means that a constant being declared as \<open>c :: \<alpha> decl\<close> may be
   defined separately on type instances \<open>c :: (\<beta>\<^sub>1, \<dots>, \<beta>\<^sub>n)\<kappa> decl\<close> for each
   type constructor \<open>\<kappa>\<close>. At most occasions overloading will be used in a
   Haskell-like fashion together with type classes by means of \<^theory_text>\<open>instantiation\<close>
   (see \secref{sec:class}). Sometimes low-level overloading is desirable; this
   is supported by \<^theory_text>\<open>consts\<close> and \<^theory_text>\<open>overloading\<close> explained below.
 
   The right-hand side of overloaded definitions may mention overloaded
   constants recursively at type instances corresponding to the immediate
   argument types \<open>\<beta>\<^sub>1, \<dots>, \<beta>\<^sub>n\<close>. Incomplete specification patterns impose
   global constraints on all occurrences. E.g.\ \<open>d :: \<alpha> \<times> \<alpha>\<close> on the left-hand
   side means that all corresponding occurrences on some right-hand side need
   to be an instance of this, and general \<open>d :: \<alpha> \<times> \<beta>\<close> will be disallowed. Full
   details are given by Kun\v{c}ar @{cite "Kuncar:2015"}.
 
   \<^medskip>
   The \<^theory_text>\<open>consts\<close> command and the \<^theory_text>\<open>overloading\<close> target provide a convenient
   interface for end-users. Regular specification elements such as @{command
   definition}, @{command inductive}, @{command function} may be used in the
   body. It is also possible to use \<^theory_text>\<open>consts c :: \<sigma>\<close> with later \<^theory_text>\<open>overloading c
   \<equiv> c :: \<sigma>\<close> to keep the declaration and definition of a constant separate.
 
   \begin{matharray}{rcl}
     @{command_def "consts"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "overloading"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command consts} ((@{syntax name} '::' @{syntax type} @{syntax mixfix}?) +)
     ;
     @@{command overloading} ( spec + ) @'begin'
     ;
     spec: @{syntax name} ( '\<equiv>' | '==' ) @{syntax term} ( '(' @'unchecked' ')' )?
   \<close>
 
   \<^descr> \<^theory_text>\<open>consts c :: \<sigma>\<close> declares constant \<open>c\<close> to have any instance of type scheme
   \<open>\<sigma>\<close>. The optional mixfix annotations may attach concrete syntax to the
   constants declared.
 
   \<^descr> \<^theory_text>\<open>overloading x\<^sub>1 \<equiv> c\<^sub>1 :: \<tau>\<^sub>1 \<dots> x\<^sub>n \<equiv> c\<^sub>n :: \<tau>\<^sub>n begin \<dots> end\<close> defines
   a theory target (cf.\ \secref{sec:target}) which allows to specify already
   declared constants via definitions in the body. These are identified by an
   explicitly given mapping from variable names \<open>x\<^sub>i\<close> to constants \<open>c\<^sub>i\<close> at
   particular type instances. The definitions themselves are established using
   common specification tools, using the names \<open>x\<^sub>i\<close> as reference to the
   corresponding constants.
 
   Option \<^theory_text>\<open>(unchecked)\<close> disables global dependency checks for the
   corresponding definition, which is occasionally useful for exotic
   overloading; this is a form of axiomatic specification. It is at the
   discretion of the user to avoid malformed theory specifications!
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 consts Length :: "'a \<Rightarrow> nat"
 
 overloading
   Length\<^sub>0 \<equiv> "Length :: unit \<Rightarrow> nat"
   Length\<^sub>1 \<equiv> "Length :: 'a \<times> unit \<Rightarrow> nat"
   Length\<^sub>2 \<equiv> "Length :: 'a \<times> 'b \<times> unit \<Rightarrow> nat"
   Length\<^sub>3 \<equiv> "Length :: 'a \<times> 'b \<times> 'c \<times> unit \<Rightarrow> nat"
 begin
 
 fun Length\<^sub>0 :: "unit \<Rightarrow> nat" where "Length\<^sub>0 () = 0"
 fun Length\<^sub>1 :: "'a \<times> unit \<Rightarrow> nat" where "Length\<^sub>1 (a, ()) = 1"
 fun Length\<^sub>2 :: "'a \<times> 'b \<times> unit \<Rightarrow> nat" where "Length\<^sub>2 (a, b, ()) = 2"
 fun Length\<^sub>3 :: "'a \<times> 'b \<times> 'c \<times> unit \<Rightarrow> nat" where "Length\<^sub>3 (a, b, c, ()) = 3"
 
 end
 
 lemma "Length (a, b, c, ()) = 3" by simp
 lemma "Length ((a, b), (c, d), ()) = 2" by simp
 lemma "Length ((a, b, c, d, e), ()) = 1" by simp
 
 
 section \<open>Incorporating ML code \label{sec:ML}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "SML_file"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "SML_file_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "SML_file_no_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_file"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_file_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_file_no_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_export"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_prf"} & : & \<open>proof \<rightarrow> proof\<close> \\
     @{command_def "ML_val"} & : & \<open>any \<rightarrow>\<close> \\
     @{command_def "ML_command"} & : & \<open>any \<rightarrow>\<close> \\
     @{command_def "setup"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "local_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "attribute_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
   \begin{tabular}{rcll}
     @{attribute_def ML_print_depth} & : & \<open>attribute\<close> & default 10 \\
     @{attribute_def ML_source_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_debugger} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_exception_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_exception_debugger} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_environment} & : & \<open>attribute\<close> & default \<open>Isabelle\<close> \\
   \end{tabular}
 
   \<^rail>\<open>
     (@@{command SML_file} |
       @@{command SML_file_debug} |
       @@{command SML_file_no_debug} |
       @@{command ML_file} |
       @@{command ML_file_debug} |
       @@{command ML_file_no_debug}) @{syntax name} ';'?
     ;
     (@@{command ML} | @@{command ML_export} | @@{command ML_prf} |
       @@{command ML_val} | @@{command ML_command} | @@{command setup} |
       @@{command local_setup}) @{syntax text}
     ;
     @@{command attribute_setup} @{syntax name} '=' @{syntax text} @{syntax text}?
   \<close>
 
   \<^descr> \<^theory_text>\<open>SML_file name\<close> reads and evaluates the given Standard ML file. Top-level
   SML bindings are stored within the (global or local) theory context; the
   initial environment is restricted to the Standard ML implementation of
   Poly/ML, without the many add-ons of Isabelle/ML. Multiple \<^theory_text>\<open>SML_file\<close>
   commands may be used to build larger Standard ML projects, independently of
   the regular Isabelle/ML environment.
 
   \<^descr> \<^theory_text>\<open>ML_file name\<close> reads and evaluates the given ML file. The current theory
   context is passed down to the ML toplevel and may be modified, using \<^ML>\<open>Context.>>\<close> or derived ML commands. Top-level ML bindings are stored
   within the (global or local) theory context.
 
   \<^descr> \<^theory_text>\<open>SML_file_debug\<close>, \<^theory_text>\<open>SML_file_no_debug\<close>, \<^theory_text>\<open>ML_file_debug\<close>, and
   \<^theory_text>\<open>ML_file_no_debug\<close> change the @{attribute ML_debugger} option locally while
   the given file is compiled.
 
   \<^descr> \<^theory_text>\<open>ML\<close> is similar to \<^theory_text>\<open>ML_file\<close>, but evaluates directly the given \<open>text\<close>.
   Top-level ML bindings are stored within the (global or local) theory
   context.
 
   \<^descr> \<^theory_text>\<open>ML_export\<close> is similar to \<^theory_text>\<open>ML\<close>, but the resulting toplevel bindings are
   exported to the global bootstrap environment of the ML process --- it has
   a lasting effect that cannot be retracted. This allows ML evaluation
   without a formal theory context, e.g. for command-line tools via @{tool
   process} @{cite "isabelle-system"}.
 
   \<^descr> \<^theory_text>\<open>ML_prf\<close> is analogous to \<^theory_text>\<open>ML\<close> but works within a proof context.
   Top-level ML bindings are stored within the proof context in a purely
   sequential fashion, disregarding the nested proof structure. ML bindings
   introduced by \<^theory_text>\<open>ML_prf\<close> are discarded at the end of the proof.
 
   \<^descr> \<^theory_text>\<open>ML_val\<close> and \<^theory_text>\<open>ML_command\<close> are diagnostic versions of \<^theory_text>\<open>ML\<close>, which means
   that the context may not be updated. \<^theory_text>\<open>ML_val\<close> echos the bindings produced
   at the ML toplevel, but \<^theory_text>\<open>ML_command\<close> is silent.
 
   \<^descr> \<^theory_text>\<open>setup "text"\<close> changes the current theory context by applying \<open>text\<close>,
   which refers to an ML expression of type \<^ML_type>\<open>theory -> theory\<close>. This
   enables to initialize any object-logic specific tools and packages written
   in ML, for example.
 
   \<^descr> \<^theory_text>\<open>local_setup\<close> is similar to \<^theory_text>\<open>setup\<close> for a local theory context, and an
   ML expression of type \<^ML_type>\<open>local_theory -> local_theory\<close>. This allows
   to invoke local theory specification packages without going through concrete
   outer syntax, for example.
 
   \<^descr> \<^theory_text>\<open>attribute_setup name = "text" description\<close> defines an attribute in the
   current context. The given \<open>text\<close> has to be an ML expression of type
   \<^ML_type>\<open>attribute context_parser\<close>, cf.\ basic parsers defined in
   structure \<^ML_structure>\<open>Args\<close> and \<^ML_structure>\<open>Attrib\<close>.
 
   In principle, attributes can operate both on a given theorem and the
   implicit context, although in practice only one is modified and the other
   serves as parameter. Here are examples for these two cases:
 \<close>
 
 (*<*)experiment begin(*>*)
         attribute_setup my_rule =
           \<open>Attrib.thms >> (fn ths =>
             Thm.rule_attribute ths
               (fn context: Context.generic => fn th: thm =>
                 let val th' = th OF ths
                 in th' end))\<close>
 
         attribute_setup my_declaration =
           \<open>Attrib.thms >> (fn ths =>
             Thm.declaration_attribute
               (fn th: thm => fn context: Context.generic =>
                 let val context' = context
                 in context' end))\<close>
 (*<*)end(*>*)
 
 text \<open>
   \<^descr> @{attribute ML_print_depth} controls the printing depth of the ML toplevel
   pretty printer. Typically the limit should be less than 10. Bigger values
   such as 100--1000 are occasionally useful for debugging.
 
   \<^descr> @{attribute ML_source_trace} indicates whether the source text that is
   given to the ML compiler should be output: it shows the raw Standard ML
   after expansion of Isabelle/ML antiquotations.
 
   \<^descr> @{attribute ML_debugger} controls compilation of sources with or without
   debugging information. The global system option @{system_option_ref
   ML_debugger} does the same when building a session image. It is also
   possible use commands like \<^theory_text>\<open>ML_file_debug\<close> etc. The ML debugger is
   explained further in @{cite "isabelle-jedit"}.
 
   \<^descr> @{attribute ML_exception_trace} indicates whether the ML run-time system
   should print a detailed stack trace on exceptions. The result is dependent
   on various ML compiler optimizations. The boundary for the exception trace
   is the current Isar command transactions: it is occasionally better to
   insert the combinator \<^ML>\<open>Runtime.exn_trace\<close> into ML code for debugging
   @{cite "isabelle-implementation"}, closer to the point where it actually
   happens.
 
   \<^descr> @{attribute ML_exception_debugger} controls detailed exception trace via
   the Poly/ML debugger, at the cost of extra compile-time and run-time
   overhead. Relevant ML modules need to be compiled beforehand with debugging
   enabled, see @{attribute ML_debugger} above.
 
   \<^descr> @{attribute ML_environment} determines the named ML environment for
   toplevel declarations, e.g.\ in command \<^theory_text>\<open>ML\<close> or \<^theory_text>\<open>ML_file\<close>. The following
   ML environments are predefined in Isabelle/Pure:
 
     \<^item> \<open>Isabelle\<close> for Isabelle/ML. It contains all modules of Isabelle/Pure and
     further add-ons, e.g. material from Isabelle/HOL.
 
     \<^item> \<open>SML\<close> for official Standard ML. It contains only the initial basis
     according to \<^url>\<open>http://sml-family.org/Basis/overview.html\<close>.
 
   The Isabelle/ML function \<^ML>\<open>ML_Env.setup\<close> defines a new ML environment.
   This is useful to incorporate big SML projects in an isolated name space,
   possibly with variations on ML syntax; the existing setup of
   \<^ML>\<open>ML_Env.SML_operations\<close> follows the official standard.
 
   It is also possible to move toplevel bindings between ML environments, using
   a notation with ``\<open>>\<close>'' as separator. For example:
 \<close>
 
 (*<*)experiment begin(*>*)
         declare [[ML_environment = "Isabelle>SML"]]
         ML \<open>val println = writeln\<close>
 
         declare [[ML_environment = "SML"]]
         ML \<open>println "test"\<close>
 
         declare [[ML_environment = "Isabelle"]]
         ML \<open>ML \<open>println\<close> (*bad*) handle ERROR msg => warning msg\<close>
 (*<*)end(*>*)
 
 
 section \<open>Generated files and exported files\<close>
 
 text \<open>
   Write access to the physical file-system is incompatible with the stateless
   model of processing Isabelle documents. To avoid bad effects, the following
   concepts for abstract file-management are provided by Isabelle:
 
     \<^descr>[Generated files] are stored within the theory context in Isabelle/ML.
     This allows to operate on the content in Isabelle/ML, e.g. via the command
     @{command compile_generated_files}.
 
     \<^descr>[Exported files] are stored within the session database in
     Isabelle/Scala. This allows to deliver artefacts to external tools, see
     also @{cite "isabelle-system"} for session \<^verbatim>\<open>ROOT\<close> declaration
     \<^theory_text>\<open>export_files\<close>, and @{tool build} option \<^verbatim>\<open>-e\<close>.
 
   A notable example is the command @{command_ref export_code}
   (\chref{ch:export-code}): it uses both concepts simultaneously.
 
   File names are hierarchically structured, using a slash as separator. The
   (long) theory name is used as a prefix: the resulting name needs to be
   globally unique.
 
   \begin{matharray}{rcll}
     @{command_def "generate_file"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "export_generated_files"} & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "compile_generated_files"} & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "external_file"} & : & \<open>any \<rightarrow> any\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command generate_file} path '=' content
     ;
     path: @{syntax embedded}
     ;
     content: @{syntax embedded}
     ;
     @@{command export_generated_files} (files_in_theory + @'and')
     ;
     files_in_theory: (@'_' | (path+)) (('(' @'in' @{syntax name} ')')?)
     ;
     @@{command compile_generated_files} (files_in_theory + @'and') \<newline>
       (@'external_files' (external_files + @'and'))? \<newline>
       (@'export_files' (export_files + @'and'))? \<newline>
       (@'export_prefix' path)?
     ;
     external_files: (path+) (('(' @'in' path ')')?)
     ;
     export_files: (path+) (executable?)
     ;
     executable: '(' ('exe' | 'executable') ')'
     ;
     @@{command external_file} @{syntax name} ';'?
   \<close>
 
   \<^descr> \<^theory_text>\<open>generate_file path = content\<close> augments the table of generated files
   within the current theory by a new entry: duplicates are not allowed. The
   name extension determines a pre-existent file-type; the \<open>content\<close> is a
   string that is preprocessed according to rules of this file-type.
 
   For example, Isabelle/Pure supports \<^verbatim>\<open>.hs\<close> as file-type for Haskell:
   embedded cartouches are evaluated as Isabelle/ML expressions of type
   \<^ML_type>\<open>string\<close>, the result is inlined in Haskell string syntax.
 
   \<^descr> \<^theory_text>\<open>export_generated_files paths (in thy)\<close> retrieves named generated files
   from the given theory (that needs be reachable via imports of the current
   one). By default, the current theory node is used. Using ``\<^verbatim>\<open>_\<close>''
   (underscore) instead of explicit path names refers to \emph{all} files of a
   theory node.
 
   The overall list of files is prefixed with the respective (long) theory name
   and exported to the session database. In Isabelle/jEdit the result can be
   browsed via the virtual file-system with prefix ``\<^verbatim>\<open>isabelle-export:\<close>''
   (using the regular file-browser).
 
   \<^descr> \<^theory_text>\<open>compile_generated_files paths (in thy) where compile_body\<close> retrieves
   named generated files as for \<^theory_text>\<open>export_generated_files\<close> and writes them into
   a temporary directory, such that the \<open>compile_body\<close> may operate on them as
   an ML function of type \<^ML_type>\<open>Path.T -> unit\<close>. This may create further
   files, e.g.\ executables produced by a compiler that is invoked as external
   process (e.g.\ via \<^ML>\<open>Isabelle_System.bash\<close>), or any other files.
 
   The option ``\<^theory_text>\<open>external_files paths (in base_dir)\<close>'' copies files from the
   physical file-system into the temporary directory, \emph{before} invoking
   \<open>compile_body\<close>. The \<open>base_dir\<close> prefix is removed from each of the \<open>paths\<close>,
   but the remaining sub-directory structure is reconstructed in the target
   directory.
 
   The option ``\<^theory_text>\<open>export_files paths\<close>'' exports the specified files from the
   temporary directory to the session database, \emph{after} invoking
   \<open>compile_body\<close>. Entries may be decorated with ``\<^theory_text>\<open>(exe)\<close>'' to say that it is
   a platform-specific executable program: the executable file-attribute will
   be set, and on Windows the \<^verbatim>\<open>.exe\<close> file-extension will be included;
   ``\<^theory_text>\<open>(executable)\<close>'' only refers to the file-attribute, without special
   treatment of the \<^verbatim>\<open>.exe\<close> extension.
 
   The option ``\<^theory_text>\<open>export_prefix path\<close>'' specifies an extra path prefix for all
   exports of \<^theory_text>\<open>export_files\<close> above.
 
   \<^descr> \<^theory_text>\<open>external_file name\<close> declares the formal dependency on the given file
   name, such that the Isabelle build process knows about it (see also @{cite
   "isabelle-system"}). This is required for any files mentioned in
   \<^theory_text>\<open>compile_generated_files / external_files\<close> above, in order to document
   source dependencies properly. It is also possible to use \<^theory_text>\<open>external_file\<close>
   alone, e.g.\ when other Isabelle/ML tools use \<^ML>\<open>File.read\<close>, without
   specific management of content by the Prover IDE.
 \<close>
 
 
 section \<open>Primitive specification elements\<close>
 
 subsection \<open>Sorts\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "default_sort"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
   \end{matharray}
 
   \<^rail>\<open>
     @@{command default_sort} @{syntax sort}
   \<close>
 
   \<^descr> \<^theory_text>\<open>default_sort s\<close> makes sort \<open>s\<close> the new default sort for any type
   variable that is given explicitly in the text, but lacks a sort constraint
   (wrt.\ the current context). Type variables generated by type inference are
   not affected.
 
   Usually the default sort is only changed when defining a new object-logic.
   For example, the default sort in Isabelle/HOL is \<^class>\<open>type\<close>, the class of
   all HOL types.
 
   When merging theories, the default sorts of the parents are logically
   intersected, i.e.\ the representations as lists of classes are joined.
 \<close>
 
 
 subsection \<open>Types \label{sec:types-pure}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "type_synonym"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "typedecl"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command type_synonym} (@{syntax typespec} '=' @{syntax type} @{syntax mixfix}?)
     ;
     @@{command typedecl} @{syntax typespec} @{syntax mixfix}?
   \<close>
 
   \<^descr> \<^theory_text>\<open>type_synonym (\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n) t = \<tau>\<close> introduces a \<^emph>\<open>type synonym\<close> \<open>(\<alpha>\<^sub>1, \<dots>,
   \<alpha>\<^sub>n) t\<close> for the existing type \<open>\<tau>\<close>. Unlike the semantic type definitions in
   Isabelle/HOL, type synonyms are merely syntactic abbreviations without any
   logical significance. Internally, type synonyms are fully expanded.
 
   \<^descr> \<^theory_text>\<open>typedecl (\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n) t\<close> declares a new type constructor \<open>t\<close>. If the
   object-logic defines a base sort \<open>s\<close>, then the constructor is declared to
   operate on that, via the axiomatic type-class instance \<open>t :: (s, \<dots>, s)s\<close>.
 
 
   \begin{warn}
     If you introduce a new type axiomatically, i.e.\ via @{command_ref
     typedecl} and @{command_ref axiomatization}
     (\secref{sec:axiomatizations}), the minimum requirement is that it has a
     non-empty model, to avoid immediate collapse of the logical environment.
     Moreover, one needs to demonstrate that the interpretation of such
     free-form axiomatizations can coexist with other axiomatization schemes
     for types, notably @{command_def typedef} in Isabelle/HOL
     (\secref{sec:hol-typedef}), or any other extension that people might have
     introduced elsewhere.
   \end{warn}
 \<close>
 
 
 section \<open>Naming existing theorems \label{sec:theorems}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "lemmas"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "named_theorems"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command lemmas} (@{syntax thmdef}? @{syntax thms} + @'and')
       @{syntax for_fixes}
     ;
     @@{command named_theorems} (@{syntax name} @{syntax text}? + @'and')
   \<close>
 
   \<^descr> \<^theory_text>\<open>lemmas a = b\<^sub>1 \<dots> b\<^sub>n\<close>~@{keyword_def "for"}~\<open>x\<^sub>1 \<dots> x\<^sub>m\<close> evaluates given
   facts (with attributes) in the current context, which may be augmented by
   local variables. Results are standardized before being stored, i.e.\
   schematic variables are renamed to enforce index \<open>0\<close> uniformly.
 
   \<^descr> \<^theory_text>\<open>named_theorems name description\<close> declares a dynamic fact within the
   context. The same \<open>name\<close> is used to define an attribute with the usual
   \<open>add\<close>/\<open>del\<close> syntax (e.g.\ see \secref{sec:simp-rules}) to maintain the
   content incrementally, in canonical declaration order of the text structure.
 \<close>
 
 
 section \<open>Oracles \label{sec:oracles}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "oracle"} & : & \<open>theory \<rightarrow> theory\<close> & (axiomatic!) \\
     @{command_def "thm_oracles"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   Oracles allow Isabelle to take advantage of external reasoners such as
   arithmetic decision procedures, model checkers, fast tautology checkers or
   computer algebra systems. Invoked as an oracle, an external reasoner can
   create arbitrary Isabelle theorems.
 
   It is the responsibility of the user to ensure that the external reasoner is
   as trustworthy as the application requires. Another typical source of errors
   is the linkup between Isabelle and the external tool, not just its concrete
   implementation, but also the required translation between two different
   logical environments.
 
   Isabelle merely guarantees well-formedness of the propositions being
   asserted, and records within the internal derivation object how presumed
   theorems depend on unproven suppositions. This also includes implicit
   type-class reasoning via the order-sorted algebra of class relations and
   type arities (see also @{command_ref instantiation} and @{command_ref
   instance}).
 
   \<^rail>\<open>
     @@{command oracle} @{syntax name} '=' @{syntax text}
     ;
     @@{command thm_oracles} @{syntax thms}
   \<close>
 
   \<^descr> \<^theory_text>\<open>oracle name = "text"\<close> turns the given ML expression \<open>text\<close> of type
   \<^ML_text>\<open>'a -> cterm\<close> into an ML function of type \<^ML_text>\<open>'a -> thm\<close>,
   which is bound to the global identifier \<^ML_text>\<open>name\<close>. This acts like an
   infinitary specification of axioms! Invoking the oracle only works within
   the scope of the resulting theory.
 
   See \<^file>\<open>~~/src/HOL/Examples/Iff_Oracle.thy\<close> for a worked example of defining
   a new primitive rule as oracle, and turning it into a proof method.
 
   \<^descr> \<^theory_text>\<open>thm_oracles thms\<close> displays all oracles used in the internal derivation
   of the given theorems; this covers the full graph of transitive
   dependencies.
 \<close>
 
 
 section \<open>Name spaces\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "alias"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "type_alias"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "hide_class"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "hide_type"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "hide_const"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "hide_fact"} & : & \<open>theory \<rightarrow> theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@{command alias} | @{command type_alias}) @{syntax name} '=' @{syntax name}
     ;
     (@{command hide_class} | @{command hide_type} |
       @{command hide_const} | @{command hide_fact}) ('(' @'open' ')')? (@{syntax name} + )
   \<close>
 
   Isabelle organizes any kind of name declarations (of types, constants,
   theorems etc.) by separate hierarchically structured name spaces. Normally
   the user does not have to control the behaviour of name spaces by hand, yet
   the following commands provide some way to do so.
 
   \<^descr> \<^theory_text>\<open>alias\<close> and \<^theory_text>\<open>type_alias\<close> introduce aliases for constants and type
   constructors, respectively. This allows adhoc changes to name-space
   accesses.
 
   \<^descr> \<^theory_text>\<open>type_alias b = c\<close> introduces an alias for an existing type constructor.
 
   \<^descr> \<^theory_text>\<open>hide_class names\<close> fully removes class declarations from a given name
   space; with the \<open>(open)\<close> option, only the unqualified base name is hidden.
 
   Note that hiding name space accesses has no impact on logical declarations
   --- they remain valid internally. Entities that are no longer accessible to
   the user are printed with the special qualifier ``\<open>??\<close>'' prefixed to the
   full internal name.
 
   \<^descr> \<^theory_text>\<open>hide_type\<close>, \<^theory_text>\<open>hide_const\<close>, and \<^theory_text>\<open>hide_fact\<close> are similar to
   \<^theory_text>\<open>hide_class\<close>, but hide types, constants, and facts, respectively.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Symbols.thy b/src/Doc/Isar_Ref/Symbols.thy
--- a/src/Doc/Isar_Ref/Symbols.thy
+++ b/src/Doc/Isar_Ref/Symbols.thy
@@ -1,40 +1,40 @@
 (*:maxLineLen=78:*)
 
 theory Symbols
   imports Main Base
 begin
 
 chapter \<open>Predefined Isabelle symbols \label{app:symbols}\<close>
 
 text \<open>
   Isabelle supports an infinite number of non-ASCII symbols, which are
   represented in source text as \<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>name\<close>\<^verbatim>\<open>>\<close> (where \<open>name\<close> may be any identifier).  It
   is left to front-end tools how to present these symbols to the user.
   The collection of predefined standard symbols given below is
   available by default for Isabelle document output, due to
   appropriate definitions of \<^verbatim>\<open>\isasym\<close>\<open>name\<close> for each \<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>name\<close>\<^verbatim>\<open>>\<close> in
   the \<^verbatim>\<open>isabellesym.sty\<close> file.  Most of these symbols
   are displayed properly in Isabelle/jEdit and {\LaTeX} generated from Isabelle.
 
   Moreover, any single symbol (or ASCII character) may be prefixed by
   \<^verbatim>\<open>\<^sup>\<close> for superscript and \<^verbatim>\<open>\<^sub>\<close> for subscript,
   such as \<^verbatim>\<open>A\<^sup>\<star>\<close> for \<open>A\<^sup>\<star>\<close> and \<^verbatim>\<open>A\<^sub>1\<close> for
   \<open>A\<^sub>1\<close>.  Sub- and superscripts that span a region of text can
   be marked up with \<^verbatim>\<open>\<^bsub>\<close>\<open>\<dots>\<close>\<^verbatim>\<open>\<^esub>\<close> and \<^verbatim>\<open>\<^bsup>\<close>\<open>\<dots>\<close>\<^verbatim>\<open>\<^esup>\<close>
   respectively, but note that there are limitations in the typographic
   rendering quality of this form.  Furthermore, all ASCII characters
   and most other symbols may be printed in bold by prefixing
   \<^verbatim>\<open>\<^bold>\<close> such as \<^verbatim>\<open>\<^bold>\<alpha>\<close> for \<open>\<^bold>\<alpha>\<close>.  Note that
   \<^verbatim>\<open>\<^sup>\<close>, \<^verbatim>\<open>\<^sub>\<close>, \<^verbatim>\<open>\<^bold>\<close> cannot be combined.
 
   Further details of Isabelle document preparation are covered in
   \chref{ch:document-prep}.
 
   \begin{center}
   \begin{isabellebody}
-  \input{syms}  
+  @{show_symbols}
   \end{isabellebody}
   \end{center}
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/document/build b/src/Doc/Isar_Ref/document/build
deleted file mode 100755
--- a/src/Doc/Isar_Ref/document/build
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo Isar
-./showsymbols "$ISABELLE_HOME/lib/texinputs/isabellesym.sty" > syms.tex
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Isar_Ref/document/root.tex b/src/Doc/Isar_Ref/document/root.tex
--- a/src/Doc/Isar_Ref/document/root.tex
+++ b/src/Doc/Isar_Ref/document/root.tex
@@ -1,99 +1,99 @@
 \documentclass[12pt,a4paper,fleqn]{report}
 \usepackage[T1]{fontenc}
 \usepackage{textcomp}
 \usepackage{amsmath}
 \usepackage{amssymb}
 \usepackage{wasysym}
 \usepackage{eurosym}
 \usepackage{pifont}
 \usepackage[english]{babel}
 \usepackage[only,bigsqcap,fatsemi,interleave,sslash]{stmaryrd}
 \usepackage{graphicx}
 \let\intorig=\int  %iman.sty redefines \int
 \usepackage{iman,extra,isar,proof}
 \usepackage[nohyphen,strings]{underscore}
 \usepackage{isabelle}
 \usepackage{isabellesym}
 \usepackage{railsetup}
 \usepackage{supertabular}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 
 \isadroptag{theory}
-\title{\includegraphics[scale=0.5]{isabelle_isar} \\[4ex] The Isabelle/Isar Reference Manual}
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex] The Isabelle/Isar Reference Manual}
 \author{\emph{Makarius Wenzel} \\[3ex]
   With Contributions by
   Clemens Ballarin,
   Stefan Berghofer, \\
   Jasmin Blanchette,
   Timothy Bourke,
   Lukas Bulwahn, \\
   Amine Chaieb,
   Lucas Dixon,
   Florian Haftmann, \\
   Brian Huffman,
   Lars Hupel,
   Gerwin Klein, \\
   Alexander Krauss,
   Ond\v{r}ej Kun\v{c}ar,
   Andreas Lochbihler, \\
   Tobias Nipkow,
   Lars Noschinski,
   David von Oheimb, \\
   Larry Paulson,
   Sebastian Skalberg, \\
   Christian Sternagel,
   Dmitriy Traytel
 }
 
 \makeindex
 
 \chardef\charbackquote=`\`
 \newcommand{\backquote}{\mbox{\tt\charbackquote}}
 
 
 \begin{document}
 
 \maketitle 
 
 \pagenumbering{roman}
 \chapter*{Preface}
 \input{Preface.tex}
 \tableofcontents
 \listoffigures
 \clearfirst
 
 \part{Basic Concepts}
 \input{Synopsis.tex}
 \input{Framework.tex}
 \input{First_Order_Logic.tex}
 \part{General Language Elements}
 \input{Outer_Syntax.tex}
 \input{Document_Preparation.tex}
 \input{Spec.tex}
 \input{Proof.tex}
 \input{Proof_Script.tex}
 \input{Inner_Syntax.tex}
 \input{Generic.tex}
 \part{Isabelle/HOL}\label{part:hol}
 \input{HOL_Specific.tex}
 
 \part{Appendix}
 \appendix
 \input{Quick_Reference.tex}
 \let\int\intorig
 \input{Symbols.tex}
 
 \begingroup
   \tocentry{\bibname}
   \bibliographystyle{abbrv} \small\raggedright\frenchspacing
   \bibliography{manual}
 \endgroup
 
 \tocentry{\indexname}
 \printindex
 
 \end{document}
diff --git a/src/Doc/Isar_Ref/document/showsymbols b/src/Doc/Isar_Ref/document/showsymbols
deleted file mode 100755
--- a/src/Doc/Isar_Ref/document/showsymbols
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env perl
-
-print "\\begin{supertabular}{ll\@{\\qquad}ll}\n";
-
-$eol = "&";
-
-while (<ARGV>) {
-    if (m/^\\newcommand\{\\isasym([A-Za-z]+)\}/) {
-        print "\\verb,\\<$1>, & {\\isasym$1} $eol\n";
-        if ("$eol" eq "&") {
-            $eol = "\\\\";
-        } else {
-            $eol = "&";
-        }
-    }
-}
-
-if ("$eol" eq "\\\\") {
-    print "$eol\n";
-}
-
-print "\\end{supertabular}\n";
-
diff --git a/src/Doc/JEdit/JEdit.thy b/src/Doc/JEdit/JEdit.thy
--- a/src/Doc/JEdit/JEdit.thy
+++ b/src/Doc/JEdit/JEdit.thy
@@ -1,2245 +1,2245 @@
 (*:maxLineLen=78:*)
 
 theory JEdit
 imports Base
 begin
 
 chapter \<open>Introduction\<close>
 
 section \<open>Concepts and terminology\<close>
 
 text \<open>
   Isabelle/jEdit is a Prover IDE that integrates \<^emph>\<open>parallel proof checking\<close>
   @{cite "Wenzel:2009" and "Wenzel:2013:ITP"} with \<^emph>\<open>asynchronous user
   interaction\<close> @{cite "Wenzel:2010" and "Wenzel:2012:UITP-EPTCS" and
   "Wenzel:2014:ITP-PIDE" and "Wenzel:2014:UITP"}, based on a document-oriented
   approach to \<^emph>\<open>continuous proof processing\<close> @{cite "Wenzel:2011:CICM" and
   "Wenzel:2012" and "Wenzel:2018:FIDE" and "Wenzel:2019:MKM"}. Many concepts
   and system components are fit together in order to make this work. The main
   building blocks are as follows.
 
     \<^descr>[Isabelle/ML] is the implementation and extension language of Isabelle,
     see also @{cite "isabelle-implementation"}. It is integrated into the
     logical context of Isabelle/Isar and allows to manipulate logical entities
     directly. Arbitrary add-on tools may be implemented for object-logics such
     as Isabelle/HOL.
 
     \<^descr>[Isabelle/Scala] is the system programming language of Isabelle. It
     extends the pure logical environment of Isabelle/ML towards the outer
     world of graphical user interfaces, text editors, IDE frameworks, web
     services, SSH servers, SQL databases etc. Special infrastructure allows to
     transfer algebraic datatypes and formatted text easily between ML and
     Scala, using asynchronous protocol commands.
 
     \<^descr>[PIDE] is a general framework for Prover IDEs based on Isabelle/Scala. It
     is built around a concept of parallel and asynchronous document
     processing, which is supported natively by the parallel proof engine that
     is implemented in Isabelle/ML. The traditional prover command loop is
     given up; instead there is direct support for editing of source text, with
     rich formal markup for GUI rendering.
 
     \<^descr>[jEdit] is a sophisticated text editor\<^footnote>\<open>\<^url>\<open>http://www.jedit.org\<close>\<close>
     implemented in Java\<^footnote>\<open>\<^url>\<open>https://adoptopenjdk.net\<close>\<close>. It is easily
     extensible by plugins written in any language that works on the JVM. In
     the context of Isabelle this is always
     Scala\<^footnote>\<open>\<^url>\<open>https://www.scala-lang.org\<close>\<close>.
 
     \<^descr>[Isabelle/jEdit] is the main application of the PIDE framework and the
     default user-interface for Isabelle. It targets both beginners and
     experts. Technically, Isabelle/jEdit consists of the original jEdit code
     base with minimal patches and a special plugin for Isabelle. This is
     integrated as a desktop application for the main operating system
     families: Linux, Windows, macOS.
 
   End-users of Isabelle download and run a standalone application that exposes
   jEdit as a text editor on the surface. Thus there is occasionally a tendency
   to apply the name ``jEdit'' to any of the Isabelle Prover IDE aspects,
   without proper differentiation. When discussing these PIDE building blocks
   in public forums, mailing lists, or even scientific publications, it is
   particularly important to distinguish Isabelle/ML versus Standard ML,
   Isabelle/Scala versus Scala, Isabelle/jEdit versus jEdit.
 \<close>
 
 
 section \<open>The Isabelle/jEdit Prover IDE\<close>
 
 text \<open>
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[width=\textwidth]{isabelle-jedit}
   \end{center}
   \caption{The Isabelle/jEdit Prover IDE}
   \label{fig:isabelle-jedit}
   \end{figure}
 
   Isabelle/jEdit (\figref{fig:isabelle-jedit}) consists of some plugins for
   the jEdit text editor, while preserving its overall look-and-feel. The main
   plugin is called ``Isabelle'' and has its own menu \<^emph>\<open>Plugins~/ Isabelle\<close>
   with access to several actions and add-on panels (see also
   \secref{sec:dockables}), as well as \<^emph>\<open>Plugins~/ Plugin Options~/ Isabelle\<close>
   (see also \secref{sec:options}).
 
   The options allow to specify a logic session name, but the same selector is
   also accessible in the \<^emph>\<open>Theories\<close> panel (\secref{sec:theories}). After
   startup of the Isabelle plugin, the selected logic session image is provided
   automatically by the Isabelle build tool @{cite "isabelle-system"}: if it is
   absent or outdated wrt.\ its sources, the build process updates it within
   the running text editor. Prover IDE functionality is fully activated after
   successful termination of the build process. A failure may require changing
   some options and restart of the Isabelle plugin or application. Changing the
   logic session requires a restart of the whole application to take effect.
 
   \<^medskip> The main job of the Prover IDE is to manage sources and their changes,
   taking the logical structure as a formal document into account (see also
   \secref{sec:document-model}). The editor and the prover are connected
   asynchronously without locking. The prover is free to organize the checking
   of the formal text in parallel on multiple cores, and provides feedback via
   markup, which is rendered in the editor via colors, boxes, squiggly
   underlines, hyperlinks, popup windows, icons, clickable output etc.
 
   Using the mouse together with the modifier key \<^verbatim>\<open>CONTROL\<close> (Linux, Windows)
   or \<^verbatim>\<open>COMMAND\<close> (macOS) exposes formal content via tooltips and/or
   hyperlinks (see also \secref{sec:tooltips-hyperlinks}). Output (in popups
   etc.) may be explored recursively, using the same techniques as in the
   editor source buffer.
 
   Thus the Prover IDE gives an impression of direct access to formal content
   of the prover within the editor, but in reality only certain aspects are
   exposed, according to the possibilities of the prover and its add-on tools.
 \<close>
 
 
 subsection \<open>Documentation\<close>
 
 text \<open>
   The \<^emph>\<open>Documentation\<close> panel of Isabelle/jEdit provides access to some example
   theory files and the standard Isabelle documentation. PDF files are opened
   by regular desktop operations of the underlying platform. The section
   ``Original jEdit Documentation'' contains the original \<^emph>\<open>User's Guide\<close> of
   this sophisticated text editor. The same is accessible via the \<^verbatim>\<open>Help\<close> menu
   or \<^verbatim>\<open>F1\<close> keyboard shortcut, using the built-in HTML viewer of Java/Swing.
   The latter also includes \<^emph>\<open>Frequently Asked Questions\<close> and documentation of
   individual plugins.
 
   Most of the information about jEdit is relevant for Isabelle/jEdit as well,
   but users need to keep in mind that defaults sometimes differ, and the
   official jEdit documentation does not know about the Isabelle plugin with
   its support for continuous checking of formal source text: jEdit is a plain
   text editor, but Isabelle/jEdit is a Prover IDE.
 \<close>
 
 
 subsection \<open>Plugins\<close>
 
 text \<open>
   The \<^emph>\<open>Plugin Manager\<close> of jEdit allows to augment editor functionality by JVM
   modules (jars) that are provided by the central plugin repository, which is
   accessible via various mirror sites.
 
   Connecting to the plugin server-infrastructure of the jEdit project allows
   to update bundled plugins or to add further functionality. This needs to be
   done with the usual care for such an open bazaar of contributions. Arbitrary
   combinations of add-on features are apt to cause problems. It is advisable
   to start with the default configuration of Isabelle/jEdit and develop a
   sense how it is meant to work, before loading too many other plugins.
 
   \<^medskip>
   The \<^emph>\<open>Isabelle\<close> plugin is responsible for the main Prover IDE functionality
   of Isabelle/jEdit: it manages the prover session in the background. A few
   additional plugins are bundled with Isabelle/jEdit for convenience or out of
   necessity, notably \<^emph>\<open>Console\<close> with its \<^emph>\<open>Scala\<close> sub-plugin
   (\secref{sec:scala-console}) and \<^emph>\<open>SideKick\<close> with some Isabelle-specific
   parsers for document tree structure (\secref{sec:sidekick}). The
   \<^emph>\<open>Navigator\<close> plugin is particularly important for hyperlinks within the
   formal document-model (\secref{sec:tooltips-hyperlinks}). Further plugins
   (e.g.\ \<^emph>\<open>ErrorList\<close>, \<^emph>\<open>Code2HTML\<close>) are included to saturate the dependencies
   of bundled plugins, but have no particular use in Isabelle/jEdit.
 \<close>
 
 
 subsection \<open>Options \label{sec:options}\<close>
 
 text \<open>
   Both jEdit and Isabelle have distinctive management of persistent options.
 
   Regular jEdit options are accessible via the dialogs \<^emph>\<open>Utilities~/ Global
   Options\<close> or \<^emph>\<open>Plugins~/ Plugin Options\<close>, with a second chance to flip the
   two within the central options dialog. Changes are stored in
   \<^path>\<open>$JEDIT_SETTINGS/properties\<close> and \<^path>\<open>$JEDIT_SETTINGS/keymaps\<close>.
 
   Isabelle system options are managed by Isabelle/Scala and changes are stored
   in \<^path>\<open>$ISABELLE_HOME_USER/etc/preferences\<close>, independently of
   other jEdit properties. See also @{cite "isabelle-system"}, especially the
   coverage of sessions and command-line tools like @{tool build} or @{tool
   options}.
 
   Those Isabelle options that are declared as \<^verbatim>\<open>public\<close> are configurable in
   Isabelle/jEdit via \<^emph>\<open>Plugin Options~/ Isabelle~/ General\<close>. Moreover, there
   are various options for rendering document content, which are configurable
   via \<^emph>\<open>Plugin Options~/ Isabelle~/ Rendering\<close>. Thus \<^emph>\<open>Plugin Options~/
   Isabelle\<close> in jEdit provides a view on a subset of Isabelle system options.
   Note that some of these options affect general parameters that are relevant
   outside Isabelle/jEdit as well, e.g.\ @{system_option threads} or
   @{system_option parallel_proofs} for the Isabelle build tool @{cite
   "isabelle-system"}, but it is possible to use the settings variable
   @{setting ISABELLE_BUILD_OPTIONS} to change defaults for batch builds
   without affecting the Prover IDE.
 
   The jEdit action @{action_def isabelle.options} opens the options dialog for
   the Isabelle plugin; it can be mapped to editor GUI elements as usual.
 
   \<^medskip>
   Options are usually loaded on startup and saved on shutdown of
   Isabelle/jEdit. Editing the generated \<^path>\<open>$JEDIT_SETTINGS/properties\<close>
   or \<^path>\<open>$ISABELLE_HOME_USER/etc/preferences\<close> manually while the
   application is running may cause lost updates!
 \<close>
 
 
 subsection \<open>Keymaps\<close>
 
 text \<open>
   Keyboard shortcuts are managed as a separate concept of \<^emph>\<open>keymap\<close> that is
   configurable via \<^emph>\<open>Global Options~/ Shortcuts\<close>. The \<^verbatim>\<open>imported\<close> keymap is
   derived from the initial environment of properties that is available at the
   first start of the editor; afterwards the keymap file takes precedence and
   is no longer affected by change of default properties.
 
   Users may modify their keymap later, but this can lead to conflicts with
   \<^verbatim>\<open>shortcut\<close> properties in \<^file>\<open>$JEDIT_HOME/dist/properties/jEdit.props\<close>.
 
   The action @{action_def "isabelle.keymap-merge"} helps to resolve pending
   Isabelle keymap changes wrt. the current jEdit keymap; non-conflicting
   changes are applied implicitly. This action is automatically invoked on
   Isabelle/jEdit startup.
 \<close>
 
 
 section \<open>Command-line invocation \label{sec:command-line}\<close>
 
 text \<open>
   Isabelle/jEdit is normally invoked as a single-instance desktop application,
   based on platform-specific executables for Linux, Windows, macOS.
 
   It is also possible to invoke the Prover IDE on the command-line, with some
   extra options and environment settings. The command-line usage of @{tool_def
   jedit} is as follows:
   @{verbatim [display]
 \<open>Usage: isabelle jedit [OPTIONS] [FILES ...]
 
   Options are:
     -A NAME      ancestor session for option -R (default: parent)
     -D NAME=X    set JVM system property
     -J OPTION    add JVM runtime option
                  (default $JEDIT_JAVA_SYSTEM_OPTIONS $JEDIT_JAVA_OPTIONS)
     -R NAME      build image with requirements from other sessions
     -b           build only
     -d DIR       include session directory
     -f           fresh build
     -i NAME      include session in name-space of theories
     -j OPTION    add jEdit runtime option
                  (default $JEDIT_OPTIONS)
     -l NAME      logic image name
     -m MODE      add print mode for output
     -n           no build of session image on startup
     -p CMD       ML process command prefix (process policy)
     -s           system build mode for session image (system_heaps=true)
     -u           user build mode for session image (system_heaps=false)
 
   Start jEdit with Isabelle plugin setup and open FILES
   (default "$USER_HOME/Scratch.thy" or ":" for empty buffer).\<close>}
 
   The \<^verbatim>\<open>-l\<close> option specifies the session name of the logic image to be used
   for proof processing. Additional session root directories may be included
   via option \<^verbatim>\<open>-d\<close> to augment the session name space (see also @{cite
   "isabelle-system"}). By default, the specified image is checked and built on
   demand, but option \<^verbatim>\<open>-n\<close> bypasses the implicit build process for the
   selected session image. Options \<^verbatim>\<open>-s\<close> and \<^verbatim>\<open>-u\<close> override the default system
   option @{system_option system_heaps}: this determines where to store the
   session image of @{tool build}.
 
   The \<^verbatim>\<open>-R\<close> option builds an auxiliary logic image with all theories from
   other sessions that are not already present in its parent; it also opens the
   session \<^verbatim>\<open>ROOT\<close> entry in the editor to facilitate editing of the main
   session. The \<^verbatim>\<open>-A\<close> option specifies and alternative ancestor session for
   option \<^verbatim>\<open>-R\<close>: this allows to restructure the hierarchy of session images on
   the spot.
 
   The \<^verbatim>\<open>-i\<close> option includes additional sessions into the name-space of
   theories: multiple occurrences are possible.
 
   The \<^verbatim>\<open>-m\<close> option specifies additional print modes for the prover process.
   Note that the system option @{system_option_ref jedit_print_mode} allows to
   do the same persistently (e.g.\ via the \<^emph>\<open>Plugin Options\<close> dialog of
   Isabelle/jEdit), without requiring command-line invocation.
 
   The \<^verbatim>\<open>-J\<close> and \<^verbatim>\<open>-j\<close> options pass additional low-level options to the JVM or
   jEdit, respectively. The defaults are provided by the Isabelle settings
   environment @{cite "isabelle-system"}, but note that these only work for the
   command-line tool described here, and not the desktop application.
 
   The \<^verbatim>\<open>-D\<close> option allows to define JVM system properties; this is passed
   directly to the underlying \<^verbatim>\<open>java\<close> process.
 
   The \<^verbatim>\<open>-b\<close> and \<^verbatim>\<open>-f\<close> options control the self-build mechanism of
   Isabelle/jEdit. This is only relevant for building from sources, which also
   requires an auxiliary \<^verbatim>\<open>jedit_build\<close> component from
   \<^url>\<open>https://isabelle.in.tum.de/components\<close>. The official Isabelle release
   already includes a pre-built version of Isabelle/jEdit.
 
   \<^bigskip>
   It is also possible to connect to an already running Isabelle/jEdit process
   via @{tool_def jedit_client}:
   @{verbatim [display]
 \<open>Usage: isabelle jedit_client [OPTIONS] [FILES ...]
 
   Options are:
     -c           only check presence of server
     -n           only report server name
     -s NAME      server name (default "Isabelle")
 
   Connect to already running Isabelle/jEdit instance and open FILES\<close>}
 
   The \<^verbatim>\<open>-c\<close> option merely checks the presence of the server, producing a
   process return-code.
 
   The \<^verbatim>\<open>-n\<close> option reports the server name, and the \<^verbatim>\<open>-s\<close> option provides a
   different server name. The default server name is the official distribution
   name (e.g.\ \<^verbatim>\<open>Isabelle2021\<close>). Thus @{tool jedit_client} can connect to the
   Isabelle desktop application without further options.
 
   The \<^verbatim>\<open>-p\<close> option allows to override the implicit default of the system
   option @{system_option_ref ML_process_policy} for ML processes started by
   the Prover IDE, e.g. to control CPU affinity on multiprocessor systems.
 
   The JVM system property \<^verbatim>\<open>isabelle.jedit_server\<close> provides a different server
   name, e.g.\ use \<^verbatim>\<open>isabelle jedit -Disabelle.jedit_server=\<close>\<open>name\<close> and
   \<^verbatim>\<open>isabelle jedit_client -s\<close>~\<open>name\<close> to connect later on.
 \<close>
 
 
 section \<open>GUI rendering\<close>
 
 text \<open>
   Isabelle/jEdit is a classic Java/AWT/Swing application: its GUI rendering
   usually works well, but there are technical side-conditions on the Java
   window system and graphics engine. When researching problems and solutions
   on the Web, it often helps to include other well-known Swing applications,
   notably IntelliJ IDEA and Netbeans.
 \<close>
 
 
 subsection \<open>Portable and scalable look-and-feel\<close>
 
 text \<open>
   In the past, \<^emph>\<open>system look-and-feels\<close> tried hard to imitate native GUI
   elements on specific platforms (Windows, macOS/Aqua, Linux/GTK+), but many
   technical problems have accumulated in recent years (e.g.\ see
   \secref{sec:problems}).
 
   In 2021, we are de-facto back to \<^emph>\<open>portable look-and-feels\<close>, which also
   happen to be \emph{scalable} on high-resolution displays:
 
     \<^item> \<^verbatim>\<open>FlatLaf Light\<close> is the default for Isabelle/jEdit on all platforms. It
     generally looks good and adapts itself pretty well to high-resolution
     displays.
 
     \<^item> \<^verbatim>\<open>FlatLaf Dark\<close> is an alternative, but it requires further changes of
     editor colors by the user (or by the jEdit plugin \<^verbatim>\<open>Editor Scheme\<close>). Also
     note that Isabelle/PIDE has its own extensive set of rendering options
     that need to be revisited.
 
     \<^item> \<^verbatim>\<open>Metal\<close> still works smoothly, although it is stylistically outdated. It
     can accommodate high-resolution displays via font properties (see below).
 
   Changing the look-and-feel in \<^emph>\<open>Global Options~/ Appearance\<close> often updates
   the GUI only partially: a full restart of Isabelle/jEdit is required to see
   the true effect.
 \<close>
 
 
 subsection \<open>Adjusting fonts\<close>
 
 text \<open>
   The preferred font family for Isabelle/jEdit is \<^verbatim>\<open>Isabelle DejaVu\<close>: it is
   used by default for the main text area and various GUI elements. The default
   font sizes attempt to deliver a usable application for common display types,
   such as ``Full HD'' at $1920 \times 1080$ and ``Ultra HD'' at $3840 \times
   2160$.
 
   \<^medskip> Isabelle/jEdit provides various options to adjust font sizes in particular
   GUI elements. Here is a summary of all relevant font properties:
 
     \<^item> \<^emph>\<open>Global Options / Text Area / Text font\<close>: the main text area font,
     which is also used as reference point for various derived font sizes,
     e.g.\ the \<^emph>\<open>Output\<close> (\secref{sec:output}) and \<^emph>\<open>State\<close>
     (\secref{sec:state-output}) panels.
 
     \<^item> \<^emph>\<open>Global Options / Gutter / Gutter font\<close>: the font for the gutter area
     left of the main text area, e.g.\ relevant for display of line numbers
     (disabled by default).
 
     \<^item> \<^emph>\<open>Global Options / Appearance / Button, menu and label font\<close> as well as
     \<^emph>\<open>List and text field font\<close>: this specifies the primary and secondary font
     for the \<^emph>\<open>Metal\<close> look-and-feel.
 
     \<^item> \<^emph>\<open>Plugin Options / Isabelle / General / Reset Font Size\<close>: the main text
     area font size for action @{action_ref "isabelle.reset-font-size"}, e.g.\
     relevant for quick scaling like in common web browsers.
 
     \<^item> \<^emph>\<open>Plugin Options / Console / General / Font\<close>: the console window font,
     e.g.\ relevant for Isabelle/Scala command-line.
 \<close>
 
 
 chapter \<open>Augmented jEdit functionality\<close>
 
 section \<open>Dockable windows \label{sec:dockables}\<close>
 
 text \<open>
   In jEdit terminology, a \<^emph>\<open>view\<close> is an editor window with one or more \<^emph>\<open>text
   areas\<close> that show the content of one or more \<^emph>\<open>buffers\<close>. A regular view may
   be surrounded by \<^emph>\<open>dockable windows\<close> that show additional information in
   arbitrary format, not just text; a \<^emph>\<open>plain view\<close> does not allow dockables.
   The \<^emph>\<open>dockable window manager\<close> of jEdit organizes these dockable windows,
   either as \<^emph>\<open>floating\<close> windows, or \<^emph>\<open>docked\<close> panels within one of the four
   margins of the view. There may be any number of floating instances of some
   dockable window, but at most one docked instance; jEdit actions that address
   \<^emph>\<open>the\<close> dockable window of a particular kind refer to the unique docked
   instance.
 
   Dockables are used routinely in jEdit for important functionality like
   \<^emph>\<open>HyperSearch Results\<close> or the \<^emph>\<open>File System Browser\<close>. Plugins often provide
   a central dockable to access their main functionality, which may be opened
   by the user on demand. The Isabelle/jEdit plugin takes this approach to the
   extreme: its plugin menu provides the entry-points to many panels that are
   managed as dockable windows. Some important panels are docked by default,
   e.g.\ \<^emph>\<open>Documentation\<close>, \<^emph>\<open>State\<close>, \<^emph>\<open>Theories\<close> \<^emph>\<open>Output\<close>, \<^emph>\<open>Query\<close>. The user
   can change this arrangement easily and persistently.
 
   Compared to plain jEdit, dockable window management in Isabelle/jEdit is
   slightly augmented according to the the following principles:
 
   \<^item> Floating windows are dependent on the main window as \<^emph>\<open>dialog\<close> in
   the sense of Java/AWT/Swing. Dialog windows always stay on top of the view,
   which is particularly important in full-screen mode. The desktop environment
   of the underlying platform may impose further policies on such dependent
   dialogs, in contrast to fully independent windows, e.g.\ some window
   management functions may be missing.
 
   \<^item> Keyboard focus of the main view vs.\ a dockable window is carefully
   managed according to the intended semantics, as a panel mainly for output or
   input. For example, activating the \<^emph>\<open>Output\<close> (\secref{sec:output}) or State
   (\secref{sec:state-output}) panel via the dockable window manager returns
   keyboard focus to the main text area, but for \<^emph>\<open>Query\<close> (\secref{sec:query})
   or \<^emph>\<open>Sledgehammer\<close> \secref{sec:sledgehammer} the focus is given to the main
   input field of that panel.
 
   \<^item> Panels that provide their own text area for output have an additional
   dockable menu item \<^emph>\<open>Detach\<close>. This produces an independent copy of the
   current output as a floating \<^emph>\<open>Info\<close> window, which displays that content
   independently of ongoing changes of the PIDE document-model. Note that
   Isabelle/jEdit popup windows (\secref{sec:tooltips-hyperlinks}) provide a
   similar \<^emph>\<open>Detach\<close> operation as an icon.
 \<close>
 
 
 section \<open>Isabelle symbols \label{sec:symbols}\<close>
 
 text \<open>
   Isabelle sources consist of \<^emph>\<open>symbols\<close> that extend plain ASCII to allow
   infinitely many mathematical symbols within the formal sources. This works
   without depending on particular encodings and varying Unicode
   standards.\<^footnote>\<open>Raw Unicode characters within formal sources compromise
   portability and reliability in the face of changing interpretation of
   special features of Unicode, such as Combining Characters or Bi-directional
   Text.\<close> See @{cite "Wenzel:2011:CICM"}.
 
   For the prover back-end, formal text consists of ASCII characters that are
   grouped according to some simple rules, e.g.\ as plain ``\<^verbatim>\<open>a\<close>'' or symbolic
   ``\<^verbatim>\<open>\<alpha>\<close>''. For the editor front-end, a certain subset of symbols is rendered
   physically via Unicode glyphs, to show ``\<^verbatim>\<open>\<alpha>\<close>'' as ``\<open>\<alpha>\<close>'', for example.
   This symbol interpretation is specified by the Isabelle system distribution
   in \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> and may be augmented by the user in
   \<^path>\<open>$ISABELLE_HOME_USER/etc/symbols\<close>.
 
   The appendix of @{cite "isabelle-isar-ref"} gives an overview of the
   standard interpretation of finitely many symbols from the infinite
   collection. Uninterpreted symbols are displayed literally, e.g.\
   ``\<^verbatim>\<open>\<foobar>\<close>''. Overlap of Unicode characters used in symbol
   interpretation with informal ones (which might appear e.g.\ in comments)
   needs to be avoided. Raw Unicode characters within prover source files
   should be restricted to informal parts, e.g.\ to write text in non-latin
   alphabets in comments.
 \<close>
 
 paragraph \<open>Encoding.\<close>
 
 text \<open>Technically, the Unicode interpretation of Isabelle symbols is an
   \<^emph>\<open>encoding\<close> called \<^verbatim>\<open>UTF-8-Isabelle\<close> in jEdit (\<^emph>\<open>not\<close> in the underlying
   JVM). It is provided by the Isabelle Base plugin and enabled by default for
   all source files in Isabelle/jEdit.
 
   Sometimes such defaults are reset accidentally, or malformed UTF-8 sequences
   in the text force jEdit to fall back on a different encoding like
   \<^verbatim>\<open>ISO-8859-15\<close>. In that case, verbatim ``\<^verbatim>\<open>\<alpha>\<close>'' will be shown in the text
   buffer instead of its Unicode rendering ``\<open>\<alpha>\<close>''. The jEdit menu operation
   \<^emph>\<open>File~/ Reload with Encoding~/ UTF-8-Isabelle\<close> helps to resolve such
   problems (after repairing malformed parts of the text).
 
   If the loaded text already contains Unicode sequences that are in conflict
   with the Isabelle symbol encoding, the fallback-encoding UTF-8 is used and
   Isabelle symbols remain in literal \<^verbatim>\<open>\<symbol>\<close> form. The jEdit menu
   operation \<^emph>\<open>Utilities~/ Buffer Options~/ Character encoding\<close> allows to
   enforce \<^verbatim>\<open>UTF-8-Isabelle\<close>, but this will also change original Unicode text
   into Isabelle symbols when saving the file!
 \<close>
 
 paragraph \<open>Font.\<close>
 text \<open>Correct rendering via Unicode requires a font that contains glyphs for
   the corresponding codepoints. There are also various unusual symbols with
   particular purpose in Isabelle, e.g.\ control symbols and very long arrows.
   Isabelle/jEdit prefers its own font collection \<^verbatim>\<open>Isabelle DejaVu\<close>, with
   families \<^verbatim>\<open>Serif\<close> (default for help texts), \<^verbatim>\<open>Sans\<close> (default for GUI
   elements), \<^verbatim>\<open>Mono Sans\<close> (default for text area). This ensures that all
   standard Isabelle symbols are shown on the screen (or printer) as expected.
 
   Note that a Java/AWT/Swing application can load additional fonts only if
   they are not installed on the operating system already! Outdated versions of
   Isabelle fonts that happen to be provided by the operating system prevent
   Isabelle/jEdit to use its bundled version. This could lead to missing glyphs
   (black rectangles), when the system version of a font is older than the
   application version. This problem can be avoided by refraining to
   ``install'' a copy of the Isabelle fonts in the first place, although it
   might be tempting to use the same font in other applications.
 
   HTML pages generated by Isabelle refer to the same Isabelle fonts as a
   server-side resource. Thus a web-browser can use that without requiring a
   locally installed copy.
 \<close>
 
 paragraph \<open>Input methods.\<close>
 text \<open>In principle, Isabelle/jEdit could delegate the problem to produce
   Isabelle symbols in their Unicode rendering to the underlying operating
   system and its \<^emph>\<open>input methods\<close>. Regular jEdit also provides various ways to
   work with \<^emph>\<open>abbreviations\<close> to produce certain non-ASCII characters. Since
   none of these standard input methods work satisfactorily for the
   mathematical characters required for Isabelle, various specific
   Isabelle/jEdit mechanisms are provided.
 
   This is a summary for practically relevant input methods for Isabelle
   symbols.
 
   \<^enum> The \<^emph>\<open>Symbols\<close> panel: some GUI buttons allow to insert certain symbols in
   the text buffer. There are also tooltips to reveal the official Isabelle
   representation with some additional information about \<^emph>\<open>symbol
   abbreviations\<close> (see below).
 
   \<^enum> Copy/paste from decoded source files: text that is already rendered as
   Unicode can be re-used for other text. This also works between different
   applications, e.g.\ Isabelle/jEdit and some web browser or mail client, as
   long as the same Unicode interpretation of Isabelle symbols is used.
 
   \<^enum> Copy/paste from prover output within Isabelle/jEdit. The same principles
   as for text buffers apply, but note that \<^emph>\<open>copy\<close> in secondary Isabelle/jEdit
   windows works via the keyboard shortcuts \<^verbatim>\<open>C+c\<close> or \<^verbatim>\<open>C+INSERT\<close>, while jEdit
   menu actions always refer to the primary text area!
 
   \<^enum> Completion provided by the Isabelle plugin (see \secref{sec:completion}).
   Isabelle symbols have a canonical name and optional abbreviations. This can
   be used with the text completion mechanism of Isabelle/jEdit, to replace a
   prefix of the actual symbol like \<^verbatim>\<open>\<lambda>\<close>, or its name preceded by backslash
   \<^verbatim>\<open>\lambda\<close>, or its ASCII abbreviation \<^verbatim>\<open>%\<close> by the Unicode rendering.
 
   The following table is an extract of the information provided by the
   standard \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> file:
 
   \<^medskip>
   \begin{tabular}{lll}
     \<^bold>\<open>symbol\<close> & \<^bold>\<open>name with backslash\<close> & \<^bold>\<open>abbreviation\<close> \\\hline
     \<open>\<lambda>\<close> & \<^verbatim>\<open>\lambda\<close> & \<^verbatim>\<open>%\<close> \\
     \<open>\<Rightarrow>\<close> & \<^verbatim>\<open>\Rightarrow\<close> & \<^verbatim>\<open>=>\<close> \\
     \<open>\<Longrightarrow>\<close> & \<^verbatim>\<open>\Longrightarrow\<close> & \<^verbatim>\<open>==>\<close> \\[0.5ex]
     \<open>\<And>\<close> & \<^verbatim>\<open>\And\<close> & \<^verbatim>\<open>!!\<close> \\
     \<open>\<equiv>\<close> & \<^verbatim>\<open>\equiv\<close> & \<^verbatim>\<open>==\<close> \\[0.5ex]
     \<open>\<forall>\<close> & \<^verbatim>\<open>\forall\<close> & \<^verbatim>\<open>!\<close> \\
     \<open>\<exists>\<close> & \<^verbatim>\<open>\exists\<close> & \<^verbatim>\<open>?\<close> \\
     \<open>\<longrightarrow>\<close> & \<^verbatim>\<open>\longrightarrow\<close> & \<^verbatim>\<open>-->\<close> \\
     \<open>\<and>\<close> & \<^verbatim>\<open>\and\<close> & \<^verbatim>\<open>&\<close> \\
     \<open>\<or>\<close> & \<^verbatim>\<open>\or\<close> & \<^verbatim>\<open>|\<close> \\
     \<open>\<not>\<close> & \<^verbatim>\<open>\not\<close> & \<^verbatim>\<open>~\<close> \\
     \<open>\<noteq>\<close> & \<^verbatim>\<open>\noteq\<close> & \<^verbatim>\<open>~=\<close> \\
     \<open>\<in>\<close> & \<^verbatim>\<open>\in\<close> & \<^verbatim>\<open>:\<close> \\
     \<open>\<notin>\<close> & \<^verbatim>\<open>\notin\<close> & \<^verbatim>\<open>~:\<close> \\
   \end{tabular}
   \<^medskip>
 
   Note that the above abbreviations refer to the input method. The logical
   notation provides ASCII alternatives that often coincide, but sometimes
   deviate. This occasionally causes user confusion with old-fashioned Isabelle
   source that use ASCII replacement notation like \<^verbatim>\<open>!\<close> or \<^verbatim>\<open>ALL\<close> directly in
   the text.
 
   On the other hand, coincidence of symbol abbreviations with ASCII
   replacement syntax syntax helps to update old theory sources via explicit
   completion (see also \<^verbatim>\<open>C+b\<close> explained in \secref{sec:completion}).
 \<close>
 
 paragraph \<open>Control symbols.\<close>
 text \<open>There are some special control symbols to modify the display style of a
   single symbol (without nesting). Control symbols may be applied to a region
   of selected text, either using the \<^emph>\<open>Symbols\<close> panel or keyboard shortcuts or
   jEdit actions. These editor operations produce a separate control symbol for
   each symbol in the text, in order to make the whole text appear in a certain
   style.
 
   \<^medskip>
   \begin{tabular}{llll}
     \<^bold>\<open>style\<close> & \<^bold>\<open>symbol\<close> & \<^bold>\<open>shortcut\<close> & \<^bold>\<open>action\<close> \\\hline
     superscript & \<^verbatim>\<open>\<^sup>\<close> & \<^verbatim>\<open>C+e UP\<close> & @{action_ref "isabelle.control-sup"} \\
     subscript & \<^verbatim>\<open>\<^sub>\<close> & \<^verbatim>\<open>C+e DOWN\<close> & @{action_ref "isabelle.control-sub"} \\
     bold face & \<^verbatim>\<open>\<^bold>\<close> & \<^verbatim>\<open>C+e RIGHT\<close> & @{action_ref "isabelle.control-bold"} \\
     emphasized & \<^verbatim>\<open>\<^emph>\<close> & \<^verbatim>\<open>C+e LEFT\<close> & @{action_ref "isabelle.control-emph"} \\
     reset & & \<^verbatim>\<open>C+e BACK_SPACE\<close> & @{action_ref "isabelle.control-reset"} \\
   \end{tabular}
   \<^medskip>
 
   To produce a single control symbol, it is also possible to complete on
   \<^verbatim>\<open>\sup\<close>, \<^verbatim>\<open>\sub\<close>, \<^verbatim>\<open>\bold\<close>, \<^verbatim>\<open>\emph\<close> as for regular symbols.
 
   The emphasized style only takes effect in document output (when used with a
   cartouche), but not in the editor.
 \<close>
 
 
 section \<open>Scala console \label{sec:scala-console}\<close>
 
 text \<open>
   The \<^emph>\<open>Console\<close> plugin manages various shells (command interpreters), e.g.\
   \<^emph>\<open>BeanShell\<close>, which is the official jEdit scripting language, and the
   cross-platform \<^emph>\<open>System\<close> shell. Thus the console provides similar
   functionality than the Emacs buffers \<^verbatim>\<open>*scratch*\<close> and \<^verbatim>\<open>*shell*\<close>.
 
   Isabelle/jEdit extends the repertoire of the console by \<^emph>\<open>Scala\<close>, which is
   the regular Scala toplevel loop running inside the same JVM process as
   Isabelle/jEdit itself. This means the Scala command interpreter has access
   to the JVM name space and state of the running Prover IDE application. The
   default environment imports the full content of packages \<^verbatim>\<open>isabelle\<close> and
   \<^verbatim>\<open>isabelle.jedit\<close>.
 
   For example, \<^verbatim>\<open>PIDE\<close> refers to the Isabelle/jEdit plugin object, and \<^verbatim>\<open>view\<close>
   to the current editor view of jEdit. The Scala expression
   \<^verbatim>\<open>PIDE.snapshot(view)\<close> makes a PIDE document snapshot of the current buffer
   within the current editor view: it allows to retrieve document markup in a
   timeless~/ stateless manner, while the prover continues its processing.
 
   This helps to explore Isabelle/Scala functionality interactively. Some care
   is required to avoid interference with the internals of the running
   application.
 \<close>
 
 
 section \<open>Physical and logical files \label{sec:files}\<close>
 
 text \<open>
   File specifications in jEdit follow various formats and conventions
   according to \<^emph>\<open>Virtual File Systems\<close>, which may be also provided by plugins.
   This allows to access remote files via the \<^verbatim>\<open>https:\<close> protocol prefix, for
   example. Isabelle/jEdit attempts to work with the file-system model of jEdit
   as far as possible. In particular, theory sources are passed from the editor
   to the prover, without indirection via the file-system. Thus files don't
   need to be saved: the editor buffer content is used directly.
 \<close>
 
 
 subsection \<open>Local files and environment variables \label{sec:local-files}\<close>
 
 text \<open>
   Local files (without URL notation) are particularly important. The file path
   notation is that of the Java Virtual Machine on the underlying platform. On
   Windows the preferred form uses backslashes, but happens to accept forward
   slashes like Unix/POSIX as well. Further differences arise due to Windows
   drive letters and network shares: thus relative paths (with forward slashes)
   are portable, but absolute paths are not.
 
   File paths in Java are distinct from Isabelle; the latter uses POSIX
   notation with forward slashes on \<^emph>\<open>all\<close> platforms. Isabelle/ML on Windows
   uses Unix-style path notation, with drive letters according to Cygwin (e.g.\
   \<^verbatim>\<open>/cygdrive/c\<close>). Environment variables from the Isabelle process may be used
   freely, e.g.\ \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> or \<^file>\<open>$POLYML_HOME/README\<close>.
   There are special shortcuts: \<^dir>\<open>~\<close> for \<^dir>\<open>$USER_HOME\<close> and \<^dir>\<open>~~\<close> for
   \<^dir>\<open>$ISABELLE_HOME\<close>.
 
   \<^medskip> Since jEdit happens to support environment variables within file
   specifications as well, it is natural to use similar notation within the
   editor, e.g.\ in the file-browser. This does not work in full generality,
   though, due to the bias of jEdit towards platform-specific notation and of
   Isabelle towards POSIX. Moreover, the Isabelle settings environment is not
   accessible when starting Isabelle/jEdit via the desktop application wrapper,
   in contrast to @{tool jedit} run from the command line
   (\secref{sec:command-line}).
 
   Isabelle/jEdit imitates important system settings within the Java process
   environment, in order to allow easy access to these important places from
   the editor: \<^verbatim>\<open>$ISABELLE_HOME\<close>, \<^verbatim>\<open>$ISABELLE_HOME_USER\<close>, \<^verbatim>\<open>$JEDIT_HOME\<close>,
   \<^verbatim>\<open>$JEDIT_SETTINGS\<close>. The file browser of jEdit also includes \<^emph>\<open>Favorites\<close> for
   these locations.
 
   \<^medskip> Path specifications in prover input or output usually include formal
   markup that turns it into a hyperlink (see also
   \secref{sec:tooltips-hyperlinks}). This allows to open the corresponding
   file in the text editor, independently of the path notation. If the path
   refers to a directory, it is opened in the jEdit file browser.
 
   Formally checked paths in prover input are subject to completion
   (\secref{sec:completion}): partial specifications are resolved via directory
   content and possible completions are offered in a popup.
 \<close>
 
 
 subsection \<open>PIDE resources via virtual file-systems\<close>
 
 text \<open>
   The jEdit file browser is docked by default. It provides immediate access to
   the local file-system, as well as important Isabelle resources via the
   \<^emph>\<open>Favorites\<close> menu. Environment variables like \<^verbatim>\<open>$ISABELLE_HOME\<close> are
   discussed in \secref{sec:local-files}. Virtual file-systems are more
   special: the idea is to present structured information like a directory
   tree. The following URLs are offered in the \<^emph>\<open>Favorites\<close> menu, or by
   corresponding jEdit actions.
 
     \<^item> URL \<^verbatim>\<open>isabelle-export:\<close> or action @{action_def
     "isabelle-export-browser"} shows a toplevel directory with theory names:
     each may provide its own tree structure of session exports. Exports are
     like a logical file-system for the current prover session, maintained as
     Isabelle/Scala data structures and written to the session database
     eventually. The \<^verbatim>\<open>isabelle-export:\<close> URL exposes the current content
     according to a snapshot of the document model. The file browser is \<^emph>\<open>not\<close>
     updated continuously when the PIDE document changes: the reload operation
     needs to be used explicitly. A notable example for exports is the command
     @{command_ref export_code} @{cite "isabelle-isar-ref"}.
 
     \<^item> URL \<^verbatim>\<open>isabelle-session:\<close> or action @{action_def
     "isabelle-session-browser"} show the structure of session chapters and
     sessions within them. What looks like a file-entry is actually a reference
     to the session definition in its corresponding \<^verbatim>\<open>ROOT\<close> file. The latter is
     subject to Prover IDE markup, so the session theories and other files may
     be browsed quickly by following hyperlinks in the text.
 \<close>
 
 
 section \<open>Indentation\<close>
 
 text \<open>
   Isabelle/jEdit augments the existing indentation facilities of jEdit to take
   the structure of theory and proof texts into account. There is also special
   support for unstructured proof scripts (\<^theory_text>\<open>apply\<close> etc.).
 
     \<^descr>[Syntactic indentation] follows the outer syntax of Isabelle/Isar.
 
     Action @{action "indent-lines"} (shortcut \<^verbatim>\<open>C+i\<close>) indents the current line
     according to command keywords and some command substructure: this
     approximation may need further manual tuning.
 
     Action @{action "isabelle.newline"} (shortcut \<^verbatim>\<open>ENTER\<close>) indents the old
     and the new line according to command keywords only: leading to precise
     alignment of the main Isar language elements. This depends on option
     @{system_option_def "jedit_indent_newline"} (enabled by default).
 
     Regular input (via keyboard or completion) indents the current line
     whenever an new keyword is emerging at the start of the line. This depends
     on option @{system_option_def "jedit_indent_input"} (enabled by default).
 
     \<^descr>[Semantic indentation] adds additional white space to unstructured proof
     scripts via the number of subgoals. This requires information of ongoing
     document processing and may thus lag behind when the user is editing too
     quickly; see also option @{system_option_def "jedit_script_indent"} and
     @{system_option_def "jedit_script_indent_limit"}.
 
   The above options are accessible in the menu \<^emph>\<open>Plugins / Plugin Options /
   Isabelle / General\<close>. A prerequisite for advanced indentation is \<^emph>\<open>Utilities
   / Buffer Options / Automatic indentation\<close>: it needs to be set to \<^verbatim>\<open>full\<close>
   (default).
 \<close>
 
 
 section \<open>SideKick parsers \label{sec:sidekick}\<close>
 
 text \<open>
   The \<^emph>\<open>SideKick\<close> plugin provides some general services to display buffer
   structure in a tree view. Isabelle/jEdit provides SideKick parsers for its
   main mode for theory files, ML files, as well as some minor modes for the
   \<^verbatim>\<open>NEWS\<close> file (see \figref{fig:sidekick}), session \<^verbatim>\<open>ROOT\<close> files, system
   \<^verbatim>\<open>options\<close>, and Bib{\TeX} files (\secref{sec:bibtex}).
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{sidekick}
   \end{center}
   \caption{The Isabelle NEWS file with SideKick tree view}
   \label{fig:sidekick}
   \end{figure}
 
   The default SideKick parser for theory files is \<^verbatim>\<open>isabelle\<close>: it provides a
   tree-view on the formal document structure, with section headings at the top
   and formal specification elements at the bottom. The alternative parser
   \<^verbatim>\<open>isabelle-context\<close> shows nesting of context blocks according to \<^theory_text>\<open>begin \<dots>
   end\<close> structure.
 
   \<^medskip>
   Isabelle/ML files are structured according to semi-formal comments that are
   explained in @{cite "isabelle-implementation"}. This outline is turned into
   a tree-view by default, by using the \<^verbatim>\<open>isabelle-ml\<close> parser. There is also a
   folding mode of the same name, for hierarchic text folds within ML files.
 
   \<^medskip>
   The special SideKick parser \<^verbatim>\<open>isabelle-markup\<close> exposes the uninterpreted
   markup tree of the PIDE document model of the current buffer. This is
   occasionally useful for informative purposes, but the amount of displayed
   information might cause problems for large buffers.
 \<close>
 
 
 chapter \<open>Prover IDE functionality \label{sec:document-model}\<close>
 
 section \<open>Document model \label{sec:document-model}\<close>
 
 text \<open>
   The document model is central to the PIDE architecture: the editor and the
   prover have a common notion of structured source text with markup, which is
   produced by formal processing. The editor is responsible for edits of
   document source, as produced by the user. The prover is responsible for
   reports of document markup, as produced by its processing in the background.
 
   Isabelle/jEdit handles classic editor events of jEdit, in order to connect
   the physical world of the GUI (with its singleton state) to the mathematical
   world of multiple document versions (with timeless and stateless updates).
 \<close>
 
 
 subsection \<open>Editor buffers and document nodes \label{sec:buffer-node}\<close>
 
 text \<open>
   As a regular text editor, jEdit maintains a collection of \<^emph>\<open>buffers\<close> to
   store text files; each buffer may be associated with any number of visible
   \<^emph>\<open>text areas\<close>. Buffers are subject to an \<^emph>\<open>edit mode\<close> that is determined
   from the file name extension. The following modes are treated specifically
   in Isabelle/jEdit:
 
   \<^medskip>
   \begin{tabular}{lll}
   \<^bold>\<open>mode\<close> & \<^bold>\<open>file name\<close> & \<^bold>\<open>content\<close> \\\hline
   \<^verbatim>\<open>isabelle\<close> & \<^verbatim>\<open>*.thy\<close> & theory source \\
   \<^verbatim>\<open>isabelle-ml\<close> & \<^verbatim>\<open>*.ML\<close> & Isabelle/ML source \\
   \<^verbatim>\<open>sml\<close> & \<^verbatim>\<open>*.sml\<close> or \<^verbatim>\<open>*.sig\<close> & Standard ML source \\
   \<^verbatim>\<open>isabelle-root\<close> & \<^verbatim>\<open>ROOT\<close> & session root \\
   \<^verbatim>\<open>isabelle-options\<close> & & Isabelle options \\
   \<^verbatim>\<open>isabelle-news\<close> & & Isabelle NEWS \\
   \end{tabular}
   \<^medskip>
 
   All jEdit buffers are automatically added to the PIDE document-model as
   \<^emph>\<open>document nodes\<close>. The overall document structure is defined by the theory
   nodes in two dimensions:
 
     \<^enum> via \<^bold>\<open>theory imports\<close> that are specified in the \<^emph>\<open>theory header\<close> using
     concrete syntax of the @{command_ref theory} command @{cite
     "isabelle-isar-ref"};
 
     \<^enum> via \<^bold>\<open>auxiliary files\<close> that are included into a theory by \<^emph>\<open>load
     commands\<close>, notably @{command_ref ML_file} and @{command_ref SML_file}
     @{cite "isabelle-isar-ref"}.
 
   In any case, source files are managed by the PIDE infrastructure: the
   physical file-system only plays a subordinate role. The relevant version of
   source text is passed directly from the editor to the prover, using internal
   communication channels.
 \<close>
 
 
 subsection \<open>Theories \label{sec:theories}\<close>
 
 text \<open>
   The \<^emph>\<open>Theories\<close> panel (see also \figref{fig:theories}) provides an overview
   of the status of continuous checking of theory nodes within the document
   model.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{theories}
   \end{center}
   \caption{Theories panel with an overview of the document-model, and jEdit
   text areas as editable views on some of the document nodes}
   \label{fig:theories}
   \end{figure}
 
   Theory imports are resolved automatically by the PIDE document model: all
   required files are loaded and stored internally, without the need to open
   corresponding jEdit buffers. Opening or closing editor buffers later on has
   no direct impact on the formal document content: it only affects visibility.
 
   In contrast, auxiliary files (e.g.\ from @{command ML_file} commands) are
   \<^emph>\<open>not\<close> resolved within the editor by default, but the prover process takes
   care of that. This may be changed by enabling the system option
   @{system_option jedit_auto_resolve}: it ensures that all files are uniformly
   provided by the editor.
 
   \<^medskip>
   The visible \<^emph>\<open>perspective\<close> of Isabelle/jEdit is defined by the collective
   view on theory buffers via open text areas. The perspective is taken as a
   hint for document processing: the prover ensures that those parts of a
   theory where the user is looking are checked, while other parts that are
   presently not required are ignored. The perspective is changed by opening or
   closing text area windows, or scrolling within a window.
 
   The \<^emph>\<open>Theories\<close> panel provides some further options to influence the process
   of continuous checking: it may be switched off globally to restrict the
   prover to superficial processing of command syntax. It is also possible to
   indicate theory nodes as \<^emph>\<open>required\<close> for continuous checking: this means
   such nodes and all their imports are always processed independently of the
   visibility status (if continuous checking is enabled). Big theory libraries
   that are marked as required can have significant impact on performance!
 
   The \<^emph>\<open>Purge\<close> button restricts the document model to theories that are
   required for open editor buffers: inaccessible theories are removed and will
   be rechecked when opened or imported later.
 
   \<^medskip>
   Formal markup of checked theory content is turned into GUI rendering, based
   on a standard repertoire known from mainstream IDEs for programming
   languages: colors, icons, highlighting, squiggly underlines, tooltips,
   hyperlinks etc. For outer syntax of Isabelle/Isar there is some traditional
   syntax-highlighting via static keywords and tokenization within the editor;
   this buffer syntax is determined from theory imports. In contrast, the
   painting of inner syntax (term language etc.)\ uses semantic information
   that is reported dynamically from the logical context. Thus the prover can
   provide additional markup to help the user to understand the meaning of
   formal text, and to produce more text with some add-on tools (e.g.\
   information messages with \<^emph>\<open>sendback\<close> markup by automated provers or
   disprovers in the background). \<close>
 
 
 subsection \<open>Auxiliary files \label{sec:aux-files}\<close>
 
 text \<open>
   Special load commands like @{command_ref ML_file} and @{command_ref
   SML_file} @{cite "isabelle-isar-ref"} refer to auxiliary files within some
   theory. Conceptually, the file argument of the command extends the theory
   source by the content of the file, but its editor buffer may be loaded~/
   changed~/ saved separately. The PIDE document model propagates changes of
   auxiliary file content to the corresponding load command in the theory, to
   update and process it accordingly: changes of auxiliary file content are
   treated as changes of the corresponding load command.
 
   \<^medskip>
   As a concession to the massive amount of ML files in Isabelle/HOL itself,
   the content of auxiliary files is only added to the PIDE document-model on
   demand, the first time when opened explicitly in the editor. There are
   further tricks to manage markup of ML files, such that Isabelle/HOL may be
   edited conveniently in the Prover IDE on small machines with only 8\,GB of
   main memory. Using \<^verbatim>\<open>Pure\<close> as logic session image, the exploration may start
   at the top \<^file>\<open>$ISABELLE_HOME/src/HOL/Main.thy\<close> or the bottom
   \<^file>\<open>$ISABELLE_HOME/src/HOL/HOL.thy\<close>, for example. It is also possible to
   explore the Isabelle/Pure bootstrap process (a virtual copy) by opening
   \<^file>\<open>$ISABELLE_HOME/src/Pure/ROOT.ML\<close> like a theory in the Prover IDE.
 
   Initially, before an auxiliary file is opened in the editor, the prover
   reads its content from the physical file-system. After the file is opened
   for the first time in the editor, e.g.\ by following the hyperlink
   (\secref{sec:tooltips-hyperlinks}) for the argument of its @{command
   ML_file} command, the content is taken from the jEdit buffer.
 
   The change of responsibility from prover to editor counts as an update of
   the document content, so subsequent theory sources need to be re-checked.
   When the buffer is closed, the responsibility remains to the editor: the
   file may be opened again without causing another document update.
 
   A file that is opened in the editor, but its theory with the load command is
   not, is presently inactive in the document model. A file that is loaded via
   multiple load commands is associated to an arbitrary one: this situation is
   morally unsupported and might lead to confusion.
 
   \<^medskip>
   Output that refers to an auxiliary file is combined with that of the
   corresponding load command, and shown whenever the file or the command are
   active (see also \secref{sec:output}).
 
   Warnings, errors, and other useful markup is attached directly to the
   positions in the auxiliary file buffer, in the manner of standard IDEs. By
   using the load command @{command SML_file} as explained in
   \<^file>\<open>$ISABELLE_HOME/src/Tools/SML/Examples.thy\<close>, Isabelle/jEdit may be used as
   fully-featured IDE for Standard ML, independently of theory or proof
   development: the required theory merely serves as some kind of project file
   for a collection of SML source modules.
 \<close>
 
 
 section \<open>Output \label{sec:output}\<close>
 
 text \<open>
   Prover output consists of \<^emph>\<open>markup\<close> and \<^emph>\<open>messages\<close>. Both are directly
   attached to the corresponding positions in the original source text, and
   visualized in the text area, e.g.\ as text colours for free and bound
   variables, or as squiggly underlines for warnings, errors etc.\ (see also
   \figref{fig:output}). In the latter case, the corresponding messages are
   shown by hovering with the mouse over the highlighted text --- although in
   many situations the user should already get some clue by looking at the
   position of the text highlighting, without seeing the message body itself.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{output}
   \end{center}
   \caption{Multiple views on prover output: gutter with icon, text area with
   popup, text overview column, \<^emph>\<open>Theories\<close> panel, \<^emph>\<open>Output\<close> panel}
   \label{fig:output}
   \end{figure}
 
   The ``gutter'' on the left-hand-side of the text area uses icons to
   provide a summary of the messages within the adjacent text line. Message
   priorities are used to prefer errors over warnings, warnings over
   information messages; other output is ignored.
 
   The ``text overview column'' on the right-hand-side of the text area uses
   similar information to paint small rectangles for the overall status of the
   whole text buffer. The graphics is scaled to fit the logical buffer length
   into the given window height. Mouse clicks on the overview area move the
   cursor approximately to the corresponding text line in the buffer.
 
   The \<^emph>\<open>Theories\<close> panel provides another course-grained overview, but without
   direct correspondence to text positions. The coloured rectangles represent
   the amount of messages of a certain kind (warnings, errors, etc.) and the
   execution status of commands. The border of each rectangle indicates the
   overall status of processing: a thick border means it is \<^emph>\<open>finished\<close> or
   \<^emph>\<open>failed\<close> (with color for errors). A double-click on one of the theory
   entries with their status overview opens the corresponding text buffer,
   without moving the cursor to a specific point.
 
   \<^medskip>
   The \<^emph>\<open>Output\<close> panel displays prover messages that correspond to a given
   command, within a separate window. The cursor position in the presently
   active text area determines the prover command whose cumulative message
   output is appended and shown in that window (in canonical order according to
   the internal execution of the command). There are also control elements to
   modify the update policy of the output wrt.\ continued editor movements:
   \<^emph>\<open>Auto update\<close> and \<^emph>\<open>Update\<close>. This is particularly useful for multiple
   instances of the \<^emph>\<open>Output\<close> panel to look at different situations.
   Alternatively, the panel can be turned into a passive \<^emph>\<open>Info\<close> window via the
   \<^emph>\<open>Detach\<close> menu item.
 
   Proof state is handled separately (\secref{sec:state-output}), but it is
   also possible to tick the corresponding checkbox to append it to regular
   output (\figref{fig:output-including-state}). This is a globally persistent
   option: it affects all open panels and future editor sessions.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{output-including-state}
   \end{center}
   \caption{Proof state display within the regular output panel}
   \label{fig:output-including-state}
   \end{figure}
 
   \<^medskip>
   Following the IDE principle, regular messages are attached to the original
   source in the proper place and may be inspected on demand via popups. This
   excludes messages that are somehow internal to the machinery of proof
   checking, notably \<^emph>\<open>proof state\<close> and \<^emph>\<open>tracing\<close>.
 
   In any case, the same display technology is used for small popups and big
   output windows. The formal text contains markup that may be explored
   recursively via further popups and hyperlinks (see
   \secref{sec:tooltips-hyperlinks}), or clicked directly to initiate certain
   actions (see \secref{sec:auto-tools} and \secref{sec:sledgehammer}).
 
   \<^medskip>
   Alternatively, the subsequent actions (with keyboard shortcuts) allow to
   show tooltip messages or navigate error positions:
 
   \<^medskip>
   \begin{tabular}[t]{l}
   @{action_ref "isabelle.tooltip"} (\<^verbatim>\<open>CS+b\<close>) \\
   @{action_ref "isabelle.message"} (\<^verbatim>\<open>CS+m\<close>) \\
   \end{tabular}\quad
   \begin{tabular}[t]{l}
   @{action_ref "isabelle.first-error"} (\<^verbatim>\<open>CS+a\<close>) \\
   @{action_ref "isabelle.last-error"} (\<^verbatim>\<open>CS+z\<close>) \\
   @{action_ref "isabelle.next-error"} (\<^verbatim>\<open>CS+n\<close>) \\
   @{action_ref "isabelle.prev-error"} (\<^verbatim>\<open>CS+p\<close>) \\
   \end{tabular}
   \<^medskip>
 \<close>
 
 
 section \<open>Proof state \label{sec:state-output}\<close>
 
 text \<open>
   The main purpose of the Prover IDE is to help the user editing proof
   documents, with ongoing formal checking by the prover in the background.
   This can be done to some extent in the main text area alone, especially for
   well-structured Isar proofs.
 
   Nonetheless, internal proof state needs to be inspected in many situations
   of exploration and ``debugging''. The \<^emph>\<open>State\<close> panel shows exclusively such
   proof state messages without further distraction, while all other messages
   are displayed in \<^emph>\<open>Output\<close> (\secref{sec:output}).
   \Figref{fig:output-and-state} shows a typical GUI layout where both panels
   are open.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{output-and-state}
   \end{center}
   \caption{Separate proof state display (right) and other output (bottom).}
   \label{fig:output-and-state}
   \end{figure}
 
   Another typical arrangement has more than one \<^emph>\<open>State\<close> panel open (as
   floating windows), with \<^emph>\<open>Auto update\<close> disabled to look at an old situation
   while the proof text in the vicinity is changed. The \<^emph>\<open>Update\<close> button
   triggers an explicit one-shot update; this operation is also available via
   the action @{action "isabelle.update-state"} (keyboard shortcut \<^verbatim>\<open>S+ENTER\<close>).
 
   On small screens, it is occasionally useful to have all messages
   concatenated in the regular \<^emph>\<open>Output\<close> panel, e.g.\ see
   \figref{fig:output-including-state}.
 
   \<^medskip>
   The mechanics of \<^emph>\<open>Output\<close> versus \<^emph>\<open>State\<close> are slightly different:
 
     \<^item> \<^emph>\<open>Output\<close> shows information that is continuously produced and already
     present when the GUI wants to show it. This is implicitly controlled by
     the visible perspective on the text.
 
     \<^item> \<^emph>\<open>State\<close> initiates a real-time query on demand, with a full round trip
     including a fresh print operation on the prover side. This is controlled
     explicitly when the cursor is moved to the next command (\<^emph>\<open>Auto update\<close>)
     or the \<^emph>\<open>Update\<close> operation is triggered.
 
   This can make a difference in GUI responsibility and resource usage within
   the prover process. Applications with very big proof states that are only
   inspected in isolation work better with the \<^emph>\<open>State\<close> panel.
 \<close>
 
 
 section \<open>Query \label{sec:query}\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel provides various GUI forms to request extra information
   from the prover, as a replacement of old-style diagnostic commands like
   @{command find_theorems}. There are input fields and buttons for a
   particular query command, with output in a dedicated text area.
 
   The main query modes are presented as separate tabs: \<^emph>\<open>Find Theorems\<close>,
   \<^emph>\<open>Find Constants\<close>, \<^emph>\<open>Print Context\<close>, e.g.\ see \figref{fig:query}. As usual
   in jEdit, multiple \<^emph>\<open>Query\<close> windows may be active at the same time: any
   number of floating instances, but at most one docked instance (which is used
   by default).
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{query}
   \end{center}
   \caption{An instance of the Query panel: find theorems}
   \label{fig:query}
   \end{figure}
 
   \<^medskip>
   The following GUI elements are common to all query modes:
 
     \<^item> The spinning wheel provides feedback about the status of a pending query
     wrt.\ the evaluation of its context and its own operation.
 
     \<^item> The \<^emph>\<open>Apply\<close> button attaches a fresh query invocation to the current
     context of the command where the cursor is pointing in the text.
 
     \<^item> The \<^emph>\<open>Search\<close> field allows to highlight query output according to some
     regular expression, in the notation that is commonly used on the Java
     platform.\<^footnote>\<open>\<^url>\<open>https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/util/regex/Pattern.html\<close>\<close>
     This may serve as an additional visual filter of the result.
 
     \<^item> The \<^emph>\<open>Zoom\<close> box controls the font size of the output area.
 
   All query operations are asynchronous: there is no need to wait for the
   evaluation of the document for the query context, nor for the query
   operation itself. Query output may be detached as independent \<^emph>\<open>Info\<close>
   window, using a menu operation of the dockable window manager. The printed
   result usually provides sufficient clues about the original query, with some
   hyperlink to its context (via markup of its head line).
 \<close>
 
 
 subsection \<open>Find theorems\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel in \<^emph>\<open>Find Theorems\<close> mode retrieves facts from the theory
   or proof context matching all of given criteria in the \<^emph>\<open>Find\<close> text field. A
   single criterion has the following syntax:
 
   \<^rail>\<open>
     ('-'?) ('name' ':' @{syntax name} | 'intro' | 'elim' | 'dest' |
       'solves' | 'simp' ':' @{syntax term} | @{syntax term})
   \<close>
 
   See also the Isar command @{command_ref find_theorems} in @{cite
   "isabelle-isar-ref"}.
 \<close>
 
 
 subsection \<open>Find constants\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel in \<^emph>\<open>Find Constants\<close> mode prints all constants whose type
   meets all of the given criteria in the \<^emph>\<open>Find\<close> text field. A single
   criterion has the following syntax:
 
   \<^rail>\<open>
     ('-'?)
       ('name' ':' @{syntax name} | 'strict' ':' @{syntax type} | @{syntax type})
   \<close>
 
   See also the Isar command @{command_ref find_consts} in @{cite
   "isabelle-isar-ref"}.
 \<close>
 
 
 subsection \<open>Print context\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel in \<^emph>\<open>Print Context\<close> mode prints information from the
   theory or proof context, or proof state. See also the Isar commands
   @{command_ref print_context}, @{command_ref print_cases}, @{command_ref
   print_term_bindings}, @{command_ref print_theorems}, described in @{cite
   "isabelle-isar-ref"}.
 \<close>
 
 
 section \<open>Tooltips and hyperlinks \label{sec:tooltips-hyperlinks}\<close>
 
 text \<open>
   Formally processed text (prover input or output) contains rich markup that
   can be explored by using the \<^verbatim>\<open>CONTROL\<close> modifier key on Linux and Windows,
   or \<^verbatim>\<open>COMMAND\<close> on macOS. Hovering with the mouse while the modifier is
   pressed reveals a \<^emph>\<open>tooltip\<close> (grey box over the text with a yellow popup)
   and/or a \<^emph>\<open>hyperlink\<close> (black rectangle over the text with change of mouse
   pointer); see also \figref{fig:tooltip}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{popup1}
   \end{center}
   \caption{Tooltip and hyperlink for some formal entity}
   \label{fig:tooltip}
   \end{figure}
 
   Tooltip popups use the same rendering technology as the main text area, and
   further tooltips and/or hyperlinks may be exposed recursively by the same
   mechanism; see \figref{fig:nested-tooltips}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{popup2}
   \end{center}
   \caption{Nested tooltips over formal entities}
   \label{fig:nested-tooltips}
   \end{figure}
 
   The tooltip popup window provides some controls to \<^emph>\<open>close\<close> or \<^emph>\<open>detach\<close> the
   window, turning it into a separate \<^emph>\<open>Info\<close> window managed by jEdit. The
   \<^verbatim>\<open>ESCAPE\<close> key closes \<^emph>\<open>all\<close> popups, which is particularly relevant when
   nested tooltips are stacking up.
 
   \<^medskip>
   A black rectangle in the text indicates a hyperlink that may be followed by
   a mouse click (while the \<^verbatim>\<open>CONTROL\<close> or \<^verbatim>\<open>COMMAND\<close> modifier key is still
   pressed). Such jumps to other text locations are recorded by the
   \<^emph>\<open>Navigator\<close> plugin, which is bundled with Isabelle/jEdit and enabled by
   default. There are usually navigation arrows in the main jEdit toolbar.
 
   Note that the link target may be a file that is itself not subject to formal
   document processing of the editor session and thus prevents further
   exploration: the chain of hyperlinks may end in some source file of the
   underlying logic image, or within the ML bootstrap sources of Isabelle/Pure.
 \<close>
 
 
 section \<open>Formal scopes and semantic selection\<close>
 
 text \<open>
   Formal entities are semantically annotated in the source text as explained
   in \secref{sec:tooltips-hyperlinks}. A \<^emph>\<open>formal scope\<close> consists of the
   defining position with all its referencing positions. This correspondence is
   highlighted in the text according to the cursor position, see also
   \figref{fig:scope1}. Here the referencing positions are rendered with an
   additional border, in reminiscence to a hyperlink. A mouse click with \<^verbatim>\<open>C\<close>
   modifier, or the action @{action_def "isabelle.goto-entity"} (shortcut
   \<^verbatim>\<open>CS+d\<close>) jumps to the original defining position.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{scope1}
   \end{center}
   \caption{Scope of formal entity: defining vs.\ referencing positions}
   \label{fig:scope1}
   \end{figure}
 
   The action @{action_def "isabelle.select-entity"} (shortcut \<^verbatim>\<open>CS+ENTER\<close>)
   supports semantic selection of all occurrences of the formal entity at the
   caret position, with a defining position in the current editor buffer. This
   facilitates systematic renaming, using regular jEdit editing of a
   multi-selection, see also \figref{fig:scope2}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{scope2}
   \end{center}
   \caption{The result of semantic selection and systematic renaming}
   \label{fig:scope2}
   \end{figure}
 
   By default, the visual feedback on scopes is restricted to definitions
   within the visible text area. The keyboard modifier \<^verbatim>\<open>CS\<close> overrides this:
   then all defining and referencing positions are shown. This modifier may be
   configured via option @{system_option jedit_focus_modifier}; the default
   coincides with the modifier for the above keyboard actions. The empty string
   means to disable this additional visual feedback.
 \<close>
 
 
 section \<open>Completion \label{sec:completion}\<close>
 
 text \<open>
   Smart completion of partial input is the IDE functionality \<^emph>\<open>par
   excellance\<close>. Isabelle/jEdit combines several sources of information to
   achieve that. Despite its complexity, it should be possible to get some idea
   how completion works by experimentation, based on the overview of completion
   varieties in \secref{sec:completion-varieties}. The remaining subsections
   explain concepts around completion more systematically.
 
   \<^medskip>
   \<^emph>\<open>Explicit completion\<close> is triggered by the action @{action_ref
   "isabelle.complete"}, which is bound to the keyboard shortcut \<^verbatim>\<open>C+b\<close>, and
   thus overrides the jEdit default for @{action_ref "complete-word"}.
 
   \<^emph>\<open>Implicit completion\<close> hooks into the regular keyboard input stream of the
   editor, with some event filtering and optional delays.
 
   \<^medskip>
   Completion options may be configured in \<^emph>\<open>Plugin Options~/ Isabelle~/
   General~/ Completion\<close>. These are explained in further detail below, whenever
   relevant. There is also a summary of options in
   \secref{sec:completion-options}.
 
   The asynchronous nature of PIDE interaction means that information from the
   prover is delayed --- at least by a full round-trip of the document update
   protocol. The default options already take this into account, with a
   sufficiently long completion delay to speculate on the availability of all
   relevant information from the editor and the prover, before completing text
   immediately or producing a popup. Although there is an inherent danger of
   non-deterministic behaviour due to such real-time parameters, the general
   completion policy aims at determined results as far as possible.
 \<close>
 
 
 subsection \<open>Varieties of completion \label{sec:completion-varieties}\<close>
 
 subsubsection \<open>Built-in templates\<close>
 
 text \<open>
   Isabelle is ultimately a framework of nested sub-languages of different
   kinds and purposes. The completion mechanism supports this by the following
   built-in templates:
 
     \<^descr> \<^verbatim>\<open>`\<close> (single ASCII back-quote) or \<^verbatim>\<open>"\<close> (double ASCII quote) support
     \<^emph>\<open>quotations\<close> via text cartouches. There are three selections, which are
     always presented in the same order and do not depend on any context
     information. The default choice produces a template ``\<open>\<open>\<box>\<close>\<close>'', where the
     box indicates the cursor position after insertion; the other choices help
     to repair the block structure of unbalanced text cartouches.
 
     \<^descr> \<^verbatim>\<open>@{\<close> is completed to the template ``\<open>@{\<box>}\<close>'', where the box indicates
     the cursor position after insertion. Here it is convenient to use the
     wildcard ``\<^verbatim>\<open>__\<close>'' or a more specific name prefix to let semantic
     completion of name-space entries propose antiquotation names.
 
   With some practice, input of quoted sub-languages and antiquotations of
   embedded languages should work smoothly. Note that national keyboard layouts
   might cause problems with back-quote as dead key, but double quote can be
   used instead.
 \<close>
 
 
 subsubsection \<open>Syntax keywords\<close>
 
 text \<open>
   Syntax completion tables are determined statically from the keywords of the
   ``outer syntax'' of the underlying edit mode: for theory files this is the
   syntax of Isar commands according to the cumulative theory imports.
 
   Keywords are usually plain words, which means the completion mechanism only
   inserts them directly into the text for explicit completion
   (\secref{sec:completion-input}), but produces a popup
   (\secref{sec:completion-popup}) otherwise.
 
   At the point where outer syntax keywords are defined, it is possible to
   specify an alternative replacement string to be inserted instead of the
   keyword itself. An empty string means to suppress the keyword altogether,
   which is occasionally useful to avoid confusion, e.g.\ the rare keyword
   @{command simproc_setup} vs.\ the frequent name-space entry \<open>simp\<close>.
 \<close>
 
 
 subsubsection \<open>Isabelle symbols\<close>
 
 text \<open>
   The completion tables for Isabelle symbols (\secref{sec:symbols}) are
   determined statically from \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> and
   \<^path>\<open>$ISABELLE_HOME_USER/etc/symbols\<close> for each symbol specification as
   follows:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<^bold>\<open>completion entry\<close> & \<^bold>\<open>example\<close> \\\hline
   literal symbol & \<^verbatim>\<open>\<forall>\<close> \\
   symbol name with backslash & \<^verbatim>\<open>\\<close>\<^verbatim>\<open>forall\<close> \\
   symbol abbreviation & \<^verbatim>\<open>ALL\<close> or \<^verbatim>\<open>!\<close> \\
   \end{tabular}
   \<^medskip>
 
   When inserted into the text, the above examples all produce the same Unicode
   rendering \<open>\<forall>\<close> of the underlying symbol \<^verbatim>\<open>\<forall>\<close>.
 
   A symbol abbreviation that is a plain word, like \<^verbatim>\<open>ALL\<close>, is treated like a
   syntax keyword. Non-word abbreviations like \<^verbatim>\<open>-->\<close> are inserted more
   aggressively, except for single-character abbreviations like \<^verbatim>\<open>!\<close> above.
 
   Completion via abbreviations like \<^verbatim>\<open>ALL\<close> or \<^verbatim>\<open>-->\<close> depends on the semantic
   language context (\secref{sec:completion-context}). In contrast, backslash
   sequences like \<^verbatim>\<open>\forall\<close> \<^verbatim>\<open>\<forall>\<close> are always possible, but require additional
   interaction to confirm (via popup). This is important in ambiguous
   situations, e.g.\ for Isabelle document source, which may contain formal
   symbols or informal {\LaTeX} macros. Backslash sequences also help when
   input is broken, and thus escapes its normal semantic context: e.g.\
   antiquotations or string literals in ML, which do not allow arbitrary
   backslash sequences.
 
   Special symbols like \<^verbatim>\<open>\<comment>\<close> or control symbols like \<^verbatim>\<open>\<^cancel>\<close>,
   \<^verbatim>\<open>\<^latex>\<close>, \<^verbatim>\<open>\<^binding>\<close> can have an argument: completing on a name
   prefix offers a template with an empty cartouche. Thus completion of \<^verbatim>\<open>\co\<close>
   or \<^verbatim>\<open>\ca\<close> allows to compose formal document comments quickly.\<^footnote>\<open>It is
   customary to put a space between \<^verbatim>\<open>\<comment>\<close> and its argument, while
   control symbols do \<^emph>\<open>not\<close> allow extra space here.\<close>
 \<close>
 
 
 subsubsection \<open>User-defined abbreviations\<close>
 
 text \<open>
   The theory header syntax supports abbreviations via the \<^theory_text>\<open>abbrevs\<close> keyword
   @{cite "isabelle-isar-ref"}. This is a slight generalization of built-in
   templates and abbreviations for Isabelle symbols, as explained above.
   Examples may be found in the Isabelle sources, by searching for
   ``\<^verbatim>\<open>abbrevs\<close>'' in \<^verbatim>\<open>*.thy\<close> files.
 
   The \<^emph>\<open>Symbols\<close> panel shows the abbreviations that are available in the
   current theory buffer (according to its \<^theory_text>\<open>imports\<close>) in the \<^verbatim>\<open>Abbrevs\<close> tab.
 \<close>
 
 
 subsubsection \<open>Name-space entries\<close>
 
 text \<open>
   This is genuine semantic completion, using information from the prover, so
   it requires some delay. A \<^emph>\<open>failed name-space lookup\<close> produces an error
   message that is annotated with a list of alternative names that are legal.
   The list of results is truncated according to the system option
   @{system_option_ref completion_limit}. The completion mechanism takes this
   into account when collecting information on the prover side.
 
   Already recognized names are \<^emph>\<open>not\<close> completed further, but completion may be
   extended by appending a suffix of underscores. This provokes a failed
   lookup, and another completion attempt (ignoring the underscores). For
   example, in a name space where \<^verbatim>\<open>foo\<close> and \<^verbatim>\<open>foobar\<close> are known, the input
   \<^verbatim>\<open>foo\<close> remains unchanged, but \<^verbatim>\<open>foo_\<close> may be completed to \<^verbatim>\<open>foo\<close> or
   \<^verbatim>\<open>foobar\<close>.
 
   The special identifier ``\<^verbatim>\<open>__\<close>'' serves as a wild-card for arbitrary
   completion: it exposes the name-space content to the completion mechanism
   (truncated according to @{system_option completion_limit}). This is
   occasionally useful to explore an unknown name-space, e.g.\ in some
   template.
 \<close>
 
 
 subsubsection \<open>File-system paths\<close>
 
 text \<open>
   Depending on prover markup about file-system paths in the source text, e.g.\
   for the argument of a load command (\secref{sec:aux-files}), the completion
   mechanism explores the directory content and offers the result as completion
   popup. Relative path specifications are understood wrt.\ the \<^emph>\<open>master
   directory\<close> of the document node (\secref{sec:buffer-node}) of the enclosing
   editor buffer; this requires a proper theory, not an auxiliary file.
 
   A suffix of slashes may be used to continue the exploration of an already
   recognized directory name.
 \<close>
 
 
 subsubsection \<open>Spell-checking\<close>
 
 text \<open>
   The spell-checker combines semantic markup from the prover (regions of plain
   words) with static dictionaries (word lists) that are known to the editor.
 
   Unknown words are underlined in the text, using @{system_option_ref
   spell_checker_color} (blue by default). This is not an error, but a hint to
   the user that some action may be taken. The jEdit context menu provides
   various actions, as far as applicable:
 
   \<^medskip>
   \begin{tabular}{l}
   @{action_ref "isabelle.complete-word"} \\
   @{action_ref "isabelle.exclude-word"} \\
   @{action_ref "isabelle.exclude-word-permanently"} \\
   @{action_ref "isabelle.include-word"} \\
   @{action_ref "isabelle.include-word-permanently"} \\
   \end{tabular}
   \<^medskip>
 
   Instead of the specific @{action_ref "isabelle.complete-word"}, it is also
   possible to use the generic @{action_ref "isabelle.complete"} with its
   default keyboard shortcut \<^verbatim>\<open>C+b\<close>.
 
   \<^medskip>
   Dictionary lookup uses some educated guesses about lower-case, upper-case,
   and capitalized words. This is oriented on common use in English, where this
   aspect is not decisive for proper spelling (in contrast to German, for
   example).
 \<close>
 
 
 subsection \<open>Semantic completion context \label{sec:completion-context}\<close>
 
 text \<open>
   Completion depends on a semantic context that is provided by the prover,
   although with some delay, because at least a full PIDE protocol round-trip
   is required. Until that information becomes available in the PIDE
   document-model, the default context is given by the outer syntax of the
   editor mode (see also \secref{sec:buffer-node}).
 
   The semantic \<^emph>\<open>language context\<close> provides information about nested
   sub-languages of Isabelle: keywords are only completed for outer syntax, and
   antiquotations for languages that support them. Symbol abbreviations only
   work for specific sub-languages: e.g.\ ``\<^verbatim>\<open>=>\<close>'' is \<^emph>\<open>not\<close> completed in
   regular ML source, but is completed within ML strings, comments,
   antiquotations. Backslash representations of symbols like ``\<^verbatim>\<open>\foobar\<close>'' or
   ``\<^verbatim>\<open>\<foobar>\<close>'' work in any context --- after additional confirmation.
 
   The prover may produce \<^emph>\<open>no completion\<close> markup in exceptional situations, to
   tell that some language keywords should be excluded from further completion
   attempts. For example, ``\<^verbatim>\<open>:\<close>'' within accepted Isar syntax looses its
   meaning as abbreviation for symbol ``\<open>\<in>\<close>''.
 \<close>
 
 
 subsection \<open>Input events \label{sec:completion-input}\<close>
 
 text \<open>
   Completion is triggered by certain events produced by the user, with
   optional delay after keyboard input according to @{system_option
   jedit_completion_delay}.
 
   \<^descr>[Explicit completion] works via action @{action_ref "isabelle.complete"}
   with keyboard shortcut \<^verbatim>\<open>C+b\<close>. This overrides the shortcut for @{action_ref
   "complete-word"} in jEdit, but it is possible to restore the original jEdit
   keyboard mapping of @{action "complete-word"} via \<^emph>\<open>Global Options~/
   Shortcuts\<close> and invent a different one for @{action "isabelle.complete"}.
 
   \<^descr>[Explicit spell-checker completion] works via @{action_ref
   "isabelle.complete-word"}, which is exposed in the jEdit context menu, if
   the mouse points to a word that the spell-checker can complete.
 
   \<^descr>[Implicit completion] works via regular keyboard input of the editor. It
   depends on further side-conditions:
 
     \<^enum> The system option @{system_option_ref jedit_completion} needs to be
     enabled (default).
 
     \<^enum> Completion of syntax keywords requires at least 3 relevant characters in
     the text.
 
     \<^enum> The system option @{system_option_ref jedit_completion_delay} determines
     an additional delay (0.5 by default), before opening a completion popup.
     The delay gives the prover a chance to provide semantic completion
     information, notably the context (\secref{sec:completion-context}).
 
     \<^enum> The system option @{system_option_ref jedit_completion_immediate}
     (enabled by default) controls whether replacement text should be inserted
     immediately without popup, regardless of @{system_option
     jedit_completion_delay}. This aggressive mode of completion is restricted
     to symbol abbreviations that are not plain words (\secref{sec:symbols}).
 
     \<^enum> Completion of symbol abbreviations with only one relevant character in
     the text always enforces an explicit popup, regardless of
     @{system_option_ref jedit_completion_immediate}.
 \<close>
 
 
 subsection \<open>Completion popup \label{sec:completion-popup}\<close>
 
 text \<open>
   A \<^emph>\<open>completion popup\<close> is a minimally invasive GUI component over the text
   area that offers a selection of completion items to be inserted into the
   text, e.g.\ by mouse clicks. Items are sorted dynamically, according to the
   frequency of selection, with persistent history. The popup may interpret
   special keys \<^verbatim>\<open>ENTER\<close>, \<^verbatim>\<open>TAB\<close>, \<^verbatim>\<open>ESCAPE\<close>, \<^verbatim>\<open>UP\<close>, \<^verbatim>\<open>DOWN\<close>, \<^verbatim>\<open>PAGE_UP\<close>,
   \<^verbatim>\<open>PAGE_DOWN\<close>, but all other key events are passed to the underlying text
   area. This allows to ignore unwanted completions most of the time and
   continue typing quickly. Thus the popup serves as a mechanism of
   confirmation of proposed items, while the default is to continue without
   completion.
 
   The meaning of special keys is as follows:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<^bold>\<open>key\<close> & \<^bold>\<open>action\<close> \\\hline
   \<^verbatim>\<open>ENTER\<close> & select completion (if @{system_option jedit_completion_select_enter}) \\
   \<^verbatim>\<open>TAB\<close> & select completion (if @{system_option jedit_completion_select_tab}) \\
   \<^verbatim>\<open>ESCAPE\<close> & dismiss popup \\
   \<^verbatim>\<open>UP\<close> & move up one item \\
   \<^verbatim>\<open>DOWN\<close> & move down one item \\
   \<^verbatim>\<open>PAGE_UP\<close> & move up one page of items \\
   \<^verbatim>\<open>PAGE_DOWN\<close> & move down one page of items \\
   \end{tabular}
   \<^medskip>
 
   Movement within the popup is only active for multiple items. Otherwise the
   corresponding key event retains its standard meaning within the underlying
   text area.
 \<close>
 
 
 subsection \<open>Insertion \label{sec:completion-insert}\<close>
 
 text \<open>
   Completion may first propose replacements to be selected (via a popup), or
   replace text immediately in certain situations and depending on certain
   options like @{system_option jedit_completion_immediate}. In any case,
   insertion works uniformly, by imitating normal jEdit text insertion,
   depending on the state of the \<^emph>\<open>text selection\<close>. Isabelle/jEdit tries to
   accommodate the most common forms of advanced selections in jEdit, but not
   all combinations make sense. At least the following important cases are
   well-defined:
 
     \<^descr>[No selection.] The original is removed and the replacement inserted,
     depending on the caret position.
 
     \<^descr>[Rectangular selection of zero width.] This special case is treated by
     jEdit as ``tall caret'' and insertion of completion imitates its normal
     behaviour: separate copies of the replacement are inserted for each line
     of the selection.
 
     \<^descr>[Other rectangular selection or multiple selections.] Here the original
     is removed and the replacement is inserted for each line (or segment) of
     the selection.
 
   Support for multiple selections is particularly useful for \<^emph>\<open>HyperSearch\<close>:
   clicking on one of the items in the \<^emph>\<open>HyperSearch Results\<close> window makes
   jEdit select all its occurrences in the corresponding line of text. Then
   explicit completion can be invoked via \<^verbatim>\<open>C+b\<close>, e.g.\ to replace occurrences
   of \<^verbatim>\<open>-->\<close> by \<open>\<longrightarrow>\<close>.
 
   \<^medskip>
   Insertion works by removing and inserting pieces of text from the buffer.
   This counts as one atomic operation on the jEdit history. Thus unintended
   completions may be reverted by the regular @{action undo} action of jEdit.
   According to normal jEdit policies, the recovered text after @{action undo}
   is selected: \<^verbatim>\<open>ESCAPE\<close> is required to reset the selection and to continue
   typing more text.
 \<close>
 
 
 subsection \<open>Options \label{sec:completion-options}\<close>
 
 text \<open>
   This is a summary of Isabelle/Scala system options that are relevant for
   completion. They may be configured in \<^emph>\<open>Plugin Options~/ Isabelle~/ General\<close>
   as usual.
 
   \<^item> @{system_option_def completion_limit} specifies the maximum number of
   items for various semantic completion operations (name-space entries etc.)
 
   \<^item> @{system_option_def jedit_completion} guards implicit completion via
   regular jEdit key events (\secref{sec:completion-input}): it allows to
   disable implicit completion altogether.
 
   \<^item> @{system_option_def jedit_completion_select_enter} and @{system_option_def
   jedit_completion_select_tab} enable keys to select a completion item from
   the popup (\secref{sec:completion-popup}). Note that a regular mouse click
   on the list of items is always possible.
 
   \<^item> @{system_option_def jedit_completion_context} specifies whether the
   language context provided by the prover should be used at all. Disabling
   that option makes completion less ``semantic''. Note that incomplete or
   severely broken input may cause some disagreement of the prover and the user
   about the intended language context.
 
   \<^item> @{system_option_def jedit_completion_delay} and @{system_option_def
   jedit_completion_immediate} determine the handling of keyboard events for
   implicit completion (\secref{sec:completion-input}).
 
   A @{system_option jedit_completion_delay}~\<^verbatim>\<open>> 0\<close> postpones the processing of
   key events, until after the user has stopped typing for the given time span,
   but @{system_option jedit_completion_immediate}~\<^verbatim>\<open>= true\<close> means that
   abbreviations of Isabelle symbols are handled nonetheless.
 
   \<^item> @{system_option_def completion_path_ignore} specifies ``glob''
   patterns to ignore in file-system path completion (separated by colons),
   e.g.\ backup files ending with tilde.
 
   \<^item> @{system_option_def spell_checker} is a global guard for all spell-checker
   operations: it allows to disable that mechanism altogether.
 
   \<^item> @{system_option_def spell_checker_dictionary} determines the current
   dictionary, taken from the colon-separated list in the settings variable
   @{setting_def JORTHO_DICTIONARIES}. There are jEdit actions to specify local
   updates to a dictionary, by including or excluding words. The result of
   permanent dictionary updates is stored in the directory
   \<^path>\<open>$ISABELLE_HOME_USER/dictionaries\<close>, in a separate file for each
   dictionary.
 
   \<^item> @{system_option_def spell_checker_include} specifies a comma-separated
   list of markup elements that delimit words in the source that is subject to
   spell-checking, including various forms of comments.
 
   \<^item> @{system_option_def spell_checker_exclude} specifies a comma-separated
   list of markup elements that disable spell-checking (e.g.\ in nested
   antiquotations).
 \<close>
 
 
 section \<open>Automatically tried tools \label{sec:auto-tools}\<close>
 
 text \<open>
   Continuous document processing works asynchronously in the background.
   Visible document source that has been evaluated may get augmented by
   additional results of \<^emph>\<open>asynchronous print functions\<close>. An example for that
   is proof state output, if that is enabled in the Output panel
   (\secref{sec:output}). More heavy-weight print functions may be applied as
   well, e.g.\ to prove or disprove parts of the formal text by other means.
 
   Isabelle/HOL provides various automatically tried tools that operate on
   outermost goal statements (e.g.\ @{command lemma}, @{command theorem}),
   independently of the state of the current proof attempt. They work
   implicitly without any arguments. Results are output as \<^emph>\<open>information
   messages\<close>, which are indicated in the text area by blue squiggles and a blue
   information sign in the gutter (see \figref{fig:auto-tools}). The message
   content may be shown as for other output (see also \secref{sec:output}).
   Some tools produce output with \<^emph>\<open>sendback\<close> markup, which means that clicking
   on certain parts of the text inserts that into the source in the proper
   place.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{auto-tools}
   \end{center}
   \caption{Result of automatically tried tools}
   \label{fig:auto-tools}
   \end{figure}
 
   \<^medskip>
   The following Isabelle system options control the behavior of automatically
   tried tools (see also the jEdit dialog window \<^emph>\<open>Plugin Options~/ Isabelle~/
   General~/ Automatically tried tools\<close>):
 
   \<^item> @{system_option_ref auto_methods} controls automatic use of a combination
   of standard proof methods (@{method auto}, @{method simp}, @{method blast},
   etc.). This corresponds to the Isar command @{command_ref "try0"} @{cite
   "isabelle-isar-ref"}.
 
   The tool is disabled by default, since unparameterized invocation of
   standard proof methods often consumes substantial CPU resources without
   leading to success.
 
   \<^item> @{system_option_ref auto_nitpick} controls a slightly reduced version of
   @{command_ref nitpick}, which tests for counterexamples using first-order
   relational logic. See also the Nitpick manual @{cite "isabelle-nitpick"}.
 
   This tool is disabled by default, due to the extra overhead of invoking an
   external Java process for each attempt to disprove a subgoal.
 
   \<^item> @{system_option_ref auto_quickcheck} controls automatic use of
   @{command_ref quickcheck}, which tests for counterexamples using a series of
   assignments for free variables of a subgoal.
 
   This tool is \<^emph>\<open>enabled\<close> by default. It requires little overhead, but is a
   bit weaker than @{command nitpick}.
 
   \<^item> @{system_option_ref auto_sledgehammer} controls a significantly reduced
   version of @{command_ref sledgehammer}, which attempts to prove a subgoal
   using external automatic provers. See also the Sledgehammer manual @{cite
   "isabelle-sledgehammer"}.
 
   This tool is disabled by default, due to the relatively heavy nature of
   Sledgehammer.
 
   \<^item> @{system_option_ref auto_solve_direct} controls automatic use of
   @{command_ref solve_direct}, which checks whether the current subgoals can
   be solved directly by an existing theorem. This also helps to detect
   duplicate lemmas.
 
   This tool is \<^emph>\<open>enabled\<close> by default.
 
 
   Invocation of automatically tried tools is subject to some global policies
   of parallel execution, which may be configured as follows:
 
   \<^item> @{system_option_ref auto_time_limit} (default 2.0) determines the timeout
   (in seconds) for each tool execution.
 
   \<^item> @{system_option_ref auto_time_start} (default 1.0) determines the start
   delay (in seconds) for automatically tried tools, after the main command
   evaluation is finished.
 
 
   Each tool is submitted independently to the pool of parallel execution tasks
   in Isabelle/ML, using hardwired priorities according to its relative
   ``heaviness''. The main stages of evaluation and printing of proof states
   take precedence, but an already running tool is not canceled and may thus
   reduce reactivity of proof document processing.
 
   Users should experiment how the available CPU resources (number of cores)
   are best invested to get additional feedback from prover in the background,
   by using a selection of weaker or stronger tools.
 \<close>
 
 
 section \<open>Sledgehammer \label{sec:sledgehammer}\<close>
 
 text \<open>
   The \<^emph>\<open>Sledgehammer\<close> panel (\figref{fig:sledgehammer}) provides a view on
   some independent execution of the Isar command @{command_ref sledgehammer},
   with process indicator (spinning wheel) and GUI elements for important
   Sledgehammer arguments and options. Any number of Sledgehammer panels may be
   active, according to the standard policies of Dockable Window Management in
   jEdit. Closing such windows also cancels the corresponding prover tasks.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{sledgehammer}
   \end{center}
   \caption{An instance of the Sledgehammer panel}
   \label{fig:sledgehammer}
   \end{figure}
 
   The \<^emph>\<open>Apply\<close> button attaches a fresh invocation of @{command sledgehammer}
   to the command where the cursor is pointing in the text --- this should be
   some pending proof problem. Further buttons like \<^emph>\<open>Cancel\<close> and \<^emph>\<open>Locate\<close>
   help to manage the running process.
 
   Results appear incrementally in the output window of the panel. Proposed
   proof snippets are marked-up as \<^emph>\<open>sendback\<close>, which means a single mouse
   click inserts the text into a suitable place of the original source. Some
   manual editing may be required nonetheless, say to remove earlier proof
   attempts.
 \<close>
 
 
 chapter \<open>Isabelle document preparation\<close>
 
 text \<open>
   The ultimate purpose of Isabelle is to produce nicely rendered documents
   with the Isabelle document preparation system, which is based on {\LaTeX};
   see also @{cite "isabelle-system" and "isabelle-isar-ref"}. Isabelle/jEdit
   provides some additional support for document editing.
 \<close>
 
 
 section \<open>Document outline\<close>
 
 text \<open>
   Theory sources may contain document markup commands, such as @{command_ref
   chapter}, @{command_ref section}, @{command subsection}. The Isabelle
   SideKick parser (\secref{sec:sidekick}) represents this document outline as
   structured tree view, with formal statements and proofs nested inside; see
   \figref{fig:sidekick-document}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{sidekick-document}
   \end{center}
   \caption{Isabelle document outline via SideKick tree view}
   \label{fig:sidekick-document}
   \end{figure}
 
   It is also possible to use text folding according to this structure, by
   adjusting \<^emph>\<open>Utilities / Buffer Options / Folding mode\<close> of jEdit. The default
   mode \<^verbatim>\<open>isabelle\<close> uses the structure of formal definitions, statements, and
   proofs. The alternative mode \<^verbatim>\<open>sidekick\<close> uses the document structure of the
   SideKick parser, as explained above.
 \<close>
 
 
 section \<open>Markdown structure\<close>
 
 text \<open>
   Document text is internally structured in paragraphs and nested lists, using
   notation that is similar to Markdown\<^footnote>\<open>\<^url>\<open>https://commonmark.org\<close>\<close>. There are
   special control symbols for items of different kinds of lists, corresponding
   to \<^verbatim>\<open>itemize\<close>, \<^verbatim>\<open>enumerate\<close>, \<^verbatim>\<open>description\<close> in {\LaTeX}. This is illustrated
   in for \<^verbatim>\<open>itemize\<close> in \figref{fig:markdown-document}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{markdown-document}
   \end{center}
   \caption{Markdown structure within document text}
   \label{fig:markdown-document}
   \end{figure}
 
   Items take colour according to the depth of nested lists. This helps to
   explore the implicit rules for list structure interactively. There is also
   markup for individual items and paragraphs in the text: it may be explored
   via mouse hovering with \<^verbatim>\<open>CONTROL\<close> / \<^verbatim>\<open>COMMAND\<close> as usual
   (\secref{sec:tooltips-hyperlinks}).
 \<close>
 
 
 section \<open>Citations and Bib{\TeX} entries \label{sec:bibtex}\<close>
 
 text \<open>
   Citations are managed by {\LaTeX} and Bib{\TeX} in \<^verbatim>\<open>.bib\<close> files. The
-  Isabelle session build process and the @{tool latex} tool @{cite
+  Isabelle session build process and the @{tool document} tool @{cite
   "isabelle-system"} are smart enough to assemble the result, based on the
   session directory layout.
 
   The document antiquotation \<open>@{cite}\<close> is described in @{cite
   "isabelle-isar-ref"}. Within the Prover IDE it provides semantic markup for
   tooltips, hyperlinks, and completion for Bib{\TeX} database entries.
   Isabelle/jEdit does \<^emph>\<open>not\<close> know about the actual Bib{\TeX} environment used
   in {\LaTeX} batch-mode, but it can take citations from those \<^verbatim>\<open>.bib\<close> files
   that happen to be open in the editor; see \figref{fig:cite-completion}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{cite-completion}
   \end{center}
   \caption{Semantic completion of citations from open Bib{\TeX} files}
   \label{fig:cite-completion}
   \end{figure}
 
   Isabelle/jEdit also provides IDE support for editing \<^verbatim>\<open>.bib\<close> files
   themselves. There is syntax highlighting based on entry types (according to
   standard Bib{\TeX} styles), a context-menu to compose entries
   systematically, and a SideKick tree view of the overall content; see
   \figref{fig:bibtex-mode}. Semantic checking with errors and warnings is
   performed by the original \<^verbatim>\<open>bibtex\<close> tool using style \<^verbatim>\<open>plain\<close>: different
   Bib{\TeX} styles may produce slightly different results.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{bibtex-mode}
   \end{center}
   \caption{Bib{\TeX} mode with context menu, SideKick tree view, and
     semantic output from the \<^verbatim>\<open>bibtex\<close> tool}
   \label{fig:bibtex-mode}
   \end{figure}
 
   Regular document preview (\secref{sec:document-preview}) of \<^verbatim>\<open>.bib\<close> files
   approximates the usual {\LaTeX} bibliography output in HTML (using style
   \<^verbatim>\<open>unsort\<close>).
 \<close>
 
 
 section \<open>Document preview and printing \label{sec:document-preview}\<close>
 
 text \<open>
   The action @{action_def isabelle.preview} opens an HTML preview of the
   current document node in the default web browser. The content is derived
   from the semantic markup produced by the prover, and thus depends on the
   status of formal processing.
 
   Action @{action_def isabelle.draft} is similar to @{action
   isabelle.preview}, but shows a plain-text document draft.
 
   Both actions show document sources in a regular Web browser, which may be
   also used to print the result in a more portable manner than the Java
   printer dialog of the jEdit @{action_ref print} action.
 \<close>
 
 
 chapter \<open>ML debugging within the Prover IDE\<close>
 
 text \<open>
   Isabelle/ML is based on Poly/ML\<^footnote>\<open>\<^url>\<open>https://www.polyml.org\<close>\<close> and thus
   benefits from the source-level debugger of that implementation of Standard
   ML. The Prover IDE provides the \<^emph>\<open>Debugger\<close> dockable to connect to running
   ML threads, inspect the stack frame with local ML bindings, and evaluate ML
   expressions in a particular run-time context. A typical debugger session is
   shown in \figref{fig:ml-debugger}.
 
   ML debugging depends on the following pre-requisites.
 
     \<^enum> ML source needs to be compiled with debugging enabled. This may be
     controlled for particular chunks of ML sources using any of the subsequent
     facilities.
 
       \<^enum> The system option @{system_option_ref ML_debugger} as implicit state
       of the Isabelle process. It may be changed in the menu \<^emph>\<open>Plugins /
       Plugin Options / Isabelle / General\<close>. ML modules need to be reloaded and
       recompiled to pick up that option as intended.
 
       \<^enum> The configuration option @{attribute_ref ML_debugger}, with an
       attribute of the same name, to update a global or local context (e.g.\
       with the @{command declare} command).
 
       \<^enum> Commands that modify @{attribute ML_debugger} state for individual
       files: @{command_ref ML_file_debug}, @{command_ref ML_file_no_debug},
       @{command_ref SML_file_debug}, @{command_ref SML_file_no_debug}.
 
     The instrumentation of ML code for debugging causes minor run-time
     overhead. ML modules that implement critical system infrastructure may
     lead to deadlocks or other undefined behaviour, when put under debugger
     control!
 
     \<^enum> The \<^emph>\<open>Debugger\<close> panel needs to be active, otherwise the program ignores
     debugger instrumentation of the compiler and runs unmanaged. It is also
     possible to start debugging with the panel open, and later undock it, to
     let the program continue unhindered.
 
     \<^enum> The ML program needs to be stopped at a suitable breakpoint, which may
     be activated individually or globally as follows.
 
     For ML sources that have been compiled with debugger support, the IDE
     visualizes possible breakpoints in the text. A breakpoint may be toggled
     by pointing accurately with the mouse, with a right-click to activate
     jEdit's context menu and its \<^emph>\<open>Toggle Breakpoint\<close> item. Alternatively, the
     \<^emph>\<open>Break\<close> checkbox in the \<^emph>\<open>Debugger\<close> panel may be enabled to stop ML
     threads always at the next possible breakpoint.
 
   Note that the state of individual breakpoints \<^emph>\<open>gets lost\<close> when the
   coresponding ML source is re-compiled! This may happen unintentionally,
   e.g.\ when following hyperlinks into ML modules that have not been loaded
   into the IDE before.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{ml-debugger}
   \end{center}
   \caption{ML debugger session}
   \label{fig:ml-debugger}
   \end{figure}
 
   The debugger panel (\figref{fig:ml-debugger}) shows a list of all threads
   that are presently stopped. Each thread shows a stack of all function
   invocations that lead to the current breakpoint at the top.
 
   It is possible to jump between stack positions freely, by clicking on this
   list. The current situation is displayed in the big output window, as a
   local ML environment with names and printed values.
 
   ML expressions may be evaluated in the current context by entering snippets
   of source into the text fields labeled \<open>Context\<close> and \<open>ML\<close>, and pushing the
   \<open>Eval\<close> button. By default, the source is interpreted as Isabelle/ML with the
   usual support for antiquotations (like @{command ML}, @{command ML_file}).
   Alternatively, strict Standard ML may be enforced via the \<^emph>\<open>SML\<close> checkbox
   (like @{command SML_file}).
 
   The context for Isabelle/ML is optional, it may evaluate to a value of type
   \<^ML_type>\<open>theory\<close>, \<^ML_type>\<open>Proof.context\<close>, or \<^ML_type>\<open>Context.generic\<close>.
   Thus the given ML expression (with its antiquotations) may be subject to the
   intended dynamic run-time context, instead of the static compile-time
   context.
 
   \<^medskip>
   The buttons labeled \<^emph>\<open>Continue\<close>, \<^emph>\<open>Step\<close>, \<^emph>\<open>Step over\<close>, \<^emph>\<open>Step out\<close>
   recommence execution of the program, with different policies concerning
   nested function invocations. The debugger always moves the cursor within the
   ML source to the next breakpoint position, and offers new stack frames as
   before.
 \<close>
 
 
 chapter \<open>Miscellaneous tools\<close>
 
 section \<open>Timing and monitoring\<close>
 
 text \<open>
   Managed evaluation of commands within PIDE documents includes timing
   information, which consists of elapsed (wall-clock) time, CPU time, and GC
   (garbage collection) time. Note that in a multithreaded system it is
   difficult to measure execution time precisely: elapsed time is closer to the
   real requirements of runtime resources than CPU or GC time, which are both
   subject to influences from the parallel environment that are outside the
   scope of the current command transaction.
 
   The \<^emph>\<open>Timing\<close> panel provides an overview of cumulative command timings for
   each document node. Commands with elapsed time below the given threshold are
   ignored in the grand total. Nodes are sorted according to their overall
   timing. For the document node that corresponds to the current buffer,
   individual command timings are shown as well. A double-click on a theory
   node or command moves the editor focus to that particular source position.
 
   It is also possible to reveal individual timing information via some tooltip
   for the corresponding command keyword, using the technique of mouse hovering
   with \<^verbatim>\<open>CONTROL\<close>~/ \<^verbatim>\<open>COMMAND\<close> modifier (\secref{sec:tooltips-hyperlinks}).
   Actual display of timing depends on the global option @{system_option_ref
   jedit_timing_threshold}, which can be configured in \<^emph>\<open>Plugin Options~/
   Isabelle~/ General\<close>.
 
   \<^medskip>
   The jEdit status line includes a monitor widget for the current heap usage
   of the Isabelle/ML process; this includes information about ongoing garbage
   collection (shown as ``ML cleanup''). A double-click opens a new instance of
   the \<^emph>\<open>Monitor\<close> panel, as explained below. There is a similar widget for the
   JVM: a double-click opens an external Java monitor process with detailed
   information and controls for the Java process underlying
   Isabelle/Scala/jEdit (this is based on \<^verbatim>\<open>jconsole\<close>).
 
   \<^medskip>
   The \<^emph>\<open>Monitor\<close> panel visualizes various data collections about recent
   activity of the runtime system of Isabelle/ML and Java. There are buttons to
   request a full garbage collection and sharing of live data on the ML heap.
   The display is continuously updated according to @{system_option_ref
   editor_chart_delay}. Note that the painting of the chart takes considerable
   runtime itself --- on the Java Virtual Machine that runs Isabelle/Scala, not
   Isabelle/ML.
 \<close>
 
 
 section \<open>Low-level output\<close>
 
 text \<open>
   Prover output is normally shown directly in the main text area or specific
   panels like \<^emph>\<open>Output\<close> (\secref{sec:output}) or \<^emph>\<open>State\<close>
   (\secref{sec:state-output}). Beyond this, it is occasionally useful to
   inspect low-level output channels via some of the following additional
   panels:
 
   \<^item> \<^emph>\<open>Protocol\<close> shows internal messages between the Isabelle/Scala and
   Isabelle/ML side of the PIDE document editing protocol. Recording of
   messages starts with the first activation of the corresponding dockable
   window; earlier messages are lost.
 
   Display of protocol messages causes considerable slowdown, so it is
   important to undock all \<^emph>\<open>Protocol\<close> panels for production work.
 
   \<^item> \<^emph>\<open>Raw Output\<close> shows chunks of text from the \<^verbatim>\<open>stdout\<close> and \<^verbatim>\<open>stderr\<close>
   channels of the prover process. Recording of output starts with the first
   activation of the corresponding dockable window; earlier output is lost.
 
   The implicit stateful nature of physical I/O channels makes it difficult to
   relate raw output to the actual command from where it was originating.
   Parallel execution may add to the confusion. Peeking at physical process I/O
   is only the last resort to diagnose problems with tools that are not PIDE
   compliant.
 
   Under normal circumstances, prover output always works via managed message
   channels (corresponding to \<^ML>\<open>writeln\<close>, \<^ML>\<open>warning\<close>,
   \<^ML>\<open>Output.error_message\<close> in Isabelle/ML), which are displayed by regular
   means within the document model (\secref{sec:output}). Unhandled Isabelle/ML
   exceptions are printed by the system via \<^ML>\<open>Output.error_message\<close>.
 
   \<^item> \<^emph>\<open>Syslog\<close> shows system messages that might be relevant to diagnose
   problems with the startup or shutdown phase of the prover process; this also
   includes raw output on \<^verbatim>\<open>stderr\<close>. Isabelle/ML also provides an explicit
   \<^ML>\<open>Output.system_message\<close> operation, which is occasionally useful for
   diagnostic purposes within the system infrastructure itself.
 
   A limited amount of syslog messages are buffered, independently of the
   docking state of the \<^emph>\<open>Syslog\<close> panel. This allows to diagnose serious
   problems with Isabelle/PIDE process management, outside of the actual
   protocol layer.
 
   Under normal situations, such low-level system output can be ignored.
 \<close>
 
 
 chapter \<open>Known problems and workarounds \label{sec:problems}\<close>
 
 text \<open>
   \<^item> \<^bold>\<open>Problem:\<close> Keyboard shortcuts \<^verbatim>\<open>C+PLUS\<close> and \<^verbatim>\<open>C+MINUS\<close> for adjusting the
   editor font size depend on platform details and national keyboards.
 
   \<^bold>\<open>Workaround:\<close> Rebind keys via \<^emph>\<open>Global Options~/ Shortcuts\<close>.
 
   \<^item> \<^bold>\<open>Problem:\<close> The macOS key sequence \<^verbatim>\<open>COMMAND+COMMA\<close> for application
   \<^emph>\<open>Preferences\<close> is in conflict with the jEdit default keyboard shortcut for
   \<^emph>\<open>Incremental Search Bar\<close> (action @{action_ref "quick-search"}).
 
   \<^bold>\<open>Workaround:\<close> Rebind key via \<^emph>\<open>Global Options~/ Shortcuts\<close> according to the
   national keyboard layout, e.g.\ \<^verbatim>\<open>COMMAND+SLASH\<close> on English ones.
 
   \<^item> \<^bold>\<open>Problem:\<close> On macOS with native Apple look-and-feel, some exotic
   national keyboards may cause a conflict of menu accelerator keys with
   regular jEdit key bindings. This leads to duplicate execution of the
   corresponding jEdit action.
 
   \<^bold>\<open>Workaround:\<close> Disable the native Apple menu bar via Java runtime option
   \<^verbatim>\<open>-Dapple.laf.useScreenMenuBar=false\<close>.
 
   \<^item> \<^bold>\<open>Problem:\<close> macOS system fonts sometimes lead to character drop-outs in
   the main text area.
 
   \<^bold>\<open>Workaround:\<close> Use the default \<^verbatim>\<open>Isabelle DejaVu\<close> fonts.
 
   \<^item> \<^bold>\<open>Problem:\<close> On macOS the Java printer dialog sometimes does not work.
 
   \<^bold>\<open>Workaround:\<close> Use action @{action isabelle.draft} and print via the Web
   browser.
 
   \<^item> \<^bold>\<open>Problem:\<close> Antialiased text rendering may show bad performance or bad
   visual quality, notably on Linux/X11.
 
   \<^bold>\<open>Workaround:\<close> The property \<^verbatim>\<open>view.antiAlias\<close> (via menu item Utilities /
   Global Options / Text Area / Anti Aliased smooth text) has the main impact
   on text rendering, but some related properties may also change the
   behaviour. The default is \<^verbatim>\<open>view.antiAlias=subpixel HRGB\<close>: it can be much
   faster than \<^verbatim>\<open>standard\<close>, but occasionally causes problems with odd color
   shades. An alternative is to have \<^verbatim>\<open>view.antiAlias=standard\<close> and set a Java
   system property like this:\<^footnote>\<open>See also
   \<^url>\<open>https://docs.oracle.com/javase/10/troubleshoot/java-2d-pipeline-rendering-and-properties.htm\<close>.\<close>
   @{verbatim [display] \<open>isabelle jedit -Dsun.java2d.opengl=true\<close>}
 
   If this works reliably, it can be made persistent via @{setting
   JEDIT_JAVA_OPTIONS} within \<^path>\<open>$ISABELLE_HOME_USER/etc/settings\<close>. For
   the Isabelle desktop ``app'', there is a corresponding file with Java
   runtime options in the main directory (name depends on the OS platform).
 
   \<^item> \<^bold>\<open>Problem:\<close> Some Linux/X11 input methods such as IBus tend to disrupt key
   event handling of Java/AWT/Swing.
 
   \<^bold>\<open>Workaround:\<close> Do not use X11 input methods. Note that environment variable
   \<^verbatim>\<open>XMODIFIERS\<close> is reset by default within Isabelle settings.
 
   \<^item> \<^bold>\<open>Problem:\<close> Some Linux/X11 window managers that are not ``re-parenting''
   cause problems with additional windows opened by Java. This affects either
   historic or neo-minimalistic window managers like \<^verbatim>\<open>awesome\<close> or \<^verbatim>\<open>xmonad\<close>.
 
   \<^bold>\<open>Workaround:\<close> Use a regular re-parenting X11 window manager.
 
   \<^item> \<^bold>\<open>Problem:\<close> Various forks of Linux/X11 window managers and desktop
   environments (like Gnome) disrupt the handling of menu popups and mouse
   positions of Java/AWT/Swing.
 
   \<^bold>\<open>Workaround:\<close> Use suitable version of Linux desktops.
 
   \<^item> \<^bold>\<open>Problem:\<close> Full-screen mode via jEdit action @{action_ref
   "toggle-full-screen"} (default keyboard shortcut \<^verbatim>\<open>F11\<close> or \<^verbatim>\<open>S+F11\<close>) works
   robustly on Windows, but not on macOS or various Linux/X11 window managers.
   For the latter platforms, it is approximated by educated guesses on the
   window size (excluding the macOS menu bar).
 
   \<^bold>\<open>Workaround:\<close> Use native full-screen control of the macOS window manager.
 
   \<^item> \<^bold>\<open>Problem:\<close> Heap space of the JVM may fill up and render the Prover IDE
   unresponsive, e.g.\ when editing big Isabelle sessions with many theories.
 
   \<^bold>\<open>Workaround:\<close> Increase JVM heap parameters by editing platform-specific
   files (for ``properties'' or ``options'') that are associated with the main
   app bundle.
 \<close>
 
 end
diff --git a/src/Doc/JEdit/document/build b/src/Doc/JEdit/document/build
deleted file mode 100755
--- a/src/Doc/JEdit/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo jEdit
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/JEdit/document/root.tex b/src/Doc/JEdit/document/root.tex
--- a/src/Doc/JEdit/document/root.tex
+++ b/src/Doc/JEdit/document/root.tex
@@ -1,89 +1,89 @@
 \documentclass[12pt,a4paper]{report}
 \usepackage[T1]{fontenc}
 \usepackage{supertabular}
 \usepackage{rotating}
 \usepackage{graphicx}
 \usepackage{iman,extra,isar}
 \usepackage[nohyphen,strings]{underscore}
 \usepackage{amssymb}
 \usepackage{isabelle,isabellesym}
 \usepackage{railsetup}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 \hyphenation{Edinburgh}
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 
 \isadroptag{theory}
 
 \isabellestyle{literal}
 \def\isastylett{\footnotesize\tt}
 
-\title{\includegraphics[scale=0.5]{isabelle_jedit} \\[4ex] Isabelle/jEdit}
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex] Isabelle/jEdit}
 
 \author{\emph{Makarius Wenzel}}
 
 \makeindex
 
 
 \begin{document}
 
 \maketitle
 
 \begin{abstract}
   Isabelle/jEdit is a fully-featured Prover IDE, based on Isabelle/Scala and
   the jEdit text editor. This document provides an overview of general
   principles and its main IDE functionality.
 \end{abstract}
 
 \vspace*{2.5cm}
 
 \begin{quote}
   {\small\em Isabelle's user interface is no advance over LCF's, which is
   widely condemned as ``user-unfriendly'': hard to use, bewildering to
   beginners. Hence the interest in proof editors, where a proof can be
   constructed and modified rule-by-rule using windows, mouse, and menus. But
   Edinburgh LCF was invented because real proofs require millions of
   inferences. Sophisticated tools --- rules, tactics and tacticals, the
   language ML, the logics themselves --- are hard to learn, yet they are
   essential. We may demand a mouse, but we need better education and
   training.}
 
   Lawrence C. Paulson, ``Isabelle: The Next 700 Theorem Provers''
 \end{quote}
 
 
 \vspace*{2.5cm}
 
 
 \subsubsection*{Acknowledgements}
 
 Research and implementation of concepts around PIDE and Isabelle/jEdit has
 started in 2008 and was kindly supported by:
 \begin{itemize}
 \item TU M\"unchen \url{https://www.in.tum.de}
 \item BMBF \url{https://www.bmbf.de}
 \item Universit\'e Paris-Sud \url{https://www.u-psud.fr}
 \item Digiteo \url{https://www.digiteo.fr}
 \item ANR \url{https://www.agence-nationale-recherche.fr}
 \end{itemize}
 
 
 \pagenumbering{roman}
 \tableofcontents
 \listoffigures
 \clearfirst
 
 \input{JEdit.tex}
 
 \begingroup
   \tocentry{\bibname}
   \bibliographystyle{abbrv} \small\raggedright\frenchspacing
   \bibliography{manual}
 \endgroup
 
 \tocentry{\indexname}
 \printindex
 
 \end{document}
diff --git a/src/Doc/Locales/document/build b/src/Doc/Locales/document/build
deleted file mode 100755
--- a/src/Doc/Locales/document/build
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Logics/document/build b/src/Doc/Logics/document/build
deleted file mode 100755
--- a/src/Doc/Logics/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Logics/document/root.tex b/src/Doc/Logics/document/root.tex
--- a/src/Doc/Logics/document/root.tex
+++ b/src/Doc/Logics/document/root.tex
@@ -1,55 +1,55 @@
 \documentclass[12pt,a4paper]{report}
 \usepackage{isabelle,isabellesym}
 \usepackage{graphicx,iman,extra,ttbox,proof,latexsym,pdfsetup}
 
 %%%STILL NEEDS MODAL, LCF
 %%% to index derived rls:  ^\([a-zA-Z0-9][a-zA-Z0-9_]*\)        \\tdx{\1}  
 %%% to index rulenames:   ^ *(\([a-zA-Z0-9][a-zA-Z0-9_]*\),     \\tdx{\1}  
 %%% to index constants:   \\tt \([a-zA-Z0-9][a-zA-Z0-9_]*\)     \\cdx{\1}  
 %%% to deverbify:         \\verb|\([^|]*\)|     \\ttindex{\1}  
 %% run    ../sedindex logics    to prepare index file
-\title{\includegraphics[scale=0.5]{isabelle} \\[4ex] Isabelle's Logics}
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex] Isabelle's Logics}
 
 \author{{\em Lawrence C. Paulson}\\
         Computer Laboratory \\ University of Cambridge \\
         \texttt{lcp@cl.cam.ac.uk}\\[3ex] 
         With Contributions by Tobias Nipkow and Markus Wenzel%
  \thanks{Markus Wenzel made numerous improvements.  Sara Kalvala
     contributed Chap.\ts\ref{chap:sequents}.  Philippe de Groote
    wrote the first version of the logic~LK.  Tobias Nipkow developed
    LCF and~Cube.  Martin Coen developed~Modal with assistance
    from Rajeev Gor\'e.  The research has been funded by the EPSRC
    (grants GR/G53279, GR/H40570, GR/K57381, GR/K77051, GR/M75440) and by ESPRIT
    (projects 3245: Logical Frameworks, and 6453: Types), and by the DFG
   Schwerpunktprogramm \emph{Deduktion}.} }
 
 \newcommand\subcaption[1]{\par {\centering\normalsize\sc#1\par}\bigskip
   \hrule\bigskip}
 \newenvironment{constants}{\begin{center}\small\begin{tabular}{rrrr}}{\end{tabular}\end{center}}
 
 \newcommand\bs{\char '134 }  % A backslash character for \tt font
 
 \makeindex
 
 \underscoreoff
 
 \setcounter{secnumdepth}{2} \setcounter{tocdepth}{2}  %% {secnumdepth}{2}???
 
 \pagestyle{headings}
 \sloppy
 \binperiod     %%%treat . like a binary operator
 
 \begin{document}
 \maketitle 
 \pagenumbering{roman} \tableofcontents \clearfirst
 \input{preface}
 \input{syntax}
 \input{HOL}
 \input{LK}
 \input{Sequents}
 %%\input{Modal}
 \input{CTT}
 \bibliographystyle{plain}
 \bibliography{manual}
 \printindex
 \end{document}
diff --git a/src/Doc/Logics_ZF/document/build b/src/Doc/Logics_ZF/document/build
deleted file mode 100755
--- a/src/Doc/Logics_ZF/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo ZF
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Logics_ZF/document/logics.sty b/src/Doc/Logics_ZF/document/logics.sty
--- a/src/Doc/Logics_ZF/document/logics.sty
+++ b/src/Doc/Logics_ZF/document/logics.sty
@@ -1,1 +1,179 @@
-% logics.sty : Logics Manuals Page Layout
%
\typeout{Document Style logics. Released 18 August 2003}

\hyphenation{Isa-belle man-u-script man-u-scripts ap-pen-dix mut-u-al-ly}
\hyphenation{data-type data-types co-data-type co-data-types }

%usage: \iflabelundefined{LABEL}{if not defined}{if defined}
\newcommand{\iflabelundefined}[1]{\@ifundefined{r@#1}}


%%%INDEXING  use isa-index to process the index

\newcommand\seealso[2]{\emph{see also} #1}
\usepackage{makeidx}

%index, putting page numbers of definitions in boldface
\def\bold#1{\textbf{#1}}
\newcommand\fnote[1]{#1n}
\newcommand\indexbold[1]{\index{#1|bold}}

% The alternative to \protect\isa in the indexing macros is
% \noexpand\noexpand \noexpand\isa
% need TWO levels of \noexpand to delay the expansion of \isa:
%  the \noexpand\noexpand will leave one \noexpand, to be given to the
%  (still unexpanded) \isa token.  See TeX by Topic, page 122.

%%%% for indexing constants, symbols, theorems, ...
\newcommand\cdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (constant)}}
\newcommand\sdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (symbol)}}

\newcommand\tdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (theorem)}}
\newcommand\tdxbold[1]{\isa{#1}\index{#1@\protect\isa{#1} (theorem)|bold}}

\newcommand\cldx[1]{\isa{#1}\index{#1@\protect\isa{#1} (class)}}
\newcommand\tydx[1]{\isa{#1}\index{#1@\protect\isa{#1} (type)}}
\newcommand\thydx[1]{\isa{#1}\index{#1@\protect\isa{#1} (theory)}}

\newcommand\attrdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (attribute)}}
\newcommand\cmmdx[1]{\index{#1@\protect\isacommand{#1} (command)}}
\newcommand\commdx[1]{\isacommand{#1}\index{#1@\protect\isacommand{#1} (command)}}
\newcommand\methdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (method)}}
\newcommand\tooldx[1]{\isa{#1}\index{#1@\protect\isa{#1} (tool)}}
\newcommand\settdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (setting)}}

%set argument in \bf font and index in ROMAN font (for definitions in text!)
\newcommand\bfindex[1]{{\bf#1}\index{#1|bold}\@}

\newcommand\rmindex[1]{{#1}\index{#1}\@}
\newcommand\ttindex[1]{\texttt{#1}\index{#1@\texttt{#1}}\@}
\newcommand\ttindexbold[1]{\texttt{#1}\index{#1@\texttt{#1}|bold}\@}

\newcommand{\indexboldpos}[2]{#1\@}
\newcommand{\ttindexboldpos}[2]{\isa{#1}\@}

%\newtheorem{theorem}{Theorem}[section]
\newtheorem{Exercise}{Exercise}[section]
\newenvironment{exercise}{\begin{Exercise}\rm}{\end{Exercise}}
\newcommand{\ttlbr}{\texttt{[|}}
\newcommand{\ttrbr}{\texttt{|]}}
\newcommand{\ttor}{\texttt{|}}
\newcommand{\ttall}{\texttt{!}}
\newcommand{\ttuniquex}{\texttt{?!}}
\newcommand{\ttEXU}{\texttt{EX!}}
\newcommand{\ttAnd}{\texttt{!!}}

\newcommand{\isasymignore}{}
\newcommand{\isasymimp}{\isasymlongrightarrow}
\newcommand{\isasymImp}{\isasymLongrightarrow}
\newcommand{\isasymFun}{\isasymRightarrow}
\newcommand{\isasymuniqex}{\isamath{\exists!\,}}
\renewcommand{\S}{Sect.\ts}

\renewenvironment{isamarkuptxt}{\begin{isamarkuptext}}{\end{isamarkuptext}}

\newif\ifremarks
\newcommand{\REMARK}[1]{\ifremarks\marginpar{\raggedright\footnotesize#1}\fi}

%names of Isabelle rules
\newcommand{\rulename}[1]{\hfill(#1)}
\newcommand{\rulenamedx}[1]{\hfill(#1\index{#1@\protect\isa{#1} (theorem)|bold})}

%%%% meta-logical connectives

\let\Forall=\bigwedge
\let\Imp=\Longrightarrow
\let\To=\Rightarrow
\newcommand{\Var}[1]{{?\!#1}}

%%% underscores as ordinary characters, not for subscripting
%%  use @ or \sb for subscripting; use \at for @
%%  only works in \tt font
%%  must not make _ an active char; would make \ttindex fail!
\gdef\underscoreoff{\catcode`\@=8\catcode`\_=\other}
\gdef\underscoreon{\catcode`\_=8\makeatother}
\chardef\other=12
\chardef\at=`\@

% alternative underscore
\def\_{\leavevmode\kern.06em\vbox{\hrule height.2ex width.3em}\hskip0.1em}


%%%% ``WARNING'' environment
\def\dbend{\vtop to 0pt{\vss\hbox{\Huge\bf!}\vss}}
\newenvironment{warn}{\medskip\medbreak\begingroup \clubpenalty=10000 
         \small %%WAS\baselineskip=0.9\baselineskip
         \noindent \hangindent\parindent \hangafter=-2 
         \hbox to0pt{\hskip-\hangindent\dbend\hfill}\ignorespaces}%
        {\par\endgroup\medbreak}


%%%% Standard logical symbols
\let\turn=\vdash
\let\conj=\wedge
\let\disj=\vee
\let\imp=\rightarrow
\let\bimp=\leftrightarrow
\newcommand\all[1]{\forall#1.}  %quantification
\newcommand\ex[1]{\exists#1.}
\newcommand{\pair}[1]{\langle#1\rangle}

\newcommand{\lparr}{\mathopen{(\!|}}
\newcommand{\rparr}{\mathclose{|\!)}}
\newcommand{\fs}{\mathpunct{,\,}}
\newcommand{\ty}{\mathrel{::}}
\newcommand{\asn}{\mathrel{:=}}
\newcommand{\more}{\ldots}
\newcommand{\record}[1]{\lparr #1 \rparr}
\newcommand{\dtt}{\mathord.}

\newcommand\lbrakk{\mathopen{[\![}}
\newcommand\rbrakk{\mathclose{]\!]}}
\newcommand\List[1]{\lbrakk#1\rbrakk}  %was \obj
\newcommand\vpile[1]{\begin{array}{c}#1\end{array}}
\newenvironment{matharray}[1]{\[\begin{array}{#1}}{\end{array}\]}
\newcommand{\Text}[1]{\mbox{#1}}

\DeclareMathSymbol{\dshsym}{\mathalpha}{letters}{"2D}
\newcommand{\dsh}{\mathit{\dshsym}}

\let\int=\cap
\let\un=\cup
\let\inter=\bigcap
\let\union=\bigcup

\def\ML{{\sc ml}}
\def\AST{{\sc ast}}

%macros to change the treatment of symbols
\def\relsemicolon{\mathcode`\;="303B}   %treat ; like a relation
\def\binperiod{\mathcode`\.="213A}   %treat . like a binary operator
\def\binvert{\mathcode`\|="226A}     %treat | like a binary operator

%redefinition of \sloppy and \fussy to use \emergencystretch
\def\sloppy{\tolerance2000 \hfuzz.5pt \vfuzz.5pt \emergencystretch=15pt}
\def\fussy{\tolerance200 \hfuzz.1pt \vfuzz.1pt \emergencystretch=0pt}

%non-bf version of description
\def\descrlabel#1{\hspace\labelsep #1}
\def\descr{\list{}{\labelwidth\z@ \itemindent-\leftmargin\let\makelabel\descrlabel}}
\let\enddescr\endlist

% The mathcodes for the letters A, ..., Z, a, ..., z are changed to
% generate text italic rather than math italic by default. This makes
% multi-letter identifiers look better. The mathcode for character c
% is set to |"7000| (variable family) + |"400| (text italic) + |c|.
%
\DeclareSymbolFont{italics}{\encodingdefault}{\rmdefault}{m}{it}%
\def\@setmcodes#1#2#3{{\count0=#1 \count1=#3
        \loop \global\mathcode\count0=\count1 \ifnum \count0<#2
        \advance\count0 by1 \advance\count1 by1 \repeat}}
\@setmcodes{`A}{`Z}{"7\hexnumber@\symitalics41}
\@setmcodes{`a}{`z}{"7\hexnumber@\symitalics61}

%%% \dquotes permits usage of "..." for \hbox{...} 
%%%   also taken from under.sty
{\catcode`\"=\active
\gdef\dquotes{\catcode`\"=\active  \let"=\@mathText}%
\gdef\@mathText#1"{\hbox{\mathTextFont #1\/}}}
\def\mathTextFont{\frenchspacing\tt}
\def\dquotesoff{\catcode`\"=\other}
\ No newline at end of file
+% logics.sty : Logics Manuals Page Layout
+%
+\typeout{Document Style logics. Released 18 August 2003}
+
+\hyphenation{Isa-belle man-u-script man-u-scripts ap-pen-dix mut-u-al-ly}
+\hyphenation{data-type data-types co-data-type co-data-types }
+
+%usage: \iflabelundefined{LABEL}{if not defined}{if defined}
+\newcommand{\iflabelundefined}[1]{\@ifundefined{r@#1}}
+
+
+%%%INDEXING  use isa-index to process the index
+
+\newcommand\seealso[2]{\emph{see also} #1}
+\usepackage{makeidx}
+
+%index, putting page numbers of definitions in boldface
+\def\bold#1{\textbf{#1}}
+\newcommand\fnote[1]{#1n}
+\newcommand\indexbold[1]{\index{#1|bold}}
+
+% The alternative to \protect\isa in the indexing macros is
+% \noexpand\noexpand \noexpand\isa
+% need TWO levels of \noexpand to delay the expansion of \isa:
+%  the \noexpand\noexpand will leave one \noexpand, to be given to the
+%  (still unexpanded) \isa token.  See TeX by Topic, page 122.
+
+%%%% for indexing constants, symbols, theorems, ...
+\newcommand\cdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (constant)}}
+\newcommand\sdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (symbol)}}
+
+\newcommand\tdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (theorem)}}
+\newcommand\tdxbold[1]{\isa{#1}\index{#1@\protect\isa{#1} (theorem)|bold}}
+
+\newcommand\cldx[1]{\isa{#1}\index{#1@\protect\isa{#1} (class)}}
+\newcommand\tydx[1]{\isa{#1}\index{#1@\protect\isa{#1} (type)}}
+\newcommand\thydx[1]{\isa{#1}\index{#1@\protect\isa{#1} (theory)}}
+
+\newcommand\attrdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (attribute)}}
+\newcommand\cmmdx[1]{\index{#1@\protect\isacommand{#1} (command)}}
+\newcommand\commdx[1]{\isacommand{#1}\index{#1@\protect\isacommand{#1} (command)}}
+\newcommand\methdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (method)}}
+
+%set argument in \bf font and index in ROMAN font (for definitions in text!)
+\newcommand\bfindex[1]{{\bf#1}\index{#1|bold}\@}
+
+\newcommand\rmindex[1]{{#1}\index{#1}\@}
+\newcommand\ttindex[1]{\texttt{#1}\index{#1@\texttt{#1}}\@}
+\newcommand\ttindexbold[1]{\texttt{#1}\index{#1@\texttt{#1}|bold}\@}
+
+\newcommand{\indexboldpos}[2]{#1\@}
+\newcommand{\ttindexboldpos}[2]{\isa{#1}\@}
+
+%\newtheorem{theorem}{Theorem}[section]
+\newtheorem{Exercise}{Exercise}[section]
+\newenvironment{exercise}{\begin{Exercise}\rm}{\end{Exercise}}
+\newcommand{\ttlbr}{\texttt{[|}}
+\newcommand{\ttrbr}{\texttt{|]}}
+\newcommand{\ttor}{\texttt{|}}
+\newcommand{\ttall}{\texttt{!}}
+\newcommand{\ttuniquex}{\texttt{?!}}
+\newcommand{\ttEXU}{\texttt{EX!}}
+\newcommand{\ttAnd}{\texttt{!!}}
+
+\newcommand{\isasymignore}{}
+\newcommand{\isasymimp}{\isasymlongrightarrow}
+\newcommand{\isasymImp}{\isasymLongrightarrow}
+\newcommand{\isasymFun}{\isasymRightarrow}
+\newcommand{\isasymuniqex}{\isamath{\exists!\,}}
+\renewcommand{\S}{Sect.\ts}
+
+\renewenvironment{isamarkuptxt}{\begin{isamarkuptext}}{\end{isamarkuptext}}
+
+\newif\ifremarks
+\newcommand{\REMARK}[1]{\ifremarks\marginpar{\raggedright\footnotesize#1}\fi}
+
+%names of Isabelle rules
+\newcommand{\rulename}[1]{\hfill(#1)}
+\newcommand{\rulenamedx}[1]{\hfill(#1\index{#1@\protect\isa{#1} (theorem)|bold})}
+
+%%%% meta-logical connectives
+
+\let\Forall=\bigwedge
+\let\Imp=\Longrightarrow
+\let\To=\Rightarrow
+\newcommand{\Var}[1]{{?\!#1}}
+
+%%% underscores as ordinary characters, not for subscripting
+%%  use @ or \sb for subscripting; use \at for @
+%%  only works in \tt font
+%%  must not make _ an active char; would make \ttindex fail!
+\gdef\underscoreoff{\catcode`\@=8\catcode`\_=\other}
+\gdef\underscoreon{\catcode`\_=8\makeatother}
+\chardef\other=12
+\chardef\at=`\@
+
+% alternative underscore
+\def\_{\leavevmode\kern.06em\vbox{\hrule height.2ex width.3em}\hskip0.1em}
+
+
+%%%% ``WARNING'' environment
+\def\dbend{\vtop to 0pt{\vss\hbox{\Huge\bf!}\vss}}
+\newenvironment{warn}{\medskip\medbreak\begingroup \clubpenalty=10000 
+         \small %%WAS\baselineskip=0.9\baselineskip
+         \noindent \hangindent\parindent \hangafter=-2 
+         \hbox to0pt{\hskip-\hangindent\dbend\hfill}\ignorespaces}%
+        {\par\endgroup\medbreak}
+
+
+%%%% Standard logical symbols
+\let\turn=\vdash
+\let\conj=\wedge
+\let\disj=\vee
+\let\imp=\rightarrow
+\let\bimp=\leftrightarrow
+\newcommand\all[1]{\forall#1.}  %quantification
+\newcommand\ex[1]{\exists#1.}
+\newcommand{\pair}[1]{\langle#1\rangle}
+
+\newcommand{\lparr}{\mathopen{(\!|}}
+\newcommand{\rparr}{\mathclose{|\!)}}
+\newcommand{\fs}{\mathpunct{,\,}}
+\newcommand{\ty}{\mathrel{::}}
+\newcommand{\asn}{\mathrel{:=}}
+\newcommand{\more}{\ldots}
+\newcommand{\record}[1]{\lparr #1 \rparr}
+\newcommand{\dtt}{\mathord.}
+
+\newcommand\lbrakk{\mathopen{[\![}}
+\newcommand\rbrakk{\mathclose{]\!]}}
+\newcommand\List[1]{\lbrakk#1\rbrakk}  %was \obj
+\newcommand\vpile[1]{\begin{array}{c}#1\end{array}}
+\newenvironment{matharray}[1]{\[\begin{array}{#1}}{\end{array}\]}
+\newcommand{\Text}[1]{\mbox{#1}}
+
+\DeclareMathSymbol{\dshsym}{\mathalpha}{letters}{"2D}
+\newcommand{\dsh}{\mathit{\dshsym}}
+
+\let\int=\cap
+\let\un=\cup
+\let\inter=\bigcap
+\let\union=\bigcup
+
+\def\ML{{\sc ml}}
+\def\AST{{\sc ast}}
+
+%macros to change the treatment of symbols
+\def\relsemicolon{\mathcode`\;="303B}   %treat ; like a relation
+\def\binperiod{\mathcode`\.="213A}   %treat . like a binary operator
+\def\binvert{\mathcode`\|="226A}     %treat | like a binary operator
+
+%redefinition of \sloppy and \fussy to use \emergencystretch
+\def\sloppy{\tolerance2000 \hfuzz.5pt \vfuzz.5pt \emergencystretch=15pt}
+\def\fussy{\tolerance200 \hfuzz.1pt \vfuzz.1pt \emergencystretch=0pt}
+
+%non-bf version of description
+\def\descrlabel#1{\hspace\labelsep #1}
+\def\descr{\list{}{\labelwidth\z@ \itemindent-\leftmargin\let\makelabel\descrlabel}}
+\let\enddescr\endlist
+
+% The mathcodes for the letters A, ..., Z, a, ..., z are changed to
+% generate text italic rather than math italic by default. This makes
+% multi-letter identifiers look better. The mathcode for character c
+% is set to |"7000| (variable family) + |"400| (text italic) + |c|.
+%
+\DeclareSymbolFont{italics}{\encodingdefault}{\rmdefault}{m}{it}%
+\def\@setmcodes#1#2#3{{\count0=#1 \count1=#3
+        \loop \global\mathcode\count0=\count1 \ifnum \count0<#2
+        \advance\count0 by1 \advance\count1 by1 \repeat}}
+\@setmcodes{`A}{`Z}{"7\hexnumber@\symitalics41}
+\@setmcodes{`a}{`z}{"7\hexnumber@\symitalics61}
+
+%%% \dquotes permits usage of "..." for \hbox{...} 
+%%%   also taken from under.sty
+{\catcode`\"=\active
+\gdef\dquotes{\catcode`\"=\active  \let"=\@mathText}%
+\gdef\@mathText#1"{\hbox{\mathTextFont #1\/}}}
+\def\mathTextFont{\frenchspacing\tt}
+\def\dquotesoff{\catcode`\"=\other}
diff --git a/src/Doc/Logics_ZF/document/root.tex b/src/Doc/Logics_ZF/document/root.tex
--- a/src/Doc/Logics_ZF/document/root.tex
+++ b/src/Doc/Logics_ZF/document/root.tex
@@ -1,91 +1,91 @@
 \documentclass[11pt,a4paper]{report}
 \usepackage{isabelle,isabellesym,railsetup}
 \usepackage{graphicx,logics,ttbox,proof,latexsym}
 \usepackage{isar}
 
 \usepackage{pdfsetup}   
 %last package!
 
 \remarkstrue 
 
 %%% to index derived rls: ^\([a-zA-Z0-9][a-zA-Z0-9_]*\)        \\tdx{\1}  
 %%% to index rulenames:   ^ *(\([a-zA-Z0-9][a-zA-Z0-9_]*\),     \\tdx{\1}  
 %%% to index constants:   \\tt \([a-zA-Z0-9][a-zA-Z0-9_]*\)     \\cdx{\1}  
 %%% to deverbify:         \\verb|\([^|]*\)|     \\ttindex{\1}  
 
-\title{\includegraphics[scale=0.5]{isabelle_zf} \\[4ex] 
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex] 
        Isabelle's Logics: FOL and ZF}
 
 \author{{\em Lawrence C. Paulson}\\
         Computer Laboratory \\ University of Cambridge \\
         \texttt{lcp@cl.cam.ac.uk}\\[3ex] 
         With Contributions by Tobias Nipkow and Markus Wenzel}
 
 \newcommand\subcaption[1]{\par {\centering\normalsize\sc#1\par}\bigskip
   \hrule\bigskip}
 \newenvironment{constants}{\begin{center}\small\begin{tabular}{rrrr}}{\end{tabular}\end{center}}
 
 \let\ts=\thinspace
 
 \makeindex
 
 \underscoreoff
 
 \setcounter{secnumdepth}{2} \setcounter{tocdepth}{2}  %% {secnumdepth}{2}???
 
 \pagestyle{headings}
 \sloppy
 \binperiod     %%%treat . like a binary operator
 
 
 \isadroptag{theory}
 
 \railtermfont{\isabellestyle{tt}}
 \railnontermfont{\isabellestyle{literal}}
 \railnamefont{\isabellestyle{literal}}
 
 
 \begin{document}
 \maketitle 
 
 \begin{abstract}
 This manual describes Isabelle's formalizations of many-sorted first-order
 logic (\texttt{FOL}) and Zermelo-Fraenkel set theory (\texttt{ZF}).  See the
 \emph{Reference Manual} for general Isabelle commands, and \emph{Introduction
   to Isabelle} for an overall tutorial.
 
 This manual is part of the earlier Isabelle documentation, 
 which is somewhat superseded by the Isabelle/HOL
 \emph{Tutorial}~\cite{isa-tutorial}. However, the present document is the
 only available documentation for Isabelle's versions of first-order logic
 and set theory. Much of it is concerned with 
 the primitives for conducting proofs 
 using the ML top level.  It has been rewritten to use the Isar proof
 language, but evidence of the old \ML{} orientation remains.
 \end{abstract}
 
 
 \subsubsection*{Acknowledgements} 
 Markus Wenzel made numerous improvements.
     Philippe de Groote contributed to~ZF.  Philippe No\"el and
     Martin Coen made many contributions to~ZF.  The research has 
     been funded by the EPSRC (grants GR/G53279, GR/H40570, GR/K57381,
     GR/K77051, GR/M75440) and by ESPRIT (projects 3245:
     Logical Frameworks, and 6453: Types) and by the DFG Schwerpunktprogramm
     \emph{Deduktion}.
     
 \pagenumbering{roman} \tableofcontents \cleardoublepage
 \pagenumbering{arabic} 
 \setcounter{page}{1} 
 \input{syntax}
 \input{FOL}
 \input{ZF}
 
 \isabellestyle{literal}
 \input{ZF_Isar}
 \isabellestyle{tt}
 
 \bibliographystyle{plain}
 \bibliography{manual}
 \printindex
 \end{document}
diff --git a/src/Doc/Main/Main_Doc.thy b/src/Doc/Main/Main_Doc.thy
--- a/src/Doc/Main/Main_Doc.thy
+++ b/src/Doc/Main/Main_Doc.thy
@@ -1,650 +1,650 @@
 (*<*)
 theory Main_Doc
 imports Main
 begin
 
 setup \<open>
-  Thy_Output.antiquotation_pretty_source \<^binding>\<open>term_type_only\<close> (Args.term -- Args.typ_abbrev)
+  Document_Output.antiquotation_pretty_source \<^binding>\<open>term_type_only\<close> (Args.term -- Args.typ_abbrev)
     (fn ctxt => fn (t, T) =>
       (if fastype_of t = Sign.certify_typ (Proof_Context.theory_of ctxt) T then ()
        else error "term_type_only: type mismatch";
        Syntax.pretty_typ ctxt T))
 \<close>
 setup \<open>
-  Thy_Output.antiquotation_pretty_source \<^binding>\<open>expanded_typ\<close> Args.typ
+  Document_Output.antiquotation_pretty_source \<^binding>\<open>expanded_typ\<close> Args.typ
     Syntax.pretty_typ
 \<close>
 (*>*)
 text\<open>
 
 \begin{abstract}
 This document lists the main types, functions and syntax provided by theory \<^theory>\<open>Main\<close>. It is meant as a quick overview of what is available. For infix operators and their precedences see the final section. The sophisticated class structure is only hinted at. For details see \<^url>\<open>https://isabelle.in.tum.de/library/HOL\<close>.
 \end{abstract}
 
 \section*{HOL}
 
 The basic logic: \<^prop>\<open>x = y\<close>, \<^const>\<open>True\<close>, \<^const>\<open>False\<close>, \<^prop>\<open>\<not> P\<close>, \<^prop>\<open>P \<and> Q\<close>,
 \<^prop>\<open>P \<or> Q\<close>, \<^prop>\<open>P \<longrightarrow> Q\<close>, \<^prop>\<open>\<forall>x. P\<close>, \<^prop>\<open>\<exists>x. P\<close>, \<^prop>\<open>\<exists>! x. P\<close>,
 \<^term>\<open>THE x. P\<close>.
 \<^smallskip>
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>HOL.undefined\<close> & \<^typeof>\<open>HOL.undefined\<close>\\
 \<^const>\<open>HOL.default\<close> & \<^typeof>\<open>HOL.default\<close>\\
 \end{tabular}
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 \<^term>\<open>\<not> (x = y)\<close> & @{term[source]"\<not> (x = y)"} & (\<^verbatim>\<open>~=\<close>)\\
 @{term[source]"P \<longleftrightarrow> Q"} & \<^term>\<open>P \<longleftrightarrow> Q\<close> \\
 \<^term>\<open>If x y z\<close> & @{term[source]"If x y z"}\\
 \<^term>\<open>Let e\<^sub>1 (\<lambda>x. e\<^sub>2)\<close> & @{term[source]"Let e\<^sub>1 (\<lambda>x. e\<^sub>2)"}\\
 \end{supertabular}
 
 
 \section*{Orderings}
 
 A collection of classes defining basic orderings:
 preorder, partial order, linear order, dense linear order and wellorder.
 \<^smallskip>
 
 \begin{supertabular}{@ {} l @ {~::~} l l @ {}}
 \<^const>\<open>Orderings.less_eq\<close> & \<^typeof>\<open>Orderings.less_eq\<close> & (\<^verbatim>\<open><=\<close>)\\
 \<^const>\<open>Orderings.less\<close> & \<^typeof>\<open>Orderings.less\<close>\\
 \<^const>\<open>Orderings.Least\<close> & \<^typeof>\<open>Orderings.Least\<close>\\
 \<^const>\<open>Orderings.Greatest\<close> & \<^typeof>\<open>Orderings.Greatest\<close>\\
 \<^const>\<open>Orderings.min\<close> & \<^typeof>\<open>Orderings.min\<close>\\
 \<^const>\<open>Orderings.max\<close> & \<^typeof>\<open>Orderings.max\<close>\\
 @{const[source] top} & \<^typeof>\<open>Orderings.top\<close>\\
 @{const[source] bot} & \<^typeof>\<open>Orderings.bot\<close>\\
 \<^const>\<open>Orderings.mono\<close> & \<^typeof>\<open>Orderings.mono\<close>\\
 \<^const>\<open>Orderings.strict_mono\<close> & \<^typeof>\<open>Orderings.strict_mono\<close>\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 @{term[source]"x \<ge> y"} & \<^term>\<open>x \<ge> y\<close> & (\<^verbatim>\<open>>=\<close>)\\
 @{term[source]"x > y"} & \<^term>\<open>x > y\<close>\\
 \<^term>\<open>\<forall>x\<le>y. P\<close> & @{term[source]"\<forall>x. x \<le> y \<longrightarrow> P"}\\
 \<^term>\<open>\<exists>x\<le>y. P\<close> & @{term[source]"\<exists>x. x \<le> y \<and> P"}\\
 \multicolumn{2}{@ {}l@ {}}{Similarly for $<$, $\ge$ and $>$}\\
 \<^term>\<open>LEAST x. P\<close> & @{term[source]"Least (\<lambda>x. P)"}\\
 \<^term>\<open>GREATEST x. P\<close> & @{term[source]"Greatest (\<lambda>x. P)"}\\
 \end{supertabular}
 
 
 \section*{Lattices}
 
 Classes semilattice, lattice, distributive lattice and complete lattice (the
 latter in theory \<^theory>\<open>HOL.Set\<close>).
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Lattices.inf\<close> & \<^typeof>\<open>Lattices.inf\<close>\\
 \<^const>\<open>Lattices.sup\<close> & \<^typeof>\<open>Lattices.sup\<close>\\
 \<^const>\<open>Complete_Lattices.Inf\<close> & @{term_type_only Complete_Lattices.Inf "'a set \<Rightarrow> 'a::Inf"}\\
 \<^const>\<open>Complete_Lattices.Sup\<close> & @{term_type_only Complete_Lattices.Sup "'a set \<Rightarrow> 'a::Sup"}\\
 \end{tabular}
 
 \subsubsection*{Syntax}
 
 Available by loading theory \<open>Lattice_Syntax\<close> in directory \<open>Library\<close>.
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 @{text[source]"x \<sqsubseteq> y"} & \<^term>\<open>x \<le> y\<close>\\
 @{text[source]"x \<sqsubset> y"} & \<^term>\<open>x < y\<close>\\
 @{text[source]"x \<sqinter> y"} & \<^term>\<open>inf x y\<close>\\
 @{text[source]"x \<squnion> y"} & \<^term>\<open>sup x y\<close>\\
 @{text[source]"\<Sqinter>A"} & \<^term>\<open>Inf A\<close>\\
 @{text[source]"\<Squnion>A"} & \<^term>\<open>Sup A\<close>\\
 @{text[source]"\<top>"} & @{term[source] top}\\
 @{text[source]"\<bottom>"} & @{term[source] bot}\\
 \end{supertabular}
 
 
 \section*{Set}
 
 \begin{supertabular}{@ {} l @ {~::~} l l @ {}}
 \<^const>\<open>Set.empty\<close> & @{term_type_only "Set.empty" "'a set"}\\
 \<^const>\<open>Set.insert\<close> & @{term_type_only insert "'a\<Rightarrow>'a set\<Rightarrow>'a set"}\\
 \<^const>\<open>Collect\<close> & @{term_type_only Collect "('a\<Rightarrow>bool)\<Rightarrow>'a set"}\\
 \<^const>\<open>Set.member\<close> & @{term_type_only Set.member "'a\<Rightarrow>'a set\<Rightarrow>bool"} & (\<^verbatim>\<open>:\<close>)\\
 \<^const>\<open>Set.union\<close> & @{term_type_only Set.union "'a set\<Rightarrow>'a set \<Rightarrow> 'a set"} & (\<^verbatim>\<open>Un\<close>)\\
 \<^const>\<open>Set.inter\<close> & @{term_type_only Set.inter "'a set\<Rightarrow>'a set \<Rightarrow> 'a set"} & (\<^verbatim>\<open>Int\<close>)\\
 \<^const>\<open>Union\<close> & @{term_type_only Union "'a set set\<Rightarrow>'a set"}\\
 \<^const>\<open>Inter\<close> & @{term_type_only Inter "'a set set\<Rightarrow>'a set"}\\
 \<^const>\<open>Pow\<close> & @{term_type_only Pow "'a set \<Rightarrow>'a set set"}\\
 \<^const>\<open>UNIV\<close> & @{term_type_only UNIV "'a set"}\\
 \<^const>\<open>image\<close> & @{term_type_only image "('a\<Rightarrow>'b)\<Rightarrow>'a set\<Rightarrow>'b set"}\\
 \<^const>\<open>Ball\<close> & @{term_type_only Ball "'a set\<Rightarrow>('a\<Rightarrow>bool)\<Rightarrow>bool"}\\
 \<^const>\<open>Bex\<close> & @{term_type_only Bex "'a set\<Rightarrow>('a\<Rightarrow>bool)\<Rightarrow>bool"}\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 \<open>{a\<^sub>1,\<dots>,a\<^sub>n}\<close> & \<open>insert a\<^sub>1 (\<dots> (insert a\<^sub>n {})\<dots>)\<close>\\
 \<^term>\<open>a \<notin> A\<close> & @{term[source]"\<not>(x \<in> A)"}\\
 \<^term>\<open>A \<subseteq> B\<close> & @{term[source]"A \<le> B"}\\
 \<^term>\<open>A \<subset> B\<close> & @{term[source]"A < B"}\\
 @{term[source]"A \<supseteq> B"} & @{term[source]"B \<le> A"}\\
 @{term[source]"A \<supset> B"} & @{term[source]"B < A"}\\
 \<^term>\<open>{x. P}\<close> & @{term[source]"Collect (\<lambda>x. P)"}\\
 \<open>{t | x\<^sub>1 \<dots> x\<^sub>n. P}\<close> & \<open>{v. \<exists>x\<^sub>1 \<dots> x\<^sub>n. v = t \<and> P}\<close>\\
 @{term[source]"\<Union>x\<in>I. A"} & @{term[source]"\<Union>((\<lambda>x. A) ` I)"} & (\texttt{UN})\\
 @{term[source]"\<Union>x. A"} & @{term[source]"\<Union>((\<lambda>x. A) ` UNIV)"}\\
 @{term[source]"\<Inter>x\<in>I. A"} & @{term[source]"\<Inter>((\<lambda>x. A) ` I)"} & (\texttt{INT})\\
 @{term[source]"\<Inter>x. A"} & @{term[source]"\<Inter>((\<lambda>x. A) ` UNIV)"}\\
 \<^term>\<open>\<forall>x\<in>A. P\<close> & @{term[source]"Ball A (\<lambda>x. P)"}\\
 \<^term>\<open>\<exists>x\<in>A. P\<close> & @{term[source]"Bex A (\<lambda>x. P)"}\\
 \<^term>\<open>range f\<close> & @{term[source]"f ` UNIV"}\\
 \end{supertabular}
 
 
 \section*{Fun}
 
 \begin{supertabular}{@ {} l @ {~::~} l l @ {}}
 \<^const>\<open>Fun.id\<close> & \<^typeof>\<open>Fun.id\<close>\\
 \<^const>\<open>Fun.comp\<close> & \<^typeof>\<open>Fun.comp\<close> & (\texttt{o})\\
 \<^const>\<open>Fun.inj_on\<close> & @{term_type_only Fun.inj_on "('a\<Rightarrow>'b)\<Rightarrow>'a set\<Rightarrow>bool"}\\
 \<^const>\<open>Fun.inj\<close> & \<^typeof>\<open>Fun.inj\<close>\\
 \<^const>\<open>Fun.surj\<close> & \<^typeof>\<open>Fun.surj\<close>\\
 \<^const>\<open>Fun.bij\<close> & \<^typeof>\<open>Fun.bij\<close>\\
 \<^const>\<open>Fun.bij_betw\<close> & @{term_type_only Fun.bij_betw "('a\<Rightarrow>'b)\<Rightarrow>'a set\<Rightarrow>'b set\<Rightarrow>bool"}\\
 \<^const>\<open>Fun.fun_upd\<close> & \<^typeof>\<open>Fun.fun_upd\<close>\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>fun_upd f x y\<close> & @{term[source]"fun_upd f x y"}\\
 \<open>f(x\<^sub>1:=y\<^sub>1,\<dots>,x\<^sub>n:=y\<^sub>n)\<close> & \<open>f(x\<^sub>1:=y\<^sub>1)\<dots>(x\<^sub>n:=y\<^sub>n)\<close>\\
 \end{tabular}
 
 
 \section*{Hilbert\_Choice}
 
 Hilbert's selection ($\varepsilon$) operator: \<^term>\<open>SOME x. P\<close>.
 \<^smallskip>
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Hilbert_Choice.inv_into\<close> & @{term_type_only Hilbert_Choice.inv_into "'a set \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'a)"}
 \end{tabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>inv\<close> & @{term[source]"inv_into UNIV"}
 \end{tabular}
 
 \section*{Fixed Points}
 
 Theory: \<^theory>\<open>HOL.Inductive\<close>.
 
 Least and greatest fixed points in a complete lattice \<^typ>\<open>'a\<close>:
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Inductive.lfp\<close> & \<^typeof>\<open>Inductive.lfp\<close>\\
 \<^const>\<open>Inductive.gfp\<close> & \<^typeof>\<open>Inductive.gfp\<close>\\
 \end{tabular}
 
 Note that in particular sets (\<^typ>\<open>'a \<Rightarrow> bool\<close>) are complete lattices.
 
 \section*{Sum\_Type}
 
 Type constructor \<open>+\<close>.
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Sum_Type.Inl\<close> & \<^typeof>\<open>Sum_Type.Inl\<close>\\
 \<^const>\<open>Sum_Type.Inr\<close> & \<^typeof>\<open>Sum_Type.Inr\<close>\\
 \<^const>\<open>Sum_Type.Plus\<close> & @{term_type_only Sum_Type.Plus "'a set\<Rightarrow>'b set\<Rightarrow>('a+'b)set"}
 \end{tabular}
 
 
 \section*{Product\_Type}
 
 Types \<^typ>\<open>unit\<close> and \<open>\<times>\<close>.
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Product_Type.Unity\<close> & \<^typeof>\<open>Product_Type.Unity\<close>\\
 \<^const>\<open>Pair\<close> & \<^typeof>\<open>Pair\<close>\\
 \<^const>\<open>fst\<close> & \<^typeof>\<open>fst\<close>\\
 \<^const>\<open>snd\<close> & \<^typeof>\<open>snd\<close>\\
 \<^const>\<open>case_prod\<close> & \<^typeof>\<open>case_prod\<close>\\
 \<^const>\<open>curry\<close> & \<^typeof>\<open>curry\<close>\\
 \<^const>\<open>Product_Type.Sigma\<close> & @{term_type_only Product_Type.Sigma "'a set\<Rightarrow>('a\<Rightarrow>'b set)\<Rightarrow>('a*'b)set"}\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} ll @ {}}
 \<^term>\<open>Pair a b\<close> & @{term[source]"Pair a b"}\\
 \<^term>\<open>case_prod (\<lambda>x y. t)\<close> & @{term[source]"case_prod (\<lambda>x y. t)"}\\
 \<^term>\<open>A \<times> B\<close> &  \<open>Sigma A (\<lambda>\<^latex>\<open>\_\<close>. B)\<close>
 \end{tabular}
 
 Pairs may be nested. Nesting to the right is printed as a tuple,
 e.g.\ \mbox{\<^term>\<open>(a,b,c)\<close>} is really \mbox{\<open>(a, (b, c))\<close>.}
 Pattern matching with pairs and tuples extends to all binders,
 e.g.\ \mbox{\<^prop>\<open>\<forall>(x,y)\<in>A. P\<close>,} \<^term>\<open>{(x,y). P}\<close>, etc.
 
 
 \section*{Relation}
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Relation.converse\<close> & @{term_type_only Relation.converse "('a * 'b)set \<Rightarrow> ('b*'a)set"}\\
 \<^const>\<open>Relation.relcomp\<close> & @{term_type_only Relation.relcomp "('a*'b)set\<Rightarrow>('b*'c)set\<Rightarrow>('a*'c)set"}\\
 \<^const>\<open>Relation.Image\<close> & @{term_type_only Relation.Image "('a*'b)set\<Rightarrow>'a set\<Rightarrow>'b set"}\\
 \<^const>\<open>Relation.inv_image\<close> & @{term_type_only Relation.inv_image "('a*'a)set\<Rightarrow>('b\<Rightarrow>'a)\<Rightarrow>('b*'b)set"}\\
 \<^const>\<open>Relation.Id_on\<close> & @{term_type_only Relation.Id_on "'a set\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>Relation.Id\<close> & @{term_type_only Relation.Id "('a*'a)set"}\\
 \<^const>\<open>Relation.Domain\<close> & @{term_type_only Relation.Domain "('a*'b)set\<Rightarrow>'a set"}\\
 \<^const>\<open>Relation.Range\<close> & @{term_type_only Relation.Range "('a*'b)set\<Rightarrow>'b set"}\\
 \<^const>\<open>Relation.Field\<close> & @{term_type_only Relation.Field "('a*'a)set\<Rightarrow>'a set"}\\
 \<^const>\<open>Relation.refl_on\<close> & @{term_type_only Relation.refl_on "'a set\<Rightarrow>('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.refl\<close> & @{term_type_only Relation.refl "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.sym\<close> & @{term_type_only Relation.sym "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.antisym\<close> & @{term_type_only Relation.antisym "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.trans\<close> & @{term_type_only Relation.trans "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.irrefl\<close> & @{term_type_only Relation.irrefl "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.total_on\<close> & @{term_type_only Relation.total_on "'a set\<Rightarrow>('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Relation.total\<close> & @{term_type_only Relation.total "('a*'a)set\<Rightarrow>bool"}\\
 \end{tabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 \<^term>\<open>converse r\<close> & @{term[source]"converse r"} & (\<^verbatim>\<open>^-1\<close>)
 \end{tabular}
 \<^medskip>
 
 \noindent
 Type synonym \ \<^typ>\<open>'a rel\<close> \<open>=\<close> @{expanded_typ "'a rel"}
 
 \section*{Equiv\_Relations}
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Equiv_Relations.equiv\<close> & @{term_type_only Equiv_Relations.equiv "'a set \<Rightarrow> ('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Equiv_Relations.quotient\<close> & @{term_type_only Equiv_Relations.quotient "'a set \<Rightarrow> ('a \<times> 'a) set \<Rightarrow> 'a set set"}\\
 \<^const>\<open>Equiv_Relations.congruent\<close> & @{term_type_only Equiv_Relations.congruent "('a*'a)set\<Rightarrow>('a\<Rightarrow>'b)\<Rightarrow>bool"}\\
 \<^const>\<open>Equiv_Relations.congruent2\<close> & @{term_type_only Equiv_Relations.congruent2 "('a*'a)set\<Rightarrow>('b*'b)set\<Rightarrow>('a\<Rightarrow>'b\<Rightarrow>'c)\<Rightarrow>bool"}\\
 %@ {const Equiv_Relations.} & @ {term_type_only Equiv_Relations. ""}\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>congruent r f\<close> & @{term[source]"congruent r f"}\\
 \<^term>\<open>congruent2 r r f\<close> & @{term[source]"congruent2 r r f"}\\
 \end{tabular}
 
 
 \section*{Transitive\_Closure}
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Transitive_Closure.rtrancl\<close> & @{term_type_only Transitive_Closure.rtrancl "('a*'a)set\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>Transitive_Closure.trancl\<close> & @{term_type_only Transitive_Closure.trancl "('a*'a)set\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>Transitive_Closure.reflcl\<close> & @{term_type_only Transitive_Closure.reflcl "('a*'a)set\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>Transitive_Closure.acyclic\<close> & @{term_type_only Transitive_Closure.acyclic "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>compower\<close> & @{term_type_only "(^^) :: ('a*'a)set\<Rightarrow>nat\<Rightarrow>('a*'a)set" "('a*'a)set\<Rightarrow>nat\<Rightarrow>('a*'a)set"}\\
 \end{tabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 \<^term>\<open>rtrancl r\<close> & @{term[source]"rtrancl r"} & (\<^verbatim>\<open>^*\<close>)\\
 \<^term>\<open>trancl r\<close> & @{term[source]"trancl r"} & (\<^verbatim>\<open>^+\<close>)\\
 \<^term>\<open>reflcl r\<close> & @{term[source]"reflcl r"} & (\<^verbatim>\<open>^=\<close>)
 \end{tabular}
 
 
 \section*{Algebra}
 
 Theories \<^theory>\<open>HOL.Groups\<close>, \<^theory>\<open>HOL.Rings\<close>, \<^theory>\<open>HOL.Fields\<close> and \<^theory>\<open>HOL.Divides\<close> define a large collection of classes describing common algebraic
 structures from semigroups up to fields. Everything is done in terms of
 overloaded operators:
 
 \begin{supertabular}{@ {} l @ {~::~} l l @ {}}
 \<open>0\<close> & \<^typeof>\<open>zero\<close>\\
 \<open>1\<close> & \<^typeof>\<open>one\<close>\\
 \<^const>\<open>plus\<close> & \<^typeof>\<open>plus\<close>\\
 \<^const>\<open>minus\<close> & \<^typeof>\<open>minus\<close>\\
 \<^const>\<open>uminus\<close> & \<^typeof>\<open>uminus\<close> & (\<^verbatim>\<open>-\<close>)\\
 \<^const>\<open>times\<close> & \<^typeof>\<open>times\<close>\\
 \<^const>\<open>inverse\<close> & \<^typeof>\<open>inverse\<close>\\
 \<^const>\<open>divide\<close> & \<^typeof>\<open>divide\<close>\\
 \<^const>\<open>abs\<close> & \<^typeof>\<open>abs\<close>\\
 \<^const>\<open>sgn\<close> & \<^typeof>\<open>sgn\<close>\\
 \<^const>\<open>Rings.dvd\<close> & \<^typeof>\<open>Rings.dvd\<close>\\
 \<^const>\<open>divide\<close> & \<^typeof>\<open>divide\<close>\\
 \<^const>\<open>modulo\<close> & \<^typeof>\<open>modulo\<close>\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>\<bar>x\<bar>\<close> & @{term[source] "abs x"}
 \end{tabular}
 
 
 \section*{Nat}
 
 \<^datatype>\<open>nat\<close>
 \<^bigskip>
 
 \begin{tabular}{@ {} lllllll @ {}}
 \<^term>\<open>(+) :: nat \<Rightarrow> nat \<Rightarrow> nat\<close> &
 \<^term>\<open>(-) :: nat \<Rightarrow> nat \<Rightarrow> nat\<close> &
 \<^term>\<open>(*) :: nat \<Rightarrow> nat \<Rightarrow> nat\<close> &
 \<^term>\<open>(^) :: nat \<Rightarrow> nat \<Rightarrow> nat\<close> &
 \<^term>\<open>(div) :: nat \<Rightarrow> nat \<Rightarrow> nat\<close>&
 \<^term>\<open>(mod) :: nat \<Rightarrow> nat \<Rightarrow> nat\<close>&
 \<^term>\<open>(dvd) :: nat \<Rightarrow> nat \<Rightarrow> bool\<close>\\
 \<^term>\<open>(\<le>) :: nat \<Rightarrow> nat \<Rightarrow> bool\<close> &
 \<^term>\<open>(<) :: nat \<Rightarrow> nat \<Rightarrow> bool\<close> &
 \<^term>\<open>min :: nat \<Rightarrow> nat \<Rightarrow> nat\<close> &
 \<^term>\<open>max :: nat \<Rightarrow> nat \<Rightarrow> nat\<close> &
 \<^term>\<open>Min :: nat set \<Rightarrow> nat\<close> &
 \<^term>\<open>Max :: nat set \<Rightarrow> nat\<close>\\
 \end{tabular}
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Nat.of_nat\<close> & \<^typeof>\<open>Nat.of_nat\<close>\\
 \<^term>\<open>(^^) :: ('a \<Rightarrow> 'a) \<Rightarrow> nat \<Rightarrow> 'a \<Rightarrow> 'a\<close> &
   @{term_type_only "(^^) :: ('a \<Rightarrow> 'a) \<Rightarrow> nat \<Rightarrow> 'a \<Rightarrow> 'a" "('a \<Rightarrow> 'a) \<Rightarrow> nat \<Rightarrow> 'a \<Rightarrow> 'a"}
 \end{tabular}
 
 \section*{Int}
 
 Type \<^typ>\<open>int\<close>
 \<^bigskip>
 
 \begin{tabular}{@ {} llllllll @ {}}
 \<^term>\<open>(+) :: int \<Rightarrow> int \<Rightarrow> int\<close> &
 \<^term>\<open>(-) :: int \<Rightarrow> int \<Rightarrow> int\<close> &
 \<^term>\<open>uminus :: int \<Rightarrow> int\<close> &
 \<^term>\<open>(*) :: int \<Rightarrow> int \<Rightarrow> int\<close> &
 \<^term>\<open>(^) :: int \<Rightarrow> nat \<Rightarrow> int\<close> &
 \<^term>\<open>(div) :: int \<Rightarrow> int \<Rightarrow> int\<close>&
 \<^term>\<open>(mod) :: int \<Rightarrow> int \<Rightarrow> int\<close>&
 \<^term>\<open>(dvd) :: int \<Rightarrow> int \<Rightarrow> bool\<close>\\
 \<^term>\<open>(\<le>) :: int \<Rightarrow> int \<Rightarrow> bool\<close> &
 \<^term>\<open>(<) :: int \<Rightarrow> int \<Rightarrow> bool\<close> &
 \<^term>\<open>min :: int \<Rightarrow> int \<Rightarrow> int\<close> &
 \<^term>\<open>max :: int \<Rightarrow> int \<Rightarrow> int\<close> &
 \<^term>\<open>Min :: int set \<Rightarrow> int\<close> &
 \<^term>\<open>Max :: int set \<Rightarrow> int\<close>\\
 \<^term>\<open>abs :: int \<Rightarrow> int\<close> &
 \<^term>\<open>sgn :: int \<Rightarrow> int\<close>\\
 \end{tabular}
 
 \begin{tabular}{@ {} l @ {~::~} l l @ {}}
 \<^const>\<open>Int.nat\<close> & \<^typeof>\<open>Int.nat\<close>\\
 \<^const>\<open>Int.of_int\<close> & \<^typeof>\<open>Int.of_int\<close>\\
 \<^const>\<open>Int.Ints\<close> & @{term_type_only Int.Ints "'a::ring_1 set"} & (\<^verbatim>\<open>Ints\<close>)
 \end{tabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>of_nat::nat\<Rightarrow>int\<close> & @{term[source]"of_nat"}\\
 \end{tabular}
 
 
 \section*{Finite\_Set}
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Finite_Set.finite\<close> & @{term_type_only Finite_Set.finite "'a set\<Rightarrow>bool"}\\
 \<^const>\<open>Finite_Set.card\<close> & @{term_type_only Finite_Set.card "'a set \<Rightarrow> nat"}\\
 \<^const>\<open>Finite_Set.fold\<close> & @{term_type_only Finite_Set.fold "('a \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> 'b \<Rightarrow> 'a set \<Rightarrow> 'b"}\\
 \end{supertabular}
 
 
 \section*{Lattices\_Big}
 
 \begin{supertabular}{@ {} l @ {~::~} l l @ {}}
 \<^const>\<open>Lattices_Big.Min\<close> & \<^typeof>\<open>Lattices_Big.Min\<close>\\
 \<^const>\<open>Lattices_Big.Max\<close> & \<^typeof>\<open>Lattices_Big.Max\<close>\\
 \<^const>\<open>Lattices_Big.arg_min\<close> & \<^typeof>\<open>Lattices_Big.arg_min\<close>\\
 \<^const>\<open>Lattices_Big.is_arg_min\<close> & \<^typeof>\<open>Lattices_Big.is_arg_min\<close>\\
 \<^const>\<open>Lattices_Big.arg_max\<close> & \<^typeof>\<open>Lattices_Big.arg_max\<close>\\
 \<^const>\<open>Lattices_Big.is_arg_max\<close> & \<^typeof>\<open>Lattices_Big.is_arg_max\<close>\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 \<^term>\<open>ARG_MIN f x. P\<close> & @{term[source]"arg_min f (\<lambda>x. P)"}\\
 \<^term>\<open>ARG_MAX f x. P\<close> & @{term[source]"arg_max f (\<lambda>x. P)"}\\
 \end{supertabular}
 
 
 \section*{Groups\_Big}
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Groups_Big.sum\<close> & @{term_type_only Groups_Big.sum "('a \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> 'b::comm_monoid_add"}\\
 \<^const>\<open>Groups_Big.prod\<close> & @{term_type_only Groups_Big.prod "('a \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> 'b::comm_monoid_mult"}\\
 \end{supertabular}
 
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l l @ {}}
 \<^term>\<open>sum (\<lambda>x. x) A\<close> & @{term[source]"sum (\<lambda>x. x) A"} & (\<^verbatim>\<open>SUM\<close>)\\
 \<^term>\<open>sum (\<lambda>x. t) A\<close> & @{term[source]"sum (\<lambda>x. t) A"}\\
 @{term[source] "\<Sum>x|P. t"} & \<^term>\<open>\<Sum>x|P. t\<close>\\
 \multicolumn{2}{@ {}l@ {}}{Similarly for \<open>\<Prod>\<close> instead of \<open>\<Sum>\<close>} & (\<^verbatim>\<open>PROD\<close>)\\
 \end{supertabular}
 
 
 \section*{Wellfounded}
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Wellfounded.wf\<close> & @{term_type_only Wellfounded.wf "('a*'a)set\<Rightarrow>bool"}\\
 \<^const>\<open>Wellfounded.acc\<close> & @{term_type_only Wellfounded.acc "('a*'a)set\<Rightarrow>'a set"}\\
 \<^const>\<open>Wellfounded.measure\<close> & @{term_type_only Wellfounded.measure "('a\<Rightarrow>nat)\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>Wellfounded.lex_prod\<close> & @{term_type_only Wellfounded.lex_prod "('a*'a)set\<Rightarrow>('b*'b)set\<Rightarrow>(('a*'b)*('a*'b))set"}\\
 \<^const>\<open>Wellfounded.mlex_prod\<close> & @{term_type_only Wellfounded.mlex_prod "('a\<Rightarrow>nat)\<Rightarrow>('a*'a)set\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>Wellfounded.less_than\<close> & @{term_type_only Wellfounded.less_than "(nat*nat)set"}\\
 \<^const>\<open>Wellfounded.pred_nat\<close> & @{term_type_only Wellfounded.pred_nat "(nat*nat)set"}\\
 \end{supertabular}
 
 
 \section*{Set\_Interval} % \<^theory>\<open>HOL.Set_Interval\<close>
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>lessThan\<close> & @{term_type_only lessThan "'a::ord \<Rightarrow> 'a set"}\\
 \<^const>\<open>atMost\<close> & @{term_type_only atMost "'a::ord \<Rightarrow> 'a set"}\\
 \<^const>\<open>greaterThan\<close> & @{term_type_only greaterThan "'a::ord \<Rightarrow> 'a set"}\\
 \<^const>\<open>atLeast\<close> & @{term_type_only atLeast "'a::ord \<Rightarrow> 'a set"}\\
 \<^const>\<open>greaterThanLessThan\<close> & @{term_type_only greaterThanLessThan "'a::ord \<Rightarrow> 'a \<Rightarrow> 'a set"}\\
 \<^const>\<open>atLeastLessThan\<close> & @{term_type_only atLeastLessThan "'a::ord \<Rightarrow> 'a \<Rightarrow> 'a set"}\\
 \<^const>\<open>greaterThanAtMost\<close> & @{term_type_only greaterThanAtMost "'a::ord \<Rightarrow> 'a \<Rightarrow> 'a set"}\\
 \<^const>\<open>atLeastAtMost\<close> & @{term_type_only atLeastAtMost "'a::ord \<Rightarrow> 'a \<Rightarrow> 'a set"}\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>lessThan y\<close> & @{term[source] "lessThan y"}\\
 \<^term>\<open>atMost y\<close> & @{term[source] "atMost y"}\\
 \<^term>\<open>greaterThan x\<close> & @{term[source] "greaterThan x"}\\
 \<^term>\<open>atLeast x\<close> & @{term[source] "atLeast x"}\\
 \<^term>\<open>greaterThanLessThan x y\<close> & @{term[source] "greaterThanLessThan x y"}\\
 \<^term>\<open>atLeastLessThan x y\<close> & @{term[source] "atLeastLessThan x y"}\\
 \<^term>\<open>greaterThanAtMost x y\<close> & @{term[source] "greaterThanAtMost x y"}\\
 \<^term>\<open>atLeastAtMost x y\<close> & @{term[source] "atLeastAtMost x y"}\\
 @{term[source] "\<Union>i\<le>n. A"} & @{term[source] "\<Union>i \<in> {..n}. A"}\\
 @{term[source] "\<Union>i<n. A"} & @{term[source] "\<Union>i \<in> {..<n}. A"}\\
 \multicolumn{2}{@ {}l@ {}}{Similarly for \<open>\<Inter>\<close> instead of \<open>\<Union>\<close>}\\
 \<^term>\<open>sum (\<lambda>x. t) {a..b}\<close> & @{term[source] "sum (\<lambda>x. t) {a..b}"}\\
 \<^term>\<open>sum (\<lambda>x. t) {a..<b}\<close> & @{term[source] "sum (\<lambda>x. t) {a..<b}"}\\
 \<^term>\<open>sum (\<lambda>x. t) {..b}\<close> & @{term[source] "sum (\<lambda>x. t) {..b}"}\\
 \<^term>\<open>sum (\<lambda>x. t) {..<b}\<close> & @{term[source] "sum (\<lambda>x. t) {..<b}"}\\
 \multicolumn{2}{@ {}l@ {}}{Similarly for \<open>\<Prod>\<close> instead of \<open>\<Sum>\<close>}\\
 \end{supertabular}
 
 
 \section*{Power}
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Power.power\<close> & \<^typeof>\<open>Power.power\<close>
 \end{tabular}
 
 
 \section*{Option}
 
 \<^datatype>\<open>option\<close>
 \<^bigskip>
 
 \begin{tabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Option.the\<close> & \<^typeof>\<open>Option.the\<close>\\
 \<^const>\<open>map_option\<close> & @{typ[source]"('a \<Rightarrow> 'b) \<Rightarrow> 'a option \<Rightarrow> 'b option"}\\
 \<^const>\<open>set_option\<close> & @{term_type_only set_option "'a option \<Rightarrow> 'a set"}\\
 \<^const>\<open>Option.bind\<close> & @{term_type_only Option.bind "'a option \<Rightarrow> ('a \<Rightarrow> 'b option) \<Rightarrow> 'b option"}
 \end{tabular}
 
 \section*{List}
 
 \<^datatype>\<open>list\<close>
 \<^bigskip>
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>List.append\<close> & \<^typeof>\<open>List.append\<close>\\
 \<^const>\<open>List.butlast\<close> & \<^typeof>\<open>List.butlast\<close>\\
 \<^const>\<open>List.concat\<close> & \<^typeof>\<open>List.concat\<close>\\
 \<^const>\<open>List.distinct\<close> & \<^typeof>\<open>List.distinct\<close>\\
 \<^const>\<open>List.drop\<close> & \<^typeof>\<open>List.drop\<close>\\
 \<^const>\<open>List.dropWhile\<close> & \<^typeof>\<open>List.dropWhile\<close>\\
 \<^const>\<open>List.filter\<close> & \<^typeof>\<open>List.filter\<close>\\
 \<^const>\<open>List.find\<close> & \<^typeof>\<open>List.find\<close>\\
 \<^const>\<open>List.fold\<close> & \<^typeof>\<open>List.fold\<close>\\
 \<^const>\<open>List.foldr\<close> & \<^typeof>\<open>List.foldr\<close>\\
 \<^const>\<open>List.foldl\<close> & \<^typeof>\<open>List.foldl\<close>\\
 \<^const>\<open>List.hd\<close> & \<^typeof>\<open>List.hd\<close>\\
 \<^const>\<open>List.last\<close> & \<^typeof>\<open>List.last\<close>\\
 \<^const>\<open>List.length\<close> & \<^typeof>\<open>List.length\<close>\\
 \<^const>\<open>List.lenlex\<close> & @{term_type_only List.lenlex "('a*'a)set\<Rightarrow>('a list * 'a list)set"}\\
 \<^const>\<open>List.lex\<close> & @{term_type_only List.lex "('a*'a)set\<Rightarrow>('a list * 'a list)set"}\\
 \<^const>\<open>List.lexn\<close> & @{term_type_only List.lexn "('a*'a)set\<Rightarrow>nat\<Rightarrow>('a list * 'a list)set"}\\
 \<^const>\<open>List.lexord\<close> & @{term_type_only List.lexord "('a*'a)set\<Rightarrow>('a list * 'a list)set"}\\
 \<^const>\<open>List.listrel\<close> & @{term_type_only List.listrel "('a*'b)set\<Rightarrow>('a list * 'b list)set"}\\
 \<^const>\<open>List.listrel1\<close> & @{term_type_only List.listrel1 "('a*'a)set\<Rightarrow>('a list * 'a list)set"}\\
 \<^const>\<open>List.lists\<close> & @{term_type_only List.lists "'a set\<Rightarrow>'a list set"}\\
 \<^const>\<open>List.listset\<close> & @{term_type_only List.listset "'a set list \<Rightarrow> 'a list set"}\\
 \<^const>\<open>Groups_List.sum_list\<close> & \<^typeof>\<open>Groups_List.sum_list\<close>\\
 \<^const>\<open>Groups_List.prod_list\<close> & \<^typeof>\<open>Groups_List.prod_list\<close>\\
 \<^const>\<open>List.list_all2\<close> & \<^typeof>\<open>List.list_all2\<close>\\
 \<^const>\<open>List.list_update\<close> & \<^typeof>\<open>List.list_update\<close>\\
 \<^const>\<open>List.map\<close> & \<^typeof>\<open>List.map\<close>\\
 \<^const>\<open>List.measures\<close> & @{term_type_only List.measures "('a\<Rightarrow>nat)list\<Rightarrow>('a*'a)set"}\\
 \<^const>\<open>List.nth\<close> & \<^typeof>\<open>List.nth\<close>\\
 \<^const>\<open>List.nths\<close> & \<^typeof>\<open>List.nths\<close>\\
 \<^const>\<open>List.remdups\<close> & \<^typeof>\<open>List.remdups\<close>\\
 \<^const>\<open>List.removeAll\<close> & \<^typeof>\<open>List.removeAll\<close>\\
 \<^const>\<open>List.remove1\<close> & \<^typeof>\<open>List.remove1\<close>\\
 \<^const>\<open>List.replicate\<close> & \<^typeof>\<open>List.replicate\<close>\\
 \<^const>\<open>List.rev\<close> & \<^typeof>\<open>List.rev\<close>\\
 \<^const>\<open>List.rotate\<close> & \<^typeof>\<open>List.rotate\<close>\\
 \<^const>\<open>List.rotate1\<close> & \<^typeof>\<open>List.rotate1\<close>\\
 \<^const>\<open>List.set\<close> & @{term_type_only List.set "'a list \<Rightarrow> 'a set"}\\
 \<^const>\<open>List.shuffles\<close> & \<^typeof>\<open>List.shuffles\<close>\\
 \<^const>\<open>List.sort\<close> & \<^typeof>\<open>List.sort\<close>\\
 \<^const>\<open>List.sorted\<close> & \<^typeof>\<open>List.sorted\<close>\\
 \<^const>\<open>List.sorted_wrt\<close> & \<^typeof>\<open>List.sorted_wrt\<close>\\
 \<^const>\<open>List.splice\<close> & \<^typeof>\<open>List.splice\<close>\\
 \<^const>\<open>List.take\<close> & \<^typeof>\<open>List.take\<close>\\
 \<^const>\<open>List.takeWhile\<close> & \<^typeof>\<open>List.takeWhile\<close>\\
 \<^const>\<open>List.tl\<close> & \<^typeof>\<open>List.tl\<close>\\
 \<^const>\<open>List.upt\<close> & \<^typeof>\<open>List.upt\<close>\\
 \<^const>\<open>List.upto\<close> & \<^typeof>\<open>List.upto\<close>\\
 \<^const>\<open>List.zip\<close> & \<^typeof>\<open>List.zip\<close>\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{supertabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<open>[x\<^sub>1,\<dots>,x\<^sub>n]\<close> & \<open>x\<^sub>1 # \<dots> # x\<^sub>n # []\<close>\\
 \<^term>\<open>[m..<n]\<close> & @{term[source]"upt m n"}\\
 \<^term>\<open>[i..j]\<close> & @{term[source]"upto i j"}\\
 \<^term>\<open>xs[n := x]\<close> & @{term[source]"list_update xs n x"}\\
 \<^term>\<open>\<Sum>x\<leftarrow>xs. e\<close> & @{term[source]"listsum (map (\<lambda>x. e) xs)"}\\
 \end{supertabular}
 \<^medskip>
 
 Filter input syntax \<open>[pat \<leftarrow> e. b]\<close>, where
 \<open>pat\<close> is a tuple pattern, which stands for \<^term>\<open>filter (\<lambda>pat. b) e\<close>.
 
 List comprehension input syntax: \<open>[e. q\<^sub>1, \<dots>, q\<^sub>n]\<close> where each
 qualifier \<open>q\<^sub>i\<close> is either a generator \mbox{\<open>pat \<leftarrow> e\<close>} or a
 guard, i.e.\ boolean expression.
 
 \section*{Map}
 
 Maps model partial functions and are often used as finite tables. However,
 the domain of a map may be infinite.
 
 \begin{supertabular}{@ {} l @ {~::~} l @ {}}
 \<^const>\<open>Map.empty\<close> & \<^typeof>\<open>Map.empty\<close>\\
 \<^const>\<open>Map.map_add\<close> & \<^typeof>\<open>Map.map_add\<close>\\
 \<^const>\<open>Map.map_comp\<close> & \<^typeof>\<open>Map.map_comp\<close>\\
 \<^const>\<open>Map.restrict_map\<close> & @{term_type_only Map.restrict_map "('a\<Rightarrow>'b option)\<Rightarrow>'a set\<Rightarrow>('a\<Rightarrow>'b option)"}\\
 \<^const>\<open>Map.dom\<close> & @{term_type_only Map.dom "('a\<Rightarrow>'b option)\<Rightarrow>'a set"}\\
 \<^const>\<open>Map.ran\<close> & @{term_type_only Map.ran "('a\<Rightarrow>'b option)\<Rightarrow>'b set"}\\
 \<^const>\<open>Map.map_le\<close> & \<^typeof>\<open>Map.map_le\<close>\\
 \<^const>\<open>Map.map_of\<close> & \<^typeof>\<open>Map.map_of\<close>\\
 \<^const>\<open>Map.map_upds\<close> & \<^typeof>\<open>Map.map_upds\<close>\\
 \end{supertabular}
 
 \subsubsection*{Syntax}
 
 \begin{tabular}{@ {} l @ {\quad$\equiv$\quad} l @ {}}
 \<^term>\<open>Map.empty\<close> & \<^term>\<open>\<lambda>x. None\<close>\\
 \<^term>\<open>m(x:=Some y)\<close> & @{term[source]"m(x:=Some y)"}\\
 \<open>m(x\<^sub>1\<mapsto>y\<^sub>1,\<dots>,x\<^sub>n\<mapsto>y\<^sub>n)\<close> & @{text[source]"m(x\<^sub>1\<mapsto>y\<^sub>1)\<dots>(x\<^sub>n\<mapsto>y\<^sub>n)"}\\
 \<open>[x\<^sub>1\<mapsto>y\<^sub>1,\<dots>,x\<^sub>n\<mapsto>y\<^sub>n]\<close> & @{text[source]"Map.empty(x\<^sub>1\<mapsto>y\<^sub>1,\<dots>,x\<^sub>n\<mapsto>y\<^sub>n)"}\\
 \<^term>\<open>map_upds m xs ys\<close> & @{term[source]"map_upds m xs ys"}\\
 \end{tabular}
 
 \section*{Infix operators in Main} % \<^theory>\<open>Main\<close>
 
 \begin{center}
 \begin{tabular}{llll}
  & Operator & precedence & associativity \\
 \hline
 Meta-logic & \<open>\<Longrightarrow>\<close> & 1 & right \\
 & \<open>\<equiv>\<close> & 2 \\
 \hline
 Logic & \<open>\<and>\<close> & 35 & right \\
 &\<open>\<or>\<close> & 30 & right \\
 &\<open>\<longrightarrow>\<close>, \<open>\<longleftrightarrow>\<close> & 25 & right\\
 &\<open>=\<close>, \<open>\<noteq>\<close> & 50 & left\\
 \hline
 Orderings & \<open>\<le>\<close>, \<open><\<close>, \<open>\<ge>\<close>, \<open>>\<close> & 50 \\
 \hline
 Sets & \<open>\<subseteq>\<close>, \<open>\<subset>\<close>, \<open>\<supseteq>\<close>, \<open>\<supset>\<close> & 50 \\
 &\<open>\<in>\<close>, \<open>\<notin>\<close> & 50 \\
 &\<open>\<inter>\<close> & 70 & left \\
 &\<open>\<union>\<close> & 65 & left \\
 \hline
 Functions and Relations & \<open>\<circ>\<close> & 55 & left\\
 &\<open>`\<close> & 90 & right\\
 &\<open>O\<close> & 75 & right\\
 &\<open>``\<close> & 90 & right\\
 &\<open>^^\<close> & 80 & right\\
 \hline
 Numbers & \<open>+\<close>, \<open>-\<close> & 65 & left \\
 &\<open>*\<close>, \<open>/\<close> & 70 & left \\
 &\<open>div\<close>, \<open>mod\<close> & 70 & left\\
 &\<open>^\<close> & 80 & right\\
 &\<open>dvd\<close> & 50 \\
 \hline
 Lists & \<open>#\<close>, \<open>@\<close> & 65 & right\\
 &\<open>!\<close> & 100 & left
 \end{tabular}
 \end{center}
 \<close>
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Main/document/build b/src/Doc/Main/document/build
deleted file mode 100755
--- a/src/Doc/Main/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle latex -o "$FORMAT"
-isabelle latex -o "$FORMAT"
-
diff --git a/src/Doc/Nitpick/document/build b/src/Doc/Nitpick/document/build
deleted file mode 100755
--- a/src/Doc/Nitpick/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo Nitpick
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Nitpick/document/root.tex b/src/Doc/Nitpick/document/root.tex
--- a/src/Doc/Nitpick/document/root.tex
+++ b/src/Doc/Nitpick/document/root.tex
@@ -1,2758 +1,2758 @@
 \documentclass[a4paper,12pt]{article}
 \usepackage[T1]{fontenc}
 \usepackage{amsmath}
 \usepackage{amssymb}
 \usepackage{color}
 \usepackage{footmisc}
 \usepackage{graphicx}
 %\usepackage{mathpazo}
 \usepackage{multicol}
 \usepackage{stmaryrd}
 %\usepackage[scaled=.85]{beramono}
 \usepackage{isabelle,iman,pdfsetup}
 
 %\oddsidemargin=4.6mm
 %\evensidemargin=4.6mm
 %\textwidth=150mm
 %\topmargin=4.6mm
 %\headheight=0mm
 %\headsep=0mm
 %\textheight=234mm
 
 \def\Colon{\mathord{:\mkern-1.5mu:}}
 %\def\lbrakk{\mathopen{\lbrack\mkern-3.25mu\lbrack}}
 %\def\rbrakk{\mathclose{\rbrack\mkern-3.255mu\rbrack}}
 \def\lparr{\mathopen{(\mkern-4mu\mid}}
 \def\rparr{\mathclose{\mid\mkern-4mu)}}
 
 %\def\unk{{?}}
 \def\unk{{\_}}
 \def\unkef{(\lambda x.\; \unk)}
 \def\undef{(\lambda x.\; \_)}
 %\def\unr{\textit{others}}
 \def\unr{\ldots}
 \def\Abs#1{\hbox{\rm{\guillemetleft}}{\,#1\,}\hbox{\rm{\guillemetright}}}
 \def\Q{{\smash{\lower.2ex\hbox{$\scriptstyle?$}}}}
 
 \hyphenation{Mini-Sat size-change First-Steps grand-parent nit-pick
 counter-example counter-examples data-type data-types co-data-type
 co-data-types in-duc-tive co-in-duc-tive}
 
 \urlstyle{tt}
 
 \renewcommand\_{\hbox{\textunderscore\kern-.05ex}}
 
 \begin{document}
 
 %%% TYPESETTING
 %\renewcommand\labelitemi{$\bullet$}
 \renewcommand\labelitemi{\raise.065ex\hbox{\small\textbullet}}
 
-\title{\includegraphics[scale=0.5]{isabelle_nitpick} \\[4ex]
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex]
 Picking Nits \\[\smallskipamount]
 \Large A User's Guide to Nitpick for Isabelle/HOL}
 \author{\hbox{} \\
 Jasmin Blanchette \\
 {\normalsize Institut f\"ur Informatik, Technische Universit\"at M\"unchen} \\
 \hbox{}}
 
 \maketitle
 
 \tableofcontents
 
 \setlength{\parskip}{.7em plus .2em minus .1em}
 \setlength{\parindent}{0pt}
 \setlength{\abovedisplayskip}{\parskip}
 \setlength{\abovedisplayshortskip}{.9\parskip}
 \setlength{\belowdisplayskip}{\parskip}
 \setlength{\belowdisplayshortskip}{.9\parskip}
 
 % General-purpose enum environment with correct spacing
 \newenvironment{enum}%
     {\begin{list}{}{%
         \setlength{\topsep}{.1\parskip}%
         \setlength{\partopsep}{.1\parskip}%
         \setlength{\itemsep}{\parskip}%
         \advance\itemsep by-\parsep}}
     {\end{list}}
 
 \def\pre{\begingroup\vskip0pt plus1ex\advance\leftskip by\leftmargin
 \advance\rightskip by\leftmargin}
 \def\post{\vskip0pt plus1ex\endgroup}
 
 \def\prew{\pre\advance\rightskip by-\leftmargin}
 \def\postw{\post}
 
 \section{Introduction}
 \label{introduction}
 
 Nitpick \cite{blanchette-nipkow-2010} is a counterexample generator for
 Isabelle/HOL \cite{isa-tutorial} that is designed to handle formulas
 combining (co)in\-duc\-tive datatypes, (co)in\-duc\-tively defined predicates, and
 quantifiers. It builds on Kodkod \cite{torlak-jackson-2007}, a highly optimized
 first-order relational model finder developed by the Software Design Group at
 MIT. It is conceptually similar to Refute \cite{weber-2008}, from which it
 borrows many ideas and code fragments, but it benefits from Kodkod's
 optimizations and a new encoding scheme. The name Nitpick is shamelessly
 appropriated from a now retired Alloy precursor.
 
 Nitpick is easy to use---you simply enter \textbf{nitpick} after a putative
 theorem and wait a few seconds. Nonetheless, there are situations where knowing
 how it works under the hood and how it reacts to various options helps
 increase the test coverage. This manual also explains how to install the tool on
 your workstation. Should the motivation fail you, think of the many hours of
 hard work Nitpick will save you. Proving non-theorems is \textsl{hard work}.
 
 Another common use of Nitpick is to find out whether the axioms of a locale are
 satisfiable, while the locale is being developed. To check this, it suffices to
 write
 
 \prew
 \textbf{lemma}~``$\textit{False\/}$'' \\
 \textbf{nitpick}~[\textit{show\_all}]
 \postw
 
 after the locale's \textbf{begin} keyword. To falsify \textit{False}, Nitpick
 must find a model for the axioms. If it finds no model, we have an indication
 that the axioms might be unsatisfiable.
 
 Nitpick provides an automatic mode that can be enabled via the ``Auto Nitpick''
 option under ``Plugins > Plugin Options > Isabelle > General'' in
 Isabelle/jEdit. In this mode, Nitpick is run on every newly entered theorem.
 
 \newbox\boxA
 \setbox\boxA=\hbox{\texttt{nospam}}
 
 \newcommand\authoremail{\texttt{jasmin.blan{\color{white}nospam}\kern-\wd\boxA{}chette@\allowbreak
 inria\allowbreak .\allowbreak fr}}
 
 To run Nitpick, you must also make sure that the theory \textit{Nitpick} is
 imported---this is rarely a problem in practice since it is part of
 \textit{Main}. The examples presented in this manual can be found
 in Isabelle's \texttt{src/HOL/\allowbreak Nitpick\_\allowbreak Examples/\allowbreak Manual\_Nits.thy} theory.
 The known bugs and limitations at the time of writing are listed in
 \S\ref{known-bugs-and-limitations}. Comments and bug reports concerning
 the tool or the manual should be directed to the author at \authoremail.
 
 \vskip2.5\smallskipamount
 
 \textbf{Acknowledgment.} The author would like to thank Mark Summerfield for
 suggesting several textual improvements.
 % and Perry James for reporting a typo.
 
 \section{Installation}
 \label{installation}
 
 Nitpick is part of Isabelle, so you do not need to install it. It relies on a
 third-party Kodkod front-end called Kodkodi, which in turn requires a Java
 virtual machine. Both are provided as official Isabelle components.
 
 %There are two main ways of installing Kodkodi:
 %
 %\begin{enum}
 %\item[\labelitemi] If you installed an official Isabelle package,
 %it should already include a properly setup version of Kodkodi.
 %
 %\item[\labelitemi] If you use a repository or snapshot version of Isabelle, you
 %an official Isabelle package, you can download the Isabelle-aware Kodkodi package
 %from \url{http://www21.in.tum.de/~blanchet/\#software}. Extract the archive, then add a
 %line to your \texttt{\$ISABELLE\_HOME\_USER\slash etc\slash components}%
 %\footnote{The variable \texttt{\$ISABELLE\_HOME\_USER} is set by Isabelle at
 %startup. Its value can be retrieved by executing \texttt{isabelle}
 %\texttt{getenv} \texttt{ISABELLE\_HOME\_USER} on the command line.}
 %file with the absolute path to Kodkodi. For example, if the
 %\texttt{components} file does not exist yet and you extracted Kodkodi to
 %\texttt{/usr/local/kodkodi-1.5.2}, create it with the single line
 %
 %\prew
 %\texttt{/usr/local/kodkodi-1.5.2}
 %\postw
 %
 %(including an invisible newline character) in it.
 %\end{enum}
 
 To check whether Kodkodi is successfully installed, you can try out the example
 in \S\ref{propositional-logic}.
 
 \section{First Steps}
 \label{first-steps}
 
 This section introduces Nitpick by presenting small examples. If possible, you
 should try out the examples on your workstation. Your theory file should start
 as follows:
 
 \prew
 \textbf{theory}~\textit{Scratch} \\
 \textbf{imports}~\textit{Main~Quotient\_Product~RealDef} \\
 \textbf{begin}
 \postw
 
 The results presented here were obtained using the JNI (Java Native Interface)
 version of MiniSat and with multithreading disabled to reduce nondeterminism.
 This was done by adding the line
 
 \prew
 \textbf{nitpick\_params} [\textit{sat\_solver}~= \textit{MiniSat\_JNI}, \,\textit{max\_threads}~= 1]
 \postw
 
 after the \textbf{begin} keyword. The JNI version of MiniSat is bundled with
 Kodkodi and is precompiled for Linux, Mac~OS~X, and Windows (Cygwin). Other SAT
 solvers can also be used, as explained in \S\ref{optimizations}. If you
 have already configured SAT solvers in Isabelle (e.g., for Refute), these will
 also be available to Nitpick.
 
 \subsection{Propositional Logic}
 \label{propositional-logic}
 
 Let's start with a trivial example from propositional logic:
 
 \prew
 \textbf{lemma}~``$P \longleftrightarrow Q$'' \\
 \textbf{nitpick}
 \postw
 
 You should get the following output:
 
 \prew
 \slshape
 Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $P = \textit{True}$ \\
 \hbox{}\qquad\qquad $Q = \textit{False}$
 \postw
 
 Nitpick can also be invoked on individual subgoals, as in the example below:
 
 \prew
 \textbf{apply}~\textit{auto} \\[2\smallskipamount]
 {\slshape goal (2 subgoals): \\
 \phantom{0}1. $P\,\Longrightarrow\, Q$ \\
 \phantom{0}2. $Q\,\Longrightarrow\, P$} \\[2\smallskipamount]
 \textbf{nitpick}~1 \\[2\smallskipamount]
 {\slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $P = \textit{True}$ \\
 \hbox{}\qquad\qquad $Q = \textit{False}$} \\[2\smallskipamount]
 \textbf{nitpick}~2 \\[2\smallskipamount]
 {\slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $P = \textit{False}$ \\
 \hbox{}\qquad\qquad $Q = \textit{True}$} \\[2\smallskipamount]
 \textbf{oops}
 \postw
 
 \subsection{Type Variables}
 \label{type-variables}
 
 If you are left unimpressed by the previous example, don't worry. The next
 one is more mind- and computer-boggling:
 
 \prew
 \textbf{lemma} ``$x \in A\,\Longrightarrow\, (\textrm{THE}~y.\;y \in A) \in A$''
 \postw
 \pagebreak[2] %% TYPESETTING
 
 The putative lemma involves the definite description operator, {THE}, presented
 in section 5.10.1 of the Isabelle tutorial \cite{isa-tutorial}. The
 operator is defined by the axiom $(\textrm{THE}~x.\; x = a) = a$. The putative
 lemma is merely asserting the indefinite description operator axiom with {THE}
 substituted for {SOME}.
 
 The free variable $x$ and the bound variable $y$ have type $'a$. For formulas
 containing type variables, Nitpick enumerates the possible domains for each type
 variable, up to a given cardinality (10 by default), looking for a finite
 countermodel:
 
 \prew
 \textbf{nitpick} [\textit{verbose}] \\[2\smallskipamount]
 \slshape
 Trying 10 scopes: \nopagebreak \\
 \hbox{}\qquad \textit{card}~$'a$~= 1; \\
 \hbox{}\qquad \textit{card}~$'a$~= 2; \\
 \hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
 \hbox{}\qquad \textit{card}~$'a$~= 10 \\[2\smallskipamount]
 Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $A = \{a_2,\, a_3\}$ \\
 \hbox{}\qquad\qquad $x = a_3$ \\[2\smallskipamount]
 Total time: 963 ms
 \postw
 
 Nitpick found a counterexample in which $'a$ has cardinality 3. (For
 cardinalities 1 and 2, the formula holds.) In the counterexample, the three
 values of type $'a$ are written $a_1$, $a_2$, and $a_3$.
 
 The message ``Trying $n$ scopes: {\ldots}''\ is shown only if the option
 \textit{verbose} is enabled. You can specify \textit{verbose} each time you
 invoke \textbf{nitpick}, or you can set it globally using the command
 
 \prew
 \textbf{nitpick\_params} [\textit{verbose}]
 \postw
 
 This command also displays the current default values for all of the options
 supported by Nitpick. The options are listed in \S\ref{option-reference}.
 
 \subsection{Constants}
 \label{constants}
 
 By just looking at Nitpick's output, it might not be clear why the
 counterexample in \S\ref{type-variables} is genuine. Let's invoke Nitpick again,
 this time telling it to show the values of the constants that occur in the
 formula:
 
 \prew
 \textbf{lemma} ``$x \in A\,\Longrightarrow\, (\textrm{THE}~y.\;y \in A) \in A$'' \\
 \textbf{nitpick}~[\textit{show\_consts}] \\[2\smallskipamount]
 \slshape
 Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $A = \{a_2,\, a_3\}$ \\
 \hbox{}\qquad\qquad $x = a_3$ \\
 \hbox{}\qquad Constant: \nopagebreak \\
 \hbox{}\qquad\qquad $\hbox{\slshape THE}~y.\;y \in A = a_1$
 \postw
 
 As the result of an optimization, Nitpick directly assigned a value to the
 subterm $\textrm{THE}~y.\;y \in A$, rather than to the \textit{The} constant. We
 can disable this optimization by using the command
 
 \prew
 \textbf{nitpick}~[\textit{dont\_specialize},\, \textit{show\_consts}]
 \postw
 
 Our misadventures with THE suggest adding `$\exists!x{.}$' (``there exists a
 unique $x$ such that'') at the front of our putative lemma's assumption:
 
 \prew
 \textbf{lemma} ``$\exists {!}x.\; x \in A\,\Longrightarrow\, (\textrm{THE}~y.\;y \in A) \in A$''
 \postw
 
 The fix appears to work:
 
 \prew
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found no counterexample
 \postw
 
 We can further increase our confidence in the formula by exhausting all
 cardinalities up to 50:
 
 \prew
 \textbf{nitpick} [\textit{card} $'a$~= 1--50]\footnote{The symbol `--'
 is entered as \texttt{-} (hyphen).} \\[2\smallskipamount]
 \slshape Nitpick found no counterexample.
 \postw
 
 Let's see if Sledgehammer can find a proof:
 
 \prew
 \textbf{sledgehammer} \\[2\smallskipamount]
 {\slshape Sledgehammer: ``$e$'' on goal \\
 Try this: \textbf{by}~(\textit{metis~theI}) (42 ms)} \\
 \hbox{}\qquad\vdots \\[2\smallskipamount]
 \textbf{by}~(\textit{metis~theI\/})
 \postw
 
 This must be our lucky day.
 
 \subsection{Skolemization}
 \label{skolemization}
 
 Are all invertible functions onto? Let's find out:
 
 \prew
 \textbf{lemma} ``$\exists g.\; \forall x.~g~(f~x) = x
  \,\Longrightarrow\, \forall y.\; \exists x.~y = f~x$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape
 Nitpick found a counterexample for \textit{card} $'a$~= 2 and \textit{card} $'b$~=~1: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $f = \undef{}(b_1 := a_1)$ \\
 \hbox{}\qquad Skolem constants: \nopagebreak \\
 \hbox{}\qquad\qquad $g = \undef{}(a_1 := b_1,\> a_2 := b_1)$ \\
 \hbox{}\qquad\qquad $y = a_2$
 \postw
 
 (The Isabelle/HOL notation $f(x := y)$ denotes the function that maps $x$ to $y$
 and that otherwise behaves like $f$.)
 Although $f$ is the only free variable occurring in the formula, Nitpick also
 displays values for the bound variables $g$ and $y$. These values are available
 to Nitpick because it performs skolemization as a preprocessing step.
 
 In the previous example, skolemization only affected the outermost quantifiers.
 This is not always the case, as illustrated below:
 
 \prew
 \textbf{lemma} ``$\exists x.\; \forall f.\; f~x = x$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape
 Nitpick found a counterexample for \textit{card} $'a$~= 2: \\[2\smallskipamount]
 \hbox{}\qquad Skolem constant: \nopagebreak \\
 \hbox{}\qquad\qquad $\lambda x.\; f =
     \undef{}(\!\begin{aligned}[t]
     & a_1 := \undef{}(a_1 := a_2,\> a_2 := a_1), \\[-2pt]
     & a_2 := \undef{}(a_1 := a_1,\> a_2 := a_1))\end{aligned}$
 \postw
 
 The variable $f$ is bound within the scope of $x$; therefore, $f$ depends on
 $x$, as suggested by the notation $\lambda x.\,f$. If $x = a_1$, then $f$ is the
 function that maps $a_1$ to $a_2$ and vice versa; otherwise, $x = a_2$ and $f$
 maps both $a_1$ and $a_2$ to $a_1$. In both cases, $f~x \not= x$.
 
 The source of the Skolem constants is sometimes more obscure:
 
 \prew
 \textbf{lemma} ``$\mathit{refl}~r\,\Longrightarrow\, \mathit{sym}~r$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape
 Nitpick found a counterexample for \textit{card} $'a$~= 2: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $r = \{(a_1, a_1),\, (a_2, a_1),\, (a_2, a_2)\}$ \\
 \hbox{}\qquad Skolem constants: \nopagebreak \\
 \hbox{}\qquad\qquad $\mathit{sym}.x = a_2$ \\
 \hbox{}\qquad\qquad $\mathit{sym}.y = a_1$
 \postw
 
 What happened here is that Nitpick expanded \textit{sym} to its definition:
 
 \prew
 $\mathit{sym}~r \,\equiv\,
  \forall x\> y.\,\> (x, y) \in r \longrightarrow (y, x) \in r.$
 \postw
 
 As their names suggest, the Skolem constants $\mathit{sym}.x$ and
 $\mathit{sym}.y$ are simply the bound variables $x$ and $y$
 from \textit{sym}'s definition.
 
 \subsection{Natural Numbers and Integers}
 \label{natural-numbers-and-integers}
 
 Because of the axiom of infinity, the type \textit{nat} does not admit any
 finite models. To deal with this, Nitpick's approach is to consider finite
 subsets $N$ of \textit{nat} and maps all numbers $\notin N$ to the undefined
 value (displayed as `$\unk$'). The type \textit{int} is handled similarly.
 Internally, undefined values lead to a three-valued logic.
 
 Here is an example involving \textit{int\/}:
 
 \prew
 \textbf{lemma} ``$\lbrakk i \le j;\> n \le (m{\Colon}\mathit{int})\rbrakk \,\Longrightarrow\, i * n + j * m \le i * m + j * n$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $i = 0$ \\
 \hbox{}\qquad\qquad $j = 1$ \\
 \hbox{}\qquad\qquad $m = 1$ \\
 \hbox{}\qquad\qquad $n = 0$
 \postw
 
 Internally, Nitpick uses either a unary or a binary representation of numbers.
 The unary representation is more efficient but only suitable for numbers very
 close to zero. By default, Nitpick attempts to choose the more appropriate
 encoding by inspecting the formula at hand. This behavior can be overridden by
 passing either \textit{unary\_ints} or \textit{binary\_ints} as option. For
 binary notation, the number of bits to use can be specified using
 the \textit{bits} option. For example:
 
 \prew
 \textbf{nitpick} [\textit{binary\_ints}, \textit{bits}${} = 16$]
 \postw
 
 With infinite types, we don't always have the luxury of a genuine counterexample
 and must often content ourselves with a potentially spurious one.
 For example:
 
 \prew
 \textbf{lemma} ``$\forall n.\; \textit{Suc}~n \mathbin{\not=} n \,\Longrightarrow\, P$'' \\
 \textbf{nitpick} [\textit{card~nat}~= 50] \\[2\smallskipamount]
 \slshape Warning: The conjecture either trivially holds for the given scopes or lies outside Nitpick's supported
 fragment; only potentially spurious counterexamples may be found \\[2\smallskipamount]
 Nitpick found a potentially spurious counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $P = \textit{False}$
 \postw
 
 The issue is that the bound variable in $\forall n.\;
 \textit{Suc}~n \mathbin{\not=} n$ ranges over an infinite type. If Nitpick finds
 an $n$ such that $\textit{Suc}~n \mathbin{=} n$, it evaluates the assumption to
 \textit{False}; but otherwise, it does not know anything about values of $n \ge
 \textit{card~nat}$ and must therefore evaluate the assumption to~$\unk$, not
 \textit{True}. Since the assumption can never be fully satisfied by Nitpick,
 the putative lemma can never be falsified.
 
 Some conjectures involving elementary number theory make Nitpick look like a
 giant with feet of clay:
 
 \prew
 \textbf{lemma} ``$P~\textit{Suc\/}$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape
 Nitpick found no counterexample
 \postw
 
 On any finite set $N$, \textit{Suc} is a partial function; for example, if $N =
 \{0, 1, \ldots, k\}$, then \textit{Suc} is $\{0 \mapsto 1,\, 1 \mapsto 2,\,
 \ldots,\, k \mapsto \unk\}$, which evaluates to $\unk$ when passed as
 argument to $P$. As a result, $P~\textit{Suc}$ is always $\unk$. The next
 example is similar:
 
 \prew
 \textbf{lemma} ``$P~(\textit{op}~{+}\Colon
 \textit{nat}\mathbin{\Rightarrow}\textit{nat}\mathbin{\Rightarrow}\textit{nat})$'' \\
 \textbf{nitpick} [\textit{card nat} = 1] \\[2\smallskipamount]
 {\slshape Nitpick found a counterexample:} \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $P = \unkef(\unkef(0 := \unkef(0 := 0)) := \mathit{False})$ \\[2\smallskipamount]
 \textbf{nitpick} [\textit{card nat} = 2] \\[2\smallskipamount]
 {\slshape Nitpick found no counterexample.}
 \postw
 
 The problem here is that \textit{op}~+ is total when \textit{nat} is taken to be
 $\{0\}$ but becomes partial as soon as we add $1$, because
 $1 + 1 \notin \{0, 1\}$.
 
 Because numbers are infinite and are approximated using a three-valued logic,
 there is usually no need to systematically enumerate domain sizes. If Nitpick
 cannot find a genuine counterexample for \textit{card~nat}~= $k$, it is very
 unlikely that one could be found for smaller domains. (The $P~(\textit{op}~{+})$
 example above is an exception to this principle.) Nitpick nonetheless enumerates
 all cardinalities from 1 to 10 for \textit{nat}, mainly because smaller
 cardinalities are fast to handle and give rise to simpler counterexamples. This
 is explained in more detail in \S\ref{scope-monotonicity}.
 
 \subsection{Inductive Datatypes}
 \label{inductive-datatypes}
 
 Like natural numbers and integers, inductive datatypes with recursive
 constructors admit no finite models and must be approximated by a subterm-closed
 subset. For example, using a cardinality of 10 for ${'}a~\textit{list}$,
 Nitpick looks for all counterexamples that can be built using at most 10
 different lists.
 
 Let's see with an example involving \textit{hd} (which returns the first element
 of a list) and $@$ (which concatenates two lists):
 
 \prew
 \textbf{lemma} ``$\textit{hd}~(\textit{xs} \mathbin{@} [y, y]) = \textit{hd}~\textit{xs\/}$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $\textit{xs} = []$ \\
 \hbox{}\qquad\qquad $\textit{y} = a_1$
 \postw
 
 To see why the counterexample is genuine, we enable \textit{show\_consts}
 and \textit{show\_\allowbreak datatypes}:
 
 \prew
 {\slshape Type:} \\
 \hbox{}\qquad $'a$~\textit{list}~= $\{[],\, [a_1],\, [a_1, a_1],\, \unr\}$ \\
 {\slshape Constants:} \\
 \hbox{}\qquad $\lambda x_1.\; x_1 \mathbin{@} [y, y] = \unkef([] := [a_1, a_1])$ \\
 \hbox{}\qquad $\textit{hd} = \unkef([] := a_2,\> [a_1] := a_1,\> [a_1, a_1] := a_1)$
 \postw
 
 Since $\mathit{hd}~[]$ is undefined in the logic, it may be given any value,
 including $a_2$.
 
 The second constant, $\lambda x_1.\; x_1 \mathbin{@} [y, y]$, is simply the
 append operator whose second argument is fixed to be $[y, y]$. Appending $[a_1,
 a_1]$ to $[a_1]$ would normally give $[a_1, a_1, a_1]$, but this value is not
 representable in the subset of $'a$~\textit{list} considered by Nitpick, which
 is shown under the ``Type'' heading; hence the result is $\unk$. Similarly,
 appending $[a_1, a_1]$ to itself gives $\unk$.
 
 Given \textit{card}~$'a = 3$ and \textit{card}~$'a~\textit{list} = 3$, Nitpick
 considers the following subsets:
 
 \kern-.5\smallskipamount %% TYPESETTING
 
 \prew
 \begin{multicols}{3}
 $\{[],\, [a_1],\, [a_2]\}$; \\
 $\{[],\, [a_1],\, [a_3]\}$; \\
 $\{[],\, [a_2],\, [a_3]\}$; \\
 $\{[],\, [a_1],\, [a_1, a_1]\}$; \\
 $\{[],\, [a_1],\, [a_2, a_1]\}$; \\
 $\{[],\, [a_1],\, [a_3, a_1]\}$; \\
 $\{[],\, [a_2],\, [a_1, a_2]\}$; \\
 $\{[],\, [a_2],\, [a_2, a_2]\}$; \\
 $\{[],\, [a_2],\, [a_3, a_2]\}$; \\
 $\{[],\, [a_3],\, [a_1, a_3]\}$; \\
 $\{[],\, [a_3],\, [a_2, a_3]\}$; \\
 $\{[],\, [a_3],\, [a_3, a_3]\}$.
 \end{multicols}
 \postw
 
 \kern-2\smallskipamount %% TYPESETTING
 
 All subterm-closed subsets of $'a~\textit{list}$ consisting of three values
 are listed and only those. As an example of a non-subterm-closed subset,
 consider $\mathcal{S} = \{[],\, [a_1],\,\allowbreak [a_1, a_2]\}$, and observe
 that $[a_1, a_2]$ (i.e., $a_1 \mathbin{\#} [a_2]$) has $[a_2] \notin
 \mathcal{S}$ as a subterm.
 
 Here's another m\"ochtegern-lemma that Nitpick can refute without a blink:
 
 \prew
 \textbf{lemma} ``$\lbrakk \textit{length}~\textit{xs} = 1;\> \textit{length}~\textit{ys} = 1
 \rbrakk \,\Longrightarrow\, \textit{xs} = \textit{ys\/}$''
 \\
 \textbf{nitpick} [\textit{show\_types}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $\textit{xs} = [a_2]$ \\
 \hbox{}\qquad\qquad $\textit{ys} = [a_1]$ \\
 \hbox{}\qquad Types: \\
 \hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, 2,\, \unr\}$ \\
 \hbox{}\qquad\qquad $'a$~\textit{list} = $\{[],\, [a_1],\, [a_2],\, \unr\}$
 \postw
 
 Because datatypes are approximated using a three-valued logic, there is usually
 no need to systematically enumerate cardinalities: If Nitpick cannot find a
 genuine counterexample for \textit{card}~$'a~\textit{list}$~= 10, it is very
 unlikely that one could be found for smaller cardinalities.
 
 \subsection{Typedefs, Quotient Types, Records, Rationals, and Reals}
 \label{typedefs-quotient-types-records-rationals-and-reals}
 
 Nitpick generally treats types declared using \textbf{typedef} as datatypes
 whose single constructor is the corresponding \textit{Abs\_\kern.1ex} function.
 For example:
 
 \prew
 \textbf{typedef}~\textit{three} = ``$\{0\Colon\textit{nat},\, 1,\, 2\}$'' \\
 \textbf{by}~\textit{blast} \\[2\smallskipamount]
 \textbf{definition}~$A \mathbin{\Colon} \textit{three}$ \textbf{where} ``\kern-.1em$A \,\equiv\, \textit{Abs\_\allowbreak three}~0$'' \\
 \textbf{definition}~$B \mathbin{\Colon} \textit{three}$ \textbf{where} ``$B \,\equiv\, \textit{Abs\_three}~1$'' \\
 \textbf{definition}~$C \mathbin{\Colon} \textit{three}$ \textbf{where} ``$C \,\equiv\, \textit{Abs\_three}~2$'' \\[2\smallskipamount]
 \textbf{lemma} ``$\lbrakk A \in X;\> B \in X\rbrakk \,\Longrightarrow\, c \in X$'' \\
 \textbf{nitpick} [\textit{show\_types}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $X = \{\Abs{0},\, \Abs{1}\}$ \\
 \hbox{}\qquad\qquad $c = \Abs{2}$ \\
 \hbox{}\qquad Types: \\
 \hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, 2,\, \unr\}$ \\
 \hbox{}\qquad\qquad $\textit{three} = \{\Abs{0},\, \Abs{1},\, \Abs{2},\, \unr\}$
 \postw
 
 In the output above, $\Abs{n}$ abbreviates $\textit{Abs\_three}~n$.
 
 Quotient types are handled in much the same way. The following fragment defines
 the integer type \textit{my\_int} by encoding the integer $x$ by a pair of
 natural numbers $(m, n)$ such that $x + n = m$:
 
 \prew
 \textbf{fun} \textit{my\_int\_rel} \textbf{where} \\
 ``$\textit{my\_int\_rel}~(x,\, y)~(u,\, v) = (x + v = u + y)$'' \\[2\smallskipamount]
 %
 \textbf{quotient\_type}~\textit{my\_int} = ``$\textit{nat} \times \textit{nat\/}$''$\;{/}\;$\textit{my\_int\_rel} \\
 \textbf{by}~(\textit{auto simp add\/}:\ \textit{equivp\_def fun\_eq\_iff}) \\[2\smallskipamount]
 %
 \textbf{definition}~\textit{add\_raw}~\textbf{where} \\
 ``$\textit{add\_raw} \,\equiv\, \lambda(x,\, y)~(u,\, v).\; (x + (u\Colon\textit{nat}), y + (v\Colon\textit{nat}))$'' \\[2\smallskipamount]
 %
 \textbf{quotient\_definition} ``$\textit{add\/}\Colon\textit{my\_int} \Rightarrow \textit{my\_int} \Rightarrow \textit{my\_int\/}$'' \textbf{is} \textit{add\_raw} \\[2\smallskipamount]
 %
 \textbf{lemma} ``$\textit{add}~x~y = \textit{add}~x~x$'' \\
 \textbf{nitpick} [\textit{show\_types}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $x = \Abs{(0,\, 0)}$ \\
 \hbox{}\qquad\qquad $y = \Abs{(0,\, 1)}$ \\
 \hbox{}\qquad Types: \\
 \hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, \unr\}$ \\
 \hbox{}\qquad\qquad $\textit{nat} \times \textit{nat}~[\textsl{boxed\/}] = \{(0,\, 0),\> (1,\, 0),\> \unr\}$ \\
 \hbox{}\qquad\qquad $\textit{my\_int} = \{\Abs{(0,\, 0)},\> \Abs{(0,\, 1)},\> \unr\}$
 \postw
 
 The values $\Abs{(0,\, 0)}$ and $\Abs{(0,\, 1)}$ represent the
 integers $0$ and $-1$, respectively. Other representants would have been
 possible---e.g., $\Abs{(5,\, 5)}$ and $\Abs{(11,\, 12)}$. If we are going to
 use \textit{my\_int} extensively, it pays off to install a term postprocessor
 that converts the pair notation to the standard mathematical notation:
 
 \prew
 $\textbf{ML}~\,\{{*} \\
 \!\begin{aligned}[t]
 %& ({*}~\,\textit{Proof.context} \rightarrow \textit{string} \rightarrow (\textit{typ} \rightarrow \textit{term~list\/}) \rightarrow \textit{typ} \rightarrow \textit{term} \\[-2pt]
 %& \phantom{(*}~\,{\rightarrow}\;\textit{term}~\,{*}) \\[-2pt]
 & \textbf{fun}\,~\textit{my\_int\_postproc}~\_~\_~\_~T~(\textit{Const}~\_~\$~(\textit{Const}~\_~\$~\textit{t1}~\$~\textit{t2\/})) = {} \\[-2pt]
 & \phantom{fun}\,~\textit{HOLogic.mk\_number}~T~(\textit{snd}~(\textit{HOLogic.dest\_number~t1}) \\[-2pt]
 & \phantom{fun\,~\textit{HOLogic.mk\_number}~T~(}{-}~\textit{snd}~(\textit{HOLogic.dest\_number~t2\/})) \\[-2pt]
 & \phantom{fun}\!{\mid}\,~\textit{my\_int\_postproc}~\_~\_~\_~\_~t = t \\[-2pt]
 {*}\}\end{aligned}$ \\[2\smallskipamount]
 $\textbf{declaration}~\,\{{*} \\
 \!\begin{aligned}[t]
 & \textit{Nitpick\_Model.register\_term\_postprocessor}~\!\begin{aligned}[t]
   & @\{\textrm{typ}~\textit{my\_int}\} \\[-2pt]
   & \textit{my\_int\_postproc}\end{aligned} \\[-2pt]
 {*}\}\end{aligned}$
 \postw
 
 Records are handled as datatypes with a single constructor:
 
 \prew
 \textbf{record} \textit{point} = \\
 \hbox{}\quad $\textit{Xcoord} \mathbin{\Colon} \textit{int}$ \\
 \hbox{}\quad $\textit{Ycoord} \mathbin{\Colon} \textit{int}$ \\[2\smallskipamount]
 \textbf{lemma} ``$\textit{Xcoord}~(p\Colon\textit{point}) = \textit{Xcoord}~(q\Colon\textit{point})$'' \\
 \textbf{nitpick} [\textit{show\_types}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $p = \lparr\textit{Xcoord} = 1,\> \textit{Ycoord} = 1\rparr$ \\
 \hbox{}\qquad\qquad $q = \lparr\textit{Xcoord} = 0,\> \textit{Ycoord} = 0\rparr$ \\
 \hbox{}\qquad Types: \\
 \hbox{}\qquad\qquad $\textit{int} = \{0,\, 1,\, \unr\}$ \\
 \hbox{}\qquad\qquad $\textit{point} = \{\!\begin{aligned}[t]
 & \lparr\textit{Xcoord} = 0,\> \textit{Ycoord} = 0\rparr, \\[-2pt] %% TYPESETTING
 & \lparr\textit{Xcoord} = 1,\> \textit{Ycoord} = 1\rparr,\, \unr\}\end{aligned}$
 \postw
 
 Finally, Nitpick provides rudimentary support for rationals and reals using a
 similar approach:
 
 \prew
 \textbf{lemma} ``$4 * x + 3 * (y\Colon\textit{real}) \not= 1/2$'' \\
 \textbf{nitpick} [\textit{show\_types}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $x = 1/2$ \\
 \hbox{}\qquad\qquad $y = -1/2$ \\
 \hbox{}\qquad Types: \\
 \hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, 2,\, 3,\, 4,\, 5,\, 6,\, 7,\, \unr\}$ \\
 \hbox{}\qquad\qquad $\textit{int} = \{-3,\, -2,\, -1,\, 0,\, 1,\, 2,\, 3,\, 4,\, \unr\}$ \\
 \hbox{}\qquad\qquad $\textit{real} = \{-3/2,\, -1/2,\, 0,\, 1/2,\, 1,\, 2,\, 3,\, 4,\, \unr\}$
 \postw
 
 \subsection{Inductive and Coinductive Predicates}
 \label{inductive-and-coinductive-predicates}
 
 Inductively defined predicates (and sets) are particularly problematic for
 counterexample generators. They can make Quickcheck~\cite{berghofer-nipkow-2004}
 loop forever and Refute~\cite{weber-2008} run out of resources. The crux of
 the problem is that they are defined using a least fixed-point construction.
 
 Nitpick's philosophy is that not all inductive predicates are equal. Consider
 the \textit{even} predicate below:
 
 \prew
 \textbf{inductive}~\textit{even}~\textbf{where} \\
 ``\textit{even}~0'' $\,\mid$ \\
 ``\textit{even}~$n\,\Longrightarrow\, \textit{even}~(\textit{Suc}~(\textit{Suc}~n))$''
 \postw
 
 This predicate enjoys the desirable property of being well-founded, which means
 that the introduction rules don't give rise to infinite chains of the form
 
 \prew
 $\cdots\,\Longrightarrow\, \textit{even}~k''
        \,\Longrightarrow\, \textit{even}~k'
        \,\Longrightarrow\, \textit{even}~k.$
 \postw
 
 For \textit{even}, this is obvious: Any chain ending at $k$ will be of length
 $k/2 + 1$:
 
 \prew
 $\textit{even}~0\,\Longrightarrow\, \textit{even}~2\,\Longrightarrow\, \cdots
        \,\Longrightarrow\, \textit{even}~(k - 2)
        \,\Longrightarrow\, \textit{even}~k.$
 \postw
 
 Wellfoundedness is desirable because it enables Nitpick to use a very efficient
 fixed-point computation.%
 \footnote{If an inductive predicate is
 well-founded, then it has exactly one fixed point, which is simultaneously the
 least and the greatest fixed point. In these circumstances, the computation of
 the least fixed point amounts to the computation of an arbitrary fixed point,
 which can be performed using a straightforward recursive equation.}
 Moreover, Nitpick can prove wellfoundedness of most well-founded predicates,
 just as Isabelle's \textbf{function} package usually discharges termination
 proof obligations automatically.
 
 Let's try an example:
 
 \prew
 \textbf{lemma} ``$\exists n.\; \textit{even}~n \mathrel{\land} \textit{even}~(\textit{Suc}~n)$'' \\
 \textbf{nitpick}~[\textit{card nat}~= 50, \textit{unary\_ints}, \textit{verbose}] \\[2\smallskipamount]
 \slshape The inductive predicate ``\textit{even}'' was proved well-founded;
 Nitpick can compute it efficiently \\[2\smallskipamount]
 Trying 1 scope: \\
 \hbox{}\qquad \textit{card nat}~= 50. \\[2\smallskipamount]
 Warning: The conjecture either trivially holds for the given scopes or lies outside Nitpick's supported fragment; only
 potentially spurious counterexamples may be found \\[2\smallskipamount]
 Nitpick found a potentially spurious counterexample for \textit{card nat}~= 50: \\[2\smallskipamount]
 \hbox{}\qquad Empty assignment \\[2\smallskipamount]
 Nitpick could not find a better counterexample
 It checked 1 of 1 scope \\[2\smallskipamount]
 Total time: 1.62 s.
 \postw
 
 No genuine counterexample is possible because Nitpick cannot rule out the
 existence of a natural number $n \ge 50$ such that both $\textit{even}~n$ and
 $\textit{even}~(\textit{Suc}~n)$ are true. To help Nitpick, we can bound the
 existential quantifier:
 
 \prew
 \textbf{lemma} ``$\exists n \mathbin{\le} 49.\; \textit{even}~n \mathrel{\land} \textit{even}~(\textit{Suc}~n)$'' \\
 \textbf{nitpick}~[\textit{card nat}~= 50, \textit{unary\_ints}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Empty assignment
 \postw
 
 So far we were blessed by the wellfoundedness of \textit{even}. What happens if
 we use the following definition instead?
 
 \prew
 \textbf{inductive} $\textit{even}'$ \textbf{where} \\
 ``$\textit{even}'~(0{\Colon}\textit{nat})$'' $\,\mid$ \\
 ``$\textit{even}'~2$'' $\,\mid$ \\
 ``$\lbrakk\textit{even}'~m;\> \textit{even}'~n\rbrakk \,\Longrightarrow\, \textit{even}'~(m + n)$''
 \postw
 
 This definition is not well-founded: From $\textit{even}'~0$ and
 $\textit{even}'~0$, we can derive that $\textit{even}'~0$. Nonetheless, the
 predicates $\textit{even}$ and $\textit{even}'$ are equivalent.
 
 Let's check a property involving $\textit{even}'$. To make up for the
 foreseeable computational hurdles entailed by non-wellfoundedness, we decrease
 \textit{nat}'s cardinality to a mere 10:
 
 \prew
 \textbf{lemma}~``$\exists n \in \{0, 2, 4, 6, 8\}.\;
 \lnot\;\textit{even}'~n$'' \\
 \textbf{nitpick}~[\textit{card nat}~= 10,\, \textit{verbose},\, \textit{show\_consts}] \\[2\smallskipamount]
 \slshape
 The inductive predicate ``$\textit{even}'\!$'' could not be proved well-founded; Nitpick might need to unroll it \\[2\smallskipamount]
 Trying 6 scopes: \\
 \hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 0; \\
 \hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 1; \\
 \hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 2; \\
 \hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 4; \\
 \hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 8; \\
 \hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 9 \\[2\smallskipamount]
 Nitpick found a counterexample for \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 2: \\[2\smallskipamount]
 \hbox{}\qquad Constant: \nopagebreak \\
 \hbox{}\qquad\qquad $\lambda i.\; \textit{even}'$ = $\unkef(\!\begin{aligned}[t]
 & 0 := \unkef(0 := \textit{True},\, 2 := \textit{True}),\, \\[-2pt]
 & 1 := \unkef(0 := \textit{True},\, 2 := \textit{True},\, 4 := \textit{True}),\, \\[-2pt]
 & 2 := \unkef(0 := \textit{True},\, 2 := \textit{True},\, 4 := \textit{True},\, \\[-2pt]
 & \phantom{2 := \unkef(}6 := \textit{True},\, 8 := \textit{True}))\end{aligned}$ \\[2\smallskipamount]
 Total time: 1.87 s.
 \postw
 
 Nitpick's output is very instructive. First, it tells us that the predicate is
 unrolled, meaning that it is computed iteratively from the empty set. Then it
 lists six scopes specifying different bounds on the numbers of iterations:\ 0,
 1, 2, 4, 8, and~9.
 
 The output also shows how each iteration contributes to $\textit{even}'$. The
 notation $\lambda i.\; \textit{even}'$ indicates that the value of the
 predicate depends on an iteration counter. Iteration 0 provides the basis
 elements, $0$ and $2$. Iteration 1 contributes $4$ ($= 2 + 2$). Iteration 2
 throws $6$ ($= 2 + 4 = 4 + 2$) and $8$ ($= 4 + 4$) into the mix. Further
 iterations would not contribute any new elements.
 The predicate $\textit{even}'$ evaluates to either \textit{True} or $\unk$,
 never \textit{False}.
 
 %Some values are marked with superscripted question
 %marks~(`\lower.2ex\hbox{$^\Q$}'). These are the elements for which the
 %predicate evaluates to $\unk$.
 
 When unrolling a predicate, Nitpick tries 0, 1, 2, 4, 8, 12, 16, 20, 24, and 28
 iterations. However, these numbers are bounded by the cardinality of the
 predicate's domain. With \textit{card~nat}~= 10, no more than 9 iterations are
 ever needed to compute the value of a \textit{nat} predicate. You can specify
 the number of iterations using the \textit{iter} option, as explained in
 \S\ref{scope-of-search}.
 
 In the next formula, $\textit{even}'$ occurs both positively and negatively:
 
 \prew
 \textbf{lemma} ``$\textit{even}'~(n - 2) \,\Longrightarrow\, \textit{even}'~n$'' \\
 \textbf{nitpick} [\textit{card nat} = 10, \textit{show\_consts}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $n = 1$ \\
 \hbox{}\qquad Constants: \nopagebreak \\
 \hbox{}\qquad\qquad $\lambda i.\; \textit{even}'$ = $\unkef(\!\begin{aligned}[t]
 & 0 := \unkef(0 := \mathit{True},\, 2 := \mathit{True}))\end{aligned}$  \\
 \hbox{}\qquad\qquad $\textit{even}' \leq \unkef(\!\begin{aligned}[t]
 & 0 := \mathit{True},\, 1 := \mathit{False},\, 2 := \mathit{True},\, \\[-2pt]
 & 4 := \mathit{True},\, 6 := \mathit{True},\, 8 := \mathit{True})\end{aligned}$
 \postw
 
 Notice the special constraint $\textit{even}' \leq \ldots$ in the output, whose
 right-hand side represents an arbitrary fixed point (not necessarily the least
 one). It is used to falsify $\textit{even}'~n$. In contrast, the unrolled
 predicate is used to satisfy $\textit{even}'~(n - 2)$.
 
 Coinductive predicates are handled dually. For example:
 
 \prew
 \textbf{coinductive} \textit{nats} \textbf{where} \\
 ``$\textit{nats}~(x\Colon\textit{nat}) \,\Longrightarrow\, \textit{nats}~x$'' \\[2\smallskipamount]
 \textbf{lemma} ``$\textit{nats} = (\lambda n.\; n \mathbin\in \{0, 1, 2, 3, 4\})$'' \\
 \textbf{nitpick}~[\textit{card nat} = 10,\, \textit{show\_consts}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample:
 \\[2\smallskipamount]
 \hbox{}\qquad Constants: \nopagebreak \\
 \hbox{}\qquad\qquad $\lambda i.\; \textit{nats} = \unkef(0 := \unkef,\, 1 := \unkef,\, 2 := \unkef)$ \\
 \hbox{}\qquad\qquad $\textit{nats} \geq \unkef(3 := \textit{True},\, 4 := \textit{False},\, 5 := \textit{True})$
 \postw
 
 As a special case, Nitpick uses Kodkod's transitive closure operator to encode
 negative occurrences of non-well-founded ``linear inductive predicates,'' i.e.,
 inductive predicates for which each the predicate occurs in at most one
 assumption of each introduction rule. For example:
 
 \prew
 \textbf{inductive} \textit{odd} \textbf{where} \\
 ``$\textit{odd}~1$'' $\,\mid$ \\
 ``$\lbrakk \textit{odd}~m;\>\, \textit{even}~n\rbrakk \,\Longrightarrow\, \textit{odd}~(m + n)$'' \\[2\smallskipamount]
 \textbf{lemma}~``$\textit{odd}~n \,\Longrightarrow\, \textit{odd}~(n - 2)$'' \\
 \textbf{nitpick}~[\textit{card nat} = 4,\, \textit{show\_consts}] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample:
 \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $n = 1$ \\
 \hbox{}\qquad Constants: \nopagebreak \\
 \hbox{}\qquad\qquad $\textit{even} = \unkef(0 := True, 1 := False, 2 := True, 3 := False)$ \\
 \hbox{}\qquad\qquad $\textit{odd}_{\textsl{base}} = {}$ \\
 \hbox{}\qquad\qquad\quad $\unkef(0 := \textit{False},\, 1 := \textit{True},\, 2 := \textit{False},\, 3 := \textit{False})$ \\
 \hbox{}\qquad\qquad $\textit{odd}_{\textsl{step}} = \unkef$\\
 \hbox{}\qquad\qquad\quad $(
 \!\begin{aligned}[t]
 & 0 := \unkef(0 := \textit{True},\, 1 := \textit{False},\, 2 := \textit{True},\, 3 := \textit{False}), \\[-2pt]
 & 1 := \unkef(0 := \textit{False},\, 1 := \textit{True},\, 2 := \textit{False},\, 3 := \textit{True}), \\[-2pt]
 & 2 := \unkef(0 := \textit{False},\, 1 := \textit{False},\, 2 := \textit{True},\, 3 := \textit{False}), \\[-2pt]
 & 3 := \unkef(0 := \textit{False},\, 1 := \textit{False},\, 2 := \textit{False},\, 3 := \textit{True}))
 \end{aligned}$ \\
 \hbox{}\qquad\qquad $\textit{odd} \leq \unkef(0 := \textit{False},\, 1 := \textit{True},\, 2 := \textit{False},\, 3 := \textit{True})$
 \postw
 
 \noindent
 In the output, $\textit{odd}_{\textrm{base}}$ represents the base elements and
 $\textit{odd}_{\textrm{step}}$ is a transition relation that computes new
 elements from known ones. The set $\textit{odd}$ consists of all the values
 reachable through the reflexive transitive closure of
 $\textit{odd}_{\textrm{step}}$ starting with any element from
 $\textit{odd}_{\textrm{base}}$, namely 1 and 3. Using Kodkod's
 transitive closure to encode linear predicates is normally either more thorough
 or more efficient than unrolling (depending on the value of \textit{iter}), but
 you can disable it by passing the \textit{dont\_star\_linear\_preds} option.
 
 \subsection{Coinductive Datatypes}
 \label{coinductive-datatypes}
 
 A coinductive datatype is similar to an inductive datatype but
 allows infinite objects. Thus, the infinite lists $\textit{ps}$ $=$ $[a, a, a,
 \ldots]$, $\textit{qs}$ $=$ $[a, b, a, b, \ldots]$, and $\textit{rs}$ $=$ $[0,
 1, 2, 3, \ldots]$ can be defined as coinductive lists, or ``lazy lists,'' using the
 $\textit{LNil}\mathbin{\Colon}{'}a~\textit{llist}$ and
 $\textit{LCons}\mathbin{\Colon}{'}a \mathbin{\Rightarrow} {'}a~\textit{llist}
 \mathbin{\Rightarrow} {'}a~\textit{llist}$ constructors.
 
 Although it is otherwise no friend of infinity, Nitpick can find counterexamples
 involving cyclic lists such as \textit{ps} and \textit{qs} above as well as
 finite lists:
 
 \prew
 \textbf{codatatype} $'a$ \textit{llist} = \textit{LNil}~$\mid$~\textit{LCons}~$'a$~``$'a\;\textit{llist}$'' \\[2\smallskipamount]
 \textbf{lemma} ``$\textit{xs} \not= \textit{LCons}~a~\textit{xs\/}$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample for {\itshape card}~$'a$ = 1: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $\textit{a} = a_1$ \\
 \hbox{}\qquad\qquad $\textit{xs} = \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega$
 \postw
 
 The notation $\textrm{THE}~\omega.\; \omega = t(\omega)$ stands
 for the infinite term $t(t(t(\ldots)))$. Hence, \textit{xs} is simply the
 infinite list $[a_1, a_1, a_1, \ldots]$.
 
 The next example is more interesting:
 
 \prew
 \textbf{primcorec}~$\textit{iterates}$~\textbf{where} \\
 ``$\textit{iterates}~f\>a = \textit{LCons}~a~(\textit{iterates}~f\>(f\>a))$'' \\[2\smallskipamount]
 \textbf{lemma}~``$\lbrakk\textit{xs} = \textit{LCons}~a~\textit{xs};\>\,
 \textit{ys} = \textit{iterates}~(\lambda b.\> a)~b\rbrakk \,\Longrightarrow\, \textit{xs} = \textit{ys\/}$'' \\
 \textbf{nitpick} [\textit{verbose}] \\[2\smallskipamount]
 \slshape The type $'a$ passed the monotonicity test; Nitpick might be able to skip
 some scopes \\[2\smallskipamount]
 Trying 10 scopes: \\
 \hbox{}\qquad \textit{card} $'a$~= 1, \textit{card} ``\kern1pt$'a~\textit{list\/}$''~= 1,
 and \textit{bisim\_depth}~= 0; \\
 \hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
 \hbox{}\qquad \textit{card} $'a$~= 10, \textit{card} ``\kern1pt$'a~\textit{list\/}$''~= 10,
 and \textit{bisim\_depth}~= 9 \\[2\smallskipamount]
 Nitpick found a counterexample for {\itshape card}~$'a$ = 2,
 \textit{card}~``\kern1pt$'a~\textit{llist\/}$''~= 2, and \textit{bisim\_\allowbreak
 depth}~= 1:
 \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $\textit{a} = a_1$ \\
 \hbox{}\qquad\qquad $\textit{b} = a_2$ \\
 \hbox{}\qquad\qquad $\textit{xs} = \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega$ \\
 \hbox{}\qquad\qquad $\textit{ys} = \textit{LCons}~a_2~(\textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega)$ \\[2\smallskipamount]
 Total time: 1.11 s
 \postw
 
 The lazy list $\textit{xs}$ is simply $[a_1, a_1, a_1, \ldots]$, whereas
 $\textit{ys}$ is $[a_2, a_1, a_1, a_1, \ldots]$, i.e., a lasso-shaped list with
 $[a_2]$ as its stem and $[a_1]$ as its cycle. In general, the list segment
 within the scope of the {THE} binder corresponds to the lasso's cycle, whereas
 the segment leading to the binder is the stem.
 
 A salient property of coinductive datatypes is that two objects are considered
 equal if and only if they lead to the same observations. For example, the two
 lazy lists
 %
 \begin{gather*}
 \textrm{THE}~\omega.\; \omega = \textit{LCons}~a~(\textit{LCons}~b~\omega) \\
 \textit{LCons}~a~(\textrm{THE}~\omega.\; \omega = \textit{LCons}~b~(\textit{LCons}~a~\omega))
 \end{gather*}
 %
 are identical, because both lead
 to the sequence of observations $a$, $b$, $a$, $b$, \hbox{\ldots} (or,
 equivalently, both encode the infinite list $[a, b, a, b, \ldots]$). This
 concept of equality for coinductive datatypes is called bisimulation and is
 defined coinductively.
 
 Internally, Nitpick encodes the coinductive bisimilarity predicate as part of
 the Kodkod problem to ensure that distinct objects lead to different
 observations. This precaution is somewhat expensive and often unnecessary, so it
 can be disabled by setting the \textit{bisim\_depth} option to $-1$. The
 bisimilarity check is then performed \textsl{after} the counterexample has been
 found to ensure correctness. If this after-the-fact check fails, the
 counterexample is tagged as ``quasi genuine'' and Nitpick recommends to try
 again with \textit{bisim\_depth} set to a nonnegative integer.
 
 The next formula illustrates the need for bisimilarity (either as a Kodkod
 predicate or as an after-the-fact check) to prevent spurious counterexamples:
 
 \prew
 \textbf{lemma} ``$\lbrakk xs = \textit{LCons}~a~\textit{xs};\>\, \textit{ys} = \textit{LCons}~a~\textit{ys}\rbrakk
 \,\Longrightarrow\, \textit{xs} = \textit{ys\/}$'' \\
 \textbf{nitpick} [\textit{bisim\_depth} = $-1$, \textit{show\_types}] \\[2\smallskipamount]
 \slshape Nitpick found a quasi genuine counterexample for $\textit{card}~'a$ = 2: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $a = a_1$ \\
 \hbox{}\qquad\qquad $\textit{xs} = \textsl{THE}~\omega.\; \omega =
 \textit{LCons}~a_1~\omega$ \\
 \hbox{}\qquad\qquad $\textit{ys} = \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega$ \\
 \hbox{}\qquad Type:\strut \nopagebreak \\
 \hbox{}\qquad\qquad $'a~\textit{llist} =
 \{\!\begin{aligned}[t]
   & \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega, \\[-2pt]
   & \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega,\> \unr\}\end{aligned}$
 \\[2\smallskipamount]
 Try again with ``\textit{bisim\_depth}'' set to a nonnegative value to confirm
 that the counterexample is genuine \\[2\smallskipamount]
 {\upshape\textbf{nitpick}} \\[2\smallskipamount]
 \slshape Nitpick found no counterexample
 \postw
 
 In the first \textbf{nitpick} invocation, the after-the-fact check discovered
 that the two known elements of type $'a~\textit{llist}$ are bisimilar, prompting
 Nitpick to label the example as only ``quasi genuine.''
 
 A compromise between leaving out the bisimilarity predicate from the Kodkod
 problem and performing the after-the-fact check is to specify a low
 nonnegative \textit{bisim\_depth} value. In general, a value of $K$ means that
 Nitpick will require all lists to be distinguished from each other by their
 prefixes of length $K$. However, setting $K$ to a too low value can
 overconstrain Nitpick, preventing it from finding any counterexamples.
 
 \subsection{Boxing}
 \label{boxing}
 
 Nitpick normally maps function and product types directly to the corresponding
 Kodkod concepts. As a consequence, if $'a$ has cardinality 3 and $'b$ has
 cardinality 4, then $'a \times {'}b$ has cardinality 12 ($= 4 \times 3$) and $'a
 \Rightarrow {'}b$ has cardinality 64 ($= 4^3$). In some circumstances, it pays
 off to treat these types in the same way as plain datatypes, by approximating
 them by a subset of a given cardinality. This technique is called ``boxing'' and
 is particularly useful for functions passed as arguments to other functions, for
 high-arity functions, and for large tuples. Under the hood, boxing involves
 wrapping occurrences of the types $'a \times {'}b$ and $'a \Rightarrow {'}b$ in
 isomorphic datatypes, as can be seen by enabling the \textit{debug} option.
 
 To illustrate boxing, we consider a formalization of $\lambda$-terms represented
 using de Bruijn's notation:
 
 \prew
 \textbf{datatype} \textit{tm} = \textit{Var}~\textit{nat}~$\mid$~\textit{Lam}~\textit{tm} $\mid$ \textit{App~tm~tm}
 \postw
 
 The $\textit{lift}~t~k$ function increments all variables with indices greater
 than or equal to $k$ by one:
 
 \prew
 \textbf{primrec} \textit{lift} \textbf{where} \\
 ``$\textit{lift}~(\textit{Var}~j)~k = \textit{Var}~(\textrm{if}~j < k~\textrm{then}~j~\textrm{else}~j + 1)$'' $\mid$ \\
 ``$\textit{lift}~(\textit{Lam}~t)~k = \textit{Lam}~(\textit{lift}~t~(k + 1))$'' $\mid$ \\
 ``$\textit{lift}~(\textit{App}~t~u)~k = \textit{App}~(\textit{lift}~t~k)~(\textit{lift}~u~k)$''
 \postw
 
 The $\textit{loose}~t~k$ predicate returns \textit{True} if and only if
 term $t$ has a loose variable with index $k$ or more:
 
 \prew
 \textbf{primrec}~\textit{loose} \textbf{where} \\
 ``$\textit{loose}~(\textit{Var}~j)~k = (j \ge k)$'' $\mid$ \\
 ``$\textit{loose}~(\textit{Lam}~t)~k = \textit{loose}~t~(\textit{Suc}~k)$'' $\mid$ \\
 ``$\textit{loose}~(\textit{App}~t~u)~k = (\textit{loose}~t~k \mathrel{\lor} \textit{loose}~u~k)$''
 \postw
 
 Next, the $\textit{subst}~\sigma~t$ function applies the substitution $\sigma$
 on $t$:
 
 \prew
 \textbf{primrec}~\textit{subst} \textbf{where} \\
 ``$\textit{subst}~\sigma~(\textit{Var}~j) = \sigma~j$'' $\mid$ \\
 ``$\textit{subst}~\sigma~(\textit{Lam}~t) = {}$\phantom{''} \\
 \phantom{``}$\textit{Lam}~(\textit{subst}~(\lambda n.\> \textrm{case}~n~\textrm{of}~0 \Rightarrow \textit{Var}~0 \mid \textit{Suc}~m \Rightarrow \textit{lift}~(\sigma~m)~1)~t)$'' $\mid$ \\
 ``$\textit{subst}~\sigma~(\textit{App}~t~u) = \textit{App}~(\textit{subst}~\sigma~t)~(\textit{subst}~\sigma~u)$''
 \postw
 
 A substitution is a function that maps variable indices to terms. Observe that
 $\sigma$ is a function passed as argument and that Nitpick can't optimize it
 away, because the recursive call for the \textit{Lam} case involves an altered
 version. Also notice the \textit{lift} call, which increments the variable
 indices when moving under a \textit{Lam}.
 
 A reasonable property to expect of substitution is that it should leave closed
 terms unchanged. Alas, even this simple property does not hold:
 
 \pre
 \textbf{lemma}~``$\lnot\,\textit{loose}~t~0 \,\Longrightarrow\, \textit{subst}~\sigma~t = t$'' \\
 \textbf{nitpick} [\textit{verbose}] \\[2\smallskipamount]
 \slshape
 Trying 10 scopes: \nopagebreak \\
 \hbox{}\qquad \textit{card~nat}~= 1, \textit{card tm}~= 1, and \textit{card} ``$\textit{nat} \Rightarrow \textit{tm\/}$'' = 1; \\
 \hbox{}\qquad \textit{card~nat}~= 2, \textit{card tm}~= 2, and \textit{card} ``$\textit{nat} \Rightarrow \textit{tm\/}$'' = 2; \\
 \hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
 \hbox{}\qquad \textit{card~nat}~= 10, \textit{card tm}~= 10, and \textit{card} ``$\textit{nat} \Rightarrow \textit{tm\/}$'' = 10 \\[2\smallskipamount]
 Nitpick found a counterexample for \textit{card~nat}~= 6, \textit{card~tm}~= 6,
 and \textit{card}~``$\textit{nat} \Rightarrow \textit{tm\/}$''~= 6: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $\sigma = \unkef(\!\begin{aligned}[t]
 & 0 := \textit{Var}~0,\>
   1 := \textit{Var}~0,\>
   2 := \textit{Var}~0, \\[-2pt]
 & 3 := \textit{Var}~0,\>
   4 := \textit{Var}~0,\>
   5 := \textit{Lam}~(\textit{Lam}~(\textit{Var}~0)))\end{aligned}$ \\
 \hbox{}\qquad\qquad $t = \textit{Lam}~(\textit{Lam}~(\textit{Var}~1))$ \\[2\smallskipamount]
 Total time: 3.08 s
 \postw
 
 Using \textit{eval}, we find out that $\textit{subst}~\sigma~t =
 \textit{Lam}~(\textit{Lam}~(\textit{Var}~0))$. Using the traditional
 $\lambda$-calculus notation, $t$ is
 $\lambda x\, y.\> x$ whereas $\textit{subst}~\sigma~t$ is (wrongly) $\lambda x\, y.\> y$.
 The bug is in \textit{subst\/}: The $\textit{lift}~(\sigma~m)~1$ call should be
 replaced with $\textit{lift}~(\sigma~m)~0$.
 
 An interesting aspect of Nitpick's verbose output is that it assigned inceasing
 cardinalities from 1 to 10 to the type $\textit{nat} \Rightarrow \textit{tm}$
 of the higher-order argument $\sigma$ of \textit{subst}.
 For the formula of interest, knowing 6 values of that type was enough to find
 the counterexample. Without boxing, $6^6 = 46\,656$ values must be
 considered, a hopeless undertaking:
 
 \prew
 \textbf{nitpick} [\textit{dont\_box}] \\[2\smallskipamount]
 {\slshape Nitpick ran out of time after checking 3 of 10 scopes}
 \postw
 
 Boxing can be enabled or disabled globally or on a per-type basis using the
 \textit{box} option. Nitpick usually performs reasonable choices about which
 types should be boxed, but option tweaking sometimes helps.
 
 %A related optimization,
 %``finitization,'' attempts to wrap functions that are constant at all but finitely
 %many points (e.g., finite sets); see the documentation for the \textit{finitize}
 %option in \S\ref{scope-of-search} for details.
 
 \subsection{Scope Monotonicity}
 \label{scope-monotonicity}
 
 The \textit{card} option (together with \textit{iter}, \textit{bisim\_depth},
 and \textit{max}) controls which scopes are actually tested. In general, to
 exhaust all models below a certain cardinality bound, the number of scopes that
 Nitpick must consider increases exponentially with the number of type variables
 (and \textbf{typedecl}'d types) occurring in the formula. Given the default
 cardinality specification of 1--10, no fewer than $10^4 = 10\,000$ scopes must be
 considered for a formula involving $'a$, $'b$, $'c$, and $'d$.
 
 Fortunately, many formulas exhibit a property called \textsl{scope
 monotonicity}, meaning that if the formula is falsifiable for a given scope,
 it is also falsifiable for all larger scopes \cite[p.~165]{jackson-2006}.
 
 Consider the formula
 
 \prew
 \textbf{lemma}~``$\textit{length~xs} = \textit{length~ys} \,\Longrightarrow\, \textit{rev}~(\textit{zip~xs~ys}) = \textit{zip~xs}~(\textit{rev~ys})$''
 \postw
 
 where \textit{xs} is of type $'a~\textit{list}$ and \textit{ys} is of type
 $'b~\textit{list}$. A priori, Nitpick would need to consider $1\,000$ scopes to
 exhaust the specification \textit{card}~= 1--10 (10 cardinalies for $'a$
 $\times$ 10 cardinalities for $'b$ $\times$ 10 cardinalities for the datatypes).
 However, our intuition tells us that any counterexample found with a small scope
 would still be a counterexample in a larger scope---by simply ignoring the fresh
 $'a$ and $'b$ values provided by the larger scope. Nitpick comes to the same
 conclusion after a careful inspection of the formula and the relevant
 definitions:
 
 \prew
 \textbf{nitpick}~[\textit{verbose}] \\[2\smallskipamount]
 \slshape
 The types $'a$ and $'b$ passed the monotonicity test; Nitpick might be able to skip some scopes.
  \\[2\smallskipamount]
 Trying 10 scopes: \\
 \hbox{}\qquad \textit{card} $'a$~= 1, \textit{card} $'b$~= 1,
 \textit{card} \textit{nat}~= 1, \textit{card} ``$('a \times {'}b)$
 \textit{list\/}''~= 1, \\
 \hbox{}\qquad\quad \textit{card} ``\kern1pt$'a$ \textit{list\/}''~= 1, and
 \textit{card} ``\kern1pt$'b$ \textit{list\/}''~= 1; \\
 \hbox{}\qquad \textit{card} $'a$~= 2, \textit{card} $'b$~= 2,
 \textit{card} \textit{nat}~= 2, \textit{card} ``$('a \times {'}b)$
 \textit{list\/}''~= 2, \\
 \hbox{}\qquad\quad \textit{card} ``\kern1pt$'a$ \textit{list\/}''~= 2, and
 \textit{card} ``\kern1pt$'b$ \textit{list\/}''~= 2; \\
 \hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
 \hbox{}\qquad \textit{card} $'a$~= 10, \textit{card} $'b$~= 10,
 \textit{card} \textit{nat}~= 10, \textit{card} ``$('a \times {'}b)$
 \textit{list\/}''~= 10, \\
 \hbox{}\qquad\quad \textit{card} ``\kern1pt$'a$ \textit{list\/}''~= 10, and
 \textit{card} ``\kern1pt$'b$ \textit{list\/}''~= 10
 \\[2\smallskipamount]
 Nitpick found a counterexample for
 \textit{card} $'a$~= 5, \textit{card} $'b$~= 5,
 \textit{card} \textit{nat}~= 5, \textit{card} ``$('a \times {'}b)$
 \textit{list\/}''~= 5, \textit{card} ``\kern1pt$'a$ \textit{list\/}''~= 5, and
 \textit{card} ``\kern1pt$'b$ \textit{list\/}''~= 5:
 \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $\textit{xs} = [a_1, a_2]$ \\
 \hbox{}\qquad\qquad $\textit{ys} = [b_1, b_1]$ \\[2\smallskipamount]
 Total time: 1.63 s.
 \postw
 
 In theory, it should be sufficient to test a single scope:
 
 \prew
 \textbf{nitpick}~[\textit{card}~= 10]
 \postw
 
 However, this is often less efficient in practice and may lead to overly complex
 counterexamples.
 
 If the monotonicity check fails but we believe that the formula is monotonic (or
 we don't mind missing some counterexamples), we can pass the
 \textit{mono} option. To convince yourself that this option is risky,
 simply consider this example from \S\ref{skolemization}:
 
 \prew
 \textbf{lemma} ``$\exists g.\; \forall x\Colon 'b.~g~(f~x) = x
  \,\Longrightarrow\, \forall y\Colon {'}a.\; \exists x.~y = f~x$'' \\
 \textbf{nitpick} [\textit{mono}] \\[2\smallskipamount]
 {\slshape Nitpick found no counterexample} \\[2\smallskipamount]
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape
 Nitpick found a counterexample for \textit{card} $'a$~= 2 and \textit{card} $'b$~=~1: \\
 \hbox{}\qquad $\vdots$
 \postw
 
 (It turns out the formula holds if and only if $\textit{card}~'a \le
 \textit{card}~'b$.) Although this is rarely advisable, the automatic
 monotonicity checks can be disabled by passing \textit{non\_mono}
 (\S\ref{optimizations}).
 
 As insinuated in \S\ref{natural-numbers-and-integers} and
 \S\ref{inductive-datatypes}, \textit{nat}, \textit{int}, and inductive datatypes
 are normally monotonic and treated as such. The same is true for record types,
 \textit{rat}, and \textit{real}. Thus, given the
 cardinality specification 1--10, a formula involving \textit{nat}, \textit{int},
 \textit{int~list}, \textit{rat}, and \textit{rat~list} will lead Nitpick to
 consider only 10~scopes instead of $10^4 = 10\,000$. On the other hand,
 \textbf{typedef}s and quotient types are generally nonmonotonic.
 
 \subsection{Inductive Properties}
 \label{inductive-properties}
 
 Inductive properties are a particular pain to prove, because the failure to
 establish an induction step can mean several things:
 %
 \begin{enumerate}
 \item The property is invalid.
 \item The property is valid but is too weak to support the induction step.
 \item The property is valid and strong enough; it's just that we haven't found
 the proof yet.
 \end{enumerate}
 %
 Depending on which scenario applies, we would take the appropriate course of
 action:
 %
 \begin{enumerate}
 \item Repair the statement of the property so that it becomes valid.
 \item Generalize the property and/or prove auxiliary properties.
 \item Work harder on a proof.
 \end{enumerate}
 %
 How can we distinguish between the three scenarios? Nitpick's normal mode of
 operation can often detect scenario 1, and Isabelle's automatic tactics help with
 scenario 3. Using appropriate techniques, it is also often possible to use
 Nitpick to identify scenario 2. Consider the following transition system,
 in which natural numbers represent states:
 
 \prew
 \textbf{inductive\_set}~\textit{reach}~\textbf{where} \\
 ``$(4\Colon\textit{nat}) \in \textit{reach\/}$'' $\mid$ \\
 ``$\lbrakk n < 4;\> n \in \textit{reach\/}\rbrakk \,\Longrightarrow\, 3 * n + 1 \in \textit{reach\/}$'' $\mid$ \\
 ``$n \in \textit{reach} \,\Longrightarrow n + 2 \in \textit{reach\/}$''
 \postw
 
 We will try to prove that only even numbers are reachable:
 
 \prew
 \textbf{lemma}~``$n \in \textit{reach} \,\Longrightarrow\, 2~\textrm{dvd}~n$''
 \postw
 
 Does this property hold? Nitpick cannot find a counterexample within 30 seconds,
 so let's attempt a proof by induction:
 
 \prew
 \textbf{apply}~(\textit{induct~set}{:}~\textit{reach\/}) \\
 \textbf{apply}~\textit{auto}
 \postw
 
 This leaves us in the following proof state:
 
 \prew
 {\slshape goal (2 subgoals): \\
 \phantom{0}1. ${\bigwedge}n.\;\, \lbrakk n \in \textit{reach\/};\, n < 4;\, 2~\textsl{dvd}~n\rbrakk \,\Longrightarrow\, 2~\textsl{dvd}~\textit{Suc}~(3 * n)$ \\
 \phantom{0}2. ${\bigwedge}n.\;\, \lbrakk n \in \textit{reach\/};\, 2~\textsl{dvd}~n\rbrakk \,\Longrightarrow\, 2~\textsl{dvd}~\textit{Suc}~(\textit{Suc}~n)$
 }
 \postw
 
 If we run Nitpick on the first subgoal, it still won't find any
 counterexample; and yet, \textit{auto} fails to go further, and \textit{arith}
 is helpless. However, notice the $n \in \textit{reach}$ assumption, which
 strengthens the induction hypothesis but is not immediately usable in the proof.
 If we remove it and invoke Nitpick, this time we get a counterexample:
 
 \prew
 \textbf{apply}~(\textit{thin\_tac}~``$n \in \textit{reach\/}$'') \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Skolem constant: \nopagebreak \\
 \hbox{}\qquad\qquad $n = 0$
 \postw
 
 Indeed, 0 < 4, 2 divides 0, but 2 does not divide 1. We can use this information
 to strength the lemma:
 
 \prew
 \textbf{lemma}~``$n \in \textit{reach} \,\Longrightarrow\, 2~\textrm{dvd}~n \mathrel{\lor} n \not= 0$''
 \postw
 
 Unfortunately, the proof by induction still gets stuck, except that Nitpick now
 finds the counterexample $n = 2$. We generalize the lemma further to
 
 \prew
 \textbf{lemma}~``$n \in \textit{reach} \,\Longrightarrow\, 2~\textrm{dvd}~n \mathrel{\lor} n \ge 4$''
 \postw
 
 and this time \textit{arith} can finish off the subgoals.
 
 \section{Case Studies}
 \label{case-studies}
 
 As a didactic device, the previous section focused mostly on toy formulas whose
 validity can easily be assessed just by looking at the formula. We will now
 review two somewhat more realistic case studies that are within Nitpick's
 reach:\ a context-free grammar modeled by mutually inductive sets and a
 functional implementation of AA trees. The results presented in this
 section were produced with the following settings:
 
 \prew
 \textbf{nitpick\_params} [\textit{max\_potential}~= 0]
 \postw
 
 \subsection{A Context-Free Grammar}
 \label{a-context-free-grammar}
 
 Our first case study is taken from section 7.4 in the Isabelle tutorial
 \cite{isa-tutorial}. The following grammar, originally due to Hopcroft and
 Ullman, produces all strings with an equal number of $a$'s and $b$'s:
 
 \prew
 \begin{tabular}{@{}r@{$\;\,$}c@{$\;\,$}l@{}}
 $S$ & $::=$ & $\epsilon \mid bA \mid aB$ \\
 $A$ & $::=$ & $aS \mid bAA$ \\
 $B$ & $::=$ & $bS \mid aBB$
 \end{tabular}
 \postw
 
 The intuition behind the grammar is that $A$ generates all strings with one more
 $a$ than $b$'s and $B$ generates all strings with one more $b$ than $a$'s.
 
 The alphabet consists exclusively of $a$'s and $b$'s:
 
 \prew
 \textbf{datatype} \textit{alphabet}~= $a$ $\mid$ $b$
 \postw
 
 Strings over the alphabet are represented by \textit{alphabet list}s.
 Nonterminals in the grammar become sets of strings. The production rules
 presented above can be expressed as a mutually inductive definition:
 
 \prew
 \textbf{inductive\_set} $S$ \textbf{and} $A$ \textbf{and} $B$ \textbf{where} \\
 \textit{R1}:\kern.4em ``$[] \in S$'' $\,\mid$ \\
 \textit{R2}:\kern.4em ``$w \in A\,\Longrightarrow\, b \mathbin{\#} w \in S$'' $\,\mid$ \\
 \textit{R3}:\kern.4em ``$w \in B\,\Longrightarrow\, a \mathbin{\#} w \in S$'' $\,\mid$ \\
 \textit{R4}:\kern.4em ``$w \in S\,\Longrightarrow\, a \mathbin{\#} w \in A$'' $\,\mid$ \\
 \textit{R5}:\kern.4em ``$w \in S\,\Longrightarrow\, b \mathbin{\#} w \in S$'' $\,\mid$ \\
 \textit{R6}:\kern.4em ``$\lbrakk v \in B;\> v \in B\rbrakk \,\Longrightarrow\, a \mathbin{\#} v \mathbin{@} w \in B$''
 \postw
 
 The conversion of the grammar into the inductive definition was done manually by
 Joe Blow, an underpaid undergraduate student. As a result, some errors might
 have sneaked in.
 
 Debugging faulty specifications is at the heart of Nitpick's \textsl{raison
 d'\^etre}. A good approach is to state desirable properties of the specification
 (here, that $S$ is exactly the set of strings over $\{a, b\}$ with as many $a$'s
 as $b$'s) and check them with Nitpick. If the properties are correctly stated,
 counterexamples will point to bugs in the specification. For our grammar
 example, we will proceed in two steps, separating the soundness and the
 completeness of the set $S$. First, soundness:
 
 \prew
 \textbf{theorem}~\textit{S\_sound\/}: \\
 ``$w \in S \longrightarrow \textit{length}~[x\mathbin{\leftarrow} w.\; x = a] =
   \textit{length}~[x\mathbin{\leftarrow} w.\; x = b]$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $w = [b]$
 \postw
 
 It would seem that $[b] \in S$. How could this be? An inspection of the
 introduction rules reveals that the only rule with a right-hand side of the form
 $b \mathbin{\#} {\ldots} \in S$ that could have introduced $[b]$ into $S$ is
 \textit{R5}:
 
 \prew
 ``$w \in S\,\Longrightarrow\, b \mathbin{\#} w \in S$''
 \postw
 
 On closer inspection, we can see that this rule is wrong. To match the
 production $B ::= bS$, the second $S$ should be a $B$. We fix the typo and try
 again:
 
 \prew
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $w = [a, a, b]$
 \postw
 
 Some detective work is necessary to find out what went wrong here. To get $[a,
 a, b] \in S$, we need $[a, b] \in B$ by \textit{R3}, which in turn can only come
 from \textit{R6}:
 
 \prew
 ``$\lbrakk v \in B;\> v \in B\rbrakk \,\Longrightarrow\, a \mathbin{\#} v \mathbin{@} w \in B$''
 \postw
 
 Now, this formula must be wrong: The same assumption occurs twice, and the
 variable $w$ is unconstrained. Clearly, one of the two occurrences of $v$ in
 the assumptions should have been a $w$.
 
 With the correction made, we don't get any counterexample from Nitpick. Let's
 move on and check completeness:
 
 \prew
 \textbf{theorem}~\textit{S\_complete}: \\
 ``$\textit{length}~[x\mathbin{\leftarrow} w.\; x = a] =
    \textit{length}~[x\mathbin{\leftarrow} w.\; x = b]
   \longrightarrow w \in S$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variable: \nopagebreak \\
 \hbox{}\qquad\qquad $w = [b, b, a, a]$
 \postw
 
 Apparently, $[b, b, a, a] \notin S$, even though it has the same numbers of
 $a$'s and $b$'s. But since our inductive definition passed the soundness check,
 the introduction rules we have are probably correct. Perhaps we simply lack an
 introduction rule. Comparing the grammar with the inductive definition, our
 suspicion is confirmed: Joe Blow simply forgot the production $A ::= bAA$,
 without which the grammar cannot generate two or more $b$'s in a row. So we add
 the rule
 
 \prew
 ``$\lbrakk v \in A;\> w \in A\rbrakk \,\Longrightarrow\, b \mathbin{\#} v \mathbin{@} w \in A$''
 \postw
 
 With this last change, we don't get any counterexamples from Nitpick for either
 soundness or completeness. We can even generalize our result to cover $A$ and
 $B$ as well:
 
 \prew
 \textbf{theorem} \textit{S\_A\_B\_sound\_and\_complete}: \\
 ``$w \in S \longleftrightarrow \textit{length}~[x \mathbin{\leftarrow} w.\; x = a] = \textit{length}~[x \mathbin{\leftarrow} w.\; x = b]$'' \\
 ``$w \in A \longleftrightarrow \textit{length}~[x \mathbin{\leftarrow} w.\; x = a] = \textit{length}~[x \mathbin{\leftarrow} w.\; x = b] + 1$'' \\
 ``$w \in B \longleftrightarrow \textit{length}~[x \mathbin{\leftarrow} w.\; x = b] = \textit{length}~[x \mathbin{\leftarrow} w.\; x = a] + 1$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found no counterexample
 \postw
 
 \subsection{AA Trees}
 \label{aa-trees}
 
 AA trees are a kind of balanced trees discovered by Arne Andersson that provide
 similar performance to red-black trees, but with a simpler implementation
 \cite{andersson-1993}. They can be used to store sets of elements equipped with
 a total order $<$. We start by defining the datatype and some basic extractor
 functions:
 
 \prew
 \textbf{datatype} $'a$~\textit{aa\_tree} = \\
 \hbox{}\quad $\Lambda$ $\mid$ $N$ ``\kern1pt$'a\Colon \textit{linorder\/}$'' \textit{nat} ``\kern1pt$'a$ \textit{aa\_tree}'' ``\kern1pt$'a$ \textit{aa\_tree}''  \\[2\smallskipamount]
 \textbf{primrec} \textit{data} \textbf{where} \\
 ``$\textit{data}~\Lambda = \unkef$'' $\,\mid$ \\
 ``$\textit{data}~(N~x~\_~\_~\_) = x$'' \\[2\smallskipamount]
 \textbf{primrec} \textit{dataset} \textbf{where} \\
 ``$\textit{dataset}~\Lambda = \{\}$'' $\,\mid$ \\
 ``$\textit{dataset}~(N~x~\_~t~u) = \{x\} \cup \textit{dataset}~t \mathrel{\cup} \textit{dataset}~u$'' \\[2\smallskipamount]
 \textbf{primrec} \textit{level} \textbf{where} \\
 ``$\textit{level}~\Lambda = 0$'' $\,\mid$ \\
 ``$\textit{level}~(N~\_~k~\_~\_) = k$'' \\[2\smallskipamount]
 \textbf{primrec} \textit{left} \textbf{where} \\
 ``$\textit{left}~\Lambda = \Lambda$'' $\,\mid$ \\
 ``$\textit{left}~(N~\_~\_~t~\_) = t$'' \\[2\smallskipamount]
 \textbf{primrec} \textit{right} \textbf{where} \\
 ``$\textit{right}~\Lambda = \Lambda$'' $\,\mid$ \\
 ``$\textit{right}~(N~\_~\_~\_~u) = u$''
 \postw
 
 The wellformedness criterion for AA trees is fairly complex. Wikipedia states it
 as follows \cite{wikipedia-2009-aa-trees}:
 
 \kern.2\parskip %% TYPESETTING
 
 \pre
 Each node has a level field, and the following invariants must remain true for
 the tree to be valid:
 
 \raggedright
 
 \kern-.4\parskip %% TYPESETTING
 
 \begin{enum}
 \item[]
 \begin{enum}
 \item[1.] The level of a leaf node is one.
 \item[2.] The level of a left child is strictly less than that of its parent.
 \item[3.] The level of a right child is less than or equal to that of its parent.
 \item[4.] The level of a right grandchild is strictly less than that of its grandparent.
 \item[5.] Every node of level greater than one must have two children.
 \end{enum}
 \end{enum}
 \post
 
 \kern.4\parskip %% TYPESETTING
 
 The \textit{wf} predicate formalizes this description:
 
 \prew
 \textbf{primrec} \textit{wf} \textbf{where} \\
 ``$\textit{wf}~\Lambda = \textit{True\/}$'' $\,\mid$ \\
 ``$\textit{wf}~(N~\_~k~t~u) =$ \\
 \phantom{``}$(\textrm{if}~t = \Lambda~\textrm{then}$ \\
 \phantom{``$(\quad$}$k = 1 \mathrel{\land} (u = \Lambda \mathrel{\lor} (\textit{level}~u = 1 \mathrel{\land} \textit{left}~u = \Lambda \mathrel{\land} \textit{right}~u = \Lambda))$ \\
 \phantom{``$($}$\textrm{else}$ \\
 \hbox{}\phantom{``$(\quad$}$\textit{wf}~t \mathrel{\land} \textit{wf}~u
 \mathrel{\land} u \not= \Lambda \mathrel{\land} \textit{level}~t < k
 \mathrel{\land} \textit{level}~u \le k$ \\
 \hbox{}\phantom{``$(\quad$}${\land}\; \textit{level}~(\textit{right}~u) < k)$''
 \postw
 
 Rebalancing the tree upon insertion and removal of elements is performed by two
 auxiliary functions called \textit{skew} and \textit{split}, defined below:
 
 \prew
 \textbf{primrec} \textit{skew} \textbf{where} \\
 ``$\textit{skew}~\Lambda = \Lambda$'' $\,\mid$ \\
 ``$\textit{skew}~(N~x~k~t~u) = {}$ \\
 \phantom{``}$(\textrm{if}~t \not= \Lambda \mathrel{\land} k =
 \textit{level}~t~\textrm{then}$ \\
 \phantom{``(\quad}$N~(\textit{data}~t)~k~(\textit{left}~t)~(N~x~k~
 (\textit{right}~t)~u)$ \\
 \phantom{``(}$\textrm{else}$ \\
 \phantom{``(\quad}$N~x~k~t~u)$''
 \postw
 
 \prew
 \textbf{primrec} \textit{split} \textbf{where} \\
 ``$\textit{split}~\Lambda = \Lambda$'' $\,\mid$ \\
 ``$\textit{split}~(N~x~k~t~u) = {}$ \\
 \phantom{``}$(\textrm{if}~u \not= \Lambda \mathrel{\land} k =
 \textit{level}~(\textit{right}~u)~\textrm{then}$ \\
 \phantom{``(\quad}$N~(\textit{data}~u)~(\textit{Suc}~k)~
 (N~x~k~t~(\textit{left}~u))~(\textit{right}~u)$ \\
 \phantom{``(}$\textrm{else}$ \\
 \phantom{``(\quad}$N~x~k~t~u)$''
 \postw
 
 Performing a \textit{skew} or a \textit{split} should have no impact on the set
 of elements stored in the tree:
 
 \prew
 \textbf{theorem}~\textit{dataset\_skew\_split\/}:\\
 ``$\textit{dataset}~(\textit{skew}~t) = \textit{dataset}~t$'' \\
 ``$\textit{dataset}~(\textit{split}~t) = \textit{dataset}~t$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 {\slshape Nitpick ran out of time after checking 9 of 10 scopes}
 \postw
 
 Furthermore, applying \textit{skew} or \textit{split} on a well-formed tree
 should not alter the tree:
 
 \prew
 \textbf{theorem}~\textit{wf\_skew\_split\/}:\\
 ``$\textit{wf}~t\,\Longrightarrow\, \textit{skew}~t = t$'' \\
 ``$\textit{wf}~t\,\Longrightarrow\, \textit{split}~t = t$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 {\slshape Nitpick found no counterexample}
 \postw
 
 Insertion is implemented recursively. It preserves the sort order:
 
 \prew
 \textbf{primrec}~\textit{insort} \textbf{where} \\
 ``$\textit{insort}~\Lambda~x = N~x~1~\Lambda~\Lambda$'' $\,\mid$ \\
 ``$\textit{insort}~(N~y~k~t~u)~x =$ \\
 \phantom{``}$({*}~(\textit{split} \circ \textit{skew})~{*})~(N~y~k~(\textrm{if}~x < y~\textrm{then}~\textit{insort}~t~x~\textrm{else}~t)$ \\
 \phantom{``$({*}~(\textit{split} \circ \textit{skew})~{*})~(N~y~k~$}$(\textrm{if}~x > y~\textrm{then}~\textit{insort}~u~x~\textrm{else}~u))$''
 \postw
 
 Notice that we deliberately commented out the application of \textit{skew} and
 \textit{split}. Let's see if this causes any problems:
 
 \prew
 \textbf{theorem}~\textit{wf\_insort\/}:\kern.4em ``$\textit{wf}~t\,\Longrightarrow\, \textit{wf}~(\textit{insort}~t~x)$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \slshape Nitpick found a counterexample for \textit{card} $'a$ = 4: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $t = N~a_1~1~\Lambda~\Lambda$ \\
 \hbox{}\qquad\qquad $x = a_2$
 \postw
 
 It's hard to see why this is a counterexample. To improve readability, we will
 restrict the theorem to \textit{nat}, so that we don't need to look up the value
 of the $\textit{op}~{<}$ constant to find out which element is smaller than the
 other. In addition, we will tell Nitpick to display the value of
 $\textit{insort}~t~x$ using the \textit{eval} option. This gives
 
 \prew
 \textbf{theorem} \textit{wf\_insort\_nat\/}:\kern.4em ``$\textit{wf}~t\,\Longrightarrow\, \textit{wf}~(\textit{insort}~t~(x\Colon\textit{nat}))$'' \\
 \textbf{nitpick} [\textit{eval} = ``$\textit{insort}~t~x$''] \\[2\smallskipamount]
 \slshape Nitpick found a counterexample: \\[2\smallskipamount]
 \hbox{}\qquad Free variables: \nopagebreak \\
 \hbox{}\qquad\qquad $t = N~1~1~\Lambda~\Lambda$ \\
 \hbox{}\qquad\qquad $x = 0$ \\
 \hbox{}\qquad Evaluated term: \\
 \hbox{}\qquad\qquad $\textit{insort}~t~x = N~1~1~(N~0~1~\Lambda~\Lambda)~\Lambda$
 \postw
 
 Nitpick's output reveals that the element $0$ was added as a left child of $1$,
 where both nodes have a level of 1. This violates the second AA tree invariant,
 which states that a left child's level must be less than its parent's. This
 shouldn't come as a surprise, considering that we commented out the tree
 rebalancing code. Reintroducing the code seems to solve the problem:
 
 \prew
 \textbf{theorem}~\textit{wf\_insort\/}:\kern.4em ``$\textit{wf}~t\,\Longrightarrow\, \textit{wf}~(\textit{insort}~t~x)$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 {\slshape Nitpick ran out of time after checking 8 of 10 scopes}
 \postw
 
 Insertion should transform the set of elements represented by the tree in the
 obvious way:
 
 \prew
 \textbf{theorem} \textit{dataset\_insort\/}:\kern.4em
 ``$\textit{dataset}~(\textit{insort}~t~x) = \{x\} \cup \textit{dataset}~t$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 {\slshape Nitpick ran out of time after checking 7 of 10 scopes}
 \postw
 
 We could continue like this and sketch a full-blown theory of AA trees. Once the
 definitions and main theorems are in place and have been thoroughly tested using
 Nitpick, we could start working on the proofs. Developing theories this way
 usually saves time, because faulty theorems and definitions are discovered much
 earlier in the process.
 
 \section{Option Reference}
 \label{option-reference}
 
 \def\defl{\{}
 \def\defr{\}}
 
 \def\flushitem#1{\item[]\noindent\kern-\leftmargin \textbf{#1}}
 \def\qty#1{$\left<\textit{#1}\right>$}
 \def\qtybf#1{$\mathbf{\left<\textbf{\textit{#1}}\right>}$}
 \def\optrue#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\enskip \defl\textit{true}\defr\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opfalse#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\enskip \defl\textit{false}\defr\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opsmart#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{smart\_bool}$\bigr]$\enskip \defl\textit{smart}\defr\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opnodefault#1#2{\flushitem{\textit{#1} = \qtybf{#2}} \nopagebreak\\[\parskip]}
 \def\opdefault#1#2#3{\flushitem{\textit{#1} = \qtybf{#2}\enskip \defl\textit{#3}\defr} \nopagebreak\\[\parskip]}
 \def\oparg#1#2#3{\flushitem{\textit{#1} \qtybf{#2} = \qtybf{#3}} \nopagebreak\\[\parskip]}
 \def\opargbool#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{bool}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
 \def\opargboolorsmart#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{smart\_bool}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
 
 Nitpick's behavior can be influenced by various options, which can be specified
 in brackets after the \textbf{nitpick} command. Default values can be set
 using \textbf{nitpick\_\allowbreak params}. For example:
 
 \prew
 \textbf{nitpick\_params} [\textit{verbose}, \,\textit{timeout} = 60]
 \postw
 
 The options are categorized as follows:\ mode of operation
 (\S\ref{mode-of-operation}), scope of search (\S\ref{scope-of-search}), output
 format (\S\ref{output-format}), regression testing (\S\ref{regression-testing}),
 optimizations (\S\ref{optimizations}), and timeouts (\S\ref{timeouts}).
 
 Nitpick also provides an automatic mode that can be enabled via the
 ``Auto Nitpick'' option under ``Plugins > Plugin Options > Isabelle > General''
 in Isabelle/jEdit. For automatic runs,
 \textit{user\_axioms} (\S\ref{mode-of-operation}),
 \textit{assms} (\S\ref{mode-of-operation}), and \textit{mono}
 (\S\ref{scope-of-search}) are implicitly enabled,
 \textit{verbose} (\S\ref{output-format}) and
 \textit{debug} (\S\ref{output-format}) are disabled, \textit{max\_potential}
 (\S\ref{output-format}) is taken to be 0, \textit{max\_threads}
 (\S\ref{optimizations}) is taken to be 1, and \textit{timeout}
 (\S\ref{timeouts}) is superseded by the ``Auto Time Limit'' in
 Isabelle/jEdit. Nitpick's output is also more concise.
 
 The number of options can be overwhelming at first glance. Do not let that worry
 you: Nitpick's defaults have been chosen so that it almost always does the right
 thing, and the most important options have been covered in context in
 \S\ref{first-steps}.
 
 The descriptions below refer to the following syntactic quantities:
 
 \begin{enum}
 \item[\labelitemi] \qtybf{string}: A string.
 \item[\labelitemi] \qtybf{string\_list\/}: A space-separated list of strings
 (e.g., ``\textit{ichi ni san}'').
 \item[\labelitemi] \qtybf{bool\/}: \textit{true} or \textit{false}.
 \item[\labelitemi] \qtybf{smart\_bool\/}: \textit{true}, \textit{false}, or \textit{smart}.
 \item[\labelitemi] \qtybf{int\/}: An integer. Negative integers are prefixed with a hyphen.
 \item[\labelitemi] \qtybf{smart\_int\/}: An integer or \textit{smart}.
 \item[\labelitemi] \qtybf{int\_range}: An integer (e.g., 3) or a range
 of nonnegative integers (e.g., $1$--$4$). The range symbol `--' is entered as \texttt{-} (hyphen).
 \item[\labelitemi] \qtybf{int\_seq}: A comma-separated sequence of ranges of integers (e.g.,~1{,}3{,}\allowbreak6--8).
 \item[\labelitemi] \qtybf{float}: An floating-point number (e.g., 0.5 or 60)
 expressing a number of seconds.
 \item[\labelitemi] \qtybf{const\/}: The name of a HOL constant.
 \item[\labelitemi] \qtybf{term}: A HOL term (e.g., ``$f~x$'').
 \item[\labelitemi] \qtybf{term\_list\/}: A space-separated list of HOL terms (e.g.,
 ``$f~x$''~``$g~y$'').
 \item[\labelitemi] \qtybf{type}: A HOL type.
 \end{enum}
 
 Default values are indicated in curly brackets (\textrm{\{\}}). Boolean options
 have a negated counterpart (e.g., \textit{mono} vs.\
 \textit{non\_mono}). When setting them, ``= \textit{true}'' may be omitted.
 
 \subsection{Mode of Operation}
 \label{mode-of-operation}
 
 \begin{enum}
 \optrue{falsify}{satisfy}
 Specifies whether Nitpick should look for falsifying examples (countermodels) or
 satisfying examples (models). This manual assumes throughout that
 \textit{falsify} is enabled.
 
 \opsmart{user\_axioms}{no\_user\_axioms}
 Specifies whether the user-defined axioms (specified using
 \textbf{axiomatization} and \textbf{axioms}) should be considered. If the option
 is set to \textit{smart}, Nitpick performs an ad hoc axiom selection based on
 the constants that occur in the formula to falsify. The option is implicitly set
 to \textit{true} for automatic runs.
 
 \textbf{Warning:} If the option is set to \textit{true}, Nitpick might
 nonetheless ignore some polymorphic axioms. Counterexamples generated under
 these conditions are tagged as ``quasi genuine.'' The \textit{debug}
 (\S\ref{output-format}) option can be used to find out which axioms were
 considered.
 
 \nopagebreak
 {\small See also \textit{assms} (\S\ref{mode-of-operation}) and \textit{debug}
 (\S\ref{output-format}).}
 
 \optrue{assms}{no\_assms}
 Specifies whether the relevant assumptions in structured proofs should be
 considered. The option is implicitly enabled for automatic runs.
 
 \nopagebreak
 {\small See also \textit{user\_axioms} (\S\ref{mode-of-operation}).}
 
 \opfalse{spy}{dont\_spy}
 Specifies whether Nitpick should record statistics in
 \texttt{\$ISA\-BELLE\_\allowbreak HOME\_\allowbreak USER/\allowbreak spy\_\allowbreak nitpick}.
 These statistics can be useful to the developer of Nitpick. If you are willing to have your
 interactions recorded in the name of science, please enable this feature and send the statistics
 file every now and then to the author of this manual (\authoremail).
 To change the default value of this option globally, set the environment variable
 \texttt{NITPICK\_SPY} to \texttt{yes}.
 
 \nopagebreak
 {\small See also \textit{debug} (\S\ref{output-format}).}
 
 \opfalse{overlord}{no\_overlord}
 Specifies whether Nitpick should put its temporary files in
 \texttt{\$ISABELLE\_\allowbreak HOME\_\allowbreak USER}, which is useful for
 debugging Nitpick but also unsafe if several instances of the tool are run
 simultaneously. The files are identified by the extensions
 \texttt{.kki}, \texttt{.cnf}, \texttt{.out}, and
 \texttt{.err}; you may safely remove them after Nitpick has run.
 
 \textbf{Warning:} This option is not thread-safe. Use at your own risks.
 
 \nopagebreak
 {\small See also \textit{debug} (\S\ref{output-format}).}
 \end{enum}
 
 \subsection{Scope of Search}
 \label{scope-of-search}
 
 \begin{enum}
 \oparg{card}{type}{int\_seq}
 Specifies the sequence of cardinalities to use for a given type.
 For free types, and often also for \textbf{typedecl}'d types, it usually makes
 sense to specify cardinalities as a range of the form \textit{$1$--$n$}.
 
 \nopagebreak
 {\small See also \textit{box} (\S\ref{scope-of-search}) and \textit{mono}
 (\S\ref{scope-of-search}).}
 
 \opdefault{card}{int\_seq}{\upshape 1--10}
 Specifies the default sequence of cardinalities to use. This can be overridden
 on a per-type basis using the \textit{card}~\qty{type} option described above.
 
 \oparg{max}{const}{int\_seq}
 Specifies the sequence of maximum multiplicities to use for a given
 (co)in\-duc\-tive datatype constructor. A constructor's multiplicity is the
 number of distinct values that it can construct. Nonsensical values (e.g.,
 \textit{max}~[]~$=$~2) are silently repaired. This option is only available for
 datatypes equipped with several constructors.
 
 \opnodefault{max}{int\_seq}
 Specifies the default sequence of maximum multiplicities to use for
 (co)in\-duc\-tive datatype constructors. This can be overridden on a per-constructor
 basis using the \textit{max}~\qty{const} option described above.
 
 \opsmart{binary\_ints}{unary\_ints}
 Specifies whether natural numbers and integers should be encoded using a unary
 or binary notation. In unary mode, the cardinality fully specifies the subset
 used to approximate the type. For example:
 %
 $$\hbox{\begin{tabular}{@{}rll@{}}%
 \textit{card nat} = 4 & induces & $\{0,\, 1,\, 2,\, 3\}$ \\
 \textit{card int} = 4 & induces & $\{-1,\, 0,\, +1,\, +2\}$ \\
 \textit{card int} = 5 & induces & $\{-2,\, -1,\, 0,\, +1,\, +2\}.$%
 \end{tabular}}$$
 %
 In general:
 %
 $$\hbox{\begin{tabular}{@{}rll@{}}%
 \textit{card nat} = $K$ & induces & $\{0,\, \ldots,\, K - 1\}$ \\
 \textit{card int} = $K$ & induces & $\{-\lceil K/2 \rceil + 1,\, \ldots,\, +\lfloor K/2 \rfloor\}.$%
 \end{tabular}}$$
 %
 In binary mode, the cardinality specifies the number of distinct values that can
 be constructed. Each of these value is represented by a bit pattern whose length
 is specified by the \textit{bits} (\S\ref{scope-of-search}) option. By default,
 Nitpick attempts to choose the more appropriate encoding by inspecting the
 formula at hand, preferring the binary notation for problems involving
 multiplicative operators or large constants.
 
 \textbf{Warning:} For technical reasons, Nitpick always reverts to unary for
 problems that refer to the types \textit{rat} or \textit{real} or the constants
 \textit{Suc}, \textit{gcd}, or \textit{lcm}.
 
 {\small See also \textit{bits} (\S\ref{scope-of-search}) and
 \textit{show\_types} (\S\ref{output-format}).}
 
 \opdefault{bits}{int\_seq}{\upshape 1--10}
 Specifies the number of bits to use to represent natural numbers and integers in
 binary, excluding the sign bit. The minimum is 1 and the maximum is 31.
 
 {\small See also \textit{binary\_ints} (\S\ref{scope-of-search}).}
 
 \opargboolorsmart{wf}{const}{non\_wf}
 Specifies whether the specified (co)in\-duc\-tively defined predicate is
 well-founded. The option can take the following values:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{true}:} Tentatively treat the (co)in\-duc\-tive
 predicate as if it were well-founded. Since this is generally not sound when the
 predicate is not well-founded, the counterexamples are tagged as ``quasi
 genuine.''
 
 \item[\labelitemi] \textbf{\textit{false}:} Treat the (co)in\-duc\-tive predicate
 as if it were not well-founded. The predicate is then unrolled as prescribed by
 the \textit{star\_linear\_preds}, \textit{iter}~\qty{const}, and \textit{iter}
 options.
 
 \item[\labelitemi] \textbf{\textit{smart}:} Try to prove that the inductive
 predicate is well-founded using Isabelle's \textit{lexicographic\_order} and
 \textit{size\_change} tactics. If this succeeds (or the predicate occurs with an
 appropriate polarity in the formula to falsify), use an efficient fixed-point
 equation as specification of the predicate; otherwise, unroll the predicates
 according to the \textit{iter}~\qty{const} and \textit{iter} options.
 \end{enum}
 
 \nopagebreak
 {\small See also \textit{iter} (\S\ref{scope-of-search}),
 \textit{star\_linear\_preds} (\S\ref{optimizations}), and \textit{tac\_timeout}
 (\S\ref{timeouts}).}
 
 \opsmart{wf}{non\_wf}
 Specifies the default wellfoundedness setting to use. This can be overridden on
 a per-predicate basis using the \textit{wf}~\qty{const} option above.
 
 \oparg{iter}{const}{int\_seq}
 Specifies the sequence of iteration counts to use when unrolling a given
 (co)in\-duc\-tive predicate. By default, unrolling is applied for inductive
 predicates that occur negatively and coinductive predicates that occur
 positively in the formula to falsify and that cannot be proved to be
 well-founded, but this behavior is influenced by the \textit{wf} option. The
 iteration counts are automatically bounded by the cardinality of the predicate's
 domain.
 
 {\small See also \textit{wf} (\S\ref{scope-of-search}) and
 \textit{star\_linear\_preds} (\S\ref{optimizations}).}
 
 \opdefault{iter}{int\_seq}{\upshape 0{,}1{,}2{,}4{,}8{,}12{,}16{,}20{,}24{,}28}
 Specifies the sequence of iteration counts to use when unrolling (co)in\-duc\-tive
 predicates. This can be overridden on a per-predicate basis using the
 \textit{iter} \qty{const} option above.
 
 \opdefault{bisim\_depth}{int\_seq}{\upshape 9}
 Specifies the sequence of iteration counts to use when unrolling the
 bisimilarity predicate generated by Nitpick for coinductive datatypes. A value
 of $-1$ means that no predicate is generated, in which case Nitpick performs an
 after-the-fact check to see if the known coinductive datatype values are
 bidissimilar. If two values are found to be bisimilar, the counterexample is
 tagged as ``quasi genuine.'' The iteration counts are automatically bounded by
 the sum of the cardinalities of the coinductive datatypes occurring in the
 formula to falsify.
 
 \opargboolorsmart{box}{type}{dont\_box}
 Specifies whether Nitpick should attempt to wrap (``box'') a given function or
 product type in an isomorphic datatype internally. Boxing is an effective mean
 to reduce the search space and speed up Nitpick, because the isomorphic datatype
 is approximated by a subset of the possible function or pair values.
 Like other drastic optimizations, it can also prevent the discovery of
 counterexamples. The option can take the following values:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{true}:} Box the specified type whenever
 practicable.
 \item[\labelitemi] \textbf{\textit{false}:} Never box the type.
 \item[\labelitemi] \textbf{\textit{smart}:} Box the type only in contexts where it
 is likely to help. For example, $n$-tuples where $n > 2$ and arguments to
 higher-order functions are good candidates for boxing.
 \end{enum}
 
 \nopagebreak
 {\small See also \textit{finitize} (\S\ref{scope-of-search}), \textit{verbose}
 (\S\ref{output-format}), and \textit{debug} (\S\ref{output-format}).}
 
 \opsmart{box}{dont\_box}
 Specifies the default boxing setting to use. This can be overridden on a
 per-type basis using the \textit{box}~\qty{type} option described above.
 
 \opargboolorsmart{finitize}{type}{dont\_finitize}
 Specifies whether Nitpick should attempt to finitize an infinite datatype. The
 option can then take the following values:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{true}:} Finitize the datatype. Since this is
 unsound, counterexamples generated under these conditions are tagged as ``quasi
 genuine.''
 \item[\labelitemi] \textbf{\textit{false}:} Don't attempt to finitize the datatype.
 \item[\labelitemi] \textbf{\textit{smart}:}
 If the datatype's constructors don't appear in the problem, perform a
 monotonicity analysis to detect whether the datatype can be soundly finitized;
 otherwise, don't finitize it.
 \end{enum}
 
 \nopagebreak
 {\small See also \textit{box} (\S\ref{scope-of-search}), \textit{mono}
 (\S\ref{scope-of-search}), \textit{verbose} (\S\ref{output-format}), and
 \textit{debug} (\S\ref{output-format}).}
 
 \opsmart{finitize}{dont\_finitize}
 Specifies the default finitization setting to use. This can be overridden on a
 per-type basis using the \textit{finitize}~\qty{type} option described above.
 
 \opargboolorsmart{mono}{type}{non\_mono}
 Specifies whether the given type should be considered monotonic when enumerating
 scopes and finitizing types. If the option is set to \textit{smart}, Nitpick
 performs a monotonicity check on the type. Setting this option to \textit{true}
 can reduce the number of scopes tried, but it can also diminish the chance of
 finding a counterexample, as demonstrated in \S\ref{scope-monotonicity}. The
 option is implicitly set to \textit{true} for automatic runs.
 
 \nopagebreak
 {\small See also \textit{card} (\S\ref{scope-of-search}),
 \textit{finitize} (\S\ref{scope-of-search}),
 \textit{merge\_type\_vars} (\S\ref{scope-of-search}), and \textit{verbose}
 (\S\ref{output-format}).}
 
 \opsmart{mono}{non\_mono}
 Specifies the default monotonicity setting to use. This can be overridden on a
 per-type basis using the \textit{mono}~\qty{type} option described above.
 
 \opfalse{merge\_type\_vars}{dont\_merge\_type\_vars}
 Specifies whether type variables with the same sort constraints should be
 merged. Setting this option to \textit{true} can reduce the number of scopes
 tried and the size of the generated Kodkod formulas, but it also diminishes the
 theoretical chance of finding a counterexample.
 
 {\small See also \textit{mono} (\S\ref{scope-of-search}).}
 \end{enum}
 
 \subsection{Output Format}
 \label{output-format}
 
 \begin{enum}
 \opfalse{verbose}{quiet}
 Specifies whether the \textbf{nitpick} command should explain what it does. This
 option is useful to determine which scopes are tried or which SAT solver is
 used. This option is implicitly disabled for automatic runs.
 
 \opfalse{debug}{no\_debug}
 Specifies whether Nitpick should display additional debugging information beyond
 what \textit{verbose} already displays. Enabling \textit{debug} also enables
 \textit{verbose} and \textit{show\_all} behind the scenes. The \textit{debug}
 option is implicitly disabled for automatic runs.
 
 \nopagebreak
 {\small See also \textit{spy} (\S\ref{mode-of-operation}),
 \textit{overlord} (\S\ref{mode-of-operation}), and
 \textit{batch\_size} (\S\ref{optimizations}).}
 
 \opfalse{show\_types}{hide\_types}
 Specifies whether the subsets used to approximate (co)in\-duc\-tive data\-types should
 be displayed as part of counterexamples. Such subsets are sometimes helpful when
 investigating whether a potentially spurious counterexample is genuine, but
 their potential for clutter is real.
 
 \optrue{show\_skolems}{hide\_skolem}
 Specifies whether the values of Skolem constants should be displayed as part of
 counterexamples. Skolem constants correspond to bound variables in the original
 formula and usually help us to understand why the counterexample falsifies the
 formula.
 
 \opfalse{show\_consts}{hide\_consts}
 Specifies whether the values of constants occurring in the formula (including
 its axioms) should be displayed along with any counterexample. These values are
 sometimes helpful when investigating why a counterexample is
 genuine, but they can clutter the output.
 
 \opnodefault{show\_all}{bool}
 Abbreviation for \textit{show\_types}, \textit{show\_skolems}, and
 \textit{show\_consts}.
 
 \opdefault{max\_potential}{int}{\upshape 1}
 Specifies the maximum number of potentially spurious counterexamples to display.
 Setting this option to 0 speeds up the search for a genuine counterexample. This
 option is implicitly set to 0 for automatic runs. If you set this option to a
 value greater than 1, you will need an incremental SAT solver, such as
 \textit{MiniSat\_JNI} (recommended) and \textit{SAT4J}. Be aware that many of
 the counterexamples may be identical.
 
 \nopagebreak
 {\small See also \textit{sat\_solver} (\S\ref{optimizations}).}
 
 \opdefault{max\_genuine}{int}{\upshape 1}
 Specifies the maximum number of genuine counterexamples to display. If you set
 this option to a value greater than 1, you will need an incremental SAT solver,
 such as \textit{MiniSat\_JNI} (recommended) and \textit{SAT4J}. Be aware that
 many of the counterexamples may be identical.
 
 \nopagebreak
 {\small See also \textit{sat\_solver} (\S\ref{optimizations}).}
 
 \opnodefault{eval}{term\_list}
 Specifies the list of terms whose values should be displayed along with
 counterexamples. This option suffers from an ``observer effect'': Nitpick might
 find different counterexamples for different values of this option.
 
 \oparg{atoms}{type}{string\_list}
 Specifies the names to use to refer to the atoms of the given type. By default,
 Nitpick generates names of the form $a_1, \ldots, a_n$, where $a$ is the first
 letter of the type's name.
 
 \opnodefault{atoms}{string\_list}
 Specifies the default names to use to refer to atoms of any type. For example,
 to call the three atoms of type ${'}a$ \textit{ichi}, \textit{ni}, and
 \textit{san} instead of $a_1$, $a_2$, $a_3$, specify the option
 ``\textit{atoms}~${'}a$ = \textit{ichi~ni~san}''. The default names can be
 overridden on a per-type basis using the \textit{atoms}~\qty{type} option
 described above.
 
 \oparg{format}{term}{int\_seq}
 Specifies how to uncurry the value displayed for a variable or constant.
 Uncurrying sometimes increases the readability of the output for high-arity
 functions. For example, given the variable $y \mathbin{\Colon} {'a}\Rightarrow
 {'b}\Rightarrow {'c}\Rightarrow {'d}\Rightarrow {'e}\Rightarrow {'f}\Rightarrow
 {'g}$, setting \textit{format}~$y$ = 3 tells Nitpick to group the last three
 arguments, as if the type had been ${'a}\Rightarrow {'b}\Rightarrow
 {'c}\Rightarrow {'d}\times {'e}\times {'f}\Rightarrow {'g}$. In general, a list
 of values $n_1,\ldots,n_k$ tells Nitpick to show the last $n_k$ arguments as an
 $n_k$-tuple, the previous $n_{k-1}$ arguments as an $n_{k-1}$-tuple, and so on;
 arguments that are not accounted for are left alone, as if the specification had
 been $1,\ldots,1,n_1,\ldots,n_k$.
 
 \opdefault{format}{int\_seq}{\upshape 1}
 Specifies the default format to use. Irrespective of the default format, the
 extra arguments to a Skolem constant corresponding to the outer bound variables
 are kept separated from the remaining arguments, the \textbf{for} arguments of
 an inductive definitions are kept separated from the remaining arguments, and
 the iteration counter of an unrolled inductive definition is shown alone. The
 default format can be overridden on a per-variable or per-constant basis using
 the \textit{format}~\qty{term} option described above.
 \end{enum}
 
 \subsection{Regression Testing}
 \label{regression-testing}
 
 \begin{enum}
 \opnodefault{expect}{string}
 Specifies the expected outcome, which must be one of the following:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{genuine}:} Nitpick found a genuine counterexample.
 \item[\labelitemi] \textbf{\textit{quasi\_genuine}:} Nitpick found a ``quasi
 genuine'' counterexample (i.e., a counterexample that is genuine unless
 it contradicts a missing axiom or a dangerous option was used inappropriately).
 \item[\labelitemi] \textbf{\textit{potential}:} Nitpick found a potentially
 spurious counterexample.
 \item[\labelitemi] \textbf{\textit{none}:} Nitpick found no counterexample.
 \item[\labelitemi] \textbf{\textit{unknown}:} Nitpick encountered some problem (e.g.,
 Kodkod ran out of memory).
 \end{enum}
 
 Nitpick emits an error if the actual outcome differs from the expected outcome.
 This option is useful for regression testing.
 \end{enum}
 
 \subsection{Optimizations}
 \label{optimizations}
 
 \def\cpp{C\nobreak\raisebox{.1ex}{+}\nobreak\raisebox{.1ex}{+}}
 
 \sloppy
 
 \begin{enum}
 \opdefault{sat\_solver}{string}{smart}
 Specifies which SAT solver to use. SAT solvers implemented in C or \cpp{} tend
 to be faster than their Java counterparts, but they can be more difficult to
 install. Also, if you set the \textit{max\_potential} (\S\ref{output-format}) or
 \textit{max\_genuine} (\S\ref{output-format}) option to a value greater than 1,
 you will need an incremental SAT solver, such as \textit{MiniSat\_JNI}
 (recommended) or \textit{SAT4J}.
 
 The supported solvers are listed below:
 
 \begin{enum}
 
 \item[\labelitemi] \textbf{\textit{Lingeling\_JNI}:}
 Lingeling is an efficient solver written in C. The JNI (Java Native Interface)
 version of Lingeling is bundled with Kodkodi and is precompiled for Linux and
 Mac~OS~X. It is also available from the Kodkod web site \cite{kodkod-2009}.
 
 \item[\labelitemi] \textbf{\textit{CryptoMiniSat}:} CryptoMiniSat is the winner of
 the 2010 SAT Race. To use CryptoMiniSat, set the environment variable
 \texttt{CRYPTO\-MINISAT\_}\discretionary{}{}{}\texttt{HOME} to the directory that contains the \texttt{crypto\-minisat}
 executable.%
 \footnote{Important note for Cygwin users: The path must be specified using
 native Windows syntax. Make sure to escape backslashes properly.%
 \label{cygwin-paths}}
 The \cpp{} sources and executables for Crypto\-Mini\-Sat are available at
 \url{http://planete.inrialpes.fr/~soos/}\allowbreak\url{CryptoMiniSat2/index.php}.
 Nitpick has been tested with version 2.51.
 
 \item[\labelitemi] \textbf{\textit{CryptoMiniSat\_JNI}:} The JNI (Java Native
 Interface) version of CryptoMiniSat is bundled with Kodkodi and is precompiled
 for Linux and Mac~OS~X. It is also available from the Kodkod web site
 \cite{kodkod-2009}.
 
 \item[\labelitemi] \textbf{\textit{MiniSat}:} MiniSat is an efficient solver
 written in \cpp{}. To use MiniSat, set the environment variable
 \texttt{MINISAT\_HOME} to the directory that contains the \texttt{minisat}
 executable.%
 \footref{cygwin-paths}
 The \cpp{} sources and executables for MiniSat are available at
 \url{http://minisat.se/MiniSat.html}. Nitpick has been tested with versions 1.14
 and 2.2.
 
 \item[\labelitemi] \textbf{\textit{MiniSat\_JNI}:} The JNI
 version of MiniSat is bundled with Kodkodi and is precompiled for Linux,
 Mac~OS~X, and Windows (Cygwin). It is also available from the Kodkod web site
 \cite{kodkod-2009}. Unlike the standard version of MiniSat, the JNI version can
 be used incrementally.
 
 \item[\labelitemi] \textbf{\textit{Riss3g}:} Riss3g is an efficient solver written in
 \cpp{}. To use Riss3g, set the environment variable \texttt{RISS3G\_HOME} to the
 directory that contains the \texttt{riss3g} executable.%
 \footref{cygwin-paths}
 The \cpp{} sources for Riss3g are available at
 \url{http://tools.computational-logic.org/content/riss3g.php}.
 Nitpick has been tested with the SAT Competition 2013 version.
 
 \item[\labelitemi] \textbf{\textit{zChaff}:} zChaff is an older solver written
 in \cpp{}. To use zChaff, set the environment variable \texttt{ZCHAFF\_HOME} to
 the directory that contains the \texttt{zchaff} executable.%
 \footref{cygwin-paths}
 The \cpp{} sources and executables for zChaff are available at
 \url{http://www.princeton.edu/~chaff/zchaff.html}. Nitpick has been tested with
 versions 2004-05-13, 2004-11-15, and 2007-03-12.
 
 \item[\labelitemi] \textbf{\textit{RSat}:} RSat is an efficient solver written in
 \cpp{}. To use RSat, set the environment variable \texttt{RSAT\_HOME} to the
 directory that contains the \texttt{rsat} executable.%
 \footref{cygwin-paths}
 The \cpp{} sources for RSat are available at
 \url{http://reasoning.cs.ucla.edu/rsat/}. Nitpick has been tested with version
 2.01.
 
 \item[\labelitemi] \textbf{\textit{BerkMin}:} BerkMin561 is an efficient solver
 written in C. To use BerkMin, set the environment variable
 \texttt{BERKMIN\_HOME} to the directory that contains the \texttt{BerkMin561}
 executable.\footref{cygwin-paths}
 The BerkMin executables are available at
 \url{http://eigold.tripod.com/BerkMin.html}.
 
 \item[\labelitemi] \textbf{\textit{BerkMin\_Alloy}:} Variant of BerkMin that is
 included with Alloy 4 and calls itself ``sat56'' in its banner text. To use this
 version of BerkMin, set the environment variable
 \texttt{BERKMINALLOY\_HOME} to the directory that contains the \texttt{berkmin}
 executable.%
 \footref{cygwin-paths}
 
 \item[\labelitemi] \textbf{\textit{SAT4J}:} SAT4J is a reasonably efficient solver
 written in Java that can be used incrementally. It is bundled with Kodkodi and
 requires no further installation or configuration steps. Do not attempt to
 install the official SAT4J packages, because their API is incompatible with
 Kodkod.
 
 \item[\labelitemi] \textbf{\textit{SAT4J\_Light}:} Variant of SAT4J that is
 optimized for small problems. It can also be used incrementally.
 
 \item[\labelitemi] \textbf{\textit{smart}:} If \textit{sat\_solver} is set to
 \textit{smart}, Nitpick selects the first solver among the above that is
 recognized by Isabelle. If \textit{verbose} (\S\ref{output-format}) is enabled,
 Nitpick displays which SAT solver was chosen.
 \end{enum}
 \fussy
 
 \opdefault{batch\_size}{smart\_int}{smart}
 Specifies the maximum number of Kodkod problems that should be lumped together
 when invoking Kodkodi. Each problem corresponds to one scope. Lumping problems
 together ensures that Kodkodi is launched less often, but it makes the verbose
 output less readable and is sometimes detrimental to performance. If
 \textit{batch\_size} is set to \textit{smart}, the actual value used is 1 if
 \textit{debug} (\S\ref{output-format}) is set and 50 otherwise.
 
 \optrue{destroy\_constrs}{dont\_destroy\_constrs}
 Specifies whether formulas involving (co)in\-duc\-tive datatype constructors should
 be rewritten to use (automatically generated) discriminators and destructors.
 This optimization can drastically reduce the size of the Boolean formulas given
 to the SAT solver.
 
 \nopagebreak
 {\small See also \textit{debug} (\S\ref{output-format}).}
 
 \optrue{specialize}{dont\_specialize}
 Specifies whether functions invoked with static arguments should be specialized.
 This optimization can drastically reduce the search space, especially for
 higher-order functions.
 
 \nopagebreak
 {\small See also \textit{debug} (\S\ref{output-format}) and
 \textit{show\_consts} (\S\ref{output-format}).}
 
 \optrue{star\_linear\_preds}{dont\_star\_linear\_preds}
 Specifies whether Nitpick should use Kodkod's transitive closure operator to
 encode non-well-founded ``linear inductive predicates,'' i.e., inductive
 predicates for which each the predicate occurs in at most one assumption of each
 introduction rule. Using the reflexive transitive closure is in principle
 equivalent to setting \textit{iter} to the cardinality of the predicate's
 domain, but it is usually more efficient.
 
 {\small See also \textit{wf} (\S\ref{scope-of-search}), \textit{debug}
 (\S\ref{output-format}), and \textit{iter} (\S\ref{scope-of-search}).}
 
 \opnodefault{whack}{term\_list}
 Specifies a list of atomic terms (usually constants, but also free and schematic
 variables) that should be taken as being $\unk$ (unknown). This can be useful to
 reduce the size of the Kodkod problem if you can guess in advance that a
 constant might not be needed to find a countermodel.
 
 {\small See also \textit{debug} (\S\ref{output-format}).}
 
 \opnodefault{need}{term\_list}
 Specifies a list of datatype values (normally ground constructor terms) that
 should be part of the subterm-closed subsets used to approximate datatypes. If
 you know that a value must necessarily belong to the subset of representable
 values that approximates a datatype, specifying it can speed up the search,
 especially for high cardinalities.
 %By default, Nitpick inspects the conjecture to infer needed datatype values.
 
 \opsmart{total\_consts}{partial\_consts}
 Specifies whether constants occurring in the problem other than constructors can
 be assumed to be considered total for the representable values that approximate
 a datatype. This option is highly incomplete; it should be used only for
 problems that do not construct datatype values explicitly. Since this option is
 (in rare cases) unsound, counterexamples generated under these conditions are
 tagged as ``quasi genuine.''
 
 \opdefault{datatype\_sym\_break}{int}{\upshape 5}
 Specifies an upper bound on the number of datatypes for which Nitpick generates
 symmetry breaking predicates. Symmetry breaking can speed up the SAT solver
 considerably, especially for unsatisfiable problems, but too much of it can slow
 it down.
 
 \opdefault{kodkod\_sym\_break}{int}{\upshape 15}
 Specifies an upper bound on the number of relations for which Kodkod generates
 symmetry breaking predicates. Symmetry breaking can speed up the SAT solver
 considerably, especially for unsatisfiable problems, but too much of it can slow
 it down.
 
 \optrue{peephole\_optim}{no\_peephole\_optim}
 Specifies whether Nitpick should simplify the generated Kodkod formulas using a
 peephole optimizer. These optimizations can make a significant difference.
 Unless you are tracking down a bug in Nitpick or distrust the peephole
 optimizer, you should leave this option enabled.
 
 \opdefault{max\_threads}{int}{\upshape 0}
 Specifies the maximum number of threads to use in Kodkod. If this option is set
 to 0, Kodkod will compute an appropriate value based on the number of processor
 cores available. The option is implicitly set to 1 for automatic runs.
 
 \nopagebreak
 {\small See also \textit{batch\_size} (\S\ref{optimizations}) and
 \textit{timeout} (\S\ref{timeouts}).}
 \end{enum}
 
 \subsection{Timeouts}
 \label{timeouts}
 
 \begin{enum}
 \opdefault{timeout}{float}{\upshape 30}
 Specifies the maximum number of seconds that the \textbf{nitpick} command should
 spend looking for a counterexample. Nitpick tries to honor this constraint as
 well as it can but offers no guarantees. For automatic runs, the ``Auto Time
 Limit'' option under ``Plugins > Plugin Options > Isabelle > General'' is used
 instead.
 
 \nopagebreak
 {\small See also \textit{max\_threads} (\S\ref{optimizations}).}
 
 \opdefault{tac\_timeout}{float}{\upshape 0.5}
 Specifies the maximum number of seconds that should be used by internal
 tactics---\textit{lexicographic\_order} and \textit{size\_change} when checking
 whether a (co)in\-duc\-tive predicate is well-founded or the monotonicity
 inference. Nitpick tries to honor this constraint but offers no guarantees.
 
 \nopagebreak
 {\small See also \textit{wf} (\S\ref{scope-of-search}) and
 \textit{mono} (\S\ref{scope-of-search}).}
 \end{enum}
 
 \section{Attribute Reference}
 \label{attribute-reference}
 
 Nitpick needs to consider the definitions of all constants occurring in a
 formula in order to falsify it. For constants introduced using the
 \textbf{definition} command, the definition is simply the associated
 \textit{\_def} axiom. In contrast, instead of using the internal representation
 of functions synthesized by Isabelle's \textbf{primrec}, \textbf{function}, and
 \textbf{nominal\_primrec} packages, Nitpick relies on the more natural
 equational specification entered by the user.
 
 Behind the scenes, Isabelle's built-in packages and theories rely on the
 following attributes to affect Nitpick's behavior:
 
 \begin{enum}
 \flushitem{\textit{nitpick\_unfold}}
 
 \nopagebreak
 This attribute specifies an equation that Nitpick should use to expand a
 constant. The equation should be logically equivalent to the constant's actual
 definition and should be of the form
 
 \qquad $c~{?}x_1~\ldots~{?}x_n \,=\, t$,
 
 or
 
 \qquad $c~{?}x_1~\ldots~{?}x_n \,\equiv\, t$,
 
 where ${?}x_1, \ldots, {?}x_n$ are distinct variables and $c$ does not occur in
 $t$. Each occurrence of $c$ in the problem is expanded to $\lambda x_1\,\ldots
 x_n.\; t$.
 
 \flushitem{\textit{nitpick\_simp}}
 
 \nopagebreak
 This attribute specifies the equations that constitute the specification of a
 constant. The \textbf{primrec}, \textbf{function}, and
 \textbf{nominal\_\allowbreak primrec} packages automatically attach this
 attribute to their \textit{simps} rules. The equations must be of the form
 
 \qquad $c~t_1~\ldots\ t_n \;\bigl[{=}\; u\bigr]$
 
 or
 
 \qquad $c~t_1~\ldots\ t_n \,\equiv\, u.$
 
 \flushitem{\textit{nitpick\_psimp}}
 
 \nopagebreak
 This attribute specifies the equations that constitute the partial specification
 of a constant. The \textbf{function} package automatically attaches this
 attribute to its \textit{psimps} rules. The conditional equations must be of the
 form
 
 \qquad $\lbrakk P_1;\> \ldots;\> P_m\rbrakk \,\Longrightarrow\, c\ t_1\ \ldots\ t_n \;\bigl[{=}\; u\bigr]$
 
 or
 
 \qquad $\lbrakk P_1;\> \ldots;\> P_m\rbrakk \,\Longrightarrow\, c\ t_1\ \ldots\ t_n \,\equiv\, u$.
 
 \flushitem{\textit{nitpick\_choice\_spec}}
 
 \nopagebreak
 This attribute specifies the (free-form) specification of a constant defined
 using the \textbf{specification} command.
 \end{enum}
 
 When faced with a constant, Nitpick proceeds as follows:
 
 \begin{enum}
 \item[1.] If the \textit{nitpick\_simp} set associated with the constant
 is not empty, Nitpick uses these rules as the specification of the constant.
 
 \item[2.] Otherwise, if the \textit{nitpick\_psimp} set associated with
 the constant is not empty, it uses these rules as the specification of the
 constant.
 
 \item[3.] Otherwise, if the constant was defined using the
 \allowbreak\textbf{specification} command and the
 \textit{nitpick\_choice\_spec} set associated with the constant is not empty, it
 uses these theorems as the specification of the constant.
 
 \item[4.] Otherwise, it looks up the definition of the constant. If the
 \textit{nitpick\_unfold} set associated with the constant is not empty, it uses
 the latest rule added to the set as the definition of the constant; otherwise it
 uses the actual definition axiom.
 
 \begin{enum}
 \item[1.] If the definition is of the form
 
 \qquad $c~{?}x_1~\ldots~{?}x_m \,\equiv\, \lambda y_1~\ldots~y_n.\; \textit{lfp}~(\lambda f.\; t)$
 
 or
 
 \qquad $c~{?}x_1~\ldots~{?}x_m \,\equiv\, \lambda y_1~\ldots~y_n.\; \textit{gfp}~(\lambda f.\; t).$
 
 Nitpick assumes that the definition was made using a (co)inductive package
 based on the user-specified introduction rules registered in Isabelle's internal
 \textit{Spec\_Rules} table. The tool uses the introduction rules to ascertain
 whether the definition is well-founded and the definition to generate a
 fixed-point equation or an unrolled equation.
 
 \item[2.] If the definition is compact enough, the constant is \textsl{unfolded}
 wherever it appears; otherwise, it is defined equationally, as with
 the \textit{nitpick\_simp} attribute.
 \end{enum}
 \end{enum}
 
 As an illustration, consider the inductive definition
 
 \prew
 \textbf{inductive}~\textit{odd}~\textbf{where} \\
 ``\textit{odd}~1'' $\,\mid$ \\
 ``\textit{odd}~$n\,\Longrightarrow\, \textit{odd}~(\textit{Suc}~(\textit{Suc}~n))$''
 \postw
 
 By default, Nitpick uses the \textit{lfp}-based definition in conjunction with
 the introduction rules. To override this, you can specify an alternative
 definition as follows:
 
 \prew
 \textbf{lemma} $\mathit{odd\_alt\_unfold}$ [\textit{nitpick\_unfold}]:\kern.4em ``$\textit{odd}~n \,\equiv\, n~\textrm{mod}~2 = 1$''
 \postw
 
 Nitpick then expands all occurrences of $\mathit{odd}~n$ to $n~\textrm{mod}~2
 = 1$. Alternatively, you can specify an equational specification of the constant:
 
 \prew
 \textbf{lemma} $\mathit{odd\_simp}$ [\textit{nitpick\_simp}]:\kern.4em ``$\textit{odd}~n = (n~\textrm{mod}~2 = 1)$''
 \postw
 
 Such tweaks should be done with great care, because Nitpick will assume that the
 constant is completely defined by its equational specification. For example, if
 you make ``$\textit{odd}~(2 * k + 1)$'' a \textit{nitpick\_simp} rule and neglect to provide rules to handle the $2 * k$ case, Nitpick will define
 $\textit{odd}~n$ arbitrarily for even values of $n$. The \textit{debug}
 (\S\ref{output-format}) option is extremely useful to understand what is going
 on when experimenting with \textit{nitpick\_} attributes.
 
 Because of its internal three-valued logic, Nitpick tends to lose a
 lot of precision in the presence of partially specified constants. For example,
 
 \prew
 \textbf{lemma} \textit{odd\_simp} [\textit{nitpick\_simp}]:\kern.4em ``$\textit{odd~x} = \lnot\, \textit{even}~x$''
 \postw
 
 is superior to
 
 \prew
 \textbf{lemma} \textit{odd\_psimps} [\textit{nitpick\_simp}]: \\
 ``$\textit{even~x} \,\Longrightarrow\, \textit{odd~x} = \textit{False\/}$'' \\
 ``$\lnot\, \textit{even~x} \,\Longrightarrow\, \textit{odd~x} = \textit{True\/}$''
 \postw
 
 Because Nitpick sometimes unfolds definitions but never simplification rules,
 you can ensure that a constant is defined explicitly using the
 \textit{nitpick\_simp}. For example:
 
 \prew
 \textbf{definition}~\textit{optimum} \textbf{where} [\textit{nitpick\_simp}]: \\
 ``$\textit{optimum}~t =
      (\forall u.\; \textit{consistent}~u \mathrel{\land} \textit{alphabet}~t = \textit{alphabet}~u$ \\
 \phantom{``$\textit{optimum}~t = (\forall u.\;$}${\mathrel{\land}}\; \textit{freq}~t = \textit{freq}~u \longrightarrow
          \textit{cost}~t \le \textit{cost}~u)$''
 \postw
 
 In some rare occasions, you might want to provide an inductive or coinductive
 view on top of an existing constant $c$. The easiest way to achieve this is to
 define a new constant $c'$ (co)inductively. Then prove that $c$ equals $c'$
 and let Nitpick know about it:
 
 \prew
 \textbf{lemma} \textit{c\_alt\_unfold} [\textit{nitpick\_unfold}]:\kern.4em ``$c \equiv c'$\kern2pt ''
 \postw
 
 This ensures that Nitpick will substitute $c'$ for $c$ and use the (co)inductive
 definition.
 
 \section{Standard ML Interface}
 \label{standard-ml-interface}
 
 Nitpick provides a rich Standard ML interface used mainly for internal purposes
 and debugging. Among the most interesting functions exported by Nitpick are
 those that let you invoke the tool programmatically and those that let you
 register and unregister custom term postprocessors as well as coinductive
 datatypes.
 
 \subsection{Invoking Nitpick}
 \label{invoking-nitpick}
 
 The \textit{Nitpick} structure offers the following functions for invoking your
 favorite counterexample generator:
 
 \prew
 $\textbf{val}\,~\textit{pick\_nits\_in\_term} : \\
 \hbox{}\quad\textit{Proof.state} \rightarrow \textit{params} \rightarrow \textit{mode}
 \rightarrow \textit{int} \rightarrow \textit{int} \rightarrow \textit{int}$ \\
 $\hbox{}\quad{\rightarrow}\; (\textit{term} * \textit{term})~\textit{list}
 \rightarrow \textit{term~list} \rightarrow \textit{term} \rightarrow \textit{string} * \textit{Proof.state}$ \\
 $\textbf{val}\,~\textit{pick\_nits\_in\_subgoal} : \\
 \hbox{}\quad\textit{Proof.state} \rightarrow \textit{params} \rightarrow \textit{mode} \rightarrow \textit{int} \rightarrow \textit{int} \rightarrow \textit{string} * \textit{Proof.state}$
 \postw
 
 The return value is a new proof state paired with an outcome string
 (``genuine'', ``quasi\_genuine'', ``potential'', ``none'', or ``unknown''). The
 \textit{params} type is a large record that lets you set Nitpick's options. The
 current default options can be retrieved by calling the following function
 defined in the \textit{Nitpick\_Isar} structure:
 
 \prew
 $\textbf{val}\,~\textit{default\_params} :\,
 \textit{theory} \rightarrow (\textit{string} * \textit{string})~\textit{list} \rightarrow \textit{params}$
 \postw
 
 The second argument lets you override option values before they are parsed and
 put into a \textit{params} record. Here is an example where Nitpick is invoked
 on subgoal $i$ of $n$ with no time limit:
 
 \prew
 $\textbf{val}\,~\textit{params} = \textit{Nitpick\_Isar.default\_params}~\textit{thy}~[(\textrm{``}\textrm{timeout\/}\textrm{''},\, \textrm{``}\textrm{none}\textrm{''})]$ \\
 $\textbf{val}\,~(\textit{outcome},\, \textit{state}') = {}$ \\
 $\hbox{}\quad\textit{Nitpick.pick\_nits\_in\_subgoal}~\textit{state}~\textit{params}~\textit{Nitpick.Normal}~\textit{i}~\textit{n}$
 \postw
 
 \let\antiq=\textrm
 
 \subsection{Registering Term Postprocessors}
 \label{registering-term-postprocessors}
 
 It is possible to change the output of any term that Nitpick considers a
 datatype by registering a term postprocessor. The interface for registering and
 unregistering postprocessors consists of the following pair of functions defined
 in the \textit{Nitpick\_Model} structure:
 
 \prew
 $\textbf{type}\,~\textit{term\_postprocessor}\,~{=} {}$ \\
 $\hbox{}\quad\textit{Proof.context} \rightarrow \textit{string} \rightarrow (\textit{typ} \rightarrow \textit{term~list\/}) \rightarrow \textit{typ} \rightarrow \textit{term} \rightarrow \textit{term}$ \\
 $\textbf{val}\,~\textit{register\_term\_postprocessor} : {}$ \\
 $\hbox{}\quad\textit{typ} \rightarrow \textit{term\_postprocessor} \rightarrow \textit{morphism} \rightarrow \textit{Context.generic}$ \\
 $\hbox{}\quad{\rightarrow}\; \textit{Context.generic}$ \\
 $\textbf{val}\,~\textit{unregister\_term\_postprocessor} : {}$ \\
 $\hbox{}\quad\textit{typ} \rightarrow \textit{morphism} \rightarrow \textit{Context.generic} \rightarrow \textit{Context.generic}$
 \postw
 
 \S\ref{typedefs-quotient-types-records-rationals-and-reals} and
 \texttt{src/HOL/Library/Multiset.thy} illustrate this feature in context.
 
 \subsection{Registering Coinductive Datatypes}
 \label{registering-coinductive-datatypes}
 
 Coinductive datatypes defined using the \textbf{codatatype} command that do not
 involve nested recursion through non-codatatypes are supported by Nitpick.
 If you have defined a custom coinductive datatype, you can tell Nitpick about
 it, so that it can use an efficient Kodkod axiomatization. The interface for
 registering and unregistering coinductive datatypes consists of the following
 pair of functions defined in the \textit{Nitpick\_HOL} structure:
 
 \prew
 $\textbf{val}\,~\textit{register\_codatatype\/} : {}$ \\
 $\hbox{}\quad\textit{morphism} \rightarrow \textit{typ} \rightarrow \textit{string} \rightarrow (\textit{string} \times \textit{typ})\;\textit{list} \rightarrow \textit{Context.generic} {}$ \\
 $\hbox{}\quad{\rightarrow}\; \textit{Context.generic}$ \\
 $\textbf{val}\,~\textit{unregister\_codatatype\/} : {}$ \\
 $\hbox{}\quad\textit{morphism} \rightarrow \textit{typ} \rightarrow \textit{Context.generic} \rightarrow \textit{Context.generic} {}$
 \postw
 
 The type $'a~\textit{llist}$ of lazy lists is already registered; had it
 not been, you could have told Nitpick about it by adding the following line
 to your theory file:
 
 \prew
 $\textbf{declaration}~\,\{{*}$ \\
 $\hbox{}\quad\textit{Nitpick\_HOL.register\_codatatype}~@\{\antiq{typ}~``\kern1pt'a~\textit{llist\/}\textrm{''}\}$ \\
 $\hbox{}\qquad\quad @\{\antiq{const\_name}~ \textit{llist\_case}\}$ \\
 $\hbox{}\qquad\quad (\textit{map}~\textit{dest\_Const}~[@\{\antiq{term}~\textit{LNil}\},\, @\{\antiq{term}~\textit{LCons}\}])$ \\
 ${*}\}$
 \postw
 
 The \textit{register\_codatatype} function takes a coinductive datatype, its
 case function, and the list of its constructors (in addition to the current
 morphism and generic proof context). The case function must take its arguments
 in the order that the constructors are listed. If no case function with the
 correct signature is available, simply pass the empty string.
 
 On the other hand, if your goal is to cripple Nitpick, add the following line to
 your theory file and try to check a few conjectures about lazy lists:
 
 \prew
 $\textbf{declaration}~\,\{{*}$ \\
 $\hbox{}\quad\textit{Nitpick\_HOL.unregister\_codatatype}~@\{\antiq{typ}~``\kern1pt'a~\textit{llist\/}\textrm{''}\}$ \\
 ${*}\}$
 \postw
 
 Inductive datatypes can be registered as coinductive datatypes, given
 appropriate coinductive constructors. However, doing so precludes
 the use of the inductive constructors---Nitpick will generate an error if they
 are needed.
 
 \section{Known Bugs and Limitations}
 \label{known-bugs-and-limitations}
 
 Here are the known bugs and limitations in Nitpick at the time of writing:
 
 \begin{enum}
 \item[\labelitemi] Underspecified functions defined using the \textbf{primrec},
 \textbf{function}, or \textbf{nominal\_\allowbreak primrec} packages can lead
 Nitpick to generate spurious counterexamples for theorems that refer to values
 for which the function is not defined. For example:
 
 \prew
 \textbf{primrec} \textit{prec} \textbf{where} \\
 ``$\textit{prec}~(\textit{Suc}~n) = n$'' \\[2\smallskipamount]
 \textbf{lemma} ``$\textit{prec}~0 = \textit{undefined\/}$'' \\
 \textbf{nitpick} \\[2\smallskipamount]
 \quad{\slshape Nitpick found a counterexample for \textit{card nat}~= 2:
 \nopagebreak
 \\[2\smallskipamount]
 \hbox{}\qquad Empty assignment} \nopagebreak\\[2\smallskipamount]
 \textbf{by}~(\textit{auto simp}:~\textit{prec\_def})
 \postw
 
 Such theorems are generally considered bad style because they rely on the
 internal representation of functions synthesized by Isabelle, an implementation
 detail.
 
 \item[\labelitemi] Similarly, Nitpick might find spurious counterexamples for
 theorems that rely on the use of the indefinite description operator internally
 by \textbf{specification} and \textbf{quot\_type}.
 
 \item[\labelitemi] Axioms or definitions that restrict the possible values of the
 \textit{undefined} constant or other partially specified built-in Isabelle
 constants (e.g., \textit{Abs\_} and \textit{Rep\_} constants) are in general
 ignored. Again, such nonconservative extensions are generally considered bad
 style.
 
 \item[\labelitemi] Nitpick produces spurious counterexamples when invoked after a
 \textbf{guess} command in a structured proof.
 
 \item[\labelitemi] Datatypes defined using \textbf{datatype} and
 codatatypes defined using \textbf{codatatype} that involve nested (co)recursion
 through non-(co)datatypes are not properly supported and may result in spurious
 counterexamples.
 
 \item[\labelitemi] Types that are registered with several distinct sets of
 constructors, including \textit{enat} if the \textit{Coinductive} entry of
 the \textit{Archive of Formal Proofs} is loaded, can confuse Nitpick.
 
 \item[\labelitemi] The \textit{nitpick\_xxx} attributes and the
 \textit{Nitpick\_xxx.register\_yyy} functions can cause havoc if used
 improperly.
 
 \item[\labelitemi] Although this has never been observed, arbitrary theorem
 morphisms could possibly confuse Nitpick, resulting in spurious counterexamples.
 
 \item[\labelitemi] All constants, types, free variables, and schematic variables
 whose names start with \textit{Nitpick}{.} are reserved for internal use.
 
 \item[\labelitemi] Some users report technical issues with the default SAT
 solver on Windows. Setting the \textit{sat\_solver} option
 (\S\ref{optimizations}) to \textit{MiniSat\_JNI} should solve this.
 \end{enum}
 
 \let\em=\sl
 \bibliography{manual}{}
 \bibliographystyle{abbrv}
 
 \end{document}
diff --git a/src/Doc/Prog_Prove/LaTeXsugar.thy b/src/Doc/Prog_Prove/LaTeXsugar.thy
--- a/src/Doc/Prog_Prove/LaTeXsugar.thy
+++ b/src/Doc/Prog_Prove/LaTeXsugar.thy
@@ -1,56 +1,57 @@
 (*  Title:      HOL/Library/LaTeXsugar.thy
     Author:     Gerwin Klein, Tobias Nipkow, Norbert Schirmer
     Copyright   2005 NICTA and TUM
 *)
 
 (*<*)
 theory LaTeXsugar
 imports Main
 begin
 
 (* DUMMY *)
 consts DUMMY :: 'a ("\<^latex>\<open>\\_\<close>")
 
 (* THEOREMS *)
 notation (Rule output)
   Pure.imp  ("\<^latex>\<open>\\mbox{}\\inferrule{\\mbox{\<close>_\<^latex>\<open>}}\<close>\<^latex>\<open>{\\mbox{\<close>_\<^latex>\<open>}}\<close>")
 
 syntax (Rule output)
   "_bigimpl" :: "asms \<Rightarrow> prop \<Rightarrow> prop"
   ("\<^latex>\<open>\\mbox{}\\inferrule{\<close>_\<^latex>\<open>}\<close>\<^latex>\<open>{\\mbox{\<close>_\<^latex>\<open>}}\<close>")
 
   "_asms" :: "prop \<Rightarrow> asms \<Rightarrow> asms" 
   ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\\\\\<close>/ _")
 
   "_asm" :: "prop \<Rightarrow> asms" ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\<close>")
 
 notation (Axiom output)
   "Trueprop"  ("\<^latex>\<open>\\mbox{}\\inferrule{\\mbox{}}{\\mbox{\<close>_\<^latex>\<open>}}\<close>")
 
 notation (IfThen output)
   Pure.imp  ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _/ \<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
 syntax (IfThen output)
   "_bigimpl" :: "asms \<Rightarrow> prop \<Rightarrow> prop"
   ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _ /\<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
   "_asms" :: "prop \<Rightarrow> asms \<Rightarrow> asms" ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\<close> /\<^latex>\<open>{\\normalsize \\,\<close>and\<^latex>\<open>\\,}\<close>/ _")
   "_asm" :: "prop \<Rightarrow> asms" ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\<close>")
 
 notation (IfThenNoBox output)
   Pure.imp  ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _/ \<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
 syntax (IfThenNoBox output)
   "_bigimpl" :: "asms \<Rightarrow> prop \<Rightarrow> prop"
   ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _ /\<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
   "_asms" :: "prop \<Rightarrow> asms \<Rightarrow> asms" ("_ /\<^latex>\<open>{\\normalsize \\,\<close>and\<^latex>\<open>\\,}\<close>/ _")
   "_asm" :: "prop \<Rightarrow> asms" ("_")
 
 setup \<open>
-  Thy_Output.antiquotation_pretty_source \<^binding>\<open>const_typ\<close> (Scan.lift Args.embedded_inner_syntax)
+  Document_Output.antiquotation_pretty_source \<^binding>\<open>const_typ\<close>
+    (Scan.lift Args.embedded_inner_syntax)
     (fn ctxt => fn c =>
       let val tc = Proof_Context.read_const {proper = false, strict = false} ctxt c in
-        Pretty.block [Thy_Output.pretty_term ctxt tc, Pretty.str " ::",
+        Pretty.block [Document_Output.pretty_term ctxt tc, Pretty.str " ::",
           Pretty.brk 1, Syntax.pretty_typ ctxt (fastype_of tc)]
       end)
 \<close>
 
 end
 (*>*)
diff --git a/src/Doc/Prog_Prove/document/build b/src/Doc/Prog_Prove/document/build
deleted file mode 100755
--- a/src/Doc/Prog_Prove/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo HOL
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Prog_Prove/document/root.tex b/src/Doc/Prog_Prove/document/root.tex
--- a/src/Doc/Prog_Prove/document/root.tex
+++ b/src/Doc/Prog_Prove/document/root.tex
@@ -1,52 +1,52 @@
 \documentclass[envcountsame,envcountchap]{svmono}
 
 \input{prelude}
 
 \newif\ifsem
 
 \begin{document}
 
 \title{Programming and Proving in Isabelle/HOL}
-\subtitle{\includegraphics[scale=.7]{isabelle_hol}}
+\subtitle{\includegraphics[scale=.7]{isabelle_logo}}
 \author{Tobias Nipkow}
 \maketitle
 
 \frontmatter%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 \setcounter{tocdepth}{1}
 \tableofcontents
 
 
 \mainmatter%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 %\part{Isabelle}
 
 \chapter{Introduction}
 \input{intro-isabelle.tex}
 
 \chapter{Programming and Proving}
 \label{sec:FP}
 \input{Basics.tex}
 \input{Bool_nat_list}
 \input{Types_and_funs}
 
 %\chapter{Case Study: IMP Expressions}
 %\label{sec:CaseStudyExp}
 %\input{../generated/Expressions}
 
 \chapter{Logic and Proof Beyond Equality}
 \label{ch:Logic}
 \input{Logic}
 
 \chapter{Isar: A Language for Structured Proofs}
 \label{ch:Isar}
 \input{Isar}
 
 \backmatter%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 \bibliographystyle{plain}
 \bibliography{root}
 
 %\printindex
 
 \end{document}
diff --git a/src/Doc/ROOT b/src/Doc/ROOT
--- a/src/Doc/ROOT
+++ b/src/Doc/ROOT
@@ -1,514 +1,490 @@
 chapter Doc
 
 session Classes (doc) in "Classes" = HOL +
-  options [document_variants = "classes", quick_and_dirty]
+  options [document_logo = "Isar", document_bibliography,
+    document_variants = "classes", quick_and_dirty]
   theories [document = false] Setup
   theories Classes
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
 
 session Codegen (doc) in "Codegen" = HOL +
-  options [document_variants = "codegen", print_mode = "no_brackets,iff"]
+  options [document_logo = "Isar", document_bibliography, document_variants = "codegen",
+    print_mode = "no_brackets,iff"]
   sessions
     "HOL-Library"
   theories [document = false]
     Setup
   theories
     Introduction
     Foundations
     Refinement
     Inductive_Predicate
     Evaluation
     Computations
     Adaptation
     Further
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
 
 session Corec (doc) in "Corec" = Datatypes +
-  options [document_variants = "corec"]
+  options [document_bibliography, document_variants = "corec"]
   theories
     Corec
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
 
 session Datatypes (doc) in "Datatypes" = HOL +
-  options [document_variants = "datatypes"]
+  options [document_bibliography, document_variants = "datatypes"]
   sessions
     "HOL-Library"
   theories [document = false]
     Setup
   theories
     Datatypes
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
 
 session Eisbach (doc) in "Eisbach" = HOL +
-  options [document_variants = "eisbach", quick_and_dirty,
-    print_mode = "no_brackets,iff", show_question_marks = false]
+  options [document_logo = "Eisbach", document_bibliography, document_variants = "eisbach",
+    quick_and_dirty, print_mode = "no_brackets,iff", show_question_marks = false]
   sessions
     "HOL-Eisbach"
   theories [document = false]
     Base
   theories
     Preface
     Manual
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "ttbox.sty"
     "underscore.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
 
 session Functions (doc) in "Functions" = HOL +
-  options [document_variants = "functions", skip_proofs = false, quick_and_dirty]
+  options [document_bibliography, document_variants = "functions",
+    skip_proofs = false, quick_and_dirty]
   theories Functions
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "manual.bib"
   document_files
-    "build"
     "conclusion.tex"
     "intro.tex"
     "root.tex"
     "style.sty"
 
 session How_to_Prove_it (no_doc) in "How_to_Prove_it" = HOL +
   options [document_variants = "how_to_prove_it", show_question_marks = false]
   theories
     How_to_Prove_it
   document_files
     "root.tex"
     "root.bib"
     "prelude.tex"
 
 session Intro (doc) in "Intro" = Pure +
-  options [document_variants = "intro"]
+  options [document_logo = "_", document_bibliography, document_build = "build",
+    document_variants = "intro"]
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "ttbox.sty"
     "manual.bib"
   document_files
     "advanced.tex"
     "build"
     "foundations.tex"
     "getting.tex"
     "root.tex"
 
 session Implementation (doc) in "Implementation" = HOL +
-  options [document_variants = "implementation", quick_and_dirty]
+  options [document_logo = "Isar", document_bibliography,
+    document_variants = "implementation", quick_and_dirty]
   theories
     Eq
     Integration
     Isar
     Local_Theory
     "ML"
     Prelim
     Proof
     Syntax
     Tactic
   theories [parallel_proofs = 0]
     Logic
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "ttbox.sty"
     "underscore.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
 
 session Isar_Ref (doc) in "Isar_Ref" = HOL +
-  options [document_variants = "isar-ref", quick_and_dirty, thy_output_source]
+  options [document_logo = "Isar", document_bibliography, document_variants = "isar-ref",
+    quick_and_dirty, thy_output_source]
   sessions
     "HOL-Library"
   theories
     Preface
     Synopsis
     Framework
     First_Order_Logic
     Outer_Syntax
     Document_Preparation
     Spec
     Proof
     Proof_Script
     Inner_Syntax
     Generic
     HOL_Specific
     Quick_Reference
     Symbols
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "ttbox.sty"
     "underscore.sty"
     "manual.bib"
   document_files
-    "build"
     "isar-vm.pdf"
     "isar-vm.svg"
     "root.tex"
-    "showsymbols"
     "style.sty"
 
 session JEdit (doc) in "JEdit" = HOL +
-  options [document_variants = "jedit", thy_output_source]
+  options [document_logo = "jEdit", document_bibliography, document_variants = "jedit",
+    thy_output_source]
   theories
     JEdit
   document_files (in "..")
     "extra.sty"
     "iman.sty"
     "isar.sty"
     "manual.bib"
     "pdfsetup.sty"
-    "prepare_document"
     "ttbox.sty"
     "underscore.sty"
   document_files (in "../Isar_Ref/document")
     "style.sty"
   document_files
     "auto-tools.png"
     "bibtex-mode.png"
-    "build"
     "cite-completion.png"
     "isabelle-jedit.png"
     "markdown-document.png"
     "ml-debugger.png"
     "output-and-state.png"
     "output-including-state.png"
     "output.png"
     "popup1.png"
     "popup2.png"
     "query.png"
     "root.tex"
     "scope1.png"
     "scope2.png"
     "sidekick-document.png"
     "sidekick.png"
     "sledgehammer.png"
     "theories.png"
 
 session Sugar (doc) in "Sugar" = HOL +
-  options [document_variants = "sugar"]
+  options [document_bibliography, document_variants = "sugar"]
   sessions
     "HOL-Library"
   theories Sugar
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
   document_files
-    "build"
     "root.bib"
     "root.tex"
 
 session Locales (doc) in "Locales" = HOL +
-  options [document_variants = "locales", thy_output_margin = 65, skip_proofs = false]
+  options [document_bibliography, document_variants = "locales",
+    thy_output_margin = 65, skip_proofs = false]
   theories
     Examples1
     Examples2
     Examples3
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
   document_files
-    "build"
     "root.bib"
     "root.tex"
 
 session Logics (doc) in "Logics" = Pure +
-  options [document_variants = "logics"]
+  options [document_logo = "_", document_bibliography, document_build = "build",
+    document_variants = "logics"]
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "ttbox.sty"
     "manual.bib"
+  document_files (in "../Intro/document")
+    "build"
   document_files
     "CTT.tex"
     "HOL.tex"
     "LK.tex"
     "Sequents.tex"
-    "build"
     "preface.tex"
     "root.tex"
     "syntax.tex"
 
 session Logics_ZF (doc) in "Logics_ZF" = ZF +
-  options [document_variants = "logics-ZF", print_mode = "brackets",
-    thy_output_source]
+  options [document_logo = "ZF", document_bibliography, document_build = "build",
+    document_variants = "logics-ZF", print_mode = "brackets", thy_output_source]
   sessions
     FOL
   theories
     IFOL_examples
     FOL_examples
     ZF_examples
     If
     ZF_Isar
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "isar.sty"
     "ttbox.sty"
     "manual.bib"
+  document_files (in "../Intro/document")
+    "build"
   document_files (in "../Logics/document")
     "syntax.tex"
   document_files
     "FOL.tex"
     "ZF.tex"
-    "build"
     "logics.sty"
     "root.tex"
 
 session Main (doc) in "Main" = HOL +
   options [document_variants = "main"]
   theories Main_Doc
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
   document_files
-    "build"
     "root.tex"
 
 session Nitpick (doc) in "Nitpick" = Pure +
-  options [document_variants = "nitpick"]
+  options [document_logo = "Nitpick", document_bibliography, document_variants = "nitpick"]
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
 
 session Prog_Prove (doc) in "Prog_Prove" = HOL +
-  options [document_variants = "prog-prove", show_question_marks = false]
+  options [document_logo = "HOL", document_bibliography, document_variants = "prog-prove",
+    show_question_marks = false]
   theories
     Basics
     Bool_nat_list
     MyList
     Types_and_funs
     Logic
     Isar
   document_files (in ".")
     "MyList.thy"
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
   document_files
     "bang.pdf"
-    "build"
     "intro-isabelle.tex"
     "prelude.tex"
     "root.bib"
     "root.tex"
     "svmono.cls"
 
 session Sledgehammer (doc) in "Sledgehammer" = Pure +
-  options [document_variants = "sledgehammer"]
+  options [document_logo = "S/H", document_bibliography, document_variants = "sledgehammer"]
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
 
 session System (doc) in "System" = Pure +
-  options [document_variants = "system", thy_output_source]
+  options [document_logo = "_", document_bibliography, document_variants = "system",
+    thy_output_source]
   sessions
     "HOL-Library"
   theories
     Environment
     Sessions
     Presentation
     Server
     Scala
     Phabricator
     Misc
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "ttbox.sty"
     "underscore.sty"
     "manual.bib"
   document_files (in "../Isar_Ref/document")
     "style.sty"
   document_files
-    "build"
     "root.tex"
 
 session Tutorial (doc) in "Tutorial" = HOL +
-  options [document_variants = "tutorial", print_mode = "brackets", skip_proofs = false]
+  options [document_logo = "HOL", document_bibliography, document_build = "build",
+    document_variants = "tutorial", print_mode = "brackets", skip_proofs = false]
   directories "Advanced" "CTL" "CodeGen" "Datatype" "Documents" "Fun" "Ifexpr"
     "Inductive" "Misc" "Protocol" "Rules" "Sets" "ToyList" "Trie" "Types"
   theories [document = false]
     Base
   theories [threads = 1]
     "ToyList/ToyList_Test"
   theories [thy_output_indent = 5]
     "ToyList/ToyList"
     "Ifexpr/Ifexpr"
     "CodeGen/CodeGen"
     "Trie/Trie"
     "Datatype/ABexpr"
     "Datatype/unfoldnested"
     "Datatype/Nested"
     "Datatype/Fundata"
     "Fun/fun0"
     "Advanced/simp2"
     "CTL/PDL"
     "CTL/CTL"
     "CTL/CTLind"
     "Inductive/Even"
     "Inductive/Mutual"
     "Inductive/Star"
     "Inductive/AB"
     "Inductive/Advanced"
     "Misc/Tree"
     "Misc/Tree2"
     "Misc/Plus"
     "Misc/case_exprs"
     "Misc/fakenat"
     "Misc/natsum"
     "Misc/pairs2"
     "Misc/Option2"
     "Misc/types"
     "Misc/prime_def"
     "Misc/simp"
     "Misc/Itrev"
     "Misc/AdvancedInd"
     "Misc/appendix"
   theories
     "Protocol/NS_Public"
     "Documents/Documents"
   theories [thy_output_margin = 64, thy_output_indent = 0]
     "Types/Numbers"
     "Types/Pairs"
     "Types/Records"
     "Types/Typedefs"
     "Types/Overloading"
     "Types/Axioms"
     "Rules/Basic"
     "Rules/Blast"
     "Rules/Force"
   theories [thy_output_margin = 64, thy_output_indent = 5]
     "Rules/TPrimes"
     "Rules/Forward"
     "Rules/Tacticals"
     "Rules/find2"
     "Sets/Examples"
     "Sets/Functions"
     "Sets/Relations"
     "Sets/Recur"
   document_files (in "ToyList")
     "ToyList1.txt"
     "ToyList2.txt"
   document_files (in "..")
     "pdfsetup.sty"
     "ttbox.sty"
     "manual.bib"
   document_files
     "advanced0.tex"
     "appendix0.tex"
     "basics.tex"
     "build"
     "cl2emono-modified.sty"
     "ctl0.tex"
     "documents0.tex"
     "fp.tex"
     "inductive0.tex"
     "isa-index"
     "Isa-logics.pdf"
     "numerics.tex"
     "pghead.pdf"
     "preface.tex"
     "protocol.tex"
     "root.tex"
     "rules.tex"
     "sets.tex"
     "tutorial.sty"
     "typedef.pdf"
     "types0.tex"
 
 session Typeclass_Hierarchy (doc) in "Typeclass_Hierarchy" = HOL +
-  options [document_variants = "typeclass_hierarchy"]
+  options [document_logo = "Isar", document_bibliography, document_variants = "typeclass_hierarchy"]
   sessions
     "HOL-Library"
   theories [document = false]
     Setup
   theories
     Typeclass_Hierarchy
   document_files (in "..")
-    "prepare_document"
     "pdfsetup.sty"
     "iman.sty"
     "extra.sty"
     "isar.sty"
     "manual.bib"
   document_files
-    "build"
     "root.tex"
     "style.sty"
diff --git a/src/Doc/Sledgehammer/document/build b/src/Doc/Sledgehammer/document/build
deleted file mode 100755
--- a/src/Doc/Sledgehammer/document/build
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo -o isabelle_sledgehammer.pdf "S/H"
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
diff --git a/src/Doc/Sledgehammer/document/root.tex b/src/Doc/Sledgehammer/document/root.tex
--- a/src/Doc/Sledgehammer/document/root.tex
+++ b/src/Doc/Sledgehammer/document/root.tex
@@ -1,1322 +1,1322 @@
 \documentclass[a4paper,12pt]{article}
 \usepackage[T1]{fontenc}
 \usepackage{amsmath}
 \usepackage{amssymb}
 \usepackage{color}
 \usepackage{footmisc}
 \usepackage{graphicx}
 %\usepackage{mathpazo}
 \usepackage{multicol}
 \usepackage{stmaryrd}
 %\usepackage[scaled=.85]{beramono}
 \usepackage{isabelle,iman,pdfsetup}
 
 \newcommand\download{\url{https://isabelle.in.tum.de/components/}}
 
 \let\oldS=\S
 \def\S{\oldS\,}
 
 \def\qty#1{\ensuremath{\left<\mathit{#1\/}\right>}}
 \def\qtybf#1{$\mathbf{\left<\textbf{\textit{#1\/}}\right>}$}
 
 \newcommand\const[1]{\textsf{#1}}
 
 %\oddsidemargin=4.6mm
 %\evensidemargin=4.6mm
 %\textwidth=150mm
 %\topmargin=4.6mm
 %\headheight=0mm
 %\headsep=0mm
 %\textheight=234mm
 
 \def\Colon{\mathord{:\mkern-1.5mu:}}
 %\def\lbrakk{\mathopen{\lbrack\mkern-3.25mu\lbrack}}
 %\def\rbrakk{\mathclose{\rbrack\mkern-3.255mu\rbrack}}
 \def\lparr{\mathopen{(\mkern-4mu\mid}}
 \def\rparr{\mathclose{\mid\mkern-4mu)}}
 
 \def\unk{{?}}
 \def\undef{(\lambda x.\; \unk)}
 %\def\unr{\textit{others}}
 \def\unr{\ldots}
 \def\Abs#1{\hbox{\rm{\guillemetleft}}{\,#1\,}\hbox{\rm{\guillemetright}}}
 \def\Q{{\smash{\lower.2ex\hbox{$\scriptstyle?$}}}}
 
 \urlstyle{tt}
 
 \renewcommand\_{\hbox{\textunderscore\kern-.05ex}}
 
 \hyphenation{Isa-belle super-posi-tion zipper-posi-tion}
 
 \begin{document}
 
 %%% TYPESETTING
 %\renewcommand\labelitemi{$\bullet$}
 \renewcommand\labelitemi{\raise.065ex\hbox{\small\textbullet}}
 
-\title{\includegraphics[scale=0.5]{isabelle_sledgehammer} \\[4ex]
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex]
 Hammering Away \\[\smallskipamount]
 \Large A User's Guide to Sledgehammer for Isabelle/HOL}
 \author{\hbox{} \\
 Jasmin Blanchette \\
 {\normalsize Institut f\"ur Informatik, Technische Universit\"at M\"unchen} \\[4\smallskipamount]
 {\normalsize with contributions from} \\[4\smallskipamount]
 Martin Desharnais \\
 {\normalsize Forschungsinstitut CODE, Universit\"at der Bundeswehr M\"unchen}  \\[4\smallskipamount]
 Lawrence C. Paulson \\
 {\normalsize Computer Laboratory, University of Cambridge} \\
 \hbox{}}
 
 \maketitle
 
 \tableofcontents
 
 \setlength{\parskip}{.7em plus .2em minus .1em}
 \setlength{\parindent}{0pt}
 \setlength{\abovedisplayskip}{\parskip}
 \setlength{\abovedisplayshortskip}{.9\parskip}
 \setlength{\belowdisplayskip}{\parskip}
 \setlength{\belowdisplayshortskip}{.9\parskip}
 
 % general-purpose enum environment with correct spacing
 \newenvironment{enum}%
     {\begin{list}{}{%
         \setlength{\topsep}{.1\parskip}%
         \setlength{\partopsep}{.1\parskip}%
         \setlength{\itemsep}{\parskip}%
         \advance\itemsep by-\parsep}}
     {\end{list}}
 
 \def\pre{\begingroup\vskip0pt plus1ex\advance\leftskip by\leftmargin
 \advance\rightskip by\leftmargin}
 \def\post{\vskip0pt plus1ex\endgroup}
 
 \def\prew{\pre\advance\rightskip by-\leftmargin}
 \def\postw{\post}
 
 
 \section{Introduction}
 \label{introduction}
 
 Sledgehammer is a tool that applies automatic theorem provers (ATPs)
 and satisfiability-modulo-theories (SMT) solvers on the current goal.%
 \footnote{The distinction between ATPs and SMT solvers is convenient but mostly
 historical.}
 %
 The supported ATPs include agsyHOL \cite{agsyHOL}, Alt-Ergo \cite{alt-ergo}, E
 \cite{schulz-2019}, iProver \cite{korovin-2009}, LEO-II \cite{leo2}, Leo-III
 \cite{leo3}, Satallax \cite{satallax}, SPASS \cite{weidenbach-et-al-2009},
 Vampire \cite{riazanov-voronkov-2002}, Waldmeister \cite{waldmeister}, and
 Zipperposition \cite{cruanes-2014}. The ATPs are run either locally or remotely
 via the System\-On\-TPTP web service \cite{sutcliffe-2000}. The supported SMT
 solvers are CVC3 \cite{cvc3}, CVC4 \cite{cvc4}, veriT \cite{bouton-et-al-2009},
 and Z3 \cite{de-moura-2008}. These are always run locally.
 
 The problem passed to the external provers (or solvers) consists of your current
 goal together with a heuristic selection of hundreds of facts (theorems) from the
 current theory context, filtered by relevance.
 
 The result of a successful proof search is some source text that typically
 reconstructs the proof within Isabelle. For ATPs, the reconstructed proof
 typically relies on the general-purpose \textit{metis} proof method, which
 integrates the Metis ATP in Isabelle/HOL with explicit inferences going through
 the kernel. Thus its results are correct by construction.
 
 For Isabelle/jEdit users, Sledgehammer provides an automatic mode that can be
 enabled via the ``Auto Sledgehammer'' option under ``Plugins > Plugin Options >
 Isabelle > General.'' In this mode, a reduced version of Sledgehammer is run on
 every newly entered theorem for a few seconds.
 
 \newbox\boxA
 \setbox\boxA=\hbox{\texttt{NOSPAM}}
 
 \newcommand\authoremail{\texttt{jasmin.blan{\color{white}NOSPAM}\kern-\wd\boxA{}chette@\allowbreak
 google.\allowbreak com}}
 
 To run Sledgehammer, you must make sure that the theory \textit{Sledgehammer} is
 imported---this is rarely a problem in practice since it is part of
 \textit{Main}. Examples of Sledgehammer use can be found in the
 \texttt{src/HOL/Metis\_Examples} directory.  Comments and bug reports
 concerning Sledgehammer or this manual should be directed to the author at
 \authoremail.
 
 
 \section{Installation}
 \label{installation}
 
 Sledgehammer is part of Isabelle, so you do not need to install it. However, it
 relies on third-party automatic provers (ATPs and SMT solvers).
 
 Among the ATPs, agsyHOL, Alt-Ergo, E, LEO-II, Leo-III, Satallax, SPASS,
 Vampire, and Zipperposition can be run locally; in addition, agsyHOL,
 Alt-Ergo, E, iProver, LEO-II, Leo-III, Satallax, Vampire, Waldmeister,
 and Zipperposition are available remotely via System\-On\-TPTP
 \cite{sutcliffe-2000}. The SMT solvers CVC3, CVC4, veriT, and Z3 can be run
 locally.
 
 There are three main ways to install automatic provers on your machine:
 
 \begin{sloppy}
 \begin{enum}
 \item[\labelitemi] If you installed an official Isabelle package, it should
 already include properly set up executables for CVC4, E, SPASS, Vampire, veriT,
 and Z3, ready to use. To use Vampire, you must confirm that you are a
 noncommercial user, as indicated by the message that is displayed when
 Sledgehammer is invoked the first time.
 
 \item[\labelitemi] Alternatively, you can download the Isabelle-aware CVC3,
 CVC4, E, SPASS, Vampire, veriT, and Z3 binary packages from \download. Extract
 the archives, then add a line to your \texttt{\$ISABELLE\_HOME\_USER\slash
 etc\slash components}%
 \footnote{The variable \texttt{\$ISABELLE\_HOME\_USER} is set by Isabelle at
 startup. Its value can be retrieved by executing \texttt{isabelle}
 \texttt{getenv} \texttt{ISABELLE\_HOME\_USER} on the command line.}
 file with the absolute path to the prover. For example, if the
 \texttt{components} file does not exist yet and you extracted SPASS to
 \texttt{/usr/local/spass-3.8ds}, create it with the single line
 
 \prew
 \texttt{/usr/local/spass-3.8ds}
 \postw
 
 in it.
 
 \item[\labelitemi] If you prefer to build agsyHOL, Alt-Ergo, E, LEO-II,
 Leo-III, or Satallax manually, set the environment variable
 \texttt{AGSYHOL\_HOME}, \texttt{E\_HOME}, \texttt{LEO2\_HOME},
 \texttt{LEO3\_HOME}, or \texttt{SATALLAX\_HOME}
 to the directory that contains the \texttt{agsyHOL},
 \texttt{eprover} (and/or \texttt{eproof} or \texttt{eproof\_ram}),
 \texttt{leo}, \texttt{leo3}, or \texttt{satallax} executable;
 for Alt-Ergo, set the environment variable \texttt{WHY3\_HOME} to the
 directory that contains the \texttt{why3} executable. Sledgehammer has been
 tested with agsyHOL 1.0, Alt-Ergo 0.95.2, E 1.6 to 2.0, LEO-II 1.3.4, Leo-III
 1.1, and Satallax 2.7. Since the ATPs' output formats are neither documented
 nor stable, other versions might not work well with Sledgehammer. Ideally, you
 should also set \texttt{E\_VERSION}, \texttt{LEO2\_VERSION},
 \texttt{LEO3\_VERSION}, or \texttt{SATALLAX\_VERSION} to the prover's version
 number (e.g., ``2.7''); this might help Sledgehammer invoke the prover
 optimally.
 
 Similarly, if you want to install CVC3, CVC4, veriT, or Z3, set the environment
 variable \texttt{CVC3\_\allowbreak SOLVER}, \texttt{CVC4\_\allowbreak SOLVER},
 \texttt{VERIT\_\allowbreak SOLVER}, or \texttt{Z3\_SOLVER} to the complete path
 of the executable, \emph{including the file name}. Sledgehammer has been tested
 with CVC3 2.2 and 2.4.1, CVC4 1.5-prerelease, veriT 2020.10-rmx, and Z3 4.3.2.
 Since Z3's output format is somewhat unstable, other versions of the solver
 might not work well with Sledgehammer. Ideally, also set
 \texttt{CVC3\_VERSION}, \texttt{CVC4\_VERSION}, \texttt{VERIT\_VERSION}, or
 \texttt{Z3\_VERSION} to the solver's version number (e.g., ``4.4.0'').
 \end{enum}
 \end{sloppy}
 
 To check whether the provers are successfully installed, try out the example
 in \S\ref{first-steps}. If the remote versions of any of these provers is used
 (identified by the prefix ``\textit{remote\_\/}''), or if the local versions
 fail to solve the easy goal presented there, something must be wrong with the
 installation.
 
 
 \section{First Steps}
 \label{first-steps}
 
 To illustrate Sledgehammer in context, let us start a theory file and
 attempt to prove a simple lemma:
 
 \prew
 \textbf{theory}~\textit{Scratch} \\
 \textbf{imports}~\textit{Main} \\
 \textbf{begin} \\[2\smallskipamount]
 %
 \textbf{lemma} ``$[a] = [b] \,\Longrightarrow\, a = b$'' \\
 \textbf{sledgehammer}
 \postw
 
 Instead of issuing the \textbf{sledgehammer} command, you can also use the
 Sledgehammer panel in Isabelle/jEdit. Sledgehammer might produce something like
 the following output after a few seconds:
 
 \prew
 \slshape
 Proof found\ldots \\
 ``\textit{e\/}'': Try this: \textbf{by} \textit{simp} (0.3 ms) \\
 %
 ``\textit{cvc4\/}'': Try this: \textbf{by} \textit{simp} (0.4 ms) \\
 %
 ``\textit{z3\/}'': Try this: \textbf{by} \textit{simp} (0.5 ms) \\
 %
 ``\textit{spass\/}'': Try this: \textbf{by} \textit{simp} (0.3 ms)
 %
 \postw
 
 Sledgehammer ran CVC4, E, SPASS, and Z3 in parallel. Depending on which
 provers are installed and how many processor cores are available, some of the
 provers might be missing or present with a \textit{remote\_} prefix.
 
 For each successful prover, Sledgehammer gives a one-line Isabelle proof. Rough
 timings are shown in parentheses, indicating how fast the call is. You can
 click the proof to insert it into the theory text.
 
 In addition, you can ask Sledgehammer for an Isar text proof by enabling the
 \textit{isar\_proofs} option (\S\ref{output-format}):
 
 \prew
 \textbf{sledgehammer} [\textit{isar\_proofs}]
 \postw
 
 When Isar proof construction is successful, it can yield proofs that are more
 readable and also faster than \textit{metis} or \textit{smt} one-line
 proofs. This feature is experimental.
 
 
 \section{Hints}
 \label{hints}
 
 This section presents a few hints that should help you get the most out of
 Sledgehammer. Frequently asked questions are answered in
 \S\ref{frequently-asked-questions}.
 
 %\newcommand\point[1]{\medskip\par{\sl\bfseries#1}\par\nopagebreak}
 \newcommand\point[1]{\subsection{\emph{#1}}}
 
 
 \point{Presimplify the goal}
 
 For best results, first simplify your problem by calling \textit{auto} or at
 least \textit{safe} followed by \textit{simp\_all}. The SMT solvers provide
 arithmetic decision procedures, but the ATPs typically do not (or if they do,
 Sledgehammer does not use it yet). Apart from Waldmeister, they are not
 particularly good at heavy rewriting, but because they regard equations as
 undirected, they often prove theorems that require the reverse orientation of a
 \textit{simp} rule. Higher-order problems can be tackled, but the success rate
 is better for first-order problems. Hence, you may get better results if you
 first simplify the problem to remove higher-order features.
 
 
 \point{Familiarize yourself with the main options}
 
 Sledgehammer's options are fully documented in \S\ref{command-syntax}. Many of
 the options are very specialized, but serious users of the tool should at least
 familiarize themselves with the following options:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{provers}} (\S\ref{mode-of-operation}) specifies
 the automatic provers (ATPs and SMT solvers) that should be run whenever
 Sledgehammer is invoked (e.g., ``\textit{provers}~= \textit{cvc4 e spass
 vampire\/}''). For convenience, you can omit ``\textit{provers}~=''
 and simply write the prover names as a space-separated list (e.g., ``\textit{cvc4 e
 spass vampire\/}'').
 
 \item[\labelitemi] \textbf{\textit{max\_facts}} (\S\ref{relevance-filter})
 specifies the maximum number of facts that should be passed to the provers. By
 default, the value is prover-dependent but varies between about 50 and 1000. If
 the provers time out, you can try lowering this value to, say, 25 or 50 and see
 if that helps.
 
 \item[\labelitemi] \textbf{\textit{isar\_proofs}} (\S\ref{output-format}) specifies
 that Isar proofs should be generated, in addition to one-line \textit{metis} or
 \textit{smt} proofs. The length of the Isar proofs can be controlled by setting
 \textit{compress} (\S\ref{output-format}).
 
 \item[\labelitemi] \textbf{\textit{timeout}} (\S\ref{timeouts}) controls the
 provers' time limit. It is set to 30 seconds by default.
 \end{enum}
 
 Options can be set globally using \textbf{sledgehammer\_params}
 (\S\ref{command-syntax}). The command also prints the list of all available
 options with their current value. Fact selection can be influenced by specifying
 ``$(\textit{add}{:}~\textit{my\_facts})$'' after the \textbf{sledgehammer} call
 to ensure that certain facts are included, or simply ``$(\textit{my\_facts})$''
 to force Sledgehammer to run only with $\textit{my\_facts}$ (and any facts
 chained into the goal).
 
 
 \section{Frequently Asked Questions}
 \label{frequently-asked-questions}
 
 This sections answers frequently (and infrequently) asked questions about
 Sledgehammer. It is a good idea to skim over it now even if you do not have any
 questions at this stage. And if you have any further questions not listed here,
 send them to the author at \authoremail.
 
 
 \point{Which facts are passed to the automatic provers?}
 
 Sledgehammer heuristically selects a few hundred relevant lemmas from the
 currently loaded libraries. The component that performs this selection is
 called \emph{relevance filter} (\S\ref{relevance-filter}).
 
 \begin{enum}
 \item[\labelitemi]
 The traditional relevance filter, \emph{MePo}
 (\underline{Me}ng--\underline{Pau}lson), assigns a score to every available
 fact (lemma, theorem, definition, or axiom) based upon how many constants that
 fact shares with the conjecture. This process iterates to include facts
 relevant to those just accepted. The constants are weighted to give unusual
 ones greater significance. MePo copes best when the conjecture contains some
 unusual constants; if all the constants are common, it is unable to
 discriminate among the hundreds of facts that are picked up. The filter is also
 memoryless: It has no information about how many times a particular fact has
 been used in a proof, and it cannot learn.
 
 \item[\labelitemi]
 An alternative to MePo is \emph{MaSh} (\underline{Ma}chine Learner for
 \underline{S}ledge\underline{h}ammer). It applies machine learning to the
 problem of finding relevant facts.
 
 \item[\labelitemi] The \emph{MeSh} filter combines MePo and MaSh. This is
 the default.
 \end{enum}
 
 The number of facts included in a problem varies from prover to prover, since
 some provers get overwhelmed more easily than others. You can show the number of
 facts given using the \textit{verbose} option (\S\ref{output-format}) and the
 actual facts using \textit{debug} (\S\ref{output-format}).
 
 Sledgehammer is good at finding short proofs combining a handful of existing
 lemmas. If you are looking for longer proofs, you must typically restrict the
 number of facts, by setting the \textit{max\_facts} option
 (\S\ref{relevance-filter}) to, say, 25 or 50.
 
 You can also influence which facts are actually selected in a number of ways. If
 you simply want to ensure that a fact is included, you can specify it using the
 ``$(\textit{add}{:}~\textit{my\_facts})$'' syntax. For example:
 %
 \prew
 \textbf{sledgehammer} (\textit{add}: \textit{hd.simps} \textit{tl.simps})
 \postw
 %
 The specified facts then replace the least relevant facts that would otherwise be
 included; the other selected facts remain the same.
 If you want to direct the selection in a particular direction, you can specify
 the facts via \textbf{using}:
 %
 \prew
 \textbf{using} \textit{hd.simps} \textit{tl.simps} \\
 \textbf{sledgehammer}
 \postw
 %
 The facts are then more likely to be selected than otherwise, and if they are
 selected at iteration $j$ they also influence which facts are selected at
 iterations $j + 1$, $j + 2$, etc. To give them even more weight, try
 %
 \prew
 \textbf{using} \textit{hd.simps} \textit{tl.simps} \\
 \textbf{apply}~\textbf{--} \\
 \textbf{sledgehammer}
 \postw
 
 
 \point{Why does Metis fail to reconstruct the proof?}
 
 There are many reasons. If Metis runs seemingly forever, that is a sign that the
 proof is too difficult for it. Metis's search is complete for first-order logic
 with equality, so if the proof was found by a superposition-based ATP such as
 E, SPASS, or Vampire, Metis should eventually find it, but that is little
 consolation.
 
 In some rare cases, \textit{metis} fails fairly quickly, and you get the error
 message ``One-line proof reconstruction failed.'' This indicates that
 Sledgehammer determined that the goal is provable, but the proof is, for
 technical reasons, beyond \textit{metis}'s power. You can then try again with
 the \textit{strict} option (\S\ref{problem-encoding}).
 
 If the goal is actually unprovable and you did not specify an unsound encoding
 using \textit{type\_enc} (\S\ref{problem-encoding}), this is a bug, and you are
 strongly encouraged to report this to the author at \authoremail.
 
 
 \point{What are the \textit{full\_types}, \textit{no\_types}, and \\
 \textit{mono\_tags} arguments to Metis?}
 
 The \textit{metis}~(\textit{full\_types}) proof method
 and its cousin \textit{metis}~(\textit{mono\_tags}) are fully-typed
 versions of Metis. It is somewhat slower than \textit{metis}, but the proof
 search is fully typed, and it also includes more powerful rules such as the
 axiom ``$x = \const{True} \mathrel{\lor} x = \const{False}$'' for reasoning in
 higher-order places (e.g., in set comprehensions). The method is tried as a
 fallback when \textit{metis} fails, and it is sometimes generated by
 Sledgehammer instead of \textit{metis} if the proof obviously requires type
 information or if \textit{metis} failed when Sledgehammer preplayed the proof.
 %
 At the other end of the soundness spectrum, \textit{metis} (\textit{no\_types})
 uses no type information at all during the proof search, which is more efficient
 but often fails. Calls to \textit{metis} (\textit{no\_types}) are occasionally
 generated by Sledgehammer.
 %
 See the \textit{type\_enc} option (\S\ref{problem-encoding}) for details.
 
 Incidentally, if you ever see warnings such as
 
 \prew
 \slshape
 Metis: Falling back on ``\textit{metis} (\textit{full\_types})''
 \postw
 
 for a successful \textit{metis} proof, you can advantageously pass the
 \textit{full\_types} option to \textit{metis} directly.
 
 
 \point{And what are the \textit{lifting} and \textit{hide\_lams} \\ arguments
 to Metis?}
 
 Orthogonally to the encoding of types, it is important to choose an appropriate
 translation of $\lambda$-abstractions. Metis supports three translation
 schemes, in decreasing order of power: Curry combinators (the default),
 $\lambda$-lifting, and a ``hiding'' scheme that disables all reasoning under
 $\lambda$-abstractions. The more powerful schemes also give the automatic
 provers more rope to hang themselves. See the \textit{lam\_trans} option
 (\S\ref{problem-encoding}) for details.
 
 
 \point{Are the generated proofs minimal?}
 
 Automatic provers frequently use many more facts than are necessary.
 Sledgehammer includes a proof minimization tool that takes a set of facts returned by
 a given prover and repeatedly calls a prover or proof method with subsets of
 those facts to find a minimal set. Reducing the number of facts typically helps
 reconstruction, while decluttering the proof scripts.
 
 
 \point{A strange error occurred---what should I do?}
 
 Sledgehammer tries to give informative error messages. Please report any strange
 error to the author at \authoremail.
 
 
 \point{Auto can solve it---why not Sledgehammer?}
 
 Problems can be easy for \textit{auto} and difficult for automatic provers, but
 the reverse is also true, so do not be discouraged if your first attempts fail.
 Because the system refers to all theorems known to Isabelle, it is particularly
 suitable when your goal has a short proof but requires lemmas that you do not
 know about.
 
 
 \point{Why are there so many options?}
 
 Sledgehammer's philosophy is that it should work out of the box, without user
 guidance. Most of the options are meant to be used by the Sledgehammer
 developers for experiments.
 
 
 \section{Command Syntax}
 \label{command-syntax}
 
 \subsection{Sledgehammer}
 \label{sledgehammer}
 
 Sledgehammer can be invoked at any point when there is an open goal by entering
 the \textbf{sledgehammer} command in the theory file. Its general syntax is as
 follows:
 
 \prew
 \textbf{sledgehammer} \qty{subcommand}$^?$ \qty{options}$^?$ \qty{facts\_override}$^?$ \qty{num}$^?$
 \postw
 
 In the general syntax, the \qty{subcommand} may be any of the following:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{run} (the default):} Runs Sledgehammer on
 subgoal number \qty{num} (1 by default), with the given options and facts.
 
 \item[\labelitemi] \textbf{\textit{supported\_provers}:} Prints the list of
 automatic provers supported by Sledgehammer. See \S\ref{installation} and
 \S\ref{mode-of-operation} for more information on how to install automatic
 provers.
 
 \item[\labelitemi] \textbf{\textit{refresh\_tptp}:} Refreshes the list of remote
 ATPs available at System\-On\-TPTP \cite{sutcliffe-2000}.
 \end{enum}
 
 In addition, the following subcommands provide finer control over machine
 learning with MaSh:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{unlearn}:} Resets MaSh, erasing any
 persistent state.
 
 \item[\labelitemi] \textbf{\textit{learn\_isar}:} Invokes MaSh on the current
 theory to process all the available facts, learning from their Isabelle/Isar
 proofs. This happens automatically at Sledgehammer invocations if the
 \textit{learn} option (\S\ref{relevance-filter}) is enabled.
 
 \item[\labelitemi] \textbf{\textit{learn\_prover}:} Invokes MaSh on the current
 theory to process all the available facts, learning from proofs generated by
 automatic provers. The prover to use and its timeout can be set using the
 \textit{prover} (\S\ref{mode-of-operation}) and \textit{timeout}
 (\S\ref{timeouts}) options. It is recommended to perform learning using a
 first-order ATP (such as E, SPASS, and Vampire) as opposed to a
 higher-order ATP or an SMT solver.
 
 \item[\labelitemi] \textbf{\textit{relearn\_isar}:} Same as \textit{unlearn}
 followed by \textit{learn\_isar}.
 
 \item[\labelitemi] \textbf{\textit{relearn\_prover}:} Same as \textit{unlearn}
 followed by \textit{learn\_prover}.
 \end{enum}
 
 Sledgehammer's behavior can be influenced by various \qty{options}, which can be
 specified in brackets after the \textbf{sledgehammer} command. The
 \qty{options} are a list of key--value pairs of the form ``[$k_1 = v_1,
 \ldots, k_n = v_n$]''. For Boolean options, ``= \textit{true\/}'' is optional.
 For example:
 
 \prew
 \textbf{sledgehammer} [\textit{isar\_proofs}, \,\textit{timeout} = 120]
 \postw
 
 Default values can be set using \textbf{sledgehammer\_\allowbreak params}:
 
 \prew
 \textbf{sledgehammer\_params} \qty{options}
 \postw
 
 The supported options are described in \S\ref{option-reference}.
 
 The \qty{facts\_override} argument lets you alter the set of facts that go
 through the relevance filter. It may be of the form ``(\qty{facts})'', where
 \qty{facts} is a space-separated list of Isabelle facts (theorems, local
 assumptions, etc.), in which case the relevance filter is bypassed and the given
 facts are used. It may also be of the form ``(\textit{add}:\ \qty{facts\/_{\mathrm{1}}})'',
 ``(\textit{del}:\ \qty{facts\/_{\mathrm{2}}})'', or ``(\textit{add}:\ \qty{facts\/_{\mathrm{1}}}\
 \textit{del}:\ \qty{facts\/_{\mathrm{2}}})'', where the relevance filter is instructed to
 proceed as usual except that it should consider \qty{facts\/_{\mathrm{1}}}
 highly-relevant and \qty{facts\/_{\mathrm{2}}} fully irrelevant.
 
 If you use Isabelle/jEdit, Sledgehammer also provides an automatic mode that can
 be enabled via the ``Auto Sledgehammer'' option under ``Plugins > Plugin Options
 > Isabelle > General.'' For automatic runs, only the first prover set using
 \textit{provers} (\S\ref{mode-of-operation}) is considered (typically E),
 \textit{slice} (\S\ref{mode-of-operation}) is disabled,
 fewer facts are
 passed to the prover, \textit{fact\_filter} (\S\ref{relevance-filter}) is set to
 \textit{mepo}, \textit{strict} (\S\ref{problem-encoding}) is enabled,
 \textit{verbose} (\S\ref{output-format}) and \textit{debug}
 (\S\ref{output-format}) are disabled, and \textit{timeout} (\S\ref{timeouts}) is
 superseded by the ``Auto Time Limit'' option in jEdit. Sledgehammer's output is
 also more concise.
 
 
 \subsection{Metis}
 \label{metis}
 
 The \textit{metis} proof method has the syntax
 
 \prew
 \textbf{\textit{metis}}~(\qty{options})${}^?$~\qty{facts}${}^?$
 \postw
 
 where \qty{facts} is a list of arbitrary facts and \qty{options} is a
 comma-separated list consisting of at most one $\lambda$ translation scheme
 specification with the same semantics as Sledgehammer's \textit{lam\_trans}
 option (\S\ref{problem-encoding}) and at most one type encoding specification
 with the same semantics as Sledgehammer's \textit{type\_enc} option
 (\S\ref{problem-encoding}).
 %
 The supported $\lambda$ translation schemes are \textit{hide\_lams},
 \textit{lifting}, and \textit{combs} (the default).
 %
 All the untyped type encodings listed in \S\ref{problem-encoding} are supported.
 For convenience, the following aliases are provided:
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{full\_types}:} Alias for \textit{poly\_guards\_query}.
 \item[\labelitemi] \textbf{\textit{partial\_types}:} Alias for \textit{poly\_args}.
 \item[\labelitemi] \textbf{\textit{no\_types}:} Alias for \textit{erased}.
 \end{enum}
 
 
 \section{Option Reference}
 \label{option-reference}
 
 \def\defl{\{}
 \def\defr{\}}
 
 \def\flushitem#1{\item[]\noindent\kern-\leftmargin \textbf{#1}}
 \def\optrueonly#1{\flushitem{\textit{#1} $\bigl[$= \textit{true}$\bigr]$\enskip}\nopagebreak\\[\parskip]}
 \def\optrue#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\enskip \defl\textit{true}\defr\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opfalse#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\enskip \defl\textit{false}\defr\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opsmart#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{smart\_bool}$\bigr]$\enskip \defl\textit{smart}\defr\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opsmartx#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{smart\_bool}$\bigr]$\enskip \defl\textit{smart}\defr\\\hbox{}\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
 \def\opnodefault#1#2{\flushitem{\textit{#1} = \qtybf{#2}} \nopagebreak\\[\parskip]}
 \def\opnodefaultbrk#1#2{\flushitem{$\bigl[$\textit{#1} =$\bigr]$ \qtybf{#2}} \nopagebreak\\[\parskip]}
 \def\opdefault#1#2#3{\flushitem{\textit{#1} = \qtybf{#2}\enskip \defl\textit{#3}\defr} \nopagebreak\\[\parskip]}
 \def\oparg#1#2#3{\flushitem{\textit{#1} \qtybf{#2} = \qtybf{#3}} \nopagebreak\\[\parskip]}
 \def\opargbool#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{bool}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
 \def\opargboolorsmart#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{smart\_bool}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
 
 Sledgehammer's options are categorized as follows:\ mode of operation
 (\S\ref{mode-of-operation}), problem encoding (\S\ref{problem-encoding}),
 relevance filter (\S\ref{relevance-filter}), output format
 (\S\ref{output-format}), regression testing (\S\ref{regression-testing}),
 and timeouts (\S\ref{timeouts}).
 
 The descriptions below refer to the following syntactic quantities:
 
 \begin{enum}
 \item[\labelitemi] \qtybf{string}: A string.
 \item[\labelitemi] \qtybf{bool\/}: \textit{true} or \textit{false}.
 \item[\labelitemi] \qtybf{smart\_bool\/}: \textit{true}, \textit{false}, or
 \textit{smart}.
 \item[\labelitemi] \qtybf{int\/}: An integer.
 \item[\labelitemi] \qtybf{float}: A floating-point number (e.g., 2.5 or 60)
 expressing a number of seconds.
 \item[\labelitemi] \qtybf{float\_pair\/}: A pair of floating-point numbers
 (e.g., 0.6 0.95).
 \item[\labelitemi] \qtybf{smart\_int\/}: An integer or \textit{smart}.
 \end{enum}
 
 Default values are indicated in curly brackets (\textrm{\{\}}). Boolean options
 have a negative counterpart (e.g., \textit{minimize} vs.\
 \textit{dont\_minimize}). When setting Boolean options or their negative
 counterparts, ``= \textit{true\/}'' may be omitted.
 
 
 \subsection{Mode of Operation}
 \label{mode-of-operation}
 
 \begin{enum}
 \opnodefaultbrk{provers}{string}
 Specifies the automatic provers to use as a space-separated list (e.g.,
 ``\textit{cvc4}~\textit{e}~\textit{spass}~\textit{vampire\/}'').
 Provers can be run locally or remotely; see \S\ref{installation} for
 installation instructions.
 
 The following local provers are supported:
 
 \begin{sloppy}
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{agsyhol}:} agsyHOL is an automatic
 higher-order prover developed by Fredrik Lindblad \cite{agsyHOL}. To use
 agsyHOL, set the environment variable \texttt{AGSYHOL\_HOME} to the directory
 that contains the \texttt{agsyHOL} executable. Sledgehammer has been tested
 with version 1.0.
 
 \item[\labelitemi] \textbf{\textit{alt\_ergo}:} Alt-Ergo is a polymorphic
 ATP developed by Bobot et al.\ \cite{alt-ergo}.
 It supports the TPTP polymorphic typed first-order format (TF1) via Why3
 \cite{why3}. To use Alt-Ergo, set the environment variable \texttt{WHY3\_HOME}
 to the directory that contains the \texttt{why3} executable. Sledgehammer
 requires Alt-Ergo 0.95.2 and Why3 0.83.
 
 \item[\labelitemi] \textbf{\textit{cvc3}:} CVC3 is an SMT solver developed by
 Clark Barrett, Cesare Tinelli, and their colleagues \cite{cvc3}. To use CVC3,
 set the environment variable \texttt{CVC3\_SOLVER} to the complete path of the
 executable, including the file name, or install the prebuilt CVC3 package from
 \download. Sledgehammer has been tested with versions 2.2 and 2.4.1.
 
 \item[\labelitemi] \textbf{\textit{cvc4}:} CVC4 \cite{cvc4} is the successor to
 CVC3. To use CVC4, set the environment variable \texttt{CVC4\_SOLVER} to the
 complete path of the executable, including the file name, or install the
 prebuilt CVC4 package from \download. Sledgehammer has been tested with version
 1.5-prerelease.
 
 \item[\labelitemi] \textbf{\textit{e}:} E is a first-order resolution prover
 developed by Stephan Schulz \cite{schulz-2019}. To use E, set the environment
 variable \texttt{E\_HOME} to the directory that contains the \texttt{eproof}
 executable and \texttt{E\_VERSION} to the version number (e.g., ``1.8''), or
 install the prebuilt E package from \download. Sledgehammer has been tested with
 versions 1.6 to 1.8.
 
 \item[\labelitemi] \textbf{\textit{iprover}:} iProver is a pure
 instantiation-based prover developed by Konstantin Korovin
 \cite{korovin-2009}. To use iProver, set the environment variable
 \texttt{IPROVER\_HOME} to the directory that contains the \texttt{iproveropt}
 executable. Sledgehammer has been tested with version 2.8. iProver depends on
 E to clausify problems, so make sure that E is installed as well.
 
 \item[\labelitemi] \textbf{\textit{leo2}:} LEO-II is an automatic
 higher-order prover developed by Christoph Benzm\"uller et al.\ \cite{leo2},
 with support for the TPTP typed higher-order syntax (TH0). To use LEO-II, set
 the environment variable \texttt{LEO2\_HOME} to the directory that contains the
 \texttt{leo} executable. Sledgehammer has been tested with version 1.3.4.
 
 \item[\labelitemi] \textbf{\textit{leo3}:} Leo-III is an automatic
 higher-order prover developed by Alexander Steen, Max Wisniewski, Christoph
 Benzm\"uller et al.\ \cite{leo3},
 with support for the TPTP typed higher-order syntax (TH0). To use Leo-III, set
 the environment variable \texttt{LEO3\_HOME} to the directory that contains the
 \texttt{leo3} executable. Sledgehammer has been tested with version 1.1.
 
 \item[\labelitemi] \textbf{\textit{satallax}:} Satallax is an automatic
 higher-order prover developed by Chad Brown et al.\ \cite{satallax}, with
 support for the TPTP typed higher-order syntax (TH0). To use Satallax, set the
 environment variable \texttt{SATALLAX\_HOME} to the directory that contains the
 \texttt{satallax} executable. Sledgehammer has been tested with version 2.2.
 
 \item[\labelitemi] \textbf{\textit{spass}:} SPASS is a first-order resolution
 prover developed by Christoph Weidenbach et al.\ \cite{weidenbach-et-al-2009}.
 To use SPASS, set the environment variable \texttt{SPASS\_HOME} to the directory
 that contains the \texttt{SPASS} executable and \texttt{SPASS\_VERSION} to the
 version number (e.g., ``3.8ds''), or install the prebuilt SPASS package from
 \download. Sledgehammer has been tested with version 3.8ds.
 
 \item[\labelitemi] \textbf{\textit{vampire}:} Vampire is a first-order
 resolution prover developed by Andrei Voronkov and his colleagues
 \cite{riazanov-voronkov-2002}. To use Vampire, set the environment variable
 \texttt{VAMPIRE\_HOME} to the directory that contains the \texttt{vampire}
 executable and \texttt{VAMPIRE\_VERSION} to the version number (e.g.,
 ``4.2.2''). Sledgehammer has been tested with versions 1.8 to 4.2.2 (in the
 post-2010 numbering scheme).
 
 \item[\labelitemi] \textbf{\textit{verit}:} veriT \cite{bouton-et-al-2009} is an
 SMT solver developed by David D\'eharbe, Pascal Fontaine, and their colleagues.
 It is designed to produce detailed proofs for reconstruction in proof
 assistants. To use veriT, set the environment variable \texttt{VERIT\_SOLVER}
 to the complete path of the executable, including the file name. Sledgehammer
 has been tested with version 2020.10-rmx.
 
 \item[\labelitemi] \textbf{\textit{z3}:} Z3 is an SMT solver developed at
 Microsoft Research \cite{de-moura-2008}. To use Z3, set the environment variable
 \texttt{Z3\_SOLVER} to the complete path of the executable, including the
 file name. Sledgehammer has been tested with a pre-release version of 4.4.0.
 
 \item[\labelitemi] \textbf{\textit{z3\_tptp}:} This version of Z3 pretends to
 be an ATP, exploiting Z3's support for the TPTP typed first-order format (TF0).
 It is included for experimental purposes. Sledgehammer has been tested with
 version 4.3.1. To use it, set the environment variable \texttt{Z3\_TPTP\_HOME}
 to the directory that contains the \texttt{z3\_tptp} executable.
 
 \item[\labelitemi] \textbf{\textit{zipperposition}:} Zipperposition
 \cite{cruanes-2014} is a higher-order superposition prover developed by Simon
 Cruanes, Petar Vukmirovi\'c, and colleagues. To use Zipperposition, set the
 environment variable \texttt{ZIPPERPOSITION\_HOME} to the directory that
 contains the \texttt{zipperposition} executable and
 \texttt{ZIPPERPOSITION\_VERSION} to the version number (e.g., ``2.0.1'').
 Sledgehammer has been tested with version 2.0.1.
 \end{enum}
 
 \end{sloppy}
 
 Moreover, the following remote provers are supported:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{remote\_agsyhol}:} The remote version of
 agsyHOL runs on Geoff Sutcliffe's Miami servers \cite{sutcliffe-2000}.
 
 \item[\labelitemi] \textbf{\textit{remote\_alt\_ergo}:} The remote version of
 Alt-Ergo runs on Geoff Sutcliffe's Miami servers \cite{sutcliffe-2000}.
 
 \item[\labelitemi] \textbf{\textit{remote\_e}:} The remote version of E runs
 on Geoff Sutcliffe's Miami servers \cite{sutcliffe-2000}.
 
 \item[\labelitemi] \textbf{\textit{remote\_iprover}:} The
 remote version of iProver runs on Geoff Sutcliffe's Miami servers
 \cite{sutcliffe-2000}.
 
 \item[\labelitemi] \textbf{\textit{remote\_leo2}:} The remote version of LEO-II
 runs on Geoff Sutcliffe's Miami servers \cite{sutcliffe-2000}.
 
 \item[\labelitemi] \textbf{\textit{remote\_leo3}:} The remote version of Leo-III
 runs on Geoff Sutcliffe's Miami servers \cite{sutcliffe-2000}.
 
 \item[\labelitemi] \textbf{\textit{remote\_vampire}:} The remote version of
 Vampire runs on Geoff Sutcliffe's Miami servers.
 
 \item[\labelitemi] \textbf{\textit{remote\_waldmeister}:} Waldmeister is a unit
 equality prover developed by Hillenbrand et al.\ \cite{waldmeister}. It can be
 used to prove universally quantified equations using unconditional equations,
 corresponding to the TPTP CNF UEQ division. The remote version of Waldmeister
 runs on Geoff Sutcliffe's Miami servers.
 
 \item[\labelitemi] \textbf{\textit{remote\_zipperposition}:} The remote
 version of Zipperposition runs on Geoff Sutcliffe's Miami servers.
 \end{enum}
 
 By default, Sledgehammer runs a subset of CVC4, E, SPASS, Vampire, veriT, and
 Z3 in parallel, either locally or remotely---depending on the number of
 processor cores available and on which provers are actually installed. It is
 generally desirable to run several provers in parallel.
 
 \opnodefault{prover}{string}
 Alias for \textit{provers}.
 
 \optrue{slice}{dont\_slice}
 Specifies whether the time allocated to a prover should be sliced into several
 segments, each of which has its own set of possibly prover-dependent options.
 For SPASS and Vampire, the first slice tries the fast but incomplete
 set-of-support (SOS) strategy, whereas the second slice runs without it. For E,
 up to three slices are tried, with different weighted search strategies and
 number of facts. For SMT solvers, several slices are tried with the same options
 each time but fewer and fewer facts. According to benchmarks with a timeout of
 30 seconds, slicing is a valuable optimization, and you should probably leave it
 enabled unless you are conducting experiments.
 
 \nopagebreak
 {\small See also \textit{verbose} (\S\ref{output-format}).}
 
 \optrue{minimize}{dont\_minimize}
 Specifies whether the proof minimization tool should be invoked automatically
 after proof search.
 
 \nopagebreak
 {\small See also \textit{preplay\_timeout} (\S\ref{timeouts})
 and \textit{dont\_preplay} (\S\ref{timeouts}).}
 
 \opfalse{spy}{dont\_spy}
 Specifies whether Sledgehammer should record statistics in
 \texttt{\$ISA\-BELLE\_\allowbreak HOME\_\allowbreak USER/\allowbreak spy\_\allowbreak sledgehammer}.
 These statistics can be useful to the developers of Sledgehammer. If you are willing to have your
 interactions recorded in the name of science, please enable this feature and send the statistics
 file every now and then to the author of this manual (\authoremail).
 To change the default value of this option globally, set the environment variable
 \texttt{SLEDGEHAMMER\_SPY} to \textit{yes}.
 
 \nopagebreak
 {\small See also \textit{debug} (\S\ref{output-format}).}
 
 \opfalse{overlord}{no\_overlord}
 Specifies whether Sledgehammer should put its temporary files in
 \texttt{\$ISA\-BELLE\_\allowbreak HOME\_\allowbreak USER}, which is useful for
 debugging Sledgehammer but also unsafe if several instances of the tool are run
 simultaneously. The files are identified by the prefixes \texttt{prob\_} and
 \texttt{mash\_}; you may safely remove them after Sledgehammer has run.
 
 \textbf{Warning:} This option is not thread-safe. Use at your own risks.
 
 \nopagebreak
 {\small See also \textit{debug} (\S\ref{output-format}).}
 \end{enum}
 
 
 \subsection{Relevance Filter}
 \label{relevance-filter}
 
 \begin{enum}
 \opdefault{fact\_filter}{string}{smart}
 Specifies the relevance filter to use. The following filters are available:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{mepo}:}
 The traditional memoryless MePo relevance filter.
 
 \item[\labelitemi] \textbf{\textit{mash}:}
 The MaSh machine learner. Three learning algorithms are provided:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{nb}} is an implementation of naive Bayes.
 
 \item[\labelitemi] \textbf{\textit{knn}} is an implementation of $k$-nearest
 neighbors.
 
 \item[\labelitemi] \textbf{\textit{nb\_knn}} (also called \textbf{\textit{yes}}
 and \textbf{\textit{sml}}) is a combination of naive Bayes and $k$-nearest
 neighbors.
 \end{enum}
 
 In addition, the special value \textit{none} is used to disable machine learning by
 default (cf.\ \textit{smart} below).
 
 The default algorithm is \textit{nb\_knn}. The algorithm can be selected by
 setting the ``MaSh'' option under ``Plugins > Plugin Options > Isabelle >
 General'' in Isabelle/jEdit. Persistent data for both algorithms is stored in
 the directory \texttt{\$ISABELLE\_\allowbreak HOME\_\allowbreak USER/\allowbreak
 mash}.
 
 \item[\labelitemi] \textbf{\textit{mesh}:} The MeSh filter, which combines the
 rankings from MePo and MaSh.
 
 \item[\labelitemi] \textbf{\textit{smart}:} A combination of MePo, MaSh, and
 MeSh. If the learning algorithm is set to be \textit{none}, \textit{smart}
 behaves like MePo.
 \end{enum}
 
 \opdefault{max\_facts}{smart\_int}{smart}
 Specifies the maximum number of facts that may be returned by the relevance
 filter. If the option is set to \textit{smart} (the default), it effectively
 takes a value that was empirically found to be appropriate for the prover.
 Typical values lie between 50 and 1000.
 
 \opdefault{fact\_thresholds}{float\_pair}{\upshape 0.45~0.85}
 Specifies the thresholds above which facts are considered relevant by the
 relevance filter. The first threshold is used for the first iteration of the
 relevance filter and the second threshold is used for the last iteration (if it
 is reached). The effective threshold is quadratically interpolated for the other
 iterations. Each threshold ranges from 0 to 1, where 0 means that all theorems
 are relevant and 1 only theorems that refer to previously seen constants.
 
 \optrue{learn}{dont\_learn}
 Specifies whether Sledgehammer invocations should run MaSh to learn the
 available theories (and hence provide more accurate results). Learning takes
 place only if MaSh is enabled.
 
 \opdefault{max\_new\_mono\_instances}{int}{smart}
 Specifies the maximum number of monomorphic instances to generate beyond
 \textit{max\_facts}. The higher this limit is, the more monomorphic instances
 are potentially generated. Whether monomorphization takes place depends on the
 type encoding used. If the option is set to \textit{smart} (the default), it
 takes a value that was empirically found to be appropriate for the prover. For
 most provers, this value is 100.
 
 \nopagebreak
 {\small See also \textit{type\_enc} (\S\ref{problem-encoding}).}
 
 \opdefault{max\_mono\_iters}{int}{smart}
 Specifies the maximum number of iterations for the monomorphization fixpoint
 construction. The higher this limit is, the more monomorphic instances are
 potentially generated. Whether monomorphization takes place depends on the
 type encoding used. If the option is set to \textit{smart} (the default), it
 takes a value that was empirically found to be appropriate for the prover.
 For most provers, this value is 3.
 
 \nopagebreak
 {\small See also \textit{type\_enc} (\S\ref{problem-encoding}).}
 \end{enum}
 
 
 \subsection{Problem Encoding}
 \label{problem-encoding}
 
 \newcommand\comb[1]{\const{#1}}
 
 \begin{enum}
 \opdefault{lam\_trans}{string}{smart}
 Specifies the $\lambda$ translation scheme to use in ATP problems. The supported
 translation schemes are listed below:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{hide\_lams}:} Hide the $\lambda$-abstractions
 by replacing them by unspecified fresh constants, effectively disabling all
 reasoning under $\lambda$-abstractions.
 
 \item[\labelitemi] \textbf{\textit{lifting}:} Introduce a new
 supercombinator \const{c} for each cluster of $n$~$\lambda$-abstractions,
 defined using an equation $\const{c}~x_1~\ldots~x_n = t$ ($\lambda$-lifting).
 
 \item[\labelitemi] \textbf{\textit{combs}:} Rewrite lambdas to the Curry
 combinators (\comb{I}, \comb{K}, \comb{S}, \comb{B}, \comb{C}). Combinators
 enable the ATPs to synthesize $\lambda$-terms but tend to yield bulkier formulas
 than $\lambda$-lifting: The translation is quadratic in the worst case, and the
 equational definitions of the combinators are very prolific in the context of
 resolution.
 
 \item[\labelitemi] \textbf{\textit{combs\_and\_lifting}:} Introduce a new
 supercombinator \const{c} for each cluster of $\lambda$-abstractions and characterize it both using a
 lifted equation $\const{c}~x_1~\ldots~x_n = t$ and via Curry combinators.
 
 \item[\labelitemi] \textbf{\textit{combs\_or\_lifting}:} For each cluster of
 $\lambda$-abstractions, heuristically choose between $\lambda$-lifting and Curry
 combinators.
 
 \item[\labelitemi] \textbf{\textit{keep\_lams}:}
 Keep the $\lambda$-abstractions in the generated problems. This is available
 only with provers that support the TH0 syntax.
 
 \item[\labelitemi] \textbf{\textit{smart}:} The actual translation scheme used
 depends on the ATP and should be the most efficient scheme for that ATP.
 \end{enum}
 
 For SMT solvers, the $\lambda$ translation scheme is always \textit{lifting},
 irrespective of the value of this option.
 
 \opsmartx{uncurried\_aliases}{no\_uncurried\_aliases}
 Specifies whether fresh function symbols should be generated as aliases for
 applications of curried functions in ATP problems.
 
 \opdefault{type\_enc}{string}{smart}
 Specifies the type encoding to use in ATP problems. Some of the type encodings
 are unsound, meaning that they can give rise to spurious proofs
 (unreconstructible using \textit{metis}). The type encodings are
 listed below, with an indication of their soundness in parentheses.
 An asterisk (*) indicates that the encoding is slightly incomplete for
 reconstruction with \textit{metis}, unless the \textit{strict} option (described
 below) is enabled.
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{erased} (unsound):} No type information is
 supplied to the ATP, not even to resolve overloading. Types are simply erased.
 
 \item[\labelitemi] \textbf{\textit{poly\_guards} (sound):} Types are encoded using
 a predicate \const{g}$(\tau, t)$ that guards bound
 variables. Constants are annotated with their types, supplied as extra
 arguments, to resolve overloading.
 
 \item[\labelitemi] \textbf{\textit{poly\_tags} (sound):} Each term and subterm is
 tagged with its type using a function $\const{t\/}(\tau, t)$.
 
 \item[\labelitemi] \textbf{\textit{poly\_args} (unsound):}
 Like for \textit{poly\_guards} constants are annotated with their types to
 resolve overloading, but otherwise no type information is encoded. This
 is the default encoding used by the \textit{metis} proof method.
 
 \item[\labelitemi]
 \textbf{%
 \textit{raw\_mono\_guards}, \textit{raw\_mono\_tags} (sound); \\
 \textit{raw\_mono\_args} (unsound):} \\
 Similar to \textit{poly\_guards}, \textit{poly\_tags}, and \textit{poly\_args},
 respectively, but the problem is additionally monomorphized, meaning that type
 variables are instantiated with heuristically chosen ground types.
 Monomorphization can simplify reasoning but also leads to larger fact bases,
 which can slow down the ATPs.
 
 \item[\labelitemi]
 \textbf{%
 \textit{mono\_guards}, \textit{mono\_tags} (sound);
 \textit{mono\_args} \\ (unsound):} \\
 Similar to
 \textit{raw\_mono\_guards}, \textit{raw\_mono\_tags}, and
 \textit{raw\_mono\_\allowbreak args}, respectively but types are mangled in constant names
 instead of being supplied as ground term arguments. The binary predicate
 $\const{g}(\tau, t)$ becomes a unary predicate
 $\const{g\_}\tau(t)$, and the binary function
 $\const{t}(\tau, t)$ becomes a unary function
 $\const{t\_}\tau(t)$.
 
 \item[\labelitemi] \textbf{\textit{mono\_native} (sound):} Exploits native
 first-order types if the prover supports the TF0, TF1, TH0, or TH1 syntax;
 otherwise, falls back on \textit{mono\_guards}. The problem is monomorphized.
 
 \item[\labelitemi] \textbf{\textit{mono\_native\_fool} (sound):} Exploits native
 first-order types, including Booleans, if the prover supports the TFX0, TFX1,
 TH0, or TH1 syntax; otherwise, falls back on \textit{mono\_native}. The problem
 is monomorphized.
 
 \item[\labelitemi] \textbf{\textit{mono\_native\_higher},
 \textit{mono\_native\_higher\_fool} \\ (sound):} Exploits native higher-order
 types, including Booleans if ending with ``\textit{\_fool}'', if the prover
 supports the TH0 syntax; otherwise, falls back on \textit{mono\_native} or
 \textit{mono\_native\_fool}. The problem is monomorphized.
 
 \item[\labelitemi] \textbf{\textit{poly\_native}, \textit{poly\_native\_fool},
 \textit{poly\_native\_higher}, \\ \textit{poly\_native\_higher\_fool} (sound):}
 Exploits native first-order polymorphic types if the prover supports the TF1,
 TFX1, or TH1 syntax; otherwise, falls back on \textit{mono\_native},
 \textit{mono\_native\_fool}, \textit{mono\_native\_higher}, or
 \textit{mono\_native\_higher\_fool}.
 
 \item[\labelitemi]
 \textbf{%
 \textit{poly\_guards}?, \textit{poly\_tags}?, \textit{raw\_mono\_guards}?, \\
 \textit{raw\_mono\_tags}?, \textit{mono\_guards}?, \textit{mono\_tags}?, \\
 \textit{mono\_native}? (sound*):} \\
 The type encodings \textit{poly\_guards}, \textit{poly\_tags},
 \textit{raw\_mono\_guards}, \textit{raw\_mono\_tags}, \textit{mono\_guards},
 \textit{mono\_tags}, and \textit{mono\_native} are fully typed and sound. For
 each of these, Sledgehammer also provides a lighter variant identified by a
 question mark (`\hbox{?}')\ that detects and erases monotonic types, notably
 infinite types. (For \textit{mono\_native}, the types are not actually erased
 but rather replaced by a shared uniform type of individuals.) As argument to the
 \textit{metis} proof method, the question mark is replaced by a
 \hbox{``\textit{\_query\/}''} suffix.
 
 \item[\labelitemi]
 \textbf{%
 \textit{poly\_guards}??, \textit{poly\_tags}??, \textit{raw\_mono\_guards}??, \\
 \textit{raw\_mono\_tags}??, \textit{mono\_guards}??, \textit{mono\_tags}?? \\
 (sound*):} \\
 Even lighter versions of the `\hbox{?}' encodings. As argument to the
 \textit{metis} proof method, the `\hbox{??}' suffix is replaced by
 \hbox{``\textit{\_query\_query\/}''}.
 
 \item[\labelitemi]
 \textbf{%
 \textit{poly\_guards}@, \textit{poly\_tags}@, \textit{raw\_mono\_guards}@, \\
 \textit{raw\_mono\_tags}@ (sound*):} \\
 Alternative versions of the `\hbox{??}' encodings. As argument to the
 \textit{metis} proof method, the `\hbox{@}' suffix is replaced by
 \hbox{``\textit{\_at\/}''}.
 
 \item[\labelitemi] \textbf{\textit{poly\_args}?, \textit{raw\_mono\_args}? (unsound):} \\
 Lighter versions of \textit{poly\_args} and \textit{raw\_mono\_args}.
 
 \item[\labelitemi] \textbf{\textit{smart}:} The actual encoding used depends on
 the ATP and should be the most efficient sound encoding for that ATP.
 \end{enum}
 
 For SMT solvers, the type encoding is always \textit{mono\_native}, irrespective
 of the value of this option.
 
 \nopagebreak
 {\small See also \textit{max\_new\_mono\_instances} (\S\ref{relevance-filter})
 and \textit{max\_mono\_iters} (\S\ref{relevance-filter}).}
 
 \opfalse{strict}{non\_strict}
 Specifies whether Sledgehammer should run in its strict mode. In that mode,
 sound type encodings marked with an asterisk (*) above are made complete
 for reconstruction with \textit{metis}, at the cost of some clutter in the
 generated problems. This option has no effect if \textit{type\_enc} is
 deliberately set to an unsound encoding.
 \end{enum}
 
 
 \subsection{Output Format}
 \label{output-format}
 
 \begin{enum}
 
 \opfalse{verbose}{quiet}
 Specifies whether the \textbf{sledgehammer} command should explain what it does.
 
 \opfalse{debug}{no\_debug}
 Specifies whether Sledgehammer should display additional debugging information
 beyond what \textit{verbose} already displays. Enabling \textit{debug} also
 enables \textit{verbose} behind the scenes.
 
 \nopagebreak
 {\small See also \textit{spy} (\S\ref{mode-of-operation}) and
 \textit{overlord} (\S\ref{mode-of-operation}).}
 
 \opsmart{isar\_proofs}{no\_isar\_proofs}
 Specifies whether Isar proofs should be output in addition to one-line proofs.
 The construction of Isar proof is still experimental and may sometimes fail;
 however, when they succeed they are usually faster and more intelligible than
 one-line proofs. If the option is set to \textit{smart} (the default), Isar
 proofs are only generated when no working one-line proof is available.
 
 \opdefault{compress}{int}{smart}
 Specifies the granularity of the generated Isar proofs if \textit{isar\_proofs}
 is explicitly enabled. A value of $n$ indicates that each Isar proof step should
 correspond to a group of up to $n$ consecutive proof steps in the ATP proof. If
 the option is set to \textit{smart} (the default), the compression factor is 10
 if the \textit{isar\_proofs} option is explicitly enabled; otherwise, it is
 $\infty$.
 
 \optrueonly{dont\_compress}
 Alias for ``\textit{compress} = 1''.
 
 \optrue{try0}{dont\_try0}
 Specifies whether standard proof methods such as \textit{auto} and
 \textit{blast} should be tried as alternatives to \textit{metis} in Isar proofs.
 The collection of methods is roughly the same as for the \textbf{try0} command.
 
 \optrue{smt\_proofs}{no\_smt\_proofs}
 Specifies whether the \textit{smt} proof method should be tried in addition to
 Isabelle's built-in proof methods.
 \end{enum}
 
 
 \subsection{Regression Testing}
 \label{regression-testing}
 
 \begin{enum}
 \opnodefault{expect}{string}
 Specifies the expected outcome, which must be one of the following:
 
 \begin{enum}
 \item[\labelitemi] \textbf{\textit{some}:} Sledgehammer found a proof.
 \item[\labelitemi] \textbf{\textit{none}:} Sledgehammer found no proof.
 \item[\labelitemi] \textbf{\textit{timeout}:} Sledgehammer timed out.
 \item[\labelitemi] \textbf{\textit{unknown}:} Sledgehammer encountered some
 problem.
 \end{enum}
 
 Sledgehammer emits an error if the actual outcome differs from the expected outcome. This option is
 useful for regression testing.
 
 \nopagebreak
 {\small See also \textit{timeout} (\S\ref{timeouts}).}
 \end{enum}
 
 
 \subsection{Timeouts}
 \label{timeouts}
 
 \begin{enum}
 \opdefault{timeout}{float}{\upshape 30}
 Specifies the maximum number of seconds that the automatic provers should spend
 searching for a proof. This excludes problem preparation and is a soft limit.
 
 \opdefault{preplay\_timeout}{float}{\upshape 1}
 Specifies the maximum number of seconds that \textit{metis} or other proof
 methods should spend trying to ``preplay'' the found proof. If this option
 is set to 0, no preplaying takes place, and no timing information is displayed
 next to the suggested proof method calls.
 
 \nopagebreak
 {\small See also \textit{minimize} (\S\ref{mode-of-operation}).}
 
 \optrueonly{dont\_preplay}
 Alias for ``\textit{preplay\_timeout} = 0''.
 
 \end{enum}
 
 \section{Mirabelle Testing Tool}
 \label{mirabelle}
 
 The \texttt{isabelle mirabelle} tool executes Sledgehammer or other advisory
 tools (e.g., Nitpick) or tactics (e.g., \textit{auto}) on all subgoals emering
 in a theory. It is typically used to measure the success rate of a proof tool
 on some benchmark. Its command-line usage is as follows:
 
 {\small
 \begin{verbatim}
 isabelle mirabelle [OPTIONS] ACTIONS FILES
 
   Options are:
     -L LOGIC     parent logic to use (default HOL)
     -O DIR       output directory for test data (default None)
     -S FILE      user-provided setup file (no actions required)
     -T THEORY    parent theory to use (default Main)
     -d DIR       include session directory
     -q           be quiet (suppress output of Isabelle process)
     -t TIMEOUT   timeout for each action in seconds (default 30)
 
   Apply the given actions at all proof steps in the given theory
   files.
 \end{verbatim}
 }
 
 Option \texttt{-L LOGIC} specifies the parent session to use. This is often a
 logic (e.g., \texttt{Pure}, \texttt{HOL}) but may be any session (e.g., from
 the AFP). Using multiple sessions is not supported. If a theory A needs to
 import theories from multiple sessions, this limitation can be overcome as
 follows:
 
 \begin{enumerate}
   \item Define a custom session \texttt{S} with a single theory \texttt{B}.
   \item Move all imports from \texttt{A} to \texttt{B}.
   \item Build the heap image of \texttt{S}.
   \item Import \texttt{S.B} from theory \texttt{A}.
   \item Execute Mirabelle with \texttt{C} as parent logic (i.e., with
     \texttt{-L S}).
 \end{enumerate}
 
 Option \texttt{-O DIR} specifies the output directory, which is created if
 needed. In this directory, one log file per theory records the position of each
 tested subgoal and the result of executing the action.
 
 Option \texttt{-t TIMEOUT} specifies a generic timeout that the actions may
 interpret differently.
 
 More specific documentation about the \texttt{ACTIONS} and \texttt{FILES}
 parameters and their corresponding options can be found in the Isabelle tool
 usage by entering \texttt{isabelle mirabelle -?} on the command line.
 
 \subsection{Example of Benchmarking Sledgehammer}
 
 \begin{verbatim}
 isabelle mirabelle -O output/ \
   sledgehammer[prover=e,prover_timeout=10] Huffman.thy
 \end{verbatim}
 
 This command specifies Sledgehammer as the action, using the E prover with a
 timeout of 10 seconds. The results are written to \texttt{output/Huffman.log}.
 
 \subsection{Example of Benchmarking Another Tool}
 
 \begin{verbatim}
 isabelle mirabelle -O output/ -t 10 try0 Huffman.thy
 \end{verbatim}
 
 This command specifies the \textbf{try0} command as the action, with a timeout
 of 10 seconds. The results are written to \texttt{output/Huffman.log}.
 
 \subsection{Example of Generating TPTP Files}
 
 \begin{verbatim}
 isabelle mirabelle -O output/ \
   sledgehammer[prover=e,prover_timeout=1,keep=/tptp/files/] \
   Huffman.thy
 \end{verbatim}
 
 This command generates TPTP files using Sledgehammer. Since the file is
 generated at the very beginning of every Sledgehammer invocation, a timeout of
 one second making the prover fail faster speeds up processing the theory. The
 results are written in the specified directory (\texttt{/tptp/files/}),
 which must exist beforehand. A TPTP file is generated for each subgoal.
 
 \let\em=\sl
 \bibliography{manual}{}
 \bibliographystyle{abbrv}
 
 \end{document}
diff --git a/src/Doc/Sugar/document/build b/src/Doc/Sugar/document/build
deleted file mode 100755
--- a/src/Doc/Sugar/document/build
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/System/Environment.thy b/src/Doc/System/Environment.thy
--- a/src/Doc/System/Environment.thy
+++ b/src/Doc/System/Environment.thy
@@ -1,501 +1,502 @@
 (*:maxLineLen=78:*)
 
 theory Environment
 imports Base
 begin
 
 chapter \<open>The Isabelle system environment\<close>
 
 text \<open>
   This manual describes Isabelle together with related tools as seen from a
   system oriented view. See also the \<^emph>\<open>Isabelle/Isar Reference Manual\<close> @{cite
   "isabelle-isar-ref"} for the actual Isabelle input language and related
   concepts, and \<^emph>\<open>The Isabelle/Isar Implementation Manual\<close> @{cite
   "isabelle-implementation"} for the main concepts of the underlying
   implementation in Isabelle/ML.
 \<close>
 
 
 section \<open>Isabelle settings \label{sec:settings}\<close>
 
 text \<open>
   Isabelle executables may depend on the \<^emph>\<open>Isabelle settings\<close> within the
   process environment. This is a statically scoped collection of environment
   variables, such as @{setting ISABELLE_HOME}, @{setting ML_SYSTEM}, @{setting
   ML_HOME}. These variables are \<^emph>\<open>not\<close> intended to be set directly from the
   shell, but are provided by Isabelle \<^emph>\<open>components\<close> their \<^emph>\<open>settings files\<close> as
   explained below.
 \<close>
 
 
 subsection \<open>Bootstrapping the environment \label{sec:boot}\<close>
 
 text \<open>
   Isabelle executables need to be run within a proper settings environment.
   This is bootstrapped as described below, on the first invocation of one of
   the outer wrapper scripts (such as @{executable_ref isabelle}). This happens
   only once for each process tree, i.e.\ the environment is passed to
   subprocesses according to regular Unix conventions.
 
     \<^enum> The special variable @{setting_def ISABELLE_HOME} is determined
     automatically from the location of the binary that has been run.
 
     You should not try to set @{setting ISABELLE_HOME} manually. Also note
     that the Isabelle executables either have to be run from their original
     location in the distribution directory, or via the executable objects
     created by the @{tool install} tool. Symbolic links are admissible, but a
     plain copy of the \<^dir>\<open>$ISABELLE_HOME/bin\<close> files will not work!
 
     \<^enum> The file \<^file>\<open>$ISABELLE_HOME/etc/settings\<close> is run as a @{executable_ref
     bash} shell script with the auto-export option for variables enabled.
 
     This file holds a rather long list of shell variable assignments, thus
     providing the site-wide default settings. The Isabelle distribution
     already contains a global settings file with sensible defaults for most
     variables. When installing the system, only a few of these may have to be
     adapted (probably @{setting ML_SYSTEM} etc.).
 
     \<^enum> The file \<^path>\<open>$ISABELLE_HOME_USER/etc/settings\<close> (if it
     exists) is run in the same way as the site default settings. Note that the
     variable @{setting ISABELLE_HOME_USER} has already been set before ---
     usually to something like \<^verbatim>\<open>$USER_HOME/.isabelle/Isabelle2021\<close>.
 
     Thus individual users may override the site-wide defaults. Typically, a
     user settings file contains only a few lines, with some assignments that
     are actually changed. Never copy the central
     \<^file>\<open>$ISABELLE_HOME/etc/settings\<close> file!
 
   Since settings files are regular GNU @{executable_def bash} scripts, one may
   use complex shell commands, such as \<^verbatim>\<open>if\<close> or \<^verbatim>\<open>case\<close> statements to set
   variables depending on the system architecture or other environment
   variables. Such advanced features should be added only with great care,
   though. In particular, external environment references should be kept at a
   minimum.
 
   \<^medskip>
   A few variables are somewhat special, e.g.\ @{setting_def ISABELLE_TOOL} is
   set automatically to the absolute path name of the @{executable isabelle}
   executables.
 
   \<^medskip>
   Note that the settings environment may be inspected with the @{tool getenv}
   tool. This might help to figure out the effect of complex settings scripts.
 \<close>
 
 
 subsection \<open>Common variables\<close>
 
 text \<open>
   This is a reference of common Isabelle settings variables. Note that the
   list is somewhat open-ended. Third-party utilities or interfaces may add
   their own selection. Variables that are special in some sense are marked
   with \<open>\<^sup>*\<close>.
 
   \<^descr>[@{setting_def USER_HOME}\<open>\<^sup>*\<close>] Is the cross-platform user home directory.
   On Unix systems this is usually the same as @{setting HOME}, but on Windows
   it is the regular home directory of the user, not the one of within the
   Cygwin root file-system.\<^footnote>\<open>Cygwin itself offers another choice whether its
   HOME should point to the \<^path>\<open>/home\<close> directory tree or the Windows user
   home.\<close>
 
   \<^descr>[@{setting_def ISABELLE_HOME}\<open>\<^sup>*\<close>] is the location of the top-level
   Isabelle distribution directory. This is automatically determined from the
   Isabelle executable that has been invoked. Do not attempt to set @{setting
   ISABELLE_HOME} yourself from the shell!
 
   \<^descr>[@{setting_def ISABELLE_HOME_USER}] is the user-specific counterpart of
   @{setting ISABELLE_HOME}. The default value is relative to \<^path>\<open>$USER_HOME/.isabelle\<close>, under rare circumstances this may be changed in the
   global setting file. Typically, the @{setting ISABELLE_HOME_USER} directory
   mimics @{setting ISABELLE_HOME} to some extend. In particular, site-wide
   defaults may be overridden by a private \<^verbatim>\<open>$ISABELLE_HOME_USER/etc/settings\<close>.
 
   \<^descr>[@{setting_def ISABELLE_PLATFORM_FAMILY}\<open>\<^sup>*\<close>] is automatically set to the
   general platform family (\<^verbatim>\<open>linux\<close>, \<^verbatim>\<open>macos\<close>, \<^verbatim>\<open>windows\<close>). Note that
   platform-dependent tools usually need to refer to the more specific
   identification according to @{setting ISABELLE_PLATFORM64}, @{setting
   ISABELLE_WINDOWS_PLATFORM64}, @{setting ISABELLE_APPLE_PLATFORM64}.
 
   \<^descr>[@{setting_def ISABELLE_PLATFORM64}\<open>\<^sup>*\<close>] indicates the standard Posix
   platform (\<^verbatim>\<open>x86_64\<close>, \<^verbatim>\<open>arm64\<close>), together with a symbolic name for the
   operating system (\<^verbatim>\<open>linux\<close>, \<^verbatim>\<open>darwin\<close>, \<^verbatim>\<open>cygwin\<close>).
 
   \<^descr>[@{setting_def ISABELLE_WINDOWS_PLATFORM64}\<open>\<^sup>*\<close>, @{setting_def
   ISABELLE_WINDOWS_PLATFORM32}\<open>\<^sup>*\<close>] indicate the native Windows platform: both
   64\,bit and 32\,bit executables are supported here.
 
   In GNU bash scripts, a preference for native Windows platform variants may
   be specified like this (first 64 bit, second 32 bit):
 
   @{verbatim [display] \<open>"${ISABELLE_WINDOWS_PLATFORM64:-${ISABELLE_WINDOWS_PLATFORM32:-
   $ISABELLE_PLATFORM64}}"\<close>}
 
   \<^descr>[@{setting_def ISABELLE_APPLE_PLATFORM64}\<open>\<^sup>*\<close>] indicates the native Apple
   Silicon platform (\<^verbatim>\<open>arm64-darwin\<close> if available), instead of Intel emulation
   via Rosetta (\<^verbatim>\<open>ISABELLE_PLATFORM64=x86_64-darwin\<close>).
 
   \<^descr>[@{setting ISABELLE_TOOL}\<open>\<^sup>*\<close>] is automatically set to the full path name
   of the @{executable isabelle} executable.
 
   \<^descr>[@{setting_def ISABELLE_IDENTIFIER}\<open>\<^sup>*\<close>] refers to the name of this
   Isabelle distribution, e.g.\ ``\<^verbatim>\<open>Isabelle2021\<close>''.
 
   \<^descr>[@{setting_def ML_SYSTEM}, @{setting_def ML_HOME}, @{setting_def
   ML_OPTIONS}, @{setting_def ML_PLATFORM}, @{setting_def ML_IDENTIFIER}\<open>\<^sup>*\<close>]
   specify the underlying ML system to be used for Isabelle. There is only a
   fixed set of admissable @{setting ML_SYSTEM} names (see the
   \<^file>\<open>$ISABELLE_HOME/etc/settings\<close> file of the distribution).
 
   The actual compiler binary will be run from the directory @{setting
   ML_HOME}, with @{setting ML_OPTIONS} as first arguments on the command line.
   The optional @{setting ML_PLATFORM} may specify the binary format of ML heap
   images, which is useful for cross-platform installations. The value of
   @{setting ML_IDENTIFIER} is automatically obtained by composing the values
   of @{setting ML_SYSTEM}, @{setting ML_PLATFORM} and the Isabelle version
   values.
 
   \<^descr>[@{setting_def ISABELLE_JDK_HOME}] points to a full JDK (Java Development
   Kit) installation with \<^verbatim>\<open>javac\<close> and \<^verbatim>\<open>jar\<close> executables. Note that
   conventional \<^verbatim>\<open>JAVA_HOME\<close> points to the JRE (Java Runtime Environment), not
   the JDK.
 
   \<^descr>[@{setting_def ISABELLE_JAVA_PLATFORM}] identifies the hardware and
   operating system platform for the Java installation of Isabelle. That is
   always the (native) 64 bit variant: \<^verbatim>\<open>x86_64-linux\<close>, \<^verbatim>\<open>x86_64-darwin\<close>,
   \<^verbatim>\<open>x86_64-windows\<close>.
 
   \<^descr>[@{setting_def ISABELLE_BROWSER_INFO}] is the directory where HTML and PDF
   browser information is stored (see also \secref{sec:info}); its default is
   \<^path>\<open>$ISABELLE_HOME_USER/browser_info\<close>. For ``system build mode'' (see
   \secref{sec:tool-build}), @{setting_def ISABELLE_BROWSER_INFO_SYSTEM} is
   used instead; its default is \<^path>\<open>$ISABELLE_HOME/browser_info\<close>.
 
   \<^descr>[@{setting_def ISABELLE_HEAPS}] is the directory where session heap images,
   log files, and build databases are stored; its default is
   \<^path>\<open>$ISABELLE_HOME_USER/heaps\<close>. If @{system_option system_heaps} is
   \<^verbatim>\<open>true\<close>, @{setting_def ISABELLE_HEAPS_SYSTEM} is used instead; its default
   is \<^path>\<open>$ISABELLE_HOME/heaps\<close>. See also \secref{sec:tool-build}.
 
   \<^descr>[@{setting_def ISABELLE_LOGIC}] specifies the default logic to load if none
   is given explicitely by the user. The default value is \<^verbatim>\<open>HOL\<close>.
 
   \<^descr>[@{setting_def ISABELLE_LINE_EDITOR}] specifies the line editor for the
   @{tool_ref console} interface.
 
-  \<^descr>[@{setting_def ISABELLE_PDFLATEX}, @{setting_def ISABELLE_BIBTEX}] refer to
-  {\LaTeX} related tools for Isabelle document preparation (see also
-  \secref{sec:tool-latex}).
+  \<^descr>[@{setting_def ISABELLE_PDFLATEX}, @{setting_def ISABELLE_LUALATEX},
+  @{setting_def ISABELLE_BIBTEX}, @{setting_def ISABELLE_MAKEINDEX}] refer to
+  {\LaTeX}-related tools for Isabelle document preparation (see also
+  \secref{sec:tool-document}).
 
   \<^descr>[@{setting_def ISABELLE_TOOLS}] is a colon separated list of directories
   that are scanned by @{executable isabelle} for external utility programs
   (see also \secref{sec:isabelle-tool}).
 
   \<^descr>[@{setting_def ISABELLE_DOCS}] is a colon separated list of directories
   with documentation files.
 
   \<^descr>[@{setting_def PDF_VIEWER}] specifies the program to be used for displaying
   \<^verbatim>\<open>pdf\<close> files.
 
   \<^descr>[@{setting_def ISABELLE_TMP_PREFIX}\<open>\<^sup>*\<close>] is the prefix from which any
   running Isabelle ML process derives an individual directory for temporary
   files.
 
   \<^descr>[@{setting_def ISABELLE_TOOL_JAVA_OPTIONS}] is passed to the \<^verbatim>\<open>java\<close>
   executable when running Isabelle tools (e.g.\ @{tool build}). This is
   occasionally helpful to provide more heap space, via additional options like
   \<^verbatim>\<open>-Xms1g -Xmx4g\<close>.
 \<close>
 
 
 subsection \<open>Additional components \label{sec:components}\<close>
 
 text \<open>
   Any directory may be registered as an explicit \<^emph>\<open>Isabelle component\<close>. The
   general layout conventions are that of the main Isabelle distribution
   itself, and the following two files (both optional) have a special meaning:
 
     \<^item> \<^verbatim>\<open>etc/settings\<close> holds additional settings that are initialized when
     bootstrapping the overall Isabelle environment, cf.\ \secref{sec:boot}. As
     usual, the content is interpreted as a GNU bash script. It may refer to
     the component's enclosing directory via the \<^verbatim>\<open>COMPONENT\<close> shell variable.
 
     For example, the following setting allows to refer to files within the
     component later on, without having to hardwire absolute paths:
     @{verbatim [display] \<open>MY_COMPONENT_HOME="$COMPONENT"\<close>}
 
     Components can also add to existing Isabelle settings such as
     @{setting_def ISABELLE_TOOLS}, in order to provide component-specific
     tools that can be invoked by end-users. For example:
     @{verbatim [display] \<open>ISABELLE_TOOLS="$ISABELLE_TOOLS:$COMPONENT/lib/Tools"\<close>}
 
     \<^item> \<^verbatim>\<open>etc/components\<close> holds a list of further sub-components of the same
     structure. The directory specifications given here can be either absolute
     (with leading \<^verbatim>\<open>/\<close>) or relative to the component's main directory.
 
   The root of component initialization is @{setting ISABELLE_HOME} itself.
   After initializing all of its sub-components recursively, @{setting
   ISABELLE_HOME_USER} is included in the same manner (if that directory
   exists). This allows to install private components via
   \<^path>\<open>$ISABELLE_HOME_USER/etc/components\<close>, although it is often more
   convenient to do that programmatically via the
   \<^bash_function>\<open>init_component\<close> shell function in the \<^verbatim>\<open>etc/settings\<close>
   script of \<^verbatim>\<open>$ISABELLE_HOME_USER\<close> (or any other component directory). For
   example:
   @{verbatim [display] \<open>init_component "$HOME/screwdriver-2.0"\<close>}
 
   This is tolerant wrt.\ missing component directories, but might produce a
   warning.
 
   \<^medskip>
   More complex situations may be addressed by initializing components listed
   in a given catalog file, relatively to some base directory:
   @{verbatim [display] \<open>init_components "$HOME/my_component_store" "some_catalog_file"\<close>}
 
   The component directories listed in the catalog file are treated as relative
   to the given base directory.
 
   See also \secref{sec:tool-components} for some tool-support for resolving
   components that are formally initialized but not installed yet.
 \<close>
 
 
 section \<open>The Isabelle tool wrapper \label{sec:isabelle-tool}\<close>
 
 text \<open>
   The main \<^emph>\<open>Isabelle tool wrapper\<close> provides a generic startup environment for
   Isabelle-related utilities, user interfaces, add-on applications etc. Such
   tools automatically benefit from the settings mechanism
   (\secref{sec:settings}). Moreover, this is the standard way to invoke
   Isabelle/Scala functionality as a separate operating-system process.
   Isabelle command-line tools are run uniformly via a common wrapper ---
   @{executable_ref isabelle}:
   @{verbatim [display]
 \<open>Usage: isabelle TOOL [ARGS ...]
 
   Start Isabelle TOOL with ARGS; pass "-?" for tool-specific help.
 
 Available tools:
   ...\<close>}
 
   Tools may be implemented in Isabelle/Scala or as stand-alone executables
   (usually as GNU bash scripts). In the invocation of ``@{executable
   isabelle}~\<open>tool\<close>'', the named \<open>tool\<close> is resolved as follows (and in the
   given order).
 
     \<^enum> An external tool found on the directories listed in the @{setting
     ISABELLE_TOOLS} settings variable (colon-separated list in standard POSIX
     notation).
 
       \<^enum> If a file ``\<open>tool\<close>\<^verbatim>\<open>.scala\<close>'' is found, the source needs to define
       some object that extends the class \<^verbatim>\<open>Isabelle_Tool.Body\<close>. The Scala
       compiler is invoked on the spot (which may take some time), and the body
       function is run with the command-line arguments as \<^verbatim>\<open>List[String]\<close>.
 
       \<^enum> If an executable file ``\<open>tool\<close>'' is found, it is invoked as
       stand-alone program with the command-line arguments provided as \<^verbatim>\<open>argv\<close>
       array.
 
     \<^enum> An internal tool that is registered in \<^verbatim>\<open>etc/settings\<close> via the shell
     function \<^bash_function>\<open>isabelle_scala_service\<close>, referring to a
     suitable instance of class \<^scala_type>\<open>isabelle.Isabelle_Scala_Tools\<close>.
     This is the preferred approach for non-trivial systems programming in
     Isabelle/Scala: instead of adhoc interpretation of \<^verbatim>\<open>scala\<close> scripts,
     which is somewhat slow and only type-checked at runtime, there are
     properly compiled \<^verbatim>\<open>jar\<close> modules (see also the shell function
     \<^bash_function>\<open>classpath\<close> in \secref{sec:scala}).
 
   There are also various administrative tools that are available from a bare
   repository clone of Isabelle, but not in regular distributions.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Show the list of available documentation of the Isabelle distribution:
   @{verbatim [display] \<open>isabelle doc\<close>}
 
   View a certain document as follows:
   @{verbatim [display] \<open>isabelle doc system\<close>}
 
   Query the Isabelle settings environment:
   @{verbatim [display] \<open>isabelle getenv ISABELLE_HOME_USER\<close>}
 \<close>
 
 
 section \<open>The raw Isabelle ML process\<close>
 
 subsection \<open>Batch mode \label{sec:tool-process}\<close>
 
 text \<open>
   The @{tool_def process} tool runs the raw ML process in batch mode:
   @{verbatim [display]
 \<open>Usage: isabelle process [OPTIONS]
 
   Options are:
     -T THEORY    load theory
     -d DIR       include session directory
     -e ML_EXPR   evaluate ML expression on startup
     -f ML_FILE   evaluate ML file on startup
     -l NAME      logic session name (default ISABELLE_LOGIC="HOL")
     -m MODE      add print mode for output
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
 
   Run the raw Isabelle ML process in batch mode.\<close>}
 
   \<^medskip>
   Options \<^verbatim>\<open>-e\<close> and \<^verbatim>\<open>-f\<close> allow to evaluate ML code, before the ML process is
   started. The source is either given literally or taken from a file. Multiple
   \<^verbatim>\<open>-e\<close> and \<^verbatim>\<open>-f\<close> options are evaluated in the given order. Errors lead to
   premature exit of the ML process with return code 1.
 
   \<^medskip>
   Option \<^verbatim>\<open>-T\<close> loads a specified theory file. This is a wrapper for \<^verbatim>\<open>-e\<close> with
   a suitable \<^ML>\<open>use_thy\<close> invocation.
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> specifies the logic session name. Option \<^verbatim>\<open>-d\<close> specifies
   additional directories for session roots, see also \secref{sec:tool-build}.
 
   \<^medskip>
   The \<^verbatim>\<open>-m\<close> option adds identifiers of print modes to be made active for this
   session. For example, \<^verbatim>\<open>-m ASCII\<close> prefers ASCII replacement syntax over
   mathematical Isabelle symbols.
 
   \<^medskip>
   Option \<^verbatim>\<open>-o\<close> allows to override Isabelle system options for this process,
   see also \secref{sec:system-options}.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   The subsequent example retrieves the \<^verbatim>\<open>Main\<close> theory value from the theory
   loader within ML:
   @{verbatim [display] \<open>isabelle process -e 'Thy_Info.get_theory "Main"'\<close>}
 
   Observe the delicate quoting rules for the GNU bash shell vs.\ ML. The
   Isabelle/ML and Scala libraries provide functions for that, but here we need
   to do it manually.
 
   \<^medskip>
   This is how to invoke a function body with proper return code and printing
   of errors, and without printing of a redundant \<^verbatim>\<open>val it = (): unit\<close> result:
   @{verbatim [display] \<open>isabelle process -e 'Command_Line.tool (fn () => writeln "OK")'\<close>}
   @{verbatim [display] \<open>isabelle process -e 'Command_Line.tool (fn () => error "Bad")'\<close>}
 \<close>
 
 
 subsection \<open>Interactive mode\<close>
 
 text \<open>
   The @{tool_def console} tool runs the raw ML process with interactive
   console and line editor:
   @{verbatim [display]
 \<open>Usage: isabelle console [OPTIONS]
 
   Options are:
     -d DIR       include session directory
     -i NAME      include session in name-space of theories
     -l NAME      logic session name (default ISABELLE_LOGIC)
     -m MODE      add print mode for output
     -n           no build of session image on startup
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -r           bootstrap from raw Poly/ML
 
   Build a logic session image and run the raw Isabelle ML process
   in interactive mode, with line editor ISABELLE_LINE_EDITOR.\<close>}
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> specifies the logic session name. By default, its heap image is
   checked and built on demand, but the option \<^verbatim>\<open>-n\<close> skips that.
 
   Option \<^verbatim>\<open>-i\<close> includes additional sessions into the name-space of theories:
   multiple occurrences are possible.
 
   Option \<^verbatim>\<open>-r\<close> indicates a bootstrap from the raw Poly/ML system, which is
   relevant for Isabelle/Pure development.
 
   \<^medskip>
   Options \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-m\<close>, \<^verbatim>\<open>-o\<close> have the same meaning as for @{tool process}
   (\secref{sec:tool-process}).
 
   \<^medskip>
   The Isabelle/ML process is run through the line editor that is specified via
   the settings variable @{setting ISABELLE_LINE_EDITOR} (e.g.\
   @{executable_def rlwrap} for GNU readline); the fall-back is to use plain
   standard input/output.
 
   The user is connected to the raw ML toplevel loop: this is neither
   Isabelle/Isar nor Isabelle/ML within the usual formal context. The most
   relevant ML commands at this stage are \<^ML>\<open>use\<close> (for ML files) and
   \<^ML>\<open>use_thy\<close> (for theory files).
 \<close>
 
 
 section \<open>The raw Isabelle Java process \label{sec:isabelle-java}\<close>
 
 text \<open>
   The @{executable_ref isabelle_java} executable allows to run a Java process
   within the name space of Java and Scala components that are bundled with
   Isabelle, but \<^emph>\<open>without\<close> the Isabelle settings environment
   (\secref{sec:settings}).
 
   After such a JVM cold-start, the Isabelle environment can be accessed via
   \<^verbatim>\<open>Isabelle_System.getenv\<close> as usual, but the underlying process environment
   remains clean. This is e.g.\ relevant when invoking other processes that
   should remain separate from the current Isabelle installation.
 
   \<^medskip>
   Note that under normal circumstances, Isabelle command-line tools are run
   \<^emph>\<open>within\<close> the settings environment, as provided by the @{executable
   isabelle} wrapper (\secref{sec:isabelle-tool} and \secref{sec:tool-java}).
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 text \<open>
   The subsequent example creates a raw Java process on the command-line and
   invokes the main Isabelle application entry point:
   @{verbatim [display] \<open>isabelle_java isabelle.Main\<close>}
 \<close>
 
 
 section \<open>YXML versus XML \label{sec:yxml-vs-xml}\<close>
 
 text \<open>
   Isabelle tools often use YXML, which is a simple and efficient syntax for
   untyped XML trees. The YXML format is defined as follows.
 
     \<^enum> The encoding is always UTF-8.
 
     \<^enum> Body text is represented verbatim (no escaping, no special treatment of
     white space, no named entities, no CDATA chunks, no comments).
 
     \<^enum> Markup elements are represented via ASCII control characters \<open>\<^bold>X = 5\<close>
     and \<open>\<^bold>Y = 6\<close> as follows:
 
     \begin{tabular}{ll}
       XML & YXML \\\hline
       \<^verbatim>\<open><\<close>\<open>name attribute\<close>\<^verbatim>\<open>=\<close>\<open>value \<dots>\<close>\<^verbatim>\<open>>\<close> &
       \<open>\<^bold>X\<^bold>Yname\<^bold>Yattribute\<close>\<^verbatim>\<open>=\<close>\<open>value\<dots>\<^bold>X\<close> \\
       \<^verbatim>\<open></\<close>\<open>name\<close>\<^verbatim>\<open>>\<close> & \<open>\<^bold>X\<^bold>Y\<^bold>X\<close> \\
     \end{tabular}
 
     There is no special case for empty body text, i.e.\ \<^verbatim>\<open><foo/>\<close> is treated
     like \<^verbatim>\<open><foo></foo>\<close>. Also note that \<open>\<^bold>X\<close> and \<open>\<^bold>Y\<close> may never occur in
     well-formed XML documents.
 
   Parsing YXML is pretty straight-forward: split the text into chunks
   separated by \<open>\<^bold>X\<close>, then split each chunk into sub-chunks separated by \<open>\<^bold>Y\<close>.
   Markup chunks start with an empty sub-chunk, and a second empty sub-chunk
   indicates close of an element. Any other non-empty chunk consists of plain
   text. For example, see \<^file>\<open>~~/src/Pure/PIDE/yxml.ML\<close> or
   \<^file>\<open>~~/src/Pure/PIDE/yxml.scala\<close>.
 
   YXML documents may be detected quickly by checking that the first two
   characters are \<open>\<^bold>X\<^bold>Y\<close>.
 \<close>
 
 end
diff --git a/src/Doc/System/Presentation.thy b/src/Doc/System/Presentation.thy
--- a/src/Doc/System/Presentation.thy
+++ b/src/Doc/System/Presentation.thy
@@ -1,223 +1,187 @@
 (*:maxLineLen=78:*)
 
 theory Presentation
 imports Base
 begin
 
 chapter \<open>Presenting theories \label{ch:present}\<close>
 
 text \<open>
   Isabelle provides several ways to present the outcome of formal
   developments, including WWW-based browsable libraries or actual printable
   documents. Presentation is centered around the concept of \<^emph>\<open>sessions\<close>
   (\chref{ch:session}). The global session structure is that of a tree, with
   Isabelle Pure at its root, further object-logics derived (e.g.\ HOLCF from
   HOL, and HOL from Pure), and application sessions further on in the
   hierarchy.
 
   The command-line tools @{tool_ref mkroot} and @{tool_ref build} provide the
   primary means for managing Isabelle sessions, including options for
   presentation: ``\<^verbatim>\<open>document=pdf\<close>'' generates PDF output from the theory
   session, and ``\<^verbatim>\<open>document_output=dir\<close>'' emits a copy of the document sources
   with the PDF into the given directory (relative to the session directory).
 
   Alternatively, @{tool_ref document} may be used to turn the generated
-  {\LaTeX} sources of a session (exports from its build database) into PDF,
-  using suitable invocations of @{tool_ref latex}.
+  {\LaTeX} sources of a session (exports from its build database) into PDF.
 \<close>
 
 
 section \<open>Generating HTML browser information \label{sec:info}\<close>
 
 text \<open>
   As a side-effect of building sessions, Isabelle is able to generate theory
   browsing information, including HTML documents that show the theory sources
   and the relationship with its ancestors and descendants. Besides the HTML
   file that is generated for every theory, Isabelle stores links to all
   theories of a session in an index file. As a second hierarchy, groups of
   sessions are organized as \<^emph>\<open>chapters\<close>, with a separate index. Note that the
   implicit tree structure of the session build hierarchy is \<^emph>\<open>not\<close> relevant
   for the presentation.
 
   \<^medskip>
   To generate theory browsing information for an existing session, just invoke
   @{tool build} with suitable options:
   @{verbatim [display] \<open>isabelle build -o browser_info -v -c FOL\<close>}
 
   The presentation output will appear in \<^verbatim>\<open>$ISABELLE_BROWSER_INFO/FOL/FOL\<close> as
   reported by the above verbose invocation of the build process.
 
   Many Isabelle sessions (such as \<^session>\<open>HOL-Library\<close> in
   \<^dir>\<open>~~/src/HOL/Library\<close>) also provide printable documents in PDF. These are
   prepared automatically as well if enabled like this:
   @{verbatim [display] \<open>isabelle build -o browser_info -o document=pdf -v -c HOL-Library\<close>}
 
   Enabling both browser info and document preparation simultaneously causes an
   appropriate ``document'' link to be included in the HTML index. Documents
   may be generated independently of browser information as well, see
   \secref{sec:tool-document} for further details.
 
   \<^bigskip>
   The theory browsing information is stored in a sub-directory directory
   determined by the @{setting_ref ISABELLE_BROWSER_INFO} setting plus a prefix
   corresponding to the session chapter and identifier. In order to present
   Isabelle applications on the web, the corresponding subdirectory from
   @{setting ISABELLE_BROWSER_INFO} can be put on a WWW server.
 \<close>
 
 
 section \<open>Preparing session root directories \label{sec:tool-mkroot}\<close>
 
 text \<open>
   The @{tool_def mkroot} tool configures a given directory as session root,
   with some \<^verbatim>\<open>ROOT\<close> file and optional document source directory. Its usage is:
   @{verbatim [display]
 \<open>Usage: isabelle mkroot [OPTIONS] [DIRECTORY]
 
   Options are:
     -A LATEX     provide author in LaTeX notation (default: user name)
     -I           init Mercurial repository and add generated files
     -T LATEX     provide title in LaTeX notation (default: session name)
     -n NAME      alternative session name (default: directory base name)
 
   Prepare session root directory (default: current directory).
 \<close>}
 
   The results are placed in the given directory \<open>dir\<close>, which refers to the
   current directory by default. The @{tool mkroot} tool is conservative in the
   sense that it does not overwrite existing files or directories. Earlier
   attempts to generate a session root need to be deleted manually.
 
   The generated session template will be accompanied by a formal document,
   with \<open>DIRECTORY\<close>\<^verbatim>\<open>/document/root.tex\<close> as its {\LaTeX} entry point (see also
   \chref{ch:present}).
 
   Options \<^verbatim>\<open>-T\<close> and \<^verbatim>\<open>-A\<close> specify the document title and author explicitly,
   using {\LaTeX} source notation.
 
   Option \<^verbatim>\<open>-I\<close> initializes a Mercurial repository in the target directory, and
   adds all generated files (without commit).
 
   Option \<^verbatim>\<open>-n\<close> specifies an alternative session name; otherwise the base name
   of the given directory is used.
 
   \<^medskip>
   The implicit Isabelle settings variable @{setting ISABELLE_LOGIC} specifies
   the parent session.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Produce session \<^verbatim>\<open>Test\<close> within a separate directory of the same name:
   @{verbatim [display] \<open>isabelle mkroot Test && isabelle build -D Test\<close>}
 
   \<^medskip>
   Upgrade the current directory into a session ROOT with document preparation,
   and build it:
   @{verbatim [display] \<open>isabelle mkroot && isabelle build -D .\<close>}
 \<close>
 
 
 section \<open>Preparing Isabelle session documents \label{sec:tool-document}\<close>
 
 text \<open>
   The @{tool_def document} tool prepares logic session documents. Its usage
   is:
   @{verbatim [display]
 \<open>Usage: isabelle document [OPTIONS] SESSION
 
   Options are:
     -O DIR       output directory for LaTeX sources and resulting PDF
     -P DIR       output directory for resulting PDF
     -S DIR       output directory for LaTeX sources
     -V           verbose latex
     -d DIR       include session directory
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose build
 
   Prepare the theory document of a session.\<close>}
 
   Generated {\LaTeX} sources are taken from the session build database:
   @{tool_ref build} is invoked beforehand to ensure that it is up-to-date.
   Further files are generated on the spot, notably essential Isabelle style
   files, and \<^verbatim>\<open>session.tex\<close> to input all theory sources from the session
   (excluding imports from other sessions).
 
   \<^medskip> Options \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-o\<close>, \<^verbatim>\<open>-v\<close> have the same meaning as for @{tool
   build}.
 
   \<^medskip> Option \<^verbatim>\<open>-V\<close> prints full output of {\LaTeX} tools.
 
   \<^medskip> Option \<^verbatim>\<open>-O\<close>~\<open>dir\<close> specifies the output directory for generated {\LaTeX}
   sources and the result PDF file. Options \<^verbatim>\<open>-P\<close> and \<^verbatim>\<open>-S\<close> only refer to the
   PDF and sources, respectively.
 
   For example, for output directory ``\<^verbatim>\<open>output\<close>'' and the default document
   variant ``\<^verbatim>\<open>document\<close>'', the generated document sources are placed into the
   subdirectory \<^verbatim>\<open>output/document/\<close> and the resulting PDF into
   \<^verbatim>\<open>output/document.pdf\<close>.
 
   \<^medskip> Isabelle is usually smart enough to create the PDF from the given
   \<^verbatim>\<open>root.tex\<close> and optional \<^verbatim>\<open>root.bib\<close> (bibliography) and \<^verbatim>\<open>root.idx\<close> (index)
-  using standard {\LaTeX} tools. Alternatively, \isakeyword{document\_files}
-  in the session \<^verbatim>\<open>ROOT\<close> may include an executable \<^verbatim>\<open>build\<close> script to take
-  care of that. It is invoked with command-line arguments for the document
-  format (\<^verbatim>\<open>pdf\<close>) and the document variant name. The script needs to produce
-  corresponding output files, e.g.\ \<^verbatim>\<open>root.pdf\<close> for default document variants
-  (the main work can be delegated to @{tool latex}). \<close>
+  using standard {\LaTeX} tools. Actual command-lines are given by settings
+  @{setting_ref ISABELLE_PDFLATEX}, @{setting_ref ISABELLE_LUALATEX},
+  @{setting_ref ISABELLE_BIBTEX}, @{setting_ref ISABELLE_MAKEINDEX}: these
+  variables are used without quoting in shell scripts, and thus may contain
+  additional options.
+
+  Alternatively, the session \<^verbatim>\<open>ROOT\<close> may include an option
+  \<^verbatim>\<open>document_build=build\<close> together with an executable \<^verbatim>\<open>build\<close> script in
+  \isakeyword{document\_files}: it is invoked with command-line arguments for
+  the document format (\<^verbatim>\<open>pdf\<close>) and the document variant name. The script needs
+  to produce corresponding output files, e.g.\ \<^verbatim>\<open>root.pdf\<close> for default
+  document variants.
+\<close>
+
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Produce the document from session \<^verbatim>\<open>FOL\<close> with full verbosity, and a copy in
   the current directory (subdirectory \<^verbatim>\<open>document\<close> and file \<^verbatim>\<open>document.pdf)\<close>:
 
   @{verbatim [display] \<open>isabelle document -v -V -O. FOL\<close>}
 \<close>
 
-
-section \<open>Running {\LaTeX} within the Isabelle environment
-  \label{sec:tool-latex}\<close>
-
-text \<open>
-  The @{tool_def latex} tool provides the basic interface for Isabelle
-  document preparation. Its usage is:
-  @{verbatim [display]
-\<open>Usage: isabelle latex [OPTIONS] [FILE]
-
-  Options are:
-    -o FORMAT    specify output format: pdf (default), bbl, idx, sty
-
-  Run LaTeX (and related tools) on FILE (default root.tex),
-  producing the specified output format.\<close>}
-
-  Appropriate {\LaTeX}-related programs are run on the input file, according
-  to the given output format: @{executable pdflatex}, @{executable bibtex}
-  (for \<^verbatim>\<open>bbl\<close>), and @{executable makeindex} (for \<^verbatim>\<open>idx\<close>). The actual commands
-  are determined from the settings environment (@{setting ISABELLE_PDFLATEX}
-  etc.).
-
-  The \<^verbatim>\<open>sty\<close> output format causes the Isabelle style files to be updated from
-  the distribution. This is useful in special situations where the document
-  sources are to be processed another time by separate tools.
-\<close>
-
-
-subsubsection \<open>Examples\<close>
-
-text \<open>
-  Invoking @{tool latex} by hand may be occasionally useful when debugging
-  failed attempts of the automatic document preparation stage of batch-mode
-  Isabelle. The abortive process leaves the sources at a certain place within
-  @{setting ISABELLE_BROWSER_INFO}, see the runtime error message for details.
-  This enables users to inspect {\LaTeX} runs in further detail, e.g.\ like
-  this:
-
-  @{verbatim [display]
-\<open>cd "$(isabelle getenv -b ISABELLE_BROWSER_INFO)/Unsorted/Test/document"
-isabelle latex -o pdf\<close>}
-\<close>
-
 end
diff --git a/src/Doc/System/Sessions.thy b/src/Doc/System/Sessions.thy
--- a/src/Doc/System/Sessions.thy
+++ b/src/Doc/System/Sessions.thy
@@ -1,836 +1,846 @@
 (*:maxLineLen=78:*)
 
 theory Sessions
 imports Base
 begin
 
 chapter \<open>Isabelle sessions and build management \label{ch:session}\<close>
 
 text \<open>
   An Isabelle \<^emph>\<open>session\<close> consists of a collection of related theories that may
   be associated with formal documents (\chref{ch:present}). There is also a
   notion of \<^emph>\<open>persistent heap\<close> image to capture the state of a session,
   similar to object-code in compiled programming languages. Thus the concept
   of session resembles that of a ``project'' in common IDE environments, but
   the specific name emphasizes the connection to interactive theorem proving:
   the session wraps-up the results of user-interaction with the prover in a
   persistent form.
 
   Application sessions are built on a given parent session, which may be built
   recursively on other parents. Following this path in the hierarchy
   eventually leads to some major object-logic session like \<open>HOL\<close>, which itself
   is based on \<open>Pure\<close> as the common root of all sessions.
 
   Processing sessions may take considerable time. Isabelle build management
   helps to organize this efficiently. This includes support for parallel build
   jobs, in addition to the multithreaded theory and proof checking that is
   already provided by the prover process itself.
 \<close>
 
 
 section \<open>Session ROOT specifications \label{sec:session-root}\<close>
 
 text \<open>
   Session specifications reside in files called \<^verbatim>\<open>ROOT\<close> within certain
   directories, such as the home locations of registered Isabelle components or
   additional project directories given by the user.
 
   The ROOT file format follows the lexical conventions of the \<^emph>\<open>outer syntax\<close>
   of Isabelle/Isar, see also @{cite "isabelle-isar-ref"}. This defines common
   forms like identifiers, names, quoted strings, verbatim text, nested
   comments etc. The grammar for @{syntax session_chapter} and @{syntax
   session_entry} is given as syntax diagram below; each ROOT file may contain
   multiple specifications like this. Chapters help to organize browser info
   (\secref{sec:info}), but have no formal meaning. The default chapter is
   ``\<open>Unsorted\<close>''.
 
   Isabelle/jEdit @{cite "isabelle-jedit"} includes a simple editing mode
   \<^verbatim>\<open>isabelle-root\<close> for session ROOT files, which is enabled by default for any
   file of that name.
 
   \<^rail>\<open>
     @{syntax_def session_chapter}: @'chapter' @{syntax name}
     ;
 
     @{syntax_def session_entry}: @'session' @{syntax system_name} groups? dir? '=' \<newline>
       (@{syntax system_name} '+')? description? options? \<newline>
       sessions? directories? (theories*) \<newline>
       (document_theories?) (document_files*) \<newline>
       (export_files*)
     ;
     groups: '(' (@{syntax name} +) ')'
     ;
     dir: @'in' @{syntax embedded}
     ;
     description: @'description' @{syntax text}
     ;
     options: @'options' opts
     ;
     opts: '[' ( (@{syntax name} '=' value | @{syntax name}) + ',' ) ']'
     ;
     value: @{syntax name} | @{syntax real}
     ;
     sessions: @'sessions' (@{syntax system_name}+)
     ;
     directories: @'directories' (dir+)
     ;
     theories: @'theories' opts? (theory_entry+)
     ;
     theory_entry: @{syntax system_name} ('(' @'global' ')')?
     ;
     document_theories: @'document_theories' (@{syntax name}+)
     ;
     document_files: @'document_files' ('(' dir ')')? (@{syntax embedded}+)
     ;
     export_files: @'export_files' ('(' dir ')')? ('[' nat ']')? \<newline>
       (@{syntax embedded}+)
   \<close>
 
   \<^descr> \isakeyword{session}~\<open>A = B + body\<close> defines a new session \<open>A\<close> based on
   parent session \<open>B\<close>, with its content given in \<open>body\<close> (imported sessions and
   theories). Note that a parent (like \<open>HOL\<close>) is mandatory in practical
   applications: only Isabelle/Pure can bootstrap itself from nothing.
 
   All such session specifications together describe a hierarchy (graph) of
   sessions, with globally unique names. The new session name \<open>A\<close> should be
   sufficiently long and descriptive to stand on its own in a potentially large
   library.
 
   \<^descr> \isakeyword{session}~\<open>A (groups)\<close> indicates a collection of groups where
   the new session is a member. Group names are uninterpreted and merely follow
   certain conventions. For example, the Isabelle distribution tags some
   important sessions by the group name called ``\<open>main\<close>''. Other projects may
   invent their own conventions, but this requires some care to avoid clashes
   within this unchecked name space.
 
   \<^descr> \isakeyword{session}~\<open>A\<close>~\isakeyword{in}~\<open>dir\<close> specifies an explicit
   directory for this session; by default this is the current directory of the
   \<^verbatim>\<open>ROOT\<close> file.
 
   All theory files are located relatively to the session directory. The prover
   process is run within the same as its current working directory.
 
   \<^descr> \isakeyword{description}~\<open>text\<close> is a free-form annotation for this
   session.
 
   \<^descr> \isakeyword{options}~\<open>[x = a, y = b, z]\<close> defines separate options
   (\secref{sec:system-options}) that are used when processing this session,
   but \<^emph>\<open>without\<close> propagation to child sessions. Note that \<open>z\<close> abbreviates \<open>z =
   true\<close> for Boolean options.
 
   \<^descr> \isakeyword{sessions}~\<open>names\<close> specifies sessions that are \<^emph>\<open>imported\<close> into
   the current name space of theories. This allows to refer to a theory \<open>A\<close>
   from session \<open>B\<close> by the qualified name \<open>B.A\<close> --- although it is loaded again
   into the current ML process, which is in contrast to a theory that is
   already present in the \<^emph>\<open>parent\<close> session.
 
   Theories that are imported from other sessions are excluded from the current
   session document.
 
   \<^descr> \isakeyword{directories}~\<open>dirs\<close> specifies additional directories for
   import of theory files via \isakeyword{theories} within \<^verbatim>\<open>ROOT\<close> or
   \<^theory_text>\<open>imports\<close> within a theory; \<open>dirs\<close> are relative to the main session
   directory (cf.\ \isakeyword{session} \dots \isakeyword{in}~\<open>dir\<close>). These
   directories need to be exclusively assigned to a unique session, without
   implicit sharing of file-system locations.
 
   \<^descr> \isakeyword{theories}~\<open>options names\<close> specifies a block of theories that
   are processed within an environment that is augmented by the given options,
   in addition to the global session options given before. Any number of blocks
   of \isakeyword{theories} may be given. Options are only active for each
   \isakeyword{theories} block separately.
 
   A theory name that is followed by \<open>(\<close>\isakeyword{global}\<open>)\<close> is treated
   literally in other session specifications or theory imports --- the normal
   situation is to qualify theory names by the session name; this ensures
   globally unique names in big session graphs. Global theories are usually the
   entry points to major logic sessions: \<open>Pure\<close>, \<open>Main\<close>, \<open>Complex_Main\<close>,
   \<open>HOLCF\<close>, \<open>IFOL\<close>, \<open>FOL\<close>, \<open>ZF\<close>, \<open>ZFC\<close> etc. Regular Isabelle applications
   should not claim any global theory names.
 
   \<^descr> \isakeyword{document_theories}~\<open>names\<close> specifies theories from other
   sessions that should be included in the generated document source directory.
   These theories need to be explicit imports in the current session, or
   implicit imports from the underlying hierarchy of parent sessions. The
   generated \<^verbatim>\<open>session.tex\<close> file is not affected: the session's {\LaTeX} setup
   needs to \<^verbatim>\<open>\input{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> generated \<^verbatim>\<open>.tex\<close> files separately.
 
   \<^descr> \isakeyword{document_files}~\<open>(\<close>\isakeyword{in}~\<open>base_dir) files\<close> lists
   source files for document preparation, typically \<^verbatim>\<open>.tex\<close> and \<^verbatim>\<open>.sty\<close> for
   {\LaTeX}. Only these explicitly given files are copied from the base
   directory to the document output directory, before formal document
   processing is started (see also \secref{sec:tool-document}). The local path
   structure of the \<open>files\<close> is preserved, which allows to reconstruct the
   original directory hierarchy of \<open>base_dir\<close>. The default \<open>base_dir\<close> is
   \<^verbatim>\<open>document\<close> within the session root directory.
 
   \<^descr> \isakeyword{export_files}~\<open>(\<close>\isakeyword{in}~\<open>target_dir) [number]
   patterns\<close> specifies theory exports that may get written to the file-system,
   e.g. via @{tool_ref build} with option \<^verbatim>\<open>-e\<close> (\secref{sec:tool-build}). The
   \<open>target_dir\<close> specification is relative to the session root directory; its
   default is \<^verbatim>\<open>export\<close>. Exports are selected via \<open>patterns\<close> as in @{tool_ref
   export} (\secref{sec:tool-export}). The number given in brackets (default:
   0) specifies elements that should be pruned from each name: it allows to
   reduce the resulting directory hierarchy at the danger of overwriting files
   due to loss of uniqueness.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   See \<^file>\<open>~~/src/HOL/ROOT\<close> for a diversity of practically relevant situations,
   although it uses relatively complex quasi-hierarchic naming conventions like
   \<^verbatim>\<open>HOL-SPARK\<close>, \<^verbatim>\<open>HOL-SPARK-Examples\<close>. An alternative is to use unqualified
   names that are relatively long and descriptive, as in the Archive of Formal
   Proofs (\<^url>\<open>https://isa-afp.org\<close>), for example.
 \<close>
 
 
 section \<open>System build options \label{sec:system-options}\<close>
 
 text \<open>
   See \<^file>\<open>~~/etc/options\<close> for the main defaults provided by the Isabelle
   distribution. Isabelle/jEdit @{cite "isabelle-jedit"} includes a simple
   editing mode \<^verbatim>\<open>isabelle-options\<close> for this file-format.
 
   The following options are particularly relevant to build Isabelle sessions,
   in particular with document preparation (\chref{ch:present}).
 
     \<^item> @{system_option_def "browser_info"} controls output of HTML browser
     info, see also \secref{sec:info}.
 
     \<^item> @{system_option_def "document"} controls document output for a
     particular session or theory; \<^verbatim>\<open>document=pdf\<close> means enabled,
     \<^verbatim>\<open>document=false\<close> means disabled (especially for particular theories).
 
     \<^item> @{system_option_def "document_output"} specifies an alternative
     directory for generated output of the document preparation system; the
     default is within the @{setting "ISABELLE_BROWSER_INFO"} hierarchy as
     explained in \secref{sec:info}. See also @{tool mkroot}, which generates a
     default configuration with output readily available to the author of the
     document.
 
     \<^item> @{system_option_def "document_variants"} specifies document variants as
     a colon-separated list of \<open>name=tags\<close> entries. The default name
     \<^verbatim>\<open>document\<close>, without additional tags.
 
     Tags are specified as a comma separated list of modifier/name pairs and
     tell {\LaTeX} how to interpret certain Isabelle command regions:
     ``\<^verbatim>\<open>+\<close>\<open>foo\<close>'' (or just ``\<open>foo\<close>'') means to keep, ``\<^verbatim>\<open>-\<close>\<open>foo\<close>'' to drop,
     and ``\<^verbatim>\<open>/\<close>\<open>foo\<close>'' to fold text tagged as \<open>foo\<close>. The builtin default is
     equivalent to the tag specification
     ``\<^verbatim>\<open>+document,+theory,+proof,+ML,+visible,-invisible,+important,+unimportant\<close>'';
     see also the {\LaTeX} macros \<^verbatim>\<open>\isakeeptag\<close>, \<^verbatim>\<open>\isadroptag\<close>, and
     \<^verbatim>\<open>\isafoldtag\<close>, in \<^file>\<open>~~/lib/texinputs/isabelle.sty\<close>.
 
     In contrast, \<^verbatim>\<open>document_variants=document:outline=/proof,/ML\<close> indicates
     two documents: the one called \<^verbatim>\<open>document\<close> with default tags, and the other
     called \<^verbatim>\<open>outline\<close> where proofs and ML sections are folded.
 
     Document variant names are just a matter of conventions. It is also
     possible to use different document variant names (without tags) for
     different document root entries, see also \secref{sec:tool-document}.
 
     \<^item> @{system_option_def "document_tags"} specifies alternative command tags
     as a comma-separated list of items: either ``\<open>command\<close>\<^verbatim>\<open>%\<close>\<open>tag\<close>'' for a
     specific command, or ``\<^verbatim>\<open>%\<close>\<open>tag\<close>'' as default for all other commands. This
     is occasionally useful to control the global visibility of commands via
     session options (e.g.\ in \<^verbatim>\<open>ROOT\<close>).
 
+    \<^item> @{system_option_def "document_bibliography"} explicitly enables the use
+    of \<^verbatim>\<open>bibtex\<close>; the default is to check the presence of \<^verbatim>\<open>root.bib\<close>, but it
+    could have a different name.
+
+    \<^item> @{system_option_def "document_preprocessor"} specifies the name of an
+    executable that is run within the document output directory, after
+    preparing the document sources and before the actual build process. This
+    allows to apply adhoc patches, without requiring a separate \<^verbatim>\<open>build\<close>
+    script.
+
     \<^item> @{system_option_def "threads"} determines the number of worker threads
     for parallel checking of theories and proofs. The default \<open>0\<close> means that a
     sensible maximum value is determined by the underlying hardware. For
     machines with many cores or with hyperthreading, this is often requires
     manual adjustment (on the command-line or within personal settings or
     preferences, not within a session \<^verbatim>\<open>ROOT\<close>).
 
     \<^item> @{system_option_def "condition"} specifies a comma-separated list of
     process environment variables (or Isabelle settings) that are required for
     the subsequent theories to be processed. Conditions are considered
     ``true'' if the corresponding environment value is defined and non-empty.
 
     \<^item> @{system_option_def "timeout"} and @{system_option_def "timeout_scale"}
     specify a real wall-clock timeout for the session as a whole: the two
     values are multiplied and taken as the number of seconds. Typically,
     @{system_option "timeout"} is given for individual sessions, and
     @{system_option "timeout_scale"} as global adjustment to overall hardware
     performance.
 
     The timer is controlled outside the ML process by the JVM that runs
     Isabelle/Scala. Thus it is relatively reliable in canceling processes that
     get out of control, even if there is a deadlock without CPU time usage.
 
     \<^item> @{system_option_def "profiling"} specifies a mode for global ML
     profiling. Possible values are the empty string (disabled), \<^verbatim>\<open>time\<close> for
     \<^ML>\<open>profile_time\<close> and \<^verbatim>\<open>allocations\<close> for \<^ML>\<open>profile_allocations\<close>.
     Results appear near the bottom of the session log file.
 
     \<^item> @{system_option_def "system_heaps"} determines the directories for
     session heap images: \<^path>\<open>$ISABELLE_HEAPS\<close> is the user directory and
     \<^path>\<open>$ISABELLE_HEAPS_SYSTEM\<close> the system directory (usually within the
     Isabelle application). For \<^verbatim>\<open>system_heaps=false\<close>, heaps are stored in the
     user directory and may be loaded from both directories. For
     \<^verbatim>\<open>system_heaps=true\<close>, store and load happens only in the system directory.
 
   The @{tool_def options} tool prints Isabelle system options. Its
   command-line usage is:
   @{verbatim [display]
 \<open>Usage: isabelle options [OPTIONS] [MORE_OPTIONS ...]
 
   Options are:
     -b           include $ISABELLE_BUILD_OPTIONS
     -g OPTION    get value of OPTION
     -l           list options
     -x FILE      export to FILE in YXML format
 
   Report Isabelle system options, augmented by MORE_OPTIONS given as
   arguments NAME=VAL or NAME.\<close>}
 
   The command line arguments provide additional system options of the form
   \<open>name\<close>\<^verbatim>\<open>=\<close>\<open>value\<close> or \<open>name\<close> for Boolean options.
 
   Option \<^verbatim>\<open>-b\<close> augments the implicit environment of system options by the ones
   of @{setting ISABELLE_BUILD_OPTIONS}, cf.\ \secref{sec:tool-build}.
 
   Option \<^verbatim>\<open>-g\<close> prints the value of the given option. Option \<^verbatim>\<open>-l\<close> lists all
   options with their declaration and current value.
 
   Option \<^verbatim>\<open>-x\<close> specifies a file to export the result in YXML format, instead
   of printing it in human-readable form.
 \<close>
 
 
 section \<open>Invoking the build process \label{sec:tool-build}\<close>
 
 text \<open>
   The @{tool_def build} tool invokes the build process for Isabelle sessions.
   It manages dependencies between sessions, related sources of theories and
   auxiliary files, and target heap images. Accordingly, it runs instances of
   the prover process with optional document preparation. Its command-line
   usage is:\<^footnote>\<open>Isabelle/Scala provides the same functionality via
   \<^scala_method>\<open>isabelle.Build.build\<close>.\<close>
   @{verbatim [display]
 \<open>Usage: isabelle build [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -N           cyclic shuffling of NUMA CPU nodes (performance tuning)
     -P DIR       enable HTML/PDF presentation in directory (":" for default)
     -R           refer to requirements of selected sessions
     -S           soft build: only observe changes of sources, not heap images
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b           build heap images
     -c           clean build
     -d DIR       include session directory
     -e           export files from session specification into file-system
     -f           fresh build
     -g NAME      select session group NAME
     -j INT       maximum number of parallel jobs (default 1)
     -k KEYWORD   check theory sources for conflicts with proposed keywords
     -l           list session source files
     -n           no build -- test dependencies only
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Build and manage Isabelle sessions, depending on implicit settings:
 
   ISABELLE_TOOL_JAVA_OPTIONS="..."
   ISABELLE_BUILD_OPTIONS="..."
 
   ML_PLATFORM="..."
   ML_HOME="..."
   ML_SYSTEM="..."
   ML_OPTIONS="..."\<close>}
 
   \<^medskip>
   Isabelle sessions are defined via session ROOT files as described in
   (\secref{sec:session-root}). The totality of sessions is determined by
   collecting such specifications from all Isabelle component directories
   (\secref{sec:components}), augmented by more directories given via options
   \<^verbatim>\<open>-d\<close>~\<open>DIR\<close> on the command line. Each such directory may contain a session
   \<^verbatim>\<open>ROOT\<close> file with several session specifications.
 
   Any session root directory may refer recursively to further directories of
   the same kind, by listing them in a catalog file \<^verbatim>\<open>ROOTS\<close> line-by-line. This
   helps to organize large collections of session specifications, or to make
   \<^verbatim>\<open>-d\<close> command line options persistent (e.g.\ in
   \<^verbatim>\<open>$ISABELLE_HOME_USER/ROOTS\<close>).
 
   \<^medskip>
   The subset of sessions to be managed is determined via individual \<open>SESSIONS\<close>
   given as command-line arguments, or session groups that are given via one or
   more options \<^verbatim>\<open>-g\<close>~\<open>NAME\<close>. Option \<^verbatim>\<open>-a\<close> selects all sessions. The build tool
   takes session dependencies into account: the set of selected sessions is
   completed by including all ancestors.
 
   \<^medskip>
   One or more options \<^verbatim>\<open>-B\<close>~\<open>NAME\<close> specify base sessions to be included (all
   descendants wrt.\ the session parent or import graph).
 
   \<^medskip>
   One or more options \<^verbatim>\<open>-x\<close>~\<open>NAME\<close> specify sessions to be excluded (all
   descendants wrt.\ the session parent or import graph). Option \<^verbatim>\<open>-X\<close> is
   analogous to this, but excluded sessions are specified by session group
   membership.
 
   \<^medskip>
   Option \<^verbatim>\<open>-R\<close> reverses the selection in the sense that it refers to its
   requirements: all ancestor sessions excluding the original selection. This
   allows to prepare the stage for some build process with different options,
   before running the main build itself (without option \<^verbatim>\<open>-R\<close>).
 
   \<^medskip>
   Option \<^verbatim>\<open>-D\<close> is similar to \<^verbatim>\<open>-d\<close>, but selects all sessions that are defined
   in the given directories.
 
   \<^medskip>
   Option \<^verbatim>\<open>-S\<close> indicates a ``soft build'': the selection is restricted to
   those sessions that have changed sources (according to actually imported
   theories). The status of heap images is ignored.
 
   \<^medskip>
   The build process depends on additional options
   (\secref{sec:system-options}) that are passed to the prover eventually. The
   settings variable @{setting_ref ISABELLE_BUILD_OPTIONS} allows to provide
   additional defaults, e.g.\ \<^verbatim>\<open>ISABELLE_BUILD_OPTIONS="document=pdf threads=4"\<close>.
   Moreover, the environment of system build options may be augmented on the
   command line via \<^verbatim>\<open>-o\<close>~\<open>name\<close>\<^verbatim>\<open>=\<close>\<open>value\<close> or \<^verbatim>\<open>-o\<close>~\<open>name\<close>, which abbreviates
   \<^verbatim>\<open>-o\<close>~\<open>name\<close>\<^verbatim>\<open>=true\<close> for Boolean options. Multiple occurrences of \<^verbatim>\<open>-o\<close> on
   the command-line are applied in the given order.
 
   \<^medskip>
   Option \<^verbatim>\<open>-P\<close> enables PDF/HTML presentation in the given directory, where
   ``\<^verbatim>\<open>-P:\<close>'' refers to the default @{setting_ref ISABELLE_BROWSER_INFO} (or
   @{setting_ref ISABELLE_BROWSER_INFO_SYSTEM}). This applies only to
   explicitly selected sessions; note that option \<open>-R\<close> allows to select all
   requirements separately.
 
   \<^medskip>
   Option \<^verbatim>\<open>-b\<close> ensures that heap images are produced for all selected
   sessions. By default, images are only saved for inner nodes of the hierarchy
   of sessions, as required for other sessions to continue later on.
 
   \<^medskip>
   Option \<^verbatim>\<open>-c\<close> cleans the selected sessions (all descendants wrt.\ the session
   parent or import graph) before performing the specified build operation.
 
   \<^medskip>
   Option \<^verbatim>\<open>-e\<close> executes the \isakeyword{export_files} directives from the ROOT
   specification of all explicitly selected sessions: the status of the session
   build database needs to be OK, but the session could have been built
   earlier. Using \isakeyword{export_files}, a session may serve as abstract
   interface for add-on build artefacts, but these are only materialized on
   explicit request: without option \<^verbatim>\<open>-e\<close> there is no effect on the physical
   file-system yet.
 
   \<^medskip>
   Option \<^verbatim>\<open>-f\<close> forces a fresh build of all selected sessions and their
   requirements.
 
   \<^medskip>
   Option \<^verbatim>\<open>-n\<close> omits the actual build process after the preparatory stage
   (including optional cleanup). Note that the return code always indicates the
   status of the set of selected sessions.
 
   \<^medskip>
   Option \<^verbatim>\<open>-j\<close> specifies the maximum number of parallel build jobs (prover
   processes). Each prover process is subject to a separate limit of parallel
   worker threads, cf.\ system option @{system_option_ref threads}.
 
   \<^medskip>
   Option \<^verbatim>\<open>-N\<close> enables cyclic shuffling of NUMA CPU nodes. This may help
   performance tuning on Linux servers with separate CPU/memory modules.
 
   \<^medskip>
   Option \<^verbatim>\<open>-v\<close> increases the general level of verbosity. Option \<^verbatim>\<open>-l\<close> lists
   the source files that contribute to a session.
 
   \<^medskip>
   Option \<^verbatim>\<open>-k\<close> specifies a newly proposed keyword for outer syntax (multiple
   uses allowed). The theory sources are checked for conflicts wrt.\ this
   hypothetical change of syntax, e.g.\ to reveal occurrences of identifiers
   that need to be quoted.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Build a specific logic image:
   @{verbatim [display] \<open>isabelle build -b HOLCF\<close>}
 
   \<^smallskip>
   Build the main group of logic images:
   @{verbatim [display] \<open>isabelle build -b -g main\<close>}
 
   \<^smallskip>
   Build all descendants (and requirements) of \<^verbatim>\<open>FOL\<close> and \<^verbatim>\<open>ZF\<close>:
   @{verbatim [display] \<open>isabelle build -B FOL -B ZF\<close>}
 
   \<^smallskip>
   Build all sessions where sources have changed (ignoring heaps):
   @{verbatim [display] \<open>isabelle build -a -S\<close>}
 
   \<^smallskip>
   Provide a general overview of the status of all Isabelle sessions, without
   building anything:
   @{verbatim [display] \<open>isabelle build -a -n -v\<close>}
 
   \<^smallskip>
   Build all sessions with HTML browser info and PDF document preparation:
   @{verbatim [display] \<open>isabelle build -a -o browser_info -o document=pdf\<close>}
 
   \<^smallskip>
   Build all sessions with a maximum of 8 parallel prover processes and 4
   worker threads each (on a machine with many cores):
   @{verbatim [display] \<open>isabelle build -a -j8 -o threads=4\<close>}
 
   \<^smallskip>
   Build some session images with cleanup of their descendants, while retaining
   their ancestry:
   @{verbatim [display] \<open>isabelle build -b -c HOL-Library HOL-Algebra\<close>}
 
   \<^smallskip>
   Clean all sessions without building anything:
   @{verbatim [display] \<open>isabelle build -a -n -c\<close>}
 
   \<^smallskip>
   Build all sessions from some other directory hierarchy, according to the
   settings variable \<^verbatim>\<open>AFP\<close> that happens to be defined inside the Isabelle
   environment:
   @{verbatim [display] \<open>isabelle build -D '$AFP'\<close>}
 
   \<^smallskip>
   Inform about the status of all sessions required for AFP, without building
   anything yet:
   @{verbatim [display] \<open>isabelle build -D '$AFP' -R -v -n\<close>}
 \<close>
 
 
 section \<open>Print messages from build database \label{sec:tool-log}\<close>
 
 text \<open>
   The @{tool_def "log"} tool prints prover messages from the build
   database of the given session. Its command-line usage is:
 
   @{verbatim [display]
 \<open>Usage: isabelle log [OPTIONS] SESSION
 
   Options are:
     -T NAME      restrict to given theories (multiple options possible)
     -U           output Unicode symbols
     -m MARGIN    margin for pretty printing (default: 76.0)
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
 
   Print messages from the build database of the given session, without any
   checks against current sources: results from a failed build can be
   printed as well.\<close>}
 
   The specified session database is taken as is, independently of the current
   session structure and theories sources. The order of messages follows the
   source positions of source files; thus the erratic evaluation of parallel
   processing rarely matters. There is \<^emph>\<open>no\<close> implicit build process involved,
   so it is possible to retrieve error messages from a failed session as well.
 
   \<^medskip> Option \<^verbatim>\<open>-o\<close> allows to change system options, as in @{tool build}
   (\secref{sec:tool-build}). This may affect the storage space for the build
   database, notably via @{system_option system_heaps}, or @{system_option
   build_database_server} and its relatives.
 
   \<^medskip> Option \<^verbatim>\<open>-T\<close> restricts output to given theories: multiple entries are
   possible by repeating this option on the command-line. The default is to
   refer to \<^emph>\<open>all\<close> theories that were used in original session build process.
 
   \<^medskip> Options \<^verbatim>\<open>-m\<close> and \<^verbatim>\<open>-U\<close> modify pretty printing and output of Isabelle
   symbols. The default is for an old-fashioned ASCII terminal at 80 characters
   per line (76 + 4 characters to prefix warnings or errors).
 
   \<^medskip> Option \<^verbatim>\<open>-v\<close> prints all messages from the session database, including
   extra information and tracing messages etc.
 \<close>
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Print messages from theory \<^verbatim>\<open>HOL.Nat\<close> of session \<^verbatim>\<open>HOL\<close>, using Unicode
   rendering of Isabelle symbols and a margin of 100 characters:
   @{verbatim [display] \<open>isabelle log -T HOL.Nat -U -m 100 HOL\<close>}
 \<close>
 
 
 section \<open>Retrieve theory exports \label{sec:tool-export}\<close>
 
 text \<open>
   The @{tool_def "export"} tool retrieves theory exports from the session
   database. Its command-line usage is: @{verbatim [display]
 \<open>Usage: isabelle export [OPTIONS] SESSION
 
   Options are:
     -O DIR       output directory for exported files (default: "export")
     -d DIR       include session directory
     -l           list exports
     -n           no build of session
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -p NUM       prune path of exported files by NUM elements
     -x PATTERN   extract files matching pattern (e.g.\ "*:**" for all)
 
   List or export theory exports for SESSION: named blobs produced by
   isabelle build. Option -l or -x is required; option -x may be repeated.
 
   The PATTERN language resembles glob patterns in the shell, with ? and *
   (both excluding ":" and "/"), ** (excluding ":"), and [abc] or [^abc],
   and variants {pattern1,pattern2,pattern3}.\<close>}
 
   \<^medskip>
   The specified session is updated via @{tool build}
   (\secref{sec:tool-build}), with the same options \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-o\<close>. The option
   \<^verbatim>\<open>-n\<close> suppresses the implicit build process: it means that a potentially
   outdated session database is used!
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> lists all stored exports, with compound names
   \<open>theory\<close>\<^verbatim>\<open>:\<close>\<open>name\<close>.
 
   \<^medskip>
   Option \<^verbatim>\<open>-x\<close> extracts stored exports whose compound name matches the given
   pattern. Note that wild cards ``\<^verbatim>\<open>?\<close>'' and ``\<^verbatim>\<open>*\<close>'' do not match the
   separators ``\<^verbatim>\<open>:\<close>'' and ``\<^verbatim>\<open>/\<close>''; the wild card \<^verbatim>\<open>**\<close> matches over directory
   name hierarchies separated by ``\<^verbatim>\<open>/\<close>''. Thus the pattern ``\<^verbatim>\<open>*:**\<close>'' matches
   \<^emph>\<open>all\<close> theory exports. Multiple options \<^verbatim>\<open>-x\<close> refer to the union of all
   specified patterns.
 
   Option \<^verbatim>\<open>-O\<close> specifies an alternative output directory for option \<^verbatim>\<open>-x\<close>: the
   default is \<^verbatim>\<open>export\<close> within the current directory. Each theory creates its
   own sub-directory hierarchy, using the session-qualified theory name.
 
   Option \<^verbatim>\<open>-p\<close> specifies the number of elements that should be pruned from
   each name: it allows to reduce the resulting directory hierarchy at the
   danger of overwriting files due to loss of uniqueness.
 \<close>
 
 
 section \<open>Dump PIDE session database \label{sec:tool-dump}\<close>
 
 text \<open>
   The @{tool_def "dump"} tool dumps information from the cumulative PIDE
   session database (which is processed on the spot). Its command-line usage
   is: @{verbatim [display]
 \<open>Usage: isabelle dump [OPTIONS] [SESSIONS ...]
 
   Options are:
     -A NAMES     dump named aspects (default: ...)
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -O DIR       output directory for dumped files (default: "dump")
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b NAME      base logic image (default "Pure")
     -d DIR       include session directory
     -g NAME      select session group NAME
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Dump cumulative PIDE session database, with the following aspects:
     ...\<close>}
 
   \<^medskip> Options \<^verbatim>\<open>-B\<close>, \<^verbatim>\<open>-D\<close>, \<^verbatim>\<open>-R\<close>, \<^verbatim>\<open>-X\<close>, \<^verbatim>\<open>-a\<close>, \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-g\<close>, \<^verbatim>\<open>-x\<close> and the
   remaining command-line arguments specify sessions as in @{tool build}
   (\secref{sec:tool-build}): the cumulative PIDE database of all their loaded
   theories is dumped to the output directory of option \<^verbatim>\<open>-O\<close> (default: \<^verbatim>\<open>dump\<close>
   in the current directory).
 
   \<^medskip> Option \<^verbatim>\<open>-b\<close> specifies an optional base logic image, for improved
   scalability of the PIDE session. Its theories are only processed if it is
   included in the overall session selection.
 
   \<^medskip> Option \<^verbatim>\<open>-o\<close> overrides Isabelle system options as for @{tool build}
   (\secref{sec:tool-build}).
 
   \<^medskip> Option \<^verbatim>\<open>-v\<close> increases the general level of verbosity.
 
   \<^medskip> Option \<^verbatim>\<open>-A\<close> specifies named aspects of the dump, as a comma-separated
   list. The default is to dump all known aspects, as given in the command-line
   usage of the tool. The underlying Isabelle/Scala operation
   \<^scala_method>\<open>isabelle.Dump.dump\<close> takes aspects as user-defined
   operations on the final PIDE state and document version. This allows to
   imitate Prover IDE rendering under program control.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Dump all Isabelle/ZF sessions (which are rather small):
   @{verbatim [display] \<open>isabelle dump -v -B ZF\<close>}
 
   \<^smallskip>
   Dump the quite substantial \<^verbatim>\<open>HOL-Analysis\<close> session, with full bootstrap
   from Isabelle/Pure:
   @{verbatim [display] \<open>isabelle dump -v HOL-Analysis\<close>}
 
   \<^smallskip>
   Dump all sessions connected to HOL-Analysis, using main Isabelle/HOL as
   basis:
   @{verbatim [display] \<open>isabelle dump -v -b HOL -B HOL-Analysis\<close>}
 
   This results in uniform PIDE markup for everything, except for the
   Isabelle/Pure bootstrap process itself. Producing that on the spot requires
   several GB of heap space, both for the Isabelle/Scala and Isabelle/ML
   process (in 64bit mode). Here are some relevant settings (\secref{sec:boot})
   for such ambitious applications:
   @{verbatim [display]
 \<open>ISABELLE_TOOL_JAVA_OPTIONS="-Xms4g -Xmx32g -Xss16m"
 ML_OPTIONS="--minheap 4G --maxheap 32G"
 \<close>}
 \<close>
 
 
 section \<open>Update theory sources based on PIDE markup \label{sec:tool-update}\<close>
 
 text \<open>
   The @{tool_def "update"} tool updates theory sources based on markup that is
   produced from a running PIDE session (similar to @{tool dump}
   \secref{sec:tool-dump}). Its command-line usage is: @{verbatim [display]
 \<open>Usage: isabelle update [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b NAME      base logic image (default "Pure")
     -d DIR       include session directory
     -g NAME      select session group NAME
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -u OPT       overide update option: shortcut for "-o update_OPT"
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Update theory sources based on PIDE markup.\<close>}
 
   \<^medskip> Options \<^verbatim>\<open>-B\<close>, \<^verbatim>\<open>-D\<close>, \<^verbatim>\<open>-R\<close>, \<^verbatim>\<open>-X\<close>, \<^verbatim>\<open>-a\<close>, \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-g\<close>, \<^verbatim>\<open>-x\<close> and the
   remaining command-line arguments specify sessions as in @{tool build}
   (\secref{sec:tool-build}) or @{tool dump} (\secref{sec:tool-dump}).
 
   \<^medskip> Option \<^verbatim>\<open>-b\<close> specifies an optional base logic image, for improved
   scalability of the PIDE session. Its theories are only processed if it is
   included in the overall session selection.
 
   \<^medskip> Option \<^verbatim>\<open>-v\<close> increases the general level of verbosity.
 
   \<^medskip> Option \<^verbatim>\<open>-o\<close> overrides Isabelle system options as for @{tool build}
   (\secref{sec:tool-build}). Option \<^verbatim>\<open>-u\<close> refers to specific \<^verbatim>\<open>update\<close>
   options, by relying on naming convention: ``\<^verbatim>\<open>-u\<close>~\<open>OPT\<close>'' is a shortcut for
   ``\<^verbatim>\<open>-o\<close>~\<^verbatim>\<open>update_\<close>\<open>OPT\<close>''.
 
   \<^medskip> The following update options are supported:
 
     \<^item> @{system_option update_inner_syntax_cartouches} to update inner syntax
     (types, terms, etc.)~to use cartouches, instead of double-quoted strings
     or atomic identifiers. For example, ``\<^theory_text>\<open>lemma \<doublequote>x =
     x\<doublequote>\<close>'' is replaced by ``\<^theory_text>\<open>lemma \<open>x = x\<close>\<close>'', and ``\<^theory_text>\<open>assume
     A\<close>'' is replaced by ``\<^theory_text>\<open>assume \<open>A\<close>\<close>''.
 
     \<^item> @{system_option update_mixfix_cartouches} to update mixfix templates to
     use cartouches instead of double-quoted strings. For example, ``\<^theory_text>\<open>(infixl
     \<doublequote>+\<doublequote> 65)\<close>'' is replaced by ``\<^theory_text>\<open>(infixl \<open>+\<close>
     65)\<close>''.
 
     \<^item> @{system_option update_control_cartouches} to update antiquotations to
     use the compact form with control symbol and cartouche argument. For
     example, ``\<open>@{term \<doublequote>x + y\<doublequote>}\<close>'' is replaced by
     ``\<open>\<^term>\<open>x + y\<close>\<close>'' (the control symbol is literally \<^verbatim>\<open>\<^term>\<close>.)
 
     \<^item> @{system_option update_path_cartouches} to update file-system paths to
     use cartouches: this depends on language markup provided by semantic
     processing of parsed input.
 
   It is also possible to produce custom updates in Isabelle/ML, by reporting
   \<^ML>\<open>Markup.update\<close> with the precise source position and a replacement
   text. This operation should be made conditional on specific system options,
   similar to the ones above. Searching the above option names in ML sources of
   \<^dir>\<open>$ISABELLE_HOME/src/Pure\<close> provides some examples.
 
   Updates can be in conflict by producing nested or overlapping edits: this
   may require to run @{tool update} multiple times.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Update some cartouche notation in all theory sources required for session
   \<^verbatim>\<open>HOL-Analysis\<close> (and ancestors):
 
   @{verbatim [display] \<open>isabelle update -u mixfix_cartouches HOL-Analysis\<close>}
 
   \<^smallskip> Update the same for all application sessions based on \<^verbatim>\<open>HOL-Analysis\<close> ---
   using its image is taken starting point (for reduced resource requirements):
 
   @{verbatim [display] \<open>isabelle update -u mixfix_cartouches -b HOL-Analysis -B HOL-Analysis\<close>}
 
   \<^smallskip> Update sessions that build on \<^verbatim>\<open>HOL-Proofs\<close>, which need to be run
   separately with special options as follows:
 
   @{verbatim [display] \<open>isabelle update -u mixfix_cartouches -l HOL-Proofs -B HOL-Proofs
   -o record_proofs=2\<close>}
 
   \<^smallskip> See also the end of \secref{sec:tool-dump} for hints on increasing
   Isabelle/ML heap sizes for very big PIDE processes that include many
   sessions, notably from the Archive of Formal Proofs.
 \<close>
 
 
 section \<open>Explore sessions structure\<close>
 
 text \<open>
   The @{tool_def "sessions"} tool explores the sessions structure. Its
   command-line usage is:
   @{verbatim [display]
 \<open>Usage: isabelle sessions [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -d DIR       include session directory
     -g NAME      select session group NAME
     -x NAME      exclude session NAME and all descendants
 
   Explore the structure of Isabelle sessions and print result names in
   topological order (on stdout).\<close>}
 
   Arguments and options for session selection resemble @{tool build}
   (\secref{sec:tool-build}).
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   All sessions of the Isabelle distribution:
   @{verbatim [display] \<open>isabelle sessions -a\<close>}
 
   \<^medskip>
   Sessions that are based on \<^verbatim>\<open>ZF\<close> (and required by it):
   @{verbatim [display] \<open>isabelle sessions -B ZF\<close>}
 
   \<^medskip>
   All sessions of Isabelle/AFP (based in directory \<^path>\<open>AFP\<close>):
   @{verbatim [display] \<open>isabelle sessions -D AFP/thys\<close>}
 
   \<^medskip>
   Sessions required by Isabelle/AFP (based in directory \<^path>\<open>AFP\<close>):
   @{verbatim [display] \<open>isabelle sessions -R -D AFP/thys\<close>}
 \<close>
 
 end
diff --git a/src/Doc/System/document/build b/src/Doc/System/document/build
deleted file mode 100755
--- a/src/Doc/System/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/System/document/root.tex b/src/Doc/System/document/root.tex
--- a/src/Doc/System/document/root.tex
+++ b/src/Doc/System/document/root.tex
@@ -1,49 +1,49 @@
 \documentclass[12pt,a4paper]{report}
 \usepackage[T1]{fontenc}
 \usepackage{supertabular}
 \usepackage{graphicx}
 \usepackage{iman,extra,isar}
 \usepackage[nohyphen,strings]{underscore}
 \usepackage{isabelle,isabellesym}
 \usepackage{railsetup}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 
 \isadroptag{theory}
 
 \isabellestyle{literal}
 \def\isastylett{\footnotesize\tt}
 
-\title{\includegraphics[scale=0.5]{isabelle} \\[4ex] The Isabelle System Manual}
+\title{\includegraphics[scale=0.5]{isabelle_logo} \\[4ex] The Isabelle System Manual}
 
 \author{\emph{Makarius Wenzel}}
 
 \makeindex
 
 
 \begin{document}
 
 \maketitle 
 \pagenumbering{roman} \tableofcontents \clearfirst
 
 \input{Environment.tex}
 \input{Sessions.tex}
 \input{Presentation.tex}
 \input{Server.tex}
 \input{Scala.tex}
 \input{Phabricator.tex}
 \input{Misc.tex}
 
 \begingroup
   \tocentry{\bibname}
   \bibliographystyle{abbrv} \small\raggedright\frenchspacing
   \bibliography{manual}
 \endgroup
 
 \tocentry{\indexname}
 \printindex
 
 \end{document}
diff --git a/src/Doc/Tutorial/document/build b/src/Doc/Tutorial/document/build
--- a/src/Doc/Tutorial/document/build
+++ b/src/Doc/Tutorial/document/build
@@ -1,14 +1,10 @@
 #!/usr/bin/env bash
 
 set -e
 
-FORMAT="$1"
-VARIANT="$2"
-
-isabelle logo HOL
-isabelle latex -o "$FORMAT"
-isabelle latex -o bbl
+$ISABELLE_LUALATEX root
+$ISABELLE_BIBTEX root
+$ISABELLE_LUALATEX root
+$ISABELLE_LUALATEX root
 ./isa-index root
-isabelle latex -o "$FORMAT"
-[ -f root.out ] && "$ISABELLE_HOME/src/Doc/fixbookmarks" root.out
-isabelle latex -o "$FORMAT"
+$ISABELLE_LUALATEX root
diff --git a/src/Doc/Tutorial/document/isa-index b/src/Doc/Tutorial/document/isa-index
--- a/src/Doc/Tutorial/document/isa-index
+++ b/src/Doc/Tutorial/document/isa-index
@@ -1,23 +1,23 @@
 #! /bin/sh
 #
 #sedindex - shell script to create indexes, preprocessing LaTeX's .idx file
 #
 #  puts strings prefixed by * into \tt font
 #    terminator characters for strings are |!@{}
 #
 # a space terminates the \tt part to allow \index{*notE theorem}, etc.
 #
 # note that makeindex uses a dboule quote (") to delimit special characters.
 #
 # change *"X"Y"Z"W  to  "X"Y"Z"W@{\tt "X"Y"Z"W}
 # change *"X"Y"Z    to  "X"Y"Z@{\tt "X"Y"Z}
 # change *"X"Y      to  "X"Y@{\tt "X"Y}
 # change *"X        to  "X@{\tt "X}
 # change *IDENT  to  IDENT@{\tt IDENT}  
 #    where IDENT is any string not containing | ! or @
 # FOUR backslashes: to escape the shell AND sed
 sed -e "s~\*\(\".\".\".\".\)~\1@\\\\isa {\1}~g
 s~\*\(\".\".\".\)~\1@\\\\isa {\1}~g
 s~\*\(\".\".\)~\1@\\\\isa {\1}~g
 s~\*\(\".\)~\1@\\\\isa {\1}~g
-s~\*\([^ |!@{}][^ |!@{}]*\)~\1@\\\\isa {\1}~g" $1.idx | makeindex -c -q -o $1.ind
+s~\*\([^ |!@{}][^ |!@{}]*\)~\1@\\\\isa {\1}~g" $1.idx | $ISABELLE_MAKEINDEX -o $1.ind
diff --git a/src/Doc/Tutorial/document/root.tex b/src/Doc/Tutorial/document/root.tex
--- a/src/Doc/Tutorial/document/root.tex
+++ b/src/Doc/Tutorial/document/root.tex
@@ -1,97 +1,97 @@
 \documentclass{article}
 \usepackage{cl2emono-modified,isabelle,isabellesym}
 \usepackage{proof,amsmath,amsfonts,amssymb}
 \usepackage{wasysym,verbatim,graphicx,tutorial,ttbox,comment}
 \usepackage{eurosym}
 \usepackage{pdfsetup}   
 %last package!
 
 \remarkstrue          %TRUE causes remarks to be displayed (as marginal notes)
 %\remarksfalse
 
 \makeindex
 
 \index{conditional expressions|see{\isa{if} expressions}}
 \index{primitive recursion|see{recursion, primitive}}
 \index{product type|see{pairs and tuples}}
 \index{structural induction|see{induction, structural}}
 \index{termination|see{functions, total}}
 \index{tuples|see{pairs and tuples}}
 \index{*<*lex*>|see{lexicographic product}}
 
 \underscoreoff
 
 \setcounter{secnumdepth}{2} \setcounter{tocdepth}{2}  %% {secnumdepth}{2}???
 
 \pagestyle{headings}
 
 
 \begin{document}
 \title{
 \begin{center}
-\includegraphics[scale=.8]{isabelle_hol}
+\includegraphics[scale=.8]{isabelle_logo}
        \\ \vspace{0.5cm} A Proof Assistant for Higher-Order Logic
 \end{center}}
 \author{Tobias Nipkow \quad Lawrence C. Paulson \quad Markus Wenzel%\\[1ex]
 %Technische Universit{\"a}t M{\"u}nchen \\
 %Institut f{\"u}r Informatik \\[1ex]
 %University of Cambridge\\
 %Computer Laboratory
 }
 \pagenumbering{roman}
 \maketitle
 \newpage
 
 %\setcounter{page}{5}
 %\vspace*{\fill}
 %\begin{center}
 %\LARGE In memoriam \\[1ex]
 %{\sc Annette Schumann}\\[1ex]
 %1959 -- 2001
 %\end{center}
 %\vspace*{\fill}
 %\vspace*{\fill}
 %\newpage
 
 \input{preface}
 
 \tableofcontents
 
 \cleardoublepage\pagenumbering{arabic}
 
 \part{Elementary Techniques}
 \input{basics}
 \input{fp}
 \input{documents0}
 
 \part{Logic and Sets}
 \input{rules}
 \input{sets}
 \input{inductive0}
 
 \part{Advanced Material}
 \input{types0}
 \input{advanced0}
 \input{protocol}
 
 \markboth{}{}
 \cleardoublepage
 \vspace*{\fill}
 \begin{flushright}
 \begin{tabular}{l}
 {\large\sf\slshape You know my methods. Apply them!}\\[1ex]
 Sherlock Holmes
 \end{tabular}
 \end{flushright}
 \vspace*{\fill}
 \vspace*{\fill}
 
 \underscoreoff
 
 \input{appendix0}
 
 \bibliographystyle{plain}
 \bibliography{manual}
 \underscoreoff
 \printindex
 \end{document}
diff --git a/src/Doc/Tutorial/document/tutorial.sty b/src/Doc/Tutorial/document/tutorial.sty
--- a/src/Doc/Tutorial/document/tutorial.sty
+++ b/src/Doc/Tutorial/document/tutorial.sty
@@ -1,191 +1,189 @@
 % tutorial.sty : Isabelle Tutorial Page Layout
 %
 \typeout{Document Style tutorial. Released 9 July 2001}
 
 \hyphenation{Isa-belle man-u-script man-u-scripts ap-pen-dix mut-u-al-ly}
 \hyphenation{data-type data-types co-data-type co-data-types }
 
 %usage: \iflabelundefined{LABEL}{if not defined}{if defined}
 \newcommand{\iflabelundefined}[1]{\@ifundefined{r@#1}}
 
 
 %%%INDEXING  use isa-index to process the index
 
 \newcommand\seealso[2]{\emph{see also} #1}
 \usepackage{makeidx}
 
 %index, putting page numbers of definitions in boldface
 \def\bold#1{\textbf{#1}}
 \newcommand\fnote[1]{#1n}
 \newcommand\indexbold[1]{\index{#1|bold}}
 
 % The alternative to \protect\isa in the indexing macros is
 % \noexpand\noexpand \noexpand\isa
 % need TWO levels of \noexpand to delay the expansion of \isa:
 %  the \noexpand\noexpand will leave one \noexpand, to be given to the
 %  (still unexpanded) \isa token.  See TeX by Topic, page 122.
 
 %%%% for indexing constants, symbols, theorems, ...
 \newcommand\cdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (constant)}}
 \newcommand\sdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (symbol)}}
 \newcommand\sdxpos[2]{\isa{#1}\index{#2@\protect\isa{#1} (symbol)}}
 
 \newcommand\tdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (theorem)}}
 \newcommand\tdxbold[1]{\isa{#1}\index{#1@\protect\isa{#1} (theorem)|bold}}
 
 \newcommand\cldx[1]{\isa{#1}\index{#1@\protect\isa{#1} (class)}}
 \newcommand\tydx[1]{\isa{#1}\index{#1@\protect\isa{#1} (type)}}
 \newcommand\tcdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (type class)}}
 \newcommand\thydx[1]{\isa{#1}\index{#1@\protect\isa{#1} (theory)}}
 
 \newcommand\attrdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (attribute)}}
 \newcommand\cmmdx[1]{\index{#1@\protect\isacommand{#1} (command)}}
 \newcommand\commdx[1]{\isacommand{#1}\index{#1@\protect\isacommand{#1} (command)}}
 \newcommand\methdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (method)}}
-\newcommand\tooldx[1]{\isa{#1}\index{#1@\protect\isa{#1} (tool)}}
-\newcommand\settdx[1]{\isa{#1}\index{#1@\protect\isa{#1} (setting)}}
 \newcommand\pgdx[1]{\pgmenu{#1}\index{#1@\protect\pgmenu{#1} (Proof General)}}
 
 %set argument in \bf font and index in ROMAN font (for definitions in text!)
 \newcommand\bfindex[1]{{\bf#1}\index{#1|bold}\@}
 
 \newcommand\rmindex[1]{{#1}\index{#1}\@}
 \newcommand\ttindex[1]{\texttt{#1}\index{#1@\texttt{#1}}\@}
 \newcommand\ttindexbold[1]{\texttt{#1}\index{#1@\texttt{#1}|bold}\@}
 
 \newcommand{\isadxpos}[2]{\isa{#1}\index{#2@\protect\isa{#1}}\@}
 \newcommand{\isadxboldpos}[2]{\isa{#1}\index{#2@\protect\isa{#1}|bold}\@}
 
 %Commented-out the original versions to see what the index looks like without them.
 %   In any event, they need to use \isa or \protect\isa rather than \texttt.
 %%\newcommand{\indexboldpos}[2]{#1\index{#2@#1|bold}\@}
 %%\newcommand{\ttindexboldpos}[2]{\texttt{#1}\index{#2@\texttt{#1}|bold}\@}
 \newcommand{\indexboldpos}[2]{#1\@}
 \newcommand{\ttindexboldpos}[2]{\isa{#1}\@}
 
 %\newtheorem{theorem}{Theorem}[section]
 \newtheorem{Exercise}{Exercise}[section]
 \newenvironment{exercise}{\begin{Exercise}\rm}{\end{Exercise}}
 \newcommand{\ttlbr}{\texttt{[|}}
 \newcommand{\ttrbr}{\texttt{|]}}
 \newcommand{\ttor}{\texttt{|}}
 \newcommand{\ttall}{\texttt{!}}
 \newcommand{\ttuniquex}{\texttt{?!}}
 \newcommand{\ttEXU}{\texttt{EX!}}
 \newcommand{\ttAnd}{\texttt{!!}}
 
 \newcommand{\isasymignore}{}
 \newcommand{\isasymimp}{\isasymlongrightarrow}
 \newcommand{\isasymImp}{\isasymLongrightarrow}
 \newcommand{\isasymFun}{\isasymRightarrow}
 \newcommand{\isasymuniqex}{\isamath{\exists!\,}}
 \renewcommand{\S}{Sect.\ts}
 
 \renewenvironment{isamarkuptxt}{\begin{isamarkuptext}}{\end{isamarkuptext}}
 
 \newif\ifremarks
 \newcommand{\REMARK}[1]{\ifremarks\marginpar{\raggedright\footnotesize#1}\fi}
 
 %names of Isabelle rules
 \newcommand{\rulename}[1]{\hfill(#1)}
 \newcommand{\rulenamedx}[1]{\hfill(#1\index{#1@\protect\isa{#1} (theorem)|bold})}
 
 %%%% meta-logical connectives
 
 \let\Forall=\bigwedge
 \let\Imp=\Longrightarrow
 \let\To=\Rightarrow
 \newcommand{\Var}[1]{{?\!#1}}
 
 %%% underscores as ordinary characters, not for subscripting
 %%  use @ or \sb for subscripting; use \at for @
 %%  only works in \tt font
 %%  must not make _ an active char; would make \ttindex fail!
 \gdef\underscoreoff{\catcode`\@=8\catcode`\_=\other}
 \gdef\underscoreon{\catcode`\_=8\makeatother}
 \chardef\other=12
 \chardef\at=`\@
 
 % alternative underscore
 \def\_{\leavevmode\kern.06em\vbox{\hrule height.2ex width.3em}\hskip0.1em}
 
 
 %%%% ``WARNING'' environment: 2 ! characters separated by negative thin space
 \def\warnbang{\vtop to 0pt{\vss\hbox{\Huge\bf!\!!}\vss}}
 \newenvironment{warn}{\medskip\medbreak\begingroup \clubpenalty=10000 
          \small %%WAS\baselineskip=0.9\baselineskip
          \noindent \hangindent\parindent \hangafter=-2 
          \hbox to0pt{\hskip-\hangindent\warnbang\hfill}\ignorespaces}%
         {\par\endgroup\medbreak}
 
 %%%% ``PROOF GENERAL'' environment
 \def\pghead{\lower3pt\vbox to 0pt{\vss\hbox{\includegraphics[width=12pt]{pghead}}\vss}}
 \newenvironment{pgnote}{\medskip\medbreak\begingroup \clubpenalty=10000 
          \small \noindent \hangindent\parindent \hangafter=-2 
          \hbox to0pt{\hskip-\hangindent \pghead\hfill}\ignorespaces}%
   {\par\endgroup\medbreak}
 \newcommand{\pgmenu}[1]{\textsf{#1}}
 
 
 %%%% Standard logical symbols
 \let\turn=\vdash
 \let\conj=\wedge
 \let\disj=\vee
 \let\imp=\rightarrow
 \let\bimp=\leftrightarrow
 \newcommand\all[1]{\forall#1.}  %quantification
 \newcommand\ex[1]{\exists#1.}
 \newcommand{\pair}[1]{\langle#1\rangle}
 
 \newcommand{\lparr}{\mathopen{(\!|}}
 \newcommand{\rparr}{\mathclose{|\!)}}
 \newcommand{\fs}{\mathpunct{,\,}}
 \newcommand{\ty}{\mathrel{::}}
 \newcommand{\asn}{\mathrel{:=}}
 \newcommand{\more}{\ldots}
 \newcommand{\record}[1]{\lparr #1 \rparr}
 \newcommand{\dtt}{\mathord.}
 
 \newcommand\lbrakk{\mathopen{[\![}}
 \newcommand\rbrakk{\mathclose{]\!]}}
 \newcommand\List[1]{\lbrakk#1\rbrakk}  %was \obj
 \newcommand\vpile[1]{\begin{array}{c}#1\end{array}}
 \newenvironment{matharray}[1]{\[\begin{array}{#1}}{\end{array}\]}
 \newcommand{\Text}[1]{\mbox{#1}}
 
 \DeclareMathSymbol{\dshsym}{\mathalpha}{letters}{"2D}
 \newcommand{\dsh}{\mathit{\dshsym}}
 
 \let\int=\cap
 \let\un=\cup
 \let\inter=\bigcap
 \let\union=\bigcup
 
 \def\ML{{\sc ml}}
 \def\AST{{\sc ast}}
 
 %macros to change the treatment of symbols
 \def\relsemicolon{\mathcode`\;="303B}   %treat ; like a relation
 \def\binperiod{\mathcode`\.="213A}   %treat . like a binary operator
 \def\binvert{\mathcode`\|="226A}     %treat | like a binary operator
 
 %redefinition of \sloppy and \fussy to use \emergencystretch
 \def\sloppy{\tolerance2000 \hfuzz.5pt \vfuzz.5pt \emergencystretch=15pt}
 \def\fussy{\tolerance200 \hfuzz.1pt \vfuzz.1pt \emergencystretch=0pt}
 
 %non-bf version of description
 \def\descrlabel#1{\hspace\labelsep #1}
 \def\descr{\list{}{\labelwidth\z@ \itemindent-\leftmargin\let\makelabel\descrlabel}}
 \let\enddescr\endlist
 
 % The mathcodes for the letters A, ..., Z, a, ..., z are changed to
 % generate text italic rather than math italic by default. This makes
 % multi-letter identifiers look better. The mathcode for character c
 % is set to |"7000| (variable family) + |"400| (text italic) + |c|.
 %
 \DeclareSymbolFont{italics}{\encodingdefault}{\rmdefault}{m}{it}%
 \def\@setmcodes#1#2#3{{\count0=#1 \count1=#3
         \loop \global\mathcode\count0=\count1 \ifnum \count0<#2
         \advance\count0 by1 \advance\count1 by1 \repeat}}
 \@setmcodes{`A}{`Z}{"7\hexnumber@\symitalics41}
 \@setmcodes{`a}{`z}{"7\hexnumber@\symitalics61}
diff --git a/src/Doc/Typeclass_Hierarchy/document/build b/src/Doc/Typeclass_Hierarchy/document/build
deleted file mode 100755
--- a/src/Doc/Typeclass_Hierarchy/document/build
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-VARIANT="$2"
-
-"$ISABELLE_TOOL" logo Isar
-"$ISABELLE_HOME/src/Doc/prepare_document" "$FORMAT"
-
diff --git a/src/Doc/Typeclass_Hierarchy/document/root.tex b/src/Doc/Typeclass_Hierarchy/document/root.tex
--- a/src/Doc/Typeclass_Hierarchy/document/root.tex
+++ b/src/Doc/Typeclass_Hierarchy/document/root.tex
@@ -1,38 +1,38 @@
 \documentclass[12pt,a4paper,fleqn]{article}
 \usepackage{latexsym,graphicx}
 \usepackage{iman,extra,isar}
 \usepackage{isabelle,isabellesym}
 \usepackage{style}
 \usepackage{pdfsetup}
 
 \hyphenation{Isabelle}
 \hyphenation{Isar}
 \isadroptag{theory}
 
-\title{\includegraphics[scale=0.5]{isabelle_isar}
+\title{\includegraphics[scale=0.5]{isabelle_logo}
   \\[4ex] The {Isabelle/HOL} type-class hierarchy}
 \author{\emph{Florian Haftmann}}
 
 \begin{document}
 
 \maketitle
 
 \begin{abstract}
   \noindent This primer introduces corner stones of the {Isabelle/HOL}
   type-class hierarchy and gives some insights into its internal
   organization.
 \end{abstract}
 
 \thispagestyle{empty}\clearpage
 
 \pagenumbering{roman}
 \clearfirst
 
 \input{Typeclass_Hierarchy.tex}
 
 \begingroup
 \bibliographystyle{plain} \small\raggedright\frenchspacing
 \bibliography{manual}
 \endgroup
 
 \end{document}
diff --git a/src/Doc/antiquote_setup.ML b/src/Doc/antiquote_setup.ML
--- a/src/Doc/antiquote_setup.ML
+++ b/src/Doc/antiquote_setup.ML
@@ -1,210 +1,158 @@
 (*  Title:      Doc/antiquote_setup.ML
     Author:     Makarius
 
 Auxiliary antiquotations for the Isabelle manuals.
 *)
 
 structure Antiquote_Setup: sig end =
 struct
 
 (* misc utils *)
 
 fun translate f = Symbol.explode #> map f #> implode;
 
 val clean_string = translate
   (fn "_" => "\\_"
     | "#" => "\\#"
     | "$" => "\\$"
     | "%" => "\\%"
     | "<" => "$<$"
     | ">" => "$>$"
     | "{" => "\\{"
     | "|" => "$\\mid$"
     | "}" => "\\}"
     | "\<hyphen>" => "-"
     | c => c);
 
 fun clean_name "\<dots>" = "dots"
   | clean_name ".." = "ddot"
   | clean_name "." = "dot"
   | clean_name "_" = "underscore"
   | clean_name "{" = "braceleft"
   | clean_name "}" = "braceright"
   | clean_name s = s |> translate (fn "_" => "-" | "\<hyphen>" => "-" | c => c);
 
 
-(* ML text *)
-
-local
-
-fun ml_val (toks1, []) = ML_Lex.read "fn _ => (" @ toks1 @ ML_Lex.read ");"
-  | ml_val (toks1, toks2) =
-      ML_Lex.read "fn _ => (" @ toks1 @ ML_Lex.read " : " @ toks2 @ ML_Lex.read ");";
-
-fun ml_op (toks1, []) = ML_Lex.read "fn _ => (op " @ toks1 @ ML_Lex.read ");"
-  | ml_op (toks1, toks2) =
-      ML_Lex.read "fn _ => (op " @ toks1 @ ML_Lex.read " : " @ toks2 @ ML_Lex.read ");";
-
-fun ml_type (toks1, []) = ML_Lex.read "val _ = NONE : (" @ toks1 @ ML_Lex.read ") option;"
-  | ml_type (toks1, toks2) =
-      ML_Lex.read "val _ = [NONE : (" @ toks1 @ ML_Lex.read ") option, NONE : (" @
-        toks2 @ ML_Lex.read ") option];";
-
-fun ml_exception (toks1, []) = ML_Lex.read "fn _ => (" @ toks1 @ ML_Lex.read " : exn);"
-  | ml_exception (toks1, toks2) =
-      ML_Lex.read "fn _ => (" @ toks1 @ ML_Lex.read " : " @ toks2 @ ML_Lex.read " -> exn);";
-
-fun ml_structure (toks, _) =
-  ML_Lex.read "functor XXX() = struct structure XX = " @ toks @ ML_Lex.read " end;";
-
-fun ml_functor (Antiquote.Text tok :: _, _) =
-      ML_Lex.read "ML_Env.check_functor " @
-      ML_Lex.read (ML_Syntax.print_string (ML_Lex.content_of tok))
-  | ml_functor _ = raise Fail "Bad ML functor specification";
-
-val is_name =
-  ML_Lex.kind_of #> (fn kind => kind = ML_Lex.Ident orelse kind = ML_Lex.Long_Ident);
-
-fun ml_name txt =
-  (case filter is_name (ML_Lex.tokenize txt) of
-    toks as [_] => ML_Lex.flatten toks
-  | _ => error ("Single ML name expected in input: " ^ quote txt));
-
-fun prep_ml source =
-  (#1 (Input.source_content source), ML_Lex.read_source source);
-
-fun index_ml name kind ml = Thy_Output.antiquotation_raw name
-  (Scan.lift (Args.text_input -- Scan.option (Args.colon |-- Args.text_input)))
-  (fn ctxt => fn (source1, opt_source2) =>
-    let
-      val (txt1, toks1) = prep_ml source1;
-      val (txt2, toks2) =
-        (case opt_source2 of
-          SOME source => prep_ml source
-        | NONE => ("", []));
-
-      val txt =
-        if txt2 = "" then txt1
-        else if kind = "type" then txt1 ^ " = " ^ txt2
-        else if kind = "exception" then txt1 ^ " of " ^ txt2
-        else if Symbol_Pos.is_identifier (Long_Name.base_name (ml_name txt1))
-        then txt1 ^ ": " ^ txt2
-        else txt1 ^ " : " ^ txt2;
-      val txt' = if kind = "" then txt else kind ^ " " ^ txt;
-
-      val pos = Input.pos_of source1;
-      val _ =
-        ML_Context.eval_in (SOME ctxt) ML_Compiler.flags pos (ml (toks1, toks2))
-          handle ERROR msg => error (msg ^ Position.here pos);
-      val kind' = if kind = "" then "ML" else "ML " ^ kind;
-    in
-      Latex.block
-       [Latex.string ("\\indexdef{}{" ^ kind' ^ "}{" ^ clean_string (ml_name txt1) ^ "}"),
-        Thy_Output.verbatim ctxt txt']
-    end);
-
-in
-
-val _ =
-  Theory.setup
-   (index_ml \<^binding>\<open>index_ML\<close> "" ml_val #>
-    index_ml \<^binding>\<open>index_ML_op\<close> "infix" ml_op #>
-    index_ml \<^binding>\<open>index_ML_type\<close> "type" ml_type #>
-    index_ml \<^binding>\<open>index_ML_exception\<close> "exception" ml_exception #>
-    index_ml \<^binding>\<open>index_ML_structure\<close> "structure" ml_structure #>
-    index_ml \<^binding>\<open>index_ML_functor\<close> "functor" ml_functor);
-
-end;
-
-
 (* named theorems *)
 
 val _ =
-  Theory.setup (Thy_Output.antiquotation_raw \<^binding>\<open>named_thms\<close>
+  Theory.setup (Document_Output.antiquotation_raw \<^binding>\<open>named_thms\<close>
     (Scan.repeat (Attrib.thm -- Scan.lift (Args.parens Args.name)))
     (fn ctxt =>
       map (fn (thm, name) =>
         Output.output
           (Document_Antiquotation.format ctxt
-            (Document_Antiquotation.delimit ctxt (Thy_Output.pretty_thm ctxt thm))) ^
+            (Document_Antiquotation.delimit ctxt (Document_Output.pretty_thm ctxt thm))) ^
         enclose "\\rulename{" "}" (Output.output name))
       #> space_implode "\\par\\smallskip%\n"
       #> Latex.string #> single
-      #> Thy_Output.isabelle ctxt));
+      #> Document_Output.isabelle ctxt));
 
 
 (* Isabelle/Isar entities (with index) *)
 
 local
 
 fun no_check (_: Proof.context) (name, _: Position.T) = name;
 
 fun check_keyword ctxt (name, pos) =
   if Keyword.is_keyword (Thy_Header.get_keywords' ctxt) name then name
   else error ("Bad outer syntax keyword " ^ quote name ^ Position.here pos);
 
 fun check_system_option ctxt arg =
   (Completion.check_option (Options.default ()) ctxt arg; true)
     handle ERROR _ => false;
 
 val arg = enclose "{" "}" o clean_string;
 
 fun entity check markup binding index =
-  Thy_Output.antiquotation_raw
+  Document_Output.antiquotation_raw
     (binding |> Binding.map_name (fn name => name ^
       (case index of NONE => "" | SOME true => "_def" | SOME false => "_ref")))
     (Scan.lift (Scan.optional (Args.parens Args.name) "" -- Args.name_position))
     (fn ctxt => fn (logic, (name, pos)) =>
       let
         val kind = translate (fn "_" => " " | c => c) (Binding.name_of binding);
         val hyper_name =
           "{" ^ Long_Name.append kind (Long_Name.append logic (clean_name name)) ^ "}";
         val hyper =
           enclose ("\\hyperlink" ^ hyper_name ^ "{") "}" #>
           index = SOME true ? enclose ("\\hypertarget" ^ hyper_name ^ "{") "}";
         val idx =
           (case index of
             NONE => ""
           | SOME is_def =>
               "\\index" ^ (if is_def then "def" else "ref") ^ arg logic ^ arg kind ^ arg name);
         val _ =
           if Context_Position.is_reported ctxt pos then ignore (check ctxt (name, pos)) else ();
         val latex =
           idx ^
           (Output.output name
             |> (if markup = "" then I else enclose ("\\" ^ markup ^ "{") "}")
             |> hyper o enclose "\\mbox{\\isa{" "}}");
       in Latex.string latex end);
 
 fun entity_antiqs check markup kind =
   entity check markup kind NONE #>
   entity check markup kind (SOME true) #>
   entity check markup kind (SOME false);
 
 in
 
 val _ =
   Theory.setup
    (entity_antiqs no_check "" \<^binding>\<open>syntax\<close> #>
     entity_antiqs Outer_Syntax.check_command "isacommand" \<^binding>\<open>command\<close> #>
     entity_antiqs check_keyword "isakeyword" \<^binding>\<open>keyword\<close> #>
     entity_antiqs check_keyword "isakeyword" \<^binding>\<open>element\<close> #>
     entity_antiqs Method.check_name "" \<^binding>\<open>method\<close> #>
     entity_antiqs Attrib.check_name "" \<^binding>\<open>attribute\<close> #>
     entity_antiqs no_check "" \<^binding>\<open>fact\<close> #>
     entity_antiqs no_check "" \<^binding>\<open>variable\<close> #>
     entity_antiqs no_check "" \<^binding>\<open>case\<close> #>
     entity_antiqs Document_Antiquotation.check "" \<^binding>\<open>antiquotation\<close> #>
     entity_antiqs Document_Antiquotation.check_option "" \<^binding>\<open>antiquotation_option\<close> #>
     entity_antiqs Document_Marker.check "" \<^binding>\<open>document_marker\<close> #>
     entity_antiqs no_check "isasystem" \<^binding>\<open>setting\<close> #>
     entity_antiqs check_system_option "isasystem" \<^binding>\<open>system_option\<close> #>
     entity_antiqs no_check "" \<^binding>\<open>inference\<close> #>
     entity_antiqs no_check "isasystem" \<^binding>\<open>executable\<close> #>
     entity_antiqs Isabelle_Tool.check "isatool" \<^binding>\<open>tool\<close> #>
     entity_antiqs ML_Context.check_antiquotation "" \<^binding>\<open>ML_antiquotation\<close> #>
     entity_antiqs (K JEdit.check_action) "isasystem" \<^binding>\<open>action\<close>);
 
 end;
 
+
+(* show symbols *)
+
+val _ =
+  Theory.setup (Document_Output.antiquotation_raw \<^binding>\<open>show_symbols\<close> (Scan.succeed ())
+    (fn _ => fn _ =>
+      let
+        val symbol_name =
+          unprefix "\\newcommand{\\isasym"
+          #> raw_explode
+          #> take_prefix Symbol.is_ascii_letter
+          #> implode;
+
+        val symbols =
+          File.read \<^file>\<open>~~/lib/texinputs/isabellesym.sty\<close>
+          |> split_lines
+          |> map_filter (fn line =>
+            (case try symbol_name line of
+              NONE => NONE
+            | SOME "" => NONE
+            | SOME name => SOME ("\\verb,\\" ^ "<" ^ name ^ ">, & {\\isasym" ^ name ^ "}")));
+
+        val eol = "\\\\\n";
+        fun table (a :: b :: rest) = a ^ " & " ^ b ^ eol :: table rest
+          | table [a] = [a ^ eol]
+          | table [] = [];
+      in
+        Latex.string
+          ("\\begin{supertabular}{ll@{\\qquad}ll}\n" ^ implode (table symbols) ^
+           "\\end{supertabular}\n")
+      end))
+
 end;
diff --git a/src/Doc/fixbookmarks b/src/Doc/fixbookmarks
deleted file mode 100755
--- a/src/Doc/fixbookmarks
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-perl -pi -e 's/\\([a-zA-Z]+)\s*/$1/g; s/\$//g; s/^BOOKMARK/\\BOOKMARK/g;' "$@"
diff --git a/src/Doc/iman.sty b/src/Doc/iman.sty
--- a/src/Doc/iman.sty
+++ b/src/Doc/iman.sty
@@ -1,153 +1,147 @@
 % iman.sty : Isabelle Manual Page Layout
 %
 \typeout{Document Style iman. Released 17 February 1994}
 
 \hyphenation{Isa-belle man-u-script man-u-scripts ap-pen-dix mut-u-al-ly}
 \hyphenation{data-type data-types co-data-type co-data-types }
 
 \let\ts=\thinspace
 
 %usage: \iflabelundefined{LABEL}{if not defined}{if defined}
 \newcommand{\iflabelundefined}[1]{\@ifundefined{r@#1}}
 
 
 %%%INDEXING  use sedindex to process the index
 
 \newcommand\seealso[2]{\emph{see also} #1}
 \usepackage{makeidx}
 
 %index, putting page numbers of definitions in boldface
 \def\bold#1{\textbf{#1}}
 \newcommand\fnote[1]{#1n}
 \newcommand\indexbold[1]{\index{#1|bold}}
 
 %for indexing constants, symbols, theorems, ...
 \newcommand\cdx[1]{{\tt#1}\index{#1@{\tt#1} constant}}
 \newcommand\sdx[1]{{\tt#1}\index{#1@{\tt#1} symbol}}
 
 \newcommand\tdx[1]{{\tt#1}\index{#1@{\tt#1} theorem}}
 \newcommand\tdxbold[1]{{\tt#1}\index{#1@{\tt#1} theorem|bold}}
 
 \newcommand\mltydx[1]{{\tt#1}\index{#1@{\tt#1} ML type}}
 \newcommand\xdx[1]{{\tt#1}\index{#1@{\tt#1} exception}}
 
-\newcommand\ndx[1]{{\tt#1}\index{#1@{\tt#1} nonterminal}}
-\newcommand\ndxbold[1]{{\tt#1}\index{#1@{\tt#1} nonterminal|bold}}
-
 \newcommand\cldx[1]{{\tt#1}\index{#1@{\tt#1} class}}
 \newcommand\tydx[1]{\textit{#1}\index{#1@{\textit{#1}} type}}
 \newcommand\thydx[1]{{\tt#1}\index{#1@{\tt#1} theory}}
 
-\newcommand\tooldx[1]{{\tt#1}\index{#1@{\tt#1} tool}}
-\newcommand\settdx[1]{{\tt#1}\index{#1@{\tt#1} setting}}
-
 %set argument in \tt font; at the same time, index using * prefix
 \newcommand\rmindex[1]{{#1}\index{#1}\@}
 \newcommand\ttindex[1]{{\tt#1}\index{*#1}\@}
 \newcommand\ttindexbold[1]{{\tt#1}\index{*#1|bold}\@}
 
 %set argument in \bf font and index in ROMAN font (for definitions in text!)
 \newcommand\bfindex[1]{{\bf#1}\index{#1|bold}\@}
 
 
 %%% underscores as ordinary characters, not for subscripting
 %%  use @ or \sb for subscripting; use \at for @
 %%  only works in \tt font
 %%  must not make _ an active char; would make \ttindex fail!
 \gdef\underscoreoff{\catcode`\@=8\catcode`\_=\other}
 \gdef\underscoreon{\catcode`\_=8\makeatother}
 \chardef\other=12
 \chardef\at=`\@
 
 % alternative underscore
 \def\_{\leavevmode\kern.06em\vbox{\hrule height.2ex width.3em}\hskip0.1em}
 
 %%% \dquotes permits usage of "..." for \hbox{...} -- also taken from under.sty
 {\catcode`\"=\active
 \gdef\dquotes{\catcode`\"=\active  \let"=\@mathText}%
 \gdef\@mathText#1"{\hbox{\mathTextFont #1\/}}}
 \def\mathTextFont{\frenchspacing\tt}
 \def\dquotesoff{\catcode`\"=\other}
 
 %%%% meta-logical connectives
 
 \let\Forall=\bigwedge
 \let\Imp=\Longrightarrow
 \let\To=\Rightarrow
 \newcommand{\PROP}{\mathop{\mathrm{PROP}}}
 \newcommand{\Var}[1]{{?\!#1}}
 \newcommand{\All}[1]{\Forall#1.}  %quantification
 
 %%%% ``WARNING'' environment
 \def\dbend{\vtop to 0pt{\vss\hbox{\Huge\bf!}\vss}}
 \newenvironment{warn}{\medskip\medbreak\begingroup \clubpenalty=10000 
          \small %%WAS\baselineskip=0.9\baselineskip
          \noindent \ifdim\parindent > 0pt\hangindent\parindent\else\hangindent1.5em\fi
          \hangafter=-2
          \hbox to0pt{\hskip-\hangindent\dbend\hfill}\ignorespaces}%
         {\par\endgroup\medbreak}
 
 
 %%%% Standard logical symbols
 \let\turn=\vdash
 \let\conj=\wedge
 \let\disj=\vee
 \let\imp=\rightarrow
 \let\bimp=\leftrightarrow
 \newcommand\all[1]{\forall#1.}  %quantification
 \newcommand\ex[1]{\exists#1.}
 \newcommand{\pair}[1]{\langle#1\rangle}
 
 \newcommand{\lparr}{\mathopen{(\!|}}
 \newcommand{\rparr}{\mathclose{|\!)}}
 \newcommand{\fs}{\mathpunct{,\,}}
 \newcommand{\ty}{\mathrel{::}}
 \newcommand{\asn}{\mathrel{:=}}
 \newcommand{\more}{\ldots}
 \newcommand{\record}[1]{\lparr #1 \rparr}
 \newcommand{\dtt}{\mathord.}
 
 \newcommand\lbrakk{\mathopen{[\![}}
 \newcommand\rbrakk{\mathclose{]\!]}}
 \newcommand\List[1]{\lbrakk#1\rbrakk}  %was \obj
 \newcommand\vpile[1]{\begin{array}{c}#1\end{array}}
 \newenvironment{matharray}[1]{\[\begin{array}{#1}}{\end{array}\]}
 \newcommand{\Text}[1]{\mbox{#1}}
 
 \DeclareMathSymbol{\dshsym}{\mathalpha}{letters}{"2D}
 \newcommand{\dsh}{\mathit{\dshsym}}
 
 \let\int=\cap
 \let\un=\cup
 \let\inter=\bigcap
 \let\union=\bigcup
 
 \def\ML{{\sc ml}}
 \def\OBJ{{\sc obj}}
 \def\AST{{\sc ast}}
 
 %macros to change the treatment of symbols
 \def\relsemicolon{\mathcode`\;="303B}   %treat ; like a relation
 \def\binperiod{\mathcode`\.="213A}   %treat . like a binary operator
 \def\binvert{\mathcode`\|="226A}     %treat | like a binary operator
 
 %redefinition of \sloppy and \fussy to use \emergencystretch
 \def\sloppy{\tolerance2000 \hfuzz.5pt \vfuzz.5pt \emergencystretch=15pt}
 \def\fussy{\tolerance200 \hfuzz.1pt \vfuzz.1pt \emergencystretch=0pt}
 
 %non-bf version of description
 \def\descrlabel#1{\hspace\labelsep #1}
 \def\descr{\list{}{\labelwidth\z@ \itemindent-\leftmargin\let\makelabel\descrlabel}}
 \let\enddescr\endlist
 
 % The mathcodes for the letters A, ..., Z, a, ..., z are changed to
 % generate text italic rather than math italic by default. This makes
 % multi-letter identifiers look better. The mathcode for character c
 % is set to |"7000| (variable family) + |"400| (text italic) + |c|.
 %
 \DeclareSymbolFont{italics}{\encodingdefault}{\rmdefault}{m}{it}%
 \def\@setmcodes#1#2#3{{\count0=#1 \count1=#3
         \loop \global\mathcode\count0=\count1 \ifnum \count0<#2
         \advance\count0 by1 \advance\count1 by1 \repeat}}
 \@setmcodes{`A}{`Z}{"7\hexnumber@\symitalics41}
 \@setmcodes{`a}{`z}{"7\hexnumber@\symitalics61}
diff --git a/src/Doc/isar.sty b/src/Doc/isar.sty
--- a/src/Doc/isar.sty
+++ b/src/Doc/isar.sty
@@ -1,29 +1,25 @@
 \usepackage{ifthen}
 
 \newcommand{\indexdef}[3]%
 {\ifthenelse{\equal{}{#1}}{\index{#3 (#2)|bold}}{\index{#3 (#1\ #2)|bold}}}
 \newcommand{\indexref}[3]{\ifthenelse{\equal{}{#1}}{\index{#3 (#2)}}{\index{#3 (#1\ #2)}}}
 
 \newcommand{\isadigitreset}{\def\isadigit##1{##1}}
 
 \newcommand{\isasystem}[1]{{\def\isacharminus{-}\def\isacharunderscore{\_}\isadigitreset\tt #1}}
 \newcommand{\isatool}[1]{{\def\isacharminus{-}\def\isacharunderscore{\_}\isadigitreset\tt isabelle #1}}
 
-\newcommand{\indexoutertoken}[1]{\indexdef{}{syntax}{#1}}
-\newcommand{\indexouternonterm}[1]{\indexdef{}{syntax}{#1}}
-\newcommand{\indexisarelem}[1]{\indexdef{}{element}{#1}}
-
 \newcommand{\isasymIF}{\isakeyword{if}}
 \newcommand{\isasymFOR}{\isakeyword{for}}
 \newcommand{\isasymAND}{\isakeyword{and}}
 \newcommand{\isasymIS}{\isakeyword{is}}
 \newcommand{\isasymWHERE}{\isakeyword{where}}
 \newcommand{\isasymBEGIN}{\isakeyword{begin}}
 \newcommand{\isasymIMPORTS}{\isakeyword{imports}}
 \newcommand{\isasymIN}{\isakeyword{in}}
 \newcommand{\isasymFIXES}{\isakeyword{fixes}}
 \newcommand{\isasymASSUMES}{\isakeyword{assumes}}
 \newcommand{\isasymSHOWS}{\isakeyword{shows}}
 \newcommand{\isasymOBTAINS}{\isakeyword{obtains}}
 
 \newcommand{\isasymASSM}{\isacommand{assm}}
diff --git a/src/Doc/more_antiquote.ML b/src/Doc/more_antiquote.ML
--- a/src/Doc/more_antiquote.ML
+++ b/src/Doc/more_antiquote.ML
@@ -1,38 +1,38 @@
 (*  Title:      Doc/more_antiquote.ML
     Author:     Florian Haftmann, TU Muenchen
 
 More antiquotations (partly depending on Isabelle/HOL).
 *)
 
 structure More_Antiquote : sig end =
 struct
 
 (* class specifications *)
 
 val _ =
-  Theory.setup (Thy_Output.antiquotation_pretty \<^binding>\<open>class_spec\<close> (Scan.lift Args.name)
+  Theory.setup (Document_Output.antiquotation_pretty \<^binding>\<open>class_spec\<close> (Scan.lift Args.name)
     (fn ctxt => fn s =>
       let
         val thy = Proof_Context.theory_of ctxt;
         val class = Sign.intern_class thy s;
       in Pretty.chunks (Class.pretty_specification thy class) end));
 
 
 (* code theorem antiquotation *)
 
 val _ =
-  Theory.setup (Thy_Output.antiquotation_pretty \<^binding>\<open>code_thms\<close> Args.term
+  Theory.setup (Document_Output.antiquotation_pretty \<^binding>\<open>code_thms\<close> Args.term
     (fn ctxt => fn raw_const =>
       let
         val thy = Proof_Context.theory_of ctxt;
         val const = Code.check_const thy raw_const;
         val { eqngr, ... } = Code_Preproc.obtain true { ctxt = ctxt, consts = [const], terms = [] };
         val thms = Code_Preproc.cert eqngr const
           |> Code.equations_of_cert thy
           |> snd
           |> these
           |> map_filter (fn (_, (some_thm, proper)) => if proper then some_thm else NONE)
           |> map (HOLogic.mk_obj_eq o Variable.import_vars ctxt o Axclass.overload ctxt);
-      in Pretty.chunks (map (Thy_Output.pretty_thm ctxt) thms) end));
+      in Pretty.chunks (map (Document_Output.pretty_thm ctxt) thms) end));
 
 end;
diff --git a/src/Doc/prepare_document b/src/Doc/prepare_document
deleted file mode 100755
--- a/src/Doc/prepare_document
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-FORMAT="$1"
-
-isabelle latex -o sty
-cp "$ISABELLE_HOME/src/Doc/pdfsetup.sty" .
-
-isabelle latex -o "$FORMAT"
-isabelle latex -o bbl
-[ -f root.idx ] && "$ISABELLE_HOME/src/Doc/sedindex" root
-isabelle latex -o "$FORMAT"
-[ -f root.out ] && "$ISABELLE_HOME/src/Doc/fixbookmarks" root.out
-isabelle latex -o "$FORMAT"
-
diff --git a/src/Doc/sedindex b/src/Doc/sedindex
--- a/src/Doc/sedindex
+++ b/src/Doc/sedindex
@@ -1,21 +1,21 @@
 #! /bin/sh
 #
 #sedindex - shell script to create indexes, preprocessing LaTeX's .idx file
 #
 #  puts strings prefixed by * into \tt font
 #    terminator characters for strings are |!@{}
 #
 # a space terminates the \tt part to allow \index{*NE theorem}, etc.
 #
 # change *"X"Y"Z"W  to  "X"Y"Z"W@{\tt "X"Y"Z"W}
 # change *"X"Y"Z    to  "X"Y"Z@{\tt "X"Y"Z}
 # change *"X"Y      to  "X"Y@{\tt "X"Y}
 # change *"X        to  "X@{\tt "X}
 # change *IDENT  to  IDENT@{\tt IDENT}  
 #    where IDENT is any string not containing | ! or @
 # FOUR backslashes: to escape the shell AND sed
 sed -e "s~\*\(\".\".\".\".\)~\1@{\\\\tt \1}~g
 s~\*\(\".\".\".\)~\1@{\\\\tt \1}~g
 s~\*\(\".\".\)~\1@{\\\\tt \1}~g
 s~\*\(\".\)~\1@{\\\\tt \1}~g
-s~\*\([^ |!@{}][^ |!@{}]*\)~\1@{\\\\tt \1}~g" $1.idx | makeindex -c -q -o $1.ind
+s~\*\([^ |!@{}][^ |!@{}]*\)~\1@{\\\\tt \1}~g" $1.idx | $ISABELLE_MAKEINDEX -o $1.ind
diff --git a/src/HOL/Library/Code_Lazy.thy b/src/HOL/Library/Code_Lazy.thy
--- a/src/HOL/Library/Code_Lazy.thy
+++ b/src/HOL/Library/Code_Lazy.thy
@@ -1,238 +1,238 @@
 (* Author: Pascal Stoop, ETH Zurich
    Author: Andreas Lochbihler, Digital Asset *)
 
 section \<open>Lazy types in generated code\<close>
 
 theory Code_Lazy
 imports Case_Converter
 keywords
   "code_lazy_type"
   "activate_lazy_type"
   "deactivate_lazy_type"
   "activate_lazy_types"
   "deactivate_lazy_types"
   "print_lazy_types" :: thy_decl
 begin
 
 text \<open>
   This theory and the CodeLazy tool described in @{cite "LochbihlerStoop2018"}.
 
   It hooks into Isabelle's code generator such that the generated code evaluates a user-specified
   set of type constructors lazily, even in target languages with eager evaluation.
   The lazy type must be algebraic, i.e., values must be built from constructors and a
   corresponding case operator decomposes them. Every datatype and codatatype is algebraic
   and thus eligible for lazification.
 \<close>
 
 subsection \<open>The type \<open>lazy\<close>\<close>
 
 typedef 'a lazy = "UNIV :: 'a set" ..
 setup_lifting type_definition_lazy
 lift_definition delay :: "(unit \<Rightarrow> 'a) \<Rightarrow> 'a lazy"  is "\<lambda>f. f ()" .
 lift_definition force :: "'a lazy \<Rightarrow> 'a" is "\<lambda>x. x" .
 
 code_datatype delay
 lemma force_delay [code]: "force (delay f) = f ()" by transfer (rule refl)
 lemma delay_force: "delay (\<lambda>_. force s) = s" by transfer (rule refl)
 
 definition termify_lazy2 :: "'a :: typerep lazy \<Rightarrow> term"
   where "termify_lazy2 x =
   Code_Evaluation.App (Code_Evaluation.Const (STR ''Code_Lazy.delay'') (TYPEREP((unit \<Rightarrow> 'a) \<Rightarrow> 'a lazy)))
     (Code_Evaluation.Const (STR ''Pure.dummy_pattern'') (TYPEREP((unit \<Rightarrow> 'a))))"
 
 definition termify_lazy ::
   "(String.literal \<Rightarrow> 'typerep \<Rightarrow> 'term) \<Rightarrow>
    ('term \<Rightarrow> 'term \<Rightarrow> 'term) \<Rightarrow>
    (String.literal \<Rightarrow> 'typerep \<Rightarrow> 'term \<Rightarrow> 'term) \<Rightarrow>
    'typerep \<Rightarrow> ('typerep \<Rightarrow> 'typerep \<Rightarrow> 'typerep) \<Rightarrow> ('typerep \<Rightarrow> 'typerep) \<Rightarrow>
    ('a \<Rightarrow> 'term) \<Rightarrow> 'typerep \<Rightarrow> 'a :: typerep lazy \<Rightarrow> 'term \<Rightarrow> term"
   where "termify_lazy _ _ _ _ _ _ _ _ x _ = termify_lazy2 x"
 
 declare [[code drop: "Code_Evaluation.term_of :: _ lazy \<Rightarrow> _"]]
 
 lemma term_of_lazy_code [code]:
   "Code_Evaluation.term_of x \<equiv>
    termify_lazy
      Code_Evaluation.Const Code_Evaluation.App Code_Evaluation.Abs
      TYPEREP(unit) (\<lambda>T U. typerep.Typerep (STR ''fun'') [T, U]) (\<lambda>T. typerep.Typerep (STR ''Code_Lazy.lazy'') [T])
      Code_Evaluation.term_of TYPEREP('a) x (Code_Evaluation.Const (STR '''') (TYPEREP(unit)))"
   for x :: "'a :: {typerep, term_of} lazy"
   by (rule term_of_anything)
 
 text \<open>
   The implementations of \<^typ>\<open>_ lazy\<close> using language primitives cache forced values.
 
   Term reconstruction for lazy looks into the lazy value and reconstructs it to the depth it has been evaluated.
   This is not done for Haskell as we do not know of any portable way to inspect whether a lazy value
   has been evaluated to or not.
 \<close>
 
 code_printing code_module Lazy \<rightharpoonup> (SML)
 \<open>signature LAZY =
 sig
   type 'a lazy;
   val lazy : (unit -> 'a) -> 'a lazy;
   val force : 'a lazy -> 'a;
   val peek : 'a lazy -> 'a option
   val termify_lazy : 
    (string -> 'typerep -> 'term) -> 
    ('term -> 'term -> 'term) -> 
    (string -> 'typerep -> 'term -> 'term) ->
    'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->
    ('a -> 'term) -> 'typerep -> 'a lazy -> 'term -> 'term;
 end;
 
 structure Lazy : LAZY = 
 struct
 
 datatype 'a content =
    Delay of unit -> 'a
  | Value of 'a 
  | Exn of exn;
 
 datatype 'a lazy = Lazy of 'a content ref;
 
 fun lazy f = Lazy (ref (Delay f));
 
 fun force (Lazy x) = case !x of
    Delay f => (
      let val res = f (); val _ = x := Value res; in res end
      handle exn => (x := Exn exn; raise exn))
   | Value x => x
   | Exn exn => raise exn;
 
 fun peek (Lazy x) = case !x of
     Value x => SOME x
   | _ => NONE;
 
 fun termify_lazy const app abs unitT funT lazyT term_of T x _ =
   app (const "Code_Lazy.delay" (funT (funT unitT T) (lazyT T))) 
     (case peek x of SOME y => abs "_" unitT (term_of y)
      | _ => const "Pure.dummy_pattern" (funT unitT T));
 
 end;\<close> for type_constructor lazy constant delay force termify_lazy
 | type_constructor lazy \<rightharpoonup> (SML) "_ Lazy.lazy"
 | constant delay \<rightharpoonup> (SML) "Lazy.lazy"
 | constant force \<rightharpoonup> (SML) "Lazy.force"
 | constant termify_lazy \<rightharpoonup> (SML) "Lazy.termify'_lazy"
 
 code_reserved SML Lazy
 
 code_printing \<comment> \<open>For code generation within the Isabelle environment, we reuse the thread-safe
   implementation of lazy from \<^file>\<open>~~/src/Pure/Concurrent/lazy.ML\<close>\<close>
   code_module Lazy \<rightharpoonup> (Eval) \<open>\<close> for constant undefined
 | type_constructor lazy \<rightharpoonup> (Eval) "_ Lazy.lazy"
 | constant delay \<rightharpoonup> (Eval) "Lazy.lazy"
 | constant force \<rightharpoonup> (Eval) "Lazy.force"
 | code_module Termify_Lazy \<rightharpoonup> (Eval)
 \<open>structure Termify_Lazy = struct
 fun termify_lazy
   (_: string -> typ -> term) (_: term -> term -> term)  (_: string -> typ -> term -> term)
   (_: typ) (_: typ -> typ -> typ) (_: typ -> typ)
   (term_of: 'a -> term) (T: typ) (x: 'a Lazy.lazy) (_: term) =
   Const ("Code_Lazy.delay", (HOLogic.unitT --> T) --> Type ("Code_Lazy.lazy", [T])) $
   (case Lazy.peek x of
     SOME (Exn.Res x) => absdummy HOLogic.unitT (term_of x)
   | _ => Const ("Pure.dummy_pattern", HOLogic.unitT --> T));
 end;\<close> for constant termify_lazy
 | constant termify_lazy \<rightharpoonup> (Eval) "Termify'_Lazy.termify'_lazy"
 
 code_reserved Eval Termify_Lazy
 
 code_printing
   type_constructor lazy \<rightharpoonup> (OCaml) "_ Lazy.t"
 | constant delay \<rightharpoonup> (OCaml) "Lazy.from'_fun"
 | constant force \<rightharpoonup> (OCaml) "Lazy.force"
 | code_module Termify_Lazy \<rightharpoonup> (OCaml)
 \<open>module Termify_Lazy : sig
   val termify_lazy :
    (string -> 'typerep -> 'term) ->
    ('term -> 'term -> 'term) ->
    (string -> 'typerep -> 'term -> 'term) ->
    'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->
    ('a -> 'term) -> 'typerep -> 'a Lazy.t -> 'term -> 'term
 end = struct
 
 let termify_lazy const app abs unitT funT lazyT term_of ty x _ =
   app (const "Code_Lazy.delay" (funT (funT unitT ty) (lazyT ty)))
     (if Lazy.is_val x then abs "_" unitT (term_of (Lazy.force x))
      else const "Pure.dummy_pattern" (funT unitT ty));;
 
 end;;\<close> for constant termify_lazy
 | constant termify_lazy \<rightharpoonup> (OCaml) "Termify'_Lazy.termify'_lazy"
 
 code_reserved OCaml Lazy Termify_Lazy
 
 
 code_printing
   code_module Lazy \<rightharpoonup> (Haskell) \<open>
 module Lazy(Lazy, delay, force) where
 
 newtype Lazy a = Lazy a
 delay f = Lazy (f ())
 force (Lazy x) = x\<close> for type_constructor lazy constant delay force
 | type_constructor lazy \<rightharpoonup> (Haskell) "Lazy.Lazy _"
 | constant delay \<rightharpoonup> (Haskell) "Lazy.delay"
 | constant force \<rightharpoonup> (Haskell) "Lazy.force"
 
 code_reserved Haskell Lazy
 
 code_printing
   code_module Lazy \<rightharpoonup> (Scala) 
 \<open>object Lazy {
   final class Lazy[A] (f: Unit => A) {
     var evaluated = false;
-    lazy val x: A = f ()
+    lazy val x: A = f(())
 
     def get() : A = {
       evaluated = true;
       return x
     }
   }
 
   def force[A] (x: Lazy[A]) : A = {
     return x.get()
   }
 
   def delay[A] (f: Unit => A) : Lazy[A] = {
     return new Lazy[A] (f)
   }
 
   def termify_lazy[Typerep, Term, A] (
     const: String => Typerep => Term,
     app: Term => Term => Term,
     abs: String => Typerep => Term => Term,
     unitT: Typerep,
     funT: Typerep => Typerep => Typerep,
     lazyT: Typerep => Typerep,
     term_of: A => Term,
     ty: Typerep,
     x: Lazy[A],
     dummy: Term) : Term = {
     if (x.evaluated)
-      app(const("Code_Lazy.delay")(funT(funT(unitT)(ty))(lazyT(ty))))(abs("_")(unitT)(term_of(x.get)))
+      app(const("Code_Lazy.delay")(funT(funT(unitT)(ty))(lazyT(ty))))(abs("_")(unitT)(term_of(x.get())))
     else
       app(const("Code_Lazy.delay")(funT(funT(unitT)(ty))(lazyT(ty))))(const("Pure.dummy_pattern")(funT(unitT)(ty)))
   }
 }\<close> for type_constructor lazy constant delay force termify_lazy
 | type_constructor lazy \<rightharpoonup> (Scala) "Lazy.Lazy[_]"
 | constant delay \<rightharpoonup> (Scala) "Lazy.delay"
 | constant force \<rightharpoonup> (Scala) "Lazy.force"
 | constant termify_lazy \<rightharpoonup> (Scala) "Lazy.termify'_lazy"
 
 code_reserved Scala Lazy
 
 text \<open>Make evaluation with the simplifier respect \<^term>\<open>delay\<close>s.\<close>
 
 lemma delay_lazy_cong: "delay f = delay f" by simp
 setup \<open>Code_Simp.map_ss (Simplifier.add_cong @{thm delay_lazy_cong})\<close>        
 
 subsection \<open>Implementation\<close>
 
 ML_file \<open>code_lazy.ML\<close>
 
 setup \<open>
   Code_Preproc.add_functrans ("lazy_datatype", Code_Lazy.transform_code_eqs)
 \<close>
 
 end
diff --git a/src/HOL/Library/LaTeXsugar.thy b/src/HOL/Library/LaTeXsugar.thy
--- a/src/HOL/Library/LaTeXsugar.thy
+++ b/src/HOL/Library/LaTeXsugar.thy
@@ -1,152 +1,152 @@
 (*  Title:      HOL/Library/LaTeXsugar.thy
     Author:     Gerwin Klein, Tobias Nipkow, Norbert Schirmer
     Copyright   2005 NICTA and TUM
 *)
 
 (*<*)
 theory LaTeXsugar
 imports Main
 begin
 
 (* LOGIC *)
 notation (latex output)
   If  ("(\<^latex>\<open>\\textsf{\<close>if\<^latex>\<open>}\<close> (_)/ \<^latex>\<open>\\textsf{\<close>then\<^latex>\<open>}\<close> (_)/ \<^latex>\<open>\\textsf{\<close>else\<^latex>\<open>}\<close> (_))" 10)
 
 syntax (latex output)
 
   "_Let"        :: "[letbinds, 'a] => 'a"
   ("(\<^latex>\<open>\\textsf{\<close>let\<^latex>\<open>}\<close> (_)/ \<^latex>\<open>\\textsf{\<close>in\<^latex>\<open>}\<close> (_))" 10)
 
   "_case_syntax":: "['a, cases_syn] => 'b"
   ("(\<^latex>\<open>\\textsf{\<close>case\<^latex>\<open>}\<close> _ \<^latex>\<open>\\textsf{\<close>of\<^latex>\<open>}\<close>/ _)" 10)
 
 
 (* SETS *)
 
 (* empty set *)
 notation (latex)
   "Set.empty" ("\<emptyset>")
 
 (* insert *)
 translations 
   "{x} \<union> A" <= "CONST insert x A"
   "{x,y}" <= "{x} \<union> {y}"
   "{x,y} \<union> A" <= "{x} \<union> ({y} \<union> A)"
   "{x}" <= "{x} \<union> \<emptyset>"
 
 (* set comprehension *)
 syntax (latex output)
   "_Collect" :: "pttrn => bool => 'a set"              ("(1{_ | _})")
   "_CollectIn" :: "pttrn => 'a set => bool => 'a set"   ("(1{_ \<in> _ | _})")
 translations
   "_Collect p P"      <= "{p. P}"
   "_Collect p P"      <= "{p|xs. P}"
   "_CollectIn p A P"  <= "{p : A. P}"
 
 (* card *)
 notation (latex output)
   card  ("|_|")
 
 (* LISTS *)
 
 (* Cons *)
 notation (latex)
   Cons  ("_ \<cdot>/ _" [66,65] 65)
 
 (* length *)
 notation (latex output)
   length  ("|_|")
 
 (* nth *)
 notation (latex output)
   nth  ("_\<^latex>\<open>\\ensuremath{_{[\\mathit{\<close>_\<^latex>\<open>}]}}\<close>" [1000,0] 1000)
 
 (* DUMMY *)
 consts DUMMY :: 'a ("\<^latex>\<open>\\_\<close>")
 
 (* THEOREMS *)
 notation (Rule output)
   Pure.imp  ("\<^latex>\<open>\\mbox{}\\inferrule{\\mbox{\<close>_\<^latex>\<open>}}\<close>\<^latex>\<open>{\\mbox{\<close>_\<^latex>\<open>}}\<close>")
 
 syntax (Rule output)
   "_bigimpl" :: "asms \<Rightarrow> prop \<Rightarrow> prop"
   ("\<^latex>\<open>\\mbox{}\\inferrule{\<close>_\<^latex>\<open>}\<close>\<^latex>\<open>{\\mbox{\<close>_\<^latex>\<open>}}\<close>")
 
   "_asms" :: "prop \<Rightarrow> asms \<Rightarrow> asms" 
   ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\\\\\<close>/ _")
 
   "_asm" :: "prop \<Rightarrow> asms" ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\<close>")
 
 notation (Axiom output)
   "Trueprop"  ("\<^latex>\<open>\\mbox{}\\inferrule{\\mbox{}}{\\mbox{\<close>_\<^latex>\<open>}}\<close>")
 
 notation (IfThen output)
   Pure.imp  ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _/ \<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
 syntax (IfThen output)
   "_bigimpl" :: "asms \<Rightarrow> prop \<Rightarrow> prop"
   ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _ /\<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
   "_asms" :: "prop \<Rightarrow> asms \<Rightarrow> asms" ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\<close> /\<^latex>\<open>{\\normalsize \\,\<close>and\<^latex>\<open>\\,}\<close>/ _")
   "_asm" :: "prop \<Rightarrow> asms" ("\<^latex>\<open>\\mbox{\<close>_\<^latex>\<open>}\<close>")
 
 notation (IfThenNoBox output)
   Pure.imp  ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _/ \<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
 syntax (IfThenNoBox output)
   "_bigimpl" :: "asms \<Rightarrow> prop \<Rightarrow> prop"
   ("\<^latex>\<open>{\\normalsize{}\<close>If\<^latex>\<open>\\,}\<close> _ /\<^latex>\<open>{\\normalsize \\,\<close>then\<^latex>\<open>\\,}\<close>/ _.")
   "_asms" :: "prop \<Rightarrow> asms \<Rightarrow> asms" ("_ /\<^latex>\<open>{\\normalsize \\,\<close>and\<^latex>\<open>\\,}\<close>/ _")
   "_asm" :: "prop \<Rightarrow> asms" ("_")
 
 setup \<open>
-  Thy_Output.antiquotation_pretty_source_embedded \<^binding>\<open>const_typ\<close>
+  Document_Output.antiquotation_pretty_source_embedded \<^binding>\<open>const_typ\<close>
     (Scan.lift Args.embedded_inner_syntax)
     (fn ctxt => fn c =>
       let val tc = Proof_Context.read_const {proper = false, strict = false} ctxt c in
-        Pretty.block [Thy_Output.pretty_term ctxt tc, Pretty.str " ::",
+        Pretty.block [Document_Output.pretty_term ctxt tc, Pretty.str " ::",
           Pretty.brk 1, Syntax.pretty_typ ctxt (fastype_of tc)]
       end)
 \<close>
 
 setup\<open>
 let
   fun dummy_pats (wrap $ (eq $ lhs $ rhs)) =
     let
       val rhs_vars = Term.add_vars rhs [];
       fun dummy (v as Var (ixn as (_, T))) =
             if member ((=) ) rhs_vars ixn then v else Const (\<^const_name>\<open>DUMMY\<close>, T)
         | dummy (t $ u) = dummy t $ dummy u
         | dummy (Abs (n, T, b)) = Abs (n, T, dummy b)
         | dummy t = t;
     in wrap $ (eq $ dummy lhs $ rhs) end
 in
   Term_Style.setup \<^binding>\<open>dummy_pats\<close> (Scan.succeed (K dummy_pats))
 end
 \<close>
 
 setup \<open>
 let
 
 fun eta_expand Ts t xs = case t of
     Abs(x,T,t) =>
       let val (t', xs') = eta_expand (T::Ts) t xs
       in (Abs (x, T, t'), xs') end
   | _ =>
       let
         val (a,ts) = strip_comb t (* assume a atomic *)
         val (ts',xs') = fold_map (eta_expand Ts) ts xs
         val t' = list_comb (a, ts');
         val Bs = binder_types (fastype_of1 (Ts,t));
         val n = Int.min (length Bs, length xs');
         val bs = map Bound ((n - 1) downto 0);
         val xBs = ListPair.zip (xs',Bs);
         val xs'' = drop n xs';
         val t'' = fold_rev Term.abs xBs (list_comb(t', bs))
       in (t'', xs'') end
 
 val style_eta_expand =
   (Scan.repeat Args.name) >> (fn xs => fn ctxt => fn t => fst (eta_expand [] t xs))
 
 in Term_Style.setup \<^binding>\<open>eta_expand\<close> style_eta_expand end
 \<close>
 
 end
 (*>*)
diff --git a/src/HOL/Tools/Ctr_Sugar/ctr_sugar.ML b/src/HOL/Tools/Ctr_Sugar/ctr_sugar.ML
--- a/src/HOL/Tools/Ctr_Sugar/ctr_sugar.ML
+++ b/src/HOL/Tools/Ctr_Sugar/ctr_sugar.ML
@@ -1,1270 +1,1270 @@
 (*  Title:      HOL/Tools/Ctr_Sugar/ctr_sugar.ML
     Author:     Jasmin Blanchette, TU Muenchen
     Author:     Martin Desharnais, TU Muenchen
     Copyright   2012, 2013
 
 Wrapping existing freely generated type's constructors.
 *)
 
 signature CTR_SUGAR =
 sig
   datatype ctr_sugar_kind = Datatype | Codatatype | Record | Unknown
 
   type ctr_sugar =
     {kind: ctr_sugar_kind,
      T: typ,
      ctrs: term list,
      casex: term,
      discs: term list,
      selss: term list list,
      exhaust: thm,
      nchotomy: thm,
      injects: thm list,
      distincts: thm list,
      case_thms: thm list,
      case_cong: thm,
      case_cong_weak: thm,
      case_distribs: thm list,
      split: thm,
      split_asm: thm,
      disc_defs: thm list,
      disc_thmss: thm list list,
      discIs: thm list,
      disc_eq_cases: thm list,
      sel_defs: thm list,
      sel_thmss: thm list list,
      distinct_discsss: thm list list list,
      exhaust_discs: thm list,
      exhaust_sels: thm list,
      collapses: thm list,
      expands: thm list,
      split_sels: thm list,
      split_sel_asms: thm list,
      case_eq_ifs: thm list};
 
   val morph_ctr_sugar: morphism -> ctr_sugar -> ctr_sugar
   val transfer_ctr_sugar: theory -> ctr_sugar -> ctr_sugar
   val ctr_sugar_of: Proof.context -> string -> ctr_sugar option
   val ctr_sugar_of_global: theory -> string -> ctr_sugar option
   val ctr_sugars_of: Proof.context -> ctr_sugar list
   val ctr_sugars_of_global: theory -> ctr_sugar list
   val ctr_sugar_of_case: Proof.context -> string -> ctr_sugar option
   val ctr_sugar_of_case_global: theory -> string -> ctr_sugar option
   val ctr_sugar_interpretation: string -> (ctr_sugar -> local_theory -> local_theory) -> theory ->
     theory
   val interpret_ctr_sugar: (string -> bool) -> ctr_sugar -> local_theory -> local_theory
   val register_ctr_sugar_raw: ctr_sugar -> local_theory -> local_theory
   val register_ctr_sugar: (string -> bool) -> ctr_sugar -> local_theory -> local_theory
   val default_register_ctr_sugar_global: (string -> bool) -> ctr_sugar -> theory -> theory
 
   val mk_half_pairss: 'a list * 'a list -> ('a * 'a) list list
   val join_halves: int -> 'a list list -> 'a list list -> 'a list * 'a list list list
 
   val mk_ctr: typ list -> term -> term
   val mk_case: typ list -> typ -> term -> term
   val mk_disc_or_sel: typ list -> term -> term
   val name_of_ctr: term -> string
   val name_of_disc: term -> string
   val dest_ctr: Proof.context -> string -> term -> term * term list
   val dest_case: Proof.context -> string -> typ list -> term ->
     (ctr_sugar * term list * term list) option
 
   type ('c, 'a) ctr_spec = (binding * 'c) * 'a list
 
   val disc_of_ctr_spec: ('c, 'a) ctr_spec -> binding
   val ctr_of_ctr_spec: ('c, 'a) ctr_spec -> 'c
   val args_of_ctr_spec: ('c, 'a) ctr_spec -> 'a list
 
   val code_plugin: string
 
   type ctr_options = (string -> bool) * bool
   type ctr_options_cmd = (Proof.context -> string -> bool) * bool
 
   val fake_local_theory_for_sel_defaults: (binding * typ) list -> Proof.context -> Proof.context
   val free_constructors: ctr_sugar_kind ->
     ({prems: thm list, context: Proof.context} -> tactic) list list ->
     ((ctr_options * binding) * (term, binding) ctr_spec list) * term list -> local_theory ->
     ctr_sugar * local_theory
   val free_constructors_cmd: ctr_sugar_kind ->
     ((((Proof.context -> Plugin_Name.filter) * bool) * binding)
      * ((binding * string) * binding list) list) * string list ->
     Proof.context -> Proof.state
   val default_ctr_options: ctr_options
   val default_ctr_options_cmd: ctr_options_cmd
   val parse_bound_term: (binding * string) parser
   val parse_ctr_options: ctr_options_cmd parser
   val parse_ctr_spec: 'c parser -> 'a parser -> ('c, 'a) ctr_spec parser
   val parse_sel_default_eqs: string list parser
 end;
 
 structure Ctr_Sugar : CTR_SUGAR =
 struct
 
 open Ctr_Sugar_Util
 open Ctr_Sugar_Tactics
 open Ctr_Sugar_Code
 
 datatype ctr_sugar_kind = Datatype | Codatatype | Record | Unknown;
 
 type ctr_sugar =
   {kind: ctr_sugar_kind,
    T: typ,
    ctrs: term list,
    casex: term,
    discs: term list,
    selss: term list list,
    exhaust: thm,
    nchotomy: thm,
    injects: thm list,
    distincts: thm list,
    case_thms: thm list,
    case_cong: thm,
    case_cong_weak: thm,
    case_distribs: thm list,
    split: thm,
    split_asm: thm,
    disc_defs: thm list,
    disc_thmss: thm list list,
    discIs: thm list,
    disc_eq_cases: thm list,
    sel_defs: thm list,
    sel_thmss: thm list list,
    distinct_discsss: thm list list list,
    exhaust_discs: thm list,
    exhaust_sels: thm list,
    collapses: thm list,
    expands: thm list,
    split_sels: thm list,
    split_sel_asms: thm list,
    case_eq_ifs: thm list};
 
 fun morph_ctr_sugar phi ({kind, T, ctrs, casex, discs, selss, exhaust, nchotomy, injects, distincts,
     case_thms, case_cong, case_cong_weak, case_distribs, split, split_asm, disc_defs, disc_thmss,
     discIs, disc_eq_cases, sel_defs, sel_thmss, distinct_discsss, exhaust_discs, exhaust_sels,
     collapses, expands, split_sels, split_sel_asms, case_eq_ifs} : ctr_sugar) =
   {kind = kind,
    T = Morphism.typ phi T,
    ctrs = map (Morphism.term phi) ctrs,
    casex = Morphism.term phi casex,
    discs = map (Morphism.term phi) discs,
    selss = map (map (Morphism.term phi)) selss,
    exhaust = Morphism.thm phi exhaust,
    nchotomy = Morphism.thm phi nchotomy,
    injects = map (Morphism.thm phi) injects,
    distincts = map (Morphism.thm phi) distincts,
    case_thms = map (Morphism.thm phi) case_thms,
    case_cong = Morphism.thm phi case_cong,
    case_cong_weak = Morphism.thm phi case_cong_weak,
    case_distribs = map (Morphism.thm phi) case_distribs,
    split = Morphism.thm phi split,
    split_asm = Morphism.thm phi split_asm,
    disc_defs = map (Morphism.thm phi) disc_defs,
    disc_thmss = map (map (Morphism.thm phi)) disc_thmss,
    discIs = map (Morphism.thm phi) discIs,
    disc_eq_cases = map (Morphism.thm phi) disc_eq_cases,
    sel_defs = map (Morphism.thm phi) sel_defs,
    sel_thmss = map (map (Morphism.thm phi)) sel_thmss,
    distinct_discsss = map (map (map (Morphism.thm phi))) distinct_discsss,
    exhaust_discs = map (Morphism.thm phi) exhaust_discs,
    exhaust_sels = map (Morphism.thm phi) exhaust_sels,
    collapses = map (Morphism.thm phi) collapses,
    expands = map (Morphism.thm phi) expands,
    split_sels = map (Morphism.thm phi) split_sels,
    split_sel_asms = map (Morphism.thm phi) split_sel_asms,
    case_eq_ifs = map (Morphism.thm phi) case_eq_ifs};
 
 val transfer_ctr_sugar = morph_ctr_sugar o Morphism.transfer_morphism;
 
 structure Data = Generic_Data
 (
   type T = (Position.T * ctr_sugar) Symtab.table;
   val empty = Symtab.empty;
   val extend = I;
   fun merge data : T = Symtab.merge (K true) data;
 );
 
 fun ctr_sugar_of_generic context =
   Option.map (transfer_ctr_sugar (Context.theory_of context) o #2) o Symtab.lookup (Data.get context);
 
 fun ctr_sugars_of_generic context =
   Symtab.fold (cons o transfer_ctr_sugar (Context.theory_of context) o #2 o #2) (Data.get context) [];
 
 fun ctr_sugar_of_case_generic context s =
   find_first (fn {casex = Const (s', _), ...} => s' = s | _ => false)
     (ctr_sugars_of_generic context);
 
 val ctr_sugar_of = ctr_sugar_of_generic o Context.Proof;
 val ctr_sugar_of_global = ctr_sugar_of_generic o Context.Theory;
 
 val ctr_sugars_of = ctr_sugars_of_generic o Context.Proof;
 val ctr_sugars_of_global = ctr_sugars_of_generic o Context.Theory;
 
 val ctr_sugar_of_case = ctr_sugar_of_case_generic o Context.Proof;
 val ctr_sugar_of_case_global = ctr_sugar_of_case_generic o Context.Theory;
 
 structure Ctr_Sugar_Plugin = Plugin(type T = ctr_sugar);
 
 fun ctr_sugar_interpretation name f =
   Ctr_Sugar_Plugin.interpretation name (fn ctr_sugar => fn lthy =>
     f (transfer_ctr_sugar (Proof_Context.theory_of lthy) ctr_sugar) lthy);
 
 val interpret_ctr_sugar = Ctr_Sugar_Plugin.data;
 
 fun register_ctr_sugar_raw (ctr_sugar as {T = Type (name, _), ...}) =
   Local_Theory.declaration {syntax = false, pervasive = true}
     (fn phi => fn context =>
       let val pos = Position.thread_data ()
       in Data.map (Symtab.update (name, (pos, morph_ctr_sugar phi ctr_sugar))) context end);
 
 fun register_ctr_sugar plugins ctr_sugar =
   register_ctr_sugar_raw ctr_sugar #> interpret_ctr_sugar plugins ctr_sugar;
 
 fun default_register_ctr_sugar_global plugins (ctr_sugar as {T = Type (name, _), ...}) thy =
   let
     val tab = Data.get (Context.Theory thy);
     val pos = Position.thread_data ();
   in
     if Symtab.defined tab name then thy
     else
       thy
       |> Context.theory_map (Data.put (Symtab.update_new (name, (pos, ctr_sugar)) tab))
       |> Named_Target.theory_map (Ctr_Sugar_Plugin.data plugins ctr_sugar)
   end;
 
 val is_prefix = "is_";
 val un_prefix = "un_";
 val not_prefix = "not_";
 
 fun mk_unN 1 1 suf = un_prefix ^ suf
   | mk_unN _ l suf = un_prefix ^ suf ^ string_of_int l;
 
 val caseN = "case";
 val case_congN = "case_cong";
 val case_eq_ifN = "case_eq_if";
 val collapseN = "collapse";
 val discN = "disc";
 val disc_eq_caseN = "disc_eq_case";
 val discIN = "discI";
 val distinctN = "distinct";
 val distinct_discN = "distinct_disc";
 val exhaustN = "exhaust";
 val exhaust_discN = "exhaust_disc";
 val expandN = "expand";
 val injectN = "inject";
 val nchotomyN = "nchotomy";
 val selN = "sel";
 val exhaust_selN = "exhaust_sel";
 val splitN = "split";
 val split_asmN = "split_asm";
 val split_selN = "split_sel";
 val split_sel_asmN = "split_sel_asm";
 val splitsN = "splits";
 val split_selsN = "split_sels";
 val case_cong_weak_thmsN = "case_cong_weak";
 val case_distribN = "case_distrib";
 
 val cong_attrs = @{attributes [cong]};
 val dest_attrs = @{attributes [dest]};
 val safe_elim_attrs = @{attributes [elim!]};
 val iff_attrs = @{attributes [iff]};
 val inductsimp_attrs = @{attributes [induct_simp]};
 val nitpicksimp_attrs = @{attributes [nitpick_simp]};
 val simp_attrs = @{attributes [simp]};
 
 fun unflat_lookup eq xs ys = map (fn xs' => permute_like_unique eq xs xs' ys);
 
 fun mk_half_pairss' _ ([], []) = []
   | mk_half_pairss' indent (x :: xs, _ :: ys) =
     indent @ fold_rev (cons o single o pair x) ys (mk_half_pairss' ([] :: indent) (xs, ys));
 
 fun mk_half_pairss p = mk_half_pairss' [[]] p;
 
 fun join_halves n half_xss other_half_xss =
   (splice (flat half_xss) (flat other_half_xss),
    map2 (map2 append) (Library.chop_groups n half_xss)
      (transpose (Library.chop_groups n other_half_xss)));
 
 fun mk_undefined T = Const (\<^const_name>\<open>undefined\<close>, T);
 
 fun mk_ctr Ts t =
   let val Type (_, Ts0) = body_type (fastype_of t) in
     subst_nonatomic_types (Ts0 ~~ Ts) t
   end;
 
 fun mk_case Ts T t =
   let val (Type (_, Ts0), body) = strip_type (fastype_of t) |>> List.last in
     subst_nonatomic_types ((body, T) :: (Ts0 ~~ Ts)) t
   end;
 
 fun mk_disc_or_sel Ts t =
   subst_nonatomic_types (snd (Term.dest_Type (domain_type (fastype_of t))) ~~ Ts) t;
 
 val name_of_ctr = name_of_const "constructor" body_type;
 
 fun name_of_disc t =
   (case head_of t of
     Abs (_, _, \<^const>\<open>Not\<close> $ (t' $ Bound 0)) =>
     Long_Name.map_base_name (prefix not_prefix) (name_of_disc t')
   | Abs (_, _, Const (\<^const_name>\<open>HOL.eq\<close>, _) $ Bound 0 $ t') =>
     Long_Name.map_base_name (prefix is_prefix) (name_of_disc t')
   | Abs (_, _, \<^const>\<open>Not\<close> $ (Const (\<^const_name>\<open>HOL.eq\<close>, _) $ Bound 0 $ t')) =>
     Long_Name.map_base_name (prefix (not_prefix ^ is_prefix)) (name_of_disc t')
   | t' => name_of_const "discriminator" (perhaps (try domain_type)) t');
 
 val base_name_of_ctr = Long_Name.base_name o name_of_ctr;
 
 fun dest_ctr ctxt s t =
   let val (f, args) = Term.strip_comb t in
     (case ctr_sugar_of ctxt s of
       SOME {ctrs, ...} =>
       (case find_first (can (fo_match ctxt f)) ctrs of
         SOME f' => (f', args)
       | NONE => raise Fail "dest_ctr")
     | NONE => raise Fail "dest_ctr")
   end;
 
 fun dest_case ctxt s Ts t =
   (case Term.strip_comb t of
     (Const (c, _), args as _ :: _) =>
     (case ctr_sugar_of ctxt s of
       SOME (ctr_sugar as {casex = Const (case_name, _), discs = discs0, selss = selss0, ...}) =>
       if case_name = c then
         let val n = length discs0 in
           if n < length args then
             let
               val (branches, obj :: leftovers) = chop n args;
               val discs = map (mk_disc_or_sel Ts) discs0;
               val selss = map (map (mk_disc_or_sel Ts)) selss0;
               val conds = map (rapp obj) discs;
               val branch_argss = map (fn sels => map (rapp obj) sels @ leftovers) selss;
               val branches' = map2 (curry Term.betapplys) branches branch_argss;
             in
               SOME (ctr_sugar, conds, branches')
             end
           else
             NONE
         end
       else
         NONE
     | _ => NONE)
   | _ => NONE);
 
 fun const_or_free_name (Const (s, _)) = Long_Name.base_name s
   | const_or_free_name (Free (s, _)) = s
   | const_or_free_name t = raise TERM ("const_or_free_name", [t])
 
 fun extract_sel_default ctxt t =
   let
     fun malformed () =
       error ("Malformed selector default value equation: " ^ Syntax.string_of_term ctxt t);
 
     val ((sel, (ctr, vars)), rhs) =
       fst (Term.replace_dummy_patterns (Syntax.check_term ctxt t) 0)
       |> HOLogic.dest_eq
       |>> (Term.dest_comb
         #>> const_or_free_name
         ##> (Term.strip_comb #>> (Term.dest_Const #> fst)))
       handle TERM _ => malformed ();
   in
     if forall (is_Free orf is_Var) vars andalso not (has_duplicates (op aconv) vars) then
       ((ctr, sel), fold_rev Term.lambda vars rhs)
     else
       malformed ()
   end;
 
 (* Ideally, we would enrich the context with constants rather than free variables. *)
 fun fake_local_theory_for_sel_defaults sel_bTs =
   Proof_Context.allow_dummies
   #> Proof_Context.add_fixes (map (fn (b, T) => (b, SOME T, NoSyn)) sel_bTs)
   #> snd;
 
 type ('c, 'a) ctr_spec = (binding * 'c) * 'a list;
 
 fun disc_of_ctr_spec ((disc, _), _) = disc;
 fun ctr_of_ctr_spec ((_, ctr), _) = ctr;
 fun args_of_ctr_spec (_, args) = args;
 
 val code_plugin = Plugin_Name.declare_setup \<^binding>\<open>code\<close>;
 
 fun prepare_free_constructors kind prep_plugins prep_term
     ((((raw_plugins, discs_sels), raw_case_binding), ctr_specs), sel_default_eqs) no_defs_lthy =
   let
     val plugins = prep_plugins no_defs_lthy raw_plugins;
 
     (* TODO: sanity checks on arguments *)
 
     val raw_ctrs = map ctr_of_ctr_spec ctr_specs;
     val raw_disc_bindings = map disc_of_ctr_spec ctr_specs;
     val raw_sel_bindingss = map args_of_ctr_spec ctr_specs;
 
     val n = length raw_ctrs;
     val ks = 1 upto n;
 
     val _ = n > 0 orelse error "No constructors specified";
 
     val ctrs0 = map (prep_term no_defs_lthy) raw_ctrs;
 
     val (fcT_name, As0) =
       (case body_type (fastype_of (hd ctrs0)) of
         Type T' => T'
       | _ => error "Expected type constructor in body type of constructor");
     val _ = forall ((fn Type (T_name, _) => T_name = fcT_name | _ => false) o body_type
       o fastype_of) (tl ctrs0) orelse error "Constructors not constructing same type";
 
     val fc_b_name = Long_Name.base_name fcT_name;
     val fc_b = Binding.name fc_b_name;
 
     fun qualify mandatory = Binding.qualify mandatory fc_b_name;
 
     val (unsorted_As, [B, C]) =
       no_defs_lthy
       |> variant_tfrees (map (fst o dest_TFree_or_TVar) As0)
       ||> fst o mk_TFrees 2;
 
     val As = map2 (resort_tfree_or_tvar o snd o dest_TFree_or_TVar) As0 unsorted_As;
 
     val fcT = Type (fcT_name, As);
     val ctrs = map (mk_ctr As) ctrs0;
     val ctr_Tss = map (binder_types o fastype_of) ctrs;
 
     val ms = map length ctr_Tss;
 
     fun can_definitely_rely_on_disc k =
       not (Binding.is_empty (nth raw_disc_bindings (k - 1))) orelse nth ms (k - 1) = 0;
     fun can_rely_on_disc k =
       can_definitely_rely_on_disc k orelse (k = 1 andalso not (can_definitely_rely_on_disc 2));
     fun should_omit_disc_binding k = n = 1 orelse (n = 2 andalso can_rely_on_disc (3 - k));
 
     val equal_binding = \<^binding>\<open>=\<close>;
 
     fun is_disc_binding_valid b =
       not (Binding.is_empty b orelse Binding.eq_name (b, equal_binding));
 
     val standard_disc_binding = Binding.name o prefix is_prefix o base_name_of_ctr;
 
     val disc_bindings =
       raw_disc_bindings
       |> @{map 4} (fn k => fn m => fn ctr => fn disc =>
         qualify false
           (if Binding.is_empty disc then
              if m = 0 then equal_binding
              else if should_omit_disc_binding k then disc
              else standard_disc_binding ctr
            else if Binding.eq_name (disc, standard_binding) then
              standard_disc_binding ctr
            else
              disc)) ks ms ctrs0;
 
     fun standard_sel_binding m l = Binding.name o mk_unN m l o base_name_of_ctr;
 
     val sel_bindingss =
       @{map 3} (fn ctr => fn m => map2 (fn l => fn sel =>
         qualify false
           (if Binding.is_empty sel orelse Binding.eq_name (sel, standard_binding) then
             standard_sel_binding m l ctr
           else
             sel)) (1 upto m) o pad_list Binding.empty m) ctrs0 ms raw_sel_bindingss;
 
     val add_bindings =
       Variable.add_fixes (distinct (op =) (filter Symbol_Pos.is_identifier
         (map Binding.name_of (disc_bindings @ flat sel_bindingss))))
       #> snd;
 
     val case_Ts = map (fn Ts => Ts ---> B) ctr_Tss;
 
     val (((((((((u, exh_y), xss), yss), fs), gs), w), (p, p'))), _) = no_defs_lthy
       |> add_bindings
       |> yield_singleton (mk_Frees fc_b_name) fcT
       ||>> yield_singleton (mk_Frees "y") fcT (* for compatibility with "datatype_realizer.ML" *)
       ||>> mk_Freess "x" ctr_Tss
       ||>> mk_Freess "y" ctr_Tss
       ||>> mk_Frees "f" case_Ts
       ||>> mk_Frees "g" case_Ts
       ||>> yield_singleton (mk_Frees "z") B
       ||>> yield_singleton (apfst (op ~~) oo mk_Frees' "P") HOLogic.boolT;
 
     val q = Free (fst p', mk_pred1T B);
 
     val xctrs = map2 (curry Term.list_comb) ctrs xss;
     val yctrs = map2 (curry Term.list_comb) ctrs yss;
 
     val xfs = map2 (curry Term.list_comb) fs xss;
     val xgs = map2 (curry Term.list_comb) gs xss;
 
     (* TODO: Eta-expension is for compatibility with the old datatype package (but it also provides
        nicer names). Consider removing. *)
     val eta_fs = map2 (fold_rev Term.lambda) xss xfs;
     val eta_gs = map2 (fold_rev Term.lambda) xss xgs;
 
     val case_binding =
       qualify false
         (if Binding.is_empty raw_case_binding orelse
             Binding.eq_name (raw_case_binding, standard_binding) then
            Binding.prefix_name (caseN ^ "_") fc_b
          else
            raw_case_binding);
 
     fun mk_case_disj xctr xf xs =
       list_exists_free xs (HOLogic.mk_conj (HOLogic.mk_eq (u, xctr), HOLogic.mk_eq (w, xf)));
 
     val case_rhs = fold_rev (fold_rev Term.lambda) [fs, [u]]
       (Const (\<^const_name>\<open>The\<close>, (B --> HOLogic.boolT) --> B) $
          Term.lambda w (Library.foldr1 HOLogic.mk_disj (@{map 3} mk_case_disj xctrs xfs xss)));
 
     val ((raw_case, (_, raw_case_def)), (lthy, lthy_old)) = no_defs_lthy
       |> (snd o Local_Theory.begin_nested)
       |> Local_Theory.define ((case_binding, NoSyn),
         ((Binding.concealed (Thm.def_binding case_binding), []), case_rhs))
       ||> `Local_Theory.end_nested;
 
     val phi = Proof_Context.export_morphism lthy_old lthy;
 
     val case_def = Morphism.thm phi raw_case_def;
 
     val case0 = Morphism.term phi raw_case;
     val casex = mk_case As B case0;
     val casexC = mk_case As C case0;
     val casexBool = mk_case As HOLogic.boolT case0;
 
     fun mk_uu_eq () = HOLogic.mk_eq (u, u);
 
     val exist_xs_u_eq_ctrs =
       map2 (fn xctr => fn xs => list_exists_free xs (HOLogic.mk_eq (u, xctr))) xctrs xss;
 
     val unique_disc_no_def = TrueI; (*arbitrary marker*)
     val alternate_disc_no_def = FalseE; (*arbitrary marker*)
 
     fun alternate_disc_lhs get_udisc k =
       HOLogic.mk_not
         (let val b = nth disc_bindings (k - 1) in
            if is_disc_binding_valid b then get_udisc b (k - 1) else nth exist_xs_u_eq_ctrs (k - 1)
          end);
 
     val no_discs_sels =
       not discs_sels andalso
       forall (forall Binding.is_empty) (raw_disc_bindings :: raw_sel_bindingss) andalso
       null sel_default_eqs;
 
     val (all_sels_distinct, discs, selss, disc_defs, sel_defs, sel_defss, lthy) =
       if no_discs_sels then
         (true, [], [], [], [], [], lthy)
       else
         let
           val all_sel_bindings = flat sel_bindingss;
           val num_all_sel_bindings = length all_sel_bindings;
           val uniq_sel_bindings = distinct Binding.eq_name all_sel_bindings;
           val all_sels_distinct = (length uniq_sel_bindings = num_all_sel_bindings);
 
           val sel_binding_index =
             if all_sels_distinct then
               1 upto num_all_sel_bindings
             else
               map (fn b => find_index (curry Binding.eq_name b) uniq_sel_bindings) all_sel_bindings;
 
           val all_proto_sels = flat (@{map 3} (fn k => fn xs => map (pair k o pair xs)) ks xss xss);
           val sel_infos =
             AList.group (op =) (sel_binding_index ~~ all_proto_sels)
             |> sort (int_ord o apply2 fst)
             |> map snd |> curry (op ~~) uniq_sel_bindings;
           val sel_bindings = map fst sel_infos;
 
           val sel_defaults =
             if null sel_default_eqs then
               []
             else
               let
                 val sel_Ts = map (curry (op -->) fcT o fastype_of o snd o snd o hd o snd) sel_infos;
                 val fake_lthy =
                   fake_local_theory_for_sel_defaults (sel_bindings ~~ sel_Ts) no_defs_lthy;
               in
                 map (extract_sel_default fake_lthy o prep_term fake_lthy) sel_default_eqs
               end;
 
           fun disc_free b = Free (Binding.name_of b, mk_pred1T fcT);
 
           fun disc_spec b exist_xs_u_eq_ctr = mk_Trueprop_eq (disc_free b $ u, exist_xs_u_eq_ctr);
 
           fun alternate_disc k =
             Term.lambda u (alternate_disc_lhs (K o rapp u o disc_free) (3 - k));
 
           fun mk_sel_case_args b proto_sels T =
             @{map 3} (fn Const (c, _) => fn Ts => fn k =>
               (case AList.lookup (op =) proto_sels k of
                 NONE =>
                 (case filter (curry (op =) (c, Binding.name_of b) o fst) sel_defaults of
                   [] => fold_rev (Term.lambda o curry Free Name.uu) Ts (mk_undefined T)
                 | [(_, t)] => t
                 | _ => error "Multiple default values for selector/constructor pair")
               | SOME (xs, x) => fold_rev Term.lambda xs x)) ctrs ctr_Tss ks;
 
           fun sel_spec b proto_sels =
             let
               val _ =
                 (case duplicates (op =) (map fst proto_sels) of
                    k :: _ => error ("Duplicate selector name " ^ quote (Binding.name_of b) ^
                      " for constructor " ^ quote (Syntax.string_of_term lthy (nth ctrs (k - 1))))
                  | [] => ())
               val T =
                 (case distinct (op =) (map (fastype_of o snd o snd) proto_sels) of
                   [T] => T
                 | T :: T' :: _ => error ("Inconsistent range type for selector " ^
                     quote (Binding.name_of b) ^ ": " ^ quote (Syntax.string_of_typ lthy T) ^
                     " vs. " ^ quote (Syntax.string_of_typ lthy T')));
             in
               mk_Trueprop_eq (Free (Binding.name_of b, fcT --> T) $ u,
                 Term.list_comb (mk_case As T case0, mk_sel_case_args b proto_sels T) $ u)
             end;
 
           fun unflat_selss xs = unflat_lookup Binding.eq_name sel_bindings xs sel_bindingss;
 
           val (((raw_discs, raw_disc_defs), (raw_sels, raw_sel_defs)), (lthy', lthy)) =
             lthy
             |> (snd o Local_Theory.begin_nested)
             |> apfst split_list o @{fold_map 3} (fn k => fn exist_xs_u_eq_ctr => fn b =>
                 if Binding.is_empty b then
                   if n = 1 then pair (Term.lambda u (mk_uu_eq ()), unique_disc_no_def)
                   else pair (alternate_disc k, alternate_disc_no_def)
                 else if Binding.eq_name (b, equal_binding) then
                   pair (Term.lambda u exist_xs_u_eq_ctr, refl)
                 else
                   Specification.definition (SOME (b, NONE, NoSyn)) [] []
                     ((Thm.def_binding b, []), disc_spec b exist_xs_u_eq_ctr) #>> apsnd snd)
               ks exist_xs_u_eq_ctrs disc_bindings
             ||>> apfst split_list o fold_map (fn (b, proto_sels) =>
               Specification.definition (SOME (b, NONE, NoSyn)) [] []
                 ((Thm.def_binding b, []), sel_spec b proto_sels) #>> apsnd snd) sel_infos
             ||> `Local_Theory.end_nested;
 
           val phi = Proof_Context.export_morphism lthy lthy';
 
           val disc_defs = map (Morphism.thm phi) raw_disc_defs;
           val sel_defs = map (Morphism.thm phi) raw_sel_defs;
           val sel_defss = unflat_selss sel_defs;
 
           val discs0 = map (Morphism.term phi) raw_discs;
           val selss0 = unflat_selss (map (Morphism.term phi) raw_sels);
 
           val discs = map (mk_disc_or_sel As) discs0;
           val selss = map (map (mk_disc_or_sel As)) selss0;
         in
           (all_sels_distinct, discs, selss, disc_defs, sel_defs, sel_defss, lthy')
         end;
 
     fun mk_imp_p Qs = Logic.list_implies (Qs, HOLogic.mk_Trueprop p);
 
     val exhaust_goal =
       let fun mk_prem xctr xs = fold_rev Logic.all xs (mk_imp_p [mk_Trueprop_eq (exh_y, xctr)]) in
         fold_rev Logic.all [p, exh_y] (mk_imp_p (map2 mk_prem xctrs xss))
       end;
 
     val inject_goalss =
       let
         fun mk_goal _ _ [] [] = []
           | mk_goal xctr yctr xs ys =
             [fold_rev Logic.all (xs @ ys) (mk_Trueprop_eq (HOLogic.mk_eq (xctr, yctr),
               Library.foldr1 HOLogic.mk_conj (map2 (curry HOLogic.mk_eq) xs ys)))];
       in
         @{map 4} mk_goal xctrs yctrs xss yss
       end;
 
     val half_distinct_goalss =
       let
         fun mk_goal ((xs, xc), (xs', xc')) =
           fold_rev Logic.all (xs @ xs')
             (HOLogic.mk_Trueprop (HOLogic.mk_not (HOLogic.mk_eq (xc, xc'))));
       in
         map (map mk_goal) (mk_half_pairss (`I (xss ~~ xctrs)))
       end;
 
     val goalss = [exhaust_goal] :: inject_goalss @ half_distinct_goalss;
 
     fun after_qed ([exhaust_thm] :: thmss) lthy =
       let
         val ((((((((u, u'), (xss, xss')), fs), gs), h), v), p), _) = lthy
           |> add_bindings
           |> yield_singleton (apfst (op ~~) oo mk_Frees' fc_b_name) fcT
           ||>> mk_Freess' "x" ctr_Tss
           ||>> mk_Frees "f" case_Ts
           ||>> mk_Frees "g" case_Ts
           ||>> yield_singleton (mk_Frees "h") (B --> C)
           ||>> yield_singleton (mk_Frees (fc_b_name ^ "'")) fcT
           ||>> yield_singleton (mk_Frees "P") HOLogic.boolT;
 
         val xfs = map2 (curry Term.list_comb) fs xss;
         val xgs = map2 (curry Term.list_comb) gs xss;
 
         val fcase = Term.list_comb (casex, fs);
 
         val ufcase = fcase $ u;
         val vfcase = fcase $ v;
 
         val eta_fcase = Term.list_comb (casex, eta_fs);
         val eta_gcase = Term.list_comb (casex, eta_gs);
 
         val eta_ufcase = eta_fcase $ u;
         val eta_vgcase = eta_gcase $ v;
 
         fun mk_uu_eq () = HOLogic.mk_eq (u, u);
 
         val uv_eq = mk_Trueprop_eq (u, v);
 
         val ((inject_thms, inject_thmss), half_distinct_thmss) = chop n thmss |>> `flat;
 
         val rho_As =
           map (fn (T, U) => (dest_TVar T, Thm.ctyp_of lthy U))
             (map Logic.varifyT_global As ~~ As);
 
         fun inst_thm t thm =
           Thm.instantiate' [] [SOME (Thm.cterm_of lthy t)]
             (Thm.instantiate (rho_As, []) (Drule.zero_var_indexes thm));
 
         val uexhaust_thm = inst_thm u exhaust_thm;
 
         val exhaust_cases = map base_name_of_ctr ctrs;
 
         val other_half_distinct_thmss = map (map (fn thm => thm RS not_sym)) half_distinct_thmss;
 
         val (distinct_thms, (distinct_thmsss', distinct_thmsss)) =
           join_halves n half_distinct_thmss other_half_distinct_thmss ||> `transpose;
 
         val nchotomy_thm =
           let
             val goal =
               HOLogic.mk_Trueprop (HOLogic.mk_all (fst u', snd u',
                 Library.foldr1 HOLogic.mk_disj exist_xs_u_eq_ctrs));
           in
             Goal.prove_sorry lthy [] [] goal (fn {context = ctxt, prems = _} =>
               mk_nchotomy_tac ctxt n exhaust_thm)
             |> Thm.close_derivation \<^here>
           end;
 
         val case_thms =
           let
             val goals =
               @{map 3} (fn xctr => fn xf => fn xs =>
                 fold_rev Logic.all (fs @ xs) (mk_Trueprop_eq (fcase $ xctr, xf))) xctrs xfs xss;
           in
             @{map 4} (fn k => fn goal => fn injects => fn distinctss =>
                 Goal.prove_sorry lthy [] [] goal (fn {context = ctxt, ...} =>
                   mk_case_tac ctxt n k case_def injects distinctss)
                 |> Thm.close_derivation \<^here>)
               ks goals inject_thmss distinct_thmsss
           end;
 
         val (case_cong_thm, case_cong_weak_thm) =
           let
             fun mk_prem xctr xs xf xg =
               fold_rev Logic.all xs (Logic.mk_implies (mk_Trueprop_eq (v, xctr),
                 mk_Trueprop_eq (xf, xg)));
 
             val goal =
               Logic.list_implies (uv_eq :: @{map 4} mk_prem xctrs xss xfs xgs,
                  mk_Trueprop_eq (eta_ufcase, eta_vgcase));
             val weak_goal = Logic.mk_implies (uv_eq, mk_Trueprop_eq (ufcase, vfcase));
             val vars = Variable.add_free_names lthy goal [];
             val weak_vars = Variable.add_free_names lthy weak_goal [];
           in
             (Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, prems = _} =>
                mk_case_cong_tac ctxt uexhaust_thm case_thms),
              Goal.prove_sorry lthy weak_vars [] weak_goal (fn {context = ctxt, prems = _} =>
                etac ctxt arg_cong 1))
             |> apply2 (Thm.close_derivation \<^here>)
           end;
 
         val split_lhs = q $ ufcase;
 
         fun mk_split_conjunct xctr xs f_xs =
           list_all_free xs (HOLogic.mk_imp (HOLogic.mk_eq (u, xctr), q $ f_xs));
         fun mk_split_disjunct xctr xs f_xs =
           list_exists_free xs (HOLogic.mk_conj (HOLogic.mk_eq (u, xctr),
             HOLogic.mk_not (q $ f_xs)));
 
         fun mk_split_goal xctrs xss xfs =
           mk_Trueprop_eq (split_lhs, Library.foldr1 HOLogic.mk_conj
             (@{map 3} mk_split_conjunct xctrs xss xfs));
         fun mk_split_asm_goal xctrs xss xfs =
           mk_Trueprop_eq (split_lhs, HOLogic.mk_not (Library.foldr1 HOLogic.mk_disj
             (@{map 3} mk_split_disjunct xctrs xss xfs)));
 
         fun prove_split selss goal =
           Variable.add_free_names lthy goal []
           |> (fn vars => Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, prems = _} =>
             mk_split_tac ctxt uexhaust_thm case_thms selss inject_thmss distinct_thmsss))
           |> Thm.close_derivation \<^here>;
 
         fun prove_split_asm asm_goal split_thm =
           Variable.add_free_names lthy asm_goal []
           |> (fn vars => Goal.prove_sorry lthy vars [] asm_goal (fn {context = ctxt, ...} =>
             mk_split_asm_tac ctxt split_thm))
           |> Thm.close_derivation \<^here>;
 
         val (split_thm, split_asm_thm) =
           let
             val goal = mk_split_goal xctrs xss xfs;
             val asm_goal = mk_split_asm_goal xctrs xss xfs;
 
             val thm = prove_split (replicate n []) goal;
             val asm_thm = prove_split_asm asm_goal thm;
           in
             (thm, asm_thm)
           end;
 
         val (sel_defs, all_sel_thms, sel_thmss, nontriv_disc_defs, disc_thmss, nontriv_disc_thmss,
              discI_thms, nontriv_discI_thms, distinct_disc_thms, distinct_disc_thmsss,
              exhaust_disc_thms, exhaust_sel_thms, all_collapse_thms, safe_collapse_thms,
              expand_thms, split_sel_thms, split_sel_asm_thms, case_eq_if_thms, disc_eq_case_thms) =
           if no_discs_sels then
             ([], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [])
           else
             let
               val udiscs = map (rapp u) discs;
               val uselss = map (map (rapp u)) selss;
               val usel_ctrs = map2 (curry Term.list_comb) ctrs uselss;
               val usel_fs = map2 (curry Term.list_comb) fs uselss;
 
               val vdiscs = map (rapp v) discs;
               val vselss = map (map (rapp v)) selss;
 
               fun make_sel_thm xs' case_thm sel_def =
                 zero_var_indexes
                   (Variable.gen_all lthy
                     (Drule.rename_bvars'
                       (map (SOME o fst) xs')
                       (Drule.forall_intr_vars (case_thm RS (sel_def RS trans)))));
 
               val sel_thmss = @{map 3} (map oo make_sel_thm) xss' case_thms sel_defss;
 
               fun has_undefined_rhs thm =
                 (case snd (HOLogic.dest_eq (HOLogic.dest_Trueprop (Thm.prop_of thm))) of
                   Const (\<^const_name>\<open>undefined\<close>, _) => true
                 | _ => false);
 
               val all_sel_thms =
                 (if all_sels_distinct andalso null sel_default_eqs then
                    flat sel_thmss
                  else
                    map_product (fn s => fn (xs', c) => make_sel_thm xs' c s) sel_defs
                      (xss' ~~ case_thms))
                 |> filter_out has_undefined_rhs;
 
               fun mk_unique_disc_def () =
                 let
                   val m = the_single ms;
                   val goal = mk_Trueprop_eq (mk_uu_eq (), the_single exist_xs_u_eq_ctrs);
                   val vars = Variable.add_free_names lthy goal [];
                 in
                   Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, prems = _} =>
                     mk_unique_disc_def_tac ctxt m uexhaust_thm)
                   |> Thm.close_derivation \<^here>
                 end;
 
               fun mk_alternate_disc_def k =
                 let
                   val goal =
                     mk_Trueprop_eq (alternate_disc_lhs (K (nth udiscs)) (3 - k),
                       nth exist_xs_u_eq_ctrs (k - 1));
                   val vars = Variable.add_free_names lthy goal [];
                 in
                   Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, ...} =>
                     mk_alternate_disc_def_tac ctxt k (nth disc_defs (2 - k))
                       (nth distinct_thms (2 - k)) uexhaust_thm)
                   |> Thm.close_derivation \<^here>
                 end;
 
               val has_alternate_disc_def =
                 exists (fn def => Thm.eq_thm_prop (def, alternate_disc_no_def)) disc_defs;
 
               val nontriv_disc_defs = disc_defs
                 |> filter_out (member Thm.eq_thm_prop [unique_disc_no_def, alternate_disc_no_def,
                   refl]);
 
               val disc_defs' =
                 map2 (fn k => fn def =>
                   if Thm.eq_thm_prop (def, unique_disc_no_def) then mk_unique_disc_def ()
                   else if Thm.eq_thm_prop (def, alternate_disc_no_def) then mk_alternate_disc_def k
                   else def) ks disc_defs;
 
               val discD_thms = map (fn def => def RS iffD1) disc_defs';
               val discI_thms =
                 map2 (fn m => fn def => funpow m (fn thm => exI RS thm) (def RS iffD2)) ms
                   disc_defs';
               val not_discI_thms =
                 map2 (fn m => fn def => funpow m (fn thm => allI RS thm)
                     (unfold_thms lthy @{thms not_ex} (def RS @{thm ssubst[of _ _ Not]})))
                   ms disc_defs';
 
               val (disc_thmss', disc_thmss) =
                 let
                   fun mk_thm discI _ [] = refl RS discI
                     | mk_thm _ not_discI [distinct] = distinct RS not_discI;
                   fun mk_thms discI not_discI distinctss = map (mk_thm discI not_discI) distinctss;
                 in
                   @{map 3} mk_thms discI_thms not_discI_thms distinct_thmsss' |> `transpose
                 end;
 
               val nontriv_disc_thmss =
                 map2 (fn b => if is_disc_binding_valid b then I else K []) disc_bindings disc_thmss;
 
               fun is_discI_triv b =
                 (n = 1 andalso Binding.is_empty b) orelse Binding.eq_name (b, equal_binding);
 
               val nontriv_discI_thms =
                 flat (map2 (fn b => if is_discI_triv b then K [] else single) disc_bindings
                   discI_thms);
 
               val (distinct_disc_thms, (distinct_disc_thmsss', distinct_disc_thmsss)) =
                 let
                   fun mk_goal [] = []
                     | mk_goal [((_, udisc), (_, udisc'))] =
                       [Logic.all u (Logic.mk_implies (HOLogic.mk_Trueprop udisc,
                          HOLogic.mk_Trueprop (HOLogic.mk_not udisc')))];
 
                   fun prove tac goal =
                     Goal.prove_sorry lthy [] [] goal (fn {context = ctxt, prems = _} => tac ctxt)
                     |> Thm.close_derivation \<^here>;
 
                   val half_pairss = mk_half_pairss (`I (ms ~~ discD_thms ~~ udiscs));
 
                   val half_goalss = map mk_goal half_pairss;
                   val half_thmss =
                     @{map 3} (fn [] => K (K []) | [goal] => fn [(((m, discD), _), _)] =>
                         fn disc_thm => [prove (fn ctxt =>
                           mk_half_distinct_disc_tac ctxt m discD disc_thm) goal])
                       half_goalss half_pairss (flat disc_thmss');
 
                   val other_half_goalss = map (mk_goal o map swap) half_pairss;
                   val other_half_thmss =
                     map2 (map2 (fn thm => prove (fn ctxt =>
                         mk_other_half_distinct_disc_tac ctxt thm))) half_thmss
                       other_half_goalss;
                 in
                   join_halves n half_thmss other_half_thmss ||> `transpose
                   |>> has_alternate_disc_def ? K []
                 end;
 
               val exhaust_disc_thm =
                 let
                   fun mk_prem udisc = mk_imp_p [HOLogic.mk_Trueprop udisc];
                   val goal = fold_rev Logic.all [p, u] (mk_imp_p (map mk_prem udiscs));
                 in
                   Goal.prove_sorry lthy [] [] goal (fn {context = ctxt, prems = _} =>
                     mk_exhaust_disc_tac ctxt n exhaust_thm discI_thms)
                   |> Thm.close_derivation \<^here>
                 end;
 
               val (safe_collapse_thms, all_collapse_thms) =
                 let
                   fun mk_goal m udisc usel_ctr =
                     let
                       val prem = HOLogic.mk_Trueprop udisc;
                       val concl = mk_Trueprop_eq ((usel_ctr, u) |> m = 0 ? swap);
                     in
                       (prem aconv concl, Logic.all u (Logic.mk_implies (prem, concl)))
                     end;
                   val (trivs, goals) = @{map 3} mk_goal ms udiscs usel_ctrs |> split_list;
                   val thms =
                     @{map 5} (fn m => fn discD => fn sel_thms => fn triv => fn goal =>
                         Goal.prove_sorry lthy [] [] goal (fn {context = ctxt, ...} =>
                           mk_collapse_tac ctxt m discD sel_thms ORELSE HEADGOAL (assume_tac ctxt))
                         |> Thm.close_derivation \<^here>
                         |> not triv ? perhaps (try (fn thm => refl RS thm)))
                       ms discD_thms sel_thmss trivs goals;
                 in
                   (map_filter (fn (true, _) => NONE | (false, thm) => SOME thm) (trivs ~~ thms),
                    thms)
                 end;
 
               val swapped_all_collapse_thms =
                 map2 (fn m => fn thm => if m = 0 then thm else thm RS sym) ms all_collapse_thms;
 
               val exhaust_sel_thm =
                 let
                   fun mk_prem usel_ctr = mk_imp_p [mk_Trueprop_eq (u, usel_ctr)];
                   val goal = fold_rev Logic.all [p, u] (mk_imp_p (map mk_prem usel_ctrs));
                 in
                   Goal.prove_sorry lthy [] [] goal (fn {context = ctxt, prems = _} =>
                     mk_exhaust_sel_tac ctxt n exhaust_disc_thm swapped_all_collapse_thms)
                   |> Thm.close_derivation \<^here>
                 end;
 
               val expand_thm =
                 let
                   fun mk_prems k udisc usels vdisc vsels =
                     (if k = n then [] else [mk_Trueprop_eq (udisc, vdisc)]) @
                     (if null usels then
                        []
                      else
                        [Logic.list_implies
                           (if n = 1 then [] else map HOLogic.mk_Trueprop [udisc, vdisc],
                              HOLogic.mk_Trueprop (Library.foldr1 HOLogic.mk_conj
                                (map2 (curry HOLogic.mk_eq) usels vsels)))]);
 
                   val goal =
                     Library.foldr Logic.list_implies
                       (@{map 5} mk_prems ks udiscs uselss vdiscs vselss, uv_eq);
                   val uncollapse_thms =
                     map2 (fn thm => fn [] => thm | _ => thm RS sym) all_collapse_thms uselss;
                   val vars = Variable.add_free_names lthy goal [];
                 in
                   Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, prems = _} =>
                     mk_expand_tac ctxt n ms (inst_thm u exhaust_disc_thm)
                       (inst_thm v exhaust_disc_thm) uncollapse_thms distinct_disc_thmsss
                       distinct_disc_thmsss')
                   |> Thm.close_derivation \<^here>
                 end;
 
               val (split_sel_thm, split_sel_asm_thm) =
                 let
                   val zss = map (K []) xss;
                   val goal = mk_split_goal usel_ctrs zss usel_fs;
                   val asm_goal = mk_split_asm_goal usel_ctrs zss usel_fs;
 
                   val thm = prove_split sel_thmss goal;
                   val asm_thm = prove_split_asm asm_goal thm;
                 in
                   (thm, asm_thm)
                 end;
 
               val case_eq_if_thm =
                 let
                   val goal = mk_Trueprop_eq (ufcase, mk_IfN B udiscs usel_fs);
                   val vars = Variable.add_free_names lthy goal [];
                 in
                   Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, ...} =>
                     mk_case_eq_if_tac ctxt n uexhaust_thm case_thms disc_thmss' sel_thmss)
                   |> Thm.close_derivation \<^here>
                 end;
 
               val disc_eq_case_thms =
                 let
                   fun const_of_bool b = if b then \<^const>\<open>True\<close> else \<^const>\<open>False\<close>;
                   fun mk_case_args n = map_index (fn (k, argTs) =>
                     fold_rev Term.absdummy argTs (const_of_bool (n = k))) ctr_Tss;
                   val goals = map_index (fn (n, udisc) =>
                     mk_Trueprop_eq (udisc, list_comb (casexBool, mk_case_args n) $ u)) udiscs;
                   val goal = Logic.mk_conjunction_balanced goals;
                   val vars = Variable.add_free_names lthy goal [];
                 in
                   Goal.prove_sorry lthy vars [] goal
                     (fn {context = ctxt, ...} => mk_disc_eq_case_tac ctxt (Thm.cterm_of ctxt u)
                        exhaust_thm (flat nontriv_disc_thmss) distinct_thms case_thms)
                   |> Thm.close_derivation \<^here>
                   |> Conjunction.elim_balanced (length goals)
                 end;
             in
               (sel_defs, all_sel_thms, sel_thmss, nontriv_disc_defs, disc_thmss, nontriv_disc_thmss,
                discI_thms, nontriv_discI_thms, distinct_disc_thms, distinct_disc_thmsss,
                [exhaust_disc_thm], [exhaust_sel_thm], all_collapse_thms, safe_collapse_thms,
                [expand_thm], [split_sel_thm], [split_sel_asm_thm], [case_eq_if_thm],
                disc_eq_case_thms)
             end;
 
         val case_distrib_thm =
           let
             val args = @{map 2} (fn f => fn argTs =>
               let val (args, _) = mk_Frees "x" argTs lthy in
                 fold_rev Term.lambda args (h $ list_comb (f, args))
               end) fs ctr_Tss;
             val goal = mk_Trueprop_eq (h $ ufcase, list_comb (casexC, args) $ u);
             val vars = Variable.add_free_names lthy goal [];
           in
             Goal.prove_sorry lthy vars [] goal (fn {context = ctxt, ...} =>
               mk_case_distrib_tac ctxt (Thm.cterm_of ctxt u) exhaust_thm case_thms)
             |> Thm.close_derivation \<^here>
           end;
 
         val exhaust_case_names_attr = Attrib.internal (K (Rule_Cases.case_names exhaust_cases));
         val cases_type_attr = Attrib.internal (K (Induct.cases_type fcT_name));
 
         val nontriv_disc_eq_thmss =
           map (map (fn th => th RS @{thm eq_False[THEN iffD2]}
             handle THM _ => th RS @{thm eq_True[THEN iffD2]})) nontriv_disc_thmss;
 
         val anonymous_notes =
           [(map (fn th => th RS notE) distinct_thms, safe_elim_attrs),
            (flat nontriv_disc_eq_thmss, nitpicksimp_attrs)]
           |> map (fn (thms, attrs) => ((Binding.empty, attrs), [(thms, [])]));
 
         val notes =
           [(caseN, case_thms, nitpicksimp_attrs @ simp_attrs),
            (case_congN, [case_cong_thm], []),
            (case_cong_weak_thmsN, [case_cong_weak_thm], cong_attrs),
            (case_distribN, [case_distrib_thm], []),
            (case_eq_ifN, case_eq_if_thms, []),
            (collapseN, safe_collapse_thms, if ms = [0] then [] else simp_attrs),
            (discN, flat nontriv_disc_thmss, simp_attrs),
            (disc_eq_caseN, disc_eq_case_thms, []),
            (discIN, nontriv_discI_thms, []),
            (distinctN, distinct_thms, simp_attrs @ inductsimp_attrs),
            (distinct_discN, distinct_disc_thms, dest_attrs),
            (exhaustN, [exhaust_thm], [exhaust_case_names_attr, cases_type_attr]),
            (exhaust_discN, exhaust_disc_thms, [exhaust_case_names_attr]),
            (exhaust_selN, exhaust_sel_thms, [exhaust_case_names_attr]),
            (expandN, expand_thms, []),
            (injectN, inject_thms, iff_attrs @ inductsimp_attrs),
            (nchotomyN, [nchotomy_thm], []),
            (selN, all_sel_thms, nitpicksimp_attrs @ simp_attrs),
            (splitN, [split_thm], []),
            (split_asmN, [split_asm_thm], []),
            (split_selN, split_sel_thms, []),
            (split_sel_asmN, split_sel_asm_thms, []),
            (split_selsN, split_sel_thms @ split_sel_asm_thms, []),
            (splitsN, [split_thm, split_asm_thm], [])]
           |> filter_out (null o #2)
           |> map (fn (thmN, thms, attrs) =>
             ((qualify true (Binding.name thmN), attrs), [(thms, [])]));
 
         val (noted, lthy') = lthy
           |> Spec_Rules.add Binding.empty Spec_Rules.equational [casex] case_thms
           |> fold (uncurry (Spec_Rules.add Binding.empty Spec_Rules.equational))
             (AList.group (eq_list (op aconv)) (map (`(single o lhs_head_of)) all_sel_thms))
           |> fold (uncurry (Spec_Rules.add Binding.empty Spec_Rules.equational))
             (filter_out (null o snd) (map single discs ~~ nontriv_disc_eq_thmss))
           |> Local_Theory.declaration {syntax = false, pervasive = true}
             (fn phi => Case_Translation.register
                (Morphism.term phi casex) (map (Morphism.term phi) ctrs))
           |> plugins code_plugin ?
              (Code.declare_default_eqns (map (rpair true) (flat nontriv_disc_eq_thmss @ case_thms @ all_sel_thms))
              #> Local_Theory.declaration {syntax = false, pervasive = false}
                (fn phi => Context.mapping
                   (add_ctr_code fcT_name (map (Morphism.typ phi) As)
                      (map (dest_Const o Morphism.term phi) ctrs) (Morphism.fact phi inject_thms)
                      (Morphism.fact phi distinct_thms) (Morphism.fact phi case_thms))
                   I))
           |> Local_Theory.notes (anonymous_notes @ notes)
           (* for "datatype_realizer.ML": *)
           |>> name_noted_thms fcT_name exhaustN;
 
         val ctr_sugar =
           {kind = kind, T = fcT, ctrs = ctrs, casex = casex, discs = discs, selss = selss,
            exhaust = exhaust_thm, nchotomy = nchotomy_thm, injects = inject_thms,
            distincts = distinct_thms, case_thms = case_thms, case_cong = case_cong_thm,
            case_cong_weak = case_cong_weak_thm, case_distribs = [case_distrib_thm],
            split = split_thm, split_asm = split_asm_thm, disc_defs = nontriv_disc_defs,
            disc_thmss = disc_thmss, discIs = discI_thms, disc_eq_cases = disc_eq_case_thms,
            sel_defs = sel_defs, sel_thmss = sel_thmss, distinct_discsss = distinct_disc_thmsss,
            exhaust_discs = exhaust_disc_thms, exhaust_sels = exhaust_sel_thms,
            collapses = all_collapse_thms, expands = expand_thms, split_sels = split_sel_thms,
            split_sel_asms = split_sel_asm_thms, case_eq_ifs = case_eq_if_thms}
           |> morph_ctr_sugar (substitute_noted_thm noted);
       in
         (ctr_sugar, lthy' |> register_ctr_sugar plugins ctr_sugar)
       end;
   in
     (goalss, after_qed, lthy)
   end;
 
 fun free_constructors kind tacss = (fn (goalss, after_qed, lthy) =>
   map2 (map2 (Thm.close_derivation \<^here> oo Goal.prove_sorry lthy [] [])) goalss tacss
   |> (fn thms => after_qed thms lthy)) oo prepare_free_constructors kind (K I) (K I);
 
 fun free_constructors_cmd kind = (fn (goalss, after_qed, lthy) =>
   Proof.theorem NONE (snd oo after_qed) (map (map (rpair [])) goalss) lthy) oo
   prepare_free_constructors kind Plugin_Name.make_filter Syntax.read_term;
 
 val parse_bound_term = Parse.binding --| \<^keyword>\<open>:\<close> -- Parse.term;
 
 type ctr_options = Plugin_Name.filter * bool;
 type ctr_options_cmd = (Proof.context -> Plugin_Name.filter) * bool;
 
 val default_ctr_options : ctr_options = (Plugin_Name.default_filter, false);
 val default_ctr_options_cmd : ctr_options_cmd = (K Plugin_Name.default_filter, false);
 
 val parse_ctr_options =
   Scan.optional (\<^keyword>\<open>(\<close> |-- Parse.list1
         (Plugin_Name.parse_filter >> (apfst o K)
          || Parse.reserved "discs_sels" >> (apsnd o K o K true)) --|
       \<^keyword>\<open>)\<close>
       >> (fn fs => fold I fs default_ctr_options_cmd))
     default_ctr_options_cmd;
 
 fun parse_ctr_spec parse_ctr parse_arg =
   parse_opt_binding_colon -- parse_ctr -- Scan.repeat parse_arg;
 
 val parse_ctr_specs = Parse.enum1 "|" (parse_ctr_spec Parse.term Parse.binding);
 val parse_sel_default_eqs = Scan.optional (\<^keyword>\<open>where\<close> |-- Parse.enum1 "|" Parse.prop) [];
 
 val _ =
   Outer_Syntax.local_theory_to_proof \<^command_keyword>\<open>free_constructors\<close>
     "register an existing freely generated type's constructors"
     (parse_ctr_options -- Parse.binding --| \<^keyword>\<open>for\<close> -- parse_ctr_specs
        -- parse_sel_default_eqs
      >> free_constructors_cmd Unknown);
 
 
 
 (** external views **)
 
 (* document antiquotations *)
 
 local
 
 fun antiquote_setup binding co =
-  Thy_Output.antiquotation_pretty_source_embedded binding
+  Document_Output.antiquotation_pretty_source_embedded binding
     ((Scan.ahead (Scan.lift Parse.not_eof) >> Token.pos_of) --
       Args.type_name {proper = true, strict = true})
     (fn ctxt => fn (pos, type_name) =>
       let
         fun err () =
           error ("Bad " ^ Binding.name_of binding ^ ": " ^ quote type_name ^ Position.here pos);
       in
         (case ctr_sugar_of ctxt type_name of
           NONE => err ()
         | SOME {kind, T = T0, ctrs = ctrs0, ...} =>
             let
               val _ = if co = (kind = Codatatype) then () else err ();
 
               val T = Logic.unvarifyT_global T0;
               val ctrs = map Logic.unvarify_global ctrs0;
 
               val pretty_typ_bracket = Syntax.pretty_typ (Config.put pretty_priority 1001 ctxt);
               fun pretty_ctr ctr =
                 Pretty.block (Pretty.breaks (Syntax.pretty_term ctxt ctr ::
                   map pretty_typ_bracket (binder_types (fastype_of ctr))));
             in
               Pretty.block (Pretty.keyword1 (Binding.name_of binding) :: Pretty.brk 1 ::
                 Syntax.pretty_typ ctxt T :: Pretty.str " =" :: Pretty.brk 1 ::
                 flat (separate [Pretty.brk 1, Pretty.str "| "] (map (single o pretty_ctr) ctrs)))
             end)
         end);
 
 in
 
 val _ =
   Theory.setup
    (antiquote_setup \<^binding>\<open>datatype\<close> false #>
     antiquote_setup \<^binding>\<open>codatatype\<close> true);
 
 end;
 
 
 (* theory export *)
 
 val _ = Export_Theory.setup_presentation (fn context => fn thy =>
   let
     val parents = map (Data.get o Context.Theory) (Theory.parents_of thy);
     val datatypes =
       (Data.get (Context.Theory thy), []) |-> Symtab.fold
         (fn (name, (pos, {kind, T, ctrs, ...})) =>
           if kind = Record orelse exists (fn tab => Symtab.defined tab name) parents then I
           else
             let
               val pos_properties = Thy_Info.adjust_pos_properties context pos;
               val typ = Logic.unvarifyT_global T;
               val constrs = map Logic.unvarify_global ctrs;
               val typargs = rev (fold Term.add_tfrees (Logic.mk_type typ :: constrs) []);
               val constructors = map (fn t => (t, Term.type_of t)) constrs;
             in
               cons (pos_properties, (name, (kind = Codatatype, (typargs, (typ, constructors)))))
             end);
   in
     if null datatypes then ()
     else
       Export_Theory.export_body thy "datatypes"
         let open XML.Encode Term_XML.Encode in
           list (pair properties (pair string (pair bool (pair (list (pair string sort))
             (pair typ (list (pair (term (Sign.consts_of thy)) typ))))))) datatypes
         end
   end);
 
 end;
diff --git a/src/HOL/Tools/value_command.ML b/src/HOL/Tools/value_command.ML
--- a/src/HOL/Tools/value_command.ML
+++ b/src/HOL/Tools/value_command.ML
@@ -1,84 +1,84 @@
 (*  Title:      HOL/Tools/value_command.ML
     Author:     Florian Haftmann, TU Muenchen
 
 Generic value command for arbitrary evaluators, with default using nbe or SML.
 *)
 
 signature VALUE_COMMAND =
 sig
   val value: Proof.context -> term -> term
   val value_select: string -> Proof.context -> term -> term
   val value_cmd: xstring -> string list -> string -> Toplevel.state -> unit
   val add_evaluator: binding * (Proof.context -> term -> term) 
     -> theory -> string * theory
 end;
 
 structure Value_Command : VALUE_COMMAND =
 struct
 
 structure Evaluators = Theory_Data
 (
   type T = (Proof.context -> term -> term) Name_Space.table;
   val empty = Name_Space.empty_table "evaluator";
   val extend = I;
   val merge = Name_Space.merge_tables;
 )
 
 fun add_evaluator (b, evaluator) thy =
   let
     val (name, tab') = Name_Space.define (Context.Theory thy) true
       (b, evaluator) (Evaluators.get thy);
     val thy' = Evaluators.put tab' thy;
   in (name, thy') end;
 
 fun intern_evaluator ctxt raw_name =
   if raw_name = "" then ""
   else Name_Space.intern (Name_Space.space_of_table
     (Evaluators.get (Proof_Context.theory_of ctxt))) raw_name;
 
 fun default_value ctxt t =
   if null (Term.add_frees t [])
   then Code_Evaluation.dynamic_value_strict ctxt t
   else Nbe.dynamic_value ctxt t;
 
 fun value_select name ctxt =
   if name = ""
   then default_value ctxt
   else Name_Space.get (Evaluators.get (Proof_Context.theory_of ctxt)) name ctxt;
 
 val value = value_select "";
 
 fun value_cmd raw_name modes raw_t state =
   let
     val ctxt = Toplevel.context_of state;
     val name = intern_evaluator ctxt raw_name;
     val t = Syntax.read_term ctxt raw_t;
     val t' = value_select name ctxt t;
     val ty' = Term.type_of t';
     val ctxt' = Proof_Context.augment t' ctxt;
     val p = Print_Mode.with_modes modes (fn () =>
       Pretty.block [Pretty.quote (Syntax.pretty_term ctxt' t'), Pretty.fbrk,
         Pretty.str "::", Pretty.brk 1, Pretty.quote (Syntax.pretty_typ ctxt' ty')]) ();
   in Pretty.writeln p end;
 
 val opt_modes =
   Scan.optional (\<^keyword>\<open>(\<close> |-- Parse.!!! (Scan.repeat1 Parse.name --| \<^keyword>\<open>)\<close>)) [];
 
 val opt_evaluator =
   Scan.optional (\<^keyword>\<open>[\<close> |-- Parse.name --| \<^keyword>\<open>]\<close>) "";
   
 val _ =
   Outer_Syntax.command \<^command_keyword>\<open>value\<close> "evaluate and print term"
     (opt_evaluator -- opt_modes -- Parse.term
       >> (fn ((name, modes), t) => Toplevel.keep (value_cmd name modes t)));
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_pretty_source_embedded \<^binding>\<open>value\<close>
+  (Document_Output.antiquotation_pretty_source_embedded \<^binding>\<open>value\<close>
     (Scan.lift opt_evaluator -- Term_Style.parse -- Args.term)
     (fn ctxt => fn ((name, style), t) =>
-      Thy_Output.pretty_term ctxt (style (value_select name ctxt t)))
+      Document_Output.pretty_term ctxt (style (value_select name ctxt t)))
   #> add_evaluator (\<^binding>\<open>simp\<close>, Code_Simp.dynamic_value) #> snd
   #> add_evaluator (\<^binding>\<open>nbe\<close>, Nbe.dynamic_value) #> snd
   #> add_evaluator (\<^binding>\<open>code\<close>, Code_Evaluation.dynamic_value_strict) #> snd);
 
 end;
diff --git a/src/Pure/Admin/build_csdp.scala b/src/Pure/Admin/build_csdp.scala
--- a/src/Pure/Admin/build_csdp.scala
+++ b/src/Pure/Admin/build_csdp.scala
@@ -1,207 +1,207 @@
 /*  Title:      Pure/Admin/build_csdp.scala
     Author:     Makarius
 
 Build Isabelle CSDP component from official download.
 */
 
 package isabelle
 
 
 object Build_CSDP
 {
   // Note: version 6.2.0 does not quite work for the "sos" proof method
   val default_download_url = "https://github.com/coin-or/Csdp/archive/releases/6.1.1.tar.gz"
 
 
   /* flags */
 
   sealed case class Flags(platform: String, CFLAGS: String = "", LIBS: String = "")
   {
     val changed: List[(String, String)] =
       List("CFLAGS" -> CFLAGS, "LIBS" -> LIBS).filter(p => p._2.nonEmpty)
 
     def print: Option[String] =
       if (changed.isEmpty) None
       else
-        Some("  * " + platform + ":\n" + changed.map(p => "    " + p._1 + "=" + p._2)
+        Some("  * " + platform + ":\n" + changed.map(p => "    " + Properties.Eq(p))
           .mkString("\n"))
 
     def change(path: Path): Unit =
     {
-      def change_line(line: String, entry: (String, String)): String =
-        line.replaceAll(entry._1 + "=.*", entry._1 + "=" + entry._2)
+      def change_line(line: String, p: (String, String)): String =
+        line.replaceAll(p._1 + "=.*", Properties.Eq(p))
       File.change(path, s =>
         split_lines(s).map(line => changed.foldLeft(line)(change_line)).mkString("\n"))
     }
   }
 
   val build_flags: List[Flags] =
     List(
       Flags("arm64-linux",
         CFLAGS = "-O3 -ansi -Wall -DNOSHORTS -DBIT64 -DUSESIGTERM -DUSEGETTIME -I../include",
         LIBS = "-static -L../lib -lsdp -llapack -lblas -lgfortran -lm"),
       Flags("x86_64-linux",
         CFLAGS = "-O3 -ansi -Wall -DNOSHORTS -DBIT64 -DUSESIGTERM -DUSEGETTIME -I../include",
         LIBS = "-static -L../lib -lsdp -llapack -lblas -lgfortran -lquadmath -lm"),
       Flags("x86_64-darwin",
         CFLAGS = "-O3 -Wall -DNOSHORTS -DBIT64 -DUSESIGTERM -DUSEGETTIME -I../include",
         LIBS = "-L../lib -lsdp -llapack -lblas -lm"),
       Flags("x86_64-windows"))
 
 
   /* build CSDP */
 
   def build_csdp(
     download_url: String = default_download_url,
     verbose: Boolean = false,
     progress: Progress = new Progress,
     target_dir: Path = Path.current,
     mingw: MinGW = MinGW.none): Unit =
   {
     mingw.check
 
     Isabelle_System.with_tmp_dir("build")(tmp_dir =>
     {
       /* component */
 
       val Archive_Name = """^.*?([^/]+)$""".r
       val Version = """^[^0-9]*([0-9].*)\.tar.gz$""".r
 
       val archive_name =
         download_url match {
           case Archive_Name(name) => name
           case _ => error("Failed to determine source archive name from " + quote(download_url))
         }
 
       val version =
         archive_name match {
           case Version(version) => version
           case _ => error("Failed to determine component version from " + quote(archive_name))
         }
 
       val component_name = "csdp-" + version
       val component_dir = Isabelle_System.new_directory(target_dir + Path.basic(component_name))
       progress.echo("Component " + component_dir)
 
 
       /* platform */
 
       val platform_name =
         proper_string(Isabelle_System.getenv("ISABELLE_WINDOWS_PLATFORM64")) orElse
         proper_string(Isabelle_System.getenv("ISABELLE_PLATFORM64")) getOrElse
         error("No 64bit platform")
 
       val platform_dir = Isabelle_System.make_directory(component_dir + Path.basic(platform_name))
 
 
       /* download source */
 
       val archive_path = tmp_dir + Path.basic(archive_name)
       Isabelle_System.download_file(download_url, archive_path, progress = progress)
 
       Isabelle_System.bash("tar xzf " + File.bash_path(archive_path), cwd = tmp_dir.file).check
       val source_name = File.get_dir(tmp_dir)
 
       Isabelle_System.bash(
         "tar xzf " + archive_path + " && mv " + Bash.string(source_name) + " src",
         cwd = component_dir.file).check
 
 
       /* build */
 
       progress.echo("Building CSDP for " + platform_name + " ...")
 
       val build_dir = tmp_dir + Path.basic(source_name)
       build_flags.find(flags => flags.platform == platform_name) match {
         case None => error("No build flags for platform " + quote(platform_name))
         case Some(flags) =>
           File.find_files(build_dir.file, pred = file => file.getName == "Makefile").
             foreach(file => flags.change(File.path(file)))
       }
 
       progress.bash(mingw.bash_script("make"), cwd = build_dir.file, echo = verbose).check
 
 
       /* install */
 
       Isabelle_System.copy_file(build_dir + Path.explode("LICENSE"), component_dir)
       Isabelle_System.copy_file(build_dir + Path.explode("solver/csdp").platform_exe, platform_dir)
 
       if (Platform.is_windows) {
         Executable.libraries_closure(platform_dir + Path.explode("csdp.exe"), mingw = mingw,
           filter =
             Set("libblas", "liblapack", "libgfortran", "libgcc_s_seh",
               "libquadmath", "libwinpthread"))
       }
 
 
       /* settings */
 
       val etc_dir = Isabelle_System.make_directory(component_dir + Path.basic("etc"))
       File.write(etc_dir + Path.basic("settings"),
         """# -*- shell-script -*- :mode=shellscript:
 
 ISABELLE_CSDP="$COMPONENT/${ISABELLE_WINDOWS_PLATFORM64:-$ISABELLE_PLATFORM64}/csdp"
 """)
 
 
       /* README */
 
       File.write(component_dir + Path.basic("README"),
 """This is CSDP """ + version + """ from
 """ + download_url + """
 
 Makefile flags have been changed for various platforms as follows:
 
 """ + build_flags.flatMap(_.print).mkString("\n\n") + """
 
 The distribution has been built like this:
 
     cd src && make
 
 Only the bare "solver/csdp" program is used for Isabelle.
 
 
         Makarius
         """ + Date.Format.date(Date.now()) + "\n")
     })
 }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool =
     Isabelle_Tool("build_csdp", "build prover component from official download", Scala_Project.here,
     args =>
     {
       var target_dir = Path.current
       var mingw = MinGW.none
       var download_url = default_download_url
       var verbose = false
 
       val getopts = Getopts("""
 Usage: isabelle build_csdp [OPTIONS]
 
   Options are:
     -D DIR       target directory (default ".")
     -M DIR       msys/mingw root specification for Windows
     -U URL       download URL
                  (default: """" + default_download_url + """")
     -v           verbose
 
   Build prover component from official download.
 """,
         "D:" -> (arg => target_dir = Path.explode(arg)),
         "M:" -> (arg => mingw = MinGW(Path.explode(arg))),
         "U:" -> (arg => download_url = arg),
         "v" -> (_ => verbose = true))
 
       val more_args = getopts(args)
       if (more_args.nonEmpty) getopts.usage()
 
       val progress = new Console_Progress()
 
       build_csdp(download_url = download_url, verbose = verbose, progress = progress,
         target_dir = target_dir, mingw = mingw)
     })
 }
diff --git a/src/Pure/Admin/build_doc.scala b/src/Pure/Admin/build_doc.scala
--- a/src/Pure/Admin/build_doc.scala
+++ b/src/Pure/Admin/build_doc.scala
@@ -1,112 +1,112 @@
 /*  Title:      Pure/Admin/build_doc.scala
     Author:     Makarius
 
 Build Isabelle documentation.
 */
 
 package isabelle
 
 
 object Build_Doc
 {
   /* build_doc */
 
   def build_doc(
     options: Options,
     progress: Progress = new Progress,
     all_docs: Boolean = false,
     max_jobs: Int = 1,
     sequential: Boolean = false,
     docs: List[String] = Nil): Unit =
   {
     val store = Sessions.store(options)
 
     val sessions_structure = Sessions.load_structure(options)
     val selected =
       for {
         session <- sessions_structure.build_topological_order
         info = sessions_structure(session)
         if info.groups.contains("doc")
         doc = info.options.string("document_variants")
         if all_docs || docs.contains(doc)
       } yield (doc, session)
 
     val documents = selected.map(_._1)
     val selection = Sessions.Selection(sessions = selected.map(_._2))
 
     docs.filter(doc => !documents.contains(doc)) match {
       case Nil =>
       case bad => error("No documentation session for " + commas_quote(bad))
     }
 
     progress.echo("Build started for sessions " + commas_quote(selection.sessions))
     Build.build(options, selection = selection, progress = progress, max_jobs = max_jobs).ok ||
       error("Build failed")
 
     progress.echo("Build started for documentation " + commas_quote(documents))
     val doc_options = options + "document=pdf"
     val deps = Sessions.load_structure(doc_options).selection_deps(selection)
 
     val errs =
       Par_List.map[(String, String), Option[String]](
       {
         case (doc, session) =>
           try {
             progress.echo("Documentation " + quote(doc) + " ...")
 
             using(store.open_database_context())(db_context =>
-              Presentation.build_documents(session, deps, db_context,
+              Document_Build.build_documents(Document_Build.context(session, deps, db_context),
                 output_pdf = Some(Path.explode("~~/doc"))))
             None
           }
           catch {
             case Exn.Interrupt.ERROR(msg) =>
               val sep = if (msg.contains('\n')) "\n" else " "
               Some("Documentation " + quote(doc) + " failed:" + sep + msg)
           }
       }, selected, sequential = sequential).flatten
 
     if (errs.nonEmpty) error(cat_lines(errs))
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool =
     Isabelle_Tool("build_doc", "build Isabelle documentation", Scala_Project.here, args =>
     {
       var all_docs = false
       var max_jobs = 1
       var sequential = false
       var options = Options.init()
 
       val getopts =
         Getopts("""
 Usage: isabelle build_doc [OPTIONS] [DOCS ...]
 
   Options are:
     -a           select all documentation sessions
     -j INT       maximum number of parallel jobs (default 1)
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -s           sequential LaTeX jobs
 
   Build Isabelle documentation from documentation sessions with
   suitable document_variants entry.
 """,
           "a" -> (_ => all_docs = true),
           "j:" -> (arg => max_jobs = Value.Int.parse(arg)),
           "o:" -> (arg => options = options + arg),
           "s" -> (_ => sequential = true))
 
       val docs = getopts(args)
 
       if (!all_docs && docs.isEmpty) getopts.usage()
 
       val progress = new Console_Progress()
 
       progress.interrupt_handler {
         build_doc(options, progress = progress, all_docs = all_docs, max_jobs = max_jobs,
           sequential = sequential, docs = docs)
       }
     })
 }
diff --git a/src/Pure/Admin/build_log.scala b/src/Pure/Admin/build_log.scala
--- a/src/Pure/Admin/build_log.scala
+++ b/src/Pure/Admin/build_log.scala
@@ -1,1175 +1,1167 @@
 /*  Title:      Pure/Admin/build_log.scala
     Author:     Makarius
 
 Management of build log files and database storage.
 */
 
 package isabelle
 
 
 import java.io.{File => JFile}
 import java.time.format.{DateTimeFormatter, DateTimeParseException}
 import java.util.Locale
 
 import scala.collection.immutable.SortedMap
 import scala.collection.mutable
 import scala.util.matching.Regex
 
 
 object Build_Log
 {
   /** content **/
 
   /* properties */
 
   object Prop
   {
     val build_tags = SQL.Column.string("build_tags")  // lines
     val build_args = SQL.Column.string("build_args")  // lines
     val build_group_id = SQL.Column.string("build_group_id")
     val build_id = SQL.Column.string("build_id")
     val build_engine = SQL.Column.string("build_engine")
     val build_host = SQL.Column.string("build_host")
     val build_start = SQL.Column.date("build_start")
     val build_end = SQL.Column.date("build_end")
     val isabelle_version = SQL.Column.string("isabelle_version")
     val afp_version = SQL.Column.string("afp_version")
 
     val all_props: List[SQL.Column] =
       List(build_tags, build_args, build_group_id, build_id, build_engine,
         build_host, build_start, build_end, isabelle_version, afp_version)
   }
 
 
   /* settings */
 
   object Settings
   {
     val ISABELLE_BUILD_OPTIONS = SQL.Column.string("ISABELLE_BUILD_OPTIONS")
     val ML_PLATFORM = SQL.Column.string("ML_PLATFORM")
     val ML_HOME = SQL.Column.string("ML_HOME")
     val ML_SYSTEM = SQL.Column.string("ML_SYSTEM")
     val ML_OPTIONS = SQL.Column.string("ML_OPTIONS")
 
     val ml_settings = List(ML_PLATFORM, ML_HOME, ML_SYSTEM, ML_OPTIONS)
     val all_settings = ISABELLE_BUILD_OPTIONS :: ml_settings
 
     type Entry = (String, String)
     type T = List[Entry]
 
     object Entry
     {
       def unapply(s: String): Option[Entry] =
-        s.indexOf('=') match {
-          case -1 => None
-          case i =>
-            val a = s.substring(0, i)
-            val b = Library.perhaps_unquote(s.substring(i + 1))
-            Some((a, b))
-        }
-      def apply(a: String, b: String): String = a + "=" + quote(b)
-      def getenv(a: String): String = apply(a, Isabelle_System.getenv(a))
+        for { (a, b) <- Properties.Eq.unapply(s) }
+        yield (a, Library.perhaps_unquote(b))
+      def getenv(a: String): String =
+        Properties.Eq(a, quote(Isabelle_System.getenv(a)))
     }
 
     def show(): String =
       cat_lines(
         List(Entry.getenv("ISABELLE_TOOL_JAVA_OPTIONS"),
           Entry.getenv(ISABELLE_BUILD_OPTIONS.name), "") :::
         ml_settings.map(c => Entry.getenv(c.name)))
   }
 
 
   /* file names */
 
   def log_date(date: Date): String =
     String.format(Locale.ROOT, "%s.%05d",
       DateTimeFormatter.ofPattern("yyyy-MM-dd").format(date.rep),
       java.lang.Long.valueOf((date.time - date.midnight.time).ms / 1000))
 
   def log_subdir(date: Date): Path =
     Path.explode("log") + Path.explode(date.rep.getYear.toString)
 
   def log_filename(engine: String, date: Date, more: List[String] = Nil): Path =
     Path.explode((engine :: log_date(date) :: more).mkString("", "_", ".log"))
 
 
 
   /** log file **/
 
   def print_date(date: Date): String = Log_File.Date_Format(date)
 
   object Log_File
   {
     /* log file */
 
     def plain_name(name: String): String =
     {
       List(".log", ".log.gz", ".log.xz", ".gz", ".xz").find(name.endsWith) match {
         case Some(s) => Library.try_unsuffix(s, name).get
         case None => name
       }
     }
 
     def apply(name: String, lines: List[String]): Log_File =
       new Log_File(plain_name(name), lines.map(Library.trim_line))
 
     def apply(name: String, text: String): Log_File =
       new Log_File(plain_name(name), Library.trim_split_lines(text))
 
     def apply(file: JFile): Log_File =
     {
       val name = file.getName
       val text =
         if (name.endsWith(".gz")) File.read_gzip(file)
         else if (name.endsWith(".xz")) File.read_xz(file)
         else File.read(file)
       apply(name, text)
     }
 
     def apply(path: Path): Log_File = apply(path.file)
 
 
     /* log file collections */
 
     def is_log(file: JFile,
       prefixes: List[String] =
         List(Build_History.log_prefix, Identify.log_prefix, Identify.log_prefix2,
           Isatest.log_prefix, AFP_Test.log_prefix, Jenkins.log_prefix),
       suffixes: List[String] = List(".log", ".log.gz", ".log.xz")): Boolean =
     {
       val name = file.getName
 
       prefixes.exists(name.startsWith) &&
       suffixes.exists(name.endsWith) &&
       name != "isatest.log" &&
       name != "afp-test.log" &&
       name != "main.log"
     }
 
 
     /* date format */
 
     val Date_Format =
     {
       val fmts =
         Date.Formatter.variants(
           List("EEE MMM d HH:mm:ss O yyyy", "EEE MMM d HH:mm:ss VV yyyy"),
           List(Locale.ENGLISH, Locale.GERMAN)) :::
         List(
           DateTimeFormatter.RFC_1123_DATE_TIME,
           Date.Formatter.pattern("EEE MMM d HH:mm:ss yyyy").withZone(Date.timezone_berlin))
 
       def tune_timezone(s: String): String =
         s match {
           case "CET" | "MET" => "GMT+1"
           case "CEST" | "MEST" => "GMT+2"
           case "EST" => "Europe/Berlin"
           case _ => s
         }
       def tune_weekday(s: String): String =
         s match {
           case "Die" => "Di"
           case "Mit" => "Mi"
           case "Don" => "Do"
           case "Fre" => "Fr"
           case "Sam" => "Sa"
           case "Son" => "So"
           case _ => s
         }
 
       def tune(s: String): String =
         Word.implode(
           Word.explode(s) match {
             case a :: "M\uFFFDr" :: bs => tune_weekday(a) :: "Mär" :: bs.map(tune_timezone)
             case a :: bs => tune_weekday(a) :: bs.map(tune_timezone)
             case Nil => Nil
           }
         )
 
       Date.Format.make(fmts, tune)
     }
   }
 
   class Log_File private(val name: String, val lines: List[String])
   {
     log_file =>
 
     override def toString: String = name
 
     def text: String = cat_lines(lines)
 
     def err(msg: String): Nothing =
       error("Error in log file " + quote(name) + ": " + msg)
 
 
     /* date format */
 
     object Strict_Date
     {
       def unapply(s: String): Some[Date] =
         try { Some(Log_File.Date_Format.parse(s)) }
         catch { case exn: DateTimeParseException => log_file.err(exn.getMessage) }
     }
 
 
     /* inlined text */
 
     def filter(Marker: Protocol_Message.Marker): List[String] =
       for (Marker(text) <- lines) yield text
 
     def find(Marker: Protocol_Message.Marker): Option[String] =
       lines.collectFirst({ case Marker(text) => text })
 
     def find_match(regexes: List[Regex]): Option[String] =
       regexes match {
         case Nil => None
         case regex :: rest =>
           lines.iterator.map(regex.unapplySeq(_)).find(res => res.isDefined && res.get.length == 1).
             map(res => res.get.head) orElse find_match(rest)
       }
 
 
     /* settings */
 
-    def get_setting(a: String): Option[Settings.Entry] =
-      lines.find(_.startsWith(a + "=")) match {
-        case Some(line) => Settings.Entry.unapply(line)
-        case None => None
-      }
+    def get_setting(name: String): Option[Settings.Entry] =
+      lines.collectFirst({ case Settings.Entry(a, b) if a == name => a -> b })
 
     def get_all_settings: Settings.T =
       for { c <- Settings.all_settings; entry <- get_setting(c.name) }
       yield entry
 
 
     /* properties (YXML) */
 
     val cache: XML.Cache = XML.Cache.make()
 
     def parse_props(text: String): Properties.T =
       try { cache.props(XML.Decode.properties(YXML.parse_body(text))) }
       catch { case _: XML.Error => log_file.err("malformed properties") }
 
     def filter_props(marker: Protocol_Message.Marker): List[Properties.T] =
       for (text <- filter(marker) if YXML.detect(text)) yield parse_props(text)
 
     def find_props(marker: Protocol_Message.Marker): Option[Properties.T] =
       for (text <- find(marker) if YXML.detect(text)) yield parse_props(text)
 
 
     /* parse various formats */
 
     def parse_meta_info(): Meta_Info = Build_Log.parse_meta_info(log_file)
 
     def parse_build_info(ml_statistics: Boolean = false): Build_Info =
       Build_Log.parse_build_info(log_file, ml_statistics)
 
     def parse_session_info(
         command_timings: Boolean = false,
         theory_timings: Boolean = false,
         ml_statistics: Boolean = false,
         task_statistics: Boolean = false): Session_Info =
       Build_Log.parse_session_info(
         log_file, command_timings, theory_timings, ml_statistics, task_statistics)
   }
 
 
 
   /** digested meta info: produced by Admin/build_history in log.xz file **/
 
   object Meta_Info
   {
     val empty: Meta_Info = Meta_Info(Nil, Nil)
   }
 
   sealed case class Meta_Info(props: Properties.T, settings: Settings.T)
   {
     def is_empty: Boolean = props.isEmpty && settings.isEmpty
 
     def get(c: SQL.Column): Option[String] =
       Properties.get(props, c.name) orElse
       Properties.get(settings, c.name)
 
     def get_date(c: SQL.Column): Option[Date] =
       get(c).map(Log_File.Date_Format.parse)
   }
 
   object Identify
   {
     val log_prefix = "isabelle_identify_"
     val log_prefix2 = "plain_identify_"
 
     def engine(log_file: Log_File): String =
       if (log_file.name.startsWith(Jenkins.log_prefix)) "jenkins_identify"
       else if (log_file.name.startsWith(log_prefix2)) "plain_identify"
       else "identify"
 
     def content(date: Date, isabelle_version: Option[String], afp_version: Option[String]): String =
       terminate_lines(
         List("isabelle_identify: " + Build_Log.print_date(date), "") :::
         isabelle_version.map("Isabelle version: " + _).toList :::
         afp_version.map("AFP version: " + _).toList)
 
     val Start = new Regex("""^isabelle_identify: (.+)$""")
     val No_End = new Regex("""$.""")
     val Isabelle_Version = List(new Regex("""^Isabelle version: (\S+)$"""))
     val AFP_Version = List(new Regex("""^AFP version: (\S+)$"""))
   }
 
   object Isatest
   {
     val log_prefix = "isatest-makeall-"
     val engine = "isatest"
     val Start = new Regex("""^------------------- starting test --- (.+) --- (.+)$""")
     val End = new Regex("""^------------------- test (?:successful|FAILED) --- (.+) --- .*$""")
     val Isabelle_Version = List(new Regex("""^Isabelle version: (\S+)$"""))
   }
 
   object AFP_Test
   {
     val log_prefix = "afp-test-devel-"
     val engine = "afp-test"
     val Start = new Regex("""^Start test(?: for .+)? at ([^,]+), (.*)$""")
     val Start_Old = new Regex("""^Start test(?: for .+)? at ([^,]+)$""")
     val End = new Regex("""^End test on (.+), .+, elapsed time:.*$""")
     val Isabelle_Version = List(new Regex("""^Isabelle version: .* -- hg id (\S+)$"""))
     val AFP_Version = List(new Regex("""^AFP version: .* -- hg id (\S+)$"""))
     val Bad_Init = new Regex("""^cp:.*: Disc quota exceeded$""")
   }
 
   object Jenkins
   {
     val log_prefix = "jenkins_"
     val engine = "jenkins"
     val Host = new Regex("""^Building remotely on (\S+) \((\S+)\).*$""")
     val Start = new Regex("""^(?:Started by an SCM change|Started from command line by admin|).*$""")
     val Start_Date = new Regex("""^Build started at (.+)$""")
     val No_End = new Regex("""$.""")
     val Isabelle_Version =
       List(new Regex("""^(?:Build for Isabelle id|Isabelle id) (\w+).*$"""),
         new Regex("""^ISABELLE_CI_REPO_ID="(\w+)".*$"""),
         new Regex("""^(\w{12}) tip.*$"""))
     val AFP_Version =
       List(new Regex("""^(?:Build for AFP id|AFP id) (\w+).*$"""),
         new Regex("""^ISABELLE_CI_AFP_ID="(\w+)".*$"""))
     val CONFIGURATION = "=== CONFIGURATION ==="
     val BUILD = "=== BUILD ==="
   }
 
   private def parse_meta_info(log_file: Log_File): Meta_Info =
   {
     def parse(engine: String, host: String, start: Date,
       End: Regex, Isabelle_Version: List[Regex], AFP_Version: List[Regex]): Meta_Info =
     {
       val build_id =
       {
         val prefix = proper_string(host) orElse proper_string(engine) getOrElse "build"
         prefix + ":" + start.time.ms
       }
       val build_engine = if (engine == "") Nil else List(Prop.build_engine.name -> engine)
       val build_host = if (host == "") Nil else List(Prop.build_host.name -> host)
 
       val start_date = List(Prop.build_start.name -> print_date(start))
       val end_date =
         log_file.lines.last match {
           case End(log_file.Strict_Date(end_date)) =>
             List(Prop.build_end.name -> print_date(end_date))
           case _ => Nil
         }
 
       val isabelle_version =
         log_file.find_match(Isabelle_Version).map(Prop.isabelle_version.name -> _)
       val afp_version =
         log_file.find_match(AFP_Version).map(Prop.afp_version.name -> _)
 
       Meta_Info((Prop.build_id.name -> build_id) :: build_engine ::: build_host :::
           start_date ::: end_date ::: isabelle_version.toList ::: afp_version.toList,
         log_file.get_all_settings)
     }
 
     log_file.lines match {
       case line :: _ if Protocol.Meta_Info_Marker.test_yxml(line) =>
         Meta_Info(log_file.find_props(Protocol.Meta_Info_Marker).get, log_file.get_all_settings)
 
       case Identify.Start(log_file.Strict_Date(start)) :: _ =>
         parse(Identify.engine(log_file), "", start, Identify.No_End,
           Identify.Isabelle_Version, Identify.AFP_Version)
 
       case Isatest.Start(log_file.Strict_Date(start), host) :: _ =>
         parse(Isatest.engine, host, start, Isatest.End,
           Isatest.Isabelle_Version, Nil)
 
       case AFP_Test.Start(log_file.Strict_Date(start), host) :: _ =>
         parse(AFP_Test.engine, host, start, AFP_Test.End,
           AFP_Test.Isabelle_Version, AFP_Test.AFP_Version)
 
       case AFP_Test.Start_Old(log_file.Strict_Date(start)) :: _ =>
         parse(AFP_Test.engine, "", start, AFP_Test.End,
           AFP_Test.Isabelle_Version, AFP_Test.AFP_Version)
 
       case Jenkins.Start() :: _ =>
         log_file.lines.dropWhile(_ != Jenkins.BUILD) match {
           case Jenkins.BUILD :: _ :: Jenkins.Start_Date(log_file.Strict_Date(start)) :: _ =>
             val host =
               log_file.lines.takeWhile(_ != Jenkins.CONFIGURATION).collectFirst({
                 case Jenkins.Host(a, b) => a + "." + b
               }).getOrElse("")
             parse(Jenkins.engine, host, start.to(Date.timezone_berlin), Jenkins.No_End,
               Jenkins.Isabelle_Version, Jenkins.AFP_Version)
           case _ => Meta_Info.empty
         }
 
       case line :: _ if line.startsWith("\u0000") => Meta_Info.empty
       case List(Isatest.End(_)) => Meta_Info.empty
       case _ :: AFP_Test.Bad_Init() :: _ => Meta_Info.empty
       case Nil => Meta_Info.empty
 
       case _ => log_file.err("cannot detect log file format")
     }
   }
 
 
 
   /** build info: toplevel output of isabelle build or Admin/build_history **/
 
   val SESSION_NAME = "session_name"
 
   object Session_Status extends Enumeration
   {
     val existing, finished, failed, cancelled = Value
   }
 
   sealed case class Session_Entry(
     chapter: String = "",
     groups: List[String] = Nil,
     threads: Option[Int] = None,
     timing: Timing = Timing.zero,
     ml_timing: Timing = Timing.zero,
     sources: Option[String] = None,
     heap_size: Option[Long] = None,
     status: Option[Session_Status.Value] = None,
     errors: List[String] = Nil,
     theory_timings: Map[String, Timing] = Map.empty,
     ml_statistics: List[Properties.T] = Nil)
   {
     def proper_groups: Option[String] = if (groups.isEmpty) None else Some(cat_lines(groups))
     def finished: Boolean = status == Some(Session_Status.finished)
     def failed: Boolean = status == Some(Session_Status.failed)
   }
 
   object Build_Info
   {
     val sessions_dummy: Map[String, Session_Entry] =
       Map("" -> Session_Entry(theory_timings = Map("" -> Timing.zero)))
   }
 
   sealed case class Build_Info(sessions: Map[String, Session_Entry])
   {
     def finished_sessions: List[String] = for ((a, b) <- sessions.toList if b.finished) yield a
     def failed_sessions: List[String] = for ((a, b) <- sessions.toList if b.failed) yield a
   }
 
   private def parse_build_info(log_file: Log_File, parse_ml_statistics: Boolean): Build_Info =
   {
     object Chapter_Name
     {
       def unapply(s: String): Some[(String, String)] =
         space_explode('/', s) match {
           case List(chapter, name) => Some((chapter, name))
           case _ => Some(("", s))
         }
     }
 
     val Session_No_Groups = new Regex("""^Session (\S+)$""")
     val Session_Groups = new Regex("""^Session (\S+) \((.*)\)$""")
     val Session_Finished1 =
       new Regex("""^Finished (\S+) \((\d+):(\d+):(\d+) elapsed time, (\d+):(\d+):(\d+) cpu time.*$""")
     val Session_Finished2 =
       new Regex("""^Finished ([^\s/]+) \((\d+):(\d+):(\d+) elapsed time.*$""")
     val Session_Timing =
       new Regex("""^Timing (\S+) \((\d+) threads, (\d+\.\d+)s elapsed time, (\d+\.\d+)s cpu time, (\d+\.\d+)s GC time.*$""")
     val Session_Started = new Regex("""^(?:Running|Building) (\S+) \.\.\.$""")
     val Sources = new Regex("""^Sources (\S+) (\S{""" + SHA1.digest_length + """})$""")
     val Heap = new Regex("""^Heap (\S+) \((\d+) bytes\)$""")
 
     object Theory_Timing
     {
       def unapply(line: String): Option[(String, (String, Timing))] =
         Protocol.Theory_Timing_Marker.unapply(line.replace('~', '-')).map(log_file.parse_props)
         match {
           case Some((SESSION_NAME, session) :: props) =>
             for (theory <- Markup.Name.unapply(props))
             yield (session, theory -> Markup.Timing_Properties.parse(props))
           case _ => None
         }
     }
 
     var chapter = Map.empty[String, String]
     var groups = Map.empty[String, List[String]]
     var threads = Map.empty[String, Int]
     var timing = Map.empty[String, Timing]
     var ml_timing = Map.empty[String, Timing]
     var started = Set.empty[String]
     var sources = Map.empty[String, String]
     var heap_sizes = Map.empty[String, Long]
     var theory_timings = Map.empty[String, Map[String, Timing]]
     var ml_statistics = Map.empty[String, List[Properties.T]]
     var errors = Map.empty[String, List[String]]
 
     def all_sessions: Set[String] =
       chapter.keySet ++ groups.keySet ++ threads.keySet ++ timing.keySet ++ ml_timing.keySet ++
       started ++ sources.keySet ++ heap_sizes.keySet ++
       theory_timings.keySet ++ ml_statistics.keySet
 
 
     for (line <- log_file.lines) {
       line match {
         case Session_No_Groups(Chapter_Name(chapt, name)) =>
           chapter += (name -> chapt)
           groups += (name -> Nil)
 
         case Session_Groups(Chapter_Name(chapt, name), grps) =>
           chapter += (name -> chapt)
           groups += (name -> Word.explode(grps))
 
         case Session_Started(name) =>
           started += name
 
         case Session_Finished1(name,
             Value.Int(e1), Value.Int(e2), Value.Int(e3),
             Value.Int(c1), Value.Int(c2), Value.Int(c3)) =>
           val elapsed = Time.hms(e1, e2, e3)
           val cpu = Time.hms(c1, c2, c3)
           timing += (name -> Timing(elapsed, cpu, Time.zero))
 
         case Session_Finished2(name,
             Value.Int(e1), Value.Int(e2), Value.Int(e3)) =>
           val elapsed = Time.hms(e1, e2, e3)
           timing += (name -> Timing(elapsed, Time.zero, Time.zero))
 
         case Session_Timing(name,
             Value.Int(t), Value.Double(e), Value.Double(c), Value.Double(g)) =>
           val elapsed = Time.seconds(e)
           val cpu = Time.seconds(c)
           val gc = Time.seconds(g)
           ml_timing += (name -> Timing(elapsed, cpu, gc))
           threads += (name -> t)
 
         case Sources(name, s) =>
           sources += (name -> s)
 
         case Heap(name, Value.Long(size)) =>
           heap_sizes += (name -> size)
 
         case _ if Protocol.Theory_Timing_Marker.test_yxml(line) =>
           line match {
             case Theory_Timing(name, theory_timing) =>
               theory_timings += (name -> (theory_timings.getOrElse(name, Map.empty) + theory_timing))
             case _ => log_file.err("malformed theory_timing " + quote(line))
           }
 
         case _ if parse_ml_statistics && Protocol.ML_Statistics_Marker.test_yxml(line) =>
           Protocol.ML_Statistics_Marker.unapply(line).map(log_file.parse_props) match {
             case Some((SESSION_NAME, name) :: props) =>
               ml_statistics += (name -> (props :: ml_statistics.getOrElse(name, Nil)))
             case _ => log_file.err("malformed ML_statistics " + quote(line))
           }
 
         case _ if Protocol.Error_Message_Marker.test_yxml(line) =>
           Protocol.Error_Message_Marker.unapply(line).map(log_file.parse_props) match {
             case Some(List((SESSION_NAME, name), (Markup.CONTENT, msg))) =>
               errors += (name -> (msg :: errors.getOrElse(name, Nil)))
             case _ => log_file.err("malformed error message " + quote(line))
           }
 
         case _ =>
       }
     }
 
     val sessions =
       Map(
         (for (name <- all_sessions.toList) yield {
           val status =
             if (timing.isDefinedAt(name) || ml_timing.isDefinedAt(name))
               Session_Status.finished
             else if (started(name)) Session_Status.failed
             else Session_Status.existing
           val entry =
             Session_Entry(
               chapter = chapter.getOrElse(name, ""),
               groups = groups.getOrElse(name, Nil),
               threads = threads.get(name),
               timing = timing.getOrElse(name, Timing.zero),
               ml_timing = ml_timing.getOrElse(name, Timing.zero),
               sources = sources.get(name),
               heap_size = heap_sizes.get(name),
               status = Some(status),
               errors = errors.getOrElse(name, Nil).reverse,
               theory_timings = theory_timings.getOrElse(name, Map.empty),
               ml_statistics = ml_statistics.getOrElse(name, Nil).reverse)
           (name -> entry)
         }):_*)
     Build_Info(sessions)
   }
 
 
 
   /** session info: produced by isabelle build as session database **/
 
   sealed case class Session_Info(
     session_timing: Properties.T,
     command_timings: List[Properties.T],
     theory_timings: List[Properties.T],
     ml_statistics: List[Properties.T],
     task_statistics: List[Properties.T],
     errors: List[String])
   {
     def error(s: String): Session_Info =
       copy(errors = errors ::: List(s))
   }
 
   private def parse_session_info(
     log_file: Log_File,
     command_timings: Boolean,
     theory_timings: Boolean,
     ml_statistics: Boolean,
     task_statistics: Boolean): Session_Info =
   {
     Session_Info(
       session_timing = log_file.find_props(Protocol.Session_Timing_Marker) getOrElse Nil,
       command_timings =
         if (command_timings) log_file.filter_props(Protocol.Command_Timing_Marker) else Nil,
       theory_timings =
         if (theory_timings) log_file.filter_props(Protocol.Theory_Timing_Marker) else Nil,
       ml_statistics =
         if (ml_statistics) log_file.filter_props(Protocol.ML_Statistics_Marker) else Nil,
       task_statistics =
         if (task_statistics) log_file.filter_props(Protocol.Task_Statistics_Marker) else Nil,
       errors = log_file.filter(Protocol.Error_Message_Marker))
   }
 
   def compress_errors(errors: List[String], cache: XZ.Cache = XZ.Cache()): Option[Bytes] =
     if (errors.isEmpty) None
     else {
       Some(Bytes(YXML.string_of_body(XML.Encode.list(XML.Encode.string)(errors))).
         compress(cache = cache))
     }
 
   def uncompress_errors(bytes: Bytes, cache: XML.Cache = XML.Cache.make()): List[String] =
     if (bytes.is_empty) Nil
     else {
       XML.Decode.list(YXML.string_of_body)(
         YXML.parse_body(bytes.uncompress(cache = cache.xz).text, cache = cache))
     }
 
 
 
   /** persistent store **/
 
   /* SQL data model */
 
   object Data
   {
     def build_log_table(name: String, columns: List[SQL.Column], body: String = ""): SQL.Table =
       SQL.Table("isabelle_build_log_" + name, columns, body)
 
 
     /* main content */
 
     val log_name = SQL.Column.string("log_name").make_primary_key
     val session_name = SQL.Column.string("session_name").make_primary_key
     val theory_name = SQL.Column.string("theory_name").make_primary_key
     val chapter = SQL.Column.string("chapter")
     val groups = SQL.Column.string("groups")
     val threads = SQL.Column.int("threads")
     val timing_elapsed = SQL.Column.long("timing_elapsed")
     val timing_cpu = SQL.Column.long("timing_cpu")
     val timing_gc = SQL.Column.long("timing_gc")
     val timing_factor = SQL.Column.double("timing_factor")
     val ml_timing_elapsed = SQL.Column.long("ml_timing_elapsed")
     val ml_timing_cpu = SQL.Column.long("ml_timing_cpu")
     val ml_timing_gc = SQL.Column.long("ml_timing_gc")
     val ml_timing_factor = SQL.Column.double("ml_timing_factor")
     val theory_timing_elapsed = SQL.Column.long("theory_timing_elapsed")
     val theory_timing_cpu = SQL.Column.long("theory_timing_cpu")
     val theory_timing_gc = SQL.Column.long("theory_timing_gc")
     val heap_size = SQL.Column.long("heap_size")
     val status = SQL.Column.string("status")
     val errors = SQL.Column.bytes("errors")
     val sources = SQL.Column.string("sources")
     val ml_statistics = SQL.Column.bytes("ml_statistics")
     val known = SQL.Column.bool("known")
 
     val meta_info_table =
       build_log_table("meta_info", log_name :: Prop.all_props ::: Settings.all_settings)
 
     val sessions_table =
       build_log_table("sessions",
         List(log_name, session_name, chapter, groups, threads, timing_elapsed, timing_cpu,
           timing_gc, timing_factor, ml_timing_elapsed, ml_timing_cpu, ml_timing_gc, ml_timing_factor,
           heap_size, status, errors, sources))
 
     val theories_table =
       build_log_table("theories",
         List(log_name, session_name, theory_name, theory_timing_elapsed, theory_timing_cpu,
           theory_timing_gc))
 
     val ml_statistics_table =
       build_log_table("ml_statistics", List(log_name, session_name, ml_statistics))
 
 
     /* AFP versions */
 
     val isabelle_afp_versions_table: SQL.Table =
     {
       val version1 = Prop.isabelle_version
       val version2 = Prop.afp_version
       build_log_table("isabelle_afp_versions", List(version1.make_primary_key, version2),
         SQL.select(List(version1, version2), distinct = true) + meta_info_table +
         " WHERE " + version1.defined + " AND " + version2.defined)
     }
 
 
     /* earliest pull date for repository version (PostgreSQL queries) */
 
     def pull_date(afp: Boolean = false): SQL.Column =
       if (afp) SQL.Column.date("afp_pull_date")
       else SQL.Column.date("pull_date")
 
     def pull_date_table(afp: Boolean = false): SQL.Table =
     {
       val (name, versions) =
         if (afp) ("afp_pull_date", List(Prop.isabelle_version, Prop.afp_version))
         else ("pull_date", List(Prop.isabelle_version))
 
       build_log_table(name, versions.map(_.make_primary_key) ::: List(pull_date(afp)),
         "SELECT " + versions.mkString(", ") +
           ", min(" + Prop.build_start + ") AS " + pull_date(afp) +
         " FROM " + meta_info_table +
         " WHERE " + (versions ::: List(Prop.build_start)).map(_.defined).mkString(" AND ") +
         " GROUP BY " + versions.mkString(", "))
     }
 
 
     /* recent entries */
 
     def recent_time(days: Int): SQL.Source =
       "now() - INTERVAL '" + days.max(0) + " days'"
 
     def recent_pull_date_table(
       days: Int, rev: String = "", afp_rev: Option[String] = None): SQL.Table =
     {
       val afp = afp_rev.isDefined
       val rev2 = afp_rev.getOrElse("")
       val table = pull_date_table(afp)
 
       val version1 = Prop.isabelle_version
       val version2 = Prop.afp_version
       val eq1 = version1(table).toString + " = " + SQL.string(rev)
       val eq2 = version2(table).toString + " = " + SQL.string(rev2)
 
       SQL.Table("recent_pull_date", table.columns,
         table.select(table.columns,
           "WHERE " + pull_date(afp)(table) + " > " + recent_time(days) +
           (if (rev != "" && rev2 == "") " OR " + eq1
            else if (rev == "" && rev2 != "") " OR " + eq2
            else if (rev != "" && rev2 != "") " OR (" + eq1 + " AND " + eq2 + ")"
            else "")))
     }
 
     def select_recent_log_names(days: Int): SQL.Source =
     {
       val table1 = meta_info_table
       val table2 = recent_pull_date_table(days)
       table1.select(List(log_name), distinct = true) + SQL.join_inner + table2.query_named +
         " ON " + Prop.isabelle_version(table1) + " = " + Prop.isabelle_version(table2)
     }
 
     def select_recent_versions(days: Int,
       rev: String = "", afp_rev: Option[String] = None, sql: SQL.Source = ""): SQL.Source =
     {
       val afp = afp_rev.isDefined
       val version = Prop.isabelle_version
       val table1 = recent_pull_date_table(days, rev = rev, afp_rev = afp_rev)
       val table2 = meta_info_table
       val aux_table = SQL.Table("aux", table2.columns, table2.select(sql = sql))
 
       val columns =
         table1.columns.map(c => c(table1)) :::
           List(known.copy(expr = log_name(aux_table).defined))
       SQL.select(columns, distinct = true) +
         table1.query_named + SQL.join_outer + aux_table.query_named +
         " ON " + version(table1) + " = " + version(aux_table) +
         " ORDER BY " + pull_date(afp)(table1) + " DESC"
     }
 
 
     /* universal view on main data */
 
     val universal_table: SQL.Table =
     {
       val afp_pull_date = pull_date(afp = true)
       val version1 = Prop.isabelle_version
       val version2 = Prop.afp_version
       val table1 = meta_info_table
       val table2 = pull_date_table(afp = true)
       val table3 = pull_date_table()
 
       val a_columns = log_name :: afp_pull_date :: table1.columns.tail
       val a_table =
         SQL.Table("a", a_columns,
           SQL.select(List(log_name, afp_pull_date) ::: table1.columns.tail.map(_.apply(table1))) +
           table1 + SQL.join_outer + table2 +
           " ON " + version1(table1) + " = " + version1(table2) +
           " AND " + version2(table1) + " = " + version2(table2))
 
       val b_columns = log_name :: pull_date() :: a_columns.tail
       val b_table =
         SQL.Table("b", b_columns,
           SQL.select(
             List(log_name(a_table), pull_date()(table3)) ::: a_columns.tail.map(_.apply(a_table))) +
           a_table.query_named + SQL.join_outer + table3 +
           " ON " + version1(a_table) + " = " + version1(table3))
 
       val c_columns = b_columns ::: sessions_table.columns.tail
       val c_table =
         SQL.Table("c", c_columns,
           SQL.select(log_name(b_table) :: c_columns.tail) +
           b_table.query_named + SQL.join_inner + sessions_table +
           " ON " + log_name(b_table) + " = " + log_name(sessions_table))
 
       SQL.Table("isabelle_build_log", c_columns ::: List(ml_statistics),
         {
           SQL.select(c_columns.map(_.apply(c_table)) ::: List(ml_statistics)) +
           c_table.query_named + SQL.join_outer + ml_statistics_table +
           " ON " + log_name(c_table) + " = " + log_name(ml_statistics_table) +
           " AND " + session_name(c_table) + " = " + session_name(ml_statistics_table)
         })
     }
   }
 
 
   /* database access */
 
   def store(options: Options, cache: XML.Cache = XML.Cache.make()): Store =
     new Store(options, cache)
 
   class Store private[Build_Log](options: Options, val cache: XML.Cache)
   {
     def open_database(
       user: String = options.string("build_log_database_user"),
       password: String = options.string("build_log_database_password"),
       database: String = options.string("build_log_database_name"),
       host: String = options.string("build_log_database_host"),
       port: Int = options.int("build_log_database_port"),
       ssh_host: String = options.string("build_log_ssh_host"),
       ssh_user: String = options.string("build_log_ssh_user"),
       ssh_port: Int = options.int("build_log_ssh_port")): PostgreSQL.Database =
     {
       PostgreSQL.open_database(
         user = user, password = password, database = database, host = host, port = port,
         ssh =
           if (ssh_host == "") None
           else Some(SSH.open_session(options, host = ssh_host, user = ssh_user, port = ssh_port)),
         ssh_close = true)
     }
 
     def update_database(
       db: PostgreSQL.Database, dirs: List[Path], ml_statistics: Boolean = false): Unit =
     {
       val log_files =
         dirs.flatMap(dir =>
           File.find_files(dir.file, pred = Log_File.is_log(_), follow_links = true))
       write_info(db, log_files, ml_statistics = ml_statistics)
 
       db.create_view(Data.pull_date_table())
       db.create_view(Data.pull_date_table(afp = true))
       db.create_view(Data.universal_table)
     }
 
     def snapshot_database(db: PostgreSQL.Database, sqlite_database: Path,
       days: Int = 100, ml_statistics: Boolean = false): Unit =
     {
       Isabelle_System.make_directory(sqlite_database.dir)
       sqlite_database.file.delete
 
       using(SQLite.open_database(sqlite_database))(db2 =>
       {
         db.transaction {
           db2.transaction {
             // main content
             db2.create_table(Data.meta_info_table)
             db2.create_table(Data.sessions_table)
             db2.create_table(Data.theories_table)
             db2.create_table(Data.ml_statistics_table)
 
             val recent_log_names =
               db.using_statement(Data.select_recent_log_names(days))(stmt =>
                 stmt.execute_query().iterator(_.string(Data.log_name)).toList)
 
             for (log_name <- recent_log_names) {
               read_meta_info(db, log_name).foreach(meta_info =>
                 update_meta_info(db2, log_name, meta_info))
 
               update_sessions(db2, log_name, read_build_info(db, log_name))
 
               if (ml_statistics) {
                 update_ml_statistics(db2, log_name,
                   read_build_info(db, log_name, ml_statistics = true))
               }
             }
 
             // pull_date
             for (afp <- List(false, true))
             {
               val afp_rev = if (afp) Some("") else None
               val table = Data.pull_date_table(afp)
               db2.create_table(table)
               db2.using_statement(table.insert())(stmt2 =>
               {
                 db.using_statement(
                   Data.recent_pull_date_table(days, afp_rev = afp_rev).query)(stmt =>
                 {
                   val res = stmt.execute_query()
                   while (res.next()) {
                     for ((c, i) <- table.columns.zipWithIndex) {
                       stmt2.string(i + 1) = res.get_string(c)
                     }
                     stmt2.execute()
                   }
                 })
               })
             }
 
             // full view
             db2.create_view(Data.universal_table)
           }
         }
         db2.rebuild
       })
     }
 
     def domain(db: SQL.Database, table: SQL.Table, column: SQL.Column): Set[String] =
       db.using_statement(table.select(List(column), distinct = true))(stmt =>
         stmt.execute_query().iterator(_.string(column)).toSet)
 
     def update_meta_info(db: SQL.Database, log_name: String, meta_info: Meta_Info): Unit =
     {
       val table = Data.meta_info_table
       db.using_statement(db.insert_permissive(table))(stmt =>
       {
         stmt.string(1) = log_name
         for ((c, i) <- table.columns.tail.zipWithIndex) {
           if (c.T == SQL.Type.Date)
             stmt.date(i + 2) = meta_info.get_date(c)
           else
             stmt.string(i + 2) = meta_info.get(c)
         }
         stmt.execute()
       })
     }
 
     def update_sessions(db: SQL.Database, log_name: String, build_info: Build_Info): Unit =
     {
       val table = Data.sessions_table
       db.using_statement(db.insert_permissive(table))(stmt =>
       {
         val sessions =
           if (build_info.sessions.isEmpty) Build_Info.sessions_dummy
           else build_info.sessions
         for ((session_name, session) <- sessions) {
           stmt.string(1) = log_name
           stmt.string(2) = session_name
           stmt.string(3) = proper_string(session.chapter)
           stmt.string(4) = session.proper_groups
           stmt.int(5) = session.threads
           stmt.long(6) = session.timing.elapsed.proper_ms
           stmt.long(7) = session.timing.cpu.proper_ms
           stmt.long(8) = session.timing.gc.proper_ms
           stmt.double(9) = session.timing.factor
           stmt.long(10) = session.ml_timing.elapsed.proper_ms
           stmt.long(11) = session.ml_timing.cpu.proper_ms
           stmt.long(12) = session.ml_timing.gc.proper_ms
           stmt.double(13) = session.ml_timing.factor
           stmt.long(14) = session.heap_size
           stmt.string(15) = session.status.map(_.toString)
           stmt.bytes(16) = compress_errors(session.errors, cache = cache.xz)
           stmt.string(17) = session.sources
           stmt.execute()
         }
       })
     }
 
     def update_theories(db: SQL.Database, log_name: String, build_info: Build_Info): Unit =
     {
       val table = Data.theories_table
       db.using_statement(db.insert_permissive(table))(stmt =>
       {
         val sessions =
           if (build_info.sessions.forall({ case (_, session) => session.theory_timings.isEmpty }))
             Build_Info.sessions_dummy
           else build_info.sessions
         for {
           (session_name, session) <- sessions
           (theory_name, timing) <- session.theory_timings
         } {
           stmt.string(1) = log_name
           stmt.string(2) = session_name
           stmt.string(3) = theory_name
           stmt.long(4) = timing.elapsed.ms
           stmt.long(5) = timing.cpu.ms
           stmt.long(6) = timing.gc.ms
           stmt.execute()
         }
       })
     }
 
     def update_ml_statistics(db: SQL.Database, log_name: String, build_info: Build_Info): Unit =
     {
       val table = Data.ml_statistics_table
       db.using_statement(db.insert_permissive(table))(stmt =>
       {
         val ml_stats: List[(String, Option[Bytes])] =
           Par_List.map[(String, Session_Entry), (String, Option[Bytes])](
             { case (a, b) => (a, Properties.compress(b.ml_statistics, cache = cache.xz).proper) },
             build_info.sessions.iterator.filter(p => p._2.ml_statistics.nonEmpty).toList)
         val entries = if (ml_stats.nonEmpty) ml_stats else List("" -> None)
         for ((session_name, ml_statistics) <- entries) {
           stmt.string(1) = log_name
           stmt.string(2) = session_name
           stmt.bytes(3) = ml_statistics
           stmt.execute()
         }
       })
     }
 
     def write_info(db: SQL.Database, files: List[JFile], ml_statistics: Boolean = false): Unit =
     {
       abstract class Table_Status(table: SQL.Table)
       {
         db.create_table(table)
         private var known: Set[String] = domain(db, table, Data.log_name)
 
         def required(file: JFile): Boolean = !known(Log_File.plain_name(file.getName))
 
         def update_db(db: SQL.Database, log_file: Log_File): Unit
         def update(log_file: Log_File): Unit =
         {
           if (!known(log_file.name)) {
             update_db(db, log_file)
             known += log_file.name
           }
         }
       }
       val status =
         List(
           new Table_Status(Data.meta_info_table) {
             override def update_db(db: SQL.Database, log_file: Log_File): Unit =
               update_meta_info(db, log_file.name, log_file.parse_meta_info())
           },
           new Table_Status(Data.sessions_table) {
             override def update_db(db: SQL.Database, log_file: Log_File): Unit =
               update_sessions(db, log_file.name, log_file.parse_build_info())
           },
           new Table_Status(Data.theories_table) {
             override def update_db(db: SQL.Database, log_file: Log_File): Unit =
               update_theories(db, log_file.name, log_file.parse_build_info())
           },
           new Table_Status(Data.ml_statistics_table) {
             override def update_db(db: SQL.Database, log_file: Log_File): Unit =
             if (ml_statistics) {
               update_ml_statistics(db, log_file.name,
                 log_file.parse_build_info(ml_statistics = true))
             }
           })
 
       for (file_group <-
             files.filter(file => status.exists(_.required(file))).
               grouped(options.int("build_log_transaction_size") max 1))
       {
         val log_files = Par_List.map[JFile, Log_File](Log_File.apply, file_group)
         db.transaction { log_files.foreach(log_file => status.foreach(_.update(log_file))) }
       }
     }
 
     def read_meta_info(db: SQL.Database, log_name: String): Option[Meta_Info] =
     {
       val table = Data.meta_info_table
       val columns = table.columns.tail
       db.using_statement(table.select(columns, Data.log_name.where_equal(log_name)))(stmt =>
       {
         val res = stmt.execute_query()
         if (!res.next()) None
         else {
           val results =
             columns.map(c => c.name ->
               (if (c.T == SQL.Type.Date)
                 res.get_date(c).map(Log_File.Date_Format(_))
                else
                 res.get_string(c)))
           val n = Prop.all_props.length
           val props = for ((x, Some(y)) <- results.take(n)) yield (x, y)
           val settings = for ((x, Some(y)) <- results.drop(n)) yield (x, y)
           Some(Meta_Info(props, settings))
         }
       })
     }
 
     def read_build_info(
       db: SQL.Database,
       log_name: String,
       session_names: List[String] = Nil,
       ml_statistics: Boolean = false): Build_Info =
     {
       val table1 = Data.sessions_table
       val table2 = Data.ml_statistics_table
 
       val where_log_name =
         Data.log_name(table1).where_equal(log_name) + " AND " +
         Data.session_name(table1) + " <> ''"
       val where =
         if (session_names.isEmpty) where_log_name
         else where_log_name + " AND " + SQL.member(Data.session_name(table1).ident, session_names)
 
       val columns1 = table1.columns.tail.map(_.apply(table1))
       val (columns, from) =
         if (ml_statistics) {
           val columns = columns1 ::: List(Data.ml_statistics(table2))
           val join =
             table1.toString + SQL.join_outer + table2 + " ON " +
             Data.log_name(table1) + " = " + Data.log_name(table2) + " AND " +
             Data.session_name(table1) + " = " + Data.session_name(table2)
           (columns, SQL.enclose(join))
         }
         else (columns1, table1.ident)
 
       val sessions =
         db.using_statement(SQL.select(columns) + from + " " + where)(stmt =>
         {
           stmt.execute_query().iterator(res =>
           {
             val session_name = res.string(Data.session_name)
             val session_entry =
               Session_Entry(
                 chapter = res.string(Data.chapter),
                 groups = split_lines(res.string(Data.groups)),
                 threads = res.get_int(Data.threads),
                 timing = res.timing(Data.timing_elapsed, Data.timing_cpu, Data.timing_gc),
                 ml_timing =
                   res.timing(Data.ml_timing_elapsed, Data.ml_timing_cpu, Data.ml_timing_gc),
                 sources = res.get_string(Data.sources),
                 heap_size = res.get_long(Data.heap_size),
                 status = res.get_string(Data.status).map(Session_Status.withName),
                 errors = uncompress_errors(res.bytes(Data.errors), cache = cache),
                 ml_statistics =
                   if (ml_statistics) {
                     Properties.uncompress(res.bytes(Data.ml_statistics), cache = cache)
                   }
                   else Nil)
             session_name -> session_entry
           }).toMap
         })
       Build_Info(sessions)
     }
   }
 }
diff --git a/src/Pure/Admin/components.scala b/src/Pure/Admin/components.scala
--- a/src/Pure/Admin/components.scala
+++ b/src/Pure/Admin/components.scala
@@ -1,356 +1,356 @@
 /*  Title:      Pure/Admin/components.scala
     Author:     Makarius
 
 Isabelle system components.
 */
 
 package isabelle
 
 
 import java.io.{File => JFile}
 
 
 object Components
 {
   /* archive name */
 
   object Archive
   {
     val suffix: String = ".tar.gz"
 
     def apply(name: String): String =
       if (name == "") error("Bad component name: " + quote(name))
       else name + suffix
 
     def unapply(archive: String): Option[String] =
     {
       for {
         name0 <- Library.try_unsuffix(suffix, archive)
         name <- proper_string(name0)
       } yield name
     }
 
     def get_name(archive: String): String =
       unapply(archive) getOrElse
         error("Bad component archive name (expecting .tar.gz): " + quote(archive))
   }
 
 
   /* component collections */
 
   def default_component_repository: String =
     Isabelle_System.getenv("ISABELLE_COMPONENT_REPOSITORY")
 
   val default_components_base: Path = Path.explode("$ISABELLE_COMPONENTS_BASE")
 
   def admin(dir: Path): Path = dir + Path.explode("Admin/components")
 
   def contrib(dir: Path = Path.current, name: String = ""): Path =
     dir + Path.explode("contrib") + Path.explode(name)
 
   def unpack(dir: Path, archive: Path, progress: Progress = new Progress): String =
   {
     val name = Archive.get_name(archive.file_name)
     progress.echo("Unpacking " + name)
     Isabelle_System.gnutar("-xzf " + File.bash_path(archive), dir = dir).check
     name
   }
 
   def resolve(base_dir: Path, names: List[String],
     target_dir: Option[Path] = None,
     copy_dir: Option[Path] = None,
     progress: Progress = new Progress): Unit =
   {
     Isabelle_System.make_directory(base_dir)
     for (name <- names) {
       val archive_name = Archive(name)
       val archive = base_dir + Path.explode(archive_name)
       if (!archive.is_file) {
         val remote = Components.default_component_repository + "/" + archive_name
         Isabelle_System.download_file(remote, archive, progress = progress)
       }
       for (dir <- copy_dir) {
         Isabelle_System.make_directory(dir)
         Isabelle_System.copy_file(archive, dir)
       }
       unpack(target_dir getOrElse base_dir, archive, progress = progress)
     }
   }
 
   private val platforms_family: Map[Platform.Family.Value, Set[String]] =
     Map(
       Platform.Family.linux_arm -> Set("arm64-linux", "arm64_32-linux"),
       Platform.Family.linux -> Set("x86_64-linux", "x86_64_32-linux"),
       Platform.Family.macos ->
         Set("arm64-darwin", "arm64_32-darwin", "x86_64-darwin", "x86_64_32-darwin"),
       Platform.Family.windows ->
         Set("x86_64-cygwin", "x86_64-windows", "x86_64_32-windows", "x86-windows"))
 
   private val platforms_all: Set[String] =
     Set("x86-linux", "x86-cygwin") ++ platforms_family.iterator.flatMap(_._2)
 
   def purge(dir: Path, platform: Platform.Family.Value): Unit =
   {
     val purge_set = platforms_all -- platforms_family(platform)
 
     File.find_files(dir.file,
       (file: JFile) => file.isDirectory && purge_set(file.getName),
       include_dirs = true).foreach(Isabelle_System.rm_tree)
   }
 
 
   /* component directory content */
 
   def settings(dir: Path = Path.current): Path = dir + Path.explode("etc/settings")
   def components(dir: Path = Path.current): Path = dir + Path.explode("etc/components")
 
   def check_dir(dir: Path): Boolean =
     settings(dir).is_file || components(dir).is_file
 
   def read_components(dir: Path): List[String] =
     split_lines(File.read(components(dir))).filter(_.nonEmpty)
 
   def write_components(dir: Path, lines: List[String]): Unit =
     File.write(components(dir), terminate_lines(lines))
 
 
   /* component repository content */
 
   val components_sha1: Path = Path.explode("~~/Admin/components/components.sha1")
 
   sealed case class SHA1_Digest(sha1: String, file_name: String)
   {
     override def toString: String = sha1 + "  " + file_name
   }
 
   def read_components_sha1(lines: List[String] = Nil): List[SHA1_Digest] =
     (proper_list(lines) getOrElse split_lines(File.read(components_sha1))).flatMap(line =>
       Word.explode(line) match {
         case Nil => None
         case List(sha1, name) => Some(SHA1_Digest(sha1, name))
         case _ => error("Bad components.sha1 entry: " + quote(line))
       })
 
   def write_components_sha1(entries: List[SHA1_Digest]): Unit =
     File.write(components_sha1, entries.sortBy(_.file_name).mkString("", "\n", "\n"))
 
 
   /** manage user components **/
 
   val components_path = Path.explode("$ISABELLE_HOME_USER/etc/components")
 
   def read_components(): List[String] =
     if (components_path.is_file) Library.trim_split_lines(File.read(components_path))
     else Nil
 
   def write_components(lines: List[String]): Unit =
   {
     Isabelle_System.make_directory(components_path.dir)
     File.write(components_path, Library.terminate_lines(lines))
   }
 
   def update_components(add: Boolean, path0: Path, progress: Progress = new Progress): Unit =
   {
     val path = path0.expand.absolute
     if (!(path + Path.explode("etc/settings")).is_file &&
         !(path + Path.explode("etc/components")).is_file) error("Bad component directory: " + path)
 
     val lines1 = read_components()
     val lines2 =
       lines1.filter(line =>
         line.isEmpty || line.startsWith("#") || !File.eq(Path.explode(line), path))
     val lines3 = if (add) lines2 ::: List(path.implode) else lines2
 
     if (lines1 != lines3) write_components(lines3)
 
     val prefix = if (lines1 == lines3) "Unchanged" else if (add) "Added" else "Removed"
     progress.echo(prefix + " component " + path)
   }
 
 
   /* main entry point */
 
   def main(args: Array[String]): Unit =
   {
     Command_Line.tool {
       for (arg <- args) {
         val add =
           if (arg.startsWith("+")) true
           else if (arg.startsWith("-")) false
           else error("Bad argument: " + quote(arg))
         val path = Path.explode(arg.substring(1))
         update_components(add, path, progress = new Console_Progress)
       }
     }
   }
 
 
   /** build and publish components **/
 
   def build_components(
     options: Options,
     components: List[Path],
     progress: Progress = new Progress,
     publish: Boolean = false,
     force: Boolean = false,
     update_components_sha1: Boolean = false): Unit =
   {
     val archives: List[Path] =
       for (path <- components) yield {
         path.file_name match {
           case Archive(_) => path
           case name =>
             if (!path.is_dir) error("Bad component directory: " + path)
             else if (!check_dir(path)) {
               error("Malformed component directory: " + path +
                 "\n  (requires " + settings() + " or " + Components.components() + ")")
             }
             else {
               val component_path = path.expand
               val archive_dir = component_path.dir
               val archive_name = Archive(name)
 
               val archive = archive_dir + Path.explode(archive_name)
               if (archive.is_file && !force) {
                 error("Component archive already exists: " + archive)
               }
 
               progress.echo("Packaging " + archive_name)
               Isabelle_System.gnutar("-czf " + File.bash_path(archive) + " " + Bash.string(name),
                 dir = archive_dir).check
 
               archive
             }
         }
       }
 
     if ((publish && archives.nonEmpty) || update_components_sha1) {
       options.string("isabelle_components_server") match {
         case SSH.Target(user, host) =>
           using(SSH.open_session(options, host = host, user = user))(ssh =>
           {
             val components_dir = Path.explode(options.string("isabelle_components_dir"))
             val contrib_dir = Path.explode(options.string("isabelle_components_contrib_dir"))
 
             for (dir <- List(components_dir, contrib_dir) if !ssh.is_dir(dir)) {
               error("Bad remote directory: " + dir)
             }
 
             if (publish) {
               for (archive <- archives) {
                 val archive_name = archive.file_name
                 val name = Archive.get_name(archive_name)
                 val remote_component = components_dir + archive.base
                 val remote_contrib = contrib_dir + Path.explode(name)
 
                 // component archive
                 if (ssh.is_file(remote_component) && !force) {
                   error("Remote component archive already exists: " + remote_component)
                 }
                 progress.echo("Uploading " + archive_name)
                 ssh.write_file(remote_component, archive)
 
                 // contrib directory
                 val is_standard_component =
                   Isabelle_System.with_tmp_dir("component")(tmp_dir =>
                   {
                     Isabelle_System.gnutar("-xzf " + File.bash_path(archive), dir = tmp_dir).check
                     check_dir(tmp_dir + Path.explode(name))
                   })
                 if (is_standard_component) {
                   if (ssh.is_dir(remote_contrib)) {
                     if (force) ssh.rm_tree(remote_contrib)
                     else error("Remote component directory already exists: " + remote_contrib)
                   }
                   progress.echo("Unpacking remote " + archive_name)
                   ssh.execute("tar -C " + ssh.bash_path(contrib_dir) + " -xzf " +
                     ssh.bash_path(remote_component)).check
                 }
                 else {
                   progress.echo_warning("No unpacking of non-standard component: " + archive_name)
                 }
               }
             }
 
             // remote SHA1 digests
             if (update_components_sha1) {
               val lines =
                 for {
                   entry <- ssh.read_dir(components_dir)
                   if entry.is_file && entry.name.endsWith(Archive.suffix)
                 }
                 yield {
                   progress.echo("Digesting remote " + entry.name)
                   ssh.execute("cd " + ssh.bash_path(components_dir) +
                     "; sha1sum " + Bash.string(entry.name)).check.out
                 }
               write_components_sha1(read_components_sha1(lines))
             }
           })
         case s => error("Bad isabelle_components_server: " + quote(s))
       }
     }
 
     // local SHA1 digests
     {
       val new_entries =
         for (archive <- archives)
         yield {
           val file_name = archive.file_name
           progress.echo("Digesting local " + file_name)
           val sha1 = SHA1.digest(archive).rep
           SHA1_Digest(sha1, file_name)
         }
       val new_names = new_entries.map(_.file_name).toSet
 
       write_components_sha1(
         new_entries :::
         read_components_sha1().filterNot(entry => new_names.contains(entry.file_name)))
     }
   }
 
 
   /* Isabelle tool wrapper */
 
   private val relevant_options =
     List("isabelle_components_server", "isabelle_components_dir", "isabelle_components_contrib_dir")
 
   val isabelle_tool =
     Isabelle_Tool("build_components", "build and publish Isabelle components",
       Scala_Project.here, args =>
     {
       var publish = false
       var update_components_sha1 = false
       var force = false
       var options = Options.init()
 
       def show_options: String =
         cat_lines(relevant_options.map(name => options.options(name).print))
 
       val getopts = Getopts("""
 Usage: isabelle build_components [OPTIONS] ARCHIVES... DIRS...
 
   Options are:
     -P           publish on SSH server (see options below)
     -f           force: overwrite existing component archives and directories
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -u           update all SHA1 keys in Isabelle repository Admin/components
 
   Build and publish Isabelle components as .tar.gz archives on SSH server,
   depending on system options:
 
-""" + Library.prefix_lines("  ", show_options) + "\n",
+""" + Library.indent_lines(2, show_options) + "\n",
         "P" -> (_ => publish = true),
         "f" -> (_ => force = true),
         "o:" -> (arg => options = options + arg),
         "u" -> (_ => update_components_sha1 = true))
 
       val more_args = getopts(args)
       if (more_args.isEmpty && !update_components_sha1) getopts.usage()
 
       val progress = new Console_Progress
 
       build_components(options, more_args.map(Path.explode), progress = progress,
         publish = publish, force = force, update_components_sha1 = update_components_sha1)
     })
 }
diff --git a/src/Pure/General/exn.scala b/src/Pure/General/exn.scala
--- a/src/Pure/General/exn.scala
+++ b/src/Pure/General/exn.scala
@@ -1,147 +1,146 @@
 /*  Title:      Pure/General/exn.scala
     Author:     Makarius
 
 Support for exceptions (arbitrary throwables).
 */
 
 package isabelle
 
 
 object Exn
 {
   /* user errors */
 
   class User_Error(message: String) extends RuntimeException(message)
   {
     override def equals(that: Any): Boolean =
       that match {
         case other: User_Error => message == other.getMessage
         case _ => false
       }
     override def hashCode: Int = message.hashCode
 
     override def toString: String = "\n" + Output.error_message_text(message)
   }
 
   object ERROR
   {
     def apply(message: String): User_Error = new User_Error(message)
     def unapply(exn: Throwable): Option[String] = user_message(exn)
   }
 
   def error(message: String): Nothing = throw ERROR(message)
 
   def cat_message(msgs: String*): String =
     cat_lines(msgs.iterator.filterNot(_ == ""))
 
   def cat_error(msgs: String*): Nothing =
     error(cat_message(msgs:_*))
 
 
   /* exceptions as values */
 
   sealed abstract class Result[A]
   {
     def user_error: Result[A] =
       this match {
         case Exn(ERROR(msg)) => Exn(ERROR(msg))
         case _ => this
       }
 
     def map[B](f: A => B): Result[B] =
       this match {
         case Res(res) => Res(f(res))
         case Exn(exn) => Exn(exn)
       }
   }
   case class Res[A](res: A) extends Result[A]
   case class Exn[A](exn: Throwable) extends Result[A]
 
   def capture[A](e: => A): Result[A] =
     try { Res(e) }
     catch { case exn: Throwable => Exn[A](exn) }
 
   def release[A](result: Result[A]): A =
     result match {
       case Res(x) => x
       case Exn(exn) => throw exn
     }
 
   def release_first[A](results: List[Result[A]]): List[A] =
     results.find({ case Exn(exn) => !is_interrupt(exn) case _ => false }) match {
       case Some(Exn(exn)) => throw exn
       case _ => results.map(release)
     }
 
 
   /* interrupts */
 
   def is_interrupt(exn: Throwable): Boolean =
   {
     var found_interrupt = false
     var e = exn
     while (!found_interrupt && e != null) {
       found_interrupt |= e.isInstanceOf[InterruptedException]
       e = e.getCause
     }
     found_interrupt
   }
 
   def interruptible_capture[A](e: => A): Result[A] =
     try { Res(e) }
     catch { case exn: Throwable if !is_interrupt(exn) => Exn[A](exn) }
 
   object Interrupt
   {
     object ERROR
     {
       def unapply(exn: Throwable): Option[String] =
         if (is_interrupt(exn)) Some(message(exn)) else user_message(exn)
     }
 
     def apply(): Throwable = new InterruptedException("Interrupt")
     def unapply(exn: Throwable): Boolean = is_interrupt(exn)
 
     def dispose(): Unit = Thread.interrupted()
     def expose(): Unit = if (Thread.interrupted()) throw apply()
     def impose(): Unit = Thread.currentThread.interrupt()
 
     val return_code = 130
   }
 
 
   /* POSIX return code */
 
   def return_code(exn: Throwable, rc: Int): Int =
     if (is_interrupt(exn)) Interrupt.return_code else rc
 
 
   /* message */
 
   def user_message(exn: Throwable): Option[String] =
-    if (exn.getClass == classOf[RuntimeException] ||
-        exn.getClass == classOf[User_Error])
+    if (exn.isInstanceOf[User_Error] || exn.getClass == classOf[RuntimeException])
     {
       Some(proper_string(exn.getMessage) getOrElse "Error")
     }
     else if (exn.isInstanceOf[java.sql.SQLException])
     {
       Some(proper_string(exn.getMessage) getOrElse "SQL error")
     }
     else if (exn.isInstanceOf[java.io.IOException])
     {
       val msg = exn.getMessage
       Some(if (msg == null || msg == "") "I/O error" else "I/O error: " + msg)
     }
     else if (exn.isInstanceOf[RuntimeException]) Some(exn.toString)
     else None
 
   def message(exn: Throwable): String =
     user_message(exn) getOrElse (if (is_interrupt(exn)) "Interrupt" else exn.toString)
 
 
   /* trace */
 
   def trace(exn: Throwable): String =
     exn.getStackTrace.mkString("\n")
 }
diff --git a/src/Pure/General/http.scala b/src/Pure/General/http.scala
--- a/src/Pure/General/http.scala
+++ b/src/Pure/General/http.scala
@@ -1,304 +1,304 @@
 /*  Title:      Pure/General/http.scala
     Author:     Makarius
 
 HTTP client and server support.
 */
 
 package isabelle
 
 
 import java.io.{File => JFile}
 import java.net.{InetSocketAddress, URI, URL, URLConnection, HttpURLConnection}
 import com.sun.net.httpserver.{HttpExchange, HttpHandler, HttpServer}
 
 
 object HTTP
 {
   /** content **/
 
   val mime_type_bytes: String = "application/octet-stream"
   val mime_type_text: String = "text/plain; charset=utf-8"
   val mime_type_html: String = "text/html; charset=utf-8"
 
   val default_mime_type: String = mime_type_bytes
   val default_encoding: String = UTF8.charset_name
 
   sealed case class Content(
     bytes: Bytes,
     file_name: String = "",
     mime_type: String = default_mime_type,
     encoding: String = default_encoding,
     elapsed_time: Time = Time.zero)
   {
     def text: String = new String(bytes.array, encoding)
   }
 
   def read_content(file: JFile): Content =
   {
     val bytes = Bytes.read(file)
     val file_name = file.getName
     val mime_type =
       Option(URLConnection.guessContentTypeFromName(file_name)).getOrElse(default_mime_type)
     Content(bytes, file_name = file_name, mime_type = mime_type)
   }
 
   def read_content(path: Path): Content = read_content(path.file)
 
 
 
   /** client **/
 
   val NEWLINE: String = "\r\n"
 
   object Client
   {
     val default_timeout: Time = Time.seconds(180)
 
     def open_connection(url: URL,
       timeout: Time = default_timeout,
       user_agent: String = ""): HttpURLConnection =
     {
       url.openConnection match {
         case connection: HttpURLConnection =>
           if (0 < timeout.ms && timeout.ms <= Integer.MAX_VALUE) {
             val ms = timeout.ms.toInt
             connection.setConnectTimeout(ms)
             connection.setReadTimeout(ms)
           }
           proper_string(user_agent).foreach(s => connection.setRequestProperty("User-Agent", s))
           connection
         case _ => error("Bad URL (not HTTP): " + quote(url.toString))
       }
     }
 
     def get_content(connection: HttpURLConnection): Content =
     {
       val Charset = """.*\bcharset="?([\S^"]+)"?.*""".r
 
       val start = Time.now()
       using(connection.getInputStream)(stream =>
       {
         val bytes = Bytes.read_stream(stream, hint = connection.getContentLength)
         val stop = Time.now()
 
         val file_name = Url.file_name(connection.getURL)
         val mime_type = Option(connection.getContentType).getOrElse(default_mime_type)
         val encoding =
           (connection.getContentEncoding, mime_type) match {
             case (enc, _) if enc != null => enc
             case (_, Charset(enc)) => enc
             case _ => default_encoding
           }
         Content(bytes, file_name = file_name, mime_type = mime_type,
           encoding = encoding, elapsed_time = stop - start)
       })
     }
 
     def get(url: URL, timeout: Time = default_timeout, user_agent: String = ""): Content =
       get_content(open_connection(url, timeout = timeout, user_agent = user_agent))
 
     def post(url: URL, parameters: List[(String, Any)],
       timeout: Time = default_timeout,
       user_agent: String = ""): Content =
     {
       val connection = open_connection(url, timeout = timeout, user_agent = user_agent)
       connection.setRequestMethod("POST")
       connection.setDoOutput(true)
 
       val boundary = UUID.random_string()
       connection.setRequestProperty(
         "Content-Type", "multipart/form-data; boundary=" + quote(boundary))
 
       using(connection.getOutputStream)(out =>
       {
         def output(s: String): Unit = out.write(UTF8.bytes(s))
         def output_newline(n: Int = 1): Unit = (1 to n).foreach(_ => output(NEWLINE))
         def output_boundary(end: Boolean = false): Unit =
           output("--" + boundary + (if (end) "--" else "") + NEWLINE)
         def output_name(name: String): Unit =
           output("Content-Disposition: form-data; name=" + quote(name))
         def output_value(value: Any): Unit =
         {
           output_newline(2)
           output(value.toString)
         }
         def output_content(content: Content): Unit =
         {
           proper_string(content.file_name).foreach(s => output("; filename=" + quote(s)))
           output_newline()
           proper_string(content.mime_type).foreach(s => output("Content-Type: " + s))
           output_newline(2)
           content.bytes.write_stream(out)
         }
 
         output_newline(2)
 
         for { (name, value) <- parameters } {
           output_boundary()
           output_name(name)
           value match {
             case content: Content => output_content(content)
             case file: JFile => output_content(read_content(file))
             case path: Path => output_content(read_content(path))
             case _ => output_value(value)
           }
           output_newline()
         }
         output_boundary(end = true)
         out.flush()
       })
 
       get_content(connection)
     }
   }
 
 
 
   /** server **/
 
   /* response */
 
   object Response
   {
     def apply(
         bytes: Bytes = Bytes.empty,
         content_type: String = mime_type_bytes): Response =
       new Response(bytes, content_type)
 
     val empty: Response = apply()
     def text(s: String): Response = apply(Bytes(s), mime_type_text)
     def html(s: String): Response = apply(Bytes(s), mime_type_html)
   }
 
   class Response private[HTTP](val bytes: Bytes, val content_type: String)
   {
     override def toString: String = bytes.toString
   }
 
 
   /* exchange */
 
   class Exchange private[HTTP](val http_exchange: HttpExchange)
   {
     def request_method: String = http_exchange.getRequestMethod
     def request_uri: URI = http_exchange.getRequestURI
 
     def read_request(): Bytes =
       using(http_exchange.getRequestBody)(Bytes.read_stream(_))
 
     def write_response(code: Int, response: Response): Unit =
     {
       http_exchange.getResponseHeaders.set("Content-Type", response.content_type)
       http_exchange.sendResponseHeaders(code, response.bytes.length.toLong)
       using(http_exchange.getResponseBody)(response.bytes.write_stream)
     }
   }
 
 
   /* handler for request method */
 
   sealed case class Arg(method: String, uri: URI, request: Bytes)
   {
     def decode_properties: Properties.T =
-      space_explode('&', request.text).map(s =>
-        space_explode('=', s) match {
-          case List(a, b) => Url.decode(a) -> Url.decode(b)
-          case _ => error("Malformed key-value pair in HTTP/POST: " + quote(s))
+      space_explode('&', request.text).map(
+        {
+          case Properties.Eq(a, b) => Url.decode(a) -> Url.decode(b)
+          case s => error("Malformed key-value pair in HTTP/POST: " + quote(s))
         })
   }
 
   object Handler
   {
     def apply(root: String, body: Exchange => Unit): Handler =
       new Handler(root, (x: HttpExchange) => body(new Exchange(x)))
 
     def method(name: String, root: String, body: Arg => Option[Response]): Handler =
       apply(root, http =>
         {
           val request = http.read_request()
           if (http.request_method == name) {
             val arg = Arg(name, http.request_uri, request)
             Exn.capture(body(arg)) match {
               case Exn.Res(Some(response)) =>
                 http.write_response(200, response)
               case Exn.Res(None) =>
                 http.write_response(404, Response.empty)
               case Exn.Exn(ERROR(msg)) =>
                 http.write_response(500, Response.text(Output.error_message_text(msg)))
               case Exn.Exn(exn) => throw exn
             }
           }
           else http.write_response(400, Response.empty)
         })
 
     def get(root: String, body: Arg => Option[Response]): Handler = method("GET", root, body)
     def post(root: String, body: Arg => Option[Response]): Handler = method("POST", root, body)
   }
 
   class Handler private(val root: String, val handler: HttpHandler)
   {
     override def toString: String = root
   }
 
 
   /* server */
 
   class Server private[HTTP](val http_server: HttpServer)
   {
     def += (handler: Handler): Unit = http_server.createContext(handler.root, handler.handler)
     def -= (handler: Handler): Unit = http_server.removeContext(handler.root)
 
     def start(): Unit = http_server.start()
     def stop(): Unit = http_server.stop(0)
 
     def address: InetSocketAddress = http_server.getAddress
     def url: String = "http://" + address.getHostName + ":" + address.getPort
     override def toString: String = url
   }
 
   def server(handlers: List[Handler] = isabelle_resources): Server =
   {
     val http_server = HttpServer.create(new InetSocketAddress(isabelle.Server.localhost, 0), 0)
     http_server.setExecutor(null)
 
     val server = new Server(http_server)
     for (handler <- handlers) server += handler
     server
   }
 
 
 
   /** Isabelle resources **/
 
   lazy val isabelle_resources: List[Handler] =
     List(welcome(), fonts())
 
 
   /* welcome */
 
   def welcome(root: String = "/"): Handler =
     Handler.get(root, arg =>
       if (arg.uri.toString == root) {
         Some(Response.text("Welcome to " + Isabelle_System.identification()))
       }
       else None)
 
 
   /* fonts */
 
   private lazy val html_fonts: List[Isabelle_Fonts.Entry] =
     Isabelle_Fonts.fonts(hidden = true)
 
   def fonts(root: String = "/fonts"): Handler =
     Handler.get(root, arg =>
       {
         val uri_name = arg.uri.toString
         if (uri_name == root) {
           Some(Response.text(cat_lines(html_fonts.map(entry => entry.path.file_name))))
         }
         else {
           html_fonts.collectFirst(
             { case entry if uri_name == root + "/" + entry.path.file_name => Response(entry.bytes) })
         }
       })
 }
diff --git a/src/Pure/General/path.scala b/src/Pure/General/path.scala
--- a/src/Pure/General/path.scala
+++ b/src/Pure/General/path.scala
@@ -1,313 +1,313 @@
 /*  Title:      Pure/General/path.scala
     Author:     Makarius
 
 Algebra of file-system paths: basic POSIX notation, extended by named
 roots (e.g. //foo) and variables (e.g. $BAR).
 */
 
 package isabelle
 
 
 import java.io.{File => JFile}
 
 import scala.util.matching.Regex
 
 
 object Path
 {
   /* path elements */
 
   sealed abstract class Elem
   private case class Root(name: String) extends Elem
   private case class Basic(name: String) extends Elem
   private case class Variable(name: String) extends Elem
   private case object Parent extends Elem
 
   private def err_elem(msg: String, s: String): Nothing =
     error(msg + " path element " + quote(s))
 
   private val illegal_elem = Set("", "~", "~~", ".", "..")
   private val illegal_char = "/\\$:\"'<>|?*"
 
   private def check_elem(s: String): String =
     if (illegal_elem.contains(s)) err_elem("Illegal", s)
     else {
       for (c <- s) {
         if (c.toInt < 32)
           err_elem("Illegal control character " + c.toInt + " in", s)
         if (illegal_char.contains(c))
           err_elem("Illegal character " + quote(c.toString) + " in", s)
       }
       s
     }
 
   private def root_elem(s: String): Elem = Root(check_elem(s))
   private def basic_elem(s: String): Elem = Basic(check_elem(s))
   private def variable_elem(s: String): Elem = Variable(check_elem(s))
 
   private def apply_elem(y: Elem, xs: List[Elem]): List[Elem] =
     (y, xs) match {
       case (Root(_), _) => List(y)
       case (Parent, Root(_) :: _) => xs
       case (Parent, Basic(_) :: rest) => rest
       case _ => y :: xs
     }
 
   private def norm_elems(elems: List[Elem]): List[Elem] =
     elems.foldRight(List.empty[Elem])(apply_elem)
 
   private def implode_elem(elem: Elem, short: Boolean): String =
     elem match {
       case Root("") => ""
       case Root(s) => "//" + s
       case Basic(s) => s
       case Variable("USER_HOME") if short => "~"
       case Variable("ISABELLE_HOME") if short => "~~"
       case Variable(s) => "$" + s
       case Parent => ".."
     }
 
   private def squash_elem(elem: Elem): String =
     elem match {
       case Root("") => "ROOT"
       case Root(s) => "SERVER_" + s
       case Basic(s) => s
       case Variable(s) => s
       case Parent => "PARENT"
     }
 
 
   /* path constructors */
 
   val current: Path = new Path(Nil)
   val root: Path = new Path(List(Root("")))
   def named_root(s: String): Path = new Path(List(root_elem(s)))
   def make(elems: List[String]): Path = new Path(elems.reverse.map(basic_elem))
   def basic(s: String): Path = new Path(List(basic_elem(s)))
   def variable(s: String): Path = new Path(List(variable_elem(s)))
   val parent: Path = new Path(List(Parent))
 
   val USER_HOME: Path = variable("USER_HOME")
   val ISABELLE_HOME: Path = variable("ISABELLE_HOME")
 
 
   /* explode */
 
   def explode(str: String): Path =
   {
     def explode_elem(s: String): Elem =
       try {
         if (s == "..") Parent
         else if (s == "~") Variable("USER_HOME")
         else if (s == "~~") Variable("ISABELLE_HOME")
         else if (s.startsWith("$")) variable_elem(s.substring(1))
         else basic_elem(s)
       }
       catch { case ERROR(msg) => cat_error(msg, "The error(s) above occurred in " + quote(str)) }
   
     val ss = space_explode('/', str)
     val r = ss.takeWhile(_.isEmpty).length
     val es = ss.dropWhile(_.isEmpty)
     val (roots, raw_elems) =
       if (r == 0) (Nil, es)
       else if (r == 1) (List(Root("")), es)
       else if (es.isEmpty) (List(Root("")), Nil)
       else (List(root_elem(es.head)), es.tail)
     val elems = raw_elems.filterNot(s => s.isEmpty || s == ".").map(explode_elem)
 
     new Path(norm_elems(elems reverse_::: roots))
   }
 
   def is_wellformed(str: String): Boolean =
     try { explode(str); true } catch { case ERROR(_) => false }
 
   def is_valid(str: String): Boolean =
     try { explode(str).expand; true } catch { case ERROR(_) => false }
 
   def split(str: String): List[Path] =
     space_explode(':', str).filterNot(_.isEmpty).map(explode)
 
 
   /* encode */
 
   val encode: XML.Encode.T[Path] = (path => XML.Encode.string(path.implode))
 
 
   /* reserved names */
 
   private val reserved_windows: Set[String] =
     Set("CON", "PRN", "AUX", "NUL",
       "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
       "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9")
 
   def is_reserved(name: String): Boolean =
     Long_Name.explode(name).exists(a => reserved_windows.contains(Word.uppercase(a)))
 
 
   /* case-insensitive names */
 
   def check_case_insensitive(paths: List[Path]): Unit =
   {
     val table =
       paths.foldLeft(Multi_Map.empty[String, String]) { case (tab, path) =>
         val name = path.expand.implode
         tab.insert(Word.lowercase(name), name)
       }
     val collisions =
       (for { (_, coll) <- table.iterator_list if coll.length > 1 } yield coll).toList.flatten
     if (collisions.nonEmpty) {
       error(("Collision of file names due case-insensitivity:" :: collisions).mkString("\n  "))
     }
   }
 }
 
 
 final class Path private(protected val elems: List[Path.Elem]) // reversed elements
 {
   override def hashCode: Int = elems.hashCode
   override def equals(that: Any): Boolean =
     that match {
       case other: Path => elems == other.elems
       case _ => false
     }
 
   def is_current: Boolean = elems.isEmpty
   def is_absolute: Boolean = elems.nonEmpty && elems.last.isInstanceOf[Path.Root]
   def is_root: Boolean = elems match { case List(Path.Root(_)) => true case _ => false }
   def is_basic: Boolean = elems match { case List(Path.Basic(_)) => true case _ => false }
   def starts_basic: Boolean = elems.nonEmpty && elems.last.isInstanceOf[Path.Basic]
 
   def +(other: Path): Path = new Path(other.elems.foldRight(elems)(Path.apply_elem))
 
 
   /* implode */
 
   private def gen_implode(short: Boolean): String =
     elems match {
       case Nil => "."
       case List(Path.Root("")) => "/"
       case _ => elems.map(Path.implode_elem(_, short)).reverse.mkString("/")
     }
   def implode: String = gen_implode(false)
   def implode_short: String = gen_implode(true)
 
   override def toString: String = quote(implode)
 
 
   /* base element */
 
   private def split_path: (Path, String) =
     elems match {
       case Path.Basic(s) :: xs => (new Path(xs), s)
       case _ => error("Cannot split path into dir/base: " + toString)
     }
 
   def dir: Path = split_path._1
   def base: Path = new Path(List(Path.Basic(split_path._2)))
 
   def ext(e: String): Path =
     if (e == "") this
     else {
       val (prfx, s) = split_path
       prfx + Path.basic(s + "." + e)
     }
 
   def xz: Path = ext("xz")
   def xml: Path = ext("xml")
   def html: Path = ext("html")
   def tex: Path = ext("tex")
   def pdf: Path = ext("pdf")
   def thy: Path = ext("thy")
   def tar: Path = ext("tar")
   def gz: Path = ext("gz")
   def log: Path = ext("log")
 
   def backup: Path =
   {
     val (prfx, s) = split_path
     prfx + Path.basic(s + "~")
   }
 
   def backup2: Path =
   {
     val (prfx, s) = split_path
     prfx + Path.basic(s + "~~")
   }
 
   def platform_exe: Path =
     if (Platform.is_windows) ext("exe") else this
 
   private val Ext = new Regex("(.*)\\.([^.]*)")
 
   def split_ext: (Path, String) =
   {
     val (prefix, base) = split_path
     base match {
       case Ext(b, e) => (prefix + Path.basic(b), e)
       case _ => (prefix + Path.basic(base), "")
     }
   }
 
   def drop_ext: Path = split_ext._1
   def get_ext: String = split_ext._2
 
   def squash: Path = new Path(elems.map(elem => Path.Basic(Path.squash_elem(elem))))
 
 
   /* expand */
 
   def expand_env(env: Map[String, String]): Path =
   {
     def eval(elem: Path.Elem): List[Path.Elem] =
       elem match {
         case Path.Variable(s) =>
           val path = Path.explode(Isabelle_System.getenv_strict(s, env))
           if (path.elems.exists(_.isInstanceOf[Path.Variable]))
-            error("Illegal path variable nesting: " + s + "=" + path.toString)
+            error("Illegal path variable nesting: " + Properties.Eq(s, path.toString))
           else path.elems
         case x => List(x)
       }
 
     new Path(Path.norm_elems(elems.flatMap(eval)))
   }
 
   def expand: Path = expand_env(Isabelle_System.settings())
 
   def file_name: String = expand.base.implode
 
 
   /* implode wrt. given directories */
 
   def implode_symbolic: String =
   {
     val directories =
       Library.space_explode(':', Isabelle_System.getenv("ISABELLE_DIRECTORIES")).reverse
     val full_name = expand.implode
     directories.view.flatMap(a =>
       try {
         val b = Path.explode(a).expand.implode
         if (full_name == b) Some(a)
         else {
           Library.try_unprefix(b + "/", full_name) match {
             case Some(name) => Some(a + "/" + name)
             case None => None
           }
         }
       } catch { case ERROR(_) => None }).headOption.getOrElse(implode)
   }
 
   def position: Position.T = Position.File(implode_symbolic)
 
 
   /* platform files */
 
   def file: JFile = File.platform_file(this)
   def is_file: Boolean = file.isFile
   def is_dir: Boolean = file.isDirectory
 
   def absolute_file: JFile = File.absolute(file)
   def canonical_file: JFile = File.canonical(file)
 
   def absolute: Path = File.path(absolute_file)
   def canonical: Path = File.path(canonical_file)
 }
diff --git a/src/Pure/General/properties.scala b/src/Pure/General/properties.scala
--- a/src/Pure/General/properties.scala
+++ b/src/Pure/General/properties.scala
@@ -1,128 +1,140 @@
 /*  Title:      Pure/General/properties.scala
     Author:     Makarius
 
 Property lists.
 */
 
 package isabelle
 
 
 object Properties
 {
   /* entries */
 
   type Entry = (java.lang.String, java.lang.String)
   type T = List[Entry]
 
+  object Eq
+  {
+    def apply(a: java.lang.String, b: java.lang.String): java.lang.String = a + "=" + b
+    def apply(entry: Entry): java.lang.String = apply(entry._1, entry._2)
+
+    def unapply(str: java.lang.String): Option[Entry] =
+    {
+      val i = str.indexOf('=')
+      if (i <= 0) None else Some((str.substring(0, i), str.substring(i + 1)))
+    }
+  }
+
   def defined(props: T, name: java.lang.String): java.lang.Boolean =
     props.exists({ case (x, _) => x == name })
 
   def get(props: T, name: java.lang.String): Option[java.lang.String] =
     props.collectFirst({ case (x, y) if x == name => y })
 
   def put(props: T, entry: Entry): T =
   {
     val (x, y) = entry
     def update(ps: T): T =
       ps match {
         case (p @ (x1, _)) :: rest =>
           if (x1 == x) (x1, y) :: rest else p :: update(rest)
         case Nil => Nil
       }
     if (defined(props, x)) update(props) else entry :: props
   }
 
 
   /* external storage */
 
   def encode(ps: T): Bytes = Bytes(YXML.string_of_body(XML.Encode.properties(ps)))
 
   def decode(bs: Bytes, cache: XML.Cache = XML.Cache.none): T =
     cache.props(XML.Decode.properties(YXML.parse_body(bs.text)))
 
   def compress(ps: List[T],
     options: XZ.Options = XZ.options(),
     cache: XZ.Cache = XZ.Cache()): Bytes =
   {
     if (ps.isEmpty) Bytes.empty
     else {
       Bytes(YXML.string_of_body(XML.Encode.list(XML.Encode.properties)(ps))).
         compress(options = options, cache = cache)
     }
   }
 
   def uncompress(bs: Bytes, cache: XML.Cache = XML.Cache.none): List[T] =
   {
     if (bs.is_empty) Nil
     else {
       val ps =
         XML.Decode.list(XML.Decode.properties)(
           YXML.parse_body(bs.uncompress(cache = cache.xz).text))
       if (cache.no_cache) ps else ps.map(cache.props)
     }
   }
 
 
   /* multi-line entries */
 
   def encode_lines(props: T): T = props.map({ case (a, b) => (a, Library.encode_lines(b)) })
   def decode_lines(props: T): T = props.map({ case (a, b) => (a, Library.decode_lines(b)) })
 
   def lines_nonempty(x: java.lang.String, ys: List[java.lang.String]): Properties.T =
     if (ys.isEmpty) Nil else List((x, cat_lines(ys)))
 
 
   /* entry types */
 
   class String(val name: java.lang.String)
   {
     def apply(value: java.lang.String): T = List((name, value))
     def unapply(props: T): Option[java.lang.String] =
       props.find(_._1 == name).map(_._2)
     def get(props: T): java.lang.String = unapply(props).getOrElse("")
   }
 
   class Boolean(val name: java.lang.String)
   {
     def apply(value: scala.Boolean): T = List((name, Value.Boolean(value)))
     def unapply(props: T): Option[scala.Boolean] =
       props.find(_._1 == name) match {
         case None => None
         case Some((_, value)) => Value.Boolean.unapply(value)
       }
     def get(props: T): scala.Boolean = unapply(props).getOrElse(false)
   }
 
   class Int(val name: java.lang.String)
   {
     def apply(value: scala.Int): T = List((name, Value.Int(value)))
     def unapply(props: T): Option[scala.Int] =
       props.find(_._1 == name) match {
         case None => None
         case Some((_, value)) => Value.Int.unapply(value)
       }
     def get(props: T): scala.Int = unapply(props).getOrElse(0)
   }
 
   class Long(val name: java.lang.String)
   {
     def apply(value: scala.Long): T = List((name, Value.Long(value)))
     def unapply(props: T): Option[scala.Long] =
       props.find(_._1 == name) match {
         case None => None
         case Some((_, value)) => Value.Long.unapply(value)
       }
     def get(props: T): scala.Long = unapply(props).getOrElse(0)
   }
 
   class Double(val name: java.lang.String)
   {
     def apply(value: scala.Double): T = List((name, Value.Double(value)))
     def unapply(props: T): Option[scala.Double] =
       props.find(_._1 == name) match {
         case None => None
         case Some((_, value)) => Value.Double.unapply(value)
       }
     def get(props: T): scala.Double = unapply(props).getOrElse(0.0)
   }
 }
diff --git a/src/Pure/ML/ml_file.ML b/src/Pure/ML/ml_file.ML
--- a/src/Pure/ML/ml_file.ML
+++ b/src/Pure/ML/ml_file.ML
@@ -1,39 +1,39 @@
 (*  Title:      Pure/ML/ml_file.ML
     Author:     Makarius
 
 Commands to load ML files.
 *)
 
 signature ML_FILE =
 sig
   val command: string -> bool option -> (theory -> Token.file) ->
     Toplevel.transition -> Toplevel.transition
   val ML: bool option -> (theory -> Token.file) -> Toplevel.transition -> Toplevel.transition
   val SML: bool option -> (theory -> Token.file) -> Toplevel.transition -> Toplevel.transition
 end;
 
 structure ML_File: ML_FILE =
 struct
 
 fun command environment debug get_file = Toplevel.generic_theory (fn gthy =>
   let
     val file = get_file (Context.theory_of gthy);
     val provide = Resources.provide_file file;
     val source = Token.file_source file;
 
-    val _ = Thy_Output.check_comments (Context.proof_of gthy) (Input.source_explode source);
+    val _ = Document_Output.check_comments (Context.proof_of gthy) (Input.source_explode source);
 
     val flags: ML_Compiler.flags =
       {environment = environment, redirect = true, verbose = true,
         debug = debug, writeln = writeln, warning = warning};
   in
     gthy
     |> ML_Context.exec (fn () => ML_Context.eval_source flags source)
     |> Local_Theory.propagate_ml_env
     |> Context.mapping provide (Local_Theory.background_theory provide)
   end);
 
 val ML = command "";
 val SML = command ML_Env.SML;
 
 end;
diff --git a/src/Pure/ML/ml_statistics.scala b/src/Pure/ML/ml_statistics.scala
--- a/src/Pure/ML/ml_statistics.scala
+++ b/src/Pure/ML/ml_statistics.scala
@@ -1,324 +1,319 @@
 /*  Title:      Pure/ML/ml_statistics.scala
     Author:     Makarius
 
 ML runtime statistics.
 */
 
 package isabelle
 
 
 import scala.annotation.tailrec
 import scala.collection.mutable
 import scala.collection.immutable.{SortedSet, SortedMap}
 import scala.swing.{Frame, Component}
 
 import org.jfree.data.xy.{XYSeries, XYSeriesCollection}
 import org.jfree.chart.{JFreeChart, ChartPanel, ChartFactory}
 import org.jfree.chart.plot.PlotOrientation
 
 
 object ML_Statistics
 {
   /* properties */
 
   val Now = new Properties.Double("now")
   def now(props: Properties.T): Double = Now.unapply(props).get
 
 
   /* memory status */
 
   val Heap_Size = new Properties.Long("size_heap")
   val Heap_Free = new Properties.Long("size_heap_free_last_GC")
   val GC_Percent = new Properties.Int("GC_percent")
 
   sealed case class Memory_Status(heap_size: Long, heap_free: Long, gc_percent: Int)
   {
     def heap_used: Long = (heap_size - heap_free) max 0
     def heap_used_fraction: Double =
       if (heap_size == 0) 0.0 else heap_used.toDouble / heap_size
     def gc_progress: Option[Double] =
       if (1 <= gc_percent && gc_percent <= 100) Some((gc_percent - 1) * 0.01) else None
   }
 
   def memory_status(props: Properties.T): Memory_Status =
   {
     val heap_size = Heap_Size.get(props)
     val heap_free = Heap_Free.get(props)
     val gc_percent = GC_Percent.get(props)
     Memory_Status(heap_size, heap_free, gc_percent)
   }
 
 
   /* monitor process */
 
   def monitor(pid: Long,
     stats_dir: String = "",
     delay: Time = Time.seconds(0.5),
     consume: Properties.T => Unit = Console.println): Unit =
   {
     def progress_stdout(line: String): Unit =
     {
-      val props =
-        Library.space_explode(',', line).flatMap((entry: String) =>
-          Library.space_explode('=', entry) match {
-            case List(a, b) => Some((a, b))
-            case _ => None
-          })
+      val props = Library.space_explode(',', line).flatMap(Properties.Eq.unapply)
       if (props.nonEmpty) consume(props)
     }
 
     val env_prefix =
       if (stats_dir.isEmpty) "" else "export POLYSTATSDIR=" + Bash.string(stats_dir) + "\n"
 
     Bash.process(env_prefix + "\"$POLYML_EXE\" -q --use src/Pure/ML/ml_statistics.ML --eval " +
         Bash.string("ML_Statistics.monitor " + ML_Syntax.print_long(pid) + " " +
           ML_Syntax.print_double(delay.seconds)),
         cwd = Path.ISABELLE_HOME.file)
       .result(progress_stdout = progress_stdout, strict = false).check
   }
 
 
   /* protocol handler */
 
   class Handler extends Session.Protocol_Handler
   {
     private var session: Session = null
     private var monitoring: Future[Unit] = Future.value(())
 
     override def init(session: Session): Unit = synchronized
     {
       this.session = session
     }
 
     override def exit(): Unit = synchronized
     {
       session = null
       monitoring.cancel()
     }
 
     private def consume(props: Properties.T): Unit = synchronized
     {
       if (session != null) {
         val props1 = (session.cache.props(props ::: Java_Statistics.jvm_statistics()))
         session.runtime_statistics.post(Session.Runtime_Statistics(props1))
       }
     }
 
     private def ml_statistics(msg: Prover.Protocol_Output): Boolean = synchronized
     {
       msg.properties match {
         case Markup.ML_Statistics(pid, stats_dir) =>
           monitoring =
             Future.thread("ML_statistics") {
               monitor(pid, stats_dir = stats_dir, consume = consume)
             }
           true
         case _ => false
       }
     }
 
     override val functions = List(Markup.ML_Statistics.name -> ml_statistics)
   }
 
 
   /* memory fields (mega bytes) */
 
   def mem_print(x: Long): Option[String] =
     if (x == 0L) None else Some(x.toString + " M")
 
   def mem_scale(x: Long): Long = x / 1024 / 1024
 
   def mem_field_scale(name: String, x: Double): Double =
     if (heap_fields._2.contains(name) || program_fields._2.contains(name))
       mem_scale(x.toLong).toDouble
     else x
 
   val CODE_SIZE = "size_code"
   val STACK_SIZE = "size_stacks"
   val HEAP_SIZE = "size_heap"
 
 
   /* standard fields */
 
   type Fields = (String, List[String])
 
   val tasks_fields: Fields =
     ("Future tasks",
       List("tasks_ready", "tasks_pending", "tasks_running", "tasks_passive",
         "tasks_urgent", "tasks_total"))
 
   val workers_fields: Fields =
     ("Worker threads", List("workers_total", "workers_active", "workers_waiting"))
 
   val GC_fields: Fields =
     ("GCs", List("partial_GCs", "full_GCs", "share_passes"))
 
   val heap_fields: Fields =
     ("Heap", List(HEAP_SIZE, "size_allocation", "size_allocation_free",
       "size_heap_free_last_full_GC", "size_heap_free_last_GC"))
 
   val program_fields: Fields =
     ("Program", List("size_code", "size_stacks"))
 
   val threads_fields: Fields =
     ("Threads", List("threads_total", "threads_in_ML", "threads_wait_condvar",
       "threads_wait_IO", "threads_wait_mutex", "threads_wait_signal"))
 
   val time_fields: Fields =
     ("Time", List("time_elapsed", "time_elapsed_GC", "time_CPU", "time_GC"))
 
   val speed_fields: Fields =
     ("Speed", List("speed_CPU", "speed_GC"))
 
   private val time_speed = Map("time_CPU" -> "speed_CPU", "time_GC" -> "speed_GC")
 
   val java_heap_fields: Fields =
     ("Java heap", List("java_heap_size", "java_heap_used"))
 
   val java_thread_fields: Fields =
     ("Java threads", List("java_threads_total", "java_workers_total", "java_workers_active"))
 
 
   val main_fields: List[Fields] =
     List(heap_fields, tasks_fields, workers_fields)
 
   val other_fields: List[Fields] =
     List(threads_fields, GC_fields, program_fields, time_fields, speed_fields,
       java_heap_fields, java_thread_fields)
 
   val all_fields: List[Fields] = main_fields ::: other_fields
 
 
   /* content interpretation */
 
   final case class Entry(time: Double, data: Map[String, Double])
   {
     def get(field: String): Double = data.getOrElse(field, 0.0)
   }
 
   val empty: ML_Statistics = apply(Nil)
 
   def apply(ml_statistics0: List[Properties.T], heading: String = "",
     domain: String => Boolean = (key: String) => true): ML_Statistics =
   {
     require(ml_statistics0.forall(props => Now.unapply(props).isDefined), "missing \"now\" field")
 
     val ml_statistics = ml_statistics0.sortBy(now)
     val time_start = if (ml_statistics.isEmpty) 0.0 else now(ml_statistics.head)
     val duration = if (ml_statistics.isEmpty) 0.0 else now(ml_statistics.last) - time_start
 
     val fields =
       SortedSet.empty[String] ++
         (for {
           props <- ml_statistics.iterator
           (x, _) <- props.iterator
           if x != Now.name && domain(x) } yield x)
 
     val content =
     {
       var last_edge = Map.empty[String, (Double, Double, Double)]
       val result = new mutable.ListBuffer[ML_Statistics.Entry]
       for (props <- ml_statistics) {
         val time = now(props) - time_start
 
         // rising edges -- relative speed
         val speeds =
           (for {
             (key, value) <- props.iterator
             key1 <- time_speed.get(key)
             if domain(key1)
           } yield {
             val (x0, y0, s0) = last_edge.getOrElse(key, (0.0, 0.0, 0.0))
 
             val x1 = time
             val y1 = java.lang.Double.parseDouble(value)
             val s1 = if (x1 == x0) 0.0 else (y1 - y0) / (x1 - x0)
 
             if (y1 > y0) {
               last_edge += (key -> (x1, y1, s1))
               (key1, s1.toString)
             }
             else (key1, s0.toString)
           }).toList
 
         val data =
           SortedMap.empty[String, Double] ++
             (for {
               (x, y) <- props.iterator ++ speeds.iterator
               if x != Now.name && domain(x)
               z = java.lang.Double.parseDouble(y) if z != 0.0
             } yield { (x.intern, mem_field_scale(x, z)) })
 
         result += ML_Statistics.Entry(time, data)
       }
       result.toList
     }
 
     new ML_Statistics(heading, fields, content, time_start, duration)
   }
 }
 
 final class ML_Statistics private(
   val heading: String,
   val fields: Set[String],
   val content: List[ML_Statistics.Entry],
   val time_start: Double,
   val duration: Double)
 {
   /* content */
 
   def maximum(field: String): Double =
     content.foldLeft(0.0) { case (m, e) => m max e.get(field) }
 
   def average(field: String): Double =
   {
     @tailrec def sum(t0: Double, list: List[ML_Statistics.Entry], acc: Double): Double =
       list match {
         case Nil => acc
         case e :: es =>
           val t = e.time
           sum(t, es, (t - t0) * e.get(field) + acc)
       }
     content match {
       case Nil => 0.0
       case List(e) => e.get(field)
       case e :: es => sum(e.time, es, 0.0) / duration
     }
   }
 
 
   /* charts */
 
   def update_data(data: XYSeriesCollection, selected_fields: List[String]): Unit =
   {
     data.removeAllSeries
     for (field <- selected_fields) {
       val series = new XYSeries(field)
       content.foreach(entry => series.add(entry.time, entry.get(field)))
       data.addSeries(series)
     }
   }
 
   def chart(title: String, selected_fields: List[String]): JFreeChart =
   {
     val data = new XYSeriesCollection
     update_data(data, selected_fields)
 
     ChartFactory.createXYLineChart(title, "time", "value", data,
       PlotOrientation.VERTICAL, true, true, true)
   }
 
   def chart(fields: ML_Statistics.Fields): JFreeChart =
     chart(fields._1, fields._2)
 
   def show_frames(fields: List[ML_Statistics.Fields] = ML_Statistics.main_fields): Unit =
     fields.map(chart).foreach(c =>
       GUI_Thread.later {
         new Frame {
           iconImage = GUI.isabelle_image()
           title = heading
           contents = Component.wrap(new ChartPanel(c))
           visible = true
         }
       })
 }
diff --git a/src/Pure/PIDE/command.ML b/src/Pure/PIDE/command.ML
--- a/src/Pure/PIDE/command.ML
+++ b/src/Pure/PIDE/command.ML
@@ -1,507 +1,507 @@
 (*  Title:      Pure/PIDE/command.ML
     Author:     Makarius
 
 Prover command execution: read -- eval -- print.
 *)
 
 signature COMMAND =
 sig
   type blob = {file_node: string, src_path: Path.T, content: (SHA1.digest * string list) option}
   val read_file: Path.T -> Position.T -> bool -> Path.T -> Token.file
   val read_thy: Toplevel.state -> theory
   val read: Keyword.keywords -> theory -> Path.T-> (unit -> theory) ->
     blob Exn.result list * int -> Token.T list -> Toplevel.transition
   val read_span: Keyword.keywords -> Toplevel.state -> Path.T -> (unit -> theory) ->
     Command_Span.span -> Toplevel.transition
   type eval
   val eval_command_id: eval -> Document_ID.command
   val eval_exec_id: eval -> Document_ID.exec
   val eval_eq: eval * eval -> bool
   val eval_running: eval -> bool
   val eval_finished: eval -> bool
   val eval_result_command: eval -> Toplevel.transition
   val eval_result_state: eval -> Toplevel.state
   val eval: Keyword.keywords -> Path.T -> (unit -> theory) ->
     blob Exn.result list * int -> Document_ID.command -> Token.T list -> eval -> eval
   type print
   type print_fn = Toplevel.transition -> Toplevel.state -> unit
   val print0: {pri: int, print_fn: print_fn} -> eval -> print
   val print: bool -> (string * string list) list -> Keyword.keywords -> string ->
     eval -> print list -> print list option
   val parallel_print: print -> bool
   type print_function =
     {keywords: Keyword.keywords, command_name: string, args: string list, exec_id: Document_ID.exec} ->
       {delay: Time.time option, pri: int, persistent: bool, strict: bool, print_fn: print_fn} option
   val print_function: string -> print_function -> unit
   val no_print_function: string -> unit
   type exec = eval * print list
   val init_exec: theory option -> exec
   val no_exec: exec
   val exec_ids: exec option -> Document_ID.exec list
   val exec: Document_ID.execution -> exec -> unit
   val exec_parallel_prints: Document_ID.execution -> Future.task list -> exec -> exec option
 end;
 
 structure Command: COMMAND =
 struct
 
 (** main phases of execution **)
 
 fun task_context group f =
   f
   |> Future.interruptible_task
   |> Future.task_context "Command.run_process" group;
 
 
 (* read *)
 
 type blob = {file_node: string, src_path: Path.T, content: (SHA1.digest * string list) option};
 
 fun read_file_node file_node master_dir pos delimited src_path =
   let
     val _ =
       if Context_Position.pide_reports ()
       then Position.report pos (Markup.language_path delimited) else ();
 
     fun read_file () =
       let
         val path = File.check_file (File.full_path master_dir src_path);
         val text = File.read path;
         val file_pos = Path.position path;
       in (text, file_pos) end;
 
     fun read_url () =
       let
         val text = Isabelle_System.download file_node;
         val file_pos = Position.file file_node;
       in (text, file_pos) end;
 
     val (text, file_pos) =
       (case try Url.explode file_node of
         NONE => read_file ()
       | SOME (Url.File _) => read_file ()
       | _ => read_url ());
 
     val lines = split_lines text;
     val digest = SHA1.digest text;
   in {src_path = src_path, lines = lines, digest = digest, pos = Position.copy_id pos file_pos} end
   handle ERROR msg => error (msg ^ Position.here pos);
 
 val read_file = read_file_node "";
 
 local
 
 fun blob_file src_path lines digest file_node =
   let
     val file_pos =
       Position.file file_node |>
       (case Position.get_id (Position.thread_data ()) of
         NONE => I
       | SOME exec_id => Position.put_id exec_id);
   in {src_path = src_path, lines = lines, digest = digest, pos = file_pos} end
 
 fun resolve_files master_dir (blobs, blobs_index) toks =
   (case Outer_Syntax.parse_spans toks of
     [Command_Span.Span (Command_Span.Command_Span _, _)] =>
       (case try (nth toks) blobs_index of
         SOME tok =>
           let
             val source = Token.input_of tok;
             val pos = Input.pos_of source;
             val delimited = Input.is_delimited source;
 
             fun make_file (Exn.Res {file_node, src_path, content = NONE}) =
                   Exn.interruptible_capture (fn () =>
                     read_file_node file_node master_dir pos delimited src_path) ()
               | make_file (Exn.Res {file_node, src_path, content = SOME (digest, lines)}) =
                   (Position.report pos (Markup.language_path delimited);
                     Exn.Res (blob_file src_path lines digest file_node))
               | make_file (Exn.Exn e) = Exn.Exn e;
             val files = map make_file blobs;
           in
             toks |> map_index (fn (i, tok) =>
               if i = blobs_index then Token.put_files files tok else tok)
           end
       | NONE => toks)
   | _ => toks);
 
 fun reports_of_token keywords tok =
   let
     val malformed_symbols =
       Input.source_explode (Token.input_of tok)
       |> map_filter (fn (sym, pos) =>
           if Symbol.is_malformed sym
           then SOME ((pos, Markup.bad ()), "Malformed symbolic character") else NONE);
     val is_malformed = Token.is_error tok orelse not (null malformed_symbols);
     val reports = Token.reports keywords tok @ Token.completion_report tok @ malformed_symbols;
   in (is_malformed, reports) end;
 
 in
 
 fun read_thy st = Toplevel.theory_of st
   handle Toplevel.UNDEF => Pure_Syn.bootstrap_thy;
 
 fun read keywords thy master_dir init blobs_info span =
   let
     val command_reports = Outer_Syntax.command_reports thy;
     val token_reports = map (reports_of_token keywords) span;
     val _ = Position.reports_text (maps #2 token_reports @ maps command_reports span);
 
     val verbatim =
       span |> map_filter (fn tok =>
         if Token.kind_of tok = Token.Verbatim then SOME (Token.pos_of tok) else NONE);
     val _ =
       if null verbatim then ()
       else legacy_feature ("Old-style {* verbatim *} token -- use \<open>cartouche\<close> instead" ^
         Position.here_list verbatim);
   in
     if exists #1 token_reports
     then Toplevel.malformed (#1 (Token.core_range_of span)) "Malformed command syntax"
     else Outer_Syntax.parse_span thy init (resolve_files master_dir blobs_info span)
   end;
 
 end;
 
 fun read_span keywords st master_dir init =
   Command_Span.content #> read keywords (read_thy st) master_dir init ([], ~1);
 
 
 (* eval *)
 
 type eval_state = {failed: bool, command: Toplevel.transition, state: Toplevel.state};
 
 fun init_eval_state opt_thy =
  {failed = false,
   command = Toplevel.empty,
   state =
     (case opt_thy of
       NONE => Toplevel.init_toplevel ()
     | SOME thy => Toplevel.theory_toplevel thy)};
 
 datatype eval =
   Eval of
     {command_id: Document_ID.command, exec_id: Document_ID.exec, eval_process: eval_state lazy};
 
 fun eval_command_id (Eval {command_id, ...}) = command_id;
 
 fun eval_exec_id (Eval {exec_id, ...}) = exec_id;
 val eval_eq = op = o apply2 eval_exec_id;
 
 val eval_running = Execution.is_running_exec o eval_exec_id;
 fun eval_finished (Eval {eval_process, ...}) = Lazy.is_finished eval_process;
 
 fun eval_result (Eval {eval_process, ...}) =
   Exn.release (Lazy.finished_result eval_process);
 
 val eval_result_command = #command o eval_result;
 val eval_result_state = #state o eval_result;
 
 local
 
 fun reset_state keywords tr st0 = Toplevel.setmp_thread_position tr (fn () =>
   let
     val name = Toplevel.name_of tr;
     val res =
       if Keyword.is_theory_body keywords name then Toplevel.reset_theory st0
       else if Keyword.is_proof keywords name then Toplevel.reset_proof st0
       else if Keyword.is_theory_end keywords name then
         (case Toplevel.reset_notepad st0 of
           NONE => Toplevel.reset_theory st0
         | some => some)
       else NONE;
   in
     (case res of
       NONE => st0
     | SOME st => (Output.error_message (Toplevel.type_error tr ^ " -- using reset state"); st))
   end) ();
 
 fun run keywords int tr st =
   if Future.proofs_enabled 1 andalso Keyword.is_diag keywords (Toplevel.name_of tr) then
     let
       val (tr1, tr2) = Toplevel.fork_presentation tr;
       val _ =
         Execution.fork {name = "Toplevel.diag", pos = Toplevel.pos_of tr, pri = ~1}
           (fn () => Toplevel.command_exception int tr1 st);
     in Toplevel.command_errors int tr2 st end
   else Toplevel.command_errors int tr st;
 
 fun check_token_comments ctxt tok =
-  (Thy_Output.check_comments ctxt (Input.source_explode (Token.input_of tok)); [])
+  (Document_Output.check_comments ctxt (Input.source_explode (Token.input_of tok)); [])
     handle exn =>
       if Exn.is_interrupt exn then Exn.reraise exn
       else Runtime.exn_messages exn;
 
 fun check_span_comments ctxt span tr =
   Toplevel.setmp_thread_position tr (fn () => maps (check_token_comments ctxt) span) ();
 
 fun report_indent tr st =
   (case try Toplevel.proof_of st of
     SOME prf =>
       let val keywords = Thy_Header.get_keywords (Proof.theory_of prf) in
         if Keyword.command_kind keywords (Toplevel.name_of tr) = SOME Keyword.prf_script then
           (case try (Thm.nprems_of o #goal o Proof.goal) prf of
             NONE => ()
           | SOME 0 => ()
           | SOME n =>
               let val report = Markup.markup_only (Markup.command_indent (n - 1));
               in Toplevel.setmp_thread_position tr (fn () => Output.report [report]) () end)
         else ()
       end
   | NONE => ());
 
 fun status tr m =
   Toplevel.setmp_thread_position tr (fn () => Output.status [Markup.markup_only m]) ();
 
 fun eval_state keywords span tr ({state, ...}: eval_state) =
   let
     val _ = Thread_Attributes.expose_interrupt ();
 
     val st = reset_state keywords tr state;
 
     val _ = report_indent tr st;
     val _ = status tr Markup.running;
     val (errs1, result) = run keywords true tr st;
     val errs2 =
       (case result of
         NONE => []
       | SOME st' => check_span_comments (Toplevel.presentation_context st') span tr);
     val errs = errs1 @ errs2;
     val _ = List.app (Future.error_message (Toplevel.pos_of tr)) errs;
   in
     (case result of
       NONE =>
         let
           val _ = status tr Markup.failed;
           val _ = status tr Markup.finished;
           val _ = if null errs then (status tr Markup.canceled; Exn.interrupt ()) else ();
         in {failed = true, command = tr, state = st} end
     | SOME st' =>
         let
           val _ =
             if Keyword.is_theory_end keywords (Toplevel.name_of tr) andalso
               can (Toplevel.end_theory Position.none) st'
             then status tr Markup.finalized else ();
           val _ = status tr Markup.finished;
         in {failed = false, command = tr, state = st'} end)
   end;
 
 in
 
 fun eval keywords master_dir init blobs_info command_id span eval0 =
   let
     val exec_id = Document_ID.make ();
     fun process () =
       let
         val eval_state0 = eval_result eval0;
         val thy = read_thy (#state eval_state0);
         val tr =
           Position.setmp_thread_data (Position.id_only (Document_ID.print exec_id))
             (fn () =>
               read keywords thy master_dir init blobs_info span |> Toplevel.exec_id exec_id) ();
       in eval_state keywords span tr eval_state0 end;
   in
     Eval {command_id = command_id, exec_id = exec_id,
       eval_process = Lazy.lazy_name "Command.eval" process}
   end;
 
 end;
 
 
 (* print *)
 
 datatype print = Print of
  {name: string, args: string list, delay: Time.time option, pri: int, persistent: bool,
   exec_id: Document_ID.exec, print_process: unit lazy};
 
 fun print_exec_id (Print {exec_id, ...}) = exec_id;
 val print_eq = op = o apply2 print_exec_id;
 
 type print_fn = Toplevel.transition -> Toplevel.state -> unit;
 
 type print_function =
   {keywords: Keyword.keywords, command_name: string, args: string list, exec_id: Document_ID.exec} ->
     {delay: Time.time option, pri: int, persistent: bool, strict: bool, print_fn: print_fn} option;
 
 local
 
 val print_functions =
   Synchronized.var "Command.print_functions" ([]: (string * print_function) list);
 
 fun print_error tr opt_context e =
   (Toplevel.setmp_thread_position tr o Runtime.controlled_execution opt_context) e ()
     handle exn =>
       if Exn.is_interrupt exn then Exn.reraise exn
       else List.app (Future.error_message (Toplevel.pos_of tr)) (Runtime.exn_messages exn);
 
 fun print_finished (Print {print_process, ...}) = Lazy.is_finished print_process;
 
 fun print_persistent (Print {persistent, ...}) = persistent;
 
 val overlay_ord = prod_ord string_ord (list_ord string_ord);
 
 fun make_print (name, args) {delay, pri, persistent, strict, print_fn} eval =
   let
     val exec_id = Document_ID.make ();
     fun process () =
       let
         val {failed, command, state = st', ...} = eval_result eval;
         val tr = Toplevel.exec_id exec_id command;
         val opt_context = try Toplevel.generic_theory_of st';
       in
         if failed andalso strict then ()
         else print_error tr opt_context (fn () => print_fn tr st')
       end;
   in
     Print {
       name = name, args = args, delay = delay, pri = pri, persistent = persistent,
       exec_id = exec_id, print_process = Lazy.lazy_name "Command.print" process}
   end;
 
 fun bad_print name_args exn =
   make_print name_args {delay = NONE, pri = 0, persistent = false,
     strict = false, print_fn = fn _ => fn _ => Exn.reraise exn};
 
 in
 
 fun print0 {pri, print_fn} =
   make_print ("", [serial_string ()])
     {delay = NONE, pri = pri, persistent = true, strict = true, print_fn = print_fn};
 
 fun print command_visible command_overlays keywords command_name eval old_prints =
   let
     val print_functions = Synchronized.value print_functions;
 
     fun new_print (name, args) get_pr =
       let
         val params =
          {keywords = keywords,
           command_name = command_name,
           args = args,
           exec_id = eval_exec_id eval};
       in
         (case Exn.capture (Runtime.controlled_execution NONE get_pr) params of
           Exn.Res NONE => NONE
         | Exn.Res (SOME pr) => SOME (make_print (name, args) pr eval)
         | Exn.Exn exn => SOME (bad_print (name, args) exn eval))
       end;
 
     fun get_print (name, args) =
       (case find_first (fn Print print => (#name print, #args print) = (name, args)) old_prints of
         NONE =>
           (case AList.lookup (op =) print_functions name of
             NONE =>
               SOME (bad_print (name, args) (ERROR ("Missing print function " ^ quote name)) eval)
           | SOME get_pr => new_print (name, args) get_pr)
       | some => some);
 
     val retained_prints =
       filter (fn print => print_finished print andalso print_persistent print) old_prints;
     val visible_prints =
       if command_visible then
         fold (fn (name, _) => cons (name, [])) print_functions command_overlays
         |> sort_distinct overlay_ord
         |> map_filter get_print
       else [];
     val new_prints = visible_prints @ retained_prints;
   in
     if eq_list print_eq (old_prints, new_prints) then NONE else SOME new_prints
   end;
 
 fun parallel_print (Print {pri, ...}) =
   pri <= 0 orelse (Future.enabled () andalso Options.default_bool "parallel_print");
 
 fun print_function name f =
   Synchronized.change print_functions (fn funs =>
    (if name = "" then error "Unnamed print function" else ();
     if not (AList.defined (op =) funs name) then ()
     else warning ("Redefining command print function: " ^ quote name);
     AList.update (op =) (name, f) funs));
 
 fun no_print_function name =
   Synchronized.change print_functions (filter_out (equal name o #1));
 
 end;
 
 val _ =
   print_function "Execution.print"
     (fn {args, exec_id, ...} =>
       if null args then
         SOME {delay = NONE, pri = Task_Queue.urgent_pri + 2, persistent = false, strict = false,
           print_fn = fn _ => fn _ => Execution.fork_prints exec_id}
       else NONE);
 
 val _ =
   print_function "print_state"
     (fn {keywords, command_name, ...} =>
       if Options.default_bool "editor_output_state" andalso Keyword.is_printed keywords command_name
       then
         SOME {delay = NONE, pri = Task_Queue.urgent_pri + 1, persistent = false, strict = false,
           print_fn = fn _ => fn st =>
             if Toplevel.is_proof st then Output.state (Toplevel.string_of_state st)
             else ()}
       else NONE);
 
 
 (* combined execution *)
 
 type exec = eval * print list;
 
 fun init_exec opt_thy : exec =
   (Eval
     {command_id = Document_ID.none, exec_id = Document_ID.none,
       eval_process = Lazy.value (init_eval_state opt_thy)}, []);
 
 val no_exec = init_exec NONE;
 
 fun exec_ids NONE = []
   | exec_ids (SOME (eval, prints)) = eval_exec_id eval :: map print_exec_id prints;
 
 local
 
 fun run_process execution_id exec_id process =
   let val group = Future.worker_subgroup () in
     if Execution.running execution_id exec_id [group] then
       ignore (task_context group (fn () => Lazy.force_result {strict = true} process) ())
     else ()
   end;
 
 fun ignore_process process =
   Lazy.is_running process orelse Lazy.is_finished process;
 
 fun run_eval execution_id (Eval {exec_id, eval_process, ...}) =
   if Lazy.is_finished eval_process then ()
   else run_process execution_id exec_id eval_process;
 
 fun fork_print execution_id deps (Print {name, delay, pri, exec_id, print_process, ...}) =
   let
     val group = Future.worker_subgroup ();
     fun fork () =
       ignore ((singleton o Future.forks)
         {name = name, group = SOME group, deps = deps, pri = pri, interrupts = true}
         (fn () =>
           if ignore_process print_process then ()
           else run_process execution_id exec_id print_process));
   in
     (case delay of
       NONE => fork ()
     | SOME d => ignore (Event_Timer.request {physical = true} (Time.now () + d) fork))
   end;
 
 fun run_print execution_id (print as Print {exec_id, print_process, ...}) =
   if ignore_process print_process then ()
   else if parallel_print print then fork_print execution_id [] print
   else run_process execution_id exec_id print_process;
 
 in
 
 fun exec execution_id (eval, prints) =
   (run_eval execution_id eval; List.app (run_print execution_id) prints);
 
 fun exec_parallel_prints execution_id deps (exec as (Eval {eval_process, ...}, prints)) =
   if Lazy.is_finished eval_process
   then (List.app (fork_print execution_id deps) prints; NONE)
   else SOME exec;
 
 end;
 
 end;
diff --git a/src/Pure/PIDE/prover.scala b/src/Pure/PIDE/prover.scala
--- a/src/Pure/PIDE/prover.scala
+++ b/src/Pure/PIDE/prover.scala
@@ -1,323 +1,323 @@
 /*  Title:      Pure/PIDE/prover.scala
     Author:     Makarius
     Options:    :folding=explicit:
 
 Prover process wrapping.
 */
 
 package isabelle
 
 
 import java.io.{InputStream, OutputStream, BufferedOutputStream, IOException}
 
 
 object Prover
 {
   /* messages */
 
   sealed abstract class Message
   type Receiver = Message => Unit
 
   class Input(val name: String, val args: List[String]) extends Message
   {
     override def toString: String =
       XML.Elem(Markup(Markup.PROVER_COMMAND, List((Markup.NAME, name))),
         args.flatMap(s =>
           List(XML.newline, XML.elem(Markup.PROVER_ARG, YXML.parse_body(s))))).toString
   }
 
   class Output(val message: XML.Elem) extends Message
   {
     def kind: String = message.markup.name
     def properties: Properties.T = message.markup.properties
     def body: XML.Body = message.body
 
     def is_init: Boolean = kind == Markup.INIT
     def is_exit: Boolean = kind == Markup.EXIT
     def is_stdout: Boolean = kind == Markup.STDOUT
     def is_stderr: Boolean = kind == Markup.STDERR
     def is_system: Boolean = kind == Markup.SYSTEM
     def is_status: Boolean = kind == Markup.STATUS
     def is_report: Boolean = kind == Markup.REPORT
     def is_syslog: Boolean = is_init || is_exit || is_system || is_stderr
 
     override def toString: String =
     {
       val res =
         if (is_status || is_report) message.body.map(_.toString).mkString
         else Pretty.string_of(message.body, metric = Symbol.Metric)
       if (properties.isEmpty)
         kind + " [[" + res + "]]"
       else
         kind + " " +
-          (for ((x, y) <- properties) yield x + "=" + y).mkString("{", ",", "}") + " [[" + res + "]]"
+          (properties.map(Properties.Eq.apply)).mkString("{", ",", "}") + " [[" + res + "]]"
     }
   }
 
   class Malformed(msg: String) extends Exn.User_Error("Malformed prover message: " + msg)
   def bad_header(print: String): Nothing = throw new Malformed("bad message header\n" + print)
   def bad_chunks(): Nothing = throw new Malformed("bad message chunks")
 
   def the_chunk(chunks: List[Bytes], print: => String): Bytes =
     chunks match {
       case List(chunk) => chunk
       case _ => throw new Malformed("single chunk expected: " + print)
     }
 
   class Protocol_Output(props: Properties.T, val chunks: List[Bytes])
     extends Output(XML.Elem(Markup(Markup.PROTOCOL, props), Nil))
   {
     def chunk: Bytes = the_chunk(chunks, toString)
     lazy val text: String = chunk.text
   }
 }
 
 
 class Prover(
   receiver: Prover.Receiver,
   cache: XML.Cache,
   channel: System_Channel,
   process: Bash.Process) extends Protocol
 {
   /** receiver output **/
 
   private def system_output(text: String): Unit =
   {
     receiver(new Prover.Output(XML.Elem(Markup(Markup.SYSTEM, Nil), List(XML.Text(text)))))
   }
 
   private def protocol_output(props: Properties.T, chunks: List[Bytes]): Unit =
   {
     receiver(new Prover.Protocol_Output(props, chunks))
   }
 
   private def output(kind: String, props: Properties.T, body: XML.Body): Unit =
   {
     val main = XML.Elem(Markup(kind, props), Protocol_Message.clean_reports(body))
     val reports = Protocol_Message.reports(props, body)
     for (msg <- main :: reports) receiver(new Prover.Output(cache.elem(msg)))
   }
 
   private def exit_message(result: Process_Result): Unit =
   {
     output(Markup.EXIT, Markup.Process_Result(result),
       List(XML.Text(result.print_return_code)))
   }
 
 
 
   /** process manager **/
 
   private val process_result: Future[Process_Result] =
     Future.thread("process_result") {
       val rc = process.join
       val timing = process.get_timing
       Process_Result(rc, timing = timing)
     }
 
   private def terminate_process(): Unit =
   {
     try { process.terminate() }
     catch {
       case exn @ ERROR(_) => system_output("Failed to terminate prover process: " + exn.getMessage)
     }
   }
 
   private val process_manager = Isabelle_Thread.fork(name = "process_manager")
   {
     val stdout = physical_output(false)
 
     val (startup_failed, startup_errors) =
     {
       var finished: Option[Boolean] = None
       val result = new StringBuilder(100)
       while (finished.isEmpty && (process.stderr.ready || !process_result.is_finished)) {
         while (finished.isEmpty && process.stderr.ready) {
           try {
             val c = process.stderr.read
             if (c == 2) finished = Some(true)
             else result += c.toChar
           }
           catch { case _: IOException => finished = Some(false) }
         }
         Time.seconds(0.05).sleep()
       }
       (finished.isEmpty || !finished.get, result.toString.trim)
     }
     if (startup_errors != "") system_output(startup_errors)
 
     if (startup_failed) {
       terminate_process()
       process_result.join
       stdout.join
       exit_message(Process_Result(127))
     }
     else {
       val (command_stream, message_stream) = channel.rendezvous()
 
       command_input_init(command_stream)
       val stderr = physical_output(true)
       val message = message_output(message_stream)
 
       val result = process_result.join
       system_output("process terminated")
       command_input_close()
       for (thread <- List(stdout, stderr, message)) thread.join
       system_output("process_manager terminated")
       exit_message(result)
     }
     channel.shutdown()
   }
 
 
   /* management methods */
 
   def join(): Unit = process_manager.join()
 
   def terminate(): Unit =
   {
     system_output("Terminating prover process")
     command_input_close()
 
     var count = 10
     while (!process_result.is_finished && count > 0) {
       Time.seconds(0.1).sleep()
       count -= 1
     }
     if (!process_result.is_finished) terminate_process()
   }
 
 
 
   /** process streams **/
 
   /* command input */
 
   private var command_input: Option[Consumer_Thread[List[Bytes]]] = None
 
   private def command_input_close(): Unit = command_input.foreach(_.shutdown())
 
   private def command_input_init(raw_stream: OutputStream): Unit =
   {
     val name = "command_input"
     val stream = new BufferedOutputStream(raw_stream)
     command_input =
       Some(
         Consumer_Thread.fork(name)(
           consume =
             {
               case chunks =>
                 try {
                   Bytes(chunks.map(_.length).mkString("", ",", "\n")).write_stream(stream)
                   chunks.foreach(_.write_stream(stream))
                   stream.flush
                   true
                 }
                 catch { case e: IOException => system_output(name + ": " + e.getMessage); false }
             },
           finish = { case () => stream.close(); system_output(name + " terminated") }
         )
       )
   }
 
 
   /* physical output */
 
   private def physical_output(err: Boolean): Thread =
   {
     val (name, reader, markup) =
       if (err) ("standard_error", process.stderr, Markup.STDERR)
       else ("standard_output", process.stdout, Markup.STDOUT)
 
     Isabelle_Thread.fork(name = name) {
       try {
         var result = new StringBuilder(100)
         var finished = false
         while (!finished) {
           //{{{
           var c = -1
           var done = false
           while (!done && (result.isEmpty || reader.ready)) {
             c = reader.read
             if (c >= 0) result.append(c.asInstanceOf[Char])
             else done = true
           }
           if (result.nonEmpty) {
             output(markup, Nil, List(XML.Text(Symbol.decode(result.toString))))
             result.clear()
           }
           else {
             reader.close()
             finished = true
           }
           //}}}
         }
       }
       catch { case e: IOException => system_output(name + ": " + e.getMessage) }
       system_output(name + " terminated")
     }
   }
 
 
   /* message output */
 
   private def message_output(stream: InputStream): Thread =
   {
     def decode_chunk(chunk: Bytes): XML.Body =
       Symbol.decode_yxml_failsafe(chunk.text, cache = cache)
 
     val thread_name = "message_output"
     Isabelle_Thread.fork(name = thread_name) {
       try {
         var finished = false
         while (!finished) {
           Byte_Message.read_message(stream) match {
             case None => finished = true
             case Some(header :: chunks) =>
               decode_chunk(header) match {
                 case List(XML.Elem(Markup(kind, props), Nil)) =>
                   if (kind == Markup.PROTOCOL) protocol_output(props, chunks)
                   else output(kind, props, decode_chunk(Prover.the_chunk(chunks, kind)))
                 case _ => Prover.bad_header(header.toString)
               }
             case Some(_) => Prover.bad_chunks()
           }
         }
       }
       catch {
         case e: IOException => system_output("Cannot read message:\n" + e.getMessage)
         case e: Prover.Malformed => system_output(e.getMessage)
       }
       stream.close()
 
       system_output(thread_name + " terminated")
     }
   }
 
 
 
   /** protocol commands **/
 
   var trace: Boolean = false
 
   def protocol_command_raw(name: String, args: List[Bytes]): Unit =
     command_input match {
       case Some(thread) if thread.is_active =>
         if (trace) {
           val payload = args.foldLeft(0) { case (n, b) => n + b.length }
           Output.writeln(
             "protocol_command " + name + ", args = " + args.length + ", payload = " + payload)
         }
         thread.send(Bytes(name) :: args)
       case _ => error("Inactive prover input thread for command " + quote(name))
     }
 
   def protocol_command_args(name: String, args: List[String]): Unit =
   {
     receiver(new Prover.Input(name, args))
     protocol_command_raw(name, args.map(Bytes(_)))
   }
 
   def protocol_command(name: String, args: String*): Unit =
     protocol_command_args(name, args.toList)
 }
diff --git a/src/Pure/PIDE/resources.ML b/src/Pure/PIDE/resources.ML
--- a/src/Pure/PIDE/resources.ML
+++ b/src/Pure/PIDE/resources.ML
@@ -1,443 +1,443 @@
 (*  Title:      Pure/PIDE/resources.ML
     Author:     Makarius
 
 Resources for theories and auxiliary files.
 *)
 
 signature RESOURCES =
 sig
   val default_qualifier: string
   val init_session:
     {session_positions: (string * Properties.T) list,
      session_directories: (string * string) list,
      session_chapters: (string * string) list,
      bibtex_entries: (string * string list) list,
      command_timings: Properties.T list,
      scala_functions: (string * (bool * Position.T)) list,
      global_theories: (string * string) list,
      loaded_theories: string list} -> unit
   val init_session_yxml: string -> unit
   val init_session_file: Path.T -> unit
   val finish_session_base: unit -> unit
   val global_theory: string -> string option
   val loaded_theory: string -> bool
   val check_session: Proof.context -> string * Position.T -> string
   val session_chapter: string -> string
   val last_timing: Toplevel.transition -> Time.time
   val scala_functions: unit -> string list
   val check_scala_function: Proof.context -> string * Position.T -> string * bool
   val master_directory: theory -> Path.T
   val imports_of: theory -> (string * Position.T) list
   val begin_theory: Path.T -> Thy_Header.header -> theory list -> theory
   val thy_path: Path.T -> Path.T
   val theory_qualifier: string -> string
   val theory_bibtex_entries: string -> string list
   val find_theory_file: string -> Path.T option
   val import_name: string -> Path.T -> string ->
     {node_name: Path.T, master_dir: Path.T, theory_name: string}
   val check_thy: Path.T -> string ->
    {master: Path.T * SHA1.digest, text: string, theory_pos: Position.T,
     imports: (string * Position.T) list, keywords: Thy_Header.keywords}
   val parse_files: (Path.T -> Path.T list) -> (theory -> Token.file list) parser
   val parse_file: (theory -> Token.file) parser
   val provide: Path.T * SHA1.digest -> theory -> theory
   val provide_file: Token.file -> theory -> theory
   val provide_parse_files: (Path.T -> Path.T list) -> (theory -> Token.file list * theory) parser
   val provide_parse_file: (theory -> Token.file * theory) parser
   val loaded_files_current: theory -> bool
   val check_path: Proof.context -> Path.T option -> Input.source -> Path.T
   val check_file: Proof.context -> Path.T option -> Input.source -> Path.T
   val check_dir: Proof.context -> Path.T option -> Input.source -> Path.T
   val check_session_dir: Proof.context -> Path.T option -> Input.source -> Path.T
 end;
 
 structure Resources: RESOURCES =
 struct
 
 (* command timings *)
 
 type timings = ((string * Time.time) Inttab.table) Symtab.table;  (*file -> offset -> name, time*)
 
 val empty_timings: timings = Symtab.empty;
 
 fun update_timings props =
   (case Markup.parse_command_timing_properties props of
     SOME ({file, offset, name}, time) =>
       Symtab.map_default (file, Inttab.empty)
         (Inttab.map_default (offset, (name, time)) (fn (_, t) => (name, t + time)))
   | NONE => I);
 
 fun make_timings command_timings =
   fold update_timings command_timings empty_timings;
 
 fun approximative_id name pos =
   (case (Position.file_of pos, Position.offset_of pos) of
     (SOME file, SOME offset) =>
       if name = "" then NONE else SOME {file = file, offset = offset, name = name}
   | _ => NONE);
 
 fun get_timings timings tr =
   (case approximative_id (Toplevel.name_of tr) (Toplevel.pos_of tr) of
     SOME {file, offset, name} =>
       (case Symtab.lookup timings file of
         SOME offsets =>
           (case Inttab.lookup offsets offset of
             SOME (name', time) => if name = name' then SOME time else NONE
           | NONE => NONE)
       | NONE => NONE)
   | NONE => NONE)
   |> the_default Time.zeroTime;
 
 
 (* session base *)
 
 val default_qualifier = "Draft";
 
 type entry = {pos: Position.T, serial: serial};
 
 fun make_entry props : entry =
   {pos = Position.of_properties props, serial = serial ()};
 
 val empty_session_base =
   ({session_positions = []: (string * entry) list,
     session_directories = Symtab.empty: Path.T list Symtab.table,
     session_chapters = Symtab.empty: string Symtab.table,
     bibtex_entries = Symtab.empty: string list Symtab.table,
     timings = empty_timings,
     scala_functions = Symtab.empty: (bool * Position.T) Symtab.table},
    {global_theories = Symtab.empty: string Symtab.table,
     loaded_theories = Symtab.empty: unit Symtab.table});
 
 val global_session_base =
   Synchronized.var "Sessions.base" empty_session_base;
 
 fun init_session
     {session_positions, session_directories, session_chapters, bibtex_entries,
       command_timings, scala_functions, global_theories, loaded_theories} =
   Synchronized.change global_session_base
     (fn _ =>
       ({session_positions = sort_by #1 (map (apsnd make_entry) session_positions),
         session_directories =
           fold_rev (fn (dir, name) => Symtab.cons_list (name, Path.explode dir))
             session_directories Symtab.empty,
         session_chapters = Symtab.make session_chapters,
         bibtex_entries = Symtab.make bibtex_entries,
         timings = make_timings command_timings,
         scala_functions = Symtab.make scala_functions},
        {global_theories = Symtab.make global_theories,
         loaded_theories = Symtab.make_set loaded_theories}));
 
 fun init_session_yxml yxml =
   let
     val (session_positions, (session_directories, (session_chapters, (bibtex_entries,
         (command_timings, (scala_functions, (global_theories, loaded_theories))))))) =
       YXML.parse_body yxml |>
         let open XML.Decode in
           (pair (list (pair string properties))
             (pair (list (pair string string)) (pair (list (pair string string))
               (pair (list (pair string (list string))) (pair (list properties)
                 (pair (list (pair string (pair bool properties)))
                   (pair (list (pair string string)) (list string))))))))
         end;
   in
     init_session
       {session_positions = session_positions,
        session_directories = session_directories,
        session_chapters = session_chapters,
        bibtex_entries = bibtex_entries,
        command_timings = command_timings,
        scala_functions = (map o apsnd o apsnd) Position.of_properties scala_functions,
        global_theories = global_theories,
        loaded_theories = loaded_theories}
   end;
 
 fun init_session_file path =
   init_session_yxml (File.read path) before File.rm path;
 
 fun finish_session_base () =
   Synchronized.change global_session_base
     (apfst (K (#1 empty_session_base)));
 
 fun get_session_base f = f (Synchronized.value global_session_base);
 fun get_session_base1 f = get_session_base (f o #1);
 fun get_session_base2 f = get_session_base (f o #2);
 
 fun global_theory a = Symtab.lookup (get_session_base2 #global_theories) a;
 fun loaded_theory a = Symtab.defined (get_session_base2 #loaded_theories) a;
 
 fun check_session ctxt arg =
   Completion.check_item "session"
     (fn (name, {pos, serial}) =>
       Markup.entity Markup.sessionN name
       |> Markup.properties (Position.entity_properties_of false serial pos))
     (get_session_base1 #session_positions) ctxt arg;
 
 fun session_chapter name =
   the_default "Unsorted" (Symtab.lookup (get_session_base1 #session_chapters) name);
 
 fun last_timing tr = get_timings (get_session_base1 #timings) tr;
 
 
 (* Scala functions *)
 
 (*raw bootstrap environment*)
 fun scala_functions () = space_explode "," (getenv "ISABELLE_SCALA_FUNCTIONS");
 
 (*regular resources*)
 fun scala_function a =
   (a, the_default (false, Position.none) (Symtab.lookup (get_session_base1 #scala_functions) a));
 
 fun check_scala_function ctxt arg =
   let
     val funs = scala_functions () |> sort_strings |> map scala_function;
     val name = Completion.check_entity Markup.scala_functionN (map (apsnd #2) funs) ctxt arg;
     val multi =
       (case AList.lookup (op =) funs name of
         SOME (multi, _) => multi
       | NONE => false);
   in (name, multi) end;
 
 val _ = Theory.setup
- (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>scala_function\<close>
+ (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>scala_function\<close>
     (Scan.lift Parse.embedded_position) (#1 oo check_scala_function) #>
   ML_Antiquotation.inline_embedded \<^binding>\<open>scala_function\<close>
     (Args.context -- Scan.lift Parse.embedded_position
       >> (uncurry check_scala_function #> #1 #> ML_Syntax.print_string)) #>
   ML_Antiquotation.value_embedded \<^binding>\<open>scala\<close>
     (Args.context -- Scan.lift Args.embedded_position >> (fn (ctxt, arg) =>
       let
         val (name, multi) = check_scala_function ctxt arg;
         val func = if multi then "Scala.function" else "Scala.function1";
       in ML_Syntax.atomic (func ^ " " ^ ML_Syntax.print_string name) end)));
 
 
 (* manage source files *)
 
 type files =
  {master_dir: Path.T,  (*master directory of theory source*)
   imports: (string * Position.T) list,  (*source specification of imports*)
   provided: (Path.T * SHA1.digest) list};  (*source path, digest*)
 
 fun make_files (master_dir, imports, provided): files =
  {master_dir = master_dir, imports = imports, provided = provided};
 
 structure Files = Theory_Data
 (
   type T = files;
   val empty = make_files (Path.current, [], []);
   val extend = I;
   fun merge ({master_dir, imports, provided = provided1}, {provided = provided2, ...}) =
     let val provided' = Library.merge (op =) (provided1, provided2)
     in make_files (master_dir, imports, provided') end
 );
 
 fun map_files f =
   Files.map (fn {master_dir, imports, provided} =>
     make_files (f (master_dir, imports, provided)));
 
 
 val master_directory = #master_dir o Files.get;
 val imports_of = #imports o Files.get;
 
 fun begin_theory master_dir {name, imports, keywords} parents =
   Theory.begin_theory name parents
   |> map_files (fn _ => (Path.explode (Path.implode_symbolic master_dir), imports, []))
   |> Thy_Header.add_keywords keywords;
 
 
 (* theory files *)
 
 val thy_path = Path.ext "thy";
 
 fun theory_qualifier theory =
   (case global_theory theory of
     SOME qualifier => qualifier
   | NONE => Long_Name.qualifier theory);
 
 fun theory_name qualifier theory =
   if Long_Name.is_qualified theory orelse is_some (global_theory theory)
   then theory
   else Long_Name.qualify qualifier theory;
 
 fun theory_bibtex_entries theory =
   Symtab.lookup_list (get_session_base1 #bibtex_entries) (theory_qualifier theory);
 
 fun find_theory_file thy_name =
   let
     val thy_file = thy_path (Path.basic (Long_Name.base_name thy_name));
     val session = theory_qualifier thy_name;
     val dirs = Symtab.lookup_list (get_session_base1 #session_directories) session;
   in
     dirs |> get_first (fn dir =>
       let val path = dir + thy_file
       in if File.is_file path then SOME path else NONE end)
   end;
 
 fun make_theory_node node_name theory =
   {node_name = node_name, master_dir = Path.dir node_name, theory_name = theory};
 
 fun loaded_theory_node theory =
   {node_name = Path.basic theory, master_dir = Path.current, theory_name = theory};
 
 fun import_name qualifier dir s =
   let
     val theory = theory_name qualifier (Thy_Header.import_name s);
     fun theory_node () =
       make_theory_node (File.full_path dir (thy_path (Path.expand (Path.explode s)))) theory;
   in
     if not (Thy_Header.is_base_name s) then theory_node ()
     else if loaded_theory theory then loaded_theory_node theory
     else
       (case find_theory_file theory of
         SOME node_name => make_theory_node node_name theory
       | NONE => if Long_Name.is_qualified s then loaded_theory_node theory else theory_node ())
   end;
 
 fun check_file dir file = File.check_file (File.full_path dir file);
 
 fun check_thy dir thy_name =
   let
     val thy_base_name = Long_Name.base_name thy_name;
     val master_file =
       (case find_theory_file thy_name of
         SOME path => check_file Path.current path
       | NONE => check_file dir (thy_path (Path.basic thy_base_name)));
     val text = File.read master_file;
 
     val {name = (name, pos), imports, keywords} =
       Thy_Header.read (Path.position master_file) text;
     val _ =
       thy_base_name <> name andalso
         error ("Bad theory name " ^ quote name ^
           " for file " ^ Path.print (Path.base master_file) ^ Position.here pos);
   in
    {master = (master_file, SHA1.digest text), text = text, theory_pos = pos,
     imports = imports, keywords = keywords}
   end;
 
 
 (* load files *)
 
 fun parse_files make_paths =
   Scan.ahead Parse.not_eof -- Parse.path_input >> (fn (tok, source) => fn thy =>
     (case Token.get_files tok of
       [] =>
         let
           val master_dir = master_directory thy;
           val name = Input.string_of source;
           val pos = Input.pos_of source;
           val delimited = Input.is_delimited source;
           val src_paths = make_paths (Path.explode name);
         in map (Command.read_file master_dir pos delimited) src_paths end
     | files => map Exn.release files));
 
 val parse_file = parse_files single >> (fn f => f #> the_single);
 
 
 fun provide (src_path, id) =
   map_files (fn (master_dir, imports, provided) =>
     if AList.defined (op =) provided src_path then
       error ("Duplicate use of source file: " ^ Path.print src_path)
     else (master_dir, imports, (src_path, id) :: provided));
 
 fun provide_file (file: Token.file) = provide (#src_path file, #digest file);
 
 fun provide_parse_files make_paths =
   parse_files make_paths >> (fn files => fn thy =>
     let
       val fs = files thy;
       val thy' = fold (fn {src_path, digest, ...} => provide (src_path, digest)) fs thy;
     in (fs, thy') end);
 
 val provide_parse_file = provide_parse_files single >> (fn f => f #>> the_single);
 
 
 fun load_file thy src_path =
   let
     val full_path = check_file (master_directory thy) src_path;
     val text = File.read full_path;
     val id = SHA1.digest text;
   in ((full_path, id), text) end;
 
 fun loaded_files_current thy =
   #provided (Files.get thy) |>
     forall (fn (src_path, id) =>
       (case try (load_file thy) src_path of
         NONE => false
       | SOME ((_, id'), _) => id = id'));
 
 
 (* formal check *)
 
 fun formal_check check_file ctxt opt_dir source =
   let
     val name = Input.string_of source;
     val pos = Input.pos_of source;
     val delimited = Input.is_delimited source;
 
     val _ = Context_Position.report ctxt pos (Markup.language_path delimited);
 
     fun err msg = error (msg ^ Position.here pos);
     val dir =
       (case opt_dir of
         SOME dir => dir
       | NONE => master_directory (Proof_Context.theory_of ctxt));
     val path = dir + Path.explode name handle ERROR msg => err msg;
     val _ = Path.expand path handle ERROR msg => err msg;
     val _ = Context_Position.report ctxt pos (Markup.path (Path.implode_symbolic path));
     val _ : Path.T = check_file path handle ERROR msg => err msg;
   in path end;
 
 val check_path = formal_check I;
 val check_file = formal_check File.check_file;
 val check_dir = formal_check File.check_dir;
 
 fun check_session_dir ctxt opt_dir s =
   let
     val dir = Path.expand (check_dir ctxt opt_dir s);
     val ok =
       File.is_file (dir + Path.explode("ROOT")) orelse
       File.is_file (dir + Path.explode("ROOTS"));
   in
     if ok then dir
     else
       error ("Bad session root directory (missing ROOT or ROOTS): " ^
         Path.print dir ^ Position.here (Input.pos_of s))
   end;
 
 
 (* antiquotations *)
 
 local
 
 fun document_antiq (check: Proof.context -> Path.T option -> Input.source -> Path.T) =
   Args.context -- Scan.lift Parse.path_input >> (fn (ctxt, source) =>
     let
       val _ = check ctxt NONE source;
       val latex = Latex.string (Latex.output_ascii_breakable "/" (Input.string_of source));
     in Latex.enclose_block "\\isatt{" "}" [latex] end);
 
 fun ML_antiq check =
   Args.context -- Scan.lift Parse.path_input >> (fn (ctxt, source) =>
     check ctxt (SOME Path.current) source |> ML_Syntax.print_path);
 
 in
 
 val _ = Theory.setup
- (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>session\<close>
+ (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>session\<close>
     (Scan.lift Parse.embedded_position) check_session #>
-  Thy_Output.antiquotation_raw_embedded \<^binding>\<open>path\<close> (document_antiq check_path) (K I) #>
-  Thy_Output.antiquotation_raw_embedded \<^binding>\<open>file\<close> (document_antiq check_file) (K I) #>
-  Thy_Output.antiquotation_raw_embedded \<^binding>\<open>dir\<close> (document_antiq check_dir) (K I) #>
+  Document_Output.antiquotation_raw_embedded \<^binding>\<open>path\<close> (document_antiq check_path) (K I) #>
+  Document_Output.antiquotation_raw_embedded \<^binding>\<open>file\<close> (document_antiq check_file) (K I) #>
+  Document_Output.antiquotation_raw_embedded \<^binding>\<open>dir\<close> (document_antiq check_dir) (K I) #>
   ML_Antiquotation.value_embedded \<^binding>\<open>path\<close> (ML_antiq check_path) #>
   ML_Antiquotation.value_embedded \<^binding>\<open>file\<close> (ML_antiq check_file) #>
   ML_Antiquotation.value_embedded \<^binding>\<open>dir\<close> (ML_antiq check_dir) #>
   ML_Antiquotation.value_embedded \<^binding>\<open>path_binding\<close>
     (Scan.lift (Parse.position Parse.path) >>
       (ML_Syntax.print_path_binding o Path.explode_binding)) #>
   ML_Antiquotation.value \<^binding>\<open>master_dir\<close>
     (Args.theory >> (ML_Syntax.print_path o master_directory)));
 
 end;
 
 end;
diff --git a/src/Pure/PIDE/yxml.scala b/src/Pure/PIDE/yxml.scala
--- a/src/Pure/PIDE/yxml.scala
+++ b/src/Pure/PIDE/yxml.scala
@@ -1,153 +1,148 @@
 /*  Title:      Pure/PIDE/yxml.scala
     Author:     Makarius
 
 Efficient text representation of XML trees.  Suitable for direct
 inlining into plain text.
 */
 
 package isabelle
 
 
 import scala.collection.mutable
 
 
 object YXML
 {
   /* chunk markers */
 
   val X = '\u0005'
   val Y = '\u0006'
 
   val is_X: Char => Boolean = _ == X
   val is_Y: Char => Boolean = _ == Y
 
   val X_string: String = X.toString
   val Y_string: String = Y.toString
   val XY_string: String = X_string + Y_string
   val XYX_string: String = XY_string + X_string
 
   def detect(s: String): Boolean = s.exists(c => c == X || c == Y)
   def detect_elem(s: String): Boolean = s.startsWith(XY_string)
 
 
   /* string representation */
 
   def traversal(string: String => Unit, body: XML.Body): Unit =
   {
     def tree(t: XML.Tree): Unit =
       t match {
         case XML.Elem(markup @ Markup(name, atts), ts) =>
           if (markup.is_empty) ts.foreach(tree)
           else {
             string(XY_string)
             string(name)
             for ((a, x) <- atts) { string(Y_string); string(a); string("="); string(x) }
             string(X_string)
             ts.foreach(tree)
             string(XYX_string)
           }
         case XML.Text(text) => string(text)
       }
     body.foreach(tree)
   }
 
   def string_of_body(body: XML.Body): String =
   {
     val s = new StringBuilder
     traversal(str => s ++= str, body)
     s.toString
   }
 
   def string_of_tree(tree: XML.Tree): String = string_of_body(List(tree))
 
 
   /* parsing */
 
   private def err(msg: String) = error("Malformed YXML: " + msg)
   private def err_attribute() = err("bad attribute")
   private def err_element() = err("bad element")
   private def err_unbalanced(name: String) =
     if (name == "") err("unbalanced element")
     else err("unbalanced element " + quote(name))
 
   private def parse_attrib(source: CharSequence): (String, String) =
-  {
-    val s = source.toString
-    val i = s.indexOf('=')
-    if (i <= 0) err_attribute()
-    (s.substring(0, i), s.substring(i + 1))
-  }
+    Properties.Eq.unapply(source.toString) getOrElse err_attribute()
 
 
   def parse_body(source: CharSequence, cache: XML.Cache = XML.Cache.none): XML.Body =
   {
     /* stack operations */
 
     def buffer(): mutable.ListBuffer[XML.Tree] = new mutable.ListBuffer[XML.Tree]
     var stack: List[(Markup, mutable.ListBuffer[XML.Tree])] = List((Markup.Empty, buffer()))
 
     def add(x: XML.Tree): Unit =
       (stack: @unchecked) match { case (_, body) :: _ => body += x }
 
     def push(name: String, atts: XML.Attributes): Unit =
       if (name == "") err_element()
       else stack = (cache.markup(Markup(name, atts)), buffer()) :: stack
 
     def pop(): Unit =
       (stack: @unchecked) match {
         case (Markup.Empty, _) :: _ => err_unbalanced("")
         case (markup, body) :: pending =>
           stack = pending
           add(cache.tree0(XML.Elem(markup, body.toList)))
       }
 
 
     /* parse chunks */
 
     for (chunk <- Library.separated_chunks(is_X, source) if chunk.length != 0) {
       if (chunk.length == 1 && chunk.charAt(0) == Y) pop()
       else {
         Library.separated_chunks(is_Y, chunk).toList match {
           case ch :: name :: atts if ch.length == 0 =>
             push(name.toString, atts.map(parse_attrib))
           case txts => for (txt <- txts) add(cache.tree0(XML.Text(cache.string(txt.toString))))
         }
       }
     }
     (stack: @unchecked) match {
       case List((Markup.Empty, body)) => body.toList
       case (Markup(name, _), _) :: _ => err_unbalanced(name)
     }
   }
 
   def parse(source: CharSequence, cache: XML.Cache = XML.Cache.none): XML.Tree =
     parse_body(source, cache = cache) match {
       case List(result) => result
       case Nil => XML.no_text
       case _ => err("multiple XML trees")
     }
 
   def parse_elem(source: CharSequence, cache: XML.Cache = XML.Cache.none): XML.Tree =
     parse_body(source, cache = cache) match {
       case List(elem: XML.Elem) => elem
       case _ => err("single XML element expected")
     }
 
 
   /* failsafe parsing */
 
   private def markup_broken(source: CharSequence) =
     XML.Elem(Markup.Broken, List(XML.Text(source.toString)))
 
   def parse_body_failsafe(source: CharSequence, cache: XML.Cache = XML.Cache.none): XML.Body =
   {
     try { parse_body(source, cache = cache) }
     catch { case ERROR(_) => List(markup_broken(source)) }
   }
 
   def parse_failsafe(source: CharSequence, cache: XML.Cache = XML.Cache.none): XML.Tree =
   {
     try { parse(source, cache = cache) }
     catch { case ERROR(_) => markup_broken(source) }
   }
 }
diff --git a/src/Pure/ROOT.ML b/src/Pure/ROOT.ML
--- a/src/Pure/ROOT.ML
+++ b/src/Pure/ROOT.ML
@@ -1,358 +1,358 @@
 (*  Title:      Pure/ROOT.ML
     Author:     Makarius
 
 Main entry point for the Isabelle/Pure bootstrap process.
 
 Note: When this file is open in the Prover IDE, the ML files of
 Isabelle/Pure can be explored interactively. This is a separate copy of
 Pure within Pure: it does not affect the running logic session.
 *)
 
 chapter "Isabelle/Pure bootstrap";
 
 ML_file "ML/ml_name_space.ML";
 
 
 section "Bootstrap phase 0: Poly/ML setup";
 
 ML_file "ML/ml_init.ML";
 ML_file "ML/ml_system.ML";
 
 ML_file "General/basics.ML";
 ML_file "General/symbol_explode.ML";
 
 ML_file "Concurrent/multithreading.ML";
 ML_file "Concurrent/unsynchronized.ML";
 ML_file "Concurrent/synchronized.ML";
 ML_file "Concurrent/counter.ML";
 
 ML_file "ML/ml_heap.ML";
 ML_file "ML/ml_profiling.ML";
 ML_file "ML/ml_print_depth0.ML";
 ML_file "ML/ml_pretty.ML";
 ML_file "ML/ml_compiler0.ML";
 
 
 section "Bootstrap phase 1: towards ML within position context";
 
 subsection "Library of general tools";
 
 ML_file "library.ML";
 ML_file "General/print_mode.ML";
 ML_file "General/alist.ML";
 ML_file "General/table.ML";
 
 ML_file "General/random.ML";
 ML_file "General/value.ML";
 ML_file "General/properties.ML";
 ML_file "General/output.ML";
 ML_file "PIDE/markup.ML";
 ML_file "General/utf8.ML";
 ML_file "General/scan.ML";
 ML_file "General/source.ML";
 ML_file "General/symbol.ML";
 ML_file "General/position.ML";
 ML_file "General/symbol_pos.ML";
 ML_file "General/input.ML";
 ML_file "General/comment.ML";
 ML_file "General/antiquote.ML";
 ML_file "ML/ml_lex.ML";
 ML_file "ML/ml_compiler1.ML";
 
 
 section "Bootstrap phase 2: towards ML within Isar context";
 
 subsection "Library of general tools";
 
 ML_file "General/integer.ML";
 ML_file "General/stack.ML";
 ML_file "General/queue.ML";
 ML_file "General/heap.ML";
 ML_file "General/same.ML";
 ML_file "General/ord_list.ML";
 ML_file "General/balanced_tree.ML";
 ML_file "General/linear_set.ML";
 ML_file "General/buffer.ML";
 ML_file "General/pretty.ML";
 ML_file "General/rat.ML";
 ML_file "PIDE/xml.ML";
 ML_file "General/path.ML";
 ML_file "General/url.ML";
 ML_file "System/bash.ML";
 ML_file "General/file.ML";
 ML_file "General/long_name.ML";
 ML_file "General/binding.ML";
 ML_file "General/socket_io.ML";
 ML_file "General/seq.ML";
 ML_file "General/time.ML";
 ML_file "General/timing.ML";
 ML_file "General/sha1.ML";
 
 ML_file "PIDE/yxml.ML";
 ML_file "PIDE/byte_message.ML";
 ML_file "PIDE/protocol_message.ML";
 ML_file "PIDE/document_id.ML";
 
 ML_file "General/change_table.ML";
 ML_file "General/graph.ML";
 
 ML_file "System/options.ML";
 
 
 subsection "Fundamental structures";
 
 ML_file "name.ML";
 ML_file "term.ML";
 ML_file "context.ML";
 ML_file "config.ML";
 ML_file "context_position.ML";
 ML_file "soft_type_system.ML";
 
 
 subsection "Concurrency within the ML runtime";
 
 ML_file "ML/exn_properties.ML";
 ML_file_no_debug "ML/exn_debugger.ML";
 
 ML_file "Concurrent/thread_data_virtual.ML";
 ML_file "Concurrent/isabelle_thread.ML";
 ML_file "Concurrent/single_assignment.ML";
 
 ML_file "Concurrent/par_exn.ML";
 ML_file "Concurrent/task_queue.ML";
 ML_file "Concurrent/future.ML";
 ML_file "Concurrent/event_timer.ML";
 ML_file "Concurrent/timeout.ML";
 ML_file "Concurrent/lazy.ML";
 ML_file "Concurrent/par_list.ML";
 
 ML_file "Concurrent/mailbox.ML";
 ML_file "Concurrent/cache.ML";
 
 ML_file "PIDE/active.ML";
 ML_file "Thy/export.ML";
 
 
 subsection "Inner syntax";
 
 ML_file "Syntax/type_annotation.ML";
 ML_file "Syntax/term_position.ML";
 ML_file "Syntax/lexicon.ML";
 ML_file "Syntax/ast.ML";
 ML_file "Syntax/syntax_ext.ML";
 ML_file "Syntax/parser.ML";
 ML_file "Syntax/syntax_trans.ML";
 ML_file "Syntax/mixfix.ML";
 ML_file "Syntax/printer.ML";
 ML_file "Syntax/syntax.ML";
 
 
 subsection "Core of tactical proof system";
 
 ML_file "term_ord.ML";
 ML_file "term_subst.ML";
 ML_file "General/completion.ML";
 ML_file "General/name_space.ML";
 ML_file "sorts.ML";
 ML_file "type.ML";
 ML_file "logic.ML";
 ML_file "Syntax/simple_syntax.ML";
 ML_file "net.ML";
 ML_file "item_net.ML";
 ML_file "envir.ML";
 ML_file "consts.ML";
 ML_file "term_xml.ML";
 ML_file "primitive_defs.ML";
 ML_file "sign.ML";
 ML_file "defs.ML";
 ML_file "term_sharing.ML";
 ML_file "pattern.ML";
 ML_file "unify.ML";
 ML_file "theory.ML";
 ML_file "proofterm.ML";
 ML_file "thm.ML";
 ML_file "more_pattern.ML";
 ML_file "more_unify.ML";
 ML_file "more_thm.ML";
 
 ML_file "facts.ML";
 ML_file "thm_name.ML";
 ML_file "global_theory.ML";
 ML_file "pure_thy.ML";
 ML_file "drule.ML";
 ML_file "morphism.ML";
 ML_file "variable.ML";
 ML_file "conv.ML";
 ML_file "goal_display.ML";
 ML_file "tactical.ML";
 ML_file "search.ML";
 ML_file "tactic.ML";
 ML_file "raw_simplifier.ML";
 ML_file "conjunction.ML";
 ML_file "assumption.ML";
 
 
 subsection "Isar -- Intelligible Semi-Automated Reasoning";
 
 (*ML support and global execution*)
 ML_file "ML/ml_syntax.ML";
 ML_file "ML/ml_env.ML";
 ML_file "ML/ml_options.ML";
 ML_file "ML/ml_print_depth.ML";
 ML_file_no_debug "Isar/runtime.ML";
 ML_file "PIDE/execution.ML";
 ML_file "ML/ml_compiler.ML";
 
 ML_file "skip_proof.ML";
 ML_file "goal.ML";
 
 (*outer syntax*)
 ML_file "Isar/keyword.ML";
 ML_file "Isar/token.ML";
 ML_file "Isar/parse.ML";
 ML_file "Thy/document_source.ML";
 ML_file "Thy/thy_header.ML";
 ML_file "Thy/document_marker.ML";
 
 (*proof context*)
 ML_file "Isar/object_logic.ML";
 ML_file "Isar/rule_cases.ML";
 ML_file "Isar/auto_bind.ML";
 ML_file "type_infer.ML";
 ML_file "Syntax/local_syntax.ML";
 ML_file "Isar/proof_context.ML";
 ML_file "type_infer_context.ML";
 ML_file "Syntax/syntax_phases.ML";
 ML_file "Isar/args.ML";
 
 (*theory specifications*)
 ML_file "Isar/local_defs.ML";
 ML_file "Isar/local_theory.ML";
 ML_file "Isar/entity.ML";
 ML_file "PIDE/command_span.ML";
 ML_file "Thy/thy_element.ML";
 ML_file "Thy/markdown.ML";
 ML_file "Thy/latex.ML";
 
 (*ML with context and antiquotations*)
 ML_file "ML/ml_context.ML";
 ML_file "ML/ml_antiquotation.ML";
 ML_file "ML/ml_compiler2.ML";
 ML_file "ML/ml_antiquotations1.ML";
 
 
 section "Bootstrap phase 3: towards theory Pure and final ML toplevel setup";
 
 (*basic proof engine*)
 ML_file "par_tactical.ML";
 ML_file "context_tactic.ML";
 ML_file "Isar/proof_display.ML";
 ML_file "Isar/attrib.ML";
 ML_file "Isar/context_rules.ML";
 ML_file "Isar/method.ML";
 ML_file "Isar/proof.ML";
 ML_file "Isar/element.ML";
 ML_file "Isar/obtain.ML";
 ML_file "Isar/subgoal.ML";
 ML_file "Isar/calculation.ML";
 
 (*local theories and targets*)
 ML_file "Isar/locale.ML";
 ML_file "Isar/generic_target.ML";
 ML_file "Isar/bundle.ML";
 ML_file "Isar/overloading.ML";
 ML_file "axclass.ML";
 ML_file "Isar/class.ML";
 ML_file "Isar/named_target.ML";
 ML_file "Isar/expression.ML";
 ML_file "Isar/interpretation.ML";
 ML_file "Isar/class_declaration.ML";
 ML_file "Isar/target_context.ML";
 ML_file "Isar/experiment.ML";
 ML_file "simplifier.ML";
 ML_file "Tools/plugin.ML";
 
 (*executable theory content*)
 ML_file "Isar/code.ML";
 
 (*specifications*)
 ML_file "Isar/spec_rules.ML";
 ML_file "Isar/specification.ML";
 ML_file "Isar/parse_spec.ML";
 ML_file "Isar/typedecl.ML";
 
 (*toplevel transactions*)
 ML_file "Isar/proof_node.ML";
 ML_file "Isar/toplevel.ML";
 
 (*proof term operations*)
 ML_file "Proof/proof_rewrite_rules.ML";
 ML_file "Proof/proof_syntax.ML";
 ML_file "Proof/proof_checker.ML";
 ML_file "Proof/extraction.ML";
 
 (*Isabelle system*)
 ML_file "PIDE/protocol_command.ML";
 ML_file "System/scala.ML";
 ML_file "System/process_result.ML";
 ML_file "System/isabelle_system.ML";
 
 
 (*theory documents*)
 ML_file "Thy/term_style.ML";
 ML_file "Isar/outer_syntax.ML";
 ML_file "ML/ml_antiquotations2.ML";
 ML_file "ML/ml_pid.ML";
 ML_file "Thy/document_antiquotation.ML";
-ML_file "Thy/thy_output.ML";
+ML_file "Thy/document_output.ML";
 ML_file "Thy/document_antiquotations.ML";
 ML_file "General/graph_display.ML";
 ML_file "pure_syn.ML";
 ML_file "PIDE/command.ML";
 ML_file "PIDE/query_operation.ML";
 ML_file "PIDE/resources.ML";
 ML_file "Thy/thy_info.ML";
 ML_file "thm_deps.ML";
 ML_file "Thy/export_theory.ML";
 ML_file "Thy/sessions.ML";
 ML_file "PIDE/session.ML";
 ML_file "PIDE/document.ML";
 
 (*theory and proof operations*)
 ML_file "Isar/isar_cmd.ML";
 
 
 subsection "Isabelle/Isar system";
 
 ML_file "System/command_line.ML";
 ML_file "System/message_channel.ML";
 ML_file "System/isabelle_process.ML";
 ML_file "System/scala_compiler.ML";
 ML_file "System/isabelle_tool.ML";
 ML_file "Thy/bibtex.ML";
 ML_file "PIDE/protocol.ML";
 ML_file "General/output_primitives_virtual.ML";
 
 
 subsection "Miscellaneous tools and packages for Pure Isabelle";
 
 ML_file "ML/ml_pp.ML";
 ML_file "ML/ml_thms.ML";
 ML_file "ML/ml_file.ML";
 
 ML_file "Tools/build.ML";
 ML_file "Tools/named_thms.ML";
 ML_file "Tools/print_operation.ML";
 ML_file "Tools/rail.ML";
 ML_file "Tools/rule_insts.ML";
 ML_file "Tools/thy_deps.ML";
 ML_file "Tools/class_deps.ML";
 ML_file "Tools/find_theorems.ML";
 ML_file "Tools/find_consts.ML";
 ML_file "Tools/simplifier_trace.ML";
 ML_file_no_debug "Tools/debugger.ML";
 ML_file "Tools/named_theorems.ML";
 ML_file "Tools/doc.ML";
 ML_file "Tools/jedit.ML";
 ML_file "Tools/ghc.ML";
 ML_file "Tools/generated_files.ML"
diff --git a/src/Pure/ROOT.scala b/src/Pure/ROOT.scala
--- a/src/Pure/ROOT.scala
+++ b/src/Pure/ROOT.scala
@@ -1,24 +1,23 @@
 /*  Title:      Pure/ROOT.scala
     Author:     Makarius
 
 Root of isabelle package.
 */
 
 package object isabelle
 {
   val ERROR = Exn.ERROR
   val error = Exn.error _
   def cat_error(msgs: String*): Nothing = Exn.cat_error(msgs:_*)
 
   def using[A <: AutoCloseable, B](a: A)(f: A => B): B = Library.using(a)(f)
   val space_explode = Library.space_explode _
   val split_lines = Library.split_lines _
   val cat_lines = Library.cat_lines _
   val terminate_lines = Library.terminate_lines _
   val quote = Library.quote _
   val commas = Library.commas _
   val commas_quote = Library.commas_quote _
   val proper_string = Library.proper_string _
   def proper_list[A](list: List[A]): Option[List[A]] = Library.proper_list(list)
 }
-
diff --git a/src/Pure/System/isabelle_platform.scala b/src/Pure/System/isabelle_platform.scala
--- a/src/Pure/System/isabelle_platform.scala
+++ b/src/Pure/System/isabelle_platform.scala
@@ -1,67 +1,64 @@
 /*  Title:      Pure/System/isabelle_platform.scala
     Author:     Makarius
 
 General hardware and operating system type for Isabelle system tools.
 */
 
 package isabelle
 
 
 object Isabelle_Platform
 {
   val settings: List[String] =
     List(
       "ISABELLE_PLATFORM_FAMILY",
       "ISABELLE_PLATFORM64",
       "ISABELLE_WINDOWS_PLATFORM32",
       "ISABELLE_WINDOWS_PLATFORM64",
       "ISABELLE_APPLE_PLATFORM64")
 
   def apply(ssh: Option[SSH.Session] = None): Isabelle_Platform =
   {
     ssh match {
       case None =>
         new Isabelle_Platform(settings.map(a => (a, Isabelle_System.getenv(a))))
       case Some(ssh) =>
         val script =
           File.read(Path.explode("~~/lib/scripts/isabelle-platform")) + "\n" +
             settings.map(a => "echo \"" + Bash.string(a) + "=$" + Bash.string(a) + "\"").mkString("\n")
         val result = ssh.execute("bash -c " + Bash.string(script)).check
         new Isabelle_Platform(
           result.out_lines.map(line =>
-            space_explode('=', line) match {
-              case List(a, b) => (a, b)
-              case _ => error("Bad output: " + quote(result.out))
-            }))
+            Properties.Eq.unapply(line) getOrElse error("Bad output: " + quote(result.out))))
     }
   }
 
   lazy val self: Isabelle_Platform = apply()
 }
 
 class Isabelle_Platform private(val settings: List[(String, String)])
 {
   private def get(name: String): String =
     settings.collectFirst({ case (a, b) if a == name => b }).
       getOrElse(error("Bad platform settings variable: " + quote(name)))
 
   val ISABELLE_PLATFORM_FAMILY: String = get("ISABELLE_PLATFORM_FAMILY")
   val ISABELLE_PLATFORM64: String = get("ISABELLE_PLATFORM64")
   val ISABELLE_WINDOWS_PLATFORM64: String = get("ISABELLE_WINDOWS_PLATFORM64")
   val ISABELLE_APPLE_PLATFORM64: String = get("ISABELLE_APPLE_PLATFORM64")
 
   def is_arm: Boolean =
     ISABELLE_PLATFORM64.startsWith("arm64-") ||
     ISABELLE_APPLE_PLATFORM64.startsWith("arm64-")
 
   def is_linux: Boolean = ISABELLE_PLATFORM_FAMILY == "linux"
   def is_macos: Boolean = ISABELLE_PLATFORM_FAMILY == "macos"
   def is_windows: Boolean = ISABELLE_PLATFORM_FAMILY == "windows"
 
   def arch_64: String = if (is_arm) "arm64" else "x86_64"
   def arch_64_32: String = if (is_arm) "arm64_32" else "x86_64_32"
 
   def os_name: String = if (is_macos) "darwin" else ISABELLE_PLATFORM_FAMILY
 
   override def toString: String = ISABELLE_PLATFORM_FAMILY
 }
diff --git a/src/Pure/System/isabelle_system.scala b/src/Pure/System/isabelle_system.scala
--- a/src/Pure/System/isabelle_system.scala
+++ b/src/Pure/System/isabelle_system.scala
@@ -1,633 +1,633 @@
 /*  Title:      Pure/System/isabelle_system.scala
     Author:     Makarius
 
 Fundamental Isabelle system environment: quasi-static module with
 optional init operation.
 */
 
 package isabelle
 
 
 import java.io.{File => JFile, IOException}
 import java.nio.file.{Path => JPath, Files, SimpleFileVisitor, FileVisitResult,
   StandardCopyOption, FileSystemException}
 import java.nio.file.attribute.BasicFileAttributes
 
 import scala.jdk.CollectionConverters._
 
 
 object Isabelle_System
 {
   /** bootstrap information **/
 
   def jdk_home(): String =
   {
     val java_home = System.getProperty("java.home", "")
     val home = new JFile(java_home)
     val parent = home.getParent
     if (home.getName == "jre" && parent != null &&
         (new JFile(new JFile(parent, "bin"), "javac")).exists) parent
     else java_home
   }
 
   def bootstrap_directory(
     preference: String, envar: String, property: String, description: String): String =
   {
     val value =
       proper_string(preference) orElse  // explicit argument
       proper_string(System.getenv(envar)) orElse  // e.g. inherited from running isabelle tool
       proper_string(System.getProperty(property)) getOrElse  // e.g. via JVM application boot process
       error("Unknown " + description + " directory")
 
     if ((new JFile(value)).isDirectory) value
     else error("Bad " + description + " directory " + quote(value))
   }
 
 
 
   /** implicit settings environment **/
 
   abstract class Service
 
   @volatile private var _settings: Option[Map[String, String]] = None
   @volatile private var _services: Option[List[Class[Service]]] = None
 
   def settings(): Map[String, String] =
   {
     if (_settings.isEmpty) init()  // unsynchronized check
     _settings.get
   }
 
   def services(): List[Class[Service]] =
   {
     if (_services.isEmpty) init()  // unsynchronized check
     _services.get
   }
 
   def make_services[C](c: Class[C]): List[C] =
     for { c1 <- services() if Library.is_subclass(c1, c) }
       yield c1.getDeclaredConstructor().newInstance().asInstanceOf[C]
 
   def init(isabelle_root: String = "", cygwin_root: String = ""): Unit = synchronized
   {
     if (_settings.isEmpty || _services.isEmpty) {
       val isabelle_root1 =
         bootstrap_directory(isabelle_root, "ISABELLE_ROOT", "isabelle.root", "Isabelle root")
 
       val cygwin_root1 =
         if (Platform.is_windows)
           bootstrap_directory(cygwin_root, "CYGWIN_ROOT", "cygwin.root", "Cygwin root")
         else ""
 
       if (Platform.is_windows) Cygwin.init(isabelle_root1, cygwin_root1)
 
       def set_cygwin_root(): Unit =
       {
         if (Platform.is_windows)
           _settings = Some(_settings.getOrElse(Map.empty) + ("CYGWIN_ROOT" -> cygwin_root1))
       }
 
       set_cygwin_root()
 
       def default(env: Map[String, String], entry: (String, String)): Map[String, String] =
         if (env.isDefinedAt(entry._1) || entry._2 == "") env
         else env + entry
 
       val env =
       {
         val temp_windows =
         {
           val temp = if (Platform.is_windows) System.getenv("TEMP") else null
           if (temp != null && temp.contains('\\')) temp else ""
         }
         val user_home = System.getProperty("user.home", "")
         val isabelle_app = System.getProperty("isabelle.app", "")
 
         default(
           default(
             default(sys.env + ("ISABELLE_JDK_HOME" -> File.standard_path(jdk_home())),
               "TEMP_WINDOWS" -> temp_windows),
             "HOME" -> user_home),
           "ISABELLE_APP" -> "true")
       }
 
       val settings =
       {
         val dump = JFile.createTempFile("settings", null)
         dump.deleteOnExit
         try {
           val cmd1 =
             if (Platform.is_windows)
               List(cygwin_root1 + "\\bin\\bash", "-l",
                 File.standard_path(isabelle_root1 + "\\bin\\isabelle"))
             else
               List(isabelle_root1 + "/bin/isabelle")
           val cmd = cmd1 ::: List("getenv", "-d", dump.toString)
 
           val (output, rc) = process_output(process(cmd, env = env, redirect = true))
           if (rc != 0) error(output)
 
           val entries =
-            (for (entry <- space_explode('\u0000', File.read(dump)) if entry != "") yield {
-              val i = entry.indexOf('=')
-              if (i <= 0) entry -> ""
-              else entry.substring(0, i) -> entry.substring(i + 1)
-            }).toMap
+            space_explode('\u0000', File.read(dump)).flatMap(
+              {
+                case Properties.Eq(a, b) => Some(a -> b)
+                case s => if (s.isEmpty || s.startsWith("=")) None else Some(s -> "")
+              }).toMap
           entries + ("PATH" -> entries("PATH_JVM")) - "PATH_JVM"
         }
         finally { dump.delete }
       }
       _settings = Some(settings)
       set_cygwin_root()
 
       val variable = "ISABELLE_SCALA_SERVICES"
       val services =
         for (name <- space_explode(':', settings.getOrElse(variable, getenv_error(variable))))
         yield {
           def err(msg: String): Nothing =
             error("Bad entry " + quote(name) + " in " + variable + "\n" + msg)
           try { Class.forName(name).asInstanceOf[Class[Service]] }
           catch {
             case _: ClassNotFoundException => err("Class not found")
             case exn: Throwable => err(Exn.message(exn))
           }
         }
       _services = Some(services)
     }
   }
 
 
   /* getenv -- dynamic process environment */
 
   private def getenv_error(name: String): Nothing =
     error("Undefined Isabelle environment variable: " + quote(name))
 
   def getenv(name: String, env: Map[String, String] = settings()): String =
     env.getOrElse(name, "")
 
   def getenv_strict(name: String, env: Map[String, String] = settings()): String =
     proper_string(getenv(name, env)) getOrElse
       error("Undefined Isabelle environment variable: " + quote(name))
 
   def cygwin_root(): String = getenv_strict("CYGWIN_ROOT")
 
 
   /* getetc -- static distribution parameters */
 
   def getetc(name: String, root: Path = Path.ISABELLE_HOME): Option[String] =
   {
     val path = root + Path.basic("etc") + Path.basic(name)
     if (path.is_file) {
       Library.trim_split_lines(File.read(path)) match {
         case Nil => None
         case List(s) => Some(s)
         case _ => error("Single line expected in " + path.absolute)
       }
     }
     else None
   }
 
 
   /* Isabelle distribution identification */
 
   def isabelle_id(root: Path = Path.ISABELLE_HOME): String =
     getetc("ISABELLE_ID", root = root) orElse Mercurial.archive_id(root) getOrElse {
       if (Mercurial.is_repository(root)) Mercurial.repository(root).parent()
       else error("Failed to identify Isabelle distribution " + root)
     }
 
   object Isabelle_Id extends Scala.Fun_String("isabelle_id")
   {
     val here = Scala_Project.here
     def apply(arg: String): String = isabelle_id()
   }
 
   def isabelle_tags(root: Path = Path.ISABELLE_HOME): String =
     getetc("ISABELLE_TAGS", root = root) orElse Mercurial.archive_tags(root) getOrElse {
       if (Mercurial.is_repository(root)) {
         val hg = Mercurial.repository(root)
         hg.tags(rev = hg.parent())
       }
       else ""
     }
 
   def isabelle_identifier(): Option[String] = proper_string(getenv("ISABELLE_IDENTIFIER"))
 
   def isabelle_heading(): String =
     isabelle_identifier() match {
       case None => ""
       case Some(version) => " (" + version + ")"
     }
 
   def isabelle_name(): String = getenv_strict("ISABELLE_NAME")
 
   def identification(): String = "Isabelle/" + isabelle_id() + isabelle_heading()
 
 
   /** file-system operations **/
 
   /* scala functions */
 
   private def apply_paths(args: List[String], fun: List[Path] => Unit): List[String] =
     { fun(args.map(Path.explode)); Nil }
 
   private def apply_paths1(args: List[String], fun: Path => Unit): List[String] =
     apply_paths(args, { case List(path) => fun(path) })
 
   private def apply_paths2(args: List[String], fun: (Path, Path) => Unit): List[String] =
     apply_paths(args, { case List(path1, path2) => fun(path1, path2) })
 
   private def apply_paths3(args: List[String], fun: (Path, Path, Path) => Unit): List[String] =
     apply_paths(args, { case List(path1, path2, path3) => fun(path1, path2, path3) })
 
 
   /* permissions */
 
   def chmod(arg: String, path: Path): Unit =
     bash("chmod " + arg + " " + File.bash_path(path)).check
 
   def chown(arg: String, path: Path): Unit =
     bash("chown " + arg + " " + File.bash_path(path)).check
 
 
   /* directories */
 
   def make_directory(path: Path): Path =
   {
     if (!path.is_dir) {
       try { Files.createDirectories(path.file.toPath) }
       catch { case ERROR(_) => error("Failed to create directory: " + path.absolute) }
     }
     path
   }
 
   def new_directory(path: Path): Path =
     if (path.is_dir) error("Directory already exists: " + path.absolute)
     else make_directory(path)
 
   def copy_dir(dir1: Path, dir2: Path): Unit =
   {
     val res = bash("cp -a " + File.bash_path(dir1) + " " + File.bash_path(dir2))
     if (!res.ok) {
       cat_error("Failed to copy directory " + dir1.absolute + " to " + dir2.absolute, res.err)
     }
   }
 
 
   object Make_Directory extends Scala.Fun_Strings("make_directory")
   {
     val here = Scala_Project.here
     def apply(args: List[String]): List[String] = apply_paths1(args, make_directory)
   }
 
   object Copy_Dir extends Scala.Fun_Strings("copy_dir")
   {
     val here = Scala_Project.here
     def apply(args: List[String]): List[String] = apply_paths2(args, copy_dir)
   }
 
 
   /* copy files */
 
   def copy_file(src: JFile, dst: JFile): Unit =
   {
     val target = if (dst.isDirectory) new JFile(dst, src.getName) else dst
     if (!File.eq(src, target)) {
       try {
         Files.copy(src.toPath, target.toPath,
           StandardCopyOption.COPY_ATTRIBUTES,
           StandardCopyOption.REPLACE_EXISTING)
       }
       catch {
         case ERROR(msg) =>
           cat_error("Failed to copy file " +
             File.path(src).absolute + " to " + File.path(dst).absolute, msg)
       }
     }
   }
 
   def copy_file(src: Path, dst: Path): Unit = copy_file(src.file, dst.file)
 
   def copy_file_base(base_dir: Path, src: Path, target_dir: Path): Unit =
   {
     val src1 = src.expand
     val src1_dir = src1.dir
     if (!src1.starts_basic) error("Illegal path specification " + src1 + " beyond base directory")
     copy_file(base_dir + src1, Isabelle_System.make_directory(target_dir + src1_dir))
   }
 
 
   object Copy_File extends Scala.Fun_Strings("copy_file")
   {
     val here = Scala_Project.here
     def apply(args: List[String]): List[String] = apply_paths2(args, copy_file)
   }
 
   object Copy_File_Base extends Scala.Fun_Strings("copy_file_base")
   {
     val here = Scala_Project.here
     def apply(args: List[String]): List[String] = apply_paths3(args, copy_file_base)
   }
 
 
   /* move files */
 
   def move_file(src: JFile, dst: JFile): Unit =
   {
     val target = if (dst.isDirectory) new JFile(dst, src.getName) else dst
     if (!File.eq(src, target))
       Files.move(src.toPath, target.toPath, StandardCopyOption.REPLACE_EXISTING)
   }
 
   def move_file(src: Path, dst: Path): Unit = move_file(src.file, dst.file)
 
 
   /* symbolic link */
 
   def symlink(src: Path, dst: Path, force: Boolean = false): Unit =
   {
     val src_file = src.file
     val dst_file = dst.file
     val target = if (dst_file.isDirectory) new JFile(dst_file, src_file.getName) else dst_file
 
     if (force) target.delete
 
     try { Files.createSymbolicLink(target.toPath, src_file.toPath) }
     catch {
       case _: UnsupportedOperationException if Platform.is_windows =>
         Cygwin.link(File.standard_path(src), target)
       case _: FileSystemException if Platform.is_windows =>
         Cygwin.link(File.standard_path(src), target)
     }
   }
 
 
   /* tmp files */
 
   def isabelle_tmp_prefix(): JFile =
   {
     val path = Path.explode("$ISABELLE_TMP_PREFIX")
     path.file.mkdirs  // low-level mkdirs to avoid recursion via Isabelle environment
     File.platform_file(path)
   }
 
   def tmp_file(name: String, ext: String = "", base_dir: JFile = isabelle_tmp_prefix()): JFile =
   {
     val suffix = if (ext == "") "" else "." + ext
     val file = Files.createTempFile(base_dir.toPath, name, suffix).toFile
     file.deleteOnExit
     file
   }
 
   def with_tmp_file[A](name: String, ext: String = "")(body: Path => A): A =
   {
     val file = tmp_file(name, ext)
     try { body(File.path(file)) } finally { file.delete }
   }
 
 
   /* tmp dirs */
 
   def rm_tree(root: JFile): Unit =
   {
     root.delete
     if (root.isDirectory) {
       Files.walkFileTree(root.toPath,
         new SimpleFileVisitor[JPath] {
           override def visitFile(file: JPath, attrs: BasicFileAttributes): FileVisitResult =
           {
             try { Files.deleteIfExists(file) }
             catch { case _: IOException => }
             FileVisitResult.CONTINUE
           }
 
           override def postVisitDirectory(dir: JPath, e: IOException): FileVisitResult =
           {
             if (e == null) {
               try { Files.deleteIfExists(dir) }
               catch { case _: IOException => }
               FileVisitResult.CONTINUE
             }
             else throw e
           }
         }
       )
     }
   }
 
   def rm_tree(root: Path): Unit = rm_tree(root.file)
 
   object Rm_Tree extends Scala.Fun_Strings("rm_tree")
   {
     val here = Scala_Project.here
     def apply(args: List[String]): List[String] = apply_paths1(args, rm_tree)
   }
 
   def tmp_dir(name: String, base_dir: JFile = isabelle_tmp_prefix()): JFile =
   {
     val dir = Files.createTempDirectory(base_dir.toPath, name).toFile
     dir.deleteOnExit
     dir
   }
 
   def with_tmp_dir[A](name: String)(body: Path => A): A =
   {
     val dir = tmp_dir(name)
     try { body(File.path(dir)) } finally { rm_tree(dir) }
   }
 
 
   /* quasi-atomic update of directory */
 
   def update_directory(dir: Path, f: Path => Unit): Unit =
   {
     val new_dir = dir.ext("new")
     val old_dir = dir.ext("old")
 
     rm_tree(new_dir)
     rm_tree(old_dir)
 
     f(new_dir)
 
     if (dir.is_dir) move_file(dir, old_dir)
     move_file(new_dir, dir)
     rm_tree(old_dir)
   }
 
 
 
   /** external processes **/
 
   /* raw process */
 
   def process(command_line: List[String],
     cwd: JFile = null,
     env: Map[String, String] = settings(),
     redirect: Boolean = false): Process =
   {
     val proc = new ProcessBuilder
 
     // fragile on Windows:
     // see https://docs.microsoft.com/en-us/cpp/cpp/main-function-command-line-args?view=msvc-160
     proc.command(command_line.asJava)
 
     if (cwd != null) proc.directory(cwd)
     if (env != null) {
       proc.environment.clear()
       for ((x, y) <- env) proc.environment.put(x, y)
     }
     proc.redirectErrorStream(redirect)
     proc.start
   }
 
   def process_output(proc: Process): (String, Int) =
   {
     proc.getOutputStream.close()
 
     val output = File.read_stream(proc.getInputStream)
     val rc =
       try { proc.waitFor }
       finally {
         proc.getInputStream.close()
         proc.getErrorStream.close()
         proc.destroy()
         Exn.Interrupt.dispose()
       }
     (output, rc)
   }
 
   def process_signal(group_pid: String, signal: String = "0"): Boolean =
   {
     val bash =
       if (Platform.is_windows) List(cygwin_root() + "\\bin\\bash.exe")
       else List("/usr/bin/env", "bash")
     val (_, rc) = process_output(process(bash ::: List("-c", "kill -" + signal + " -" + group_pid)))
     rc == 0
   }
 
 
   /* GNU bash */
 
   def bash(script: String,
     cwd: JFile = null,
     env: Map[String, String] = settings(),
     redirect: Boolean = false,
     progress_stdout: String => Unit = (_: String) => (),
     progress_stderr: String => Unit = (_: String) => (),
     watchdog: Option[Bash.Watchdog] = None,
     strict: Boolean = true,
     cleanup: () => Unit = () => ()): Process_Result =
   {
     Bash.process(script, cwd = cwd, env = env, redirect = redirect, cleanup = cleanup).
       result(progress_stdout = progress_stdout, progress_stderr = progress_stderr,
         watchdog = watchdog, strict = strict)
   }
 
   private lazy val gnutar_check: Boolean =
     try { bash("tar --version").check.out.containsSlice("GNU tar") || error("") }
     catch { case ERROR(_) => false }
 
   def gnutar(
     args: String,
     dir: Path = Path.current,
     original_owner: Boolean = false,
     strip: Int = 0,
     redirect: Boolean = false): Process_Result =
   {
     val options =
       (if (dir.is_current) "" else "-C " + File.bash_path(dir) + " ") +
       (if (original_owner) "" else "--owner=root --group=staff ") +
       (if (strip <= 0) "" else "--strip-components=" + strip + " ")
 
     if (gnutar_check) bash("tar " + options + args, redirect = redirect)
     else error("Expected to find GNU tar executable")
   }
 
   def require_command(cmd: String, test: String = "--version"): Unit =
   {
     if (!bash(Bash.string(cmd) + " " + test).ok) error("Missing system command: " + quote(cmd))
   }
 
   def hostname(): String = bash("hostname -s").check.out
 
   def open(arg: String): Unit =
     bash("exec \"$ISABELLE_OPEN\" " + Bash.string(arg) + " >/dev/null 2>/dev/null &")
 
   def pdf_viewer(arg: Path): Unit =
     bash("exec \"$PDF_VIEWER\" " + File.bash_path(arg) + " >/dev/null 2>/dev/null &")
 
   def open_external_file(name: String): Boolean =
   {
     val ext = Library.take_suffix((c: Char) => c != '.', name.toList)._2.mkString
     val external =
       ext.nonEmpty &&
       Library.space_explode(':', getenv("ISABELLE_EXTERNAL_FILES")).contains(ext)
     if (external) {
       if (ext == "pdf" && Path.is_wellformed(name)) pdf_viewer(Path.explode(name))
       else open(name)
     }
     external
   }
 
   def export_isabelle_identifier(isabelle_identifier: String): String =
     if (isabelle_identifier == "") ""
     else "export ISABELLE_IDENTIFIER=" + Bash.string(isabelle_identifier) + "\n"
 
 
   /** Isabelle resources **/
 
   /* repository clone with Admin */
 
   def admin(): Boolean = Path.explode("~~/Admin").is_dir
 
 
   /* components */
 
   def components(): List[Path] =
     Path.split(getenv_strict("ISABELLE_COMPONENTS"))
 
 
   /* default logic */
 
   def default_logic(args: String*): String =
   {
     args.find(_ != "") match {
       case Some(logic) => logic
       case None => getenv_strict("ISABELLE_LOGIC")
     }
   }
 
 
   /* download file */
 
   def download(url_name: String, progress: Progress = new Progress): HTTP.Content =
   {
     val url = Url(url_name)
     progress.echo("Getting " + quote(url_name))
     try { HTTP.Client.get(url) }
     catch { case ERROR(msg) => cat_error("Failed to download " + quote(url_name), msg) }
   }
 
   def download_file(url_name: String, file: Path, progress: Progress = new Progress): Unit =
     Bytes.write(file, download(url_name, progress = progress).bytes)
 
   object Download extends Scala.Fun("download", thread = true)
   {
     val here = Scala_Project.here
     override def invoke(args: List[Bytes]): List[Bytes] =
       args match { case List(url) => List(download(url.text).bytes) }
   }
 
 
   /* repositories */
 
   val isabelle_repository: Mercurial.Server =
     Mercurial.Server("https://isabelle.sketis.net/repos/isabelle")
 
   val afp_repository: Mercurial.Server =
     Mercurial.Server("https://isabelle.sketis.net/repos/afp-devel")
 
   def official_releases(): List[String] =
     Library.trim_split_lines(
       isabelle_repository.read_file(Path.explode("Admin/Release/official")))
 }
diff --git a/src/Pure/System/isabelle_tool.ML b/src/Pure/System/isabelle_tool.ML
--- a/src/Pure/System/isabelle_tool.ML
+++ b/src/Pure/System/isabelle_tool.ML
@@ -1,44 +1,44 @@
 (*  Title:      Pure/System/isabelle_tool.ML
     Author:     Makarius
 
 Support for Isabelle system tools.
 *)
 
 signature ISABELLE_TOOL =
 sig
   val isabelle_tools: unit -> (string * Position.T) list
   val check: Proof.context -> string * Position.T -> string
 end;
 
 structure Isabelle_Tool: ISABELLE_TOOL =
 struct
 
 (* list tools *)
 
 fun symbolic_file (a, b) =
   if a = Markup.fileN
   then (a, Path.explode b |> Path.implode_symbolic)
   else (a, b);
 
 fun isabelle_tools () =
   \<^scala>\<open>isabelle_tools\<close> ""
   |> YXML.parse_body
   |> let open XML.Decode in list (pair string properties) end
   |> map (apsnd (map symbolic_file #> Position.of_properties));
 
 
 (* check *)
 
 fun check ctxt arg =
   Completion.check_item Markup.toolN
     (fn (name, pos) =>
       Markup.entity Markup.toolN name
       |> Markup.properties (Position.def_properties_of pos))
     (isabelle_tools ()) ctxt arg;
 
 val _ =
   Theory.setup
-   (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>tool\<close>
+   (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>tool\<close>
       (Scan.lift Parse.embedded_position) check);
 
 end;
diff --git a/src/Pure/System/isabelle_tool.scala b/src/Pure/System/isabelle_tool.scala
--- a/src/Pure/System/isabelle_tool.scala
+++ b/src/Pure/System/isabelle_tool.scala
@@ -1,235 +1,235 @@
 /*  Title:      Pure/System/isabelle_tool.scala
     Author:     Makarius
     Author:     Lars Hupel
 
 Isabelle system tools: external executables or internal Scala functions.
 */
 
 package isabelle
 
 import java.net.URLClassLoader
 import scala.reflect.runtime.universe
 import scala.tools.reflect.{ToolBox, ToolBoxError}
 
 
 object Isabelle_Tool
 {
   /* Scala source tools */
 
   abstract class Body extends Function[List[String], Unit]
 
   private def compile(path: Path): Body =
   {
     def err(msg: String): Nothing =
       cat_error(msg, "The error(s) above occurred in Isabelle/Scala tool " + path)
 
     val source = File.read(path)
 
     val class_loader = new URLClassLoader(Array(), getClass.getClassLoader)
     val tool_box = universe.runtimeMirror(class_loader).mkToolBox()
 
     try {
       val tree = tool_box.parse(source)
       val module =
         try { tree.asInstanceOf[universe.ModuleDef] }
         catch {
           case _: java.lang.ClassCastException =>
             err("Source does not describe a module (Scala object)")
         }
       tool_box.compile(universe.Ident(tool_box.define(module)))() match {
         case body: Body => body
         case _ => err("Ill-typed source: Isabelle_Tool.Body expected")
       }
     }
     catch {
       case e: ToolBoxError =>
         if (tool_box.frontEnd.hasErrors) {
           val infos = tool_box.frontEnd.infos.toList
           val msgs = infos.map(info => "Error in line " + info.pos.line + ":\n" + info.msg)
           err(msgs.mkString("\n"))
         }
         else
           err(e.toString)
     }
   }
 
 
   /* external tools */
 
   private def dirs(): List[Path] = Path.split(Isabelle_System.getenv_strict("ISABELLE_TOOLS"))
 
   private def is_external(dir: Path, file_name: String): Boolean =
   {
     val file = (dir + Path.explode(file_name)).file
     try {
       file.isFile && file.canRead &&
         (file_name.endsWith(".scala") || file.canExecute) &&
         !file_name.endsWith("~") && !file_name.endsWith(".orig")
     }
     catch { case _: SecurityException => false }
   }
 
   private def find_external(name: String): Option[List[String] => Unit] =
     dirs().collectFirst({
       case dir if is_external(dir, name + ".scala") =>
         compile(dir + Path.explode(name + ".scala"))
       case dir if is_external(dir, name) =>
         (args: List[String]) =>
           {
             val tool = dir + Path.explode(name)
             val result = Isabelle_System.bash(File.bash_path(tool) + " " + Bash.strings(args))
             sys.exit(result.print_stdout.rc)
           }
     })
 
 
   /* internal tools */
 
   private lazy val internal_tools: List[Isabelle_Tool] =
     Isabelle_System.make_services(classOf[Isabelle_Scala_Tools]).flatMap(_.tools)
 
   private def find_internal(name: String): Option[List[String] => Unit] =
     internal_tools.collectFirst({
       case tool if tool.name == name =>
         args => Command_Line.tool { tool.body(args) }
       })
 
 
   /* list tools */
 
   abstract class Entry
   {
     def name: String
     def position: Properties.T
     def description: String
     def print: String =
       description match {
         case "" => name
         case descr => name + " - " + descr
       }
   }
 
   sealed case class External(name: String, path: Path) extends Entry
   {
     def position: Properties.T = Position.File(path.absolute.implode)
     def description: String =
     {
       val Pattern = """.*\bDESCRIPTION: *(.*)""".r
       split_lines(File.read(path)).collectFirst({ case Pattern(s) => s }) getOrElse ""
     }
   }
 
   def external_tools(): List[External] =
   {
     for {
       dir <- dirs() if dir.is_dir
       file_name <- File.read_dir(dir) if is_external(dir, file_name)
     } yield {
       val path = dir + Path.explode(file_name)
       val name = Library.perhaps_unsuffix(".scala", file_name)
       External(name, path)
     }
   }
 
   def isabelle_tools(): List[Entry] =
     (external_tools() ::: internal_tools).sortBy(_.name)
 
   object Isabelle_Tools extends Scala.Fun_String("isabelle_tools")
   {
     val here = Scala_Project.here
     def apply(arg: String): String =
       if (arg.nonEmpty) error("Bad argument: " + quote(arg))
       else {
         val result = isabelle_tools().map(entry => (entry.name, entry.position))
         val body = { import XML.Encode._; list(pair(string, properties))(result) }
         YXML.string_of_body(body)
       }
   }
 
 
   /* command line entry point */
 
   def main(args: Array[String]): Unit =
   {
     Command_Line.tool {
       args.toList match {
         case Nil | List("-?") =>
           val tool_descriptions = isabelle_tools().map(_.print)
           Getopts("""
 Usage: isabelle TOOL [ARGS ...]
 
   Start Isabelle TOOL with ARGS; pass "-?" for tool-specific help.
 
 Available tools:""" + tool_descriptions.mkString("\n  ", "\n  ", "\n")).usage()
         case tool_name :: tool_args =>
           find_external(tool_name) orElse find_internal(tool_name) match {
             case Some(tool) => tool(tool_args)
             case None => error("Unknown Isabelle tool: " + quote(tool_name))
           }
       }
     }
   }
 }
 
 sealed case class Isabelle_Tool(
   name: String,
   description: String,
   here: Scala_Project.Here,
   body: List[String] => Unit) extends Isabelle_Tool.Entry
 {
   def position: Position.T = here.position
 }
 
 class Isabelle_Scala_Tools(val tools: Isabelle_Tool*) extends Isabelle_System.Service
 
 class Tools extends Isabelle_Scala_Tools(
   Build.isabelle_tool,
   Build_Docker.isabelle_tool,
   Build_Job.isabelle_tool,
   Doc.isabelle_tool,
+  Document_Build.isabelle_tool,
   Dump.isabelle_tool,
   Export.isabelle_tool,
   ML_Process.isabelle_tool,
   Mercurial.isabelle_tool,
   Mkroot.isabelle_tool,
   Logo.isabelle_tool,
   Options.isabelle_tool,
   Phabricator.isabelle_tool1,
   Phabricator.isabelle_tool2,
   Phabricator.isabelle_tool3,
   Phabricator.isabelle_tool4,
-  Presentation.isabelle_tool,
   Profiling_Report.isabelle_tool,
   Server.isabelle_tool,
   Sessions.isabelle_tool,
   Scala_Project.isabelle_tool,
   Update.isabelle_tool,
   Update_Cartouches.isabelle_tool,
   Update_Comments.isabelle_tool,
   Update_Header.isabelle_tool,
   Update_Then.isabelle_tool,
   Update_Theorems.isabelle_tool,
   isabelle.mirabelle.Mirabelle.isabelle_tool,
   isabelle.vscode.TextMate_Grammar.isabelle_tool,
   isabelle.vscode.Language_Server.isabelle_tool)
 
 class Admin_Tools extends Isabelle_Scala_Tools(
   Build_CSDP.isabelle_tool,
   Build_Cygwin.isabelle_tool,
   Build_Doc.isabelle_tool,
   Build_E.isabelle_tool,
   Build_Fonts.isabelle_tool,
   Build_JCEF.isabelle_tool,
   Build_JDK.isabelle_tool,
   Build_JEdit.isabelle_tool,
   Build_PolyML.isabelle_tool1,
   Build_PolyML.isabelle_tool2,
   Build_SPASS.isabelle_tool,
   Build_SQLite.isabelle_tool,
   Build_Status.isabelle_tool,
   Build_Vampire.isabelle_tool,
   Build_VeriT.isabelle_tool,
   Build_Zipperposition.isabelle_tool,
   Check_Sources.isabelle_tool,
   Components.isabelle_tool,
   isabelle.vscode.Build_VSCode.isabelle_tool)
diff --git a/src/Pure/System/options.scala b/src/Pure/System/options.scala
--- a/src/Pure/System/options.scala
+++ b/src/Pure/System/options.scala
@@ -1,454 +1,452 @@
 /*  Title:      Pure/System/options.scala
     Author:     Makarius
 
 System options with external string representation.
 */
 
 package isabelle
 
 
 object Options
 {
   type Spec = (String, Option[String])
 
   val empty: Options = new Options()
 
 
   /* representation */
 
   sealed abstract class Type
   {
     def print: String = Word.lowercase(toString)
   }
   case object Bool extends Type
   case object Int extends Type
   case object Real extends Type
   case object String extends Type
   case object Unknown extends Type
 
   case class Opt(
     public: Boolean,
     pos: Position.T,
     name: String,
     typ: Type,
     value: String,
     default_value: String,
     description: String,
     section: String)
   {
     private def print(default: Boolean): String =
     {
       val x = if (default) default_value else value
       "option " + name + " : " + typ.print + " = " +
         (if (typ == Options.String) quote(x) else x) +
         (if (description == "") "" else "\n  -- " + quote(description))
     }
 
     def print: String = print(false)
     def print_default: String = print(true)
 
     def title(strip: String = ""): String =
     {
       val words = Word.explode('_', name)
       val words1 =
         words match {
           case word :: rest if word == strip => rest
           case _ => words
         }
       Word.implode(words1.map(Word.perhaps_capitalize))
     }
 
     def unknown: Boolean = typ == Unknown
   }
 
 
   /* parsing */
 
   private val SECTION = "section"
   private val PUBLIC = "public"
   private val OPTION = "option"
   private val OPTIONS = Path.explode("etc/options")
   private val PREFS = Path.explode("$ISABELLE_HOME_USER/etc/preferences")
 
   val options_syntax: Outer_Syntax =
     Outer_Syntax.empty + ":" + "=" + "--" + Symbol.comment + Symbol.comment_decoded +
       (SECTION, Keyword.DOCUMENT_HEADING) +
       (PUBLIC, Keyword.BEFORE_COMMAND) +
       (OPTION, Keyword.THY_DECL)
 
   val prefs_syntax: Outer_Syntax = Outer_Syntax.empty + "="
 
   trait Parser extends Parse.Parser
   {
     val option_name: Parser[String] = atom("option name", _.is_name)
     val option_type: Parser[String] = atom("option type", _.is_name)
     val option_value: Parser[String] =
       opt(token("-", tok => tok.is_sym_ident && tok.content == "-")) ~ atom("nat", _.is_nat) ^^
         { case s ~ n => if (s.isDefined) "-" + n else n } |
       atom("option value", tok => tok.is_name || tok.is_float)
   }
 
   private object Parser extends Parser
   {
     def comment_marker: Parser[String] =
       $$$("--") | $$$(Symbol.comment) | $$$(Symbol.comment_decoded)
 
     val option_entry: Parser[Options => Options] =
     {
       command(SECTION) ~! text ^^
         { case _ ~ a => (options: Options) => options.set_section(a) } |
       opt($$$(PUBLIC)) ~ command(OPTION) ~! (position(option_name) ~ $$$(":") ~ option_type ~
       $$$("=") ~ option_value ~ (comment_marker ~! text ^^ { case _ ~ x => x } | success(""))) ^^
         { case a ~ _ ~ ((b, pos) ~ _ ~ c ~ _ ~ d ~ e) =>
             (options: Options) => options.declare(a.isDefined, pos, b, c, d, e) }
     }
 
     val prefs_entry: Parser[Options => Options] =
     {
       option_name ~ ($$$("=") ~! option_value) ^^
       { case a ~ (_ ~ b) => (options: Options) => options.add_permissive(a, b) }
     }
 
     def parse_file(options: Options, file_name: String, content: String,
       syntax: Outer_Syntax = options_syntax,
       parser: Parser[Options => Options] = option_entry): Options =
     {
       val toks = Token.explode(syntax.keywords, content)
       val ops =
         parse_all(rep(parser), Token.reader(toks, Token.Pos.file(file_name))) match {
           case Success(result, _) => result
           case bad => error(bad.toString)
         }
       try { ops.foldLeft(options.set_section("")) { case (opts, op) => op(opts) } }
       catch { case ERROR(msg) => error(msg + Position.here(Position.File(file_name))) }
     }
 
     def parse_prefs(options: Options, content: String): Options =
       parse_file(options, PREFS.file_name, content, syntax = prefs_syntax, parser = prefs_entry)
   }
 
   def read_prefs(file: Path = PREFS): String =
     if (file.is_file) File.read(file) else ""
 
   def init(prefs: String = read_prefs(PREFS), opts: List[String] = Nil): Options =
   {
     var options = empty
     for {
       dir <- Isabelle_System.components()
       file = dir + OPTIONS if file.is_file
     } { options = Parser.parse_file(options, file.implode, File.read(file)) }
     opts.foldLeft(Options.Parser.parse_prefs(options, prefs))(_ + _)
   }
 
 
   /* encode */
 
   val encode: XML.Encode.T[Options] = (options => options.encode)
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool = Isabelle_Tool("options", "print Isabelle system options",
     Scala_Project.here, args =>
   {
     var build_options = false
     var get_option = ""
     var list_options = false
     var export_file = ""
 
     val getopts = Getopts("""
 Usage: isabelle options [OPTIONS] [MORE_OPTIONS ...]
 
   Options are:
     -b           include $ISABELLE_BUILD_OPTIONS
     -g OPTION    get value of OPTION
     -l           list options
     -x FILE      export options to FILE in YXML format
 
   Report Isabelle system options, augmented by MORE_OPTIONS given as
   arguments NAME=VAL or NAME.
 """,
       "b" -> (_ => build_options = true),
       "g:" -> (arg => get_option = arg),
       "l" -> (_ => list_options = true),
       "x:" -> (arg => export_file = arg))
 
     val more_options = getopts(args)
     if (get_option == "" && !list_options && export_file == "") getopts.usage()
 
     val options =
     {
       val options0 = Options.init()
       val options1 =
         if (build_options)
           Word.explode(Isabelle_System.getenv("ISABELLE_BUILD_OPTIONS")).foldLeft(options0)(_ + _)
         else options0
       more_options.foldLeft(options1)(_ + _)
     }
 
     if (get_option != "")
       Output.writeln(options.check_name(get_option).value, stdout = true)
 
     if (export_file != "")
       File.write(Path.explode(export_file), YXML.string_of_body(options.encode))
 
     if (get_option == "" && export_file == "")
       Output.writeln(options.print, stdout = true)
   })
 }
 
 
 final class Options private(
   val options: Map[String, Options.Opt] = Map.empty,
   val section: String = "")
 {
   override def toString: String = options.iterator.mkString("Options(", ",", ")")
 
   private def print_opt(opt: Options.Opt): String =
     if (opt.public) "public " + opt.print else opt.print
 
   def print: String = cat_lines(options.toList.sortBy(_._1).map(p => print_opt(p._2)))
 
   def description(name: String): String = check_name(name).description
 
 
   /* check */
 
   def check_name(name: String): Options.Opt =
     options.get(name) match {
       case Some(opt) if !opt.unknown => opt
       case _ => error("Unknown option " + quote(name))
     }
 
   private def check_type(name: String, typ: Options.Type): Options.Opt =
   {
     val opt = check_name(name)
     if (opt.typ == typ) opt
     else error("Ill-typed option " + quote(name) + " : " + opt.typ.print + " vs. " + typ.print)
   }
 
 
   /* basic operations */
 
   private def put[A](name: String, typ: Options.Type, value: String): Options =
   {
     val opt = check_type(name, typ)
     new Options(options + (name -> opt.copy(value = value)), section)
   }
 
   private def get[A](name: String, typ: Options.Type, parse: String => Option[A]): A =
   {
     val opt = check_type(name, typ)
     parse(opt.value) match {
       case Some(x) => x
       case None =>
         error("Malformed value for option " + quote(name) +
           " : " + typ.print + " =\n" + quote(opt.value))
     }
   }
 
 
   /* internal lookup and update */
 
   class Bool_Access
   {
     def apply(name: String): Boolean = get(name, Options.Bool, Value.Boolean.unapply)
     def update(name: String, x: Boolean): Options =
       put(name, Options.Bool, Value.Boolean(x))
   }
   val bool = new Bool_Access
 
   class Int_Access
   {
     def apply(name: String): Int = get(name, Options.Int, Value.Int.unapply)
     def update(name: String, x: Int): Options =
       put(name, Options.Int, Value.Int(x))
   }
   val int = new Int_Access
 
   class Real_Access
   {
     def apply(name: String): Double = get(name, Options.Real, Value.Double.unapply)
     def update(name: String, x: Double): Options =
       put(name, Options.Real, Value.Double(x))
   }
   val real = new Real_Access
 
   class String_Access
   {
     def apply(name: String): String = get(name, Options.String, s => Some(s))
     def update(name: String, x: String): Options = put(name, Options.String, x)
   }
   val string = new String_Access
 
   def proper_string(name: String): Option[String] =
     Library.proper_string(string(name))
 
   def seconds(name: String): Time = Time.seconds(real(name))
 
 
   /* external updates */
 
   private def check_value(name: String): Options =
   {
     val opt = check_name(name)
     opt.typ match {
       case Options.Bool => bool(name); this
       case Options.Int => int(name); this
       case Options.Real => real(name); this
       case Options.String => string(name); this
       case Options.Unknown => this
     }
   }
 
   def declare(
     public: Boolean,
     pos: Position.T,
     name: String,
     typ_name: String,
     value: String,
     description: String): Options =
   {
     options.get(name) match {
       case Some(other) =>
         error("Duplicate declaration of option " + quote(name) + Position.here(pos) +
           Position.here(other.pos))
       case None =>
         val typ =
           typ_name match {
             case "bool" => Options.Bool
             case "int" => Options.Int
             case "real" => Options.Real
             case "string" => Options.String
             case _ =>
               error("Unknown type for option " + quote(name) + " : " + quote(typ_name) +
                 Position.here(pos))
           }
         val opt = Options.Opt(public, pos, name, typ, value, value, description, section)
         (new Options(options + (name -> opt), section)).check_value(name)
     }
   }
 
   def add_permissive(name: String, value: String): Options =
   {
     if (options.isDefinedAt(name)) this + (name, value)
     else {
       val opt = Options.Opt(false, Position.none, name, Options.Unknown, value, value, "", "")
       new Options(options + (name -> opt), section)
     }
   }
 
   def + (name: String, value: String): Options =
   {
     val opt = check_name(name)
     (new Options(options + (name -> opt.copy(value = value)), section)).check_value(name)
   }
 
   def + (name: String, opt_value: Option[String]): Options =
   {
     val opt = check_name(name)
     opt_value match {
       case Some(value) => this + (name, value)
       case None if opt.typ == Options.Bool => this + (name, "true")
       case None => error("Missing value for option " + quote(name) + " : " + opt.typ.print)
     }
   }
 
   def + (str: String): Options =
-  {
-    str.indexOf('=') match {
-      case -1 => this + (str, None)
-      case i => this + (str.substring(0, i), str.substring(i + 1))
+    str match {
+      case Properties.Eq(a, b) => this + (a, b)
+      case _ => this + (str, None)
     }
-  }
 
   def ++ (specs: List[Options.Spec]): Options =
     specs.foldLeft(this) { case (x, (y, z)) => x + (y, z) }
 
 
   /* sections */
 
   def set_section(new_section: String): Options =
     new Options(options, new_section)
 
   def sections: List[(String, List[Options.Opt])] =
     options.groupBy(_._2.section).toList.map({ case (a, opts) => (a, opts.toList.map(_._2)) })
 
 
   /* encode */
 
   def encode: XML.Body =
   {
     val opts =
       for ((_, opt) <- options.toList; if !opt.unknown)
         yield (opt.pos, (opt.name, (opt.typ.print, opt.value)))
 
     import XML.Encode.{string => string_, _}
     list(pair(properties, pair(string_, pair(string_, string_))))(opts)
   }
 
 
   /* save preferences */
 
   def save_prefs(file: Path = Options.PREFS): Unit =
   {
     val defaults: Options = Options.init(prefs = "")
     val changed =
       (for {
         (name, opt2) <- options.iterator
         opt1 = defaults.options.get(name)
         if opt1.isEmpty || opt1.get.value != opt2.value
       } yield (name, opt2.value, if (opt1.isEmpty) "  (* unknown *)" else "")).toList
 
     val prefs =
       changed.sortBy(_._1)
         .map({ case (x, y, z) => x + " = " + Outer_Syntax.quote_string(y) + z + "\n" }).mkString
 
     Isabelle_System.make_directory(file.dir)
     File.write_backup(file, "(* generated by Isabelle " + Date.now() + " *)\n\n" + prefs)
   }
 }
 
 
 class Options_Variable(init_options: Options)
 {
   private var options = init_options
 
   def value: Options = synchronized { options }
 
   private def upd(f: Options => Options): Unit = synchronized { options = f(options) }
   def += (name: String, x: String): Unit = upd(opts => opts + (name, x))
 
   class Bool_Access
   {
     def apply(name: String): Boolean = value.bool(name)
     def update(name: String, x: Boolean): Unit = upd(opts => opts.bool.update(name, x))
   }
   val bool = new Bool_Access
 
   class Int_Access
   {
     def apply(name: String): Int = value.int(name)
     def update(name: String, x: Int): Unit = upd(opts => opts.int.update(name, x))
   }
   val int = new Int_Access
 
   class Real_Access
   {
     def apply(name: String): Double = value.real(name)
     def update(name: String, x: Double): Unit = upd(opts => opts.real.update(name, x))
   }
   val real = new Real_Access
 
   class String_Access
   {
     def apply(name: String): String = value.string(name)
     def update(name: String, x: String): Unit = upd(opts => opts.string.update(name, x))
   }
   val string = new String_Access
 
   def proper_string(name: String): Option[String] =
     Library.proper_string(string(name))
 
   def seconds(name: String): Time = value.seconds(name)
 }
diff --git a/src/Pure/System/scala_compiler.ML b/src/Pure/System/scala_compiler.ML
--- a/src/Pure/System/scala_compiler.ML
+++ b/src/Pure/System/scala_compiler.ML
@@ -1,99 +1,99 @@
 (*  Title:      Pure/System/scala_compiler.ML
     Author:     Makarius
 
 Scala compiler operations.
 *)
 
 signature SCALA_COMPILER =
 sig
   val toplevel: bool -> string -> unit
   val static_check: string * Position.T -> unit
 end;
 
 structure Scala_Compiler: SCALA_COMPILER =
 struct
 
 (* check declaration *)
 
 fun toplevel interpret source =
   let val errors =
     (interpret, source)
     |> let open XML.Encode in pair bool string end
     |> YXML.string_of_body
     |> \<^scala>\<open>scala_toplevel\<close>
     |> YXML.parse_body
     |> let open XML.Decode in list string end
   in if null errors then () else error (cat_lines errors) end;
 
 fun static_check (source, pos) =
   toplevel false ("package test\nclass __Dummy__ { __dummy__ => " ^ source ^ " }")
     handle ERROR msg => error (msg ^ Position.here pos);
 
 
 (* antiquotations *)
 
 local
 
 fun make_list bg en = space_implode "," #> enclose bg en;
 
 fun print_args [] = ""
   | print_args xs = make_list "(" ")" xs;
 
 fun print_types [] = ""
   | print_types Ts = make_list "[" "]" Ts;
 
 fun print_class (c, Ts) = c ^ print_types Ts;
 
 val types =
   Scan.optional (Parse.$$$ "[" |-- Parse.list1 Parse.name --| Parse.$$$ "]") [];
 
 val class =
   Scan.option
     (Parse.$$$ "(" |-- Parse.!!! (Parse.$$$ "in" |-- Parse.name -- types  --| Parse.$$$ ")"));
 
 val arguments =
   (Parse.nat >> (fn n => replicate n "_") ||
     Parse.list (Parse.underscore || Parse.name >> (fn T => "_ : " ^ T))) >> print_args;
 
 val args = Scan.optional (Parse.$$$ "(" |-- arguments --| Parse.$$$ ")") " _";
 
 fun scala_name name =
   let val latex = Latex.string (Latex.output_ascii_breakable "." name)
   in Latex.enclose_block "\\isatt{" "}" [latex] end;
 
 in
 
 val _ =
   Theory.setup
-    (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>scala\<close>
+    (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>scala\<close>
       (Scan.lift Args.embedded_position)
       (fn _ => fn (s, pos) => (static_check (s, pos); s)) #>
 
-    Thy_Output.antiquotation_raw_embedded \<^binding>\<open>scala_type\<close>
+    Document_Output.antiquotation_raw_embedded \<^binding>\<open>scala_type\<close>
       (Scan.lift (Args.embedded_position -- (types >> print_types)))
       (fn _ => fn ((t, pos), type_args) =>
         (static_check ("type _Test_" ^ type_args ^ " = " ^ t ^ type_args, pos);
           scala_name (t ^ type_args))) #>
 
-    Thy_Output.antiquotation_raw_embedded \<^binding>\<open>scala_object\<close>
+    Document_Output.antiquotation_raw_embedded \<^binding>\<open>scala_object\<close>
       (Scan.lift Args.embedded_position)
       (fn _ => fn (x, pos) => (static_check ("val _test_ = " ^ x, pos); scala_name x)) #>
 
-    Thy_Output.antiquotation_raw_embedded \<^binding>\<open>scala_method\<close>
+    Document_Output.antiquotation_raw_embedded \<^binding>\<open>scala_method\<close>
       (Scan.lift (class -- Args.embedded_position -- types -- args))
       (fn _ => fn (((class_context, (method, pos)), method_types), method_args) =>
         let
           val class_types = (case class_context of SOME (_, Ts) => Ts | NONE => []);
           val def = "def _test_" ^ print_types (merge (op =) (method_types, class_types));
           val def_context =
             (case class_context of
               NONE => def ^ " = "
             | SOME c => def ^ "(_this_ : " ^ print_class c ^ ") = _this_.");
           val source = def_context ^ method ^ method_args;
           val _ = static_check (source, pos);
           val text = (case class_context of NONE => method | SOME c => print_class c ^ "." ^ method);
         in scala_name text end));
 
 end;
 
 end;
diff --git a/src/Pure/Thy/bibtex.ML b/src/Pure/Thy/bibtex.ML
--- a/src/Pure/Thy/bibtex.ML
+++ b/src/Pure/Thy/bibtex.ML
@@ -1,66 +1,66 @@
 (*  Title:      Pure/Thy/bibtex.ML
     Author:     Makarius
 
 BibTeX support.
 *)
 
 signature BIBTEX =
 sig
   val check_database:
     Position.T -> string -> (string * Position.T) list * (string * Position.T) list
   val check_database_output: Position.T -> string -> unit
   val cite_macro: string Config.T
 end;
 
 structure Bibtex: BIBTEX =
 struct
 
 (* check database *)
 
 type message = string * Position.T;
 
 fun check_database pos0 database =
   \<^scala>\<open>bibtex_check_database\<close> database
   |> YXML.parse_body
   |> let open XML.Decode in pair (list (pair string properties)) (list (pair string properties)) end
   |> (apply2 o map o apsnd) (fn pos => Position.of_properties (pos @ Position.get_props pos0));
 
 fun check_database_output pos0 database =
   let val (errors, warnings) = check_database pos0 database in
     errors |> List.app (fn (msg, pos) =>
       Output.error_message ("Bibtex error" ^ Position.here pos ^ ":\n  " ^ msg));
     warnings |> List.app (fn (msg, pos) =>
       warning ("Bibtex warning" ^ Position.here pos ^ ":\n  " ^ msg))
   end;
 
 
 (* document antiquotations *)
 
 val cite_macro = Attrib.setup_config_string \<^binding>\<open>cite_macro\<close> (K "cite");
 
 val _ =
   Theory.setup
    (Document_Antiquotation.setup_option \<^binding>\<open>cite_macro\<close> (Config.put cite_macro) #>
-    Thy_Output.antiquotation_raw \<^binding>\<open>cite\<close>
+    Document_Output.antiquotation_raw \<^binding>\<open>cite\<close>
       (Scan.lift
         (Scan.option (Parse.verbatim || Parse.cartouche) -- Parse.and_list1 Args.name_position))
       (fn ctxt => fn (opt, citations) =>
         let
           val _ =
             Context_Position.reports ctxt
               (map (fn (name, pos) => (pos, Markup.citation name)) citations);
 
           val thy_name = Context.theory_long_name (Proof_Context.theory_of ctxt);
           val bibtex_entries = Resources.theory_bibtex_entries thy_name;
           val _ =
             if null bibtex_entries andalso thy_name <> Context.PureN then ()
             else
               citations |> List.app (fn (name, pos) =>
                 if member (op =) bibtex_entries name then ()
                 else error ("Unknown Bibtex entry " ^ quote name ^ Position.here pos));
 
           val opt_arg = (case opt of NONE => "" | SOME s => "[" ^ s ^ "]");
           val arg = "{" ^ space_implode "," (map #1 citations) ^ "}";
         in Latex.string ("\\" ^ Config.get ctxt cite_macro ^ opt_arg ^ arg) end));
 
 end;
diff --git a/src/Pure/Thy/bibtex.scala b/src/Pure/Thy/bibtex.scala
--- a/src/Pure/Thy/bibtex.scala
+++ b/src/Pure/Thy/bibtex.scala
@@ -1,704 +1,706 @@
 /*  Title:      Pure/Thy/bibtex.scala
     Author:     Makarius
 
 BibTeX support.
 */
 
 package isabelle
 
 
 import java.io.{File => JFile}
 
 import scala.collection.mutable
 import scala.util.parsing.combinator.RegexParsers
 import scala.util.parsing.input.Reader
 
 
 object Bibtex
 {
   /** file format **/
 
   def is_bibtex(name: String): Boolean = name.endsWith(".bib")
 
   class File_Format extends isabelle.File_Format
   {
     val format_name: String = "bibtex"
     val file_ext: String = "bib"
 
     override def theory_suffix: String = "bibtex_file"
     override def theory_content(name: String): String =
       """theory "bib" imports Pure begin bibtex_file """ +
         Outer_Syntax.quote_string(name) + """ end"""
 
     override def html_document(snapshot: Document.Snapshot): Option[Presentation.HTML_Document] =
     {
       val name = snapshot.node_name
       if (detect(name.node)) {
         val title = "Bibliography " + quote(snapshot.node_name.path.file_name)
         val content =
           Isabelle_System.with_tmp_file("bib", "bib") { bib =>
             File.write(bib, snapshot.node.source)
             Bibtex.html_output(List(bib), style = "unsort", title = title)
           }
         Some(Presentation.HTML_Document(title, content))
       }
       else None
     }
   }
 
 
 
   /** bibtex errors **/
 
   def bibtex_errors(dir: Path, root_name: String): List[String] =
   {
     val log_path = dir + Path.explode(root_name).ext("blg")
     if (log_path.is_file) {
       val Error1 = """^(I couldn't open database file .+)$""".r
-      val Error2 = """^(.+)---line (\d+) of file (.+)""".r
+      val Error2 = """^(I found no .+)$""".r
+      val Error3 = """^(.+)---line (\d+) of file (.+)""".r
       Line.logical_lines(File.read(log_path)).flatMap(line =>
         line match {
           case Error1(msg) => Some("Bibtex error: " + msg)
-          case Error2(msg, Value.Int(l), file) =>
+          case Error2(msg) => Some("Bibtex error: " + msg)
+          case Error3(msg, Value.Int(l), file) =>
             val path = File.standard_path(file)
             if (Path.is_wellformed(path)) {
               val pos = Position.Line_File(l, (dir + Path.explode(path)).canonical.implode)
               Some("Bibtex error" + Position.here(pos) + ":\n  " + msg)
             }
             else None
           case _ => None
         })
     }
     else Nil
   }
 
 
 
   /** check database **/
 
   def check_database(database: String): (List[(String, Position.T)], List[(String, Position.T)]) =
   {
     val chunks = parse(Line.normalize(database))
     var chunk_pos = Map.empty[String, Position.T]
     val tokens = new mutable.ListBuffer[(Token, Position.T)]
     var line = 1
     var offset = 1
 
     def make_pos(length: Int): Position.T =
       Position.Offset(offset) ::: Position.End_Offset(offset + length) ::: Position.Line(line)
 
     def advance_pos(tok: Token): Unit =
     {
       for (s <- Symbol.iterator(tok.source)) {
         if (Symbol.is_newline(s)) line += 1
         offset += 1
       }
     }
 
     def get_line_pos(l: Int): Position.T =
       if (0 < l && l <= tokens.length) tokens(l - 1)._2 else Position.none
 
     for (chunk <- chunks) {
       val name = chunk.name
       if (name != "" && !chunk_pos.isDefinedAt(name)) {
         chunk_pos += (name -> make_pos(chunk.heading_length))
       }
       for (tok <- chunk.tokens) {
         tokens += (tok.copy(source = tok.source.replace("\n", " ")) -> make_pos(tok.source.length))
         advance_pos(tok)
       }
     }
 
     Isabelle_System.with_tmp_dir("bibtex")(tmp_dir =>
     {
       File.write(tmp_dir + Path.explode("root.bib"),
         tokens.iterator.map(p => p._1.source).mkString("", "\n", "\n"))
       File.write(tmp_dir + Path.explode("root.aux"),
         "\\bibstyle{plain}\n\\bibdata{root}\n\\citation{*}")
       Isabelle_System.bash("\"$ISABELLE_BIBTEX\" root", cwd = tmp_dir.file)
 
       val Error = """^(.*)---line (\d+) of file root.bib$""".r
       val Warning = """^Warning--(.+)$""".r
       val Warning_Line = """--line (\d+) of file root.bib$""".r
       val Warning_in_Chunk = """^Warning--(.+) in (.+)$""".r
 
       val log_file = tmp_dir + Path.explode("root.blg")
       val lines = if (log_file.is_file) Line.logical_lines(File.read(log_file)) else Nil
 
       val (errors, warnings) =
         if (lines.isEmpty) (Nil, Nil)
         else {
           lines.zip(lines.tail ::: List("")).flatMap(
             {
               case (Error(msg, Value.Int(l)), _) =>
                 Some((true, (msg, get_line_pos(l))))
               case (Warning_in_Chunk(msg, name), _) if chunk_pos.isDefinedAt(name) =>
                 Some((false, (Word.capitalize(msg + " in entry " + quote(name)), chunk_pos(name))))
               case (Warning(msg), Warning_Line(Value.Int(l))) =>
                 Some((false, (Word.capitalize(msg), get_line_pos(l))))
               case (Warning(msg), _) =>
                 Some((false, (Word.capitalize(msg), Position.none)))
               case _ => None
             }
           ).partition(_._1)
         }
       (errors.map(_._2), warnings.map(_._2))
     })
   }
 
   object Check_Database extends Scala.Fun_String("bibtex_check_database")
   {
     val here = Scala_Project.here
     def apply(database: String): String =
     {
       import XML.Encode._
       YXML.string_of_body(pair(list(pair(string, properties)), list(pair(string, properties)))(
         check_database(database)))
     }
   }
 
 
 
   /** document model **/
 
   /* entries */
 
   def entries(text: String): List[Text.Info[String]] =
   {
     val result = new mutable.ListBuffer[Text.Info[String]]
     var offset = 0
     for (chunk <- Bibtex.parse(text)) {
       val end_offset = offset + chunk.source.length
       if (chunk.name != "" && !chunk.is_command)
         result += Text.Info(Text.Range(offset, end_offset), chunk.name)
       offset = end_offset
     }
     result.toList
   }
 
   def entries_iterator[A, B <: Document.Model](models: Map[A, B])
     : Iterator[Text.Info[(String, B)]] =
   {
     for {
       (_, model) <- models.iterator
       info <- model.bibtex_entries.iterator
     } yield info.map((_, model))
   }
 
 
   /* completion */
 
   def completion[A, B <: Document.Model](
     history: Completion.History, rendering: Rendering, caret: Text.Offset,
     models: Map[A, B]): Option[Completion.Result] =
   {
     for {
       Text.Info(r, name) <- rendering.citations(rendering.before_caret_range(caret)).headOption
       name1 <- Completion.clean_name(name)
 
       original <- rendering.get_text(r)
       original1 <- Completion.clean_name(Library.perhaps_unquote(original))
 
       entries =
         (for {
           Text.Info(_, (entry, _)) <- entries_iterator(models)
           if entry.toLowerCase.containsSlice(name1.toLowerCase) && entry != original1
         } yield entry).toList
       if entries.nonEmpty
 
       items =
         entries.sorted.map({
           case entry =>
             val full_name = Long_Name.qualify(Markup.CITATION, entry)
             val description = List(entry, "(BibTeX entry)")
             val replacement = quote(entry)
           Completion.Item(r, original, full_name, description, replacement, 0, false)
         }).sorted(history.ordering).take(rendering.options.int("completion_limit"))
     } yield Completion.Result(r, original, false, items)
   }
 
 
 
   /** content **/
 
   private val months = List(
     "jan",
     "feb",
     "mar",
     "apr",
     "may",
     "jun",
     "jul",
     "aug",
     "sep",
     "oct",
     "nov",
     "dec")
   def is_month(s: String): Boolean = months.contains(s.toLowerCase)
 
   private val commands = List("preamble", "string")
   def is_command(s: String): Boolean = commands.contains(s.toLowerCase)
 
   sealed case class Entry(
     kind: String,
     required: List[String],
     optional_crossref: List[String],
     optional_other: List[String])
   {
     val optional_standard: List[String] = List("url", "doi", "ee")
 
     def is_required(s: String): Boolean = required.contains(s.toLowerCase)
     def is_optional(s: String): Boolean =
       optional_crossref.contains(s.toLowerCase) ||
       optional_other.contains(s.toLowerCase) ||
       optional_standard.contains(s.toLowerCase)
 
     def fields: List[String] =
       required ::: optional_crossref ::: optional_other ::: optional_standard
 
     def template: String =
       "@" + kind + "{,\n" + fields.map(x => "  " + x + " = {},\n").mkString + "}\n"
   }
 
   val known_entries: List[Entry] =
     List(
       Entry("Article",
         List("author", "title"),
         List("journal", "year"),
         List("volume", "number", "pages", "month", "note")),
       Entry("InProceedings",
         List("author", "title"),
         List("booktitle", "year"),
         List("editor", "volume", "number", "series", "pages", "month", "address",
           "organization", "publisher", "note")),
       Entry("InCollection",
         List("author", "title", "booktitle"),
         List("publisher", "year"),
         List("editor", "volume", "number", "series", "type", "chapter", "pages",
           "edition", "month", "address", "note")),
       Entry("InBook",
         List("author", "editor", "title", "chapter"),
         List("publisher", "year"),
         List("volume", "number", "series", "type", "address", "edition", "month", "pages", "note")),
       Entry("Proceedings",
         List("title", "year"),
         List(),
         List("booktitle", "editor", "volume", "number", "series", "address", "month",
           "organization", "publisher", "note")),
       Entry("Book",
         List("author", "editor", "title"),
         List("publisher", "year"),
         List("volume", "number", "series", "address", "edition", "month", "note")),
       Entry("Booklet",
         List("title"),
         List(),
         List("author", "howpublished", "address", "month", "year", "note")),
       Entry("PhdThesis",
         List("author", "title", "school", "year"),
         List(),
         List("type", "address", "month", "note")),
       Entry("MastersThesis",
         List("author", "title", "school", "year"),
         List(),
         List("type", "address", "month", "note")),
       Entry("TechReport",
         List("author", "title", "institution", "year"),
         List(),
         List("type", "number", "address", "month", "note")),
       Entry("Manual",
         List("title"),
         List(),
         List("author", "organization", "address", "edition", "month", "year", "note")),
       Entry("Unpublished",
         List("author", "title", "note"),
         List(),
         List("month", "year")),
       Entry("Misc",
         List(),
         List(),
         List("author", "title", "howpublished", "month", "year", "note")))
 
   def get_entry(kind: String): Option[Entry] =
     known_entries.find(entry => entry.kind.toLowerCase == kind.toLowerCase)
 
   def is_entry(kind: String): Boolean = get_entry(kind).isDefined
 
 
 
   /** tokens and chunks **/
 
   object Token
   {
     object Kind extends Enumeration
     {
       val COMMAND = Value("command")
       val ENTRY = Value("entry")
       val KEYWORD = Value("keyword")
       val NAT = Value("natural number")
       val STRING = Value("string")
       val NAME = Value("name")
       val IDENT = Value("identifier")
       val SPACE = Value("white space")
       val COMMENT = Value("ignored text")
       val ERROR = Value("bad input")
     }
   }
 
   sealed case class Token(kind: Token.Kind.Value, source: String)
   {
     def is_kind: Boolean =
       kind == Token.Kind.COMMAND ||
       kind == Token.Kind.ENTRY ||
       kind == Token.Kind.IDENT
     def is_name: Boolean =
       kind == Token.Kind.NAME ||
       kind == Token.Kind.IDENT
     def is_ignored: Boolean =
       kind == Token.Kind.SPACE ||
       kind == Token.Kind.COMMENT
     def is_malformed: Boolean =
       kind == Token.Kind.ERROR
     def is_open: Boolean =
       kind == Token.Kind.KEYWORD && (source == "{" || source == "(")
   }
 
   case class Chunk(kind: String, tokens: List[Token])
   {
     val source = tokens.map(_.source).mkString
 
     private val content: Option[List[Token]] =
       tokens match {
         case Token(Token.Kind.KEYWORD, "@") :: body if body.nonEmpty =>
           (body.init.filterNot(_.is_ignored), body.last) match {
             case (tok :: Token(Token.Kind.KEYWORD, "{") :: toks, Token(Token.Kind.KEYWORD, "}"))
             if tok.is_kind => Some(toks)
 
             case (tok :: Token(Token.Kind.KEYWORD, "(") :: toks, Token(Token.Kind.KEYWORD, ")"))
             if tok.is_kind => Some(toks)
 
             case _ => None
           }
         case _ => None
       }
 
     def name: String =
       content match {
         case Some(tok :: _) if tok.is_name => tok.source
         case _ => ""
       }
 
     def heading_length: Int =
       if (name == "") 1
       else {
         tokens.takeWhile(tok => !tok.is_open).foldLeft(0) { case (n, tok) => n + tok.source.length }
       }
 
     def is_ignored: Boolean = kind == "" && tokens.forall(_.is_ignored)
     def is_malformed: Boolean = kind == "" || tokens.exists(_.is_malformed)
     def is_command: Boolean = Bibtex.is_command(kind) && name != "" && content.isDefined
     def is_entry: Boolean = Bibtex.is_entry(kind) && name != "" && content.isDefined
   }
 
 
 
   /** parsing **/
 
   // context of partial line-oriented scans
   abstract class Line_Context
   case object Ignored extends Line_Context
   case object At extends Line_Context
   case class Item_Start(kind: String) extends Line_Context
   case class Item_Open(kind: String, end: String) extends Line_Context
   case class Item(kind: String, end: String, delim: Delimited) extends Line_Context
 
   case class Delimited(quoted: Boolean, depth: Int)
   val Closed = Delimited(false, 0)
 
   private def token(kind: Token.Kind.Value)(source: String): Token = Token(kind, source)
   private def keyword(source: String): Token = Token(Token.Kind.KEYWORD, source)
 
 
   // See also https://ctan.org/tex-archive/biblio/bibtex/base/bibtex.web
   // module @<Scan for and process a \.{.bib} command or database entry@>.
 
   object Parsers extends RegexParsers
   {
     /* white space and comments */
 
     override val whiteSpace = "".r
 
     private val space = """[ \t\n\r]+""".r ^^ token(Token.Kind.SPACE)
     private val spaces = rep(space)
 
 
     /* ignored text */
 
     private val ignored: Parser[Chunk] =
       rep1("""(?i)([^@]+|@[ \t]*comment)""".r) ^^ {
         case ss => Chunk("", List(Token(Token.Kind.COMMENT, ss.mkString))) }
 
     private def ignored_line: Parser[(Chunk, Line_Context)] =
       ignored ^^ { case a => (a, Ignored) }
 
 
     /* delimited string: outermost "..." or {...} and body with balanced {...} */
 
     // see also bibtex.web: scan_a_field_token_and_eat_white, scan_balanced_braces
     private def delimited_depth(delim: Delimited): Parser[(String, Delimited)] =
       new Parser[(String, Delimited)]
       {
         require(if (delim.quoted) delim.depth > 0 else delim.depth >= 0,
           "bad delimiter depth")
 
         def apply(in: Input) =
         {
           val start = in.offset
           val end = in.source.length
 
           var i = start
           var q = delim.quoted
           var d = delim.depth
           var finished = false
           while (!finished && i < end) {
             val c = in.source.charAt(i)
 
             if (c == '"' && d == 0) { i += 1; d = 1; q = true }
             else if (c == '"' && d == 1 && q) {
               i += 1; d = 0; q = false; finished = true
             }
             else if (c == '{') { i += 1; d += 1 }
             else if (c == '}') {
               if (d == 1 && !q || d > 1) { i += 1; d -= 1; if (d == 0) finished = true }
               else {i = start; finished = true }
             }
             else if (d > 0) i += 1
             else finished = true
           }
           if (i == start) Failure("bad input", in)
           else {
             val s = in.source.subSequence(start, i).toString
             Success((s, Delimited(q, d)), in.drop(i - start))
           }
         }
       }.named("delimited_depth")
 
     private def delimited: Parser[Token] =
       delimited_depth(Closed) ^?
         { case (s, delim) if delim == Closed => Token(Token.Kind.STRING, s) }
 
     private def recover_delimited: Parser[Token] =
       """["{][^@]*""".r ^^ token(Token.Kind.ERROR)
 
     def delimited_line(ctxt: Item): Parser[(Chunk, Line_Context)] =
       delimited_depth(ctxt.delim) ^^ { case (s, delim1) =>
         (Chunk(ctxt.kind, List(Token(Token.Kind.STRING, s))), ctxt.copy(delim = delim1)) } |
       recover_delimited ^^ { case a => (Chunk(ctxt.kind, List(a)), Ignored) }
 
 
     /* other tokens */
 
     private val at = "@" ^^ keyword
 
     private val nat = "[0-9]+".r ^^ token(Token.Kind.NAT)
 
     private val name = """[\x21-\x7f&&[^"#%'(),={}]]+""".r ^^ token(Token.Kind.NAME)
 
     private val identifier =
       """[\x21-\x7f&&[^"#%'(),={}0-9]][\x21-\x7f&&[^"#%'(),={}]]*""".r
 
     private val ident = identifier ^^ token(Token.Kind.IDENT)
 
     val other_token = "[=#,]".r ^^ keyword | (nat | (ident | space))
 
 
     /* body */
 
     private val body =
       delimited | (recover_delimited | other_token)
 
     private def body_line(ctxt: Item) =
       if (ctxt.delim.depth > 0)
         delimited_line(ctxt)
       else
         delimited_line(ctxt) |
         other_token ^^ { case a => (Chunk(ctxt.kind, List(a)), ctxt) } |
         ctxt.end ^^ { case a => (Chunk(ctxt.kind, List(keyword(a))), Ignored) }
 
 
     /* items: command or entry */
 
     private val item_kind =
       identifier ^^ { case a =>
         val kind =
           if (is_command(a)) Token.Kind.COMMAND
           else if (is_entry(a)) Token.Kind.ENTRY
           else Token.Kind.IDENT
         Token(kind, a)
       }
 
     private val item_begin =
       "{" ^^ { case a => ("}", keyword(a)) } |
       "(" ^^ { case a => (")", keyword(a)) }
 
     private def item_name(kind: String) =
       kind.toLowerCase match {
         case "preamble" => failure("")
         case "string" => identifier ^^ token(Token.Kind.NAME)
         case _ => name
       }
 
     private val item_start =
       at ~ spaces ~ item_kind ~ spaces ^^
         { case a ~ b ~ c ~ d => (c.source, List(a) ::: b ::: List(c) ::: d) }
 
     private val item: Parser[Chunk] =
       (item_start ~ item_begin ~ spaces) into
         { case (kind, a) ~ ((end, b)) ~ c =>
             opt(item_name(kind)) ~ rep(body) ~ opt(end ^^ keyword) ^^ {
               case d ~ e ~ f => Chunk(kind, a ::: List(b) ::: c ::: d.toList ::: e ::: f.toList) } }
 
     private val recover_item: Parser[Chunk] =
       at ~ "[^@]*".r ^^ { case a ~ b => Chunk("", List(a, Token(Token.Kind.ERROR, b))) }
 
 
     /* chunks */
 
     val chunk: Parser[Chunk] = ignored | (item | recover_item)
 
     def chunk_line(ctxt: Line_Context): Parser[(Chunk, Line_Context)] =
     {
       ctxt match {
         case Ignored =>
           ignored_line |
           at ^^ { case a => (Chunk("", List(a)), At) }
 
         case At =>
           space ^^ { case a => (Chunk("", List(a)), ctxt) } |
           item_kind ^^ { case a => (Chunk(a.source, List(a)), Item_Start(a.source)) } |
           recover_item ^^ { case a => (a, Ignored) } |
           ignored_line
 
         case Item_Start(kind) =>
           space ^^ { case a => (Chunk(kind, List(a)), ctxt) } |
           item_begin ^^ { case (end, a) => (Chunk(kind, List(a)), Item_Open(kind, end)) } |
           recover_item ^^ { case a => (a, Ignored) } |
           ignored_line
 
         case Item_Open(kind, end) =>
           space ^^ { case a => (Chunk(kind, List(a)), ctxt) } |
           item_name(kind) ^^ { case a => (Chunk(kind, List(a)), Item(kind, end, Closed)) } |
           body_line(Item(kind, end, Closed)) |
           ignored_line
 
         case item_ctxt: Item =>
           body_line(item_ctxt) |
           ignored_line
 
         case _ => failure("")
       }
     }
   }
 
 
   /* parse */
 
   def parse(input: CharSequence): List[Chunk] =
     Parsers.parseAll(Parsers.rep(Parsers.chunk), Scan.char_reader(input)) match {
       case Parsers.Success(result, _) => result
       case _ => error("Unexpected failure to parse input:\n" + input.toString)
     }
 
   def parse_line(input: CharSequence, context: Line_Context): (List[Chunk], Line_Context) =
   {
     var in: Reader[Char] = Scan.char_reader(input)
     val chunks = new mutable.ListBuffer[Chunk]
     var ctxt = context
     while (!in.atEnd) {
       Parsers.parse(Parsers.chunk_line(ctxt), in) match {
         case Parsers.Success((x, c), rest) => chunks += x; ctxt = c; in = rest
         case Parsers.NoSuccess(_, rest) =>
           error("Unepected failure to parse input:\n" + rest.source.toString)
       }
     }
     (chunks.toList, ctxt)
   }
 
 
 
   /** HTML output **/
 
   private val output_styles =
     List(
       "" -> "html-n",
       "plain" -> "html-n",
       "alpha" -> "html-a",
       "named" -> "html-n",
       "paragraph" -> "html-n",
       "unsort" -> "html-u",
       "unsortlist" -> "html-u")
 
   def html_output(bib: List[Path],
     title: String = "Bibliography",
     body: Boolean = false,
     citations: List[String] = List("*"),
     style: String = "",
     chronological: Boolean = false): String =
   {
     Isabelle_System.with_tmp_dir("bibtex")(tmp_dir =>
     {
       /* database files */
 
       val bib_files = bib.map(_.drop_ext)
       val bib_names =
       {
         val names0 = bib_files.map(_.file_name)
         if (Library.duplicates(names0).isEmpty) names0
         else names0.zipWithIndex.map({ case (name, i) => (i + 1).toString + "-" + name })
       }
 
       for ((a, b) <- bib_files zip bib_names) {
         Isabelle_System.copy_file(a.ext("bib"), tmp_dir + Path.basic(b).ext("bib"))
       }
 
 
       /* style file */
 
       val bst =
         output_styles.toMap.get(style) match {
           case Some(base) => base + (if (chronological) "c" else "") + ".bst"
           case None =>
             error("Bad style for bibtex HTML output: " + quote(style) +
               "\n(expected: " + commas_quote(output_styles.map(_._1)) + ")")
         }
       Isabelle_System.copy_file(Path.explode("$BIB2XHTML_HOME/bst") + Path.explode(bst), tmp_dir)
 
 
       /* result */
 
       val in_file = Path.explode("bib.aux")
       val out_file = Path.explode("bib.html")
 
       File.write(tmp_dir + in_file,
         bib_names.mkString("\\bibdata{", ",", "}\n") +
         citations.map(cite => "\\citation{" + cite + "}\n").mkString)
 
       Isabelle_System.bash(
         "\"$BIB2XHTML_HOME/main/bib2xhtml.pl\" -B \"$ISABELLE_BIBTEX\"" +
           " -u -s " + Bash.string(proper_string(style) getOrElse "empty") +
           (if (chronological) " -c" else "") +
           (if (title != "") " -h " + Bash.string(title) + " " else "") +
           " " + File.bash_path(in_file) + " " + File.bash_path(out_file),
         cwd = tmp_dir.file).check
 
       val html = File.read(tmp_dir + out_file)
 
       if (body) {
         cat_lines(
           split_lines(html).
             dropWhile(line => !line.startsWith("<!-- BEGIN BIBLIOGRAPHY")).reverse.
             dropWhile(line => !line.startsWith("<!-- END BIBLIOGRAPHY")).reverse)
       }
       else html
     })
   }
 }
diff --git a/src/Pure/Thy/document_antiquotation.ML b/src/Pure/Thy/document_antiquotation.ML
--- a/src/Pure/Thy/document_antiquotation.ML
+++ b/src/Pure/Thy/document_antiquotation.ML
@@ -1,238 +1,276 @@
 (*  Title:      Pure/Thy/document_antiquotation.ML
     Author:     Makarius
 
 Document antiquotations.
 *)
 
 signature DOCUMENT_ANTIQUOTATION =
 sig
   val thy_output_display: bool Config.T
   val thy_output_cartouche: bool Config.T
   val thy_output_quotes: bool Config.T
   val thy_output_margin: int Config.T
   val thy_output_indent: int Config.T
   val thy_output_source: bool Config.T
   val thy_output_source_cartouche: bool Config.T
   val thy_output_break: bool Config.T
   val thy_output_modes: string Config.T
   val trim_blanks: Proof.context -> string -> string
   val trim_lines: Proof.context -> string -> string
   val indent_lines: Proof.context -> string -> string
   val prepare_lines: Proof.context -> string -> string
   val delimit: Proof.context -> Pretty.T -> Pretty.T
   val indent: Proof.context -> Pretty.T -> Pretty.T
   val format: Proof.context -> Pretty.T -> string
   val output: Proof.context -> Pretty.T -> Output.output
   val print_antiquotations: bool -> Proof.context -> unit
   val check: Proof.context -> xstring * Position.T -> string
   val check_option: Proof.context -> xstring * Position.T -> string
   val setup: binding -> 'a context_parser ->
     ({context: Proof.context, source: Token.src, argument: 'a} -> Latex.text) -> theory -> theory
   val setup_embedded: binding -> 'a context_parser ->
     ({context: Proof.context, source: Token.src, argument: 'a} -> Latex.text) -> theory -> theory
   val setup_option: binding -> (string -> Proof.context -> Proof.context) -> theory -> theory
   val boolean: string -> bool
   val integer: string -> int
   val evaluate: (Symbol_Pos.T list -> Latex.text list) -> Proof.context ->
     Antiquote.text_antiquote -> Latex.text list
+  val approx_content: Proof.context -> string -> string
 end;
 
 structure Document_Antiquotation: DOCUMENT_ANTIQUOTATION =
 struct
 
 (* options *)
 
 val thy_output_display = Attrib.setup_option_bool ("thy_output_display", \<^here>);
 val thy_output_break = Attrib.setup_option_bool ("thy_output_break", \<^here>);
 val thy_output_cartouche = Attrib.setup_option_bool ("thy_output_cartouche", \<^here>);
 val thy_output_quotes = Attrib.setup_option_bool ("thy_output_quotes", \<^here>);
 val thy_output_margin = Attrib.setup_option_int ("thy_output_margin", \<^here>);
 val thy_output_indent = Attrib.setup_option_int ("thy_output_indent", \<^here>);
 val thy_output_source = Attrib.setup_option_bool ("thy_output_source", \<^here>);
 val thy_output_source_cartouche = Attrib.setup_option_bool ("thy_output_source_cartouche", \<^here>);
 val thy_output_modes = Attrib.setup_option_string ("thy_output_modes", \<^here>);
 
 
 (* blanks *)
 
 fun trim_blanks ctxt =
   not (Config.get ctxt thy_output_display) ? Symbol.trim_blanks;
 
 fun trim_lines ctxt =
   if not (Config.get ctxt thy_output_display) then
     split_lines #> map Symbol.trim_blanks #> space_implode " "
   else I;
 
 fun indent_lines ctxt =
   if Config.get ctxt thy_output_display then
     prefix_lines (Symbol.spaces (Config.get ctxt thy_output_indent))
   else I;
 
 fun prepare_lines ctxt = trim_lines ctxt #> indent_lines ctxt;
 
 
 (* output *)
 
 fun delimit ctxt =
   if Config.get ctxt thy_output_cartouche then Pretty.cartouche
   else if Config.get ctxt thy_output_quotes then Pretty.quote
   else I;
 
 fun indent ctxt =
   Config.get ctxt thy_output_display ? Pretty.indent (Config.get ctxt thy_output_indent);
 
 fun format ctxt =
   if Config.get ctxt thy_output_display orelse Config.get ctxt thy_output_break
   then Pretty.string_of_margin (Config.get ctxt thy_output_margin)
   else Pretty.unformatted_string_of;
 
 fun output ctxt = delimit ctxt #> indent ctxt #> format ctxt #> Output.output;
 
 
 (* theory data *)
 
 structure Data = Theory_Data
 (
   type T =
     (bool * (Token.src -> Proof.context -> Latex.text)) Name_Space.table *
       (string -> Proof.context -> Proof.context) Name_Space.table;
   val empty : T =
     (Name_Space.empty_table Markup.document_antiquotationN,
       Name_Space.empty_table Markup.document_antiquotation_optionN);
   val extend = I;
   fun merge ((commands1, options1), (commands2, options2)) : T =
     (Name_Space.merge_tables (commands1, commands2),
       Name_Space.merge_tables (options1, options2));
 );
 
 val get_antiquotations = Data.get o Proof_Context.theory_of;
 
 fun print_antiquotations verbose ctxt =
   let
     val (commands, options) = get_antiquotations ctxt;
     val command_names = map #1 (Name_Space.markup_table verbose ctxt commands);
     val option_names = map #1 (Name_Space.markup_table verbose ctxt options);
   in
     [Pretty.big_list "document antiquotations:" (map Pretty.mark_str command_names),
      Pretty.big_list "document antiquotation options:" (map Pretty.mark_str option_names)]
   end |> Pretty.writeln_chunks;
 
 fun check ctxt = #1 o Name_Space.check (Context.Proof ctxt) (#1 (get_antiquotations ctxt));
 fun check_option ctxt = #1 o Name_Space.check (Context.Proof ctxt) (#2 (get_antiquotations ctxt));
 
 fun gen_setup name embedded scan body thy =
   let
     fun cmd src ctxt =
       let val (x, ctxt') = Token.syntax scan src ctxt
       in body {context = ctxt', source = src, argument = x} end;
     val entry = (name, (embedded, cmd));
   in thy |> Data.map (apfst (Name_Space.define (Context.Theory thy) true entry #> #2)) end;
 
 fun setup name = gen_setup name false;
 fun setup_embedded name = gen_setup name true;
 
 fun setup_option name opt thy = thy
   |> Data.map (apsnd (Name_Space.define (Context.Theory thy) true (name, opt) #> #2));
 
 
 (* syntax *)
 
 local
 
 val property =
   Parse.name_position -- Scan.optional (Parse.$$$ "=" |-- Parse.!!! Parse.name) "";
 
 val properties =
   Scan.optional (Parse.$$$ "[" |-- Parse.!!! (Parse.enum "," property --| Parse.$$$ "]")) [];
 
 in
 
 val parse_antiq =
   Parse.!!!
     (Parse.token Parse.liberal_name -- properties -- Parse.args --| Scan.ahead Parse.eof)
   >> (fn ((name, opts), args) => (opts, name :: args));
 
 end;
 
 
 (* evaluate *)
 
 local
 
 fun command pos (opts, src) ctxt =
   let
     val (src', (embedded, scan)) = Token.check_src ctxt (#1 o get_antiquotations) src;
     val _ =
       if null opts andalso Options.default_bool "update_control_cartouches" then
         Context_Position.reports_text ctxt
           (Antiquote.update_reports embedded pos (map Token.content_of src'))
       else ();
   in scan src' ctxt end;
 
 fun option ((xname, pos), s) ctxt =
   let
     val (_, opt) =
       Name_Space.check (Context.Proof ctxt) (#2 (get_antiquotations ctxt)) (xname, pos);
   in opt s ctxt end;
 
 fun eval ctxt pos (opts, src) =
   let
     val preview_ctxt = fold option opts (Config.put show_markup false ctxt);
     val _ = command pos (opts, src) preview_ctxt;
 
     val print_ctxt = Context_Position.set_visible false preview_ctxt;
     val print_modes =
       space_explode "," (Config.get print_ctxt thy_output_modes) @ [Latex.latexN, Pretty.regularN];
   in [Print_Mode.with_modes print_modes (fn () => command pos (opts, src) print_ctxt) ()] end;
 
 in
 
+fun read_antiq ctxt ({range = (pos, _), body, ...}: Antiquote.antiq) =
+  let val keywords = Thy_Header.get_keywords' ctxt;
+  in Token.read_antiq keywords parse_antiq (body, pos) end;
+
 fun evaluate eval_text ctxt antiq =
   (case antiq of
     Antiquote.Text ss => eval_text ss
   | Antiquote.Control {name, body, ...} =>
       eval ctxt Position.none
         ([], Token.make_src name (if null body then [] else [Token.read_cartouche body]))
-  | Antiquote.Antiq {range = (pos, _), body, ...} =>
-      let val keywords = Thy_Header.get_keywords' ctxt;
-      in eval ctxt pos (Token.read_antiq keywords parse_antiq (body, pos)) end);
+  | Antiquote.Antiq antiq => eval ctxt (#1 (#range antiq)) (read_antiq ctxt antiq));
+
+end;
+
+
+(* approximative content, e.g. for index entries *)
+
+local
+
+val strip_symbols = [Symbol.open_, Symbol.close, "'", "\"", "`"];
+
+fun strip_symbol sym =
+  if member (op =) strip_symbols sym then ""
+  else
+    (case Symbol.decode sym of
+      Symbol.Char s => s
+    | Symbol.UTF8 s => s
+    | Symbol.Sym s => s
+    | Symbol.Control s => s
+    | _ => "");
+
+fun strip_antiq _ (Antiquote.Text body) = map Symbol_Pos.symbol body
+  | strip_antiq _ (Antiquote.Control {body, ...}) = map Symbol_Pos.symbol body
+  | strip_antiq ctxt (Antiquote.Antiq antiq) =
+      read_antiq ctxt antiq |> #2 |> tl
+      |> maps (Symbol.explode o Token.content_of);
+
+in
+
+fun approx_content ctxt =
+  Symbol_Pos.explode0
+  #> trim (Symbol.is_blank o Symbol_Pos.symbol)
+  #> Antiquote.parse_comments Position.none
+  #> maps (strip_antiq ctxt)
+  #> map strip_symbol
+  #> implode;
 
 end;
 
 
 (* option syntax *)
 
 fun boolean "" = true
   | boolean "true" = true
   | boolean "false" = false
   | boolean s = error ("Bad boolean value: " ^ Library.quote s);
 
 fun integer s =
   let
     fun int ss =
       (case Library.read_int ss of (i, []) => i
       | _ => error ("Bad integer value: " ^ Library.quote s));
   in (case Symbol.explode s of "-" :: ss => ~ (int ss) | ss => int ss) end;
 
 val _ = Theory.setup
  (setup_option \<^binding>\<open>show_types\<close> (Config.put show_types o boolean) #>
   setup_option \<^binding>\<open>show_sorts\<close> (Config.put show_sorts o boolean) #>
   setup_option \<^binding>\<open>show_structs\<close> (Config.put show_structs o boolean) #>
   setup_option \<^binding>\<open>show_question_marks\<close> (Config.put show_question_marks o boolean) #>
   setup_option \<^binding>\<open>show_abbrevs\<close> (Config.put show_abbrevs o boolean) #>
   setup_option \<^binding>\<open>names_long\<close> (Config.put Name_Space.names_long o boolean) #>
   setup_option \<^binding>\<open>names_short\<close> (Config.put Name_Space.names_short o boolean) #>
   setup_option \<^binding>\<open>names_unique\<close> (Config.put Name_Space.names_unique o boolean) #>
   setup_option \<^binding>\<open>eta_contract\<close> (Config.put Syntax_Trans.eta_contract o boolean) #>
   setup_option \<^binding>\<open>display\<close> (Config.put thy_output_display o boolean) #>
   setup_option \<^binding>\<open>break\<close> (Config.put thy_output_break o boolean) #>
   setup_option \<^binding>\<open>cartouche\<close> (Config.put thy_output_cartouche o boolean) #>
   setup_option \<^binding>\<open>quotes\<close> (Config.put thy_output_quotes o boolean) #>
   setup_option \<^binding>\<open>mode\<close> (Config.put thy_output_modes) #>
   setup_option \<^binding>\<open>margin\<close> (Config.put thy_output_margin o integer) #>
   setup_option \<^binding>\<open>indent\<close> (Config.put thy_output_indent o integer) #>
   setup_option \<^binding>\<open>source\<close> (Config.put thy_output_source o boolean) #>
   setup_option \<^binding>\<open>source_cartouche\<close> (Config.put thy_output_source_cartouche o boolean) #>
   setup_option \<^binding>\<open>goals_limit\<close> (Config.put Goal_Display.goals_limit o integer));
 
 end;
diff --git a/src/Pure/Thy/document_antiquotations.ML b/src/Pure/Thy/document_antiquotations.ML
--- a/src/Pure/Thy/document_antiquotations.ML
+++ b/src/Pure/Thy/document_antiquotations.ML
@@ -1,350 +1,446 @@
 (*  Title:      Pure/Thy/document_antiquotations.ML
     Author:     Makarius
 
 Miscellaneous document antiquotations.
 *)
 
 structure Document_Antiquotations: sig end =
 struct
 
 (* basic entities *)
 
 local
 
 type style = term -> term;
 
 fun pretty_term_style ctxt (style: style, t) =
-  Thy_Output.pretty_term ctxt (style t);
+  Document_Output.pretty_term ctxt (style t);
 
 fun pretty_thms_style ctxt (style: style, ths) =
-  map (fn th => Thy_Output.pretty_term ctxt (style (Thm.full_prop_of th))) ths;
+  map (fn th => Document_Output.pretty_term ctxt (style (Thm.full_prop_of th))) ths;
 
 fun pretty_term_typ ctxt (style: style, t) =
   let val t' = style t
-  in Thy_Output.pretty_term ctxt (Type.constraint (Term.fastype_of t') t') end;
+  in Document_Output.pretty_term ctxt (Type.constraint (Term.fastype_of t') t') end;
 
 fun pretty_term_typeof ctxt (style: style, t) =
   Syntax.pretty_typ ctxt (Term.fastype_of (style t));
 
 fun pretty_const ctxt c =
   let
     val t = Const (c, Consts.type_scheme (Proof_Context.consts_of ctxt) c)
       handle TYPE (msg, _, _) => error msg;
     val (t', _) = yield_singleton (Variable.import_terms true) t ctxt;
-  in Thy_Output.pretty_term ctxt t' end;
+  in Document_Output.pretty_term ctxt t' end;
 
 fun pretty_abbrev ctxt s =
   let
     val t = Syntax.read_term (Proof_Context.set_mode Proof_Context.mode_abbrev ctxt) s;
     fun err () = error ("Abbreviated constant expected: " ^ Syntax.string_of_term ctxt t);
     val (head, args) = Term.strip_comb t;
     val (c, T) = Term.dest_Const head handle TERM _ => err ();
     val (U, u) = Consts.the_abbreviation (Proof_Context.consts_of ctxt) c
       handle TYPE _ => err ();
     val t' = Term.betapplys (Envir.expand_atom T (U, u), args);
     val eq = Logic.mk_equals (t, t');
     val ctxt' = Proof_Context.augment eq ctxt;
   in Proof_Context.pretty_term_abbrev ctxt' eq end;
 
 fun pretty_locale ctxt (name, pos) =
   let val thy = Proof_Context.theory_of ctxt
   in Pretty.str (Locale.extern thy (Locale.check thy (name, pos))) end;
 
 fun pretty_class ctxt s =
   Pretty.str (Proof_Context.extern_class ctxt (Proof_Context.read_class ctxt s));
 
 fun pretty_type ctxt s =
   let val Type (name, _) = Proof_Context.read_type_name {proper = true, strict = false} ctxt s
   in Pretty.str (Proof_Context.extern_type ctxt name) end;
 
 fun pretty_prf full ctxt = Proof_Syntax.pretty_standard_proof_of ctxt full;
 
 fun pretty_theory ctxt (name, pos) =
   (Theory.check {long = true} ctxt (name, pos); Pretty.str name);
 
-val basic_entity = Thy_Output.antiquotation_pretty_source_embedded;
+val basic_entity = Document_Output.antiquotation_pretty_source_embedded;
 
 fun basic_entities name scan pretty =
   Document_Antiquotation.setup name scan
     (fn {context = ctxt, source = src, argument = xs} =>
-      Thy_Output.pretty_items_source ctxt {embedded = false} src (map (pretty ctxt) xs));
-
-in
+      Document_Output.pretty_items_source ctxt {embedded = false} src (map (pretty ctxt) xs));
 
 val _ = Theory.setup
  (basic_entity \<^binding>\<open>prop\<close> (Term_Style.parse -- Args.prop) pretty_term_style #>
   basic_entity \<^binding>\<open>term\<close> (Term_Style.parse -- Args.term) pretty_term_style #>
   basic_entity \<^binding>\<open>term_type\<close> (Term_Style.parse -- Args.term) pretty_term_typ #>
   basic_entity \<^binding>\<open>typeof\<close> (Term_Style.parse -- Args.term) pretty_term_typeof #>
   basic_entity \<^binding>\<open>const\<close> (Args.const {proper = true, strict = false}) pretty_const #>
   basic_entity \<^binding>\<open>abbrev\<close> (Scan.lift Args.embedded_inner_syntax) pretty_abbrev #>
   basic_entity \<^binding>\<open>typ\<close> Args.typ_abbrev Syntax.pretty_typ #>
   basic_entity \<^binding>\<open>locale\<close> (Scan.lift Args.embedded_position) pretty_locale #>
   basic_entity \<^binding>\<open>class\<close> (Scan.lift Args.embedded_inner_syntax) pretty_class #>
   basic_entity \<^binding>\<open>type\<close> (Scan.lift Args.embedded_inner_syntax) pretty_type #>
   basic_entity \<^binding>\<open>theory\<close> (Scan.lift Args.embedded_position) pretty_theory #>
   basic_entities \<^binding>\<open>prf\<close> Attrib.thms (pretty_prf false) #>
   basic_entities \<^binding>\<open>full_prf\<close> Attrib.thms (pretty_prf true) #>
   Document_Antiquotation.setup \<^binding>\<open>thm\<close> (Term_Style.parse -- Attrib.thms)
     (fn {context = ctxt, source = src, argument = arg} =>
-      Thy_Output.pretty_items_source ctxt {embedded = false} src (pretty_thms_style ctxt arg)));
+      Document_Output.pretty_items_source ctxt {embedded = false} src (pretty_thms_style ctxt arg)));
 
-end;
+in end;
 
 
 (* Markdown errors *)
 
 local
 
 fun markdown_error binding =
   Document_Antiquotation.setup binding (Scan.succeed ())
     (fn {source = src, ...} =>
       error ("Bad Markdown structure: illegal " ^ quote (Binding.name_of binding) ^
         Position.here (Position.no_range_position (#1 (Token.range_of src)))))
 
-in
-
 val _ =
   Theory.setup
    (markdown_error \<^binding>\<open>item\<close> #>
     markdown_error \<^binding>\<open>enum\<close> #>
     markdown_error \<^binding>\<open>descr\<close>);
 
-end;
+in end;
 
 
 (* control spacing *)
 
 val _ =
   Theory.setup
-   (Thy_Output.antiquotation_raw \<^binding>\<open>noindent\<close> (Scan.succeed ())
+   (Document_Output.antiquotation_raw \<^binding>\<open>noindent\<close> (Scan.succeed ())
       (fn _ => fn () => Latex.string "\\noindent") #>
-    Thy_Output.antiquotation_raw \<^binding>\<open>smallskip\<close> (Scan.succeed ())
+    Document_Output.antiquotation_raw \<^binding>\<open>smallskip\<close> (Scan.succeed ())
       (fn _ => fn () => Latex.string "\\smallskip") #>
-    Thy_Output.antiquotation_raw \<^binding>\<open>medskip\<close> (Scan.succeed ())
+    Document_Output.antiquotation_raw \<^binding>\<open>medskip\<close> (Scan.succeed ())
       (fn _ => fn () => Latex.string "\\medskip") #>
-    Thy_Output.antiquotation_raw \<^binding>\<open>bigskip\<close> (Scan.succeed ())
+    Document_Output.antiquotation_raw \<^binding>\<open>bigskip\<close> (Scan.succeed ())
       (fn _ => fn () => Latex.string "\\bigskip"));
 
 
-(* control style *)
+(* nested document text *)
 
 local
 
-fun control_antiquotation name s1 s2 =
-  Thy_Output.antiquotation_raw_embedded name (Scan.lift Args.cartouche_input)
-    (fn ctxt => Latex.enclose_block s1 s2 o Thy_Output.output_document ctxt {markdown = false});
-
-in
+fun nested_antiquotation name s1 s2 =
+  Document_Output.antiquotation_raw_embedded name (Scan.lift Args.cartouche_input)
+    (fn ctxt => fn txt =>
+      (Context_Position.reports ctxt (Document_Output.document_reports txt);
+        Latex.enclose_block s1 s2 (Document_Output.output_document ctxt {markdown = false} txt)));
 
 val _ =
   Theory.setup
-   (control_antiquotation \<^binding>\<open>footnote\<close> "\\footnote{" "}" #>
-    control_antiquotation \<^binding>\<open>emph\<close> "\\emph{" "}" #>
-    control_antiquotation \<^binding>\<open>bold\<close> "\\textbf{" "}");
+   (nested_antiquotation \<^binding>\<open>footnote\<close> "\\footnote{" "}" #>
+    nested_antiquotation \<^binding>\<open>emph\<close> "\\emph{" "}" #>
+    nested_antiquotation \<^binding>\<open>bold\<close> "\\textbf{" "}");
 
-end;
+in end;
+
+
+(* index entries *)
+
+local
+
+val index_like = Parse.$$$ "(" |-- Parse.!!! (Parse.$$$ "is" |-- Args.name --| Parse.$$$ ")");
+val index_args = Parse.enum1 "!" (Args.embedded_input -- Scan.option index_like);
+
+fun output_text ctxt = Latex.block o Document_Output.output_document ctxt {markdown = false};
+
+fun index binding def =
+  Document_Output.antiquotation_raw binding (Scan.lift index_args)
+    (fn ctxt => fn args =>
+      let
+        val _ = Context_Position.reports ctxt (maps (Document_Output.document_reports o #1) args);
+        fun make_item (txt, opt_like) =
+          let
+            val text = output_text ctxt txt;
+            val like =
+              (case opt_like of
+                SOME s => s
+              | NONE => Document_Antiquotation.approx_content ctxt (Input.string_of txt));
+            val _ =
+              if is_none opt_like andalso Context_Position.is_visible ctxt then
+                writeln ("(" ^ Markup.markup Markup.keyword2 "is" ^ " " ^ quote like ^ ")" ^
+                  Position.here (Input.pos_of txt))
+              else ();
+          in {text = text, like = like} end;
+      in Latex.index_entry {items = map make_item args, def = def} end);
+
+val _ = Theory.setup (index \<^binding>\<open>index_ref\<close> false #> index \<^binding>\<open>index_def\<close> true);
+
+in end;
 
 
 (* quasi-formal text (unchecked) *)
 
 local
 
 fun report_text ctxt text =
   let val pos = Input.pos_of text in
     Context_Position.reports ctxt
       [(pos, Markup.language_text (Input.is_delimited text)),
        (pos, Markup.raw_text)]
   end;
 
 fun prepare_text ctxt =
   Input.source_content #> #1 #> Document_Antiquotation.prepare_lines ctxt;
 
 fun text_antiquotation name =
-  Thy_Output.antiquotation_raw_embedded name (Scan.lift Args.text_input)
+  Document_Output.antiquotation_raw_embedded name (Scan.lift Args.text_input)
     (fn ctxt => fn text =>
       let
         val _ = report_text ctxt text;
       in
         prepare_text ctxt text
-        |> Thy_Output.output_source ctxt
-        |> Thy_Output.isabelle ctxt
+        |> Document_Output.output_source ctxt
+        |> Document_Output.isabelle ctxt
       end);
 
 val theory_text_antiquotation =
-  Thy_Output.antiquotation_raw_embedded \<^binding>\<open>theory_text\<close> (Scan.lift Args.text_input)
+  Document_Output.antiquotation_raw_embedded \<^binding>\<open>theory_text\<close> (Scan.lift Args.text_input)
     (fn ctxt => fn text =>
       let
         val keywords = Thy_Header.get_keywords' ctxt;
 
         val _ = report_text ctxt text;
         val _ =
           Input.source_explode text
           |> Token.tokenize keywords {strict = true}
           |> maps (Token.reports keywords)
           |> Context_Position.reports_text ctxt;
       in
         prepare_text ctxt text
         |> Token.explode0 keywords
-        |> maps (Thy_Output.output_token ctxt)
-        |> Thy_Output.isabelle ctxt
+        |> maps (Document_Output.output_token ctxt)
+        |> Document_Output.isabelle ctxt
       end);
 
-in
-
 val _ =
   Theory.setup
    (text_antiquotation \<^binding>\<open>text\<close> #>
     text_antiquotation \<^binding>\<open>cartouche\<close> #>
     theory_text_antiquotation);
 
-end;
-
-
+in end;
 
 
 (* goal state *)
 
 local
 
 fun goal_state name main =
-  Thy_Output.antiquotation_pretty name (Scan.succeed ())
+  Document_Output.antiquotation_pretty name (Scan.succeed ())
     (fn ctxt => fn () =>
       Goal_Display.pretty_goal
         (Config.put Goal_Display.show_main_goal main ctxt)
         (#goal (Proof.goal (Toplevel.proof_of (Toplevel.presentation_state ctxt)))));
 
-in
-
 val _ = Theory.setup
  (goal_state \<^binding>\<open>goals\<close> true #>
   goal_state \<^binding>\<open>subgoals\<close> false);
 
-end;
+in end;
 
 
 (* embedded lemma *)
 
 val _ = Theory.setup
   (Document_Antiquotation.setup \<^binding>\<open>lemma\<close>
     (Scan.lift (Scan.ahead Parse.not_eof) -- Args.prop --
       Scan.lift (Parse.position (Parse.reserved "by") -- Method.parse -- Scan.option Method.parse))
     (fn {context = ctxt, source = src, argument = ((prop_tok, prop), (((_, by_pos), m1), m2))} =>
       let
         val reports =
           (by_pos, Markup.keyword1 |> Markup.keyword_properties) ::
             maps Method.reports_of (m1 :: the_list m2);
         val _ = Context_Position.reports ctxt reports;
 
         (* FIXME check proof!? *)
         val _ = ctxt
           |> Proof.theorem NONE (K I) [[(prop, [])]]
           |> Proof.global_terminal_proof (m1, m2);
       in
-        Thy_Output.pretty_source ctxt {embedded = false}
-          [hd src, prop_tok] (Thy_Output.pretty_term ctxt prop)
+        Document_Output.pretty_source ctxt {embedded = false}
+          [hd src, prop_tok] (Document_Output.pretty_term ctxt prop)
       end));
 
 
 (* verbatim text *)
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>verbatim\<close> (Scan.lift Args.text_input)
+  (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>verbatim\<close> (Scan.lift Args.text_input)
     (fn ctxt => fn text =>
       let
         val pos = Input.pos_of text;
         val _ =
           Context_Position.reports ctxt
             [(pos, Markup.language_verbatim (Input.is_delimited text)),
              (pos, Markup.raw_text)];
       in #1 (Input.source_content text) end));
 
 
 (* bash functions *)
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>bash_function\<close>
+  (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>bash_function\<close>
     (Scan.lift Args.embedded_position) Isabelle_System.check_bash_function);
 
 
 (* system options *)
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>system_option\<close>
+  (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>system_option\<close>
     (Scan.lift Args.embedded_position)
     (fn ctxt => fn (name, pos) =>
       let val _ = Completion.check_option (Options.default ()) ctxt (name, pos);
       in name end));
 
 
 (* ML text *)
 
 local
 
-fun ml_text name ml =
-  Thy_Output.antiquotation_verbatim_embedded name (Scan.lift Args.text_input)
-    (fn ctxt => fn text =>
-      let val _ = ML_Context.eval_in (SOME ctxt) ML_Compiler.flags (Input.pos_of text) (ml text)
-      in #1 (Input.source_content text) end);
+fun test_val (ml1, []) = ML_Lex.read "fn _ => (" @ ml1 @ ML_Lex.read ");"
+  | test_val (ml1, ml2) = ML_Lex.read "fn _ => (" @ ml1 @ ML_Lex.read " : " @ ml2 @ ML_Lex.read ");";
 
-fun ml_enclose bg en source =
-  ML_Lex.read bg @ ML_Lex.read_source source @ ML_Lex.read en;
+fun test_op (ml1, ml2) = test_val (ML_Lex.read "op " @ ml1, ml2);
+
+fun test_type (ml1, []) = ML_Lex.read "val _ = NONE : (" @ ml1 @ ML_Lex.read ") option;"
+  | test_type (ml1, ml2) =
+      ML_Lex.read "val _ = [NONE : (" @ ml1 @ ML_Lex.read ") option, NONE : (" @
+      ml2 @ ML_Lex.read ") option];";
+
+fun test_exn (ml1, []) = ML_Lex.read "fn _ => (" @ ml1 @ ML_Lex.read " : exn);"
+  | test_exn (ml1, ml2) =
+      ML_Lex.read "fn _ => (" @ ml1 @ ML_Lex.read " : " @ ml2 @ ML_Lex.read " -> exn);";
+
+fun test_struct (ml, _) =
+  ML_Lex.read "functor XXX() = struct structure XX = " @ ml @ ML_Lex.read " end;";
+
+fun test_functor (Antiquote.Text tok :: _, _) =
+      ML_Lex.read "ML_Env.check_functor " @
+      ML_Lex.read (ML_Syntax.print_string (ML_Lex.content_of tok))
+  | test_functor _ = raise Fail "Bad ML functor specification";
+
+val parse_ml0 = Args.text_input >> (fn source => ("", (source, Input.empty)));
+
+val parse_ml =
+  Args.text_input -- Scan.optional (Args.colon |-- Args.text_input) Input.empty >> pair "";
+
+val parse_exn =
+  Args.text_input -- Scan.optional (Args.$$$ "of" |-- Args.text_input) Input.empty >> pair "";
+
+val parse_type =
+  (Parse.type_args >> (fn [] => "" | [a] => a ^ " " | bs => enclose "(" ") " (commas bs))) --
+    (Args.text_input -- Scan.optional (Args.$$$ "=" |-- Args.text_input) Input.empty);
+
+fun eval ctxt pos ml =
+  ML_Context.eval_in (SOME ctxt) ML_Compiler.flags pos ml
+    handle ERROR msg => error (msg ^ Position.here pos);
+
+fun make_text sep sources =
+  let
+    val (txt1, txt2) = apply2 (#1 o Input.source_content) sources;
+    val is_ident =
+      (case try List.last (Symbol.explode txt1) of
+        NONE => false
+      | SOME s => Symbol.is_ascii_letdig s);
+    val txt =
+      if txt2 = "" then txt1
+      else if sep = ":" andalso is_ident then txt1 ^ ": " ^ txt2
+      else txt1 ^ " " ^ sep ^ " " ^ txt2
+  in (txt, txt1) end;
+
+fun antiquotation_ml parse test kind show_kind binding index =
+  Document_Output.antiquotation_raw binding (Scan.lift parse)
+    (fn ctxt => fn (txt0, sources) =>
+      let
+        val (ml1, ml2) = apply2 ML_Lex.read_source sources;
+        val ml0 = ML_Lex.read_source (Input.string txt0);
+        val _ = test (ml0 @ ml1, ml2) |> eval ctxt (Input.pos_of (#1 sources));
+
+        val sep = if kind = "type" then "=" else if kind = "exception" then "of" else ":";
+        val (txt, idx) = make_text sep sources;
+
+        val main_text =
+          Document_Output.verbatim ctxt
+            ((if kind = "" orelse not show_kind then "" else kind ^ " ") ^ txt0 ^ txt);
+
+        val index_text =
+          index |> Option.map (fn def =>
+            let
+              val ctxt' = Config.put Document_Antiquotation.thy_output_display false ctxt;
+              val kind' = if kind = "" then " (ML)" else " (ML " ^ kind ^ ")";
+              val txt' = Latex.block [Document_Output.verbatim ctxt' idx, Latex.string kind'];
+              val like = Document_Antiquotation.approx_content ctxt' idx;
+            in Latex.index_entry {items = [{text = txt', like = like}], def = def} end);
+      in Latex.block (the_list index_text @ [main_text]) end);
+
+fun antiquotation_ml0 test kind =
+  antiquotation_ml parse_ml0 test kind false;
+
+fun antiquotation_ml1 parse test kind binding =
+  antiquotation_ml parse test kind true binding (SOME true);
 
 in
 
-val _ = Theory.setup
- (ml_text \<^binding>\<open>ML\<close> (ml_enclose "fn _ => (" ");") #>
-  ml_text \<^binding>\<open>ML_op\<close> (ml_enclose "fn _ => (op " ");") #>
-  ml_text \<^binding>\<open>ML_type\<close> (ml_enclose "val _ = NONE : (" ") option;") #>
-  ml_text \<^binding>\<open>ML_structure\<close>
-    (ml_enclose "functor XXX() = struct structure XX = " " end;") #>
-
-  ml_text \<^binding>\<open>ML_functor\<close>   (* FIXME formal treatment of functor name (!?) *)
-    (fn source =>
-      ML_Lex.read ("ML_Env.check_functor " ^
-        ML_Syntax.print_string (#1 (Input.source_content source)))) #>
-
-  ml_text \<^binding>\<open>ML_text\<close> (K []));
+val _ =
+  Theory.setup
+   (Latex.index_variants (antiquotation_ml0 test_val "") \<^binding>\<open>ML\<close> #>
+    Latex.index_variants (antiquotation_ml0 test_op "infix") \<^binding>\<open>ML_infix\<close> #>
+    Latex.index_variants (antiquotation_ml0 test_type "type") \<^binding>\<open>ML_type\<close> #>
+    Latex.index_variants (antiquotation_ml0 test_struct "structure") \<^binding>\<open>ML_structure\<close> #>
+    Latex.index_variants (antiquotation_ml0 test_functor "functor") \<^binding>\<open>ML_functor\<close> #>
+    antiquotation_ml0 (K []) "text" \<^binding>\<open>ML_text\<close> NONE #>
+    antiquotation_ml1 parse_ml test_val "" \<^binding>\<open>define_ML\<close> #>
+    antiquotation_ml1 parse_ml test_op "infix" \<^binding>\<open>define_ML_infix\<close> #>
+    antiquotation_ml1 parse_type test_type "type" \<^binding>\<open>define_ML_type\<close> #>
+    antiquotation_ml1 parse_exn test_exn "exception" \<^binding>\<open>define_ML_exception\<close> #>
+    antiquotation_ml1 parse_ml0 test_struct "structure" \<^binding>\<open>define_ML_structure\<close> #>
+    antiquotation_ml1 parse_ml0 test_functor "functor" \<^binding>\<open>define_ML_functor\<close>);
 
 end;
 
 
 (* URLs *)
 
 val escape_url =
   translate_string (fn c => if c = "%" orelse c = "#" orelse c = "^" then "\\" ^ c else c);
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_raw_embedded \<^binding>\<open>url\<close> (Scan.lift Args.embedded_input)
+  (Document_Output.antiquotation_raw_embedded \<^binding>\<open>url\<close> (Scan.lift Args.embedded_input)
     (fn ctxt => fn source =>
       let
         val url = Input.string_of source;
         val pos = Input.pos_of source;
         val delimited = Input.is_delimited source;
         val _ =
           Context_Position.reports ctxt
             [(pos, Markup.language_url delimited), (pos, Markup.url url)];
       in Latex.enclose_block "\\url{" "}" [Latex.string (escape_url url)] end));
 
 
 (* formal entities *)
 
 local
 
 fun entity_antiquotation name check bg en =
-  Thy_Output.antiquotation_raw name (Scan.lift Args.name_position)
+  Document_Output.antiquotation_raw name (Scan.lift Args.name_position)
     (fn ctxt => fn (name, pos) =>
       let val _ = check ctxt (name, pos)
       in Latex.enclose_block bg en [Latex.string (Output.output name)] end);
 
-in
-
 val _ =
   Theory.setup
    (entity_antiquotation \<^binding>\<open>command\<close> Outer_Syntax.check_command "\\isacommand{" "}" #>
     entity_antiquotation \<^binding>\<open>method\<close> Method.check_name "\\isa{" "}" #>
     entity_antiquotation \<^binding>\<open>attribute\<close> Attrib.check_name "\\isa{" "}");
 
-end;
+in end;
 
 end;
diff --git a/src/Pure/Thy/document_build.scala b/src/Pure/Thy/document_build.scala
new file mode 100644
--- /dev/null
+++ b/src/Pure/Thy/document_build.scala
@@ -0,0 +1,535 @@
+/*  Title:      Pure/Thy/document_build.scala
+    Author:     Makarius
+
+Build theory document (PDF) from session database.
+*/
+
+package isabelle
+
+
+object Document_Build
+{
+  /* document variants */
+
+  sealed case class Content(path: Path, bytes: Bytes)
+  {
+    def write(dir: Path): Unit = Bytes.write(dir + path, bytes)
+  }
+
+  abstract class Document_Name
+  {
+    def name: String
+    def path: Path = Path.basic(name)
+
+    override def toString: String = name
+  }
+
+  object Document_Variant
+  {
+    def parse(name: String, tags: String): Document_Variant =
+      Document_Variant(name, Library.space_explode(',', tags))
+
+    def parse(opt: String): Document_Variant =
+      Library.space_explode('=', opt) match {
+        case List(name) => Document_Variant(name, Nil)
+        case List(name, tags) => parse(name, tags)
+        case _ => error("Malformed document variant: " + quote(opt))
+      }
+  }
+
+  sealed case class Document_Variant(name: String, tags: List[String]) extends Document_Name
+  {
+    def print_tags: String = tags.mkString(",")
+    def print: String = if (tags.isEmpty) name else name + "=" + print_tags
+
+    def isabelletags: Content =
+    {
+      val path = Path.explode("isabelletags.sty")
+      val text =
+        Library.terminate_lines(
+          tags.map(tag =>
+            tag.toList match {
+              case '/' :: cs => "\\isafoldtag{" + cs.mkString + "}"
+              case '-' :: cs => "\\isadroptag{" + cs.mkString + "}"
+              case '+' :: cs => "\\isakeeptag{" + cs.mkString + "}"
+              case cs => "\\isakeeptag{" + cs.mkString + "}"
+            }))
+      Content(path, Bytes(text))
+    }
+  }
+
+  sealed case class Document_Input(name: String, sources: SHA1.Digest)
+    extends Document_Name
+
+  sealed case class Document_Output(name: String, sources: SHA1.Digest, log_xz: Bytes, pdf: Bytes)
+    extends Document_Name
+  {
+    def log: String = log_xz.uncompress().text
+    def log_lines: List[String] = split_lines(log)
+
+    def write(db: SQL.Database, session_name: String): Unit =
+      write_document(db, session_name, this)
+
+    def write(dir: Path): Path =
+    {
+      val path = dir + Path.basic(name).pdf
+      Isabelle_System.make_directory(path.expand.dir)
+      Bytes.write(path, pdf)
+      path
+    }
+  }
+
+
+  /* SQL data model */
+
+  object Data
+  {
+    val session_name = SQL.Column.string("session_name").make_primary_key
+    val name = SQL.Column.string("name").make_primary_key
+    val sources = SQL.Column.string("sources")
+    val log_xz = SQL.Column.bytes("log_xz")
+    val pdf = SQL.Column.bytes("pdf")
+
+    val table = SQL.Table("isabelle_documents", List(session_name, name, sources, log_xz, pdf))
+
+    def where_equal(session_name: String, name: String = ""): SQL.Source =
+      "WHERE " + Data.session_name.equal(session_name) +
+        (if (name == "") "" else " AND " + Data.name.equal(name))
+  }
+
+  def read_documents(db: SQL.Database, session_name: String): List[Document_Input] =
+  {
+    val select = Data.table.select(List(Data.name, Data.sources), Data.where_equal(session_name))
+    db.using_statement(select)(stmt =>
+      stmt.execute_query().iterator(res =>
+      {
+        val name = res.string(Data.name)
+        val sources = res.string(Data.sources)
+        Document_Input(name, SHA1.fake(sources))
+      }).toList)
+  }
+
+  def read_document(db: SQL.Database, session_name: String, name: String): Option[Document_Output] =
+  {
+    val select = Data.table.select(sql = Data.where_equal(session_name, name))
+    db.using_statement(select)(stmt =>
+    {
+      val res = stmt.execute_query()
+      if (res.next()) {
+        val name = res.string(Data.name)
+        val sources = res.string(Data.sources)
+        val log_xz = res.bytes(Data.log_xz)
+        val pdf = res.bytes(Data.pdf)
+        Some(Document_Output(name, SHA1.fake(sources), log_xz, pdf))
+      }
+      else None
+    })
+  }
+
+  def write_document(db: SQL.Database, session_name: String, doc: Document_Output): Unit =
+  {
+    db.using_statement(Data.table.insert())(stmt =>
+    {
+      stmt.string(1) = session_name
+      stmt.string(2) = doc.name
+      stmt.string(3) = doc.sources.toString
+      stmt.bytes(4) = doc.log_xz
+      stmt.bytes(5) = doc.pdf
+      stmt.execute()
+    })
+  }
+
+
+  /* context */
+
+  val isabelle_styles: List[Path] =
+    List("comment.sty", "isabelle.sty", "isabellesym.sty", "pdfsetup.sty", "railsetup.sty").
+      map(name => Path.explode("~~/lib/texinputs") + Path.basic(name))
+
+  def context(
+    session: String,
+    deps: Sessions.Deps,
+    db_context: Sessions.Database_Context,
+    progress: Progress = new Progress): Context =
+  {
+    val info = deps.sessions_structure(session)
+    val base = deps(session)
+    val hierarchy = deps.sessions_structure.hierarchy(session)
+    new Context(info, base, hierarchy, db_context, progress)
+  }
+
+  final class Context private[Document_Build](
+    info: Sessions.Info,
+    base: Sessions.Base,
+    hierarchy: List[String],
+    db_context: Sessions.Database_Context,
+    val progress: Progress = new Progress)
+  {
+    /* session info */
+
+    def session: String = info.name
+    def options: Options = info.options
+
+    def document_bibliography: Boolean = options.bool("document_bibliography")
+
+    def document_preprocessor: Option[String] =
+      proper_string(options.string("document_preprocessor"))
+
+    def document_logo: Option[String] =
+      options.string("document_logo") match {
+        case "" => None
+        case "_" => Some("")
+        case name => Some(name)
+      }
+
+    def document_build: String = options.string("document_build")
+
+    def get_engine(): Engine =
+    {
+      val name = document_build
+      engines.find(_.name == name).getOrElse(error("Bad document_build engine " + quote(name)))
+    }
+
+    def get_export(theory: String, name: String): Export.Entry =
+      db_context.get_export(hierarchy, theory, name)
+
+
+    /* document content */
+
+    def documents: List[Document_Variant] = info.documents
+
+    def session_theories: List[Document.Node.Name] = base.session_theories
+    def document_theories: List[Document.Node.Name] = session_theories ::: base.document_theories
+
+    lazy val tex_files: List[Content] =
+      for (name <- document_theories)
+      yield {
+        val path = Path.basic(tex_name(name))
+        val bytes = get_export(name.theory, document_tex_name(name)).uncompressed
+        Content(path, bytes)
+      }
+
+    lazy val session_graph: Content =
+    {
+      val path = Presentation.session_graph_path
+      val bytes = graphview.Graph_File.make_pdf(options, base.session_graph_display)
+      Content(path, bytes)
+    }
+
+    lazy val session_tex: Content =
+    {
+      val path = Path.basic("session.tex")
+      val text =
+        Library.terminate_lines(
+          base.session_theories.map(name => "\\input{" + tex_name(name) + "}"))
+      Content(path, Bytes(text))
+    }
+
+    lazy val isabelle_logo: Option[Content] =
+    {
+      document_logo.map(logo_name =>
+        Isabelle_System.with_tmp_file("logo", ext = "pdf")(tmp_path =>
+        {
+          Logo.create_logo(logo_name, output_file = tmp_path, quiet = true)
+          val path = Path.basic("isabelle_logo.pdf")
+          val bytes = Bytes.read(tmp_path)
+          Content(path, bytes)
+        }))
+    }
+
+
+    /* document directory */
+
+    def prepare_directory(dir: Path, doc: Document_Variant): Directory =
+    {
+      val doc_dir = dir + Path.basic(doc.name)
+      Isabelle_System.make_directory(doc_dir)
+
+
+      /* sources */
+
+      isabelle_styles.foreach(Isabelle_System.copy_file(_, doc_dir))
+      doc.isabelletags.write(doc_dir)
+
+      for ((base_dir, src) <- info.document_files) {
+        Isabelle_System.copy_file_base(info.dir + base_dir, src, doc_dir)
+      }
+
+      session_tex.write(doc_dir)
+      tex_files.foreach(_.write(doc_dir))
+
+      val root_name1 = "root_" + doc.name
+      val root_name = if ((doc_dir + Path.explode(root_name1).tex).is_file) root_name1 else "root"
+
+      for (name <- document_preprocessor) {
+        def message(s: String): String = s + " for document_preprocessor=" + quote(name)
+        val path = doc_dir + Path.explode(name)
+        if (path.is_file) {
+          try { Isabelle_System.bash(File.bash_path(path), cwd = doc_dir.file).check }
+          catch { case ERROR(msg) => cat_error(msg, message("The error(s) above occurred")) }
+        }
+        else error(message("Missing executable"))
+      }
+
+      val digests1 = List(doc.print, document_logo.toString, document_build).map(SHA1.digest)
+      val digests2 = File.find_files(doc_dir.file, follow_links = true).map(SHA1.digest)
+      val sources = SHA1.digest_set(digests1 ::: digests2)
+
+
+      /* derived material (without SHA1 digest) */
+
+      isabelle_logo.foreach(_.write(doc_dir))
+
+      session_graph.write(doc_dir)
+
+      Directory(doc_dir, doc, root_name, sources)
+    }
+
+    def old_document(directory: Directory): Option[Document_Output] =
+      for {
+        old_doc <- db_context.input_database(session)(read_document(_, _, directory.doc.name))
+        if old_doc.sources == directory.sources
+      }
+      yield old_doc
+  }
+
+  sealed case class Directory(
+    doc_dir: Path,
+    doc: Document_Variant,
+    root_name: String,
+    sources: SHA1.Digest)
+  {
+    def root_name_script(ext: String = ""): String =
+      Bash.string(if (ext.isEmpty) root_name else root_name + "." + ext)
+
+    def conditional_script(ext: String, exe: String, after: String = ""): String =
+      "if [ -f " + root_name_script(ext) + " ]\n" +
+      "then\n" +
+      "  " + exe + " " + root_name_script() + "\n" +
+      (if (after.isEmpty) "" else "  " + after) +
+      "fi\n"
+
+    def log_errors(): List[String] =
+      Latex.latex_errors(doc_dir, root_name) :::
+      Bibtex.bibtex_errors(doc_dir, root_name)
+
+    def make_document(log: List[String], errors: List[String]): Document_Output =
+    {
+      val root_pdf = Path.basic(root_name).pdf
+      val result_pdf = doc_dir + root_pdf
+
+      if (errors.nonEmpty) {
+        val errors1 = errors ::: List("Failed to build document " + quote(doc.name))
+        throw new Build_Error(log, Exn.cat_message(errors1: _*))
+      }
+      else if (!result_pdf.is_file) {
+        val message = "Bad document result: expected to find " + root_pdf
+        throw new Build_Error(log, message)
+      }
+      else {
+        val log_xz = Bytes(cat_lines(log)).compress()
+        val pdf = Bytes.read(result_pdf)
+        Document_Output(doc.name, sources, log_xz, pdf)
+      }
+    }
+  }
+
+
+  /* build engines */
+
+  lazy val engines: List[Engine] = Isabelle_System.make_services(classOf[Engine])
+
+  abstract class Engine(val name: String) extends Isabelle_System.Service
+  {
+    override def toString: String = name
+
+    def prepare_directory(context: Context, dir: Path, doc: Document_Variant): Directory
+    def build_document(context: Context, directory: Directory, verbose: Boolean): Document_Output
+  }
+
+  abstract class Bash_Engine(name: String) extends Engine(name)
+  {
+    def prepare_directory(context: Context, dir: Path, doc: Document_Variant): Directory =
+      context.prepare_directory(dir, doc)
+
+    def use_pdflatex: Boolean = false
+    def latex_script(context: Context, directory: Directory): String =
+      (if (use_pdflatex) "$ISABELLE_PDFLATEX" else "$ISABELLE_LUALATEX") +
+        " " + directory.root_name_script() + "\n"
+
+    def bibtex_script(context: Context, directory: Directory, latex: Boolean = false): String =
+    {
+      val ext = if (context.document_bibliography) "aux" else "bib"
+      directory.conditional_script(ext, "$ISABELLE_BIBTEX",
+        after = if (latex) latex_script(context, directory) else "")
+    }
+
+    def makeindex_script(context: Context, directory: Directory, latex: Boolean = false): String =
+      directory.conditional_script("idx", "$ISABELLE_MAKEINDEX",
+        after = if (latex) latex_script(context, directory) else "")
+
+    def use_build_script: Boolean = false
+    def build_script(context: Context, directory: Directory): String =
+    {
+      val has_build_script = (directory.doc_dir + Path.explode("build")).is_file
+
+      if (!use_build_script && has_build_script) {
+        error("Unexpected document build script for option document_build=" +
+          quote(context.document_build))
+      }
+      else if (use_build_script && !has_build_script) error("Missing document build script")
+      else if (has_build_script) "./build pdf " + Bash.string(directory.doc.name)
+      else {
+        "set -e\n" +
+        latex_script(context, directory) +
+        bibtex_script(context, directory, latex = true) +
+        makeindex_script(context, directory) +
+        latex_script(context, directory) +
+        makeindex_script(context, directory, latex = true)
+      }
+    }
+
+    def build_document(context: Context, directory: Directory, verbose: Boolean): Document_Output =
+    {
+      val result =
+        context.progress.bash(
+          build_script(context, directory),
+          cwd = directory.doc_dir.file,
+          echo = verbose,
+          watchdog = Time.seconds(0.5))
+
+      val log = result.out_lines ::: result.err_lines
+      val errors = (if (result.ok) Nil else List(result.err)) ::: directory.log_errors()
+      directory.make_document(log, errors)
+    }
+  }
+
+  class LuaLaTeX_Engine extends Bash_Engine("lualatex")
+  class PDFLaTeX_Engine extends Bash_Engine("pdflatex") { override def use_pdflatex: Boolean = true }
+  class Build_Engine extends Bash_Engine("build") { override def use_build_script: Boolean = true }
+
+
+  /* build documents */
+
+  def tex_name(name: Document.Node.Name): String = name.theory_base_name + ".tex"
+  def document_tex_name(name: Document.Node.Name): String = "document/" + tex_name(name)
+
+  class Build_Error(val log_lines: List[String], val message: String)
+    extends Exn.User_Error(message)
+
+  def build_documents(
+    context: Context,
+    output_sources: Option[Path] = None,
+    output_pdf: Option[Path] = None,
+    verbose: Boolean = false): List[Document_Output] =
+  {
+    val progress = context.progress
+    val engine = context.get_engine()
+
+    val documents =
+      for (doc <- context.documents)
+      yield {
+        Isabelle_System.with_tmp_dir("document")(tmp_dir =>
+        {
+          progress.echo("Preparing " + context.session + "/" + doc.name + " ...")
+          val start = Time.now()
+
+          output_sources.foreach(engine.prepare_directory(context, _, doc))
+          val directory = engine.prepare_directory(context, tmp_dir, doc)
+
+          val document =
+            context.old_document(directory) getOrElse
+              engine.build_document(context, directory, verbose)
+
+          val stop = Time.now()
+          val timing = stop - start
+
+          progress.echo("Finished " + context.session + "/" + doc.name +
+            " (" + timing.message_hms + " elapsed time)")
+
+          document
+        })
+      }
+
+    for (dir <- output_pdf; doc <- documents) {
+      val path = doc.write(dir)
+      progress.echo("Document at " + path.absolute)
+    }
+
+    documents
+  }
+
+
+  /* Isabelle tool wrapper */
+
+  val isabelle_tool =
+    Isabelle_Tool("document", "prepare session theory document", Scala_Project.here, args =>
+    {
+      var output_sources: Option[Path] = None
+      var output_pdf: Option[Path] = None
+      var verbose_latex = false
+      var dirs: List[Path] = Nil
+      var options = Options.init()
+      var verbose_build = false
+
+      val getopts = Getopts(
+        """
+Usage: isabelle document [OPTIONS] SESSION
+
+  Options are:
+    -O DIR       output directory for LaTeX sources and resulting PDF
+    -P DIR       output directory for resulting PDF
+    -S DIR       output directory for LaTeX sources
+    -V           verbose latex
+    -d DIR       include session directory
+    -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
+    -v           verbose build
+
+  Prepare the theory document of a session.
+""",
+        "O:" -> (arg =>
+          {
+            val dir = Path.explode(arg)
+            output_sources = Some(dir)
+            output_pdf = Some(dir)
+          }),
+        "P:" -> (arg => { output_pdf = Some(Path.explode(arg)) }),
+        "S:" -> (arg => { output_sources = Some(Path.explode(arg)) }),
+        "V" -> (_ => verbose_latex = true),
+        "d:" -> (arg => dirs = dirs ::: List(Path.explode(arg))),
+        "o:" -> (arg => options = options + arg),
+        "v" -> (_ => verbose_build = true))
+
+      val more_args = getopts(args)
+      val session =
+        more_args match {
+          case List(a) => a
+          case _ => getopts.usage()
+        }
+
+      val progress = new Console_Progress(verbose = verbose_build)
+      val store = Sessions.store(options)
+
+      progress.interrupt_handler {
+        val res =
+          Build.build(options, selection = Sessions.Selection.session(session),
+            dirs = dirs, progress = progress, verbose = verbose_build)
+        if (!res.ok) error("Failed to build session " + quote(session))
+
+        val deps =
+          Sessions.load_structure(options + "document=pdf", dirs = dirs).
+            selection_deps(Sessions.Selection.session(session))
+
+        if (output_sources.isEmpty && output_pdf.isEmpty) {
+          progress.echo_warning("No output directory")
+        }
+
+        using(store.open_database_context())(db_context =>
+        {
+          build_documents(context(session, deps, db_context, progress = progress),
+            output_sources = output_sources, output_pdf = output_pdf,
+            verbose = verbose_latex)
+        })
+      }
+    })
+}
diff --git a/src/Pure/Thy/thy_output.ML b/src/Pure/Thy/document_output.ML
rename from src/Pure/Thy/thy_output.ML
rename to src/Pure/Thy/document_output.ML
--- a/src/Pure/Thy/thy_output.ML
+++ b/src/Pure/Thy/document_output.ML
@@ -1,570 +1,577 @@
-(*  Title:      Pure/Thy/thy_output.ML
+(*  Title:      Pure/Thy/document_output.ML
     Author:     Makarius
 
 Theory document output.
 *)
 
-signature THY_OUTPUT =
+signature DOCUMENT_OUTPUT =
 sig
+  val document_reports: Input.source -> Position.report list
   val output_document: Proof.context -> {markdown: bool} -> Input.source -> Latex.text list
   val check_comments: Proof.context -> Symbol_Pos.T list -> unit
   val output_token: Proof.context -> Token.T -> Latex.text list
   val output_source: Proof.context -> string -> Latex.text list
   type segment =
     {span: Command_Span.span, command: Toplevel.transition,
      prev_state: Toplevel.state, state: Toplevel.state}
   val present_thy: Options.T -> theory -> segment list -> Latex.text list
   val pretty_term: Proof.context -> term -> Pretty.T
   val pretty_thm: Proof.context -> thm -> Pretty.T
   val lines: Latex.text list -> Latex.text list
   val items: Latex.text list -> Latex.text list
   val isabelle: Proof.context -> Latex.text list -> Latex.text
   val isabelle_typewriter: Proof.context -> Latex.text list -> Latex.text
   val typewriter: Proof.context -> string -> Latex.text
   val verbatim: Proof.context -> string -> Latex.text
   val source: Proof.context -> {embedded: bool} -> Token.src -> Latex.text
   val pretty: Proof.context -> Pretty.T -> Latex.text
   val pretty_source: Proof.context -> {embedded: bool} -> Token.src -> Pretty.T -> Latex.text
   val pretty_items: Proof.context -> Pretty.T list -> Latex.text
   val pretty_items_source: Proof.context -> {embedded: bool} -> Token.src ->
     Pretty.T list -> Latex.text
   val antiquotation_pretty:
     binding -> 'a context_parser -> (Proof.context -> 'a -> Pretty.T) -> theory -> theory
   val antiquotation_pretty_embedded:
     binding -> 'a context_parser -> (Proof.context -> 'a -> Pretty.T) -> theory -> theory
   val antiquotation_pretty_source:
     binding -> 'a context_parser -> (Proof.context -> 'a -> Pretty.T) -> theory -> theory
   val antiquotation_pretty_source_embedded:
     binding -> 'a context_parser -> (Proof.context -> 'a -> Pretty.T) -> theory -> theory
   val antiquotation_raw:
     binding -> 'a context_parser -> (Proof.context -> 'a -> Latex.text) -> theory -> theory
   val antiquotation_raw_embedded:
     binding -> 'a context_parser -> (Proof.context -> 'a -> Latex.text) -> theory -> theory
   val antiquotation_verbatim:
     binding -> 'a context_parser -> (Proof.context -> 'a -> string) -> theory -> theory
   val antiquotation_verbatim_embedded:
     binding -> 'a context_parser -> (Proof.context -> 'a -> string) -> theory -> theory
 end;
 
-structure Thy_Output: THY_OUTPUT =
+structure Document_Output: DOCUMENT_OUTPUT =
 struct
 
 (* output document source *)
 
+fun document_reports txt =
+  let val pos = Input.pos_of txt in
+    [(pos, Markup.language_document (Input.is_delimited txt)),
+     (pos, Markup.plain_text)]
+  end;
+
 val output_symbols = single o Latex.symbols_output;
 
 fun output_comment ctxt (kind, syms) =
   (case kind of
     Comment.Comment =>
       Input.cartouche_content syms
       |> output_document (ctxt |> Config.put Document_Antiquotation.thy_output_display false)
           {markdown = false}
       |> Latex.enclose_body "%\n\\isamarkupcmt{" "%\n}"
   | Comment.Cancel =>
       Symbol_Pos.cartouche_content syms
       |> output_symbols
       |> Latex.enclose_body "%\n\\isamarkupcancel{" "}"
   | Comment.Latex => [Latex.symbols (Symbol_Pos.cartouche_content syms)]
   | Comment.Marker => [])
 and output_comment_document ctxt (comment, syms) =
   (case comment of
     SOME kind => output_comment ctxt (kind, syms)
   | NONE => [Latex.symbols syms])
 and output_document_text ctxt syms =
   Comment.read_body syms |> maps (output_comment_document ctxt)
 and output_document ctxt {markdown} source =
   let
     val pos = Input.pos_of source;
     val syms = Input.source_explode source;
 
     val output_antiquotes =
       maps (Document_Antiquotation.evaluate (output_document_text ctxt) ctxt);
 
     fun output_line line =
       (if Markdown.line_is_item line then [Latex.string "\\item "] else []) @
         output_antiquotes (Markdown.line_content line);
 
     fun output_block (Markdown.Par lines) =
           Latex.block (separate (Latex.string "\n") (map (Latex.block o output_line) lines))
       | output_block (Markdown.List {kind, body, ...}) =
           Latex.environment_block (Markdown.print_kind kind) (output_blocks body)
     and output_blocks blocks = separate (Latex.string "\n\n") (map output_block blocks);
   in
     if Toplevel.is_skipped_proof (Toplevel.presentation_state ctxt) then []
     else if markdown andalso exists (Markdown.is_control o Symbol_Pos.symbol) syms
     then
       let
         val ants = Antiquote.parse_comments pos syms;
         val reports = Antiquote.antiq_reports ants;
         val blocks = Markdown.read_antiquotes ants;
         val _ = Context_Position.reports ctxt (reports @ Markdown.reports blocks);
       in output_blocks blocks end
     else
       let
         val ants = Antiquote.parse_comments pos (trim (Symbol.is_blank o Symbol_Pos.symbol) syms);
         val reports = Antiquote.antiq_reports ants;
         val _ = Context_Position.reports ctxt (reports @ Markdown.text_reports ants);
       in output_antiquotes ants end
   end;
 
 
 (* output tokens with formal comments *)
 
 local
 
 val output_symbols_antiq =
   (fn Antiquote.Text syms => output_symbols syms
     | Antiquote.Control {name = (name, _), body, ...} =>
         Latex.string (Latex.output_symbols [Symbol.encode (Symbol.Control name)]) ::
           output_symbols body
     | Antiquote.Antiq {body, ...} =>
         Latex.enclose_body "%\n\\isaantiq\n" "{}%\n\\endisaantiq\n" (output_symbols body));
 
 fun output_comment_symbols ctxt {antiq} (comment, syms) =
   (case (comment, antiq) of
     (NONE, false) => output_symbols syms
   | (NONE, true) =>
       Antiquote.parse_comments (#1 (Symbol_Pos.range syms)) syms
       |> maps output_symbols_antiq
   | (SOME comment, _) => output_comment ctxt (comment, syms));
 
 fun output_body ctxt antiq bg en syms =
   Comment.read_body syms
   |> maps (output_comment_symbols ctxt {antiq = antiq})
   |> Latex.enclose_body bg en;
 
 in
 
 fun output_token ctxt tok =
   let
     fun output antiq bg en =
       output_body ctxt antiq bg en (Input.source_explode (Token.input_of tok));
   in
     (case Token.kind_of tok of
       Token.Comment NONE => []
     | Token.Comment (SOME Comment.Marker) => []
     | Token.Command => output false "\\isacommand{" "}"
     | Token.Keyword =>
         if Symbol.is_ascii_identifier (Token.content_of tok)
         then output false "\\isakeyword{" "}"
         else output false "" ""
     | Token.String => output false "{\\isachardoublequoteopen}" "{\\isachardoublequoteclose}"
     | Token.Alt_String => output false "{\\isacharbackquoteopen}" "{\\isacharbackquoteclose}"
     | Token.Verbatim => output true "{\\isacharverbatimopen}" "{\\isacharverbatimclose}"
     | Token.Cartouche => output false "{\\isacartoucheopen}" "{\\isacartoucheclose}"
     | _ => output false "" "")
   end handle ERROR msg => error (msg ^ Position.here (Token.pos_of tok));
 
 fun output_source ctxt s =
   output_body ctxt false "" "" (Symbol_Pos.explode (s, Position.none));
 
 fun check_comments ctxt =
   Comment.read_body #> List.app (fn (comment, syms) =>
     let
       val pos = #1 (Symbol_Pos.range syms);
       val _ =
         comment |> Option.app (fn kind =>
           Context_Position.reports ctxt (map (pair pos) (Comment.kind_markups kind)));
       val _ = output_comment_symbols ctxt {antiq = false} (comment, syms);
     in if comment = SOME Comment.Comment then check_comments ctxt syms else () end);
 
 end;
 
 
 
 (** present theory source **)
 
 (* presentation tokens *)
 
 datatype token =
     Ignore
   | Token of Token.T
   | Heading of string * Input.source
   | Body of string * Input.source
   | Raw of Input.source;
 
 fun token_with pred (Token tok) = pred tok
   | token_with _ _ = false;
 
 val white_token = token_with Document_Source.is_white;
 val white_comment_token = token_with Document_Source.is_white_comment;
 val blank_token = token_with Token.is_blank;
 val newline_token = token_with Token.is_newline;
 
 fun present_token ctxt tok =
   (case tok of
     Ignore => []
   | Token tok => output_token ctxt tok
   | Heading (cmd, source) =>
       Latex.enclose_body ("%\n\\isamarkup" ^ cmd ^ "{") "%\n}\n"
         (output_document ctxt {markdown = false} source)
   | Body (cmd, source) =>
       [Latex.environment_block ("isamarkup" ^ cmd) (output_document ctxt {markdown = true} source)]
   | Raw source =>
       Latex.string "%\n" :: output_document ctxt {markdown = true} source @ [Latex.string "\n"]);
 
 
 (* command spans *)
 
 type command = string * Position.T;   (*name, position*)
 type source = (token * (string * int)) list;        (*token, markup flag, meta-comment depth*)
 
 datatype span = Span of command * (source * source * source * source) * bool;
 
 fun make_span cmd src =
   let
     fun chop_newline (tok :: toks) =
           if newline_token (fst tok) then ([tok], toks, true)
           else ([], tok :: toks, false)
       | chop_newline [] = ([], [], false);
     val (((src_prefix, src_main), src_suffix1), (src_suffix2, src_appendix, newline)) =
       src
       |> chop_prefix (white_token o fst)
       ||>> chop_suffix (white_token o fst)
       ||>> chop_prefix (white_comment_token o fst)
       ||> chop_newline;
   in Span (cmd, (src_prefix, src_main, src_suffix1 @ src_suffix2, src_appendix), newline) end;
 
 
 (* present spans *)
 
 local
 
 fun err_bad_nesting here =
   error ("Bad nesting of commands in presentation" ^ here);
 
 fun edge which f (x: string option, y) =
   if x = y then I
   else (case which (x, y) of NONE => I | SOME txt => cons (Latex.string (f txt)));
 
 val begin_tag = edge #2 Latex.begin_tag;
 val end_tag = edge #1 Latex.end_tag;
 fun open_delim delim e = edge #2 Latex.begin_delim e #> delim #> edge #2 Latex.end_delim e;
 fun close_delim delim e = edge #1 Latex.begin_delim e #> delim #> edge #1 Latex.end_delim e;
 
 fun document_tag cmd_pos state state' tagging_stack =
   let
     val ctxt' = Toplevel.presentation_context state';
     val nesting = Toplevel.level state' - Toplevel.level state;
 
     val (tagging, taggings) = tagging_stack;
     val (tag', tagging') = Document_Source.update_tagging ctxt' tagging;
 
     val tagging_stack' =
       if nesting = 0 andalso not (Toplevel.is_proof state) then tagging_stack
       else if nesting >= 0 then (tagging', replicate nesting tagging @ taggings)
       else
         (case drop (~ nesting - 1) taggings of
           tg :: tgs => (tg, tgs)
         | [] => err_bad_nesting (Position.here cmd_pos));
   in (tag', tagging_stack') end;
 
 fun read_tag s =
   (case space_explode "%" s of
     ["", b] => (SOME b, NONE)
   | [a, b] => (NONE, SOME (a, b))
   | _ => error ("Bad document_tags specification: " ^ quote s));
 
 in
 
 fun make_command_tag options keywords =
   let
     val document_tags =
       map read_tag (space_explode "," (Options.string options \<^system_option>\<open>document_tags\<close>));
     val document_tags_default = map_filter #1 document_tags;
     val document_tags_command = map_filter #2 document_tags;
   in
     fn cmd_name => fn state => fn state' => fn active_tag =>
       let
         val keyword_tags =
           if cmd_name = "end" andalso Toplevel.is_end_theory state' then ["theory"]
           else Keyword.command_tags keywords cmd_name;
         val command_tags =
           the_list (AList.lookup (op =) document_tags_command cmd_name) @
           keyword_tags @ document_tags_default;
         val active_tag' =
           (case command_tags of
             default_tag :: _ => SOME default_tag
           | [] =>
               if Keyword.is_vacuous keywords cmd_name andalso Toplevel.is_proof state
               then active_tag
               else NONE);
       in active_tag' end
   end;
 
 fun present_span command_tag span state state'
     (tagging_stack, active_tag, newline, latex, present_cont) =
   let
     val ctxt' = Toplevel.presentation_context state';
     val present = fold (fn (tok, (flag, 0)) =>
         fold cons (present_token ctxt' tok)
         #> cons (Latex.string flag)
       | _ => I);
 
     val Span ((cmd_name, cmd_pos), srcs, span_newline) = span;
 
     val (tag', tagging_stack') = document_tag cmd_pos state state' tagging_stack;
     val active_tag' =
       if is_some tag' then Option.map #1 tag'
       else command_tag cmd_name state state' active_tag;
     val edge = (active_tag, active_tag');
 
     val newline' =
       if is_none active_tag' then span_newline else newline;
 
     val latex' =
       latex
       |> end_tag edge
       |> close_delim (fst present_cont) edge
       |> snd present_cont
       |> open_delim (present (#1 srcs)) edge
       |> begin_tag edge
       |> present (#2 srcs);
     val present_cont' =
       if newline then (present (#3 srcs), present (#4 srcs))
       else (I, present (#3 srcs) #> present (#4 srcs));
   in (tagging_stack', active_tag', newline', latex', present_cont') end;
 
 fun present_trailer ((_, tags), active_tag, _, latex, present_cont) =
   if not (null tags) then err_bad_nesting " at end of theory"
   else
     latex
     |> end_tag (active_tag, NONE)
     |> close_delim (fst present_cont) (active_tag, NONE)
     |> snd present_cont;
 
 end;
 
 
 (* present_thy *)
 
 local
 
 val markup_true = "\\isamarkuptrue%\n";
 val markup_false = "\\isamarkupfalse%\n";
 
 val opt_newline = Scan.option (Scan.one Token.is_newline);
 
 val ignore =
   Scan.depend (fn d => opt_newline |-- Scan.one Token.is_begin_ignore
     >> pair (d + 1)) ||
   Scan.depend (fn d => Scan.one Token.is_end_ignore --|
     (if d = 0 then Scan.fail_with (K (fn () => "Bad nesting of meta-comments")) else opt_newline)
     >> pair (d - 1));
 
 val locale =
   Scan.option ((Parse.$$$ "(" -- Document_Source.improper -- Parse.$$$ "in") |--
     Parse.!!!
       (Document_Source.improper |-- Parse.name --| (Document_Source.improper -- Parse.$$$ ")")));
 
 in
 
 type segment =
   {span: Command_Span.span, command: Toplevel.transition,
    prev_state: Toplevel.state, state: Toplevel.state};
 
 fun present_thy options thy (segments: segment list) =
   let
     val keywords = Thy_Header.get_keywords thy;
 
 
     (* tokens *)
 
     val ignored = Scan.state --| ignore
       >> (fn d => (NONE, (Ignore, ("", d))));
 
     fun markup pred mk flag = Scan.peek (fn d =>
       Document_Source.improper |--
         Parse.position (Scan.one (fn tok =>
           Token.is_command tok andalso pred keywords (Token.content_of tok))) --
       (Document_Source.annotation |--
         Parse.!!!! ((Document_Source.improper -- locale -- Document_Source.improper) |--
           Parse.document_source --| Document_Source.improper_end))
             >> (fn ((tok, pos'), source) =>
               let val name = Token.content_of tok
               in (SOME (name, pos'), (mk (name, source), (flag, d))) end));
 
     val command = Scan.peek (fn d =>
       Scan.optional (Scan.one Token.is_command_modifier ::: Document_Source.improper) [] --
       Scan.one Token.is_command --| Document_Source.annotation
       >> (fn (cmd_mod, cmd) =>
         map (fn tok => (NONE, (Token tok, ("", d)))) cmd_mod @
           [(SOME (Token.content_of cmd, Token.pos_of cmd),
             (Token cmd, (markup_false, d)))]));
 
     val cmt = Scan.peek (fn d =>
       Scan.one Document_Source.is_black_comment >> (fn tok => (NONE, (Token tok, ("", d)))));
 
     val other = Scan.peek (fn d =>
        Parse.not_eof >> (fn tok => (NONE, (Token tok, ("", d)))));
 
     val tokens =
       (ignored ||
         markup Keyword.is_document_heading Heading markup_true ||
         markup Keyword.is_document_body Body markup_true ||
         markup Keyword.is_document_raw (Raw o #2) "") >> single ||
       command ||
       (cmt || other) >> single;
 
 
     (* spans *)
 
     val is_eof = fn (_, (Token x, _)) => Token.is_eof x | _ => false;
     val stopper = Scan.stopper (K (NONE, (Token Token.eof, ("", 0)))) is_eof;
 
     val cmd = Scan.one (is_some o fst);
     val non_cmd = Scan.one (is_none o fst andf not o is_eof) >> #2;
 
     val white_comments = Scan.many (white_comment_token o fst o snd);
     val blank = Scan.one (blank_token o fst o snd);
     val newline = Scan.one (newline_token o fst o snd);
     val before_cmd =
       Scan.option (newline -- white_comments) --
       Scan.option (newline -- white_comments) --
       Scan.option (blank -- white_comments) -- cmd;
 
     val span =
       Scan.repeat non_cmd -- cmd --
         Scan.repeat (Scan.unless before_cmd non_cmd) --
         Scan.option (newline >> (single o snd))
       >> (fn (((toks1, (cmd, tok2)), toks3), tok4) =>
           make_span (the cmd) (toks1 @ (tok2 :: (toks3 @ the_default [] tok4))));
 
     val spans = segments
       |> maps (Command_Span.content o #span)
       |> drop_suffix Token.is_space
       |> Source.of_list
       |> Source.source' 0 Token.stopper (Scan.error (Scan.bulk tokens >> flat))
       |> Source.source stopper (Scan.error (Scan.bulk span))
       |> Source.exhaust;
 
     val command_results =
       segments |> map_filter (fn {command, state, ...} =>
         if Toplevel.is_ignored command then NONE else SOME (command, state));
 
 
     (* present commands *)
 
     val command_tag = make_command_tag options keywords;
 
     fun present_command tr span st st' =
       Toplevel.setmp_thread_position tr (present_span command_tag span st st');
 
     fun present _ [] = I
       | present st ((span, (tr, st')) :: rest) = present_command tr span st st' #> present st' rest;
   in
     if length command_results = length spans then
       (([], []), NONE, true, [], (I, I))
       |> present (Toplevel.init_toplevel ()) (spans ~~ command_results)
       |> present_trailer
       |> rev
     else error "Messed-up outer syntax for presentation"
   end;
 
 end;
 
 
 
 (** standard output operations **)
 
 (* pretty printing *)
 
 fun pretty_term ctxt t =
   Syntax.pretty_term (Proof_Context.augment t ctxt) t;
 
 fun pretty_thm ctxt = pretty_term ctxt o Thm.full_prop_of;
 
 
 (* default output *)
 
 val lines = separate (Latex.string "\\isanewline%\n");
 val items = separate (Latex.string "\\isasep\\isanewline%\n");
 
 fun isabelle ctxt body =
   if Config.get ctxt Document_Antiquotation.thy_output_display
   then Latex.environment_block "isabelle" body
   else Latex.block (Latex.enclose_body "\\isa{" "}" body);
 
 fun isabelle_typewriter ctxt body =
   if Config.get ctxt Document_Antiquotation.thy_output_display
   then Latex.environment_block "isabellett" body
   else Latex.block (Latex.enclose_body "\\isatt{" "}" body);
 
 fun typewriter ctxt s =
   isabelle_typewriter ctxt [Latex.string (Latex.output_ascii s)];
 
 fun verbatim ctxt =
   if Config.get ctxt Document_Antiquotation.thy_output_display
   then Document_Antiquotation.indent_lines ctxt #> typewriter ctxt
   else split_lines #> map (typewriter ctxt) #> lines #> Latex.block;
 
 fun token_source ctxt {embedded} tok =
   if Token.is_kind Token.Cartouche tok andalso embedded andalso
     not (Config.get ctxt Document_Antiquotation.thy_output_source_cartouche)
   then Token.content_of tok
   else Token.unparse tok;
 
 fun is_source ctxt =
   Config.get ctxt Document_Antiquotation.thy_output_source orelse
   Config.get ctxt Document_Antiquotation.thy_output_source_cartouche;
 
 fun source ctxt embedded =
   Token.args_of_src
   #> map (token_source ctxt embedded #> Document_Antiquotation.prepare_lines ctxt)
   #> space_implode " "
   #> output_source ctxt
   #> isabelle ctxt;
 
 fun pretty ctxt =
   Document_Antiquotation.output ctxt #> Latex.string #> single #> isabelle ctxt;
 
 fun pretty_source ctxt embedded src prt =
   if is_source ctxt then source ctxt embedded src else pretty ctxt prt;
 
 fun pretty_items ctxt =
   map (Document_Antiquotation.output ctxt #> Latex.string) #> items #> isabelle ctxt;
 
 fun pretty_items_source ctxt embedded src prts =
   if is_source ctxt then source ctxt embedded src else pretty_items ctxt prts;
 
 
 (* antiquotation variants *)
 
 local
 
 fun gen_setup name embedded =
   if embedded
   then Document_Antiquotation.setup_embedded name
   else Document_Antiquotation.setup name;
 
 fun gen_antiquotation_pretty name embedded scan f =
   gen_setup name embedded scan (fn {context = ctxt, argument = x, ...} => pretty ctxt (f ctxt x));
 
 fun gen_antiquotation_pretty_source name embedded scan f =
   gen_setup name embedded scan
     (fn {context = ctxt, source = src, argument = x} =>
       pretty_source ctxt {embedded = embedded} src (f ctxt x));
 
 fun gen_antiquotation_raw name embedded scan f =
   gen_setup name embedded scan (fn {context = ctxt, argument = x, ...} => f ctxt x);
 
 fun gen_antiquotation_verbatim name embedded scan f =
   gen_antiquotation_raw name embedded scan (fn ctxt => verbatim ctxt o f ctxt);
 
 in
 
 fun antiquotation_pretty name = gen_antiquotation_pretty name false;
 fun antiquotation_pretty_embedded name = gen_antiquotation_pretty name true;
 
 fun antiquotation_pretty_source name = gen_antiquotation_pretty_source name false;
 fun antiquotation_pretty_source_embedded name = gen_antiquotation_pretty_source name true;
 
 fun antiquotation_raw name = gen_antiquotation_raw name false;
 fun antiquotation_raw_embedded name = gen_antiquotation_raw name true;
 
 fun antiquotation_verbatim name = gen_antiquotation_verbatim name false;
 fun antiquotation_verbatim_embedded name = gen_antiquotation_verbatim name true;
 
 end;
 
 end;
diff --git a/src/Pure/Thy/latex.ML b/src/Pure/Thy/latex.ML
--- a/src/Pure/Thy/latex.ML
+++ b/src/Pure/Thy/latex.ML
@@ -1,268 +1,307 @@
 (*  Title:      Pure/Thy/latex.ML
-    Author:     Markus Wenzel, TU Muenchen
+    Author:     Makarius
 
-LaTeX presentation elements -- based on outer lexical syntax.
+LaTeX output of theory sources.
 *)
 
 signature LATEX =
 sig
   type text
   val string: string -> text
   val text: string * Position.T -> text
   val block: text list -> text
   val enclose_body: string -> string -> text list -> text list
   val enclose_block: string -> string -> text list -> text
   val output_text: text list -> string
   val output_positions: Position.T -> text list -> string
   val output_name: string -> string
   val output_ascii: string -> string
   val output_ascii_breakable: string -> string -> string
   val output_symbols: Symbol.symbol list -> string
   val output_syms: string -> string
   val symbols: Symbol_Pos.T list -> text
   val symbols_output: Symbol_Pos.T list -> text
   val begin_delim: string -> string
   val end_delim: string -> string
   val begin_tag: string -> string
   val end_tag: string -> string
   val environment_block: string -> text list -> text
   val environment: string -> string -> string
   val isabelle_body: string -> text list -> text list
   val theory_entry: string -> string
+  val index_escape: string -> string
+  type index_item = {text: text, like: string}
+  val index_item: index_item -> text
+  type index_entry = {items: index_item list, def: bool}
+  val index_entry: index_entry -> text
+  val index_variants: (binding -> bool option -> 'a -> 'a) -> binding -> 'a -> 'a
   val latexN: string
   val latex_output: string -> string * int
   val latex_markup: string * Properties.T -> Markup.output
   val latex_indent: string -> int -> string
 end;
 
 structure Latex: LATEX =
 struct
 
 (* text with positions *)
 
 abstype text = Text of string * Position.T | Block of text list
 with
 
 fun string s = Text (s, Position.none);
 val text = Text;
 val block = Block;
 
+fun map_text f (Text (s, pos)) = Text (f s, pos)
+  | map_text f (Block texts) = Block ((map o map_text) f texts);
+
 fun output_text texts =
   let
     fun output (Text (s, _)) = Buffer.add s
       | output (Block body) = fold output body;
   in Buffer.empty |> fold output texts |> Buffer.content end;
 
 fun output_positions file_pos texts =
   let
     fun position (a, b) = enclose "%:%" "%:%" (a ^ "=" ^ b);
     fun add_position p positions =
       let val s = position (apply2 Value.print_int p)
       in positions |> s <> hd positions ? cons s end;
 
     fun output (Text (s, pos)) (positions, line) =
           let
             val positions' =
               (case Position.line_of pos of
                 NONE => positions
               | SOME l => add_position (line, l) positions);
             val line' = fold_string (fn c => fn n => if c = "\n" then n + 1 else n) s line;
           in (positions', line') end
       | output (Block body) res = fold output body res;
   in
     (case Position.file_of file_pos of
       NONE => ""
     | SOME file =>
         ([position (Markup.fileN, file), "\\endinput"], 1)
         |> fold output texts |> #1 |> rev |> cat_lines)
   end;
 
 end;
 
 fun enclose_body bg en body =
   (if bg = "" then [] else [string bg]) @ body @
   (if en = "" then [] else [string en]);
 
 fun enclose_block bg en = block o enclose_body bg en;
 
 
 (* output name for LaTeX macros *)
 
 val output_name =
   translate_string
     (fn "_" => "UNDERSCORE"
       | "'" => "PRIME"
       | "0" => "ZERO"
       | "1" => "ONE"
       | "2" => "TWO"
       | "3" => "THREE"
       | "4" => "FOUR"
       | "5" => "FIVE"
       | "6" => "SIX"
       | "7" => "SEVEN"
       | "8" => "EIGHT"
       | "9" => "NINE"
       | s => s);
 
 fun enclose_name bg en = enclose bg en o output_name;
 
 
 (* output verbatim ASCII *)
 
 val output_ascii =
   translate_string
     (fn " " => "\\ "
       | "\t" => "\\ "
       | "\n" => "\\isanewline\n"
       | s =>
           s
           |> exists_string (fn s' => s = s') "\"#$%&',-<>\\^_`{}~" ? enclose "{\\char`\\" "}"
           |> suffix "{\\kern0pt}");
 
 fun output_ascii_breakable sep =
   space_explode sep
   #> map output_ascii
   #> space_implode (output_ascii sep ^ "\\discretionary{}{}{}");
 
 
 (* output symbols *)
 
 local
 
 val char_table =
   Symtab.make
    [("\007", "{\\isacharbell}"),
     ("!", "{\\isacharbang}"),
     ("\"", "{\\isachardoublequote}"),
     ("#", "{\\isacharhash}"),
     ("$", "{\\isachardollar}"),
     ("%", "{\\isacharpercent}"),
     ("&", "{\\isacharampersand}"),
     ("'", "{\\isacharprime}"),
     ("(", "{\\isacharparenleft}"),
     (")", "{\\isacharparenright}"),
     ("*", "{\\isacharasterisk}"),
     ("+", "{\\isacharplus}"),
     (",", "{\\isacharcomma}"),
     ("-", "{\\isacharminus}"),
     (".", "{\\isachardot}"),
     ("/", "{\\isacharslash}"),
     (":", "{\\isacharcolon}"),
     (";", "{\\isacharsemicolon}"),
     ("<", "{\\isacharless}"),
     ("=", "{\\isacharequal}"),
     (">", "{\\isachargreater}"),
     ("?", "{\\isacharquery}"),
     ("@", "{\\isacharat}"),
     ("[", "{\\isacharbrackleft}"),
     ("\\", "{\\isacharbackslash}"),
     ("]", "{\\isacharbrackright}"),
     ("^", "{\\isacharcircum}"),
     ("_", "{\\isacharunderscore}"),
     ("`", "{\\isacharbackquote}"),
     ("{", "{\\isacharbraceleft}"),
     ("|", "{\\isacharbar}"),
     ("}", "{\\isacharbraceright}"),
     ("~", "{\\isachartilde}")];
 
 fun output_chr " " = "\\ "
   | output_chr "\t" = "\\ "
   | output_chr "\n" = "\\isanewline\n"
   | output_chr c =
       (case Symtab.lookup char_table c of
         SOME s => s ^ "{\\kern0pt}"
       | NONE => if Symbol.is_ascii_digit c then enclose "{\\isadigit{" "}}" c else c);
 
 fun output_sym sym =
   (case Symbol.decode sym of
     Symbol.Char s => output_chr s
   | Symbol.UTF8 s => s
   | Symbol.Sym s => enclose_name "{\\isasym" "}" s
   | Symbol.Control s => enclose_name "\\isactrl" " " s
   | Symbol.Malformed s => error (Symbol.malformed_msg s)
   | Symbol.EOF => error "Bad EOF symbol");
 
 open Basic_Symbol_Pos;
 
 val scan_latex_length =
   Scan.many1 (fn (s, _) => s <> Symbol.latex andalso Symbol.not_eof s)
     >> (Symbol.length o map Symbol_Pos.symbol) ||
   $$ Symbol.latex -- Scan.option (Scan.permissive Symbol_Pos.scan_cartouche "") >> K 0;
 
 val scan_latex =
   $$ Symbol.latex |-- Symbol_Pos.scan_cartouche_content "Embedded LaTeX: "
     >> (implode o map Symbol_Pos.symbol) ||
   Scan.one (Symbol.not_eof o Symbol_Pos.symbol) >> (output_sym o Symbol_Pos.symbol);
 
 fun read scan syms =
   Scan.read Symbol_Pos.stopper (Scan.repeat scan) (map (rpair Position.none) syms);
 
 in
 
 fun length_symbols syms =
   fold Integer.add (these (read scan_latex_length syms)) 0;
 
 fun output_symbols syms =
   if member (op =) syms Symbol.latex then
     (case read scan_latex syms of
       SOME ss => implode ss
     | NONE => error ("Malformed embedded LaTeX: " ^ quote (Symbol.beginning 10 syms)))
   else implode (map output_sym syms);
 
 val output_syms = output_symbols o Symbol.explode;
 
 end;
 
 fun symbols syms = text (Symbol_Pos.content syms, #1 (Symbol_Pos.range syms));
 fun symbols_output syms =
   text (output_symbols (map Symbol_Pos.symbol syms), #1 (Symbol_Pos.range syms));
 
 
 (* tags *)
 
 val begin_delim = enclose_name "%\n\\isadelim" "\n";
 val end_delim = enclose_name "%\n\\endisadelim" "\n";
 val begin_tag = enclose_name "%\n\\isatag" "\n";
 fun end_tag tg = enclose_name "%\n\\endisatag" "\n" tg ^ enclose "{\\isafold" "}%\n" tg;
 
 
 (* theory presentation *)
 
 fun environment_delim name =
  ("%\n\\begin{" ^ output_name name ^ "}%\n",
   "%\n\\end{" ^ output_name name ^ "}");
 
 fun environment_block name = environment_delim name |-> enclose_body #> block;
 fun environment name = environment_delim name |-> enclose;
 
 fun isabelle_body name =
   enclose_body
    ("%\n\\begin{isabellebody}%\n\\setisabellecontext{" ^ output_syms name ^ "}%\n")
    "%\n\\end{isabellebody}%\n";
 
 fun theory_entry name = "\\input{" ^ name ^ ".tex}\n\n";
 
 
+(* index entries *)
+
+type index_item = {text: text, like: string};
+type index_entry = {items: index_item list, def: bool};
+
+val index_escape =
+  translate_string (fn s =>
+    if member_string "!\"@|" s then "\\char" ^ string_of_int (ord s)
+    else if member_string "\\{}#" s then "\"" ^ s else s);
+
+fun index_item (item: index_item) =
+  let
+    val like_text =
+      if #like item = "" then []
+      else [string (index_escape (#like item) ^ "@")];
+  in block (like_text @ [map_text index_escape (#text item)]) end;
+
+fun index_entry (entry: index_entry) =
+  (separate (string "!") (map index_item (#items entry)) @
+    [string ("|" ^ index_escape (if #def entry then "isaindexdef" else "isaindexref"))])
+  |> enclose_block "\\index{" "}";
+
+
+fun index_binding NONE = I
+  | index_binding (SOME def) = Binding.map_name (suffix (if def then "_def" else "_ref"));
+
+fun index_variants setup binding =
+  fold (fn index => setup (index_binding index binding) index) [NONE, SOME true, SOME false];
+
+
 (* print mode *)
 
 val latexN = "latex";
 
 fun latex_output str =
   let val syms = Symbol.explode str
   in (output_symbols syms, length_symbols syms) end;
 
 fun latex_markup (s, _: Properties.T) =
   if s = Markup.commandN orelse s = Markup.keyword1N orelse s = Markup.keyword3N
   then ("\\isacommand{", "}")
   else if s = Markup.keyword2N
   then ("\\isakeyword{", "}")
   else Markup.no_output;
 
 fun latex_indent "" _ = ""
   | latex_indent s _ = enclose "\\isaindent{" "}" s;
 
 val _ = Output.add_mode latexN latex_output (prefix Symbol.latex o cartouche);
 val _ = Markup.add_mode latexN latex_markup;
 val _ = Pretty.add_mode latexN latex_indent;
 
 end;
diff --git a/src/Pure/Thy/latex.scala b/src/Pure/Thy/latex.scala
--- a/src/Pure/Thy/latex.scala
+++ b/src/Pure/Thy/latex.scala
@@ -1,182 +1,182 @@
 /*  Title:      Pure/Thy/latex.scala
     Author:     Makarius
 
 Support for LaTeX.
 */
 
 package isabelle
 
 
 import java.io.{File => JFile}
 
 import scala.annotation.tailrec
 import scala.util.matching.Regex
 
 
 object Latex
 {
   /** latex errors **/
 
   def latex_errors(dir: Path, root_name: String): List[String] =
   {
     val root_log_path = dir + Path.explode(root_name).ext("log")
     if (root_log_path.is_file) {
       for { (msg, pos) <- filter_errors(dir, File.read(root_log_path)) }
-      yield "Latex error" + Position.here(pos) + ":\n" + Library.prefix_lines("  ", msg)
+      yield "Latex error" + Position.here(pos) + ":\n" + Library.indent_lines(2, msg)
     }
     else Nil
   }
 
 
   /* generated .tex file */
 
   private val File_Pattern = """^%:%file=(.+)%:%$""".r
   private val Line_Pattern = """^*%:%(\d+)=(\d+)%:%$""".r
 
   def read_tex_file(tex_file: Path): Tex_File =
   {
     val positions =
       Line.logical_lines(File.read(tex_file)).reverse.
         takeWhile(_ != "\\endinput").reverse
 
     val source_file =
       positions match {
         case File_Pattern(file) :: _ => Some(file)
         case _ => None
       }
 
     val source_lines =
       if (source_file.isEmpty) Nil
       else
         positions.flatMap(line =>
           line match {
             case Line_Pattern(Value.Int(line), Value.Int(source_line)) => Some(line -> source_line)
             case _ => None
           })
 
     new Tex_File(tex_file, source_file, source_lines)
   }
 
   final class Tex_File private[Latex](
     tex_file: Path, source_file: Option[String], source_lines: List[(Int, Int)])
   {
     override def toString: String = tex_file.toString
 
     def source_position(l: Int): Option[Position.T] =
       source_file match {
         case None => None
         case Some(file) =>
           val source_line =
             source_lines.iterator.takeWhile({ case (m, _) => m <= l }).
               foldLeft(0) { case (_, (_, n)) => n }
           if (source_line == 0) None else Some(Position.Line_File(source_line, file))
       }
 
     def position(line: Int): Position.T =
       source_position(line) getOrElse Position.Line_File(line, tex_file.implode)
   }
 
 
   /* latex log */
 
   def filter_errors(dir: Path, root_log: String): List[(String, Position.T)] =
   {
     val seen_files = Synchronized(Map.empty[JFile, Tex_File])
 
     def check_tex_file(path: Path): Option[Tex_File] =
       seen_files.change_result(seen =>
         seen.get(path.file) match {
           case None =>
             if (path.is_file) {
               val tex_file = read_tex_file(path)
               (Some(tex_file), seen + (path.file -> tex_file))
             }
             else (None, seen)
           case some => (some, seen)
         })
 
     def tex_file_position(path: Path, line: Int): Position.T =
       check_tex_file(path) match {
         case Some(tex_file) => tex_file.position(line)
         case None => Position.Line_File(line, path.implode)
       }
 
     object File_Line_Error
     {
       val Pattern: Regex = """^(.*?\.\w\w\w):(\d+): (.*)$""".r
       def unapply(line: String): Option[(Path, Int, String)] =
         line match {
           case Pattern(file, Value.Int(line), message) =>
             val path = File.standard_path(file)
             if (Path.is_wellformed(path)) {
               val file = (dir + Path.explode(path)).canonical
               val msg = Library.perhaps_unprefix("LaTeX Error: ", message)
               if (file.is_file) Some((file, line, msg)) else None
             }
             else None
           case _ => None
         }
     }
 
     val Line_Error = """^l\.\d+ (.*)$""".r
     val More_Error =
       List(
         "<argument>",
         "<template>",
         "<recently read>",
         "<to be read again>",
         "<inserted text>",
         "<output>",
         "<everypar>",
         "<everymath>",
         "<everydisplay>",
         "<everyhbox>",
         "<everyvbox>",
         "<everyjob>",
         "<everycr>",
         "<mark>",
         "<everyeof>",
         "<write>").mkString("^(?:", "|", ") (.*)$").r
 
     val Bad_Font = """^LaTeX Font Warning: (Font .*\btxmia\b.* undefined).*$""".r
     val Bad_File = """^! LaTeX Error: (File `.*' not found\.)$""".r
 
     val error_ignore =
       Set(
         "See the LaTeX manual or LaTeX Companion for explanation.",
         "Type  H <return>  for immediate help.")
 
     def error_suffix1(lines: List[String]): Option[String] =
     {
       val lines1 =
         lines.take(20).takeWhile({ case File_Line_Error((_, _, _)) => false case _ => true })
       lines1.zipWithIndex.collectFirst({
         case (Line_Error(msg), i) =>
           cat_lines(lines1.take(i).filterNot(error_ignore) ::: List(msg)) })
     }
     def error_suffix2(lines: List[String]): Option[String] =
       lines match {
         case More_Error(msg) :: _ => Some(msg)
         case _ => None
       }
 
     @tailrec def filter(lines: List[String], result: List[(String, Position.T)])
       : List[(String, Position.T)] =
     {
       lines match {
         case File_Line_Error((file, line, msg1)) :: rest1 =>
           val pos = tex_file_position(file, line)
           val msg2 = error_suffix1(rest1) orElse error_suffix2(rest1) getOrElse ""
           filter(rest1, (Exn.cat_message(msg1, msg2), pos) :: result)
         case Bad_Font(msg) :: rest =>
           filter(rest, (msg, Position.none) :: result)
         case Bad_File(msg) :: rest =>
           filter(rest, (msg, Position.none) :: result)
         case _ :: rest => filter(rest, result)
         case Nil => result.reverse
       }
     }
 
     filter(Line.logical_lines(root_log), Nil)
   }
 }
diff --git a/src/Pure/Thy/presentation.scala b/src/Pure/Thy/presentation.scala
--- a/src/Pure/Thy/presentation.scala
+++ b/src/Pure/Thy/presentation.scala
@@ -1,871 +1,502 @@
-/*  Title:      Pure/Thy/present.scala
+/*  Title:      Pure/Thy/presentation.scala
     Author:     Makarius
 
-HTML/PDF presentation of theory documents.
+HTML presentation of PIDE document content.
 */
 
 package isabelle
 
 
 import scala.collection.immutable.SortedMap
 
 
 object Presentation
 {
   /** HTML documents **/
 
+  /* HTML context */
+
   val fonts_path = Path.explode("fonts")
 
   sealed case class HTML_Document(title: String, content: String)
 
   def html_context(fonts_url: String => String = HTML.fonts_url()): HTML_Context =
     new HTML_Context(fonts_url)
 
   final class HTML_Context private[Presentation](fonts_url: String => String)
   {
     def init_fonts(dir: Path): Unit =
     {
       val fonts_dir = Isabelle_System.make_directory(dir + fonts_path)
       for (entry <- Isabelle_Fonts.fonts(hidden = true))
         Isabelle_System.copy_file(entry.path, fonts_dir)
     }
 
     def head(title: String, rest: XML.Body = Nil): XML.Tree =
       HTML.div("head", HTML.chapter(title) :: rest)
 
     def source(body: XML.Body): XML.Tree = HTML.pre("source", body)
 
     def contents(heading: String, items: List[XML.Body], css_class: String = "contents")
       : List[XML.Elem] =
     {
       if (items.isEmpty) Nil
       else List(HTML.div(css_class, List(HTML.section(heading), HTML.itemize(items))))
     }
 
     def output_document(title: String, body: XML.Body): String =
       HTML.output_document(
         List(
           HTML.style(HTML.fonts_css(fonts_url) + "\n\n" + File.read(HTML.isabelle_css)),
           HTML.title(title)),
         List(HTML.source(body)), css = "", structural = false)
 
     def html_document(title: String, body: XML.Body): HTML_Document =
       HTML_Document(title, output_document(title, body))
   }
 
 
   /* presentation elements */
 
   sealed case class Elements(
     html: Markup.Elements = Markup.Elements.empty,
     entity: Markup.Elements = Markup.Elements.empty,
     language: Markup.Elements = Markup.Elements.empty)
 
   val elements1: Elements =
     Elements(
       html =
         Rendering.foreground_elements ++ Rendering.text_color_elements +
         Markup.NUMERAL + Markup.COMMENT + Markup.ENTITY + Markup.LANGUAGE,
       entity = Markup.Elements(Markup.THEORY))
 
   val elements2: Elements =
     Elements(
       html = elements1.html ++ Rendering.markdown_elements,
       language = Markup.Elements(Markup.Language.DOCUMENT))
 
 
-  /* HTML */
+  /* HTML output */
 
   private val div_elements =
     Set(HTML.div.name, HTML.pre.name, HTML.par.name, HTML.list.name, HTML.enum.name,
       HTML.descr.name)
 
   def make_html(
     elements: Elements,
     entity_link: (Properties.T, XML.Body) => Option[XML.Tree],
     xml: XML.Body): XML.Body =
   {
     def html_div(html: XML.Body): Boolean =
       html exists {
         case XML.Elem(markup, body) => div_elements.contains(markup.name) || html_div(body)
         case XML.Text(_) => false
       }
 
     def html_class(c: String, html: XML.Body): XML.Body =
       if (c == "") html
       else if (html_div(html)) List(HTML.div(c, html))
       else List(HTML.span(c, html))
 
     def html_body(xml_body: XML.Body): XML.Body =
       xml_body flatMap {
         case XML.Wrapped_Elem(markup, _, body) => html_body(List(XML.Elem(markup, body)))
         case XML.Elem(Markup(Markup.ENTITY, props @ Markup.Kind(kind)), body) =>
           val body1 = html_body(body)
           if (elements.entity(kind)) {
             entity_link(props, body1) match {
               case Some(link) => List(link)
               case None => body1
             }
           }
           else body1
         case XML.Elem(Markup(Markup.LANGUAGE, Markup.Name(name)), body) =>
           html_class(if (elements.language(name)) name else "", html_body(body))
         case XML.Elem(Markup(Markup.MARKDOWN_PARAGRAPH, _), body) =>
           List(HTML.par(html_body(body)))
         case XML.Elem(Markup(Markup.MARKDOWN_ITEM, _), body) =>
           List(HTML.item(html_body(body)))
         case XML.Elem(Markup(Markup.Markdown_Bullet.name, _), _) => Nil
         case XML.Elem(Markup.Markdown_List(kind), body) =>
           if (kind == Markup.ENUMERATE) List(HTML.enum(html_body(body)))
           else List(HTML.list(html_body(body)))
         case XML.Elem(markup, body) =>
           val name = markup.name
           val html =
             markup.properties match {
               case Markup.Kind(kind) if kind == Markup.COMMAND || kind == Markup.KEYWORD =>
                 html_class(kind, html_body(body))
               case _ =>
                 html_body(body)
             }
           Rendering.foreground.get(name) orElse Rendering.text_color.get(name) match {
             case Some(c) => html_class(c.toString, html)
             case None => html_class(name, html)
           }
         case XML.Text(text) =>
           HTML.text(Symbol.decode(text))
       }
 
     html_body(xml)
   }
 
 
   /* PIDE HTML document */
 
   def html_document(
     resources: Resources,
     snapshot: Document.Snapshot,
     html_context: HTML_Context,
     elements: Elements,
     plain_text: Boolean = false): HTML_Document =
   {
     require(!snapshot.is_outdated, "document snapshot outdated")
 
     val name = snapshot.node_name
     if (plain_text) {
       val title = "File " + Symbol.cartouche_decoded(name.path.file_name)
       val body = HTML.text(snapshot.node.source)
       html_context.html_document(title, body)
     }
     else {
       resources.html_document(snapshot) getOrElse {
         val title =
           if (name.is_theory) "Theory " + quote(name.theory_base_name)
           else "File " + Symbol.cartouche_decoded(name.path.file_name)
         val body = make_html(elements, (_, _) => None, snapshot.xml_markup(elements = elements.html))
         html_context.html_document(title, body)
       }
     }
   }
 
 
 
-  /** PDF LaTeX documents **/
-
-  /* document info */
-
-  abstract class Document_Name
-  {
-    def name: String
-    def path: Path = Path.basic(name)
-
-    override def toString: String = name
-  }
-
-  object Document_Variant
-  {
-    def parse(name: String, tags: String): Document_Variant =
-      Document_Variant(name, Library.space_explode(',', tags))
-
-    def parse(opt: String): Document_Variant =
-      Library.space_explode('=', opt) match {
-        case List(name) => Document_Variant(name, Nil)
-        case List(name, tags) => parse(name, tags)
-        case _ => error("Malformed document variant: " + quote(opt))
-      }
-  }
-
-  sealed case class Document_Variant(name: String, tags: List[String]) extends Document_Name
-  {
-    def print_tags: String = tags.mkString(",")
-    def print: String = if (tags.isEmpty) name else name + "=" + print_tags
-
-    def latex_sty: String =
-      Library.terminate_lines(
-        tags.map(tag =>
-          tag.toList match {
-            case '/' :: cs => "\\isafoldtag{" + cs.mkString + "}"
-            case '-' :: cs => "\\isadroptag{" + cs.mkString + "}"
-            case '+' :: cs => "\\isakeeptag{" + cs.mkString + "}"
-            case cs => "\\isakeeptag{" + cs.mkString + "}"
-          }))
-  }
-
-  sealed case class Document_Input(name: String, sources: SHA1.Digest)
-    extends Document_Name
-
-  sealed case class Document_Output(name: String, sources: SHA1.Digest, log_xz: Bytes, pdf: Bytes)
-    extends Document_Name
-  {
-    def log: String = log_xz.uncompress().text
-    def log_lines: List[String] = split_lines(log)
-
-    def write(db: SQL.Database, session_name: String): Unit =
-      write_document(db, session_name, this)
-  }
-
-
-  /* SQL data model */
-
-  object Data
-  {
-    val session_name = SQL.Column.string("session_name").make_primary_key
-    val name = SQL.Column.string("name").make_primary_key
-    val sources = SQL.Column.string("sources")
-    val log_xz = SQL.Column.bytes("log_xz")
-    val pdf = SQL.Column.bytes("pdf")
-
-    val table = SQL.Table("isabelle_documents", List(session_name, name, sources, log_xz, pdf))
-
-    def where_equal(session_name: String, name: String = ""): SQL.Source =
-      "WHERE " + Data.session_name.equal(session_name) +
-        (if (name == "") "" else " AND " + Data.name.equal(name))
-  }
-
-  def read_documents(db: SQL.Database, session_name: String): List[Document_Input] =
-  {
-    val select = Data.table.select(List(Data.name, Data.sources), Data.where_equal(session_name))
-    db.using_statement(select)(stmt =>
-      stmt.execute_query().iterator(res =>
-      {
-        val name = res.string(Data.name)
-        val sources = res.string(Data.sources)
-        Document_Input(name, SHA1.fake(sources))
-      }).toList)
-  }
-
-  def read_document(db: SQL.Database, session_name: String, name: String): Option[Document_Output] =
-  {
-    val select = Data.table.select(sql = Data.where_equal(session_name, name))
-    db.using_statement(select)(stmt =>
-    {
-      val res = stmt.execute_query()
-      if (res.next()) {
-        val name = res.string(Data.name)
-        val sources = res.string(Data.sources)
-        val log_xz = res.bytes(Data.log_xz)
-        val pdf = res.bytes(Data.pdf)
-        Some(Document_Output(name, SHA1.fake(sources), log_xz, pdf))
-      }
-      else None
-    })
-  }
-
-  def write_document(db: SQL.Database, session_name: String, doc: Document_Output): Unit =
-  {
-    db.using_statement(Data.table.insert())(stmt =>
-    {
-      stmt.string(1) = session_name
-      stmt.string(2) = doc.name
-      stmt.string(3) = doc.sources.toString
-      stmt.bytes(4) = doc.log_xz
-      stmt.bytes(5) = doc.pdf
-      stmt.execute()
-    })
-  }
-
+  /** HTML presentation **/
 
   /* presentation context */
 
   object Context
   {
     val none: Context = new Context { def enabled: Boolean = false }
     val standard: Context = new Context { def enabled: Boolean = true }
 
     def dir(path: Path): Context =
       new Context {
         def enabled: Boolean = true
         override def dir(store: Sessions.Store): Path = path
       }
 
     def make(s: String): Context =
       if (s == ":") standard else dir(Path.explode(s))
   }
 
   abstract class Context private
   {
     def enabled: Boolean
     def enabled(info: Sessions.Info): Boolean = enabled || info.browser_info
     def dir(store: Sessions.Store): Path = store.presentation_dir
     def dir(store: Sessions.Store, info: Sessions.Info): Path =
       dir(store) + Path.explode(info.chapter_session)
   }
 
 
-
-  /** HTML presentation **/
-
   /* maintain chapter index */
 
   private val sessions_path = Path.basic(".sessions")
 
   private def read_sessions(dir: Path): List[(String, String)] =
   {
     val path = dir + sessions_path
     if (path.is_file) {
       import XML.Decode._
       list(pair(string, string))(Symbol.decode_yxml(File.read(path)))
     }
     else Nil
   }
 
   private def write_sessions(dir: Path, sessions: List[(String, String)]): Unit =
   {
     import XML.Encode._
     File.write(dir + sessions_path, YXML.string_of_body(list(pair(string, string))(sessions)))
   }
 
   def update_chapter_index(
     browser_info: Path, chapter: String, new_sessions: List[(String, String)]): Unit =
   {
     val dir = Isabelle_System.make_directory(browser_info + Path.basic(chapter))
 
     val sessions0 =
       try { read_sessions(dir) }
       catch { case _: XML.Error => Nil }
 
     val sessions = (SortedMap.empty[String, String] ++ sessions0 ++ new_sessions).toList
     write_sessions(dir, sessions)
 
     val title = "Isabelle/" + chapter + " sessions"
     HTML.write_document(dir, "index.html",
       List(HTML.title(title + Isabelle_System.isabelle_heading())),
       HTML.chapter(title) ::
        (if (sessions.isEmpty) Nil
         else
           List(HTML.div("sessions",
             List(HTML.description(
               sessions.map({ case (name, description) =>
                 val descr = Symbol.trim_blank_lines(description)
                 (List(HTML.link(name + "/index.html", HTML.text(name))),
                   if (descr == "") Nil
                   else HTML.break ::: List(HTML.pre(HTML.text(descr)))) })))))))
   }
 
   def make_global_index(browser_info: Path): Unit =
   {
     if (!(browser_info + Path.explode("index.html")).is_file) {
       Isabelle_System.make_directory(browser_info)
       Isabelle_System.copy_file(Path.explode("~~/lib/logo/isabelle.gif"),
         browser_info + Path.explode("isabelle.gif"))
       val title = "The " + XML.text(Isabelle_System.isabelle_name()) + " Library"
       File.write(browser_info + Path.explode("index.html"),
         HTML.header +
 """
 <head>
   """ + HTML.head_meta + """
   <title>""" + title + """</title>
 </head>
 
 <body text="#000000" bgcolor="#FFFFFF" link="#0000FF" vlink="#000099" alink="#404040">
   <center>
     <table width="100%" border="0" cellspacing="10" cellpadding="0">
       <tr>
         <td width="20%" valign="middle" align="center"><a href="http://isabelle.in.tum.de/"><img align="bottom" src="isabelle.gif" width="100" height="86" alt="[Isabelle]" border="0" /></a></td>
 
         <td width="80%" valign="middle" align="center">
           <table width="90%" border="0" cellspacing="0" cellpadding="20">
             <tr>
               <td valign="middle" align="center" bgcolor="#AACCCC"><font face="Helvetica,Arial" size="+2">""" + title + """</font></td>
             </tr>
           </table>
         </td>
       </tr>
     </table>
   </center>
   <hr />
   <ul>
     <li>Higher-Order Logic</li>
 
     <li style="list-style: none">
       <ul>
         <li><a href="HOL/index.html">HOL (Higher-Order Logic)</a>
         is a version of classical higher-order logic resembling
         that of the <a href="http://www.cl.cam.ac.uk/Research/HVG/HOL/">HOL System</a>.
         </li>
       </ul>
     </li>
   </ul>
 
   <ul>
     <li>First-Order Logic</li>
 
     <li style="list-style: none">
       <ul>
         <li><a href="FOL/index.html">FOL (Many-sorted First-Order Logic)</a>
         provides basic classical and intuitionistic first-order logic. It is
         polymorphic.
         </li>
 
         <li><a href="ZF/index.html">ZF (Set Theory)</a>
         offers a formulation of Zermelo-Fraenkel set theory on top of FOL.
         </li>
 
         <li><a href="CCL/index.html">CCL (Classical Computational Logic)</a></li>
 
         <li><a href="LCF/index.html">LCF (Logic of Computable Functions)</a></li>
 
         <li><a href="FOLP/index.html">FOLP (FOL with Proof Terms)</a></li>
       </ul>
     </li>
   </ul>
 
   <ul>
     <li>Miscellaneous</li>
 
     <li style="list-style: none">
       <ul>
         <li><a href="Sequents/index.html">Sequents (first-order, modal and linear logics)</a></li>
 
         <li><a href="CTT/index.html">CTT (Constructive Type Theory)</a>
         is an extensional version of Martin-L&ouml;f's Type Theory.</li>
 
         <li><a href="Cube/index.html">Cube (The Lambda Cube)</a></li>
 
         <li><a href="Pure/index.html">The Pure logical framework</a></li>
 
         <li><a href="Doc/index.html">Sources of Documentation</a></li>
       </ul>
     </li>
   </ul>
 </body>
 """ + HTML.footer)
     }
   }
 
 
   /* present session */
 
   val session_graph_path = Path.explode("session_graph.pdf")
   val readme_path = Path.explode("README.html")
   val files_path = Path.explode("files")
 
   def html_name(name: Document.Node.Name): String = name.theory_base_name + ".html"
 
   def theory_link(deps: Sessions.Deps, session0: String,
     name: Document.Node.Name, body: XML.Body): Option[XML.Tree] =
   {
     val session1 = deps(session0).theory_qualifier(name)
     val info0 = deps.sessions_structure.get(session0)
     val info1 = deps.sessions_structure.get(session1)
     if (info0.isDefined && info1.isDefined) {
       Some(HTML.link(info0.get.relative_path(info1.get) + html_name(name), body))
     }
     else None
   }
 
   def session_html(
     resources: Resources,
     session: String,
     deps: Sessions.Deps,
     db_context: Sessions.Database_Context,
     progress: Progress = new Progress,
     verbose: Boolean = false,
     html_context: HTML_Context,
     elements: Elements,
     presentation: Context): Unit =
   {
     val info = deps.sessions_structure(session)
     val options = info.options
     val base = deps(session)
 
     val session_dir = presentation.dir(db_context.store, info)
 
     html_context.init_fonts(session_dir)
 
     Bytes.write(session_dir + session_graph_path,
       graphview.Graph_File.make_pdf(options, base.session_graph_display))
 
     val documents =
       for {
         doc <- info.document_variants
-        document <- db_context.input_database(session)(read_document(_, _, doc.name))
+        document <- db_context.input_database(session)(Document_Build.read_document(_, _, doc.name))
       } yield {
         if (verbose) progress.echo("Presenting document " + session + "/" + doc.name)
         Bytes.write(session_dir + doc.path.pdf, document.pdf)
         doc
       }
 
     val view_links =
     {
       val deps_link =
         HTML.link(session_graph_path, HTML.text("theory dependencies"))
 
       val readme_links =
         if ((info.dir + readme_path).is_file) {
           Isabelle_System.copy_file(info.dir + readme_path, session_dir + readme_path)
           List(HTML.link(readme_path, HTML.text("README")))
         }
         else Nil
 
       val document_links =
         documents.map(doc => HTML.link(doc.path.pdf, HTML.text(doc.name)))
 
       Library.separate(HTML.break ::: HTML.nl,
         (deps_link :: readme_links ::: document_links).
           map(link => HTML.text("View ") ::: List(link))).flatten
     }
 
     val theories: List[XML.Body] =
     {
       var seen_files = List.empty[(Path, String, Document.Node.Name)]
 
       def entity_link(props: Properties.T, body: XML.Body): Option[XML.Tree] =
         (props, props, props) match {
           case (Markup.Kind(Markup.THEORY), Markup.Name(theory), Position.Def_File(thy_file)) =>
             val node_name = resources.file_node(Path.explode(thy_file), theory = theory)
             theory_link(deps, session, node_name, body)
           case _ => None
         }
 
       sealed case class Theory(
         name: Document.Node.Name,
         command: Command,
         files_html: List[(Path, XML.Tree)],
         html: XML.Tree)
 
       def read_theory(name: Document.Node.Name): Option[Theory] =
       {
         progress.expose_interrupt()
         if (verbose) progress.echo("Presenting theory " + name)
 
         for (command <- Build_Job.read_theory(db_context, resources, session, name.theory))
         yield {
           val snapshot = Document.State.init.snippet(command)
 
           val files_html =
             for {
               (src_path, xml) <- snapshot.xml_markup_blobs(elements = elements.html)
               if xml.nonEmpty
             }
             yield {
               progress.expose_interrupt()
               if (verbose) progress.echo("Presenting file " + src_path)
 
               (src_path, html_context.source(make_html(elements, entity_link, xml)))
             }
 
           val html =
             html_context.source(
               make_html(elements, entity_link, snapshot.xml_markup(elements = elements.html)))
 
           Theory(name, command, files_html, html)
         }
       }
 
       for (thy <- Par_List.map(read_theory, base.session_theories).flatten)
       yield {
         val files =
           for { (src_path, file_html) <- thy.files_html }
           yield {
             val file_name = (files_path + src_path.squash.html).implode
 
             seen_files.find(p => p._1 == src_path || p._2 == file_name) match {
               case None => seen_files ::= (src_path, file_name, thy.name)
               case Some((_, _, thy_name1)) =>
                 error("Incoherent use of file name " + src_path + " as " + quote(file_name) +
                   " in theory " + thy_name1 + " vs. " + thy.name)
             }
 
             val file_path = session_dir + Path.explode(file_name)
             html_context.init_fonts(file_path.dir)
 
             val file_title = "File " + Symbol.cartouche_decoded(src_path.implode_short)
             HTML.write_document(file_path.dir, file_path.file_name,
               List(HTML.title(file_title)), List(html_context.head(file_title), file_html))
 
             List(HTML.link(file_name, HTML.text(file_title)))
           }
 
         val thy_title = "Theory " + thy.name.theory_base_name
 
         HTML.write_document(session_dir, html_name(thy.name),
           List(HTML.title(thy_title)), List(html_context.head(thy_title), thy.html))
 
         List(HTML.link(html_name(thy.name),
           HTML.text(thy.name.theory_base_name) :::
             (if (files.isEmpty) Nil else List(HTML.itemize(files)))))
       }
     }
 
     val title = "Session " + session
     HTML.write_document(session_dir, "index.html",
       List(HTML.title(title + Isabelle_System.isabelle_heading())),
       html_context.head(title, List(HTML.par(view_links))) ::
         html_context.contents("Theories", theories))
   }
-
-
-
-  /** build documents **/
-
-  val session_tex_path = Path.explode("session.tex")
-
-  def tex_name(name: Document.Node.Name): String = name.theory_base_name + ".tex"
-  def document_tex_name(name: Document.Node.Name): String = "document/" + tex_name(name)
-
-  class Build_Error(val log_lines: List[String], val message: String)
-    extends Exn.User_Error(message)
-
-  def build_documents(
-    session: String,
-    deps: Sessions.Deps,
-    db_context: Sessions.Database_Context,
-    progress: Progress = new Progress,
-    output_sources: Option[Path] = None,
-    output_pdf: Option[Path] = None,
-    verbose: Boolean = false,
-    verbose_latex: Boolean = false): List[Document_Output] =
-  {
-    /* session info */
-
-    val info = deps.sessions_structure(session)
-    val hierarchy = deps.sessions_structure.hierarchy(session)
-    val options = info.options
-    val base = deps(session)
-    val graph_pdf = graphview.Graph_File.make_pdf(options, base.session_graph_display)
-
-
-    /* prepare document directory */
-
-    lazy val tex_files =
-      for (name <- base.session_theories ::: base.document_theories)
-      yield {
-        val entry = db_context.get_export(hierarchy, name.theory, document_tex_name(name))
-        Path.basic(tex_name(name)) -> entry.uncompressed
-      }
-
-    def prepare_dir1(dir: Path, doc: Document_Variant): (Path, String) =
-    {
-      val doc_dir = dir + Path.basic(doc.name)
-      Isabelle_System.make_directory(doc_dir)
-
-      Isabelle_System.bash("isabelle latex -o sty", cwd = doc_dir.file).check
-      File.write(doc_dir + Path.explode("isabelletags.sty"), doc.latex_sty)
-      for ((base_dir, src) <- info.document_files) {
-        Isabelle_System.copy_file_base(info.dir + base_dir, src, doc_dir)
-      }
-
-      File.write(doc_dir + session_tex_path,
-        Library.terminate_lines(
-          base.session_theories.map(name => "\\input{" + tex_name(name) + "}")))
-
-      for ((path, tex) <- tex_files) Bytes.write(doc_dir + path, tex)
-
-      val root1 = "root_" + doc.name
-      val root = if ((doc_dir + Path.explode(root1).tex).is_file) root1 else "root"
-
-      (doc_dir, root)
-    }
-
-    def prepare_dir2(dir: Path, doc: Document_Variant): Unit =
-    {
-      val doc_dir = dir + Path.basic(doc.name)
-
-      // non-deterministic, but irrelevant
-      Bytes.write(doc_dir + session_graph_path, graph_pdf)
-    }
-
-
-    /* produce documents */
-
-    val documents =
-      for (doc <- info.documents)
-      yield {
-        Isabelle_System.with_tmp_dir("document")(tmp_dir =>
-        {
-          progress.echo("Preparing " + session + "/" + doc.name + " ...")
-          val start = Time.now()
-
-
-          // prepare sources
-
-          val (doc_dir, root) = prepare_dir1(tmp_dir, doc)
-          val digests = File.find_files(doc_dir.file, follow_links = true).map(SHA1.digest)
-          val sources = SHA1.digest_set(digests)
-          prepare_dir2(tmp_dir, doc)
-
-          for (dir <- output_sources) {
-            prepare_dir1(dir, doc)
-            prepare_dir2(dir, doc)
-          }
-
-
-          // old document from database
-
-          val old_document =
-            for {
-              old_doc <- db_context.input_database(session)(read_document(_, _, doc.name))
-              if old_doc.sources == sources
-            }
-            yield {
-              Bytes.write(doc_dir + doc.path.pdf, old_doc.pdf)
-              old_doc
-            }
-
-          old_document getOrElse {
-            // bash scripts
-
-            def root_bash(ext: String): String = Bash.string(root + "." + ext)
-
-            def latex_bash(fmt: String = "pdf", ext: String = "tex"): String =
-              "isabelle latex -o " + Bash.string(fmt) + " " + Bash.string(root + "." + ext)
-
-            def bash(items: String*): Process_Result =
-              progress.bash(items.mkString(" && "), cwd = doc_dir.file,
-                echo = verbose_latex, watchdog = Time.seconds(0.5))
-
-
-            // prepare document
-
-            val result =
-              if ((doc_dir + Path.explode("build")).is_file) {
-                bash("./build pdf " + Bash.string(doc.name))
-              }
-              else {
-                bash(
-                  latex_bash(),
-                  "{ [ ! -f " + root_bash("bib") + " ] || " + latex_bash("bbl") + "; }",
-                  "{ [ ! -f " + root_bash("idx") + " ] || " + latex_bash("idx") + "; }",
-                  latex_bash(),
-                  latex_bash())
-              }
-
-
-            // result
-
-            val root_pdf = Path.basic(root).pdf
-            val result_path = doc_dir + root_pdf
-
-            val log_lines = result.out_lines ::: result.err_lines
-
-            val errors =
-              (if (result.ok) Nil else List(result.err)) :::
-              Latex.latex_errors(doc_dir, root) :::
-              Bibtex.bibtex_errors(doc_dir, root)
-
-            if (errors.nonEmpty) {
-              val message =
-                Exn.cat_message(
-                  (errors ::: List("Failed to build document " + quote(doc.name))):_*)
-              throw new Build_Error(log_lines, message)
-            }
-            else if (!result_path.is_file) {
-              val message = "Bad document result: expected to find " + root_pdf
-              throw new Build_Error(log_lines, message)
-            }
-            else {
-              val stop = Time.now()
-              val timing = stop - start
-              progress.echo("Finished " + session + "/" + doc.name +
-                " (" + timing.message_hms + " elapsed time)")
-
-              val log_xz = Bytes(cat_lines(log_lines)).compress()
-              val pdf = Bytes.read(result_path)
-              Document_Output(doc.name, sources, log_xz, pdf)
-            }
-          }
-        })
-      }
-
-    for (dir <- output_pdf; doc <- documents) {
-      Isabelle_System.make_directory(dir)
-      val path = dir + doc.path.pdf
-      Bytes.write(path, doc.pdf)
-      progress.echo("Document at " + path.absolute)
-    }
-
-    documents
-  }
-
-
-  /* Isabelle tool wrapper */
-
-  val isabelle_tool =
-    Isabelle_Tool("document", "prepare session theory document", Scala_Project.here, args =>
-    {
-      var output_sources: Option[Path] = None
-      var output_pdf: Option[Path] = None
-      var verbose_latex = false
-      var dirs: List[Path] = Nil
-      var options = Options.init()
-      var verbose_build = false
-
-      val getopts = Getopts(
-        """
-Usage: isabelle document [OPTIONS] SESSION
-
-  Options are:
-    -O DIR       output directory for LaTeX sources and resulting PDF
-    -P DIR       output directory for resulting PDF
-    -S DIR       output directory for LaTeX sources
-    -V           verbose latex
-    -d DIR       include session directory
-    -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
-    -v           verbose build
-
-  Prepare the theory document of a session.
-""",
-        "O:" -> (arg =>
-          {
-            val dir = Path.explode(arg)
-            output_sources = Some(dir)
-            output_pdf = Some(dir)
-          }),
-        "P:" -> (arg => { output_pdf = Some(Path.explode(arg)) }),
-        "S:" -> (arg => { output_sources = Some(Path.explode(arg)) }),
-        "V" -> (_ => verbose_latex = true),
-        "d:" -> (arg => dirs = dirs ::: List(Path.explode(arg))),
-        "o:" -> (arg => options = options + arg),
-        "v" -> (_ => verbose_build = true))
-
-      val more_args = getopts(args)
-      val session =
-        more_args match {
-          case List(a) => a
-          case _ => getopts.usage()
-        }
-
-      val progress = new Console_Progress(verbose = verbose_build)
-      val store = Sessions.store(options)
-
-      progress.interrupt_handler {
-        val res =
-          Build.build(options, selection = Sessions.Selection.session(session),
-            dirs = dirs, progress = progress, verbose = verbose_build)
-        if (!res.ok) error("Failed to build session " + quote(session))
-
-        val deps =
-          Sessions.load_structure(options + "document=pdf", dirs = dirs).
-            selection_deps(Sessions.Selection.session(session))
-
-        if (output_sources.isEmpty && output_pdf.isEmpty) {
-          progress.echo_warning("No output directory")
-        }
-
-        using(store.open_database_context())(db_context =>
-          build_documents(session, deps, db_context, progress = progress,
-            output_sources = output_sources, output_pdf = output_pdf,
-            verbose = true, verbose_latex = verbose_latex))
-      }
-    })
 }
diff --git a/src/Pure/Thy/sessions.scala b/src/Pure/Thy/sessions.scala
--- a/src/Pure/Thy/sessions.scala
+++ b/src/Pure/Thy/sessions.scala
@@ -1,1523 +1,1523 @@
 /*  Title:      Pure/Thy/sessions.scala
     Author:     Makarius
 
 Cumulative session information.
 */
 
 package isabelle
 
 import java.io.{File => JFile}
 import java.nio.ByteBuffer
 import java.nio.channels.FileChannel
 import java.nio.file.StandardOpenOption
 
 import scala.collection.immutable.{SortedSet, SortedMap}
 import scala.collection.mutable
 
 
 object Sessions
 {
   /* session and theory names */
 
   val ROOTS: Path = Path.explode("ROOTS")
   val ROOT: Path = Path.explode("ROOT")
 
   val roots_name: String = "ROOTS"
   val root_name: String = "ROOT"
   val theory_name: String = "Pure.Sessions"
 
   val UNSORTED = "Unsorted"
   val DRAFT = "Draft"
 
   def is_pure(name: String): Boolean = name == Thy_Header.PURE
 
 
   def exclude_session(name: String): Boolean = name == "" || name == DRAFT
 
   def exclude_theory(name: String): Boolean =
     name == root_name || name == "README" || name == "index" || name == "bib"
 
 
   /* ROOTS file format */
 
   class File_Format extends isabelle.File_Format
   {
     val format_name: String = roots_name
     val file_ext = ""
 
     override def detect(name: String): Boolean =
       Thy_Header.split_file_name(name) match {
         case Some((_, file_name)) => file_name == roots_name
         case None => false
       }
 
     override def theory_suffix: String = "ROOTS_file"
     override def theory_content(name: String): String =
       """theory "ROOTS" imports Pure begin ROOTS_file """ +
         Outer_Syntax.quote_string(name) + """ end"""
   }
 
 
   /* base info and source dependencies */
 
   sealed case class Base(
     pos: Position.T = Position.none,
     session_directories: Map[JFile, String] = Map.empty,
     global_theories: Map[String, String] = Map.empty,
     session_theories: List[Document.Node.Name] = Nil,
     document_theories: List[Document.Node.Name] = Nil,
     loaded_theories: Graph[String, Outer_Syntax] = Graph.string,
     used_theories: List[(Document.Node.Name, Options)] = Nil,
     load_commands: Map[Document.Node.Name, List[Command_Span.Span]] = Map.empty,
     known_theories: Map[String, Document.Node.Entry] = Map.empty,
     known_loaded_files: Map[String, List[Path]] = Map.empty,
     overall_syntax: Outer_Syntax = Outer_Syntax.empty,
     imported_sources: List[(Path, SHA1.Digest)] = Nil,
     sources: List[(Path, SHA1.Digest)] = Nil,
     session_graph_display: Graph_Display.Graph = Graph_Display.empty_graph,
     errors: List[String] = Nil)
   {
     override def toString: String =
       "Sessions.Base(loaded_theories = " + loaded_theories.size +
         ", used_theories = " + used_theories.length + ")"
 
     def theory_qualifier(name: String): String =
       global_theories.getOrElse(name, Long_Name.qualifier(name))
     def theory_qualifier(name: Document.Node.Name): String = theory_qualifier(name.theory)
 
     def loaded_theory(name: String): Boolean = loaded_theories.defined(name)
     def loaded_theory(name: Document.Node.Name): Boolean = loaded_theory(name.theory)
 
     def loaded_theory_syntax(name: String): Option[Outer_Syntax] =
       if (loaded_theory(name)) Some(loaded_theories.get_node(name)) else None
     def loaded_theory_syntax(name: Document.Node.Name): Option[Outer_Syntax] =
       loaded_theory_syntax(name.theory)
 
     def theory_syntax(name: Document.Node.Name): Outer_Syntax =
       loaded_theory_syntax(name) getOrElse overall_syntax
 
     def node_syntax(nodes: Document.Nodes, name: Document.Node.Name): Outer_Syntax =
       nodes(name).syntax orElse loaded_theory_syntax(name) getOrElse overall_syntax
   }
 
   sealed case class Deps(sessions_structure: Structure, session_bases: Map[String, Base])
   {
     override def toString: String = "Sessions.Deps(" + sessions_structure + ")"
 
     def is_empty: Boolean = session_bases.isEmpty
     def apply(name: String): Base = session_bases(name)
     def get(name: String): Option[Base] = session_bases.get(name)
 
     def imported_sources(name: String): List[SHA1.Digest] =
       session_bases(name).imported_sources.map(_._2)
 
     def sources(name: String): List[SHA1.Digest] =
       session_bases(name).sources.map(_._2)
 
     def errors: List[String] =
       (for {
         (name, base) <- session_bases.iterator
         if base.errors.nonEmpty
       } yield cat_lines(base.errors) +
           "\nThe error(s) above occurred in session " + quote(name) + Position.here(base.pos)
       ).toList
 
     def check_errors: Deps =
       errors match {
         case Nil => this
         case errs => error(cat_lines(errs))
       }
   }
 
   def deps(sessions_structure: Structure,
       progress: Progress = new Progress,
       inlined_files: Boolean = false,
       verbose: Boolean = false,
       list_files: Boolean = false,
       check_keywords: Set[String] = Set.empty): Deps =
   {
     var cache_sources = Map.empty[JFile, SHA1.Digest]
     def check_sources(paths: List[Path]): List[(Path, SHA1.Digest)] =
     {
       for {
         path <- paths
         file = path.file
         if cache_sources.isDefinedAt(file) || file.isFile
       }
       yield {
         cache_sources.get(file) match {
           case Some(digest) => (path, digest)
           case None =>
             val digest = SHA1.digest(file)
             cache_sources = cache_sources + (file -> digest)
             (path, digest)
         }
       }
     }
 
     val session_bases =
       sessions_structure.imports_topological_order.foldLeft(Map("" -> sessions_structure.bootstrap)) {
         case (session_bases, session_name) =>
           progress.expose_interrupt()
 
           val info = sessions_structure(session_name)
           try {
             val deps_base = info.deps_base(session_bases)
             val resources = new Resources(sessions_structure, deps_base)
 
             if (verbose || list_files) {
               val groups =
                 if (info.groups.isEmpty) ""
                 else info.groups.mkString(" (", " ", ")")
               progress.echo("Session " + info.chapter_session + groups)
             }
 
             val dependencies = resources.session_dependencies(info)
 
             val overall_syntax = dependencies.overall_syntax
 
             val session_theories =
               dependencies.theories.filter(name => deps_base.theory_qualifier(name) == session_name)
 
             val theory_files = dependencies.theories.map(_.path)
 
             dependencies.load_commands
 
             val (load_commands, load_commands_errors) =
               try { if (inlined_files) (dependencies.load_commands, Nil) else (Nil, Nil) }
               catch { case ERROR(msg) => (Nil, List(msg)) }
 
             val loaded_files =
               load_commands.map({ case (name, spans) => dependencies.loaded_files(name, spans) })
 
             val session_files =
               (theory_files ::: loaded_files.flatMap(_._2) :::
                 info.document_files.map(file => info.dir + file._1 + file._2)).map(_.expand)
 
             val imported_files = if (inlined_files) dependencies.imported_files else Nil
 
             if (list_files)
               progress.echo(cat_lines(session_files.map(_.implode).sorted.map("  " + _)))
 
             if (check_keywords.nonEmpty) {
               Check_Keywords.check_keywords(
                 progress, overall_syntax.keywords, check_keywords, theory_files)
             }
 
             val session_graph_display: Graph_Display.Graph =
             {
               def session_node(name: String): Graph_Display.Node =
                 Graph_Display.Node("[" + name + "]", "session." + name)
 
               def node(name: Document.Node.Name): Graph_Display.Node =
               {
                 val qualifier = deps_base.theory_qualifier(name)
                 if (qualifier == info.name)
                   Graph_Display.Node(name.theory_base_name, "theory." + name.theory)
                 else session_node(qualifier)
               }
 
               val required_sessions =
                 dependencies.loaded_theories.all_preds(dependencies.theories.map(_.theory))
                   .map(theory => deps_base.theory_qualifier(theory))
                   .filter(name => name != info.name && sessions_structure.defined(name))
 
               val required_subgraph =
                 sessions_structure.imports_graph
                   .restrict(sessions_structure.imports_graph.all_preds(required_sessions).toSet)
                   .transitive_closure
                   .restrict(required_sessions.toSet)
                   .transitive_reduction_acyclic
 
               val graph0 =
                 required_subgraph.topological_order.foldLeft(Graph_Display.empty_graph) {
                   case (g, session) =>
                     val a = session_node(session)
                     val bs = required_subgraph.imm_preds(session).toList.map(session_node)
                     bs.foldLeft((a :: bs).foldLeft(g)(_.default_node(_, Nil)))(_.add_edge(_, a))
                 }
 
               dependencies.entries.foldLeft(graph0) {
                 case (g, entry) =>
                   val a = node(entry.name)
                   val bs = entry.header.imports.map(node).filterNot(_ == a)
                   bs.foldLeft((a :: bs).foldLeft(g)(_.default_node(_, Nil)))(_.add_edge(_, a))
               }
             }
 
             val known_theories =
               dependencies.entries.iterator.map(entry => entry.name.theory -> entry).
                 foldLeft(deps_base.known_theories)(_ + _)
 
             val known_loaded_files = deps_base.known_loaded_files ++ loaded_files
 
             val import_errors =
             {
               val known_sessions =
                 sessions_structure.imports_requirements(List(session_name)).toSet
               for {
                 name <- dependencies.theories
                 qualifier = deps_base.theory_qualifier(name)
                 if !known_sessions(qualifier)
               } yield "Bad import of theory " + quote(name.toString) +
                 ": need to include sessions " + quote(qualifier) + " in ROOT"
             }
 
             val document_errors =
               info.document_theories.flatMap(
               {
                 case (thy, pos) =>
                   val parent_sessions =
                     if (sessions_structure.build_graph.defined(session_name)) {
                       sessions_structure.build_requirements(List(session_name))
                     }
                     else Nil
 
                   def err(msg: String): Option[String] =
                     Some(msg + " " + quote(thy) + Position.here(pos))
 
                   known_theories.get(thy).map(_.name) match {
                     case None => err("Unknown document theory")
                     case Some(name) =>
                       val qualifier = deps_base.theory_qualifier(name)
                       if (session_theories.contains(name)) {
                         err("Redundant document theory from this session:")
                       }
                       else if (parent_sessions.contains(qualifier)) None
                       else if (dependencies.theories.contains(name)) None
                       else err("Document theory from other session not imported properly:")
                   }
               })
             val document_theories =
               info.document_theories.map({ case (thy, _) => known_theories(thy).name })
 
             val dir_errors =
             {
               val ok = info.dirs.map(_.canonical_file).toSet
               val bad =
                 (for {
                   name <- session_theories.iterator
                   path = name.master_dir_path
                   if !ok(path.canonical_file)
                   path1 = File.relative_path(info.dir.canonical, path).getOrElse(path)
                 } yield (path1, name)).toList
               val bad_dirs = (for { (path1, _) <- bad } yield path1.toString).distinct.sorted
 
               val errs1 =
                 for { (path1, name) <- bad }
                 yield "Implicit use of directory " + path1 + " for theory " + quote(name.toString)
               val errs2 =
                 if (bad_dirs.isEmpty) Nil
                 else List("Implicit use of session directories: " + commas(bad_dirs))
               val errs3 = for (p <- info.dirs if !p.is_dir) yield "No such directory: " + p
               val errs4 =
                 (for {
                   name <- session_theories.iterator
                   name1 <- resources.find_theory_node(name.theory)
                   if name.node != name1.node
                 } yield "Incoherent theory file import:\n  " + name.path + " vs. \n  " + name1.path)
                 .toList
 
               errs1 ::: errs2 ::: errs3 ::: errs4
             }
 
             val sources_errors =
               for (p <- session_files if !p.is_file) yield "No such file: " + p
 
             val path_errors =
               try { Path.check_case_insensitive(session_files ::: imported_files); Nil }
               catch { case ERROR(msg) => List(msg) }
 
             val bibtex_errors =
               try { info.bibtex_entries; Nil }
               catch { case ERROR(msg) => List(msg) }
 
             val base =
               Base(
                 pos = info.pos,
                 session_directories = sessions_structure.session_directories,
                 global_theories = sessions_structure.global_theories,
                 session_theories = session_theories,
                 document_theories = document_theories,
                 loaded_theories = dependencies.loaded_theories,
                 used_theories = dependencies.theories_adjunct,
                 load_commands = load_commands.toMap,
                 known_theories = known_theories,
                 known_loaded_files = known_loaded_files,
                 overall_syntax = overall_syntax,
                 imported_sources = check_sources(imported_files),
                 sources = check_sources(session_files),
                 session_graph_display = session_graph_display,
                 errors = dependencies.errors ::: load_commands_errors ::: import_errors :::
                   document_errors ::: dir_errors ::: sources_errors ::: path_errors :::
                   bibtex_errors)
 
             session_bases + (info.name -> base)
           }
           catch {
             case ERROR(msg) =>
               cat_error(msg, "The error(s) above occurred in session " +
                 quote(info.name) + Position.here(info.pos))
           }
       }
 
     Deps(sessions_structure, session_bases)
   }
 
 
   /* base info */
 
   sealed case class Base_Info(
     session: String,
     sessions_structure: Structure,
     errors: List[String],
     base: Base,
     infos: List[Info])
   {
     def check: Base_Info = if (errors.isEmpty) this else error(cat_lines(errors))
   }
 
   def base_info(options: Options,
     session: String,
     progress: Progress = new Progress,
     dirs: List[Path] = Nil,
     include_sessions: List[String] = Nil,
     session_ancestor: Option[String] = None,
     session_requirements: Boolean = false): Base_Info =
   {
     val full_sessions = load_structure(options, dirs = dirs)
 
     val selected_sessions =
       full_sessions.selection(Selection(sessions = session :: session_ancestor.toList))
     val info = selected_sessions(session)
     val ancestor = session_ancestor orElse info.parent
 
     val (session1, infos1) =
       if (session_requirements && ancestor.isDefined) {
         val deps = Sessions.deps(selected_sessions, progress = progress)
         val base = deps(session)
 
         val ancestor_loaded =
           deps.get(ancestor.get) match {
             case Some(ancestor_base)
             if !selected_sessions.imports_requirements(List(ancestor.get)).contains(session) =>
               ancestor_base.loaded_theories.defined _
             case _ =>
               error("Bad ancestor " + quote(ancestor.get) + " for session " + quote(session))
           }
 
         val required_theories =
           for {
             thy <- base.loaded_theories.keys
             if !ancestor_loaded(thy) && base.theory_qualifier(thy) != session
           }
           yield thy
 
         if (required_theories.isEmpty) (ancestor.get, Nil)
         else {
           val other_name = info.name + "_requirements(" + ancestor.get + ")"
           Isabelle_System.isabelle_tmp_prefix()
 
           (other_name,
             List(
               make_info(info.options,
                 dir_selected = false,
                 dir = Path.explode("$ISABELLE_TMP_PREFIX"),
                 chapter = info.chapter,
                 Session_Entry(
                   pos = info.pos,
                   name = other_name,
                   groups = info.groups,
                   path = ".",
                   parent = ancestor,
                   description = "Required theory imports from other sessions",
                   options = Nil,
                   imports = info.deps,
                   directories = Nil,
                   theories = List((Nil, required_theories.map(thy => ((thy, Position.none), false)))),
                   document_theories = Nil,
                   document_files = Nil,
                   export_files = Nil))))
         }
       }
       else (session, Nil)
 
     val full_sessions1 =
       if (infos1.isEmpty) full_sessions
       else load_structure(options, dirs = dirs, infos = infos1)
 
     val selected_sessions1 =
       full_sessions1.selection(Selection(sessions = session1 :: session :: include_sessions))
 
     val deps1 = Sessions.deps(selected_sessions1, progress = progress)
 
     Base_Info(session1, full_sessions1, deps1.errors, deps1(session1), infos1)
   }
 
 
   /* cumulative session info */
 
   sealed case class Info(
     name: String,
     chapter: String,
     dir_selected: Boolean,
     pos: Position.T,
     groups: List[String],
     dir: Path,
     parent: Option[String],
     description: String,
     directories: List[Path],
     options: Options,
     imports: List[String],
     theories: List[(Options, List[(String, Position.T)])],
     global_theories: List[String],
     document_theories: List[(String, Position.T)],
     document_files: List[(Path, Path)],
     export_files: List[(Path, Int, List[String])],
     meta_digest: SHA1.Digest)
   {
     def chapter_session: String = chapter + "/" + name
 
     def relative_path(info1: Info): String =
       if (name == info1.name) ""
       else if (chapter == info1.chapter) "../" + info1.name + "/"
       else "../../" + info1.chapter_session + "/"
 
     def deps: List[String] = parent.toList ::: imports
 
     def deps_base(session_bases: String => Base): Base =
     {
       val parent_base = session_bases(parent.getOrElse(""))
       val imports_bases = imports.map(session_bases)
       parent_base.copy(
         known_theories =
           (for {
             base <- imports_bases.iterator
             (_, entry) <- base.known_theories.iterator
           } yield (entry.name.theory -> entry)).foldLeft(parent_base.known_theories)(_ + _),
         known_loaded_files =
           imports_bases.iterator.map(_.known_loaded_files).
             foldLeft(parent_base.known_loaded_files)(_ ++ _))
     }
 
     def dirs: List[Path] = dir :: directories
 
     def timeout_ignored: Boolean =
       !options.bool("timeout_build") || Time.seconds(options.real("timeout")) < Time.ms(1)
 
     def timeout: Time = Time.seconds(options.real("timeout") * options.real("timeout_scale"))
 
     def document_enabled: Boolean =
       options.string("document") match {
         case "" | "false" => false
         case "pdf" => true
         case doc => error("Bad document specification " + quote(doc))
       }
 
-    def document_variants: List[Presentation.Document_Variant] =
+    def document_variants: List[Document_Build.Document_Variant] =
     {
       val variants =
         Library.space_explode(':', options.string("document_variants")).
-          map(Presentation.Document_Variant.parse)
+          map(Document_Build.Document_Variant.parse)
 
       val dups = Library.duplicates(variants.map(_.name))
       if (dups.nonEmpty) error("Duplicate document variants: " + commas_quote(dups))
 
       variants
     }
 
-    def documents: List[Presentation.Document_Variant] =
+    def documents: List[Document_Build.Document_Variant] =
     {
       val variants = document_variants
       if (!document_enabled || document_files.isEmpty) Nil else variants
     }
 
     def document_output: Option[Path] =
       options.string("document_output") match {
         case "" => None
         case s => Some(dir + Path.explode(s))
       }
 
     def browser_info: Boolean = options.bool("browser_info")
 
     lazy val bibtex_entries: List[Text.Info[String]] =
       (for {
         (document_dir, file) <- document_files.iterator
         if Bibtex.is_bibtex(file.file_name)
         info <- Bibtex.entries(File.read(dir + document_dir + file)).iterator
       } yield info).toList
 
     def record_proofs: Boolean = options.int("record_proofs") >= 2
 
     def is_afp: Boolean = chapter == AFP.chapter
     def is_afp_bulky: Boolean = is_afp && groups.exists(AFP.groups_bulky.contains)
   }
 
   def make_info(options: Options, dir_selected: Boolean, dir: Path, chapter: String,
     entry: Session_Entry): Info =
   {
     try {
       val name = entry.name
 
       if (exclude_session(name)) error("Bad session name")
       if (is_pure(name) && entry.parent.isDefined) error("Illegal parent session")
       if (!is_pure(name) && !entry.parent.isDefined) error("Missing parent session")
 
       val session_path = dir + Path.explode(entry.path)
       val directories = entry.directories.map(dir => session_path + Path.explode(dir))
 
       val session_options = options ++ entry.options
 
       val theories =
         entry.theories.map({ case (opts, thys) =>
           (session_options ++ opts,
             thys.map({ case ((thy, pos), _) =>
               if (exclude_theory(thy))
                 error("Bad theory name " + quote(thy) + Position.here(pos))
               else (thy, pos) })) })
 
       val global_theories =
         for { (_, thys) <- entry.theories; ((thy, pos), global) <- thys if global }
         yield {
           val thy_name = Path.explode(thy).file_name
           if (Long_Name.is_qualified(thy_name))
             error("Bad qualified name for global theory " +
               quote(thy_name) + Position.here(pos))
           else thy_name
         }
 
       val conditions =
         theories.flatMap(thys => space_explode(',', thys._1.string("condition"))).distinct.sorted.
           map(x => (x, Isabelle_System.getenv(x) != ""))
 
       val document_files =
         entry.document_files.map({ case (s1, s2) => (Path.explode(s1), Path.explode(s2)) })
 
       val export_files =
         entry.export_files.map({ case (dir, prune, pats) => (Path.explode(dir), prune, pats) })
 
       val meta_digest =
         SHA1.digest(
           (name, chapter, entry.parent, entry.directories, entry.options, entry.imports,
             entry.theories_no_position, conditions, entry.document_theories_no_position,
             entry.document_files)
           .toString)
 
       Info(name, chapter, dir_selected, entry.pos, entry.groups, session_path,
         entry.parent, entry.description, directories, session_options,
         entry.imports, theories, global_theories, entry.document_theories, document_files,
         export_files, meta_digest)
     }
     catch {
       case ERROR(msg) =>
         error(msg + "\nThe error(s) above occurred in session entry " +
           quote(entry.name) + Position.here(entry.pos))
     }
   }
 
   object Selection
   {
     val empty: Selection = Selection()
     val all: Selection = Selection(all_sessions = true)
     def session(session: String): Selection = Selection(sessions = List(session))
   }
 
   sealed case class Selection(
     requirements: Boolean = false,
     all_sessions: Boolean = false,
     base_sessions: List[String] = Nil,
     exclude_session_groups: List[String] = Nil,
     exclude_sessions: List[String] = Nil,
     session_groups: List[String] = Nil,
     sessions: List[String] = Nil)
   {
     def ++ (other: Selection): Selection =
       Selection(
         requirements = requirements || other.requirements,
         all_sessions = all_sessions || other.all_sessions,
         base_sessions = Library.merge(base_sessions, other.base_sessions),
         exclude_session_groups = Library.merge(exclude_session_groups, other.exclude_session_groups),
         exclude_sessions = Library.merge(exclude_sessions, other.exclude_sessions),
         session_groups = Library.merge(session_groups, other.session_groups),
         sessions = Library.merge(sessions, other.sessions))
   }
 
   object Structure
   {
     val empty: Structure = make(Nil)
 
     def make(infos: List[Info]): Structure =
     {
       def add_edges(graph: Graph[String, Info], kind: String, edges: Info => Iterable[String])
         : Graph[String, Info] =
       {
         def add_edge(pos: Position.T, name: String, g: Graph[String, Info], parent: String) =
         {
           if (!g.defined(parent))
             error("Bad " + kind + " session " + quote(parent) + " for " +
               quote(name) + Position.here(pos))
 
           try { g.add_edge_acyclic(parent, name) }
           catch {
             case exn: Graph.Cycles[_] =>
               error(cat_lines(exn.cycles.map(cycle =>
                 "Cyclic session dependency of " +
                   cycle.map(c => quote(c.toString)).mkString(" via "))) + Position.here(pos))
           }
         }
         graph.iterator.foldLeft(graph) {
           case (g, (name, (info, _))) =>
             edges(info).foldLeft(g)(add_edge(info.pos, name, _, _))
         }
       }
 
       val info_graph =
         infos.foldLeft(Graph.string[Info]) {
           case (graph, info) =>
             if (graph.defined(info.name))
               error("Duplicate session " + quote(info.name) + Position.here(info.pos) +
                 Position.here(graph.get_node(info.name).pos))
             else graph.new_node(info.name, info)
         }
       val build_graph = add_edges(info_graph, "parent", _.parent)
       val imports_graph = add_edges(build_graph, "imports", _.imports)
 
       val session_positions: List[(String, Position.T)] =
         (for ((name, (info, _)) <- info_graph.iterator) yield (name, info.pos)).toList
 
       val session_directories: Map[JFile, String] =
         (for {
           session <- imports_graph.topological_order.iterator
           info = info_graph.get_node(session)
           dir <- info.dirs.iterator
         } yield (info, dir)).foldLeft(Map.empty[JFile, String]) {
             case (dirs, (info, dir)) =>
               val session = info.name
               val canonical_dir = dir.canonical_file
               dirs.get(canonical_dir) match {
                 case Some(session1) =>
                   val info1 = info_graph.get_node(session1)
                   error("Duplicate use of directory " + dir +
                     "\n  for session " + quote(session1) + Position.here(info1.pos) +
                     "\n  vs. session " + quote(session) + Position.here(info.pos))
                 case None => dirs + (canonical_dir -> session)
               }
           }
 
       val global_theories: Map[String, String] =
         (for {
           session <- imports_graph.topological_order.iterator
           info = info_graph.get_node(session)
           thy <- info.global_theories.iterator }
           yield (info, thy)).foldLeft(Thy_Header.bootstrap_global_theories.toMap) {
             case (global, (info, thy)) =>
               val qualifier = info.name
               global.get(thy) match {
                 case Some(qualifier1) if qualifier != qualifier1 =>
                   error("Duplicate global theory " + quote(thy) + Position.here(info.pos))
                 case _ => global + (thy -> qualifier)
               }
           }
 
       new Structure(
         session_positions, session_directories, global_theories, build_graph, imports_graph)
     }
   }
 
   final class Structure private[Sessions](
       val session_positions: List[(String, Position.T)],
       val session_directories: Map[JFile, String],
       val global_theories: Map[String, String],
       val build_graph: Graph[String, Info],
       val imports_graph: Graph[String, Info])
   {
     sessions_structure =>
 
     def bootstrap: Base =
       Base(
         session_directories = session_directories,
         global_theories = global_theories,
         overall_syntax = Thy_Header.bootstrap_syntax)
 
     def dest_session_directories: List[(String, String)] =
       for ((file, session) <- session_directories.toList)
         yield (File.standard_path(file), session)
 
     lazy val chapters: SortedMap[String, List[Info]] =
       build_graph.iterator.foldLeft(SortedMap.empty[String, List[Info]]) {
         case (chs, (_, (info, _))) =>
           chs + (info.chapter -> (info :: chs.getOrElse(info.chapter, Nil)))
       }
 
     def build_graph_display: Graph_Display.Graph = Graph_Display.make_graph(build_graph)
     def imports_graph_display: Graph_Display.Graph = Graph_Display.make_graph(imports_graph)
 
     def defined(name: String): Boolean = imports_graph.defined(name)
     def apply(name: String): Info = imports_graph.get_node(name)
     def get(name: String): Option[Info] = if (defined(name)) Some(apply(name)) else None
 
     def theory_qualifier(name: String): String =
       global_theories.getOrElse(name, Long_Name.qualifier(name))
 
     def check_sessions(names: List[String]): Unit =
     {
       val bad_sessions = SortedSet(names.filterNot(defined): _*).toList
       if (bad_sessions.nonEmpty)
         error("Undefined session(s): " + commas_quote(bad_sessions))
     }
 
     def check_sessions(sel: Selection): Unit =
       check_sessions(sel.base_sessions ::: sel.exclude_sessions ::: sel.sessions)
 
     private def selected(graph: Graph[String, Info], sel: Selection): List[String] =
     {
       check_sessions(sel)
 
       val select_group = sel.session_groups.toSet
       val select_session = sel.sessions.toSet ++ imports_graph.all_succs(sel.base_sessions)
 
       val selected0 =
         if (sel.all_sessions) graph.keys
         else {
           (for {
             (name, (info, _)) <- graph.iterator
             if info.dir_selected || select_session(name) ||
               graph.get_node(name).groups.exists(select_group)
           } yield name).toList
         }
 
       if (sel.requirements) (graph.all_preds(selected0).toSet -- selected0).toList
       else selected0
     }
 
     def selection(sel: Selection): Structure =
     {
       check_sessions(sel)
 
       val excluded =
       {
         val exclude_group = sel.exclude_session_groups.toSet
         val exclude_group_sessions =
           (for {
             (name, (info, _)) <- imports_graph.iterator
             if imports_graph.get_node(name).groups.exists(exclude_group)
           } yield name).toList
         imports_graph.all_succs(exclude_group_sessions ::: sel.exclude_sessions).toSet
       }
 
       def restrict(graph: Graph[String, Info]): Graph[String, Info] =
       {
         val sessions = graph.all_preds(selected(graph, sel)).filterNot(excluded)
         graph.restrict(graph.all_preds(sessions).toSet)
       }
 
       new Structure(
         session_positions, session_directories, global_theories,
         restrict(build_graph), restrict(imports_graph))
     }
 
     def selection(session: String): Structure = selection(Selection.session(session))
 
     def selection_deps(
       selection: Selection,
       progress: Progress = new Progress,
       loading_sessions: Boolean = false,
       inlined_files: Boolean = false,
       verbose: Boolean = false): Deps =
     {
       val deps =
         Sessions.deps(sessions_structure.selection(selection),
           progress = progress, inlined_files = inlined_files, verbose = verbose)
 
       if (loading_sessions) {
         val selection_size = deps.sessions_structure.build_graph.size
         if (selection_size > 1) progress.echo("Loading " + selection_size + " sessions ...")
       }
 
       deps
     }
 
     def hierarchy(session: String): List[String] = build_graph.all_preds(List(session))
 
     def build_selection(sel: Selection): List[String] = selected(build_graph, sel)
     def build_descendants(ss: List[String]): List[String] = build_graph.all_succs(ss)
     def build_requirements(ss: List[String]): List[String] = build_graph.all_preds_rev(ss)
     def build_topological_order: List[String] = build_graph.topological_order
 
     def imports_selection(sel: Selection): List[String] = selected(imports_graph, sel)
     def imports_descendants(ss: List[String]): List[String] = imports_graph.all_succs(ss)
     def imports_requirements(ss: List[String]): List[String] = imports_graph.all_preds_rev(ss)
     def imports_topological_order: List[String] = imports_graph.topological_order
 
     def bibtex_entries: List[(String, List[String])] =
       build_topological_order.flatMap(name =>
         apply(name).bibtex_entries match {
           case Nil => None
           case entries => Some(name -> entries.map(_.info))
         })
 
     def session_chapters: List[(String, String)] =
       imports_topological_order.map(name => name -> apply(name).chapter)
 
     override def toString: String =
       imports_graph.keys_iterator.mkString("Sessions.Structure(", ", ", ")")
   }
 
 
   /* parser */
 
   private val CHAPTER = "chapter"
   private val SESSION = "session"
   private val IN = "in"
   private val DESCRIPTION = "description"
   private val DIRECTORIES = "directories"
   private val OPTIONS = "options"
   private val SESSIONS = "sessions"
   private val THEORIES = "theories"
   private val GLOBAL = "global"
   private val DOCUMENT_THEORIES = "document_theories"
   private val DOCUMENT_FILES = "document_files"
   private val EXPORT_FILES = "export_files"
 
   val root_syntax: Outer_Syntax =
     Outer_Syntax.empty + "(" + ")" + "+" + "," + "=" + "[" + "]" +
       GLOBAL + IN +
       (CHAPTER, Keyword.THY_DECL) +
       (SESSION, Keyword.THY_DECL) +
       (DESCRIPTION, Keyword.QUASI_COMMAND) +
       (DIRECTORIES, Keyword.QUASI_COMMAND) +
       (OPTIONS, Keyword.QUASI_COMMAND) +
       (SESSIONS, Keyword.QUASI_COMMAND) +
       (THEORIES, Keyword.QUASI_COMMAND) +
       (DOCUMENT_THEORIES, Keyword.QUASI_COMMAND) +
       (DOCUMENT_FILES, Keyword.QUASI_COMMAND) +
       (EXPORT_FILES, Keyword.QUASI_COMMAND)
 
   abstract class Entry
   sealed case class Chapter(name: String) extends Entry
   sealed case class Session_Entry(
     pos: Position.T,
     name: String,
     groups: List[String],
     path: String,
     parent: Option[String],
     description: String,
     options: List[Options.Spec],
     imports: List[String],
     directories: List[String],
     theories: List[(List[Options.Spec], List[((String, Position.T), Boolean)])],
     document_theories: List[(String, Position.T)],
     document_files: List[(String, String)],
     export_files: List[(String, Int, List[String])]) extends Entry
   {
     def theories_no_position: List[(List[Options.Spec], List[(String, Boolean)])] =
       theories.map({ case (a, b) => (a, b.map({ case ((c, _), d) => (c, d) })) })
     def document_theories_no_position: List[String] =
       document_theories.map(_._1)
   }
 
   private object Parser extends Options.Parser
   {
     private val chapter: Parser[Chapter] =
     {
       val chapter_name = atom("chapter name", _.is_name)
 
       command(CHAPTER) ~! chapter_name ^^ { case _ ~ a => Chapter(a) }
     }
 
     private val session_entry: Parser[Session_Entry] =
     {
       val option =
         option_name ~ opt($$$("=") ~! option_value ^^ { case _ ~ x => x }) ^^
           { case x ~ y => (x, y) }
       val options = $$$("[") ~> rep1sep(option, $$$(",")) <~ $$$("]")
 
       val theory_entry =
         position(theory_name) ~ opt_keyword(GLOBAL) ^^ { case x ~ y => (x, y) }
 
       val theories =
         $$$(THEORIES) ~!
           ((options | success(Nil)) ~ rep1(theory_entry)) ^^
           { case _ ~ (x ~ y) => (x, y) }
 
       val in_path = $$$("(") ~! ($$$(IN) ~ path ~ $$$(")")) ^^ { case _ ~ (_ ~ x ~ _) => x }
 
       val document_theories =
         $$$(DOCUMENT_THEORIES) ~! rep1(position(name)) ^^ { case _ ~ x => x }
 
       val document_files =
         $$$(DOCUMENT_FILES) ~!
           ((in_path | success("document")) ~ rep1(path)) ^^ { case _ ~ (x ~ y) => y.map((x, _)) }
 
       val prune = $$$("[") ~! (nat ~ $$$("]")) ^^ { case _ ~ (x ~ _) => x } | success(0)
 
       val export_files =
         $$$(EXPORT_FILES) ~! ((in_path | success("export")) ~ prune ~ rep1(embedded)) ^^
           { case _ ~ (x ~ y ~ z) => (x, y, z) }
 
       command(SESSION) ~!
         (position(session_name) ~
           (($$$("(") ~! (rep1(name) <~ $$$(")")) ^^ { case _ ~ x => x }) | success(Nil)) ~
           (($$$(IN) ~! path ^^ { case _ ~ x => x }) | success(".")) ~
           ($$$("=") ~!
             (opt(session_name ~! $$$("+") ^^ { case x ~ _ => x }) ~
               (($$$(DESCRIPTION) ~! text ^^ { case _ ~ x => x }) | success("")) ~
               (($$$(OPTIONS) ~! options ^^ { case _ ~ x => x }) | success(Nil)) ~
               (($$$(SESSIONS) ~! rep1(session_name)  ^^ { case _ ~ x => x }) | success(Nil)) ~
               (($$$(DIRECTORIES) ~! rep1(path) ^^ { case _ ~ x => x }) | success(Nil)) ~
               rep(theories) ~
               (opt(document_theories) ^^ (x => x.getOrElse(Nil))) ~
               (rep(document_files) ^^ (x => x.flatten)) ~
               rep(export_files)))) ^^
         { case _ ~ ((a, pos) ~ b ~ c ~ (_ ~ (d ~ e ~ f ~ g ~ h ~ i ~ j ~ k ~ l))) =>
             Session_Entry(pos, a, b, c, d, e, f, g, h, i, j, k, l) }
     }
 
     def parse_root(path: Path): List[Entry] =
     {
       val toks = Token.explode(root_syntax.keywords, File.read(path))
       val start = Token.Pos.file(path.implode)
 
       parse_all(rep(chapter | session_entry), Token.reader(toks, start)) match {
         case Success(result, _) => result
         case bad => error(bad.toString)
       }
     }
   }
 
   def parse_root(path: Path): List[Entry] = Parser.parse_root(path)
 
   def parse_root_entries(path: Path): List[Session_Entry] =
     for (entry <- Parser.parse_root(path) if entry.isInstanceOf[Session_Entry])
     yield entry.asInstanceOf[Session_Entry]
 
   def read_root(options: Options, select: Boolean, path: Path): List[Info] =
   {
     var entry_chapter = UNSORTED
     val infos = new mutable.ListBuffer[Info]
     parse_root(path).foreach {
       case Chapter(name) => entry_chapter = name
       case entry: Session_Entry =>
         infos += make_info(options, select, path.dir, entry_chapter, entry)
     }
     infos.toList
   }
 
   def parse_roots(roots: Path): List[String] =
   {
     for {
       line <- split_lines(File.read(roots))
       if !(line == "" || line.startsWith("#"))
     } yield line
   }
 
 
   /* load sessions from certain directories */
 
   private def is_session_dir(dir: Path): Boolean =
     (dir + ROOT).is_file || (dir + ROOTS).is_file
 
   private def check_session_dir(dir: Path): Path =
     if (is_session_dir(dir)) File.pwd() + dir.expand
     else error("Bad session root directory (missing ROOT or ROOTS): " + dir.expand.toString)
 
   def directories(dirs: List[Path], select_dirs: List[Path]): List[(Boolean, Path)] =
   {
     val default_dirs = Isabelle_System.components().filter(is_session_dir)
     for { (select, dir) <- (default_dirs ::: dirs).map((false, _)) ::: select_dirs.map((true, _)) }
     yield (select, dir.canonical)
   }
 
   def load_structure(options: Options,
     dirs: List[Path] = Nil,
     select_dirs: List[Path] = Nil,
     infos: List[Info] = Nil): Structure =
   {
     def load_dir(select: Boolean, dir: Path): List[(Boolean, Path)] =
       load_root(select, dir) ::: load_roots(select, dir)
 
     def load_root(select: Boolean, dir: Path): List[(Boolean, Path)] =
     {
       val root = dir + ROOT
       if (root.is_file) List((select, root)) else Nil
     }
 
     def load_roots(select: Boolean, dir: Path): List[(Boolean, Path)] =
     {
       val roots = dir + ROOTS
       if (roots.is_file) {
         for {
           entry <- parse_roots(roots)
           dir1 =
             try { check_session_dir(dir + Path.explode(entry)) }
             catch {
               case ERROR(msg) =>
                 error(msg + "\nThe error(s) above occurred in session catalog " + roots.toString)
             }
           res <- load_dir(select, dir1)
         } yield res
       }
       else Nil
     }
 
     val roots =
       for {
         (select, dir) <- directories(dirs, select_dirs)
         res <- load_dir(select, check_session_dir(dir))
       } yield res
 
     val unique_roots =
       roots.foldLeft(Map.empty[JFile, (Boolean, Path)]) {
         case (m, (select, path)) =>
           val file = path.canonical_file
           m.get(file) match {
             case None => m + (file -> (select, path))
             case Some((select1, path1)) => m + (file -> (select1 || select, path1))
           }
       }.toList.map(_._2)
 
     Structure.make(unique_roots.flatMap(p => read_root(options, p._1, p._2)) ::: infos)
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool = Isabelle_Tool("sessions", "explore structure of Isabelle sessions",
     Scala_Project.here, args =>
   {
     var base_sessions: List[String] = Nil
     var select_dirs: List[Path] = Nil
     var requirements = false
     var exclude_session_groups: List[String] = Nil
     var all_sessions = false
     var dirs: List[Path] = Nil
     var session_groups: List[String] = Nil
     var exclude_sessions: List[String] = Nil
 
     val getopts = Getopts("""
 Usage: isabelle sessions [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -d DIR       include session directory
     -g NAME      select session group NAME
     -x NAME      exclude session NAME and all descendants
 
   Explore the structure of Isabelle sessions and print result names in
   topological order (on stdout).
 """,
       "B:" -> (arg => base_sessions = base_sessions ::: List(arg)),
       "D:" -> (arg => select_dirs = select_dirs ::: List(Path.explode(arg))),
       "R" -> (_ => requirements = true),
       "X:" -> (arg => exclude_session_groups = exclude_session_groups ::: List(arg)),
       "a" -> (_ => all_sessions = true),
       "d:" -> (arg => dirs = dirs ::: List(Path.explode(arg))),
       "g:" -> (arg => session_groups = session_groups ::: List(arg)),
       "x:" -> (arg => exclude_sessions = exclude_sessions ::: List(arg)))
 
     val sessions = getopts(args)
 
     val options = Options.init()
 
     val selection =
       Selection(requirements = requirements, all_sessions = all_sessions, base_sessions = base_sessions,
         exclude_session_groups = exclude_session_groups, exclude_sessions = exclude_sessions,
         session_groups = session_groups, sessions = sessions)
     val sessions_structure =
       load_structure(options, dirs = dirs, select_dirs = select_dirs).selection(selection)
 
     for (name <- sessions_structure.imports_topological_order) {
       Output.writeln(name, stdout = true)
     }
   })
 
 
 
   /** heap file with SHA1 digest **/
 
   private val sha1_prefix = "SHA1:"
 
   def read_heap_digest(heap: Path): Option[String] =
   {
     if (heap.is_file) {
       using(FileChannel.open(heap.file.toPath, StandardOpenOption.READ))(file =>
       {
         val len = file.size
         val n = sha1_prefix.length + SHA1.digest_length
         if (len >= n) {
           file.position(len - n)
 
           val buf = ByteBuffer.allocate(n)
           var i = 0
           var m = 0
           do {
             m = file.read(buf)
             if (m != -1) i += m
           }
           while (m != -1 && n > i)
 
           if (i == n) {
             val prefix = new String(buf.array(), 0, sha1_prefix.length, UTF8.charset)
             val s = new String(buf.array(), sha1_prefix.length, SHA1.digest_length, UTF8.charset)
             if (prefix == sha1_prefix) Some(s) else None
           }
           else None
         }
         else None
       })
     }
     else None
   }
 
   def write_heap_digest(heap: Path): String =
     read_heap_digest(heap) match {
       case None =>
         val s = SHA1.digest(heap).rep
         File.append(heap, sha1_prefix + s)
         s
       case Some(s) => s
     }
 
 
 
   /** persistent store **/
 
   object Session_Info
   {
     val session_name = SQL.Column.string("session_name").make_primary_key
 
     // Build_Log.Session_Info
     val session_timing = SQL.Column.bytes("session_timing")
     val command_timings = SQL.Column.bytes("command_timings")
     val theory_timings = SQL.Column.bytes("theory_timings")
     val ml_statistics = SQL.Column.bytes("ml_statistics")
     val task_statistics = SQL.Column.bytes("task_statistics")
     val errors = SQL.Column.bytes("errors")
     val build_log_columns =
       List(session_name, session_timing, command_timings, theory_timings,
         ml_statistics, task_statistics, errors)
 
     // Build.Session_Info
     val sources = SQL.Column.string("sources")
     val input_heaps = SQL.Column.string("input_heaps")
     val output_heap = SQL.Column.string("output_heap")
     val return_code = SQL.Column.int("return_code")
     val build_columns = List(sources, input_heaps, output_heap, return_code)
 
     val table = SQL.Table("isabelle_session_info", build_log_columns ::: build_columns)
   }
 
   class Database_Context private[Sessions](
     val store: Sessions.Store,
     database_server: Option[SQL.Database]) extends AutoCloseable
   {
     def cache: XML.Cache = store.cache
 
     def close(): Unit = database_server.foreach(_.close())
 
     def output_database[A](session: String)(f: SQL.Database => A): A =
       database_server match {
         case Some(db) => f(db)
         case None => using(store.open_database(session, output = true))(f)
       }
 
     def input_database[A](session: String)(f: (SQL.Database, String) => Option[A]): Option[A] =
       database_server match {
         case Some(db) => f(db, session)
         case None =>
           store.try_open_database(session) match {
             case Some(db) => using(db)(f(_, session))
             case None => None
           }
       }
 
     def read_export(
       sessions: List[String], theory_name: String, name: String): Option[Export.Entry] =
     {
       val attempts =
         database_server match {
           case Some(db) =>
             sessions.view.map(session_name =>
               Export.read_entry(db, store.cache, session_name, theory_name, name))
           case None =>
             sessions.view.map(session_name =>
               store.try_open_database(session_name) match {
                 case Some(db) =>
                   using(db)(Export.read_entry(_, store.cache, session_name, theory_name, name))
                 case None => None
               })
         }
       attempts.collectFirst({ case Some(entry) => entry })
     }
 
     def get_export(
         session_hierarchy: List[String], theory_name: String, name: String): Export.Entry =
       read_export(session_hierarchy, theory_name, name) getOrElse
         Export.empty_entry(theory_name, name)
 
     override def toString: String =
     {
       val s =
         database_server match {
           case Some(db) => db.toString
           case None => "input_dirs = " + store.input_dirs.map(_.absolute).mkString(", ")
         }
       "Database_Context(" + s + ")"
     }
   }
 
   def store(options: Options, cache: XML.Cache = XML.Cache.make()): Store =
     new Store(options, cache)
 
   class Store private[Sessions](val options: Options, val cache: XML.Cache)
   {
     store =>
 
     override def toString: String = "Store(output_dir = " + output_dir.absolute + ")"
 
 
     /* directories */
 
     val system_output_dir: Path = Path.explode("$ISABELLE_HEAPS_SYSTEM/$ML_IDENTIFIER")
     val user_output_dir: Path = Path.explode("$ISABELLE_HEAPS/$ML_IDENTIFIER")
 
     def system_heaps: Boolean = options.bool("system_heaps")
 
     val output_dir: Path =
       if (system_heaps) system_output_dir else user_output_dir
 
     val input_dirs: List[Path] =
       if (system_heaps) List(system_output_dir)
       else List(user_output_dir, system_output_dir)
 
     def presentation_dir: Path =
       if (system_heaps) Path.explode("$ISABELLE_BROWSER_INFO_SYSTEM")
       else Path.explode("$ISABELLE_BROWSER_INFO")
 
 
     /* file names */
 
     def heap(name: String): Path = Path.basic(name)
     def database(name: String): Path = Path.basic("log") + Path.basic(name).ext("db")
     def log(name: String): Path = Path.basic("log") + Path.basic(name)
     def log_gz(name: String): Path = log(name).ext("gz")
 
     def output_heap(name: String): Path = output_dir + heap(name)
     def output_database(name: String): Path = output_dir + database(name)
     def output_log(name: String): Path = output_dir + log(name)
     def output_log_gz(name: String): Path = output_dir + log_gz(name)
 
     def prepare_output_dir(): Unit = Isabelle_System.make_directory(output_dir + Path.basic("log"))
 
 
     /* heap */
 
     def find_heap(name: String): Option[Path] =
       input_dirs.map(_ + heap(name)).find(_.is_file)
 
     def find_heap_digest(name: String): Option[String] =
       find_heap(name).flatMap(read_heap_digest)
 
     def the_heap(name: String): Path =
       find_heap(name) getOrElse
         error("Missing heap image for session " + quote(name) + " -- expected in:\n" +
           cat_lines(input_dirs.map(dir => "  " + dir.expand.implode)))
 
 
     /* database */
 
     def database_server: Boolean = options.bool("build_database_server")
 
     def open_database_server(): SQL.Database =
       PostgreSQL.open_database(
         user = options.string("build_database_user"),
         password = options.string("build_database_password"),
         database = options.string("build_database_name"),
         host = options.string("build_database_host"),
         port = options.int("build_database_port"),
         ssh =
           options.proper_string("build_database_ssh_host").map(ssh_host =>
             SSH.open_session(options,
               host = ssh_host,
               user = options.string("build_database_ssh_user"),
               port = options.int("build_database_ssh_port"))),
         ssh_close = true)
 
     def open_database_context(): Database_Context =
       new Database_Context(store, if (database_server) Some(open_database_server()) else None)
 
     def try_open_database(name: String, output: Boolean = false): Option[SQL.Database] =
     {
       def check(db: SQL.Database): Option[SQL.Database] =
         if (output || session_info_exists(db)) Some(db) else { db.close(); None }
 
       if (database_server) check(open_database_server())
       else if (output) Some(SQLite.open_database(output_database(name)))
       else {
         (for {
           dir <- input_dirs.view
           path = dir + database(name) if path.is_file
           db <- check(SQLite.open_database(path))
         } yield db).headOption
       }
     }
 
     def open_database(name: String, output: Boolean = false): SQL.Database =
       try_open_database(name, output = output) getOrElse
         error("Missing build database for session " + quote(name))
 
     def clean_output(name: String): (Boolean, Boolean) =
     {
       val relevant_db =
         database_server &&
         {
           try_open_database(name) match {
             case Some(db) =>
               try {
                 db.transaction {
                   val relevant_db = session_info_defined(db, name)
                   init_session_info(db, name)
                   relevant_db
                 }
               } finally { db.close() }
             case None => false
           }
         }
 
       val del =
         for {
           dir <-
             (if (system_heaps) List(user_output_dir, system_output_dir) else List(user_output_dir))
           file <- List(heap(name), database(name), log(name), log_gz(name))
           path = dir + file if path.is_file
         } yield path.file.delete
 
       val relevant = relevant_db || del.nonEmpty
       val ok = del.forall(b => b)
       (relevant, ok)
     }
 
 
     /* SQL database content */
 
     def read_bytes(db: SQL.Database, name: String, column: SQL.Column): Bytes =
       db.using_statement(Session_Info.table.select(List(column),
         Session_Info.session_name.where_equal(name)))(stmt =>
       {
         val res = stmt.execute_query()
         if (!res.next()) Bytes.empty else res.bytes(column)
       })
 
     def read_properties(db: SQL.Database, name: String, column: SQL.Column): List[Properties.T] =
       Properties.uncompress(read_bytes(db, name, column), cache = cache)
 
 
     /* session info */
 
     def init_session_info(db: SQL.Database, name: String): Unit =
     {
       db.transaction {
         db.create_table(Session_Info.table)
         db.using_statement(
           Session_Info.table.delete(Session_Info.session_name.where_equal(name)))(_.execute())
 
         db.create_table(Export.Data.table)
         db.using_statement(
           Export.Data.table.delete(Export.Data.session_name.where_equal(name)))(_.execute())
 
-        db.create_table(Presentation.Data.table)
+        db.create_table(Document_Build.Data.table)
         db.using_statement(
-          Presentation.Data.table.delete(
-            Presentation.Data.session_name.where_equal(name)))(_.execute())
+          Document_Build.Data.table.delete(
+            Document_Build.Data.session_name.where_equal(name)))(_.execute())
       }
     }
 
     def session_info_exists(db: SQL.Database): Boolean =
     {
       val tables = db.tables
       tables.contains(Session_Info.table.name) &&
       tables.contains(Export.Data.table.name)
     }
 
     def session_info_defined(db: SQL.Database, name: String): Boolean =
       db.transaction {
         session_info_exists(db) &&
         {
           db.using_statement(
             Session_Info.table.select(List(Session_Info.session_name),
               Session_Info.session_name.where_equal(name)))(stmt => stmt.execute_query().next())
         }
       }
 
     def write_session_info(
       db: SQL.Database,
       name: String,
       build_log: Build_Log.Session_Info,
       build: Build.Session_Info): Unit =
     {
       db.transaction {
         db.using_statement(Session_Info.table.insert())(stmt =>
         {
           stmt.string(1) = name
           stmt.bytes(2) = Properties.encode(build_log.session_timing)
           stmt.bytes(3) = Properties.compress(build_log.command_timings, cache = cache.xz)
           stmt.bytes(4) = Properties.compress(build_log.theory_timings, cache = cache.xz)
           stmt.bytes(5) = Properties.compress(build_log.ml_statistics, cache = cache.xz)
           stmt.bytes(6) = Properties.compress(build_log.task_statistics, cache = cache.xz)
           stmt.bytes(7) = Build_Log.compress_errors(build_log.errors, cache = cache.xz)
           stmt.string(8) = build.sources
           stmt.string(9) = cat_lines(build.input_heaps)
           stmt.string(10) = build.output_heap getOrElse ""
           stmt.int(11) = build.return_code
           stmt.execute()
         })
       }
     }
 
     def read_session_timing(db: SQL.Database, name: String): Properties.T =
       Properties.decode(read_bytes(db, name, Session_Info.session_timing), cache = cache)
 
     def read_command_timings(db: SQL.Database, name: String): List[Properties.T] =
       read_properties(db, name, Session_Info.command_timings)
 
     def read_theory_timings(db: SQL.Database, name: String): List[Properties.T] =
       read_properties(db, name, Session_Info.theory_timings)
 
     def read_ml_statistics(db: SQL.Database, name: String): List[Properties.T] =
       read_properties(db, name, Session_Info.ml_statistics)
 
     def read_task_statistics(db: SQL.Database, name: String): List[Properties.T] =
       read_properties(db, name, Session_Info.task_statistics)
 
     def read_theories(db: SQL.Database, name: String): List[String] =
       read_theory_timings(db, name).flatMap(Markup.Name.unapply)
 
     def read_errors(db: SQL.Database, name: String): List[String] =
       Build_Log.uncompress_errors(read_bytes(db, name, Session_Info.errors), cache = cache)
 
     def read_build(db: SQL.Database, name: String): Option[Build.Session_Info] =
     {
       if (db.tables.contains(Session_Info.table.name)) {
         db.using_statement(Session_Info.table.select(Session_Info.build_columns,
           Session_Info.session_name.where_equal(name)))(stmt =>
         {
           val res = stmt.execute_query()
           if (!res.next()) None
           else {
             Some(
               Build.Session_Info(
                 res.string(Session_Info.sources),
                 split_lines(res.string(Session_Info.input_heaps)),
                 res.string(Session_Info.output_heap) match { case "" => None case s => Some(s) },
                 res.int(Session_Info.return_code)))
           }
         })
       }
       else None
     }
   }
 }
diff --git a/src/Pure/Thy/thy_info.ML b/src/Pure/Thy/thy_info.ML
--- a/src/Pure/Thy/thy_info.ML
+++ b/src/Pure/Thy/thy_info.ML
@@ -1,483 +1,483 @@
 (*  Title:      Pure/Thy/thy_info.ML
     Author:     Makarius
 
 Global theory info database, with auto-loading according to theory and
 file dependencies, and presentation of theory documents.
 *)
 
 signature THY_INFO =
 sig
   type presentation_context =
     {options: Options.T, file_pos: Position.T, adjust_pos: Position.T -> Position.T,
-      segments: Thy_Output.segment list}
+      segments: Document_Output.segment list}
   val adjust_pos_properties: presentation_context -> Position.T -> Properties.T
   val apply_presentation: presentation_context -> theory -> unit
   val add_presentation: (presentation_context -> theory -> unit) -> theory -> theory
   val get_names: unit -> string list
   val lookup_theory: string -> theory option
   val get_theory: string -> theory
   val master_directory: string -> Path.T
   val remove_thy: string -> unit
   val use_theories: Options.T -> string -> (string * Position.T) list -> unit
   val use_thy: string -> unit
   val script_thy: Position.T -> string -> theory -> theory
   val register_thy: theory -> unit
   val finish: unit -> unit
 end;
 
 structure Thy_Info: THY_INFO =
 struct
 
 (** theory presentation **)
 
 (* artefact names *)
 
 fun document_name ext thy =
   Path.explode_binding0 ("document/" ^ Context.theory_name thy ^ "." ^ ext);
 
 val document_tex_name = document_name "tex";
 
 
 (* hook for consolidated theory *)
 
 type presentation_context =
   {options: Options.T, file_pos: Position.T, adjust_pos: Position.T -> Position.T,
-    segments: Thy_Output.segment list};
+    segments: Document_Output.segment list};
 
 fun adjust_pos_properties (context: presentation_context) pos =
   Position.offset_properties_of (#adjust_pos context pos) @ Position.id_properties_of pos;
 
 structure Presentation = Theory_Data
 (
   type T = ((presentation_context -> theory -> unit) * stamp) list;
   val empty = [];
   val extend = I;
   fun merge data : T = Library.merge (eq_snd op =) data;
 );
 
 fun sequential_presentation options =
   not (Options.bool options \<^system_option>\<open>parallel_presentation\<close>);
 
 fun apply_presentation (context: presentation_context) thy =
   Par_List.map'
     {name = "apply_presentation", sequential = sequential_presentation (#options context)}
     (fn (f, _) => f context thy) (Presentation.get thy)
   |> ignore;
 
 fun add_presentation f = Presentation.map (cons (f, stamp ()));
 
 val _ =
   Theory.setup (add_presentation (fn {options, file_pos, segments, ...} => fn thy =>
     if exists (Toplevel.is_skipped_proof o #state) segments then ()
     else
       let
-        val body = Thy_Output.present_thy options thy segments;
+        val body = Document_Output.present_thy options thy segments;
       in
         if Options.string options "document" = "false" then ()
         else
           let
             val thy_name = Context.theory_name thy;
             val document_tex_name = document_tex_name thy;
 
             val latex = Latex.isabelle_body thy_name body;
             val output = [Latex.output_text latex, Latex.output_positions file_pos latex];
           in Export.export thy document_tex_name (XML.blob output) end
       end));
 
 
 
 (** thy database **)
 
 (* messages *)
 
 val show_path = space_implode " via " o map quote;
 
 fun cycle_msg names = "Cyclic dependency of " ^ show_path names;
 
 
 (* derived graph operations *)
 
 fun add_deps name parents G = String_Graph.add_deps_acyclic (name, parents) G
   handle String_Graph.CYCLES namess => error (cat_lines (map cycle_msg namess));
 
 fun new_entry name parents entry =
   String_Graph.new_node (name, entry) #> add_deps name parents;
 
 
 (* global thys *)
 
 type deps =
  {master: (Path.T * SHA1.digest),  (*master dependencies for thy file*)
   imports: (string * Position.T) list};  (*source specification of imports (partially qualified)*)
 
 fun make_deps master imports : deps = {master = master, imports = imports};
 
 fun master_dir_deps (d: deps option) =
   the_default Path.current (Option.map (Path.dir o #1 o #master) d);
 
 local
   val global_thys =
     Synchronized.var "Thy_Info.thys"
       (String_Graph.empty: (deps option * theory option) String_Graph.T);
 in
   fun get_thys () = Synchronized.value global_thys;
   fun change_thys f = Synchronized.change global_thys f;
 end;
 
 fun get_names () = String_Graph.topological_order (get_thys ());
 
 
 (* access thy *)
 
 fun lookup thys name = try (String_Graph.get_node thys) name;
 fun lookup_thy name = lookup (get_thys ()) name;
 
 fun get thys name =
   (case lookup thys name of
     SOME thy => thy
   | NONE => error ("Theory loader: nothing known about theory " ^ quote name));
 
 fun get_thy name = get (get_thys ()) name;
 
 
 (* access deps *)
 
 val lookup_deps = Option.map #1 o lookup_thy;
 
 val master_directory = master_dir_deps o #1 o get_thy;
 
 
 (* access theory *)
 
 fun lookup_theory name =
   (case lookup_thy name of
     SOME (_, SOME theory) => SOME theory
   | _ => NONE);
 
 fun get_theory name =
   (case lookup_theory name of
     SOME theory => theory
   | _ => error ("Theory loader: undefined entry for theory " ^ quote name));
 
 val get_imports = Resources.imports_of o get_theory;
 
 
 
 (** thy operations **)
 
 (* remove *)
 
 fun remove name thys =
   (case lookup thys name of
     NONE => thys
   | SOME (NONE, _) => error ("Cannot update finished theory " ^ quote name)
   | SOME _ =>
       let
         val succs = String_Graph.all_succs thys [name];
         val _ = writeln ("Theory loader: removing " ^ commas_quote succs);
       in fold String_Graph.del_node succs thys end);
 
 val remove_thy = change_thys o remove;
 
 
 (* update *)
 
 fun update deps theory thys =
   let
     val name = Context.theory_long_name theory;
     val parents = map Context.theory_long_name (Theory.parents_of theory);
 
     val thys' = remove name thys;
     val _ = map (get thys') parents;
   in new_entry name parents (SOME deps, SOME theory) thys' end;
 
 fun update_thy deps theory = change_thys (update deps theory);
 
 
 (* scheduling loader tasks *)
 
 datatype result =
   Result of {theory: theory, exec_id: Document_ID.exec,
     present: unit -> unit, commit: unit -> unit, weight: int};
 
 fun theory_result theory =
   Result {theory = theory, exec_id = Document_ID.none, present = I, commit = I, weight = 0};
 
 fun result_theory (Result {theory, ...}) = theory;
 fun result_present (Result {present, ...}) = present;
 fun result_commit (Result {commit, ...}) = commit;
 fun result_ord (Result {weight = i, ...}, Result {weight = j, ...}) = int_ord (j, i);
 
 fun join_theory (Result {theory, exec_id, ...}) =
   let
     val _ = Execution.join [exec_id];
     val res = Exn.capture Thm.consolidate_theory theory;
     val exns = maps Task_Queue.group_status (Execution.peek exec_id);
   in res :: map Exn.Exn exns end;
 
 datatype task =
   Task of string list * (theory list -> result) |
   Finished of theory;
 
 fun task_finished (Task _) = false
   | task_finished (Finished _) = true;
 
 fun task_parents deps (parents: string list) = map (the o AList.lookup (op =) deps) parents;
 
 val schedule_seq =
   String_Graph.schedule (fn deps => fn (_, task) =>
     (case task of
       Task (parents, body) =>
         let
           val result = body (task_parents deps parents);
           val _ = Par_Exn.release_all (join_theory result);
           val _ = result_present result ();
           val _ = result_commit result ();
         in result_theory result end
     | Finished thy => thy)) #> ignore;
 
 val schedule_futures = Thread_Attributes.uninterruptible (fn _ => fn tasks =>
   let
     val futures = tasks
       |> String_Graph.schedule (fn deps => fn (name, task) =>
         (case task of
           Task (parents, body) =>
             (singleton o Future.forks)
               {name = "theory:" ^ name, group = NONE,
                 deps = map (Future.task_of o #2) deps, pri = 0, interrupts = true}
               (fn () =>
                 (case filter (not o can Future.join o #2) deps of
                   [] => body (map (result_theory o Future.join) (task_parents deps parents))
                 | bad =>
                     error
                       ("Failed to load theory " ^ quote name ^
                         " (unresolved " ^ commas_quote (map #1 bad) ^ ")")))
         | Finished theory => Future.value (theory_result theory)));
 
     val results1 = futures
       |> maps (fn future =>
           (case Future.join_result future of
             Exn.Res result => join_theory result
           | Exn.Exn exn => [Exn.Exn exn]));
 
     val results2 = futures
       |> map_filter (Exn.get_res o Future.join_result)
       |> sort result_ord
       |> Par_List.map'
           {name = "present", sequential = sequential_presentation (Options.default ())}
           (fn result => Exn.capture (result_present result) ());
 
     (* FIXME more precise commit order (!?) *)
     val results3 = futures
       |> map (fn future => Exn.capture (fn () => result_commit (Future.join future) ()) ());
 
     (* FIXME avoid global Execution.reset (!??) *)
     val results4 = map Exn.Exn (maps Task_Queue.group_status (Execution.reset ()));
 
     val _ = Par_Exn.release_all (results1 @ results2 @ results3 @ results4);
   in () end);
 
 
 (* eval theory *)
 
 fun eval_thy options master_dir header text_pos text parents =
   let
     val (name, _) = #name header;
     val keywords =
       fold (curry Keyword.merge_keywords o Thy_Header.get_keywords) parents
         (Keyword.add_keywords (#keywords header) Keyword.empty_keywords);
 
     val spans = Outer_Syntax.parse_spans (Token.explode keywords text_pos text);
     val elements = Thy_Element.parse_elements keywords spans;
 
     val text_id = Position.copy_id text_pos Position.none;
 
     fun init () = Resources.begin_theory master_dir header parents;
 
     fun excursion () =
       let
         fun element_result span_elem (st, _) =
           let
             fun prepare span =
               let
                 val tr =
                   Position.setmp_thread_data text_id
                     (fn () => Command.read_span keywords st master_dir init span) ();
               in Toplevel.timing (Resources.last_timing tr) tr end;
             val elem = Thy_Element.map_element prepare span_elem;
             val (results, st') = Toplevel.element_result keywords elem st;
             val pos' = Toplevel.pos_of (Thy_Element.last_element elem);
           in (results, (st', pos')) end;
 
         val (results, (end_state, end_pos)) =
           fold_map element_result elements (Toplevel.init_toplevel (), Position.none);
 
         val thy = Toplevel.end_theory end_pos end_state;
       in (results, thy) end;
 
     val (results, thy) = cond_timeit true ("theory " ^ quote name) excursion;
 
     fun present () =
       let
         val segments =
           (spans ~~ maps Toplevel.join_results results) |> map (fn (span, (st, tr, st')) =>
             {span = span, prev_state = st, command = tr, state = st'});
         val context: presentation_context =
           {options = options, file_pos = text_pos, adjust_pos = I, segments = segments};
       in apply_presentation context thy end;
 
   in (thy, present, size text) end;
 
 
 (* require_thy -- checking database entries wrt. the file-system *)
 
 local
 
 fun required_by _ [] = ""
   | required_by s initiators = s ^ "(required by " ^ show_path (rev initiators) ^ ")";
 
 fun load_thy options initiators deps text (name, header_pos) keywords parents =
   let
     val {master = (thy_path, _), imports} = deps;
     val dir = Path.dir thy_path;
 
     val exec_id = Document_ID.make ();
     val id = Document_ID.print exec_id;
     val put_id = Position.put_id id;
     val _ =
       Execution.running Document_ID.none exec_id [] orelse
         raise Fail ("Failed to register execution: " ^ id);
 
     val text_pos = put_id (Path.position thy_path);
     val text_props = Position.properties_of text_pos;
 
     val _ = remove_thy name;
     val _ = writeln ("Loading theory " ^ quote name ^ required_by " " initiators);
     val _ = Output.try_protocol_message (Markup.loading_theory name @ text_props) [XML.blob [text]];
 
     val _ =
       Position.setmp_thread_data (Position.id_only id) (fn () =>
         (parents, map #2 imports) |> ListPair.app (fn (thy, pos) =>
           Context_Position.reports_global thy [(put_id pos, Theory.get_markup thy)])) ();
 
     val timing_start = Timing.start ();
 
     val header = Thy_Header.make (name, put_id header_pos) imports keywords;
     val (theory, present, weight) =
       eval_thy options dir header text_pos text
         (if name = Context.PureN then [Context.the_global_context ()] else parents);
 
     val timing_result = Timing.result timing_start;
     val timing_props = [Markup.theory_timing, (Markup.nameN, name)];
     val _ = Output.try_protocol_message (timing_props @ Markup.timing_properties timing_result) []
 
     fun commit () = update_thy deps theory;
   in
     Result {theory = theory, exec_id = exec_id, present = present, commit = commit, weight = weight}
   end;
 
 fun check_thy_deps dir name =
   (case lookup_deps name of
     SOME NONE => (true, NONE, Position.none, get_imports name, [])
   | NONE =>
       let val {master, text, theory_pos, imports, keywords} = Resources.check_thy dir name
       in (false, SOME (make_deps master imports, text), theory_pos, imports, keywords) end
   | SOME (SOME {master, ...}) =>
       let
         val {master = master', text = text', theory_pos = theory_pos', imports = imports',
           keywords = keywords'} = Resources.check_thy dir name;
         val deps' = SOME (make_deps master' imports', text');
         val current =
           #2 master = #2 master' andalso
             (case lookup_theory name of
               NONE => false
             | SOME theory => Resources.loaded_files_current theory);
       in (current, deps', theory_pos', imports', keywords') end);
 
 in
 
 fun require_thys options initiators qualifier dir strs tasks =
       fold_map (require_thy options initiators qualifier dir) strs tasks |>> forall I
 and require_thy options initiators qualifier dir (s, require_pos) tasks =
   let
     val {master_dir, theory_name, ...} = Resources.import_name qualifier dir s;
   in
     (case try (String_Graph.get_node tasks) theory_name of
       SOME task => (task_finished task, tasks)
     | NONE =>
         let
           val _ = member (op =) initiators theory_name andalso error (cycle_msg initiators);
 
           val (current, deps, theory_pos, imports, keywords) = check_thy_deps master_dir theory_name
             handle ERROR msg =>
               cat_error msg
                 ("The error(s) above occurred for theory " ^ quote theory_name ^
                   Position.here require_pos ^ required_by "\n" initiators);
 
           val qualifier' = Resources.theory_qualifier theory_name;
           val dir' = dir + master_dir_deps (Option.map #1 deps);
 
           val parents = map (#theory_name o Resources.import_name qualifier' dir' o #1) imports;
           val (parents_current, tasks') =
             require_thys options (theory_name :: initiators) qualifier' dir' imports tasks;
 
           val all_current = current andalso parents_current;
           val task =
             if all_current then Finished (get_theory theory_name)
             else
               (case deps of
                 NONE => raise Fail "Malformed deps"
               | SOME (dep, text) =>
                   Task (parents,
                     load_thy options initiators dep text (theory_name, theory_pos) keywords));
 
           val tasks'' = new_entry theory_name parents task tasks';
         in (all_current, tasks'') end)
   end;
 
 end;
 
 
 (* use theories *)
 
 fun use_theories options qualifier imports =
   let val (_, tasks) = require_thys options [] qualifier Path.current imports String_Graph.empty
   in if Multithreading.max_threads () > 1 then schedule_futures tasks else schedule_seq tasks end;
 
 fun use_thy name =
   use_theories (Options.default ()) Resources.default_qualifier [(name, Position.none)];
 
 
 (* toplevel scripting -- without maintaining database *)
 
 fun script_thy pos txt thy =
   let
     val trs = Outer_Syntax.parse_text thy (K thy) pos txt;
     val end_pos = if null trs then pos else Toplevel.pos_of (List.last trs);
     val end_state = fold (Toplevel.command_exception true) trs (Toplevel.init_toplevel ());
   in Toplevel.end_theory end_pos end_state end;
 
 
 (* register theory *)
 
 fun register_thy theory =
   let
     val name = Context.theory_long_name theory;
     val {master, ...} = Resources.check_thy (Resources.master_directory theory) name;
     val imports = Resources.imports_of theory;
   in
     change_thys (fn thys =>
       let
         val thys' = remove name thys;
         val _ = writeln ("Registering theory " ^ quote name);
       in update (make_deps master imports) theory thys' end)
   end;
 
 
 (* finish all theories *)
 
 fun finish () = change_thys (String_Graph.map (fn _ => fn (_, entry) => (NONE, entry)));
 
 end;
 
 fun use_thy name = Runtime.toplevel_program (fn () => Thy_Info.use_thy name);
diff --git a/src/Pure/Tools/build.scala b/src/Pure/Tools/build.scala
--- a/src/Pure/Tools/build.scala
+++ b/src/Pure/Tools/build.scala
@@ -1,679 +1,679 @@
 /*  Title:      Pure/Tools/build.scala
     Author:     Makarius
     Options:    :folding=explicit:
 
 Build and manage Isabelle sessions.
 */
 
 package isabelle
 
 
 import scala.collection.immutable.SortedSet
 import scala.annotation.tailrec
 
 
 object Build
 {
   /** auxiliary **/
 
   /* persistent build info */
 
   sealed case class Session_Info(
     sources: String,
     input_heaps: List[String],
     output_heap: Option[String],
     return_code: Int)
   {
     def ok: Boolean = return_code == 0
   }
 
 
   /* queue with scheduling information */
 
   private object Queue
   {
     type Timings = (List[Properties.T], Double)
 
     def load_timings(progress: Progress, store: Sessions.Store, session_name: String): Timings =
     {
       val no_timings: Timings = (Nil, 0.0)
 
       store.try_open_database(session_name) match {
         case None => no_timings
         case Some(db) =>
           def ignore_error(msg: String) =
           {
             progress.echo_warning("Ignoring bad database " + db + (if (msg == "") "" else "\n" + msg))
             no_timings
           }
           try {
             val command_timings = store.read_command_timings(db, session_name)
             val session_timing =
               store.read_session_timing(db, session_name) match {
                 case Markup.Elapsed(t) => t
                 case _ => 0.0
               }
             (command_timings, session_timing)
           }
           catch {
             case ERROR(msg) => ignore_error(msg)
             case exn: java.lang.Error => ignore_error(Exn.message(exn))
             case _: XML.Error => ignore_error("")
           }
           finally { db.close() }
       }
     }
 
     def make_session_timing(sessions_structure: Sessions.Structure, timing: Map[String, Double])
       : Map[String, Double] =
     {
       val maximals = sessions_structure.build_graph.maximals.toSet
       def desc_timing(session_name: String): Double =
       {
         if (maximals.contains(session_name)) timing(session_name)
         else {
           val descendants = sessions_structure.build_descendants(List(session_name)).toSet
           val g = sessions_structure.build_graph.restrict(descendants)
           (0.0 :: g.maximals.flatMap(desc => {
             val ps = g.all_preds(List(desc))
             if (ps.exists(p => !timing.isDefinedAt(p))) None
             else Some(ps.map(timing(_)).sum)
           })).max
         }
       }
       timing.keySet.iterator.map(name => (name -> desc_timing(name))).toMap.withDefaultValue(0.0)
     }
 
     def apply(progress: Progress, sessions_structure: Sessions.Structure, store: Sessions.Store)
       : Queue =
     {
       val graph = sessions_structure.build_graph
       val names = graph.keys
 
       val timings = names.map(name => (name, load_timings(progress, store, name)))
       val command_timings =
         timings.map({ case (name, (ts, _)) => (name, ts) }).toMap.withDefaultValue(Nil)
       val session_timing =
         make_session_timing(sessions_structure,
           timings.map({ case (name, (_, t)) => (name, t) }).toMap)
 
       object Ordering extends scala.math.Ordering[String]
       {
         def compare(name1: String, name2: String): Int =
           session_timing(name2) compare session_timing(name1) match {
             case 0 =>
               sessions_structure(name2).timeout compare sessions_structure(name1).timeout match {
                 case 0 => name1 compare name2
                 case ord => ord
               }
             case ord => ord
           }
       }
 
       new Queue(graph, SortedSet(names: _*)(Ordering), command_timings)
     }
   }
 
   private class Queue(
     graph: Graph[String, Sessions.Info],
     order: SortedSet[String],
     val command_timings: String => List[Properties.T])
   {
     def is_inner(name: String): Boolean = !graph.is_maximal(name)
 
     def is_empty: Boolean = graph.is_empty
 
     def - (name: String): Queue =
       new Queue(graph.del_node(name), order - name, command_timings)
 
     def dequeue(skip: String => Boolean): Option[(String, Sessions.Info)] =
     {
       val it = order.iterator.dropWhile(name => skip(name) || !graph.is_minimal(name))
       if (it.hasNext) { val name = it.next(); Some((name, graph.get_node(name))) }
       else None
     }
   }
 
 
 
   /** build with results **/
 
   class Results private[Build](results: Map[String, (Option[Process_Result], Sessions.Info)])
   {
     def sessions: Set[String] = results.keySet
     def infos: List[Sessions.Info] = results.values.map(_._2).toList
     def cancelled(name: String): Boolean = results(name)._1.isEmpty
     def apply(name: String): Process_Result = results(name)._1.getOrElse(Process_Result(1))
     def info(name: String): Sessions.Info = results(name)._2
     val rc: Int =
       results.iterator.map({ case (_, (Some(r), _)) => r.rc case (_, (None, _)) => 1 }).
         foldLeft(0)(_ max _)
     def ok: Boolean = rc == 0
 
     override def toString: String = rc.toString
   }
 
   def session_finished(session_name: String, process_result: Process_Result): String =
     "Finished " + session_name + " (" + process_result.timing.message_resources + ")"
 
   def session_timing(session_name: String, build_log: Build_Log.Session_Info): String =
   {
     val props = build_log.session_timing
     val threads = Markup.Session_Timing.Threads.unapply(props) getOrElse 1
     val timing = Markup.Timing_Properties.parse(props)
     "Timing " + session_name + " (" + threads + " threads, " + timing.message_factor + ")"
   }
 
   def build(
     options: Options,
     selection: Sessions.Selection = Sessions.Selection.empty,
     presentation: Presentation.Context = Presentation.Context.none,
     progress: Progress = new Progress,
     check_unknown_files: Boolean = false,
     build_heap: Boolean = false,
     clean_build: Boolean = false,
     dirs: List[Path] = Nil,
     select_dirs: List[Path] = Nil,
     infos: List[Sessions.Info] = Nil,
     numa_shuffling: Boolean = false,
     max_jobs: Int = 1,
     list_files: Boolean = false,
     check_keywords: Set[String] = Set.empty,
     fresh_build: Boolean = false,
     no_build: Boolean = false,
     soft_build: Boolean = false,
     verbose: Boolean = false,
     export_files: Boolean = false): Results =
   {
     val build_options =
       options +
         "completion_limit=0" +
         "editor_tracing_messages=0" +
         "kodkod_scala=false" +
         ("pide_reports=" + options.bool("build_pide_reports"))
 
     val store = Sessions.store(build_options)
 
     Isabelle_Fonts.init()
 
 
     /* session selection and dependencies */
 
     val full_sessions =
       Sessions.load_structure(build_options, dirs = dirs, select_dirs = select_dirs, infos = infos)
 
     val full_sessions_selection = full_sessions.imports_selection(selection)
 
     def sources_stamp(deps: Sessions.Deps, session_name: String): String =
     {
       val digests =
         full_sessions(session_name).meta_digest ::
         deps.sources(session_name) :::
         deps.imported_sources(session_name)
       SHA1.digest_set(digests).toString
     }
 
     val deps =
     {
       val deps0 =
         Sessions.deps(full_sessions.selection(selection),
           progress = progress, inlined_files = true, verbose = verbose,
           list_files = list_files, check_keywords = check_keywords).check_errors
 
       if (soft_build && !fresh_build) {
         val outdated =
           deps0.sessions_structure.build_topological_order.flatMap(name =>
             store.try_open_database(name) match {
               case Some(db) =>
                 using(db)(store.read_build(_, name)) match {
                   case Some(build)
                   if build.ok && build.sources == sources_stamp(deps0, name) => None
                   case _ => Some(name)
                 }
               case None => Some(name)
             })
 
         Sessions.deps(full_sessions.selection(Sessions.Selection(sessions = outdated)),
           progress = progress, inlined_files = true).check_errors
       }
       else deps0
     }
 
 
     /* check unknown files */
 
     if (check_unknown_files) {
       val source_files =
         (for {
           (_, base) <- deps.session_bases.iterator
           (path, _) <- base.sources.iterator
         } yield path).toList
       val exclude_files = List(Path.explode("$POLYML_EXE")).map(_.canonical_file)
       val unknown_files =
         Mercurial.check_files(source_files)._2.
           filterNot(path => exclude_files.contains(path.canonical_file))
       if (unknown_files.nonEmpty) {
         progress.echo_warning("Unknown files (not part of the underlying Mercurial repository):" +
           unknown_files.map(path => path.expand.implode).sorted.mkString("\n  ", "\n  ", ""))
       }
     }
 
 
     /* main build process */
 
     val queue = Queue(progress, deps.sessions_structure, store)
 
     store.prepare_output_dir()
 
     if (clean_build) {
       for (name <- full_sessions.imports_descendants(full_sessions_selection)) {
         val (relevant, ok) = store.clean_output(name)
         if (relevant) {
           if (ok) progress.echo("Cleaned " + name)
           else progress.echo(name + " FAILED to clean")
         }
       }
     }
 
     // scheduler loop
     case class Result(
       current: Boolean,
       heap_digest: Option[String],
       process: Option[Process_Result],
       info: Sessions.Info)
     {
       def ok: Boolean =
         process match {
           case None => false
           case Some(res) => res.rc == 0
         }
     }
 
     def sleep(): Unit =
       Isabelle_Thread.interrupt_handler(_ => progress.stop()) { Time.seconds(0.5).sleep() }
 
     val numa_nodes = new NUMA.Nodes(numa_shuffling)
 
     @tailrec def loop(
       pending: Queue,
       running: Map[String, (List[String], Build_Job)],
       results: Map[String, Result]): Map[String, Result] =
     {
       def used_node(i: Int): Boolean =
         running.iterator.exists(
           { case (_, (_, job)) => job.numa_node.isDefined && job.numa_node.get == i })
 
       if (pending.is_empty) results
       else {
         if (progress.stopped) {
           for ((_, (_, job)) <- running) job.terminate()
         }
 
         running.find({ case (_, (_, job)) => job.is_finished }) match {
           case Some((session_name, (input_heaps, job))) =>
             //{{{ finish job
 
             val (process_result, heap_digest) = job.join
 
             val log_lines = process_result.out_lines.filterNot(Protocol_Message.Marker.test)
             val process_result_tail =
             {
               val tail = job.info.options.int("process_output_tail")
               process_result.copy(
                 out_lines =
                   "(see also " + store.output_log(session_name).file.toString + ")" ::
                   (if (tail == 0) log_lines else log_lines.drop(log_lines.length - tail max 0)))
             }
 
             val build_log =
               Build_Log.Log_File(session_name, process_result.out_lines).
                 parse_session_info(
                   command_timings = true,
                   theory_timings = true,
                   ml_statistics = true,
                   task_statistics = true)
 
             // write log file
             if (process_result.ok) {
               File.write_gzip(store.output_log_gz(session_name), terminate_lines(log_lines))
             }
             else File.write(store.output_log(session_name), terminate_lines(log_lines))
 
             // write database
             using(store.open_database(session_name, output = true))(db =>
               store.write_session_info(db, session_name,
                 build_log =
                   if (process_result.timeout) build_log.error("Timeout") else build_log,
                 build =
                   Session_Info(sources_stamp(deps, session_name), input_heaps, heap_digest,
                     process_result.rc)))
 
             // messages
             process_result.err_lines.foreach(progress.echo)
 
             if (process_result.ok) {
               if (verbose) progress.echo(session_timing(session_name, build_log))
               progress.echo(session_finished(session_name, process_result))
             }
             else {
               progress.echo(session_name + " FAILED")
               if (!process_result.interrupted) progress.echo(process_result_tail.out)
             }
 
             loop(pending - session_name, running - session_name,
               results +
                 (session_name -> Result(false, heap_digest, Some(process_result_tail), job.info)))
             //}}}
           case None if running.size < (max_jobs max 1) =>
             //{{{ check/start next job
             pending.dequeue(running.isDefinedAt) match {
               case Some((session_name, info)) =>
                 val ancestor_results =
                   deps.sessions_structure.build_requirements(List(session_name)).
                     filterNot(_ == session_name).map(results(_))
                 val ancestor_heaps = ancestor_results.flatMap(_.heap_digest)
 
                 val do_store =
                   build_heap || Sessions.is_pure(session_name) || queue.is_inner(session_name)
 
                 val (current, heap_digest) =
                 {
                   store.try_open_database(session_name) match {
                     case Some(db) =>
                       using(db)(store.read_build(_, session_name)) match {
                         case Some(build) =>
                           val heap_digest = store.find_heap_digest(session_name)
                           val current =
                             !fresh_build &&
                             build.ok &&
                             build.sources == sources_stamp(deps, session_name) &&
                             build.input_heaps == ancestor_heaps &&
                             build.output_heap == heap_digest &&
                             !(do_store && heap_digest.isEmpty)
                           (current, heap_digest)
                         case None => (false, None)
                       }
                     case None => (false, None)
                   }
                 }
                 val all_current = current && ancestor_results.forall(_.current)
 
                 if (all_current)
                   loop(pending - session_name, running,
                     results +
                       (session_name -> Result(true, heap_digest, Some(Process_Result(0)), info)))
                 else if (no_build) {
                   progress.echo_if(verbose, "Skipping " + session_name + " ...")
                   loop(pending - session_name, running,
                     results +
                       (session_name -> Result(false, heap_digest, Some(Process_Result(1)), info)))
                 }
                 else if (ancestor_results.forall(_.ok) && !progress.stopped) {
                   progress.echo((if (do_store) "Building " else "Running ") + session_name + " ...")
 
                   store.clean_output(session_name)
                   using(store.open_database(session_name, output = true))(
                     store.init_session_info(_, session_name))
 
                   val numa_node = numa_nodes.next(used_node)
                   val job =
                     new Build_Job(progress, session_name, info, deps, store, do_store,
                       verbose, numa_node, queue.command_timings(session_name))
                   loop(pending, running + (session_name -> (ancestor_heaps, job)), results)
                 }
                 else {
                   progress.echo(session_name + " CANCELLED")
                   loop(pending - session_name, running,
                     results + (session_name -> Result(false, heap_digest, None, info)))
                 }
               case None => sleep(); loop(pending, running, results)
             }
             ///}}}
           case None => sleep(); loop(pending, running, results)
         }
       }
     }
 
 
     /* build results */
 
     val results =
     {
       val results0 =
         if (deps.is_empty) {
           progress.echo_warning("Nothing to build")
           Map.empty[String, Result]
         }
         else Isabelle_Thread.uninterruptible { loop(queue, Map.empty, Map.empty) }
 
       new Results(
         (for ((name, result) <- results0.iterator)
           yield (name, (result.process, result.info))).toMap)
     }
 
     if (export_files) {
       for (name <- full_sessions.imports_selection(selection).iterator if results(name).ok) {
         val info = results.info(name)
         if (info.export_files.nonEmpty) {
           progress.echo("Exporting " + info.name + " ...")
           for ((dir, prune, pats) <- info.export_files) {
             Export.export_files(store, name, info.dir + dir,
               progress = if (verbose) progress else new Progress,
               export_prune = prune,
               export_patterns = pats)
           }
         }
       }
     }
 
     if (results.rc != 0 && (verbose || !no_build)) {
       val unfinished =
         (for {
           name <- results.sessions.iterator
           if !results(name).ok
          } yield name).toList.sorted
       progress.echo("Unfinished session(s): " + commas(unfinished))
     }
 
 
     /* PDF/HTML presentation */
 
     if (!no_build && !progress.stopped && results.ok) {
       val selected = full_sessions_selection.toSet
       val presentation_chapters =
         (for {
           session_name <- deps.sessions_structure.build_topological_order.iterator
           info = results.info(session_name)
           if selected(session_name) && presentation.enabled(info) && results(session_name).ok }
         yield (info.chapter, (session_name, info.description))).toList
 
       if (presentation_chapters.nonEmpty) {
         val presentation_dir = presentation.dir(store)
         progress.echo("Presentation in " + presentation_dir.absolute)
 
         val resources = Resources.empty
         val html_context = Presentation.html_context()
 
         using(store.open_database_context())(db_context =>
           for ((_, (session_name, _)) <- presentation_chapters) {
             progress.expose_interrupt()
             progress.echo("Presenting " + session_name + " ...")
             Presentation.session_html(
               resources, session_name, deps, db_context, progress = progress,
               verbose = verbose, html_context = html_context,
               elements = Presentation.elements1, presentation = presentation)
           })
 
         val browser_chapters =
           presentation_chapters.groupBy(_._1).
             map({ case (chapter, es) => (chapter, es.map(_._2)) }).filterNot(_._2.isEmpty)
 
         for ((chapter, entries) <- browser_chapters)
           Presentation.update_chapter_index(presentation_dir, chapter, entries)
 
         if (browser_chapters.nonEmpty) Presentation.make_global_index(presentation_dir)
       }
     }
 
     results
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool = Isabelle_Tool("build", "build and manage Isabelle sessions",
     Scala_Project.here, args =>
   {
     val build_options = Word.explode(Isabelle_System.getenv("ISABELLE_BUILD_OPTIONS"))
 
     var base_sessions: List[String] = Nil
     var select_dirs: List[Path] = Nil
     var numa_shuffling = false
     var presentation = Presentation.Context.none
     var requirements = false
     var soft_build = false
     var exclude_session_groups: List[String] = Nil
     var all_sessions = false
     var build_heap = false
     var clean_build = false
     var dirs: List[Path] = Nil
     var export_files = false
     var fresh_build = false
     var session_groups: List[String] = Nil
     var max_jobs = 1
     var check_keywords: Set[String] = Set.empty
     var list_files = false
     var no_build = false
     var options = Options.init(opts = build_options)
     var verbose = false
     var exclude_sessions: List[String] = Nil
 
     val getopts = Getopts("""
 Usage: isabelle build [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -N           cyclic shuffling of NUMA CPU nodes (performance tuning)
     -P DIR       enable HTML/PDF presentation in directory (":" for default)
     -R           refer to requirements of selected sessions
     -S           soft build: only observe changes of sources, not heap images
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b           build heap images
     -c           clean build
     -d DIR       include session directory
     -e           export files from session specification into file-system
     -f           fresh build
     -g NAME      select session group NAME
     -j INT       maximum number of parallel jobs (default 1)
     -k KEYWORD   check theory sources for conflicts with proposed keywords
     -l           list session source files
     -n           no build -- test dependencies only
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Build and manage Isabelle sessions, depending on implicit settings:
 
-""" + Library.prefix_lines("  ",  Build_Log.Settings.show()) + "\n",
+""" + Library.indent_lines(2,  Build_Log.Settings.show()) + "\n",
       "B:" -> (arg => base_sessions = base_sessions ::: List(arg)),
       "D:" -> (arg => select_dirs = select_dirs ::: List(Path.explode(arg))),
       "N" -> (_ => numa_shuffling = true),
       "P:" -> (arg => presentation = Presentation.Context.make(arg)),
       "R" -> (_ => requirements = true),
       "S" -> (_ => soft_build = true),
       "X:" -> (arg => exclude_session_groups = exclude_session_groups ::: List(arg)),
       "a" -> (_ => all_sessions = true),
       "b" -> (_ => build_heap = true),
       "c" -> (_ => clean_build = true),
       "d:" -> (arg => dirs = dirs ::: List(Path.explode(arg))),
       "e" -> (_ => export_files = true),
       "f" -> (_ => fresh_build = true),
       "g:" -> (arg => session_groups = session_groups ::: List(arg)),
       "j:" -> (arg => max_jobs = Value.Int.parse(arg)),
       "k:" -> (arg => check_keywords = check_keywords + arg),
       "l" -> (_ => list_files = true),
       "n" -> (_ => no_build = true),
       "o:" -> (arg => options = options + arg),
       "v" -> (_ => verbose = true),
       "x:" -> (arg => exclude_sessions = exclude_sessions ::: List(arg)))
 
     val sessions = getopts(args)
 
     val progress = new Console_Progress(verbose = verbose)
 
     val start_date = Date.now()
 
     if (verbose) {
       progress.echo(
         "Started at " + Build_Log.print_date(start_date) +
           " (" + Isabelle_System.getenv("ML_IDENTIFIER") + " on " + Isabelle_System.hostname() +")")
       progress.echo(Build_Log.Settings.show() + "\n")
     }
 
     val results =
       progress.interrupt_handler {
         build(options,
           selection = Sessions.Selection(
             requirements = requirements,
             all_sessions = all_sessions,
             base_sessions = base_sessions,
             exclude_session_groups = exclude_session_groups,
             exclude_sessions = exclude_sessions,
             session_groups = session_groups,
             sessions = sessions),
           presentation = presentation,
           progress = progress,
           check_unknown_files = Mercurial.is_repository(Path.ISABELLE_HOME),
           build_heap = build_heap,
           clean_build = clean_build,
           dirs = dirs,
           select_dirs = select_dirs,
           numa_shuffling = NUMA.enabled_warning(progress, numa_shuffling),
           max_jobs = max_jobs,
           list_files = list_files,
           check_keywords = check_keywords,
           fresh_build = fresh_build,
           no_build = no_build,
           soft_build = soft_build,
           verbose = verbose,
           export_files = export_files)
       }
     val end_date = Date.now()
     val elapsed_time = end_date.time - start_date.time
 
     if (verbose) {
       progress.echo("\nFinished at " + Build_Log.print_date(end_date))
     }
 
     val total_timing =
       results.sessions.iterator.map(a => results(a).timing).foldLeft(Timing.zero)(_ + _).
         copy(elapsed = elapsed_time)
     progress.echo(total_timing.message_resources)
 
     sys.exit(results.rc)
   })
 
 
   /* build logic image */
 
   def build_logic(options: Options, logic: String,
     progress: Progress = new Progress,
     build_heap: Boolean = false,
     dirs: List[Path] = Nil,
     fresh: Boolean = false,
     strict: Boolean = false): Int =
   {
     val selection = Sessions.Selection.session(logic)
     val rc =
       if (!fresh && build(options, selection = selection,
             build_heap = build_heap, no_build = true, dirs = dirs).ok) 0
       else {
         progress.echo("Build started for Isabelle/" + logic + " ...")
         Build.build(options, selection = selection, progress = progress,
           build_heap = build_heap, fresh_build = fresh, dirs = dirs).rc
       }
     if (strict && rc != 0) error("Failed to build Isabelle/" + logic) else rc
   }
 }
diff --git a/src/Pure/Tools/build_job.scala b/src/Pure/Tools/build_job.scala
--- a/src/Pure/Tools/build_job.scala
+++ b/src/Pure/Tools/build_job.scala
@@ -1,537 +1,537 @@
 /*  Title:      Pure/Tools/build_job.scala
     Author:     Makarius
 
 Build job running prover process, with rudimentary PIDE session.
 */
 
 package isabelle
 
 
 import scala.collection.mutable
 
 
 object Build_Job
 {
   /* theory markup/messages from database */
 
   def read_theory(
     db_context: Sessions.Database_Context,
     resources: Resources,
     session: String,
     theory: String,
     unicode_symbols: Boolean = false): Option[Command] =
   {
     def read(name: String): Export.Entry =
       db_context.get_export(List(session), theory, name)
 
     def read_xml(name: String): XML.Body =
       YXML.parse_body(
         Symbol.output(unicode_symbols, UTF8.decode_permissive(read(name).uncompressed)),
         cache = db_context.cache)
 
     (read(Export.DOCUMENT_ID).text, split_lines(read(Export.FILES).text)) match {
       case (Value.Long(id), thy_file :: blobs_files) =>
         val node_name = resources.file_node(Path.explode(thy_file), theory = theory)
 
         val results =
           Command.Results.make(
             for (elem @ XML.Elem(Markup(_, Markup.Serial(i)), _) <- read_xml(Export.MESSAGES))
               yield i -> elem)
 
         val blobs =
           blobs_files.map(file =>
           {
             val path = Path.explode(file)
             val name = resources.file_node(path)
             val src_path = File.relative_path(node_name.master_dir_path, path).getOrElse(path)
             Command.Blob(name, src_path, None)
           })
         val blobs_xml =
           for (i <- (1 to blobs.length).toList)
             yield read_xml(Export.MARKUP + i)
 
         val blobs_info =
           Command.Blobs_Info(
             for { (Command.Blob(name, src_path, _), xml) <- blobs zip blobs_xml }
               yield {
                 val text = XML.content(xml)
                 val chunk = Symbol.Text_Chunk(text)
                 val digest = SHA1.digest(Symbol.encode(text))
                 Exn.Res(Command.Blob(name, src_path, Some((digest, chunk))))
               })
 
         val thy_xml = read_xml(Export.MARKUP)
         val thy_source = XML.content(thy_xml)
 
         val markups_index =
           Command.Markup_Index.markup :: blobs.map(Command.Markup_Index.blob)
         val markups =
           Command.Markups.make(
             for ((index, xml) <- markups_index.zip(thy_xml :: blobs_xml))
             yield index -> Markup_Tree.from_XML(xml))
 
         val command =
           Command.unparsed(thy_source, theory = true, id = id, node_name = node_name,
             blobs_info = blobs_info, results = results, markups = markups)
         Some(command)
       case _ => None
     }
   }
 
 
   /* print messages */
 
   def print_log(
     options: Options,
     session_name: String,
     theories: List[String] = Nil,
     verbose: Boolean = false,
     progress: Progress = new Progress,
     margin: Double = Pretty.default_margin,
     breakgain: Double = Pretty.default_breakgain,
     metric: Pretty.Metric = Symbol.Metric,
     unicode_symbols: Boolean = false): Unit =
   {
     val store = Sessions.store(options)
 
     val resources = Resources.empty
     val session = new Session(options, resources)
 
     using(store.open_database_context())(db_context =>
     {
       val result =
         db_context.input_database(session_name)((db, _) =>
         {
           val theories = store.read_theories(db, session_name)
           val errors = store.read_errors(db, session_name)
           store.read_build(db, session_name).map(info => (theories, errors, info.return_code))
         })
       result match {
         case None => error("Missing build database for session " + quote(session_name))
         case Some((used_theories, errors, rc)) =>
           val bad_theories = theories.filterNot(used_theories.toSet)
           if (bad_theories.nonEmpty) error("Unknown theories " + commas_quote(bad_theories))
 
           val print_theories =
             if (theories.isEmpty) used_theories else used_theories.filter(theories.toSet)
           for (thy <- print_theories) {
             val thy_heading = "\nTheory " + quote(thy) + ":"
             read_theory(db_context, resources, session_name, thy, unicode_symbols = unicode_symbols)
             match {
               case None => progress.echo(thy_heading + " MISSING")
               case Some(command) =>
                 val snapshot = Document.State.init.snippet(command)
                 val rendering = new Rendering(snapshot, options, session)
                 val messages =
                   rendering.text_messages(Text.Range.full)
                     .filter(message => verbose || Protocol.is_exported(message.info))
                 if (messages.nonEmpty) {
                   val line_document = Line.Document(command.source)
                   progress.echo(thy_heading)
                   for (Text.Info(range, elem) <- messages) {
                     val line = line_document.position(range.start).line1
                     val pos = Position.Line_File(line, command.node_name.node)
                     progress.echo(
                       Protocol.message_text(elem, heading = true, pos = pos,
                         margin = margin, breakgain = breakgain, metric = metric))
                   }
                 }
             }
           }
 
           if (errors.nonEmpty) {
             val msg = Symbol.output(unicode_symbols, cat_lines(errors))
             progress.echo("\nBuild errors:\n" + Output.error_message_text(msg))
           }
           if (rc != 0) progress.echo("\n" + Process_Result.print_return_code(rc))
       }
     })
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool = Isabelle_Tool("log", "print messages from build database",
     Scala_Project.here, args =>
   {
     /* arguments */
 
     var unicode_symbols = false
     var theories: List[String] = Nil
     var margin = Pretty.default_margin
     var options = Options.init()
     var verbose = false
 
     val getopts = Getopts("""
 Usage: isabelle log [OPTIONS] SESSION
 
   Options are:
     -T NAME      restrict to given theories (multiple options possible)
     -U           output Unicode symbols
     -m MARGIN    margin for pretty printing (default: """ + margin + """)
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           print all messages, including information, tracing etc.
 
   Print messages from the build database of the given session, without any
   checks against current sources: results from a failed build can be
   printed as well.
 """,
       "T:" -> (arg => theories = theories ::: List(arg)),
       "U" -> (_ => unicode_symbols = true),
       "m:" -> (arg => margin = Value.Double.parse(arg)),
       "o:" -> (arg => options = options + arg),
       "v" -> (_ => verbose = true))
 
     val more_args = getopts(args)
     val session_name =
       more_args match {
         case List(session_name) => session_name
         case _ => getopts.usage()
       }
 
     val progress = new Console_Progress()
 
     print_log(options, session_name, theories = theories, verbose = verbose, margin = margin,
       progress = progress, unicode_symbols = unicode_symbols)
   })
 }
 
 class Build_Job(progress: Progress,
   session_name: String,
   val info: Sessions.Info,
   deps: Sessions.Deps,
   store: Sessions.Store,
   do_store: Boolean,
   verbose: Boolean,
   val numa_node: Option[Int],
   command_timings0: List[Properties.T])
 {
   val options: Options = NUMA.policy_options(info.options, numa_node)
 
   private val sessions_structure = deps.sessions_structure
 
   private val future_result: Future[Process_Result] =
     Future.thread("build", uninterruptible = true) {
       val parent = info.parent.getOrElse("")
       val base = deps(parent)
       val result_base = deps(session_name)
 
       val env =
         Isabelle_System.settings() +
           ("ISABELLE_ML_DEBUGGER" -> options.bool("ML_debugger").toString)
 
       val is_pure = Sessions.is_pure(session_name)
 
       val use_prelude = if (is_pure) Thy_Header.ml_roots.map(_._1) else Nil
 
       val eval_store =
         if (do_store) {
           (if (info.theories.nonEmpty) List("ML_Heap.share_common_data ()") else Nil) :::
           List("ML_Heap.save_child " +
             ML_Syntax.print_string_bytes(File.platform_path(store.output_heap(session_name))))
         }
         else Nil
 
       val resources = new Resources(sessions_structure, base, command_timings = command_timings0)
       val session =
         new Session(options, resources) {
           override val cache: XML.Cache = store.cache
 
           override def build_blobs_info(name: Document.Node.Name): Command.Blobs_Info =
           {
             result_base.load_commands.get(name.expand) match {
               case Some(spans) =>
                 val syntax = result_base.theory_syntax(name)
                 Command.build_blobs_info(syntax, name, spans)
               case None => Command.Blobs_Info.none
             }
           }
         }
 
       object Build_Session_Errors
       {
         private val promise: Promise[List[String]] = Future.promise
 
         def result: Exn.Result[List[String]] = promise.join_result
         def cancel(): Unit = promise.cancel()
         def apply(errs: List[String]): Unit =
         {
           try { promise.fulfill(errs) }
           catch { case _: IllegalStateException => }
         }
       }
 
       val export_consumer =
         Export.consumer(store.open_database(session_name, output = true), store.cache)
 
       val stdout = new StringBuilder(1000)
       val stderr = new StringBuilder(1000)
       val command_timings = new mutable.ListBuffer[Properties.T]
       val theory_timings = new mutable.ListBuffer[Properties.T]
       val session_timings = new mutable.ListBuffer[Properties.T]
       val runtime_statistics = new mutable.ListBuffer[Properties.T]
       val task_statistics = new mutable.ListBuffer[Properties.T]
 
       def fun(
         name: String,
         acc: mutable.ListBuffer[Properties.T],
         unapply: Properties.T => Option[Properties.T]): (String, Session.Protocol_Function) =
       {
         name -> ((msg: Prover.Protocol_Output) =>
           unapply(msg.properties) match {
             case Some(props) => acc += props; true
             case _ => false
           })
       }
 
       session.init_protocol_handler(new Session.Protocol_Handler
         {
           override def exit(): Unit = Build_Session_Errors.cancel()
 
           private def build_session_finished(msg: Prover.Protocol_Output): Boolean =
           {
             val (rc, errors) =
               try {
                 val (rc, errs) =
                 {
                   import XML.Decode._
                   pair(int, list(x => x))(Symbol.decode_yxml(msg.text))
                 }
                 val errors =
                   for (err <- errs) yield {
                     val prt = Protocol_Message.expose_no_reports(err)
                     Pretty.string_of(prt, metric = Symbol.Metric)
                   }
                 (rc, errors)
               }
               catch { case ERROR(err) => (2, List(err)) }
 
             session.protocol_command("Prover.stop", rc.toString)
             Build_Session_Errors(errors)
             true
           }
 
           private def loading_theory(msg: Prover.Protocol_Output): Boolean =
             msg.properties match {
               case Markup.Loading_Theory(Markup.Name(name)) =>
                 progress.theory(Progress.Theory(name, session = session_name))
                 false
               case _ => false
             }
 
           private def export(msg: Prover.Protocol_Output): Boolean =
             msg.properties match {
               case Protocol.Export(args) =>
                 export_consumer(session_name, args, msg.chunk)
                 true
               case _ => false
             }
 
           override val functions =
             List(
               Markup.Build_Session_Finished.name -> build_session_finished,
               Markup.Loading_Theory.name -> loading_theory,
               Markup.EXPORT -> export,
               fun(Markup.Theory_Timing.name, theory_timings, Markup.Theory_Timing.unapply),
               fun(Markup.Session_Timing.name, session_timings, Markup.Session_Timing.unapply),
               fun(Markup.Task_Statistics.name, task_statistics, Markup.Task_Statistics.unapply))
         })
 
       session.command_timings += Session.Consumer("command_timings")
         {
           case Session.Command_Timing(props) =>
             for {
               elapsed <- Markup.Elapsed.unapply(props)
               elapsed_time = Time.seconds(elapsed)
               if elapsed_time.is_relevant && elapsed_time >= options.seconds("command_timing_threshold")
             } command_timings += props.filter(Markup.command_timing_property)
         }
 
       session.runtime_statistics += Session.Consumer("ML_statistics")
         {
           case Session.Runtime_Statistics(props) => runtime_statistics += props
         }
 
       session.finished_theories += Session.Consumer[Document.Snapshot]("finished_theories")
         {
           case snapshot =>
             val rendering = new Rendering(snapshot, options, session)
 
             def export(name: String, xml: XML.Body, compress: Boolean = true): Unit =
             {
               val theory_name = snapshot.node_name.theory
               val args =
                 Protocol.Export.Args(theory_name = theory_name, name = name, compress = compress)
               val bytes = Bytes(Symbol.encode(YXML.string_of_body(xml)))
               if (!bytes.is_empty) export_consumer(session_name, args, bytes)
             }
             def export_text(name: String, text: String, compress: Boolean = true): Unit =
               export(name, List(XML.Text(text)), compress = compress)
 
             for (command <- snapshot.snippet_command) {
               export_text(Export.DOCUMENT_ID, command.id.toString, compress = false)
             }
 
             export_text(Export.FILES,
               cat_lines(snapshot.node_files.map(_.symbolic.node)), compress = false)
 
             for (((_, xml), i) <- snapshot.xml_markup_blobs().zipWithIndex) {
               export(Export.MARKUP + (i + 1), xml)
             }
             export(Export.MARKUP, snapshot.xml_markup())
             export(Export.MESSAGES, snapshot.messages.map(_._1))
 
             val citations = Library.distinct(rendering.citations(Text.Range.full).map(_.info))
             export_text(Export.CITATIONS, cat_lines(citations))
         }
 
       session.all_messages += Session.Consumer[Any]("build_session_output")
         {
           case msg: Prover.Output =>
             val message = msg.message
             if (msg.is_stdout) {
               stdout ++= Symbol.encode(XML.content(message))
             }
             else if (msg.is_stderr) {
               stderr ++= Symbol.encode(XML.content(message))
             }
             else if (msg.is_exit) {
               val err =
                 "Prover terminated" +
                   (msg.properties match {
                     case Markup.Process_Result(result) => ": " + result.print_rc
                     case _ => ""
                   })
               Build_Session_Errors(List(err))
             }
           case _ =>
         }
 
       val eval_main = Command_Line.ML_tool("Isabelle_Process.init_build ()" :: eval_store)
 
       val process =
         Isabelle_Process(session, options, sessions_structure, store,
           logic = parent, raw_ml_system = is_pure,
           use_prelude = use_prelude, eval_main = eval_main,
           cwd = info.dir.file, env = env)
 
       val build_errors =
         Isabelle_Thread.interrupt_handler(_ => process.terminate()) {
           Exn.capture { process.await_startup() } match {
             case Exn.Res(_) =>
               val resources_yxml = resources.init_session_yxml
               val args_yxml =
                 YXML.string_of_body(
                   {
                     import XML.Encode._
                     pair(string, list(pair(Options.encode, list(pair(string, properties)))))(
                       (session_name, info.theories))
                   })
               session.protocol_command("build_session", resources_yxml, args_yxml)
               Build_Session_Errors.result
             case Exn.Exn(exn) => Exn.Res(List(Exn.message(exn)))
           }
         }
 
       val process_result =
         Isabelle_Thread.interrupt_handler(_ => process.terminate()) { process.await_shutdown() }
 
       session.stop()
 
       val export_errors =
         export_consumer.shutdown(close = true).map(Output.error_message_text)
 
       val (document_output, document_errors) =
         try {
           if (build_errors.isInstanceOf[Exn.Res[_]] && process_result.ok && info.documents.nonEmpty) {
             using(store.open_database_context())(db_context =>
               {
                 val documents =
-                  Presentation.build_documents(session_name, deps, db_context,
+                  Document_Build.build_documents(
+                    Document_Build.context(session_name, deps, db_context, progress = progress),
                     output_sources = info.document_output,
                     output_pdf = info.document_output,
-                    progress = progress,
                     verbose = verbose)
                 db_context.output_database(session_name)(db =>
                   documents.foreach(_.write(db, session_name)))
                 (documents.flatMap(_.log_lines), Nil)
               })
           }
           else (Nil, Nil)
         }
         catch {
-          case exn: Presentation.Build_Error => (exn.log_lines, List(exn.message))
+          case exn: Document_Build.Build_Error => (exn.log_lines, List(exn.message))
           case Exn.Interrupt.ERROR(msg) => (Nil, List(msg))
         }
 
       val result =
       {
         val theory_timing =
           theory_timings.iterator.map(
             { case props @ Markup.Name(name) => name -> props }).toMap
         val used_theory_timings =
           for { (name, _) <- deps(session_name).used_theories }
             yield theory_timing.getOrElse(name.theory, Markup.Name(name.theory))
 
         val more_output =
           Library.trim_line(stdout.toString) ::
             command_timings.toList.map(Protocol.Command_Timing_Marker.apply) :::
             used_theory_timings.map(Protocol.Theory_Timing_Marker.apply) :::
             session_timings.toList.map(Protocol.Session_Timing_Marker.apply) :::
             runtime_statistics.toList.map(Protocol.ML_Statistics_Marker.apply) :::
             task_statistics.toList.map(Protocol.Task_Statistics_Marker.apply) :::
             document_output
 
         process_result.output(more_output)
           .error(Library.trim_line(stderr.toString))
           .errors_rc(export_errors ::: document_errors)
       }
 
       build_errors match {
         case Exn.Res(build_errs) =>
           val errs = build_errs ::: document_errors
           if (errs.isEmpty) result
           else {
             result.error_rc.output(
               errs.flatMap(s => split_lines(Output.error_message_text(s))) :::
                 errs.map(Protocol.Error_Message_Marker.apply))
           }
         case Exn.Exn(Exn.Interrupt()) =>
           if (result.ok) result.copy(rc = Exn.Interrupt.return_code) else result
         case Exn.Exn(exn) => throw exn
       }
     }
 
   def terminate(): Unit = future_result.cancel()
   def is_finished: Boolean = future_result.is_finished
 
   private val timeout_request: Option[Event_Timer.Request] =
   {
     if (info.timeout_ignored) None
     else Some(Event_Timer.request(Time.now() + info.timeout) { terminate() })
   }
 
   def join: (Process_Result, Option[String]) =
   {
     val result1 = future_result.join
 
     val was_timeout =
       timeout_request match {
         case None => false
         case Some(request) => !request.cancel()
       }
 
     val result2 =
       if (result1.ok) result1
       else if (was_timeout) result1.error(Output.error_message_text("Timeout")).timeout_rc
       else if (result1.interrupted) result1.error(Output.error_message_text("Interrupt"))
       else result1
 
     val heap_digest =
       if (result2.ok && do_store && store.output_heap(session_name).is_file)
         Some(Sessions.write_heap_digest(store.output_heap(session_name)))
       else None
 
     (result2, heap_digest)
   }
 }
diff --git a/src/Pure/Tools/doc.ML b/src/Pure/Tools/doc.ML
--- a/src/Pure/Tools/doc.ML
+++ b/src/Pure/Tools/doc.ML
@@ -1,24 +1,24 @@
 (*  Title:      Pure/Tools/doc.ML
     Author:     Makarius
 
 Access to Isabelle documentation.
 *)
 
 signature DOC =
 sig
   val check: Proof.context -> string * Position.T -> string
 end;
 
 structure Doc: DOC =
 struct
 
 fun check ctxt arg =
   Completion.check_item "documentation" (Markup.doc o #1)
     (\<^scala>\<open>doc_names\<close> "" |> split_lines |> map (rpair ())) ctxt arg;
 
 val _ =
   Theory.setup
-   (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>doc\<close>
+   (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>doc\<close>
       (Scan.lift Parse.embedded_position) check);
 
 end;
diff --git a/src/Pure/Tools/dump.scala b/src/Pure/Tools/dump.scala
--- a/src/Pure/Tools/dump.scala
+++ b/src/Pure/Tools/dump.scala
@@ -1,505 +1,505 @@
 /*  Title:      Pure/Tools/dump.scala
     Author:     Makarius
 
 Dump cumulative PIDE session database.
 */
 
 package isabelle
 
 import java.io.{BufferedWriter, FileOutputStream, OutputStreamWriter}
 
 
 object Dump
 {
   /* aspects */
 
   sealed case class Aspect_Args(
     options: Options,
     deps: Sessions.Deps,
     progress: Progress,
     output_dir: Path,
     snapshot: Document.Snapshot,
     status: Document_Status.Node_Status)
   {
     def write_path(file_name: Path): Path =
     {
       val path = output_dir + Path.basic(snapshot.node_name.theory) + file_name
       Isabelle_System.make_directory(path.dir)
       path
     }
 
     def write(file_name: Path, bytes: Bytes): Unit =
       Bytes.write(write_path(file_name), bytes)
 
     def write(file_name: Path, text: String): Unit =
       write(file_name, Bytes(text))
 
     def write(file_name: Path, body: XML.Body): Unit =
       using(File.writer(write_path(file_name).file))(
         writer => YXML.traversal(s => writer.write(Symbol.encode(s)), body))
   }
 
   sealed case class Aspect(name: String, description: String, operation: Aspect_Args => Unit,
     options: List[String] = Nil)
   {
     override def toString: String = name
   }
 
   val known_aspects: List[Aspect] =
     List(
       Aspect("markup", "PIDE markup (YXML format)",
         args => args.write(Path.explode(Export.MARKUP), args.snapshot.xml_markup())),
       Aspect("messages", "output messages (YXML format)",
         args => args.write(Path.explode(Export.MESSAGES), args.snapshot.messages.map(_._1))),
       Aspect("latex", "generated LaTeX source",
         args =>
           for {
             entry <- args.snapshot.exports
             if entry.name_has_prefix(Export.DOCUMENT_PREFIX)
           } args.write(Path.explode(entry.name), entry.uncompressed)),
       Aspect("theory", "foundational theory content",
         args =>
           for {
             entry <- args.snapshot.exports
             if entry.name_has_prefix(Export.THEORY_PREFIX)
           } args.write(Path.explode(entry.name), entry.uncompressed),
         options = List("export_theory"))
     ).sortBy(_.name)
 
   def show_aspects: String =
     cat_lines(known_aspects.map(aspect => aspect.name + " - " + aspect.description))
 
   def the_aspect(name: String): Aspect =
     known_aspects.find(aspect => aspect.name == name) getOrElse
       error("Unknown aspect " + quote(name))
 
 
   /* context and session */
 
   sealed case class Args(
     session: Headless.Session,
     snapshot: Document.Snapshot,
     status: Document_Status.Node_Status)
   {
     def print_node: String = snapshot.node_name.toString
   }
 
   object Context
   {
     def apply(
       options: Options,
       aspects: List[Aspect] = Nil,
       progress: Progress = new Progress,
       dirs: List[Path] = Nil,
       select_dirs: List[Path] = Nil,
       selection: Sessions.Selection = Sessions.Selection.empty,
       pure_base: Boolean = false,
       skip_base: Boolean = false): Context =
     {
       val session_options: Options =
       {
         val options0 = if (NUMA.enabled) NUMA.policy_options(options) else options
         val options1 =
           options0 +
             "parallel_proofs=0" +
             "completion_limit=0" +
             "editor_tracing_messages=0" +
             "editor_presentation"
         aspects.foldLeft(options1) { case (opts, aspect) => aspect.options.foldLeft(opts)(_ + _) }
       }
 
       val sessions_structure: Sessions.Structure =
         Sessions.load_structure(session_options, dirs = dirs, select_dirs = select_dirs).
           selection(selection)
 
       {
         val selection_size = sessions_structure.build_graph.size
         if (selection_size > 1) progress.echo("Loading " + selection_size + " sessions ...")
       }
 
       val deps: Sessions.Deps =
         Sessions.deps(sessions_structure, progress = progress).check_errors
 
       new Context(options, progress, dirs, select_dirs, pure_base, skip_base, session_options, deps)
     }
   }
 
   class Context private(
     val options: Options,
     val progress: Progress,
     val dirs: List[Path],
     val select_dirs: List[Path],
     val pure_base: Boolean,
     val skip_base: Boolean,
     val session_options: Options,
     val deps: Sessions.Deps)
   {
     context =>
 
     def session_dirs: List[Path] = dirs ::: select_dirs
 
     def build_logic(logic: String): Unit =
     {
       Build.build_logic(options, logic, build_heap = true, progress = progress,
         dirs = session_dirs, strict = true)
     }
 
     def sessions(
       logic: String = default_logic,
       log: Logger = No_Logger): List[Session] =
     {
       /* partitions */
 
       def session_info(session_name: String): Sessions.Info =
         deps.sessions_structure(session_name)
 
       val session_graph = deps.sessions_structure.build_graph
       val all_sessions = session_graph.topological_order
 
       val afp_sessions =
         (for (name <- all_sessions if session_info(name).is_afp) yield name).toSet
 
       val afp_bulky_sessions =
         (for (name <- all_sessions if session_info(name).is_afp_bulky) yield name).toList
 
       val base_sessions =
         session_graph.all_preds_rev(List(logic).filter(session_graph.defined))
 
       val proof_sessions =
         session_graph.all_succs(
           for (name <- all_sessions if session_info(name).record_proofs) yield name)
 
 
       /* resulting sessions */
 
       def make_session(
         selected_sessions: List[String],
         session_logic: String = logic,
         strict: Boolean = false,
         record_proofs: Boolean = false): List[Session] =
       {
         if (selected_sessions.isEmpty && !strict) Nil
         else List(new Session(context, session_logic, log, selected_sessions, record_proofs))
       }
 
       val PURE = isabelle.Thy_Header.PURE
 
       val base =
         if ((logic == PURE && !pure_base) || skip_base) Nil
         else make_session(base_sessions, session_logic = PURE, strict = logic == PURE)
 
       val main =
         make_session(
           session_graph.topological_order.filterNot(name =>
             afp_sessions.contains(name) ||
             base_sessions.contains(name) ||
             proof_sessions.contains(name)))
 
       val proofs = make_session(proof_sessions, session_logic = PURE, record_proofs = true)
 
       val afp =
         if (afp_sessions.isEmpty) Nil
         else {
           val (part1, part2) =
           {
             val graph = session_graph.restrict(afp_sessions -- afp_bulky_sessions)
             val force_partition1 = AFP.force_partition1.filter(graph.defined)
             val force_part1 = graph.all_preds(graph.all_succs(force_partition1)).toSet
             graph.keys.partition(a => force_part1(a) || graph.is_isolated(a))
           }
           List(part1, part2, afp_bulky_sessions).flatMap(make_session(_))
         }
 
       proofs ::: base ::: main ::: afp
     }
 
 
     /* processed theories */
 
     private val processed_theories = Synchronized(Set.empty[String])
 
     def process_theory(theory: String): Boolean =
       processed_theories.change_result(processed => (!processed(theory), processed + theory))
 
 
     /* errors */
 
     private val errors = Synchronized(List.empty[String])
 
     def add_errors(more_errs: List[String]): Unit =
     {
       errors.change(errs => errs ::: more_errs)
     }
 
     def check_errors: Unit =
     {
       val errs = errors.value
       if (errs.nonEmpty) error(errs.mkString("\n\n"))
     }
   }
 
   class Session private[Dump](
     val context: Context,
     val logic: String,
     log: Logger,
     selected_sessions: List[String],
     record_proofs: Boolean)
   {
     /* resources */
 
     val options: Options =
       if (record_proofs) context.session_options + "record_proofs=2"
       else context.session_options
 
     private def deps = context.deps
     private def progress = context.progress
 
     val resources: Headless.Resources =
       Headless.Resources.make(options, logic, progress = progress, log = log,
         session_dirs = context.session_dirs,
         include_sessions = deps.sessions_structure.imports_topological_order)
 
     val used_theories: List[Document.Node.Name] =
     {
       for {
         session_name <-
           deps.sessions_structure.build_graph.restrict(selected_sessions.toSet).topological_order
         (name, theory_options) <- deps(session_name).used_theories
         if !resources.session_base.loaded_theory(name.theory)
         if {
           def warn(msg: String): Unit =
             progress.echo_warning("Skipping theory " + name + "  (" + msg + ")")
 
           val conditions =
             space_explode(',', theory_options.string("condition")).
               filter(cond => Isabelle_System.getenv(cond) == "")
           if (conditions.nonEmpty) {
             warn("undefined " + conditions.mkString(", "))
             false
           }
           else if (options.bool("skip_proofs") && !theory_options.bool("skip_proofs")) {
             warn("option skip_proofs")
             false
           }
           else true
         }
       } yield name
     }
 
 
     /* process */
 
     def process(process_theory: Args => Unit, unicode_symbols: Boolean = false): Unit =
     {
       val session = resources.start_session(progress = progress)
 
 
       // asynchronous consumer
 
       object Consumer
       {
         sealed case class Bad_Theory(
           name: Document.Node.Name,
           status: Document_Status.Node_Status,
           errors: List[String])
 
         private val consumer_bad_theories = Synchronized(List.empty[Bad_Theory])
 
         private val consumer =
           Consumer_Thread.fork(name = "dump")(
             consume = (args: (Document.Snapshot, Document_Status.Node_Status)) =>
               {
                 val (snapshot, status) = args
                 val name = snapshot.node_name
                 if (status.ok) {
                   try {
                     if (context.process_theory(name.theory)) {
                       process_theory(Args(session, snapshot, status))
                     }
                   }
                   catch {
                     case exn: Throwable if !Exn.is_interrupt(exn) =>
                       val msg = Exn.message(exn)
                       progress.echo("FAILED to process theory " + name)
                       progress.echo_error_message(msg)
                       consumer_bad_theories.change(Bad_Theory(name, status, List(msg)) :: _)
                   }
                 }
                 else {
                   val msgs =
                     for ((elem, pos) <- snapshot.messages if Protocol.is_error(elem))
                     yield {
                       "Error" + Position.here(pos) + ":\n" +
                         XML.content(Pretty.formatted(List(elem)))
                     }
                   progress.echo("FAILED to process theory " + name)
                   msgs.foreach(progress.echo_error_message)
                   consumer_bad_theories.change(Bad_Theory(name, status, msgs) :: _)
                 }
                 true
               })
 
         def apply(snapshot: Document.Snapshot, status: Document_Status.Node_Status): Unit =
           consumer.send((snapshot, status))
 
         def shutdown(): List[Bad_Theory] =
         {
           consumer.shutdown()
           consumer_bad_theories.value.reverse
         }
       }
 
 
       // synchronous body
 
       try {
         val use_theories_result =
           session.use_theories(used_theories.map(_.theory),
             unicode_symbols = unicode_symbols,
             progress = progress,
             commit = Some(Consumer.apply))
 
         val bad_theories = Consumer.shutdown()
         val bad_msgs =
           bad_theories.map(bad =>
             Output.clean_yxml(
               "FAILED theory " + bad.name +
                 (if (bad.status.consolidated) "" else ": " + bad.status.percentage + "% finished") +
                 (if (bad.errors.isEmpty) "" else bad.errors.mkString("\n", "\n", ""))))
 
         val pending_msgs =
           use_theories_result.nodes_pending match {
             case Nil => Nil
             case pending => List("Pending theories: " + commas(pending.map(p => p._1.toString)))
           }
 
         context.add_errors(bad_msgs ::: pending_msgs)
       }
       finally { session.stop() }
     }
   }
 
 
   /* dump */
 
   val default_output_dir: Path = Path.explode("dump")
   val default_logic: String = Thy_Header.PURE
 
   def dump(
     options: Options,
     logic: String,
     aspects: List[Aspect] = Nil,
     progress: Progress = new Progress,
     log: Logger = No_Logger,
     dirs: List[Path] = Nil,
     select_dirs: List[Path] = Nil,
     output_dir: Path = default_output_dir,
     selection: Sessions.Selection = Sessions.Selection.empty): Unit =
   {
     val context =
       Context(options, aspects = aspects, progress = progress, dirs = dirs,
         select_dirs = select_dirs, selection = selection)
 
     context.build_logic(logic)
 
     for (session <- context.sessions(logic = logic, log = log)) {
       session.process((args: Args) =>
         {
           progress.echo("Processing theory " + args.print_node + " ...")
           val aspect_args =
             Aspect_Args(session.options, context.deps, progress, output_dir,
               args.snapshot, args.status)
           aspects.foreach(_.operation(aspect_args))
         })
     }
 
     context.check_errors
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool =
     Isabelle_Tool("dump", "dump cumulative PIDE session database", Scala_Project.here, args =>
     {
       var aspects: List[Aspect] = known_aspects
       var base_sessions: List[String] = Nil
       var select_dirs: List[Path] = Nil
       var output_dir = default_output_dir
       var requirements = false
       var exclude_session_groups: List[String] = Nil
       var all_sessions = false
       var logic = default_logic
       var dirs: List[Path] = Nil
       var session_groups: List[String] = Nil
       var options = Options.init()
       var verbose = false
       var exclude_sessions: List[String] = Nil
 
       val getopts = Getopts("""
 Usage: isabelle dump [OPTIONS] [SESSIONS ...]
 
   Options are:
     -A NAMES     dump named aspects (default: """ + known_aspects.mkString("\"", ",", "\"") + """)
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -O DIR       output directory for dumped files (default: """ + default_output_dir + """)
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b NAME      base logic image (default """ + isabelle.quote(default_logic) + """)
     -d DIR       include session directory
     -g NAME      select session group NAME
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Dump cumulative PIDE session database, with the following aspects:
 
-""" + Library.prefix_lines("    ", show_aspects) + "\n",
+""" + Library.indent_lines(4, show_aspects) + "\n",
       "A:" -> (arg => aspects = Library.distinct(space_explode(',', arg)).map(the_aspect)),
       "B:" -> (arg => base_sessions = base_sessions ::: List(arg)),
       "D:" -> (arg => select_dirs = select_dirs ::: List(Path.explode(arg))),
       "O:" -> (arg => output_dir = Path.explode(arg)),
       "R" -> (_ => requirements = true),
       "X:" -> (arg => exclude_session_groups = exclude_session_groups ::: List(arg)),
       "a" -> (_ => all_sessions = true),
       "b:" -> (arg => logic = arg),
       "d:" -> (arg => dirs = dirs ::: List(Path.explode(arg))),
       "g:" -> (arg => session_groups = session_groups ::: List(arg)),
       "o:" -> (arg => options = options + arg),
       "v" -> (_ => verbose = true),
       "x:" -> (arg => exclude_sessions = exclude_sessions ::: List(arg)))
 
       val sessions = getopts(args)
 
       val progress = new Console_Progress(verbose = verbose)
 
       val start_date = Date.now()
 
       progress.echo_if(verbose, "Started at " + Build_Log.print_date(start_date))
 
       progress.interrupt_handler {
         dump(options, logic,
           aspects = aspects,
           progress = progress,
           dirs = dirs,
           select_dirs = select_dirs,
           output_dir = output_dir,
           selection = Sessions.Selection(
             requirements = requirements,
             all_sessions = all_sessions,
             base_sessions = base_sessions,
             exclude_session_groups = exclude_session_groups,
             exclude_sessions = exclude_sessions,
             session_groups = session_groups,
             sessions = sessions))
       }
 
       val end_date = Date.now()
       val timing = end_date.time - start_date.time
 
       progress.echo_if(verbose, "\nFinished at " + Build_Log.print_date(end_date))
       progress.echo(timing.message_hms + " elapsed time")
     })
 }
diff --git a/src/Pure/Tools/jedit.ML b/src/Pure/Tools/jedit.ML
--- a/src/Pure/Tools/jedit.ML
+++ b/src/Pure/Tools/jedit.ML
@@ -1,90 +1,90 @@
 (*  Title:      Pure/Tools/jedit.ML
     Author:     Makarius
 
 Support for Isabelle/jEdit.
 *)
 
 signature JEDIT =
 sig
   val get_actions: unit -> string list
   val check_action: string * Position.T -> string
 end;
 
 structure JEdit: JEDIT =
 struct
 
 (* parse XML *)
 
 fun parse_named a (XML.Elem ((b, props), _)) =
       (case Properties.get props "NAME" of
         SOME name => if a = b then [name] else []
       | NONE => [])
   | parse_named _ _ = [];
 
 fun parse_actions (XML.Elem (("ACTIONS", _), body)) = maps (parse_named "ACTION") body
   | parse_actions _ = [];
 
 fun parse_dockables (XML.Elem (("DOCKABLES", _), body)) =
       maps (parse_named "DOCKABLE") body
       |> maps (fn a => [a, a ^ "-toggle", a ^ "-float"])
   | parse_dockables _ = [];
 
 
 (* XML resources *)
 
 val xml_file = XML.parse o File.read;
 
 fun xml_resource name =
   let
     val res =
       Isabelle_System.bash_process ("unzip -p \"$JEDIT_HOME/dist/jedit.jar\" " ^ Bash.string name);
     val rc = Process_Result.rc res;
   in
     res |> Process_Result.check |> Process_Result.out |> XML.parse
       handle ERROR _ => error ("Cannot unzip jedit.jar\nreturn code = " ^ string_of_int rc)
   end;
 
 
 (* actions *)
 
 val lazy_actions =
   Lazy.lazy (fn () =>
     (parse_actions (xml_file \<^file>\<open>~~/src/Tools/jEdit/src/actions.xml\<close>) @
       parse_dockables (xml_file \<^file>\<open>~~/src/Tools/jEdit/src/dockables.xml\<close>) @
       parse_actions (xml_resource "org/gjt/sp/jedit/actions.xml") @
       parse_dockables (xml_resource "org/gjt/sp/jedit/dockables.xml"))
     |> sort_strings);
 
 fun get_actions () = Lazy.force lazy_actions;
 
 fun check_action (name, pos) =
   if member (op =) (get_actions ()) name then
     let
       val ((bg1, bg2), en) =
         YXML.output_markup_elem
           (Active.make_markup Markup.jedit_actionN {implicit = false, properties = []});
       val msg = "Invoke " ^ bg1 ^ name ^ bg2 ^ name ^ en ^ " jEdit action";
     in writeln (msg ^ Position.here pos); name end
   else
     let
       val completion_report =
         Completion.make_report (name, pos)
           (fn completed =>
             get_actions ()
             |> filter completed
             |> sort_strings
             |> map (fn a => (a, ("action", a))));
     in error ("Bad jEdit action " ^ quote name ^ Position.here pos ^ completion_report) end;
 
 val _ =
   Theory.setup
-    (Thy_Output.antiquotation_verbatim_embedded \<^binding>\<open>action\<close> (Scan.lift Args.embedded_position)
+    (Document_Output.antiquotation_verbatim_embedded \<^binding>\<open>action\<close> (Scan.lift Args.embedded_position)
       (fn ctxt => fn (name, pos) =>
         let
           val _ =
             if Context_Position.is_reported ctxt pos
             then ignore (check_action (name, pos))
             else ();
         in name end));
 
 end;
diff --git a/src/Pure/Tools/logo.scala b/src/Pure/Tools/logo.scala
--- a/src/Pure/Tools/logo.scala
+++ b/src/Pure/Tools/logo.scala
@@ -1,58 +1,64 @@
 /*  Title:      Pure/Tools/logo.scala
     Author:     Makarius
 
 Create variants of the Isabelle logo (PDF).
 */
 
 package isabelle
 
 
 object Logo
 {
   /* create logo */
 
+  def make_output_file(logo_name: String): Path =
+  {
+    val name = if (logo_name.isEmpty) "isabelle" else "isabelle_" + Word.lowercase(logo_name)
+    Path.explode(name).pdf
+  }
+
   def create_logo(logo_name: String, output_file: Path, quiet: Boolean = false): Unit =
   {
     Isabelle_System.with_tmp_file("logo", ext = "eps")(tmp_file =>
     {
       val template = File.read(Path.explode("$ISABELLE_HOME/lib/logo/isabelle_any.eps"))
       File.write(tmp_file, template.replace("<any>", logo_name))
+
       Isabelle_System.bash(
         "\"$ISABELLE_EPSTOPDF\" --filter < " + File.bash_path(tmp_file) +
           " > " + File.bash_path(output_file)).check
       if (!quiet) Output.writeln(output_file.expand.implode)
     })
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool =
     Isabelle_Tool("logo", "create variants of the Isabelle logo (PDF)", Scala_Project.here, args =>
     {
       var output: Option[Path] = None
       var quiet = false
 
       val getopts = Getopts("""
 Usage: isabelle logo [OPTIONS] [NAME]
 
   Options are:
     -o FILE      alternative output file
     -q           quiet mode
 
   Create variant NAME of the Isabelle logo as "isabelle_name.pdf".
 """,
         "o:" -> (arg => output = Some(Path.explode(arg))),
         "q" -> (_ => quiet = true))
 
       val more_args = getopts(args)
-      val (logo_name, output_file) =
+      val logo_name =
         more_args match {
-          case Nil => ("", Path.explode("isabelle").pdf)
-          case List(a) => (a, output.getOrElse(Path.explode("isabelle_" + Word.lowercase(a)).pdf))
+          case Nil => ""
+          case List(name) => name
           case _ => getopts.usage()
         }
-
-      create_logo(logo_name, output_file, quiet = quiet)
+      create_logo(logo_name, output getOrElse make_output_file(logo_name), quiet = quiet)
     })
 }
diff --git a/src/Pure/Tools/phabricator.scala b/src/Pure/Tools/phabricator.scala
--- a/src/Pure/Tools/phabricator.scala
+++ b/src/Pure/Tools/phabricator.scala
@@ -1,1075 +1,1075 @@
 /*  Title:      Pure/Tools/phabricator.scala
     Author:     Makarius
 
 Support for Phabricator server, notably for Ubuntu 18.04 LTS.
 
 See also:
   - https://www.phacility.com/phabricator
   - https://secure.phabricator.com/book/phabricator
 */
 
 package isabelle
 
 
 import scala.collection.mutable
 import scala.util.matching.Regex
 
 
 object Phabricator
 {
   /** defaults **/
 
   /* required packages */
 
   val packages_ubuntu_20_04: List[String] =
     Build_Docker.packages :::
     List(
       // https://secure.phabricator.com/source/phabricator/browse/master/scripts/install/install_ubuntu.sh 15e6e2adea61
       "git", "mysql-server", "apache2", "libapache2-mod-php", "php", "php-mysql",
       "php-gd", "php-curl", "php-apcu", "php-cli", "php-json", "php-mbstring",
       // more packages
       "php-xml", "php-zip", "python3-pygments", "ssh", "subversion", "python-pygments",
       // mercurial build packages
       "make", "gcc", "python", "python2-dev", "python-docutils", "python-openssl")
 
   def packages: List[String] =
   {
     val release = Linux.Release()
     if (release.is_ubuntu_20_04) packages_ubuntu_20_04
     else error("Bad Linux version: expected Ubuntu 20.04 LTS")
   }
 
 
   /* global system resources */
 
   val www_user = "www-data"
 
   val daemon_user = "phabricator"
 
   val sshd_config: Path = Path.explode("/etc/ssh/sshd_config")
 
 
   /* installation parameters */
 
   val default_name = "vcs"
 
   def phabricator_name(name: String = "", ext: String = ""): String =
     "phabricator" + (if (name.isEmpty) "" else "-" + name) + (if (ext.isEmpty) "" else "." + ext)
 
   def isabelle_phabricator_name(name: String = "", ext: String = ""): String =
     "isabelle-" + phabricator_name(name = name, ext = ext)
 
   def default_root(name: String): Path =
     Path.explode("/var/www") + Path.basic(phabricator_name(name = name))
 
   def default_repo(name: String): Path = default_root(name) + Path.basic("repo")
 
   val default_mailers: Path = Path.explode("mailers.json")
 
   val default_system_port: Int = SSH.default_port
   val alternative_system_port = 222
   val default_server_port = 2222
 
   val standard_mercurial_source = "https://www.mercurial-scm.org/release/mercurial-3.9.2.tar.gz"
 
 
 
   /** global configuration **/
 
   val global_config: Path = Path.explode("/etc/" + isabelle_phabricator_name(ext = "conf"))
 
   def global_config_script(
     init: String = "",
     body: String = "",
     exit: String = ""): String =
   {
 """#!/bin/bash
 """ + (if (init.nonEmpty) "\n" + init else "") + """
 {
   while { unset REPLY; read -r; test "$?" = 0 -o -n "$REPLY"; }
   do
     NAME="$(echo "$REPLY" | cut -d: -f1)"
     ROOT="$(echo "$REPLY" | cut -d: -f2)"
     {
-""" + Library.prefix_lines("      ", body) + """
+""" + Library.indent_lines(6, body) + """
     } < /dev/null
   done
 } < """ + File.bash_path(global_config) + "\n" +
     (if (exit.nonEmpty) "\n" + exit + "\n" else "")
   }
 
   sealed case class Config(name: String, root: Path)
   {
     def home: Path = root + Path.explode(phabricator_name())
 
     def execute(command: String): Process_Result =
       Isabelle_System.bash("bin/" + command, cwd = home.file, redirect = true).check
   }
 
   def read_config(): List[Config] =
   {
     if (global_config.is_file) {
       for (entry <- Library.trim_split_lines(File.read(global_config)) if entry.nonEmpty)
       yield {
         space_explode(':', entry) match {
           case List(name, root) => Config(name, Path.explode(root))
           case _ => error("Malformed config file " + global_config + "\nentry " + quote(entry))
         }
       }
     }
     else Nil
   }
 
   def write_config(configs: List[Config]): Unit =
   {
     File.write(global_config,
       configs.map(config => config.name + ":" + config.root.implode).mkString("", "\n", "\n"))
   }
 
   def get_config(name: String): Config =
     read_config().find(config => config.name == name) getOrElse
       error("Bad Isabelle/Phabricator installation " + quote(name))
 
 
 
   /** administrative tools **/
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool1 =
     Isabelle_Tool("phabricator", "invoke command-line tool within Phabricator home directory",
       Scala_Project.here, args =>
     {
       var list = false
       var name = default_name
 
       val getopts =
         Getopts("""
 Usage: isabelle phabricator [OPTIONS] COMMAND [ARGS...]
 
   Options are:
     -l           list available Phabricator installations
     -n NAME      Phabricator installation name (default: """ + quote(default_name) + """)
 
   Invoke a command-line tool within the home directory of the named
   Phabricator installation.
 """,
           "l" -> (_ => list = true),
           "n:" -> (arg => name = arg))
 
       val more_args = getopts(args)
       if (more_args.isEmpty && !list) getopts.usage()
 
       val progress = new Console_Progress
 
       if (list) {
         for (config <- read_config()) {
           progress.echo("phabricator " + quote(config.name) + " root " + config.root)
         }
       }
       else {
         val config = get_config(name)
         val result = progress.bash(Bash.strings(more_args), cwd = config.home.file, echo = true)
         if (!result.ok) error(result.print_return_code)
       }
     })
 
 
 
   /** setup **/
 
   def user_setup(name: String, description: String, ssh_setup: Boolean = false): Unit =
   {
     if (!Linux.user_exists(name)) {
       Linux.user_add(name, description = description, system = true, ssh_setup = ssh_setup)
     }
     else if (Linux.user_description(name) != description) {
       error("User " + quote(name) + " already exists --" +
         " for Phabricator it should have the description:\n  " + quote(description))
     }
   }
 
   def command_setup(name: String,
     init: String = "",
     body: String = "",
     exit: String = ""): Path =
   {
     val command = Path.explode("/usr/local/bin") + Path.basic(name)
     File.write(command, global_config_script(init = init, body = body, exit = exit))
     Isabelle_System.chmod("755", command)
     Isabelle_System.chown("root:root", command)
     command
   }
 
   def mercurial_setup(mercurial_source: String, progress: Progress = new Progress): Unit =
   {
     progress.echo("\nMercurial installation from source " + quote(mercurial_source) + " ...")
     Isabelle_System.with_tmp_dir("mercurial")(tmp_dir =>
     {
       val archive =
         if (Url.is_wellformed(mercurial_source)) {
           val archive = tmp_dir + Path.basic("mercurial.tar.gz")
           Isabelle_System.download_file(mercurial_source, archive)
           archive
         }
         else Path.explode(mercurial_source)
 
       Isabelle_System.gnutar("-xzf " + File.bash_path(archive), dir = tmp_dir).check
       val build_dir = tmp_dir + Path.basic(File.get_dir(tmp_dir))
 
       progress.bash("make all && make install", cwd = build_dir.file, echo = true).check
     })
   }
 
   def phabricator_setup(
     options: Options,
     name: String = default_name,
     root: String = "",
     repo: String = "",
     package_update: Boolean = false,
     mercurial_source: String = "",
     progress: Progress = new Progress): Unit =
   {
     /* system environment */
 
     Linux.check_system_root()
 
     progress.echo("System packages ...")
 
     if (package_update) {
       Linux.package_update(progress = progress)
       Linux.check_reboot_required()
     }
 
     Linux.package_install(packages, progress = progress)
     Linux.check_reboot_required()
 
 
     if (mercurial_source.nonEmpty) {
       for { name <- List("mercurial", "mercurial-common") if Linux.package_installed(name) } {
         error("Cannot install Mercurial from source:\n" +
           "package package " + quote(name) + " already installed")
       }
       mercurial_setup(mercurial_source, progress = progress)
     }
 
 
     /* users */
 
     if (name.exists((c: Char) => !(Symbol.is_ascii_letter(c) || Symbol.is_ascii_digit(c))) ||
         Set("", "ssh", "phd", "dump", daemon_user).contains(name)) {
       error("Bad installation name: " + quote(name))
     }
 
     user_setup(daemon_user, "Phabricator Daemon User", ssh_setup = true)
     user_setup(name, "Phabricator SSH User")
 
 
     /* basic installation */
 
     progress.echo("\nPhabricator installation ...")
 
     val root_path = if (root.nonEmpty) Path.explode(root) else default_root(name)
     val repo_path = if (repo.nonEmpty) Path.explode(repo) else default_repo(name)
 
     val configs = read_config()
 
     for (config <- configs if config.name == name) {
       error("Duplicate Phabricator installation " + quote(name) + " in " + config.root)
     }
 
     if (!Isabelle_System.bash("mkdir -p " + File.bash_path(root_path)).ok) {
       error("Failed to create root directory " + root_path)
     }
 
     Isabelle_System.chown(Bash.string(www_user) + ":" + Bash.string(www_user), root_path)
     Isabelle_System.chmod("755", root_path)
 
     progress.bash(cwd = root_path.file, echo = true,
       script = """
         set -e
         echo "Cloning distribution repositories:"
 
         git clone --branch stable https://github.com/phacility/arcanist.git
         git -C arcanist reset --hard """ +
           Bash.string(options.string("phabricator_version_arcanist")) + """
 
         git clone --branch stable https://github.com/phacility/phabricator.git
         git -C phabricator reset --hard """ +
           Bash.string(options.string("phabricator_version_phabricator")) + """
       """).check
 
     val config = Config(name, root_path)
     write_config(configs ::: List(config))
 
     config.execute("config set pygments.enabled true")
 
 
     /* local repository directory */
 
     progress.echo("\nRepository hosting setup ...")
 
     if (!Isabelle_System.bash("mkdir -p " + File.bash_path(repo_path)).ok) {
       error("Failed to create local repository directory " + repo_path)
     }
 
     Isabelle_System.chown(
       "-R " + Bash.string(daemon_user) + ":" + Bash.string(daemon_user), repo_path)
     Isabelle_System.chmod("755", repo_path)
 
     config.execute("config set repository.default-local-path " + File.bash_path(repo_path))
 
 
     val sudoers_file =
       Path.explode("/etc/sudoers.d") + Path.basic(isabelle_phabricator_name(name = name))
     File.write(sudoers_file,
       www_user + " ALL=(" + daemon_user + ") SETENV: NOPASSWD: /usr/bin/git, /usr/local/bin/hg, /usr/bin/hg, /usr/bin/ssh, /usr/bin/id\n" +
       name + " ALL=(" + daemon_user + ") SETENV: NOPASSWD: /usr/bin/git, /usr/bin/git-upload-pack, /usr/bin/git-receive-pack, /usr/local/bin/hg, /usr/bin/hg, /usr/bin/svnserve, /usr/bin/ssh, /usr/bin/id\n")
 
     Isabelle_System.chmod("440", sudoers_file)
 
     config.execute("config set diffusion.ssh-user " + Bash.string(config.name))
 
 
     /* MySQL setup */
 
     progress.echo("\nMySQL setup ...")
 
     File.write(Path.explode("/etc/mysql/mysql.conf.d/" + phabricator_name(ext = "cnf")),
 """[mysqld]
 max_allowed_packet = 32M
 innodb_buffer_pool_size = 1600M
 local_infile = 0
 """)
 
     Linux.service_restart("mysql")
 
 
     def mysql_conf(R: Regex, which: String): String =
     {
       val conf = Path.explode("/etc/mysql/debian.cnf")
       split_lines(File.read(conf)).collectFirst({ case R(a) => a }) match {
         case Some(res) => res
         case None => error("Cannot determine " + which + " from " + conf)
       }
     }
 
     val mysql_root_user = mysql_conf("""^user\s*=\s*(\S*)\s*$""".r, "superuser name")
     val mysql_root_password = mysql_conf("""^password\s*=\s*(\S*)\s*$""".r, "superuser password")
 
     val mysql_name = phabricator_name(name = name).replace("-", "_")
     val mysql_user_string = SQL.string(mysql_name) + "@'localhost'"
     val mysql_password = Linux.generate_password()
 
     Isabelle_System.bash("mysql --user=" + Bash.string(mysql_root_user) +
       " --password=" + Bash.string(mysql_root_password) + " --execute=" +
       Bash.string(
         """DROP USER IF EXISTS """ + mysql_user_string + "; " +
         """CREATE USER """ + mysql_user_string +
         """ IDENTIFIED BY """ + SQL.string(mysql_password) + """ PASSWORD EXPIRE NEVER; """ +
         """GRANT ALL ON `""" + (mysql_name + "_%").replace("_", "\\_") +
         """`.* TO """ + mysql_user_string + ";" +
         """GRANT PROCESS ON *.* TO """ + mysql_user_string + ";")).check
 
     config.execute("config set mysql.user " + Bash.string(mysql_name))
     config.execute("config set mysql.pass " + Bash.string(mysql_password))
 
     config.execute("config set phabricator.cache-namespace " + Bash.string(mysql_name))
     config.execute("config set storage.default-namespace " + Bash.string(mysql_name))
     config.execute("config set storage.mysql-engine.max-size 8388608")
 
     progress.bash("bin/storage upgrade --force", cwd = config.home.file, echo = true).check
 
 
     /* database dump */
 
     val dump_name = isabelle_phabricator_name(name = "dump")
     command_setup(dump_name, body =
 """mkdir -p "$ROOT/database" && chown root:root "$ROOT/database" && chmod 700 "$ROOT/database"
 [ -e "$ROOT/database/dump.sql.gz" ] && mv -f "$ROOT/database/dump.sql.gz" "$ROOT/database/dump-old.sql.gz"
 echo -n "Creating $ROOT/database/dump.sql.gz ..."
 "$ROOT/phabricator/bin/storage" dump --compress --output "$ROOT/database/dump.sql.gz" 2>&1 | fgrep -v '[Warning] Using a password on the command line interface can be insecure'
 echo " $(ls -hs "$ROOT/database/dump.sql.gz" | cut -d" " -f1)" """)
 
 
     /* Phabricator upgrade */
 
     command_setup(isabelle_phabricator_name(name = "upgrade"),
       init =
 """BRANCH="${1:-stable}"
 if [ "$BRANCH" != "master" -a "$BRANCH" != "stable" ]
 then
   echo "Bad branch: \"$BRANCH\""
   exit 1
 fi
 
 systemctl stop isabelle-phabricator-phd
 systemctl stop apache2
 """,
       body =
 """echo -e "\nUpgrading phabricator \"$NAME\" root \"$ROOT\" ..."
 for REPO in arcanist phabricator
 do
   cd "$ROOT/$REPO"
   echo -e "\nUpdating \"$REPO\" ..."
   git checkout "$BRANCH"
   git pull
 done
 echo -e "\nUpgrading storage ..."
 "$ROOT/phabricator/bin/storage" upgrade --force
 """,
       exit =
 """systemctl start apache2
 systemctl start isabelle-phabricator-phd""")
 
 
     /* PHP setup */
 
     val php_version =
       Isabelle_System.bash("""php --run 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;'""")
         .check.out
 
     val php_conf =
       Path.explode("/etc/php") + Path.basic(php_version) +  // educated guess
         Path.explode("apache2/conf.d") +
         Path.basic(isabelle_phabricator_name(ext = "ini"))
 
     File.write(php_conf,
       "post_max_size = 32M\n" +
       "opcache.validate_timestamps = 0\n" +
       "memory_limit = 512M\n" +
       "max_execution_time = 120\n")
 
 
     /* Apache setup */
 
     progress.echo("Apache setup ...")
 
     val apache_root = Path.explode("/etc/apache2")
     val apache_sites = apache_root + Path.explode("sites-available")
 
     if (!apache_sites.is_dir) error("Bad Apache sites directory " + apache_sites)
 
     val server_name = phabricator_name(name = name, ext = "lvh.me")  // alias for "localhost" for testing
     val server_url = "http://" + server_name
 
     File.write(apache_sites + Path.basic(isabelle_phabricator_name(name = name, ext = "conf")),
 """<VirtualHost *:80>
     ServerName """ + server_name + """
     ServerAdmin webmaster@localhost
     DocumentRoot """ + config.home.implode + """/webroot
 
     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined
 
     RewriteEngine on
     RewriteRule ^(.*)$  /index.php?__path__=$1  [B,L,QSA]
 </VirtualHost>
 
 # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
 """)
 
     Isabelle_System.bash( """
       set -e
       a2enmod rewrite
       a2ensite """ + Bash.string(isabelle_phabricator_name(name = name))).check
 
     config.execute("config set phabricator.base-uri " + Bash.string(server_url))
 
     Linux.service_restart("apache2")
 
     progress.echo("\nFurther manual configuration via " + server_url)
 
 
     /* PHP daemon */
 
     progress.echo("\nPHP daemon setup ...")
 
     val phd_log_path = Isabelle_System.make_directory(Path.explode("/var/tmp/phd"))
     Isabelle_System.chown(
       "-R " + Bash.string(daemon_user) + ":" + Bash.string(daemon_user), phd_log_path)
     Isabelle_System.chmod("755", phd_log_path)
 
     config.execute("config set phd.user " + Bash.string(daemon_user))
     config.execute("config set phd.log-directory /var/tmp/phd/" +
       isabelle_phabricator_name(name = name) + "/log")
 
     val phd_name = isabelle_phabricator_name(name = "phd")
     Linux.service_shutdown(phd_name)
     val phd_command = command_setup(phd_name, body = """"$ROOT/phabricator/bin/phd" "$@" """)
     try {
       Linux.service_install(phd_name,
 """[Unit]
 Description=PHP daemon manager for Isabelle/Phabricator
 After=syslog.target network.target apache2.service mysql.service
 
 [Service]
 Type=oneshot
 User=""" + daemon_user + """
 Group=""" + daemon_user + """
 Environment=PATH=/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin
 ExecStart=""" + phd_command.implode + """ start --force
 ExecStop=""" + phd_command.implode + """ stop
 RemainAfterExit=yes
 
 [Install]
 WantedBy=multi-user.target
 """)
     }
     catch {
       case ERROR(msg) =>
         progress.bash("bin/phd status", cwd = config.home.file, echo = true).check
         error(msg)
     }
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool2 =
     Isabelle_Tool("phabricator_setup", "setup Phabricator server on Ubuntu Linux",
       Scala_Project.here, args =>
     {
       var mercurial_source = ""
       var repo = ""
       var package_update = false
       var name = default_name
       var options = Options.init()
       var root = ""
 
       val getopts =
         Getopts("""
 Usage: isabelle phabricator_setup [OPTIONS]
 
   Options are:
     -M SOURCE    install Mercurial from source: local PATH, or URL, or ":" for
                  """ + standard_mercurial_source + """
     -R DIR       repository directory (default: """ + default_repo("NAME") + """)
     -U           full update of system packages before installation
     -n NAME      Phabricator installation name (default: """ + quote(default_name) + """)
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -r DIR       installation root directory (default: """ + default_root("NAME") + """)
 
   Install Phabricator as LAMP application (Linux, Apache, MySQL, PHP).
 
   The installation name (default: """ + quote(default_name) + """) is mapped to a regular
   Unix user; this is relevant for public SSH access.
 """,
           "M:" -> (arg => mercurial_source = (if (arg == ":") standard_mercurial_source else arg)),
           "R:" -> (arg => repo = arg),
           "U" -> (_ => package_update = true),
           "n:" -> (arg => name = arg),
           "o:" -> (arg => options = options + arg),
           "r:" -> (arg => root = arg))
 
       val more_args = getopts(args)
       if (more_args.nonEmpty) getopts.usage()
 
       val progress = new Console_Progress
 
       phabricator_setup(options, name = name, root = root, repo = repo,
         package_update = package_update, mercurial_source = mercurial_source, progress = progress)
     })
 
 
 
   /** setup mail **/
 
   val mailers_template: String =
 """[
   {
     "key": "example.org",
     "type": "smtp",
     "options": {
       "host": "mail.example.org",
       "port": 465,
       "user": "phabricator@example.org",
       "password": "********",
       "protocol": "ssl",
       "message-id": true
     }
   }
 ]"""
 
   def phabricator_setup_mail(
     name: String = default_name,
     config_file: Option[Path] = None,
     test_user: String = "",
     progress: Progress = new Progress): Unit =
   {
     Linux.check_system_root()
 
     val config = get_config(name)
     val default_config_file = config.root + default_mailers
 
     val mail_config = config_file getOrElse default_config_file
 
     def setup_mail: Unit =
     {
       progress.echo("Using mail configuration from " + mail_config)
       config.execute("config set cluster.mailers --stdin < " + File.bash_path(mail_config))
 
       if (test_user.nonEmpty) {
         progress.echo("Sending test mail to " + quote(test_user))
         progress.bash(cwd = config.home.file, echo = true,
           script = """echo "Test from Phabricator ($(date))" | bin/mail send-test --subject "Test" --to """ +
             Bash.string(test_user)).check
       }
     }
 
     if (config_file.isEmpty) {
       if (!default_config_file.is_file) {
         File.write(default_config_file, mailers_template)
         Isabelle_System.chmod("600", default_config_file)
       }
       if (File.read(default_config_file) == mailers_template) {
         progress.echo("Please invoke the tool again, after providing details in\n  " +
           default_config_file.implode + "\n")
       }
       else setup_mail
     }
     else setup_mail
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool3 =
     Isabelle_Tool("phabricator_setup_mail", "setup mail for one Phabricator installation",
       Scala_Project.here, args =>
     {
       var test_user = ""
       var name = default_name
       var config_file: Option[Path] = None
 
       val getopts =
         Getopts("""
 Usage: isabelle phabricator_setup_mail [OPTIONS]
 
   Options are:
     -T USER      send test mail to Phabricator user
     -f FILE      config file (default: """ + default_mailers + """ within Phabricator root)
     -n NAME      Phabricator installation name (default: """ + quote(default_name) + """)
 
   Provide mail configuration for existing Phabricator installation.
 """,
           "T:" -> (arg => test_user = arg),
           "f:" -> (arg => config_file = Some(Path.explode(arg))),
           "n:" -> (arg => name = arg))
 
       val more_args = getopts(args)
       if (more_args.nonEmpty) getopts.usage()
 
       val progress = new Console_Progress
 
       phabricator_setup_mail(name = name, config_file = config_file,
         test_user = test_user, progress = progress)
     })
 
 
 
   /** setup ssh **/
 
   /* sshd config */
 
   private val Port = """^\s*Port\s+(\d+)\s*$""".r
   private val No_Port = """^#\s*Port\b.*$""".r
   private val Any_Port = """^#?\s*Port\b.*$""".r
 
   def conf_ssh_port(port: Int): String =
     if (port == SSH.default_port) "#Port " + SSH.default_port else "Port " + port
 
   def read_ssh_port(conf: Path): Int =
   {
     val lines = split_lines(File.read(conf))
     val ports =
       lines.flatMap({
         case Port(Value.Int(p)) => Some(p)
         case No_Port() => Some(SSH.default_port)
         case _ => None
       })
     ports match {
       case List(port) => port
       case Nil => error("Missing Port specification in " + conf)
       case _ => error("Multiple Port specifications in " + conf)
     }
   }
 
   def write_ssh_port(conf: Path, port: Int): Boolean =
   {
     val old_port = read_ssh_port(conf)
     if (old_port == port) false
     else {
       val lines = split_lines(File.read(conf))
       val lines1 = lines.map({ case Any_Port() => conf_ssh_port(port) case line => line })
       File.write(conf, cat_lines(lines1))
       true
     }
   }
 
 
   /* phabricator_setup_ssh */
 
   def phabricator_setup_ssh(
     server_port: Int = default_server_port,
     system_port: Int = default_system_port,
     progress: Progress = new Progress): Unit =
   {
     Linux.check_system_root()
 
     val configs = read_config()
 
     if (server_port == system_port) {
       error("Port for Phabricator sshd coincides with system port: " + system_port)
     }
 
     val sshd_conf_system = Path.explode("/etc/ssh/sshd_config")
     val sshd_conf_server = sshd_conf_system.ext(isabelle_phabricator_name())
 
     val ssh_name = isabelle_phabricator_name(name = "ssh")
     Linux.service_shutdown(ssh_name)
 
     val old_system_port = read_ssh_port(sshd_conf_system)
     if (old_system_port != system_port) {
       progress.echo("Reconfigurig system ssh service")
       Linux.service_shutdown("ssh")
       write_ssh_port(sshd_conf_system, system_port)
       Linux.service_start("ssh")
     }
 
     progress.echo("Configuring " + ssh_name + " service")
 
     val ssh_command = command_setup(ssh_name, body =
 """if [ "$1" = "$NAME" ]
 then
   exec "$ROOT/phabricator/bin/ssh-auth" "$@"
 fi""", exit = "exit 1")
 
     File.write(sshd_conf_server,
 """# OpenBSD Secure Shell server for Isabelle/Phabricator
 AuthorizedKeysCommand """ + ssh_command.implode + """
 AuthorizedKeysCommandUser """ + daemon_user + """
 AuthorizedKeysFile none
 AllowUsers """ + configs.map(_.name).mkString(" ") + """
 Port """ + server_port + """
 Protocol 2
 PermitRootLogin no
 AllowAgentForwarding no
 AllowTcpForwarding no
 PrintMotd no
 PrintLastLog no
 PasswordAuthentication no
 ChallengeResponseAuthentication no
 PidFile /var/run/""" + ssh_name + """.pid
 """)
 
     Linux.service_install(ssh_name,
 """[Unit]
 Description=OpenBSD Secure Shell server for Isabelle/Phabricator
 After=network.target auditd.service
 ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
 
 [Service]
 EnvironmentFile=-/etc/default/ssh
 ExecStartPre=/usr/sbin/sshd -f """ + sshd_conf_server.implode + """ -t
 ExecStart=/usr/sbin/sshd -f """ + sshd_conf_server.implode + """ -D $SSHD_OPTS
 ExecReload=/usr/sbin/sshd -f """ + sshd_conf_server.implode + """ -t
 ExecReload=/bin/kill -HUP $MAINPID
 KillMode=process
 Restart=on-failure
 RestartPreventExitStatus=255
 Type=notify
 RuntimeDirectory=sshd-phabricator
 RuntimeDirectoryMode=0755
 
 [Install]
 WantedBy=multi-user.target
 Alias=""" + ssh_name + """.service
 """)
 
     for (config <- configs) {
       progress.echo("phabricator " + quote(config.name) + " port " +  server_port)
       config.execute("config set diffusion.ssh-port " + Bash.string(server_port.toString))
       if (server_port == SSH.default_port) config.execute("config delete diffusion.ssh-port")
     }
   }
 
 
   /* Isabelle tool wrapper */
 
   val isabelle_tool4 =
     Isabelle_Tool("phabricator_setup_ssh", "setup ssh service for all Phabricator installations",
       Scala_Project.here, args =>
     {
       var server_port = default_server_port
       var system_port = default_system_port
 
       val getopts =
         Getopts("""
 Usage: isabelle phabricator_setup_ssh [OPTIONS]
 
   Options are:
     -p PORT      sshd port for Phabricator servers (default: """ + default_server_port + """)
     -q PORT      sshd port for the operating system (default: """ + default_system_port + """)
 
   Configure ssh service for all Phabricator installations: a separate sshd
   is run in addition to the one of the operating system, and ports need to
   be distinct.
 
   A particular Phabricator installation is addressed by using its
   name as the ssh user; the actual Phabricator user is determined via
   stored ssh keys.
 """,
           "p:" -> (arg => server_port = Value.Int.parse(arg)),
           "q:" -> (arg => system_port = Value.Int.parse(arg)))
 
       val more_args = getopts(args)
       if (more_args.nonEmpty) getopts.usage()
 
       val progress = new Console_Progress
 
       phabricator_setup_ssh(
         server_port = server_port, system_port = system_port, progress = progress)
     })
 
 
 
   /** conduit API **/
 
   object API
   {
     /* user information */
 
     sealed case class User(
       id: Long,
       phid: String,
       name: String,
       real_name: String,
       roles: List[String])
     {
       def is_valid: Boolean =
         roles.contains("verified") &&
         roles.contains("approved") &&
         roles.contains("activated")
       def is_admin: Boolean = roles.contains("admin")
       def is_regular: Boolean = !(roles.contains("bot") || roles.contains("list"))
     }
 
 
     /* repository information */
 
     sealed case class Repository(
       vcs: VCS.Value,
       id: Long,
       phid: String,
       name: String,
       callsign: String,
       short_name: String,
       importing: Boolean,
       ssh_url: String)
     {
       def is_hg: Boolean = vcs == VCS.hg
     }
 
     object VCS extends Enumeration
     {
       val hg, git, svn = Value
       def read(s: String): Value =
         try { withName(s) }
         catch { case _: java.util.NoSuchElementException  => error("Unknown vcs type " + quote(s)) }
     }
 
     def edits(typ: String, value: JSON.T): List[JSON.Object.T] =
       List(JSON.Object("type" -> typ, "value" -> value))
 
     def opt_edits(typ: String, value: Option[JSON.T]): List[JSON.Object.T] =
       value.toList.flatMap(edits(typ, _))
 
 
     /* result with optional error */
 
     sealed case class Result(result: JSON.T, error: Option[String])
     {
       def ok: Boolean = error.isEmpty
       def get: JSON.T = if (ok) result else Exn.error(error.get)
 
       def get_value[A](unapply: JSON.T => Option[A]): A =
         unapply(get) getOrElse Exn.error("Bad JSON result: " + JSON.Format(result))
 
       def get_string: String = get_value(JSON.Value.String.unapply)
     }
 
     def make_result(json: JSON.T): Result =
     {
       val result = JSON.value(json, "result").getOrElse(JSON.Object.empty)
       val error_info = JSON.string(json, "error_info")
       val error_code = JSON.string(json, "error_code")
       Result(result, error_info orElse error_code)
     }
 
 
     /* context for operations */
 
     def apply(user: String, host: String, port: Int = SSH.default_port): API =
       new API(user, host, port)
   }
 
   final class API private(ssh_user: String, ssh_host: String, ssh_port: Int)
   {
     /* connection */
 
     require(ssh_host.nonEmpty && ssh_port >= 0, "bad ssh host or port")
 
     private def ssh_user_prefix: String = SSH.user_prefix(ssh_user)
     private def ssh_port_suffix: String = SSH.port_suffix(ssh_port)
 
     override def toString: String = ssh_user_prefix + ssh_host + ssh_port_suffix
     def hg_url: String = "ssh://" + ssh_user_prefix + ssh_host + ssh_port_suffix
 
 
     /* execute methods */
 
     def execute_raw(method: String, params: JSON.T = JSON.Object.empty): JSON.T =
     {
       Isabelle_System.with_tmp_file("params", "json")(params_file =>
       {
         File.write(params_file, JSON.Format(JSON.Object("params" -> JSON.Format(params))))
         val result =
           Isabelle_System.bash(
             "ssh -p " + ssh_port + " " + Bash.string(ssh_user_prefix + ssh_host) +
             " conduit " + Bash.string(method) + " < " + File.bash_path(params_file)).check
         JSON.parse(result.out, strict = false)
       })
     }
 
     def execute(method: String, params: JSON.T = JSON.Object.empty): API.Result =
       API.make_result(execute_raw(method, params = params))
 
     def execute_search[A](
       method: String, params: JSON.Object.T, unapply: JSON.T => Option[A]): List[A] =
     {
       val results = new mutable.ListBuffer[A]
       var after = ""
 
       do {
         val result =
           execute(method, params = params ++ JSON.optional("after" -> proper_string(after)))
         results ++= result.get_value(JSON.list(_, "data", unapply))
         after = result.get_value(JSON.value(_, "cursor", JSON.string0(_, "after")))
       } while (after.nonEmpty)
 
       results.toList
     }
 
     def ping(): String = execute("conduit.ping").get_string
 
 
     /* users */
 
     lazy val user_phid: String = execute("user.whoami").get_value(JSON.string(_, "phid"))
     lazy val user_name: String = execute("user.whoami").get_value(JSON.string(_, "userName"))
 
     def get_users(
       all: Boolean = false,
       phid: String = "",
       name: String = ""): List[API.User] =
     {
       val constraints: JSON.Object.T =
         (for { (key, value) <- List("phids" -> phid, "usernames" -> name) if value.nonEmpty }
           yield (key, List(value))).toMap
 
       execute_search("user.search",
           JSON.Object("queryKey" -> (if (all) "all" else "active"), "constraints" -> constraints),
             data => JSON.value(data, "fields", fields =>
               for {
                 id <- JSON.long(data, "id")
                 phid <- JSON.string(data, "phid")
                 name <- JSON.string(fields, "username")
                 real_name <- JSON.string0(fields, "realName")
                 roles <- JSON.strings(fields, "roles")
               } yield API.User(id, phid, name, real_name, roles)))
     }
 
     def the_user(phid: String): API.User =
       get_users(phid = phid) match {
         case List(user) => user
         case _ => error("Bad user PHID " + quote(phid))
       }
 
 
     /* repositories */
 
     def get_repositories(
       all: Boolean = false,
       phid: String = "",
       callsign: String = "",
       short_name: String = ""): List[API.Repository] =
     {
       val constraints: JSON.Object.T =
         (for {
           (key, value) <- List("phids" -> phid, "callsigns" -> callsign, "shortNames" -> short_name)
           if value.nonEmpty
         } yield (key, List(value))).toMap
 
       execute_search("diffusion.repository.search",
           JSON.Object("queryKey" -> (if (all) "all" else "active"), "constraints" -> constraints),
             data => JSON.value(data, "fields", fields =>
               for {
                 vcs_name <- JSON.string(fields, "vcs")
                 id <- JSON.long(data, "id")
                 phid <- JSON.string(data, "phid")
                 name <- JSON.string(fields, "name")
                 callsign <- JSON.string0(fields, "callsign")
                 short_name <- JSON.string0(fields, "shortName")
                 importing <- JSON.bool(fields, "isImporting")
               }
               yield {
                 val vcs = API.VCS.read(vcs_name)
                 val url_path =
                   if (short_name.isEmpty) "/diffusion/" + id else "/source/" + short_name
                 val ssh_url =
                   vcs match {
                     case API.VCS.hg => hg_url + url_path
                     case API.VCS.git => hg_url + url_path + ".git"
                     case API.VCS.svn => ""
                   }
                 API.Repository(vcs, id, phid, name, callsign, short_name, importing, ssh_url)
               }))
     }
 
     def the_repository(phid: String): API.Repository =
       get_repositories(phid = phid) match {
         case List(repo) => repo
         case _ => error("Bad repository PHID " + quote(phid))
       }
 
     def create_repository(
       name: String,
       callsign: String = "",    // unique name, UPPERCASE
       short_name: String = "",  // unique name
       description: String = "",
       public: Boolean = false,
       vcs: API.VCS.Value = API.VCS.hg): API.Repository =
     {
       require(name.nonEmpty, "bad repository name")
 
       val transactions =
         API.edits("vcs", vcs.toString) :::
         API.edits("name", name) :::
         API.opt_edits("callsign", proper_string(callsign)) :::
         API.opt_edits("shortName", proper_string(short_name)) :::
         API.opt_edits("description", proper_string(description)) :::
         (if (public) Nil
          else API.edits("view", user_phid) ::: API.edits("policy.push", user_phid)) :::
         API.edits("status", "active")
 
       val phid =
         execute("diffusion.repository.edit", params = JSON.Object("transactions" -> transactions))
           .get_value(JSON.value(_, "object", JSON.string(_, "phid")))
 
       execute("diffusion.looksoon", params = JSON.Object("repositories" -> List(phid))).get
 
       the_repository(phid)
     }
   }
 }
diff --git a/src/Pure/Tools/rail.ML b/src/Pure/Tools/rail.ML
--- a/src/Pure/Tools/rail.ML
+++ b/src/Pure/Tools/rail.ML
@@ -1,392 +1,392 @@
 (*  Title:      Pure/Tools/rail.ML
     Author:     Michael Kerscher, TU München
     Author:     Makarius
 
 Railroad diagrams in LaTeX.
 *)
 
 signature RAIL =
 sig
   datatype rails =
     Cat of int * rail list
   and rail =
     Bar of rails list |
     Plus of rails * rails |
     Newline of int |
     Nonterminal of string |
     Terminal of bool * string |
     Antiquote of bool * Antiquote.antiq
   val read: Proof.context -> Input.source -> (string Antiquote.antiquote * rail) list
   val output_rules: Proof.context -> (string Antiquote.antiquote * rail) list -> Latex.text
 end;
 
 structure Rail: RAIL =
 struct
 
 (** lexical syntax **)
 
 (* singleton keywords *)
 
 val keywords =
   Symtab.make [
     ("|", Markup.keyword3),
     ("*", Markup.keyword3),
     ("+", Markup.keyword3),
     ("?", Markup.keyword3),
     ("(", Markup.empty),
     (")", Markup.empty),
     ("\<newline>", Markup.keyword2),
     (";", Markup.keyword2),
     (":", Markup.keyword2),
     ("@", Markup.keyword1)];
 
 
 (* datatype token *)
 
 datatype kind =
   Keyword | Ident | String | Space | Comment of Comment.kind | Antiq of Antiquote.antiq | EOF;
 
 datatype token = Token of Position.range * (kind * string);
 
 fun pos_of (Token ((pos, _), _)) = pos;
 fun end_pos_of (Token ((_, pos), _)) = pos;
 
 fun range_of (toks as tok :: _) =
       let val pos' = end_pos_of (List.last toks)
       in Position.range (pos_of tok, pos') end
   | range_of [] = Position.no_range;
 
 fun kind_of (Token (_, (k, _))) = k;
 fun content_of (Token (_, (_, x))) = x;
 
 fun is_proper (Token (_, (Space, _))) = false
   | is_proper (Token (_, (Comment _, _))) = false
   | is_proper _ = true;
 
 
 (* diagnostics *)
 
 val print_kind =
  fn Keyword => "rail keyword"
   | Ident => "identifier"
   | String => "single-quoted string"
   | Space => "white space"
   | Comment _ => "formal comment"
   | Antiq _ => "antiquotation"
   | EOF => "end-of-input";
 
 fun print (Token ((pos, _), (k, x))) =
   (if k = EOF then print_kind k else print_kind k ^ " " ^ quote x) ^
   Position.here pos;
 
 fun print_keyword x = print_kind Keyword ^ " " ^ quote x;
 
 fun reports_of_token (Token ((pos, _), (Keyword, x))) =
       map (pair pos) (the_list (Symtab.lookup keywords x) @ Completion.suppress_abbrevs x)
   | reports_of_token (Token ((pos, _), (String, _))) = [(pos, Markup.inner_string)]
   | reports_of_token (Token (_, (Antiq antiq, _))) = Antiquote.antiq_reports [Antiquote.Antiq antiq]
   | reports_of_token _ = [];
 
 
 (* stopper *)
 
 fun mk_eof pos = Token ((pos, Position.none), (EOF, ""));
 val eof = mk_eof Position.none;
 
 fun is_eof (Token (_, (EOF, _))) = true
   | is_eof _ = false;
 
 val stopper =
   Scan.stopper (fn [] => eof | toks => mk_eof (end_pos_of (List.last toks))) is_eof;
 
 
 (* tokenize *)
 
 local
 
 fun token k ss = [Token (Symbol_Pos.range ss, (k, Symbol_Pos.content ss))];
 
 fun antiq_token antiq =
   [Token (#range antiq, (Antiq antiq, Symbol_Pos.content (#body antiq)))];
 
 val scan_space = Scan.many1 (Symbol.is_blank o Symbol_Pos.symbol);
 
 val scan_keyword =
   Scan.one (Symtab.defined keywords o Symbol_Pos.symbol);
 
 val err_prefix = "Rail lexical error: ";
 
 val scan_token =
   scan_space >> token Space ||
   Comment.scan_inner >> (fn (kind, ss) => token (Comment kind) ss) ||
   Antiquote.scan_antiq >> antiq_token ||
   scan_keyword >> (token Keyword o single) ||
   Lexicon.scan_id >> token Ident ||
   Symbol_Pos.scan_string_q err_prefix >> (fn (pos1, (ss, pos2)) =>
     [Token (Position.range (pos1, pos2), (String, Symbol_Pos.content ss))]);
 
 val scan =
   Scan.repeats scan_token --|
     Symbol_Pos.!!! (fn () => err_prefix ^ "bad input")
       (Scan.ahead (Scan.one Symbol_Pos.is_eof));
 
 in
 
 val tokenize = #1 o Scan.error (Scan.finite Symbol_Pos.stopper scan);
 
 end;
 
 
 
 (** parsing **)
 
 (* parser combinators *)
 
 fun !!! scan =
   let
     val prefix = "Rail syntax error";
 
     fun get_pos [] = " (end-of-input)"
       | get_pos (tok :: _) = Position.here (pos_of tok);
 
     fun err (toks, NONE) = (fn () => prefix ^ get_pos toks)
       | err (toks, SOME msg) =
           (fn () =>
             let val s = msg () in
               if String.isPrefix prefix s then s
               else prefix ^ get_pos toks ^ ": " ^ s
             end);
   in Scan.!! err scan end;
 
 fun $$$ x =
   Scan.one (fn tok => kind_of tok = Keyword andalso content_of tok = x) ||
   Scan.fail_with
     (fn [] => (fn () => print_keyword x ^ " expected,\nbut end-of-input was found")
       | tok :: _ => (fn () => print_keyword x ^ " expected,\nbut " ^ print tok ^ " was found"));
 
 fun enum1 sep scan = scan ::: Scan.repeat ($$$ sep |-- !!! scan);
 fun enum sep scan = enum1 sep scan || Scan.succeed [];
 
 val ident = Scan.some (fn tok => if kind_of tok = Ident then SOME (content_of tok) else NONE);
 val string = Scan.some (fn tok => if kind_of tok = String then SOME (content_of tok) else NONE);
 
 val antiq = Scan.some (fn tok => (case kind_of tok of Antiq a => SOME a | _ => NONE));
 
 fun RANGE scan = Scan.trace scan >> apsnd range_of;
 fun RANGE_APP scan = RANGE scan >> (fn (f, r) => f r);
 
 
 (* parse trees *)
 
 datatype trees =
   CAT of tree list * Position.range
 and tree =
   BAR of trees list * Position.range |
   STAR of (trees * trees) * Position.range |
   PLUS of (trees * trees) * Position.range |
   MAYBE of tree * Position.range |
   NEWLINE of Position.range |
   NONTERMINAL of string * Position.range |
   TERMINAL of (bool * string) * Position.range |
   ANTIQUOTE of (bool * Antiquote.antiq) * Position.range;
 
 fun reports_of_tree ctxt =
   if Context_Position.reports_enabled ctxt then
     let
       fun reports r =
         if r = Position.no_range then []
         else [(Position.range_position r, Markup.expression "")];
       fun trees (CAT (ts, r)) = reports r @ maps tree ts
       and tree (BAR (Ts, r)) = reports r @ maps trees Ts
         | tree (STAR ((T1, T2), r)) = reports r @ trees T1 @ trees T2
         | tree (PLUS ((T1, T2), r)) = reports r @ trees T1 @ trees T2
         | tree (MAYBE (t, r)) = reports r @ tree t
         | tree (NEWLINE r) = reports r
         | tree (NONTERMINAL (_, r)) = reports r
         | tree (TERMINAL (_, r)) = reports r
         | tree (ANTIQUOTE (_, r)) = reports r;
     in distinct (op =) o tree end
   else K [];
 
 local
 
 val at_mode = Scan.option ($$$ "@") >> (fn NONE => false | _ => true);
 
 fun body x = (RANGE (enum1 "|" body1) >> BAR) x
 and body0 x = (RANGE (enum "|" body1) >> BAR) x
 and body1 x =
  (RANGE_APP (body2 :|-- (fn a =>
    $$$ "*" |-- !!! body4e >> (fn b => fn r => CAT ([STAR ((a, b), r)], r)) ||
    $$$ "+" |-- !!! body4e >> (fn b => fn r => CAT ([PLUS ((a, b), r)], r)) ||
    Scan.succeed (K a)))) x
 and body2 x = (RANGE (Scan.repeat1 body3) >> CAT) x
 and body3 x =
  (RANGE_APP (body4 :|-- (fn a =>
    $$$ "?" >> K (curry MAYBE a) ||
    Scan.succeed (K a)))) x
 and body4 x =
  ($$$ "(" |-- !!! (body0 --| $$$ ")") ||
   RANGE_APP
    ($$$ "\<newline>" >> K NEWLINE ||
     ident >> curry NONTERMINAL ||
     at_mode -- string >> curry TERMINAL ||
     at_mode -- antiq >> curry ANTIQUOTE)) x
 and body4e x =
   (RANGE (Scan.option body4) >> (fn (a, r) => CAT (the_list a, r))) x;
 
 val rule_name = ident >> Antiquote.Text || antiq >> Antiquote.Antiq;
 val rule = rule_name -- ($$$ ":" |-- !!! body) || body >> pair (Antiquote.Text "");
 val rules = enum1 ";" (Scan.option rule) >> map_filter I;
 
 in
 
 fun parse_rules toks =
   #1 (Scan.error (Scan.finite stopper (rules --| !!! (Scan.ahead (Scan.one is_eof)))) toks);
 
 end;
 
 
 (** rail expressions **)
 
 (* datatype *)
 
 datatype rails =
   Cat of int * rail list
 and rail =
   Bar of rails list |
   Plus of rails * rails |
   Newline of int |
   Nonterminal of string |
   Terminal of bool * string |
   Antiquote of bool * Antiquote.antiq;
 
 fun is_newline (Newline _) = true | is_newline _ = false;
 
 
 (* prepare *)
 
 local
 
 fun cat rails = Cat (0, rails);
 
 val empty = cat [];
 fun is_empty (Cat (_, [])) = true | is_empty _ = false;
 
 fun bar [Cat (_, [rail])] = rail
   | bar cats = Bar cats;
 
 fun reverse_cat (Cat (y, rails)) = Cat (y, rev (map reverse rails))
 and reverse (Bar cats) = Bar (map reverse_cat cats)
   | reverse (Plus (cat1, cat2)) = Plus (reverse_cat cat1, reverse_cat cat2)
   | reverse x = x;
 
 fun plus (cat1, cat2) = Plus (cat1, reverse_cat cat2);
 
 in
 
 fun prepare_trees (CAT (ts, _)) = Cat (0, map prepare_tree ts)
 and prepare_tree (BAR (Ts, _)) = bar (map prepare_trees Ts)
   | prepare_tree (STAR (Ts, _)) =
       let val (cat1, cat2) = apply2 prepare_trees Ts in
         if is_empty cat2 then plus (empty, cat1)
         else bar [empty, cat [plus (cat1, cat2)]]
       end
   | prepare_tree (PLUS (Ts, _)) = plus (apply2 prepare_trees Ts)
   | prepare_tree (MAYBE (t, _)) = bar [empty, cat [prepare_tree t]]
   | prepare_tree (NEWLINE _) = Newline 0
   | prepare_tree (NONTERMINAL (a, _)) = Nonterminal a
   | prepare_tree (TERMINAL (a, _)) = Terminal a
   | prepare_tree (ANTIQUOTE (a, _)) = Antiquote a;
 
 end;
 
 
 (* read *)
 
 fun read ctxt source =
   let
     val _ = Context_Position.report ctxt (Input.pos_of source) Markup.language_rail;
     val toks = tokenize (Input.source_explode source);
     val _ = Context_Position.reports ctxt (maps reports_of_token toks);
     val rules = parse_rules (filter is_proper toks);
     val _ = Context_Position.reports ctxt (maps (reports_of_tree ctxt o #2) rules);
   in map (apsnd prepare_tree) rules end;
 
 
 (* latex output *)
 
 local
 
 fun vertical_range_cat (Cat (_, rails)) y =
   let val (rails', (_, y')) =
     fold_map (fn rail => fn (y0, y') =>
       if is_newline rail then (Newline (y' + 1), (y' + 1, y' + 2))
       else
         let val (rail', y0') = vertical_range rail y0;
         in (rail', (y0, Int.max (y0', y'))) end) rails (y, y + 1)
   in (Cat (y, rails'), y') end
 
 and vertical_range (Bar cats) y =
       let val (cats', y') = fold_map vertical_range_cat cats y
       in (Bar cats', Int.max (y + 1, y')) end
   | vertical_range (Plus (cat1, cat2)) y =
       let val ([cat1', cat2'], y') = fold_map vertical_range_cat [cat1, cat2] y;
       in (Plus (cat1', cat2'), Int.max (y + 1, y')) end
   | vertical_range (Newline _) y = (Newline (y + 2), y + 3)
   | vertical_range atom y = (atom, y + 1);
 
 in
 
 fun output_rules ctxt rules =
   let
     val output_antiq =
       Antiquote.Antiq #>
       Document_Antiquotation.evaluate (single o Latex.symbols) ctxt #>
       Latex.output_text;
     fun output_text b s =
       Output.output s
       |> b ? enclose "\\isakeyword{" "}"
       |> enclose "\\isa{" "}";
 
     fun output_cat c (Cat (_, rails)) = outputs c rails
     and outputs c [rail] = output c rail
       | outputs _ rails = implode (map (output "") rails)
     and output _ (Bar []) = ""
       | output c (Bar [cat]) = output_cat c cat
       | output _ (Bar (cat :: cats)) =
           "\\rail@bar\n" ^ output_cat "" cat ^
           implode (map (fn Cat (y, rails) =>
               "\\rail@nextbar{" ^ string_of_int y ^ "}\n" ^ outputs "" rails) cats) ^
           "\\rail@endbar\n"
       | output c (Plus (cat, Cat (y, rails))) =
           "\\rail@plus\n" ^ output_cat c cat ^
           "\\rail@nextplus{" ^ string_of_int y ^ "}\n" ^ outputs "c" rails ^
           "\\rail@endplus\n"
       | output _ (Newline y) = "\\rail@cr{" ^ string_of_int y ^ "}\n"
       | output c (Nonterminal s) = "\\rail@" ^ c ^ "nont{" ^ output_text false s ^ "}[]\n"
       | output c (Terminal (b, s)) = "\\rail@" ^ c ^ "term{" ^ output_text b s ^ "}[]\n"
       | output c (Antiquote (b, a)) =
           "\\rail@" ^ c ^ (if b then "term{" else "nont{") ^ output_antiq a ^ "}[]\n";
 
     fun output_rule (name, rail) =
       let
         val (rail', y') = vertical_range rail 0;
         val out_name =
           (case name of
             Antiquote.Text "" => ""
           | Antiquote.Text s => output_text false s
           | Antiquote.Antiq a => output_antiq a);
       in
         "\\rail@begin{" ^ string_of_int y' ^ "}{" ^ out_name ^ "}\n" ^
         output "" rail' ^
         "\\rail@end\n"
       end;
   in Latex.string (Latex.environment "railoutput" (implode (map output_rule rules))) end;
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_raw_embedded \<^binding>\<open>rail\<close> (Scan.lift Args.text_input)
+  (Document_Output.antiquotation_raw_embedded \<^binding>\<open>rail\<close> (Scan.lift Args.text_input)
     (fn ctxt => output_rules ctxt o read ctxt));
 
 end;
 
 end;
diff --git a/src/Pure/build-jars b/src/Pure/build-jars
--- a/src/Pure/build-jars
+++ b/src/Pure/build-jars
@@ -1,327 +1,328 @@
 #!/usr/bin/env bash
 #
 # Author: Makarius
 #
 # build-jars - build Isabelle/Scala
 #
 # Requires proper Isabelle settings environment.
 
 ## sources
 
 declare -a SOURCES=(
   src/HOL/SPARK/Tools/spark.scala
   src/HOL/Tools/ATP/system_on_tptp.scala
   src/HOL/Tools/Mirabelle/mirabelle.scala
   src/HOL/Tools/Nitpick/kodkod.scala
   src/Pure/Admin/afp.scala
   src/Pure/Admin/build_csdp.scala
   src/Pure/Admin/build_cygwin.scala
   src/Pure/Admin/build_doc.scala
   src/Pure/Admin/build_e.scala
   src/Pure/Admin/build_fonts.scala
   src/Pure/Admin/build_history.scala
   src/Pure/Admin/build_jcef.scala
   src/Pure/Admin/build_jdk.scala
   src/Pure/Admin/build_jedit.scala
   src/Pure/Admin/build_log.scala
   src/Pure/Admin/build_polyml.scala
   src/Pure/Admin/build_release.scala
   src/Pure/Admin/build_spass.scala
   src/Pure/Admin/build_sqlite.scala
   src/Pure/Admin/build_status.scala
   src/Pure/Admin/build_vampire.scala
   src/Pure/Admin/build_verit.scala
   src/Pure/Admin/build_zipperposition.scala
   src/Pure/Admin/check_sources.scala
   src/Pure/Admin/ci_profile.scala
   src/Pure/Admin/components.scala
   src/Pure/Admin/isabelle_cronjob.scala
   src/Pure/Admin/isabelle_devel.scala
   src/Pure/Admin/jenkins.scala
   src/Pure/Admin/other_isabelle.scala
   src/Pure/Concurrent/consumer_thread.scala
   src/Pure/Concurrent/counter.scala
   src/Pure/Concurrent/delay.scala
   src/Pure/Concurrent/event_timer.scala
   src/Pure/Concurrent/future.scala
   src/Pure/Concurrent/isabelle_thread.scala
   src/Pure/Concurrent/mailbox.scala
   src/Pure/Concurrent/par_list.scala
   src/Pure/Concurrent/synchronized.scala
   src/Pure/GUI/color_value.scala
   src/Pure/GUI/desktop_app.scala
   src/Pure/GUI/gui.scala
   src/Pure/GUI/gui_thread.scala
   src/Pure/GUI/popup.scala
   src/Pure/GUI/wrap_panel.scala
   src/Pure/General/antiquote.scala
   src/Pure/General/bytes.scala
   src/Pure/General/cache.scala
   src/Pure/General/codepoint.scala
   src/Pure/General/comment.scala
   src/Pure/General/completion.scala
   src/Pure/General/csv.scala
   src/Pure/General/date.scala
   src/Pure/General/exn.scala
   src/Pure/General/file.scala
   src/Pure/General/file_watcher.scala
   src/Pure/General/graph.scala
   src/Pure/General/graph_display.scala
   src/Pure/General/graphics_file.scala
   src/Pure/General/http.scala
   src/Pure/General/json.scala
   src/Pure/General/linear_set.scala
   src/Pure/General/logger.scala
   src/Pure/General/long_name.scala
   src/Pure/General/mailman.scala
   src/Pure/General/mercurial.scala
   src/Pure/General/multi_map.scala
   src/Pure/General/output.scala
   src/Pure/General/path.scala
   src/Pure/General/position.scala
   src/Pure/General/pretty.scala
   src/Pure/General/properties.scala
   src/Pure/General/rdf.scala
   src/Pure/General/scan.scala
   src/Pure/General/sha1.scala
   src/Pure/General/sql.scala
   src/Pure/General/ssh.scala
   src/Pure/General/symbol.scala
   src/Pure/General/time.scala
   src/Pure/General/timing.scala
   src/Pure/General/untyped.scala
   src/Pure/General/url.scala
   src/Pure/General/utf8.scala
   src/Pure/General/uuid.scala
   src/Pure/General/value.scala
   src/Pure/General/word.scala
   src/Pure/General/xz.scala
   src/Pure/Isar/document_structure.scala
   src/Pure/Isar/keyword.scala
   src/Pure/Isar/line_structure.scala
   src/Pure/Isar/outer_syntax.scala
   src/Pure/Isar/parse.scala
   src/Pure/Isar/token.scala
   src/Pure/ML/ml_console.scala
   src/Pure/ML/ml_lex.scala
   src/Pure/ML/ml_process.scala
   src/Pure/ML/ml_statistics.scala
   src/Pure/ML/ml_syntax.scala
   src/Pure/PIDE/byte_message.scala
   src/Pure/PIDE/command.scala
   src/Pure/PIDE/command_span.scala
   src/Pure/PIDE/document.scala
   src/Pure/PIDE/document_id.scala
   src/Pure/PIDE/document_status.scala
   src/Pure/PIDE/editor.scala
   src/Pure/PIDE/headless.scala
   src/Pure/PIDE/line.scala
   src/Pure/PIDE/markup.scala
   src/Pure/PIDE/markup_tree.scala
   src/Pure/PIDE/protocol.scala
   src/Pure/PIDE/protocol_handlers.scala
   src/Pure/PIDE/protocol_message.scala
   src/Pure/PIDE/prover.scala
   src/Pure/PIDE/query_operation.scala
   src/Pure/PIDE/rendering.scala
   src/Pure/PIDE/resources.scala
   src/Pure/PIDE/session.scala
   src/Pure/PIDE/text.scala
   src/Pure/PIDE/xml.scala
   src/Pure/PIDE/yxml.scala
   src/Pure/ROOT.scala
   src/Pure/System/bash.scala
   src/Pure/System/command_line.scala
   src/Pure/System/cygwin.scala
   src/Pure/System/executable.scala
   src/Pure/System/getopts.scala
   src/Pure/System/isabelle_charset.scala
   src/Pure/System/isabelle_fonts.scala
   src/Pure/System/isabelle_platform.scala
   src/Pure/System/isabelle_process.scala
   src/Pure/System/isabelle_system.scala
   src/Pure/System/isabelle_tool.scala
   src/Pure/System/java_statistics.scala
   src/Pure/System/linux.scala
   src/Pure/System/mingw.scala
   src/Pure/System/numa.scala
   src/Pure/System/options.scala
   src/Pure/System/platform.scala
   src/Pure/System/posix_interrupt.scala
   src/Pure/System/process_result.scala
   src/Pure/System/progress.scala
   src/Pure/System/scala.scala
   src/Pure/System/system_channel.scala
   src/Pure/System/tty_loop.scala
   src/Pure/Thy/bibtex.scala
+  src/Pure/Thy/document_build.scala
   src/Pure/Thy/export.scala
   src/Pure/Thy/export_theory.scala
   src/Pure/Thy/file_format.scala
   src/Pure/Thy/html.scala
   src/Pure/Thy/latex.scala
   src/Pure/Thy/presentation.scala
   src/Pure/Thy/sessions.scala
   src/Pure/Thy/thy_element.scala
   src/Pure/Thy/thy_header.scala
   src/Pure/Thy/thy_syntax.scala
   src/Pure/Tools/build.scala
   src/Pure/Tools/build_docker.scala
   src/Pure/Tools/build_job.scala
   src/Pure/Tools/check_keywords.scala
   src/Pure/Tools/debugger.scala
   src/Pure/Tools/doc.scala
   src/Pure/Tools/dump.scala
   src/Pure/Tools/fontforge.scala
   src/Pure/Tools/java_monitor.scala
   src/Pure/Tools/logo.scala
   src/Pure/Tools/main.scala
   src/Pure/Tools/mkroot.scala
   src/Pure/Tools/phabricator.scala
   src/Pure/Tools/print_operation.scala
   src/Pure/Tools/profiling_report.scala
   src/Pure/Tools/scala_project.scala
   src/Pure/Tools/server.scala
   src/Pure/Tools/server_commands.scala
   src/Pure/Tools/simplifier_trace.scala
   src/Pure/Tools/spell_checker.scala
   src/Pure/Tools/task_statistics.scala
   src/Pure/Tools/update.scala
   src/Pure/Tools/update_cartouches.scala
   src/Pure/Tools/update_comments.scala
   src/Pure/Tools/update_header.scala
   src/Pure/Tools/update_then.scala
   src/Pure/Tools/update_theorems.scala
   src/Pure/library.scala
   src/Pure/pure_thy.scala
   src/Pure/term.scala
   src/Pure/term_xml.scala
   src/Pure/thm_name.scala
   src/Tools/Graphview/graph_file.scala
   src/Tools/Graphview/graph_panel.scala
   src/Tools/Graphview/graphview.scala
   src/Tools/Graphview/layout.scala
   src/Tools/Graphview/main_panel.scala
   src/Tools/Graphview/metrics.scala
   src/Tools/Graphview/model.scala
   src/Tools/Graphview/mutator.scala
   src/Tools/Graphview/mutator_dialog.scala
   src/Tools/Graphview/mutator_event.scala
   src/Tools/Graphview/popups.scala
   src/Tools/Graphview/shapes.scala
   src/Tools/Graphview/tree_panel.scala
   src/Tools/VSCode/src/build_vscode.scala
   src/Tools/VSCode/src/channel.scala
   src/Tools/VSCode/src/dynamic_output.scala
   src/Tools/VSCode/src/language_server.scala
   src/Tools/VSCode/src/lsp.scala
   src/Tools/VSCode/src/preview_panel.scala
   src/Tools/VSCode/src/state_panel.scala
   src/Tools/VSCode/src/textmate_grammar.scala
   src/Tools/VSCode/src/vscode_model.scala
   src/Tools/VSCode/src/vscode_rendering.scala
   src/Tools/VSCode/src/vscode_resources.scala
   src/Tools/VSCode/src/vscode_spell_checker.scala
 )
 
 
 ## diagnostics
 
 PRG="$(basename "$0")"
 
 function usage()
 {
   echo
   echo "Usage: isabelle $PRG [OPTIONS]"
   echo
   echo "  Options are:"
   echo "    -f           fresh build"
   echo
   exit 1
 }
 
 function fail()
 {
   echo "$1" >&2
   exit 2
 }
 
 [ -z "$ISABELLE_HOME" ] && fail "Missing Isabelle settings environment"
 
 
 ## process command line
 
 # options
 
 FRESH=""
 
 while getopts "f" OPT
 do
   case "$OPT" in
     f)
       FRESH=true
       ;;
     \?)
       usage
       ;;
   esac
 done
 
 shift $(($OPTIND - 1))
 
 
 # args
 
 [ "$#" -ne 0 ] && usage
 
 
 ## target
 
 TARGET_DIR="lib/classes"
 TARGET_JAR="$TARGET_DIR/Pure.jar"
 TARGET_SHASUM="$TARGET_DIR/Pure.shasum"
 
 function target_shasum()
 {
   shasum -a1 -b "$TARGET_JAR" "${SOURCES[@]}" 2>/dev/null
 }
 
 function target_clean()
 {
   rm -rf "$TARGET_DIR"
 }
 
 [ -n "$FRESH" ] && target_clean
 
 
 ## build
 
 target_shasum | cmp "$TARGET_SHASUM" >/dev/null 2>/dev/null
 if [ "$?" -ne 0 ]; then
   echo "### Building Isabelle/Scala ..."
 
   target_clean
 
   BUILD_DIR="$TARGET_DIR/build"
   mkdir -p "$BUILD_DIR"
 
   (
     export CLASSPATH="$(platform_path "$ISABELLE_CLASSPATH")"
     isabelle_scala scalac $ISABELLE_SCALAC_OPTIONS \
       -d "$BUILD_DIR" "${SOURCES[@]}"
   ) || fail "Failed to compile sources"
 
   CHARSET_SERVICE="META-INF/services/java.nio.charset.spi.CharsetProvider"
   mkdir -p "$BUILD_DIR/$(dirname "$CHARSET_SERVICE")"
   echo isabelle.Isabelle_Charset_Provider > "$BUILD_DIR/$CHARSET_SERVICE"
 
   cp "$ISABELLE_HOME/lib/logo/isabelle_transparent-32.gif" "$BUILD_DIR/isabelle/."
   cp "$ISABELLE_HOME/lib/logo/isabelle_transparent.gif" "$BUILD_DIR/isabelle/."
 
   isabelle_jdk jar -c -f "$(platform_path "$TARGET_JAR")" -e isabelle.Main \
     -C "$BUILD_DIR" META-INF \
     -C "$BUILD_DIR" isabelle || fail "Failed to produce $TARGET_JAR"
 
   rm -rf "$BUILD_DIR"
 
   target_shasum > "$TARGET_SHASUM"
 fi
diff --git a/src/Pure/library.ML b/src/Pure/library.ML
--- a/src/Pure/library.ML
+++ b/src/Pure/library.ML
@@ -1,1093 +1,1096 @@
 (*  Title:      Pure/library.ML
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     Author:     Markus Wenzel, TU Muenchen
 
 Basic library: functions, pairs, booleans, lists, integers,
 strings, lists as sets, orders, current directory, misc.
 
 See also General/basics.ML for the most fundamental concepts.
 *)
 
 infixr 0 <<<
 infix 2 ?
 infix 3 o oo ooo oooo
 infix 4 ~~ upto downto
 infix orf andf
 
 signature BASIC_LIBRARY =
 sig
   (*functions*)
   val undefined: 'a -> 'b
   val I: 'a -> 'a
   val K: 'a -> 'b -> 'a
   val curry: ('a * 'b -> 'c) -> 'a -> 'b -> 'c
   val uncurry: ('a -> 'b -> 'c) -> 'a * 'b -> 'c
   val ? : bool * ('a -> 'a) -> 'a -> 'a
   val oo: ('a -> 'b) * ('c -> 'd -> 'a) -> 'c -> 'd -> 'b
   val ooo: ('a -> 'b) * ('c -> 'd -> 'e -> 'a) -> 'c -> 'd -> 'e -> 'b
   val oooo: ('a -> 'b) * ('c -> 'd -> 'e -> 'f -> 'a) -> 'c -> 'd -> 'e -> 'f -> 'b
   val funpow: int -> ('a -> 'a) -> 'a -> 'a
   val funpow_yield: int -> ('a -> 'b * 'a) -> 'a -> 'b list * 'a
 
   (*pairs*)
   val pair: 'a -> 'b -> 'a * 'b
   val rpair: 'a -> 'b -> 'b * 'a
   val fst: 'a * 'b -> 'a
   val snd: 'a * 'b -> 'b
   val eq_fst: ('a * 'c -> bool) -> ('a * 'b) * ('c * 'd) -> bool
   val eq_snd: ('b * 'd -> bool) -> ('a * 'b) * ('c * 'd) -> bool
   val eq_pair: ('a * 'c -> bool) -> ('b * 'd -> bool) -> ('a * 'b) * ('c * 'd) -> bool
   val swap: 'a * 'b -> 'b * 'a
   val apfst: ('a -> 'b) -> 'a * 'c -> 'b * 'c
   val apsnd: ('a -> 'b) -> 'c * 'a -> 'c * 'b
   val apply2: ('a -> 'b) -> 'a * 'a -> 'b * 'b
 
   (*booleans*)
   val equal: ''a -> ''a -> bool
   val not_equal: ''a -> ''a -> bool
   val orf: ('a -> bool) * ('a -> bool) -> 'a -> bool
   val andf: ('a -> bool) * ('a -> bool) -> 'a -> bool
   val exists: ('a -> bool) -> 'a list -> bool
   val forall: ('a -> bool) -> 'a list -> bool
 
   (*lists*)
   val single: 'a -> 'a list
   val the_single: 'a list -> 'a
   val singleton: ('a list -> 'b list) -> 'a -> 'b
   val yield_singleton: ('a list -> 'c -> 'b list * 'c) -> 'a -> 'c -> 'b * 'c
   val perhaps_apply: ('a -> 'a option) list -> 'a -> 'a option
   val perhaps_loop: ('a -> 'a option) -> 'a -> 'a option
   val foldl1: ('a * 'a -> 'a) -> 'a list -> 'a
   val foldr1: ('a * 'a -> 'a) -> 'a list -> 'a
   val eq_list: ('a * 'a -> bool) -> 'a list * 'a list -> bool
   val maps: ('a -> 'b list) -> 'a list -> 'b list
   val filter: ('a -> bool) -> 'a list -> 'a list
   val filter_out: ('a -> bool) -> 'a list -> 'a list
   val map_filter: ('a -> 'b option) -> 'a list -> 'b list
   val take: int -> 'a list -> 'a list
   val drop: int -> 'a list -> 'a list
   val chop: int -> 'a list -> 'a list * 'a list
   val chop_groups: int -> 'a list -> 'a list list
   val nth: 'a list -> int -> 'a
   val nth_list: 'a list list -> int -> 'a list
   val nth_map: int -> ('a -> 'a) -> 'a list -> 'a list
   val nth_drop: int -> 'a list -> 'a list
   val map_index: (int * 'a -> 'b) -> 'a list -> 'b list
   val fold_index: (int * 'a -> 'b -> 'b) -> 'a list -> 'b -> 'b
   val map_range: (int -> 'a) -> int -> 'a list
   val fold_range: (int -> 'a -> 'a) -> int -> 'a -> 'a
   val split_last: 'a list -> 'a list * 'a
   val find_first: ('a -> bool) -> 'a list -> 'a option
   val find_index: ('a -> bool) -> 'a list -> int
   val get_first: ('a -> 'b option) -> 'a list -> 'b option
   val get_index: ('a -> 'b option) -> 'a list -> (int * 'b) option
   val flat: 'a list list -> 'a list
   val unflat: 'a list list -> 'b list -> 'b list list
   val grouped: int -> (('a list -> 'b list) -> 'c list list -> 'd list list) ->
     ('a -> 'b) -> 'c list -> 'd list
   val burrow: ('a list -> 'b list) -> 'a list list -> 'b list list
   val burrow_options: ('a list -> 'b list) -> 'a option list -> 'b option list
   val fold_burrow: ('a list -> 'c -> 'b list * 'd) -> 'a list list -> 'c -> 'b list list * 'd
   val separate: 'a -> 'a list -> 'a list
   val surround: 'a -> 'a list -> 'a list
   val replicate: int -> 'a -> 'a list
   val map_product: ('a -> 'b -> 'c) -> 'a list -> 'b list -> 'c list
   val fold_product: ('a -> 'b -> 'c -> 'c) -> 'a list -> 'b list -> 'c -> 'c
   val map2: ('a -> 'b -> 'c) -> 'a list -> 'b list -> 'c list
   val fold2: ('a -> 'b -> 'c -> 'c) -> 'a list -> 'b list -> 'c -> 'c
   val map_split: ('a -> 'b * 'c) -> 'a list -> 'b list * 'c list
   val zip_options: 'a list -> 'b option list -> ('a * 'b) list
   val ~~ : 'a list * 'b list -> ('a * 'b) list
   val split_list: ('a * 'b) list -> 'a list * 'b list
   val burrow_fst: ('a list -> 'b list) -> ('a * 'c) list -> ('b * 'c) list
   val take_prefix: ('a -> bool) -> 'a list -> 'a list
   val drop_prefix: ('a -> bool) -> 'a list -> 'a list
   val chop_prefix: ('a -> bool) -> 'a list -> 'a list * 'a list
   val take_suffix: ('a -> bool) -> 'a list -> 'a list
   val drop_suffix: ('a -> bool) -> 'a list -> 'a list
   val chop_suffix: ('a -> bool) -> 'a list -> 'a list * 'a list
   val is_prefix: ('a * 'a -> bool) -> 'a list -> 'a list -> bool
   val chop_common_prefix: ('a * 'b -> bool) -> 'a list * 'b list -> 'a list * ('a list * 'b list)
   val prefixes1: 'a list -> 'a list list
   val prefixes: 'a list -> 'a list list
   val suffixes1: 'a list -> 'a list list
   val suffixes: 'a list -> 'a list list
   val trim: ('a -> bool) -> 'a list -> 'a list
 
   (*integers*)
   val upto: int * int -> int list
   val downto: int * int -> int list
   val hex_digit: int -> string
   val radixpand: int * int -> int list
   val radixstring: int * string * int -> string
   val string_of_int: int -> string
   val signed_string_of_int: int -> string
   val string_of_indexname: string * int -> string
   val read_radix_int: int -> string list -> int * string list
   val read_int: string list -> int * string list
   val oct_char: string -> string
 
   (*strings*)
   val nth_string: string -> int -> string
   val fold_string: (string -> 'a -> 'a) -> string -> 'a -> 'a
   val exists_string: (string -> bool) -> string -> bool
   val forall_string: (string -> bool) -> string -> bool
+  val member_string: string -> string -> bool
   val first_field: string -> string -> (string * string) option
   val enclose: string -> string -> string -> string
   val unenclose: string -> string
   val quote: string -> string
   val cartouche: string -> string
   val space_implode: string -> string list -> string
   val commas: string list -> string
   val commas_quote: string list -> string
   val cat_lines: string list -> string
   val space_explode: string -> string -> string list
   val split_lines: string -> string list
   val plain_words: string -> string
   val prefix_lines: string -> string -> string
   val prefix: string -> string -> string
   val suffix: string -> string -> string
   val unprefix: string -> string -> string
   val unsuffix: string -> string -> string
   val trim_line: string -> string
   val trim_split_lines: string -> string list
   val normalize_lines: string -> string
   val replicate_string: int -> string -> string
   val translate_string: (string -> string) -> string -> string
   val encode_lines: string -> string
   val decode_lines: string -> string
   val align_right: string -> int -> string -> string
   val match_string: string -> string -> bool
 
   (*reals*)
   val string_of_real: real -> string
   val signed_string_of_real: real -> string
 
   (*lists as sets -- see also Pure/General/ord_list.ML*)
   val member: ('b * 'a -> bool) -> 'a list -> 'b -> bool
   val insert: ('a * 'a -> bool) -> 'a -> 'a list -> 'a list
   val remove: ('b * 'a -> bool) -> 'b -> 'a list -> 'a list
   val update: ('a * 'a -> bool) -> 'a -> 'a list -> 'a list
   val union: ('a * 'a -> bool) -> 'a list -> 'a list -> 'a list
   val subtract: ('b * 'a -> bool) -> 'b list -> 'a list -> 'a list
   val inter: ('a * 'b -> bool) -> 'b list -> 'a list -> 'a list
   val merge: ('a * 'a -> bool) -> 'a list * 'a list -> 'a list
   val subset: ('a * 'b -> bool) -> 'a list * 'b list -> bool
   val eq_set: ('a * 'a -> bool) -> 'a list * 'a list -> bool
   val distinct: ('a * 'a -> bool) -> 'a list -> 'a list
   val duplicates: ('a * 'a -> bool) -> 'a list -> 'a list
   val has_duplicates: ('a * 'a -> bool) -> 'a list -> bool
   val map_transpose: ('a list -> 'b) -> 'a list list -> 'b list
 
   (*lists as multisets*)
   val remove1: ('b * 'a -> bool) -> 'b -> 'a list -> 'a list
   val combine: ('a * 'a -> bool) -> 'a list -> 'a list -> 'a list
   val submultiset: ('a * 'b -> bool) -> 'a list * 'b list -> bool
 
   (*orders*)
   type 'a ord = 'a * 'a -> order
   val is_equal: order -> bool
   val is_less: order -> bool
   val is_less_equal: order -> bool
   val is_greater: order -> bool
   val is_greater_equal: order -> bool
   val rev_order: order -> order
   val make_ord: ('a * 'a -> bool) -> 'a ord
   val bool_ord: bool ord
   val int_ord: int ord
   val string_ord: string ord
   val fast_string_ord: string ord
   val option_ord: ('a * 'b -> order) -> 'a option * 'b option -> order
   val <<< : ('a -> order) * ('a -> order) -> 'a -> order
   val prod_ord: ('a * 'b -> order) -> ('c * 'd -> order) -> ('a * 'c) * ('b * 'd) -> order
   val dict_ord: ('a * 'b -> order) -> 'a list * 'b list -> order
   val list_ord: ('a * 'b -> order) -> 'a list * 'b list -> order
   val sort: 'a ord -> 'a list -> 'a list
   val sort_distinct: 'a ord -> 'a list -> 'a list
   val sort_strings: string list -> string list
   val sort_by: ('a -> string) -> 'a list -> 'a list
   val tag_list: int -> 'a list -> (int * 'a) list
   val untag_list: (int * 'a) list -> 'a list
   val order_list: (int * 'a) list -> 'a list
 
   (*misc*)
   val divide_and_conquer: ('a -> 'a list * ('b list -> 'b)) -> 'a -> 'b
   val divide_and_conquer': ('a -> 'b -> ('a list * ('c list * 'b -> 'c * 'b)) * 'b) ->
     'a -> 'b -> 'c * 'b
   val partition_eq: ('a * 'a -> bool) -> 'a list -> 'a list list
   val partition_list: (int -> 'a -> bool) -> int -> int -> 'a list -> 'a list list
   type serial = int
   val serial: unit -> serial
   val serial_string: unit -> string
   eqtype stamp
   val stamp: unit -> stamp
   structure Any: sig type T = exn end
   val getenv: string -> string
   val getenv_strict: string -> string
 end;
 
 signature LIBRARY =
 sig
   include BASIC_LIBRARY
   val foldl: ('a * 'b -> 'a) -> 'a * 'b list -> 'a
   val foldr: ('a * 'b -> 'b) -> 'a list * 'b -> 'b
 end;
 
 structure Library: LIBRARY =
 struct
 
 (* functions *)
 
 fun undefined _ = raise Match;
 
 fun I x = x;
 fun K x = fn _ => x;
 fun curry f x y = f (x, y);
 fun uncurry f (x, y) = f x y;
 
 (*conditional application*)
 fun b ? f = fn x => if b then f x else x;
 
 (*composition with multiple args*)
 fun (f oo g) x y = f (g x y);
 fun (f ooo g) x y z = f (g x y z);
 fun (f oooo g) x y z w = f (g x y z w);
 
 (*function exponentiation: f (... (f x) ...) with n applications of f*)
 fun funpow (0: int) _ x = x
   | funpow n f x = funpow (n - 1) f (f x);
 
 fun funpow_yield (0 : int) _ x = ([], x)
   | funpow_yield n f x = x |> f ||>> funpow_yield (n - 1) f |>> op ::;
 
 
 (* pairs *)
 
 fun pair x y = (x, y);
 fun rpair x y = (y, x);
 
 fun fst (x, y) = x;
 fun snd (x, y) = y;
 
 fun eq_fst eq ((x1, _), (x2, _)) = eq (x1, x2);
 fun eq_snd eq ((_, y1), (_, y2)) = eq (y1, y2);
 fun eq_pair eqx eqy ((x1, y1), (x2, y2)) = eqx (x1, x2) andalso eqy (y1, y2);
 
 fun swap (x, y) = (y, x);
 
 fun apfst f (x, y) = (f x, y);
 fun apsnd f (x, y) = (x, f y);
 fun apply2 f (x, y) = (f x, f y);
 
 
 (* booleans *)
 
 (*polymorphic equality*)
 fun equal x y = x = y;
 fun not_equal x y = x <> y;
 
 (*combining predicates*)
 fun p orf q = fn x => p x orelse q x;
 fun p andf q = fn x => p x andalso q x;
 
 val exists = List.exists;
 val forall = List.all;
 
 
 
 (** lists **)
 
 fun single x = [x];
 
 fun the_single [x] = x
   | the_single _ = raise List.Empty;
 
 fun singleton f x = the_single (f [x]);
 
 fun yield_singleton f x = f [x] #>> the_single;
 
 fun perhaps_apply funs arg =
   let
     fun app [] res = res
       | app (f :: fs) (changed, x) =
           (case f x of
             NONE => app fs (changed, x)
           | SOME x' => app fs (true, x'));
   in (case app funs (false, arg) of (false, _) => NONE | (true, arg') => SOME arg') end;
 
 fun perhaps_loop f arg =
   let
     fun loop (changed, x) =
       (case f x of
         NONE => (changed, x)
       | SOME x' => loop (true, x'));
   in (case loop (false, arg) of (false, _) => NONE | (true, arg') => SOME arg') end;
 
 
 (* fold -- old versions *)
 
 (*the following versions of fold are designed to fit nicely with infixes*)
 
 (*  (op @) (e, [x1, ..., xn])  ===>  ((e @ x1) @ x2) ... @ xn
     for operators that associate to the left (TAIL RECURSIVE)*)
 fun foldl (f: 'a * 'b -> 'a) : 'a * 'b list -> 'a =
   let fun itl (e, [])  = e
         | itl (e, a::l) = itl (f(e, a), l)
   in  itl end;
 
 (*  (op @) ([x1, ..., xn], e)  ===>   x1 @ (x2 ... @ (xn @ e))
     for operators that associate to the right (not tail recursive)*)
 fun foldr f (l, e) =
   let fun itr [] = e
         | itr (a::l) = f(a, itr l)
   in  itr l  end;
 
 (*  (op @) [x1, ..., xn]  ===>  ((x1 @ x2) @ x3) ... @ xn
     for operators that associate to the left (TAIL RECURSIVE)*)
 fun foldl1 f [] = raise List.Empty
   | foldl1 f (x :: xs) = foldl f (x, xs);
 
 (*  (op @) [x1, ..., xn]  ===>   x1 @ (x2 ... @ (x[n-1] @ xn))
     for n > 0, operators that associate to the right (not tail recursive)*)
 fun foldr1 f [] = raise List.Empty
   | foldr1 f l =
       let fun itr [x] = x
             | itr (x::l) = f(x, itr l)
       in  itr l  end;
 
 
 (* basic list functions *)
 
 fun eq_list eq (list1, list2) =
   pointer_eq (list1, list2) orelse
     let
       fun eq_lst (x :: xs, y :: ys) = eq (x, y) andalso eq_lst (xs, ys)
         | eq_lst _ = true;
     in length list1 = length list2 andalso eq_lst (list1, list2) end;
 
 fun maps f [] = []
   | maps f (x :: xs) = f x @ maps f xs;
 
 val filter = List.filter;
 fun filter_out f = filter (not o f);
 val map_filter = List.mapPartial;
 
 fun take (0: int) xs = []
   | take _ [] = []
   | take n (x :: xs) = x :: take (n - 1) xs;
 
 fun drop (0: int) xs = xs
   | drop _ [] = []
   | drop n (x :: xs) = drop (n - 1) xs;
 
 fun chop (0: int) xs = ([], xs)
   | chop _ [] = ([], [])
   | chop n (x :: xs) = chop (n - 1) xs |>> cons x;
 
 fun chop_groups n list =
   (case chop (Int.max (n, 1)) list of
     ([], _) => []
   | (g, rest) => g :: chop_groups n rest);
 
 
 (*return nth element of a list, where 0 designates the first element;
   raise Subscript if list too short*)
 fun nth xs i = List.nth (xs, i);
 
 fun nth_list xss i = nth xss i handle General.Subscript => [];
 
 fun nth_map 0 f (x :: xs) = f x :: xs
   | nth_map n f (x :: xs) = x :: nth_map (n - 1) f xs
   | nth_map (_: int) _ [] = raise Subscript;
 
 fun nth_drop n xs =
   List.take (xs, n) @ List.drop (xs, n + 1);
 
 fun map_index f =
   let
     fun map_aux (_: int) [] = []
       | map_aux i (x :: xs) = f (i, x) :: map_aux (i + 1) xs
   in map_aux 0 end;
 
 fun fold_index f =
   let
     fun fold_aux (_: int) [] y = y
       | fold_aux i (x :: xs) y = fold_aux (i + 1) xs (f (i, x) y)
   in fold_aux 0 end;
 
 fun map_range f i =
   let
     fun map_aux (k: int) =
       if k < i then f k :: map_aux (k + 1) else []
   in map_aux 0 end;
 
 fun fold_range f i =
   let
     fun fold_aux (k: int) y =
       if k < i then fold_aux (k + 1) (f k y) else y
   in fold_aux 0 end;
 
 
 (*rear decomposition*)
 fun split_last [] = raise List.Empty
   | split_last [x] = ([], x)
   | split_last (x :: xs) = apfst (cons x) (split_last xs);
 
 (*find first element satisfying predicate*)
 val find_first = List.find;
 
 (*find position of first element satisfying a predicate*)
 fun find_index pred =
   let fun find (_: int) [] = ~1
         | find n (x :: xs) = if pred x then n else find (n + 1) xs;
   in find 0 end;
 
 (*get first element by lookup function*)
 fun get_first _ [] = NONE
   | get_first f (x :: xs) =
       (case f x of
         NONE => get_first f xs
       | some => some);
 
 fun get_index f =
   let
     fun get_aux (_: int) [] = NONE
       | get_aux i (x :: xs) =
           (case f x of
             NONE => get_aux (i + 1) xs
           | SOME y => SOME (i, y))
   in get_aux 0 end;
 
 val flat = List.concat;
 
 fun unflat (xs :: xss) ys =
       let val (ps, qs) = chop (length xs) ys
       in ps :: unflat xss qs end
   | unflat [] [] = []
   | unflat _ _ = raise ListPair.UnequalLengths;
 
 fun grouped n comb f = chop_groups n #> comb (map f) #> flat;
 
 fun burrow f xss = unflat xss (f (flat xss));
 
 fun burrow_options f os = map (try hd) (burrow f (map the_list os));
 
 fun fold_burrow f xss s =
   apfst (unflat xss) (f (flat xss) s);
 
 (*separate s [x1, x2, ..., xn]  ===>  [x1, s, x2, s, ..., s, xn]*)
 fun separate s (x :: (xs as _ :: _)) = x :: s :: separate s xs
   | separate _ xs = xs;
 
 fun surround s (x :: xs) = s :: x :: surround s xs
   | surround s [] = [s];
 
 (*make the list [x, x, ..., x] of length n*)
 fun replicate (n: int) x =
   let fun rep (0, xs) = xs
         | rep (n, xs) = rep (n - 1, x :: xs)
   in
     if n < 0 then raise Subscript
     else rep (n, [])
   end;
 
 
 (* direct product *)
 
 fun map_product f _ [] = []
   | map_product f [] _ = []
   | map_product f (x :: xs) ys = map (f x) ys @ map_product f xs ys;
 
 fun fold_product f _ [] z = z
   | fold_product f [] _ z = z
   | fold_product f (x :: xs) ys z = z |> fold (f x) ys |> fold_product f xs ys;
 
 
 (* lists of pairs *)
 
 fun map2 _ [] [] = []
   | map2 f (x :: xs) (y :: ys) = f x y :: map2 f xs ys
   | map2 _ _ _ = raise ListPair.UnequalLengths;
 
 fun fold2 _ [] [] z = z
   | fold2 f (x :: xs) (y :: ys) z = fold2 f xs ys (f x y z)
   | fold2 _ _ _ _ = raise ListPair.UnequalLengths;
 
 fun map_split _ [] = ([], [])
   | map_split f (x :: xs) =
       let
         val (y, w) = f x;
         val (ys, ws) = map_split f xs;
       in (y :: ys, w :: ws) end;
 
 fun zip_options (x :: xs) (SOME y :: ys) = (x, y) :: zip_options xs ys
   | zip_options (_ :: xs) (NONE :: ys) = zip_options xs ys
   | zip_options _ [] = []
   | zip_options [] _ = raise ListPair.UnequalLengths;
 
 (*combine two lists forming a list of pairs:
   [x1, ..., xn] ~~ [y1, ..., yn]  ===>  [(x1, y1), ..., (xn, yn)]*)
 fun [] ~~ [] = []
   | (x :: xs) ~~ (y :: ys) = (x, y) :: (xs ~~ ys)
   | _ ~~ _ = raise ListPair.UnequalLengths;
 
 (*inverse of ~~; the old 'split':
   [(x1, y1), ..., (xn, yn)]  ===>  ([x1, ..., xn], [y1, ..., yn])*)
 val split_list = ListPair.unzip;
 
 fun burrow_fst f xs = split_list xs |>> f |> op ~~;
 
 
 (* take, drop, chop, trim according to predicate *)
 
 fun take_prefix pred list =
   let
     fun take res (x :: xs) = if pred x then take (x :: res) xs else rev res
       | take res [] = rev res;
   in take [] list end;
 
 fun drop_prefix pred list =
   let
     fun drop (x :: xs) = if pred x then drop xs else x :: xs
       | drop [] = [];
   in drop list end;
 
 fun chop_prefix pred list =
   let
     val prfx = take_prefix pred list;
     val sffx = drop (length prfx) list;
   in (prfx, sffx) end;
 
 fun take_suffix pred list =
   let
     fun take res (x :: xs) = if pred x then take (x :: res) xs else res
       | take res [] = res;
   in take [] (rev list) end;
 
 fun drop_suffix pred list =
   let
     fun drop (x :: xs) = if pred x then drop xs else rev (x :: xs)
       | drop [] = [];
   in drop (rev list) end;
 
 fun chop_suffix pred list =
   let
     val prfx = drop_suffix pred list;
     val sffx = drop (length prfx) list;
   in (prfx, sffx) end;
 
 fun trim pred = drop_prefix pred #> drop_suffix pred;
 
 
 (* prefixes, suffixes *)
 
 fun is_prefix _ [] _ = true
   | is_prefix eq (x :: xs) (y :: ys) = eq (x, y) andalso is_prefix eq xs ys
   | is_prefix eq _ _ = false;
 
 fun chop_common_prefix eq ([], ys) = ([], ([], ys))
   | chop_common_prefix eq (xs, []) = ([], (xs, []))
   | chop_common_prefix eq (xs as x :: xs', ys as y :: ys') =
       if eq (x, y) then
         let val (ps', xys'') = chop_common_prefix eq (xs', ys')
         in (x :: ps', xys'') end
       else ([], (xs, ys));
 
 fun prefixes1 [] = []
   | prefixes1 (x :: xs) = map (cons x) ([] :: prefixes1 xs);
 
 fun prefixes xs = [] :: prefixes1 xs;
 
 fun suffixes1 xs = map rev (prefixes1 (rev xs));
 fun suffixes xs = [] :: suffixes1 xs;
 
 
 
 (** integers **)
 
 (* lists of integers *)
 
 (*make the list [from, from + 1, ..., to]*)
 fun ((i: int) upto j) =
   if i > j then [] else i :: (i + 1 upto j);
 
 (*make the list [from, from - 1, ..., to]*)
 fun ((i: int) downto j) =
   if i < j then [] else i :: (i - 1 downto j);
 
 
 (* convert integers to strings *)
 
 (*hexadecimal*)
 fun hex_digit i =
   if i < 10 then chr (Char.ord #"0" + i) else chr (Char.ord #"a" + i - 10);
 
 (*expand the number in the given base;
   example: radixpand (2, 8) gives [1, 0, 0, 0]*)
 fun radixpand (base, num) : int list =
   let
     fun radix (n, tail) =
       if n < base then n :: tail
       else radix (n div base, (n mod base) :: tail)
   in radix (num, []) end;
 
 (*expands a number into a string of characters starting from "zerochar";
   example: radixstring (2, "0", 8) gives "1000"*)
 fun radixstring (base, zerochar, num) =
   let val offset = ord zerochar;
       fun chrof n = chr (offset + n)
   in implode (map chrof (radixpand (base, num))) end;
 
 
 local
   val zero = Char.ord #"0";
   val small_int = 10000: int;
   val small_int_table = Vector.tabulate (small_int, Int.toString);
 in
 
 fun string_of_int i =
   if i < 0 then Int.toString i
   else if i < 10 then chr (zero + i)
   else if i < small_int then Vector.sub (small_int_table, i)
   else Int.toString i;
 
 end;
 
 fun signed_string_of_int i =
   if i < 0 then "-" ^ string_of_int (~ i) else string_of_int i;
 
 fun string_of_indexname (a, 0) = a
   | string_of_indexname (a, i) = a ^ "_" ^ string_of_int i;
 
 
 (* read integers *)
 
 fun read_radix_int radix cs =
   let
     val zero = Char.ord #"0";
     val limit = zero + radix;
     fun scan (num, []) = (num, [])
       | scan (num, c :: cs) =
           if zero <= ord c andalso ord c < limit then
             scan (radix * num + (ord c - zero), cs)
           else (num, c :: cs);
   in scan (0, cs) end;
 
 val read_int = read_radix_int 10;
 
 fun oct_char s = chr (#1 (read_radix_int 8 (raw_explode s)));
 
 
 
 (** strings **)
 
 (* functions tuned for strings, avoiding explode *)
 
 fun nth_string str i =
   (case try String.substring (str, i, 1) of
     SOME s => s
   | NONE => raise Subscript);
 
 fun fold_string f str x0 =
   let
     val n = size str;
     fun iter (x, i) =
       if i < n then iter (f (String.substring (str, i, 1)) x, i + 1) else x;
   in iter (x0, 0) end;
 
 fun exists_string pred str =
   let
     val n = size str;
     fun ex i = i < n andalso (pred (String.substring (str, i, 1)) orelse ex (i + 1));
   in ex 0 end;
 
 fun forall_string pred = not o exists_string (not o pred);
 
+fun member_string str s = exists_string (fn s' => s = s') str;
+
 fun first_field sep str =
   let
     val n = size sep;
     val len = size str;
     fun find i =
       if i + n > len then NONE
       else if String.substring (str, i, n) = sep then SOME i
       else find (i + 1);
   in
     (case find 0 of
       NONE => NONE
     | SOME i => SOME (String.substring (str, 0, i), String.extract (str, i + n, NONE)))
   end;
 
 (*enclose in brackets*)
 fun enclose lpar rpar str = lpar ^ str ^ rpar;
 fun unenclose str = String.substring (str, 1, size str - 2);
 
 (*simple quoting (does not escape special chars)*)
 val quote = enclose "\"" "\"";
 
 val cartouche = enclose "\<open>" "\<close>";
 
 val space_implode = String.concatWith;
 
 val commas = space_implode ", ";
 val commas_quote = commas o map quote;
 
 val cat_lines = space_implode "\n";
 
 (*space_explode "." "h.e..l.lo" = ["h", "e", "", "l", "lo"]*)
 fun space_explode _ "" = []
   | space_explode sep s = String.fields (fn c => str c = sep) s;
 
 val split_lines = space_explode "\n";
 
 fun plain_words s = space_explode "_" s |> space_implode " ";
 
 fun prefix_lines "" txt = txt
   | prefix_lines prfx txt = txt |> split_lines |> map (fn s => prfx ^ s) |> cat_lines;
 
 fun prefix prfx s = prfx ^ s;
 fun suffix sffx s = s ^ sffx;
 
 fun unprefix prfx s =
   if String.isPrefix prfx s then String.substring (s, size prfx, size s - size prfx)
   else raise Fail "unprefix";
 
 fun unsuffix sffx s =
   if String.isSuffix sffx s then String.substring (s, 0, size s - size sffx)
   else raise Fail "unsuffix";
 
 fun trim_line s =
   if String.isSuffix "\r\n" s
   then String.substring (s, 0, size s - 2)
   else if String.isSuffix "\r" s orelse String.isSuffix "\n" s
   then String.substring (s, 0, size s - 1)
   else s;
 
 val trim_split_lines = trim_line #> split_lines #> map trim_line;
 
 fun normalize_lines str =
   if exists_string (fn s => s = "\r") str then
     split_lines str |> map trim_line |> cat_lines
   else str;
 
 fun replicate_string (0: int) _ = ""
   | replicate_string 1 a = a
   | replicate_string k a =
       if k mod 2 = 0 then replicate_string (k div 2) (a ^ a)
       else replicate_string (k div 2) (a ^ a) ^ a;
 
 fun translate_string f = String.translate (f o String.str);
 
 val encode_lines = translate_string (fn "\n" => "\v" | c => c);
 val decode_lines = translate_string (fn "\v" => "\n" | c => c);
 
 fun align_right c k s =
   let
     val _ = if size c <> 1 orelse size s > k
       then raise Fail "align_right" else ()
   in replicate_string (k - size s) c ^ s end;
 
 (*crude matching of str against simple glob pat*)
 fun match_string pat str =
   let
     fun match [] _ = true
       | match (p :: ps) s =
           size p <= size s andalso
             (case try (unprefix p) s of
               SOME s' => match ps s'
             | NONE => match (p :: ps) (String.substring (s, 1, size s - 1)));
   in match (space_explode "*" pat) str end;
 
 
 
 (** reals **)
 
 val string_of_real = Real.fmt (StringCvt.GEN NONE);
 
 fun signed_string_of_real x =
   if x < 0.0 then "-" ^ string_of_real (~ x) else string_of_real x;
 
 
 
 (** lists as sets -- see also Pure/General/ord_list.ML **)
 
 (* canonical operations *)
 
 fun member eq list x =
   let
     fun memb [] = false
       | memb (y :: ys) = eq (x, y) orelse memb ys;
   in memb list end;
 
 fun insert eq x xs = if member eq xs x then xs else x :: xs;
 fun remove eq x xs = if member eq xs x then filter_out (fn y => eq (x, y)) xs else xs;
 fun update eq x xs = cons x (remove eq x xs);
 
 fun inter eq xs = filter (member eq xs);
 
 fun union eq = fold (insert eq);
 fun subtract eq = fold (remove eq);
 
 fun merge eq (xs, ys) =
   if pointer_eq (xs, ys) then xs
   else if null xs then ys
   else fold_rev (insert eq) ys xs;
 
 
 (* subset and set equality *)
 
 fun subset eq (xs, ys) = forall (member eq ys) xs;
 
 fun eq_set eq (xs, ys) =
   eq_list eq (xs, ys) orelse
     (subset eq (xs, ys) andalso subset (eq o swap) (ys, xs));
 
 
 (*makes a list of the distinct members of the input; preserves order, takes
   first of equal elements*)
 fun distinct eq lst =
   let
     fun dist (rev_seen, []) = rev rev_seen
       | dist (rev_seen, x :: xs) =
           if member eq rev_seen x then dist (rev_seen, xs)
           else dist (x :: rev_seen, xs);
   in dist ([], lst) end;
 
 (*returns a list containing all repeated elements exactly once; preserves
   order, takes first of equal elements*)
 fun duplicates eq lst =
   let
     fun dups (rev_dups, []) = rev rev_dups
       | dups (rev_dups, x :: xs) =
           if member eq rev_dups x orelse not (member eq xs x) then
             dups (rev_dups, xs)
           else dups (x :: rev_dups, xs);
   in dups ([], lst) end;
 
 fun has_duplicates eq =
   let
     fun dups [] = false
       | dups (x :: xs) = member eq xs x orelse dups xs;
   in dups end;
 
 
 (* matrices *)
 
 fun map_transpose f xss =
   let
     val n =
       (case distinct (op =) (map length xss) of
         [] => 0
       | [n] => n
       | _ => raise ListPair.UnequalLengths);
   in map_range (fn m => f (map (fn xs => nth xs m) xss)) n end;
 
 
 
 (** lists as multisets **)
 
 fun remove1 eq x [] = []
   | remove1 eq x (y :: ys) = if eq (x, y) then ys else y :: remove1 eq x ys;
 
 fun combine eq xs ys = fold (remove1 eq) ys xs @ ys;
 
 fun submultiset _ ([], _)  = true
   | submultiset eq (x :: xs, ys) = member eq ys x andalso submultiset eq (xs, remove1 eq x ys);
 
 
 
 (** orders **)
 
 type 'a ord = 'a * 'a -> order;
 
 fun is_equal ord = ord = EQUAL;
 fun is_less ord = ord = LESS;
 fun is_less_equal ord = ord = LESS orelse ord = EQUAL;
 fun is_greater ord = ord = GREATER;
 fun is_greater_equal ord = ord = GREATER orelse ord = EQUAL;
 
 fun rev_order LESS = GREATER
   | rev_order EQUAL = EQUAL
   | rev_order GREATER = LESS;
 
 (*compose orders*)
 fun (a_ord <<< b_ord) p = (case a_ord p of EQUAL => b_ord p | ord => ord);
 
 (*assume rel is a linear strict order*)
 fun make_ord rel (x, y) =
   if rel (x, y) then LESS
   else if rel (y, x) then GREATER
   else EQUAL;
 
 fun bool_ord (false, true) = LESS
   | bool_ord (true, false) = GREATER
   | bool_ord _ = EQUAL;
 
 val int_ord = Int.compare;
 val string_ord = String.compare;
 
 fun fast_string_ord (s1, s2) =
   if pointer_eq (s1, s2) then EQUAL
   else (case int_ord (size s1, size s2) of EQUAL => string_ord (s1, s2) | ord => ord);
 
 fun option_ord ord (SOME x, SOME y) = ord (x, y)
   | option_ord _ (NONE, NONE) = EQUAL
   | option_ord _ (NONE, SOME _) = LESS
   | option_ord _ (SOME _, NONE) = GREATER;
 
 (*lexicographic product*)
 fun prod_ord a_ord b_ord ((x, y), (x', y')) =
   (case a_ord (x, x') of EQUAL => b_ord (y, y') | ord => ord);
 
 (*dictionary order -- in general NOT well-founded!*)
 fun dict_ord elem_ord (x :: xs, y :: ys) =
       (case elem_ord (x, y) of EQUAL => dict_ord elem_ord (xs, ys) | ord => ord)
   | dict_ord _ ([], []) = EQUAL
   | dict_ord _ ([], _ :: _) = LESS
   | dict_ord _ (_ :: _, []) = GREATER;
 
 (*lexicographic product of lists*)
 fun list_ord elem_ord (xs, ys) =
   (case int_ord (length xs, length ys) of EQUAL => dict_ord elem_ord (xs, ys) | ord => ord);
 
 
 (* sorting *)
 
 (*stable mergesort -- preserves order of equal elements*)
 fun mergesort unique ord =
   let
     fun merge (xs as x :: xs') (ys as y :: ys') =
           (case ord (x, y) of
             LESS => x :: merge xs' ys
           | EQUAL =>
               if unique then merge xs ys'
               else x :: merge xs' ys
           | GREATER => y :: merge xs ys')
       | merge [] ys = ys
       | merge xs [] = xs;
 
     fun merge_all [xs] = xs
       | merge_all xss = merge_all (merge_pairs xss)
     and merge_pairs (xs :: ys :: xss) = merge xs ys :: merge_pairs xss
       | merge_pairs xss = xss;
 
     fun runs (x :: y :: xs) =
           (case ord (x, y) of
              LESS => ascending y [x] xs
            | EQUAL =>
                if unique then runs (x :: xs)
                else ascending y [x] xs
            | GREATER => descending y [x] xs)
       | runs xs = [xs]
 
     and ascending x xs (zs as y :: ys) =
           (case ord (x, y) of
              LESS => ascending y (x :: xs) ys
            | EQUAL =>
                if unique then ascending x xs ys
                else ascending y (x :: xs) ys
            | GREATER => rev (x :: xs) :: runs zs)
       | ascending x xs [] = [rev (x :: xs)]
 
     and descending x xs (zs as y :: ys) =
           (case ord (x, y) of
              GREATER => descending y (x :: xs) ys
            | EQUAL =>
                if unique then descending x xs ys
                else (x :: xs) :: runs zs
            | LESS => (x :: xs) :: runs zs)
       | descending x xs [] = [x :: xs];
 
   in merge_all o runs end;
 
 fun sort ord = mergesort false ord;
 fun sort_distinct ord = mergesort true ord;
 
 val sort_strings = sort string_ord;
 fun sort_by key xs = sort (string_ord o apply2 key) xs;
 
 
 (* items tagged by integer index *)
 
 (*insert tags*)
 fun tag_list k [] = []
   | tag_list k (x :: xs) = (k:int, x) :: tag_list (k + 1) xs;
 
 (*remove tags and suppress duplicates -- list is assumed sorted!*)
 fun untag_list [] = []
   | untag_list [(k: int, x)] = [x]
   | untag_list ((k, x) :: (rest as (k', x') :: _)) =
       if k = k' then untag_list rest
       else x :: untag_list rest;
 
 (*return list elements in original order*)
 fun order_list list = untag_list (sort (int_ord o apply2 fst) list);
 
 
 
 (** misc **)
 
 fun divide_and_conquer decomp x =
   let val (ys, recomb) = decomp x
   in recomb (map (divide_and_conquer decomp) ys) end;
 
 fun divide_and_conquer' decomp x s =
   let val ((ys, recomb), s') = decomp x s
   in recomb (fold_map (divide_and_conquer' decomp) ys s') end;
 
 
 (*Partition a list into buckets  [ bi, b(i+1), ..., bj ]
    putting x in bk if p(k)(x) holds.  Preserve order of elements if possible.*)
 fun partition_list p i j =
   let
     fun part (k: int) xs =
       if k > j then
         (case xs of
           [] => []
         | _ => raise Fail "partition_list")
       else
         let val (ns, rest) = List.partition (p k) xs
         in ns :: part (k + 1) rest end;
   in part (i: int) end;
 
 fun partition_eq (eq: 'a * 'a -> bool) =
   let
     fun part [] = []
       | part (x :: ys) =
           let val (xs, xs') = List.partition (fn y => eq (x, y)) ys
           in (x :: xs) :: part xs' end;
   in part end;
 
 
 (* serial numbers and abstract stamps *)
 
 type serial = int;
 val serial = Counter.make ();
 val serial_string = string_of_int o serial;
 
 datatype stamp = Stamp of serial;
 fun stamp () = Stamp (serial ());
 
 
 (* values of any type *)
 
 (*note that the builtin exception datatype may be extended by new
   constructors at any time*)
 structure Any = struct type T = exn end;
 
 
 (* getenv *)
 
 fun getenv x =
   (case OS.Process.getEnv x of
     NONE => ""
   | SOME y => y);
 
 fun getenv_strict x =
   (case getenv x of
     "" => error ("Undefined Isabelle environment variable: " ^ quote x)
   | y => y);
 
 end;
 
 structure Basic_Library: BASIC_LIBRARY = Library;
 open Basic_Library;
diff --git a/src/Pure/library.scala b/src/Pure/library.scala
--- a/src/Pure/library.scala
+++ b/src/Pure/library.scala
@@ -1,304 +1,307 @@
 /*  Title:      Pure/library.scala
     Author:     Makarius
 
 Basic library.
 */
 
 package isabelle
 
 
 import scala.annotation.tailrec
 import scala.collection.mutable
 import scala.util.matching.Regex
 
 
 object Library
 {
   /* resource management */
 
   def using[A <: AutoCloseable, B](a: A)(f: A => B): B =
   {
     try { f(a) }
     finally { if (a != null) a.close() }
   }
 
 
   /* integers */
 
   private val small_int = 10000
   private lazy val small_int_table =
   {
     val array = new Array[String](small_int)
     for (i <- 0 until small_int) array(i) = i.toString
     array
   }
 
   def is_small_int(s: String): Boolean =
   {
     val len = s.length
     1 <= len && len <= 4 &&
     s.forall(c => '0' <= c && c <= '9') &&
     (len == 1 || s(0) != '0')
   }
 
   def signed_string_of_long(i: Long): String =
     if (0 <= i && i < small_int) small_int_table(i.toInt)
     else i.toString
 
   def signed_string_of_int(i: Int): String =
     if (0 <= i && i < small_int) small_int_table(i)
     else i.toString
 
 
   /* separated chunks */
 
   def separate[A](s: A, list: List[A]): List[A] =
   {
     val result = new mutable.ListBuffer[A]
     var first = true
     for (x <- list) {
       if (first) {
         first = false
         result += x
       }
       else {
         result += s
         result += x
       }
     }
     result.toList
   }
 
   def separated_chunks(sep: Char => Boolean, source: CharSequence): Iterator[CharSequence] =
     new Iterator[CharSequence] {
       private val end = source.length
       private def next_chunk(i: Int): Option[(CharSequence, Int)] =
       {
         if (i < end) {
           var j = i; do j += 1 while (j < end && !sep(source.charAt(j)))
           Some((source.subSequence(i + 1, j), j))
         }
         else None
       }
       private var state: Option[(CharSequence, Int)] = if (end == 0) None else next_chunk(-1)
 
       def hasNext: Boolean = state.isDefined
       def next(): CharSequence =
         state match {
           case Some((s, i)) => state = next_chunk(i); s
           case None => Iterator.empty.next()
         }
     }
 
   def space_explode(sep: Char, str: String): List[String] =
     separated_chunks(_ == sep, str).map(_.toString).toList
 
 
   /* lines */
 
   def terminate_lines(lines: IterableOnce[String]): String =
     lines.iterator.mkString("", "\n", "\n")
 
   def cat_lines(lines: IterableOnce[String]): String =
     lines.iterator.mkString("\n")
 
   def split_lines(str: String): List[String] = space_explode('\n', str)
 
   def prefix_lines(prfx: String, str: String): String =
     if (str == "") str else cat_lines(split_lines(str).map(prfx + _))
 
+  def indent_lines(n: Int, str: String): String =
+    prefix_lines(Symbol.spaces(n), str)
+
   def first_line(source: CharSequence): String =
   {
     val lines = separated_chunks(_ == '\n', source)
     if (lines.hasNext) lines.next().toString
     else ""
   }
 
   def trim_line(s: String): String =
     if (s.endsWith("\r\n")) s.substring(0, s.length - 2)
     else if (s.endsWith("\r") || s.endsWith("\n")) s.substring(0, s.length - 1)
     else s
 
   def trim_split_lines(s: String): List[String] =
     split_lines(trim_line(s)).map(trim_line)
 
   def encode_lines(s: String): String = s.replace('\n', '\u000b')
   def decode_lines(s: String): String = s.replace('\u000b', '\n')
 
 
   /* strings */
 
   def make_string(f: StringBuilder => Unit): String =
   {
     val s = new StringBuilder
     f(s)
     s.toString
   }
 
   def try_unprefix(prfx: String, s: String): Option[String] =
     if (s.startsWith(prfx)) Some(s.substring(prfx.length)) else None
 
   def try_unsuffix(sffx: String, s: String): Option[String] =
     if (s.endsWith(sffx)) Some(s.substring(0, s.length - sffx.length)) else None
 
   def perhaps_unprefix(prfx: String, s: String): String = try_unprefix(prfx, s) getOrElse s
   def perhaps_unsuffix(sffx: String, s: String): String = try_unsuffix(sffx, s) getOrElse s
 
   def isolate_substring(s: String): String = new String(s.toCharArray)
 
   def strip_ansi_color(s: String): String =
     s.replaceAll("\u001b\\[\\d+m", "")
 
 
   /* quote */
 
   def single_quote(s: String): String = "'" + s + "'"
 
   def quote(s: String): String = "\"" + s + "\""
 
   def try_unquote(s: String): Option[String] =
     if (s.startsWith("\"") && s.endsWith("\"")) Some(s.substring(1, s.length - 1))
     else None
 
   def perhaps_unquote(s: String): String = try_unquote(s) getOrElse s
 
   def commas(ss: Iterable[String]): String = ss.iterator.mkString(", ")
   def commas_quote(ss: Iterable[String]): String = ss.iterator.map(quote).mkString(", ")
 
 
   /* CharSequence */
 
   class Reverse(text: CharSequence, start: Int, end: Int) extends CharSequence
   {
     require(0 <= start && start <= end && end <= text.length, "bad reverse range")
 
     def this(text: CharSequence) = this(text, 0, text.length)
 
     def length: Int = end - start
     def charAt(i: Int): Char = text.charAt(end - i - 1)
 
     def subSequence(i: Int, j: Int): CharSequence =
       if (0 <= i && i <= j && j <= length) new Reverse(text, end - j, end - i)
       else throw new IndexOutOfBoundsException
 
     override def toString: String =
     {
       val buf = new StringBuilder(length)
       for (i <- 0 until length)
         buf.append(charAt(i))
       buf.toString
     }
   }
 
   class Line_Termination(text: CharSequence) extends CharSequence
   {
     def length: Int = text.length + 1
     def charAt(i: Int): Char = if (i == text.length) '\n' else text.charAt(i)
     def subSequence(i: Int, j: Int): CharSequence =
       if (j == text.length + 1) new Line_Termination(text.subSequence(i, j - 1))
       else text.subSequence(i, j)
     override def toString: String = text.toString + "\n"
   }
 
 
   /* regular expressions */
 
   def make_regex(s: String): Option[Regex] =
     try { Some(new Regex(s)) } catch { case ERROR(_) => None }
 
   def is_regex_meta(c: Char): Boolean = """()[]{}\^$|?*+.<>-=!""".contains(c)
 
   def escape_regex(s: String): String =
     if (s.exists(is_regex_meta)) {
       (for (c <- s.iterator)
        yield { if (is_regex_meta(c)) "\\" + c.toString else c.toString }).mkString
     }
     else s
 
 
   /* lists */
 
   def take_prefix[A](pred: A => Boolean, xs: List[A]): (List[A], List[A]) =
     (xs.takeWhile(pred), xs.dropWhile(pred))
 
   def take_suffix[A](pred: A => Boolean, xs: List[A]): (List[A], List[A]) =
   {
     val rev_xs = xs.reverse
     (rev_xs.dropWhile(pred).reverse, rev_xs.takeWhile(pred).reverse)
   }
 
   def trim[A](pred: A => Boolean, xs: List[A]): List[A] =
     take_suffix(pred, take_prefix(pred, xs)._2)._1
 
   def member[A, B](xs: List[A])(x: B): Boolean = xs.contains(x)
   def insert[A](x: A)(xs: List[A]): List[A] = if (xs.contains(x)) xs else x :: xs
   def remove[A, B](x: B)(xs: List[A]): List[A] = if (member(xs)(x)) xs.filterNot(_ == x) else xs
   def update[A](x: A)(xs: List[A]): List[A] = x :: remove(x)(xs)
 
   def merge[A](xs: List[A], ys: List[A]): List[A] =
     if (xs.eq(ys)) xs
     else if (xs.isEmpty) ys
     else ys.foldRight(xs)(Library.insert(_)(_))
 
   def distinct[A](xs: List[A], eq: (A, A) => Boolean = (x: A, y: A) => x == y): List[A] =
   {
     val result = new mutable.ListBuffer[A]
     xs.foreach(x => if (!result.exists(y => eq(x, y))) result += x)
     result.toList
   }
 
   def duplicates[A](lst: List[A], eq: (A, A) => Boolean = (x: A, y: A) => x == y): List[A] =
   {
     val result = new mutable.ListBuffer[A]
     @tailrec def dups(rest: List[A]): Unit =
       rest match {
         case Nil =>
         case x :: xs =>
           if (!result.exists(y => eq(x, y)) && xs.exists(y => eq(x, y))) result += x
           dups(xs)
       }
     dups(lst)
     result.toList
   }
 
   def replicate[A](n: Int, a: A): List[A] =
     if (n < 0) throw new IllegalArgumentException
     else if (n == 0) Nil
     else {
       val res = new mutable.ListBuffer[A]
       (1 to n).foreach(_ => res += a)
       res.toList
     }
 
   def the_single[A](xs: List[A]): A =
     xs match {
       case List(x) => x
       case _ => error("Single argument expected")
     }
 
 
   /* proper values */
 
   def proper_string(s: String): Option[String] =
     if (s == null || s == "") None else Some(s)
 
   def proper_list[A](list: List[A]): Option[List[A]] =
     if (list == null || list.isEmpty) None else Some(list)
 
 
   /* reflection */
 
   def is_subclass[A, B](a: Class[A], b: Class[B]): Boolean =
   {
     import scala.language.existentials
     @tailrec def subclass(c: Class[_]): Boolean =
     {
       c == b ||
         {
           val d = c.getSuperclass
           d != null && subclass(d)
         }
     }
     subclass(a)
   }
 }
diff --git a/src/Pure/pure_syn.ML b/src/Pure/pure_syn.ML
--- a/src/Pure/pure_syn.ML
+++ b/src/Pure/pure_syn.ML
@@ -1,85 +1,81 @@
 (*  Title:      Pure/pure_syn.ML
     Author:     Makarius
 
 Outer syntax for bootstrapping: commands that are accessible outside a
 regular theory context.
 *)
 
 signature PURE_SYN =
 sig
   val document_command: {markdown: bool} -> (xstring * Position.T) option * Input.source ->
     Toplevel.transition -> Toplevel.transition
   val bootstrap_thy: theory
 end;
 
 structure Pure_Syn: PURE_SYN =
 struct
 
 val semi = Scan.option (Parse.$$$ ";");
 
 fun output_document state markdown txt =
   let
     val ctxt = Toplevel.presentation_context state;
-    val pos = Input.pos_of txt;
-    val _ =
-      Context_Position.reports ctxt
-        [(pos, Markup.language_document (Input.is_delimited txt)),
-         (pos, Markup.plain_text)];
-  in Thy_Output.output_document ctxt markdown txt end;
+    val _ = Context_Position.reports ctxt (Document_Output.document_reports txt);
+  in Document_Output.output_document ctxt markdown txt end;
 
 fun document_command markdown (loc, txt) =
   Toplevel.keep (fn state =>
     (case loc of
       NONE => ignore (output_document state markdown txt)
     | SOME (_, pos) =>
         error ("Illegal target specification -- not a theory context" ^ Position.here pos))) o
   Toplevel.present_local_theory loc (fn state =>
     ignore (output_document state markdown txt));
 
 val _ =
   Outer_Syntax.command ("chapter", \<^here>) "chapter heading"
     (Parse.opt_target -- Parse.document_source --| semi >> document_command {markdown = false});
 
 val _ =
   Outer_Syntax.command ("section", \<^here>) "section heading"
     (Parse.opt_target -- Parse.document_source --| semi >> document_command {markdown = false});
 
 val _ =
   Outer_Syntax.command ("subsection", \<^here>) "subsection heading"
     (Parse.opt_target -- Parse.document_source --| semi >> document_command {markdown = false});
 
 val _ =
   Outer_Syntax.command ("subsubsection", \<^here>) "subsubsection heading"
     (Parse.opt_target -- Parse.document_source --| semi >> document_command {markdown = false});
 
 val _ =
   Outer_Syntax.command ("paragraph", \<^here>) "paragraph heading"
     (Parse.opt_target -- Parse.document_source --| semi >> document_command {markdown = false});
 
 val _ =
   Outer_Syntax.command ("subparagraph", \<^here>) "subparagraph heading"
     (Parse.opt_target -- Parse.document_source --| semi >> document_command {markdown = false});
 
 val _ =
   Outer_Syntax.command ("text", \<^here>) "formal comment (primary style)"
     (Parse.opt_target -- Parse.document_source >> document_command {markdown = true});
 
 val _ =
   Outer_Syntax.command ("txt", \<^here>) "formal comment (secondary style)"
     (Parse.opt_target -- Parse.document_source >> document_command {markdown = true});
 
 val _ =
   Outer_Syntax.command ("text_raw", \<^here>) "LaTeX text (without surrounding environment)"
     (Parse.opt_target -- Parse.document_source >> document_command {markdown = true});
 
 val _ =
   Outer_Syntax.command ("theory", \<^here>) "begin theory"
     (Thy_Header.args >>
       (fn _ => Toplevel.init_theory (fn () => error "Missing theory initialization")));
 
 
 val bootstrap_thy = Context.the_global_context ();
 
 val _ = Theory.setup (Config.put_global Outer_Syntax.bootstrap false);
 
 end;
diff --git a/src/Tools/Code/code_target.ML b/src/Tools/Code/code_target.ML
--- a/src/Tools/Code/code_target.ML
+++ b/src/Tools/Code/code_target.ML
@@ -1,797 +1,797 @@
 (*  Title:      Tools/Code/code_target.ML
     Author:     Florian Haftmann, TU Muenchen
 
 Generic infrastructure for target language data.
 *)
 
 signature CODE_TARGET =
 sig
   val cert_tyco: Proof.context -> string -> string
   val read_tyco: Proof.context -> string -> string
 
   datatype pretty_modules = Singleton of string * Pretty.T | Hierarchy of (string list * Pretty.T) list;
   val next_export: theory -> string * theory
 
   val export_code_for: ({physical: bool} * (Path.T * Position.T)) option -> string -> string
     -> int option -> Token.T list  -> Code_Thingol.program -> bool -> Code_Symbol.T list
     -> local_theory -> local_theory
   val produce_code_for: Proof.context -> string -> string -> int option -> Token.T list
     -> Code_Thingol.program -> bool -> Code_Symbol.T list -> (string list * string) list * string option list
   val present_code_for: Proof.context -> string -> string -> int option -> Token.T list
     -> Code_Thingol.program -> Code_Symbol.T list * Code_Symbol.T list -> string
   val check_code_for: string -> bool -> Token.T list
     -> Code_Thingol.program -> bool -> Code_Symbol.T list -> local_theory -> local_theory
 
   val export_code: bool -> string list
     -> (((string * string) * ({physical: bool} * (Path.T * Position.T)) option) * Token.T list) list
     -> local_theory -> local_theory
   val export_code_cmd: bool -> string list
     -> (((string * string) * ({physical: bool} * Input.source) option) * Token.T list) list
     -> local_theory -> local_theory
   val produce_code: Proof.context -> bool -> string list
     -> string -> string -> int option -> Token.T list -> (string list * string) list * string option list
   val present_code: Proof.context -> string list -> Code_Symbol.T list
     -> string -> string -> int option -> Token.T list -> string
   val check_code: bool -> string list -> ((string * bool) * Token.T list) list
     -> local_theory -> local_theory
 
   val codeN: string
   val generatedN: string
   val code_path: Path.T -> Path.T
   val code_export_message: theory -> unit
   val export: Path.binding -> string -> theory -> theory
   val compilation_text: Proof.context -> string -> Code_Thingol.program
     -> Code_Symbol.T list -> bool -> ((string * class list) list * Code_Thingol.itype) * Code_Thingol.iterm
     -> (string list * string) list * string
   val compilation_text': Proof.context -> string -> string option -> Code_Thingol.program
     -> Code_Symbol.T list -> bool -> ((string * class list) list * Code_Thingol.itype) * Code_Thingol.iterm
     -> ((string list * string) list * string) * (Code_Symbol.T -> string option)
 
   type serializer
   type literals = Code_Printer.literals
   type language
   type ancestry
   val assert_target: theory -> string -> string
   val add_language: string * language -> theory -> theory
   val add_derived_target: string * ancestry -> theory -> theory
   val the_literals: Proof.context -> string -> literals
   val parse_args: 'a parser -> Token.T list -> 'a
   val default_code_width: int Config.T
 
   type ('a, 'b, 'c, 'd, 'e, 'f) symbol_attr_decl
   val set_identifiers: (string, string, string, string, string, string) symbol_attr_decl
     -> theory -> theory
   val set_printings: (Code_Printer.raw_const_syntax, Code_Printer.tyco_syntax, string, unit, unit, string * Code_Symbol.T list) symbol_attr_decl
     -> theory -> theory
   val add_reserved: string -> string -> theory -> theory
 end;
 
 structure Code_Target : CODE_TARGET =
 struct
 
 open Basic_Code_Symbol;
 open Basic_Code_Thingol;
 
 type literals = Code_Printer.literals;
 type ('a, 'b, 'c, 'd, 'e, 'f) symbol_attr_decl =
   (string * (string * 'a option) list, string * (string * 'b option) list,
     class * (string * 'c option) list, (class * class) * (string * 'd option) list,
     (class * string) * (string * 'e option) list,
     string * (string * 'f option) list) Code_Symbol.attr;
 
 type tyco_syntax = Code_Printer.tyco_syntax;
 type raw_const_syntax = Code_Printer.raw_const_syntax;
 
 
 (** checking and parsing of symbols **)
 
 fun cert_const ctxt const =
   let
     val _ = if Sign.declared_const (Proof_Context.theory_of ctxt) const then ()
       else error ("No such constant: " ^ quote const);
   in const end;
 
 fun read_const ctxt = Code.read_const (Proof_Context.theory_of ctxt);
 
 fun cert_tyco ctxt tyco =
   let
     val _ = if Sign.declared_tyname (Proof_Context.theory_of ctxt) tyco then ()
       else error ("No such type constructor: " ^ quote tyco);
   in tyco end;
 
 fun read_tyco ctxt =
   #1 o dest_Type o Proof_Context.read_type_name {proper = true, strict = true} ctxt;
 
 fun cert_class ctxt class =
   let
     val _ = Axclass.get_info (Proof_Context.theory_of ctxt) class;
   in class end;
 
 val parse_classrel_ident = Parse.class --| \<^keyword>\<open><\<close> -- Parse.class;
 
 fun cert_inst ctxt (class, tyco) =
   (cert_class ctxt class, cert_tyco ctxt tyco);
 
 fun read_inst ctxt (raw_tyco, raw_class) =
   (read_tyco ctxt raw_tyco, Proof_Context.read_class ctxt raw_class);
 
 val parse_inst_ident = Parse.name --| \<^keyword>\<open>::\<close> -- Parse.class;
 
 fun cert_syms ctxt =
   Code_Symbol.map_attr (cert_const ctxt) (cert_tyco ctxt)
     (cert_class ctxt) (apply2 (cert_class ctxt)) (cert_inst ctxt) I;
 
 fun read_syms ctxt =
   Code_Symbol.map_attr (read_const ctxt) (read_tyco ctxt)
     (Proof_Context.read_class ctxt) (apply2 (Proof_Context.read_class ctxt)) (read_inst ctxt) I;
 
 fun cert_syms' ctxt =
   Code_Symbol.map_attr (apfst (cert_const ctxt)) (apfst (cert_tyco ctxt))
     (apfst (cert_class ctxt)) ((apfst o apply2) (cert_class ctxt)) (apfst (cert_inst ctxt)) I;
 
 fun read_syms' ctxt =
   Code_Symbol.map_attr (apfst (read_const ctxt)) (apfst (read_tyco ctxt))
     (apfst (Proof_Context.read_class ctxt)) ((apfst o apply2) (Proof_Context.read_class ctxt)) (apfst (read_inst ctxt)) I;
 
 fun check_name is_module s =
   let
     val _ = if s = "" then error "Bad empty code name" else ();
     val xs = Long_Name.explode s;
     val xs' = if is_module
         then map (Name.desymbolize NONE) xs
       else if length xs < 2
         then error ("Bad code name without module component: " ^ quote s)
       else
         let
           val (ys, y) = split_last xs;
           val ys' = map (Name.desymbolize NONE) ys;
           val y' = Name.desymbolize NONE y;
         in ys' @ [y'] end;
   in if xs' = xs
     then if is_module then (xs, "") else split_last xs
     else error ("Invalid code name: " ^ quote s ^ "\n"
       ^ "better try " ^ quote (Long_Name.implode xs'))
   end;
 
 
 (** theory data **)
 
 datatype pretty_modules = Singleton of string * Pretty.T | Hierarchy of (string list * Pretty.T) list;
 
 type serializer = Token.T list
   -> Proof.context
   -> {
     reserved_syms: string list,
     identifiers: Code_Printer.identifiers,
     includes: (string * Pretty.T) list,
     class_syntax: string -> string option,
     tyco_syntax: string -> Code_Printer.tyco_syntax option,
     const_syntax: string -> Code_Printer.const_syntax option,
     module_name: string }
   -> Code_Thingol.program
   -> Code_Symbol.T list
   -> pretty_modules * (Code_Symbol.T -> string option);
 
 type language = {serializer: serializer, literals: literals,
   check: {env_var: string, make_destination: Path.T -> Path.T, make_command: string -> string},
   evaluation_args: Token.T list};
 
 type ancestry = (string * (Code_Thingol.program -> Code_Thingol.program)) list;
 
 val merge_ancestry : ancestry * ancestry -> ancestry = AList.join (op =) (K snd);
 
 type target = {serial: serial, language: language, ancestry: ancestry};
 
 structure Targets = Theory_Data
 (
   type T = (target * Code_Printer.data) Symtab.table * int;
   val empty = (Symtab.empty, 0);
   val extend = I;
   fun merge ((targets1, index1), (targets2, index2)) : T =
     let
       val targets' =
         Symtab.join (fn target_name => fn ((target1, data1), (target2, data2)) =>
           if #serial target1 = #serial target2 then
           ({serial = #serial target1, language = #language target1,
             ancestry = merge_ancestry (#ancestry target1, #ancestry target2)},
             Code_Printer.merge_data (data1, data2))
           else error ("Incompatible targets: " ^ quote target_name)) (targets1, targets2)
       val index' = Int.max (index1, index2);
     in (targets', index') end;
 );
 
 val exists_target = Symtab.defined o #1 o Targets.get;
 val lookup_target_data = Symtab.lookup o #1 o Targets.get;
 fun assert_target thy target_name =
   if exists_target thy target_name
   then target_name
   else error ("Unknown code target language: " ^ quote target_name);
 
 fun reset_index thy =
   if #2 (Targets.get thy) = 0 then NONE
   else SOME ((Targets.map o apsnd) (K 0) thy);
 
 val _ = Theory.setup (Theory.at_begin reset_index);
 
 fun next_export thy =
   let
     val thy' = (Targets.map o apsnd) (fn i => i + 1) thy;
     val i = #2 (Targets.get thy');
   in ("export" ^ string_of_int i, thy') end;
 
 fun fold1 f xs = fold f (tl xs) (hd xs);
 
 fun join_ancestry thy target_name =
   let
     val _ = assert_target thy target_name;
     val the_target_data = the o lookup_target_data thy;
     val (target, this_data) = the_target_data target_name;
     val ancestry = #ancestry target;
     val modifies = rev (map snd ancestry);
     val modify = fold (curry (op o)) modifies I;
     val datas = rev (map (snd o the_target_data o fst) ancestry) @ [this_data];
     val data = fold1 (fn data' => fn data => Code_Printer.merge_data (data, data')) datas;
   in (modify, (target, data)) end;
 
 fun allocate_target target_name target thy =
   let
     val _ = if exists_target thy target_name
       then error ("Attempt to overwrite existing target " ^ quote target_name)
       else ();
   in
     thy
     |> (Targets.map o apfst o Symtab.update) (target_name, (target, Code_Printer.empty_data))
   end;
 
 fun add_language (target_name, language) =
   allocate_target target_name {serial = serial (), language = language,
     ancestry = []};
 
 fun add_derived_target (target_name, initial_ancestry) thy =
   let
     val _ = if null initial_ancestry
       then error "Must derive from existing target(s)" else ();
     fun the_target_data target_name' = case lookup_target_data thy target_name' of
       NONE => error ("Unknown code target language: " ^ quote target_name')
     | SOME target_data' => target_data';
     val targets = rev (map (fst o the_target_data o fst) initial_ancestry);
     val supremum = fold1 (fn target' => fn target =>
       if #serial target = #serial target'
       then target else error "Incompatible targets") targets;
     val ancestries = map #ancestry targets @ [initial_ancestry];
     val ancestry = fold1 (fn ancestry' => fn ancestry =>
       merge_ancestry (ancestry, ancestry')) ancestries;
   in
     allocate_target target_name {serial = #serial supremum, language = #language supremum,
       ancestry = ancestry} thy
   end;
 
 fun map_data target_name f thy =
   let
     val _ = assert_target thy target_name;
   in
     thy
     |> (Targets.map o apfst o Symtab.map_entry target_name o apsnd o Code_Printer.map_data) f
   end;
 
 fun map_reserved target_name = map_data target_name o @{apply 3(1)};
 fun map_identifiers target_name = map_data target_name o @{apply 3(2)};
 fun map_printings target_name = map_data target_name o @{apply 3(3)};
 
 
 (** serializers **)
 
 val codeN = "code";
 val generatedN = "Generated_Code";
 
 val code_path = Path.append (Path.basic codeN);
 fun code_export_message thy = writeln (Export.message thy (Path.basic codeN));
 
 fun export binding content thy =
   let
     val thy' = thy |> Generated_Files.add_files (binding, content);
     val _ = Export.export thy' binding [XML.Text content];
   in thy' end;
 
 local
 
 fun export_logical (file_prefix, file_pos) format pretty_modules =
   let
     fun binding path = Path.binding (path, file_pos);
     val prefix = code_path file_prefix;
   in
     (case pretty_modules of
       Singleton (ext, p) => export (binding (Path.ext ext prefix)) (format p)
     | Hierarchy modules =>
         fold (fn (names, p) =>
           export (binding (prefix + Path.make names)) (format p)) modules)
     #> tap code_export_message
   end;
 
 fun export_physical root format pretty_modules =
   (case pretty_modules of
     Singleton (_, p) => File.write root (format p)
   | Hierarchy code_modules =>
       (Isabelle_System.make_directory root;
         List.app (fn (names, p) =>
           File.write (Path.appends (root :: map Path.basic names)) (format p)) code_modules));
 
 in
 
 fun export_result some_file format (pretty_code, _) thy =
   (case some_file of
     NONE =>
       let val (file_prefix, thy') = next_export thy;
       in export_logical (Path.basic file_prefix, Position.none) format pretty_code thy' end
   | SOME ({physical = false}, file_prefix) =>
       export_logical file_prefix format pretty_code thy
   | SOME ({physical = true}, (file, _)) =>
       let
         val root = File.full_path (Resources.master_directory thy) file;
         val _ = File.check_dir (Path.dir root);
         val _ = export_physical root format pretty_code;
       in thy end);
 
 fun produce_result syms width pretty_modules =
   let val format = Code_Printer.format [] width in
     (case pretty_modules of
       (Singleton (_, p), deresolve) => ([([], format p)], map deresolve syms)
     | (Hierarchy code_modules, deresolve) =>
         ((map o apsnd) format code_modules, map deresolve syms))
   end;
 
 fun present_result selects width (pretty_modules, _) =
   let val format = Code_Printer.format selects width in
     (case pretty_modules of
       Singleton (_, p) => format p
     | Hierarchy code_modules => space_implode "\n\n" (map (format o #2) code_modules))
   end;
 
 end;
 
 
 (** serializer usage **)
 
 (* technical aside: pretty printing width *)
 
 val default_code_width = Attrib.setup_config_int \<^binding>\<open>default_code_width\<close> (K 80);
 
 fun default_width ctxt = Config.get ctxt default_code_width;
 
 val the_width = the_default o default_width;
 
 
 (* montage *)
 
 fun the_language ctxt =
   #language o fst o the o lookup_target_data (Proof_Context.theory_of ctxt);
 
 fun the_literals ctxt = #literals o the_language ctxt;
 
 fun the_evaluation_args ctxt = #evaluation_args o the_language ctxt;
 
 local
 
 fun activate_target ctxt target_name =
   let
     val thy = Proof_Context.theory_of ctxt;
     val (modify, (target, data)) = join_ancestry thy target_name;
     val serializer = (#serializer o #language) target;
   in { serializer = serializer, data = data, modify = modify } end;
 
 fun project_program_for_syms ctxt syms_hidden syms1 program1 =
   let
     val syms2 = subtract (op =) syms_hidden syms1;
     val program2 = Code_Symbol.Graph.restrict (not o member (op =) syms_hidden) program1;
     val unimplemented = Code_Thingol.unimplemented program2;
     val _ =
       if null unimplemented then ()
       else error ("No code equations for " ^
         commas (map (Proof_Context.markup_const ctxt) unimplemented));
     val syms3 = Code_Symbol.Graph.all_succs program2 syms2;
     val program3 = Code_Symbol.Graph.restrict (member (op =) syms3) program2;
   in program3 end;
 
 fun project_includes_for_syms syms includes =
    let
      fun select_include (name, (content, cs)) =
        if null cs orelse exists (member (op =) syms) cs
        then SOME (name, content) else NONE;
   in map_filter select_include includes end;
 
 fun prepare_serializer ctxt target_name module_name args proto_program syms =
   let
     val { serializer, data, modify } = activate_target ctxt target_name;
     val printings = Code_Printer.the_printings data;
     val _ = if module_name = "" then () else (check_name true module_name; ())
     val hidden_syms = Code_Symbol.symbols_of printings;
     val prepared_program = project_program_for_syms ctxt hidden_syms syms proto_program;
     val prepared_syms = subtract (op =) hidden_syms syms;
     val all_syms = Code_Symbol.Graph.all_succs proto_program syms;
     val includes = project_includes_for_syms all_syms
       (Code_Symbol.dest_module_data printings);
     val prepared_serializer = serializer args ctxt {
       reserved_syms = Code_Printer.the_reserved data,
       identifiers = Code_Printer.the_identifiers data,
       includes = includes,
       const_syntax = Code_Symbol.lookup_constant_data printings,
       tyco_syntax = Code_Symbol.lookup_type_constructor_data printings,
       class_syntax = Code_Symbol.lookup_type_class_data printings,
       module_name = module_name };
   in
     (prepared_serializer o modify, (prepared_program, prepared_syms))
   end;
 
 fun invoke_serializer ctxt target_name module_name args program all_public syms =
   let
     val (prepared_serializer, (prepared_program, prepared_syms)) =
       prepare_serializer ctxt target_name module_name args program syms;
     val exports = if all_public then [] else prepared_syms;
   in
     Code_Preproc.timed_exec "serializing"
       (fn () => prepared_serializer prepared_program exports) ctxt
   end;
 
 fun assert_module_name "" = error "Empty module name not allowed here"
   | assert_module_name module_name = module_name;
 
 in
 
 fun export_code_for some_file target_name module_name some_width args program all_public cs lthy =
   let
     val format = Code_Printer.format [] (the_width lthy some_width);
     val res = invoke_serializer lthy target_name module_name args program all_public cs;
   in Local_Theory.background_theory (export_result some_file format res) lthy end;
 
 fun produce_code_for ctxt target_name module_name some_width args =
   let
     val serializer = invoke_serializer ctxt target_name (assert_module_name module_name) args;
   in fn program => fn all_public => fn syms =>
     produce_result syms (the_width ctxt some_width)
       (serializer program all_public syms)
   end;
 
 fun present_code_for ctxt target_name module_name some_width args =
   let
     val serializer = invoke_serializer ctxt target_name (assert_module_name module_name) args;
   in fn program => fn (syms, selects) =>
     present_result selects (the_width ctxt some_width) (serializer program false syms)
   end;
 
 fun check_code_for target_name strict args program all_public syms lthy =
   let
     val { env_var, make_destination, make_command } = #check (the_language lthy target_name);
     val format = Code_Printer.format [] 80;
     fun ext_check p =
       let
         val destination = make_destination p;
         val lthy' = lthy
           |> Local_Theory.background_theory
             (export_result (SOME ({physical = true}, (destination, Position.none))) format
               (invoke_serializer lthy target_name generatedN args program all_public syms));
         val cmd = make_command generatedN;
         val context_cmd = "cd " ^ File.bash_path p ^ " && " ^ cmd ^ " 2>&1";
       in
         if Isabelle_System.bash context_cmd <> 0
         then error ("Code check failed for " ^ target_name ^ ": " ^ cmd)
         else lthy'
       end;
   in
     if not (env_var = "") andalso getenv env_var = "" then
       if strict
       then error (env_var ^ " not set; cannot check code for " ^ target_name)
       else (warning (env_var ^ " not set; skipped checking code for " ^ target_name); lthy)
     else Isabelle_System.with_tmp_dir "Code_Test" ext_check
   end;
 
 fun dynamic_compilation_text prepared_serializer width prepared_program syms all_public ((vs, ty), t) =
   let
     val _ = if Code_Thingol.contains_dict_var t then
       error "Term to be evaluated contains free dictionaries" else ();
     val v' = singleton (Name.variant_list (map fst vs)) "a";
     val vs' = (v', []) :: vs;
     val ty' = ITyVar v' `-> ty;
     val program = prepared_program
       |> Code_Symbol.Graph.new_node (Code_Symbol.value,
           Code_Thingol.Fun (((vs', ty'), [(([IVar (SOME "dummy")], t), (NONE, true))]), NONE))
       |> fold (curry (perhaps o try o
           Code_Symbol.Graph.add_edge) Code_Symbol.value) syms;
     val (pretty_code, deresolve) =
       prepared_serializer program (if all_public then [] else [Code_Symbol.value]);
     val (compilation_code, [SOME value_name]) =
       produce_result [Code_Symbol.value] width (pretty_code, deresolve);
   in ((compilation_code, value_name), deresolve) end;
 
 fun compilation_text' ctxt target_name some_module_name program syms =
   let
     val width = default_width ctxt;
     val evaluation_args = the_evaluation_args ctxt target_name;
     val (prepared_serializer, (prepared_program, _)) =
       prepare_serializer ctxt target_name (the_default generatedN some_module_name) evaluation_args program syms;
   in
     Code_Preproc.timed_exec "serializing"
       (fn () => dynamic_compilation_text prepared_serializer width prepared_program syms) ctxt
   end;
 
 fun compilation_text ctxt target_name program syms =
   fst oo compilation_text' ctxt target_name NONE program syms
 
 end; (* local *)
 
 
 (* code generation *)
 
 fun prep_destination (location, source) =
   let
     val s = Input.string_of source
     val pos = Input.pos_of source
     val delimited = Input.is_delimited source
   in
     if location = {physical = false}
     then (location, Path.explode_pos (s, pos))
     else
       let
         val _ =
           if s = ""
           then error ("Bad bad empty " ^ Markup.markup Markup.keyword2 "file" ^ " argument")
           else ();
         val _ =
           legacy_feature
             (Markup.markup Markup.keyword1 "export_code" ^ " with " ^
               Markup.markup Markup.keyword2 "file" ^ " argument" ^ Position.here pos);
         val _ = Position.report pos (Markup.language_path delimited);
         val path = #1 (Path.explode_pos (s, pos));
         val _ = Position.report pos (Markup.path (Path.implode_symbolic path));
       in (location, (path, pos)) end
   end;
 
 fun export_code all_public cs seris lthy =
   let
     val program = Code_Thingol.consts_program lthy cs;
   in
     (seris, lthy) |-> fold (fn (((target_name, module_name), some_file), args) =>
       export_code_for some_file target_name module_name NONE args
         program all_public (map Constant cs))
   end;
 
 fun export_code_cmd all_public raw_cs seris lthy =
   let
     val cs = Code_Thingol.read_const_exprs lthy raw_cs;
   in export_code all_public cs ((map o apfst o apsnd o Option.map) prep_destination seris) lthy end;
 
 fun produce_code ctxt all_public cs target_name some_width some_module_name args =
   let
     val program = Code_Thingol.consts_program ctxt cs;
   in produce_code_for ctxt target_name some_width some_module_name args program all_public (map Constant cs) end;
 
 fun present_code ctxt cs syms target_name some_width some_module_name args =
   let
     val program = Code_Thingol.consts_program ctxt cs;
   in present_code_for ctxt target_name some_width some_module_name args program (map Constant cs, syms) end;
 
 fun check_code all_public cs seris lthy =
   let
     val program = Code_Thingol.consts_program lthy cs;
   in
     (seris, lthy) |-> fold (fn ((target_name, strict), args) =>
       check_code_for target_name strict args program all_public (map Constant cs))
   end;
 
 fun check_code_cmd all_public raw_cs seris lthy =
   check_code all_public (Code_Thingol.read_const_exprs lthy raw_cs) seris lthy;
 
 
 (** serializer configuration **)
 
 (* reserved symbol names *)
 
 fun add_reserved target_name sym thy =
   let
     val (_, (_, data)) = join_ancestry thy target_name;
     val _ = if member (op =) (Code_Printer.the_reserved data) sym
       then error ("Reserved symbol " ^ quote sym ^ " already declared")
       else ();
   in
     thy
     |> map_reserved target_name (insert (op =) sym)
   end;
 
 
 (* checking of syntax *)
 
 fun check_const_syntax ctxt target_name c syn =
   if Code_Printer.requires_args syn > Code.args_number (Proof_Context.theory_of ctxt) c
   then error ("Too many arguments in syntax for constant " ^ quote c)
   else Code_Printer.prep_const_syntax (Proof_Context.theory_of ctxt) (the_literals ctxt target_name) c syn;
 
 fun check_tyco_syntax ctxt target_name tyco syn =
   if fst syn <> Sign.arity_number (Proof_Context.theory_of ctxt) tyco
   then error ("Number of arguments mismatch in syntax for type constructor " ^ quote tyco)
   else syn;
 
 
 (* custom symbol names *)
 
 fun arrange_name_decls x =
   let
     fun arrange is_module (sym, target_names) = map (fn (target, some_name) =>
       (target, (sym, Option.map (check_name is_module) some_name))) target_names;
   in
     Code_Symbol.maps_attr' (arrange false) (arrange false) (arrange false)
       (arrange false) (arrange false) (arrange true) x
   end;
 
 fun cert_name_decls ctxt = cert_syms' ctxt #> arrange_name_decls;
 
 fun read_name_decls ctxt = read_syms' ctxt #> arrange_name_decls;
 
 fun set_identifier (target_name, sym_name) = map_identifiers target_name (Code_Symbol.set_data sym_name);
 
 fun gen_set_identifiers prep_name_decl raw_name_decls thy =
   fold set_identifier (prep_name_decl (Proof_Context.init_global thy) raw_name_decls) thy;
 
 val set_identifiers = gen_set_identifiers cert_name_decls;
 val set_identifiers_cmd = gen_set_identifiers read_name_decls;
 
 
 (* custom printings *)
 
 fun arrange_printings prep_syms ctxt =
   let
     fun arrange check (sym, target_syns) =
       map (fn (target_name, some_syn) =>
         (target_name, (sym, Option.map (check ctxt target_name sym) some_syn))) target_syns;
   in
     Code_Symbol.maps_attr'
       (arrange check_const_syntax) (arrange check_tyco_syntax)
         (arrange ((K o K o K) I)) (arrange ((K o K o K) I)) (arrange ((K o K o K) I))
         (arrange (fn ctxt => fn _ => fn _ => fn (raw_content, raw_syms) =>
           (Pretty.blk (0, Pretty.fbreaks (map Code_Printer.str (split_lines raw_content))),
             map (prep_syms ctxt) raw_syms)))
   end;
 
 fun cert_printings ctxt = cert_syms' ctxt #> arrange_printings cert_syms ctxt;
 
 fun read_printings ctxt = read_syms' ctxt #> arrange_printings read_syms ctxt;
 
 fun set_printing (target_name, sym_syn) = map_printings target_name (Code_Symbol.set_data sym_syn);
 
 fun gen_set_printings prep_print_decl raw_print_decls thy =
   fold set_printing (prep_print_decl (Proof_Context.init_global thy) raw_print_decls) thy;
 
 val set_printings = gen_set_printings cert_printings;
 val set_printings_cmd = gen_set_printings read_printings;
 
 
 (* concrete syntax *)
 
 fun parse_args f args =
   case Scan.read Token.stopper f args
    of SOME x => x
     | NONE => error "Bad serializer arguments";
 
 
 (** Isar setup **)
 
 val (constantK, type_constructorK, type_classK, class_relationK, class_instanceK, code_moduleK) =
   (\<^keyword>\<open>constant\<close>, \<^keyword>\<open>type_constructor\<close>, \<^keyword>\<open>type_class\<close>,
     \<^keyword>\<open>class_relation\<close>, \<^keyword>\<open>class_instance\<close>, \<^keyword>\<open>code_module\<close>);
 
 local
 
 val parse_constants = constantK |-- Scan.repeat1 Parse.term >> map Constant;
 
 val parse_type_constructors = type_constructorK |-- Scan.repeat1 Parse.type_const >> map Type_Constructor;
 
 val parse_classes = type_classK |-- Scan.repeat1 Parse.class >> map Type_Class;
 
 val parse_class_relations = class_relationK |-- Scan.repeat1 parse_classrel_ident >> map Class_Relation;
 
 val parse_instances = class_instanceK |-- Scan.repeat1 parse_inst_ident >> map Class_Instance;
 
 val parse_simple_symbols = Scan.repeats1 (parse_constants || parse_type_constructors || parse_classes
   || parse_class_relations || parse_instances);
 
 fun parse_single_symbol_pragma parse_keyword parse_isa parse_target =
   parse_keyword |-- Parse.!!! (parse_isa --| (\<^keyword>\<open>\<rightharpoonup>\<close> || \<^keyword>\<open>=>\<close>)
     -- Parse.and_list1 (\<^keyword>\<open>(\<close> |-- (Parse.name --| \<^keyword>\<open>)\<close> -- Scan.option parse_target)));
 
 fun parse_symbol_pragma parse_const parse_tyco parse_class parse_classrel parse_inst parse_module =
   parse_single_symbol_pragma constantK Parse.term parse_const
     >> Constant
   || parse_single_symbol_pragma type_constructorK Parse.type_const parse_tyco
     >> Type_Constructor
   || parse_single_symbol_pragma type_classK Parse.class parse_class
     >> Type_Class
   || parse_single_symbol_pragma class_relationK parse_classrel_ident parse_classrel
     >> Class_Relation
   || parse_single_symbol_pragma class_instanceK parse_inst_ident parse_inst
     >> Class_Instance
   || parse_single_symbol_pragma code_moduleK Parse.name parse_module
     >> Module;
 
 fun parse_symbol_pragmas parse_const parse_tyco parse_class parse_classrel parse_inst parse_module =
   Parse.enum1 "|" (Parse.group (fn () => "code symbol pragma")
     (parse_symbol_pragma parse_const parse_tyco parse_class parse_classrel parse_inst parse_module));
 
 val code_expr_argsP = Scan.optional (\<^keyword>\<open>(\<close> |-- Parse.args --| \<^keyword>\<open>)\<close>) [];
 
 fun code_expr_inP (all_public, raw_cs) =
   Scan.repeat (\<^keyword>\<open>in\<close> |-- Parse.!!! (Parse.name
     -- Scan.optional (\<^keyword>\<open>module_name\<close> |-- Parse.name) ""
     -- Scan.option
         ((\<^keyword>\<open>file_prefix\<close> >> K {physical = false} || \<^keyword>\<open>file\<close> >> K {physical = true})
           -- Parse.!!! Parse.path_input)
     -- code_expr_argsP))
       >> (fn seri_args => export_code_cmd all_public raw_cs seri_args);
 
 fun code_expr_checkingP (all_public, raw_cs) =
   (\<^keyword>\<open>checking\<close> |-- Parse.!!!
     (Scan.repeat (Parse.name -- (Scan.optional (\<^keyword>\<open>?\<close> >> K false) true) -- code_expr_argsP)))
       >> (fn seri_args => check_code_cmd all_public raw_cs seri_args);
 
 in
 
 val _ =
   Outer_Syntax.command \<^command_keyword>\<open>code_reserved\<close>
     "declare words as reserved for target language"
     (Parse.name -- Scan.repeat1 Parse.name
       >> (fn (target, reserveds) => (Toplevel.theory o fold (add_reserved target)) reserveds));
 
 val _ =
   Outer_Syntax.command \<^command_keyword>\<open>code_identifier\<close> "declare mandatory names for code symbols"
     (parse_symbol_pragmas Parse.name Parse.name Parse.name Parse.name Parse.name Parse.name
       >> (Toplevel.theory o fold set_identifiers_cmd));
 
 val _ =
   Outer_Syntax.command \<^command_keyword>\<open>code_printing\<close> "declare dedicated printing for code symbols"
     (parse_symbol_pragmas (Code_Printer.parse_const_syntax) (Code_Printer.parse_tyco_syntax)
       Parse.string (Parse.minus >> K ()) (Parse.minus >> K ())
       (Parse.text -- Scan.optional (\<^keyword>\<open>for\<close> |-- parse_simple_symbols) [])
       >> (Toplevel.theory o fold set_printings_cmd));
 
 val _ =
   Outer_Syntax.local_theory \<^command_keyword>\<open>export_code\<close> "generate executable code for constants"
     (Scan.optional (\<^keyword>\<open>open\<close> >> K true) false -- Scan.repeat1 Parse.term
       :|-- (fn args => (code_expr_checkingP args || code_expr_inP args)));
 
 end;
 
 local
 
 val parse_const_terms = Args.theory -- Scan.repeat1 Args.term
   >> uncurry (fn thy => map (Code.check_const thy));
 
 fun parse_symbols keyword parse internalize mark_symbol =
   Scan.lift (keyword --| Args.colon) |-- Args.theory -- Scan.repeat1 parse
   >> uncurry (fn thy => map (mark_symbol o internalize thy));
 
 val parse_consts = parse_symbols constantK Args.term
   Code.check_const Constant;
 
 val parse_types = parse_symbols type_constructorK (Scan.lift Args.name)
   Sign.intern_type Type_Constructor;
 
 val parse_classes = parse_symbols type_classK (Scan.lift Args.name)
   Sign.intern_class Type_Class;
 
 val parse_instances = parse_symbols class_instanceK (Scan.lift (Args.name --| Args.$$$ "::" -- Args.name))
   (fn thy => fn (raw_tyco, raw_class) =>
     (Sign.intern_class thy raw_tyco, Sign.intern_type thy raw_class)) Class_Instance;
 
 in
 
 val _ = Theory.setup
-  (Thy_Output.antiquotation_raw \<^binding>\<open>code_stmts\<close>
+  (Document_Output.antiquotation_raw \<^binding>\<open>code_stmts\<close>
     (parse_const_terms --
       Scan.repeats (parse_consts || parse_types || parse_classes || parse_instances)
       -- Scan.lift (Args.parens (Args.name -- Scan.option Parse.int)))
     (fn ctxt => fn ((consts, symbols), (target_name, some_width)) =>
        present_code ctxt consts symbols
          target_name "Example" some_width []
        |> trim_line
-       |> Thy_Output.verbatim (Config.put Document_Antiquotation.thy_output_display true ctxt)));
+       |> Document_Output.verbatim (Config.put Document_Antiquotation.thy_output_display true ctxt)));
 
 end;
 
 end; (*struct*)
diff --git a/src/Tools/jEdit/src/keymap_merge.scala b/src/Tools/jEdit/src/keymap_merge.scala
--- a/src/Tools/jEdit/src/keymap_merge.scala
+++ b/src/Tools/jEdit/src/keymap_merge.scala
@@ -1,259 +1,259 @@
 /*  Title:      Tools/jEdit/src/keymap_merge.scala
     Author:     Makarius
 
 Merge of Isabelle shortcuts vs. jEdit keymap.
 */
 
 package isabelle.jedit
 
 
 import isabelle._
 
 import java.awt.{Color, Dimension, BorderLayout}
 import javax.swing.{JPanel, JTable, JScrollPane, JOptionPane}
 import javax.swing.table.AbstractTableModel
 
 import scala.jdk.CollectionConverters._
 
 import org.gjt.sp.jedit.{jEdit, View}
 import org.gjt.sp.util.GenericGUIUtilities
 import org.jedit.keymap.{KeymapManager, Keymap}
 
 
 object Keymap_Merge
 {
   /** shortcuts **/
 
   private def is_shortcut(property: String): Boolean =
     (property.endsWith(".shortcut") || property.endsWith(".shortcut2")) &&
     !property.startsWith("options.shortcuts.")
 
   class Shortcut(val property: String, val binding: String)
   {
-    override def toString: String = property + "=" + binding
+    override def toString: String = Properties.Eq(property, binding)
 
     def primary: Boolean = property.endsWith(".shortcut")
 
     val action: String =
       Library.try_unsuffix(".shortcut", property) orElse
       Library.try_unsuffix(".shortcut2", property) getOrElse
       error("Bad shortcut property: " + quote(property))
 
     val label: String =
       GenericGUIUtilities.prettifyMenuLabel(jEdit.getProperty(action + ".label", ""))
 
 
     /* ignore wrt. keymap */
 
     private def prop_ignore: String = property + ".ignore"
 
     def ignored_keymaps(): List[String] =
       space_explode(',', jEdit.getProperty(prop_ignore, ""))
 
     def is_ignored(keymap_name: String): Boolean =
       ignored_keymaps().contains(keymap_name)
 
     def ignore(keymap_name: String): Unit =
       jEdit.setProperty(prop_ignore,
         Library.insert(keymap_name)(ignored_keymaps()).sorted.mkString(","))
 
     def set(keymap: Keymap): Unit = keymap.setShortcut(property, binding)
     def reset(keymap: Keymap): Unit = keymap.setShortcut(property, null)
   }
 
 
   /* content wrt. keymap */
 
   def convert_properties(props: java.util.Properties): List[Shortcut] =
     if (props == null) Nil
     else {
       var result = List.empty[Shortcut]
       for (entry <- props.asScala) {
         entry match {
           case (a: String, b: String) if is_shortcut(a) =>
             result ::= new Shortcut(a, b)
           case _ =>
         }
       }
       result.sortBy(_.property)
     }
 
   def get_shortcut_conflicts(keymap_name: String, keymap: Keymap): List[(Shortcut, List[Shortcut])] =
   {
     val keymap_shortcuts =
       if (keymap == null) Nil
       else convert_properties(Untyped.get[java.util.Properties](keymap, "props"))
 
     for (s <- convert_properties(jEdit.getProperties) if !s.is_ignored(keymap_name)) yield {
       val conflicts =
         keymap_shortcuts.filter(s1 =>
           s.property == s1.property && s.binding != s1.binding ||
           s.property != s1.property && s.binding == s1.binding && s1.binding != "")
       (s, conflicts)
     }
   }
 
 
 
   /** table **/
 
   private def conflict_color: Color =
     PIDE.options.color_value("error_color")
 
   private sealed case class Table_Entry(shortcut: Shortcut, head: Option[Int], tail: List[Int])
   {
     override def toString: String =
       if (head.isEmpty) "<html>" + HTML.output(shortcut.toString) + "</html>"
       else
         "<html><font style='color: #" + Color_Value.print(conflict_color) + ";'>" +
           HTML.output("--- " + shortcut.toString) +
         "</font></html>"
   }
 
   private class Table_Model(entries: List[Table_Entry]) extends AbstractTableModel
   {
     private val entries_count = entries.length
     private def has_entry(row: Int): Boolean = 0 <= row && row <= entries_count
     private def get_entry(row: Int): Option[Table_Entry] =
       if (has_entry(row)) Some(entries(row)) else None
 
     private val selected =
       Synchronized[Set[Int]](
         (for ((e, i) <- entries.iterator.zipWithIndex if e.head.isEmpty) yield i).toSet)
 
     private def is_selected(row: Int): Boolean =
       selected.value.contains(row)
 
     private def select(head: Int, tail: List[Int], b: Boolean): Unit =
       selected.change(set => if (b) set + head -- tail else set - head ++ tail)
 
     def apply(keymap_name: String, keymap: Keymap): Unit =
     {
       GUI_Thread.require {}
 
       for ((entry, row) <- entries.iterator.zipWithIndex if entry.head.isEmpty) {
         val b = is_selected(row)
         if (b) {
           entry.tail.foreach(i => entries(i).shortcut.reset(keymap))
           entry.shortcut.set(keymap)
         }
         else
           entry.shortcut.ignore(keymap_name)
       }
     }
 
     override def getColumnCount: Int = 2
 
     override def getColumnClass(i: Int): Class[_ <: Object] =
       if (i == 0) classOf[java.lang.Boolean] else classOf[Object]
 
     override def getColumnName(i: Int): String =
       if (i == 0) " " else if (i == 1) "Keyboard shortcut" else "???"
 
     override def getRowCount: Int = entries_count
 
     override def getValueAt(row: Int, column: Int): AnyRef =
     {
       get_entry(row) match {
         case Some(entry) if column == 0 => java.lang.Boolean.valueOf(is_selected(row))
         case Some(entry) if column == 1 => entry
         case _ => null
       }
     }
 
     override def isCellEditable(row: Int, column: Int): Boolean =
       has_entry(row) && column == 0
 
     override def setValueAt(value: AnyRef, row: Int, column: Int): Unit =
     {
       value match {
         case obj: java.lang.Boolean if has_entry(row) && column == 0 =>
           val b = obj.booleanValue
           val entry = entries(row)
           entry.head match {
             case None => select(row, entry.tail, b)
             case Some(head_row) =>
               val head_entry = entries(head_row)
               select(head_row, head_entry.tail, !b)
           }
           GUI_Thread.later { fireTableDataChanged() }
         case _ =>
       }
     }
   }
 
   private class Table(table_model: Table_Model) extends JPanel(new BorderLayout)
   {
     private val cell_size = GenericGUIUtilities.defaultTableCellSize()
     private val table_size = new Dimension(cell_size.width * 2, cell_size.height * 15)
 
     val table = new JTable(table_model)
     table.setShowGrid(false)
     table.setIntercellSpacing(new Dimension(0, 0))
     table.setRowHeight(cell_size.height + 2)
     table.setPreferredScrollableViewportSize(table_size)
     table.setFillsViewportHeight(true)
     table.getTableHeader.setReorderingAllowed(false)
 
 		table.getColumnModel.getColumn(0).setPreferredWidth(30)
 		table.getColumnModel.getColumn(0).setMinWidth(30)
 		table.getColumnModel.getColumn(0).setMaxWidth(30)
 		table.getColumnModel.getColumn(0).setResizable(false)
 		table.getColumnModel.getColumn(1).setPreferredWidth(table_size.width - 30)
 
     val scroller = new JScrollPane(table)
 		scroller.getViewport.setBackground(table.getBackground)
 		scroller.setPreferredSize(table_size)
 
     add(scroller, BorderLayout.CENTER)
   }
 
 
 
   /** check with optional dialog **/
 
   def check_dialog(view: View): Unit =
   {
     GUI_Thread.require {}
 
     val keymap_manager = jEdit.getKeymapManager
     val keymap_name = jEdit.getProperty("keymap.current", KeymapManager.DEFAULT_KEYMAP_NAME)
     val keymap =
       keymap_manager.getKeymap(keymap_name) match {
         case null => keymap_manager.getKeymap(KeymapManager.DEFAULT_KEYMAP_NAME)
         case keymap => keymap
       }
 
     val all_shortcut_conflicts = get_shortcut_conflicts(keymap_name, keymap)
     val no_shortcut_conflicts = for ((s, cs) <- all_shortcut_conflicts if cs.isEmpty) yield s
     val shortcut_conflicts = all_shortcut_conflicts.filter(_._2.nonEmpty)
 
     val table_entries =
       for {
         ((shortcut, conflicts), i) <- shortcut_conflicts zip
           shortcut_conflicts.scanLeft(0)({ case (i, (_, cs)) => i + 1 + cs.length })
         entry <-
           Table_Entry(shortcut, None, ((i + 1) to (i + conflicts.length)).toList) ::
           conflicts.map(Table_Entry(_, Some(i), Nil))
       } yield entry
 
     val table_model = new Table_Model(table_entries)
 
     if (table_entries.nonEmpty &&
         GUI.confirm_dialog(view,
           "Pending Isabelle/jEdit keymap changes",
           JOptionPane.OK_CANCEL_OPTION,
           "The following Isabelle keymap changes are in conflict with the current",
           "jEdit keymap " + quote(keymap_name) + ":",
           new Table(table_model),
           "Selected shortcuts will be applied, unselected changes will be ignored.",
           "Results are stored in $JEDIT_SETTINGS/properties and $JEDIT_SETTINGS/keymaps/.") == 0)
     { table_model.apply(keymap_name, keymap) }
 
     no_shortcut_conflicts.foreach(_.set(keymap))
 
     keymap.save()
     jEdit.saveSettings()
     jEdit.propertiesChanged()
   }
 }