diff --git a/src/HOL/Analysis/Change_Of_Vars.thy b/src/HOL/Analysis/Change_Of_Vars.thy
--- a/src/HOL/Analysis/Change_Of_Vars.thy
+++ b/src/HOL/Analysis/Change_Of_Vars.thy
@@ -1,3498 +1,3498 @@
 (*  Title:      HOL/Analysis/Change_Of_Vars.thy
     Authors:    LC Paulson, based on material from HOL Light
 *)
 
 section\<open>Change of Variables Theorems\<close>
 
 theory Change_Of_Vars
   imports Vitali_Covering_Theorem Determinants
 
 begin
 
 subsection \<open>Measurable Shear and Stretch\<close>
 
 proposition
   fixes a :: "real^'n"
   assumes "m \<noteq> n" and ab_ne: "cbox a b \<noteq> {}" and an: "0 \<le> a$n"
   shows measurable_shear_interval: "(\<lambda>x. \<chi> i. if i = m then x$m + x$n else x$i) ` (cbox a b) \<in> lmeasurable"
        (is  "?f ` _ \<in> _")
    and measure_shear_interval: "measure lebesgue ((\<lambda>x. \<chi> i. if i = m then x$m + x$n else x$i) ` cbox a b)
                = measure lebesgue (cbox a b)" (is "?Q")
 proof -
   have lin: "linear ?f"
     by (rule linearI) (auto simp: plus_vec_def scaleR_vec_def algebra_simps)
   show fab: "?f ` cbox a b \<in> lmeasurable"
     by (simp add: lin measurable_linear_image_interval)
   let ?c = "\<chi> i. if i = m then b$m + b$n else b$i"
   let ?mn = "axis m 1 - axis n (1::real)"
   have eq1: "measure lebesgue (cbox a ?c)
             = measure lebesgue (?f ` cbox a b)
             + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m})
             + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})"
   proof (rule measure_Un3_negligible)
     show "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m} \<in> lmeasurable" "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} \<in> lmeasurable"
       by (auto simp: convex_Int convex_halfspace_le convex_halfspace_ge bounded_Int measurable_convex)
     have "negligible {x. ?mn \<bullet> x = a$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "?f ` cbox a b \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}) \<subseteq> {x. ?mn \<bullet> x = a$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible ((?f ` cbox a b) \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}))"
       by (rule negligible_subset)
     have "negligible {x. ?mn \<bullet> x = b$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(?f ` cbox a b) \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}) \<subseteq> {x. ?mn \<bullet> x = b$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible (?f ` cbox a b \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}))"
       by (rule negligible_subset)
     have "negligible {x. ?mn \<bullet> x = b$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})) \<subseteq> {x. ?mn \<bullet> x = b$m}"
       using \<open>m \<noteq> n\<close> ab_ne
       apply (auto simp: algebra_simps mem_box_cart inner_axis')
       apply (drule_tac x=m in spec)+
       apply simp
       done
     ultimately show "negligible (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}))"
       by (rule negligible_subset)
     show "?f ` cbox a b \<union> cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<union> cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} = cbox a ?c" (is "?lhs = _")
     proof
       show "?lhs \<subseteq> cbox a ?c"
         by (auto simp: mem_box_cart add_mono) (meson add_increasing2 an order_trans)
       show "cbox a ?c \<subseteq> ?lhs"
         apply (auto simp: algebra_simps image_iff inner_axis' lambda_add_Galois [OF \<open>m \<noteq> n\<close>])
         apply (auto simp: mem_box_cart split: if_split_asm)
         done
     qed
   qed (fact fab)
   let ?d = "\<chi> i. if i = m then a $ m - b $ m else 0"
   have eq2: "measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}) + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})
            = measure lebesgue (cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i))"
   proof (rule measure_translate_add[of "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m}" "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}"
      "(\<chi> i. if i = m then a$m - b$m else 0)" "cbox a (\<chi> i. if i = m then a$m + b$n else b$i)"])
     show "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m}) \<in> lmeasurable"
       "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} \<in> lmeasurable"
       by (auto simp: convex_Int convex_halfspace_le convex_halfspace_ge bounded_Int measurable_convex)
     have "\<And>x. \<lbrakk>x $ n + a $ m \<le> x $ m\<rbrakk>
          \<Longrightarrow> x \<in> (+) (\<chi> i. if i = m then a $ m - b $ m else 0) ` {x. x $ n + b $ m \<le> x $ m}"
       using \<open>m \<noteq> n\<close>
       by (rule_tac x="x - (\<chi> i. if i = m then a$m - b$m else 0)" in image_eqI)
          (simp_all add: mem_box_cart)
     then have imeq: "(+) ?d ` {x. b $ m \<le> ?mn \<bullet> x} = {x. a $ m \<le> ?mn \<bullet> x}"
       using \<open>m \<noteq> n\<close> by (auto simp: mem_box_cart inner_axis' algebra_simps)
     have "\<And>x. \<lbrakk>0 \<le> a $ n; x $ n + a $ m \<le> x $ m;
                 \<forall>i. i \<noteq> m \<longrightarrow> a $ i \<le> x $ i \<and> x $ i \<le> b $ i\<rbrakk>
          \<Longrightarrow> a $ m \<le> x $ m"
       using \<open>m \<noteq> n\<close>  by force
     then have "(+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x})
             = cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i) \<inter> {x. a $ m \<le> ?mn \<bullet> x}"
       using an ab_ne
       apply (simp add: cbox_translation [symmetric] translation_Int interval_ne_empty_cart imeq)
       apply (auto simp: mem_box_cart inner_axis' algebra_simps if_distrib all_if_distrib)
       by (metis (full_types) add_mono mult_2_right)
     then show "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<union>
           (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x}) =
           cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i)"  (is "?lhs = ?rhs")
       using an \<open>m \<noteq> n\<close>
       apply (auto simp: mem_box_cart inner_axis' algebra_simps if_distrib all_if_distrib, force)
         apply (drule_tac x=n in spec)+
       by (meson ab_ne add_mono_thms_linordered_semiring(3) dual_order.trans interval_ne_empty_cart(1))
     have "negligible{x. ?mn \<bullet> x = a$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter>
                                  (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x})) \<subseteq> {x. ?mn \<bullet> x = a$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter>
                                  (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x}))"
       by (rule negligible_subset)
   qed
   have ac_ne: "cbox a ?c \<noteq> {}"
     using ab_ne an
     by (clarsimp simp: interval_eq_empty_cart) (meson add_less_same_cancel1 le_less_linear less_le_trans)
   have ax_ne: "cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i) \<noteq> {}"
     using ab_ne an
     by (clarsimp simp: interval_eq_empty_cart) (meson add_less_same_cancel1 le_less_linear less_le_trans)
   have eq3: "measure lebesgue (cbox a ?c) = measure lebesgue (cbox a (\<chi> i. if i = m then a$m + b$n else b$i)) + measure lebesgue (cbox a b)"
     by (simp add: content_cbox_if_cart ab_ne ac_ne ax_ne algebra_simps prod.delta_remove
              if_distrib [of "\<lambda>u. u - z" for z] prod.remove)
   show ?Q
     using eq1 eq2 eq3
     by (simp add: algebra_simps)
 qed
 
 
 proposition
   fixes S :: "(real^'n) set"
   assumes "S \<in> lmeasurable"
   shows measurable_stretch: "((\<lambda>x. \<chi> k. m k * x$k) ` S) \<in> lmeasurable" (is  "?f ` S \<in> _")
     and measure_stretch: "measure lebesgue ((\<lambda>x. \<chi> k. m k * x$k) ` S) = \<bar>prod m UNIV\<bar> * measure lebesgue S"
     (is "?MEQ")
 proof -
   have "(?f ` S) \<in> lmeasurable \<and> ?MEQ"
   proof (cases "\<forall>k. m k \<noteq> 0")
     case True
     have m0: "0 < \<bar>prod m UNIV\<bar>"
       using True by simp
     have "(indicat_real (?f ` S) has_integral \<bar>prod m UNIV\<bar> * measure lebesgue S) UNIV"
     proof (clarsimp simp add: has_integral_alt [where i=UNIV])
       fix e :: "real"
       assume "e > 0"
       have "(indicat_real S has_integral (measure lebesgue S)) UNIV"
         using assms lmeasurable_iff_has_integral by blast
       then obtain B where "B>0"
         and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow>
                         \<exists>z. (indicat_real S has_integral z) (cbox a b) \<and>
                             \<bar>z - measure lebesgue S\<bar> < e / \<bar>prod m UNIV\<bar>"
         by (simp add: has_integral_alt [where i=UNIV]) (metis (full_types) divide_pos_pos m0  m0 \<open>e > 0\<close>)
       show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                   (\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox a b) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e)"
       proof (intro exI conjI allI)
         let ?C = "Max (range (\<lambda>k. \<bar>m k\<bar>)) * B"
         show "?C > 0"
           using True \<open>B > 0\<close> by (simp add: Max_gr_iff)
         show "ball 0 ?C \<subseteq> cbox u v \<longrightarrow>
                   (\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox u v) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e)" for u v
         proof
           assume uv: "ball 0 ?C \<subseteq> cbox u v"
           with \<open>?C > 0\<close> have cbox_ne: "cbox u v \<noteq> {}"
             using centre_in_ball by blast
           let ?\<alpha> = "\<lambda>k. u$k / m k"
           let ?\<beta> = "\<lambda>k. v$k / m k"
           have invm0: "\<And>k. inverse (m k) \<noteq> 0"
             using True by auto
           have "ball 0 B \<subseteq> (\<lambda>x. \<chi> k. x $ k / m k) ` ball 0 ?C"
           proof clarsimp
             fix x :: "real^'n"
             assume x: "norm x < B"
             have [simp]: "\<bar>Max (range (\<lambda>k. \<bar>m k\<bar>))\<bar> = Max (range (\<lambda>k. \<bar>m k\<bar>))"
               by (meson Max_ge abs_ge_zero abs_of_nonneg finite finite_imageI order_trans rangeI)
             have "norm (\<chi> k. m k * x $ k) \<le> norm (Max (range (\<lambda>k. \<bar>m k\<bar>)) *\<^sub>R x)"
               by (rule norm_le_componentwise_cart) (auto simp: abs_mult intro: mult_right_mono)
             also have "\<dots> < ?C"
               using x \<open>0 < (MAX k. \<bar>m k\<bar>) * B\<close> \<open>0 < B\<close> zero_less_mult_pos2 by fastforce
             finally have "norm (\<chi> k. m k * x $ k) < ?C" .
             then show "x \<in> (\<lambda>x. \<chi> k. x $ k / m k) ` ball 0 ?C"
               using stretch_Galois [of "inverse \<circ> m"] True by (auto simp: image_iff field_simps)
           qed
           then have Bsub: "ball 0 B \<subseteq> cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k))"
             using cbox_ne uv image_stretch_interval_cart [of "inverse \<circ> m" u v, symmetric]
             by (force simp: field_simps)
           obtain z where zint: "(indicat_real S has_integral z) (cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k)))"
                    and zless: "\<bar>z - measure lebesgue S\<bar> < e / \<bar>prod m UNIV\<bar>"
             using B [OF Bsub] by blast
           have ind: "indicat_real (?f ` S) = (\<lambda>x. indicator S (\<chi> k. x$k / m k))"
             using True stretch_Galois [of m] by (force simp: indicator_def)
           show "\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox u v) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e"
           proof (simp add: ind, intro conjI exI)
             have "((\<lambda>x. indicat_real S (\<chi> k. x $ k/ m k)) has_integral z *\<^sub>R \<bar>prod m UNIV\<bar>)
                 ((\<lambda>x. \<chi> k. x $ k * m k) ` cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k)))"
               using True has_integral_stretch_cart [OF zint, of "inverse \<circ> m"]
               by (simp add: field_simps prod_dividef)
             moreover have "((\<lambda>x. \<chi> k. x $ k * m k) ` cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k))) = cbox u v"
               using True image_stretch_interval_cart [of "inverse \<circ> m" u v, symmetric]
                 image_stretch_interval_cart [of "\<lambda>k. 1" u v, symmetric] \<open>cbox u v \<noteq> {}\<close>
               by (simp add: field_simps image_comp o_def)
             ultimately show "((\<lambda>x. indicat_real S (\<chi> k. x $ k/ m k)) has_integral z *\<^sub>R \<bar>prod m UNIV\<bar>) (cbox u v)"
               by simp
             have "\<bar>z *\<^sub>R \<bar>prod m UNIV\<bar> - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar>
                  = \<bar>prod m UNIV\<bar> * \<bar>z - measure lebesgue S\<bar>"
               by (metis (no_types, opaque_lifting) abs_abs abs_scaleR mult.commute real_scaleR_def right_diff_distrib')
             also have "\<dots> < e"
               using zless True by (simp add: field_simps)
             finally show "\<bar>z *\<^sub>R \<bar>prod m UNIV\<bar> - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e" .
           qed
         qed
       qed
     qed
     then show ?thesis
       by (auto simp: has_integral_integrable integral_unique lmeasure_integral_UNIV measurable_integrable)
   next
     case False
     then obtain k where "m k = 0" and prm: "prod m UNIV = 0"
       by auto
     have nfS: "negligible (?f ` S)"
       by (rule negligible_subset [OF negligible_standard_hyperplane_cart]) (use \<open>m k = 0\<close> in auto)
     then have "(?f ` S) \<in> lmeasurable"
       by (simp add: negligible_iff_measure)
     with nfS show ?thesis
       by (simp add: prm negligible_iff_measure0)
   qed
   then show "(?f ` S) \<in> lmeasurable" ?MEQ
     by metis+
 qed
 
 
 proposition
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "linear f" "S \<in> lmeasurable"
   shows measurable_linear_image: "(f ` S) \<in> lmeasurable"
     and measure_linear_image: "measure lebesgue (f ` S) = \<bar>det (matrix f)\<bar> * measure lebesgue S" (is "?Q f S")
 proof -
   have "\<forall>S \<in> lmeasurable. (f ` S) \<in> lmeasurable \<and> ?Q f S"
   proof (rule induct_linear_elementary [OF \<open>linear f\<close>]; intro ballI)
     fix f g and S :: "(real,'n) vec set"
     assume "linear f" and "linear g"
       and f [rule_format]: "\<forall>S \<in> lmeasurable. f ` S \<in> lmeasurable \<and> ?Q f S"
       and g [rule_format]: "\<forall>S \<in> lmeasurable. g ` S \<in> lmeasurable \<and> ?Q g S"
       and S: "S \<in> lmeasurable"
     then have gS: "g ` S \<in> lmeasurable"
       by blast
     show "(f \<circ> g) ` S \<in> lmeasurable \<and> ?Q (f \<circ> g) S"
       using f [OF gS] g [OF S] matrix_compose [OF \<open>linear g\<close> \<open>linear f\<close>]
       by (simp add: o_def image_comp abs_mult det_mul)
   next
     fix f :: "real^'n::_ \<Rightarrow> real^'n::_" and i and S :: "(real^'n::_) set"
     assume "linear f" and 0: "\<And>x. f x $ i = 0" and "S \<in> lmeasurable"
     then have "\<not> inj f"
       by (metis (full_types) linear_injective_imp_surjective one_neq_zero surjE vec_component)
     have detf: "det (matrix f) = 0"
       using \<open>\<not> inj f\<close> det_nz_iff_inj[OF \<open>linear f\<close>] by blast
     show "f ` S \<in> lmeasurable \<and> ?Q f S"
     proof
       show "f ` S \<in> lmeasurable"
         using lmeasurable_iff_indicator_has_integral \<open>linear f\<close> \<open>\<not> inj f\<close> negligible_UNIV negligible_linear_singular_image by blast
       have "measure lebesgue (f ` S) = 0"
         by (meson \<open>\<not> inj f\<close> \<open>linear f\<close> negligible_imp_measure0 negligible_linear_singular_image)
       also have "\<dots> = \<bar>det (matrix f)\<bar> * measure lebesgue S"
         by (simp add: detf)
       finally show "?Q f S" .
     qed
   next
     fix c and S :: "(real^'n::_) set"
     assume "S \<in> lmeasurable"
     show "(\<lambda>a. \<chi> i. c i * a $ i) ` S \<in> lmeasurable \<and> ?Q (\<lambda>a. \<chi> i. c i * a $ i) S"
     proof
       show "(\<lambda>a. \<chi> i. c i * a $ i) ` S \<in> lmeasurable"
         by (simp add: \<open>S \<in> lmeasurable\<close> measurable_stretch)
       show "?Q (\<lambda>a. \<chi> i. c i * a $ i) S"
         by (simp add: measure_stretch [OF \<open>S \<in> lmeasurable\<close>, of c] axis_def matrix_def det_diagonal)
     qed
   next
     fix m :: "'n" and n :: "'n" and S :: "(real, 'n) vec set"
     assume "m \<noteq> n" and "S \<in> lmeasurable"
     let ?h = "\<lambda>v::(real, 'n) vec. \<chi> i. v $ Transposition.transpose m n i"
     have lin: "linear ?h"
       by (rule linearI) (simp_all add: plus_vec_def scaleR_vec_def)
     have meq: "measure lebesgue ((\<lambda>v::(real, 'n) vec. \<chi> i. v $ Transposition.transpose m n i) ` cbox a b)
              = measure lebesgue (cbox a b)" for a b
     proof (cases "cbox a b = {}")
       case True then show ?thesis
         by simp
     next
       case False
       then have him: "?h ` (cbox a b) \<noteq> {}"
         by blast
       have eq: "?h ` (cbox a b) = cbox (?h a) (?h b)"
         by (auto simp: image_iff lambda_swap_Galois mem_box_cart) (metis transpose_involutory)+
       show ?thesis
         using him prod.permute [OF permutes_swap_id, where S=UNIV and g="\<lambda>i. (b - a)$i", symmetric]
         by (simp add: eq content_cbox_cart False)
     qed
     have "(\<chi> i j. if Transposition.transpose m n i = j then 1 else 0) = (\<chi> i j. if j = Transposition.transpose m n i then 1 else (0::real))"
       by (auto intro!: Cart_lambda_cong)
     then have "matrix ?h = transpose(\<chi> i j. mat 1 $ i $ Transposition.transpose m n j)"
       by (auto simp: matrix_eq transpose_def axis_def mat_def matrix_def)
     then have 1: "\<bar>det (matrix ?h)\<bar> = 1"
       by (simp add: det_permute_columns permutes_swap_id sign_swap_id abs_mult)
     show "?h ` S \<in> lmeasurable \<and> ?Q ?h S"
     proof
       show "?h ` S \<in> lmeasurable" "?Q ?h S"
         using measure_linear_sufficient [OF lin \<open>S \<in> lmeasurable\<close>] meq 1 by force+
     qed
   next
     fix m n :: "'n" and S :: "(real, 'n) vec set"
     assume "m \<noteq> n" and "S \<in> lmeasurable"
     let ?h = "\<lambda>v::(real, 'n) vec. \<chi> i. if i = m then v $ m + v $ n else v $ i"
     have lin: "linear ?h"
       by (rule linearI) (auto simp: algebra_simps plus_vec_def scaleR_vec_def vec_eq_iff)
     consider "m < n" | " n < m"
       using \<open>m \<noteq> n\<close> less_linear by blast
     then have 1: "det(matrix ?h) = 1"
     proof cases
       assume "m < n"
       have *: "matrix ?h $ i $ j = (0::real)" if "j < i" for i j :: 'n
       proof -
         have "axis j 1 = (\<chi> n. if n = j then 1 else (0::real))"
           using axis_def by blast
         then have "(\<chi> p q. if p = m then axis q 1 $ m + axis q 1 $ n else axis q 1 $ p) $ i $ j = (0::real)"
           using \<open>j < i\<close> axis_def \<open>m < n\<close> by auto
         with \<open>m < n\<close> show ?thesis
           by (auto simp: matrix_def axis_def cong: if_cong)
       qed
       show ?thesis
         using \<open>m \<noteq> n\<close> by (subst det_upperdiagonal [OF *]) (auto simp: matrix_def axis_def cong: if_cong)
     next
       assume "n < m"
       have *: "matrix ?h $ i $ j = (0::real)" if "j > i" for i j :: 'n
       proof -
         have "axis j 1 = (\<chi> n. if n = j then 1 else (0::real))"
           using axis_def by blast
         then have "(\<chi> p q. if p = m then axis q 1 $ m + axis q 1 $ n else axis q 1 $ p) $ i $ j = (0::real)"
           using \<open>j > i\<close> axis_def \<open>m > n\<close> by auto
         with \<open>m > n\<close> show ?thesis
           by (auto simp: matrix_def axis_def cong: if_cong)
       qed
       show ?thesis
         using \<open>m \<noteq> n\<close>
         by (subst det_lowerdiagonal [OF *]) (auto simp: matrix_def axis_def cong: if_cong)
     qed
     have meq: "measure lebesgue (?h ` (cbox a b)) = measure lebesgue (cbox a b)" for a b
     proof (cases "cbox a b = {}")
       case True then show ?thesis by simp
     next
       case False
       then have ne: "(+) (\<chi> i. if i = n then - a $ n else 0) ` cbox a b \<noteq> {}"
         by auto
       let ?v = "\<chi> i. if i = n then - a $ n else 0"
       have "?h ` cbox a b
             = (+) (\<chi> i. if i = m \<or> i = n then a $ n else 0) ` ?h ` (+) ?v ` (cbox a b)"
         using \<open>m \<noteq> n\<close> unfolding image_comp o_def by (force simp: vec_eq_iff)
       then have "measure lebesgue (?h ` (cbox a b))
                = measure lebesgue ((\<lambda>v. \<chi> i. if i = m then v $ m + v $ n else v $ i) `
                                    (+) ?v ` cbox a b)"
         by (rule ssubst) (rule measure_translation)
       also have "\<dots> = measure lebesgue ((\<lambda>v. \<chi> i. if i = m then v $ m + v $ n else v $ i) ` cbox (?v +a) (?v + b))"
         by (metis (no_types, lifting) cbox_translation)
       also have "\<dots> = measure lebesgue ((+) (\<chi> i. if i = n then - a $ n else 0) ` cbox a b)"
         apply (subst measure_shear_interval)
         using \<open>m \<noteq> n\<close> ne apply auto
         apply (simp add: cbox_translation)
         by (metis cbox_borel cbox_translation measure_completion sets_lborel)
       also have "\<dots> = measure lebesgue (cbox a b)"
         by (rule measure_translation)
         finally show ?thesis .
       qed
     show "?h ` S \<in> lmeasurable \<and> ?Q ?h S"
       using measure_linear_sufficient [OF lin \<open>S \<in> lmeasurable\<close>] meq 1 by force
   qed
   with assms show "(f ` S) \<in> lmeasurable" "?Q f S"
     by metis+
 qed
 
 
 lemma
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes f: "orthogonal_transformation f" and S: "S \<in> lmeasurable"
   shows measurable_orthogonal_image: "f ` S \<in> lmeasurable"
     and measure_orthogonal_image: "measure lebesgue (f ` S) = measure lebesgue S"
 proof -
   have "linear f"
     by (simp add: f orthogonal_transformation_linear)
   then show "f ` S \<in> lmeasurable"
     by (metis S measurable_linear_image)
   show "measure lebesgue (f ` S) = measure lebesgue S"
     by (simp add: measure_linear_image \<open>linear f\<close> S f)
 qed
 
 proposition measure_semicontinuous_with_hausdist_explicit:
   assumes "bounded S" and neg: "negligible(frontier S)" and "e > 0"
   obtains d where "d > 0"
                   "\<And>T. \<lbrakk>T \<in> lmeasurable; \<And>y. y \<in> T \<Longrightarrow> \<exists>x. x \<in> S \<and> dist x y < d\<rbrakk>
                         \<Longrightarrow> measure lebesgue T < measure lebesgue S + e"
 proof (cases "S = {}")
   case True
   with that \<open>e > 0\<close> show ?thesis by force
 next
   case False
   then have frS: "frontier S \<noteq> {}"
     using \<open>bounded S\<close> frontier_eq_empty not_bounded_UNIV by blast
   have "S \<in> lmeasurable"
     by (simp add: \<open>bounded S\<close> measurable_Jordan neg)
   have null: "(frontier S) \<in> null_sets lebesgue"
     by (metis neg negligible_iff_null_sets)
   have "frontier S \<in> lmeasurable" and mS0: "measure lebesgue (frontier S) = 0"
     using neg negligible_imp_measurable negligible_iff_measure by blast+
   with \<open>e > 0\<close> sets_lebesgue_outer_open
   obtain U where "open U"
     and U: "frontier S \<subseteq> U" "U - frontier S \<in> lmeasurable" "emeasure lebesgue (U - frontier S) < e"
     by (metis fmeasurableD)
   with null have "U \<in> lmeasurable"
     by (metis borel_open measurable_Diff_null_set sets_completionI_sets sets_lborel)
   have "measure lebesgue (U - frontier S) = measure lebesgue U"
     using mS0 by (simp add: \<open>U \<in> lmeasurable\<close> fmeasurableD measure_Diff_null_set null)
   with U have mU: "measure lebesgue U < e"
     by (simp add: emeasure_eq_measure2 ennreal_less_iff)
   show ?thesis
   proof
     have "U \<noteq> UNIV"
       using \<open>U \<in> lmeasurable\<close> by auto
     then have "- U \<noteq> {}"
       by blast
     with \<open>open U\<close> \<open>frontier S \<subseteq> U\<close> show "setdist (frontier S) (- U) > 0"
       by (auto simp: \<open>bounded S\<close> open_closed compact_frontier_bounded setdist_gt_0_compact_closed frS)
     fix T
     assume "T \<in> lmeasurable"
       and T: "\<And>t. t \<in> T \<Longrightarrow> \<exists>y. y \<in> S \<and> dist y t < setdist (frontier S) (- U)"
     then have "measure lebesgue T - measure lebesgue S \<le> measure lebesgue (T - S)"
       by (simp add: \<open>S \<in> lmeasurable\<close> measure_diff_le_measure_setdiff)
     also have "\<dots>  \<le> measure lebesgue U"
     proof -
       have "T - S \<subseteq> U"
       proof clarify
         fix x
         assume "x \<in> T" and "x \<notin> S"
         then obtain y where "y \<in> S" and y: "dist y x < setdist (frontier S) (- U)"
           using T by blast
         have "closed_segment x y \<inter> frontier S \<noteq> {}"
           using connected_Int_frontier \<open>x \<notin> S\<close> \<open>y \<in> S\<close> by blast
         then obtain z where z: "z \<in> closed_segment x y" "z \<in> frontier S"
           by auto
         with y have "dist z x < setdist(frontier S) (- U)"
           by (auto simp: dist_commute dest!: dist_in_closed_segment)
         with z have False if "x \<in> -U"
           using setdist_le_dist [OF \<open>z \<in> frontier S\<close> that] by auto
         then show "x \<in> U"
           by blast
       qed
       then show ?thesis
         by (simp add: \<open>S \<in> lmeasurable\<close> \<open>T \<in> lmeasurable\<close> \<open>U \<in> lmeasurable\<close> fmeasurableD measure_mono_fmeasurable sets.Diff)
     qed
     finally have "measure lebesgue T - measure lebesgue S \<le> measure lebesgue U" .
     with mU show "measure lebesgue T < measure lebesgue S + e"
       by linarith
   qed
 qed
 
 proposition
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> lmeasurable"
   and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   and bounded: "\<And>x. x \<in> S \<Longrightarrow> \<bar>det (matrix (f' x))\<bar> \<le> B"
   shows measurable_bounded_differentiable_image:
        "f ` S \<in> lmeasurable"
     and measure_bounded_differentiable_image:
        "measure lebesgue (f ` S) \<le> B * measure lebesgue S" (is "?M")
 proof -
   have "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) \<le> B * measure lebesgue S"
   proof (cases "B < 0")
     case True
     then have "S = {}"
       by (meson abs_ge_zero bounded empty_iff equalityI less_le_trans linorder_not_less subsetI)
     then show ?thesis
       by auto
   next
     case False
     then have "B \<ge> 0"
       by arith
     let ?\<mu> = "measure lebesgue"
     have f_diff: "f differentiable_on S"
       using deriv by (auto simp: differentiable_on_def differentiable_def)
     have eps: "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> (B+e) * ?\<mu> S" (is "?ME")
               if "e > 0" for e
     proof -
       have eps_d: "f ` S \<in> lmeasurable"  "?\<mu> (f ` S) \<le> (B+e) * (?\<mu> S + d)" (is "?MD")
                   if "d > 0" for d
       proof -
         obtain T where T: "open T" "S \<subseteq> T" and TS: "(T-S) \<in> lmeasurable" and "emeasure lebesgue (T-S) < ennreal d"
           using S \<open>d > 0\<close> sets_lebesgue_outer_open by blast
         then have "?\<mu> (T-S) < d"
           by (metis emeasure_eq_measure2 ennreal_leI not_less)
         with S T TS have "T \<in> lmeasurable" and Tless: "?\<mu> T < ?\<mu> S + d"
           by (auto simp: measurable_measure_Diff dest!: fmeasurable_Diff_D)
         have "\<exists>r. 0 < r \<and> r < d \<and> ball x r \<subseteq> T \<and> f ` (S \<inter> ball x r) \<in> lmeasurable \<and>
                   ?\<mu> (f ` (S \<inter> ball x r)) \<le> (B + e) * ?\<mu> (ball x r)"
           if "x \<in> S" "d > 0" for x d
         proof -
           have lin: "linear (f' x)"
             and lim0: "((\<lambda>y. (f y - (f x + f' x (y - x))) /\<^sub>R norm(y - x)) \<longlongrightarrow> 0) (at x within S)"
             using deriv \<open>x \<in> S\<close> by (auto simp: has_derivative_within bounded_linear.linear field_simps)
           have bo: "bounded (f' x ` ball 0 1)"
             by (simp add: bounded_linear_image linear_linear lin)
           have neg: "negligible (frontier (f' x ` ball 0 1))"
             using deriv has_derivative_linear \<open>x \<in> S\<close>
             by (auto intro!: negligible_convex_frontier [OF convex_linear_image])
           let ?unit_vol = "content (ball (0 :: real ^ 'n :: {finite, wellorder}) 1)"
           have 0: "0 < e * ?unit_vol"
             using \<open>e > 0\<close> by (simp add: content_ball_pos)
           obtain k where "k > 0" and k:
                   "\<And>U. \<lbrakk>U \<in> lmeasurable; \<And>y. y \<in> U \<Longrightarrow> \<exists>z. z \<in> f' x ` ball 0 1 \<and> dist z y < k\<rbrakk>
                         \<Longrightarrow> ?\<mu> U < ?\<mu> (f' x ` ball 0 1) + e * ?unit_vol"
             using measure_semicontinuous_with_hausdist_explicit [OF bo neg 0] by blast
           obtain l where "l > 0" and l: "ball x l \<subseteq> T"
             using \<open>x \<in> S\<close> \<open>open T\<close> \<open>S \<subseteq> T\<close> openE by blast
           obtain \<zeta> where "0 < \<zeta>"
             and \<zeta>: "\<And>y. \<lbrakk>y \<in> S; y \<noteq> x; dist y x < \<zeta>\<rbrakk>
                         \<Longrightarrow> norm (f y - (f x + f' x (y - x))) / norm (y - x) < k"
             using lim0 \<open>k > 0\<close> by (simp add: Lim_within) (auto simp add: field_simps)
           define r where "r \<equiv> min (min l (\<zeta>/2)) (min 1 (d/2))"
           show ?thesis
           proof (intro exI conjI)
             show "r > 0" "r < d"
               using \<open>l > 0\<close> \<open>\<zeta> > 0\<close> \<open>d > 0\<close> by (auto simp: r_def)
             have "r \<le> l"
               by (auto simp: r_def)
             with l show "ball x r \<subseteq> T"
               by auto
             have ex_lessK: "\<exists>x' \<in> ball 0 1. dist (f' x x') ((f y - f x) /\<^sub>R r) < k"
               if "y \<in> S" and "dist x y < r" for y
             proof (cases "y = x")
               case True
               with lin linear_0 \<open>k > 0\<close> that show ?thesis
                 by (rule_tac x=0 in bexI) (auto simp: linear_0)
             next
               case False
               then show ?thesis
               proof (rule_tac x="(y - x) /\<^sub>R r" in bexI)
                 have "f' x ((y - x) /\<^sub>R r) = f' x (y - x) /\<^sub>R r"
                   by (simp add: lin linear_scale)
                 then have "dist (f' x ((y - x) /\<^sub>R r)) ((f y - f x) /\<^sub>R r) = norm (f' x (y - x) /\<^sub>R r - (f y - f x) /\<^sub>R r)"
                   by (simp add: dist_norm)
                 also have "\<dots> = norm (f' x (y - x) - (f y - f x)) / r"
                   using \<open>r > 0\<close> by (simp add: divide_simps scale_right_diff_distrib [symmetric])
                 also have "\<dots> \<le> norm (f y - (f x + f' x (y - x))) / norm (y - x)"
                   using that \<open>r > 0\<close> False by (simp add: field_split_simps dist_norm norm_minus_commute mult_right_mono)
                 also have "\<dots> < k"
                   using that \<open>0 < \<zeta>\<close> by (simp add: dist_commute r_def  \<zeta> [OF \<open>y \<in> S\<close> False])
                 finally show "dist (f' x ((y - x) /\<^sub>R r)) ((f y - f x) /\<^sub>R r) < k" .
                 show "(y - x) /\<^sub>R r \<in> ball 0 1"
                   using that \<open>r > 0\<close> by (simp add: dist_norm divide_simps norm_minus_commute)
               qed
             qed
             let ?rfs = "(\<lambda>x. x /\<^sub>R r) ` (+) (- f x) ` f ` (S \<inter> ball x r)"
             have rfs_mble: "?rfs \<in> lmeasurable"
             proof (rule bounded_set_imp_lmeasurable)
               have "f differentiable_on S \<inter> ball x r"
                 using f_diff by (auto simp: fmeasurableD differentiable_on_subset)
               with S show "?rfs \<in> sets lebesgue"
                 by (auto simp: sets.Int intro!: lebesgue_sets_translation differentiable_image_in_sets_lebesgue)
               let ?B = "(\<lambda>(x, y). x + y) ` (f' x ` ball 0 1 \<times> ball 0 k)"
               have "bounded ?B"
                 by (simp add: bounded_plus [OF bo])
               moreover have "?rfs \<subseteq> ?B"
                 apply (auto simp: dist_norm image_iff dest!: ex_lessK)
                 by (metis (no_types, opaque_lifting) add.commute diff_add_cancel dist_0_norm dist_commute dist_norm mem_ball)
               ultimately show "bounded (?rfs)"
                 by (rule bounded_subset)
             qed
             then have "(\<lambda>x. r *\<^sub>R x) ` ?rfs \<in> lmeasurable"
               by (simp add: measurable_linear_image)
             with \<open>r > 0\<close> have "(+) (- f x) ` f ` (S \<inter> ball x r) \<in> lmeasurable"
               by (simp add: image_comp o_def)
             then have "(+) (f x) ` (+) (- f x) ` f ` (S \<inter> ball x r) \<in> lmeasurable"
               using  measurable_translation by blast
             then show fsb: "f ` (S \<inter> ball x r) \<in> lmeasurable"
               by (simp add: image_comp o_def)
             have "?\<mu> (f ` (S \<inter> ball x r)) = ?\<mu> (?rfs) * r ^ CARD('n)"
               using \<open>r > 0\<close> fsb
               by (simp add: measure_linear_image measure_translation_subtract measurable_translation_subtract field_simps cong: image_cong_simp)
             also have "\<dots> \<le> (\<bar>det (matrix (f' x))\<bar> * ?unit_vol + e * ?unit_vol) * r ^ CARD('n)"
             proof -
               have "?\<mu> (?rfs) < ?\<mu> (f' x ` ball 0 1) + e * ?unit_vol"
                 using rfs_mble by (force intro: k dest!: ex_lessK)
               then have "?\<mu> (?rfs) < \<bar>det (matrix (f' x))\<bar> * ?unit_vol + e * ?unit_vol"
                 by (simp add: lin measure_linear_image [of "f' x"])
               with \<open>r > 0\<close> show ?thesis
                 by auto
             qed
             also have "\<dots> \<le> (B + e) * ?\<mu> (ball x r)"
               using bounded [OF \<open>x \<in> S\<close>] \<open>r > 0\<close>
               by (simp add: algebra_simps content_ball_conv_unit_ball[of r] content_ball_pos)
             finally show "?\<mu> (f ` (S \<inter> ball x r)) \<le> (B + e) * ?\<mu> (ball x r)" .
           qed
         qed
         then obtain r where
           r0d: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow> 0 < r x d \<and> r x d < d"
           and rT: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow> ball x (r x d) \<subseteq> T"
           and r: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow>
                   (f ` (S \<inter> ball x (r x d))) \<in> lmeasurable \<and>
                   ?\<mu> (f ` (S \<inter> ball x (r x d))) \<le> (B + e) * ?\<mu> (ball x (r x d))"
           by metis
         obtain C where "countable C" and Csub: "C \<subseteq> {(x,r x t) |x t. x \<in> S \<and> 0 < t}"
           and pwC: "pairwise (\<lambda>i j. disjnt (ball (fst i) (snd i)) (ball (fst j) (snd j))) C"
           and negC: "negligible(S - (\<Union>i \<in> C. ball (fst i) (snd i)))"
           apply (rule Vitali_covering_theorem_balls [of S "{(x,r x t) |x t. x \<in> S \<and> 0 < t}" fst snd])
            apply auto
           by (metis dist_eq_0_iff r0d)
         let ?UB = "(\<Union>(x,s) \<in> C. ball x s)"
         have eq: "f ` (S \<inter> ?UB) = (\<Union>(x,s) \<in> C. f ` (S \<inter> ball x s))"
           by auto
         have mle: "?\<mu> (\<Union>(x,s) \<in> K. f ` (S \<inter> ball x s)) \<le> (B + e) * (?\<mu> S + d)"  (is "?l \<le> ?r")
           if "K \<subseteq> C" and "finite K" for K
         proof -
           have gt0: "b > 0" if "(a, b) \<in> K" for a b
             using Csub that \<open>K \<subseteq> C\<close> r0d by auto
           have inj: "inj_on (\<lambda>(x, y). ball x y) K"
             by (force simp: inj_on_def ball_eq_ball_iff dest: gt0)
           have disjnt: "disjoint ((\<lambda>(x, y). ball x y) ` K)"
             using pwC that
             apply (clarsimp simp: pairwise_def case_prod_unfold ball_eq_ball_iff)
             by (metis subsetD fst_conv snd_conv)
           have "?l \<le> (\<Sum>i\<in>K. ?\<mu> (case i of (x, s) \<Rightarrow> f ` (S \<inter> ball x s)))"
           proof (rule measure_UNION_le [OF \<open>finite K\<close>], clarify)
             fix x r
             assume "(x,r) \<in> K"
             then have "x \<in> S"
               using Csub \<open>K \<subseteq> C\<close> by auto
             show "f ` (S \<inter> ball x r) \<in> sets lebesgue"
               by (meson Int_lower1 S differentiable_on_subset f_diff fmeasurableD lmeasurable_ball order_refl sets.Int differentiable_image_in_sets_lebesgue)
           qed
           also have "\<dots> \<le> (\<Sum>(x,s) \<in> K. (B + e) * ?\<mu> (ball x s))"
             apply (rule sum_mono)
             using Csub r \<open>K \<subseteq> C\<close> by auto
           also have "\<dots> = (B + e) * (\<Sum>(x,s) \<in> K. ?\<mu> (ball x s))"
             by (simp add: prod.case_distrib sum_distrib_left)
           also have "\<dots> = (B + e) * sum ?\<mu> ((\<lambda>(x, y). ball x y) ` K)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> by (simp add: inj sum.reindex prod.case_distrib)
           also have "\<dots> = (B + e) * ?\<mu> (\<Union>(x,s) \<in> K. ball x s)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> that
             by (subst measure_Union') (auto simp: disjnt measure_Union')
           also have "\<dots> \<le> (B + e) * ?\<mu> T"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> that apply simp
             apply (rule measure_mono_fmeasurable [OF _ _ \<open>T \<in> lmeasurable\<close>])
             using Csub rT by force+
           also have "\<dots> \<le> (B + e) * (?\<mu> S + d)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> Tless by simp
           finally show ?thesis .
         qed
         have fSUB_mble: "(f ` (S \<inter> ?UB)) \<in> lmeasurable"
           unfolding eq using Csub r False \<open>e > 0\<close> that
           by (auto simp: intro!: fmeasurable_UN_bound [OF \<open>countable C\<close> _ mle])
         have fSUB_meas: "?\<mu> (f ` (S \<inter> ?UB)) \<le> (B + e) * (?\<mu> S + d)"  (is "?MUB")
           unfolding eq using Csub r False \<open>e > 0\<close> that
           by (auto simp: intro!: measure_UN_bound [OF \<open>countable C\<close> _ mle])
         have neg: "negligible ((f ` (S \<inter> ?UB) - f ` S) \<union> (f ` S - f ` (S \<inter> ?UB)))"
         proof (rule negligible_subset [OF negligible_differentiable_image_negligible [OF order_refl negC, where f=f]])
           show "f differentiable_on S - (\<Union>i\<in>C. ball (fst i) (snd i))"
             by (meson DiffE differentiable_on_subset subsetI f_diff)
         qed force
         show "f ` S \<in> lmeasurable"
           by (rule lmeasurable_negligible_symdiff [OF fSUB_mble neg])
         show ?MD
           using fSUB_meas measure_negligible_symdiff [OF fSUB_mble neg] by simp
       qed
       show "f ` S \<in> lmeasurable"
         using eps_d [of 1] by simp
       show ?ME
       proof (rule field_le_epsilon)
         fix \<delta> :: real
         assume "0 < \<delta>"
         then show "?\<mu> (f ` S) \<le> (B + e) * ?\<mu> S + \<delta>"
           using eps_d [of "\<delta> / (B+e)"] \<open>e > 0\<close> \<open>B \<ge> 0\<close> by (auto simp: divide_simps mult_ac)
       qed
     qed
     show ?thesis
     proof (cases "?\<mu> S = 0")
       case True
       with eps have "?\<mu> (f ` S) = 0"
         by (metis mult_zero_right not_le zero_less_measure_iff)
       then show ?thesis
         using eps [of 1] by (simp add: True)
     next
       case False
       have "?\<mu> (f ` S) \<le> B * ?\<mu> S"
       proof (rule field_le_epsilon)
         fix e :: real
         assume "e > 0"
         then show "?\<mu> (f ` S) \<le> B * ?\<mu> S + e"
           using eps [of "e / ?\<mu> S"] False by (auto simp: algebra_simps zero_less_measure_iff)
       qed
       with eps [of 1] show ?thesis by auto
     qed
   qed
   then show "f ` S \<in> lmeasurable" ?M by blast+
 qed
 
 lemma m_diff_image_weak:
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> lmeasurable"
     and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
 proof -
   let ?\<mu> = "measure lebesgue"
   have aint_S: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
     using int unfolding absolutely_integrable_on_def by auto
   define m where "m \<equiv> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
   have *: "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> m + e * ?\<mu> S"
     if "e > 0" for e
   proof -
     define T where "T \<equiv> \<lambda>n. {x \<in> S. n * e \<le> \<bar>det (matrix (f' x))\<bar> \<and>
                                      \<bar>det (matrix (f' x))\<bar> < (Suc n) * e}"
     have meas_t: "T n \<in> lmeasurable" for n
     proof -
       have *: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) \<in> borel_measurable (lebesgue_on S)"
         using aint_S by (simp add: S borel_measurable_restrict_space_iff fmeasurableD set_integrable_def)
       have [intro]: "x \<in> sets (lebesgue_on S) \<Longrightarrow> x \<in> sets lebesgue" for x
         using S sets_restrict_space_subset by blast
       have "{x \<in> S. real n * e \<le> \<bar>det (matrix (f' x))\<bar>} \<in> sets lebesgue"
         using * by (auto simp: borel_measurable_iff_halfspace_ge space_restrict_space)
       then have 1: "{x \<in> S. real n * e \<le> \<bar>det (matrix (f' x))\<bar>} \<in> lmeasurable"
         using S by (simp add: fmeasurableI2)
       have "{x \<in> S. \<bar>det (matrix (f' x))\<bar> < (1 + real n) * e} \<in> sets lebesgue"
         using * by (auto simp: borel_measurable_iff_halfspace_less space_restrict_space)
       then have 2: "{x \<in> S. \<bar>det (matrix (f' x))\<bar> < (1 + real n) * e} \<in> lmeasurable"
         using S by (simp add: fmeasurableI2)
       show ?thesis
         using fmeasurable.Int [OF 1 2] by (simp add: T_def Int_def cong: conj_cong)
     qed
     have aint_T: "\<And>k. (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on T k"
       using set_integrable_subset [OF aint_S] meas_t T_def by blast
     have Seq: "S = (\<Union>n. T n)"
       apply (auto simp: T_def)
       apply (rule_tac x="nat(floor(abs(det(matrix(f' x))) / e))" in exI)
       using that apply auto
       using of_int_floor_le pos_le_divide_eq apply blast
       by (metis add.commute pos_divide_less_eq real_of_int_floor_add_one_gt)
     have meas_ft: "f ` T n \<in> lmeasurable" for n
     proof (rule measurable_bounded_differentiable_image)
       show "T n \<in> lmeasurable"
         by (simp add: meas_t)
     next
       fix x :: "(real,'n) vec"
       assume "x \<in> T n"
       show "(f has_derivative f' x) (at x within T n)"
         by (metis (no_types, lifting) \<open>x \<in> T n\<close> deriv has_derivative_subset mem_Collect_eq subsetI T_def)
       show "\<bar>det (matrix (f' x))\<bar> \<le> (Suc n) * e"
         using \<open>x \<in> T n\<close> T_def by auto
     next
       show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T n"
         using aint_T absolutely_integrable_on_def by blast
     qed
     have disT: "disjoint (range T)"
       unfolding disjoint_def
     proof clarsimp
       show "T m \<inter> T n = {}" if "T m \<noteq> T n" for m n
         using that
       proof (induction m n rule: linorder_less_wlog)
         case (less m n)
         with \<open>e > 0\<close> show ?case
           unfolding T_def
           proof (clarsimp simp add: Collect_conj_eq [symmetric])
             fix x
             assume "e > 0"  "m < n"  "n * e \<le> \<bar>det (matrix (f' x))\<bar>"  "\<bar>det (matrix (f' x))\<bar> < (1 + real m) * e"
             then have "n < 1 + real m"
               by (metis (no_types, opaque_lifting) less_le_trans mult.commute not_le mult_le_cancel_iff2)
             then show "False"
               using less.hyps by linarith
           qed
       qed auto
     qed
     have injT: "inj_on T ({n. T n \<noteq> {}})"
       unfolding inj_on_def
     proof clarsimp
       show "m = n" if "T m = T n" "T n \<noteq> {}" for m n
         using that
       proof (induction m n rule: linorder_less_wlog)
         case (less m n)
         have False if "T n \<subseteq> T m" "x \<in> T n" for x
           using \<open>e > 0\<close> \<open>m < n\<close> that
           apply (auto simp: T_def  mult.commute intro: less_le_trans dest!: subsetD)
           by (metis add.commute less_le_trans nat_less_real_le not_le mult_le_cancel_iff2)
         then show ?case
           using less.prems by blast
       qed auto
     qed
     have sum_eq_Tim: "(\<Sum>k\<le>n. f (T k)) = sum f (T ` {..n})" if "f {} = 0" for f :: "_ \<Rightarrow> real" and n
     proof (subst sum.reindex_nontrivial)
       fix i j  assume "i \<in> {..n}" "j \<in> {..n}" "i \<noteq> j" "T i = T j"
       with that  injT [unfolded inj_on_def] show "f (T i) = 0"
         by simp metis
     qed (use atMost_atLeast0 in auto)
     let ?B = "m + e * ?\<mu> S"
     have "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> ?B" for n
     proof -
       have "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> (\<Sum>k\<le>n. ((k+1) * e) * ?\<mu>(T k))"
       proof (rule sum_mono [OF measure_bounded_differentiable_image])
         show "(f has_derivative f' x) (at x within T k)" if "x \<in> T k" for k x
           using that unfolding T_def by (blast intro: deriv has_derivative_subset)
         show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T k" for k
           using absolutely_integrable_on_def aint_T by blast
         show "\<bar>det (matrix (f' x))\<bar> \<le> real (k + 1) * e" if "x \<in> T k" for k x
           using T_def that by auto
       qed (use meas_t in auto)
       also have "\<dots> \<le> (\<Sum>k\<le>n. (k * e) * ?\<mu>(T k)) + (\<Sum>k\<le>n. e * ?\<mu>(T k))"
         by (simp add: algebra_simps sum.distrib)
       also have "\<dots> \<le> ?B"
       proof (rule add_mono)
         have "(\<Sum>k\<le>n. real k * e * ?\<mu> (T k)) = (\<Sum>k\<le>n. integral (T k) (\<lambda>x. k * e))"
           by (simp add: lmeasure_integral [OF meas_t]
                    flip: integral_mult_right integral_mult_left)
         also have "\<dots> \<le> (\<Sum>k\<le>n. integral (T k) (\<lambda>x.  (abs (det (matrix (f' x))))))"
         proof (rule sum_mono)
           fix k
           assume "k \<in> {..n}"
           show "integral (T k) (\<lambda>x. k * e) \<le> integral (T k) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
           proof (rule integral_le [OF integrable_on_const [OF meas_t]])
             show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T k"
               using absolutely_integrable_on_def aint_T by blast
           next
             fix x assume "x \<in> T k"
             show "k * e \<le> \<bar>det (matrix (f' x))\<bar>"
               using \<open>x \<in> T k\<close> T_def by blast
           qed
         qed
         also have "\<dots> = sum (\<lambda>T. integral T (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)) (T ` {..n})"
           by (auto intro: sum_eq_Tim)
         also have "\<dots> = integral (\<Union>k\<le>n. T k) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
         proof (rule integral_unique [OF has_integral_Union, symmetric])
           fix S  assume "S \<in> T ` {..n}"
           then show "((\<lambda>x. \<bar>det (matrix (f' x))\<bar>) has_integral integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)) S"
           using absolutely_integrable_on_def aint_T by blast
         next
           show "pairwise (\<lambda>S S'. negligible (S \<inter> S')) (T ` {..n})"
             using disT unfolding disjnt_iff by (auto simp: pairwise_def intro!: empty_imp_negligible)
         qed auto
         also have "\<dots> \<le> m"
           unfolding m_def
         proof (rule integral_subset_le)
           have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on (\<Union>k\<le>n. T k)"
             apply (rule set_integrable_subset [OF aint_S])
              apply (intro measurable meas_t fmeasurableD)
             apply (force simp: Seq)
             done
           then show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on (\<Union>k\<le>n. T k)"
             using absolutely_integrable_on_def by blast
         qed (use Seq int in auto)
         finally show "(\<Sum>k\<le>n. real k * e * ?\<mu> (T k)) \<le> m" .
       next
         have "(\<Sum>k\<le>n. ?\<mu> (T k)) = sum ?\<mu> (T ` {..n})"
           by (auto intro: sum_eq_Tim)
         also have "\<dots> = ?\<mu> (\<Union>k\<le>n. T k)"
           using S disT by (auto simp: pairwise_def meas_t intro: measure_Union' [symmetric])
         also have "\<dots> \<le> ?\<mu> S"
           using S by (auto simp: Seq intro: meas_t fmeasurableD measure_mono_fmeasurable)
         finally have "(\<Sum>k\<le>n. ?\<mu> (T k)) \<le> ?\<mu> S" .
         then show "(\<Sum>k\<le>n. e * ?\<mu> (T k)) \<le> e * ?\<mu> S"
           by (metis less_eq_real_def ordered_comm_semiring_class.comm_mult_left_mono sum_distrib_left that)
       qed
       finally show "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> ?B" .
     qed
     moreover have "measure lebesgue (\<Union>k\<le>n. f ` T k) \<le> (\<Sum>k\<le>n. ?\<mu> (f ` T k))" for n
       by (simp add: fmeasurableD meas_ft measure_UNION_le)
     ultimately have B_ge_m: "?\<mu> (\<Union>k\<le>n. (f ` T k)) \<le> ?B" for n
       by (meson order_trans)
     have "(\<Union>n. f ` T n) \<in> lmeasurable"
       by (rule fmeasurable_countable_Union [OF meas_ft B_ge_m])
     moreover have "?\<mu> (\<Union>n. f ` T n) \<le> m + e * ?\<mu> S"
       by (rule measure_countable_Union_le [OF meas_ft B_ge_m])
     ultimately show "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> m + e * ?\<mu> S"
       by (auto simp: Seq image_Union)
   qed
   show ?thesis
   proof
     show "f ` S \<in> lmeasurable"
       using * linordered_field_no_ub by blast
     let ?x = "m - ?\<mu> (f ` S)"
     have False if "?\<mu> (f ` S) > integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
     proof -
       have ml: "m < ?\<mu> (f ` S)"
         using m_def that by blast
       then have "?\<mu> S \<noteq> 0"
         using "*"(2) bgauge_existence_lemma by fastforce
       with ml have 0: "0 < - (m - ?\<mu> (f ` S))/2 / ?\<mu> S"
         using that zero_less_measure_iff by force
       then show ?thesis
         using * [OF 0] that by (auto simp: field_split_simps m_def split: if_split_asm)
     qed
     then show "?\<mu> (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       by fastforce
   qed
 qed
 
 
 theorem
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue"
     and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows measurable_differentiable_image: "f ` S \<in> lmeasurable"
     and measure_differentiable_image:
        "measure lebesgue (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" (is "?M")
 proof -
   let ?I = "\<lambda>n::nat. cbox (vec (-n)) (vec n) \<inter> S"
   let ?\<mu> = "measure lebesgue"
   have "x \<in> cbox (vec (- real (nat \<lceil>norm x\<rceil>))) (vec (real (nat \<lceil>norm x\<rceil>)))" for x :: "real^'n::_"
     apply (auto simp: mem_box_cart)
     apply (metis abs_le_iff component_le_norm_cart minus_le_iff of_nat_ceiling order.trans)
     by (meson abs_le_D1 norm_bound_component_le_cart real_nat_ceiling_ge)
   then have Seq: "S = (\<Union>n. ?I n)"
     by auto
   have fIn: "f ` ?I n \<in> lmeasurable"
        and mfIn: "?\<mu> (f ` ?I n) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" (is ?MN) for n
   proof -
     have In: "?I n \<in> lmeasurable"
       by (simp add: S bounded_Int bounded_set_imp_lmeasurable sets.Int)
     moreover have "\<And>x. x \<in> ?I n \<Longrightarrow> (f has_derivative f' x) (at x within ?I n)"
       by (meson Int_iff deriv has_derivative_subset subsetI)
     moreover have int_In: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on ?I n"
     proof -
       have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
         using int absolutely_integrable_integrable_bound by force
       then have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on ?I n"
         by (metis (no_types) Int_lower1 In fmeasurableD inf_commute set_integrable_subset)
       then show ?thesis
         using absolutely_integrable_on_def by blast
     qed
     ultimately have "f ` ?I n \<in> lmeasurable" "?\<mu> (f ` ?I n) \<le> integral (?I n) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       using m_diff_image_weak by metis+
     moreover have "integral (?I n) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       by (simp add: int_In int integral_subset_le)
     ultimately show "f ` ?I n \<in> lmeasurable" ?MN
       by auto
   qed
   have "?I k \<subseteq> ?I n" if "k \<le> n" for k n
     by (rule Int_mono) (use that in \<open>auto simp: subset_interval_imp_cart\<close>)
   then have "(\<Union>k\<le>n. f ` ?I k) = f ` ?I n" for n
     by (fastforce simp add:)
   with mfIn have "?\<mu> (\<Union>k\<le>n. f ` ?I k) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" for n
     by simp
   then have "(\<Union>n. f ` ?I n) \<in> lmeasurable" "?\<mu> (\<Union>n. f ` ?I n) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
     by (rule fmeasurable_countable_Union [OF fIn] measure_countable_Union_le [OF fIn])+
   then show "f ` S \<in> lmeasurable" ?M
     by (metis Seq image_UN)+
 qed
 
 
 lemma borel_measurable_simple_function_limit_increasing:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   shows "(f \<in> borel_measurable lebesgue \<and> (\<forall>x. 0 \<le> f x)) \<longleftrightarrow>
          (\<exists>g. (\<forall>n x. 0 \<le> g n x \<and> g n x \<le> f x) \<and> (\<forall>n x. g n x \<le> (g(Suc n) x)) \<and>
               (\<forall>n. g n \<in> borel_measurable lebesgue) \<and> (\<forall>n. finite(range (g n))) \<and>
               (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x))"
          (is "?lhs = ?rhs")
 proof
   assume f: ?lhs
   have leb_f: "{x. a \<le> f x \<and> f x < b} \<in> sets lebesgue" for a b
   proof -
     have "{x. a \<le> f x \<and> f x < b} = {x. f x < b} - {x. f x < a}"
       by auto
     also have "\<dots> \<in> sets lebesgue"
       using borel_measurable_vimage_halfspace_component_lt [of f UNIV] f by auto
     finally show ?thesis .
   qed
   have "g n x \<le> f x"
         if inc_g: "\<And>n x. 0 \<le> g n x \<and> g n x \<le> g (Suc n) x"
            and meas_g: "\<And>n. g n \<in> borel_measurable lebesgue"
            and fin: "\<And>n. finite(range (g n))" and lim: "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x" for g n x
   proof -
     have "\<exists>r>0. \<forall>N. \<exists>n\<ge>N. dist (g n x) (f x) \<ge> r" if "g n x > f x"
     proof -
       have g: "g n x \<le> g (N + n) x" for N
         by (rule transitive_stepwise_le) (use inc_g in auto)
       have "\<exists>na\<ge>N. g n x - f x \<le> dist (g na x) (f x)" for N
         apply (rule_tac x="N+n" in exI)
         using g [of N] by (auto simp: dist_norm)
       with that show ?thesis
         using diff_gt_0_iff_gt by blast
     qed
     with lim show ?thesis
       apply (auto simp: lim_sequentially)
       by (meson less_le_not_le not_le_imp_less)
   qed
   moreover
   let ?\<Omega> = "\<lambda>n k. indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n}"
   let ?g = "\<lambda>n x. (\<Sum>k::real | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x)"
   have "\<exists>g. (\<forall>n x. 0 \<le> g n x \<and> g n x \<le> (g(Suc n) x)) \<and>
              (\<forall>n. g n \<in> borel_measurable lebesgue) \<and> (\<forall>n. finite(range (g n))) \<and>(\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x)"
   proof (intro exI allI conjI)
     show "0 \<le> ?g n x" for n x
     proof (clarify intro!: ordered_comm_monoid_add_class.sum_nonneg)
       fix k::real
       assume "k \<in> \<int>" and k: "\<bar>k\<bar> \<le> 2 ^ (2*n)"
       show "0 \<le> k/2^n * ?\<Omega> n k x"
         using f \<open>k \<in> \<int>\<close> apply (auto simp: indicator_def field_split_simps Ints_def)
         apply (drule spec [where x=x])
         using zero_le_power [of "2::real" n] mult_nonneg_nonneg [of "f x" "2^n"]
         by linarith
     qed
     show "?g n x \<le> ?g (Suc n) x" for n x
     proof -
       have "?g n x =
             (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
               k/2^n * (indicator {y. k/2^n \<le> f y \<and> f y < (k+1/2)/2^n} x +
               indicator {y. (k+1/2)/2^n \<le> f y \<and> f y < (k+1)/2^n} x))"
         by (rule sum.cong [OF refl]) (simp add: indicator_def field_split_simps)
       also have "\<dots> = (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1/2)/2^n} x) +
                        (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * indicator {y. (k+1/2)/2^n \<le> f y \<and> f y < (k+1)/2^n} x)"
         by (simp add:  comm_monoid_add_class.sum.distrib algebra_simps)
       also have "\<dots> = (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). (2 * k)/2 ^ Suc n * indicator {y. (2 * k)/2 ^ Suc n \<le> f y \<and> f y < (2 * k+1)/2 ^ Suc n} x) +
                        (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). (2 * k)/2 ^ Suc n * indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < ((2 * k+1) + 1)/2 ^ Suc n} x)"
         by (force simp: field_simps indicator_def intro: sum.cong)
       also have "\<dots> \<le> (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2 * Suc n). k/2 ^ Suc n * (indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x))"
                 (is "?a + _ \<le> ?b")
       proof -
         have *: "\<lbrakk>sum f I \<le> sum h I; a + sum h I \<le> b\<rbrakk> \<Longrightarrow> a + sum f I \<le> b" for I a b f and h :: "real\<Rightarrow>real"
           by linarith
         let ?h = "\<lambda>k. (2*k+1)/2 ^ Suc n *
                       (indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < ((2*k+1) + 1)/2 ^ Suc n} x)"
         show ?thesis
         proof (rule *)
           show "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
                   2 * k/2 ^ Suc n * indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < (2 * k+1 + 1)/2 ^ Suc n} x)
                 \<le> sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
             by (rule sum_mono) (simp add: indicator_def field_split_simps)
         next
           have \<alpha>: "?a = (\<Sum>k \<in> (*)2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                          k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             by (auto simp: inj_on_def field_simps comm_monoid_add_class.sum.reindex)
           have \<beta>: "sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}
                    = (\<Sum>k \<in> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                       k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             by (auto simp: inj_on_def field_simps comm_monoid_add_class.sum.reindex)
           have 0: "(*) 2 ` {k \<in> \<int>. P k} \<inter> (\<lambda>x. 2 * x + 1) ` {k \<in> \<int>. P k} = {}" for P :: "real \<Rightarrow> bool"
           proof -
             have "2 * i \<noteq> 2 * j + 1" for i j :: int by arith
             thus ?thesis
               unfolding Ints_def by auto (use of_int_eq_iff in fastforce)
           qed
           have "?a + sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}
                 = (\<Sum>k \<in> (*)2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                   k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             unfolding \<alpha> \<beta>
             using finite_abs_int_segment [of "2 ^ (2*n)"]
             by (subst sum_Un) (auto simp: 0)
           also have "\<dots> \<le> ?b"
           proof (rule sum_mono2)
             show "finite {k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)}"
               by (rule finite_abs_int_segment)
             show "(*) 2 ` {k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2^(2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2^(2*n)} \<subseteq> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)}"
               apply auto
               using one_le_power [of "2::real" "2*n"]  by linarith
             have *: "\<lbrakk>x \<in> (S \<union> T) - U; \<And>x. x \<in> S \<Longrightarrow> x \<in> U; \<And>x. x \<in> T \<Longrightarrow> x \<in> U\<rbrakk> \<Longrightarrow> P x" for S T U P
               by blast
             have "0 \<le> b" if "b \<in> \<int>" "f x * (2 * 2^n) < b + 1" for b
             proof -
               have "0 \<le> f x * (2 * 2^n)"
                 by (simp add: f)
               also have "\<dots> < b+1"
                 by (simp add: that)
               finally show "0 \<le> b"
                 using \<open>b \<in> \<int>\<close> by (auto simp: elim!: Ints_cases)
             qed
             then show "0 \<le> b/2 ^ Suc n * indicator {y. b/2 ^ Suc n \<le> f y \<and> f y < (b + 1)/2 ^ Suc n} x"
                   if "b \<in> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)} -
                           ((*) 2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})" for b
               using that by (simp add: indicator_def divide_simps)
           qed
           finally show "?a + sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<le> ?b" .
         qed
       qed
       finally show ?thesis .
     qed
     show "?g n \<in> borel_measurable lebesgue" for n
       apply (intro borel_measurable_indicator borel_measurable_times borel_measurable_sum)
       using leb_f sets_restrict_UNIV by auto
     show "finite (range (?g n))" for n
     proof -
       have "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x)
               \<in> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}" for x
       proof (cases "\<exists>k. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n) \<and> k/2^n \<le> f x \<and> f x < (k+1)/2^n")
         case True
         then show ?thesis
           by (blast intro: indicator_sum_eq)
       next
         case False
         then have "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) = 0"
           by auto
         then show ?thesis by force
       qed
       then have "range (?g n) \<subseteq> ((\<lambda>k. (k/2^n)) ` {k. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n)})"
         by auto
       moreover have "finite ((\<lambda>k::real. (k/2^n)) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})"
         by (intro finite_imageI finite_abs_int_segment)
       ultimately show ?thesis
         by (rule finite_subset)
     qed
     show "(\<lambda>n. ?g n x) \<longlonglongrightarrow> f x" for x
     proof (clarsimp simp add: lim_sequentially)
       fix e::real
       assume "e > 0"
       obtain N1 where N1: "2 ^ N1 > abs(f x)"
         using real_arch_pow by fastforce
       obtain N2 where N2: "(1/2) ^ N2 < e"
         using real_arch_pow_inv \<open>e > 0\<close> by fastforce
       have "dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) (f x) < e" if "N1 + N2 \<le> n" for n
       proof -
         let ?m = "real_of_int \<lfloor>2^n * f x\<rfloor>"
         have "\<bar>?m\<bar> \<le> 2^n * 2^N1"
           using N1 apply (simp add: f)
           by (meson floor_mono le_floor_iff less_le_not_le mult_le_cancel_left_pos zero_less_numeral zero_less_power)
         also have "\<dots> \<le> 2 ^ (2*n)"
           by (metis that add_leD1 add_le_cancel_left mult.commute mult_2_right one_less_numeral_iff
                     power_add power_increasing_iff semiring_norm(76))
         finally have m_le: "\<bar>?m\<bar> \<le> 2 ^ (2*n)" .
         have "?m/2^n \<le> f x" "f x < (?m + 1)/2^n"
           by (auto simp: mult.commute pos_divide_le_eq mult_imp_less_div_pos)
         then have eq: "dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) (f x)
                      = dist (?m/2^n) (f x)"
           by (subst indicator_sum_eq [of ?m]) (auto simp: m_le)
         have "\<bar>2^n\<bar> * \<bar>?m/2^n - f x\<bar> = \<bar>2^n * (?m/2^n - f x)\<bar>"
           by (simp add: abs_mult)
         also have "\<dots> < 2 ^ N2 * e"
           using N2 by (simp add: divide_simps mult.commute) linarith
         also have "\<dots> \<le> \<bar>2^n\<bar> * e"
           using that \<open>e > 0\<close> by auto
         finally have "dist (?m/2^n) (f x) < e"
           by (simp add: dist_norm)
         then show ?thesis
           using eq by linarith
       qed
       then show "\<exists>no. \<forall>n\<ge>no. dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k * ?\<Omega> n k x/2^n) (f x) < e"
         by force
     qed
   qed
   ultimately show ?rhs
     by metis
 next
   assume RHS: ?rhs
   with borel_measurable_simple_function_limit [of f UNIV, unfolded lebesgue_on_UNIV_eq]
   show ?lhs
     by (blast intro: order_trans)
 qed
 
 subsection\<open>Borel measurable Jacobian determinant\<close>
 
 lemma lemma_partial_derivatives0:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" and lim0: "((\<lambda>x. f x /\<^sub>R norm x) \<longlongrightarrow> 0) (at 0 within S)"
     and lb: "\<And>v. v \<noteq> 0 \<Longrightarrow> (\<exists>k>0. \<forall>e>0. \<exists>x. x \<in> S - {0} \<and> norm x < e \<and> k * norm x \<le> \<bar>v \<bullet> x\<bar>)"
   shows "f x = 0"
 proof -
   interpret linear f by fact
   have "dim {x. f x = 0} \<le> DIM('a)"
     by (rule dim_subset_UNIV)
   moreover have False if less: "dim {x. f x = 0} < DIM('a)"
   proof -
     obtain d where "d \<noteq> 0" and d: "\<And>y. f y = 0 \<Longrightarrow> d \<bullet> y = 0"
       using orthogonal_to_subspace_exists [OF less] orthogonal_def
       by (metis (mono_tags, lifting) mem_Collect_eq span_base)
     then obtain k where "k > 0"
       and k: "\<And>e. e > 0 \<Longrightarrow> \<exists>y. y \<in> S - {0} \<and> norm y < e \<and> k * norm y \<le> \<bar>d \<bullet> y\<bar>"
       using lb by blast
     have "\<exists>h. \<forall>n. ((h n \<in> S \<and> h n \<noteq> 0 \<and> k * norm (h n) \<le> \<bar>d \<bullet> h n\<bar>) \<and> norm (h n) < 1 / real (Suc n)) \<and>
                norm (h (Suc n)) < norm (h n)"
     proof (rule dependent_nat_choice)
       show "\<exists>y. (y \<in> S \<and> y \<noteq> 0 \<and> k * norm y \<le> \<bar>d \<bullet> y\<bar>) \<and> norm y < 1 / real (Suc 0)"
         by simp (metis DiffE insertCI k not_less not_one_le_zero)
     qed (use k [of "min (norm x) (1/(Suc n + 1))" for x n] in auto)
     then obtain \<alpha> where \<alpha>: "\<And>n. \<alpha> n \<in> S - {0}" and kd: "\<And>n. k * norm(\<alpha> n) \<le> \<bar>d \<bullet> \<alpha> n\<bar>"
          and norm_lt: "\<And>n. norm(\<alpha> n) < 1/(Suc n)"
       by force
     let ?\<beta> = "\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)"
     have com: "\<And>g. (\<forall>n. g n \<in> sphere (0::'a) 1)
               \<Longrightarrow> \<exists>l \<in> sphere 0 1. \<exists>\<rho>::nat\<Rightarrow>nat. strict_mono \<rho> \<and> (g \<circ> \<rho>) \<longlonglongrightarrow> l"
       using compact_sphere compact_def by metis
     moreover have "\<forall>n. ?\<beta> n \<in> sphere 0 1"
       using \<alpha> by auto
     ultimately obtain l::'a and \<rho>::"nat\<Rightarrow>nat"
        where l: "l \<in> sphere 0 1" and "strict_mono \<rho>" and to_l: "(?\<beta> \<circ> \<rho>) \<longlonglongrightarrow> l"
       by meson
     moreover have "continuous (at l) (\<lambda>x. (\<bar>d \<bullet> x\<bar> - k))"
       by (intro continuous_intros)
     ultimately have lim_dl: "((\<lambda>x. (\<bar>d \<bullet> x\<bar> - k)) \<circ> (?\<beta> \<circ> \<rho>)) \<longlonglongrightarrow> (\<bar>d \<bullet> l\<bar> - k)"
       by (meson continuous_imp_tendsto)
     have "\<forall>\<^sub>F i in sequentially. 0 \<le> ((\<lambda>x. \<bar>d \<bullet> x\<bar> - k) \<circ> ((\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>)) i"
       using \<alpha> kd by (auto simp: field_split_simps)
     then have "k \<le> \<bar>d \<bullet> l\<bar>"
       using tendsto_lowerbound [OF lim_dl, of 0] by auto
     moreover have "d \<bullet> l = 0"
     proof (rule d)
       show "f l = 0"
       proof (rule LIMSEQ_unique [of "f \<circ> ?\<beta> \<circ> \<rho>"])
         have "isCont f l"
           using \<open>linear f\<close> linear_continuous_at linear_conv_bounded_linear by blast
         then show "(f \<circ> (\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>) \<longlonglongrightarrow> f l"
           unfolding comp_assoc
           using to_l continuous_imp_tendsto by blast
         have "\<alpha> \<longlonglongrightarrow> 0"
           using norm_lt LIMSEQ_norm_0 by metis
         with \<open>strict_mono \<rho>\<close> have "(\<alpha> \<circ> \<rho>) \<longlonglongrightarrow> 0"
           by (metis LIMSEQ_subseq_LIMSEQ)
         with lim0 \<alpha> have "((\<lambda>x. f x /\<^sub>R norm x) \<circ> (\<alpha> \<circ> \<rho>)) \<longlonglongrightarrow> 0"
           by (force simp: tendsto_at_iff_sequentially)
         then show "(f \<circ> (\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>) \<longlonglongrightarrow> 0"
           by (simp add: o_def scale)
       qed
     qed
     ultimately show False
       using \<open>k > 0\<close> by auto
   qed
   ultimately have dim: "dim {x. f x = 0} = DIM('a)"
     by force
   then show ?thesis
     using dim_eq_full
     by (metis (mono_tags, lifting) eq_0_on_span eucl.span_Basis linear_axioms linear_eq_stdbasis
         mem_Collect_eq module_hom_zero span_base span_raw_def)
 qed
 
 lemma lemma_partial_derivatives:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" and lim: "((\<lambda>x. f (x - a) /\<^sub>R norm (x - a)) \<longlongrightarrow> 0) (at a within S)"
     and lb: "\<And>v. v \<noteq> 0 \<Longrightarrow> (\<exists>k>0.  \<forall>e>0. \<exists>x \<in> S - {a}. norm(a - x) < e \<and> k * norm(a - x) \<le> \<bar>v \<bullet> (x - a)\<bar>)"
   shows "f x = 0"
 proof -
   have "((\<lambda>x. f x /\<^sub>R norm x) \<longlongrightarrow> 0) (at 0 within (\<lambda>x. x-a) ` S)"
     using lim by (simp add: Lim_within dist_norm)
   then show ?thesis
   proof (rule lemma_partial_derivatives0 [OF \<open>linear f\<close>])
     fix v :: "'a"
     assume v: "v \<noteq> 0"
     show "\<exists>k>0. \<forall>e>0. \<exists>x. x \<in> (\<lambda>x. x - a) ` S - {0} \<and> norm x < e \<and> k * norm x \<le> \<bar>v \<bullet> x\<bar>"
       using lb [OF v] by (force simp:  norm_minus_commute)
   qed
 qed
 
 
 proposition borel_measurable_partial_derivatives:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n"
   assumes S: "S \<in> sets lebesgue"
     and f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "(\<lambda>x. (matrix(f' x)$m$n)) \<in> borel_measurable (lebesgue_on S)"
 proof -
   have contf: "continuous_on S f"
     using continuous_on_eq_continuous_within f has_derivative_continuous by blast
   have "{x \<in> S.  (matrix (f' x)$m$n) \<le> b} \<in> sets lebesgue" for b
   proof (rule sets_negligible_symdiff)
     let ?T = "{x \<in> S. \<forall>e>0. \<exists>d>0. \<exists>A. A$m$n < b \<and> (\<forall>i j. A$i$j \<in> \<rat>) \<and>
                        (\<forall>y \<in> S. norm(y - x) < d \<longrightarrow> norm(f y - f x - A *v (y - x)) \<le> e * norm(y - x))}"
     let ?U = "S \<inter>
               (\<Inter>e \<in> {e \<in> \<rat>. e > 0}.
                 \<Union>A \<in> {A. A$m$n < b \<and> (\<forall>i j. A$i$j \<in> \<rat>)}.
                   \<Union>d \<in> {d \<in> \<rat>. 0 < d}.
                      S \<inter> (\<Inter>y \<in> S. {x \<in> S. norm(y - x) < d \<longrightarrow> norm(f y - f x - A *v (y - x)) \<le> e * norm(y - x)}))"
     have "?T = ?U"
     proof (intro set_eqI iffI)
       fix x
       assume xT: "x \<in> ?T"
       then show "x \<in> ?U"
       proof (clarsimp simp add:)
         fix q :: real
         assume "q \<in> \<rat>" "q > 0"
         then obtain d A where "d > 0" and A: "A $ m $ n < b" "\<And>i j. A $ i $ j \<in> \<rat>"
           "\<And>y. \<lbrakk>y\<in>S;  norm (y - x) < d\<rbrakk> \<Longrightarrow> norm (f y - f x - A *v (y - x)) \<le> q * norm (y - x)"
           using xT by auto
         then obtain \<delta> where "d > \<delta>" "\<delta> > 0" "\<delta> \<in> \<rat>"
           using Rats_dense_in_real by blast
         with A show "\<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                          (\<exists>s. s \<in> \<rat> \<and> 0 < s \<and> (\<forall>y\<in>S. norm (y - x) < s \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> q * norm (y - x)))"
           by force
       qed
     next
       fix x
       assume xU: "x \<in> ?U"
       then show "x \<in> ?T"
       proof clarsimp
         fix e :: "real"
         assume "e > 0"
         then obtain \<epsilon> where \<epsilon>: "e > \<epsilon>" "\<epsilon> > 0" "\<epsilon> \<in> \<rat>"
           using Rats_dense_in_real by blast
         with xU obtain A r where "x \<in> S" and Ar: "A $ m $ n < b" "\<forall>i j. A $ i $ j \<in> \<rat>" "r \<in> \<rat>" "r > 0"
           and "\<forall>y\<in>S. norm (y - x) < r \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> \<epsilon> * norm (y - x)"
           by (auto simp: split: if_split_asm)
         then have "\<forall>y\<in>S. norm (y - x) < r \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)"
           by (meson \<open>e > \<epsilon>\<close> less_eq_real_def mult_right_mono norm_ge_zero order_trans)
         then show "\<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and> (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
           using \<open>x \<in> S\<close> Ar by blast
       qed
     qed
     moreover have "?U \<in> sets lebesgue"
     proof -
       have coQ: "countable {e \<in> \<rat>. 0 < e}"
         using countable_Collect countable_rat by blast
       have ne: "{e \<in> \<rat>. (0::real) < e} \<noteq> {}"
         using zero_less_one Rats_1 by blast
       have coA: "countable {A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>)}"
       proof (rule countable_subset)
         show "countable {A. \<forall>i j. A $ i $ j \<in> \<rat>}"
           using countable_vector [OF countable_vector, of "\<lambda>i j. \<rat>"] by (simp add: countable_rat)
       qed blast
       have *: "\<lbrakk>U \<noteq> {} \<Longrightarrow> closedin (top_of_set S) (S \<inter> \<Inter> U)\<rbrakk>
                \<Longrightarrow> closedin (top_of_set S) (S \<inter> \<Inter> U)" for U
         by fastforce
       have eq: "{x::(real,'m)vec. P x \<and> (Q x \<longrightarrow> R x)} = {x. P x \<and> \<not> Q x} \<union> {x. P x \<and> R x}" for P Q R
         by auto
       have sets: "S \<inter> (\<Inter>y\<in>S. {x \<in> S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)})
                   \<in> sets lebesgue" for e A d
       proof -
         have clo: "closedin (top_of_set S)
                      {x \<in> S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)}"
           for y
         proof -
           have cont1: "continuous_on S (\<lambda>x. norm (y - x))"
           and  cont2: "continuous_on S (\<lambda>x. e * norm (y - x) - norm (f y - f x - (A *v y - A *v x)))"
             by (force intro: contf continuous_intros)+
           have clo1: "closedin (top_of_set S) {x \<in> S. d \<le> norm (y - x)}"
             using continuous_closedin_preimage [OF cont1, of "{d..}"] by (simp add: vimage_def Int_def)
           have clo2: "closedin (top_of_set S)
                        {x \<in> S. norm (f y - f x - (A *v y - A *v x)) \<le> e * norm (y - x)}"
             using continuous_closedin_preimage [OF cont2, of "{0..}"] by (simp add: vimage_def Int_def)
           show ?thesis
             by (auto simp: eq not_less matrix_vector_mult_diff_distrib intro: clo1 clo2)
         qed
         show ?thesis
           by (rule lebesgue_closedin [of S]) (force intro: * S clo)+
       qed
       show ?thesis
         by (intro sets sets.Int S sets.countable_UN'' sets.countable_INT'' coQ coA) auto
     qed
     ultimately show "?T \<in> sets lebesgue"
       by simp
     let ?M = "(?T - {x \<in> S. matrix (f' x) $ m $ n \<le> b} \<union> ({x \<in> S. matrix (f' x) $ m $ n \<le> b} - ?T))"
     let ?\<Theta> = "\<lambda>x v. \<forall>\<xi>>0. \<exists>e>0. \<forall>y \<in> S-{x}. norm (x - y) < e \<longrightarrow> \<bar>v \<bullet> (y - x)\<bar> < \<xi> * norm (x - y)"
     have nN: "negligible {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
       unfolding negligible_eq_zero_density
     proof clarsimp
       fix x v and r e :: "real"
       assume "x \<in> S" "v \<noteq> 0" "r > 0" "e > 0"
       and Theta [rule_format]: "?\<Theta> x v"
       moreover have "(norm v * e / 2) / CARD('m) ^ CARD('m) > 0"
         by (simp add: \<open>v \<noteq> 0\<close> \<open>e > 0\<close>)
       ultimately obtain d where "d > 0"
          and dless: "\<And>y. \<lbrakk>y \<in> S - {x}; norm (x - y) < d\<rbrakk> \<Longrightarrow>
                         \<bar>v \<bullet> (y - x)\<bar> < ((norm v * e / 2) / CARD('m) ^ CARD('m)) * norm (x - y)"
         by metis
       let ?W = "ball x (min d r) \<inter> {y. \<bar>v \<bullet> (y - x)\<bar> < (norm v * e/2 * min d r) / CARD('m) ^ CARD('m)}"
       have "open {x. \<bar>v \<bullet> (x - a)\<bar> < b}" for a b
         by (intro open_Collect_less continuous_intros)
       show "\<exists>d>0. d \<le> r \<and>
             (\<exists>U. {x' \<in> S. \<exists>v\<noteq>0. ?\<Theta> x' v} \<inter> ball x d \<subseteq> U \<and>
                  U \<in> lmeasurable \<and> measure lebesgue U < e * content (ball x d))"
       proof (intro exI conjI)
         show "0 < min d r" "min d r \<le> r"
           using \<open>r > 0\<close> \<open>d > 0\<close> by auto
         show "{x' \<in> S. \<exists>v. v \<noteq> 0 \<and> (\<forall>\<xi>>0. \<exists>e>0. \<forall>z\<in>S - {x'}. norm (x' - z) < e \<longrightarrow> \<bar>v \<bullet> (z - x')\<bar> < \<xi> * norm (x' - z))} \<inter> ball x (min d r) \<subseteq> ?W"
           proof (clarsimp simp: dist_norm norm_minus_commute)
             fix y w
             assume "y \<in> S" "w \<noteq> 0"
               and less [rule_format]:
                     "\<forall>\<xi>>0. \<exists>e>0. \<forall>z\<in>S - {y}. norm (y - z) < e \<longrightarrow> \<bar>w \<bullet> (z - y)\<bar> < \<xi> * norm (y - z)"
               and d: "norm (y - x) < d" and r: "norm (y - x) < r"
             show "\<bar>v \<bullet> (y - x)\<bar> < norm v * e * min d r / (2 * real CARD('m) ^ CARD('m))"
             proof (cases "y = x")
               case True
               with \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> \<open>v \<noteq> 0\<close> show ?thesis
                 by simp
             next
               case False
               have "\<bar>v \<bullet> (y - x)\<bar> < norm v * e / 2 / real (CARD('m) ^ CARD('m)) * norm (x - y)"
                 apply (rule dless)
                 using False \<open>y \<in> S\<close> d by (auto simp: norm_minus_commute)
               also have "\<dots> \<le> norm v * e * min d r / (2 * real CARD('m) ^ CARD('m))"
                 using d r \<open>e > 0\<close> by (simp add: field_simps norm_minus_commute mult_left_mono)
               finally show ?thesis .
             qed
           qed
           show "?W \<in> lmeasurable"
             by (simp add: fmeasurable_Int_fmeasurable borel_open)
           obtain k::'m where True
             by metis
           obtain T where T: "orthogonal_transformation T" and v: "v = T(norm v *\<^sub>R axis k (1::real))"
             using rotation_rightward_line by metis
           define b where "b \<equiv> norm v"
           have "b > 0"
             using \<open>v \<noteq> 0\<close> by (auto simp: b_def)
           obtain eqb: "inv T v = b *\<^sub>R axis k (1::real)" and "inj T" "bij T" and invT: "orthogonal_transformation (inv T)"
             by (metis UNIV_I b_def  T v bij_betw_inv_into_left orthogonal_transformation_inj orthogonal_transformation_bij orthogonal_transformation_inv)
           let ?v = "\<chi> i. min d r / CARD('m)"
           let ?v' = "\<chi> i. if i = k then (e/2 * min d r) / CARD('m) ^ CARD('m) else min d r"
           let ?x' = "inv T x"
           let ?W' = "(ball ?x' (min d r) \<inter> {y. \<bar>(y - ?x')$k\<bar> < e * min d r / (2 * CARD('m) ^ CARD('m))})"
           have abs: "x - e \<le> y \<and> y \<le> x + e \<longleftrightarrow> abs(y - x) \<le> e" for x y e::real
             by auto
           have "?W = T ` ?W'"
           proof -
             have 1: "T ` (ball (inv T x) (min d r)) = ball x (min d r)"
               by (simp add: T image_orthogonal_transformation_ball orthogonal_transformation_surj surj_f_inv_f)
             have 2: "{y. \<bar>v \<bullet> (y - x)\<bar> < b * e * min d r / (2 * real CARD('m) ^ CARD('m))} =
                       T ` {y. \<bar>y $ k - ?x' $ k\<bar> < e * min d r / (2 * real CARD('m) ^ CARD('m))}"
             proof -
               have *: "\<bar>T (b *\<^sub>R axis k 1) \<bullet> (y - x)\<bar> = b * \<bar>inv T y $ k - ?x' $ k\<bar>" for y
               proof -
                 have "\<bar>T (b *\<^sub>R axis k 1) \<bullet> (y - x)\<bar> = \<bar>(b *\<^sub>R axis k 1) \<bullet> inv T (y - x)\<bar>"
                   by (metis (no_types, opaque_lifting) b_def eqb invT orthogonal_transformation_def v)
                 also have "\<dots> = b * \<bar>(axis k 1) \<bullet> inv T (y - x)\<bar>"
                   using \<open>b > 0\<close> by (simp add: abs_mult)
                 also have "\<dots> = b * \<bar>inv T y $ k - ?x' $ k\<bar>"
                   using orthogonal_transformation_linear [OF invT]
                   by (simp add: inner_axis' linear_diff)
                 finally show ?thesis
                   by simp
               qed
               show ?thesis
                 using v b_def [symmetric]
                 using \<open>b > 0\<close> by (simp add: * bij_image_Collect_eq [OF \<open>bij T\<close>] mult_less_cancel_left_pos times_divide_eq_right [symmetric] del: times_divide_eq_right)
             qed
             show ?thesis
               using \<open>b > 0\<close> by (simp add: image_Int \<open>inj T\<close> 1 2 b_def [symmetric])
           qed
           moreover have "?W' \<in> lmeasurable"
             by (auto intro: fmeasurable_Int_fmeasurable)
           ultimately have "measure lebesgue ?W = measure lebesgue ?W'"
             by (metis measure_orthogonal_image T)
           also have "\<dots> \<le> measure lebesgue (cbox (?x' - ?v') (?x' + ?v'))"
           proof (rule measure_mono_fmeasurable)
             show "?W' \<subseteq> cbox (?x' - ?v') (?x' + ?v')"
               apply (clarsimp simp add: mem_box_cart abs dist_norm norm_minus_commute simp del: min_less_iff_conj min.bounded_iff)
               by (metis component_le_norm_cart less_eq_real_def le_less_trans vector_minus_component)
           qed auto
           also have "\<dots> \<le> e/2 * measure lebesgue (cbox (?x' - ?v) (?x' + ?v))"
           proof -
             have "cbox (?x' - ?v) (?x' + ?v) \<noteq> {}"
               using \<open>r > 0\<close> \<open>d > 0\<close> by (auto simp: interval_eq_empty_cart divide_less_0_iff)
             with \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> show ?thesis
               apply (simp add: content_cbox_if_cart mem_box_cart)
               apply (auto simp: prod_nonneg)
               apply (simp add: abs if_distrib prod.delta_remove field_simps power_diff split: if_split_asm)
               done
           qed
           also have "\<dots> \<le> e/2 * measure lebesgue (cball ?x' (min d r))"
           proof (rule mult_left_mono [OF measure_mono_fmeasurable])
             have *: "norm (?x' - y) \<le> min d r"
               if y: "\<And>i. \<bar>?x' $ i - y $ i\<bar> \<le> min d r / real CARD('m)" for y
             proof -
               have "norm (?x' - y) \<le> (\<Sum>i\<in>UNIV. \<bar>(?x' - y) $ i\<bar>)"
                 by (rule norm_le_l1_cart)
               also have "\<dots> \<le> real CARD('m) * (min d r / real CARD('m))"
                 by (rule sum_bounded_above) (use y in auto)
               finally show ?thesis
                 by simp
             qed
             show "cbox (?x' - ?v) (?x' + ?v) \<subseteq> cball ?x' (min d r)"
               apply (clarsimp simp only: mem_box_cart dist_norm mem_cball intro!: *)
               by (simp add: abs_diff_le_iff abs_minus_commute)
           qed (use \<open>e > 0\<close> in auto)
           also have "\<dots> < e * content (cball ?x' (min d r))"
             using \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> by (auto intro: content_cball_pos)
           also have "\<dots> = e * content (ball x (min d r))"
             using \<open>r > 0\<close> \<open>d > 0\<close> content_ball_conv_unit_ball[of "min d r" "inv T x"]
                   content_ball_conv_unit_ball[of "min d r" x]
             by (simp add: content_cball_conv_ball)
           finally show "measure lebesgue ?W < e * content (ball x (min d r))" .
       qed
     qed
     have *: "(\<And>x. (x \<notin> S) \<Longrightarrow> (x \<in> T \<longleftrightarrow> x \<in> U)) \<Longrightarrow> (T - U) \<union> (U - T) \<subseteq> S" for S T U :: "(real,'m) vec set"
       by blast
     have MN: "?M \<subseteq> {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
     proof (rule *)
       fix x
       assume x: "x \<notin> {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
       show "(x \<in> ?T) \<longleftrightarrow> (x \<in> {x \<in> S. matrix (f' x) $ m $ n \<le> b})"
       proof (cases "x \<in> S")
         case True
         then have x: "\<not> ?\<Theta> x v" if "v \<noteq> 0" for v
           using x that by force
         show ?thesis
         proof (rule iffI; clarsimp)
           assume b: "\<forall>e>0. \<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                                     (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
                      (is "\<forall>e>0. \<exists>d>0. \<exists>A. ?\<Phi> e d A")
           then have "\<forall>k. \<exists>d>0. \<exists>A. ?\<Phi> (1 / Suc k) d A"
             by (metis (no_types, opaque_lifting) less_Suc_eq_0_disj of_nat_0_less_iff zero_less_divide_1_iff)
           then obtain \<delta> A where \<delta>: "\<And>k. \<delta> k > 0"
                            and Ab: "\<And>k. A k $ m $ n < b"
                            and A: "\<And>k y. \<lbrakk>y \<in> S; norm (y - x) < \<delta> k\<rbrakk> \<Longrightarrow>
                                           norm (f y - f x - A k *v (y - x)) \<le> 1/(Suc k) * norm (y - x)"
             by metis
           have "\<forall>i j. \<exists>a. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> a"
           proof (intro allI)
             fix i j
             have vax: "(A n *v axis j 1) $ i = A n $ i $ j" for n
               by (metis cart_eq_inner_axis matrix_vector_mul_component)
             let ?CA = "{x. Cauchy (\<lambda>n. (A n) *v x)}"
             have "subspace ?CA"
               unfolding subspace_def convergent_eq_Cauchy [symmetric]
                 by (force simp: algebra_simps intro: tendsto_intros)
             then have CA_eq: "?CA = span ?CA"
               by (metis span_eq_iff)
             also have "\<dots> = UNIV"
             proof -
               have "dim ?CA \<le> CARD('m)"
                 using dim_subset_UNIV[of ?CA]
                 by auto
               moreover have "False" if less: "dim ?CA < CARD('m)"
               proof -
                 obtain d where "d \<noteq> 0" and d: "\<And>y. y \<in> span ?CA \<Longrightarrow> orthogonal d y"
                   using less by (force intro: orthogonal_to_subspace_exists [of ?CA])
                 with x [OF \<open>d \<noteq> 0\<close>] obtain \<xi> where "\<xi> > 0"
                   and \<xi>: "\<And>e. e > 0 \<Longrightarrow> \<exists>y \<in> S - {x}. norm (x - y) < e \<and> \<xi> * norm (x - y) \<le> \<bar>d \<bullet> (y - x)\<bar>"
                   by (fastforce simp: not_le Bex_def)
                 obtain \<gamma> z where \<gamma>Sx: "\<And>i. \<gamma> i \<in> S - {x}"
                            and \<gamma>le:   "\<And>i. \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar>"
                            and \<gamma>x:    "\<gamma> \<longlonglongrightarrow> x"
                            and z:     "(\<lambda>n. (\<gamma> n - x) /\<^sub>R norm (\<gamma> n - x)) \<longlonglongrightarrow> z"
                 proof -
                   have "\<exists>\<gamma>. (\<forall>i. (\<gamma> i \<in> S - {x} \<and>
                                   \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar> \<and> norm(\<gamma> i - x) < 1/Suc i) \<and>
                                  norm(\<gamma>(Suc i) - x) < norm(\<gamma> i - x))"
                   proof (rule dependent_nat_choice)
                     show "\<exists>y. y \<in> S - {x} \<and> \<xi> * norm (y - x) \<le> \<bar>d \<bullet> (y - x)\<bar> \<and> norm (y - x) < 1 / Suc 0"
                       using \<xi> [of 1] by (auto simp: dist_norm norm_minus_commute)
                   next
                     fix y i
                     assume "y \<in> S - {x} \<and> \<xi> * norm (y - x) \<le> \<bar>d \<bullet> (y - x)\<bar> \<and> norm (y - x) < 1/Suc i"
                     then have "min (norm(y - x)) (1/((Suc i) + 1)) > 0"
                       by auto
                     then obtain y' where "y' \<in> S - {x}" and y': "norm (x - y') < min (norm (y - x)) (1/((Suc i) + 1))"
                                          "\<xi> * norm (x - y') \<le> \<bar>d \<bullet> (y' - x)\<bar>"
                       using \<xi> by metis
                     with \<xi> show "\<exists>y'. (y' \<in> S - {x} \<and> \<xi> * norm (y' - x) \<le> \<bar>d \<bullet> (y' - x)\<bar> \<and>
                               norm (y' - x) < 1/(Suc (Suc i))) \<and> norm (y' - x) < norm (y - x)"
                       by (auto simp: dist_norm norm_minus_commute)
                   qed
                   then obtain \<gamma> where
                         \<gamma>Sx: "\<And>i. \<gamma> i \<in> S - {x}"
                         and \<gamma>le: "\<And>i. \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar>"
                         and \<gamma>conv: "\<And>i. norm(\<gamma> i - x) < 1/(Suc i)"
                     by blast
                   let ?f = "\<lambda>i. (\<gamma> i - x) /\<^sub>R norm (\<gamma> i - x)"
                   have "?f i \<in> sphere 0 1" for i
                     using \<gamma>Sx by auto
                   then obtain l \<rho> where "l \<in> sphere 0 1" "strict_mono \<rho>" and l: "(?f \<circ> \<rho>) \<longlonglongrightarrow> l"
                     using compact_sphere [of "0::(real,'m) vec" 1]  unfolding compact_def by meson
                   show thesis
                   proof
                     show "(\<gamma> \<circ> \<rho>) i \<in> S - {x}" "\<xi> * norm ((\<gamma> \<circ> \<rho>) i - x) \<le> \<bar>d \<bullet> ((\<gamma> \<circ> \<rho>) i - x)\<bar>" for i
                       using \<gamma>Sx \<gamma>le by auto
                     have "\<gamma> \<longlonglongrightarrow> x"
                     proof (clarsimp simp add: LIMSEQ_def dist_norm)
                       fix r :: "real"
                       assume "r > 0"
                       with real_arch_invD obtain no where "no \<noteq> 0" "real no > 1/r"
                         by (metis divide_less_0_1_iff not_less_iff_gr_or_eq of_nat_0_eq_iff reals_Archimedean2)
                       with \<gamma>conv show "\<exists>no. \<forall>n\<ge>no. norm (\<gamma> n - x) < r"
                         by (metis \<open>r > 0\<close> add.commute divide_inverse inverse_inverse_eq inverse_less_imp_less less_trans mult.left_neutral nat_le_real_less of_nat_Suc)
                     qed
                     with \<open>strict_mono \<rho>\<close> show "(\<gamma> \<circ> \<rho>) \<longlonglongrightarrow> x"
                       by (metis LIMSEQ_subseq_LIMSEQ)
                     show "(\<lambda>n. ((\<gamma> \<circ> \<rho>) n - x) /\<^sub>R norm ((\<gamma> \<circ> \<rho>) n - x)) \<longlonglongrightarrow> l"
                       using l by (auto simp: o_def)
                   qed
                 qed
                 have "isCont (\<lambda>x. (\<bar>d \<bullet> x\<bar> - \<xi>)) z"
                   by (intro continuous_intros)
                 from isCont_tendsto_compose [OF this z]
                 have lim: "(\<lambda>y. \<bar>d \<bullet> ((\<gamma> y - x) /\<^sub>R norm (\<gamma> y - x))\<bar> - \<xi>) \<longlonglongrightarrow> \<bar>d \<bullet> z\<bar> - \<xi>"
                   by auto
                 moreover have "\<forall>\<^sub>F i in sequentially. 0 \<le> \<bar>d \<bullet> ((\<gamma> i - x) /\<^sub>R norm (\<gamma> i - x))\<bar> - \<xi>"
                 proof (rule eventuallyI)
                   fix n
                   show "0 \<le> \<bar>d \<bullet> ((\<gamma> n - x) /\<^sub>R norm (\<gamma> n - x))\<bar> - \<xi>"
                   using \<gamma>le [of n] \<gamma>Sx by (auto simp: abs_mult divide_simps)
                 qed
                 ultimately have "\<xi> \<le> \<bar>d \<bullet> z\<bar>"
                   using tendsto_lowerbound [where a=0] by fastforce
                 have "Cauchy (\<lambda>n. (A n) *v z)"
                 proof (clarsimp simp add: Cauchy_def)
                   fix \<epsilon> :: "real"
                   assume "0 < \<epsilon>"
                   then obtain N::nat where "N > 0" and N: "\<epsilon>/2 > 1/N"
                     by (metis half_gt_zero inverse_eq_divide neq0_conv real_arch_inverse)
                   show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (A m *v z) (A n *v z) < \<epsilon>"
                   proof (intro exI allI impI)
                     fix i j
                     assume ij: "N \<le> i" "N \<le> j"
                     let ?V = "\<lambda>i k. A i *v ((\<gamma> k - x) /\<^sub>R norm (\<gamma> k - x))"
                     have "\<forall>\<^sub>F k in sequentially. dist (\<gamma> k) x < min (\<delta> i) (\<delta> j)"
                       using \<gamma>x [unfolded tendsto_iff] by (meson min_less_iff_conj \<delta>)
                     then have even: "\<forall>\<^sub>F k in sequentially. norm (?V i k - ?V j k) - 2 / N \<le> 0"
                     proof (rule eventually_mono, clarsimp)
                       fix p
                       assume p: "dist (\<gamma> p) x < \<delta> i" "dist (\<gamma> p) x < \<delta> j"
                       let ?C = "\<lambda>k. f (\<gamma> p) - f x - A k *v (\<gamma> p - x)"
                       have "norm ((A i - A j) *v (\<gamma> p - x)) = norm (?C j - ?C i)"
                         by (simp add: algebra_simps)
                       also have "\<dots> \<le> norm (?C j) + norm (?C i)"
                         using norm_triangle_ineq4 by blast
                       also have "\<dots> \<le> 1/(Suc j) * norm (\<gamma> p - x) + 1/(Suc i) * norm (\<gamma> p - x)"
                         by (metis A Diff_iff \<gamma>Sx dist_norm p add_mono)
                       also have "\<dots> \<le> 1/N * norm (\<gamma> p - x) + 1/N * norm (\<gamma> p - x)"
                         apply (intro add_mono mult_right_mono)
                         using ij \<open>N > 0\<close> by (auto simp: field_simps)
                       also have "\<dots> = 2 / N * norm (\<gamma> p - x)"
                         by simp
                       finally have no_le: "norm ((A i - A j) *v (\<gamma> p - x)) \<le> 2 / N * norm (\<gamma> p - x)" .
                       have "norm (?V i p - ?V j p) =
                             norm ((A i - A j) *v ((\<gamma> p - x) /\<^sub>R norm (\<gamma> p - x)))"
                         by (simp add: algebra_simps)
                       also have "\<dots> = norm ((A i - A j) *v (\<gamma> p - x)) / norm (\<gamma> p - x)"
                         by (simp add: divide_inverse matrix_vector_mult_scaleR)
                       also have "\<dots> \<le> 2 / N"
                         using no_le by (auto simp: field_split_simps)
                       finally show "norm (?V i p - ?V j p) \<le> 2 / N" .
                     qed
                     have "isCont (\<lambda>w. (norm(A i *v w - A j *v w) - 2 / N)) z"
                       by (intro continuous_intros)
                     from isCont_tendsto_compose [OF this z]
                     have lim: "(\<lambda>w. norm (A i *v ((\<gamma> w - x) /\<^sub>R norm (\<gamma> w - x)) -
                                     A j *v ((\<gamma> w - x) /\<^sub>R norm (\<gamma> w - x))) - 2 / N)
                                \<longlonglongrightarrow> norm (A i *v z - A j *v z) - 2 / N"
                       by auto
                     have "dist (A i *v z) (A j *v z) \<le> 2 / N"
                       using tendsto_upperbound [OF lim even] by (auto simp: dist_norm)
                     with N show "dist (A i *v z) (A j *v z) < \<epsilon>"
                       by linarith
                   qed
                 qed
                 then have "d \<bullet> z = 0"
                   using CA_eq d orthogonal_def by auto
                 then show False
                   using \<open>0 < \<xi>\<close> \<open>\<xi> \<le> \<bar>d \<bullet> z\<bar>\<close> by auto
               qed
               ultimately show ?thesis
                 using dim_eq_full by fastforce
             qed
             finally have "?CA = UNIV" .
             then have "Cauchy (\<lambda>n. (A n) *v axis j 1)"
               by auto
             then obtain L where "(\<lambda>n. A n *v axis j 1) \<longlonglongrightarrow> L"
               by (auto simp: Cauchy_convergent_iff convergent_def)
             then have "(\<lambda>x. (A x *v axis j 1) $ i) \<longlonglongrightarrow> L $ i"
               by (rule tendsto_vec_nth)
             then show "\<exists>a. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> a"
               by (force simp: vax)
           qed
           then obtain B where B: "\<And>i j. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> B $ i $ j"
             by (auto simp: lambda_skolem)
           have lin_df: "linear (f' x)"
                and lim_df: "((\<lambda>y. (1 / norm (y - x)) *\<^sub>R (f y - (f x + f' x (y - x)))) \<longlongrightarrow> 0) (at x within S)"
             using \<open>x \<in> S\<close> assms by (auto simp: has_derivative_within linear_linear)
           moreover
           interpret linear "f' x" by fact
           have "(matrix (f' x) - B) *v w = 0" for w
           proof (rule lemma_partial_derivatives [of "(*v) (matrix (f' x) - B)"])
             show "linear ((*v) (matrix (f' x) - B))"
               by (rule matrix_vector_mul_linear)
             have "((\<lambda>y. ((f x + f' x (y - x)) - f y) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
               using tendsto_minus [OF lim_df] by (simp add: field_split_simps)
             then show "((\<lambda>y. (matrix (f' x) - B) *v (y - x) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
             proof (rule Lim_transform)
               have "((\<lambda>y. ((f y + B *v x - (f x + B *v y)) /\<^sub>R norm (y - x))) \<longlongrightarrow> 0) (at x within S)"
               proof (clarsimp simp add: Lim_within dist_norm)
                 fix e :: "real"
                 assume "e > 0"
                 then obtain q::nat where "q \<noteq> 0" and qe2: "1/q < e/2"
                   by (metis divide_pos_pos inverse_eq_divide real_arch_inverse zero_less_numeral)
                 let ?g = "\<lambda>p. sum  (\<lambda>i. sum (\<lambda>j. abs((A p - B)$i$j)) UNIV) UNIV"
                 have "(\<lambda>k. onorm (\<lambda>y. (A k - B) *v y)) \<longlonglongrightarrow> 0"
                 proof (rule Lim_null_comparison)
                   show "\<forall>\<^sub>F k in sequentially. norm (onorm (\<lambda>y. (A k - B) *v y)) \<le> ?g k"
                   proof (rule eventually_sequentiallyI)
                     fix k :: "nat"
                     assume "0 \<le> k"
                     have "0 \<le> onorm ((*v) (A k - B))"
                       using matrix_vector_mul_bounded_linear
                       by (rule onorm_pos_le)
                     then show "norm (onorm ((*v) (A k - B))) \<le> (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. \<bar>(A k - B) $ i $ j\<bar>)"
                       by (simp add: onorm_le_matrix_component_sum del: vector_minus_component)
                   qed
                 next
                   show "?g \<longlonglongrightarrow> 0"
                     using B Lim_null tendsto_rabs_zero_iff by (fastforce intro!: tendsto_null_sum)
                 qed
                 with \<open>e > 0\<close> obtain p where "\<And>n. n \<ge> p \<Longrightarrow> \<bar>onorm ((*v) (A n - B))\<bar> < e/2"
                   unfolding lim_sequentially by (metis diff_zero dist_real_def divide_pos_pos zero_less_numeral)
                 then have pqe2: "\<bar>onorm ((*v) (A (p + q) - B))\<bar> < e/2" (*17 [`abs (onorm (\y. A (p + q) ** y - B ** y)) < e / &2`]*)
                   using le_add1 by blast
                 show "\<exists>d>0. \<forall>y\<in>S. y \<noteq> x \<and> norm (y - x) < d \<longrightarrow>
                            inverse (norm (y - x)) * norm (f y + B *v x - (f x + B *v y)) < e"
                 proof (intro exI, safe)
                   show "0 < \<delta>(p + q)"
                     by (simp add: \<delta>)
                 next
                   fix y
                   assume y: "y \<in> S" "norm (y - x) < \<delta>(p + q)" and "y \<noteq> x"
                   have *: "\<lbrakk>norm(b - c) < e - d; norm(y - x - b) \<le> d\<rbrakk> \<Longrightarrow> norm(y - x - c) < e"
                     for b c d e x and y:: "real^'n"
                     using norm_triangle_ineq2 [of "y - x - c" "y - x - b"] by simp
                   have "norm (f y - f x - B *v (y - x)) < e * norm (y - x)"
                   proof (rule *)
                     show "norm (f y - f x - A (p + q) *v (y - x)) \<le> norm (y - x) / (Suc (p + q))"
                       using A [OF y] by simp
                     have "norm (A (p + q) *v (y - x) - B *v (y - x)) \<le> onorm(\<lambda>x. (A(p + q) - B) *v x) * norm(y - x)"
                       by (metis linear_linear matrix_vector_mul_linear matrix_vector_mult_diff_rdistrib onorm)
                     also have "\<dots> < (e/2) * norm (y - x)"
                       using \<open>y \<noteq> x\<close> pqe2 by auto
                     also have "\<dots> \<le> (e - 1 / (Suc (p + q))) * norm (y - x)"
                     proof (rule mult_right_mono)
                       have "1 / Suc (p + q) \<le> 1 / q"
                         using \<open>q \<noteq> 0\<close> by (auto simp: field_split_simps)
                       also have "\<dots> < e/2"
                         using qe2 by auto
                       finally show "e / 2 \<le> e - 1 / real (Suc (p + q))"
                         by linarith
                     qed auto
                     finally show "norm (A (p + q) *v (y - x) - B *v (y - x)) < e * norm (y - x) - norm (y - x) / real (Suc (p + q))"
                       by (simp add: algebra_simps)
                   qed
                   then show "inverse (norm (y - x)) * norm (f y + B *v x - (f x + B *v y)) < e"
                     using \<open>y \<noteq> x\<close> by (simp add: field_split_simps algebra_simps)
                 qed
               qed
               then show "((\<lambda>y. (matrix (f' x) - B) *v (y - x) /\<^sub>R
                            norm (y - x) - (f x + f' x (y - x) - f y) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0)
                           (at x within S)"
                 by (simp add: algebra_simps diff lin_df scalar_mult_eq_scaleR)
             qed
           qed (use x in \<open>simp; auto simp: not_less\<close>)
           ultimately have "f' x = (*v) B"
             by (force simp: algebra_simps scalar_mult_eq_scaleR)
           show "matrix (f' x) $ m $ n \<le> b"
           proof (rule tendsto_upperbound [of "\<lambda>i. (A i $ m $ n)" _ sequentially])
             show "(\<lambda>i. A i $ m $ n) \<longlonglongrightarrow> matrix (f' x) $ m $ n"
               by (simp add: B \<open>f' x = (*v) B\<close>)
             show "\<forall>\<^sub>F i in sequentially. A i $ m $ n \<le> b"
               by (simp add: Ab less_eq_real_def)
           qed auto
         next
           fix e :: "real"
           assume "x \<in> S" and b: "matrix (f' x) $ m $ n \<le> b" and "e > 0"
           then obtain d where "d>0"
             and d: "\<And>y. y\<in>S \<Longrightarrow> 0 < dist y x \<and> dist y x < d \<longrightarrow> norm (f y - f x - f' x (y - x)) / (norm (y - x))
                   < e/2"
             using f [OF \<open>x \<in> S\<close>]
             by (simp add: Deriv.has_derivative_at_within Lim_within)
               (auto simp add: field_simps dest: spec [of _ "e/2"])
           let ?A = "matrix(f' x) - (\<chi> i j. if i = m \<and> j = n then e / 4 else 0)"
           obtain B where BRats: "\<And>i j. B$i$j \<in> \<rat>" and Bo_e6: "onorm((*v) (?A - B)) < e/6"
             using matrix_rational_approximation \<open>e > 0\<close>
             by (metis zero_less_divide_iff zero_less_numeral)
           show "\<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                 (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
           proof (intro exI conjI ballI allI impI)
             show "d>0"
               by (rule \<open>d>0\<close>)
             show "B $ m $ n < b"
             proof -
               have "\<bar>matrix ((*v) (?A - B)) $ m $ n\<bar> \<le> onorm ((*v) (?A - B))"
                 using component_le_onorm [OF matrix_vector_mul_linear, of _ m n] by metis
               then show ?thesis
                 using b Bo_e6 by simp
             qed
             show "B $ i $ j \<in> \<rat>" for i j
               using BRats by auto
             show "norm (f y - f x - B *v (y - x)) \<le> e * norm (y - x)"
               if "y \<in> S" and y: "norm (y - x) < d" for y
             proof (cases "y = x")
               case True then show ?thesis
                 by simp
             next
               case False
               have *: "norm(d' - d) \<le> e/2 \<Longrightarrow> norm(y - (x + d')) < e/2 \<Longrightarrow> norm(y - x - d) \<le> e" for d d' e and x y::"real^'n"
                 using norm_triangle_le [of "d' - d" "y - (x + d')"] by simp
               show ?thesis
               proof (rule *)
                 have split246: "\<lbrakk>norm y \<le> e / 6; norm(x - y) \<le> e / 4\<rbrakk> \<Longrightarrow> norm x \<le> e/2" if "e > 0" for e and x y :: "real^'n"
                   using norm_triangle_le [of y "x-y" "e/2"] \<open>e > 0\<close> by simp
                 have "linear (f' x)"
                   using True f has_derivative_linear by blast
                 then have "norm (f' x (y - x) - B *v (y - x)) = norm ((matrix (f' x) - B) *v (y - x))"
                   by (simp add: matrix_vector_mult_diff_rdistrib)
                 also have "\<dots> \<le> (e * norm (y - x)) / 2"
                 proof (rule split246)
                   have "norm ((?A - B) *v (y - x)) / norm (y - x) \<le> onorm(\<lambda>x. (?A - B) *v x)"
                     by (rule le_onorm) auto
                   also have  "\<dots> < e/6"
                     by (rule Bo_e6)
                   finally have "norm ((?A - B) *v (y - x)) / norm (y - x) < e / 6" .
                   then show "norm ((?A - B) *v (y - x)) \<le> e * norm (y - x) / 6"
                     by (simp add: field_split_simps False)
                   have "norm ((matrix (f' x) - B) *v (y - x) - ((?A - B) *v (y - x))) = norm ((\<chi> i j. if i = m \<and> j = n then e / 4 else 0) *v (y - x))"
                     by (simp add: algebra_simps)
                   also have "\<dots> = norm((e/4) *\<^sub>R (y - x)$n *\<^sub>R axis m (1::real))"
                   proof -
                     have "(\<Sum>j\<in>UNIV. (if i = m \<and> j = n then e / 4 else 0) * (y $ j - x $ j)) * 4 = e * (y $ n - x $ n) * axis m 1 $ i" for i
                     proof (cases "i=m")
                       case True then show ?thesis
                         by (auto simp: if_distrib [of "\<lambda>z. z * _"] cong: if_cong)
                     next
                       case False then show ?thesis
                         by (simp add: axis_def)
                     qed
                     then have "(\<chi> i j. if i = m \<and> j = n then e / 4 else 0) *v (y - x) = (e/4) *\<^sub>R (y - x)$n *\<^sub>R axis m (1::real)"
                       by (auto simp: vec_eq_iff matrix_vector_mult_def)
                     then show ?thesis
                       by metis
                   qed
                   also have "\<dots> \<le> e * norm (y - x) / 4"
                     using \<open>e > 0\<close> apply (simp add: norm_mult abs_mult)
                     by (metis component_le_norm_cart vector_minus_component)
                   finally show "norm ((matrix (f' x) - B) *v (y - x) - ((?A - B) *v (y - x))) \<le> e * norm (y - x) / 4" .
                   show "0 < e * norm (y - x)"
                     by (simp add: False \<open>e > 0\<close>)
                 qed
                 finally show "norm (f' x (y - x) - B *v (y - x)) \<le> (e * norm (y - x)) / 2" .
                 show "norm (f y - (f x + f' x (y - x))) < (e * norm (y - x)) / 2"
                   using False d [OF \<open>y \<in> S\<close>] y by (simp add: dist_norm field_simps)
               qed
             qed
           qed
         qed
       qed auto
     qed
     show "negligible ?M"
       using negligible_subset [OF nN MN] .
   qed
   then show ?thesis
     by (simp add: borel_measurable_vimage_halfspace_component_le sets_restrict_space_iff assms)
 qed
 
 
 theorem borel_measurable_det_Jacobian:
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue" and f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "(\<lambda>x. det(matrix(f' x))) \<in> borel_measurable (lebesgue_on S)"
   unfolding det_def
   by (intro measurable) (auto intro: f borel_measurable_partial_derivatives [OF S])
 
 text\<open>The localisation wrt S uses the same argument for many similar results.\<close>
 (*See HOL Light's MEASURABLE_ON_LEBESGUE_MEASURABLE_PREIMAGE_BOREL, etc.*)
 theorem borel_measurable_lebesgue_on_preimage_borel:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue)"
 proof -
   have "{x. (if x \<in> S then f x else 0) \<in> T} \<in> sets lebesgue \<longleftrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue"
          if "T \<in> sets borel" for T
     proof (cases "0 \<in> T")
       case True
       then have "{x \<in> S. f x \<in> T} = {x. (if x \<in> S then f x else 0) \<in> T} \<inter> S"
                 "{x. (if x \<in> S then f x else 0) \<in> T} = {x \<in> S. f x \<in> T} \<union> -S"
         by auto
       then show ?thesis
         by (metis (no_types, lifting) Compl_in_sets_lebesgue assms sets.Int sets.Un)
     next
       case False
       then have "{x. (if x \<in> S then f x else 0) \<in> T} = {x \<in> S. f x \<in> T}"
         by auto
       then show ?thesis
         by auto
     qed
     then show ?thesis
       unfolding borel_measurable_lebesgue_preimage_borel borel_measurable_if [OF assms, symmetric]
       by blast
 qed
 
 lemma sets_lebesgue_almost_borel:
   assumes "S \<in> sets lebesgue"
   obtains B N where "B \<in> sets borel" "negligible N" "B \<union> N = S"
 proof -
   obtain T N N' where "S = T \<union> N" "N \<subseteq> N'" "N' \<in> null_sets lborel" "T \<in> sets borel"
     using sets_completionE [OF assms] by auto
   then show thesis
     by (metis negligible_iff_null_sets negligible_subset null_sets_completionI that)
 qed
 
 lemma double_lebesgue_sets:
  assumes S: "S \<in> sets lebesgue" and T: "T \<in> sets lebesgue" and fim: "f ` S \<subseteq> T"
  shows "(\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue) \<longleftrightarrow>
           f \<in> borel_measurable (lebesgue_on S) \<and>
           (\<forall>U. negligible U \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue)"
          (is "?lhs \<longleftrightarrow> _ \<and> ?rhs")
   unfolding borel_measurable_lebesgue_on_preimage_borel [OF S]
 proof (intro iffI allI conjI impI, safe)
   fix V :: "'b set"
   assume *: "\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
     and "V \<in> sets borel"
   then have V: "V \<in> sets lebesgue"
     by simp
   have "{x \<in> S. f x \<in> V} = {x \<in> S. f x \<in> T \<inter> V}"
     using fim by blast
   also have "{x \<in> S. f x \<in> T \<inter> V} \<in> sets lebesgue"
     using T V * le_inf_iff by blast
   finally show "{x \<in> S. f x \<in> V} \<in> sets lebesgue" .
 next
   fix U :: "'b set"
   assume "\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
          "negligible U" "U \<subseteq> T"
   then show "{x \<in> S. f x \<in> U} \<in> sets lebesgue"
     using negligible_imp_sets by blast
 next
   fix U :: "'b set"
   assume 1 [rule_format]: "(\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue)"
      and 2 [rule_format]: "\<forall>U. negligible U \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
      and "U \<in> sets lebesgue" "U \<subseteq> T"
   then obtain C N where C: "C \<in> sets borel \<and> negligible N \<and> C \<union> N = U"
     using sets_lebesgue_almost_borel
     by metis
   then have "{x \<in> S. f x \<in> C} \<in> sets lebesgue"
     by (blast intro: 1)
   moreover have "{x \<in> S. f x \<in> N} \<in> sets lebesgue"
     using C \<open>U \<subseteq> T\<close> by (blast intro: 2)
   moreover have "{x \<in> S. f x \<in> C \<union> N} = {x \<in> S. f x \<in> C} \<union> {x \<in> S. f x \<in> N}"
     by auto
   ultimately show "{x \<in> S. f x \<in> U} \<in> sets lebesgue"
     using C by auto
 qed
 
 
 subsection\<open>Simplest case of Sard's theorem (we don't need continuity of derivative)\<close>
 
 lemma Sard_lemma00:
   fixes P :: "'b::euclidean_space set"
   assumes "a \<ge> 0" and a: "a *\<^sub>R i \<noteq> 0" and i: "i \<in> Basis"
     and P: "P \<subseteq> {x. a *\<^sub>R i \<bullet> x = 0}"
     and "0 \<le> m" "0 \<le> e"
  obtains S where "S \<in> lmeasurable"
             and "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
             and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (DIM('b) - 1)"
 proof -
   have "a > 0"
     using assms by simp
   let ?v = "(\<Sum>j\<in>Basis. (if j = i then e else m) *\<^sub>R j)"
   show thesis
   proof
     have "- e \<le> x \<bullet> i" "x \<bullet> i \<le> e"
       if "t \<in> P" "norm (x - t) \<le> e" for x t
       using \<open>a > 0\<close> that Basis_le_norm [of i "x-t"] P i
       by (auto simp: inner_commute algebra_simps)
     moreover have "- m \<le> x \<bullet> j" "x \<bullet> j \<le> m"
       if "norm x \<le> m" "t \<in> P" "norm (x - t) \<le> e" "j \<in> Basis" and "j \<noteq> i"
       for x t j
       using that Basis_le_norm [of j x] by auto
     ultimately
     show "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> cbox (-?v) ?v"
       by (auto simp: mem_box)
     have *: "\<forall>k\<in>Basis. - ?v \<bullet> k \<le> ?v \<bullet> k"
       using \<open>0 \<le> m\<close> \<open>0 \<le> e\<close> by (auto simp: inner_Basis)
     have 2: "2 ^ DIM('b) = 2 * 2 ^ (DIM('b) - Suc 0)"
       by (metis DIM_positive Suc_pred power_Suc)
     show "measure lebesgue (cbox (-?v) ?v) \<le> 2 * e * (2 * m) ^ (DIM('b) - 1)"
       using \<open>i \<in> Basis\<close>
       by (simp add: content_cbox [OF *] prod.distrib prod.If_cases Diff_eq [symmetric] 2)
   qed blast
 qed
 
 text\<open>As above, but reorienting the vector (HOL Light's @text{GEOM\_BASIS\_MULTIPLE\_TAC})\<close>
 lemma Sard_lemma0:
   fixes P :: "(real^'n::{finite,wellorder}) set"
   assumes "a \<noteq> 0"
     and P: "P \<subseteq> {x. a \<bullet> x = 0}" and "0 \<le> m" "0 \<le> e"
   obtains S where "S \<in> lmeasurable"
     and "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
     and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
 proof -
   obtain T and k::'n where T: "orthogonal_transformation T" and a: "a = T (norm a *\<^sub>R axis k (1::real))"
     using rotation_rightward_line by metis
   have Tinv [simp]: "T (inv T x) = x" for x
     by (simp add: T orthogonal_transformation_surj surj_f_inv_f)
   obtain S where S: "S \<in> lmeasurable"
     and subS: "{z. norm z \<le> m \<and> (\<exists>t \<in> T-`P. norm(z - t) \<le> e)} \<subseteq> S"
     and mS: "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
   proof (rule Sard_lemma00 [of "norm a" "axis k (1::real)" "T-`P" m e])
     have "norm a *\<^sub>R axis k 1 \<bullet> x = 0" if "T x \<in> P" for x
     proof -
       have "a \<bullet> T x = 0"
         using P that by blast
       then show ?thesis
         by (metis (no_types, lifting) T a orthogonal_orthogonal_transformation orthogonal_def)
     qed
     then show "T -` P \<subseteq> {x. norm a *\<^sub>R axis k 1 \<bullet> x = 0}"
       by auto
   qed (use assms T in auto)
   show thesis
   proof
     show "T ` S \<in> lmeasurable"
       using S measurable_orthogonal_image T by blast
     have "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> T ` {z. norm z \<le> m \<and> (\<exists>t\<in>T -` P. norm (z - t) \<le> e)}"
     proof clarsimp
       fix x t
       assume "norm x \<le> m" "t \<in> P" "norm (x - t) \<le> e"
       then have "norm (inv T x) \<le> m"
         using orthogonal_transformation_inv [OF T] by (simp add: orthogonal_transformation_norm)
       moreover have "\<exists>t\<in>T -` P. norm (inv T x - t) \<le> e"
       proof
         have "T (inv T x - inv T t) = x - t"
           using T linear_diff orthogonal_transformation_def
           by (metis (no_types, opaque_lifting) Tinv)
         then have "norm (inv T x - inv T t) = norm (x - t)"
           by (metis T orthogonal_transformation_norm)
         then show "norm (inv T x - inv T t) \<le> e"
           using \<open>norm (x - t) \<le> e\<close> by linarith
        next
          show "inv T t \<in> T -` P"
            using \<open>t \<in> P\<close> by force
       qed
       ultimately show "x \<in> T ` {z. norm z \<le> m \<and> (\<exists>t\<in>T -` P. norm (z - t) \<le> e)}"
         by force
     qed
     then show "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> T ` S"
       using image_mono [OF subS] by (rule order_trans)
     show "measure lebesgue (T ` S) \<le> 2 * e * (2 * m) ^ (CARD('n) - 1)"
       using mS T by (simp add: S measure_orthogonal_image)
   qed
 qed
 
 text\<open>As above, but translating the sets (HOL Light's @text{GEN\_GEOM\_ORIGIN\_TAC})\<close>
 lemma Sard_lemma1:
   fixes P :: "(real^'n::{finite,wellorder}) set"
    assumes P: "dim P < CARD('n)" and "0 \<le> m" "0 \<le> e"
  obtains S where "S \<in> lmeasurable"
             and "{z. norm(z - w) \<le> m \<and> (\<exists>t \<in> P. norm(z - w - t) \<le> e)} \<subseteq> S"
             and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
 proof -
   obtain a where "a \<noteq> 0" "P \<subseteq> {x. a \<bullet> x = 0}"
     using lowdim_subset_hyperplane [of P] P span_base by auto
   then obtain S where S: "S \<in> lmeasurable"
     and subS: "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
     and mS: "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
     by (rule Sard_lemma0 [OF _ _ \<open>0 \<le> m\<close> \<open>0 \<le> e\<close>])
   show thesis
   proof
     show "(+)w ` S \<in> lmeasurable"
       by (metis measurable_translation S)
     show "{z. norm (z - w) \<le> m \<and> (\<exists>t\<in>P. norm (z - w - t) \<le> e)} \<subseteq> (+)w ` S"
       using subS by force
     show "measure lebesgue ((+)w ` S) \<le> 2 * e * (2 * m) ^ (CARD('n) - 1)"
       by (metis measure_translation mS)
   qed
 qed
 
 lemma Sard_lemma2:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n::{finite,wellorder}"
   assumes mlen: "CARD('m) \<le> CARD('n)" (is "?m \<le> ?n")
     and "B > 0" "bounded S"
     and derS: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and rank: "\<And>x. x \<in> S \<Longrightarrow> rank(matrix(f' x)) < CARD('n)"
     and B: "\<And>x. x \<in> S \<Longrightarrow> onorm(f' x) \<le> B"
   shows "negligible(f ` S)"
 proof -
   have lin_f': "\<And>x. x \<in> S \<Longrightarrow> linear(f' x)"
     using derS has_derivative_linear by blast
   show ?thesis
   proof (clarsimp simp add: negligible_outer_le)
     fix e :: "real"
     assume "e > 0"
     obtain c where csub: "S \<subseteq> cbox (- (vec c)) (vec c)" and "c > 0"
     proof -
       obtain b where b: "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> b"
         using \<open>bounded S\<close> by (auto simp: bounded_iff)
       show thesis
       proof
         have "- \<bar>b\<bar> - 1 \<le> x $ i \<and> x $ i \<le> \<bar>b\<bar> + 1" if "x \<in> S" for x i
           using component_le_norm_cart [of x i] b [OF that] by auto
         then show "S \<subseteq> cbox (- vec (\<bar>b\<bar> + 1)) (vec (\<bar>b\<bar> + 1))"
           by (auto simp: mem_box_cart)
       qed auto
     qed
     then have box_cc: "box (- (vec c)) (vec c) \<noteq> {}" and cbox_cc: "cbox (- (vec c)) (vec c) \<noteq> {}"
       by (auto simp: interval_eq_empty_cart)
     obtain d where "d > 0" "d \<le> B"
              and d: "(d * 2) * (4 * B) ^ (?n - 1) \<le> e / (2*c) ^ ?m / ?m ^ ?m"
       apply (rule that [of "min B (e / (2*c) ^ ?m / ?m ^ ?m / (4 * B) ^ (?n - 1) / 2)"])
       using \<open>B > 0\<close> \<open>c > 0\<close> \<open>e > 0\<close>
       by (simp_all add: divide_simps min_mult_distrib_right)
     have "\<exists>r. 0 < r \<and> r \<le> 1/2 \<and>
               (x \<in> S
                \<longrightarrow> (\<forall>y. y \<in> S \<and> norm(y - x) < r
                        \<longrightarrow> norm(f y - f x - f' x (y - x)) \<le> d * norm(y - x)))" for x
     proof (cases "x \<in> S")
       case True
       then obtain r where "r > 0"
               and "\<And>y. \<lbrakk>y \<in> S; norm (y - x) < r\<rbrakk>
                        \<Longrightarrow> norm (f y - f x - f' x (y - x)) \<le> d * norm (y - x)"
         using derS \<open>d > 0\<close> by (force simp: has_derivative_within_alt)
       then show ?thesis
         by (rule_tac x="min r (1/2)" in exI) simp
     next
       case False
       then show ?thesis
         by (rule_tac x="1/2" in exI) simp
     qed
     then obtain r where r12: "\<And>x. 0 < r x \<and> r x \<le> 1/2"
             and r: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S; norm(y - x) < r x\<rbrakk>
                           \<Longrightarrow> norm(f y - f x - f' x (y - x)) \<le> d * norm(y - x)"
       by metis
     then have ga: "gauge (\<lambda>x. ball x (r x))"
       by (auto simp: gauge_def)
     obtain \<D> where \<D>: "countable \<D>" and sub_cc: "\<Union>\<D> \<subseteq> cbox (- vec c) (vec c)"
       and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>u v. K = cbox u v)"
       and djointish: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
       and covered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> ball x (r x)"
       and close: "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i::'m. v $ i - u $ i = 2*c / 2^n"
       and covers: "S \<subseteq> \<Union>\<D>"
       apply (rule covering_lemma [OF csub box_cc ga])
       apply (auto simp: Basis_vec_def cart_eq_inner_axis [symmetric])
       done
     let ?\<mu> = "measure lebesgue"
     have "\<exists>T. T \<in> lmeasurable \<and> f ` (K \<inter> S) \<subseteq> T \<and> ?\<mu> T \<le> e / (2*c) ^ ?m * ?\<mu> K"
       if "K \<in> \<D>" for K
     proof -
       obtain u v where uv: "K = cbox u v"
         using cbox \<open>K \<in> \<D>\<close> by blast
       then have uv_ne: "cbox u v \<noteq> {}"
         using cbox that by fastforce
       obtain x where x: "x \<in> S \<inter> cbox u v" "cbox u v \<subseteq> ball x (r x)"
         using \<open>K \<in> \<D>\<close> covered uv by blast
       then have "dim (range (f' x)) < ?n"
         using rank_dim_range [of "matrix (f' x)"] x rank[of x]
         by (auto simp: matrix_works scalar_mult_eq_scaleR lin_f')
       then obtain T where T: "T \<in> lmeasurable"
             and subT: "{z. norm(z - f x) \<le> (2 * B) * norm(v - u) \<and> (\<exists>t \<in> range (f' x). norm(z - f x - t) \<le> d * norm(v - u))} \<subseteq> T"
             and measT: "?\<mu> T \<le> (2 * (d * norm(v - u))) * (2 * ((2 * B) * norm(v - u))) ^ (?n - 1)"
                         (is "_ \<le> ?DVU")
         apply (rule Sard_lemma1 [of "range (f' x)" "(2 * B) * norm(v - u)" "d * norm(v - u)" "f x"])
         using \<open>B > 0\<close> \<open>d > 0\<close> by simp_all
       show ?thesis
       proof (intro exI conjI)
         have "f ` (K \<inter> S) \<subseteq> {z. norm(z - f x) \<le> (2 * B) * norm(v - u) \<and> (\<exists>t \<in> range (f' x). norm(z - f x - t) \<le> d * norm(v - u))}"
           unfolding uv
         proof (clarsimp simp: mult.assoc, intro conjI)
           fix y
           assume y: "y \<in> cbox u v" and "y \<in> S"
           then have "norm (y - x) < r x"
             by (metis dist_norm mem_ball norm_minus_commute subsetCE x(2))
           then have le_dyx: "norm (f y - f x - f' x (y - x)) \<le> d * norm (y - x)"
             using r [of x y] x \<open>y \<in> S\<close> by blast
           have yx_le: "norm (y - x) \<le> norm (v - u)"
           proof (rule norm_le_componentwise_cart)
             show "norm ((y - x) $ i) \<le> norm ((v - u) $ i)" for i
               using x y by (force simp: mem_box_cart dest!: spec [where x=i])
           qed
           have *: "\<lbrakk>norm(y - x - z) \<le> d; norm z \<le> B; d \<le> B\<rbrakk> \<Longrightarrow> norm(y - x) \<le> 2 * B"
             for x y z :: "real^'n::_" and d B
             using norm_triangle_ineq2 [of "y - x" z] by auto
           show "norm (f y - f x) \<le> 2 * (B * norm (v - u))"
           proof (rule * [OF le_dyx])
             have "norm (f' x (y - x)) \<le> onorm (f' x) * norm (y - x)"
               using onorm [of "f' x" "y-x"] by (meson IntE lin_f' linear_linear x(1))
             also have "\<dots> \<le> B * norm (v - u)"
             proof (rule mult_mono)
               show "onorm (f' x) \<le> B"
                 using B x by blast
             qed (use \<open>B > 0\<close> yx_le in auto)
             finally show "norm (f' x (y - x)) \<le> B * norm (v - u)" .
             show "d * norm (y - x) \<le> B * norm (v - u)"
               using \<open>B > 0\<close> by (auto intro: mult_mono [OF \<open>d \<le> B\<close> yx_le])
           qed
           show "\<exists>t. norm (f y - f x - f' x t) \<le> d * norm (v - u)"
             apply (rule_tac x="y-x" in exI)
             using \<open>d > 0\<close> yx_le le_dyx mult_left_mono [where c=d]
             by (meson order_trans mult_le_cancel_iff2)
         qed
         with subT show "f ` (K \<inter> S) \<subseteq> T" by blast
         show "?\<mu> T \<le> e / (2*c) ^ ?m * ?\<mu> K"
         proof (rule order_trans [OF measT])
           have "?DVU = (d * 2 * (4 * B) ^ (?n - 1)) * norm (v - u)^?n"
             using \<open>c > 0\<close>
             apply (simp add: algebra_simps)
             by (metis Suc_pred power_Suc zero_less_card_finite)
           also have "\<dots> \<le> (e / (2*c) ^ ?m / (?m ^ ?m)) * norm(v - u) ^ ?n"
             by (rule mult_right_mono [OF d]) auto
           also have "\<dots> \<le> e / (2*c) ^ ?m * ?\<mu> K"
           proof -
             have "u \<in> ball (x) (r x)" "v \<in> ball x (r x)"
               using box_ne_empty(1) contra_subsetD [OF x(2)] mem_box(2) uv_ne by fastforce+
             moreover have "r x \<le> 1/2"
               using r12 by auto
             ultimately have "norm (v - u) \<le> 1"
               using norm_triangle_half_r [of x u 1 v]
               by (metis (no_types, opaque_lifting) dist_commute dist_norm less_eq_real_def less_le_trans mem_ball)
             then have "norm (v - u) ^ ?n \<le> norm (v - u) ^ ?m"
               by (simp add: power_decreasing [OF mlen])
             also have "\<dots> \<le> ?\<mu> K * real (?m ^ ?m)"
             proof -
               obtain n where n: "\<And>i. v$i - u$i = 2 * c / 2^n"
                 using close [of u v] \<open>K \<in> \<D>\<close> uv by blast
               have "norm (v - u) ^ ?m \<le> (\<Sum>i\<in>UNIV. \<bar>(v - u) $ i\<bar>) ^ ?m"
                 by (intro norm_le_l1_cart power_mono) auto
               also have "\<dots> \<le> (\<Prod>i\<in>UNIV. v $ i - u $ i) * real CARD('m) ^ CARD('m)"
                 by (simp add: n field_simps \<open>c > 0\<close> less_eq_real_def)
               also have "\<dots> = ?\<mu> K * real (?m ^ ?m)"
                 by (simp add: uv uv_ne content_cbox_cart)
               finally show ?thesis .
             qed
             finally have *: "1 / real (?m ^ ?m) * norm (v - u) ^ ?n \<le> ?\<mu> K"
               by (simp add: field_split_simps)
             show ?thesis
               using mult_left_mono [OF *, of "e / (2*c) ^ ?m"] \<open>c > 0\<close> \<open>e > 0\<close> by auto
           qed
           finally show "?DVU \<le> e / (2*c) ^ ?m * ?\<mu> K" .
         qed
       qed (use T in auto)
     qed
     then obtain g where meas_g: "\<And>K. K \<in> \<D> \<Longrightarrow> g K \<in> lmeasurable"
                     and sub_g: "\<And>K. K \<in> \<D> \<Longrightarrow> f ` (K \<inter> S) \<subseteq> g K"
                     and le_g: "\<And>K. K \<in> \<D> \<Longrightarrow> ?\<mu> (g K) \<le> e / (2*c)^?m * ?\<mu> K"
       by metis
     have le_e: "?\<mu> (\<Union>i\<in>\<F>. g i) \<le> e"
       if "\<F> \<subseteq> \<D>" "finite \<F>" for \<F>
     proof -
       have "?\<mu> (\<Union>i\<in>\<F>. g i) \<le> (\<Sum>i\<in>\<F>. ?\<mu> (g i))"
         using meas_g \<open>\<F> \<subseteq> \<D>\<close> by (auto intro: measure_UNION_le [OF \<open>finite \<F>\<close>])
       also have "\<dots> \<le> (\<Sum>K\<in>\<F>. e / (2*c) ^ ?m * ?\<mu> K)"
         using \<open>\<F> \<subseteq> \<D>\<close> sum_mono [OF le_g] by (meson le_g subsetCE sum_mono)
       also have "\<dots> = e / (2*c) ^ ?m * (\<Sum>K\<in>\<F>. ?\<mu> K)"
         by (simp add: sum_distrib_left)
       also have "\<dots> \<le> e"
       proof -
         have "\<F> division_of \<Union>\<F>"
         proof (rule division_ofI)
           show "K \<subseteq> \<Union>\<F>"  "K \<noteq> {}" "\<exists>a b. K = cbox a b" if "K \<in> \<F>" for K
             using \<open>K \<in> \<F>\<close> covered cbox \<open>\<F> \<subseteq> \<D>\<close> by (auto simp: Union_upper)
           show "interior K \<inter> interior L = {}" if "K \<in> \<F>" and "L \<in> \<F>" and "K \<noteq> L" for K L
             by (metis (mono_tags, lifting) \<open>\<F> \<subseteq> \<D>\<close> pairwiseD djointish pairwise_subset that)
         qed (use that in auto)
         then have "sum ?\<mu> \<F> \<le> ?\<mu> (\<Union>\<F>)"
           by (simp add: content_division)
         also have "\<dots> \<le> ?\<mu> (cbox (- vec c) (vec c) :: (real, 'm) vec set)"
         proof (rule measure_mono_fmeasurable)
           show "\<Union>\<F> \<subseteq> cbox (- vec c) (vec c)"
             by (meson Sup_subset_mono sub_cc order_trans \<open>\<F> \<subseteq> \<D>\<close>)
         qed (use \<open>\<F> division_of \<Union>\<F>\<close> lmeasurable_division in auto)
         also have "\<dots> = content (cbox (- vec c) (vec c) :: (real, 'm) vec set)"
           by simp
         also have "\<dots> \<le> (2 ^ ?m * c ^ ?m)"
           using \<open>c > 0\<close> by (simp add: content_cbox_if_cart)
         finally have "sum ?\<mu> \<F> \<le> (2 ^ ?m * c ^ ?m)" .
         then show ?thesis
           using \<open>e > 0\<close> \<open>c > 0\<close> by (auto simp: field_split_simps)
       qed
       finally show ?thesis .
     qed
     show "\<exists>T. f ` S \<subseteq> T \<and> T \<in> lmeasurable \<and> ?\<mu> T \<le> e"
     proof (intro exI conjI)
       show "f ` S \<subseteq> \<Union> (g ` \<D>)"
         using covers sub_g by force
       show "\<Union> (g ` \<D>) \<in> lmeasurable"
         by (rule fmeasurable_UN_bound [OF \<open>countable \<D>\<close> meas_g le_e])
       show "?\<mu> (\<Union> (g ` \<D>)) \<le> e"
         by (rule measure_UN_bound [OF \<open>countable \<D>\<close> meas_g le_e])
     qed
   qed
 qed
 
 
 theorem baby_Sard:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n::{finite,wellorder}"
   assumes mlen: "CARD('m) \<le> CARD('n)"
     and der: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and rank: "\<And>x. x \<in> S \<Longrightarrow> rank(matrix(f' x)) < CARD('n)"
   shows "negligible(f ` S)"
 proof -
   let ?U = "\<lambda>n. {x \<in> S. norm(x) \<le> n \<and> onorm(f' x) \<le> real n}"
   have "\<And>x. x \<in> S \<Longrightarrow> \<exists>n. norm x \<le> real n \<and> onorm (f' x) \<le> real n"
     by (meson linear order_trans real_arch_simple)
   then have eq: "S = (\<Union>n. ?U n)"
     by auto
   have "negligible (f ` ?U n)" for n
   proof (rule Sard_lemma2 [OF mlen])
     show "0 < real n + 1"
       by auto
     show "bounded (?U n)"
       using bounded_iff by blast
     show "(f has_derivative f' x) (at x within ?U n)" if "x \<in> ?U n" for x
       using der that by (force intro: has_derivative_subset)
   qed (use rank in auto)
   then show ?thesis
     by (subst eq) (simp add: image_Union negligible_Union_nat)
 qed
 
 
 subsection\<open>A one-way version of change-of-variables not assuming injectivity. \<close>
 
 lemma integral_on_image_ubound_weak:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
       and f: "f \<in> borel_measurable (lebesgue_on (g ` S))"
       and nonneg_fg:  "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
       and der_g:   "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and det_int_fg: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
       and meas_gim: "\<And>T. \<lbrakk>T \<subseteq> g ` S; T \<in> sets lebesgue\<rbrakk> \<Longrightarrow> {x \<in> S. g x \<in> T} \<in> sets lebesgue"
     shows "f integrable_on (g ` S) \<and>
            integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
          (is "_ \<and> _ \<le> ?b")
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar>"
   have cont_g: "continuous_on S g"
     using der_g has_derivative_continuous_on by blast
   have [simp]: "space (lebesgue_on S) = S"
     by (simp add: S)
   have gS_in_sets_leb: "g ` S \<in> sets lebesgue"
     apply (rule differentiable_image_in_sets_lebesgue)
     using der_g by (auto simp: S differentiable_def differentiable_on_def)
   obtain h where nonneg_h: "\<And>n x. 0 \<le> h n x"
     and h_le_f: "\<And>n x. x \<in> S \<Longrightarrow> h n (g x) \<le> f (g x)"
     and h_inc: "\<And>n x. h n x \<le> h (Suc n) x"
     and h_meas: "\<And>n. h n \<in> borel_measurable lebesgue"
     and fin_R: "\<And>n. finite(range (h n))"
     and lim: "\<And>x. x \<in> g ` S \<Longrightarrow> (\<lambda>n. h n x) \<longlonglongrightarrow> f x"
   proof -
     let ?f = "\<lambda>x. if x \<in> g ` S then f x else 0"
     have "?f \<in> borel_measurable lebesgue \<and> (\<forall>x. 0 \<le> ?f x)"
       by (auto simp: gS_in_sets_leb f nonneg_fg measurable_restrict_space_iff [symmetric])
     then show ?thesis
       apply (clarsimp simp add: borel_measurable_simple_function_limit_increasing)
       apply (rename_tac h)
       by (rule_tac h=h in that) (auto split: if_split_asm)
   qed
   have h_lmeas: "{t. h n (g t) = y} \<inter> S \<in> sets lebesgue" for y n
   proof -
     have "space (lebesgue_on (UNIV::(real,'n) vec set)) = UNIV"
       by simp
     then have "((h n) -`{y} \<inter> g ` S) \<in> sets (lebesgue_on (g ` S))"
       by (metis Int_commute borel_measurable_vimage h_meas image_eqI inf_top.right_neutral sets_restrict_space space_borel space_completion space_lborel)
     then have "({u. h n u = y} \<inter> g ` S) \<in> sets lebesgue"
       using gS_in_sets_leb
       by (simp add: integral_indicator fmeasurableI2 sets_restrict_space_iff vimage_def)
     then have "{x \<in> S. g x \<in> ({u. h n u = y} \<inter> g ` S)} \<in> sets lebesgue"
       using meas_gim[of "({u. h n u = y} \<inter> g ` S)"] by force
     moreover have "{t. h n (g t) = y} \<inter> S = {x \<in> S. g x \<in> ({u. h n u = y} \<inter> g ` S)}"
       by blast
     ultimately show ?thesis
       by auto
   qed
   have hint: "h n integrable_on g ` S \<and> integral (g ` S) (h n) \<le> integral S (\<lambda>x. ?D x * h n (g x))"
           (is "?INT \<and> ?lhs \<le> ?rhs")  for n
   proof -
     let ?R = "range (h n)"
     have hn_eq: "h n = (\<lambda>x. \<Sum>y\<in>?R. y * indicat_real {x. h n x = y} x)"
       by (simp add: indicator_def if_distrib fin_R cong: if_cong)
     have yind: "(\<lambda>t. y * indicator{x. h n x = y} t) integrable_on (g ` S) \<and>
                 (integral (g ` S) (\<lambda>t. y * indicator {x. h n x = y} t))
                  \<le> integral S (\<lambda>t. \<bar>det (matrix (g' t))\<bar> * y * indicator {x. h n x = y} (g t))"
        if y: "y \<in> ?R" for y::real
     proof (cases "y=0")
       case True
       then show ?thesis using gS_in_sets_leb integrable_0 by force
     next
       case False
       with that have "y > 0"
         using less_eq_real_def nonneg_h by fastforce
       have "(\<lambda>x. if x \<in> {t. h n (g t) = y} then ?D x else 0) integrable_on S"
       proof (rule measurable_bounded_by_integrable_imp_integrable)
         have "(\<lambda>x. ?D x) \<in> borel_measurable (lebesgue_on ({t. h n (g t) = y} \<inter> S))"
           apply (intro borel_measurable_abs borel_measurable_det_Jacobian [OF h_lmeas, where f=g])
           by (meson der_g IntD2 has_derivative_subset inf_le2)
         then have "(\<lambda>x. if x \<in> {t. h n (g t) = y} \<inter> S then ?D x else 0) \<in> borel_measurable lebesgue"
           by (rule borel_measurable_if_I [OF _ h_lmeas])
         then show "(\<lambda>x. if x \<in> {t. h n (g t) = y} then ?D x else 0) \<in> borel_measurable (lebesgue_on S)"
           by (simp add: if_if_eq_conj Int_commute borel_measurable_if [OF S, symmetric])
         show "(\<lambda>x. ?D x *\<^sub>R f (g x) /\<^sub>R y) integrable_on S"
           by (rule integrable_cmul) (use det_int_fg in auto)
         show "norm (if x \<in> {t. h n (g t) = y} then ?D x else 0) \<le> ?D x *\<^sub>R f (g x) /\<^sub>R y"
           if "x \<in> S" for x
           using nonneg_h [of n x] \<open>y > 0\<close> nonneg_fg [of x] h_le_f [of x n] that
           by (auto simp: divide_simps mult_left_mono)
       qed (use S in auto)
       then have int_det: "(\<lambda>t. \<bar>det (matrix (g' t))\<bar>) integrable_on ({t. h n (g t) = y} \<inter> S)"
         using integrable_restrict_Int by force
       have "(g ` ({t. h n (g t) = y} \<inter> S)) \<in> lmeasurable"
         apply (rule measurable_differentiable_image [OF h_lmeas])
          apply (blast intro: has_derivative_subset [OF der_g])
         apply (rule int_det)
         done
       moreover have "g ` ({t. h n (g t) = y} \<inter> S) = {x. h n x = y} \<inter> g ` S"
         by blast
       moreover have "measure lebesgue (g ` ({t. h n (g t) = y} \<inter> S))
                      \<le> integral ({t. h n (g t) = y} \<inter> S) (\<lambda>t. \<bar>det (matrix (g' t))\<bar>)"
         apply (rule measure_differentiable_image [OF h_lmeas _ int_det])
         apply (blast intro: has_derivative_subset [OF der_g])
         done
       ultimately show ?thesis
         using \<open>y > 0\<close> integral_restrict_Int [of S "{t. h n (g t) = y}" "\<lambda>t. \<bar>det (matrix (g' t))\<bar> * y"]
         apply (simp add: integrable_on_indicator integral_indicator)
         apply (simp add: indicator_def of_bool_def if_distrib cong: if_cong)
         done
     qed
     have hn_int: "h n integrable_on g ` S"
       apply (subst hn_eq)
       using yind by (force intro: integrable_sum [OF fin_R])
     then show ?thesis
     proof
       have "?lhs = integral (g ` S) (\<lambda>x. \<Sum>y\<in>range (h n). y * indicat_real {x. h n x = y} x)"
         by (metis hn_eq)
       also have "\<dots> = (\<Sum>y\<in>range (h n). integral (g ` S) (\<lambda>x. y * indicat_real {x. h n x = y} x))"
         by (rule integral_sum [OF fin_R]) (use yind in blast)
       also have "\<dots> \<le> (\<Sum>y\<in>range (h n). integral S (\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)))"
         using yind by (force intro: sum_mono)
       also have "\<dots> = integral S (\<lambda>u. \<Sum>y\<in>range (h n). \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u))"
       proof (rule integral_sum [OF fin_R, symmetric])
         fix y assume y: "y \<in> ?R"
         with nonneg_h have "y \<ge> 0"
           by auto
         show "(\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)) integrable_on S"
         proof (rule measurable_bounded_by_integrable_imp_integrable)
           have "(\<lambda>x. indicat_real {x. h n x = y} (g x)) \<in> borel_measurable (lebesgue_on S)"
             using h_lmeas S
             by (auto simp: indicator_vimage [symmetric] borel_measurable_indicator_iff sets_restrict_space_iff)
           then show "(\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)) \<in> borel_measurable (lebesgue_on S)"
             by (intro borel_measurable_times borel_measurable_abs borel_measurable_const borel_measurable_det_Jacobian [OF S der_g])
         next
           fix x
           assume "x \<in> S"
           have "y * indicat_real {x. h n x = y} (g x) \<le> f (g x)"
             by (metis \<open>x \<in> S\<close> h_le_f indicator_simps(1) indicator_simps(2) mem_Collect_eq mult.commute mult.left_neutral mult_zero_left nonneg_fg)
           with \<open>y \<ge> 0\<close> show "norm (?D x * y * indicat_real {x. h n x = y} (g x)) \<le> ?D x * f(g x)"
             by (simp add: abs_mult mult.assoc mult_left_mono)
         qed (use S det_int_fg in auto)
       qed
       also have "\<dots> = integral S (\<lambda>T. \<bar>det (matrix (g' T))\<bar> *
                                         (\<Sum>y\<in>range (h n). y * indicat_real {x. h n x = y} (g T)))"
         by (simp add: sum_distrib_left mult.assoc)
       also have "\<dots> = ?rhs"
         by (metis hn_eq)
       finally show "integral (g ` S) (h n) \<le> ?rhs" .
     qed
   qed
   have le: "integral S (\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) \<le> ?b" for n
   proof (rule integral_le)
     show "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) integrable_on S"
     proof (rule measurable_bounded_by_integrable_imp_integrable)
       have "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> *\<^sub>R h n (g T)) \<in> borel_measurable (lebesgue_on S)"
       proof (intro borel_measurable_scaleR borel_measurable_abs borel_measurable_det_Jacobian \<open>S \<in> sets lebesgue\<close>)
         have eq: "{x \<in> S. f x \<le> a} = (\<Union>b \<in> (f ` S) \<inter> atMost a. {x. f x = b} \<inter> S)" for f and a::real
           by auto
         have "finite ((\<lambda>x. h n (g x)) ` S \<inter> {..a})" for a
           by (force intro: finite_subset [OF _ fin_R])
         with h_lmeas [of n] show "(\<lambda>x. h n (g x)) \<in> borel_measurable (lebesgue_on S)"
           apply (simp add: borel_measurable_vimage_halfspace_component_le \<open>S \<in> sets lebesgue\<close> sets_restrict_space_iff eq)
           by (metis (mono_tags) SUP_inf sets.finite_UN)
       qed (use der_g in blast)
       then show "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) \<in> borel_measurable (lebesgue_on S)"
         by simp
       show "norm (?D x * h n (g x)) \<le> ?D x *\<^sub>R f (g x)"
         if "x \<in> S" for x
         by (simp add: h_le_f mult_left_mono nonneg_h that)
     qed (use S det_int_fg in auto)
     show "?D x * h n (g x) \<le> ?D x * f (g x)" if "x \<in> S" for x
       by (simp add: \<open>x \<in> S\<close> h_le_f mult_left_mono)
     show "(\<lambda>x. ?D x * f (g x)) integrable_on S"
       using det_int_fg by blast
   qed
   have "f integrable_on g ` S \<and> (\<lambda>k. integral (g ` S) (h k)) \<longlonglongrightarrow> integral (g ` S) f"
   proof (rule monotone_convergence_increasing)
     have "\<bar>integral (g ` S) (h n)\<bar> \<le> integral S (\<lambda>x. ?D x * f (g x))" for n
     proof -
       have "\<bar>integral (g ` S) (h n)\<bar> = integral (g ` S) (h n)"
         using hint by (simp add: integral_nonneg nonneg_h)
       also have "\<dots> \<le> integral S (\<lambda>x. ?D x * f (g x))"
         using hint le by (meson order_trans)
       finally show ?thesis .
     qed
     then show "bounded (range (\<lambda>k. integral (g ` S) (h k)))"
       by (force simp: bounded_iff)
   qed (use h_inc lim hint in auto)
   moreover have "integral (g ` S) (h n) \<le> integral S (\<lambda>x. ?D x * f (g x))" for n
     using hint by (blast intro: le order_trans)
   ultimately show ?thesis
     by (auto intro: Lim_bounded)
 qed
 
 
 lemma integral_on_image_ubound_nonneg:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real"
   assumes nonneg_fg: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
       and der_g:   "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
   shows "f integrable_on (g ` S) \<and> integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
          (is "_ \<and> _ \<le> ?b")
 proof -
   let ?D = "\<lambda>x. det (matrix (g' x))"
   define S' where "S' \<equiv> {x \<in> S. ?D x * f(g x) \<noteq> 0}"
   then have der_gS': "\<And>x. x \<in> S' \<Longrightarrow> (g has_derivative g' x) (at x within S')"
     by (metis (mono_tags, lifting) der_g has_derivative_subset mem_Collect_eq subset_iff)
   have "(\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) integrable_on UNIV"
     by (simp add: integrable_restrict_UNIV intS)
   then have Df_borel: "(\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> borel_measurable lebesgue"
     using integrable_imp_measurable lebesgue_on_UNIV_eq by force
   have S': "S' \<in> sets lebesgue"
   proof -
     from Df_borel borel_measurable_vimage_open [of _ UNIV]
     have "{x. (if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> T} \<in> sets lebesgue"
       if "open T" for T
       using that unfolding lebesgue_on_UNIV_eq
       by (fastforce simp add: dest!: spec)
     then have "{x. (if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> -{0}} \<in> sets lebesgue"
       using open_Compl by blast
     then show ?thesis
       by (simp add: S'_def conj_ac split: if_split_asm cong: conj_cong)
   qed
   then have gS': "g ` S' \<in> sets lebesgue"
   proof (rule differentiable_image_in_sets_lebesgue)
     show "g differentiable_on S'"
       using der_g unfolding S'_def differentiable_def differentiable_on_def
       by (blast intro: has_derivative_subset)
   qed auto
   have f: "f \<in> borel_measurable (lebesgue_on (g ` S'))"
   proof (clarsimp simp add: borel_measurable_vimage_open)
     fix T :: "real set"
     assume "open T"
     have "{x \<in> g ` S'. f x \<in> T} = g ` {x \<in> S'. f(g x) \<in> T}"
       by blast
     moreover have "g ` {x \<in> S'. f(g x) \<in> T} \<in> sets lebesgue"
     proof (rule differentiable_image_in_sets_lebesgue)
       let ?h = "\<lambda>x. \<bar>?D x\<bar> * f (g x) /\<^sub>R \<bar>?D x\<bar>"
       have "(\<lambda>x. if x \<in> S' then \<bar>?D x\<bar> * f (g x) else 0) = (\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0)"
         by (auto simp: S'_def)
       also have "\<dots> \<in> borel_measurable lebesgue"
         by (rule Df_borel)
       finally have *: "(\<lambda>x. \<bar>?D x\<bar> * f (g x)) \<in> borel_measurable (lebesgue_on S')"
         by (simp add: borel_measurable_if_D)
       have "?h \<in> borel_measurable (lebesgue_on S')"
         by (intro * S' der_gS' borel_measurable_det_Jacobian measurable) (blast intro: der_gS')
       moreover have "?h x = f(g x)" if "x \<in> S'" for x
         using that by (auto simp: S'_def)
       ultimately have "(\<lambda>x. f(g x)) \<in> borel_measurable (lebesgue_on S')"
         by (metis (no_types, lifting) measurable_lebesgue_cong)
       then show "{x \<in> S'. f (g x) \<in> T} \<in> sets lebesgue"
         by (simp add: \<open>S' \<in> sets lebesgue\<close> \<open>open T\<close> borel_measurable_vimage_open sets_restrict_space_iff)
       show "g differentiable_on {x \<in> S'. f (g x) \<in> T}"
         using der_g unfolding S'_def differentiable_def differentiable_on_def
         by (blast intro: has_derivative_subset)
     qed auto
     ultimately have "{x \<in> g ` S'. f x \<in> T} \<in> sets lebesgue"
       by metis
     then show "{x \<in> g ` S'. f x \<in> T} \<in> sets (lebesgue_on (g ` S'))"
       by (simp add: \<open>g ` S' \<in> sets lebesgue\<close> sets_restrict_space_iff)
   qed
   have intS': "(\<lambda>x. \<bar>?D x\<bar> * f (g x)) integrable_on S'"
     using intS
     by (rule integrable_spike_set) (auto simp: S'_def intro: empty_imp_negligible)
   have lebS': "{x \<in> S'. g x \<in> T} \<in> sets lebesgue" if "T \<subseteq> g ` S'" "T \<in> sets lebesgue" for T
   proof -
     have "g \<in> borel_measurable (lebesgue_on S')"
       using der_gS' has_derivative_continuous_on S'
       by (blast intro: continuous_imp_measurable_on_sets_lebesgue)
     moreover have "{x \<in> S'. g x \<in> U} \<in> sets lebesgue" if "negligible U" "U \<subseteq> g ` S'" for U
     proof (intro negligible_imp_sets negligible_differentiable_vimage that)
       fix x
       assume x: "x \<in> S'"
       then have "linear (g' x)"
         using der_gS' has_derivative_linear by blast
       with x show "inj (g' x)"
         by (auto simp: S'_def det_nz_iff_inj)
     qed (use der_gS' in auto)
     ultimately show ?thesis
       using double_lebesgue_sets [OF S' gS' order_refl] that by blast
   qed
   have int_gS': "f integrable_on g ` S' \<and> integral (g ` S') f \<le> integral S' (\<lambda>x. \<bar>?D x\<bar> * f(g x))"
     using integral_on_image_ubound_weak [OF S' f nonneg_fg der_gS' intS' lebS'] S'_def by blast
   have "negligible (g ` {x \<in> S. det(matrix(g' x)) = 0})"
   proof (rule baby_Sard, simp_all)
     fix x
     assume x: "x \<in> S \<and> det (matrix (g' x)) = 0"
     then show "(g has_derivative g' x) (at x within {x \<in> S. det (matrix (g' x)) = 0})"
       by (metis (no_types, lifting) der_g has_derivative_subset mem_Collect_eq subsetI)
     then show "rank (matrix (g' x)) < CARD('n)"
       using det_nz_iff_inj matrix_vector_mul_linear x
       by (fastforce simp add: less_rank_noninjective)
   qed
   then have negg: "negligible (g ` S - g ` {x \<in> S. ?D x \<noteq> 0})"
     by (rule negligible_subset) (auto simp: S'_def)
   have null: "g ` {x \<in> S. ?D x \<noteq> 0} - g ` S = {}"
     by (auto simp: S'_def)
   let ?F = "{x \<in> S. f (g x) \<noteq> 0}"
   have eq: "g ` S' = g ` ?F \<inter> g ` {x \<in> S. ?D x \<noteq> 0}"
     by (auto simp: S'_def image_iff)
   show ?thesis
   proof
     have "((\<lambda>x. if x \<in> g ` ?F then f x else 0) integrable_on g ` {x \<in> S. ?D x \<noteq> 0})"
       using int_gS' eq integrable_restrict_Int [where f=f]
       by simp
     then have "f integrable_on g ` {x \<in> S. ?D x \<noteq> 0}"
       by (auto simp: image_iff elim!: integrable_eq)
     then show "f integrable_on g ` S"
       apply (rule integrable_spike_set [OF _ empty_imp_negligible negligible_subset])
       using negg null by auto
     have "integral (g ` S) f = integral (g ` {x \<in> S. ?D x \<noteq> 0}) f"
       using negg by (auto intro: negligible_subset integral_spike_set)
     also have "\<dots> = integral (g ` {x \<in> S. ?D x \<noteq> 0}) (\<lambda>x. if x \<in> g ` ?F then f x else 0)"
       by (auto simp: image_iff intro!: integral_cong)
     also have "\<dots> = integral (g ` S') f"
       using  eq integral_restrict_Int by simp
     also have "\<dots> \<le> integral S' (\<lambda>x. \<bar>?D x\<bar> * f(g x))"
       by (metis int_gS')
     also have "\<dots> \<le> ?b"
       by (rule integral_subset_le [OF _ intS' intS]) (use nonneg_fg S'_def in auto)
     finally show "integral (g ` S) f \<le> ?b" .
   qed
 qed
 
 
 lemma absolutely_integrable_on_image_real:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) absolutely_integrable_on S"
   shows "f absolutely_integrable_on (g ` S)"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f (g x)"
   let ?N = "{x \<in> S. f (g x) < 0}" and ?P = "{x \<in> S. f (g x) > 0}"
   have eq: "{x. (if x \<in> S then ?D x else 0) > 0} = {x \<in> S. ?D x > 0}"
            "{x. (if x \<in> S then ?D x else 0) < 0} = {x \<in> S. ?D x < 0}"
     by auto
   have "?D integrable_on S"
     using intS absolutely_integrable_on_def by blast
   then have "(\<lambda>x. if x \<in> S then ?D x else 0) integrable_on UNIV"
     by (simp add: integrable_restrict_UNIV)
   then have D_borel: "(\<lambda>x. if x \<in> S then ?D x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
     using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
   then have Dlt: "{x \<in> S. ?D x < 0} \<in> sets lebesgue"
     unfolding borel_measurable_vimage_halfspace_component_lt
     by (drule_tac x=0 in spec) (auto simp: eq)
   from D_borel have Dgt: "{x \<in> S. ?D x > 0} \<in> sets lebesgue"
     unfolding borel_measurable_vimage_halfspace_component_gt
     by (drule_tac x=0 in spec) (auto simp: eq)
 
   have dfgbm: "?D \<in> borel_measurable (lebesgue_on S)"
     using intS absolutely_integrable_on_def integrable_imp_measurable by blast
   have der_gN: "(g has_derivative g' x) (at x within ?N)" if "x \<in> ?N" for x
       using der_g has_derivative_subset that by force
   have "(\<lambda>x. - f x) integrable_on g ` ?N \<and>
          integral (g ` ?N) (\<lambda>x. - f x) \<le> integral ?N (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x))"
   proof (rule integral_on_image_ubound_nonneg [OF _ der_gN])
     have 1: "?D integrable_on {x \<in> S. ?D x < 0}"
       using Dlt
       by (auto intro: set_lebesgue_integral_eq_integral [OF set_integrable_subset] intS)
     have "uminus \<circ> (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x)) integrable_on ?N"
       by (simp add: o_def mult_less_0_iff empty_imp_negligible integrable_spike_set [OF 1])
     then show "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x)) integrable_on ?N"
       by (simp add: integrable_neg_iff o_def)
   qed auto
   then have "f integrable_on g ` ?N"
     by (simp add: integrable_neg_iff)
   moreover have "g ` ?N = {y \<in> g ` S. f y < 0}"
     by auto
   ultimately have "f integrable_on {y \<in> g ` S. f y < 0}"
     by simp
   then have N: "f absolutely_integrable_on {y \<in> g ` S. f y < 0}"
     by (rule absolutely_integrable_absolutely_integrable_ubound) auto
 
   have der_gP: "(g has_derivative g' x) (at x within ?P)" if "x \<in> ?P" for x
       using der_g has_derivative_subset that by force
   have "f integrable_on g ` ?P \<and> integral (g ` ?P) f \<le> integral ?P ?D"
   proof (rule integral_on_image_ubound_nonneg [OF _ der_gP])
     have "?D integrable_on {x \<in> S. 0 < ?D x}"
       using Dgt
       by (auto intro: set_lebesgue_integral_eq_integral [OF set_integrable_subset] intS)
     then show "?D integrable_on ?P"
       apply (rule integrable_spike_set)
       by (auto simp: zero_less_mult_iff empty_imp_negligible)
   qed auto
   then have "f integrable_on g ` ?P"
     by metis
   moreover have "g ` ?P = {y \<in> g ` S. f y > 0}"
     by auto
   ultimately have "f integrable_on {y \<in> g ` S. f y > 0}"
     by simp
   then have P: "f absolutely_integrable_on {y \<in> g ` S. f y > 0}"
     by (rule absolutely_integrable_absolutely_integrable_lbound) auto
   have "(\<lambda>x. if x \<in> g ` S \<and> f x < 0 \<or> x \<in> g ` S \<and> 0 < f x then f x else 0) = (\<lambda>x. if x \<in> g ` S then f x else 0)"
     by auto
   then show ?thesis
     using absolutely_integrable_Un [OF N P] absolutely_integrable_restrict_UNIV [symmetric, where f=f]
     by simp
 qed
 
 
 proposition absolutely_integrable_on_image:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S"
   shows "f absolutely_integrable_on (g ` S)"
   apply (rule absolutely_integrable_componentwise [OF absolutely_integrable_on_image_real [OF der_g]])
   using absolutely_integrable_component [OF intS]  by auto
 
 proposition integral_on_image_ubound:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes"\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
     and "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
   shows "integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
   using integral_on_image_ubound_nonneg [OF assms] by simp
 
 
 subsection\<open>Change-of-variables theorem\<close>
 
 text\<open>The classic change-of-variables theorem. We have two versions with quite general hypotheses,
 the first that the transforming function has a continuous inverse, the second that the base set is
 Lebesgue measurable.\<close>
 lemma cov_invertible_nonneg_le:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
     and f0: "\<And>y. y \<in> T \<Longrightarrow> 0 \<le> f y"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
     and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
     and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "f integrable_on T \<and> (integral T f) \<le> b \<longleftrightarrow>
              (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) \<le> b"
         (is "?lhs = ?rhs")
 proof -
   have Teq: "T = g`S" and Seq: "S = h`T"
     using hg gh image_iff by fastforce+
   have gS: "g differentiable_on S"
     by (meson der_g differentiable_def differentiable_on_def)
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f (g x)"
   show ?thesis
   proof
     assume ?lhs
     then have fT: "f integrable_on T" and intf: "integral T f \<le> b"
       by blast+
     show ?rhs
     proof
       let ?fgh = "\<lambda>x. \<bar>det (matrix (h' x))\<bar> * (\<bar>det (matrix (g' (h x)))\<bar> * f (g (h x)))"
       have ddf: "?fgh x = f x"
         if "x \<in> T" for x
       proof -
         have "matrix (h' x) ** matrix (g' (h x)) = mat 1"
           using that id[OF that] der_g[of "h x"] gh[OF that] left_inverse_linear has_derivative_linear
           by (subst matrix_compose[symmetric]) (force simp: matrix_id_mat_1 has_derivative_linear)+
         then have "\<bar>det (matrix (h' x))\<bar> * \<bar>det (matrix (g' (h x)))\<bar> = 1"
           by (metis abs_1 abs_mult det_I det_mul)
         then show ?thesis
           by (simp add: gh that)
       qed
       have "?D integrable_on (h ` T)"
       proof (intro set_lebesgue_integral_eq_integral absolutely_integrable_on_image_real)
         show "(\<lambda>x. ?fgh x) absolutely_integrable_on T"
         proof (subst absolutely_integrable_on_iff_nonneg)
           show "(\<lambda>x. ?fgh x) integrable_on T"
             using ddf fT integrable_eq by force
         qed (simp add: zero_le_mult_iff f0 gh)
       qed (use der_h in auto)
       with Seq show "(\<lambda>x. ?D x) integrable_on S"
         by simp
       have "integral S (\<lambda>x. ?D x) \<le> integral T (\<lambda>x. ?fgh x)"
         unfolding Seq
       proof (rule integral_on_image_ubound)
         show "(\<lambda>x. ?fgh x) integrable_on T"
         using ddf fT integrable_eq by force
       qed (use f0 gh der_h in auto)
       also have "\<dots> = integral T f"
         by (force simp: ddf intro: integral_cong)
       also have "\<dots> \<le> b"
         by (rule intf)
       finally show "integral S (\<lambda>x. ?D x) \<le> b" .
     qed
   next
     assume R: ?rhs
     then have "f integrable_on g ` S"
       using der_g f0 hg integral_on_image_ubound_nonneg by blast
     moreover have "integral (g ` S) f \<le> integral S (\<lambda>x. ?D x)"
       by (rule integral_on_image_ubound [OF f0 der_g]) (use R Teq in auto)
     ultimately show ?lhs
       using R by (simp add: Teq)
   qed
 qed
 
 
 lemma cov_invertible_nonneg_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
       and "\<And>y. y \<in> T \<Longrightarrow> 0 \<le> f y"
       and "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
       and "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
       and "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) has_integral b) S \<longleftrightarrow> (f has_integral b) T"
   using cov_invertible_nonneg_le [OF assms]
   by (simp add: has_integral_iff) (meson eq_iff)
 
 
 lemma cov_invertible_real:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
       and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
       and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
       and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) = b \<longleftrightarrow>
          f absolutely_integrable_on T \<and> integral T f = b"
          (is "?lhs = ?rhs")
 proof -
   have Teq: "T = g`S" and Seq: "S = h`T"
     using hg gh image_iff by fastforce+
   let ?DP = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)" and ?DN = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * -f(g x)"
   have "+": "(?DP has_integral b) {x \<in> S. f (g x) > 0} \<longleftrightarrow> (f has_integral b) {y \<in> T. f y > 0}" for b
   proof (rule cov_invertible_nonneg_eq)
     have *: "(\<lambda>x. f (g x)) -` Y \<inter> {x \<in> S. f (g x) > 0}
           = ((\<lambda>x. f (g x)) -` Y \<inter> S) \<inter> {x \<in> S. f (g x) > 0}" for Y
       by auto
     show "(g has_derivative g' x) (at x within {x \<in> S. f (g x) > 0})" if "x \<in> {x \<in> S. f (g x) > 0}" for x
       using that der_g has_derivative_subset by fastforce
     show "(h has_derivative h' y) (at y within {y \<in> T. f y > 0})" if "y \<in> {y \<in> T. f y > 0}" for y
       using that der_h has_derivative_subset by fastforce
   qed (use gh hg id in auto)
   have "-": "(?DN has_integral b) {x \<in> S. f (g x) < 0} \<longleftrightarrow> ((\<lambda>x. - f x) has_integral b) {y \<in> T. f y < 0}" for b
   proof (rule cov_invertible_nonneg_eq)
     have *: "(\<lambda>x. - f (g x)) -` y \<inter> {x \<in> S. f (g x) < 0}
           = ((\<lambda>x. f (g x)) -` uminus ` y \<inter> S) \<inter> {x \<in> S. f (g x) < 0}" for y
       using image_iff by fastforce
     show "(g has_derivative g' x) (at x within {x \<in> S. f (g x) < 0})" if "x \<in> {x \<in> S. f (g x) < 0}" for x
       using that der_g has_derivative_subset by fastforce
     show "(h has_derivative h' y) (at y within {y \<in> T. f y < 0})" if "y \<in> {y \<in> T. f y < 0}" for y
       using that der_h has_derivative_subset by fastforce
   qed (use gh hg id in auto)
   show ?thesis
   proof
     assume LHS: ?lhs
     have eq: "{x. (if x \<in> S then ?DP x else 0) > 0} = {x \<in> S. ?DP x > 0}"
       "{x. (if x \<in> S then ?DP x else 0) < 0} = {x \<in> S. ?DP x < 0}"
       by auto
     have "?DP integrable_on S"
       using LHS absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> S then ?DP x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have D_borel: "(\<lambda>x. if x \<in> S then ?DP x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then have SN: "{x \<in> S. ?DP x < 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_lt
       by (drule_tac x=0 in spec) (auto simp: eq)
     from D_borel have SP: "{x \<in> S. ?DP x > 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_gt
       by (drule_tac x=0 in spec) (auto simp: eq)
     have "?DP absolutely_integrable_on {x \<in> S. ?DP x > 0}"
       using LHS by (fast intro!: set_integrable_subset [OF _, of _ S] SP)
     then have aP: "?DP absolutely_integrable_on {x \<in> S. f (g x) > 0}"
       by (rule absolutely_integrable_spike_set) (auto simp: zero_less_mult_iff empty_imp_negligible)
     have "?DP absolutely_integrable_on {x \<in> S. ?DP x < 0}"
       using LHS by (fast intro!: set_integrable_subset [OF _, of _ S] SN)
     then have aN: "?DP absolutely_integrable_on {x \<in> S. f (g x) < 0}"
       by (rule absolutely_integrable_spike_set) (auto simp: mult_less_0_iff empty_imp_negligible)
     have fN: "f integrable_on {y \<in> T. f y < 0}"
              "integral {y \<in> T. f y < 0} f = integral {x \<in> S. f (g x) < 0} ?DP"
       using "-" [of "integral {x \<in> S. f(g x) < 0} ?DN"] aN
       by (auto simp: set_lebesgue_integral_eq_integral has_integral_iff integrable_neg_iff)
     have faN: "f absolutely_integrable_on {y \<in> T. f y < 0}"
       apply (rule absolutely_integrable_integrable_bound [where g = "\<lambda>x. - f x"])
       using fN by (auto simp: integrable_neg_iff)
     have fP: "f integrable_on {y \<in> T. f y > 0}"
              "integral {y \<in> T. f y > 0} f = integral {x \<in> S. f (g x) > 0} ?DP"
       using "+" [of "integral {x \<in> S. f(g x) > 0} ?DP"] aP
       by (auto simp: set_lebesgue_integral_eq_integral has_integral_iff integrable_neg_iff)
     have faP: "f absolutely_integrable_on {y \<in> T. f y > 0}"
       apply (rule absolutely_integrable_integrable_bound [where g = f])
       using fP by auto
     have fa: "f absolutely_integrable_on ({y \<in> T. f y < 0} \<union> {y \<in> T. f y > 0})"
       by (rule absolutely_integrable_Un [OF faN faP])
     show ?rhs
     proof
       have eq: "((if x \<in> T \<and> f x < 0 \<or> x \<in> T \<and> 0 < f x then 1 else 0) * f x)
               = (if x \<in> T then 1 else 0) * f x" for x
         by auto
       show "f absolutely_integrable_on T"
         using fa by (simp add: indicator_def of_bool_def set_integrable_def eq)
       have [simp]: "{y \<in> T. f y < 0} \<inter> {y \<in> T. 0 < f y} = {}" for T and f :: "(real^'n::_) \<Rightarrow> real"
         by auto
       have "integral T f = integral ({y \<in> T. f y < 0} \<union> {y \<in> T. f y > 0}) f"
         by (intro empty_imp_negligible integral_spike_set) (auto simp: eq)
       also have "\<dots> = integral {y \<in> T. f y < 0} f + integral {y \<in> T. f y > 0} f"
         using fN fP by simp
       also have "\<dots> = integral {x \<in> S. f (g x) < 0} ?DP + integral {x \<in> S. 0 < f (g x)} ?DP"
         by (simp add: fN fP)
       also have "\<dots> = integral ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. 0 < f (g x)}) ?DP"
         using aP aN by (simp add: set_lebesgue_integral_eq_integral)
       also have "\<dots> = integral S ?DP"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = b"
         using LHS by simp
       finally show "integral T f = b" .
     qed
   next
     assume RHS: ?rhs
     have eq: "{x. (if x \<in> T then f x else 0) > 0} = {x \<in> T. f x > 0}"
              "{x. (if x \<in> T then f x else 0) < 0} = {x \<in> T. f x < 0}"
       by auto
     have "f integrable_on T"
       using RHS absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> T then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have D_borel: "(\<lambda>x. if x \<in> T then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then have TN: "{x \<in> T. f x < 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_lt
       by (drule_tac x=0 in spec) (auto simp: eq)
     from D_borel have TP: "{x \<in> T. f x > 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_gt
       by (drule_tac x=0 in spec) (auto simp: eq)
     have aint: "f absolutely_integrable_on {y. y \<in> T \<and> 0 < (f y)}"
                "f absolutely_integrable_on {y. y \<in> T \<and> (f y) < 0}"
          and intT: "integral T f = b"
       using set_integrable_subset [of _ T] TP TN RHS
       by blast+
     show ?lhs
     proof
       have fN: "f integrable_on {v \<in> T. f v < 0}"
         using absolutely_integrable_on_def aint by blast
       then have DN: "(?DN has_integral integral {y \<in> T. f y < 0} (\<lambda>x. - f x)) {x \<in> S. f (g x) < 0}"
         using "-" [of "integral {y \<in> T. f y < 0} (\<lambda>x. - f x)"]
         by (simp add: has_integral_neg_iff integrable_integral)
       have aDN: "?DP absolutely_integrable_on {x \<in> S. f (g x) < 0}"
         apply (rule absolutely_integrable_integrable_bound [where g = ?DN])
         using DN hg by (fastforce simp: abs_mult integrable_neg_iff)+
       have fP: "f integrable_on {v \<in> T. f v > 0}"
         using absolutely_integrable_on_def aint by blast
       then have DP: "(?DP has_integral integral {y \<in> T. f y > 0} f) {x \<in> S. f (g x) > 0}"
         using "+" [of "integral {y \<in> T. f y > 0} f"]
         by (simp add: has_integral_neg_iff integrable_integral)
       have aDP: "?DP absolutely_integrable_on {x \<in> S. f (g x) > 0}"
         apply (rule absolutely_integrable_integrable_bound [where g = ?DP])
         using DP hg by (fastforce simp: integrable_neg_iff)+
       have eq: "(if x \<in> S then 1 else 0) * ?DP x = (if x \<in> S \<and> f (g x) < 0 \<or> x \<in> S \<and> f (g x) > 0 then 1 else 0) * ?DP x" for x
         by force
       have "?DP absolutely_integrable_on ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. f (g x) > 0})"
         by (rule absolutely_integrable_Un [OF aDN aDP])
       then show I: "?DP absolutely_integrable_on S"
         by (simp add: indicator_def of_bool_def eq set_integrable_def)
       have [simp]: "{y \<in> S. f y < 0} \<inter> {y \<in> S. 0 < f y} = {}" for S and f :: "(real^'n::_) \<Rightarrow> real"
         by auto
       have "integral S ?DP = integral ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. f (g x) > 0}) ?DP"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = integral {x \<in> S. f (g x) < 0} ?DP + integral {x \<in> S. 0 < f (g x)} ?DP"
         using aDN aDP by (simp add: set_lebesgue_integral_eq_integral)
       also have "\<dots> = - integral {y \<in> T. f y < 0} (\<lambda>x. - f x) + integral {y \<in> T. f y > 0} f"
         using DN DP by (auto simp: has_integral_iff)
       also have "\<dots> = integral ({x \<in> T. f x < 0} \<union> {x \<in> T. 0 < f x}) f"
         by (simp add: fN fP)
       also have "\<dots> = integral T f"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = b"
         using intT by simp
       finally show "integral S ?DP = b" .
     qed
   qed
 qed
 
 
 lemma cv_inv_version3:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
     and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
     and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on T \<and> integral T f = b"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)"
   have "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x) $ i) absolutely_integrable_on S \<and> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * (f(g x) $ i)) = b $ i) \<longleftrightarrow>
         ((\<lambda>x. f x $ i) absolutely_integrable_on T \<and> integral T (\<lambda>x. f x $ i) = b $ i)" for i
     by (rule cov_invertible_real [OF der_g der_h hg gh id])
   then have "?D absolutely_integrable_on S \<and> (?D has_integral b) S \<longleftrightarrow>
         f absolutely_integrable_on T \<and> (f has_integral b) T"
     unfolding absolutely_integrable_componentwise_iff [where f=f] has_integral_componentwise_iff [of f]
               absolutely_integrable_componentwise_iff [where f="?D"] has_integral_componentwise_iff [of ?D]
     by (auto simp: all_conj_distrib Basis_vec_def cart_eq_inner_axis [symmetric]
            has_integral_iff set_lebesgue_integral_eq_integral)
   then show ?thesis
     using absolutely_integrable_on_def by blast
 qed
 
 
 lemma cv_inv_version4:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S) \<and> invertible(matrix(g' x))"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> continuous_on (g ` S) h \<and> h(g x) = x"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   have "\<forall>x. \<exists>h'. x \<in> S
            \<longrightarrow> (g has_derivative g' x) (at x within S) \<and> linear h' \<and> g' x \<circ> h' = id \<and> h' \<circ> g' x = id"
     using der_g matrix_invertible has_derivative_linear by blast
   then obtain h' where h':
     "\<And>x. x \<in> S
            \<Longrightarrow> (g has_derivative g' x) (at x within S) \<and>
                linear (h' x) \<and> g' x \<circ> (h' x) = id \<and> (h' x) \<circ> g' x = id"
     by metis
   show ?thesis
   proof (rule cv_inv_version3)
     show "\<And>y. y \<in> g ` S \<Longrightarrow> (h has_derivative h' (h y)) (at y within g ` S)"
       using h' hg
       by (force simp: continuous_on_eq_continuous_within intro!: has_derivative_inverse_within)
   qed (use h' hg in auto)
 qed
 
 
 theorem has_absolute_integral_change_of_variables_invertible:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and hg: "\<And>x. x \<in> S \<Longrightarrow> h(g x) = x"
       and conth: "continuous_on (g ` S) h"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b \<longleftrightarrow>
          f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
     (is "?lhs = ?rhs")
 proof -
   let ?S = "{x \<in> S. invertible (matrix (g' x))}" and ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)"
   have *: "?D absolutely_integrable_on ?S \<and> integral ?S ?D = b
            \<longleftrightarrow> f absolutely_integrable_on (g ` ?S) \<and> integral (g ` ?S) f = b"
   proof (rule cv_inv_version4)
     show "(g has_derivative g' x) (at x within ?S) \<and> invertible (matrix (g' x))"
       if "x \<in> ?S" for x
       using der_g that has_derivative_subset that by fastforce
     show "continuous_on (g ` ?S) h \<and> h (g x) = x"
       if "x \<in> ?S" for x
       using that continuous_on_subset [OF conth]  by (simp add: hg image_mono)
   qed
   have "(g has_derivative g' x) (at x within {x \<in> S. rank (matrix (g' x)) < CARD('m)})" if "x \<in> S" for x
     by (metis (no_types, lifting) der_g has_derivative_subset mem_Collect_eq subsetI that)
   then have "negligible (g ` {x \<in> S. \<not> invertible (matrix (g' x))})"
     by (auto simp: invertible_det_nz det_eq_0_rank intro: baby_Sard)
   then have neg: "negligible {x \<in> g ` S. x \<notin> g ` ?S \<and> f x \<noteq> 0}"
     by (auto intro: negligible_subset)
   have [simp]: "{x \<in> g ` ?S. x \<notin> g ` S \<and> f x \<noteq> 0} = {}"
     by auto
   have "?D absolutely_integrable_on ?S \<and> integral ?S ?D = b
     \<longleftrightarrow> ?D absolutely_integrable_on S \<and> integral S ?D = b"
     apply (intro conj_cong absolutely_integrable_spike_set_eq)
       apply(auto simp: integral_spike_set invertible_det_nz empty_imp_negligible neg)
     done
   moreover
   have "f absolutely_integrable_on (g ` ?S) \<and> integral (g ` ?S) f = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
     by (auto intro!: conj_cong absolutely_integrable_spike_set_eq integral_spike_set neg)
   ultimately
   show ?thesis
     using "*" by blast
 qed
 
 
 
 theorem has_absolute_integral_change_of_variables_compact:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "compact S"
       and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and inj: "inj_on g S"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
       \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b)"
 proof -
   obtain h where hg: "\<And>x. x \<in> S \<Longrightarrow> h(g x) = x"
     using inj by (metis the_inv_into_f_f)
   have conth: "continuous_on (g ` S) h"
     by (metis \<open>compact S\<close> continuous_on_inv der_g has_derivative_continuous_on hg)
   show ?thesis
     by (rule has_absolute_integral_change_of_variables_invertible [OF der_g hg conth])
 qed
 
 
 lemma has_absolute_integral_change_of_variables_compact_family:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes compact: "\<And>n::nat. compact (F n)"
       and der_g: "\<And>x. x \<in> (\<Union>n. F n) \<Longrightarrow> (g has_derivative g' x) (at x within (\<Union>n. F n))"
       and inj: "inj_on g (\<Union>n. F n)"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on (\<Union>n. F n) \<and>
              integral (\<Union>n. F n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
       \<longleftrightarrow> f absolutely_integrable_on (g ` (\<Union>n. F n)) \<and> integral (g ` (\<Union>n. F n)) f = b)"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)"
   let ?U = "\<lambda>n. \<Union>m\<le>n. F m"
   let ?lift = "vec::real\<Rightarrow>real^1"
   have F_leb: "F m \<in> sets lebesgue" for m
     by (simp add: compact borel_compact)
   have iff: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)) absolutely_integrable_on (?U n) \<and>
              integral (?U n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on (g ` (?U n)) \<and> integral (g ` (?U n)) f = b" for n b and f :: "real^'m::_ \<Rightarrow> real^'k"
   proof (rule has_absolute_integral_change_of_variables_compact)
     show "compact (?U n)"
       by (simp add: compact compact_UN)
     show "(g has_derivative g' x) (at x within (?U n))"
       if "x \<in> ?U n" for x
       using that by (blast intro!: has_derivative_subset [OF der_g])
     show "inj_on g (?U n)"
       using inj by (auto simp: inj_on_def)
   qed
   show ?thesis
     unfolding image_UN
   proof safe
     assume DS: "?D absolutely_integrable_on (\<Union>n. F n)"
       and b: "b = integral (\<Union>n. F n) ?D"
     have DU: "\<And>n. ?D absolutely_integrable_on (?U n)"
              "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
       using integral_countable_UN [OF DS F_leb] by auto
     with iff have fag: "f absolutely_integrable_on g ` (?U n)"
       and fg_int: "integral (\<Union>m\<le>n. g ` F m) f = integral (?U n) ?D" for n
       by (auto simp: image_UN)
     let ?h = "\<lambda>x. if x \<in> (\<Union>m. g ` F m) then norm(f x) else 0"
     have "(\<lambda>x. if x \<in> (\<Union>m. g ` F m) then f x else 0) absolutely_integrable_on UNIV"
     proof (rule dominated_convergence_absolutely_integrable)
       show "(\<lambda>x. if x \<in> (\<Union>m\<le>k. g ` F m) then f x else 0) absolutely_integrable_on UNIV" for k
         unfolding absolutely_integrable_restrict_UNIV
         using fag by (simp add: image_UN)
       let ?nf = "\<lambda>n x. if x \<in> (\<Union>m\<le>n. g ` F m) then norm(f x) else 0"
       show "?h integrable_on UNIV"
       proof (rule monotone_convergence_increasing [THEN conjunct1])
         show "?nf k integrable_on UNIV" for k
           using fag
           unfolding integrable_restrict_UNIV absolutely_integrable_on_def by (simp add: image_UN)
         { fix n
           have "(norm \<circ> ?D) absolutely_integrable_on ?U n"
             by (intro absolutely_integrable_norm DU)
           then have "integral (g ` ?U n) (norm \<circ> f) = integral (?U n) (norm \<circ> ?D)"
             using iff [of n "vec \<circ> norm \<circ> f" "integral (?U n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R (?lift \<circ> norm \<circ> f) (g x))"]
             unfolding absolutely_integrable_on_1_iff integral_on_1_eq by (auto simp: o_def)
         }
         moreover have "bounded (range (\<lambda>k. integral (?U k) (norm \<circ> ?D)))"
           unfolding bounded_iff
         proof (rule exI, clarify)
           fix k
           show "norm (integral (?U k) (norm \<circ> ?D)) \<le> integral (\<Union>n. F n) (norm \<circ> ?D)"
             unfolding integral_restrict_UNIV [of _ "norm \<circ> ?D", symmetric]
           proof (rule integral_norm_bound_integral)
             show "(\<lambda>x. if x \<in> \<Union> (F ` {..k}) then (norm \<circ> ?D) x else 0) integrable_on UNIV"
               "(\<lambda>x. if x \<in> (\<Union>n. F n) then (norm \<circ> ?D) x else 0) integrable_on UNIV"
               using DU(1) DS
               unfolding absolutely_integrable_on_def o_def integrable_restrict_UNIV by auto
           qed auto
         qed
         ultimately show "bounded (range (\<lambda>k. integral UNIV (?nf k)))"
           by (simp add: integral_restrict_UNIV image_UN [symmetric] o_def)
       next
         show "(\<lambda>k. if x \<in> (\<Union>m\<le>k. g ` F m) then norm (f x) else 0)
               \<longlonglongrightarrow> (if x \<in> (\<Union>m. g ` F m) then norm (f x) else 0)" for x
           by (force intro: tendsto_eventually eventually_sequentiallyI)
       qed auto
     next
       show "(\<lambda>k. if x \<in> (\<Union>m\<le>k. g ` F m) then f x else 0)
             \<longlonglongrightarrow> (if x \<in> (\<Union>m. g ` F m) then f x else 0)" for x
       proof clarsimp
         fix m y
         assume "y \<in> F m"
         show "(\<lambda>k. if \<exists>x\<in>{..k}. g y \<in> g ` F x then f (g y) else 0) \<longlonglongrightarrow> f (g y)"
           using \<open>y \<in> F m\<close> by (force intro: tendsto_eventually eventually_sequentiallyI [of m])
       qed
     qed auto
     then show fai: "f absolutely_integrable_on (\<Union>m. g ` F m)"
       using absolutely_integrable_restrict_UNIV by blast
     show "integral ((\<Union>x. g ` F x)) f = integral (\<Union>n. F n) ?D"
     proof (rule LIMSEQ_unique)
       show "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>x. g ` F x) f"
         unfolding fg_int [symmetric]
       proof (rule integral_countable_UN [OF fai])
         show "g ` F m \<in> sets lebesgue" for m
         proof (rule differentiable_image_in_sets_lebesgue [OF F_leb])
           show "g differentiable_on F m"
             by (meson der_g differentiableI UnionI differentiable_on_def differentiable_on_subset rangeI subsetI)
         qed auto
       qed
     next
       show "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
         by (rule DU)
     qed
   next
     assume fs: "f absolutely_integrable_on (\<Union>x. g ` F x)"
       and b: "b = integral ((\<Union>x. g ` F x)) f"
     have gF_leb: "g ` F m \<in> sets lebesgue" for m
     proof (rule differentiable_image_in_sets_lebesgue [OF F_leb])
       show "g differentiable_on F m"
         using der_g unfolding differentiable_def differentiable_on_def
         by (meson Sup_upper UNIV_I UnionI has_derivative_subset image_eqI)
     qed auto
     have fgU: "\<And>n. f absolutely_integrable_on (\<Union>m\<le>n. g ` F m)"
       "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>m. g ` F m) f"
       using integral_countable_UN [OF fs gF_leb] by auto
     with iff have DUn: "?D absolutely_integrable_on ?U n"
       and D_int: "integral (?U n) ?D = integral (\<Union>m\<le>n. g ` F m) f" for n
       by (auto simp: image_UN)
     let ?h = "\<lambda>x. if x \<in> (\<Union>n. F n) then norm(?D x) else 0"
     have "(\<lambda>x. if x \<in> (\<Union>n. F n) then ?D x else 0) absolutely_integrable_on UNIV"
     proof (rule dominated_convergence_absolutely_integrable)
       show "(\<lambda>x. if x \<in> ?U k then ?D x else 0) absolutely_integrable_on UNIV" for k
         unfolding absolutely_integrable_restrict_UNIV using DUn by simp
       let ?nD = "\<lambda>n x. if x \<in> ?U n then norm(?D x) else 0"
       show "?h integrable_on UNIV"
       proof (rule monotone_convergence_increasing [THEN conjunct1])
         show "?nD k integrable_on UNIV" for k
           using DUn
           unfolding integrable_restrict_UNIV absolutely_integrable_on_def by (simp add: image_UN)
         { fix n::nat
           have "(norm \<circ> f) absolutely_integrable_on (\<Union>m\<le>n. g ` F m)"
             apply (rule absolutely_integrable_norm)
             using fgU by blast
           then have "integral (?U n) (norm \<circ> ?D) = integral (g ` ?U n) (norm \<circ> f)"
             using iff [of n "?lift \<circ> norm \<circ> f" "integral (g ` ?U n) (?lift \<circ> norm \<circ> f)"]
             unfolding absolutely_integrable_on_1_iff integral_on_1_eq image_UN by (auto simp: o_def)
         }
         moreover have "bounded (range (\<lambda>k. integral (g ` ?U k) (norm \<circ> f)))"
           unfolding bounded_iff
         proof (rule exI, clarify)
           fix k
           show "norm (integral (g ` ?U k) (norm \<circ> f)) \<le> integral (g ` (\<Union>n. F n)) (norm \<circ> f)"
             unfolding integral_restrict_UNIV [of _ "norm \<circ> f", symmetric]
           proof (rule integral_norm_bound_integral)
             show "(\<lambda>x. if x \<in> g ` ?U k then (norm \<circ> f) x else 0) integrable_on UNIV"
                  "(\<lambda>x. if x \<in> g ` (\<Union>n. F n) then (norm \<circ> f) x else 0) integrable_on UNIV"
               using fgU fs
               unfolding absolutely_integrable_on_def o_def integrable_restrict_UNIV
               by (auto simp: image_UN)
           qed auto
         qed
         ultimately show "bounded (range (\<lambda>k. integral UNIV (?nD k)))"
           unfolding integral_restrict_UNIV image_UN [symmetric] o_def by simp
       next
         show "(\<lambda>k. if x \<in> ?U k then norm (?D x) else 0) \<longlonglongrightarrow> (if x \<in> (\<Union>n. F n) then norm (?D x) else 0)" for x
           by (force intro: tendsto_eventually eventually_sequentiallyI)
       qed auto
     next
       show "(\<lambda>k. if x \<in> ?U k then ?D x else 0) \<longlonglongrightarrow> (if x \<in> (\<Union>n. F n) then ?D x else 0)" for x
       proof clarsimp
         fix n
         assume "x \<in> F n"
         show "(\<lambda>m. if \<exists>j\<in>{..m}. x \<in> F j then ?D x else 0) \<longlonglongrightarrow> ?D x"
           using \<open>x \<in> F n\<close> by (auto intro!: tendsto_eventually eventually_sequentiallyI [of n])
       qed
     qed auto
     then show Dai: "?D absolutely_integrable_on (\<Union>n. F n)"
       unfolding absolutely_integrable_restrict_UNIV by simp
     show "integral (\<Union>n. F n) ?D = integral ((\<Union>x. g ` F x)) f"
     proof (rule LIMSEQ_unique)
       show "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>x. g ` F x) f"
         by (rule fgU)
       show "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
         unfolding D_int [symmetric] by (rule integral_countable_UN [OF Dai F_leb])
     qed
   qed
 qed
 
 
 theorem has_absolute_integral_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   obtain C N where "fsigma C" and N: "N \<in> null_sets lebesgue" and CNS: "C \<union> N = S" and "disjnt C N"
     using lebesgue_set_almost_fsigma [OF S] .
   then obtain F :: "nat \<Rightarrow> (real^'m::_) set"
     where F: "range F \<subseteq> Collect compact" and Ceq: "C = Union(range F)"
     using fsigma_Union_compact by metis
   have "negligible N"
     using N by (simp add: negligible_iff_null_sets)
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)"
   have "?D absolutely_integrable_on C \<and> integral C ?D = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` C) \<and> integral (g ` C) f = b"
     unfolding Ceq
   proof (rule has_absolute_integral_change_of_variables_compact_family)
     fix n x
     assume "x \<in> \<Union>(F ` UNIV)"
     then show "(g has_derivative g' x) (at x within \<Union>(F ` UNIV))"
       using Ceq \<open>C \<union> N = S\<close> der_g has_derivative_subset by blast
   next
     have "\<Union>(F ` UNIV) \<subseteq> S"
       using Ceq \<open>C \<union> N = S\<close> by blast
     then show "inj_on g (\<Union>(F ` UNIV))"
       using inj by (meson inj_on_subset)
   qed (use F in auto)
   moreover
   have "?D absolutely_integrable_on C \<and> integral C ?D = b
     \<longleftrightarrow> ?D absolutely_integrable_on S \<and> integral S ?D = b"
   proof (rule conj_cong)
     have neg: "negligible {x \<in> C - S. ?D x \<noteq> 0}" "negligible {x \<in> S - C. ?D x \<noteq> 0}"
       using CNS by (blast intro: negligible_subset [OF \<open>negligible N\<close>])+
     then show "(?D absolutely_integrable_on C) = (?D absolutely_integrable_on S)"
       by (rule absolutely_integrable_spike_set_eq)
     show "(integral C ?D = b) \<longleftrightarrow> (integral S ?D = b)"
       using integral_spike_set [OF neg] by simp
   qed
   moreover
   have "f absolutely_integrable_on (g ` C) \<and> integral (g ` C) f = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
   proof (rule conj_cong)
     have "g differentiable_on N"
       by (metis CNS der_g differentiable_def differentiable_on_def differentiable_on_subset sup.cobounded2)
     with \<open>negligible N\<close>
     have neg_gN: "negligible (g ` N)"
       by (blast intro: negligible_differentiable_image_negligible)
     have neg: "negligible {x \<in> g ` C - g ` S. f x \<noteq> 0}"
               "negligible {x \<in> g ` S - g ` C. f x \<noteq> 0}"
       using CNS by (blast intro: negligible_subset [OF neg_gN])+
     then show "(f absolutely_integrable_on g ` C) = (f absolutely_integrable_on g ` S)"
       by (rule absolutely_integrable_spike_set_eq)
     show "(integral (g ` C) f = b) \<longleftrightarrow> (integral (g ` S) f = b)"
       using integral_spike_set [OF neg] by simp
   qed
   ultimately show ?thesis
     by simp
 qed
 
 
 corollary absolutely_integrable_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "S \<in> sets lebesgue"
     and "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and "inj_on g S"
   shows "f absolutely_integrable_on (g ` S)
      \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S"
   using assms has_absolute_integral_change_of_variables by blast
 
 corollary integral_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
     and disj: "(f absolutely_integrable_on (g ` S) \<or>
         (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S)"
   shows "integral (g ` S) f = integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x))"
   using has_absolute_integral_change_of_variables [OF S der_g inj] disj
   by blast
 
 lemma has_absolute_integral_change_of_variables_1:
   fixes f :: "real \<Rightarrow> real^'n::{finite,wellorder}" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_vector_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   let ?lift = "vec :: real \<Rightarrow> real^1"
   let ?drop = "(\<lambda>x::real^1. x $ 1)"
   have S': "?lift ` S \<in> sets lebesgue"
     by (auto intro: differentiable_image_in_sets_lebesgue [OF S] differentiable_vec)
   have "((\<lambda>x. vec (g (x $ 1))) has_derivative (*\<^sub>R) (g' z)) (at (vec z) within ?lift ` S)"
     if "z \<in> S" for z
     using der_g [OF that]
     by (simp add: has_vector_derivative_def has_derivative_vector_1)
   then have der': "\<And>x. x \<in> ?lift ` S \<Longrightarrow>
         (?lift \<circ> g \<circ> ?drop has_derivative (*\<^sub>R) (g' (?drop x))) (at x within ?lift ` S)"
     by (auto simp: o_def)
   have inj': "inj_on (vec \<circ> g \<circ> ?drop) (vec ` S)"
     using inj by (simp add: inj_on_def)
   let ?fg = "\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)"
   have "((\<lambda>x. ?fg x $ i) absolutely_integrable_on S \<and> ((\<lambda>x. ?fg x $ i) has_integral b $ i) S
     \<longleftrightarrow> (\<lambda>x. f x $ i) absolutely_integrable_on g ` S \<and> ((\<lambda>x. f x $ i) has_integral b $ i) (g ` S))" for i
     using has_absolute_integral_change_of_variables [OF S' der' inj', of "\<lambda>x. ?lift(f (?drop x) $ i)" "?lift (b$i)"]
     unfolding integrable_on_1_iff integral_on_1_eq absolutely_integrable_on_1_iff absolutely_integrable_drop absolutely_integrable_on_def
     by (auto simp: image_comp o_def integral_vec1_eq has_integral_iff)
   then have "?fg absolutely_integrable_on S \<and> (?fg has_integral b) S
          \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> (f has_integral b) (g ` S)"
     unfolding has_integral_componentwise_iff [where y=b]
            absolutely_integrable_componentwise_iff [where f=f]
            absolutely_integrable_componentwise_iff [where f = ?fg]
     by (force simp: Basis_vec_def cart_eq_inner_axis)
   then show ?thesis
     using absolutely_integrable_on_def by blast
 qed
 
 
 corollary absolutely_integrable_change_of_variables_1:
   fixes f :: "real \<Rightarrow> real^'n::{finite,wellorder}" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_vector_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(f absolutely_integrable_on g ` S \<longleftrightarrow>
              (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S)"
   using has_absolute_integral_change_of_variables_1 [OF assms] by auto
 
 text \<open>when @{term "n=1"}\<close>
 lemma has_absolute_integral_change_of_variables_1':
   fixes f :: "real \<Rightarrow> real" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_field_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   have "(\<lambda>x. \<bar>g' x\<bar> *\<^sub>R vec (f(g x)) :: real ^ 1) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R vec (f(g x))) = (vec b :: real ^ 1)
          \<longleftrightarrow> (\<lambda>x. vec (f x) :: real ^ 1) absolutely_integrable_on (g ` S) \<and>
            integral (g ` S) (\<lambda>x. vec (f x)) = (vec b :: real ^ 1)"
-    using assms unfolding has_field_derivative_iff_has_vector_derivative
+    using assms unfolding has_real_derivative_iff_has_vector_derivative
     by (intro has_absolute_integral_change_of_variables_1 assms) auto
   thus ?thesis
     by (simp add: absolutely_integrable_on_1_iff integral_on_1_eq)
 qed
 
 
 subsection\<open>Change of variables for integrals: special case of linear function\<close>
 
 lemma has_absolute_integral_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "(\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof (cases "det(matrix g) = 0")
   case True
   then have "negligible(g ` S)"
     using assms det_nz_iff_inj negligible_linear_singular_image by blast
   with True show ?thesis
     by (auto simp: absolutely_integrable_on_def integrable_negligible integral_negligible)
 next
   case False
   then obtain h where h: "\<And>x. x \<in> S \<Longrightarrow> h (g x) = x" "linear h"
     using assms det_nz_iff_inj linear_injective_isomorphism by metis
   show ?thesis
   proof (rule has_absolute_integral_change_of_variables_invertible)
     show "(g has_derivative g) (at x within S)" for x
       by (simp add: assms linear_imp_has_derivative)
     show "continuous_on (g ` S) h"
       using continuous_on_eq_continuous_within has_derivative_continuous linear_imp_has_derivative h by blast
   qed (use h in auto)
 qed
 
 lemma absolutely_integrable_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "(\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S
      \<longleftrightarrow> f absolutely_integrable_on (g ` S)"
   using assms has_absolute_integral_change_of_variables_linear by blast
 
 lemma absolutely_integrable_on_linear_image:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "f absolutely_integrable_on (g ` S)
      \<longleftrightarrow> (f \<circ> g) absolutely_integrable_on S \<or> det(matrix g) = 0"
   unfolding assms absolutely_integrable_change_of_variables_linear [OF assms, symmetric] absolutely_integrable_on_scaleR_iff
   by (auto simp: set_integrable_def)
 
 lemma integral_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
       and "f absolutely_integrable_on (g ` S) \<or> (f \<circ> g) absolutely_integrable_on S"
     shows "integral (g ` S) f = \<bar>det (matrix g)\<bar> *\<^sub>R integral S (f \<circ> g)"
 proof -
   have "((\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f (g x)) absolutely_integrable_on S) \<or> (f absolutely_integrable_on g ` S)"
     using absolutely_integrable_on_linear_image assms by blast
   moreover
   have ?thesis if "((\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f (g x)) absolutely_integrable_on S)" "(f absolutely_integrable_on g ` S)"
     using has_absolute_integral_change_of_variables_linear [OF \<open>linear g\<close>] that
     by (auto simp: o_def)
   ultimately show ?thesis
     using absolutely_integrable_change_of_variables_linear [OF \<open>linear g\<close>]
     by blast
 qed
 
 subsection\<open>Change of variable for measure\<close>
 
 lemma has_measure_differentiable_image:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
       and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
       and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) = m
      \<longleftrightarrow> ((\<lambda>x. \<bar>det (matrix (f' x))\<bar>) has_integral m) S"
   using has_absolute_integral_change_of_variables [OF assms, of "\<lambda>x. (1::real^1)" "vec m"]
   unfolding absolutely_integrable_on_1_iff integral_on_1_eq integrable_on_1_iff absolutely_integrable_on_def
   by (auto simp: has_integral_iff lmeasurable_iff_integrable_on lmeasure_integral)
 
 lemma measurable_differentiable_image_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
       and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
       and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   using has_measure_differentiable_image [OF assms]
   by blast
 
 lemma measurable_differentiable_image_alt:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
     and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
   using measurable_differentiable_image_eq [OF assms]
   by (simp only: absolutely_integrable_on_iff_nonneg)
 
 lemma measure_differentiable_image_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue"
     and der_f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and inj: "inj_on f S"
     and intS: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows "measure lebesgue (f ` S) = integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
   using measurable_differentiable_image_eq [OF S der_f inj]
         assms has_measure_differentiable_image by blast
 
 end
diff --git a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
--- a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
+++ b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
@@ -1,5084 +1,5084 @@
 (*  Title:      HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
     Author:     Johannes Hölzl, TU München
     Author:     Robert Himmelmann, TU München
     Huge cleanup by LCP
 *)
 
 theory Equivalence_Lebesgue_Henstock_Integration
   imports
     Lebesgue_Measure
     Henstock_Kurzweil_Integration
     Complete_Measure
     Set_Integral
     Homeomorphism
     Cartesian_Euclidean_Space
 begin
 
 lemma LIMSEQ_if_less: "(\<lambda>k. if i < k then a else b) \<longlonglongrightarrow> a"
   by (rule_tac k="Suc i" in LIMSEQ_offset) auto
 
 text \<open>Note that the rhs is an implication. This lemma plays a specific role in one proof.\<close>
 lemma le_left_mono: "x \<le> y \<Longrightarrow> y \<le> a \<longrightarrow> x \<le> (a::'a::preorder)"
   by (auto intro: order_trans)
 
 lemma ball_trans:
   assumes "y \<in> ball z q" "r + q \<le> s" shows "ball y r \<subseteq> ball z s"
   using assms by metric
 
 lemma has_integral_implies_lebesgue_measurable_cbox:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "(f has_integral I) (cbox x y)"
   shows "f \<in> lebesgue_on (cbox x y) \<rightarrow>\<^sub>M borel"
 proof (rule cld_measure.borel_measurable_cld)
   let ?L = "lebesgue_on (cbox x y)"
   let ?\<mu> = "emeasure ?L"
   let ?\<mu>' = "outer_measure_of ?L"
   interpret L: finite_measure ?L
   proof
     show "?\<mu> (space ?L) \<noteq> \<infinity>"
       by (simp add: emeasure_restrict_space space_restrict_space emeasure_lborel_cbox_eq)
   qed
 
   show "cld_measure ?L"
   proof
     fix B A assume "B \<subseteq> A" "A \<in> null_sets ?L"
     then show "B \<in> sets ?L"
       using null_sets_completion_subset[OF \<open>B \<subseteq> A\<close>, of lborel]
       by (auto simp add: null_sets_restrict_space sets_restrict_space_iff intro: )
   next
     fix A assume "A \<subseteq> space ?L" "\<And>B. B \<in> sets ?L \<Longrightarrow> ?\<mu> B < \<infinity> \<Longrightarrow> A \<inter> B \<in> sets ?L"
     from this(1) this(2)[of "space ?L"] show "A \<in> sets ?L"
       by (auto simp: Int_absorb2 less_top[symmetric])
   qed auto
   then interpret cld_measure ?L
     .
 
   have content_eq_L: "A \<in> sets borel \<Longrightarrow> A \<subseteq> cbox x y \<Longrightarrow> content A = measure ?L A" for A
     by (subst measure_restrict_space) (auto simp: measure_def)
 
   fix E and a b :: real assume "E \<in> sets ?L" "a < b" "0 < ?\<mu> E" "?\<mu> E < \<infinity>"
   then obtain M :: real where "?\<mu> E = M" "0 < M"
     by (cases "?\<mu> E") auto
   define e where "e = M / (4 + 2 / (b - a))"
   from \<open>a < b\<close> \<open>0<M\<close> have "0 < e"
     by (auto intro!: divide_pos_pos simp: field_simps e_def)
 
   have "e < M / (3 + 2 / (b - a))"
     using \<open>a < b\<close> \<open>0 < M\<close>
     unfolding e_def by (intro divide_strict_left_mono add_strict_right_mono mult_pos_pos) (auto simp: field_simps)
   then have "2 * e < (b - a) * (M - e * 3)"
     using \<open>0<M\<close> \<open>0 < e\<close> \<open>a < b\<close> by (simp add: field_simps)
 
   have e_less_M: "e < M / 1"
     unfolding e_def using \<open>a < b\<close> \<open>0<M\<close> by (intro divide_strict_left_mono) (auto simp: field_simps)
 
   obtain d
     where "gauge d"
       and integral_f: "\<forall>p. p tagged_division_of cbox x y \<and> d fine p \<longrightarrow>
         norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R f x) - I) < e"
     using \<open>0<e\<close> f unfolding has_integral by auto
 
   define C where "C X m = X \<inter> {x. ball x (1/Suc m) \<subseteq> d x}" for X m
   have "incseq (C X)" for X
     unfolding C_def [abs_def]
     by (intro monoI Collect_mono conj_mono imp_refl le_left_mono subset_ball divide_left_mono Int_mono) auto
 
   { fix X assume "X \<subseteq> space ?L" and eq: "?\<mu>' X = ?\<mu> E"
     have "(SUP m. outer_measure_of ?L (C X m)) = outer_measure_of ?L (\<Union>m. C X m)"
       using \<open>X \<subseteq> space ?L\<close> by (intro SUP_outer_measure_of_incseq \<open>incseq (C X)\<close>) (auto simp: C_def)
     also have "(\<Union>m. C X m) = X"
     proof -
       { fix x
         obtain e where "0 < e" "ball x e \<subseteq> d x"
           using gaugeD[OF \<open>gauge d\<close>, of x] unfolding open_contains_ball by auto
         moreover
         obtain n where "1 / (1 + real n) < e"
           using reals_Archimedean[OF \<open>0<e\<close>] by (auto simp: inverse_eq_divide)
         then have "ball x (1 / (1 + real n)) \<subseteq> ball x e"
           by (intro subset_ball) auto
         ultimately have "\<exists>n. ball x (1 / (1 + real n)) \<subseteq> d x"
           by blast }
       then show ?thesis
         by (auto simp: C_def)
     qed
     finally have "(SUP m. outer_measure_of ?L (C X m)) = ?\<mu> E"
       using eq by auto
     also have "\<dots> > M - e"
       using \<open>0 < M\<close> \<open>?\<mu> E = M\<close> \<open>0<e\<close> by (auto intro!: ennreal_lessI)
     finally have "\<exists>m. M - e < outer_measure_of ?L (C X m)"
       unfolding less_SUP_iff by auto }
   note C = this
 
   let ?E = "{x\<in>E. f x \<le> a}" and ?F = "{x\<in>E. b \<le> f x}"
 
   have "\<not> (?\<mu>' ?E = ?\<mu> E \<and> ?\<mu>' ?F = ?\<mu> E)"
   proof
     assume eq: "?\<mu>' ?E = ?\<mu> E \<and> ?\<mu>' ?F = ?\<mu> E"
     with C[of ?E] C[of ?F] \<open>E \<in> sets ?L\<close>[THEN sets.sets_into_space] obtain ma mb
       where "M - e < outer_measure_of ?L (C ?E ma)" "M - e < outer_measure_of ?L (C ?F mb)"
       by auto
     moreover define m where "m = max ma mb"
     ultimately have M_minus_e: "M - e < outer_measure_of ?L (C ?E m)" "M - e < outer_measure_of ?L (C ?F m)"
       using
         incseqD[OF \<open>incseq (C ?E)\<close>, of ma m, THEN outer_measure_of_mono]
         incseqD[OF \<open>incseq (C ?F)\<close>, of mb m, THEN outer_measure_of_mono]
       by (auto intro: less_le_trans)
     define d' where "d' x = d x \<inter> ball x (1 / (3 * Suc m))" for x
     have "gauge d'"
       unfolding d'_def by (intro gauge_Int \<open>gauge d\<close> gauge_ball) auto
     then obtain p where p: "p tagged_division_of cbox x y" "d' fine p"
       by (rule fine_division_exists)
     then have "d fine p"
       unfolding d'_def[abs_def] fine_def by auto
 
     define s where "s = {(x::'a, k). k \<inter> (C ?E m) \<noteq> {} \<and> k \<inter> (C ?F m) \<noteq> {}}"
     define T where "T E k = (SOME x. x \<in> k \<inter> C E m)" for E k
     let ?A = "(\<lambda>(x, k). (T ?E k, k)) ` (p \<inter> s) \<union> (p - s)"
     let ?B = "(\<lambda>(x, k). (T ?F k, k)) ` (p \<inter> s) \<union> (p - s)"
 
     { fix X assume X_eq: "X = ?E \<or> X = ?F"
       let ?T = "(\<lambda>(x, k). (T X k, k))"
       let ?p = "?T ` (p \<inter> s) \<union> (p - s)"
 
       have in_s: "(x, k) \<in> s \<Longrightarrow> T X k \<in> k \<inter> C X m" for x k
         using someI_ex[of "\<lambda>x. x \<in> k \<inter> C X m"] X_eq unfolding ex_in_conv by (auto simp: T_def s_def)
 
       { fix x k assume "(x, k) \<in> p" "(x, k) \<in> s"
         have k: "k \<subseteq> ball x (1 / (3 * Suc m))"
           using \<open>d' fine p\<close>[THEN fineD, OF \<open>(x, k) \<in> p\<close>] by (auto simp: d'_def)
         then have "x \<in> ball (T X k) (1 / (3 * Suc m))"
           using in_s[OF \<open>(x, k) \<in> s\<close>] by (auto simp: C_def subset_eq dist_commute)
         then have "ball x (1 / (3 * Suc m)) \<subseteq> ball (T X k) (1 / Suc m)"
           by (rule ball_trans) (auto simp: field_split_simps)
         with k in_s[OF \<open>(x, k) \<in> s\<close>] have "k \<subseteq> d (T X k)"
           by (auto simp: C_def) }
       then have "d fine ?p"
         using \<open>d fine p\<close> by (auto intro!: fineI)
       moreover
       have "?p tagged_division_of cbox x y"
       proof (rule tagged_division_ofI)
         show "finite ?p"
           using p(1) by auto
       next
         fix z k assume *: "(z, k) \<in> ?p"
         then consider "(z, k) \<in> p" "(z, k) \<notin> s"
           | x' where "(x', k) \<in> p" "(x', k) \<in> s" "z = T X k"
           by (auto simp: T_def)
         then have "z \<in> k \<and> k \<subseteq> cbox x y \<and> (\<exists>a b. k = cbox a b)"
           using p(1) by cases (auto dest: in_s)
         then show "z \<in> k" "k \<subseteq> cbox x y" "\<exists>a b. k = cbox a b"
           by auto
       next
         fix z k z' k' assume "(z, k) \<in> ?p" "(z', k') \<in> ?p" "(z, k) \<noteq> (z', k')"
         with tagged_division_ofD(5)[OF p(1), of _ k _ k']
         show "interior k \<inter> interior k' = {}"
           by (auto simp: T_def dest: in_s)
       next
         have "{k. \<exists>x. (x, k) \<in> ?p} = {k. \<exists>x. (x, k) \<in> p}"
           by (auto simp: T_def image_iff Bex_def)
         then show "\<Union>{k. \<exists>x. (x, k) \<in> ?p} = cbox x y"
           using p(1) by auto
       qed
       ultimately have I: "norm ((\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) - I) < e"
         using integral_f by auto
 
       have "(\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) =
         (\<Sum>(x,k) \<in> ?T ` (p \<inter> s). content k *\<^sub>R f x) + (\<Sum>(x,k) \<in> p - s. content k *\<^sub>R f x)"
         using p(1)[THEN tagged_division_ofD(1)]
         by (safe intro!: sum.union_inter_neutral) (auto simp: s_def T_def)
       also have "(\<Sum>(x,k) \<in> ?T ` (p \<inter> s). content k *\<^sub>R f x) = (\<Sum>(x,k) \<in> p \<inter> s. content k *\<^sub>R f (T X k))"
       proof (subst sum.reindex_nontrivial, safe)
         fix x1 x2 k assume 1: "(x1, k) \<in> p" "(x1, k) \<in> s" and 2: "(x2, k) \<in> p" "(x2, k) \<in> s"
           and eq: "content k *\<^sub>R f (T X k) \<noteq> 0"
         with tagged_division_ofD(5)[OF p(1), of x1 k x2 k] tagged_division_ofD(4)[OF p(1), of x1 k]
         show "x1 = x2"
           by (auto simp: content_eq_0_interior)
       qed (use p in \<open>auto intro!: sum.cong\<close>)
       finally have eq: "(\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) =
         (\<Sum>(x,k) \<in> p \<inter> s. content k *\<^sub>R f (T X k)) + (\<Sum>(x,k) \<in> p - s. content k *\<^sub>R f x)" .
 
       have in_T: "(x, k) \<in> s \<Longrightarrow> T X k \<in> X" for x k
         using in_s[of x k] by (auto simp: C_def)
 
       note I eq in_T }
     note parts = this
 
     have p_in_L: "(x, k) \<in> p \<Longrightarrow> k \<in> sets ?L" for x k
       using tagged_division_ofD(3, 4)[OF p(1), of x k] by (auto simp: sets_restrict_space)
 
     have [simp]: "finite p"
       using tagged_division_ofD(1)[OF p(1)] .
 
     have "(M - 3*e) * (b - a) \<le> (\<Sum>(x,k) \<in> p \<inter> s. content k) * (b - a)"
     proof (intro mult_right_mono)
       have fin: "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) < \<infinity>" for X
         using \<open>?\<mu> E < \<infinity>\<close> by (rule le_less_trans[rotated]) (auto intro!: emeasure_mono \<open>E \<in> sets ?L\<close>)
       have sets: "(E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) \<in> sets ?L" for X
         using tagged_division_ofD(1)[OF p(1)] by (intro sets.Diff \<open>E \<in> sets ?L\<close> sets.finite_Union sets.Int) (auto intro: p_in_L)
       { fix X assume "X \<subseteq> E" "M - e < ?\<mu>' (C X m)"
         have "M - e \<le> ?\<mu>' (C X m)"
           by (rule less_imp_le) fact
         also have "\<dots> \<le> ?\<mu>' (E - (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}))"
         proof (intro outer_measure_of_mono subsetI)
           fix v assume "v \<in> C X m"
           then have "v \<in> cbox x y" "v \<in> E"
             using \<open>E \<subseteq> space ?L\<close> \<open>X \<subseteq> E\<close> by (auto simp: space_restrict_space C_def)
           then obtain z k where "(z, k) \<in> p" "v \<in> k"
             using tagged_division_ofD(6)[OF p(1), symmetric] by auto
           then show "v \<in> E - E \<inter> (\<Union>{k\<in>snd`p. k \<inter> C X m = {}})"
             using \<open>v \<in> C X m\<close> \<open>v \<in> E\<close> by auto
         qed
         also have "\<dots> = ?\<mu> E - ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}})"
           using \<open>E \<in> sets ?L\<close> fin[of X] sets[of X] by (auto intro!: emeasure_Diff)
         finally have "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) \<le> e"
           using \<open>0 < e\<close> e_less_M 
           by (cases "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}})") (auto simp add: \<open>?\<mu> E = M\<close> ennreal_minus ennreal_le_iff2)
         note this }
       note upper_bound = this
 
       have "?\<mu> (E \<inter> \<Union>(snd`(p - s))) =
         ?\<mu> ((E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?E m = {}}) \<union> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?F m = {}}))"
         by (intro arg_cong[where f="?\<mu>"]) (auto simp: s_def image_def Bex_def)
       also have "\<dots> \<le> ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?E m = {}}) + ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?F m = {}})"
         using sets[of ?E] sets[of ?F] M_minus_e by (intro emeasure_subadditive) auto
       also have "\<dots> \<le> e + ennreal e"
         using upper_bound[of ?E] upper_bound[of ?F] M_minus_e by (intro add_mono) auto
       finally have "?\<mu> E - 2*e \<le> ?\<mu> (E - (E \<inter> \<Union>(snd`(p - s))))"
         using \<open>0 < e\<close> \<open>E \<in> sets ?L\<close> tagged_division_ofD(1)[OF p(1)]
         by (subst emeasure_Diff)
            (auto simp: top_unique simp flip: ennreal_plus
                  intro!: sets.Int sets.finite_UN ennreal_mono_minus intro: p_in_L)
       also have "\<dots> \<le> ?\<mu> (\<Union>x\<in>p \<inter> s. snd x)"
       proof (safe intro!: emeasure_mono subsetI)
         fix v assume "v \<in> E" and not: "v \<notin> (\<Union>x\<in>p \<inter> s. snd x)"
         then have "v \<in> cbox x y"
           using \<open>E \<subseteq> space ?L\<close> by (auto simp: space_restrict_space)
         then obtain z k where "(z, k) \<in> p" "v \<in> k"
           using tagged_division_ofD(6)[OF p(1), symmetric] by auto
         with not show "v \<in> \<Union>(snd ` (p - s))"
           by (auto intro!: bexI[of _ "(z, k)"] elim: ballE[of _ _ "(z, k)"])
       qed (auto intro!: sets.Int sets.finite_UN ennreal_mono_minus intro: p_in_L)
       also have "\<dots> = measure ?L (\<Union>x\<in>p \<inter> s. snd x)"
         by (auto intro!: emeasure_eq_ennreal_measure)
       finally have "M - 2 * e \<le> measure ?L (\<Union>x\<in>p \<inter> s. snd x)"
         unfolding \<open>?\<mu> E = M\<close> using \<open>0 < e\<close> by (simp add: ennreal_minus)
       also have "measure ?L (\<Union>x\<in>p \<inter> s. snd x) = content (\<Union>x\<in>p \<inter> s. snd x)"
         using tagged_division_ofD(1,3,4) [OF p(1)]
         by (intro content_eq_L[symmetric])
            (fastforce intro!: sets.finite_UN UN_least del: subsetI)+
       also have "content (\<Union>x\<in>p \<inter> s. snd x) \<le> (\<Sum>k\<in>p \<inter> s. content (snd k))"
         using p(1) by (auto simp: emeasure_lborel_cbox_eq intro!: measure_subadditive_finite
                             dest!: p(1)[THEN tagged_division_ofD(4)])
       finally show "M - 3 * e \<le> (\<Sum>(x, y)\<in>p \<inter> s. content y)"
         using \<open>0 < e\<close> by (simp add: split_beta)
     qed (use \<open>a < b\<close> in auto)
     also have "\<dots> = (\<Sum>(x,k) \<in> p \<inter> s. content k * (b - a))"
       by (simp add: sum_distrib_right split_beta')
     also have "\<dots> \<le> (\<Sum>(x,k) \<in> p \<inter> s. content k * (f (T ?F k) - f (T ?E k)))"
       using parts(3) by (auto intro!: sum_mono mult_left_mono diff_mono)
     also have "\<dots> = (\<Sum>(x,k) \<in> p \<inter> s. content k * f (T ?F k)) - (\<Sum>(x,k) \<in> p \<inter> s. content k * f (T ?E k))"
       by (auto intro!: sum.cong simp: field_simps sum_subtractf[symmetric])
     also have "\<dots> = (\<Sum>(x,k) \<in> ?B. content k *\<^sub>R f x) - (\<Sum>(x,k) \<in> ?A. content k *\<^sub>R f x)"
       by (subst (1 2) parts) auto
     also have "\<dots> \<le> norm ((\<Sum>(x,k) \<in> ?B. content k *\<^sub>R f x) - (\<Sum>(x,k) \<in> ?A. content k *\<^sub>R f x))"
       by auto
     also have "\<dots> \<le> e + e"
       using parts(1)[of ?E] parts(1)[of ?F] by (intro norm_diff_triangle_le[of _ I]) auto
     finally show False
       using \<open>2 * e < (b - a) * (M - e * 3)\<close> by (auto simp: field_simps)
   qed
   moreover have "?\<mu>' ?E \<le> ?\<mu> E" "?\<mu>' ?F \<le> ?\<mu> E"
     unfolding outer_measure_of_eq[OF \<open>E \<in> sets ?L\<close>, symmetric] by (auto intro!: outer_measure_of_mono)
   ultimately show "min (?\<mu>' ?E) (?\<mu>' ?F) < ?\<mu> E"
     unfolding min_less_iff_disj by (auto simp: less_le)
 qed
 
 lemma has_integral_implies_lebesgue_measurable_real:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "(f has_integral I) \<Omega>"
   shows "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
 proof -
   define B :: "nat \<Rightarrow> 'a set" where "B n = cbox (- real n *\<^sub>R One) (real n *\<^sub>R One)" for n
   show "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
   proof (rule measurable_piecewise_restrict)
     have "(\<Union>n. box (- real n *\<^sub>R One) (real n *\<^sub>R One)) \<subseteq> \<Union>(B ` UNIV)"
       unfolding B_def by (intro UN_mono box_subset_cbox order_refl)
     then show "countable (range B)" "space lebesgue \<subseteq> \<Union>(B ` UNIV)"
       by (auto simp: B_def UN_box_eq_UNIV)
   next
     fix \<Omega>' assume "\<Omega>' \<in> range B"
     then obtain n where \<Omega>': "\<Omega>' = B n" by auto
     then show "\<Omega>' \<inter> space lebesgue \<in> sets lebesgue"
       by (auto simp: B_def)
 
     have "f integrable_on \<Omega>"
       using f by auto
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on \<Omega>"
       by (auto simp: integrable_on_def cong: has_integral_cong)
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on (\<Omega> \<union> B n)"
       by (rule integrable_on_superset) auto
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on B n"
       unfolding B_def by (rule integrable_on_subcbox) auto
     then show "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue_on \<Omega>' \<rightarrow>\<^sub>M borel"
       unfolding B_def \<Omega>' by (auto intro: has_integral_implies_lebesgue_measurable_cbox simp: integrable_on_def)
   qed
 qed
 
 lemma has_integral_implies_lebesgue_measurable:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "(f has_integral I) \<Omega>"
   shows "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
 proof (intro borel_measurable_euclidean_space[where 'c='b, THEN iffD2] ballI)
   fix i :: "'b" assume "i \<in> Basis"
   have "(\<lambda>x. (f x \<bullet> i) * indicator \<Omega> x) \<in> borel_measurable (completion lborel)"
     using has_integral_linear[OF f bounded_linear_inner_left, of i]
     by (intro has_integral_implies_lebesgue_measurable_real) (auto simp: comp_def)
   then show "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x \<bullet> i) \<in> borel_measurable (completion lborel)"
     by (simp add: ac_simps)
 qed
 
 subsection \<open>Equivalence Lebesgue integral on \<^const>\<open>lborel\<close> and HK-integral\<close>
 
 lemma has_integral_measure_lborel:
   fixes A :: "'a::euclidean_space set"
   assumes A[measurable]: "A \<in> sets borel" and finite: "emeasure lborel A < \<infinity>"
   shows "((\<lambda>x. 1) has_integral measure lborel A) A"
 proof -
   { fix l u :: 'a
     have "((\<lambda>x. 1) has_integral measure lborel (box l u)) (box l u)"
     proof cases
       assume "\<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b"
       then show ?thesis
         using has_integral_const[of "1::real" l u]
         by (simp flip: has_integral_restrict[OF box_subset_cbox] add: has_integral_spike_interior)
     next
       assume "\<not> (\<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b)"
       then have "box l u = {}"
         unfolding box_eq_empty by (auto simp: not_le intro: less_imp_le)
       then show ?thesis
         by simp
     qed }
   note has_integral_box = this
 
   { fix a b :: 'a let ?M = "\<lambda>A. measure lborel (A \<inter> box a b)"
     have "Int_stable  (range (\<lambda>(a, b). box a b))"
       by (auto simp: Int_stable_def box_Int_box)
     moreover have "(range (\<lambda>(a, b). box a b)) \<subseteq> Pow UNIV"
       by auto
     moreover have "A \<in> sigma_sets UNIV (range (\<lambda>(a, b). box a b))"
        using A unfolding borel_eq_box by simp
     ultimately have "((\<lambda>x. 1) has_integral ?M A) (A \<inter> box a b)"
     proof (induction rule: sigma_sets_induct_disjoint)
       case (basic A) then show ?case
         by (auto simp: box_Int_box has_integral_box)
     next
       case empty then show ?case
         by simp
     next
       case (compl A)
       then have [measurable]: "A \<in> sets borel"
         by (simp add: borel_eq_box)
 
       have "((\<lambda>x. 1) has_integral ?M (box a b)) (box a b)"
         by (simp add: has_integral_box)
       moreover have "((\<lambda>x. if x \<in> A \<inter> box a b then 1 else 0) has_integral ?M A) (box a b)"
         by (subst has_integral_restrict) (auto intro: compl)
       ultimately have "((\<lambda>x. 1 - (if x \<in> A \<inter> box a b then 1 else 0)) has_integral ?M (box a b) - ?M A) (box a b)"
         by (rule has_integral_diff)
       then have "((\<lambda>x. (if x \<in> (UNIV - A) \<inter> box a b then 1 else 0)) has_integral ?M (box a b) - ?M A) (box a b)"
         by (rule has_integral_cong[THEN iffD1, rotated 1]) auto
       then have "((\<lambda>x. 1) has_integral ?M (box a b) - ?M A) ((UNIV - A) \<inter> box a b)"
         by (subst (asm) has_integral_restrict) auto
       also have "?M (box a b) - ?M A = ?M (UNIV - A)"
         by (subst measure_Diff[symmetric]) (auto simp: emeasure_lborel_box_eq Diff_Int_distrib2)
       finally show ?case .
     next
       case (union F)
       then have [measurable]: "\<And>i. F i \<in> sets borel"
         by (simp add: borel_eq_box subset_eq)
       have "((\<lambda>x. if x \<in> \<Union>(F ` UNIV) \<inter> box a b then 1 else 0) has_integral ?M (\<Union>i. F i)) (box a b)"
       proof (rule has_integral_monotone_convergence_increasing)
         let ?f = "\<lambda>k x. \<Sum>i<k. if x \<in> F i \<inter> box a b then 1 else 0 :: real"
         show "\<And>k. (?f k has_integral (\<Sum>i<k. ?M (F i))) (box a b)"
           using union.IH by (auto intro!: has_integral_sum simp del: Int_iff)
         show "\<And>k x. ?f k x \<le> ?f (Suc k) x"
           by (intro sum_mono2) auto
         from union(1) have *: "\<And>x i j. x \<in> F i \<Longrightarrow> x \<in> F j \<longleftrightarrow> j = i"
           by (auto simp add: disjoint_family_on_def)
         show "(\<lambda>k. ?f k x) \<longlonglongrightarrow> (if x \<in> \<Union>(F ` UNIV) \<inter> box a b then 1 else 0)" for x
           by (auto simp: * sum.If_cases Iio_Int_singleton if_distrib LIMSEQ_if_less cong: if_cong)
         have *: "emeasure lborel ((\<Union>x. F x) \<inter> box a b) \<le> emeasure lborel (box a b)"
           by (intro emeasure_mono) auto
 
         with union(1) show "(\<lambda>k. \<Sum>i<k. ?M (F i)) \<longlonglongrightarrow> ?M (\<Union>i. F i)"
           unfolding sums_def[symmetric] UN_extend_simps
           by (intro measure_UNION) (auto simp: disjoint_family_on_def emeasure_lborel_box_eq top_unique)
       qed
       then show ?case
         by (subst (asm) has_integral_restrict) auto
     qed }
   note * = this
 
   show ?thesis
   proof (rule has_integral_monotone_convergence_increasing)
     let ?B = "\<lambda>n::nat. box (- real n *\<^sub>R One) (real n *\<^sub>R One) :: 'a set"
     let ?f = "\<lambda>n::nat. \<lambda>x. if x \<in> A \<inter> ?B n then 1 else 0 :: real"
     let ?M = "\<lambda>n. measure lborel (A \<inter> ?B n)"
 
     show "\<And>n::nat. (?f n has_integral ?M n) A"
       using * by (subst has_integral_restrict) simp_all
     show "\<And>k x. ?f k x \<le> ?f (Suc k) x"
       by (auto simp: box_def)
     { fix x assume "x \<in> A"
       moreover have "(\<lambda>k. indicator (A \<inter> ?B k) x :: real) \<longlonglongrightarrow> indicator (\<Union>k::nat. A \<inter> ?B k) x"
         by (intro LIMSEQ_indicator_incseq) (auto simp: incseq_def box_def)
       ultimately show "(\<lambda>k. if x \<in> A \<inter> ?B k then 1 else 0::real) \<longlonglongrightarrow> 1"
         by (simp add: indicator_def of_bool_def UN_box_eq_UNIV) }
 
     have "(\<lambda>n. emeasure lborel (A \<inter> ?B n)) \<longlonglongrightarrow> emeasure lborel (\<Union>n::nat. A \<inter> ?B n)"
       by (intro Lim_emeasure_incseq) (auto simp: incseq_def box_def)
     also have "(\<lambda>n. emeasure lborel (A \<inter> ?B n)) = (\<lambda>n. measure lborel (A \<inter> ?B n))"
     proof (intro ext emeasure_eq_ennreal_measure)
       fix n have "emeasure lborel (A \<inter> ?B n) \<le> emeasure lborel (?B n)"
         by (intro emeasure_mono) auto
       then show "emeasure lborel (A \<inter> ?B n) \<noteq> top"
         by (auto simp: top_unique)
     qed
     finally show "(\<lambda>n. measure lborel (A \<inter> ?B n)) \<longlonglongrightarrow> measure lborel A"
       using emeasure_eq_ennreal_measure[of lborel A] finite
       by (simp add: UN_box_eq_UNIV less_top)
   qed
 qed
 
 lemma nn_integral_has_integral:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
   shows "(f has_integral r) UNIV"
 using f proof (induct f arbitrary: r rule: borel_measurable_induct_real)
   case (set A)
   then have "((\<lambda>x. 1) has_integral measure lborel A) A"
     by (intro has_integral_measure_lborel) (auto simp: ennreal_indicator)
   with set show ?case
     by (simp add: ennreal_indicator measure_def) (simp add: indicator_def of_bool_def)
 next
   case (mult g c)
   then have "ennreal c * (\<integral>\<^sup>+ x. g x \<partial>lborel) = ennreal r"
     by (subst nn_integral_cmult[symmetric]) (auto simp: ennreal_mult)
   with \<open>0 \<le> r\<close> \<open>0 \<le> c\<close>
   obtain r' where "(c = 0 \<and> r = 0) \<or> (0 \<le> r' \<and> (\<integral>\<^sup>+ x. ennreal (g x) \<partial>lborel) = ennreal r' \<and> r = c * r')"
     by (cases "\<integral>\<^sup>+ x. ennreal (g x) \<partial>lborel" rule: ennreal_cases)
        (auto split: if_split_asm simp: ennreal_mult_top ennreal_mult[symmetric])
   with mult show ?case
     by (auto intro!: has_integral_cmult_real)
 next
   case (add g h)
   then have "(\<integral>\<^sup>+ x. h x + g x \<partial>lborel) = (\<integral>\<^sup>+ x. h x \<partial>lborel) + (\<integral>\<^sup>+ x. g x \<partial>lborel)"
     by (simp add: nn_integral_add)
   with add obtain a b where "0 \<le> a" "0 \<le> b" "(\<integral>\<^sup>+ x. h x \<partial>lborel) = ennreal a" "(\<integral>\<^sup>+ x. g x \<partial>lborel) = ennreal b" "r = a + b"
     by (cases "\<integral>\<^sup>+ x. h x \<partial>lborel" "\<integral>\<^sup>+ x. g x \<partial>lborel" rule: ennreal2_cases)
        (auto simp: add_top nn_integral_add top_add simp flip: ennreal_plus)
   with add show ?case
     by (auto intro!: has_integral_add)
 next
   case (seq U)
   note seq(1)[measurable] and f[measurable]
 
   have U_le_f: "U i x \<le> f x" for i x
     by (metis (no_types) LIMSEQ_le_const UNIV_I incseq_def le_fun_def seq.hyps(4) seq.hyps(5) space_borel)
 
   { fix i
     have "(\<integral>\<^sup>+x. U i x \<partial>lborel) \<le> (\<integral>\<^sup>+x. f x \<partial>lborel)"
       using seq(2) f(2) U_le_f by (intro nn_integral_mono) simp
     then obtain p where "(\<integral>\<^sup>+x. U i x \<partial>lborel) = ennreal p" "p \<le> r" "0 \<le> p"
       using seq(6) \<open>0\<le>r\<close> by (cases "\<integral>\<^sup>+x. U i x \<partial>lborel" rule: ennreal_cases) (auto simp: top_unique)
     moreover note seq
     ultimately have "\<exists>p. (\<integral>\<^sup>+x. U i x \<partial>lborel) = ennreal p \<and> 0 \<le> p \<and> p \<le> r \<and> (U i has_integral p) UNIV"
       by auto }
   then obtain p where p: "\<And>i. (\<integral>\<^sup>+x. ennreal (U i x) \<partial>lborel) = ennreal (p i)"
     and bnd: "\<And>i. p i \<le> r" "\<And>i. 0 \<le> p i"
     and U_int: "\<And>i.(U i has_integral (p i)) UNIV" by metis
 
   have int_eq: "\<And>i. integral UNIV (U i) = p i" using U_int by (rule integral_unique)
 
   have *: "f integrable_on UNIV \<and> (\<lambda>k. integral UNIV (U k)) \<longlonglongrightarrow> integral UNIV f"
   proof (rule monotone_convergence_increasing)
     show "\<And>k. U k integrable_on UNIV" using U_int by auto
     show "\<And>k x. x\<in>UNIV \<Longrightarrow> U k x \<le> U (Suc k) x" using \<open>incseq U\<close> by (auto simp: incseq_def le_fun_def)
     then show "bounded (range (\<lambda>k. integral UNIV (U k)))"
       using bnd int_eq by (auto simp: bounded_real intro!: exI[of _ r])
     show "\<And>x. x\<in>UNIV \<Longrightarrow> (\<lambda>k. U k x) \<longlonglongrightarrow> f x"
       using seq by auto
   qed
   moreover have "(\<lambda>i. (\<integral>\<^sup>+x. U i x \<partial>lborel)) \<longlonglongrightarrow> (\<integral>\<^sup>+x. f x \<partial>lborel)"
     using seq f(2) U_le_f by (intro nn_integral_dominated_convergence[where w=f]) auto
   ultimately have "integral UNIV f = r"
     by (auto simp add: bnd int_eq p seq intro: LIMSEQ_unique)
   with * show ?case
     by (simp add: has_integral_integral)
 qed
 
 lemma nn_integral_lborel_eq_integral:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) < \<infinity>"
   shows "(\<integral>\<^sup>+x. f x \<partial>lborel) = integral UNIV f"
 proof -
   from f(3) obtain r where r: "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
     by (cases "\<integral>\<^sup>+x. f x \<partial>lborel" rule: ennreal_cases) auto
   then show ?thesis
     using nn_integral_has_integral[OF f(1,2) r] by (simp add: integral_unique)
 qed
 
 lemma nn_integral_integrable_on:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) < \<infinity>"
   shows "f integrable_on UNIV"
 proof -
   from f(3) obtain r where r: "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
     by (cases "\<integral>\<^sup>+x. f x \<partial>lborel" rule: ennreal_cases) auto
   then show ?thesis
     by (intro has_integral_integrable[where i=r] nn_integral_has_integral[where r=r] f)
 qed
 
 lemma nn_integral_has_integral_lborel:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f_borel: "f \<in> borel_measurable borel" and nonneg: "\<And>x. 0 \<le> f x"
   assumes I: "(f has_integral I) UNIV"
   shows "integral\<^sup>N lborel f = I"
 proof -
   from f_borel have "(\<lambda>x. ennreal (f x)) \<in> borel_measurable lborel" by auto
   from borel_measurable_implies_simple_function_sequence'[OF this]
   obtain F where F: "\<And>i. simple_function lborel (F i)" "incseq F"
                  "\<And>i x. F i x < top" "\<And>x. (SUP i. F i x) = ennreal (f x)"
     by blast
   then have [measurable]: "\<And>i. F i \<in> borel_measurable lborel"
     by (metis borel_measurable_simple_function)
   let ?B = "\<lambda>i::nat. box (- (real i *\<^sub>R One)) (real i *\<^sub>R One) :: 'a set"
 
   have "0 \<le> I"
     using I by (rule has_integral_nonneg) (simp add: nonneg)
 
   have F_le_f: "enn2real (F i x) \<le> f x" for i x
     using F(3,4)[where x=x] nonneg SUP_upper[of i UNIV "\<lambda>i. F i x"]
     by (cases "F i x" rule: ennreal_cases) auto
   let ?F = "\<lambda>i x. F i x * indicator (?B i) x"
   have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) = (SUP i. integral\<^sup>N lborel (\<lambda>x. ?F i x))"
   proof (subst nn_integral_monotone_convergence_SUP[symmetric])
     { fix x
       obtain j where j: "x \<in> ?B j"
         using UN_box_eq_UNIV by auto
 
       have "ennreal (f x) = (SUP i. F i x)"
         using F(4)[of x] nonneg[of x] by (simp add: max_def)
       also have "\<dots> = (SUP i. ?F i x)"
       proof (rule SUP_eq)
         fix i show "\<exists>j\<in>UNIV. F i x \<le> ?F j x"
           using j F(2)
           by (intro bexI[of _ "max i j"])
              (auto split: split_max split_indicator simp: incseq_def le_fun_def box_def)
       qed (auto intro!: F split: split_indicator)
       finally have "ennreal (f x) =  (SUP i. ?F i x)" . }
     then show "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) = (\<integral>\<^sup>+ x. (SUP i. ?F i x) \<partial>lborel)"
       by simp
   qed (insert F, auto simp: incseq_def le_fun_def box_def split: split_indicator)
   also have "\<dots> \<le> ennreal I"
   proof (rule SUP_least)
     fix i :: nat
     have finite_F: "(\<integral>\<^sup>+ x. ennreal (enn2real (F i x) * indicator (?B i) x) \<partial>lborel) < \<infinity>"
     proof (rule nn_integral_bound_simple_function)
       have "emeasure lborel {x \<in> space lborel. ennreal (enn2real (F i x) * indicator (?B i) x) \<noteq> 0} \<le>
         emeasure lborel (?B i)"
         by (intro emeasure_mono)  (auto split: split_indicator)
       then show "emeasure lborel {x \<in> space lborel. ennreal (enn2real (F i x) * indicator (?B i) x) \<noteq> 0} < \<infinity>"
         by (auto simp: less_top[symmetric] top_unique)
     qed (auto split: split_indicator
               intro!: F simple_function_compose1[where g="enn2real"] simple_function_ennreal)
 
     have int_F: "(\<lambda>x. enn2real (F i x) * indicator (?B i) x) integrable_on UNIV"
       using F(4) finite_F
       by (intro nn_integral_integrable_on) (auto split: split_indicator simp: enn2real_nonneg)
 
     have "(\<integral>\<^sup>+ x. F i x * indicator (?B i) x \<partial>lborel) =
       (\<integral>\<^sup>+ x. ennreal (enn2real (F i x) * indicator (?B i) x) \<partial>lborel)"
       using F(3,4)
       by (intro nn_integral_cong) (auto simp: image_iff eq_commute split: split_indicator)
     also have "\<dots> = ennreal (integral UNIV (\<lambda>x. enn2real (F i x) * indicator (?B i) x))"
       using F
       by (intro nn_integral_lborel_eq_integral[OF _ _ finite_F])
          (auto split: split_indicator intro: enn2real_nonneg)
     also have "\<dots> \<le> ennreal I"
       by (auto intro!: has_integral_le[OF integrable_integral[OF int_F] I] nonneg F_le_f
                simp: \<open>0 \<le> I\<close> split: split_indicator )
     finally show "(\<integral>\<^sup>+ x. F i x * indicator (?B i) x \<partial>lborel) \<le> ennreal I" .
   qed
   finally have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) < \<infinity>"
     by (auto simp: less_top[symmetric] top_unique)
   from nn_integral_lborel_eq_integral[OF assms(1,2) this] I show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma has_integral_iff_emeasure_lborel:
   fixes A :: "'a::euclidean_space set"
   assumes A[measurable]: "A \<in> sets borel" and [simp]: "0 \<le> r"
   shows "((\<lambda>x. 1) has_integral r) A \<longleftrightarrow> emeasure lborel A = ennreal r"
 proof (cases "emeasure lborel A = \<infinity>")
   case emeasure_A: True
   have "\<not> (\<lambda>x. 1::real) integrable_on A"
   proof
     assume int: "(\<lambda>x. 1::real) integrable_on A"
     then have "(indicator A::'a \<Rightarrow> real) integrable_on UNIV"
       unfolding indicator_def of_bool_def integrable_restrict_UNIV .
     then obtain r where "((indicator A::'a\<Rightarrow>real) has_integral r) UNIV"
       by auto
     from nn_integral_has_integral_lborel[OF _ _ this] emeasure_A show False
       by (simp add: ennreal_indicator)
   qed
   with emeasure_A show ?thesis
     by auto
 next
   case False
   then have "((\<lambda>x. 1) has_integral measure lborel A) A"
     by (simp add: has_integral_measure_lborel less_top)
   with False show ?thesis
     by (auto simp: emeasure_eq_ennreal_measure has_integral_unique)
 qed
 
 lemma ennreal_max_0: "ennreal (max 0 x) = ennreal x"
   by (auto simp: max_def ennreal_neg)
 
 lemma has_integral_integral_real:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "integrable lborel f"
   shows "(f has_integral (integral\<^sup>L lborel f)) UNIV"
 proof -
   from integrableE[OF f] obtain r q
     where "0 \<le> r" "0 \<le> q"
       and r: "(\<integral>\<^sup>+ x. ennreal (max 0 (f x)) \<partial>lborel) = ennreal r"
       and q: "(\<integral>\<^sup>+ x. ennreal (max 0 (- f x)) \<partial>lborel) = ennreal q"
       and f: "f \<in> borel_measurable lborel" and eq: "integral\<^sup>L lborel f = r - q"
     unfolding ennreal_max_0 by auto
   then have "((\<lambda>x. max 0 (f x)) has_integral r) UNIV" "((\<lambda>x. max 0 (- f x)) has_integral q) UNIV"
     using nn_integral_has_integral[OF _ _ r] nn_integral_has_integral[OF _ _ q] by auto
   note has_integral_diff[OF this]
   moreover have "(\<lambda>x. max 0 (f x) - max 0 (- f x)) = f"
     by auto
   ultimately show ?thesis
     by (simp add: eq)
 qed
 
 lemma has_integral_AE:
   assumes ae: "AE x in lborel. x \<in> \<Omega> \<longrightarrow> f x = g x"
   shows "(f has_integral x) \<Omega> = (g has_integral x) \<Omega>"
 proof -
   from ae obtain N
     where N: "N \<in> sets borel" "emeasure lborel N = 0" "{x. \<not> (x \<in> \<Omega> \<longrightarrow> f x = g x)} \<subseteq> N"
     by (auto elim!: AE_E)
   then have not_N: "AE x in lborel. x \<notin> N"
     by (simp add: AE_iff_measurable)
   show ?thesis
   proof (rule has_integral_spike_eq[symmetric])
     show "\<And>x. x\<in>\<Omega> - N \<Longrightarrow> f x = g x" using N(3) by auto
     show "negligible N"
       unfolding negligible_def
     proof (intro allI)
       fix a b :: "'a"
       let ?F = "\<lambda>x::'a. if x \<in> cbox a b then indicator N x else 0 :: real"
       have "integrable lborel ?F = integrable lborel (\<lambda>x::'a. 0::real)"
         using not_N N(1) by (intro integrable_cong_AE) auto
       moreover have "(LINT x|lborel. ?F x) = (LINT x::'a|lborel. 0::real)"
         using not_N N(1) by (intro integral_cong_AE) auto
       ultimately have "(?F has_integral 0) UNIV"
         using has_integral_integral_real[of ?F] by simp
       then show "(indicator N has_integral (0::real)) (cbox a b)"
         unfolding has_integral_restrict_UNIV .
     qed
   qed
 qed
 
 lemma nn_integral_has_integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes nonneg: "\<And>x. 0 \<le> f x" and I: "(f has_integral I) \<Omega>"
   shows "integral\<^sup>N lborel (\<lambda>x. indicator \<Omega> x * f x) = I"
 proof -
   from I have "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
     by (rule has_integral_implies_lebesgue_measurable)
   then obtain f' :: "'a \<Rightarrow> real"
     where [measurable]: "f' \<in> borel \<rightarrow>\<^sub>M borel" and eq: "AE x in lborel. indicator \<Omega> x * f x = f' x"
     by (auto dest: completion_ex_borel_measurable_real)
 
   from I have "((\<lambda>x. abs (indicator \<Omega> x * f x)) has_integral I) UNIV"
     using nonneg by (simp add: indicator_def of_bool_def if_distrib[of "\<lambda>x. x * f y" for y] cong: if_cong)
   also have "((\<lambda>x. abs (indicator \<Omega> x * f x)) has_integral I) UNIV \<longleftrightarrow> ((\<lambda>x. abs (f' x)) has_integral I) UNIV"
     using eq by (intro has_integral_AE) auto
   finally have "integral\<^sup>N lborel (\<lambda>x. abs (f' x)) = I"
     by (rule nn_integral_has_integral_lborel[rotated 2]) auto
   also have "integral\<^sup>N lborel (\<lambda>x. abs (f' x)) = integral\<^sup>N lborel (\<lambda>x. abs (indicator \<Omega> x * f x))"
     using eq by (intro nn_integral_cong_AE) auto
   finally show ?thesis
     using nonneg by auto
 qed
 
 lemma has_integral_iff_nn_integral_lebesgue:
   assumes f: "\<And>x. 0 \<le> f x"
   shows "(f has_integral r) UNIV \<longleftrightarrow> (f \<in> lebesgue \<rightarrow>\<^sub>M borel \<and> integral\<^sup>N lebesgue f = r \<and> 0 \<le> r)" (is "?I = ?N")
 proof
   assume ?I
   have "0 \<le> r"
     using has_integral_nonneg[OF \<open>?I\<close>] f by auto
   then show ?N
     using nn_integral_has_integral_lebesgue[OF f \<open>?I\<close>]
       has_integral_implies_lebesgue_measurable[OF \<open>?I\<close>]
     by (auto simp: nn_integral_completion)
 next
   assume ?N
   then obtain f' where f': "f' \<in> borel \<rightarrow>\<^sub>M borel" "AE x in lborel. f x = f' x"
     by (auto dest: completion_ex_borel_measurable_real)
   moreover have "(\<integral>\<^sup>+ x. ennreal \<bar>f' x\<bar> \<partial>lborel) = (\<integral>\<^sup>+ x. ennreal \<bar>f x\<bar> \<partial>lborel)"
     using f' by (intro nn_integral_cong_AE) auto
   moreover have "((\<lambda>x. \<bar>f' x\<bar>) has_integral r) UNIV \<longleftrightarrow> ((\<lambda>x. \<bar>f x\<bar>) has_integral r) UNIV"
     using f' by (intro has_integral_AE) auto
   moreover note nn_integral_has_integral[of "\<lambda>x. \<bar>f' x\<bar>" r] \<open>?N\<close>
   ultimately show ?I
     using f by (auto simp: nn_integral_completion)
 qed
 
 context
   fixes f::"'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
 begin
 
 lemma has_integral_integral_lborel:
   assumes f: "integrable lborel f"
   shows "(f has_integral (integral\<^sup>L lborel f)) UNIV"
 proof -
   have "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. integral\<^sup>L lborel (\<lambda>x. f x \<bullet> b) *\<^sub>R b)) UNIV"
     using f by (intro has_integral_sum finite_Basis ballI has_integral_scaleR_left has_integral_integral_real) auto
   also have eq_f: "(\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) = f"
     by (simp add: fun_eq_iff euclidean_representation)
   also have "(\<Sum>b\<in>Basis. integral\<^sup>L lborel (\<lambda>x. f x \<bullet> b) *\<^sub>R b) = integral\<^sup>L lborel f"
     using f by (subst (2) eq_f[symmetric]) simp
   finally show ?thesis .
 qed
 
 lemma integrable_on_lborel: "integrable lborel f \<Longrightarrow> f integrable_on UNIV"
   using has_integral_integral_lborel by auto
 
 lemma integral_lborel: "integrable lborel f \<Longrightarrow> integral UNIV f = (\<integral>x. f x \<partial>lborel)"
   using has_integral_integral_lborel by auto
 
 end
 
 context
 begin
 
 private lemma has_integral_integral_lebesgue_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "integrable lebesgue f"
   shows "(f has_integral (integral\<^sup>L lebesgue f)) UNIV"
 proof -
   obtain f' where f': "f' \<in> borel \<rightarrow>\<^sub>M borel" "AE x in lborel. f x = f' x"
     using completion_ex_borel_measurable_real[OF borel_measurable_integrable[OF f]] by auto
   moreover have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>lborel) = (\<integral>\<^sup>+ x. ennreal (norm (f' x)) \<partial>lborel)"
     using f' by (intro nn_integral_cong_AE) auto
   ultimately have "integrable lborel f'"
     using f by (auto simp: integrable_iff_bounded nn_integral_completion cong: nn_integral_cong_AE)
   note has_integral_integral_real[OF this]
   moreover have "integral\<^sup>L lebesgue f = integral\<^sup>L lebesgue f'"
     using f' f by (intro integral_cong_AE) (auto intro: AE_completion measurable_completion)
   moreover have "integral\<^sup>L lebesgue f' = integral\<^sup>L lborel f'"
     using f' by (simp add: integral_completion)
   moreover have "(f' has_integral integral\<^sup>L lborel f') UNIV \<longleftrightarrow> (f has_integral integral\<^sup>L lborel f') UNIV"
     using f' by (intro has_integral_AE) auto
   ultimately show ?thesis
     by auto
 qed
 
 lemma has_integral_integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "integrable lebesgue f"
   shows "(f has_integral (integral\<^sup>L lebesgue f)) UNIV"
 proof -
   have "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. integral\<^sup>L lebesgue (\<lambda>x. f x \<bullet> b) *\<^sub>R b)) UNIV"
     using f by (intro has_integral_sum finite_Basis ballI has_integral_scaleR_left has_integral_integral_lebesgue_real) auto
   also have eq_f: "(\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) = f"
     by (simp add: fun_eq_iff euclidean_representation)
   also have "(\<Sum>b\<in>Basis. integral\<^sup>L lebesgue (\<lambda>x. f x \<bullet> b) *\<^sub>R b) = integral\<^sup>L lebesgue f"
     using f by (subst (2) eq_f[symmetric]) simp
   finally show ?thesis .
 qed
 
 lemma has_integral_integral_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "integrable (lebesgue_on S) f" "S \<in> sets lebesgue"
   shows "(f has_integral (integral\<^sup>L (lebesgue_on S) f)) S"
 proof -
   let ?f = "\<lambda>x. if x \<in> S then f x else 0"
   have "integrable lebesgue (\<lambda>x. indicat_real S x *\<^sub>R f x)"
     using indicator_scaleR_eq_if [of S _ f] assms
   by (metis (full_types) integrable_restrict_space sets.Int_space_eq2)
   then have "integrable lebesgue ?f"
     using indicator_scaleR_eq_if [of S _ f] assms by auto
   then have "(?f has_integral (integral\<^sup>L lebesgue ?f)) UNIV"
     by (rule has_integral_integral_lebesgue)
   then have "(f has_integral (integral\<^sup>L lebesgue ?f)) S"
     using has_integral_restrict_UNIV by blast
   moreover
   have "S \<inter> space lebesgue \<in> sets lebesgue"
     by (simp add: assms)
   then have "(integral\<^sup>L lebesgue ?f) = (integral\<^sup>L (lebesgue_on S) f)"
     by (simp add: integral_restrict_space indicator_scaleR_eq_if)
   ultimately show ?thesis
     by auto
 qed
 
 lemma lebesgue_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "integrable (lebesgue_on S) f" "S \<in> sets lebesgue"
   shows "integral\<^sup>L (lebesgue_on S) f = integral S f"
   by (metis has_integral_integral_lebesgue_on assms integral_unique)
 
 lemma integrable_on_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "integrable lebesgue f \<Longrightarrow> f integrable_on UNIV"
   using has_integral_integral_lebesgue by auto
 
 lemma integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "integrable lebesgue f \<Longrightarrow> integral UNIV f = (\<integral>x. f x \<partial>lebesgue)"
   using has_integral_integral_lebesgue by auto
 
 end
 
 subsection \<open>Absolute integrability (this is the same as Lebesgue integrability)\<close>
 
 translations
 "LBINT x. f" == "CONST lebesgue_integral CONST lborel (\<lambda>x. f)"
 
 translations
 "LBINT x:A. f" == "CONST set_lebesgue_integral CONST lborel A (\<lambda>x. f)"
 
 lemma set_integral_reflect:
   fixes S and f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "(LBINT x : S. f x) = (LBINT x : {x. - x \<in> S}. f (- x))"
   unfolding set_lebesgue_integral_def
   by (subst lborel_integral_real_affine[where c="-1" and t=0])
      (auto intro!: Bochner_Integration.integral_cong split: split_indicator)
 
 lemma borel_integrable_atLeastAtMost':
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes f: "continuous_on {a..b} f"
   shows "set_integrable lborel {a..b} f"
   unfolding set_integrable_def
   by (intro borel_integrable_compact compact_Icc f)
 
 lemma integral_FTC_atLeastAtMost:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes "a \<le> b"
     and F: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
     and f: "continuous_on {a .. b} f"
   shows "integral\<^sup>L lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x) = F b - F a"
 proof -
   let ?f = "\<lambda>x. indicator {a .. b} x *\<^sub>R f x"
   have "(?f has_integral (\<integral>x. ?f x \<partial>lborel)) UNIV"
     using borel_integrable_atLeastAtMost'[OF f]
     unfolding set_integrable_def by (rule has_integral_integral_lborel)
   moreover
   have "(f has_integral F b - F a) {a .. b}"
     by (intro fundamental_theorem_of_calculus ballI assms) auto
   then have "(?f has_integral F b - F a) {a .. b}"
     by (subst has_integral_cong[where g=f]) auto
   then have "(?f has_integral F b - F a) UNIV"
     by (intro has_integral_on_superset[where T=UNIV and S="{a..b}"]) auto
   ultimately show "integral\<^sup>L lborel ?f = F b - F a"
     by (rule has_integral_unique)
 qed
 
 lemma set_borel_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "set_integrable lborel S f"
   shows "f integrable_on S" "LINT x : S | lborel. f x = integral S f"
 proof -
   let ?f = "\<lambda>x. indicator S x *\<^sub>R f x"
   have "(?f has_integral LINT x : S | lborel. f x) UNIV"
     using assms has_integral_integral_lborel
     unfolding set_integrable_def set_lebesgue_integral_def by blast
   hence 1: "(f has_integral (set_lebesgue_integral lborel S f)) S"
     by (simp add: indicator_scaleR_eq_if)
   thus "f integrable_on S"
     by (auto simp add: integrable_on_def)
   with 1 have "(f has_integral (integral S f)) S"
     by (intro integrable_integral, auto simp add: integrable_on_def)
   thus "LINT x : S | lborel. f x = integral S f"
     by (intro has_integral_unique [OF 1])
 qed
 
 lemma has_integral_set_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "set_integrable lebesgue S f"
   shows "(f has_integral (LINT x:S|lebesgue. f x)) S"
   using has_integral_integral_lebesgue f
   by (fastforce simp add: set_integrable_def set_lebesgue_integral_def indicator_def
     of_bool_def if_distrib[of "\<lambda>x. x *\<^sub>R f _"] cong: if_cong)
 
 lemma set_lebesgue_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "set_integrable lebesgue S f"
   shows "f integrable_on S" "LINT x:S | lebesgue. f x = integral S f"
   using has_integral_set_lebesgue[OF f] by (auto simp: integral_unique integrable_on_def)
 
 lemma lmeasurable_iff_has_integral:
   "S \<in> lmeasurable \<longleftrightarrow> ((indicator S) has_integral measure lebesgue S) UNIV"
   by (subst has_integral_iff_nn_integral_lebesgue)
      (auto simp: ennreal_indicator emeasure_eq_measure2 borel_measurable_indicator_iff intro!: fmeasurableI)
 
 abbreviation
   absolutely_integrable_on :: "('a::euclidean_space \<Rightarrow> 'b::{banach, second_countable_topology}) \<Rightarrow> 'a set \<Rightarrow> bool"
   (infixr "absolutely'_integrable'_on" 46)
   where "f absolutely_integrable_on s \<equiv> set_integrable lebesgue s f"
 
 
 lemma absolutely_integrable_zero [simp]: "(\<lambda>x. 0) absolutely_integrable_on S"
     by (simp add: set_integrable_def)
 
 lemma absolutely_integrable_on_def:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f integrable_on S \<and> (\<lambda>x. norm (f x)) integrable_on S"
 proof safe
   assume f: "f absolutely_integrable_on S"
   then have nf: "integrable lebesgue (\<lambda>x. norm (indicator S x *\<^sub>R f x))"
     using integrable_norm set_integrable_def by blast
   show "f integrable_on S"
     by (rule set_lebesgue_integral_eq_integral[OF f])
   have "(\<lambda>x. norm (indicator S x *\<^sub>R f x)) = (\<lambda>x. if x \<in> S then norm (f x) else 0)"
     by auto
   with integrable_on_lebesgue[OF nf] show "(\<lambda>x. norm (f x)) integrable_on S"
     by (simp add: integrable_restrict_UNIV)
 next
   assume f: "f integrable_on S" and nf: "(\<lambda>x. norm (f x)) integrable_on S"
   show "f absolutely_integrable_on S"
     unfolding set_integrable_def
   proof (rule integrableI_bounded)
     show "(\<lambda>x. indicator S x *\<^sub>R f x) \<in> borel_measurable lebesgue"
       using f has_integral_implies_lebesgue_measurable[of f _ S] by (auto simp: integrable_on_def)
     show "(\<integral>\<^sup>+ x. ennreal (norm (indicator S x *\<^sub>R f x)) \<partial>lebesgue) < \<infinity>"
       using nf nn_integral_has_integral_lebesgue[of "\<lambda>x. norm (f x)" _ S]
       by (auto simp: integrable_on_def nn_integral_completion)
   qed
 qed
 
 lemma integrable_on_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "integrable (lebesgue_on S) f" and S: "S \<in> sets lebesgue"
   shows "f integrable_on S"
 proof -
   have "integrable lebesgue (\<lambda>x. indicator S x *\<^sub>R f x)"
     using S f inf_top.comm_neutral integrable_restrict_space by blast
   then show ?thesis
     using absolutely_integrable_on_def set_integrable_def by blast
 qed
 
 lemma absolutely_integrable_imp_integrable:
   assumes "f absolutely_integrable_on S" "S \<in> sets lebesgue"
   shows "integrable (lebesgue_on S) f"
   by (meson assms integrable_restrict_space set_integrable_def sets.Int sets.top)
 
 lemma absolutely_integrable_on_null [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "content (cbox a b) = 0 \<Longrightarrow> f absolutely_integrable_on (cbox a b)"
   by (auto simp: absolutely_integrable_on_def)
 
 lemma absolutely_integrable_on_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "f absolutely_integrable_on box a b \<longleftrightarrow>
          f absolutely_integrable_on cbox a b"
   by (auto simp: integrable_on_open_interval absolutely_integrable_on_def)
 
 lemma absolutely_integrable_restrict_UNIV:
   "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV \<longleftrightarrow> f absolutely_integrable_on S"
     unfolding set_integrable_def
   by (intro arg_cong2[where f=integrable]) auto
 
 lemma absolutely_integrable_onI:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f integrable_on S \<Longrightarrow> (\<lambda>x. norm (f x)) integrable_on S \<Longrightarrow> f absolutely_integrable_on S"
   unfolding absolutely_integrable_on_def by auto
 
 lemma nonnegative_absolutely_integrable_1:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on A" and "\<And>x. x \<in> A \<Longrightarrow> 0 \<le> f x"
   shows "f absolutely_integrable_on A"
   by (rule absolutely_integrable_onI [OF f]) (use assms in \<open>simp add: integrable_eq\<close>)
 
 lemma absolutely_integrable_on_iff_nonneg:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x" shows "f absolutely_integrable_on S \<longleftrightarrow> f integrable_on S"
 proof -
   { assume "f integrable_on S"
     then have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV"
       using \<open>f integrable_on S\<close> absolutely_integrable_restrict_UNIV assms nonnegative_absolutely_integrable_1 by blast
     then have "f absolutely_integrable_on S"
       using absolutely_integrable_restrict_UNIV by blast
   }
   then show ?thesis
     unfolding absolutely_integrable_on_def by auto
 qed
 
 lemma absolutely_integrable_on_scaleR_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows
    "(\<lambda>x. c *\<^sub>R f x) absolutely_integrable_on S \<longleftrightarrow>
       c = 0 \<or> f absolutely_integrable_on S"
 proof (cases "c=0")
   case False
   then show ?thesis
   unfolding absolutely_integrable_on_def
   by (simp add: norm_mult)
 qed auto
 
 lemma absolutely_integrable_spike:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f absolutely_integrable_on T" and S: "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "g absolutely_integrable_on T"
   using assms integrable_spike
   unfolding absolutely_integrable_on_def by metis
 
 lemma absolutely_integrable_negligible:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible S"
   shows "f absolutely_integrable_on S"
   using assms by (simp add: absolutely_integrable_on_def integrable_negligible)
 
 lemma absolutely_integrable_spike_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "(f absolutely_integrable_on T \<longleftrightarrow> g absolutely_integrable_on T)"
   using assms by (blast intro: absolutely_integrable_spike sym)
 
 lemma absolutely_integrable_spike_set_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "(f absolutely_integrable_on S \<longleftrightarrow> f absolutely_integrable_on T)"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV \<longleftrightarrow>
         (\<lambda>x. if x \<in> T then f x else 0) absolutely_integrable_on UNIV"
   proof (rule absolutely_integrable_spike_eq)
     show "negligible ({x \<in> S - T. f x \<noteq> 0} \<union> {x \<in> T - S. f x \<noteq> 0})"
       by (rule negligible_Un [OF assms])
   qed auto
   with absolutely_integrable_restrict_UNIV show ?thesis
     by blast
 qed
 
 lemma absolutely_integrable_spike_set:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f absolutely_integrable_on S" and neg: "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "f absolutely_integrable_on T"
   using absolutely_integrable_spike_set_eq f neg by blast
 
 lemma absolutely_integrable_reflect[simp]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "(\<lambda>x. f(-x)) absolutely_integrable_on cbox (-b) (-a) \<longleftrightarrow> f absolutely_integrable_on cbox a b"
   unfolding absolutely_integrable_on_def
   by (metis (mono_tags, lifting) integrable_eq integrable_reflect)
 
 lemma absolutely_integrable_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "(\<lambda>x. f(-x)) absolutely_integrable_on {-b .. -a} \<longleftrightarrow> f absolutely_integrable_on {a..b::real}"
   unfolding box_real[symmetric] by (rule absolutely_integrable_reflect)
 
 lemma absolutely_integrable_on_subcbox:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "\<lbrakk>f absolutely_integrable_on S; cbox a b \<subseteq> S\<rbrakk> \<Longrightarrow> f absolutely_integrable_on cbox a b"
   by (meson absolutely_integrable_on_def integrable_on_subcbox)
 
 lemma absolutely_integrable_on_subinterval:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "\<lbrakk>f absolutely_integrable_on S; {a..b} \<subseteq> S\<rbrakk> \<Longrightarrow> f absolutely_integrable_on {a..b}"
   using absolutely_integrable_on_subcbox by fastforce
 
 lemma integrable_subinterval:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..b}) f"
     and "{c..d} \<subseteq> {a..b}"
   shows "integrable (lebesgue_on {c..d}) f"
 proof (rule absolutely_integrable_imp_integrable)
   show "f absolutely_integrable_on {c..d}"
   proof -
     have "f integrable_on {c..d}"
       using assms integrable_on_lebesgue_on integrable_on_subinterval by fastforce
     moreover have "(\<lambda>x. norm (f x)) integrable_on {c..d}"
     proof (rule integrable_on_subinterval)
       show "(\<lambda>x. norm (f x)) integrable_on {a..b}"
         by (simp add: assms integrable_on_lebesgue_on)
     qed (use assms in auto)
     ultimately show ?thesis
       by (auto simp: absolutely_integrable_on_def)
   qed
 qed auto
 
 lemma indefinite_integral_continuous_real:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..b}) f"
   shows "continuous_on {a..b} (\<lambda>x. integral\<^sup>L (lebesgue_on {a..x}) f)"
 proof -
   have "f integrable_on {a..b}"
     by (simp add: assms integrable_on_lebesgue_on)
   then have "continuous_on {a..b} (\<lambda>x. integral {a..x} f)"
     using indefinite_integral_continuous_1 by blast
   moreover have "integral\<^sup>L (lebesgue_on {a..x}) f = integral {a..x} f" if "a \<le> x" "x \<le> b" for x
   proof -
     have "{a..x} \<subseteq> {a..b}"
       using that by auto
     then have "integrable (lebesgue_on {a..x}) f"
       using integrable_subinterval assms by blast
     then show "integral\<^sup>L (lebesgue_on {a..x}) f = integral {a..x} f"
       by (simp add: lebesgue_integral_eq_integral)
   qed
   ultimately show ?thesis
     by (metis (no_types, lifting) atLeastAtMost_iff continuous_on_cong)
 qed
 
 lemma lmeasurable_iff_integrable_on: "S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. 1::real) integrable_on S"
   by (subst absolutely_integrable_on_iff_nonneg[symmetric])
      (simp_all add: lmeasurable_iff_integrable set_integrable_def)
 
 lemma lmeasure_integral_UNIV: "S \<in> lmeasurable \<Longrightarrow> measure lebesgue S = integral UNIV (indicator S)"
   by (simp add: lmeasurable_iff_has_integral integral_unique)
 
 lemma lmeasure_integral: "S \<in> lmeasurable \<Longrightarrow> measure lebesgue S = integral S (\<lambda>x. 1::real)"
   by (fastforce simp add: lmeasure_integral_UNIV indicator_def [abs_def] of_bool_def lmeasurable_iff_integrable_on)
 
 lemma integrable_on_const: "S \<in> lmeasurable \<Longrightarrow> (\<lambda>x. c) integrable_on S"
   unfolding lmeasurable_iff_integrable
   by (metis (mono_tags, lifting) integrable_eq integrable_on_scaleR_left lmeasurable_iff_integrable lmeasurable_iff_integrable_on scaleR_one)
 
 lemma integral_indicator:
   assumes "(S \<inter> T) \<in> lmeasurable"
   shows "integral T (indicator S) = measure lebesgue (S \<inter> T)"
 proof -
   have "integral UNIV (indicator (S \<inter> T)) = integral UNIV (\<lambda>a. if a \<in> S \<inter> T then 1::real else 0)"
     by (simp add: indicator_def [abs_def] of_bool_def)
   moreover have "(indicator (S \<inter> T) has_integral measure lebesgue (S \<inter> T)) UNIV"
     using assms by (simp add: lmeasurable_iff_has_integral)
   ultimately have "integral UNIV (\<lambda>x. if x \<in> S \<inter> T then 1 else 0) = measure lebesgue (S \<inter> T)"
     by (metis (no_types) integral_unique)
   moreover have "integral T (\<lambda>a. if a \<in> S then 1::real else 0) = integral (S \<inter> T \<inter> UNIV) (\<lambda>a. 1)"
     by (simp add: Henstock_Kurzweil_Integration.integral_restrict_Int)
   moreover have "integral T (indicat_real S) = integral T (\<lambda>a. if a \<in> S then 1 else 0)"
     by (simp add: indicator_def [abs_def] of_bool_def)
   ultimately show ?thesis
     by (simp add: assms lmeasure_integral)
 qed
 
 lemma measurable_integrable:
   fixes S :: "'a::euclidean_space set"
   shows "S \<in> lmeasurable \<longleftrightarrow> (indicat_real S) integrable_on UNIV"
   by (auto simp: lmeasurable_iff_integrable absolutely_integrable_on_iff_nonneg [symmetric] set_integrable_def)
 
 lemma integrable_on_indicator:
   fixes S :: "'a::euclidean_space set"
   shows "indicat_real S integrable_on T \<longleftrightarrow> (S \<inter> T) \<in> lmeasurable"
   unfolding measurable_integrable
   unfolding integrable_restrict_UNIV [of T, symmetric]
   by (fastforce simp add: indicator_def elim: integrable_eq)
 
 lemma
   assumes \<D>: "\<D> division_of S"
   shows lmeasurable_division: "S \<in> lmeasurable" (is ?l)
     and content_division: "(\<Sum>k\<in>\<D>. measure lebesgue k) = measure lebesgue S" (is ?m)
 proof -
   { fix d1 d2 assume *: "d1 \<in> \<D>" "d2 \<in> \<D>" "d1 \<noteq> d2"
     then obtain a b c d where "d1 = cbox a b" "d2 = cbox c d"
       using division_ofD(4)[OF \<D>] by blast
     with division_ofD(5)[OF \<D> *]
     have "d1 \<in> sets lborel" "d2 \<in> sets lborel" "d1 \<inter> d2 \<subseteq> (cbox a b - box a b) \<union> (cbox c d - box c d)"
       by auto
     moreover have "(cbox a b - box a b) \<union> (cbox c d - box c d) \<in> null_sets lborel"
       by (intro null_sets.Un null_sets_cbox_Diff_box)
     ultimately have "d1 \<inter> d2 \<in> null_sets lborel"
       by (blast intro: null_sets_subset) }
   then show ?l ?m
     unfolding division_ofD(6)[OF \<D>, symmetric]
     using division_ofD(1,4)[OF \<D>]
     by (auto intro!: measure_Union_AE[symmetric] simp: completion.AE_iff_null_sets Int_def[symmetric] pairwise_def null_sets_def)
 qed
 
 lemma has_measure_limit:
   assumes "S \<in> lmeasurable" "e > 0"
   obtains B where "B > 0"
     "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> \<bar>measure lebesgue (S \<inter> cbox a b) - measure lebesgue S\<bar> < e"
   using assms unfolding lmeasurable_iff_has_integral has_integral_alt'
   by (force simp: integral_indicator integrable_on_indicator)
 
 lemma lmeasurable_iff_indicator_has_integral:
   fixes S :: "'a::euclidean_space set"
   shows "S \<in> lmeasurable \<and> m = measure lebesgue S \<longleftrightarrow> (indicat_real S has_integral m) UNIV"
   by (metis has_integral_iff lmeasurable_iff_has_integral measurable_integrable)
 
 lemma has_measure_limit_iff:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "S \<in> lmeasurable \<and> m = measure lebesgue S \<longleftrightarrow>
           (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
             (S \<inter> cbox a b) \<in> lmeasurable \<and> \<bar>measure lebesgue (S \<inter> cbox a b) - m\<bar> < e)" (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     by (meson has_measure_limit fmeasurable.Int lmeasurable_cbox)
 next
   assume RHS [rule_format]: ?rhs
   then show ?lhs
     apply (simp add: lmeasurable_iff_indicator_has_integral has_integral' [where i=m])
     by (metis (full_types) integral_indicator integrable_integral integrable_on_indicator)
 qed
 
 subsection\<open>Applications to Negligibility\<close>
 
 lemma negligible_iff_null_sets: "negligible S \<longleftrightarrow> S \<in> null_sets lebesgue"
 proof
   assume "negligible S"
   then have "(indicator S has_integral (0::real)) UNIV"
     by (auto simp: negligible)
   then show "S \<in> null_sets lebesgue"
     by (subst (asm) has_integral_iff_nn_integral_lebesgue)
         (auto simp: borel_measurable_indicator_iff nn_integral_0_iff_AE AE_iff_null_sets indicator_eq_0_iff)
 next
   assume S: "S \<in> null_sets lebesgue"
   show "negligible S"
     unfolding negligible_def
   proof (safe intro!: has_integral_iff_nn_integral_lebesgue[THEN iffD2]
                       has_integral_restrict_UNIV[where s="cbox _ _", THEN iffD1])
     fix a b
     show "(\<lambda>x. if x \<in> cbox a b then indicator S x else 0) \<in> lebesgue \<rightarrow>\<^sub>M borel"
       using S by (auto intro!: measurable_If)
     then show "(\<integral>\<^sup>+ x. ennreal (if x \<in> cbox a b then indicator S x else 0) \<partial>lebesgue) = ennreal 0"
       using S[THEN AE_not_in] by (auto intro!: nn_integral_0_iff_AE[THEN iffD2])
   qed auto
 qed
 
 corollary eventually_ae_filter_negligible:
   "eventually P (ae_filter lebesgue) \<longleftrightarrow> (\<exists>N. negligible N \<and> {x. \<not> P x} \<subseteq> N)"
   by (auto simp: completion.AE_iff_null_sets negligible_iff_null_sets null_sets_completion_subset)
 
 lemma starlike_negligible:
   assumes "closed S"
       and eq1: "\<And>c x. (a + c *\<^sub>R x) \<in> S \<Longrightarrow> 0 \<le> c \<Longrightarrow> a + x \<in> S \<Longrightarrow> c = 1"
     shows "negligible S"
 proof -
   have "negligible ((+) (-a) ` S)"
   proof (subst negligible_on_intervals, intro allI)
     fix u v
     show "negligible ((+) (- a) ` S \<inter> cbox u v)"
       using \<open>closed S\<close> eq1 by (auto simp add: negligible_iff_null_sets algebra_simps
         intro!: closed_translation_subtract starlike_negligible_compact cong: image_cong_simp)
         (metis add_diff_eq diff_add_cancel scale_right_diff_distrib)
   qed
   then show ?thesis
     by (rule negligible_translation_rev)
 qed
 
 lemma starlike_negligible_strong:
   assumes "closed S"
       and star: "\<And>c x. \<lbrakk>0 \<le> c; c < 1; a+x \<in> S\<rbrakk> \<Longrightarrow> a + c *\<^sub>R x \<notin> S"
     shows "negligible S"
 proof -
   show ?thesis
   proof (rule starlike_negligible [OF \<open>closed S\<close>, of a])
     fix c x
     assume cx: "a + c *\<^sub>R x \<in> S" "0 \<le> c" "a + x \<in> S"
     with star have "\<not> (c < 1)" by auto
     moreover have "\<not> (c > 1)"
       using star [of "1/c" "c *\<^sub>R x"] cx by force
     ultimately show "c = 1" by arith
   qed
 qed
 
 lemma negligible_hyperplane:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0" shows "negligible {x. a \<bullet> x = b}"
 proof -
   obtain x where x: "a \<bullet> x \<noteq> b"
     using assms by (metis euclidean_all_zero_iff inner_zero_right)
   moreover have "c = 1" if "a \<bullet> (x + c *\<^sub>R w) = b" "a \<bullet> (x + w) = b" for c w
     using that
     by (metis (no_types, opaque_lifting) add_diff_eq diff_0 diff_minus_eq_add inner_diff_right inner_scaleR_right mult_cancel_right2 right_minus_eq x)
   ultimately
   show ?thesis
     using starlike_negligible [OF closed_hyperplane, of x] by simp
 qed
 
 lemma negligible_lowdim:
   fixes S :: "'N :: euclidean_space set"
   assumes "dim S < DIM('N)"
     shows "negligible S"
 proof -
   obtain a where "a \<noteq> 0" and a: "span S \<subseteq> {x. a \<bullet> x = 0}"
     using lowdim_subset_hyperplane [OF assms] by blast
   have "negligible (span S)"
     using \<open>a \<noteq> 0\<close> a negligible_hyperplane by (blast intro: negligible_subset)
   then show ?thesis
     using span_base by (blast intro: negligible_subset)
 qed
 
 proposition negligible_convex_frontier:
   fixes S :: "'N :: euclidean_space set"
   assumes "convex S"
     shows "negligible(frontier S)"
 proof -
   have nf: "negligible(frontier S)" if "convex S" "0 \<in> S" for S :: "'N set"
   proof -
     obtain B where "B \<subseteq> S" and indB: "independent B"
                and spanB: "S \<subseteq> span B" and cardB: "card B = dim S"
       by (metis basis_exists)
     consider "dim S < DIM('N)" | "dim S = DIM('N)"
       using dim_subset_UNIV le_eq_less_or_eq by auto
     then show ?thesis
     proof cases
       case 1
       show ?thesis
         by (rule negligible_subset [of "closure S"])
            (simp_all add: frontier_def negligible_lowdim 1)
     next
       case 2
       obtain a where "a \<in> interior (convex hull insert 0 B)"
       proof (rule interior_simplex_nonempty [OF indB])
         show "finite B"
           by (simp add: indB independent_finite)
         show "card B = DIM('N)"
           by (simp add: cardB 2)
       qed
       then have a: "a \<in> interior S"
         by (metis \<open>B \<subseteq> S\<close> \<open>0 \<in> S\<close> \<open>convex S\<close> insert_absorb insert_subset interior_mono subset_hull)
       show ?thesis
       proof (rule starlike_negligible_strong [where a=a])
         fix c::real and x
         have eq: "a + c *\<^sub>R x = (a + x) - (1 - c) *\<^sub>R ((a + x) - a)"
           by (simp add: algebra_simps)
         assume "0 \<le> c" "c < 1" "a + x \<in> frontier S"
         then show "a + c *\<^sub>R x \<notin> frontier S"
           using eq mem_interior_closure_convex_shrink [OF \<open>convex S\<close> a, of _ "1-c"]
           unfolding frontier_def
           by (metis Diff_iff add_diff_cancel_left' add_diff_eq diff_gt_0_iff_gt group_cancel.rule0 not_le)
       qed auto
     qed
   qed
   show ?thesis
   proof (cases "S = {}")
     case True then show ?thesis by auto
   next
     case False
     then obtain a where "a \<in> S" by auto
     show ?thesis
       using nf [of "(\<lambda>x. -a + x) ` S"]
       by (metis \<open>a \<in> S\<close> add.left_inverse assms convex_translation_eq frontier_translation
                 image_eqI negligible_translation_rev)
   qed
 qed
 
 corollary negligible_sphere: "negligible (sphere a e)"
   using frontier_cball negligible_convex_frontier convex_cball
   by (blast intro: negligible_subset)
 
 lemma non_negligible_UNIV [simp]: "\<not> negligible UNIV"
   unfolding negligible_iff_null_sets by (auto simp: null_sets_def)
 
 lemma negligible_interval:
   "negligible (cbox a b) \<longleftrightarrow> box a b = {}" "negligible (box a b) \<longleftrightarrow> box a b = {}"
    by (auto simp: negligible_iff_null_sets null_sets_def prod_nonneg inner_diff_left box_eq_empty
                   not_le emeasure_lborel_cbox_eq emeasure_lborel_box_eq
             intro: eq_refl antisym less_imp_le)
 
 proposition open_not_negligible:
   assumes "open S" "S \<noteq> {}"
   shows "\<not> negligible S"
 proof
   assume neg: "negligible S"
   obtain a where "a \<in> S"
     using \<open>S \<noteq> {}\<close> by blast
   then obtain e where "e > 0" "cball a e \<subseteq> S"
     using \<open>open S\<close> open_contains_cball_eq by blast
   let ?p = "a - (e / DIM('a)) *\<^sub>R One" let ?q = "a + (e / DIM('a)) *\<^sub>R One"
   have "cbox ?p ?q \<subseteq> cball a e"
   proof (clarsimp simp: mem_box dist_norm)
     fix x
     assume "\<forall>i\<in>Basis. ?p \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> ?q \<bullet> i"
     then have ax: "\<bar>(a - x) \<bullet> i\<bar> \<le> e / real DIM('a)" if "i \<in> Basis" for i
       using that by (auto simp: algebra_simps)
     have "norm (a - x) \<le> (\<Sum>i\<in>Basis. \<bar>(a - x) \<bullet> i\<bar>)"
       by (rule norm_le_l1)
     also have "\<dots> \<le> DIM('a) * (e / real DIM('a))"
       by (intro sum_bounded_above ax)
     also have "\<dots> = e"
       by simp
     finally show "norm (a - x) \<le> e" .
   qed
   then have "negligible (cbox ?p ?q)"
     by (meson \<open>cball a e \<subseteq> S\<close> neg negligible_subset)
   with \<open>e > 0\<close> show False
     by (simp add: negligible_interval box_eq_empty algebra_simps field_split_simps mult_le_0_iff)
 qed
 
 lemma negligible_convex_interior:
    "convex S \<Longrightarrow> (negligible S \<longleftrightarrow> interior S = {})"
   by (metis Diff_empty closure_subset frontier_def interior_subset negligible_convex_frontier negligible_subset open_interior open_not_negligible)
 
 lemma measure_eq_0_null_sets: "S \<in> null_sets M \<Longrightarrow> measure M S = 0"
   by (auto simp: measure_def null_sets_def)
 
 lemma negligible_imp_measure0: "negligible S \<Longrightarrow> measure lebesgue S = 0"
   by (simp add: measure_eq_0_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_emeasure0: "S \<in> sets lebesgue \<Longrightarrow> (negligible S \<longleftrightarrow> emeasure lebesgue S = 0)"
   by (auto simp: measure_eq_0_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_measure0: "S \<in> lmeasurable \<Longrightarrow> (negligible S \<longleftrightarrow> measure lebesgue S = 0)"
   by (metis (full_types) completion.null_sets_outer negligible_iff_null_sets negligible_imp_measure0 order_refl)
 
 lemma negligible_imp_sets: "negligible S \<Longrightarrow> S \<in> sets lebesgue"
   by (simp add: negligible_iff_null_sets null_setsD2)
 
 lemma negligible_imp_measurable: "negligible S \<Longrightarrow> S \<in> lmeasurable"
   by (simp add: fmeasurableI_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_measure: "negligible S \<longleftrightarrow> S \<in> lmeasurable \<and> measure lebesgue S = 0"
   by (fastforce simp: negligible_iff_measure0 negligible_imp_measurable dest: negligible_imp_measure0)
 
 lemma negligible_outer:
   "negligible S \<longleftrightarrow> (\<forall>e>0. \<exists>T. S \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T < e)" (is "_ = ?rhs")
 proof
   assume "negligible S" then show ?rhs
     by (metis negligible_iff_measure order_refl)
 next
   assume ?rhs then show "negligible S"
   by (meson completion.null_sets_outer negligible_iff_null_sets)
 qed
 
 lemma negligible_outer_le:
      "negligible S \<longleftrightarrow> (\<forall>e>0. \<exists>T. S \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e)" (is "_ = ?rhs")
 proof
   assume "negligible S" then show ?rhs
     by (metis dual_order.strict_implies_order negligible_imp_measurable negligible_imp_measure0 order_refl)
 next
   assume ?rhs then show "negligible S"
     by (metis le_less_trans negligible_outer field_lbound_gt_zero)
 qed
 
 lemma negligible_UNIV: "negligible S \<longleftrightarrow> (indicat_real S has_integral 0) UNIV" (is "_=?rhs")
   by (metis lmeasurable_iff_indicator_has_integral negligible_iff_measure)
 
 lemma sets_negligible_symdiff:
    "\<lbrakk>S \<in> sets lebesgue; negligible((S - T) \<union> (T - S))\<rbrakk> \<Longrightarrow> T \<in> sets lebesgue"
   by (metis Diff_Diff_Int Int_Diff_Un inf_commute negligible_Un_eq negligible_imp_sets sets.Diff sets.Un)
 
 lemma lmeasurable_negligible_symdiff:
    "\<lbrakk>S \<in> lmeasurable; negligible((S - T) \<union> (T - S))\<rbrakk> \<Longrightarrow> T \<in> lmeasurable"
   using integrable_spike_set_eq lmeasurable_iff_integrable_on by blast
 
 
 lemma measure_Un3_negligible:
   assumes meas: "S \<in> lmeasurable" "T \<in> lmeasurable" "U \<in> lmeasurable"
   and neg: "negligible(S \<inter> T)" "negligible(S \<inter> U)" "negligible(T \<inter> U)" and V: "S \<union> T \<union> U = V"
 shows "measure lebesgue V = measure lebesgue S + measure lebesgue T + measure lebesgue U"
 proof -
   have [simp]: "measure lebesgue (S \<inter> T) = 0"
     using neg(1) negligible_imp_measure0 by blast
   have [simp]: "measure lebesgue (S \<inter> U \<union> T \<inter> U) = 0"
     using neg(2) neg(3) negligible_Un negligible_imp_measure0 by blast
   have "measure lebesgue V = measure lebesgue (S \<union> T \<union> U)"
     using V by simp
   also have "\<dots> = measure lebesgue S + measure lebesgue T + measure lebesgue U"
     by (simp add: measure_Un3 meas fmeasurable.Un Int_Un_distrib2)
   finally show ?thesis .
 qed
 
 lemma measure_translate_add:
   assumes meas: "S \<in> lmeasurable" "T \<in> lmeasurable"
     and U: "S \<union> ((+)a ` T) = U" and neg: "negligible(S \<inter> ((+)a ` T))"
   shows "measure lebesgue S + measure lebesgue T = measure lebesgue U"
 proof -
   have [simp]: "measure lebesgue (S \<inter> (+) a ` T) = 0"
     using neg negligible_imp_measure0 by blast
   have "measure lebesgue (S \<union> ((+)a ` T)) = measure lebesgue S + measure lebesgue T"
     by (simp add: measure_Un3 meas measurable_translation measure_translation fmeasurable.Un)
   then show ?thesis
     using U by auto
 qed
 
 lemma measure_negligible_symdiff:
   assumes S: "S \<in> lmeasurable"
     and neg: "negligible (S - T \<union> (T - S))"
   shows "measure lebesgue T = measure lebesgue S"
 proof -
   have "measure lebesgue (S - T) = 0"
     using neg negligible_Un_eq negligible_imp_measure0 by blast
   then show ?thesis
     by (metis S Un_commute add.right_neutral lmeasurable_negligible_symdiff measure_Un2 neg negligible_Un_eq negligible_imp_measure0)
 qed
 
 lemma measure_closure:
   assumes "bounded S" and neg: "negligible (frontier S)"
   shows "measure lebesgue (closure S) = measure lebesgue S"
 proof -
   have "measure lebesgue (frontier S) = 0"
     by (metis neg negligible_imp_measure0)
   then show ?thesis
     by (metis assms lmeasurable_iff_integrable_on eq_iff_diff_eq_0 has_integral_interior integrable_on_def integral_unique lmeasurable_interior lmeasure_integral measure_frontier)
 qed
 
 lemma measure_interior:
    "\<lbrakk>bounded S; negligible(frontier S)\<rbrakk> \<Longrightarrow> measure lebesgue (interior S) = measure lebesgue S"
   using measure_closure measure_frontier negligible_imp_measure0 by fastforce
 
 lemma measurable_Jordan:
   assumes "bounded S" and neg: "negligible (frontier S)"
   shows "S \<in> lmeasurable"
 proof -
   have "closure S \<in> lmeasurable"
     by (metis lmeasurable_closure \<open>bounded S\<close>)
   moreover have "interior S \<in> lmeasurable"
     by (simp add: lmeasurable_interior \<open>bounded S\<close>)
   moreover have "interior S \<subseteq> S"
     by (simp add: interior_subset)
   ultimately show ?thesis
     using assms by (metis (full_types) closure_subset completion.complete_sets_sandwich_fmeasurable measure_closure measure_interior)
 qed
 
 lemma measurable_convex: "\<lbrakk>convex S; bounded S\<rbrakk> \<Longrightarrow> S \<in> lmeasurable"
   by (simp add: measurable_Jordan negligible_convex_frontier)
 
 lemma content_cball_conv_ball: "content (cball c r) = content (ball c r)"
 proof -
   have "ball c r - cball c r \<union> (cball c r - ball c r) = sphere c r"
     by auto
   hence "measure lebesgue (cball c r) = measure lebesgue (ball c r)"
     using negligible_sphere[of c r] by (intro measure_negligible_symdiff) simp_all
   thus ?thesis by simp
 qed
 
 subsection\<open>Negligibility of image under non-injective linear map\<close>
 
 lemma negligible_Union_nat:
   assumes "\<And>n::nat. negligible(S n)"
   shows "negligible(\<Union>n. S n)"
 proof -
   have "negligible (\<Union>m\<le>k. S m)" for k
     using assms by blast
   then have 0:  "integral UNIV (indicat_real (\<Union>m\<le>k. S m)) = 0"
     and 1: "(indicat_real (\<Union>m\<le>k. S m)) integrable_on UNIV" for k
     by (auto simp: negligible has_integral_iff)
   have 2: "\<And>k x. indicat_real (\<Union>m\<le>k. S m) x \<le> (indicat_real (\<Union>m\<le>Suc k. S m) x)"
     by (auto simp add: indicator_def)
   have 3: "\<And>x. (\<lambda>k. indicat_real (\<Union>m\<le>k. S m) x) \<longlonglongrightarrow> (indicat_real (\<Union>n. S n) x)"
     by (force simp: indicator_def eventually_sequentially intro: tendsto_eventually)
   have 4: "bounded (range (\<lambda>k. integral UNIV (indicat_real (\<Union>m\<le>k. S m))))"
     by (simp add: 0)
   have *: "indicat_real (\<Union>n. S n) integrable_on UNIV \<and>
         (\<lambda>k. integral UNIV (indicat_real (\<Union>m\<le>k. S m))) \<longlonglongrightarrow> (integral UNIV (indicat_real (\<Union>n. S n)))"
     by (intro monotone_convergence_increasing 1 2 3 4)
   then have "integral UNIV (indicat_real (\<Union>n. S n)) = (0::real)"
     using LIMSEQ_unique by (auto simp: 0)
   then show ?thesis
     using * by (simp add: negligible_UNIV has_integral_iff)
 qed
 
 
 lemma negligible_linear_singular_image:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'n"
   assumes "linear f" "\<not> inj f"
   shows "negligible (f ` S)"
 proof -
   obtain a where "a \<noteq> 0" "\<And>S. f ` S \<subseteq> {x. a \<bullet> x = 0}"
     using assms linear_singular_image_hyperplane by blast
   then show "negligible (f ` S)"
     by (metis negligible_hyperplane negligible_subset)
 qed
 
 lemma measure_negligible_finite_Union:
   assumes "finite \<F>"
     and meas: "\<And>S. S \<in> \<F> \<Longrightarrow> S \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>S T. negligible (S \<inter> T)) \<F>"
   shows "measure lebesgue (\<Union>\<F>) = (\<Sum>S\<in>\<F>. measure lebesgue S)"
   using assms
 proof (induction)
   case empty
   then show ?case
     by auto
 next
   case (insert S \<F>)
   then have "S \<in> lmeasurable" "\<Union>\<F> \<in> lmeasurable" "pairwise (\<lambda>S T. negligible (S \<inter> T)) \<F>"
     by (simp_all add: fmeasurable.finite_Union insert.hyps(1) insert.prems(1) pairwise_insert subsetI)
   then show ?case
   proof (simp add: measure_Un3 insert)
     have *: "\<And>T. T \<in> (\<inter>) S ` \<F> \<Longrightarrow> negligible T"
       using insert by (force simp: pairwise_def)
     have "negligible(S \<inter> \<Union>\<F>)"
       unfolding Int_Union
       by (rule negligible_Union) (simp_all add: * insert.hyps(1))
     then show "measure lebesgue (S \<inter> \<Union>\<F>) = 0"
       using negligible_imp_measure0 by blast
   qed
 qed
 
 lemma measure_negligible_finite_Union_image:
   assumes "finite S"
     and meas: "\<And>x. x \<in> S \<Longrightarrow> f x \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>x y. negligible (f x \<inter> f y)) S"
   shows "measure lebesgue (\<Union>(f ` S)) = (\<Sum>x\<in>S. measure lebesgue (f x))"
 proof -
   have "measure lebesgue (\<Union>(f ` S)) = sum (measure lebesgue) (f ` S)"
     using assms by (auto simp: pairwise_mono pairwise_image intro: measure_negligible_finite_Union)
   also have "\<dots> = sum (measure lebesgue \<circ> f) S"
     using djointish [unfolded pairwise_def] by (metis inf.idem negligible_imp_measure0 sum.reindex_nontrivial [OF \<open>finite S\<close>])
   also have "\<dots> = (\<Sum>x\<in>S. measure lebesgue (f x))"
     by simp
   finally show ?thesis .
 qed
 
 subsection \<open>Negligibility of a Lipschitz image of a negligible set\<close>
 
 text\<open>The bound will be eliminated by a sort of onion argument\<close>
 lemma locally_Lipschitz_negl_bounded:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "0 < B" "bounded S" "negligible S"
       and lips: "\<And>x. x \<in> S
                       \<Longrightarrow> \<exists>T. open T \<and> x \<in> T \<and>
                               (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
   shows "negligible (f ` S)"
   unfolding negligible_iff_null_sets
 proof (clarsimp simp: completion.null_sets_outer)
   fix e::real
   assume "0 < e"
   have "S \<in> lmeasurable"
     using \<open>negligible S\<close> by (simp add: negligible_iff_null_sets fmeasurableI_null_sets)
   then have "S \<in> sets lebesgue"
     by blast
   have e22: "0 < e/2 / (2 * B * real DIM('M)) ^ DIM('N)"
     using \<open>0 < e\<close> \<open>0 < B\<close> by (simp add: field_split_simps)
   obtain T where "open T" "S \<subseteq> T" "(T - S) \<in> lmeasurable"
                  "measure lebesgue (T - S) < e/2 / (2 * B * DIM('M)) ^ DIM('N)"
     using sets_lebesgue_outer_open [OF \<open>S \<in> sets lebesgue\<close> e22]
     by (metis emeasure_eq_measure2 ennreal_leI linorder_not_le)
   then have T: "measure lebesgue T \<le> e/2 / (2 * B * DIM('M)) ^ DIM('N)"
     using \<open>negligible S\<close> by (simp add: measure_Diff_null_set negligible_iff_null_sets)
   have "\<exists>r. 0 < r \<and> r \<le> 1/2 \<and>
             (x \<in> S \<longrightarrow> (\<forall>y. norm(y - x) < r
                        \<longrightarrow> y \<in> T \<and> (y \<in> S \<longrightarrow> norm(f y - f x) \<le> B * norm(y - x))))"
         for x
   proof (cases "x \<in> S")
     case True
     obtain U where "open U" "x \<in> U" and U: "\<And>y. y \<in> S \<inter> U \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
       using lips [OF \<open>x \<in> S\<close>] by auto
     have "x \<in> T \<inter> U"
       using \<open>S \<subseteq> T\<close> \<open>x \<in> U\<close> \<open>x \<in> S\<close> by auto
     then obtain \<epsilon> where "0 < \<epsilon>" "ball x \<epsilon> \<subseteq> T \<inter> U"
       by (metis \<open>open T\<close> \<open>open U\<close> openE open_Int)
     then show ?thesis
       by (rule_tac x="min (1/2) \<epsilon>" in exI) (simp add: U dist_norm norm_minus_commute subset_iff)
   next
     case False
     then show ?thesis
       by (rule_tac x="1/4" in exI) auto
   qed
   then obtain R where R12: "\<And>x. 0 < R x \<and> R x \<le> 1/2"
                 and RT: "\<And>x y. \<lbrakk>x \<in> S; norm(y - x) < R x\<rbrakk> \<Longrightarrow> y \<in> T"
                 and RB: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S; norm(y - x) < R x\<rbrakk> \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
     by metis+
   then have gaugeR: "gauge (\<lambda>x. ball x (R x))"
     by (simp add: gauge_def)
   obtain c where c: "S \<subseteq> cbox (-c *\<^sub>R One) (c *\<^sub>R One)" "box (-c *\<^sub>R One:: 'M) (c *\<^sub>R One) \<noteq> {}"
   proof -
     obtain B where B: "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> B"
       using \<open>bounded S\<close> bounded_iff by blast
     show ?thesis
     proof (rule_tac c = "abs B + 1" in that)
       show "S \<subseteq> cbox (- (\<bar>B\<bar> + 1) *\<^sub>R One) ((\<bar>B\<bar> + 1) *\<^sub>R One)"
         using norm_bound_Basis_le Basis_le_norm
         by (fastforce simp: mem_box dest!: B intro: order_trans)
       show "box (- (\<bar>B\<bar> + 1) *\<^sub>R One) ((\<bar>B\<bar> + 1) *\<^sub>R One) \<noteq> {}"
         by (simp add: box_eq_empty(1))
     qed
   qed
   obtain \<D> where "countable \<D>"
      and Dsub: "\<Union>\<D> \<subseteq> cbox (-c *\<^sub>R One) (c *\<^sub>R One)"
      and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
      and pw:   "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
      and Ksub: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> (\<lambda>x. ball x (R x)) x"
      and exN:  "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v \<bullet> i - u \<bullet> i = (2*c) / 2^n"
      and "S \<subseteq> \<Union>\<D>"
     using covering_lemma [OF c gaugeR]  by force
   have "\<exists>u v z. K = cbox u v \<and> box u v \<noteq> {} \<and> z \<in> S \<and> z \<in> cbox u v \<and>
                 cbox u v \<subseteq> ball z (R z)" if "K \<in> \<D>" for K
   proof -
     obtain u v where "K = cbox u v"
       using \<open>K \<in> \<D>\<close> cbox by blast
     with that show ?thesis
       by (metis Int_iff interior_cbox cbox Ksub)
   qed
   then obtain uf vf zf
     where uvz: "\<And>K. K \<in> \<D> \<Longrightarrow>
                 K = cbox (uf K) (vf K) \<and> box (uf K) (vf K) \<noteq> {} \<and> zf K \<in> S \<and>
                 zf K \<in> cbox (uf K) (vf K) \<and> cbox (uf K) (vf K) \<subseteq> ball (zf K) (R (zf K))"
     by metis
   define prj1 where "prj1 \<equiv> \<lambda>x::'M. x \<bullet> (SOME i. i \<in> Basis)"
   define fbx where "fbx \<equiv> \<lambda>D. cbox (f(zf D) - (B * DIM('M) * (prj1(vf D - uf D))) *\<^sub>R One::'N)
                                     (f(zf D) + (B * DIM('M) * prj1(vf D - uf D)) *\<^sub>R One)"
   have vu_pos: "0 < prj1 (vf X - uf X)" if "X \<in> \<D>" for X
     using uvz [OF that] by (simp add: prj1_def box_ne_empty SOME_Basis inner_diff_left)
   have prj1_idem: "prj1 (vf X - uf X) = (vf X - uf X) \<bullet> i" if  "X \<in> \<D>" "i \<in> Basis" for X i
   proof -
     have "cbox (uf X) (vf X) \<in> \<D>"
       using uvz \<open>X \<in> \<D>\<close> by auto
     with exN obtain n where "\<And>i. i \<in> Basis \<Longrightarrow> vf X \<bullet> i - uf X \<bullet> i = (2*c) / 2^n"
       by blast
     then show ?thesis
       by (simp add: \<open>i \<in> Basis\<close> SOME_Basis inner_diff prj1_def)
   qed
   have countbl: "countable (fbx ` \<D>)"
     using \<open>countable \<D>\<close> by blast
   have "(\<Sum>k\<in>fbx`\<D>'. measure lebesgue k) \<le> e/2" if "\<D>' \<subseteq> \<D>" "finite \<D>'" for \<D>'
   proof -
     have BM_ge0: "0 \<le> B * (DIM('M) * prj1 (vf X - uf X))" if "X \<in> \<D>'" for X
       using \<open>0 < B\<close> \<open>\<D>' \<subseteq> \<D>\<close> that vu_pos by fastforce
     have "{} \<notin> \<D>'"
       using cbox \<open>\<D>' \<subseteq> \<D>\<close> interior_empty by blast
     have "(\<Sum>k\<in>fbx`\<D>'. measure lebesgue k) \<le> sum (measure lebesgue o fbx) \<D>'"
       by (rule sum_image_le [OF \<open>finite \<D>'\<close>]) (force simp: fbx_def)
     also have "\<dots> \<le> (\<Sum>X\<in>\<D>'. (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X)"
     proof (rule sum_mono)
       fix X assume "X \<in> \<D>'"
       then have "X \<in> \<D>" using \<open>\<D>' \<subseteq> \<D>\<close> by blast
       then have ufvf: "cbox (uf X) (vf X) = X"
         using uvz by blast
       have "prj1 (vf X - uf X) ^ DIM('M) = (\<Prod>i::'M \<in> Basis. prj1 (vf X - uf X))"
         by (rule prod_constant [symmetric])
       also have "\<dots> = (\<Prod>i\<in>Basis. vf X \<bullet> i - uf X \<bullet> i)"
         by (simp add: \<open>X \<in> \<D>\<close> inner_diff_left prj1_idem cong: prod.cong)
       finally have prj1_eq: "prj1 (vf X - uf X) ^ DIM('M) = (\<Prod>i\<in>Basis. vf X \<bullet> i - uf X \<bullet> i)" .
       have "uf X \<in> cbox (uf X) (vf X)" "vf X \<in> cbox (uf X) (vf X)"
         using uvz [OF \<open>X \<in> \<D>\<close>] by (force simp: mem_box)+
       moreover have "cbox (uf X) (vf X) \<subseteq> ball (zf X) (1/2)"
         by (meson R12 order_trans subset_ball uvz [OF \<open>X \<in> \<D>\<close>])
       ultimately have "uf X \<in> ball (zf X) (1/2)"  "vf X \<in> ball (zf X) (1/2)"
         by auto
       then have "dist (vf X) (uf X) \<le> 1"
         unfolding mem_ball
         by (metis dist_commute dist_triangle_half_l dual_order.order_iff_strict)
       then have 1: "prj1 (vf X - uf X) \<le> 1"
         unfolding prj1_def dist_norm using Basis_le_norm SOME_Basis order_trans by fastforce
       have 0: "0 \<le> prj1 (vf X - uf X)"
         using \<open>X \<in> \<D>\<close> prj1_def vu_pos by fastforce
       have "(measure lebesgue \<circ> fbx) X \<le> (2 * B * DIM('M)) ^ DIM('N) * content (cbox (uf X) (vf X))"
         apply (simp add: fbx_def content_cbox_cases algebra_simps BM_ge0 \<open>X \<in> \<D>'\<close> \<open>0 < B\<close> flip: prj1_eq)
         using MleN 0 1 uvz \<open>X \<in> \<D>\<close>
         by (fastforce simp add: box_ne_empty power_decreasing)
       also have "\<dots> = (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X"
         by (subst (3) ufvf[symmetric]) simp
       finally show "(measure lebesgue \<circ> fbx) X \<le> (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X" .
     qed
     also have "\<dots> = (2 * B * DIM('M)) ^ DIM('N) * sum (measure lebesgue) \<D>'"
       by (simp add: sum_distrib_left)
     also have "\<dots> \<le> e/2"
     proof -
       have "\<And>K. K \<in> \<D>' \<Longrightarrow> \<exists>a b. K = cbox a b"
         using cbox that by blast
       then have div: "\<D>' division_of \<Union>\<D>'"
         using pairwise_subset [OF pw \<open>\<D>' \<subseteq> \<D>\<close>] unfolding pairwise_def
         by (force simp: \<open>finite \<D>'\<close> \<open>{} \<notin> \<D>'\<close> division_of_def)
       have le_meaT: "measure lebesgue (\<Union>\<D>') \<le> measure lebesgue T"
       proof (rule measure_mono_fmeasurable)
         show "(\<Union>\<D>') \<in> sets lebesgue"
           using div lmeasurable_division by auto
         have "\<Union>\<D>' \<subseteq> \<Union>\<D>"
           using \<open>\<D>' \<subseteq> \<D>\<close> by blast
         also have "... \<subseteq> T"
         proof (clarify)
           fix x D
           assume "x \<in> D" "D \<in> \<D>"
           show "x \<in> T"
             using Ksub [OF \<open>D \<in> \<D>\<close>]
             by (metis \<open>x \<in> D\<close> Int_iff dist_norm mem_ball norm_minus_commute subsetD RT)
         qed
         finally show "\<Union>\<D>' \<subseteq> T" .
         show "T \<in> lmeasurable"
           using \<open>S \<in> lmeasurable\<close> \<open>S \<subseteq> T\<close> \<open>T - S \<in> lmeasurable\<close> fmeasurable_Diff_D by blast
       qed
       have "sum (measure lebesgue) \<D>' = sum content \<D>'"
         using  \<open>\<D>' \<subseteq> \<D>\<close> cbox by (force intro: sum.cong)
       then have "(2 * B * DIM('M)) ^ DIM('N) * sum (measure lebesgue) \<D>' =
                  (2 * B * real DIM('M)) ^ DIM('N) * measure lebesgue (\<Union>\<D>')"
         using content_division [OF div] by auto
       also have "\<dots> \<le> (2 * B * real DIM('M)) ^ DIM('N) * measure lebesgue T"
         using \<open>0 < B\<close> 
         by (intro mult_left_mono [OF le_meaT]) (force simp add: algebra_simps)
       also have "\<dots> \<le> e/2"
         using T \<open>0 < B\<close> by (simp add: field_simps)
       finally show ?thesis .
     qed
     finally show ?thesis .
   qed
   then have e2: "sum (measure lebesgue) \<G> \<le> e/2" if "\<G> \<subseteq> fbx ` \<D>" "finite \<G>" for \<G>
     by (metis finite_subset_image that)
   show "\<exists>W\<in>lmeasurable. f ` S \<subseteq> W \<and> measure lebesgue W < e"
   proof (intro bexI conjI)
     have "\<exists>X\<in>\<D>. f y \<in> fbx X" if "y \<in> S" for y
     proof -
       obtain X where "y \<in> X" "X \<in> \<D>"
         using \<open>S \<subseteq> \<Union>\<D>\<close> \<open>y \<in> S\<close> by auto
       then have y: "y \<in> ball(zf X) (R(zf X))"
         using uvz by fastforce
       have conj_le_eq: "z - b \<le> y \<and> y \<le> z + b \<longleftrightarrow> abs(y - z) \<le> b" for z y b::real
         by auto
       have yin: "y \<in> cbox (uf X) (vf X)" and zin: "(zf X) \<in> cbox (uf X) (vf X)"
         using uvz \<open>X \<in> \<D>\<close> \<open>y \<in> X\<close> by auto
       have "norm (y - zf X) \<le> (\<Sum>i\<in>Basis. \<bar>(y - zf X) \<bullet> i\<bar>)"
         by (rule norm_le_l1)
       also have "\<dots> \<le> real DIM('M) * prj1 (vf X - uf X)"
       proof (rule sum_bounded_above)
         fix j::'M assume j: "j \<in> Basis"
         show "\<bar>(y - zf X) \<bullet> j\<bar> \<le> prj1 (vf X - uf X)"
           using yin zin j
           by (fastforce simp add: mem_box prj1_idem [OF \<open>X \<in> \<D>\<close> j] inner_diff_left)
       qed
       finally have nole: "norm (y - zf X) \<le> DIM('M) * prj1 (vf X - uf X)"
         by simp
       have fle: "\<bar>f y \<bullet> i - f(zf X) \<bullet> i\<bar> \<le> B * DIM('M) * prj1 (vf X - uf X)" if "i \<in> Basis" for i
       proof -
         have "\<bar>f y \<bullet> i - f (zf X) \<bullet> i\<bar> = \<bar>(f y - f (zf X)) \<bullet> i\<bar>"
           by (simp add: algebra_simps)
         also have "\<dots> \<le> norm (f y - f (zf X))"
           by (simp add: Basis_le_norm that)
         also have "\<dots> \<le> B * norm(y - zf X)"
           by (metis uvz RB \<open>X \<in> \<D>\<close> dist_commute dist_norm mem_ball \<open>y \<in> S\<close> y)
         also have "\<dots> \<le> B * real DIM('M) * prj1 (vf X - uf X)"
           using \<open>0 < B\<close> by (simp add: nole)
         finally show ?thesis .
       qed
       show ?thesis
         by (rule_tac x=X in bexI)
            (auto simp: fbx_def prj1_idem mem_box conj_le_eq inner_add inner_diff fle \<open>X \<in> \<D>\<close>)
     qed
     then show "f ` S \<subseteq> (\<Union>D\<in>\<D>. fbx D)" by auto
   next
     have 1: "\<And>D. D \<in> \<D> \<Longrightarrow> fbx D \<in> lmeasurable"
       by (auto simp: fbx_def)
     have 2: "I' \<subseteq> \<D> \<Longrightarrow> finite I' \<Longrightarrow> measure lebesgue (\<Union>D\<in>I'. fbx D) \<le> e/2" for I'
       by (rule order_trans[OF measure_Union_le e2]) (auto simp: fbx_def)
     show "(\<Union>D\<in>\<D>. fbx D) \<in> lmeasurable"
       by (intro fmeasurable_UN_bound[OF \<open>countable \<D>\<close> 1 2])
     have "measure lebesgue (\<Union>D\<in>\<D>. fbx D) \<le> e/2"
       by (intro measure_UN_bound[OF \<open>countable \<D>\<close> 1 2])
     then show "measure lebesgue (\<Union>D\<in>\<D>. fbx D) < e"
       using \<open>0 < e\<close> by linarith
   qed
 qed
 
 proposition negligible_locally_Lipschitz_image:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "negligible S"
       and lips: "\<And>x. x \<in> S
                       \<Longrightarrow> \<exists>T B. open T \<and> x \<in> T \<and>
                               (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
     shows "negligible (f ` S)"
 proof -
   let ?S = "\<lambda>n. ({x \<in> S. norm x \<le> n \<and>
                           (\<exists>T. open T \<and> x \<in> T \<and>
                                (\<forall>y\<in>S \<inter> T. norm (f y - f x) \<le> (real n + 1) * norm (y - x)))})"
   have negfn: "f ` ?S n \<in> null_sets lebesgue" for n::nat
     unfolding negligible_iff_null_sets[symmetric]
     apply (rule_tac B = "real n + 1" in locally_Lipschitz_negl_bounded)
     by (auto simp: MleN bounded_iff intro: negligible_subset [OF \<open>negligible S\<close>])
   have "S = (\<Union>n. ?S n)"
   proof (intro set_eqI iffI)
     fix x assume "x \<in> S"
     with lips obtain T B where T: "open T" "x \<in> T"
                            and B: "\<And>y. y \<in> S \<inter> T \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
       by metis+
     have no: "norm (f y - f x) \<le> (nat \<lceil>max B (norm x)\<rceil> + 1) * norm (y - x)" if "y \<in> S \<inter> T" for y
     proof -
       have "B * norm(y - x) \<le> (nat \<lceil>max B (norm x)\<rceil> + 1) * norm (y - x)"
         by (meson max.cobounded1 mult_right_mono nat_ceiling_le_eq nat_le_iff_add norm_ge_zero order_trans)
       then show ?thesis
         using B order_trans that by blast
     qed
     have "norm x \<le> real (nat \<lceil>max B (norm x)\<rceil>)"
       by linarith
     then have "x \<in> ?S (nat (ceiling (max B (norm x))))"
       using T no by (force simp: \<open>x \<in> S\<close> algebra_simps)
     then show "x \<in> (\<Union>n. ?S n)" by force
   qed auto
   then show ?thesis
     by (rule ssubst) (auto simp: image_Union negligible_iff_null_sets intro: negfn)
 qed
 
 corollary negligible_differentiable_image_negligible:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "negligible S"
       and diff_f: "f differentiable_on S"
     shows "negligible (f ` S)"
 proof -
   have "\<exists>T B. open T \<and> x \<in> T \<and> (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
         if "x \<in> S" for x
   proof -
     obtain f' where "linear f'"
        and f': "\<And>e. e>0 \<Longrightarrow>
                         \<exists>d>0. \<forall>y\<in>S. norm (y - x) < d \<longrightarrow>
                                     norm (f y - f x - f' (y - x)) \<le> e * norm (y - x)"
       using diff_f \<open>x \<in> S\<close>
       by (auto simp: linear_linear differentiable_on_def differentiable_def has_derivative_within_alt)
     obtain B where "B > 0" and B: "\<forall>x. norm (f' x) \<le> B * norm x"
       using linear_bounded_pos \<open>linear f'\<close> by blast
     obtain d where "d>0"
               and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - x) < d\<rbrakk> \<Longrightarrow>
                           norm (f y - f x - f' (y - x)) \<le> norm (y - x)"
       using f' [of 1] by (force simp:)
     show ?thesis
     proof (intro exI conjI ballI)
       show "norm (f y - f x) \<le> (B + 1) * norm (y - x)"
         if "y \<in> S \<inter> ball x d" for y
       proof -
         have "norm (f y - f x) - B * norm (y - x) \<le> norm (f y - f x) - norm (f' (y - x))"
           by (simp add: B)
         also have "\<dots> \<le> norm (f y - f x - f' (y - x))"
           by (rule norm_triangle_ineq2)
         also have "... \<le> norm (y - x)"
           by (metis IntE d dist_norm mem_ball norm_minus_commute that)
         finally show ?thesis
           by (simp add: algebra_simps)
       qed
     qed (use \<open>d>0\<close> in auto)
   qed
   with negligible_locally_Lipschitz_image assms show ?thesis by metis
 qed
 
 corollary negligible_differentiable_image_lowdim:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MlessN: "DIM('M) < DIM('N)" and diff_f: "f differentiable_on S"
     shows "negligible (f ` S)"
 proof -
   have "x \<le> DIM('M) \<Longrightarrow> x \<le> DIM('N)" for x
     using MlessN by linarith
   obtain lift :: "'M * real \<Rightarrow> 'N" and drop :: "'N \<Rightarrow> 'M * real" and j :: 'N
     where "linear lift" "linear drop" and dropl [simp]: "\<And>z. drop (lift z) = z"
       and "j \<in> Basis" and j: "\<And>x. lift(x,0) \<bullet> j = 0"
     using lowerdim_embeddings [OF MlessN] by metis
   have "negligible ((\<lambda>x. lift (x, 0)) ` S)"
   proof -
     have "negligible {x. x\<bullet>j = 0}"
       by (metis \<open>j \<in> Basis\<close> negligible_standard_hyperplane)
     moreover have "(\<lambda>m. lift (m, 0)) ` S \<subseteq> {n. n \<bullet> j = 0}"
       using j by force
     ultimately show ?thesis
       using negligible_subset by auto
   qed
   moreover
   have "f \<circ> fst \<circ> drop differentiable_on (\<lambda>x. lift (x, 0)) ` S"
     using diff_f
     apply (clarsimp simp add: differentiable_on_def)
     apply (intro differentiable_chain_within linear_imp_differentiable [OF \<open>linear drop\<close>]
              linear_imp_differentiable [OF linear_fst])
     apply (force simp: image_comp o_def)
     done
   moreover
   have "f = f \<circ> fst \<circ> drop \<circ> (\<lambda>x. lift (x, 0))"
     by (simp add: o_def)
   ultimately show ?thesis
     by (metis (no_types) image_comp negligible_differentiable_image_negligible order_refl)
 qed
 
 subsection\<open>Measurability of countable unions and intersections of various kinds.\<close>
 
 lemma
   assumes S: "\<And>n. S n \<in> lmeasurable"
     and leB: "\<And>n. measure lebesgue (S n) \<le> B"
     and nest: "\<And>n. S n \<subseteq> S(Suc n)"
   shows measurable_nested_Union: "(\<Union>n. S n) \<in> lmeasurable"
   and measure_nested_Union:  "(\<lambda>n. measure lebesgue (S n)) \<longlonglongrightarrow> measure lebesgue (\<Union>n. S n)" (is ?Lim)
 proof -
   have "indicat_real (\<Union> (range S)) integrable_on UNIV \<and>
     (\<lambda>n. integral UNIV (indicat_real (S n)))
     \<longlonglongrightarrow> integral UNIV (indicat_real (\<Union> (range S)))"
   proof (rule monotone_convergence_increasing)
     show "\<And>n. (indicat_real (S n)) integrable_on UNIV"
       using S measurable_integrable by blast
     show "\<And>n x::'a. indicat_real (S n) x \<le> (indicat_real (S (Suc n)) x)"
       by (simp add: indicator_leI nest rev_subsetD)
     have "\<And>x. (\<exists>n. x \<in> S n) \<longrightarrow> (\<forall>\<^sub>F n in sequentially. x \<in> S n)"
       by (metis eventually_sequentiallyI lift_Suc_mono_le nest subsetCE)
     then
     show "\<And>x. (\<lambda>n. indicat_real (S n) x) \<longlonglongrightarrow> (indicat_real (\<Union>(S ` UNIV)) x)"
       by (simp add: indicator_def tendsto_eventually)
     show "bounded (range (\<lambda>n. integral UNIV (indicat_real (S n))))"
       using leB by (auto simp: lmeasure_integral_UNIV [symmetric] S bounded_iff)
   qed
   then have "(\<Union>n. S n) \<in> lmeasurable \<and> ?Lim"
     by (simp add: lmeasure_integral_UNIV S cong: conj_cong) (simp add: measurable_integrable)
   then show "(\<Union>n. S n) \<in> lmeasurable" "?Lim"
     by auto
 qed
 
 lemma
   assumes S: "\<And>n. S n \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>m n. negligible (S m \<inter> S n)) UNIV"
     and leB: "\<And>n. (\<Sum>k\<le>n. measure lebesgue (S k)) \<le> B"
   shows measurable_countable_negligible_Union: "(\<Union>n. S n) \<in> lmeasurable"
   and   measure_countable_negligible_Union:    "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. S n)" (is ?Sums)
 proof -
   have 1: "\<Union> (S ` {..n}) \<in> lmeasurable" for n
     using S by blast
   have 2: "measure lebesgue (\<Union> (S ` {..n})) \<le> B" for n
   proof -
     have "measure lebesgue (\<Union> (S ` {..n})) \<le> (\<Sum>k\<le>n. measure lebesgue (S k))"
       by (simp add: S fmeasurableD measure_UNION_le)
     with leB show ?thesis
       using order_trans by blast
   qed
   have 3: "\<And>n. \<Union> (S ` {..n}) \<subseteq> \<Union> (S ` {..Suc n})"
     by (simp add: SUP_subset_mono)
   have eqS: "(\<Union>n. S n) = (\<Union>n. \<Union> (S ` {..n}))"
     using atLeastAtMost_iff by blast
   also have "(\<Union>n. \<Union> (S ` {..n})) \<in> lmeasurable"
     by (intro measurable_nested_Union [OF 1 2] 3)
   finally show "(\<Union>n. S n) \<in> lmeasurable" .
   have eqm: "(\<Sum>i\<le>n. measure lebesgue (S i)) = measure lebesgue (\<Union> (S ` {..n}))" for n
     using assms by (simp add: measure_negligible_finite_Union_image pairwise_mono)
   have "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. \<Union> (S ` {..n}))"
     by (simp add: sums_def' eqm atLeast0AtMost) (intro measure_nested_Union [OF 1 2] 3)
   then show ?Sums
     by (simp add: eqS)
 qed
 
 lemma negligible_countable_Union [intro]:
   assumes "countable \<F>" and meas: "\<And>S. S \<in> \<F> \<Longrightarrow> negligible S"
   shows "negligible (\<Union>\<F>)"
 proof (cases "\<F> = {}")
   case False
   then show ?thesis
     by (metis from_nat_into range_from_nat_into assms negligible_Union_nat)
 qed simp
 
 lemma
   assumes S: "\<And>n. (S n) \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>m n. negligible (S m \<inter> S n)) UNIV"
     and bo: "bounded (\<Union>n. S n)"
   shows measurable_countable_negligible_Union_bounded: "(\<Union>n. S n) \<in> lmeasurable"
   and   measure_countable_negligible_Union_bounded:    "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. S n)" (is ?Sums)
 proof -
   obtain a b where ab: "(\<Union>n. S n) \<subseteq> cbox a b"
     using bo bounded_subset_cbox_symmetric by metis
   then have B: "(\<Sum>k\<le>n. measure lebesgue (S k)) \<le> measure lebesgue (cbox a b)" for n
   proof -
     have "(\<Sum>k\<le>n. measure lebesgue (S k)) = measure lebesgue (\<Union> (S ` {..n}))"
       using measure_negligible_finite_Union_image [OF _ _ pairwise_subset] djointish
       by (metis S finite_atMost subset_UNIV)
     also have "\<dots> \<le> measure lebesgue (cbox a b)"
     proof (rule measure_mono_fmeasurable)
       show "\<Union> (S ` {..n}) \<in> sets lebesgue" using S by blast
     qed (use ab in auto)
     finally show ?thesis .
   qed
   show "(\<Union>n. S n) \<in> lmeasurable"
     by (rule measurable_countable_negligible_Union [OF S djointish B])
   show ?Sums
     by (rule measure_countable_negligible_Union [OF S djointish B])
 qed
 
 lemma measure_countable_Union_approachable:
   assumes "countable \<D>" "e > 0" and measD: "\<And>d. d \<in> \<D> \<Longrightarrow> d \<in> lmeasurable"
       and B: "\<And>D'. \<lbrakk>D' \<subseteq> \<D>; finite D'\<rbrakk> \<Longrightarrow> measure lebesgue (\<Union>D') \<le> B"
     obtains D' where "D' \<subseteq> \<D>" "finite D'" "measure lebesgue (\<Union>\<D>) - e < measure lebesgue (\<Union>D')"
 proof (cases "\<D> = {}")
   case True
   then show ?thesis
     by (simp add: \<open>e > 0\<close> that)
 next
   case False
   let ?S = "\<lambda>n. \<Union>k \<le> n. from_nat_into \<D> k"
   have "(\<lambda>n. measure lebesgue (?S n)) \<longlonglongrightarrow> measure lebesgue (\<Union>n. ?S n)"
   proof (rule measure_nested_Union)
     show "?S n \<in> lmeasurable" for n
       by (simp add: False fmeasurable.finite_UN from_nat_into measD)
     show "measure lebesgue (?S n) \<le> B" for n
       by (metis (mono_tags, lifting) B False finite_atMost finite_imageI from_nat_into image_iff subsetI)
     show "?S n \<subseteq> ?S (Suc n)" for n
       by force
   qed
   then obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> dist (measure lebesgue (?S n)) (measure lebesgue (\<Union>n. ?S n)) < e"
     using metric_LIMSEQ_D \<open>e > 0\<close> by blast
   show ?thesis
   proof
     show "from_nat_into \<D> ` {..N} \<subseteq> \<D>"
       by (auto simp: False from_nat_into)
     have eq: "(\<Union>n. \<Union>k\<le>n. from_nat_into \<D> k) = (\<Union>\<D>)"
       using \<open>countable \<D>\<close> False
       by (auto intro: from_nat_into dest: from_nat_into_surj [OF \<open>countable \<D>\<close>])
     show "measure lebesgue (\<Union>\<D>) - e < measure lebesgue (\<Union> (from_nat_into \<D> ` {..N}))"
       using N [OF order_refl]
       by (auto simp: eq algebra_simps dist_norm)
   qed auto
 qed
 
 
 subsection\<open>Negligibility is a local property\<close>
 
 lemma locally_negligible_alt:
     "negligible S \<longleftrightarrow> (\<forall>x \<in> S. \<exists>U. openin (top_of_set S) U \<and> x \<in> U \<and> negligible U)"
      (is "_ = ?rhs")
 proof
   assume "negligible S"
   then show ?rhs
     using openin_subtopology_self by blast
 next
   assume ?rhs
   then obtain U where ope: "\<And>x. x \<in> S \<Longrightarrow> openin (top_of_set S) (U x)"
     and cov: "\<And>x. x \<in> S \<Longrightarrow> x \<in> U x"
     and neg: "\<And>x. x \<in> S \<Longrightarrow> negligible (U x)"
     by metis
   obtain \<F> where "\<F> \<subseteq> U ` S" "countable \<F>" and eq: "\<Union>\<F> = \<Union>(U ` S)"
     using ope by (force intro: Lindelof_openin [of "U ` S" S])
   then have "negligible (\<Union>\<F>)"
     by (metis imageE neg negligible_countable_Union subset_eq)
   with eq have "negligible (\<Union>(U ` S))"
     by metis
   moreover have "S \<subseteq> \<Union>(U ` S)"
     using cov by blast
   ultimately show "negligible S"
     using negligible_subset by blast
 qed
 
 lemma locally_negligible: "locally negligible S \<longleftrightarrow> negligible S"
   unfolding locally_def
   by (metis locally_negligible_alt negligible_subset openin_imp_subset openin_subtopology_self)
 
 
 subsection\<open>Integral bounds\<close>
 
 lemma set_integral_norm_bound:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "set_integrable M k f \<Longrightarrow> norm (LINT x:k|M. f x) \<le> LINT x:k|M. norm (f x)"
   using integral_norm_bound[of M "\<lambda>x. indicator k x *\<^sub>R f x"] by (simp add: set_lebesgue_integral_def)
 
 lemma set_integral_finite_UN_AE:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "finite I"
     and ae: "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> AE x in M. (x \<in> A i \<and> x \<in> A j) \<longrightarrow> i = j"
     and [measurable]: "\<And>i. i \<in> I \<Longrightarrow> A i \<in> sets M"
     and f: "\<And>i. i \<in> I \<Longrightarrow> set_integrable M (A i) f"
   shows "LINT x:(\<Union>i\<in>I. A i)|M. f x = (\<Sum>i\<in>I. LINT x:A i|M. f x)"
   using \<open>finite I\<close> order_refl[of I]
 proof (induction I rule: finite_subset_induct')
   case (insert i I')
   have "AE x in M. (\<forall>j\<in>I'. x \<in> A i \<longrightarrow> x \<notin> A j)"
   proof (intro AE_ball_countable[THEN iffD2] ballI)
     fix j assume "j \<in> I'"
     with \<open>I' \<subseteq> I\<close> \<open>i \<notin> I'\<close> have "i \<noteq> j" "j \<in> I"
       by auto
     then show "AE x in M. x \<in> A i \<longrightarrow> x \<notin> A j"
       using ae[of i j] \<open>i \<in> I\<close> by auto
   qed (use \<open>finite I'\<close> in \<open>rule countable_finite\<close>)
   then have "AE x\<in>A i in M. \<forall>xa\<in>I'. x \<notin> A xa "
     by auto
   with insert.hyps insert.IH[symmetric]
   show ?case
     by (auto intro!: set_integral_Un_AE sets.finite_UN f set_integrable_UN)
 qed (simp add: set_lebesgue_integral_def)
 
 lemma set_integrable_norm:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f: "set_integrable M k f" shows "set_integrable M k (\<lambda>x. norm (f x))"
   using integrable_norm f by (force simp add: set_integrable_def)
 
 lemma absolutely_integrable_bounded_variation:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f absolutely_integrable_on UNIV"
   obtains B where "\<forall>d. d division_of (\<Union>d) \<longrightarrow> sum (\<lambda>k. norm (integral k f)) d \<le> B"
 proof (rule that[of "integral UNIV (\<lambda>x. norm (f x))"]; safe)
   fix d :: "'a set set" assume d: "d division_of \<Union>d"
   have *: "k \<in> d \<Longrightarrow> f absolutely_integrable_on k" for k
     using f[THEN set_integrable_subset, of k] division_ofD(2,4)[OF d, of k] by auto
   note d' = division_ofD[OF d]
   have "(\<Sum>k\<in>d. norm (integral k f)) = (\<Sum>k\<in>d. norm (LINT x:k|lebesgue. f x))"
     by (intro sum.cong refl arg_cong[where f=norm] set_lebesgue_integral_eq_integral(2)[symmetric] *)
   also have "\<dots> \<le> (\<Sum>k\<in>d. LINT x:k|lebesgue. norm (f x))"
     by (intro sum_mono set_integral_norm_bound *)
   also have "\<dots> = (\<Sum>k\<in>d. integral k (\<lambda>x. norm (f x)))"
     by (intro sum.cong refl set_lebesgue_integral_eq_integral(2) set_integrable_norm *)
   also have "\<dots> \<le> integral (\<Union>d) (\<lambda>x. norm (f x))"
     using integrable_on_subdivision[OF d] assms f unfolding absolutely_integrable_on_def
     by (subst integral_combine_division_topdown[OF _ d]) auto
   also have "\<dots> \<le> integral UNIV (\<lambda>x. norm (f x))"
     using integrable_on_subdivision[OF d] assms unfolding absolutely_integrable_on_def
     by (intro integral_subset_le) auto
   finally show "(\<Sum>k\<in>d. norm (integral k f)) \<le> integral UNIV (\<lambda>x. norm (f x))" .
 qed
 
 lemma absdiff_norm_less:
   assumes "sum (\<lambda>x. norm (f x - g x)) S < e"
   shows "\<bar>sum (\<lambda>x. norm(f x)) S - sum (\<lambda>x. norm(g x)) S\<bar> < e" (is "?lhs < e")
 proof -
   have "?lhs \<le> (\<Sum>i\<in>S. \<bar>norm (f i) - norm (g i)\<bar>)"
     by (metis (no_types) sum_abs sum_subtractf)
   also have "... \<le> (\<Sum>x\<in>S. norm (f x - g x))"
     by (simp add: norm_triangle_ineq3 sum_mono)
   also have "... < e"
     using assms(1) by blast
   finally show ?thesis .
 qed
 
 proposition bounded_variation_absolutely_integrable_interval:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "f integrable_on cbox a b"
     and *: "\<And>d. d division_of (cbox a b) \<Longrightarrow> sum (\<lambda>K. norm(integral K f)) d \<le> B"
   shows "f absolutely_integrable_on cbox a b"
 proof -
   let ?f = "\<lambda>d. \<Sum>K\<in>d. norm (integral K f)" and ?D = "{d. d division_of (cbox a b)}"
   have D_1: "?D \<noteq> {}"
     by (rule elementary_interval[of a b]) auto
   have D_2: "bdd_above (?f`?D)"
     by (metis * mem_Collect_eq bdd_aboveI2)
   note D = D_1 D_2
   let ?S = "SUP x\<in>?D. ?f x"
   have *: "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>p. p tagged_division_of cbox a b \<and>
                   \<gamma> fine p \<longrightarrow>
                   norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - ?S) < e)"
     if e: "e > 0" for e
   proof -
     have "?S - e/2 < ?S" using \<open>e > 0\<close> by simp
     then obtain d where d: "d division_of (cbox a b)" "?S - e/2 < (\<Sum>k\<in>d. norm (integral k f))"
       unfolding less_cSUP_iff[OF D] by auto
     note d' = division_ofD[OF this(1)]
 
     have "\<exists>e>0. \<forall>i\<in>d. x \<notin> i \<longrightarrow> ball x e \<inter> i = {}" for x
     proof -
       have "\<exists>d'>0. \<forall>x'\<in>\<Union>{i \<in> d. x \<notin> i}. d' \<le> dist x x'"
       proof (rule separate_point_closed)
         show "closed (\<Union>{i \<in> d. x \<notin> i})"
           using d' by force
         show "x \<notin> \<Union>{i \<in> d. x \<notin> i}"
           by auto
       qed
       then show ?thesis
         by force
     qed
     then obtain k where k: "\<And>x. 0 < k x" "\<And>i x. \<lbrakk>i \<in> d; x \<notin> i\<rbrakk> \<Longrightarrow> ball x (k x) \<inter> i = {}"
       by metis
     have "e/2 > 0"
       using e by auto
     with Henstock_lemma[OF f]
     obtain \<gamma> where g: "gauge \<gamma>"
       "\<And>p. \<lbrakk>p tagged_partial_division_of cbox a b; \<gamma> fine p\<rbrakk>
                 \<Longrightarrow> (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x - integral k f)) < e/2"
       by (metis (no_types, lifting))
     let ?g = "\<lambda>x. \<gamma> x \<inter> ball x (k x)"
     show ?thesis
     proof (intro exI conjI allI impI)
       show "gauge ?g"
         using g(1) k(1) by (auto simp: gauge_def)
     next
       fix p
       assume "p tagged_division_of (cbox a b) \<and> ?g fine p"
       then have p: "p tagged_division_of cbox a b" "\<gamma> fine p" "(\<lambda>x. ball x (k x)) fine p"
         by (auto simp: fine_Int)
       note p' = tagged_division_ofD[OF p(1)]
       define p' where "p' = {(x,k) | x k. \<exists>i l. x \<in> i \<and> i \<in> d \<and> (x,l) \<in> p \<and> k = i \<inter> l}"
       have gp': "\<gamma> fine p'"
         using p(2) by (auto simp: p'_def fine_def)
       have p'': "p' tagged_division_of (cbox a b)"
       proof (rule tagged_division_ofI)
         show "finite p'"
         proof (rule finite_subset)
           show "p' \<subseteq> (\<lambda>(k, x, l). (x, k \<inter> l)) ` (d \<times> p)"
             by (force simp: p'_def image_iff)
           show "finite ((\<lambda>(k, x, l). (x, k \<inter> l)) ` (d \<times> p))"
             by (simp add: d'(1) p'(1))
         qed
       next
         fix x K
         assume "(x, K) \<in> p'"
         then have "\<exists>i l. x \<in> i \<and> i \<in> d \<and> (x, l) \<in> p \<and> K = i \<inter> l"
           unfolding p'_def by auto
         then obtain i l where il: "x \<in> i" "i \<in> d" "(x, l) \<in> p" "K = i \<inter> l" by blast
         show "x \<in> K" and "K \<subseteq> cbox a b"
           using p'(2-3)[OF il(3)] il by auto
         show "\<exists>a b. K = cbox a b"
           unfolding il using p'(4)[OF il(3)] d'(4)[OF il(2)] by (meson Int_interval)
       next
         fix x1 K1
         assume "(x1, K1) \<in> p'"
         then have "\<exists>i l. x1 \<in> i \<and> i \<in> d \<and> (x1, l) \<in> p \<and> K1 = i \<inter> l"
           unfolding p'_def by auto
         then obtain i1 l1 where il1: "x1 \<in> i1" "i1 \<in> d" "(x1, l1) \<in> p" "K1 = i1 \<inter> l1" by blast
         fix x2 K2
         assume "(x2,K2) \<in> p'"
         then have "\<exists>i l. x2 \<in> i \<and> i \<in> d \<and> (x2, l) \<in> p \<and> K2 = i \<inter> l"
           unfolding p'_def by auto
         then obtain i2 l2 where il2: "x2 \<in> i2" "i2 \<in> d" "(x2, l2) \<in> p" "K2 = i2 \<inter> l2" by blast
         assume "(x1, K1) \<noteq> (x2, K2)"
         then have "interior i1 \<inter> interior i2 = {} \<or> interior l1 \<inter> interior l2 = {}"
           using d'(5)[OF il1(2) il2(2)] p'(5)[OF il1(3) il2(3)]  by (auto simp: il1 il2)
         then show "interior K1 \<inter> interior K2 = {}"
           unfolding il1 il2 by auto
       next
         have *: "\<forall>(x, X) \<in> p'. X \<subseteq> cbox a b"
           unfolding p'_def using d' by blast
         show "\<Union>{K. \<exists>x. (x, K) \<in> p'} = cbox a b"
         proof
           show "\<Union>{k. \<exists>x. (x, k) \<in> p'} \<subseteq> cbox a b"
             using * by auto
         next
           show "cbox a b \<subseteq> \<Union>{k. \<exists>x. (x, k) \<in> p'}"
           proof
             fix y
             assume y: "y \<in> cbox a b"
             obtain x L where xl: "(x, L) \<in> p" "y \<in> L"
               using y unfolding p'(6)[symmetric] by auto
             obtain I where i: "I \<in> d" "y \<in> I"
               using y unfolding d'(6)[symmetric] by auto
             have "x \<in> I"
               using fineD[OF p(3) xl(1)] using k(2) i xl by auto
             then show "y \<in> \<Union>{K. \<exists>x. (x, K) \<in> p'}"
             proof -
               obtain x l where xl: "(x, l) \<in> p" "y \<in> l"
                 using y unfolding p'(6)[symmetric] by auto
               obtain i where i: "i \<in> d" "y \<in> i"
                 using y unfolding d'(6)[symmetric] by auto
               have "x \<in> i"
                 using fineD[OF p(3) xl(1)] using k(2) i xl by auto
               then show ?thesis
                 unfolding p'_def by (rule_tac X="i \<inter> l" in UnionI) (use i xl in auto)
             qed
           qed
         qed
       qed
       then have sum_less_e2: "(\<Sum>(x,K) \<in> p'. norm (content K *\<^sub>R f x - integral K f)) < e/2"
         using g(2) gp' tagged_division_of_def by blast
 
       have in_p': "(x, I \<inter> L) \<in> p'" if x: "(x, L) \<in> p" "I \<in> d" and y: "y \<in> I" "y \<in> L"
         for x I L y
       proof -
         have "x \<in> I"
           using fineD[OF p(3) that(1)] k(2)[OF \<open>I \<in> d\<close>] y by auto
         with x have "(\<exists>i l. x \<in> i \<and> i \<in> d \<and> (x, l) \<in> p \<and> I \<inter> L = i \<inter> l)"
           by blast
         then have "(x, I \<inter> L) \<in> p'"
           by (simp add: p'_def)
         with y show ?thesis by auto
       qed
       moreover 
       have Ex_p_p': "\<exists>y i l. (x, K) = (y, i \<inter> l) \<and> (y, l) \<in> p \<and> i \<in> d \<and> i \<inter> l \<noteq> {}"
         if xK: "(x,K) \<in> p'" for x K
       proof -
         obtain i l where il: "x \<in> i" "i \<in> d" "(x, l) \<in> p" "K = i \<inter> l"
           using xK unfolding p'_def by auto
         then show ?thesis
           using p'(2) by fastforce
       qed
       ultimately have p'alt: "p' = {(x, I \<inter> L) | x I L. (x,L) \<in> p \<and> I \<in> d \<and> I \<inter> L \<noteq> {}}"
         by auto
       have sum_p': "(\<Sum>(x,K) \<in> p'. norm (integral K f)) = (\<Sum>k\<in>snd ` p'. norm (integral k f))"
       proof (rule sum.over_tagged_division_lemma[OF p''])
         show "\<And>u v. box u v = {} \<Longrightarrow> norm (integral (cbox u v) f) = 0"
           by (auto intro: integral_null simp: content_eq_0_interior)
       qed
       have snd_p_div: "snd ` p division_of cbox a b"
         by (rule division_of_tagged_division[OF p(1)])
       note snd_p = division_ofD[OF snd_p_div]
       have fin_d_sndp: "finite (d \<times> snd ` p)"
         by (simp add: d'(1) snd_p(1))
 
       have *: "\<And>sni sni' sf sf'. \<lbrakk>\<bar>sf' - sni'\<bar> < e/2; ?S - e/2 < sni; sni' \<le> ?S;
                        sni \<le> sni'; sf' = sf\<rbrakk> \<Longrightarrow> \<bar>sf - ?S\<bar> < e"
         by arith
       show "norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - ?S) < e"
         unfolding real_norm_def
       proof (rule *)
         show "\<bar>(\<Sum>(x,K)\<in>p'. norm (content K *\<^sub>R f x)) - (\<Sum>(x,k)\<in>p'. norm (integral k f))\<bar> < e/2"
           using p'' sum_less_e2 unfolding split_def by (force intro!: absdiff_norm_less)
         show "(\<Sum>(x,k) \<in> p'. norm (integral k f)) \<le>?S"
           by (auto simp: sum_p' division_of_tagged_division[OF p''] D intro!: cSUP_upper)
         show "(\<Sum>k\<in>d. norm (integral k f)) \<le> (\<Sum>(x,k) \<in> p'. norm (integral k f))"
         proof -
           have *: "{k \<inter> l | k l. k \<in> d \<and> l \<in> snd ` p} = (\<lambda>(k,l). k \<inter> l) ` (d \<times> snd ` p)"
             by auto
           have "(\<Sum>K\<in>d. norm (integral K f)) \<le> (\<Sum>i\<in>d. \<Sum>l\<in>snd ` p. norm (integral (i \<inter> l) f))"
           proof (rule sum_mono)
             fix K assume k: "K \<in> d"
             from d'(4)[OF this] obtain u v where uv: "K = cbox u v" by metis
             define d' where "d' = {cbox u v \<inter> l |l. l \<in> snd ` p \<and>  cbox u v \<inter> l \<noteq> {}}"
             have uvab: "cbox u v \<subseteq> cbox a b"
               using d(1) k uv by blast
             have d'_div: "d' division_of cbox u v"
               unfolding d'_def by (rule division_inter_1 [OF snd_p_div uvab])
             moreover have "norm (\<Sum>i\<in>d'. integral i f) \<le> (\<Sum>k\<in>d'. norm (integral k f))"
               by (simp add: sum_norm_le)
             moreover have "f integrable_on K"
               using f integrable_on_subcbox uv uvab by blast
             moreover have "d' division_of K"
               using d'_div uv by blast
             ultimately have "norm (integral K f) \<le> sum (\<lambda>k. norm (integral k f)) d'"
               by (simp add: integral_combine_division_topdown)
             also have "\<dots> = (\<Sum>I\<in>{K \<inter> L |L. L \<in> snd ` p}. norm (integral I f))"
             proof (rule sum.mono_neutral_left)
               show "finite {K \<inter> L |L. L \<in> snd ` p}"
                 by (simp add: snd_p(1))
               show "\<forall>i\<in>{K \<inter> L |L. L \<in> snd ` p} - d'. norm (integral i f) = 0"
                 "d' \<subseteq> {K \<inter> L |L. L \<in> snd ` p}"
                 using d'_def image_eqI uv by auto
             qed
             also have "\<dots> = (\<Sum>l\<in>snd ` p. norm (integral (K \<inter> l) f))"
               unfolding Setcompr_eq_image
             proof (rule sum.reindex_nontrivial [unfolded o_def])
               show "finite (snd ` p)"
                 using snd_p(1) by blast
               show "norm (integral (K \<inter> l) f) = 0"
                 if "l \<in> snd ` p" "y \<in> snd ` p" "l \<noteq> y" "K \<inter> l = K \<inter> y" for l y
               proof -
                 have "interior (K \<inter> l) \<subseteq> interior (l \<inter> y)"
                   by (metis Int_lower2 interior_mono le_inf_iff that(4))
                 then have "interior (K \<inter> l) = {}"
                   by (simp add: snd_p(5) that)
                 moreover from d'(4)[OF k] snd_p(4)[OF that(1)]
                 obtain u1 v1 u2 v2
                   where uv: "K = cbox u1 u2" "l = cbox v1 v2" by metis
                 ultimately show ?thesis
                   using that integral_null
                   unfolding uv Int_interval content_eq_0_interior
                   by (metis (mono_tags, lifting) norm_eq_zero)
               qed
             qed
             finally show "norm (integral K f) \<le> (\<Sum>l\<in>snd ` p. norm (integral (K \<inter> l) f))" .
           qed
           also have "\<dots> = (\<Sum>(i,l) \<in> d \<times> snd ` p. norm (integral (i\<inter>l) f))"
             by (simp add: sum.cartesian_product)
           also have "\<dots> = (\<Sum>x \<in> d \<times> snd ` p. norm (integral (case_prod (\<inter>) x) f))"
             by (force simp: split_def intro!: sum.cong)
           also have "\<dots> = (\<Sum>k\<in>{i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}. norm (integral k f))"
           proof -
             have eq0: " (integral (l1 \<inter> k1) f) = 0"
               if "l1 \<inter> k1 = l2 \<inter> k2" "(l1, k1) \<noteq> (l2, k2)"
                  "l1 \<in> d" "(j1,k1) \<in> p" "l2 \<in> d" "(j2,k2) \<in> p"
               for l1 l2 k1 k2 j1 j2
             proof -
               obtain u1 v1 u2 v2 where uv: "l1 = cbox u1 u2" "k1 = cbox v1 v2"
                 using \<open>(j1, k1) \<in> p\<close> \<open>l1 \<in> d\<close> d'(4) p'(4) by blast
               have "l1 \<noteq> l2 \<or> k1 \<noteq> k2"
                 using that by auto
               then have "interior k1 \<inter> interior k2 = {} \<or> interior l1 \<inter> interior l2 = {}"
                 by (meson d'(5) old.prod.inject p'(5) that(3) that(4) that(5) that(6))
               moreover have "interior (l1 \<inter> k1) = interior (l2 \<inter> k2)"
                 by (simp add: that(1))
               ultimately have "interior(l1 \<inter> k1) = {}"
                 by auto
               then show ?thesis
                 unfolding uv Int_interval content_eq_0_interior[symmetric] by auto
             qed
             show ?thesis
               unfolding *
               apply (rule sum.reindex_nontrivial [OF fin_d_sndp, symmetric, unfolded o_def])
               apply clarsimp
               by (metis eq0 fst_conv snd_conv)
           qed
           also have "\<dots> = (\<Sum>(x,k) \<in> p'. norm (integral k f))"
             unfolding sum_p'
           proof (rule sum.mono_neutral_right)
             show "finite {i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}"
               by (metis * finite_imageI[OF fin_d_sndp])
             show "snd ` p' \<subseteq> {i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}"
               by (clarsimp simp: p'_def) (metis image_eqI snd_conv)
             show "\<forall>i\<in>{i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p} - snd ` p'. norm (integral i f) = 0"
               by clarsimp (metis Henstock_Kurzweil_Integration.integral_empty disjoint_iff image_eqI in_p' snd_conv)
           qed
           finally show ?thesis .
         qed
         show "(\<Sum>(x,k) \<in> p'. norm (content k *\<^sub>R f x)) = (\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x))"
         proof -
           let ?S = "{(x, i \<inter> l) |x i l. (x, l) \<in> p \<and> i \<in> d}"
           have *: "?S = (\<lambda>(xl,i). (fst xl, snd xl \<inter> i)) ` (p \<times> d)"
             by force
           have fin_pd: "finite (p \<times> d)"
             using finite_cartesian_product[OF p'(1) d'(1)] by metis
           have "(\<Sum>(x,k) \<in> p'. norm (content k *\<^sub>R f x)) = (\<Sum>(x,k) \<in> ?S. \<bar>content k\<bar> * norm (f x))"
             unfolding norm_scaleR
           proof (rule sum.mono_neutral_left)
             show "finite {(x, i \<inter> l) |x i l. (x, l) \<in> p \<and> i \<in> d}"
               by (simp add: "*" fin_pd)
           qed (use p'alt in \<open>force+\<close>)
           also have "\<dots> = (\<Sum>((x,l),i)\<in>p \<times> d. \<bar>content (l \<inter> i)\<bar> * norm (f x))"
           proof -
             have "\<bar>content (l1 \<inter> k1)\<bar> * norm (f x1) = 0"
               if "(x1, l1) \<in> p" "(x2, l2) \<in> p" "k1 \<in> d" "k2 \<in> d"
                 "x1 = x2" "l1 \<inter> k1 = l2 \<inter> k2" "x1 \<noteq> x2 \<or> l1 \<noteq> l2 \<or> k1 \<noteq> k2"
               for x1 l1 k1 x2 l2 k2
             proof -
               obtain u1 v1 u2 v2 where uv: "k1 = cbox u1 u2" "l1 = cbox v1 v2"
                 by (meson \<open>(x1, l1) \<in> p\<close> \<open>k1 \<in> d\<close> d(1) division_ofD(4) p'(4))
               have "l1 \<noteq> l2 \<or> k1 \<noteq> k2"
                 using that by auto
               then have "interior k1 \<inter> interior k2 = {} \<or> interior l1 \<inter> interior l2 = {}"
                 using that p'(5) d'(5) by (metis snd_conv)
               moreover have "interior (l1 \<inter> k1) = interior (l2 \<inter> k2)"
                 unfolding that ..
               ultimately have "interior (l1 \<inter> k1) = {}"
                 by auto
               then show "\<bar>content (l1 \<inter> k1)\<bar> * norm (f x1) = 0"
                 unfolding uv Int_interval content_eq_0_interior[symmetric] by auto
             qed
             then show ?thesis
               unfolding *
               apply (subst sum.reindex_nontrivial [OF fin_pd])
               unfolding split_paired_all o_def split_def prod.inject
               by force+
           qed
           also have "\<dots> = (\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x))"
           proof -
             have sumeq: "(\<Sum>i\<in>d. content (l \<inter> i) * norm (f x)) = content l * norm (f x)"
               if "(x, l) \<in> p" for x l
             proof -
               note xl = p'(2-4)[OF that]
               then obtain u v where uv: "l = cbox u v" by blast
               have "(\<Sum>i\<in>d. \<bar>content (l \<inter> i)\<bar>) = (\<Sum>k\<in>d. content (k \<inter> cbox u v))"
                 by (simp add: Int_commute uv)
               also have "\<dots> = sum content {k \<inter> cbox u v| k. k \<in> d}"
               proof -
                 have eq0: "content (k \<inter> cbox u v) = 0"
                   if "k \<in> d" "y \<in> d" "k \<noteq> y" and eq: "k \<inter> cbox u v = y \<inter> cbox u v" for k y
                 proof -
                   from d'(4)[OF that(1)] d'(4)[OF that(2)]
                   obtain \<alpha> \<beta> where \<alpha>: "k \<inter> cbox u v = cbox \<alpha> \<beta>"
                     by (meson Int_interval)
                   have "{} = interior ((k \<inter> y) \<inter> cbox u v)"
                     by (simp add: d'(5) that)
                   also have "\<dots> = interior (y \<inter> (k \<inter> cbox u v))"
                     by auto
                   also have "\<dots> = interior (k \<inter> cbox u v)"
                     unfolding eq by auto
                   finally show ?thesis
                     unfolding \<alpha> content_eq_0_interior ..
                 qed
                 then show ?thesis
                   unfolding Setcompr_eq_image
                   by (fastforce intro: sum.reindex_nontrivial [OF \<open>finite d\<close>, unfolded o_def, symmetric])
               qed
               also have "\<dots> = sum content {cbox u v \<inter> k |k. k \<in> d \<and> cbox u v \<inter> k \<noteq> {}}"
               proof (rule sum.mono_neutral_right)
                 show "finite {k \<inter> cbox u v |k. k \<in> d}"
                   by (simp add: d'(1))
               qed (fastforce simp: inf.commute)+
               finally have "(\<Sum>i\<in>d. \<bar>content (l \<inter> i)\<bar>) = content (cbox u v)"
                 using additive_content_division[OF division_inter_1[OF d(1)]] uv xl(2) by auto
               then show "(\<Sum>i\<in>d. content (l \<inter> i) * norm (f x)) = content l * norm (f x)"              
                 unfolding sum_distrib_right[symmetric] using uv by auto
             qed
             show ?thesis
               by (subst sum_Sigma_product[symmetric]) (auto intro!: sumeq sum.cong p' d')
           qed
           finally show ?thesis .
         qed
       qed (rule d)
     qed
   qed
   then show ?thesis
     using absolutely_integrable_onI [OF f has_integral_integrable] has_integral[of _ ?S]
     by blast
 qed
 
 
 lemma bounded_variation_absolutely_integrable:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f integrable_on UNIV"
     and "\<forall>d. d division_of (\<Union>d) \<longrightarrow> sum (\<lambda>k. norm (integral k f)) d \<le> B"
   shows "f absolutely_integrable_on UNIV"
 proof (rule absolutely_integrable_onI, fact)
   let ?f = "\<lambda>D. \<Sum>k\<in>D. norm (integral k f)" and ?D = "{d. d division_of (\<Union>d)}"
   define SDF where "SDF \<equiv> SUP d\<in>?D. ?f d"
   have D_1: "?D \<noteq> {}"
     by (rule elementary_interval) auto
   have D_2: "bdd_above (?f`?D)"
     using assms(2) by auto
   have f_int: "\<And>a b. f absolutely_integrable_on cbox a b"
     using assms integrable_on_subcbox 
     by (blast intro!: bounded_variation_absolutely_integrable_interval)
   have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                     \<bar>integral (cbox a b) (\<lambda>x. norm (f x)) - SDF\<bar> < e"
     if "0 < e" for e
   proof -
     have "\<exists>y \<in> ?f ` ?D. \<not> y \<le> SDF - e"
     proof (rule ccontr)
       assume "\<not> ?thesis"
       then have "SDF \<le> SDF - e"
         unfolding SDF_def
         by (metis (mono_tags) D_1 cSUP_least image_eqI)
       then show False
         using that by auto
     qed
     then obtain d K where ddiv: "d division_of \<Union>d" and "K = ?f d" "SDF - e < K"
       by (auto simp add: image_iff not_le)
     then have d: "SDF - e < ?f d"
       by auto
     note d'=division_ofD[OF ddiv]
     have "bounded (\<Union>d)"
       using ddiv by blast
     then obtain K where K: "0 < K" "\<forall>x\<in>\<Union>d. norm x \<le> K"
       using bounded_pos by blast
     show ?thesis
     proof (intro conjI impI allI exI)
       fix a b :: 'n
       assume ab: "ball 0 (K + 1) \<subseteq> cbox a b"
       have *: "\<And>s s1. \<lbrakk>SDF - e < s1; s1 \<le> s; s < SDF + e\<rbrakk> \<Longrightarrow> \<bar>s - SDF\<bar> < e"
         by arith
       show "\<bar>integral (cbox a b) (\<lambda>x. norm (f x)) - SDF\<bar> < e"
         unfolding real_norm_def
       proof (rule * [OF d])
         have "?f d \<le> sum (\<lambda>k. integral k (\<lambda>x. norm (f x))) d"
         proof (intro sum_mono)
           fix k assume "k \<in> d"
           with d'(4) f_int show "norm (integral k f) \<le> integral k (\<lambda>x. norm (f x))"
             by (force simp: absolutely_integrable_on_def integral_norm_bound_integral)
         qed
         also have "\<dots> = integral (\<Union>d) (\<lambda>x. norm (f x))"
           by (metis (full_types) absolutely_integrable_on_def d'(4) ddiv f_int integral_combine_division_bottomup)
         also have "\<dots> \<le> integral (cbox a b) (\<lambda>x. norm (f x))"
         proof -
           have "\<Union>d \<subseteq> cbox a b"
             using K(2) ab by fastforce
           then show ?thesis
             using integrable_on_subdivision[OF ddiv] f_int[of a b] unfolding absolutely_integrable_on_def
             by (auto intro!: integral_subset_le)
         qed
         finally show "?f d \<le> integral (cbox a b) (\<lambda>x. norm (f x))" .
       next
         have "e/2>0"
           using \<open>e > 0\<close> by auto
         moreover
         have f: "f integrable_on cbox a b" "(\<lambda>x. norm (f x)) integrable_on cbox a b"
           using f_int by (auto simp: absolutely_integrable_on_def)
         ultimately obtain d1 where "gauge d1"
            and d1: "\<And>p. \<lbrakk>p tagged_division_of (cbox a b); d1 fine p\<rbrakk> \<Longrightarrow>
             norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - integral (cbox a b) (\<lambda>x. norm (f x))) < e/2"
           unfolding has_integral_integral has_integral by meson
         obtain d2 where "gauge d2"
           and d2: "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox a b); d2 fine p\<rbrakk> \<Longrightarrow>
             (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x - integral k f)) < e/2"
           by (blast intro: Henstock_lemma [OF f(1) \<open>e/2>0\<close>])
         obtain p where
           p: "p tagged_division_of (cbox a b)" "d1 fine p" "d2 fine p"
           by (rule fine_division_exists [OF gauge_Int [OF \<open>gauge d1\<close> \<open>gauge d2\<close>], of a b])
             (auto simp add: fine_Int)
         have *: "\<And>sf sf' si di. \<lbrakk>sf' = sf; si \<le> SDF; \<bar>sf - si\<bar> < e/2;
                       \<bar>sf' - di\<bar> < e/2\<rbrakk> \<Longrightarrow> di < SDF + e"
           by arith
         have "integral (cbox a b) (\<lambda>x. norm (f x)) < SDF + e"
         proof (rule *)
           show "\<bar>(\<Sum>(x,k)\<in>p. norm (content k *\<^sub>R f x)) - (\<Sum>(x,k)\<in>p. norm (integral k f))\<bar> < e/2"
             unfolding split_def
           proof (rule absdiff_norm_less)
             show "(\<Sum>p\<in>p. norm (content (snd p) *\<^sub>R f (fst p) - integral (snd p) f)) < e/2"
               using d2[of p] p(1,3) by (auto simp: tagged_division_of_def split_def)
           qed
           show "\<bar>(\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - integral (cbox a b) (\<lambda>x. norm(f x))\<bar> < e/2"
             using d1[OF p(1,2)] by (simp only: real_norm_def)
           show "(\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) = (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x))"
             by (auto simp: split_paired_all sum.cong [OF refl])
           have "(\<Sum>(x,k) \<in> p. norm (integral k f)) = (\<Sum>k\<in>snd ` p. norm (integral k f))"
             apply (rule sum.over_tagged_division_lemma[OF p(1)])
             by (metis Henstock_Kurzweil_Integration.integral_empty integral_open_interval norm_zero)
           also have "... \<le> SDF"
             using partial_division_of_tagged_division[of p "cbox a b"] p(1)
             by (auto simp: SDF_def tagged_partial_division_of_def intro!: cSUP_upper2 D_1 D_2)
           finally show "(\<Sum>(x,k) \<in> p. norm (integral k f)) \<le> SDF" .
         qed
         then show "integral (cbox a b) (\<lambda>x. norm (f x)) < SDF + e"
           by simp
       qed
     qed (use K in auto)
   qed
   moreover have "\<And>a b. (\<lambda>x. norm (f x)) integrable_on cbox a b"
     using absolutely_integrable_on_def f_int by auto
   ultimately
   have "((\<lambda>x. norm (f x)) has_integral SDF) UNIV"
     by (auto simp: has_integral_alt')
   then show "(\<lambda>x. norm (f x)) integrable_on UNIV"
     by blast
 qed
 
 
 subsection\<open>Outer and inner approximation of measurable sets by well-behaved sets.\<close>
 
 proposition measurable_outer_intervals_bounded:
   assumes "S \<in> lmeasurable" "S \<subseteq> cbox a b" "e > 0"
   obtains \<D>
   where "countable \<D>"
         "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
         "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
         "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v \<bullet> i - u \<bullet> i = (b \<bullet> i - a \<bullet> i)/2^n"
         "\<And>K. \<lbrakk>K \<in> \<D>; box a b \<noteq> {}\<rbrakk> \<Longrightarrow> interior K \<noteq> {}"
         "S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable" "measure lebesgue (\<Union>\<D>) \<le> measure lebesgue S + e"
 proof (cases "box a b = {}")
   case True
   show ?thesis
   proof (cases "cbox a b = {}")
     case True
     with assms have [simp]: "S = {}"
       by auto
     show ?thesis
     proof
       show "countable {}"
         by simp
     qed (use \<open>e > 0\<close> in auto)
   next
     case False
     show ?thesis
     proof
       show "countable {cbox a b}"
         by simp
       show "\<And>u v. cbox u v \<in> {cbox a b} \<Longrightarrow> \<exists>n. \<forall>i\<in>Basis. v \<bullet> i - u \<bullet> i = (b \<bullet> i - a \<bullet> i)/2 ^ n"
         using False by (force simp: eq_cbox intro: exI [where x=0])
       show "measure lebesgue (\<Union>{cbox a b}) \<le> measure lebesgue S + e"
         using assms by (simp add: sum_content.box_empty_imp [OF True])
     qed (use assms \<open>cbox a b \<noteq> {}\<close> in auto)
   qed
 next
   case False
   let ?\<mu> = "measure lebesgue"
   have "S \<inter> cbox a b \<in> lmeasurable"
     using \<open>S \<in> lmeasurable\<close> by blast
   then have indS_int: "(indicator S has_integral (?\<mu> S)) (cbox a b)"
     by (metis integral_indicator \<open>S \<subseteq> cbox a b\<close> has_integral_integrable_integral inf.orderE integrable_on_indicator)
   with \<open>e > 0\<close> obtain \<gamma> where "gauge \<gamma>" and \<gamma>:
     "\<And>\<D>. \<lbrakk>\<D> tagged_division_of (cbox a b); \<gamma> fine \<D>\<rbrakk> \<Longrightarrow> norm ((\<Sum>(x,K)\<in>\<D>. content(K) *\<^sub>R indicator S x) - ?\<mu> S) < e"
     by (force simp: has_integral)
   have inteq: "integral (cbox a b) (indicat_real S) = integral UNIV (indicator S)"
     using assms by (metis has_integral_iff indS_int lmeasure_integral_UNIV)
   obtain \<D> where \<D>: "countable \<D>"  "\<Union>\<D> \<subseteq> cbox a b"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and djointish: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and covered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> \<gamma> x"
             and close: "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v\<bullet>i - u\<bullet>i = (b\<bullet>i - a\<bullet>i)/2^n"
             and covers: "S \<subseteq> \<Union>\<D>"
     using covering_lemma [of S a b \<gamma>] \<open>gauge \<gamma>\<close> \<open>box a b \<noteq> {}\<close> assms by force
   show ?thesis
   proof
     show "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
       by (meson Sup_le_iff \<D>(2) cbox interior_empty)
     have negl_int: "negligible(K \<inter> L)" if "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L" for K L
     proof -
       have "interior K \<inter> interior L = {}"
         using djointish pairwiseD that by fastforce
       moreover obtain u v x y where "K = cbox u v" "L = cbox x y"
         using cbox \<open>K \<in> \<D>\<close> \<open>L \<in> \<D>\<close> by blast
       ultimately show ?thesis
         by (simp add: Int_interval box_Int_box negligible_interval(1))
     qed
     have fincase: "\<Union>\<F> \<in> lmeasurable \<and> ?\<mu> (\<Union>\<F>) \<le> ?\<mu> S + e" if "finite \<F>" "\<F> \<subseteq> \<D>" for \<F>
     proof -
       obtain t where t: "\<And>K. K \<in> \<F> \<Longrightarrow> t K \<in> S \<inter> K \<and> K \<subseteq> \<gamma>(t K)"
         using covered \<open>\<F> \<subseteq> \<D>\<close> subsetD by metis
       have "\<forall>K \<in> \<F>. \<forall>L \<in> \<F>. K \<noteq> L \<longrightarrow> interior K \<inter> interior L = {}"
         using that djointish by (simp add: pairwise_def) (metis subsetD)
       with cbox that \<D> have \<F>div: "\<F> division_of (\<Union>\<F>)"
         by (fastforce simp: division_of_def dest: cbox)
       then have 1: "\<Union>\<F> \<in> lmeasurable"
         by blast
       have norme: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
           \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p. content K * indicator S x) - integral (cbox a b) (indicator S)) < e"
         by (auto simp: lmeasure_integral_UNIV assms inteq dest: \<gamma>)
       have "\<forall>x K y L. (x,K) \<in> (\<lambda>K. (t K,K)) ` \<F> \<and> (y,L) \<in> (\<lambda>K. (t K,K)) ` \<F> \<and> (x,K) \<noteq> (y,L) \<longrightarrow>             interior K \<inter> interior L = {}"
         using that djointish  by (clarsimp simp: pairwise_def) (metis subsetD)
       with that \<D> have tagged: "(\<lambda>K. (t K, K)) ` \<F> tagged_partial_division_of cbox a b"
         by (auto simp: tagged_partial_division_of_def dest: t cbox)
       have fine: "\<gamma> fine (\<lambda>K. (t K, K)) ` \<F>"
         using t by (auto simp: fine_def)
       have *: "y \<le> ?\<mu> S \<Longrightarrow> \<bar>x - y\<bar> \<le> e \<Longrightarrow> x \<le> ?\<mu> S + e" for x y
         by arith
       have "?\<mu> (\<Union>\<F>) \<le> ?\<mu> S + e"
       proof (rule *)
         have "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) = ?\<mu> (\<Union>C\<in>\<F>. C \<inter> S)"
         proof (rule measure_negligible_finite_Union_image [OF \<open>finite \<F>\<close>, symmetric])
           show "\<And>K. K \<in> \<F> \<Longrightarrow> K \<inter> S \<in> lmeasurable"
             using \<F>div \<open>S \<in> lmeasurable\<close> by blast
           show "pairwise (\<lambda>K y. negligible (K \<inter> S \<inter> (y \<inter> S))) \<F>"
             unfolding pairwise_def
             by (metis inf.commute inf_sup_aci(3) negligible_Int subsetCE negl_int \<open>\<F> \<subseteq> \<D>\<close>)
         qed
         also have "\<dots> = ?\<mu> (\<Union>\<F> \<inter> S)"
           by simp
         also have "\<dots> \<le> ?\<mu> S"
           by (simp add: "1" \<open>S \<in> lmeasurable\<close> fmeasurableD measure_mono_fmeasurable sets.Int)
         finally show "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) \<le> ?\<mu> S" .
       next
         have "?\<mu> (\<Union>\<F>) = sum ?\<mu> \<F>"
           by (metis \<F>div content_division)
         also have "\<dots> = (\<Sum>K\<in>\<F>. content K)"
           using \<F>div by (force intro: sum.cong)
         also have "\<dots> = (\<Sum>x\<in>\<F>. content x * indicator S (t x))"
           using t by auto
         finally have eq1: "?\<mu> (\<Union>\<F>) = (\<Sum>x\<in>\<F>. content x * indicator S (t x))" .
         have eq2: "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) = (\<Sum>K\<in>\<F>. integral K (indicator S))"
           apply (rule sum.cong [OF refl])
           by (metis integral_indicator \<F>div \<open>S \<in> lmeasurable\<close> division_ofD(4) fmeasurable.Int inf.commute lmeasurable_cbox)
         have "\<bar>\<Sum>(x,K)\<in>(\<lambda>K. (t K, K)) ` \<F>. content K * indicator S x - integral K (indicator S)\<bar> \<le> e"
           using Henstock_lemma_part1 [of "indicator S::'a\<Rightarrow>real", OF _ \<open>e > 0\<close> \<open>gauge \<gamma>\<close> _ tagged fine]
             indS_int norme by auto
         then show "\<bar>?\<mu> (\<Union>\<F>) - (\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S))\<bar> \<le> e"
           by (simp add: eq1 eq2 comm_monoid_add_class.sum.reindex inj_on_def sum_subtractf)
       qed
       with 1 show ?thesis by blast
     qed
     have "\<Union>\<D> \<in> lmeasurable \<and> ?\<mu> (\<Union>\<D>) \<le> ?\<mu> S + e"
     proof (cases "finite \<D>")
       case True
       with fincase show ?thesis
         by blast
     next
       case False
       let ?T = "from_nat_into \<D>"
       have T: "bij_betw ?T UNIV \<D>"
         by (simp add: False \<D>(1) bij_betw_from_nat_into)
       have TM: "\<And>n. ?T n \<in> lmeasurable"
         by (metis False cbox finite.emptyI from_nat_into lmeasurable_cbox)
       have TN: "\<And>m n. m \<noteq> n \<Longrightarrow> negligible (?T m \<inter> ?T n)"
         by (simp add: False \<D>(1) from_nat_into infinite_imp_nonempty negl_int)
       have TB: "(\<Sum>k\<le>n. ?\<mu> (?T k)) \<le> ?\<mu> S + e" for n
       proof -
         have "(\<Sum>k\<le>n. ?\<mu> (?T k)) = ?\<mu> (\<Union> (?T ` {..n}))"
           by (simp add: pairwise_def TM TN measure_negligible_finite_Union_image)
         also have "?\<mu> (\<Union> (?T ` {..n})) \<le> ?\<mu> S + e"
           using fincase [of "?T ` {..n}"] T by (auto simp: bij_betw_def)
         finally show ?thesis .
       qed
       have "\<Union>\<D> \<in> lmeasurable"
         by (metis lmeasurable_compact T \<D>(2) bij_betw_def cbox compact_cbox countable_Un_Int(1) fmeasurableD fmeasurableI2 rangeI)
       moreover
       have "?\<mu> (\<Union>x. from_nat_into \<D> x) \<le> ?\<mu> S + e"
       proof (rule measure_countable_Union_le [OF TM])
         show "?\<mu> (\<Union>x\<le>n. from_nat_into \<D> x) \<le> ?\<mu> S + e" for n
           by (metis (mono_tags, lifting) False fincase finite.emptyI finite_atMost finite_imageI from_nat_into imageE subsetI)
       qed
       ultimately show ?thesis by (metis T bij_betw_def)
     qed
     then show "\<Union>\<D> \<in> lmeasurable" "measure lebesgue (\<Union>\<D>) \<le> ?\<mu> S + e" by blast+
   qed (use \<D> cbox djointish close covers in auto)
 qed
 
 
 subsection\<open>Transformation of measure by linear maps\<close>
 
 lemma emeasure_lebesgue_ball_conv_unit_ball:
   fixes c :: "'a :: euclidean_space"
   assumes "r \<ge> 0"
   shows "emeasure lebesgue (ball c r) =
            ennreal (r ^ DIM('a)) * emeasure lebesgue (ball (0 :: 'a) 1)"
 proof (cases "r = 0")
   case False
   with assms have r: "r > 0" by auto
   have "emeasure lebesgue ((\<lambda>x. c + x) ` (\<lambda>x. r *\<^sub>R x) ` ball (0 :: 'a) 1) =
           r ^ DIM('a) * emeasure lebesgue (ball (0 :: 'a) 1)"
     unfolding image_image using emeasure_lebesgue_affine[of r c "ball 0 1"] assms
     by (simp add: add_ac)
   also have "(\<lambda>x. r *\<^sub>R x) ` ball 0 1 = ball (0 :: 'a) r"
     using r by (subst ball_scale) auto
   also have "(\<lambda>x. c + x) ` \<dots> = ball c r"
     by (subst image_add_ball) (simp_all add: algebra_simps)
   finally show ?thesis by simp
 qed auto
 
 lemma content_ball_conv_unit_ball:
   fixes c :: "'a :: euclidean_space"
   assumes "r \<ge> 0"
   shows "content (ball c r) = r ^ DIM('a) * content (ball (0 :: 'a) 1)"
 proof -
   have "ennreal (content (ball c r)) = emeasure lebesgue (ball c r)"
     using emeasure_lborel_ball_finite[of c r] by (subst emeasure_eq_ennreal_measure) auto
   also have "\<dots> = ennreal (r ^ DIM('a)) * emeasure lebesgue (ball (0 :: 'a) 1)"
     using assms by (intro emeasure_lebesgue_ball_conv_unit_ball) auto
   also have "\<dots> = ennreal (r ^ DIM('a) * content (ball (0::'a) 1))"
     using emeasure_lborel_ball_finite[of "0::'a" 1] assms
     by (subst emeasure_eq_ennreal_measure) (auto simp: ennreal_mult')
   finally show ?thesis 
     using assms by (subst (asm) ennreal_inj) auto
 qed
 
 lemma measurable_linear_image_interval:
    "linear f \<Longrightarrow> f ` (cbox a b) \<in> lmeasurable"
   by (metis bounded_linear_image linear_linear bounded_cbox closure_bounded_linear_image closure_cbox compact_closure lmeasurable_compact)
 
 proposition measure_linear_sufficient:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'n"
   assumes "linear f" and S: "S \<in> lmeasurable"
     and im: "\<And>a b. measure lebesgue (f ` (cbox a b)) = m * measure lebesgue (cbox a b)"
   shows "f ` S \<in> lmeasurable \<and> m * measure lebesgue S = measure lebesgue (f ` S)"
   using le_less_linear [of 0 m]
 proof
   assume "m < 0"
   then show ?thesis
     using im [of 0 One] by auto
 next
   assume "m \<ge> 0"
   let ?\<mu> = "measure lebesgue"
   show ?thesis
   proof (cases "inj f")
     case False
     then have "?\<mu> (f ` S) = 0"
       using \<open>linear f\<close> negligible_imp_measure0 negligible_linear_singular_image by blast
     then have "m * ?\<mu> (cbox 0 (One)) = 0"
       by (metis False \<open>linear f\<close> cbox_borel content_unit im measure_completion negligible_imp_measure0 negligible_linear_singular_image sets_lborel)
     then show ?thesis
       using \<open>linear f\<close> negligible_linear_singular_image negligible_imp_measure0 False
       by (auto simp: lmeasurable_iff_has_integral negligible_UNIV)
   next
     case True
     then obtain h where "linear h" and hf: "\<And>x. h (f x) = x" and fh: "\<And>x. f (h x) = x"
       using \<open>linear f\<close> linear_injective_isomorphism by blast
     have fBS: "(f ` S) \<in> lmeasurable \<and> m * ?\<mu> S = ?\<mu> (f ` S)"
       if "bounded S" "S \<in> lmeasurable" for S
     proof -
       obtain a b where "S \<subseteq> cbox a b"
         using \<open>bounded S\<close> bounded_subset_cbox_symmetric by metis
       have fUD: "(f ` \<Union>\<D>) \<in> lmeasurable \<and> ?\<mu> (f ` \<Union>\<D>) = (m * ?\<mu> (\<Union>\<D>))"
         if "countable \<D>"
           and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
           and intint: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
         for \<D>
       proof -
         have conv: "\<And>K. K \<in> \<D> \<Longrightarrow> convex K"
           using cbox convex_box(1) by blast
         have neg: "negligible (g ` K \<inter> g ` L)" if "linear g" "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L"
           for K L and g :: "'n\<Rightarrow>'n"
         proof (cases "inj g")
           case True
           have "negligible (frontier(g ` K \<inter> g ` L) \<union> interior(g ` K \<inter> g ` L))"
           proof (rule negligible_Un)
             show "negligible (frontier (g ` K \<inter> g ` L))"
               by (simp add: negligible_convex_frontier convex_Int conv convex_linear_image that)
           next
             have "\<forall>p N. pairwise p N = (\<forall>Na. (Na::'n set) \<in> N \<longrightarrow> (\<forall>Nb. Nb \<in> N \<and> Na \<noteq> Nb \<longrightarrow> p Na Nb))"
               by (metis pairwise_def)
             then have "interior K \<inter> interior L = {}"
               using intint that(2) that(3) that(4) by presburger
             then show "negligible (interior (g ` K \<inter> g ` L))"
               by (metis True empty_imp_negligible image_Int image_empty interior_Int interior_injective_linear_image that(1))
           qed
           moreover have "g ` K \<inter> g ` L \<subseteq> frontier (g ` K \<inter> g ` L) \<union> interior (g ` K \<inter> g ` L)"
             by (metis Diff_partition Int_commute calculation closure_Un_frontier frontier_def inf.absorb_iff2 inf_bot_right inf_sup_absorb negligible_Un_eq open_interior open_not_negligible sup_commute)
           ultimately show ?thesis
             by (rule negligible_subset)
         next
           case False
           then show ?thesis
             by (simp add: negligible_Int negligible_linear_singular_image \<open>linear g\<close>)
         qed
         have negf: "negligible ((f ` K) \<inter> (f ` L))"
         and negid: "negligible (K \<inter> L)" if "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L" for K L
           using neg [OF \<open>linear f\<close>] neg [OF linear_id] that by auto
         show ?thesis
         proof (cases "finite \<D>")
           case True
           then have "?\<mu> (\<Union>x\<in>\<D>. f ` x) = (\<Sum>x\<in>\<D>. ?\<mu> (f ` x))"
             using \<open>linear f\<close> cbox measurable_linear_image_interval negf
             by (blast intro: measure_negligible_finite_Union_image [unfolded pairwise_def])
           also have "\<dots> = (\<Sum>k\<in>\<D>. m * ?\<mu> k)"
             by (metis (no_types, lifting) cbox im sum.cong)
           also have "\<dots> = m * ?\<mu> (\<Union>\<D>)"
             unfolding sum_distrib_left [symmetric]
             by (metis True cbox lmeasurable_cbox measure_negligible_finite_Union [unfolded pairwise_def] negid)
           finally show ?thesis
             by (metis True \<open>linear f\<close> cbox image_Union fmeasurable.finite_UN measurable_linear_image_interval)
         next
           case False
           with \<open>countable \<D>\<close> obtain X :: "nat \<Rightarrow> 'n set" where S: "bij_betw X UNIV \<D>"
             using bij_betw_from_nat_into by blast
           then have eq: "(\<Union>\<D>) = (\<Union>n. X n)" "(f ` \<Union>\<D>) = (\<Union>n. f ` X n)"
             by (auto simp: bij_betw_def)
           have meas: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<in> lmeasurable"
             using cbox by blast
           with S have 1: "\<And>n. X n \<in> lmeasurable"
             by (auto simp: bij_betw_def)
           have 2: "pairwise (\<lambda>m n. negligible (X m \<inter> X n)) UNIV"
             using S unfolding bij_betw_def pairwise_def by (metis injD negid range_eqI)
           have "bounded (\<Union>\<D>)"
             by (meson Sup_least bounded_cbox bounded_subset cbox)
           then have 3: "bounded (\<Union>n. X n)"
             using S unfolding bij_betw_def by blast
           have "(\<Union>n. X n) \<in> lmeasurable"
             by (rule measurable_countable_negligible_Union_bounded [OF 1 2 3])
           with S have f1: "\<And>n. f ` (X n) \<in> lmeasurable"
             unfolding bij_betw_def by (metis assms(1) cbox measurable_linear_image_interval rangeI)
           have f2: "pairwise (\<lambda>m n. negligible (f ` (X m) \<inter> f ` (X n))) UNIV"
             using S unfolding bij_betw_def pairwise_def by (metis injD negf rangeI)
           have "bounded (\<Union>\<D>)"
             by (meson Sup_least bounded_cbox bounded_subset cbox)
           then have f3: "bounded (\<Union>n. f ` X n)"
             using S unfolding bij_betw_def
             by (metis bounded_linear_image linear_linear assms(1) image_Union range_composition)
           have "(\<lambda>n. ?\<mu> (X n)) sums ?\<mu> (\<Union>n. X n)"
             by (rule measure_countable_negligible_Union_bounded [OF 1 2 3])
           have meq: "?\<mu> (\<Union>n. f ` X n) = m * ?\<mu> (\<Union>(X ` UNIV))"
           proof (rule sums_unique2 [OF measure_countable_negligible_Union_bounded [OF f1 f2 f3]])
             have m: "\<And>n. ?\<mu> (f ` X n) = (m * ?\<mu> (X n))"
               using S unfolding bij_betw_def by (metis cbox im rangeI)
             show "(\<lambda>n. ?\<mu> (f ` X n)) sums (m * ?\<mu> (\<Union>(X ` UNIV)))"
               unfolding m
               using measure_countable_negligible_Union_bounded [OF 1 2 3] sums_mult by blast
           qed
           show ?thesis
             using measurable_countable_negligible_Union_bounded [OF f1 f2 f3] meq
             by (auto simp: eq [symmetric])
         qed
       qed
       show ?thesis
         unfolding completion.fmeasurable_measure_inner_outer_le
       proof (intro conjI allI impI)
         fix e :: real
         assume "e > 0"
         have 1: "cbox a b - S \<in> lmeasurable"
           by (simp add: fmeasurable.Diff that)
         have 2: "0 < e / (1 + \<bar>m\<bar>)"
           using \<open>e > 0\<close> by (simp add: field_split_simps abs_add_one_gt_zero)
         obtain \<D>
           where "countable \<D>"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and intdisj: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and DD: "cbox a b - S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable"
             and le: "?\<mu> (\<Union>\<D>) \<le> ?\<mu> (cbox a b - S) + e/(1 + \<bar>m\<bar>)"
           by (rule measurable_outer_intervals_bounded [of "cbox a b - S" a b "e/(1 + \<bar>m\<bar>)"]; use 1 2 pairwise_def in force)
         show "\<exists>T \<in> lmeasurable. T \<subseteq> f ` S \<and> m * ?\<mu> S - e \<le> ?\<mu> T"
         proof (intro bexI conjI)
           show "f ` (cbox a b) - f ` (\<Union>\<D>) \<subseteq> f ` S"
             using \<open>cbox a b - S \<subseteq> \<Union>\<D>\<close> by force
           have "m * ?\<mu> S - e \<le> m * (?\<mu> S - e / (1 + \<bar>m\<bar>))"
             using \<open>m \<ge> 0\<close> \<open>e > 0\<close> by (simp add: field_simps)
           also have "\<dots> \<le> ?\<mu> (f ` cbox a b) - ?\<mu> (f ` (\<Union>\<D>))"
           proof -
             have "?\<mu> (cbox a b - S) = ?\<mu> (cbox a b) - ?\<mu> S"
               by (simp add: measurable_measure_Diff \<open>S \<subseteq> cbox a b\<close> fmeasurableD that(2))
             then have "(?\<mu> S - e / (1 + m)) \<le> (content (cbox a b) - ?\<mu> (\<Union> \<D>))"
               using \<open>m \<ge> 0\<close> le by auto
             then show ?thesis
               using \<open>m \<ge> 0\<close> \<open>e > 0\<close>
               by (simp add: mult_left_mono im fUD [OF \<open>countable \<D>\<close> cbox intdisj] flip: right_diff_distrib)
           qed
           also have "\<dots> = ?\<mu> (f ` cbox a b - f ` \<Union>\<D>)"
           proof (rule measurable_measure_Diff [symmetric])
             show "f ` cbox a b \<in> lmeasurable"
               by (simp add: assms(1) measurable_linear_image_interval)
             show "f ` \<Union> \<D> \<in> sets lebesgue"
               by (simp add: \<open>countable \<D>\<close> cbox fUD fmeasurableD intdisj)
             show "f ` \<Union> \<D> \<subseteq> f ` cbox a b"
               by (simp add: Sup_le_iff cbox image_mono)
           qed
           finally show "m * ?\<mu> S - e \<le> ?\<mu> (f ` cbox a b - f ` \<Union>\<D>)" .
           show "f ` cbox a b - f ` \<Union>\<D> \<in> lmeasurable"
             by (simp add: fUD \<open>countable \<D>\<close> \<open>linear f\<close> cbox fmeasurable.Diff intdisj measurable_linear_image_interval)
         qed
       next
         fix e :: real
         assume "e > 0"
         have em: "0 < e / (1 + \<bar>m\<bar>)"
           using \<open>e > 0\<close> by (simp add: field_split_simps abs_add_one_gt_zero)
         obtain \<D>
           where "countable \<D>"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and intdisj: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and DD: "S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable"
             and le: "?\<mu> (\<Union>\<D>) \<le> ?\<mu> S + e/(1 + \<bar>m\<bar>)"
           by (rule measurable_outer_intervals_bounded [of S a b "e/(1 + \<bar>m\<bar>)"]; use \<open>S \<in> lmeasurable\<close> \<open>S \<subseteq> cbox a b\<close> em in force)
         show "\<exists>U \<in> lmeasurable. f ` S \<subseteq> U \<and> ?\<mu> U \<le> m * ?\<mu> S + e"
         proof (intro bexI conjI)
           show "f ` S \<subseteq> f ` (\<Union>\<D>)"
             by (simp add: DD(1) image_mono)
           have "?\<mu> (f ` \<Union>\<D>) \<le> m * (?\<mu> S + e / (1 + \<bar>m\<bar>))"
             using \<open>m \<ge> 0\<close> le mult_left_mono
             by (auto simp: fUD \<open>countable \<D>\<close> \<open>linear f\<close> cbox fmeasurable.Diff intdisj measurable_linear_image_interval)
           also have "\<dots> \<le> m * ?\<mu> S + e"
             using \<open>m \<ge> 0\<close> \<open>e > 0\<close> by (simp add: fUD [OF \<open>countable \<D>\<close> cbox intdisj] field_simps)
           finally show "?\<mu> (f ` \<Union>\<D>) \<le> m * ?\<mu> S + e" .
           show "f ` \<Union>\<D> \<in> lmeasurable"
             by (simp add: \<open>countable \<D>\<close> cbox fUD intdisj)
         qed
       qed
     qed
     show ?thesis
       unfolding has_measure_limit_iff
     proof (intro allI impI)
       fix e :: real
       assume "e > 0"
       obtain B where "B > 0" and B:
         "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> \<bar>?\<mu> (S \<inter> cbox a b) - ?\<mu> S\<bar> < e / (1 + \<bar>m\<bar>)"
         using has_measure_limit [OF S] \<open>e > 0\<close> by (metis abs_add_one_gt_zero zero_less_divide_iff)
       obtain c d::'n where cd: "ball 0 B \<subseteq> cbox c d"
         by (metis bounded_subset_cbox_symmetric bounded_ball)
       with B have less: "\<bar>?\<mu> (S \<inter> cbox c d) - ?\<mu> S\<bar> < e / (1 + \<bar>m\<bar>)" .
       obtain D where "D > 0" and D: "cbox c d \<subseteq> ball 0 D"
         by (metis bounded_cbox bounded_subset_ballD)
       obtain C where "C > 0" and C: "\<And>x. norm (f x) \<le> C * norm x"
         using linear_bounded_pos \<open>linear f\<close> by blast
       have "f ` S \<inter> cbox a b \<in> lmeasurable \<and>
             \<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e"
         if "ball 0 (D*C) \<subseteq> cbox a b" for a b
       proof -
         have "bounded (S \<inter> h ` cbox a b)"
           by (simp add: bounded_linear_image linear_linear \<open>linear h\<close> bounded_Int)
         moreover have Shab: "S \<inter> h ` cbox a b \<in> lmeasurable"
           by (simp add: S \<open>linear h\<close> fmeasurable.Int measurable_linear_image_interval)
         moreover have fim: "f ` (S \<inter> h ` (cbox a b)) = (f ` S) \<inter> cbox a b"
           by (auto simp: hf rev_image_eqI fh)
         ultimately have 1: "(f ` S) \<inter> cbox a b \<in> lmeasurable"
               and 2: "?\<mu> ((f ` S) \<inter> cbox a b) = m * ?\<mu> (S \<inter> h ` cbox a b)"
           using fBS [of "S \<inter> (h ` (cbox a b))"] by auto
         have *: "\<lbrakk>\<bar>z - m\<bar> < e; z \<le> w; w \<le> m\<rbrakk> \<Longrightarrow> \<bar>w - m\<bar> \<le> e"
           for w z m and e::real by auto
         have meas_adiff: "\<bar>?\<mu> (S \<inter> h ` cbox a b) - ?\<mu> S\<bar> \<le> e / (1 + \<bar>m\<bar>)"
         proof (rule * [OF less])
           show "?\<mu> (S \<inter> cbox c d) \<le> ?\<mu> (S \<inter> h ` cbox a b)"
           proof (rule measure_mono_fmeasurable [OF _ _ Shab])
             have "f ` ball 0 D \<subseteq> ball 0 (C * D)"
               using C \<open>C > 0\<close>
               apply (clarsimp simp: algebra_simps)
               by (meson le_less_trans linordered_comm_semiring_strict_class.comm_mult_strict_left_mono)
             then have "f ` ball 0 D \<subseteq> cbox a b"
               by (metis mult.commute order_trans that)
             have "ball 0 D \<subseteq> h ` cbox a b"
               by (metis \<open>f ` ball 0 D \<subseteq> cbox a b\<close> hf image_subset_iff subsetI)
             then show "S \<inter> cbox c d \<subseteq> S \<inter> h ` cbox a b"
               using D by blast
           next
             show "S \<inter> cbox c d \<in> sets lebesgue"
               using S fmeasurable_cbox by blast
           qed
         next
           show "?\<mu> (S \<inter> h ` cbox a b) \<le> ?\<mu> S"
             by (simp add: S Shab fmeasurableD measure_mono_fmeasurable)
         qed
         have "\<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> \<le> \<bar>?\<mu> S - ?\<mu> (S \<inter> h ` cbox a b)\<bar> * m"
           by (metis "2" \<open>m \<ge> 0\<close> abs_minus_commute abs_mult_pos mult.commute order_refl right_diff_distrib')
         also have "\<dots> \<le> e / (1 + m) * m"
           by (metis \<open>m \<ge> 0\<close> abs_minus_commute abs_of_nonneg meas_adiff mult.commute mult_left_mono)
         also have "\<dots> < e"
           using \<open>e > 0\<close> \<open>m \<ge> 0\<close> by (simp add: field_simps)
         finally have "\<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e" .
         with 1 show ?thesis by auto
       qed
       then show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                          f ` S \<inter> cbox a b \<in> lmeasurable \<and>
                          \<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e"
         using \<open>C>0\<close> \<open>D>0\<close> by (metis mult_zero_left mult_less_iff1)
     qed
   qed
 qed
 
 subsection\<open>Lemmas about absolute integrability\<close>
 
 lemma absolutely_integrable_linear:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
     and h :: "'n::euclidean_space \<Rightarrow> 'p::euclidean_space"
   shows "f absolutely_integrable_on s \<Longrightarrow> bounded_linear h \<Longrightarrow> (h \<circ> f) absolutely_integrable_on s"
   using integrable_bounded_linear[of h lebesgue "\<lambda>x. indicator s x *\<^sub>R f x"]
   by (simp add: linear_simps[of h] set_integrable_def)
 
 lemma absolutely_integrable_sum:
   fixes f :: "'a \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "finite T" and "\<And>a. a \<in> T \<Longrightarrow> (f a) absolutely_integrable_on S"
   shows "(\<lambda>x. sum (\<lambda>a. f a x) T) absolutely_integrable_on S"
   using assms by induction auto
 
 lemma absolutely_integrable_integrable_bound:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes le: "\<And>x. x\<in>S \<Longrightarrow> norm (f x) \<le> g x" and f: "f integrable_on S" and g: "g integrable_on S"
   shows "f absolutely_integrable_on S"
     unfolding set_integrable_def
 proof (rule Bochner_Integration.integrable_bound)
   have "g absolutely_integrable_on S"
     unfolding absolutely_integrable_on_def
   proof
     show "(\<lambda>x. norm (g x)) integrable_on S"
       using le norm_ge_zero[of "f _"]
       by (intro integrable_spike_finite[OF _ _ g, of "{}"])
          (auto intro!: abs_of_nonneg intro: order_trans simp del: norm_ge_zero)
   qed fact
   then show "integrable lebesgue (\<lambda>x. indicat_real S x *\<^sub>R g x)"
     by (simp add: set_integrable_def)
   show "(\<lambda>x. indicat_real S x *\<^sub>R f x) \<in> borel_measurable lebesgue"
     using f by (auto intro: has_integral_implies_lebesgue_measurable simp: integrable_on_def)
 qed (use le in \<open>force intro!: always_eventually split: split_indicator\<close>)
 
 corollary absolutely_integrable_on_const [simp]:
   fixes c :: "'a::euclidean_space"
   assumes "S \<in> lmeasurable"
   shows "(\<lambda>x. c) absolutely_integrable_on S"
   by (metis (full_types) assms absolutely_integrable_integrable_bound integrable_on_const order_refl)
 
 lemma absolutely_integrable_continuous:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "continuous_on (cbox a b) f \<Longrightarrow> f absolutely_integrable_on cbox a b"
   using absolutely_integrable_integrable_bound
   by (simp add: absolutely_integrable_on_def continuous_on_norm integrable_continuous)
 
 lemma absolutely_integrable_continuous_real:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "continuous_on {a..b} f \<Longrightarrow> f absolutely_integrable_on {a..b}"
   by (metis absolutely_integrable_continuous box_real(2))
 
 lemma continuous_imp_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on (cbox a b) f"
   shows "integrable (lebesgue_on (cbox a b)) f"
 proof -
   have "f absolutely_integrable_on cbox a b"
     by (simp add: absolutely_integrable_continuous assms)
   then show ?thesis
     by (simp add: integrable_restrict_space set_integrable_def)
 qed
 
 lemma continuous_imp_integrable_real:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on {a..b} f"
   shows "integrable (lebesgue_on {a..b}) f"
   by (metis assms continuous_imp_integrable interval_cbox)
 
 
 
 subsection \<open>Componentwise\<close>
 
 proposition absolutely_integrable_componentwise_iff:
   shows "f absolutely_integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) absolutely_integrable_on A)"
 proof -
   have *: "(\<lambda>x. norm (f x)) integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. norm (f x \<bullet> b)) integrable_on A)" (is "?lhs = ?rhs")
     if "f integrable_on A"
   proof
     assume ?lhs
     then show ?rhs
       by (metis absolutely_integrable_on_def Topology_Euclidean_Space.norm_nth_le absolutely_integrable_integrable_bound integrable_component that)
   next
     assume R: ?rhs
     have "f absolutely_integrable_on A"
     proof (rule absolutely_integrable_integrable_bound)
       show "(\<lambda>x. \<Sum>i\<in>Basis. norm (f x \<bullet> i)) integrable_on A"
         using R by (force intro: integrable_sum)
     qed (use that norm_le_l1 in auto)
     then show ?lhs
       using absolutely_integrable_on_def by auto
   qed
   show ?thesis
     unfolding absolutely_integrable_on_def
     by (simp add:  integrable_componentwise_iff [symmetric] ball_conj_distrib * cong: conj_cong)
 qed
 
 lemma absolutely_integrable_componentwise:
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> (\<lambda>x. f x \<bullet> b) absolutely_integrable_on A) \<Longrightarrow> f absolutely_integrable_on A"
   using absolutely_integrable_componentwise_iff by blast
 
 lemma absolutely_integrable_component:
   "f absolutely_integrable_on A \<Longrightarrow> (\<lambda>x. f x \<bullet> (b :: 'b :: euclidean_space)) absolutely_integrable_on A"
   by (drule absolutely_integrable_linear[OF _ bounded_linear_inner_left[of b]]) (simp add: o_def)
 
 
 lemma absolutely_integrable_scaleR_left:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
     assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. c *\<^sub>R f x) absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. c *\<^sub>R x) o f absolutely_integrable_on S"
     by (simp add: absolutely_integrable_linear assms bounded_linear_scaleR_right)
   then show ?thesis
     using assms by blast
 qed
 
 lemma absolutely_integrable_scaleR_right:
   assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. f x *\<^sub>R c) absolutely_integrable_on S"
   using assms by blast
 
 lemma absolutely_integrable_norm:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f absolutely_integrable_on S"
   shows "(norm o f) absolutely_integrable_on S"
   using assms by (simp add: absolutely_integrable_on_def o_def)
 
 lemma absolutely_integrable_abs:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) absolutely_integrable_on S"
         (is "?g absolutely_integrable_on S")
 proof -
   have *: "(\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0) \<circ>
            (\<lambda>x. norm (\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f
            absolutely_integrable_on S"
         if "i \<in> Basis" for i
   proof -
     have "bounded_linear (\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0)"
       by (simp add: linear_linear algebra_simps linearI)
     moreover have "(\<lambda>x. norm (\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f
                    absolutely_integrable_on S"
       using assms \<open>i \<in> Basis\<close>
       unfolding o_def
       by (intro absolutely_integrable_norm [unfolded o_def])
          (auto simp: algebra_simps dest: absolutely_integrable_component)
     ultimately show ?thesis
       by (subst comp_assoc) (blast intro: absolutely_integrable_linear)
   qed
   have eq: "?g =
         (\<lambda>x. \<Sum>i\<in>Basis. ((\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0) \<circ>
                (\<lambda>x. norm(\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f) x)"
     by (simp)
   show ?thesis
     unfolding eq
     by (rule absolutely_integrable_sum) (force simp: intro!: *)+
 qed
 
 lemma abs_absolutely_integrableI_1:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on A" and "(\<lambda>x. \<bar>f x\<bar>) integrable_on A"
   shows "f absolutely_integrable_on A"
   by (rule absolutely_integrable_integrable_bound [OF _ assms]) auto
 
 
 lemma abs_absolutely_integrableI:
   assumes f: "f integrable_on S" and fcomp: "(\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) integrable_on S"
   shows "f absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on S" if "i \<in> Basis" for i
   proof -
     have "(\<lambda>x. \<bar>f x \<bullet> i\<bar>) integrable_on S"
       using assms integrable_component [OF fcomp, where y=i] that by simp
     then have "(\<lambda>x. f x \<bullet> i) absolutely_integrable_on S"
       using abs_absolutely_integrableI_1 f integrable_component by blast
     then show ?thesis
       by (rule absolutely_integrable_scaleR_right)
   qed
   then have "(\<lambda>x. \<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on S"
     by (simp add: absolutely_integrable_sum)
   then show ?thesis
     by (simp add: euclidean_representation)
 qed
 
 
 lemma absolutely_integrable_abs_iff:
    "f absolutely_integrable_on S \<longleftrightarrow>
     f integrable_on S \<and> (\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) integrable_on S"
     (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     using absolutely_integrable_abs absolutely_integrable_on_def by blast
 next
   assume ?rhs
   moreover
   have "(\<lambda>x. if x \<in> S then \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i else 0) = (\<lambda>x. \<Sum>i\<in>Basis. \<bar>(if x \<in> S then f x else 0) \<bullet> i\<bar> *\<^sub>R i)"
     by force
   ultimately show ?lhs
     by (simp only: absolutely_integrable_restrict_UNIV [of S, symmetric] integrable_restrict_UNIV [of S, symmetric] abs_absolutely_integrableI)
 qed
 
 lemma absolutely_integrable_max:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. \<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i)
             absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. \<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
         (\<lambda>x. (1/2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))"
   proof (rule ext)
     fix x
     have "(\<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) = (\<Sum>i\<in>Basis. ((f x \<bullet> i + g x \<bullet> i + \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) / 2) *\<^sub>R i)"
       by (force intro: sum.cong)
     also have "... = (1 / 2) *\<^sub>R (\<Sum>i\<in>Basis. (f x \<bullet> i + g x \<bullet> i + \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) *\<^sub>R i)"
       by (simp add: scaleR_right.sum)
     also have "... = (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))"
       by (simp add: sum.distrib algebra_simps euclidean_representation)
     finally
     show "(\<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
          (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))" .
   qed
   moreover have "(\<lambda>x. (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))
                  absolutely_integrable_on S"
     using absolutely_integrable_abs [OF set_integral_diff(1) [OF assms]]
     by (intro set_integral_add absolutely_integrable_scaleR_left assms) (simp add: algebra_simps)
   ultimately show ?thesis by metis
 qed
 
 corollary absolutely_integrable_max_1:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. max (f x) (g x)) absolutely_integrable_on S"
   using absolutely_integrable_max [OF assms] by simp
 
 lemma absolutely_integrable_min:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. \<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i)
             absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. \<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
         (\<lambda>x. (1/2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))"
   proof (rule ext)
     fix x
     have "(\<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) = (\<Sum>i\<in>Basis. ((f x \<bullet> i + g x \<bullet> i - \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) / 2) *\<^sub>R i)"
       by (force intro: sum.cong)
     also have "... = (1 / 2) *\<^sub>R (\<Sum>i\<in>Basis. (f x \<bullet> i + g x \<bullet> i - \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) *\<^sub>R i)"
       by (simp add: scaleR_right.sum)
     also have "... = (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))"
       by (simp add: sum.distrib sum_subtractf algebra_simps euclidean_representation)
     finally
     show "(\<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
          (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))" .
   qed
   moreover have "(\<lambda>x. (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))
                  absolutely_integrable_on S"
     using absolutely_integrable_abs [OF set_integral_diff(1) [OF assms]]
     by (intro set_integral_add set_integral_diff absolutely_integrable_scaleR_left assms)
        (simp add: algebra_simps)
   ultimately show ?thesis by metis
 qed
 
 corollary absolutely_integrable_min_1:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. min (f x) (g x)) absolutely_integrable_on S"
   using absolutely_integrable_min [OF assms] by simp
 
 lemma nonnegative_absolutely_integrable:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f integrable_on A" and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> 0 \<le> f x \<bullet> b"
   shows "f absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on A" if "i \<in> Basis" for i
   proof -
     have "(\<lambda>x. f x \<bullet> i) integrable_on A"
       by (simp add: assms(1) integrable_component)
     then have "(\<lambda>x. f x \<bullet> i) absolutely_integrable_on A"
       by (metis that comp nonnegative_absolutely_integrable_1)
     then show ?thesis
       by (rule absolutely_integrable_scaleR_right)
   qed
   then have "(\<lambda>x. \<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on A"
     by (simp add: absolutely_integrable_sum)
   then show ?thesis
     by (simp add: euclidean_representation)
 qed
 
 lemma absolutely_integrable_component_ubound:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f integrable_on A" and g: "g absolutely_integrable_on A"
       and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> f x \<bullet> b \<le> g x \<bullet> b"
   shows "f absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. g x - (g x - f x)) absolutely_integrable_on A"
   proof (rule set_integral_diff [OF g nonnegative_absolutely_integrable])
     show "(\<lambda>x. g x - f x) integrable_on A"
       using Henstock_Kurzweil_Integration.integrable_diff absolutely_integrable_on_def f g by blast
   qed (simp add: comp inner_diff_left)
   then show ?thesis
     by simp
 qed
 
 lemma absolutely_integrable_component_lbound:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f absolutely_integrable_on A" and g: "g integrable_on A"
       and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> f x \<bullet> b \<le> g x \<bullet> b"
   shows "g absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. f x + (g x - f x)) absolutely_integrable_on A"
   proof (rule set_integral_add [OF f nonnegative_absolutely_integrable])
     show "(\<lambda>x. g x - f x) integrable_on A"
       using Henstock_Kurzweil_Integration.integrable_diff absolutely_integrable_on_def f g by blast
   qed (simp add: comp inner_diff_left)
   then show ?thesis
     by simp
 qed
 
 lemma integrable_on_1_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "f integrable_on S \<longleftrightarrow> (\<lambda>x. f x $ 1) integrable_on S"
   by (auto simp: integrable_componentwise_iff [of f] Basis_vec_def cart_eq_inner_axis)
 
 lemma integral_on_1_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "integral S f = vec (integral S (\<lambda>x. f x $ 1))"
 by (cases "f integrable_on S") (simp_all add: integrable_on_1_iff vec_eq_iff not_integrable_integral)
 
 lemma absolutely_integrable_on_1_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "f absolutely_integrable_on S \<longleftrightarrow> (\<lambda>x. f x $ 1) absolutely_integrable_on S"
   unfolding absolutely_integrable_on_def
   by (auto simp: integrable_on_1_iff norm_real)
 
 lemma absolutely_integrable_absolutely_integrable_lbound:
   fixes f :: "'m::euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on S" and g: "g absolutely_integrable_on S"
     and *: "\<And>x. x \<in> S \<Longrightarrow> g x \<le> f x"
   shows "f absolutely_integrable_on S"
   by (rule absolutely_integrable_component_lbound [OF g f]) (simp add: *)
 
 lemma absolutely_integrable_absolutely_integrable_ubound:
   fixes f :: "'m::euclidean_space \<Rightarrow> real"
   assumes fg: "f integrable_on S" "g absolutely_integrable_on S"
     and *: "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "f absolutely_integrable_on S"
   by (rule absolutely_integrable_component_ubound [OF fg]) (simp add: *)
 
 lemma has_integral_vec1_I_cbox:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) (cbox a b)"
   shows "((f \<circ> vec) has_integral y) {a$1..b$1}"
 proof -
   have "((\<lambda>x. f(vec x)) has_integral (1 / 1) *\<^sub>R y) ((\<lambda>x. x $ 1) ` cbox a b)"
   proof (rule has_integral_twiddle)
     show "\<exists>w z::real^1. vec ` cbox u v = cbox w z"
          "content (vec ` cbox u v :: (real^1) set) = 1 * content (cbox u v)" for u v
       unfolding vec_cbox_1_eq
       by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
     show "\<exists>w z. (\<lambda>x. x $ 1) ` cbox u v = cbox w z" for u v :: "real^1"
       using vec_nth_cbox_1_eq by blast
   qed (auto simp: continuous_vec assms)
   then show ?thesis
     by (simp add: o_def)
 qed
 
 lemma has_integral_vec1_I:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) S"
   shows "(f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
 proof -
   have *: "\<exists>z. ((\<lambda>x. if x \<in> (\<lambda>x. x $ 1) ` S then (f \<circ> vec) x else 0) has_integral z) {a..b} \<and> norm (z - y) < e"
     if int: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow>
                     (\<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e)"
       and B: "ball 0 B \<subseteq> {a..b}" for e B a b
   proof -
     have [simp]: "(\<exists>y\<in>S. x = y $ 1) \<longleftrightarrow> vec x \<in> S" for x
       by force
     have B': "ball (0::real^1) B \<subseteq> cbox (vec a) (vec b)"
       using B by (simp add: Basis_vec_def cart_eq_inner_axis [symmetric] mem_box norm_real subset_iff)
     show ?thesis
       using int [OF B'] by (auto simp: image_iff o_def cong: if_cong dest!: has_integral_vec1_I_cbox)
   qed
   show ?thesis
     using assms
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp add: has_integral_vec1_I_cbox split: if_split_asm)
     subgoal by (metis vector_one_nth)
     subgoal
       apply (erule all_forward imp_forward ex_forward asm_rl)+
       by (blast intro!: *)+
     done
 qed
 
 lemma has_integral_vec1_nth_cbox:
   fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) {a..b}"
   shows "((\<lambda>x::real^1. f(x$1)) has_integral y) (cbox (vec a) (vec b))"
 proof -
   have "((\<lambda>x::real^1. f(x$1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)"
   proof (rule has_integral_twiddle)
     show "\<exists>w z::real. (\<lambda>x. x $ 1) ` cbox u v = cbox w z"
          "content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)" for u v::"real^1"
       unfolding vec_cbox_1_eq by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
     show "\<exists>w z::real^1. vec ` cbox u v = cbox w z" for u v :: "real"
       using vec_cbox_1_eq by auto
   qed (auto simp: continuous_vec assms)
   then show ?thesis
     using vec_cbox_1_eq by auto
 qed
 
 lemma has_integral_vec1_D_cbox:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "((f \<circ> vec) has_integral y) {a$1..b$1}"
   shows "(f has_integral y) (cbox a b)"
   by (metis (mono_tags, lifting) assms comp_apply has_integral_eq has_integral_vec1_nth_cbox vector_one_nth)
 
 lemma has_integral_vec1_D:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "((f \<circ> vec) has_integral y) ((\<lambda>x. x $ 1) ` S)"
   shows "(f has_integral y) S"
 proof -
   have *: "\<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e"
     if int: "\<And>a b. ball 0 B \<subseteq> {a..b} \<Longrightarrow>
                              (\<exists>z. ((\<lambda>x. if x \<in> (\<lambda>x. x $ 1) ` S then (f \<circ> vec) x else 0) has_integral z) {a..b} \<and> norm (z - y) < e)"
       and B: "ball 0 B \<subseteq> cbox a b" for e B and a b::"real^1"
   proof -
     have B': "ball 0 B \<subseteq> {a$1..b$1}"
     proof (clarsimp)
       fix t
       assume "\<bar>t\<bar> < B" then show "a $ 1 \<le> t \<and> t \<le> b $ 1"
         using subsetD [OF B]
         by (metis (mono_tags, opaque_lifting) mem_ball_0 mem_box_cart(2) norm_real vec_component)
     qed
     have eq: "(\<lambda>x. if vec x \<in> S then f (vec x) else 0) = (\<lambda>x. if x \<in> S then f x else 0) \<circ> vec"
       by force
     have [simp]: "(\<exists>y\<in>S. x = y $ 1) \<longleftrightarrow> vec x \<in> S" for x
       by force
     show ?thesis
       using int [OF B'] by (auto simp: image_iff eq cong: if_cong dest!: has_integral_vec1_D_cbox)
 qed
   show ?thesis
     using assms
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp add: has_integral_vec1_D_cbox eq_cbox split: if_split_asm, blast)
     apply (intro conjI impI)
     subgoal by (metis vector_one_nth)
     apply (erule thin_rl)
     apply (erule all_forward ex_forward conj_forward)+
       by (blast intro!: *)+
 qed
 
 
 lemma integral_vec1_eq:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   shows "integral S f = integral ((\<lambda>x. x $ 1) ` S) (f \<circ> vec)"
   using has_integral_vec1_I [of f] has_integral_vec1_D [of f]
   by (metis has_integral_iff not_integrable_integral)
 
 lemma absolutely_integrable_drop:
   fixes f :: "real^1 \<Rightarrow> 'b::euclidean_space"
   shows "f absolutely_integrable_on S \<longleftrightarrow> (f \<circ> vec) absolutely_integrable_on (\<lambda>x. x $ 1) ` S"
   unfolding absolutely_integrable_on_def integrable_on_def
 proof safe
   fix y r
   assume "(f has_integral y) S" "((\<lambda>x. norm (f x)) has_integral r) S"
   then show "\<exists>y. (f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
             "\<exists>y. ((\<lambda>x. norm ((f \<circ> vec) x)) has_integral y) ((\<lambda>x. x $ 1) ` S)"
     by (force simp: o_def dest!: has_integral_vec1_I)+
 next
   fix y :: "'b" and r :: "real"
   assume "(f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
          "((\<lambda>x. norm ((f \<circ> vec) x)) has_integral r) ((\<lambda>x. x $ 1) ` S)"
   then show "\<exists>y. (f has_integral y) S"  "\<exists>y. ((\<lambda>x. norm (f x)) has_integral y) S"
     by (force simp: o_def intro: has_integral_vec1_D)+
 qed
 
 subsection \<open>Dominated convergence\<close>
 
 lemma dominated_convergence:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. (f k) integrable_on S" and h: "h integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> norm (f k x) \<le> h x"
     and conv: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g integrable_on S" "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
 proof -
   have 3: "h absolutely_integrable_on S"
     unfolding absolutely_integrable_on_def
   proof
     show "(\<lambda>x. norm (h x)) integrable_on S"
     proof (intro integrable_spike_finite[OF _ _ h, of "{}"] ballI)
       fix x assume "x \<in> S - {}" then show "norm (h x) = h x"
         by (metis Diff_empty abs_of_nonneg bot_set_def le norm_ge_zero order_trans real_norm_def)
     qed auto
   qed fact
   have 2: "set_borel_measurable lebesgue S (f k)" for k
     unfolding set_borel_measurable_def
     using f by (auto intro: has_integral_implies_lebesgue_measurable simp: integrable_on_def)
   then have 1: "set_borel_measurable lebesgue S g"
     unfolding set_borel_measurable_def
     by (rule borel_measurable_LIMSEQ_metric) (use conv in \<open>auto split: split_indicator\<close>)
   have 4: "AE x in lebesgue. (\<lambda>i. indicator S x *\<^sub>R f i x) \<longlonglongrightarrow> indicator S x *\<^sub>R g x"
     "AE x in lebesgue. norm (indicator S x *\<^sub>R f k x) \<le> indicator S x *\<^sub>R h x" for k
     using conv le by (auto intro!: always_eventually split: split_indicator)
   have g: "g absolutely_integrable_on S"
     using 1 2 3 4 unfolding set_borel_measurable_def set_integrable_def
     by (rule integrable_dominated_convergence)
   then show "g integrable_on S"
     by (auto simp: absolutely_integrable_on_def)
   have "(\<lambda>k. (LINT x:S|lebesgue. f k x)) \<longlonglongrightarrow> (LINT x:S|lebesgue. g x)"
     unfolding set_borel_measurable_def set_lebesgue_integral_def
     using 1 2 3 4 unfolding set_borel_measurable_def set_lebesgue_integral_def set_integrable_def
     by (rule integral_dominated_convergence)
   then show "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
     using g absolutely_integrable_integrable_bound[OF le f h]
     by (subst (asm) (1 2) set_lebesgue_integral_eq_integral) auto
 qed
 
 lemma has_integral_dominated_convergence:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "\<And>k. (f k has_integral y k) S" "h integrable_on S"
     "\<And>k. \<forall>x\<in>S. norm (f k x) \<le> h x" "\<forall>x\<in>S. (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
     and x: "y \<longlonglongrightarrow> x"
   shows "(g has_integral x) S"
 proof -
   have int_f: "\<And>k. (f k) integrable_on S"
     using assms by (auto simp: integrable_on_def)
   have "(g has_integral (integral S g)) S"
     by (metis assms(2-4) dominated_convergence(1) has_integral_integral int_f)
   moreover have "integral S g = x"
   proof (rule LIMSEQ_unique)
     show "(\<lambda>i. integral S (f i)) \<longlonglongrightarrow> x"
       using integral_unique[OF assms(1)] x by simp
     show "(\<lambda>i. integral S (f i)) \<longlonglongrightarrow> integral S g"
       by (metis assms(2) assms(3) assms(4) dominated_convergence(2) int_f)
   qed
   ultimately show ?thesis
     by simp
 qed
 
 lemma dominated_convergence_integrable_1:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
  shows "g integrable_on S"
 proof -
   have habs: "h absolutely_integrable_on S"
     using h normg nonnegative_absolutely_integrable_1 norm_ge_zero order_trans by blast
   let ?f = "\<lambda>n x. (min (max (- h x) (f n x)) (h x))"
   have h0: "h x \<ge> 0" if "x \<in> S" for x
     using normg that by force
   have leh: "norm (?f k x) \<le> h x" if "x \<in> S" for k x
     using h0 that by force
   have limf: "(\<lambda>k. ?f k x) \<longlonglongrightarrow> g x" if "x \<in> S" for x
   proof -
     have "\<And>e y. \<bar>f y x - g x\<bar> < e \<Longrightarrow> \<bar>min (max (- h x) (f y x)) (h x) - g x\<bar> < e"
       using h0 [OF that] normg [OF that] by simp
     then show ?thesis
       using lim [OF that] by (auto simp add: tendsto_iff dist_norm elim!: eventually_mono)
   qed
   show ?thesis
   proof (rule dominated_convergence [of ?f S h g])
     have "(\<lambda>x. - h x) absolutely_integrable_on S"
       using habs unfolding set_integrable_def by auto
     then show "?f k integrable_on S" for k
       by (intro set_lebesgue_integral_eq_integral absolutely_integrable_min_1 absolutely_integrable_max_1 f habs)
   qed (use assms leh limf in auto)
 qed
 
 lemma dominated_convergence_integrable:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g integrable_on S"
   using f
   unfolding integrable_componentwise_iff [of g] absolutely_integrable_componentwise_iff [where f = "f k" for k]
 proof clarify
   fix b :: "'m"
   assume fb [rule_format]: "\<And>k. \<forall>b\<in>Basis. (\<lambda>x. f k x \<bullet> b) absolutely_integrable_on S" and b: "b \<in> Basis"
   show "(\<lambda>x. g x \<bullet> b) integrable_on S"
   proof (rule dominated_convergence_integrable_1 [OF fb h])
     fix x
     assume "x \<in> S"
     show "norm (g x \<bullet> b) \<le> h x"
       using norm_nth_le \<open>x \<in> S\<close> b normg order.trans by blast
     show "(\<lambda>k. f k x \<bullet> b) \<longlonglongrightarrow> g x \<bullet> b"
       using \<open>x \<in> S\<close> b lim tendsto_componentwise_iff by fastforce
   qed (use b in auto)
 qed
 
 lemma dominated_convergence_absolutely_integrable:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g absolutely_integrable_on S"
 proof -
   have "g integrable_on S"
     by (rule dominated_convergence_integrable [OF assms])
   with assms show ?thesis
     by (blast intro:  absolutely_integrable_integrable_bound [where g=h])
 qed
 
 
 proposition integral_countable_UN:
   fixes f :: "real^'m \<Rightarrow> real^'n"
   assumes f: "f absolutely_integrable_on (\<Union>(range s))"
     and s: "\<And>m. s m \<in> sets lebesgue"
   shows "\<And>n. f absolutely_integrable_on (\<Union>m\<le>n. s m)"
     and "(\<lambda>n. integral (\<Union>m\<le>n. s m) f) \<longlonglongrightarrow> integral (\<Union>(s ` UNIV)) f" (is "?F \<longlonglongrightarrow> ?I")
 proof -
   show fU: "f absolutely_integrable_on (\<Union>m\<le>n. s m)" for n
     using assms by (blast intro: set_integrable_subset [OF f])
   have fint: "f integrable_on (\<Union> (range s))"
     using absolutely_integrable_on_def f by blast
   let ?h = "\<lambda>x. if x \<in> \<Union>(s ` UNIV) then norm(f x) else 0"
   have "(\<lambda>n. integral UNIV (\<lambda>x. if x \<in> (\<Union>m\<le>n. s m) then f x else 0))
         \<longlonglongrightarrow> integral UNIV (\<lambda>x. if x \<in> \<Union>(s ` UNIV) then f x else 0)"
   proof (rule dominated_convergence)
     show "(\<lambda>x. if x \<in> (\<Union>m\<le>n. s m) then f x else 0) integrable_on UNIV" for n
       unfolding integrable_restrict_UNIV
       using fU absolutely_integrable_on_def by blast
     show "(\<lambda>x. if x \<in> \<Union>(s ` UNIV) then norm(f x) else 0) integrable_on UNIV"
       by (metis (no_types) absolutely_integrable_on_def f integrable_restrict_UNIV)
     show "\<And>x. (\<lambda>n. if x \<in> (\<Union>m\<le>n. s m) then f x else 0)
          \<longlonglongrightarrow> (if x \<in> \<Union>(s ` UNIV) then f x else 0)"
       by (force intro: tendsto_eventually eventually_sequentiallyI)
   qed auto
   then show "?F \<longlonglongrightarrow> ?I"
     by (simp only: integral_restrict_UNIV)
 qed
 
 
 subsection \<open>Fundamental Theorem of Calculus for the Lebesgue integral\<close>
 
 text \<open>
 
 For the positive integral we replace continuity with Borel-measurability.
 
 \<close>
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes [measurable]: "f \<in> borel_measurable borel"
   assumes f: "\<And>x. x \<in> {a..b} \<Longrightarrow> DERIV F x :> f x" "\<And>x. x \<in> {a..b} \<Longrightarrow> 0 \<le> f x" and "a \<le> b"
   shows nn_integral_FTC_Icc: "(\<integral>\<^sup>+x. ennreal (f x) * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?nn)
     and has_bochner_integral_FTC_Icc_nonneg:
       "has_bochner_integral lborel (\<lambda>x. f x * indicator {a .. b} x) (F b - F a)" (is ?has)
     and integral_FTC_Icc_nonneg: "(\<integral>x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?eq)
     and integrable_FTC_Icc_nonneg: "integrable lborel (\<lambda>x. f x * indicator {a .. b} x)" (is ?int)
 proof -
   have *: "(\<lambda>x. f x * indicator {a..b} x) \<in> borel_measurable borel" "\<And>x. 0 \<le> f x * indicator {a..b} x"
     using f(2) by (auto split: split_indicator)
 
   have F_mono: "a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b\<Longrightarrow> F x \<le> F y" for x y
     using f by (intro DERIV_nonneg_imp_nondecreasing[of x y F]) (auto intro: order_trans)
 
   have "(f has_integral F b - F a) {a..b}"
     by (intro fundamental_theorem_of_calculus)
-       (auto simp: has_field_derivative_iff_has_vector_derivative[symmetric]
+       (auto simp: has_real_derivative_iff_has_vector_derivative[symmetric]
              intro: has_field_derivative_subset[OF f(1)] \<open>a \<le> b\<close>)
   then have i: "((\<lambda>x. f x * indicator {a .. b} x) has_integral F b - F a) UNIV"
     unfolding indicator_def of_bool_def if_distrib[where f="\<lambda>x. a * x" for a]
     by (simp cong del: if_weak_cong del: atLeastAtMost_iff)
   then have nn: "(\<integral>\<^sup>+x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a"
     by (rule nn_integral_has_integral_lborel[OF *])
   then show ?has
     by (rule has_bochner_integral_nn_integral[rotated 3]) (simp_all add: * F_mono \<open>a \<le> b\<close>)
   then show ?eq ?int
     unfolding has_bochner_integral_iff by auto
   show ?nn
     by (subst nn[symmetric])
        (auto intro!: nn_integral_cong simp add: ennreal_mult f split: split_indicator)
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes "a \<le> b"
   assumes "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
   assumes cont: "continuous_on {a .. b} f"
   shows has_bochner_integral_FTC_Icc:
       "has_bochner_integral lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x) (F b - F a)" (is ?has)
     and integral_FTC_Icc: "(\<integral>x. indicator {a .. b} x *\<^sub>R f x \<partial>lborel) = F b - F a" (is ?eq)
 proof -
   let ?f = "\<lambda>x. indicator {a .. b} x *\<^sub>R f x"
   have int: "integrable lborel ?f"
     using borel_integrable_compact[OF _ cont] by auto
   have "(f has_integral F b - F a) {a..b}"
     using assms(1,2) by (intro fundamental_theorem_of_calculus) auto
   moreover
   have "(f has_integral integral\<^sup>L lborel ?f) {a..b}"
     using has_integral_integral_lborel[OF int]
     unfolding indicator_def of_bool_def if_distrib[where f="\<lambda>x. x *\<^sub>R a" for a]
     by (simp cong del: if_weak_cong del: atLeastAtMost_iff)
   ultimately show ?eq
     by (auto dest: has_integral_unique)
   then show ?has
     using int by (auto simp: has_bochner_integral_iff)
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes deriv: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> DERIV F x :> f x"
   assumes cont: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> isCont f x"
   shows has_bochner_integral_FTC_Icc_real:
       "has_bochner_integral lborel (\<lambda>x. f x * indicator {a .. b} x) (F b - F a)" (is ?has)
     and integral_FTC_Icc_real: "(\<integral>x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?eq)
 proof -
   have 1: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
-    unfolding has_field_derivative_iff_has_vector_derivative[symmetric]
+    unfolding has_real_derivative_iff_has_vector_derivative[symmetric]
     using deriv by (auto intro: DERIV_subset)
   have 2: "continuous_on {a .. b} f"
     using cont by (intro continuous_at_imp_continuous_on) auto
   show ?has ?eq
     using has_bochner_integral_FTC_Icc[OF \<open>a \<le> b\<close> 1 2] integral_FTC_Icc[OF \<open>a \<le> b\<close> 1 2]
     by (auto simp: mult.commute)
 qed
 
 lemma nn_integral_FTC_atLeast:
   fixes f :: "real \<Rightarrow> real"
   assumes f_borel: "f \<in> borel_measurable borel"
   assumes f: "\<And>x. a \<le> x \<Longrightarrow> DERIV F x :> f x"
   assumes nonneg: "\<And>x. a \<le> x \<Longrightarrow> 0 \<le> f x"
   assumes lim: "(F \<longlongrightarrow> T) at_top"
   shows "(\<integral>\<^sup>+x. ennreal (f x) * indicator {a ..} x \<partial>lborel) = T - F a"
 proof -
   let ?f = "\<lambda>(i::nat) (x::real). ennreal (f x) * indicator {a..a + real i} x"
   let ?fR = "\<lambda>x. ennreal (f x) * indicator {a ..} x"
 
   have F_mono: "a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> F x \<le> F y" for x y
     using f nonneg by (intro DERIV_nonneg_imp_nondecreasing[of x y F]) (auto intro: order_trans)
   then have F_le_T: "a \<le> x \<Longrightarrow> F x \<le> T" for x
     by (intro tendsto_lowerbound[OF lim])
        (auto simp: eventually_at_top_linorder)
 
   have "(SUP i. ?f i x) = ?fR x" for x
   proof (rule LIMSEQ_unique[OF LIMSEQ_SUP])
     obtain n where "x - a < real n"
       using reals_Archimedean2[of "x - a"] ..
     then have "eventually (\<lambda>n. ?f n x = ?fR x) sequentially"
       by (auto intro!: eventually_sequentiallyI[where c=n] split: split_indicator)
     then show "(\<lambda>n. ?f n x) \<longlonglongrightarrow> ?fR x"
       by (rule tendsto_eventually)
   qed (auto simp: nonneg incseq_def le_fun_def split: split_indicator)
   then have "integral\<^sup>N lborel ?fR = (\<integral>\<^sup>+ x. (SUP i. ?f i x) \<partial>lborel)"
     by simp
   also have "\<dots> = (SUP i. (\<integral>\<^sup>+ x. ?f i x \<partial>lborel))"
   proof (rule nn_integral_monotone_convergence_SUP)
     show "incseq ?f"
       using nonneg by (auto simp: incseq_def le_fun_def split: split_indicator)
     show "\<And>i. (?f i) \<in> borel_measurable lborel"
       using f_borel by auto
   qed
   also have "\<dots> = (SUP i. ennreal (F (a + real i) - F a))"
     by (subst nn_integral_FTC_Icc[OF f_borel f nonneg]) auto
   also have "\<dots> = T - F a"
   proof (rule LIMSEQ_unique[OF LIMSEQ_SUP])
      have "(\<lambda>x. F (a + real x)) \<longlonglongrightarrow> T"
        by (auto intro: filterlim_compose[OF lim filterlim_tendsto_add_at_top] filterlim_real_sequentially)
     then show "(\<lambda>n. ennreal (F (a + real n) - F a)) \<longlonglongrightarrow> ennreal (T - F a)"
       by (simp add: F_mono F_le_T tendsto_diff)
   qed (auto simp: incseq_def intro!: ennreal_le_iff[THEN iffD2] F_mono)
   finally show ?thesis .
 qed
 
 lemma integral_power:
   "a \<le> b \<Longrightarrow> (\<integral>x. x^k * indicator {a..b} x \<partial>lborel) = (b^Suc k - a^Suc k) / Suc k"
 proof (subst integral_FTC_Icc_real)
   fix x show "DERIV (\<lambda>x. x^Suc k / Suc k) x :> x^k"
     by (intro derivative_eq_intros) auto
 qed (auto simp: field_simps simp del: of_nat_Suc)
 
 subsection \<open>Integration by parts\<close>
 
 lemma integral_by_parts_integrable:
   fixes f g F G::"real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes cont_f[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes cont_g[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes [intro]: "!!x. DERIV F x :> f x"
   assumes [intro]: "!!x. DERIV G x :> g x"
   shows  "integrable lborel (\<lambda>x.((F x) * (g x) + (f x) * (G x)) * indicator {a .. b} x)"
   by (auto intro!: borel_integrable_atLeastAtMost continuous_intros) (auto intro!: DERIV_isCont)
 
 lemma integral_by_parts:
   fixes f g F G::"real \<Rightarrow> real"
   assumes [arith]: "a \<le> b"
   assumes cont_f[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes cont_g[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes [intro]: "!!x. DERIV F x :> f x"
   assumes [intro]: "!!x. DERIV G x :> g x"
   shows "(\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel)
             =  F b * G b - F a * G a - \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel"
 proof-
   have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) 
       = LBINT x. F x * g x * indicat_real {a..b} x + f x * G x * indicat_real {a..b} x"
     by (meson vector_space_over_itself.scale_left_distrib)
   also have "... = (\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel) + \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel"
   proof (intro Bochner_Integration.integral_add borel_integrable_atLeastAtMost cont_f cont_g continuous_intros)
     show "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont F x" "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont G x"
       using DERIV_isCont by blast+
   qed
   finally have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) =
                 (\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel) + \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel" .
   moreover have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) = F b * G b - F a * G a"
   proof (intro integral_FTC_Icc_real derivative_eq_intros cont_f cont_g continuous_intros)
     show "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont F x" "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont G x"
       using DERIV_isCont by blast+
   qed auto
   ultimately show ?thesis by auto
 qed
 
 lemma integral_by_parts':
   fixes f g F G::"real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes "!!x. DERIV F x :> f x"
   assumes "!!x. DERIV G x :> g x"
   shows "(\<integral>x. indicator {a .. b} x *\<^sub>R (F x * g x) \<partial>lborel)
             =  F b * G b - F a * G a - \<integral>x. indicator {a .. b} x *\<^sub>R (f x * G x) \<partial>lborel"
   using integral_by_parts[OF assms] by (simp add: ac_simps)
 
 lemma has_bochner_integral_even_function:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x) x"
   assumes even: "\<And>x. f (- x) = f x"
   shows "has_bochner_integral lborel f (2 *\<^sub>R x)"
 proof -
   have indicator: "\<And>x::real. indicator {..0} (- x) = indicator {0..} x"
     by (auto split: split_indicator)
   have "has_bochner_integral lborel (\<lambda>x. indicator {.. 0} x *\<^sub>R f x) x"
     by (subst lborel_has_bochner_integral_real_affine_iff[where c="-1" and t=0])
        (auto simp: indicator even f)
   with f have "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x + indicator {.. 0} x *\<^sub>R f x) (x + x)"
     by (rule has_bochner_integral_add)
   then have "has_bochner_integral lborel f (x + x)"
     by (rule has_bochner_integral_discrete_difference[where X="{0}", THEN iffD1, rotated 4])
        (auto split: split_indicator)
   then show ?thesis
     by (simp add: scaleR_2)
 qed
 
 lemma has_bochner_integral_odd_function:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x) x"
   assumes odd: "\<And>x. f (- x) = - f x"
   shows "has_bochner_integral lborel f 0"
 proof -
   have indicator: "\<And>x::real. indicator {..0} (- x) = indicator {0..} x"
     by (auto split: split_indicator)
   have "has_bochner_integral lborel (\<lambda>x. - indicator {.. 0} x *\<^sub>R f x) x"
     by (subst lborel_has_bochner_integral_real_affine_iff[where c="-1" and t=0])
        (auto simp: indicator odd f)
   from has_bochner_integral_minus[OF this]
   have "has_bochner_integral lborel (\<lambda>x. indicator {.. 0} x *\<^sub>R f x) (- x)"
     by simp
   with f have "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x + indicator {.. 0} x *\<^sub>R f x) (x + - x)"
     by (rule has_bochner_integral_add)
   then have "has_bochner_integral lborel f (x + - x)"
     by (rule has_bochner_integral_discrete_difference[where X="{0}", THEN iffD1, rotated 4])
        (auto split: split_indicator)
   then show ?thesis
     by simp
 qed
 
 subsection \<open>A non-negative continuous function whose integral is zero must be zero\<close>
 
 lemma has_integral_0_closure_imp_0:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "continuous_on (closure S) f"
     and nonneg_interior: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
     and pos: "0 < emeasure lborel S"
     and finite: "emeasure lborel S < \<infinity>"
     and regular: "emeasure lborel (closure S) = emeasure lborel S"
     and opn: "open S"
   assumes int: "(f has_integral 0) (closure S)"
   assumes x: "x \<in> closure S"
   shows "f x = 0"
 proof -
   have zero: "emeasure lborel (frontier S) = 0"
     using finite closure_subset regular
     unfolding frontier_def
     by (subst emeasure_Diff) (auto simp: frontier_def interior_open \<open>open S\<close> )
   have nonneg: "0 \<le> f x" if "x \<in> closure S" for x
     using continuous_ge_on_closure[OF f that nonneg_interior] by simp
   have "0 = integral (closure S) f"
     by (blast intro: int sym)
   also
   note intl = has_integral_integrable[OF int]
   have af: "f absolutely_integrable_on (closure S)"
     using nonneg
     by (intro absolutely_integrable_onI intl integrable_eq[OF intl]) simp
   then have "integral (closure S) f = set_lebesgue_integral lebesgue (closure S) f"
     by (intro set_lebesgue_integral_eq_integral(2)[symmetric])
   also have "\<dots> = 0 \<longleftrightarrow> (AE x in lebesgue. indicator (closure S) x *\<^sub>R f x = 0)"
     unfolding set_lebesgue_integral_def
   proof (rule integral_nonneg_eq_0_iff_AE)
     show "integrable lebesgue (\<lambda>x. indicat_real (closure S) x *\<^sub>R f x)"
       by (metis af set_integrable_def)
   qed (use nonneg in \<open>auto simp: indicator_def\<close>)
   also have "\<dots> \<longleftrightarrow> (AE x in lebesgue. x \<in> {x. x \<in> closure S \<longrightarrow> f x = 0})"
     by (auto simp: indicator_def)
   finally have "(AE x in lebesgue. x \<in> {x. x \<in> closure S \<longrightarrow> f x = 0})" by simp
   moreover have "(AE x in lebesgue. x \<in> - frontier S)"
     using zero
     by (auto simp: eventually_ae_filter null_sets_def intro!: exI[where x="frontier S"])
   ultimately have ae: "AE x \<in> S in lebesgue. x \<in> {x \<in> closure S. f x = 0}" (is ?th)
     by eventually_elim (use closure_subset in \<open>auto simp: \<close>)
   have "closed {0::real}" by simp
   with continuous_on_closed_vimage[OF closed_closure, of S f] f
   have "closed (f -` {0} \<inter> closure S)" by blast
   then have "closed {x \<in> closure S. f x = 0}" by (auto simp: vimage_def Int_def conj_commute)
   with \<open>open S\<close> have "x \<in> {x \<in> closure S. f x = 0}" if "x \<in> S" for x using ae that
     by (rule mem_closed_if_AE_lebesgue_open)
   then have "f x = 0" if "x \<in> S" for x using that by auto
   from continuous_constant_on_closure[OF f this \<open>x \<in> closure S\<close>]
   show "f x = 0" .
 qed
 
 lemma has_integral_0_cbox_imp_0:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "continuous_on (cbox a b) f" and "\<And>x. x \<in> box a b \<Longrightarrow> 0 \<le> f x"
   assumes "(f has_integral 0) (cbox a b)"
   assumes ne: "box a b \<noteq> {}"
   assumes x: "x \<in> cbox a b"
   shows "f x = 0"
 proof -
   have "0 < emeasure lborel (box a b)"
     using ne x unfolding emeasure_lborel_box_eq
     by (force intro!: prod_pos simp: mem_box algebra_simps)
   then show ?thesis using assms
     by (intro has_integral_0_closure_imp_0[of "box a b" f x])
       (auto simp: emeasure_lborel_box_eq emeasure_lborel_cbox_eq algebra_simps mem_box)
 qed
 
 corollary integral_cbox_eq_0_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "continuous_on (cbox a b) f" and "box a b \<noteq> {}"
     and "\<And>x. x \<in> cbox a b \<Longrightarrow> f x \<ge> 0"
   shows "integral (cbox a b) f = 0 \<longleftrightarrow> (\<forall>x \<in> cbox a b. f x = 0)" (is "?lhs = ?rhs")
 proof
   assume int0: ?lhs
   show ?rhs
     using has_integral_0_cbox_imp_0 [of a b f] assms
     by (metis box_subset_cbox eq_integralD int0 integrable_continuous subsetD) 
 next
   assume ?rhs then show ?lhs
     by (meson has_integral_is_0_cbox integral_unique)
 qed
 
 lemma integral_eq_0_iff:
   fixes f :: "real \<Rightarrow> real"
   assumes "continuous_on {a..b} f" and "a < b"
     and "\<And>x. x \<in> {a..b} \<Longrightarrow> f x \<ge> 0"
   shows "integral {a..b} f = 0 \<longleftrightarrow> (\<forall>x \<in> {a..b}. f x = 0)" 
   using integral_cbox_eq_0_iff [of a b f] assms by simp
 
 lemma integralL_eq_0_iff:
   fixes f :: "real \<Rightarrow> real"
   assumes contf: "continuous_on {a..b} f" and "a < b"
     and "\<And>x. x \<in> {a..b} \<Longrightarrow> f x \<ge> 0"
   shows "integral\<^sup>L (lebesgue_on {a..b}) f = 0 \<longleftrightarrow> (\<forall>x \<in> {a..b}. f x = 0)" 
   using integral_eq_0_iff [OF assms]
   by (simp add: contf continuous_imp_integrable_real lebesgue_integral_eq_integral)
 
 text \<open>In fact, strict inequality is required only at a single point within the box.\<close>
 lemma integral_less:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes cont: "continuous_on (cbox a b) f" "continuous_on (cbox a b) g" and "box a b \<noteq> {}"
     and fg: "\<And>x. x \<in> box a b \<Longrightarrow> f x < g x"
   shows "integral (cbox a b) f < integral (cbox a b) g"
 proof -
   obtain int: "f integrable_on (cbox a b)" "g integrable_on (cbox a b)"
     using cont integrable_continuous by blast
   then have "integral (cbox a b) f \<le> integral (cbox a b) g"
     by (metis fg integrable_on_open_interval integral_le integral_open_interval less_eq_real_def)
   moreover have "integral (cbox a b) f \<noteq> integral (cbox a b) g"
   proof (rule ccontr)
     assume "\<not> integral (cbox a b) f \<noteq> integral (cbox a b) g"
     then have 0: "((\<lambda>x. g x - f x) has_integral 0) (cbox a b)"
       by (metis (full_types) cancel_comm_monoid_add_class.diff_cancel has_integral_diff int integrable_integral)
     have cgf: "continuous_on (cbox a b) (\<lambda>x. g x - f x)"
       using cont continuous_on_diff by blast
     show False
       using has_integral_0_cbox_imp_0 [OF cgf _ 0] assms(3) box_subset_cbox fg less_eq_real_def by fastforce
   qed
   ultimately show ?thesis
     by linarith
 qed
 
 lemma integral_less_real:
   fixes f :: "real \<Rightarrow> real"
   assumes "continuous_on {a..b} f" "continuous_on {a..b} g" and "{a<..<b} \<noteq> {}"
     and "\<And>x. x \<in> {a<..<b} \<Longrightarrow> f x < g x"
   shows "integral {a..b} f < integral {a..b} g"
   by (metis assms box_real integral_less)
 
 subsection\<open>Various common equivalent forms of function measurability\<close>
 
 lemma indicator_sum_eq:
   fixes m::real and f :: "'a \<Rightarrow> real"
   assumes "\<bar>m\<bar> \<le> 2 ^ (2*n)" "m/2^n \<le> f x" "f x < (m+1)/2^n" "m \<in> \<int>"
   shows   "(\<Sum>k::real | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
             k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x)  = m/2^n"
           (is "sum ?f ?S = _")
 proof -
   have "sum ?f ?S = sum (\<lambda>k. k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x) {m}"
   proof (rule comm_monoid_add_class.sum.mono_neutral_right)
     show "finite ?S"
       by (rule finite_abs_int_segment)
     show "{m} \<subseteq> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
       using assms by auto
     show "\<forall>i\<in>{k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} - {m}. ?f i = 0"
       using assms by (auto simp: indicator_def Ints_def abs_le_iff field_split_simps)
   qed
   also have "\<dots> = m/2^n"
     using assms by (auto simp: indicator_def not_less)
   finally show ?thesis .
 qed
 
 lemma measurable_on_sf_limit_lemma1:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "\<And>a b. {x \<in> S. a \<le> f x \<and> f x < b} \<in> sets (lebesgue_on S)"
   obtains g where "\<And>n. g n \<in> borel_measurable (lebesgue_on S)"
                   "\<And>n. finite(range (g n))"
                   "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x"
 proof
   show "(\<lambda>x. sum (\<lambda>k::real. k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x)
                  {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}) \<in> borel_measurable (lebesgue_on S)"
         (is "?g \<in> _")  for n
   proof -
     have "\<And>k. \<lbrakk>k \<in> \<int>; \<bar>k\<bar> \<le> 2 ^ (2*n)\<rbrakk>
          \<Longrightarrow> Measurable.pred (lebesgue_on S) (\<lambda>x. k / (2^n) \<le> f x \<and> f x < (k+1) / (2^n))"
       using assms by (force simp: pred_def space_restrict_space)
     then show ?thesis
       by (simp add: field_class.field_divide_inverse)
   qed
   show "finite (range (?g n))" for n
   proof -
     have "range (?g n) \<subseteq> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
     proof clarify
       fix x
       show "?g n x  \<in> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
       proof (cases "\<exists>k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n) \<and> k/2^n \<le> (f x) \<and> (f x) < (k+1)/2^n")
         case True
         then show ?thesis
           apply clarify
           by (subst indicator_sum_eq) auto
       next
         case False
         then have "?g n x = 0" by auto
         then show ?thesis by force
       qed
     qed
     moreover have "finite ((\<lambda>k::real. (k/2^n)) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})"
       by (simp add: finite_abs_int_segment)
     ultimately show ?thesis
       using finite_subset by blast
   qed
   show "(\<lambda>n. ?g n x) \<longlonglongrightarrow> f x" for x
   proof (rule LIMSEQ_I)
     fix e::real
     assume "e > 0"
     obtain N1 where N1: "\<bar>f x\<bar> < 2 ^ N1"
       using real_arch_pow by fastforce
     obtain N2 where N2: "(1/2) ^ N2 < e"
       using real_arch_pow_inv \<open>e > 0\<close> by force
     have "norm (?g n x - f x) < e" if n: "n \<ge> max N1 N2" for n
     proof -
       define m where "m \<equiv> floor(2^n * (f x))"
       have "1 \<le> \<bar>2^n\<bar> * e"
         using n N2 \<open>e > 0\<close> less_eq_real_def less_le_trans by (fastforce simp add: field_split_simps)
       then have *: "\<lbrakk>x \<le> y; y < x + 1\<rbrakk> \<Longrightarrow> abs(x - y) < \<bar>2^n\<bar> * e" for x y::real
         by linarith
       have "\<bar>2^n\<bar> * \<bar>m/2^n - f x\<bar> = \<bar>2^n * (m/2^n - f x)\<bar>"
         by (simp add: abs_mult)
       also have "\<dots> = \<bar>real_of_int \<lfloor>2^n * f x\<rfloor> - f x * 2^n\<bar>"
         by (simp add: algebra_simps m_def)
       also have "\<dots> < \<bar>2^n\<bar> * e"
         by (rule *; simp add: mult.commute)
       finally have "\<bar>2^n\<bar> * \<bar>m/2^n - f x\<bar> < \<bar>2^n\<bar> * e" .
       then have me: "\<bar>m/2^n - f x\<bar> < e"
         by simp
       have "\<bar>real_of_int m\<bar> \<le> 2 ^ (2*n)"
       proof (cases "f x < 0")
         case True
         then have "-\<lfloor>f x\<rfloor> \<le> \<lfloor>(2::real) ^ N1\<rfloor>"
           using N1 le_floor_iff minus_le_iff by fastforce
         with n True have "\<bar>real_of_int\<lfloor>f x\<rfloor>\<bar> \<le> 2 ^ N1"
           by linarith
         also have "\<dots> \<le> 2^n"
           using n by (simp add: m_def)
         finally have "\<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n \<le> 2^n * 2^n"
           by simp
         moreover
         have "\<bar>real_of_int \<lfloor>2^n * f x\<rfloor>\<bar> \<le> \<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n"
         proof -
           have "\<bar>real_of_int \<lfloor>2^n * f x\<rfloor>\<bar> = - (real_of_int \<lfloor>2^n * f x\<rfloor>)"
             using True by (simp add: abs_if mult_less_0_iff)
           also have "\<dots> \<le> - (real_of_int (\<lfloor>(2::real) ^ n\<rfloor> * \<lfloor>f x\<rfloor>))"
             using le_mult_floor_Ints [of "(2::real)^n"] by simp
           also have "\<dots> \<le> \<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n"
             using True
             by simp
           finally show ?thesis .
         qed
         ultimately show ?thesis
           by (metis (no_types, opaque_lifting) m_def order_trans power2_eq_square power_even_eq)
       next
         case False
         with n N1 have "f x \<le> 2^n"
           by (simp add: not_less) (meson less_eq_real_def one_le_numeral order_trans power_increasing)
         moreover have "0 \<le> m"
           using False m_def by force
         ultimately show ?thesis
           by (metis abs_of_nonneg floor_mono le_floor_iff m_def of_int_0_le_iff power2_eq_square power_mult mult_le_cancel_iff1 zero_less_numeral mult.commute zero_less_power)
       qed
       then have "?g n x = m/2^n"
         by (rule indicator_sum_eq) (auto simp add: m_def field_split_simps, linarith)
       then have "norm (?g n x - f x) = norm (m/2^n - f x)"
         by simp
       also have "\<dots> < e"
         by (simp add: me)
       finally show ?thesis .
     qed
     then show "\<exists>no. \<forall>n\<ge>no. norm (?g n x - f x) < e"
       by blast
   qed
 qed
 
 
 lemma borel_measurable_simple_function_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
               (\<forall>n. finite (range (g n))) \<and> (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x))"
 proof -
   have "\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
             (\<forall>n. finite (range (g n))) \<and> (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x)"
        if f: "\<And>a i. i \<in> Basis \<Longrightarrow> {x \<in> S. f x \<bullet> i < a} \<in> sets (lebesgue_on S)"
   proof -
     have "\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
                   (\<forall>n. finite(image (g n) UNIV)) \<and>
                   (\<forall>x. ((\<lambda>n. g n x) \<longlonglongrightarrow> f x \<bullet> i))" if "i \<in> Basis" for i
     proof (rule measurable_on_sf_limit_lemma1 [of S "\<lambda>x. f x \<bullet> i"])
       show "{x \<in> S. a \<le> f x \<bullet> i \<and> f x \<bullet> i < b} \<in> sets (lebesgue_on S)" for a b
       proof -
         have "{x \<in> S. a \<le> f x \<bullet> i \<and> f x \<bullet> i < b} = {x \<in> S. f x \<bullet> i < b} - {x \<in> S. a > f x \<bullet> i}"
           by auto
         also have "\<dots> \<in> sets (lebesgue_on S)"
           using f that by blast
         finally show ?thesis .
       qed
     qed blast
     then obtain g where g:
           "\<And>i n. i \<in> Basis \<Longrightarrow> g i n \<in> borel_measurable (lebesgue_on S)"
           "\<And>i n. i \<in> Basis \<Longrightarrow> finite(range (g i n))"
           "\<And>i x. i \<in> Basis \<Longrightarrow> ((\<lambda>n. g i n x) \<longlonglongrightarrow> f x \<bullet> i)"
       by metis
     show ?thesis
     proof (intro conjI allI exI)
       show "(\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<in> borel_measurable (lebesgue_on S)" for n
         by (intro borel_measurable_sum borel_measurable_scaleR) (auto intro: g)
       show "finite (range (\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i))" for n
       proof -
         have "range (\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<subseteq> (\<lambda>h. \<Sum>i\<in>Basis. h i *\<^sub>R i) ` PiE Basis (\<lambda>i. range (g i n))"
         proof clarify
           fix x
           show "(\<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<in> (\<lambda>h. \<Sum>i\<in>Basis. h i *\<^sub>R i) ` (\<Pi>\<^sub>E i\<in>Basis. range (g i n))"
             by (rule_tac x="\<lambda>i\<in>Basis. g i n x" in image_eqI) auto
         qed
         moreover have "finite(PiE Basis (\<lambda>i. range (g i n)))"
           by (simp add: g finite_PiE)
         ultimately show ?thesis
           by (metis (mono_tags, lifting) finite_surj)
       qed
       show "(\<lambda>n. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<longlonglongrightarrow> f x" for x
       proof -
         have "(\<lambda>n. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<longlonglongrightarrow> (\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i)"
           by (auto intro!: tendsto_sum tendsto_scaleR g)
         moreover have "(\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) = f x"
           using euclidean_representation by blast
         ultimately show ?thesis
           by metis
       qed
     qed
   qed
   moreover have "f \<in> borel_measurable (lebesgue_on S)"
               if meas_g: "\<And>n. g n \<in> borel_measurable (lebesgue_on S)"
                  and fin: "\<And>n. finite (range (g n))"
                  and to_f: "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x" for  g
     by (rule borel_measurable_LIMSEQ_metric [OF meas_g to_f])
   ultimately show ?thesis
     using borel_measurable_vimage_halfspace_component_lt by blast
 qed
 
 subsection \<open>Lebesgue sets and continuous images\<close>
 
 proposition lebesgue_regular_inner:
  assumes "S \<in> sets lebesgue"
  obtains K C where "negligible K" "\<And>n::nat. compact(C n)" "S = (\<Union>n. C n) \<union> K"
 proof -
   have "\<exists>T. closed T \<and> T \<subseteq> S \<and> (S - T) \<in> lmeasurable \<and> emeasure lebesgue (S - T) < ennreal ((1/2)^n)" for n
     using sets_lebesgue_inner_closed assms
     by (metis sets_lebesgue_inner_closed zero_less_divide_1_iff zero_less_numeral zero_less_power)
   then obtain C where clo: "\<And>n. closed (C n)" and subS: "\<And>n. C n \<subseteq> S"
     and mea: "\<And>n. (S - C n) \<in> lmeasurable"
     and less: "\<And>n. emeasure lebesgue (S - C n) < ennreal ((1/2)^n)"
     by metis
   have "\<exists>F. (\<forall>n::nat. compact(F n)) \<and> (\<Union>n. F n) = C m" for m::nat
     by (metis clo closed_Union_compact_subsets)
   then obtain D :: "[nat,nat] \<Rightarrow> 'a set" where D: "\<And>m n. compact(D m n)" "\<And>m. (\<Union>n. D m n) = C m"
     by metis
   let ?C = "from_nat_into (\<Union>m. range (D m))"
   have "countable (\<Union>m. range (D m))"
     by blast
   have "range (from_nat_into (\<Union>m. range (D m))) = (\<Union>m. range (D m))"
     using range_from_nat_into by simp
   then have CD: "\<exists>m n. ?C k = D m n"  for k
     by (metis (mono_tags, lifting) UN_iff rangeE range_eqI)
   show thesis
   proof
     show "negligible (S - (\<Union>n. C n))"
     proof (clarsimp simp: negligible_outer_le)
       fix e :: "real"
       assume "e > 0"
       then obtain n where n: "(1/2)^n < e"
         using real_arch_pow_inv [of e "1/2"] by auto
       show "\<exists>T. S - (\<Union>n. C n) \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e"
       proof (intro exI conjI)
         show "S - (\<Union>n. C n) \<subseteq> S - C n"
           by blast
         show "S - C n \<in> lmeasurable"
           by (simp add: mea)
         show "measure lebesgue (S - C n) \<le> e"
           using less [of n] n
           by (simp add: emeasure_eq_measure2 less_le mea)
       qed
     qed
     show "compact (?C n)" for n
       using CD D by metis
     show "S = (\<Union>n. ?C n) \<union> (S - (\<Union>n. C n))" (is "_ = ?rhs")
     proof
       show "S \<subseteq> ?rhs"
         using D by fastforce
       show "?rhs \<subseteq> S"
         using subS D CD by auto (metis Sup_upper range_eqI subsetCE)
     qed
   qed
 qed
 
 lemma sets_lebesgue_continuous_image:
   assumes T: "T \<in> sets lebesgue" and contf: "continuous_on S f"
     and negim: "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible(f ` T)" and "T \<subseteq> S"
  shows "f ` T \<in> sets lebesgue"
 proof -
   obtain K C where "negligible K" and com: "\<And>n::nat. compact(C n)" and Teq: "T = (\<Union>n. C n) \<union> K"
     using lebesgue_regular_inner [OF T] by metis
   then have comf: "\<And>n::nat. compact(f ` C n)"
     by (metis Un_subset_iff Union_upper \<open>T \<subseteq> S\<close> compact_continuous_image contf continuous_on_subset rangeI)
   have "((\<Union>n. f ` C n) \<union> f ` K) \<in> sets lebesgue"
   proof (rule sets.Un)
     have "K \<subseteq> S"
       using Teq \<open>T \<subseteq> S\<close> by blast
     show "(\<Union>n. f ` C n) \<in> sets lebesgue"
     proof (rule sets.countable_Union)
       show "range (\<lambda>n. f ` C n) \<subseteq> sets lebesgue"
         using borel_compact comf by (auto simp: borel_compact)
     qed auto
     show "f ` K \<in> sets lebesgue"
       by (simp add: \<open>K \<subseteq> S\<close> \<open>negligible K\<close> negim negligible_imp_sets)
   qed
   then show ?thesis
     by (simp add: Teq image_Un image_Union)
 qed
 
 lemma differentiable_image_in_sets_lebesgue:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes S: "S \<in> sets lebesgue" and dim: "DIM('m) \<le> DIM('n)" and f: "f differentiable_on S"
   shows "f`S \<in> sets lebesgue"
 proof (rule sets_lebesgue_continuous_image [OF S])
   show "continuous_on S f"
     by (meson differentiable_imp_continuous_on f)
   show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
     using differentiable_on_subset f
     by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
 qed auto
 
 lemma sets_lebesgue_on_continuous_image:
   assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and contf: "continuous_on S f"
     and negim: "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible(f ` T)"
   shows "f ` X \<in> sets (lebesgue_on (f ` S))"
 proof -
   have "X \<subseteq> S"
     by (metis S X sets.Int_space_eq2 sets_restrict_space_iff)
   moreover have "f ` S \<in> sets lebesgue"
     using S contf negim sets_lebesgue_continuous_image by blast
   moreover have "f ` X \<in> sets lebesgue"
     by (metis S X contf negim sets_lebesgue_continuous_image sets_restrict_space_iff space_restrict_space space_restrict_space2)
   ultimately show ?thesis
     by (auto simp: sets_restrict_space_iff)
 qed
 
 lemma differentiable_image_in_sets_lebesgue_on:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and dim: "DIM('m) \<le> DIM('n)"
        and f: "f differentiable_on S"
      shows "f ` X \<in> sets (lebesgue_on (f`S))"
 proof (rule sets_lebesgue_on_continuous_image [OF S X])
   show "continuous_on S f"
     by (meson differentiable_imp_continuous_on f)
   show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
     using differentiable_on_subset f
     by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
 qed
 
 subsection \<open>Affine lemmas\<close>
 
 lemma borel_measurable_affine:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and "c \<noteq> 0"
   shows "(\<lambda>x. f(t + c *\<^sub>R x)) \<in> borel_measurable lebesgue"
 proof -
   { fix a b
     have "{x. f x \<in> cbox a b} \<in> sets lebesgue"
       using f cbox_borel lebesgue_measurable_vimage_borel by blast
     then have "(\<lambda>x. (x - t) /\<^sub>R c) ` {x. f x \<in> cbox a b} \<in> sets lebesgue"
     proof (rule differentiable_image_in_sets_lebesgue)
       show "(\<lambda>x. (x - t) /\<^sub>R c) differentiable_on {x. f x \<in> cbox a b}"
         unfolding differentiable_on_def differentiable_def
         by (rule \<open>c \<noteq> 0\<close> derivative_eq_intros strip exI | simp)+
     qed auto
     moreover
     have "{x. f(t + c *\<^sub>R x) \<in> cbox a b} = (\<lambda>x. (x-t) /\<^sub>R c) ` {x. f x \<in> cbox a b}"
       using \<open>c \<noteq> 0\<close> by (auto simp: image_def)
     ultimately have "{x. f(t + c *\<^sub>R x) \<in> cbox a b} \<in> sets lebesgue"
       by (auto simp: borel_measurable_vimage_closed_interval) }
   then show ?thesis
     by (subst lebesgue_on_UNIV_eq [symmetric]; auto simp: borel_measurable_vimage_closed_interval)
 qed
     
 lemma lebesgue_integrable_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes f: "integrable lebesgue f" and "c \<noteq> 0"
   shows "integrable lebesgue (\<lambda>x. f(t + c * x))"
 proof -
   have "(\<lambda>x. norm (f x)) \<in> borel_measurable lebesgue"
     by (simp add: borel_measurable_integrable f)
   then show ?thesis
     using assms borel_measurable_affine [of f c]
     unfolding integrable_iff_bounded
     by (subst (asm) nn_integral_real_affine_lebesgue[where c=c and t=t])  (auto simp: ennreal_mult_less_top)
 qed
 
 lemma lebesgue_integrable_real_affine_iff:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow> integrable lebesgue (\<lambda>x. f(t + c * x)) \<longleftrightarrow> integrable lebesgue f"
   using lebesgue_integrable_real_affine[of f c t]
         lebesgue_integrable_real_affine[of "\<lambda>x. f(t + c * x)" "1/c" "-t/c"]
   by (auto simp: field_simps)
 
 lemma\<^marker>\<open>tag important\<close> lebesgue_integral_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space" and c :: real
   assumes c: "c \<noteq> 0" shows "(\<integral>x. f x \<partial> lebesgue) = \<bar>c\<bar> *\<^sub>R (\<integral>x. f(t + c * x) \<partial>lebesgue)"
 proof cases
   have "(\<lambda>x. t + c * x) \<in> lebesgue \<rightarrow>\<^sub>M lebesgue"
     using lebesgue_affine_measurable[where c= "\<lambda>x::real. c"] \<open>c \<noteq> 0\<close> by simp
   moreover
   assume "integrable lebesgue f"
   ultimately show ?thesis
     by (subst lebesgue_real_affine[OF c, of t]) (auto simp: integral_density integral_distr)
 next
   assume "\<not> integrable lebesgue f" with c show ?thesis
     by (simp add: lebesgue_integrable_real_affine_iff not_integrable_integral_eq)
 qed
 
 lemma has_bochner_integral_lebesgue_real_affine_iff:
   fixes i :: "'a :: euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow>
     has_bochner_integral lebesgue f i \<longleftrightarrow>
     has_bochner_integral lebesgue (\<lambda>x. f(t + c * x)) (i /\<^sub>R \<bar>c\<bar>)"
   unfolding has_bochner_integral_iff lebesgue_integrable_real_affine_iff
   by (simp_all add: lebesgue_integral_real_affine[symmetric] divideR_right cong: conj_cong)
 
 lemma has_bochner_integral_reflect_real_lemma[intro]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "has_bochner_integral (lebesgue_on {a..b}) f i"
   shows "has_bochner_integral (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) i"
 proof -
   have eq: "indicat_real {a..b} (- x) *\<^sub>R f(- x) = indicat_real {- b..- a} x *\<^sub>R f(- x)" for x
     by (auto simp: indicator_def)
   have i: "has_bochner_integral lebesgue (\<lambda>x. indicator {a..b} x *\<^sub>R f x) i"
     using assms by (auto simp: has_bochner_integral_restrict_space)
   then have "has_bochner_integral lebesgue (\<lambda>x. indicator {-b..-a} x *\<^sub>R f(-x)) i"
     using has_bochner_integral_lebesgue_real_affine_iff [of "-1" "(\<lambda>x. indicator {a..b} x *\<^sub>R f x)" i 0]
     by (auto simp: eq)
   then show ?thesis
     by (auto simp: has_bochner_integral_restrict_space)
 qed
 
 lemma has_bochner_integral_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "has_bochner_integral (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) i \<longleftrightarrow> has_bochner_integral (lebesgue_on {a..b}) f i"
   by (auto simp: dest: has_bochner_integral_reflect_real_lemma)
 
 lemma integrable_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "integrable (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) \<longleftrightarrow> integrable (lebesgue_on {a..b}) f"
   by (metis has_bochner_integral_iff has_bochner_integral_reflect_real)
 
 lemma integral_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "integral\<^sup>L (lebesgue_on {-b .. -a}) (\<lambda>x. f(-x)) = integral\<^sup>L (lebesgue_on {a..b::real}) f"
   using has_bochner_integral_reflect_real [of b a f]
   by (metis has_bochner_integral_iff not_integrable_integral_eq)
 
 subsection\<open>More results on integrability\<close>
 
 lemma integrable_on_all_intervals_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "\<And>a b. f integrable_on cbox a b"
     and normf: "\<And>x. norm(f x) \<le> g x" and g: "g integrable_on UNIV"
   shows "f integrable_on UNIV"
 proof -
 have intg: "(\<forall>a b. g integrable_on cbox a b)"
     and gle_e: "\<forall>e>0. \<exists>B>0. \<forall>a b c d.
                     ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d \<longrightarrow>
                     \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>
                     < e"
     using g
     by (auto simp: integrable_alt_subset [of _ UNIV] intf)
   have le: "norm (integral (cbox a b) f - integral (cbox c d) f) \<le> \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>"
     if "cbox a b \<subseteq> cbox c d" for a b c d
   proof -
     have "norm (integral (cbox a b) f - integral (cbox c d) f) = norm (integral (cbox c d - cbox a b) f)"
       using intf that by (simp add: norm_minus_commute integral_setdiff)
     also have "\<dots> \<le> integral (cbox c d - cbox a b) g"
     proof (rule integral_norm_bound_integral [OF _ _ normf])
       show "f integrable_on cbox c d - cbox a b" "g integrable_on cbox c d - cbox a b"
         by (meson integrable_integral integrable_setdiff intf intg negligible_setdiff that)+
     qed
     also have "\<dots> = integral (cbox c d) g - integral (cbox a b) g"
       using intg that by (simp add: integral_setdiff)
     also have "\<dots> \<le> \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>"
       by simp
     finally show ?thesis .
   qed
   show ?thesis
     using gle_e
     apply (simp add: integrable_alt_subset [of _ UNIV] intf)
     apply (erule imp_forward all_forward ex_forward asm_rl)+
     by (meson not_less order_trans le)
 qed
 
 lemma integrable_on_all_intervals_integrable_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "\<And>a b. (\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and g: "g integrable_on S"
   shows "f integrable_on S"
   using integrable_on_all_intervals_UNIV [OF intf, of "(\<lambda>x. if x \<in> S then g x else 0)"]
   by (simp add: g integrable_restrict_UNIV normf)
 
 lemma measurable_bounded_lemma:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and g: "g integrable_on cbox a b"
     and normf: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm(f x) \<le> g x"
   shows "f integrable_on cbox a b"
 proof -
   have "g absolutely_integrable_on cbox a b"
     by (metis (full_types) add_increasing g le_add_same_cancel1 nonnegative_absolutely_integrable_1 norm_ge_zero normf)
   then have "integrable (lebesgue_on (cbox a b)) g"
     by (simp add: integrable_restrict_space set_integrable_def)
   then have "integrable (lebesgue_on (cbox a b)) f"
   proof (rule Bochner_Integration.integrable_bound)
     show "AE x in lebesgue_on (cbox a b). norm (f x) \<le> norm (g x)"
       by (rule AE_I2) (auto intro: normf order_trans)
   qed (simp add: f measurable_restrict_space1)
   then show ?thesis
     by (simp add: integrable_on_lebesgue_on)
 qed
 
 proposition measurable_bounded_by_integrable_imp_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and g: "g integrable_on S"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and S: "S \<in> sets lebesgue"
   shows "f integrable_on S"
 proof (rule integrable_on_all_intervals_integrable_bound [OF _ normf g])
   show "(\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b" for a b
   proof (rule measurable_bounded_lemma)
     show "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable lebesgue"
       by (simp add: S borel_measurable_if f)
     show "(\<lambda>x. if x \<in> S then g x else 0) integrable_on cbox a b"
       by (simp add: g integrable_altD(1))
     show "norm (if x \<in> S then f x else 0) \<le> (if x \<in> S then g x else 0)" for x
       using normf by simp
   qed
 qed
 
 lemma measurable_bounded_by_integrable_imp_lebesgue_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and g: "integrable (lebesgue_on S) g"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and S: "S \<in> sets lebesgue"
   shows "integrable (lebesgue_on S) f"
 proof -
   have "f absolutely_integrable_on S"
     by (metis (no_types) S absolutely_integrable_integrable_bound f g integrable_on_lebesgue_on measurable_bounded_by_integrable_imp_integrable normf)
   then show ?thesis
     by (simp add: S integrable_restrict_space set_integrable_def)
 qed
 
 lemma measurable_bounded_by_integrable_imp_integrable_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "g integrable_on S" "\<And>x. x \<in> S \<Longrightarrow> abs(f x) \<le> g x" "S \<in> sets lebesgue"
   shows "f integrable_on S"
   using measurable_bounded_by_integrable_imp_integrable [of f S g] assms by simp
 
 subsection\<open> Relation between Borel measurability and integrability.\<close>
 
 lemma integrable_imp_measurable_weak:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "f integrable_on S"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   by (metis (mono_tags, lifting) assms has_integral_implies_lebesgue_measurable borel_measurable_restrict_space_iff integrable_on_def sets.Int_space_eq2)
 
 lemma integrable_imp_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on S"
   shows "f \<in> borel_measurable (lebesgue_on S)"
 proof -
   have "(UNIV::'a set) \<in> sets lborel"
     by simp
   then show ?thesis
     by (metis (mono_tags, lifting) assms borel_measurable_if_D integrable_imp_measurable_weak integrable_restrict_UNIV lebesgue_on_UNIV_eq sets_lebesgue_on_refl)
 qed
 
 lemma integrable_iff_integrable_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>lebesgue_on S) < \<infinity>"
   shows "integrable (lebesgue_on S) f \<longleftrightarrow> f integrable_on S"
   using assms integrable_iff_bounded integrable_imp_measurable integrable_on_lebesgue_on by blast
 
 lemma absolutely_integrable_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S) \<and> integrable (lebesgue_on S) (norm \<circ> f)"
     (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   then have "f \<in> borel_measurable (lebesgue_on S)"
     by (simp add: absolutely_integrable_on_def integrable_imp_measurable)
   then show ?rhs
     using assms set_integrable_norm [of lebesgue S f] L
     by (simp add: integrable_restrict_space set_integrable_def)
 next
   assume ?rhs then show ?lhs
     using assms integrable_on_lebesgue_on
     by (metis absolutely_integrable_integrable_bound comp_def eq_iff measurable_bounded_by_integrable_imp_integrable)
 qed
 
 lemma absolutely_integrable_measurable_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow>
          f \<in> borel_measurable (lebesgue_on S) \<and> integrable (lebesgue_on S) (\<lambda>x. \<bar>f x\<bar>)"
   by (simp add: absolutely_integrable_measurable assms o_def)
 
 lemma absolutely_integrable_measurable_real':
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S) \<and> (\<lambda>x. \<bar>f x\<bar>) integrable_on S"
   by (metis abs_absolutely_integrableI_1 absolutely_integrable_measurable_real assms 
             measurable_bounded_by_integrable_imp_integrable order_refl real_norm_def set_integrable_abs set_lebesgue_integral_eq_integral(1))
 
 lemma absolutely_integrable_imp_borel_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f absolutely_integrable_on S" "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   using absolutely_integrable_measurable assms by blast
 
 lemma measurable_bounded_by_integrable_imp_absolutely_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "S \<in> sets lebesgue"
     and "g integrable_on S" and "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> (g x)"
   shows "f absolutely_integrable_on S"
   using assms absolutely_integrable_integrable_bound measurable_bounded_by_integrable_imp_integrable by blast
 
 proposition negligible_differentiable_vimage:
   fixes f :: "'a \<Rightarrow> 'a::euclidean_space"
   assumes "negligible T"
     and f': "\<And>x. x \<in> S \<Longrightarrow> inj(f' x)"
     and derf: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "negligible {x \<in> S. f x \<in> T}"
 proof -
   define U where
     "U \<equiv> \<lambda>n::nat. {x \<in> S. \<forall>y. y \<in> S \<and> norm(y - x) < 1/n
                      \<longrightarrow> norm(y - x) \<le> n * norm(f y - f x)}"
   have "negligible {x \<in> U n. f x \<in> T}" if "n > 0" for n
   proof (subst locally_negligible_alt, clarify)
     fix a
     assume a: "a \<in> U n" and fa: "f a \<in> T"
     define V where "V \<equiv> {x. x \<in> U n \<and> f x \<in> T} \<inter> ball a (1 / n / 2)"
     show "\<exists>V. openin (top_of_set {x \<in> U n. f x \<in> T}) V \<and> a \<in> V \<and> negligible V"
     proof (intro exI conjI)
       have noxy: "norm(x - y) \<le> n * norm(f x - f y)" if "x \<in> V" "y \<in> V" for x y
         using that unfolding U_def V_def mem_Collect_eq Int_iff mem_ball dist_norm
         by (meson norm_triangle_half_r)
       then have "inj_on f V"
         by (force simp: inj_on_def)
       then obtain g where g: "\<And>x. x \<in> V \<Longrightarrow> g(f x) = x"
         by (metis inv_into_f_f)
       have "\<exists>T' B. open T' \<and> f x \<in> T' \<and>
                    (\<forall>y\<in>f ` V \<inter> T \<inter> T'. norm (g y - g (f x)) \<le> B * norm (y - f x))"
         if "f x \<in> T" "x \<in> V" for x
         using that noxy 
         by (rule_tac x = "ball (f x) 1" in exI) (force simp: g)
       then have "negligible (g ` (f ` V \<inter> T))"
         by (force simp: \<open>negligible T\<close> negligible_Int intro!: negligible_locally_Lipschitz_image)
       moreover have "V \<subseteq> g ` (f ` V \<inter> T)"
         by (force simp: g image_iff V_def)
       ultimately show "negligible V"
         by (rule negligible_subset)
     qed (use a fa V_def that in auto)
   qed
   with negligible_countable_Union have "negligible (\<Union>n \<in> {0<..}. {x. x \<in> U n \<and> f x \<in> T})"
     by auto
   moreover have "{x \<in> S. f x \<in> T} \<subseteq> (\<Union>n \<in> {0<..}. {x. x \<in> U n \<and> f x \<in> T})"
   proof clarsimp
     fix x
     assume "x \<in> S" and "f x \<in> T"
     then obtain inj: "inj(f' x)" and der: "(f has_derivative f' x) (at x within S)"
       using assms by metis
     moreover have "linear(f' x)"
       and eps: "\<And>\<epsilon>. \<epsilon> > 0 \<Longrightarrow> \<exists>\<delta>>0. \<forall>y\<in>S. norm (y - x) < \<delta> \<longrightarrow>
                       norm (f y - f x - f' x (y - x)) \<le> \<epsilon> * norm (y - x)"
       using der by (auto simp: has_derivative_within_alt linear_linear)
     ultimately obtain g where "linear g" and g: "g \<circ> f' x = id"
       using linear_injective_left_inverse by metis
     then obtain B where "B > 0" and B: "\<And>z. B * norm z \<le> norm(f' x z)"
       using linear_invertible_bounded_below_pos \<open>linear (f' x)\<close> by blast
     then obtain i where "i \<noteq> 0" and i: "1 / real i < B"
       by (metis (full_types) inverse_eq_divide real_arch_invD)
     then obtain \<delta> where "\<delta> > 0"
          and \<delta>: "\<And>y. \<lbrakk>y\<in>S; norm (y - x) < \<delta>\<rbrakk> \<Longrightarrow>
                   norm (f y - f x - f' x (y - x)) \<le> (B - 1 / real i) * norm (y - x)"
       using eps [of "B - 1/i"] by auto
     then obtain j where "j \<noteq> 0" and j: "inverse (real j) < \<delta>"
       using real_arch_inverse by blast
     have "norm (y - x)/(max i j) \<le> norm (f y - f x)"
       if "y \<in> S" and less: "norm (y - x) < 1 / (max i j)" for y
     proof -
       have "1 / real (max i j) < \<delta>"
         using j \<open>j \<noteq> 0\<close> \<open>0 < \<delta>\<close>
         by (auto simp: field_split_simps max_mult_distrib_left of_nat_max)
     then have "norm (y - x) < \<delta>"
       using less by linarith
     with \<delta> \<open>y \<in> S\<close> have le: "norm (f y - f x - f' x (y - x)) \<le> B * norm (y - x) - norm (y - x)/i"
       by (auto simp: algebra_simps)
     have "norm (y - x) / real (max i j) \<le> norm (y - x) / real i"
       using \<open>i \<noteq> 0\<close> \<open>j \<noteq> 0\<close> by (simp add: field_split_simps max_mult_distrib_left of_nat_max less_max_iff_disj)
     also have "... \<le> norm (f y - f x)"
       using B [of "y-x"] le norm_triangle_ineq3 [of "f y - f x" "f' x (y - x)"]
       by linarith 
     finally show ?thesis .
   qed
   with \<open>x \<in> S\<close> \<open>i \<noteq> 0\<close> \<open>j \<noteq> 0\<close> show "\<exists>n\<in>{0<..}. x \<in> U n"
     by (rule_tac x="max i j" in bexI) (auto simp: field_simps U_def less_max_iff_disj)
 qed
   ultimately show ?thesis
     by (rule negligible_subset)
 qed
 
 lemma absolutely_integrable_Un:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes S: "f absolutely_integrable_on S" and T: "f absolutely_integrable_on T"
   shows "f absolutely_integrable_on (S \<union> T)"
 proof -
   have [simp]: "{x. (if x \<in> A then f x else 0) \<noteq> 0} = {x \<in> A. f x \<noteq> 0}" for A
     by auto
   let ?ST = "{x \<in> S. f x \<noteq> 0} \<inter> {x \<in> T. f x \<noteq> 0}"
   have "?ST \<in> sets lebesgue"
   proof (rule Sigma_Algebra.sets.Int)
     have "f integrable_on S"
       using S absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have borel: "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then show "{x \<in> S. f x \<noteq> 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_open
       by (rule allE [where x = "-{0}"]) auto
   next
     have "f integrable_on T"
       using T absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> T then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have borel: "(\<lambda>x. if x \<in> T then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then show "{x \<in> T. f x \<noteq> 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_open
       by (rule allE [where x = "-{0}"]) auto
   qed
   then have "f absolutely_integrable_on ?ST"
     by (rule set_integrable_subset [OF S]) auto
   then have Int: "(\<lambda>x. if x \<in> ?ST then f x else 0) absolutely_integrable_on UNIV"
     using absolutely_integrable_restrict_UNIV by blast
   have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV"
        "(\<lambda>x. if x \<in> T then f x else 0) absolutely_integrable_on UNIV"
     using S T absolutely_integrable_restrict_UNIV by blast+
   then have "(\<lambda>x. (if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)) absolutely_integrable_on UNIV"
     by (rule set_integral_add)
   then have "(\<lambda>x. ((if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)) - (if x \<in> ?ST then f x else 0)) absolutely_integrable_on UNIV"
     using Int by (rule set_integral_diff)
   then have "(\<lambda>x. if x \<in> S \<union> T then f x else 0) absolutely_integrable_on UNIV"
     by (rule absolutely_integrable_spike) (auto intro: empty_imp_negligible)
   then show ?thesis
     unfolding absolutely_integrable_restrict_UNIV .
 qed
 
 lemma absolutely_integrable_on_combine:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "f absolutely_integrable_on {a..c}"
     and "f absolutely_integrable_on {c..b}"
     and "a \<le> c"
     and "c \<le> b"
   shows "f absolutely_integrable_on {a..b}"
   by (metis absolutely_integrable_Un assms ivl_disj_un_two_touch(4))
 
 lemma uniform_limit_set_lebesgue_integral_at_top:
   fixes f :: "'a \<Rightarrow> real \<Rightarrow> 'b::{banach, second_countable_topology}"
     and g :: "real \<Rightarrow> real"
   assumes bound: "\<And>x y. x \<in> A \<Longrightarrow> y \<ge> a \<Longrightarrow> norm (f x y) \<le> g y"
   assumes integrable: "set_integrable M {a..} g"
   assumes measurable: "\<And>x. x \<in> A \<Longrightarrow> set_borel_measurable M {a..} (f x)"
   assumes "sets borel \<subseteq> sets M"
   shows   "uniform_limit A (\<lambda>b x. LINT y:{a..b}|M. f x y) (\<lambda>x. LINT y:{a..}|M. f x y) at_top"
 proof (cases "A = {}")
   case False
   then obtain x where x: "x \<in> A" by auto
   have g_nonneg: "g y \<ge> 0" if "y \<ge> a" for y
   proof -
     have "0 \<le> norm (f x y)" by simp
     also have "\<dots> \<le> g y" using bound[OF x that] by simp
     finally show ?thesis .
   qed
 
   have integrable': "set_integrable M {a..} (\<lambda>y. f x y)" if "x \<in> A" for x
     unfolding set_integrable_def
   proof (rule Bochner_Integration.integrable_bound)
     show "integrable M (\<lambda>x. indicator {a..} x * g x)"
       using integrable by (simp add: set_integrable_def)
     show "(\<lambda>y. indicat_real {a..} y *\<^sub>R f x y) \<in> borel_measurable M" using measurable[OF that]
       by (simp add: set_borel_measurable_def)
     show "AE y in M. norm (indicat_real {a..} y *\<^sub>R f x y) \<le> norm (indicat_real {a..} y * g y)"
       using bound[OF that] by (intro AE_I2) (auto simp: indicator_def g_nonneg)
   qed
 
   show ?thesis
   proof (rule uniform_limitI)
     fix e :: real assume e: "e > 0"
     have sets [intro]: "A \<in> sets M" if "A \<in> sets borel" for A
       using that assms by blast
 
     have "((\<lambda>b. LINT y:{a..b}|M. g y) \<longlongrightarrow> (LINT y:{a..}|M. g y)) at_top"
       by (intro tendsto_set_lebesgue_integral_at_top assms sets) auto
     with e obtain b0 :: real where b0: "\<forall>b\<ge>b0. \<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
       by (auto simp: tendsto_iff eventually_at_top_linorder dist_real_def abs_minus_commute)
     define b where "b = max a b0"
     have "a \<le> b" by (simp add: b_def)
     from b0 have "\<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
       by (auto simp: b_def)
     also have "{a..} = {a..b} \<union> {b<..}" by (auto simp: b_def)
     also have "\<bar>(LINT y:\<dots>|M. g y) - (LINT y:{a..b}|M. g y)\<bar> = \<bar>(LINT y:{b<..}|M. g y)\<bar>"
       using \<open>a \<le> b\<close> by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable])
     also have "(LINT y:{b<..}|M. g y) \<ge> 0"
       using g_nonneg \<open>a \<le> b\<close> unfolding set_lebesgue_integral_def
       by (intro Bochner_Integration.integral_nonneg) (auto simp: indicator_def)
     hence "\<bar>(LINT y:{b<..}|M. g y)\<bar> = (LINT y:{b<..}|M. g y)" by simp
     finally have less: "(LINT y:{b<..}|M. g y) < e" .
 
     have "eventually (\<lambda>b. b \<ge> b0) at_top" by (rule eventually_ge_at_top)
     moreover have "eventually (\<lambda>b. b \<ge> a) at_top" by (rule eventually_ge_at_top)
     ultimately show "eventually (\<lambda>b. \<forall>x\<in>A.
                        dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) < e) at_top"
     proof eventually_elim
       case (elim b)
       show ?case
       proof
         fix x assume x: "x \<in> A"
         have "dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) =
                 norm ((LINT y:{a..}|M. f x y) - (LINT y:{a..b}|M. f x y))"
           by (simp add: dist_norm norm_minus_commute)
         also have "{a..} = {a..b} \<union> {b<..}" using elim by auto
         also have "(LINT y:\<dots>|M. f x y) - (LINT y:{a..b}|M. f x y) = (LINT y:{b<..}|M. f x y)"
           using elim x
           by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable'])
         also have "norm \<dots> \<le> (LINT y:{b<..}|M. norm (f x y))" using elim x
           by (intro set_integral_norm_bound set_integrable_subset[OF integrable']) auto
         also have "\<dots> \<le> (LINT y:{b<..}|M. g y)" using elim x bound g_nonneg
           by (intro set_integral_mono set_integrable_norm set_integrable_subset[OF integrable']
                     set_integrable_subset[OF integrable]) auto
         also have "(LINT y:{b<..}|M. g y) \<ge> 0"
           using g_nonneg \<open>a \<le> b\<close> unfolding set_lebesgue_integral_def
           by (intro Bochner_Integration.integral_nonneg) (auto simp: indicator_def)
         hence "(LINT y:{b<..}|M. g y) = \<bar>(LINT y:{b<..}|M. g y)\<bar>" by simp
         also have "\<dots> = \<bar>(LINT y:{a..b} \<union> {b<..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar>"
           using elim by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable])
         also have "{a..b} \<union> {b<..} = {a..}" using elim by auto
         also have "\<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
           using b0 elim by blast
         finally show "dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) < e" .
       qed
     qed
   qed
 qed auto
 
 
 
 subsubsection\<open>Differentiability of inverse function (most basic form)\<close>
 
 proposition has_derivative_inverse_within:
   fixes f :: "'a::real_normed_vector \<Rightarrow> 'b::euclidean_space"
   assumes der_f: "(f has_derivative f') (at a within S)"
     and cont_g: "continuous (at (f a) within f ` S) g"
     and "a \<in> S" "linear g'" and id: "g' \<circ> f' = id"
     and gf: "\<And>x. x \<in> S \<Longrightarrow> g(f x) = x"
   shows "(g has_derivative g') (at (f a) within f ` S)"
 proof -
   have [simp]: "g' (f' x) = x" for x
     by (simp add: local.id pointfree_idE)
   have "bounded_linear f'"
     and f': "\<And>e. e>0 \<Longrightarrow> \<exists>d>0. \<forall>y\<in>S. norm (y - a) < d \<longrightarrow>
                         norm (f y - f a - f' (y - a)) \<le> e * norm (y - a)"
     using der_f by (auto simp: has_derivative_within_alt)
   obtain C where "C > 0" and C: "\<And>x. norm (g' x) \<le> C * norm x"
     using linear_bounded_pos [OF \<open>linear g'\<close>] by metis
   obtain B k where "B > 0" "k > 0"
     and Bk: "\<And>x. \<lbrakk>x \<in> S; norm(f x - f a) < k\<rbrakk> \<Longrightarrow> norm(x - a) \<le> B * norm(f x - f a)"
   proof -
     obtain B where "B > 0" and B: "\<And>x. B * norm x \<le> norm (f' x)"
       using linear_inj_bounded_below_pos [of f'] \<open>linear g'\<close> id der_f has_derivative_linear
         linear_invertible_bounded_below_pos by blast
     then obtain d where "d>0"
       and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - a) < d\<rbrakk> \<Longrightarrow>
                     norm (f y - f a - f' (y - a)) \<le> B / 2 * norm (y - a)"
       using f' [of "B/2"] by auto
     then obtain e where "e > 0"
       and e: "\<And>x. \<lbrakk>x \<in> S; norm (f x - f a) < e\<rbrakk> \<Longrightarrow> norm (g (f x) - g (f a)) < d"
       using cont_g by (auto simp: continuous_within_eps_delta dist_norm)
     show thesis
     proof
       show "2/B > 0"
         using \<open>B > 0\<close> by simp
       show "norm (x - a) \<le> 2 / B * norm (f x - f a)"
         if "x \<in> S" "norm (f x - f a) < e" for x
       proof -
         have xa: "norm (x - a) < d"
           using e [OF that] gf by (simp add: \<open>a \<in> S\<close> that)
         have *: "\<lbrakk>norm(y - f') \<le> B / 2 * norm x; B * norm x \<le> norm f'\<rbrakk>
                  \<Longrightarrow> norm y \<ge> B / 2 * norm x" for y f'::'b and x::'a
           using norm_triangle_ineq3 [of y f'] by linarith
         show ?thesis
           using * [OF d [OF \<open>x \<in> S\<close> xa] B] \<open>B > 0\<close> by (simp add: field_simps)
       qed
     qed (use \<open>e > 0\<close> in auto)
   qed
   show ?thesis
     unfolding has_derivative_within_alt
   proof (intro conjI impI allI)
     show "bounded_linear g'"
       using \<open>linear g'\<close> by (simp add: linear_linear)
   next
     fix e :: "real"
     assume "e > 0"
     then obtain d where "d>0"
       and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - a) < d\<rbrakk> \<Longrightarrow>
                     norm (f y - f a - f' (y - a)) \<le> e / (B * C) * norm (y - a)"
       using f' [of "e / (B * C)"] \<open>B > 0\<close> \<open>C > 0\<close> by auto
     have "norm (x - a - g' (f x - f a)) \<le> e * norm (f x - f a)"
       if "x \<in> S" and lt_k: "norm (f x - f a) < k" and lt_dB: "norm (f x - f a) < d/B" for x
     proof -
       have "norm (x - a) \<le> B * norm(f x - f a)"
         using Bk lt_k \<open>x \<in> S\<close> by blast
       also have "\<dots> < d"
         by (metis \<open>0 < B\<close> lt_dB mult.commute pos_less_divide_eq)
       finally have lt_d: "norm (x - a) < d" .
       have "norm (x - a - g' (f x - f a)) \<le> norm(g'(f x - f a - (f' (x - a))))"
         by (simp add: linear_diff [OF \<open>linear g'\<close>] norm_minus_commute)
       also have "\<dots> \<le> C * norm (f x - f a - f' (x - a))"
         using C by blast
       also have "\<dots> \<le> e * norm (f x - f a)"
       proof -
         have "norm (f x - f a - f' (x - a)) \<le> e / (B * C) * norm (x - a)"
           using d [OF \<open>x \<in> S\<close> lt_d] .
         also have "\<dots> \<le> (norm (f x - f a) * e) / C"
           using \<open>B > 0\<close> \<open>C > 0\<close> \<open>e > 0\<close> by (simp add: field_simps Bk lt_k \<open>x \<in> S\<close>)
         finally show ?thesis
           using \<open>C > 0\<close> by (simp add: field_simps)
       qed
     finally show ?thesis .
     qed
     with \<open>k > 0\<close> \<open>B > 0\<close> \<open>d > 0\<close> \<open>a \<in> S\<close> 
     show "\<exists>d>0. \<forall>y\<in>f ` S.
                norm (y - f a) < d \<longrightarrow>
                norm (g y - g (f a) - g' (y - f a)) \<le> e * norm (y - f a)"
       by (rule_tac x="min k (d / B)" in exI) (auto simp: gf)
   qed
 qed
 
 end
diff --git a/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy b/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
--- a/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
+++ b/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
@@ -1,7606 +1,7645 @@
 (*  Author:     John Harrison
     Author:     Robert Himmelmann, TU Muenchen (Translation from HOL light)
                 Huge cleanup by LCP
 *)
 
 section \<open>Henstock-Kurzweil Gauge Integration in Many Dimensions\<close>
 
 theory Henstock_Kurzweil_Integration
 imports
   Lebesgue_Measure Tagged_Division
 begin
 
 lemma norm_diff2: "\<lbrakk>y = y1 + y2; x = x1 + x2; e = e1 + e2; norm(y1 - x1) \<le> e1; norm(y2 - x2) \<le> e2\<rbrakk>
   \<Longrightarrow> norm(y-x) \<le> e"
   using norm_triangle_mono [of "y1 - x1" "e1" "y2 - x2" "e2"]
   by (simp add: add_diff_add)
 
 lemma setcomp_dot1: "{z. P (z \<bullet> (i,0))} = {(x,y). P(x \<bullet> i)}"
   by auto
 
 lemma setcomp_dot2: "{z. P (z \<bullet> (0,i))} = {(x,y). P(y \<bullet> i)}"
   by auto
 
 lemma Sigma_Int_Paircomp1: "(Sigma A B) \<inter> {(x, y). P x} = Sigma (A \<inter> {x. P x}) B"
   by blast
 
 lemma Sigma_Int_Paircomp2: "(Sigma A B) \<inter> {(x, y). P y} = Sigma A (\<lambda>z. B z \<inter> {y. P y})"
   by blast
 (* END MOVE *)
 
 subsection \<open>Content (length, area, volume...) of an interval\<close>
 
 abbreviation content :: "'a::euclidean_space set \<Rightarrow> real"
   where "content s \<equiv> measure lborel s"
 
 lemma content_cbox_cases:
   "content (cbox a b) = (if \<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i then prod (\<lambda>i. b\<bullet>i - a\<bullet>i) Basis else 0)"
   by (simp add: measure_lborel_cbox_eq inner_diff)
 
 lemma content_cbox: "\<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i \<Longrightarrow> content (cbox a b) = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   unfolding content_cbox_cases by simp
 
 lemma content_cbox': "cbox a b \<noteq> {} \<Longrightarrow> content (cbox a b) = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   by (simp add: box_ne_empty inner_diff)
 
 lemma content_cbox_if: "content (cbox a b) = (if cbox a b = {} then 0 else \<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   by (simp add: content_cbox')
 
 lemma content_cbox_cart:
    "cbox a b \<noteq> {} \<Longrightarrow> content(cbox a b) = prod (\<lambda>i. b$i - a$i) UNIV"
   by (simp add: content_cbox_if Basis_vec_def cart_eq_inner_axis axis_eq_axis prod.UNION_disjoint)
 
 lemma content_cbox_if_cart:
    "content(cbox a b) = (if cbox a b = {} then 0 else prod (\<lambda>i. b$i - a$i) UNIV)"
   by (simp add: content_cbox_cart)
 
 lemma content_division_of:
   assumes "K \<in> \<D>" "\<D> division_of S"
   shows "content K = (\<Prod>i \<in> Basis. interval_upperbound K \<bullet> i - interval_lowerbound K \<bullet> i)"
 proof -
   obtain a b where "K = cbox a b"
     using cbox_division_memE assms by metis
   then show ?thesis
     using assms by (force simp: division_of_def content_cbox')
 qed
 
 lemma content_real: "a \<le> b \<Longrightarrow> content {a..b} = b - a"
   by simp
 
 lemma abs_eq_content: "\<bar>y - x\<bar> = (if x\<le>y then content {x..y} else content {y..x})"
   by (auto simp: content_real)
 
 lemma content_singleton: "content {a} = 0"
   by simp
 
 lemma content_unit[iff]: "content (cbox 0 (One::'a::euclidean_space)) = 1"
   by simp
 
 lemma content_pos_le [iff]: "0 \<le> content X"
   by simp
 
 corollary\<^marker>\<open>tag unimportant\<close> content_nonneg [simp]: "\<not> content (cbox a b) < 0"
   using not_le by blast
 
 lemma content_pos_lt: "\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i \<Longrightarrow> 0 < content (cbox a b)"
   by (auto simp: less_imp_le inner_diff box_eq_empty intro!: prod_pos)
 
 lemma content_eq_0: "content (cbox a b) = 0 \<longleftrightarrow> (\<exists>i\<in>Basis. b\<bullet>i \<le> a\<bullet>i)"
   by (auto simp: content_cbox_cases not_le intro: less_imp_le antisym eq_refl)
 
 lemma content_eq_0_interior: "content (cbox a b) = 0 \<longleftrightarrow> interior(cbox a b) = {}"
   unfolding content_eq_0 interior_cbox box_eq_empty by auto
 
 lemma content_pos_lt_eq: "0 < content (cbox a (b::'a::euclidean_space)) \<longleftrightarrow> (\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i)"
   by (auto simp add: content_cbox_cases less_le prod_nonneg)
 
 lemma content_empty [simp]: "content {} = 0"
   by simp
 
 lemma content_real_if [simp]: "content {a..b} = (if a \<le> b then b - a else 0)"
   by (simp add: content_real)
 
 lemma content_subset: "cbox a b \<subseteq> cbox c d \<Longrightarrow> content (cbox a b) \<le> content (cbox c d)"
   unfolding measure_def
   by (intro enn2real_mono emeasure_mono) (auto simp: emeasure_lborel_cbox_eq)
 
 lemma content_lt_nz: "0 < content (cbox a b) \<longleftrightarrow> content (cbox a b) \<noteq> 0"
   unfolding content_pos_lt_eq content_eq_0 unfolding not_ex not_le by fastforce
 
 lemma content_Pair: "content (cbox (a,c) (b,d)) = content (cbox a b) * content (cbox c d)"
   unfolding measure_lborel_cbox_eq Basis_prod_def
   apply (subst prod.union_disjoint)
   apply (auto simp: bex_Un ball_Un)
   apply (subst (1 2) prod.reindex_nontrivial)
   apply auto
   done
 
 lemma content_cbox_pair_eq0_D:
    "content (cbox (a,c) (b,d)) = 0 \<Longrightarrow> content (cbox a b) = 0 \<or> content (cbox c d) = 0"
   by (simp add: content_Pair)
 
 lemma content_cbox_plus:
   fixes x :: "'a::euclidean_space"
   shows "content(cbox x (x + h *\<^sub>R One)) = (if h \<ge> 0 then h ^ DIM('a) else 0)"
   by (simp add: algebra_simps content_cbox_if box_eq_empty)
 
 lemma content_0_subset: "content(cbox a b) = 0 \<Longrightarrow> s \<subseteq> cbox a b \<Longrightarrow> content s = 0"
   using emeasure_mono[of s "cbox a b" lborel]
   by (auto simp: measure_def enn2real_eq_0_iff emeasure_lborel_cbox_eq)
 
 lemma content_ball_pos:
   assumes "r > 0"
   shows   "content (ball c r) > 0"
 proof -
   from rational_boxes[OF assms, of c] obtain a b where ab: "c \<in> box a b" "box a b \<subseteq> ball c r"
     by auto
   from ab have "0 < content (box a b)"
     by (subst measure_lborel_box_eq) (auto intro!: prod_pos simp: algebra_simps box_def)
   have "emeasure lborel (box a b) \<le> emeasure lborel (ball c r)"
     using ab by (intro emeasure_mono) auto
   also have "emeasure lborel (box a b) = ennreal (content (box a b))"
     using emeasure_lborel_box_finite[of a b] by (intro emeasure_eq_ennreal_measure) auto
   also have "emeasure lborel (ball c r) = ennreal (content (ball c r))"
     using emeasure_lborel_ball_finite[of c r] by (intro emeasure_eq_ennreal_measure) auto
   finally show ?thesis
     using \<open>content (box a b) > 0\<close> by simp
 qed
 
 lemma content_cball_pos:
   assumes "r > 0"
   shows   "content (cball c r) > 0"
 proof -
   from rational_boxes[OF assms, of c] obtain a b where ab: "c \<in> box a b" "box a b \<subseteq> ball c r"
     by auto
   from ab have "0 < content (box a b)"
     by (subst measure_lborel_box_eq) (auto intro!: prod_pos simp: algebra_simps box_def)
   have "emeasure lborel (box a b) \<le> emeasure lborel (ball c r)"
     using ab by (intro emeasure_mono) auto
   also have "\<dots> \<le> emeasure lborel (cball c r)"
     by (intro emeasure_mono) auto
   also have "emeasure lborel (box a b) = ennreal (content (box a b))"
     using emeasure_lborel_box_finite[of a b] by (intro emeasure_eq_ennreal_measure) auto
   also have "emeasure lborel (cball c r) = ennreal (content (cball c r))"
     using emeasure_lborel_cball_finite[of c r] by (intro emeasure_eq_ennreal_measure) auto
   finally show ?thesis
     using \<open>content (box a b) > 0\<close> by simp
 qed
 
 lemma content_split:
   fixes a :: "'a::euclidean_space"
   assumes "k \<in> Basis"
   shows "content (cbox a b) = content(cbox a b \<inter> {x. x\<bullet>k \<le> c}) + content(cbox a b \<inter> {x. x\<bullet>k \<ge> c})"
   \<comment> \<open>Prove using measure theory\<close>
 proof (cases "\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i")
   case True
   have 1: "\<And>X Y Z. (\<Prod>i\<in>Basis. Z i (if i = k then X else Y i)) = Z k X * (\<Prod>i\<in>Basis-{k}. Z i (Y i))"
     by (simp add: if_distrib prod.delta_remove assms)
   note simps = interval_split[OF assms] content_cbox_cases
   have 2: "(\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i) = (\<Prod>i\<in>Basis-{k}. b\<bullet>i - a\<bullet>i) * (b\<bullet>k - a\<bullet>k)"
     by (metis (no_types, lifting) assms finite_Basis mult.commute prod.remove)
   have "\<And>x. min (b \<bullet> k) c = max (a \<bullet> k) c \<Longrightarrow>
     x * (b\<bullet>k - a\<bullet>k) = x * (max (a \<bullet> k) c - a \<bullet> k) + x * (b \<bullet> k - max (a \<bullet> k) c)"
     by  (auto simp add: field_simps)
   moreover
   have **: "(\<Prod>i\<in>Basis. ((\<Sum>i\<in>Basis. (if i = k then min (b \<bullet> k) c else b \<bullet> i) *\<^sub>R i) \<bullet> i - a \<bullet> i)) =
       (\<Prod>i\<in>Basis. (if i = k then min (b \<bullet> k) c else b \<bullet> i) - a \<bullet> i)"
     "(\<Prod>i\<in>Basis. b \<bullet> i - ((\<Sum>i\<in>Basis. (if i = k then max (a \<bullet> k) c else a \<bullet> i) *\<^sub>R i) \<bullet> i)) =
       (\<Prod>i\<in>Basis. b \<bullet> i - (if i = k then max (a \<bullet> k) c else a \<bullet> i))"
     by (auto intro!: prod.cong)
   have "\<not> a \<bullet> k \<le> c \<Longrightarrow> \<not> c \<le> b \<bullet> k \<Longrightarrow> False"
     unfolding not_le using True assms by auto
   ultimately show ?thesis
     using assms unfolding simps ** 1[of "\<lambda>i x. b\<bullet>i - x"] 1[of "\<lambda>i x. x - a\<bullet>i"] 2
     by auto
 next
   case False
   then have "cbox a b = {}"
     unfolding box_eq_empty by (auto simp: not_le)
   then show ?thesis
     by (auto simp: not_le)
 qed
 
 lemma division_of_content_0:
   assumes "content (cbox a b) = 0" "d division_of (cbox a b)" "K \<in> d"
   shows "content K = 0"
   unfolding forall_in_division[OF assms(2)]
   by (meson assms content_0_subset division_of_def)
 
 lemma sum_content_null:
   assumes "content (cbox a b) = 0"
     and "p tagged_division_of (cbox a b)"
   shows "(\<Sum>(x,K)\<in>p. content K *\<^sub>R f x) = (0::'a::real_normed_vector)"
 proof (rule sum.neutral, rule)
   fix y
   assume y: "y \<in> p"
   obtain x K where xk: "y = (x, K)"
     using surj_pair[of y] by blast
   then obtain c d where k: "K = cbox c d" "K \<subseteq> cbox a b"
     by (metis assms(2) tagged_division_ofD(3) tagged_division_ofD(4) y)
   have "(\<lambda>(x',K'). content K' *\<^sub>R f x') y = content K *\<^sub>R f x"
     unfolding xk by auto
   also have "\<dots> = 0"
     using assms(1) content_0_subset k(2) by auto
   finally show "(\<lambda>(x, k). content k *\<^sub>R f x) y = 0" .
 qed
 
 global_interpretation sum_content: operative plus 0 content
   rewrites "comm_monoid_set.F plus 0 = sum"
 proof -
   interpret operative plus 0 content
     by standard (auto simp add: content_split [symmetric] content_eq_0_interior)
   show "operative plus 0 content"
     by standard
   show "comm_monoid_set.F plus 0 = sum"
     by (simp add: sum_def)
 qed
 
 lemma additive_content_division: "d division_of (cbox a b) \<Longrightarrow> sum content d = content (cbox a b)"
   by (fact sum_content.division)
 
 lemma additive_content_tagged_division:
   "d tagged_division_of (cbox a b) \<Longrightarrow> sum (\<lambda>(x,l). content l) d = content (cbox a b)"
   by (fact sum_content.tagged_division)
 
 lemma subadditive_content_division:
   assumes "\<D> division_of S" "S \<subseteq> cbox a b"
   shows "sum content \<D> \<le> content(cbox a b)"
 proof -
   have "\<D> division_of \<Union>\<D>" "\<Union>\<D> \<subseteq> cbox a b"
     using assms by auto
   then obtain \<D>' where "\<D> \<subseteq> \<D>'" "\<D>' division_of cbox a b"
     using partial_division_extend_interval by metis
   then have "sum content \<D> \<le> sum content \<D>'"
     using sum_mono2 by blast
   also have "... \<le> content(cbox a b)"
     by (simp add: \<open>\<D>' division_of cbox a b\<close> additive_content_division less_eq_real_def)
   finally show ?thesis .
 qed
 
 lemma content_real_eq_0: "content {a..b::real} = 0 \<longleftrightarrow> a \<ge> b"
   by (metis atLeastatMost_empty_iff2 content_empty content_real diff_self eq_iff le_cases le_iff_diff_le_0)
 
 lemma property_empty_interval: "\<forall>a b. content (cbox a b) = 0 \<longrightarrow> P (cbox a b) \<Longrightarrow> P {}"
   using content_empty unfolding empty_as_interval by auto
 
 lemma interval_bounds_nz_content [simp]:
   assumes "content (cbox a b) \<noteq> 0"
   shows "interval_upperbound (cbox a b) = b"
     and "interval_lowerbound (cbox a b) = a"
   by (metis assms content_empty interval_bounds')+
 
 subsection \<open>Gauge integral\<close>
 
 text \<open>Case distinction to define it first on compact intervals first, then use a limit. This is only
 much later unified. In Fremlin: Measure Theory, Volume 4I this is generalized using residual sets.\<close>
 
 definition has_integral :: "('n::euclidean_space \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'b \<Rightarrow> 'n set \<Rightarrow> bool"
   (infixr "has'_integral" 46)
   where "(f has_integral I) s \<longleftrightarrow>
     (if \<exists>a b. s = cbox a b
       then ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R f x) \<longlongrightarrow> I) (division_filter s)
       else (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
         (\<exists>z. ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R (if x \<in> s then f x else 0)) \<longlongrightarrow> z) (division_filter (cbox a b)) \<and>
           norm (z - I) < e)))"
 
 lemma has_integral_cbox:
   "(f has_integral I) (cbox a b) \<longleftrightarrow> ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R f x) \<longlongrightarrow> I) (division_filter (cbox a b))"
   by (auto simp add: has_integral_def)
 
 lemma has_integral:
   "(f has_integral y) (cbox a b) \<longleftrightarrow>
     (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
       (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
         norm (sum (\<lambda>(x,k). content(k) *\<^sub>R f x) \<D> - y) < e))"
   by (auto simp: dist_norm eventually_division_filter has_integral_def tendsto_iff)
 
 lemma has_integral_real:
   "(f has_integral y) {a..b::real} \<longleftrightarrow>
     (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
       (\<forall>\<D>. \<D> tagged_division_of {a..b} \<and> \<gamma> fine \<D> \<longrightarrow>
         norm (sum (\<lambda>(x,k). content(k) *\<^sub>R f x) \<D> - y) < e))"
   unfolding box_real[symmetric] by (rule has_integral)
 
 lemma has_integralD[dest]:
   assumes "(f has_integral y) (cbox a b)"
     and "e > 0"
   obtains \<gamma>
     where "gauge \<gamma>"
       and "\<And>\<D>. \<D> tagged_division_of (cbox a b) \<Longrightarrow> \<gamma> fine \<D> \<Longrightarrow>
         norm ((\<Sum>(x,k)\<in>\<D>. content k *\<^sub>R f x) - y) < e"
   using assms unfolding has_integral by auto
 
 lemma has_integral_alt:
   "(f has_integral y) i \<longleftrightarrow>
     (if \<exists>a b. i = cbox a b
      then (f has_integral y) i
      else (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> i then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e)))"
   by (subst has_integral_def) (auto simp add: has_integral_cbox)
 
 lemma has_integral_altD:
   assumes "(f has_integral y) i"
     and "\<not> (\<exists>a b. i = cbox a b)"
     and "e>0"
   obtains B where "B > 0"
     and "\<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> i then f(x) else 0) has_integral z) (cbox a b) \<and> norm(z - y) < e)"
   using assms has_integral_alt[of f y i] by auto
 
 definition integrable_on (infixr "integrable'_on" 46)
   where "f integrable_on i \<longleftrightarrow> (\<exists>y. (f has_integral y) i)"
 
 definition "integral i f = (SOME y. (f has_integral y) i \<or> \<not> f integrable_on i \<and> y=0)"
 
 lemma integrable_integral[intro]: "f integrable_on i \<Longrightarrow> (f has_integral (integral i f)) i"
   unfolding integrable_on_def integral_def by (metis (mono_tags, lifting) someI_ex)
 
 lemma not_integrable_integral: "\<not> f integrable_on i \<Longrightarrow> integral i f = 0"
   unfolding integrable_on_def integral_def by blast
 
 lemma has_integral_integrable[dest]: "(f has_integral i) s \<Longrightarrow> f integrable_on s"
   unfolding integrable_on_def by auto
 
 lemma has_integral_integral: "f integrable_on s \<longleftrightarrow> (f has_integral (integral s f)) s"
   by auto
 
 subsection \<open>Basic theorems about integrals\<close>
 
 lemma has_integral_eq_rhs: "(f has_integral j) S \<Longrightarrow> i = j \<Longrightarrow> (f has_integral i) S"
   by (rule forw_subst)
 
 lemma has_integral_unique_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   shows "(f has_integral k1) (cbox a b) \<Longrightarrow> (f has_integral k2) (cbox a b) \<Longrightarrow> k1 = k2"
     by (auto simp: has_integral_cbox intro: tendsto_unique[OF division_filter_not_empty])    
 
 lemma has_integral_unique:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral k1) i" "(f has_integral k2) i"
   shows "k1 = k2"
 proof (rule ccontr)
   let ?e = "norm (k1 - k2)/2"
   let ?F = "(\<lambda>x. if x \<in> i then f x else 0)"
   assume "k1 \<noteq> k2"
   then have e: "?e > 0"
     by auto
   have nonbox: "\<not> (\<exists>a b. i = cbox a b)"
     using \<open>k1 \<noteq> k2\<close> assms has_integral_unique_cbox by blast
   obtain B1 where B1:
       "0 < B1"
       "\<And>a b. ball 0 B1 \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?F has_integral z) (cbox a b) \<and> norm (z - k1) < norm (k1 - k2)/2"
     by (rule has_integral_altD[OF assms(1) nonbox,OF e]) blast
   obtain B2 where B2:
       "0 < B2"
       "\<And>a b. ball 0 B2 \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?F has_integral z) (cbox a b) \<and> norm (z - k2) < norm (k1 - k2)/2"
     by (rule has_integral_altD[OF assms(2) nonbox,OF e]) blast
   obtain a b :: 'n where ab: "ball 0 B1 \<subseteq> cbox a b" "ball 0 B2 \<subseteq> cbox a b"
     by (metis Un_subset_iff bounded_Un bounded_ball bounded_subset_cbox_symmetric)
   obtain w where w: "(?F has_integral w) (cbox a b)" "norm (w - k1) < norm (k1 - k2)/2"
     using B1(2)[OF ab(1)] by blast
   obtain z where z: "(?F has_integral z) (cbox a b)" "norm (z - k2) < norm (k1 - k2)/2"
     using B2(2)[OF ab(2)] by blast
   have "z = w"
     using has_integral_unique_cbox[OF w(1) z(1)] by auto
   then have "norm (k1 - k2) \<le> norm (z - k2) + norm (w - k1)"
     using norm_triangle_ineq4 [of "k1 - w" "k2 - z"]
     by (auto simp add: norm_minus_commute)
   also have "\<dots> < norm (k1 - k2)/2 + norm (k1 - k2)/2"
     by (metis add_strict_mono z(2) w(2))
   finally show False by auto
 qed
 
 lemma integral_unique [intro]: "(f has_integral y) k \<Longrightarrow> integral k f = y"
   unfolding integral_def
   by (rule some_equality) (auto intro: has_integral_unique)
 
 lemma has_integral_iff: "(f has_integral i) S \<longleftrightarrow> (f integrable_on S \<and> integral S f = i)"
   by blast
 
 lemma eq_integralD: "integral k f = y \<Longrightarrow> (f has_integral y) k \<or> \<not> f integrable_on k \<and> y=0"
   unfolding integral_def integrable_on_def
   apply (erule subst)
   apply (rule someI_ex)
   by blast
 
 lemma has_integral_const [intro]:
   fixes a b :: "'a::euclidean_space"
   shows "((\<lambda>x. c) has_integral (content (cbox a b) *\<^sub>R c)) (cbox a b)"
   using eventually_division_filter_tagged_division[of "cbox a b"]
      additive_content_tagged_division[of _ a b]
   by (auto simp: has_integral_cbox split_beta' scaleR_sum_left[symmetric]
            elim!: eventually_mono intro!: tendsto_cong[THEN iffD1, OF _ tendsto_const])
 
 lemma has_integral_const_real [intro]:
   fixes a b :: real
   shows "((\<lambda>x. c) has_integral (content {a..b} *\<^sub>R c)) {a..b}"
   by (metis box_real(2) has_integral_const)
 
 lemma has_integral_integrable_integral: "(f has_integral i) s \<longleftrightarrow> f integrable_on s \<and> integral s f = i"
   by blast
 
 lemma integral_const [simp]:
   fixes a b :: "'a::euclidean_space"
   shows "integral (cbox a b) (\<lambda>x. c) = content (cbox a b) *\<^sub>R c"
   by (rule integral_unique) (rule has_integral_const)
 
 lemma integral_const_real [simp]:
   fixes a b :: real
   shows "integral {a..b} (\<lambda>x. c) = content {a..b} *\<^sub>R c"
   by (metis box_real(2) integral_const)
 
 lemma has_integral_is_0_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "\<And>x. x \<in> cbox a b \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) (cbox a b)"
     unfolding has_integral_cbox
     using eventually_division_filter_tagged_division[of "cbox a b"] assms
     by (subst tendsto_cong[where g="\<lambda>_. 0"])
        (auto elim!: eventually_mono intro!: sum.neutral simp: tag_in_interval)
 
 lemma has_integral_is_0:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "\<And>x. x \<in> S \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) S"
 proof (cases "(\<exists>a b. S = cbox a b)")
   case True with assms has_integral_is_0_cbox show ?thesis
     by blast
 next
   case False
   have *: "(\<lambda>x. if x \<in> S then f x else 0) = (\<lambda>x. 0)"
     by (auto simp add: assms)
   show ?thesis
     using has_integral_is_0_cbox False
     by (subst has_integral_alt) (force simp add: *)
 qed
 
 lemma has_integral_0[simp]: "((\<lambda>x::'n::euclidean_space. 0) has_integral 0) S"
   by (rule has_integral_is_0) auto
 
 lemma has_integral_0_eq[simp]: "((\<lambda>x. 0) has_integral i) S \<longleftrightarrow> i = 0"
   using has_integral_unique[OF has_integral_0] by auto
 
 lemma has_integral_linear_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral y) (cbox a b)"
     and h: "bounded_linear h"
   shows "((h \<circ> f) has_integral (h y)) (cbox a b)"
 proof -
   interpret bounded_linear h using h .
   show ?thesis
     unfolding has_integral_cbox using tendsto [OF f [unfolded has_integral_cbox]]
     by (simp add: sum scaleR split_beta')
 qed
 
 lemma has_integral_linear:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral y) S"
     and h: "bounded_linear h"
   shows "((h \<circ> f) has_integral (h y)) S"
 proof (cases "(\<exists>a b. S = cbox a b)")
   case True with f h has_integral_linear_cbox show ?thesis 
     by blast
 next
   case False
   interpret bounded_linear h using h .
   from pos_bounded obtain B where B: "0 < B" "\<And>x. norm (h x) \<le> norm x * B"
     by blast
   let ?S = "\<lambda>f x. if x \<in> S then f x else 0"
   show ?thesis
   proof (subst has_integral_alt, clarsimp simp: False)
     fix e :: real
     assume e: "e > 0"
     have *: "0 < e/B" using e B(1) by simp
     obtain M where M:
       "M > 0"
       "\<And>a b. ball 0 M \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?S f has_integral z) (cbox a b) \<and> norm (z - y) < e/B"
       using has_integral_altD[OF f False *] by blast
     show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. (?S(h \<circ> f) has_integral z) (cbox a b) \<and> norm (z - h y) < e)"
     proof (rule exI, intro allI conjI impI)
       show "M > 0" using M by metis
     next
       fix a b::'n
       assume sb: "ball 0 M \<subseteq> cbox a b"
       obtain z where z: "(?S f has_integral z) (cbox a b)" "norm (z - y) < e/B"
         using M(2)[OF sb] by blast
       have *: "?S(h \<circ> f) = h \<circ> ?S f"
         using zero by auto
       show "\<exists>z. (?S(h \<circ> f) has_integral z) (cbox a b) \<and> norm (z - h y) < e"
       proof (intro exI conjI)
         show "(?S(h \<circ> f) has_integral h z) (cbox a b)"
           by (simp add: * has_integral_linear_cbox[OF z(1) h])
         show "norm (h z - h y) < e"
           by (metis B diff le_less_trans pos_less_divide_eq z(2))
       qed
     qed
   qed
 qed
 
 lemma has_integral_scaleR_left:
   "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x *\<^sub>R c) has_integral (y *\<^sub>R c)) S"
   using has_integral_linear[OF _ bounded_linear_scaleR_left] by (simp add: comp_def)
 
 lemma integrable_on_scaleR_left:
   assumes "f integrable_on A"
   shows "(\<lambda>x. f x *\<^sub>R y) integrable_on A"
   using assms has_integral_scaleR_left unfolding integrable_on_def by blast
 
 lemma has_integral_mult_left:
   fixes c :: "_ :: real_normed_algebra"
   shows "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x * c) has_integral (y * c)) S"
   using has_integral_linear[OF _ bounded_linear_mult_left] by (simp add: comp_def)
 
 lemma has_integral_divide:
   fixes c :: "_ :: real_normed_div_algebra"
   shows "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x / c) has_integral (y / c)) S"
   unfolding divide_inverse by (simp add: has_integral_mult_left)
 
 text\<open>The case analysis eliminates the condition \<^term>\<open>f integrable_on S\<close> at the cost
      of the type class constraint \<open>division_ring\<close>\<close>
 corollary integral_mult_left [simp]:
   fixes c:: "'a::{real_normed_algebra,division_ring}"
   shows "integral S (\<lambda>x. f x * c) = integral S f * c"
 proof (cases "f integrable_on S \<or> c = 0")
   case True then show ?thesis
     by (force intro: has_integral_mult_left)
 next
   case False then have "\<not> (\<lambda>x. f x * c) integrable_on S"
     using has_integral_mult_left [of "(\<lambda>x. f x * c)" _ S "inverse c"]
     by (auto simp add: mult.assoc)
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 corollary integral_mult_right [simp]:
   fixes c:: "'a::{real_normed_field}"
   shows "integral S (\<lambda>x. c * f x) = c * integral S f"
 by (simp add: mult.commute [of c])
 
 corollary integral_divide [simp]:
   fixes z :: "'a::real_normed_field"
   shows "integral S (\<lambda>x. f x / z) = integral S (\<lambda>x. f x) / z"
 using integral_mult_left [of S f "inverse z"]
   by (simp add: divide_inverse_commute)
 
 lemma has_integral_mult_right:
   fixes c :: "'a :: real_normed_algebra"
   shows "(f has_integral y) i \<Longrightarrow> ((\<lambda>x. c * f x) has_integral (c * y)) i"
   using has_integral_linear[OF _ bounded_linear_mult_right] by (simp add: comp_def)
 
 lemma has_integral_cmul: "(f has_integral k) S \<Longrightarrow> ((\<lambda>x. c *\<^sub>R f x) has_integral (c *\<^sub>R k)) S"
   unfolding o_def[symmetric]
   by (metis has_integral_linear bounded_linear_scaleR_right)
 
 lemma has_integral_cmult_real:
   fixes c :: real
   assumes "c \<noteq> 0 \<Longrightarrow> (f has_integral x) A"
   shows "((\<lambda>x. c * f x) has_integral c * x) A"
 proof (cases "c = 0")
   case True
   then show ?thesis by simp
 next
   case False
   from has_integral_cmul[OF assms[OF this], of c] show ?thesis
     unfolding real_scaleR_def .
 qed
 
 lemma has_integral_neg: "(f has_integral k) S \<Longrightarrow> ((\<lambda>x. -(f x)) has_integral -k) S"
   by (drule_tac c="-1" in has_integral_cmul) auto
 
 lemma has_integral_neg_iff: "((\<lambda>x. - f x) has_integral k) S \<longleftrightarrow> (f has_integral - k) S"
   using has_integral_neg[of f "- k"] has_integral_neg[of "\<lambda>x. - f x" k] by auto
 
 lemma has_integral_add_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral k) (cbox a b)" "(g has_integral l) (cbox a b)"
   shows "((\<lambda>x. f x + g x) has_integral (k + l)) (cbox a b)"
   using assms
     unfolding has_integral_cbox
     by (simp add: split_beta' scaleR_add_right sum.distrib[abs_def] tendsto_add)
 
 lemma has_integral_add:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral k) S" and g: "(g has_integral l) S"
   shows "((\<lambda>x. f x + g x) has_integral (k + l)) S"
 proof (cases "\<exists>a b. S = cbox a b")
   case True with has_integral_add_cbox assms show ?thesis
     by blast 
 next
   let ?S = "\<lambda>f x. if x \<in> S then f x else 0"
   case False
   then show ?thesis
   proof (subst has_integral_alt, clarsimp, goal_cases)
     case (1 e)
     then have e2: "e/2 > 0"
       by auto
     obtain Bf where "0 < Bf"
       and Bf: "\<And>a b. ball 0 Bf \<subseteq> cbox a b \<Longrightarrow>
                      \<exists>z. (?S f has_integral z) (cbox a b) \<and> norm (z - k) < e/2"
       using has_integral_altD[OF f False e2] by blast
     obtain Bg where "0 < Bg"
       and Bg: "\<And>a b. ball 0 Bg \<subseteq> (cbox a b) \<Longrightarrow>
                      \<exists>z. (?S g has_integral z) (cbox a b) \<and> norm (z - l) < e/2"
       using has_integral_altD[OF g False e2] by blast
     show ?case
     proof (rule_tac x="max Bf Bg" in exI, clarsimp simp add: max.strict_coboundedI1 \<open>0 < Bf\<close>)
       fix a b
       assume "ball 0 (max Bf Bg) \<subseteq> cbox a (b::'n)"
       then have fs: "ball 0 Bf \<subseteq> cbox a (b::'n)" and gs: "ball 0 Bg \<subseteq> cbox a (b::'n)"
         by auto
       obtain w where w: "(?S f has_integral w) (cbox a b)" "norm (w - k) < e/2"
         using Bf[OF fs] by blast
       obtain z where z: "(?S g has_integral z) (cbox a b)" "norm (z - l) < e/2"
         using Bg[OF gs] by blast
       have *: "\<And>x. (if x \<in> S then f x + g x else 0) = (?S f x) + (?S g x)"
         by auto
       show "\<exists>z. (?S(\<lambda>x. f x + g x) has_integral z) (cbox a b) \<and> norm (z - (k + l)) < e"
       proof (intro exI conjI)
         show "(?S(\<lambda>x. f x + g x) has_integral (w + z)) (cbox a b)"
           by (simp add: has_integral_add_cbox[OF w(1) z(1), unfolded *[symmetric]])
         show "norm (w + z - (k + l)) < e"
           by (metis dist_norm dist_triangle_add_half w(2) z(2))
       qed
     qed
   qed
 qed
 
 lemma has_integral_diff:
   "(f has_integral k) S \<Longrightarrow> (g has_integral l) S \<Longrightarrow>
     ((\<lambda>x. f x - g x) has_integral (k - l)) S"
   using has_integral_add[OF _ has_integral_neg, of f k S g l]
   by (auto simp: algebra_simps)
 
 lemma integral_0 [simp]:
   "integral S (\<lambda>x::'n::euclidean_space. 0::'m::real_normed_vector) = 0"
   by (rule integral_unique has_integral_0)+
 
 lemma integral_add: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow>
     integral S (\<lambda>x. f x + g x) = integral S f + integral S g"
   by (rule integral_unique) (metis integrable_integral has_integral_add)
 
 lemma integral_cmul [simp]: "integral S (\<lambda>x. c *\<^sub>R f x) = c *\<^sub>R integral S f"
 proof (cases "f integrable_on S \<or> c = 0")
   case True with has_integral_cmul integrable_integral show ?thesis
     by fastforce
 next
   case False then have "\<not> (\<lambda>x. c *\<^sub>R f x) integrable_on S"
     using has_integral_cmul [of "(\<lambda>x. c *\<^sub>R f x)" _ S "inverse c"] by auto
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma integral_mult:
   fixes K::real
   shows "f integrable_on X \<Longrightarrow> K * integral X f = integral X (\<lambda>x. K * f x)"
   unfolding real_scaleR_def[symmetric] integral_cmul ..
 
 lemma integral_neg [simp]: "integral S (\<lambda>x. - f x) = - integral S f"
 proof (cases "f integrable_on S")
   case True then show ?thesis
     by (simp add: has_integral_neg integrable_integral integral_unique)
 next
   case False then have "\<not> (\<lambda>x. - f x) integrable_on S"
     using has_integral_neg [of "(\<lambda>x. - f x)" _ S ] by auto
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma integral_diff: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow>
     integral S (\<lambda>x. f x - g x) = integral S f - integral S g"
   by (rule integral_unique) (metis integrable_integral has_integral_diff)
 
 lemma integrable_0: "(\<lambda>x. 0) integrable_on S"
   unfolding integrable_on_def using has_integral_0 by auto
 
 lemma integrable_add: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow> (\<lambda>x. f x + g x) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_add)
 
 lemma integrable_cmul: "f integrable_on S \<Longrightarrow> (\<lambda>x. c *\<^sub>R f(x)) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_cmul)
 
 lemma integrable_on_scaleR_iff [simp]:
   fixes c :: real
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. c *\<^sub>R f x) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_cmul[of "\<lambda>x. c *\<^sub>R f x" S "1 / c"] integrable_cmul[of f S c] \<open>c \<noteq> 0\<close>
   by auto
 
 lemma integrable_on_cmult_iff [simp]:
   fixes c :: real
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. c * f x) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_on_scaleR_iff [of c f] assms by simp
 
 lemma integrable_on_cmult_left:
   assumes "f integrable_on S"
   shows "(\<lambda>x. of_real c * f x) integrable_on S"
     using integrable_cmul[of f S "of_real c"] assms
     by (simp add: scaleR_conv_of_real)
 
 lemma integrable_neg: "f integrable_on S \<Longrightarrow> (\<lambda>x. -f(x)) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_neg)
 
 lemma integrable_neg_iff: "(\<lambda>x. -f(x)) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_neg by fastforce
 
 lemma integrable_diff:
   "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow> (\<lambda>x. f x - g x) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_diff)
 
 lemma integrable_linear:
   "f integrable_on S \<Longrightarrow> bounded_linear h \<Longrightarrow> (h \<circ> f) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_linear)
 
 lemma integral_linear:
   "f integrable_on S \<Longrightarrow> bounded_linear h \<Longrightarrow> integral S (h \<circ> f) = h (integral S f)"
   by (meson has_integral_iff has_integral_linear)
 
 lemma integrable_on_cnj_iff:
   "(\<lambda>x. cnj (f x)) integrable_on A \<longleftrightarrow> f integrable_on A"
   using integrable_linear[OF _ bounded_linear_cnj, of f A]
         integrable_linear[OF _ bounded_linear_cnj, of "cnj \<circ> f" A]
   by (auto simp: o_def)
 
 lemma integral_cnj: "cnj (integral A f) = integral A (\<lambda>x. cnj (f x))"
   by (cases "f integrable_on A")
      (simp_all add: integral_linear[OF _ bounded_linear_cnj, symmetric]
                     o_def integrable_on_cnj_iff not_integrable_integral)
 
 lemma integral_component_eq[simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f integrable_on S"
   shows "integral S (\<lambda>x. f x \<bullet> k) = integral S f \<bullet> k"
   unfolding integral_linear[OF assms(1) bounded_linear_inner_left,unfolded o_def] ..
 
 lemma has_integral_sum:
   assumes "finite T"
     and "\<And>a. a \<in> T \<Longrightarrow> ((f a) has_integral (i a)) S"
   shows "((\<lambda>x. sum (\<lambda>a. f a x) T) has_integral (sum i T)) S"
   using assms(1) subset_refl[of T]
 proof (induct rule: finite_subset_induct)
   case empty
   then show ?case by auto
 next
   case (insert x F)
   with assms show ?case
     by (simp add: has_integral_add)
 qed
 
 lemma integral_sum:
   "\<lbrakk>finite I;  \<And>a. a \<in> I \<Longrightarrow> f a integrable_on S\<rbrakk> \<Longrightarrow>
    integral S (\<lambda>x. \<Sum>a\<in>I. f a x) = (\<Sum>a\<in>I. integral S (f a))"
   by (simp add: has_integral_sum integrable_integral integral_unique)
 
 lemma integrable_sum:
   "\<lbrakk>finite I;  \<And>a. a \<in> I \<Longrightarrow> f a integrable_on S\<rbrakk> \<Longrightarrow> (\<lambda>x. \<Sum>a\<in>I. f a x) integrable_on S"
   unfolding integrable_on_def using has_integral_sum[of I] by metis
 
 lemma has_integral_eq:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
     and "(f has_integral k) s"
   shows "(g has_integral k) s"
   using has_integral_diff[OF assms(2), of "\<lambda>x. f x - g x" 0]
   using has_integral_is_0[of s "\<lambda>x. f x - g x"]
   using assms(1)
   by auto
 
 lemma integrable_eq: "\<lbrakk>f integrable_on s; \<And>x. x \<in> s \<Longrightarrow> f x = g x\<rbrakk> \<Longrightarrow> g integrable_on s"
   unfolding integrable_on_def
   using has_integral_eq[of s f g] has_integral_eq by blast
 
 lemma has_integral_cong:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
   shows "(f has_integral i) s = (g has_integral i) s"
   using has_integral_eq[of s f g] has_integral_eq[of s g f] assms
   by auto
 
+lemma integrable_cong:
+  assumes "\<And>x. x \<in> A \<Longrightarrow> f x = g x"
+  shows   "f integrable_on A \<longleftrightarrow> g integrable_on A"
+  using has_integral_cong [OF assms] by fast
+
 lemma integral_cong:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
   shows "integral s f = integral s g"
   unfolding integral_def
 by (metis (full_types, opaque_lifting) assms has_integral_cong integrable_eq)
 
 lemma integrable_on_cmult_left_iff [simp]:
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. of_real c * f x) integrable_on s \<longleftrightarrow> f integrable_on s"
         (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then have "(\<lambda>x. of_real (1 / c) * (of_real c * f x)) integrable_on s"
     using integrable_cmul[of "\<lambda>x. of_real c * f x" s "1 / of_real c"]
     by (simp add: scaleR_conv_of_real)
   then have "(\<lambda>x. (of_real (1 / c) * of_real c * f x)) integrable_on s"
     by (simp add: algebra_simps)
   with \<open>c \<noteq> 0\<close> show ?rhs
     by (metis (no_types, lifting) integrable_eq mult.left_neutral nonzero_divide_eq_eq of_real_1 of_real_mult)
 qed (blast intro: integrable_on_cmult_left)
 
 lemma integrable_on_cmult_right:
   fixes f :: "_ \<Rightarrow> 'b :: {comm_ring,real_algebra_1,real_normed_vector}"
   assumes "f integrable_on s"
   shows "(\<lambda>x. f x * of_real c) integrable_on s"
 using integrable_on_cmult_left [OF assms] by (simp add: mult.commute)
 
 lemma integrable_on_cmult_right_iff [simp]:
   fixes f :: "_ \<Rightarrow> 'b :: {comm_ring,real_algebra_1,real_normed_vector}"
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. f x * of_real c) integrable_on s \<longleftrightarrow> f integrable_on s"
 using integrable_on_cmult_left_iff [OF assms] by (simp add: mult.commute)
 
 lemma integrable_on_cdivide:
   fixes f :: "_ \<Rightarrow> 'b :: real_normed_field"
   assumes "f integrable_on s"
   shows "(\<lambda>x. f x / of_real c) integrable_on s"
 by (simp add: integrable_on_cmult_right divide_inverse assms flip: of_real_inverse)
 
 lemma integrable_on_cdivide_iff [simp]:
   fixes f :: "_ \<Rightarrow> 'b :: real_normed_field"
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. f x / of_real c) integrable_on s \<longleftrightarrow> f integrable_on s"
 by (simp add: divide_inverse assms flip: of_real_inverse)
 
 lemma has_integral_null [intro]: "content(cbox a b) = 0 \<Longrightarrow> (f has_integral 0) (cbox a b)"
   unfolding has_integral_cbox
   using eventually_division_filter_tagged_division[of "cbox a b"]
   by (subst tendsto_cong[where g="\<lambda>_. 0"]) (auto elim: eventually_mono intro: sum_content_null)
 
 lemma has_integral_null_real [intro]: "content {a..b::real} = 0 \<Longrightarrow> (f has_integral 0) {a..b}"
   by (metis box_real(2) has_integral_null)
 
 lemma has_integral_null_eq[simp]: "content (cbox a b) = 0 \<Longrightarrow> (f has_integral i) (cbox a b) \<longleftrightarrow> i = 0"
   by (auto simp add: has_integral_null dest!: integral_unique)
 
 lemma integral_null [simp]: "content (cbox a b) = 0 \<Longrightarrow> integral (cbox a b) f = 0"
   by (metis has_integral_null integral_unique)
 
 lemma integrable_on_null [intro]: "content (cbox a b) = 0 \<Longrightarrow> f integrable_on (cbox a b)"
   by (simp add: has_integral_integrable)
 
 lemma has_integral_empty[intro]: "(f has_integral 0) {}"
   by (meson ex_in_conv has_integral_is_0)
 
 lemma has_integral_empty_eq[simp]: "(f has_integral i) {} \<longleftrightarrow> i = 0"
   by (auto simp add: has_integral_empty has_integral_unique)
 
 lemma integrable_on_empty[intro]: "f integrable_on {}"
   unfolding integrable_on_def by auto
 
 lemma integral_empty[simp]: "integral {} f = 0"
   by (rule integral_unique) (rule has_integral_empty)
 
 lemma has_integral_refl[intro]:
   fixes a :: "'a::euclidean_space"
   shows "(f has_integral 0) (cbox a a)"
     and "(f has_integral 0) {a}"
 proof -
   show "(f has_integral 0) (cbox a a)"
      by (rule has_integral_null) simp
   then show "(f has_integral 0) {a}"
     by simp
 qed
 
 lemma integrable_on_refl[intro]: "f integrable_on cbox a a"
   unfolding integrable_on_def by auto
 
 lemma integral_refl [simp]: "integral (cbox a a) f = 0"
   by (rule integral_unique) auto
 
 lemma integral_singleton [simp]: "integral {a} f = 0"
   by auto
 
 lemma integral_blinfun_apply:
   assumes "f integrable_on s"
   shows "integral s (\<lambda>x. blinfun_apply h (f x)) = blinfun_apply h (integral s f)"
   by (subst integral_linear[symmetric, OF assms blinfun.bounded_linear_right]) (simp add: o_def)
 
 lemma blinfun_apply_integral:
   assumes "f integrable_on s"
   shows "blinfun_apply (integral s f) x = integral s (\<lambda>y. blinfun_apply (f y) x)"
   by (metis (no_types, lifting) assms blinfun.prod_left.rep_eq integral_blinfun_apply integral_cong)
 
 lemma has_integral_componentwise_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(f has_integral y) A \<longleftrightarrow> (\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
 proof safe
   fix b :: 'b assume "(f has_integral y) A"
   from has_integral_linear[OF this(1) bounded_linear_inner_left, of b]
     show "((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A" by (simp add: o_def)
 next
   assume "(\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
   hence "\<forall>b\<in>Basis. (((\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. f x \<bullet> b)) has_integral ((y \<bullet> b) *\<^sub>R b)) A"
     by (intro ballI has_integral_linear) (simp_all add: bounded_linear_scaleR_left)
   hence "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. (y \<bullet> b) *\<^sub>R b)) A"
     by (intro has_integral_sum) (simp_all add: o_def)
   thus "(f has_integral y) A" by (simp add: euclidean_representation)
 qed
 
 lemma has_integral_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A) \<Longrightarrow> (f has_integral y) A"
   by (subst has_integral_componentwise_iff) blast
 
 lemma integrable_componentwise_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "f integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)"
 proof
   assume "f integrable_on A"
   then obtain y where "(f has_integral y) A" by (auto simp: integrable_on_def)
   hence "(\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
     by (subst (asm) has_integral_componentwise_iff)
   thus "(\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)" by (auto simp: integrable_on_def)
 next
   assume "(\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)"
   then obtain y where "\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral y b) A"
     unfolding integrable_on_def by (subst (asm) bchoice_iff) blast
   hence "\<forall>b\<in>Basis. (((\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. f x \<bullet> b)) has_integral (y b *\<^sub>R b)) A"
     by (intro ballI has_integral_linear) (simp_all add: bounded_linear_scaleR_left)
   hence "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. y b *\<^sub>R b)) A"
     by (intro has_integral_sum) (simp_all add: o_def)
   thus "f integrable_on A" by (auto simp: integrable_on_def o_def euclidean_representation)
 qed
 
 lemma integrable_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> (\<lambda>x. f x \<bullet> b) integrable_on A) \<Longrightarrow> f integrable_on A"
   by (subst integrable_componentwise_iff) blast
 
 lemma integral_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f integrable_on A"
   shows "integral A f = (\<Sum>b\<in>Basis. integral A (\<lambda>x. (f x \<bullet> b) *\<^sub>R b))"
 proof -
   from assms have integrable: "\<forall>b\<in>Basis. (\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. (f x \<bullet> b)) integrable_on A"
     by (subst (asm) integrable_componentwise_iff, intro integrable_linear ballI)
        (simp_all add: bounded_linear_scaleR_left)
   have "integral A f = integral A (\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b)"
     by (simp add: euclidean_representation)
   also from integrable have "\<dots> = (\<Sum>a\<in>Basis. integral A (\<lambda>x. (f x \<bullet> a) *\<^sub>R a))"
     by (subst integral_sum) (simp_all add: o_def)
   finally show ?thesis .
 qed
 
 lemma integrable_component:
   "f integrable_on A \<Longrightarrow> (\<lambda>x. f x \<bullet> (y :: 'b :: euclidean_space)) integrable_on A"
   by (drule integrable_linear[OF _ bounded_linear_inner_left[of y]]) (simp add: o_def)
 
 
 
 subsection \<open>Cauchy-type criterion for integrability\<close>
 
 proposition integrable_Cauchy:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::{real_normed_vector,complete_space}"
   shows "f integrable_on cbox a b \<longleftrightarrow>
         (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
           (\<forall>\<D>1 \<D>2. \<D>1 tagged_division_of (cbox a b) \<and> \<gamma> fine \<D>1 \<and>
             \<D>2 tagged_division_of (cbox a b) \<and> \<gamma> fine \<D>2 \<longrightarrow>
             norm ((\<Sum>(x,K)\<in>\<D>1. content K *\<^sub>R f x) - (\<Sum>(x,K)\<in>\<D>2. content K *\<^sub>R f x)) < e))"
   (is "?l = (\<forall>e>0. \<exists>\<gamma>. ?P e \<gamma>)")
 proof (intro iffI allI impI)
   assume ?l
   then obtain y
     where y: "\<And>e. e > 0 \<Longrightarrow>
         \<exists>\<gamma>. gauge \<gamma> \<and>
             (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                  norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - y) < e)"
     by (auto simp: integrable_on_def has_integral)
   show "\<exists>\<gamma>. ?P e \<gamma>" if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
     with y obtain \<gamma> where "gauge \<gamma>"
       and \<gamma>: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<Longrightarrow>
                   norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f x) - y) < e/2"
       by meson
     show ?thesis
     apply (rule_tac x=\<gamma> in exI, clarsimp simp: \<open>gauge \<gamma>\<close>)
         by (blast intro!: \<gamma> dist_triangle_half_l[where y=y,unfolded dist_norm])
     qed
 next
   assume "\<forall>e>0. \<exists>\<gamma>. ?P e \<gamma>"
   then have "\<forall>n::nat. \<exists>\<gamma>. ?P (1 / (n + 1)) \<gamma>"
     by auto
   then obtain \<gamma> :: "nat \<Rightarrow> 'n \<Rightarrow> 'n set" where \<gamma>:
     "\<And>m. gauge (\<gamma> m)"
     "\<And>m \<D>1 \<D>2. \<lbrakk>\<D>1 tagged_division_of cbox a b;
               \<gamma> m fine \<D>1; \<D>2 tagged_division_of cbox a b; \<gamma> m fine \<D>2\<rbrakk>
               \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> \<D>2. content K *\<^sub>R f x))
                   < 1 / (m + 1)"
     by metis
   have "gauge (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..n}})" for n
     using \<gamma> by (intro gauge_Inter) auto
   then have "\<forall>n. \<exists>p. p tagged_division_of (cbox a b) \<and> (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..n}}) fine p"
     by (meson fine_division_exists)
   then obtain p where p: "\<And>z. p z tagged_division_of cbox a b"
                          "\<And>z. (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..z}}) fine p z"
     by meson
   have dp: "\<And>i n. i\<le>n \<Longrightarrow> \<gamma> i fine p n"
     using p unfolding fine_Inter
     using atLeastAtMost_iff by blast
   have "Cauchy (\<lambda>n. sum (\<lambda>(x,K). content K *\<^sub>R (f x)) (p n))"
   proof (rule CauchyI)
     fix e::real
     assume "0 < e"
     then obtain N where "N \<noteq> 0" and N: "inverse (real N) < e"
       using real_arch_inverse[of e] by blast
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < e"
     proof (intro exI allI impI)
       fix m n
       assume mn: "N \<le> m" "N \<le> n"
       have "norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < 1 / (real N + 1)"
         by (simp add: p(1) dp mn \<gamma>)
       also have "... < e"
         using  N \<open>N \<noteq> 0\<close> \<open>0 < e\<close> by (auto simp: field_simps)
       finally show "norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < e" .
     qed
   qed
   then obtain y where y: "\<exists>no. \<forall>n\<ge>no. norm ((\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x) - y) < r" if "r > 0" for r
     by (auto simp: convergent_eq_Cauchy[symmetric] dest: LIMSEQ_D)
   show ?l
     unfolding integrable_on_def has_integral
   proof (rule_tac x=y in exI, clarify)
     fix e :: real
     assume "e>0"
     then have e2: "e/2 > 0" by auto
     then obtain N1::nat where N1: "N1 \<noteq> 0" "inverse (real N1) < e/2"
       using real_arch_inverse by blast
     obtain N2::nat where N2: "\<And>n. n \<ge> N2 \<Longrightarrow> norm ((\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x) - y) < e/2"
       using y[OF e2] by metis
     show "\<exists>\<gamma>. gauge \<gamma> \<and>
               (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
                 norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - y) < e)"
     proof (intro exI conjI allI impI)
       show "gauge (\<gamma> (N1+N2))"
         using \<gamma> by auto
       show "norm ((\<Sum>(x,K) \<in> q. content K *\<^sub>R f x) - y) < e"
            if "q tagged_division_of cbox a b \<and> \<gamma> (N1+N2) fine q" for q
       proof (rule norm_triangle_half_r)
         have "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> q. content K *\<^sub>R f x))
                < 1 / (real (N1+N2) + 1)"
           by (rule \<gamma>; simp add: dp p that)
         also have "... < e/2"
           using N1 \<open>0 < e\<close> by (auto simp: field_simps intro: less_le_trans)
         finally show "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> q. content K *\<^sub>R f x)) < e/2" .
         show "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - y) < e/2"
           using N2 le_add_same_cancel2 by blast
       qed
     qed
   qed
 qed
 
 
 subsection \<open>Additivity of integral on abutting intervals\<close>
 
 lemma tagged_division_split_left_inj_content:
   assumes \<D>: "\<D> tagged_division_of S"
     and "(x1, K1) \<in> \<D>" "(x2, K2) \<in> \<D>" "K1 \<noteq> K2" "K1 \<inter> {x. x\<bullet>k \<le> c} = K2 \<inter> {x. x\<bullet>k \<le> c}" "k \<in> Basis"
   shows "content (K1 \<inter> {x. x\<bullet>k \<le> c}) = 0"
 proof -
   from tagged_division_ofD(4)[OF \<D> \<open>(x1, K1) \<in> \<D>\<close>] obtain a b where K1: "K1 = cbox a b"
     by auto
   then have "interior (K1 \<inter> {x. x \<bullet> k \<le> c}) = {}"
     by (metis tagged_division_split_left_inj assms)
   then show ?thesis
     unfolding K1 interval_split[OF \<open>k \<in> Basis\<close>] by (auto simp: content_eq_0_interior)
 qed
 
 lemma tagged_division_split_right_inj_content:
   assumes \<D>: "\<D> tagged_division_of S"
     and "(x1, K1) \<in> \<D>" "(x2, K2) \<in> \<D>" "K1 \<noteq> K2" "K1 \<inter> {x. x\<bullet>k \<ge> c} = K2 \<inter> {x. x\<bullet>k \<ge> c}" "k \<in> Basis"
   shows "content (K1 \<inter> {x. x\<bullet>k \<ge> c}) = 0"
 proof -
   from tagged_division_ofD(4)[OF \<D> \<open>(x1, K1) \<in> \<D>\<close>] obtain a b where K1: "K1 = cbox a b"
     by auto
   then have "interior (K1 \<inter> {x. c \<le> x \<bullet> k}) = {}"
     by (metis tagged_division_split_right_inj assms)
   then show ?thesis
     unfolding K1 interval_split[OF \<open>k \<in> Basis\<close>]
     by (auto simp: content_eq_0_interior)
 qed
 
 
 proposition has_integral_split:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes fi: "(f has_integral i) (cbox a b \<inter> {x. x\<bullet>k \<le> c})"
       and fj: "(f has_integral j) (cbox a b \<inter> {x. x\<bullet>k \<ge> c})"
       and k: "k \<in> Basis"
 shows "(f has_integral (i + j)) (cbox a b)"
   unfolding has_integral
 proof clarify
   fix e::real
   assume "0 < e"
   then have e: "e/2 > 0"
     by auto
     obtain \<gamma>1 where \<gamma>1: "gauge \<gamma>1"
       and \<gamma>1norm:
         "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; \<gamma>1 fine \<D>\<rbrakk>
              \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - i) < e/2"
        apply (rule has_integralD[OF fi[unfolded interval_split[OF k]] e])
        apply (simp add: interval_split[symmetric] k)
       done
     obtain \<gamma>2 where \<gamma>2: "gauge \<gamma>2"
       and \<gamma>2norm:
         "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; \<gamma>2 fine \<D>\<rbrakk>
              \<Longrightarrow> norm ((\<Sum>(x, k) \<in> \<D>. content k *\<^sub>R f x) - j) < e/2"
        apply (rule has_integralD[OF fj[unfolded interval_split[OF k]] e])
        apply (simp add: interval_split[symmetric] k)
        done
   let ?\<gamma> = "\<lambda>x. if x\<bullet>k = c then (\<gamma>1 x \<inter> \<gamma>2 x) else ball x \<bar>x\<bullet>k - c\<bar> \<inter> \<gamma>1 x \<inter> \<gamma>2 x"
   have "gauge ?\<gamma>"
     using \<gamma>1 \<gamma>2 unfolding gauge_def by auto
   then show "\<exists>\<gamma>. gauge \<gamma> \<and>
                  (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                       norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - (i + j)) < e)"
   proof (rule_tac x="?\<gamma>" in exI, safe)
     fix p
     assume p: "p tagged_division_of (cbox a b)" and "?\<gamma> fine p"
     have ab_eqp: "cbox a b = \<Union>{K. \<exists>x. (x, K) \<in> p}"
       using p by blast
     have xk_le_c: "x\<bullet>k \<le> c" if as: "(x,K) \<in> p" and K: "K \<inter> {x. x\<bullet>k \<le> c} \<noteq> {}" for x K
     proof (rule ccontr)
       assume **: "\<not> x \<bullet> k \<le> c"
       then have "K \<subseteq> ball x \<bar>x \<bullet> k - c\<bar>"
         using \<open>?\<gamma> fine p\<close> as by (fastforce simp: not_le algebra_simps)
       with K obtain y where y: "y \<in> ball x \<bar>x \<bullet> k - c\<bar>" "y\<bullet>k \<le> c"
         by blast
       then have "\<bar>x \<bullet> k - y \<bullet> k\<bar> < \<bar>x \<bullet> k - c\<bar>"
         using Basis_le_norm[OF k, of "x - y"]
         by (auto simp add: dist_norm inner_diff_left intro: le_less_trans)
       with y show False
         using ** by (auto simp add: field_simps)
     qed
     have xk_ge_c: "x\<bullet>k \<ge> c" if as: "(x,K) \<in> p" and K: "K \<inter> {x. x\<bullet>k \<ge> c} \<noteq> {}" for x K
     proof (rule ccontr)
       assume **: "\<not> x \<bullet> k \<ge> c"
       then have "K \<subseteq> ball x \<bar>x \<bullet> k - c\<bar>"
         using \<open>?\<gamma> fine p\<close> as by (fastforce simp: not_le algebra_simps)
       with K obtain y where y: "y \<in> ball x \<bar>x \<bullet> k - c\<bar>" "y\<bullet>k \<ge> c"
         by blast
       then have "\<bar>x \<bullet> k - y \<bullet> k\<bar> < \<bar>x \<bullet> k - c\<bar>"
         using Basis_le_norm[OF k, of "x - y"]
         by (auto simp add: dist_norm inner_diff_left intro: le_less_trans)
       with y show False
         using ** by (auto simp add: field_simps)
     qed
     have fin_finite: "finite {(x,f K) | x K. (x,K) \<in> s \<and> P x K}"
       if "finite s" for s and f :: "'a set \<Rightarrow> 'a set" and P :: "'a \<Rightarrow> 'a set \<Rightarrow> bool"
     proof -
       from that have "finite ((\<lambda>(x,K). (x, f K)) ` s)"
         by auto
       then show ?thesis
         by (rule rev_finite_subset) auto
     qed
     { fix \<G> :: "'a set \<Rightarrow> 'a set"
       fix i :: "'a \<times> 'a set"
       assume "i \<in> (\<lambda>(x, k). (x, \<G> k)) ` p - {(x, \<G> k) |x k. (x, k) \<in> p \<and> \<G> k \<noteq> {}}"
       then obtain x K where xk: "i = (x, \<G> K)"  "(x,K) \<in> p"
                                  "(x, \<G> K) \<notin> {(x, \<G> K) |x K. (x,K) \<in> p \<and> \<G> K \<noteq> {}}"
         by auto
       have "content (\<G> K) = 0"
         using xk using content_empty by auto
       then have "(\<lambda>(x,K). content K *\<^sub>R f x) i = 0"
         unfolding xk split_conv by auto
     } note [simp] = this
     have "finite p"
       using p by blast
     let ?M1 = "{(x, K \<inter> {x. x\<bullet>k \<le> c}) |x K. (x,K) \<in> p \<and> K \<inter> {x. x\<bullet>k \<le> c} \<noteq> {}}"
     have \<gamma>1_fine: "\<gamma>1 fine ?M1"
       using \<open>?\<gamma> fine p\<close> by (fastforce simp: fine_def split: if_split_asm)
     have "norm ((\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) - i) < e/2"
     proof (rule \<gamma>1norm [OF tagged_division_ofI \<gamma>1_fine])
       show "finite ?M1"
         by (rule fin_finite) (use p in blast)
       show "\<Union>{k. \<exists>x. (x, k) \<in> ?M1} = cbox a b \<inter> {x. x\<bullet>k \<le> c}"
         by (auto simp: ab_eqp)
 
       fix x L
       assume xL: "(x, L) \<in> ?M1"
       then obtain x' L' where xL': "x = x'" "L = L' \<inter> {x. x \<bullet> k \<le> c}"
                                    "(x', L') \<in> p" "L' \<inter> {x. x \<bullet> k \<le> c} \<noteq> {}"
         by blast
       then obtain a' b' where ab': "L' = cbox a' b'"
         using p by blast
       show "x \<in> L" "L \<subseteq> cbox a b \<inter> {x. x \<bullet> k \<le> c}"
         using p xk_le_c xL' by auto
       show "\<exists>a b. L = cbox a b"
         using p xL' ab' by (auto simp add: interval_split[OF k,where c=c])
 
       fix y R
       assume yR: "(y, R) \<in> ?M1"
       then obtain y' R' where yR': "y = y'" "R = R' \<inter> {x. x \<bullet> k \<le> c}"
                                    "(y', R') \<in> p" "R' \<inter> {x. x \<bullet> k \<le> c} \<noteq> {}"
         by blast
       assume as: "(x, L) \<noteq> (y, R)"
       show "interior L \<inter> interior R = {}"
       proof (cases "L' = R' \<longrightarrow> x' = y'")
         case False
         have "interior R' = {}"
           by (metis (no_types) False Pair_inject inf.idem tagged_division_ofD(5) [OF p] xL'(3) yR'(3))
         then show ?thesis
           using yR' by simp
       next
         case True
         then have "L' \<noteq> R'"
           using as unfolding xL' yR' by auto
         have "interior L' \<inter> interior R' = {}"
           by (metis (no_types) Pair_inject \<open>L' \<noteq> R'\<close> p tagged_division_ofD(5) xL'(3) yR'(3))
         then show ?thesis
           using xL'(2) yR'(2) by auto
       qed
     qed
     moreover
     let ?M2 = "{(x,K \<inter> {x. x\<bullet>k \<ge> c}) |x K. (x,K) \<in> p \<and> K \<inter> {x. x\<bullet>k \<ge> c} \<noteq> {}}"
     have \<gamma>2_fine: "\<gamma>2 fine ?M2"
       using \<open>?\<gamma> fine p\<close> by (fastforce simp: fine_def split: if_split_asm)
     have "norm ((\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - j) < e/2"
     proof (rule \<gamma>2norm [OF tagged_division_ofI \<gamma>2_fine])
       show "finite ?M2"
         by (rule fin_finite) (use p in blast)
       show "\<Union>{k. \<exists>x. (x, k) \<in> ?M2} = cbox a b \<inter> {x. x\<bullet>k \<ge> c}"
         by (auto simp: ab_eqp)
 
       fix x L
       assume xL: "(x, L) \<in> ?M2"
       then obtain x' L' where xL': "x = x'" "L = L' \<inter> {x. x \<bullet> k \<ge> c}"
                                    "(x', L') \<in> p" "L' \<inter> {x. x \<bullet> k \<ge> c} \<noteq> {}"
         by blast
       then obtain a' b' where ab': "L' = cbox a' b'"
         using p by blast
       show "x \<in> L" "L \<subseteq> cbox a b \<inter> {x. x \<bullet> k \<ge> c}"
         using p xk_ge_c xL' by auto
       show "\<exists>a b. L = cbox a b"
         using p xL' ab' by (auto simp add: interval_split[OF k,where c=c])
 
       fix y R
       assume yR: "(y, R) \<in> ?M2"
       then obtain y' R' where yR': "y = y'" "R = R' \<inter> {x. x \<bullet> k \<ge> c}"
                                    "(y', R') \<in> p" "R' \<inter> {x. x \<bullet> k \<ge> c} \<noteq> {}"
         by blast
       assume as: "(x, L) \<noteq> (y, R)"
       show "interior L \<inter> interior R = {}"
       proof (cases "L' = R' \<longrightarrow> x' = y'")
         case False
         have "interior R' = {}"
           by (metis (no_types) False Pair_inject inf.idem tagged_division_ofD(5) [OF p] xL'(3) yR'(3))
         then show ?thesis
           using yR' by simp
       next
         case True
         then have "L' \<noteq> R'"
           using as unfolding xL' yR' by auto
         have "interior L' \<inter> interior R' = {}"
           by (metis (no_types) Pair_inject \<open>L' \<noteq> R'\<close> p tagged_division_ofD(5) xL'(3) yR'(3))
         then show ?thesis
           using xL'(2) yR'(2) by auto
       qed
     qed
     ultimately
     have "norm (((\<Sum>(x,K) \<in> ?M1. content K *\<^sub>R f x) - i) + ((\<Sum>(x,K) \<in> ?M2. content K *\<^sub>R f x) - j)) < e/2 + e/2"
       using norm_add_less by blast
     moreover have "((\<Sum>(x,K) \<in> ?M1. content K *\<^sub>R f x) - i) +
                    ((\<Sum>(x,K) \<in> ?M2. content K *\<^sub>R f x) - j) =
                    (\<Sum>(x, ka)\<in>p. content ka *\<^sub>R f x) - (i + j)"
     proof -
       have eq0: "\<And>x y. x = (0::real) \<Longrightarrow> x *\<^sub>R (y::'b) = 0"
          by auto
       have cont_eq: "\<And>g. (\<lambda>(x,l). content l *\<^sub>R f x) \<circ> (\<lambda>(x,l). (x,g l)) = (\<lambda>(x,l). content (g l) *\<^sub>R f x)"
         by auto
       have *: "\<And>\<G> :: 'a set \<Rightarrow> 'a set.
                   (\<Sum>(x,K)\<in>{(x, \<G> K) |x K. (x,K) \<in> p \<and> \<G> K \<noteq> {}}. content K *\<^sub>R f x) =
                   (\<Sum>(x,K)\<in>(\<lambda>(x,K). (x, \<G> K)) ` p. content K *\<^sub>R f x)"
         by (rule sum.mono_neutral_left) (auto simp: \<open>finite p\<close>)
       have "((\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) - i) + ((\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - j) =
         (\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - (i + j)"
         by auto
       moreover have "\<dots> = (\<Sum>(x,K) \<in> p. content (K \<inter> {x. x \<bullet> k \<le> c}) *\<^sub>R f x) +
         (\<Sum>(x,K) \<in> p. content (K \<inter> {x. c \<le> x \<bullet> k}) *\<^sub>R f x) - (i + j)"
         unfolding *
         apply (subst (1 2) sum.reindex_nontrivial)
            apply (auto intro!: k p eq0 tagged_division_split_left_inj_content tagged_division_split_right_inj_content
                        simp: cont_eq \<open>finite p\<close>)
         done
       moreover have "\<And>x. x \<in> p \<Longrightarrow> (\<lambda>(a,B). content (B \<inter> {a. a \<bullet> k \<le> c}) *\<^sub>R f a) x +
                                 (\<lambda>(a,B). content (B \<inter> {a. c \<le> a \<bullet> k}) *\<^sub>R f a) x =
                                 (\<lambda>(a,B). content B *\<^sub>R f a) x"
       proof clarify
         fix a B
         assume "(a, B) \<in> p"
         with p obtain u v where uv: "B = cbox u v" by blast
         then show "content (B \<inter> {x. x \<bullet> k \<le> c}) *\<^sub>R f a + content (B \<inter> {x. c \<le> x \<bullet> k}) *\<^sub>R f a = content B *\<^sub>R f a"
           by (auto simp: scaleR_left_distrib uv content_split[OF k,of u v c])
       qed
       ultimately show ?thesis
         by (auto simp: sum.distrib[symmetric])
       qed
     ultimately show "norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - (i + j)) < e"
       by auto
   qed
 qed
 
 
 subsection \<open>A sort of converse, integrability on subintervals\<close>
 
 lemma has_integral_separate_sides:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes f: "(f has_integral i) (cbox a b)"
     and "e > 0"
     and k: "k \<in> Basis"
   obtains d where "gauge d"
     "\<forall>p1 p2. p1 tagged_division_of (cbox a b \<inter> {x. x\<bullet>k \<le> c}) \<and> d fine p1 \<and>
         p2 tagged_division_of (cbox a b \<inter> {x. x\<bullet>k \<ge> c}) \<and> d fine p2 \<longrightarrow>
         norm ((sum (\<lambda>(x,k). content k *\<^sub>R f x) p1 + sum (\<lambda>(x,k). content k *\<^sub>R f x) p2) - i) < e"
 proof -
   obtain \<gamma> where d: "gauge \<gamma>"
       "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
             \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < e"
     using has_integralD[OF f \<open>e > 0\<close>] by metis
   { fix p1 p2
     assume tdiv1: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" and "\<gamma> fine p1"
     note p1=tagged_division_ofD[OF this(1)] 
     assume tdiv2: "p2 tagged_division_of (cbox a b) \<inter> {x. c \<le> x \<bullet> k}" and "\<gamma> fine p2"
     note p2=tagged_division_ofD[OF this(1)] 
     note tagged_division_Un_interval[OF tdiv1 tdiv2] 
     note p12 = tagged_division_ofD[OF this] this
     { fix a b
       assume ab: "(a, b) \<in> p1 \<inter> p2"
       have "(a, b) \<in> p1"
         using ab by auto
       obtain u v where uv: "b = cbox u v"
         using \<open>(a, b) \<in> p1\<close> p1(4) by moura
       have "b \<subseteq> {x. x\<bullet>k = c}"
         using ab p1(3)[of a b] p2(3)[of a b] by fastforce
       moreover
       have "interior {x::'a. x \<bullet> k = c} = {}"
       proof (rule ccontr)
         assume "\<not> ?thesis"
         then obtain x where x: "x \<in> interior {x::'a. x\<bullet>k = c}"
           by auto
         then obtain \<epsilon> where "0 < \<epsilon>" and \<epsilon>: "ball x \<epsilon> \<subseteq> {x. x \<bullet> k = c}"
           using mem_interior by metis
         have x: "x\<bullet>k = c"
           using x interior_subset by fastforce
         have *: "\<And>i. i \<in> Basis \<Longrightarrow> \<bar>(x - (x + (\<epsilon>/2) *\<^sub>R k)) \<bullet> i\<bar> = (if i = k then \<epsilon>/2 else 0)"
           using \<open>0 < \<epsilon>\<close> k by (auto simp: inner_simps inner_not_same_Basis)
         have "(\<Sum>i\<in>Basis. \<bar>(x - (x + (\<epsilon>/2 ) *\<^sub>R k)) \<bullet> i\<bar>) =
               (\<Sum>i\<in>Basis. (if i = k then \<epsilon>/2 else 0))"
           using "*" by (blast intro: sum.cong)
         also have "\<dots> < \<epsilon>"
           by (subst sum.delta) (use \<open>0 < \<epsilon>\<close> in auto)
         finally have "x + (\<epsilon>/2) *\<^sub>R k \<in> ball x \<epsilon>"
           unfolding mem_ball dist_norm by(rule le_less_trans[OF norm_le_l1])
         then have "x + (\<epsilon>/2) *\<^sub>R k \<in> {x. x\<bullet>k = c}"
           using \<epsilon> by auto
         then show False
           using \<open>0 < \<epsilon>\<close> x k by (auto simp: inner_simps)
       qed
       ultimately have "content b = 0"
         unfolding uv content_eq_0_interior
         using interior_mono by blast
       then have "content b *\<^sub>R f a = 0"
         by auto
     }
     then have "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - i) =
                norm ((\<Sum>(x, k)\<in>p1 \<union> p2. content k *\<^sub>R f x) - i)"
       by (subst sum.union_inter_neutral) (auto simp: p1 p2)
     also have "\<dots> < e"
       using d(2) p12 by (simp add: fine_Un k \<open>\<gamma> fine p1\<close> \<open>\<gamma> fine p2\<close>)
     finally have "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - i) < e" .
    }
   then show ?thesis
     using d(1) that by auto
 qed
 
 lemma integrable_split [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{real_normed_vector,complete_space}"
   assumes f: "f integrable_on cbox a b"
       and k: "k \<in> Basis"
     shows "f integrable_on (cbox a b \<inter> {x. x\<bullet>k \<le> c})"   (is ?thesis1)
     and   "f integrable_on (cbox a b \<inter> {x. x\<bullet>k \<ge> c})"   (is ?thesis2)
 proof -
   obtain y where y: "(f has_integral y) (cbox a b)"
     using f by blast
   define a' where "a' = (\<Sum>i\<in>Basis. (if i = k then max (a\<bullet>k) c else a\<bullet>i)*\<^sub>R i)"
   define b' where "b' = (\<Sum>i\<in>Basis. (if i = k then min (b\<bullet>k) c else b\<bullet>i)*\<^sub>R i)"
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> d fine p2 \<longrightarrow>
                      norm ((\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)) < e)"
     if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
   with has_integral_separate_sides[OF y this k, of c]
   obtain d
     where "gauge d"
          and d: "\<And>p1 p2. \<lbrakk>p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; d fine p1;
                           p2 tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; d fine p2\<rbrakk>
                   \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) + (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x) - y) < e/2"
     by metis
   show ?thesis
     proof (rule_tac x=d in exI, clarsimp simp add: \<open>gauge d\<close>)
       fix p1 p2
       assume as: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" "d fine p1"
                  "p2 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" "d fine p2"
       show "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)) < e"
       proof (rule fine_division_exists[OF \<open>gauge d\<close>, of a' b])
         fix p
         assume "p tagged_division_of cbox a' b" "d fine p"
         then show ?thesis
           using as norm_triangle_half_l[OF d[of p1 p] d[of p2 p]]
           unfolding interval_split[OF k] b'_def[symmetric] a'_def[symmetric]
           by (auto simp add: algebra_simps)
       qed
     qed
   qed
   with f show ?thesis1
     by (simp add: interval_split[OF k] integrable_Cauchy)
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<ge> c} \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<ge> c} \<and> d fine p2 \<longrightarrow>
                      norm ((\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)) < e)"
     if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
   with has_integral_separate_sides[OF y this k, of c]
   obtain d
     where "gauge d"
          and d: "\<And>p1 p2. \<lbrakk>p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; d fine p1;
                           p2 tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; d fine p2\<rbrakk>
                   \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) + (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x) - y) < e/2"
     by metis
   show ?thesis
     proof (rule_tac x=d in exI, clarsimp simp add: \<open>gauge d\<close>)
       fix p1 p2
       assume as: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<ge> c}" "d fine p1"
                  "p2 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<ge> c}" "d fine p2"
       show "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)) < e"
       proof (rule fine_division_exists[OF \<open>gauge d\<close>, of a b'])
         fix p
         assume "p tagged_division_of cbox a b'" "d fine p"
         then show ?thesis
           using as norm_triangle_half_l[OF d[of p p1] d[of p p2]]
           unfolding interval_split[OF k] b'_def[symmetric] a'_def[symmetric]
           by (auto simp add: algebra_simps)
       qed
     qed
   qed
   with f show ?thesis2
     by (simp add: interval_split[OF k] integrable_Cauchy)
 qed
 
 lemma operative_integralI:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   shows "operative (lift_option (+)) (Some 0)
     (\<lambda>i. if f integrable_on i then Some (integral i f) else None)"
 proof -
   interpret comm_monoid "lift_option plus" "Some (0::'b)"
     by (rule comm_monoid_lift_option)
       (rule add.comm_monoid_axioms)
   show ?thesis
   proof
     fix a b c
     fix k :: 'a
     assume k: "k \<in> Basis"
     show "(if f integrable_on cbox a b then Some (integral (cbox a b) f) else None) =
           lift_option (+) (if f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c} then Some (integral (cbox a b \<inter> {x. x \<bullet> k \<le> c}) f) else None)
           (if f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k} then Some (integral (cbox a b \<inter> {x. c \<le> x \<bullet> k}) f) else None)"
     proof (cases "f integrable_on cbox a b")
       case True
       with k show ?thesis
         by (auto simp: integrable_split intro: integral_unique [OF has_integral_split[OF _ _ k]])
     next
     case False
       have "\<not> (f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}) \<or> \<not> ( f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k})"
       proof (rule ccontr)
         assume "\<not> ?thesis"
         then have "f integrable_on cbox a b"
           unfolding integrable_on_def
           apply (rule_tac x="integral (cbox a b \<inter> {x. x \<bullet> k \<le> c}) f + integral (cbox a b \<inter> {x. x \<bullet> k \<ge> c}) f" in exI)
           apply (auto intro: has_integral_split[OF _ _ k])
           done
         then show False
           using False by auto
       qed
       then show ?thesis
         using False by auto
     qed
   next
     fix a b :: 'a
     assume "box a b = {}"
     then show "(if f integrable_on cbox a b then Some (integral (cbox a b) f) else None) = Some 0"
       using has_integral_null_eq
       by (auto simp: integrable_on_null content_eq_0_interior)
   qed
 qed
 
 subsection \<open>Bounds on the norm of Riemann sums and the integral itself\<close>
 
 lemma dsum_bound:
   assumes p: "p division_of (cbox a b)"
     and "norm c \<le> e"
   shows "norm (sum (\<lambda>l. content l *\<^sub>R c) p) \<le> e * content(cbox a b)"
 proof -
   have sumeq: "(\<Sum>i\<in>p. \<bar>content i\<bar>) = sum content p"
     by simp
   have e: "0 \<le> e"
     using assms(2) norm_ge_zero order_trans by blast
   have "norm (sum (\<lambda>l. content l *\<^sub>R c) p) \<le> (\<Sum>i\<in>p. norm (content i *\<^sub>R c))"
     using norm_sum by blast
   also have "...  \<le> e * (\<Sum>i\<in>p. \<bar>content i\<bar>)"
     by (simp add: sum_distrib_left[symmetric] mult.commute assms(2) mult_right_mono sum_nonneg)
   also have "... \<le> e * content (cbox a b)"
     by (metis additive_content_division p eq_iff sumeq)
   finally show ?thesis .
 qed
 
 lemma rsum_bound:
   assumes p: "p tagged_division_of (cbox a b)"
       and "\<forall>x\<in>cbox a b. norm (f x) \<le> e"
     shows "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p) \<le> e * content (cbox a b)"
 proof (cases "cbox a b = {}")
   case True show ?thesis
     using p unfolding True tagged_division_of_trivial by auto
 next
   case False
   then have e: "e \<ge> 0"
     by (meson ex_in_conv assms(2) norm_ge_zero order_trans)
   have sum_le: "sum (content \<circ> snd) p \<le> content (cbox a b)"
     unfolding additive_content_tagged_division[OF p, symmetric] split_def
     by (auto intro: eq_refl)
   have con: "\<And>xk. xk \<in> p \<Longrightarrow> 0 \<le> content (snd xk)"
     using tagged_division_ofD(4) [OF p] content_pos_le
     by force
   have "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p) \<le> (\<Sum>i\<in>p. norm (case i of (x, k) \<Rightarrow> content k *\<^sub>R f x))"
     by (rule norm_sum)
   also have "...  \<le> e * content (cbox a b)"
   proof -
     have "\<And>xk. xk \<in> p \<Longrightarrow> norm (f (fst xk)) \<le> e"
       using assms(2) p tag_in_interval by force
     moreover have "(\<Sum>i\<in>p. \<bar>content (snd i)\<bar> * e) \<le> e * content (cbox a b)"
       unfolding sum_distrib_right[symmetric]
       using con sum_le by (auto simp: mult.commute intro: mult_left_mono [OF _ e])
     ultimately show ?thesis
       unfolding split_def norm_scaleR
       by (metis (no_types, lifting) mult_left_mono[OF _ abs_ge_zero]   order_trans[OF sum_mono])
   qed
   finally show ?thesis .
 qed
 
 lemma rsum_diff_bound:
   assumes "p tagged_division_of (cbox a b)"
     and "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e"
   shows "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - sum (\<lambda>(x,k). content k *\<^sub>R g x) p) \<le>
          e * content (cbox a b)"
   using order_trans[OF _ rsum_bound[OF assms]]
   by (simp add: split_def scaleR_diff_right sum_subtractf eq_refl)
 
 lemma has_integral_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B"
       and f: "(f has_integral i) (cbox a b)"
       and "\<And>x. x\<in>cbox a b \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content (cbox a b)"
 proof (rule ccontr)
   assume "\<not> ?thesis"
   then have "norm i - B * content (cbox a b) > 0"
     by auto
   with f[unfolded has_integral]
   obtain \<gamma> where "gauge \<gamma>" and \<gamma>:
     "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
           \<Longrightarrow> norm ((\<Sum>(x, K)\<in>p. content K *\<^sub>R f x) - i) < norm i - B * content (cbox a b)"
     by metis
   then obtain p where p: "p tagged_division_of cbox a b" and "\<gamma> fine p"
     using fine_division_exists by blast
   have "\<And>s B. norm s \<le> B \<Longrightarrow> \<not> norm (s - i) < norm i - B"
     unfolding not_less
     by (metis diff_left_mono dist_commute dist_norm norm_triangle_ineq2 order_trans)
   then show False
     using \<gamma> [OF p \<open>\<gamma> fine p\<close>] rsum_bound[OF p] assms by metis
 qed
 
 corollary integrable_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B"
       and "f integrable_on (cbox a b)"
       and "\<And>x. x\<in>cbox a b \<Longrightarrow> norm (f x) \<le> B"
     shows "norm (integral (cbox a b) f) \<le> B * content (cbox a b)"
 by (metis integrable_integral has_integral_bound assms)
 
 
 subsection \<open>Similar theorems about relationship among components\<close>
 
 lemma rsum_component_le:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes p: "p tagged_division_of (cbox a b)"
       and "\<And>x. x \<in> cbox a b \<Longrightarrow> (f x)\<bullet>i \<le> (g x)\<bullet>i"
     shows "(\<Sum>(x, K)\<in>p. content K *\<^sub>R f x) \<bullet> i \<le> (\<Sum>(x, K)\<in>p. content K *\<^sub>R g x) \<bullet> i"
 unfolding inner_sum_left
 proof (rule sum_mono, clarify)
   fix x K
   assume ab: "(x, K) \<in> p"
   with p obtain u v where K: "K = cbox u v"
     by blast
   then show "(content K *\<^sub>R f x) \<bullet> i \<le> (content K *\<^sub>R g x) \<bullet> i"
     by (metis ab assms inner_scaleR_left measure_nonneg mult_left_mono tag_in_interval)
 qed
 
 lemma has_integral_component_le:
   fixes f g :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes k: "k \<in> Basis"
   assumes "(f has_integral i) S" "(g has_integral j) S"
     and f_le_g: "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> (g x)\<bullet>k"
   shows "i\<bullet>k \<le> j\<bullet>k"
 proof -
   have ik_le_jk: "i\<bullet>k \<le> j\<bullet>k"
     if f_i: "(f has_integral i) (cbox a b)"
     and g_j: "(g has_integral j) (cbox a b)"
     and le: "\<forall>x\<in>cbox a b. (f x)\<bullet>k \<le> (g x)\<bullet>k"
     for a b i and j :: 'b and f g :: "'a \<Rightarrow> 'b"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then have *: "0 < (i\<bullet>k - j\<bullet>k) / 3"
       by auto
     obtain \<gamma>1 where "gauge \<gamma>1" 
       and \<gamma>1: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma>1 fine p\<rbrakk>
                 \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < (i \<bullet> k - j \<bullet> k) / 3"
       using f_i[unfolded has_integral,rule_format,OF *] by fastforce 
     obtain \<gamma>2 where "gauge \<gamma>2" 
       and \<gamma>2: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma>2 fine p\<rbrakk>
                 \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R g x) - j) < (i \<bullet> k - j \<bullet> k) / 3"
       using g_j[unfolded has_integral,rule_format,OF *] by fastforce 
     obtain p where p: "p tagged_division_of cbox a b" and "\<gamma>1 fine p" "\<gamma>2 fine p"
        using fine_division_exists[OF gauge_Int[OF \<open>gauge \<gamma>1\<close> \<open>gauge \<gamma>2\<close>], of a b] unfolding fine_Int
        by metis
     then have "\<bar>((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
          "\<bar>((\<Sum>(x, k)\<in>p. content k *\<^sub>R g x) - j) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
       using le_less_trans[OF Basis_le_norm[OF k]] k \<gamma>1 \<gamma>2 by metis+ 
     then show False
       unfolding inner_simps
       using rsum_component_le[OF p] le
       by (fastforce simp add: abs_real_def split: if_split_asm)
   qed
   show ?thesis
   proof (cases "\<exists>a b. S = cbox a b")
     case True
     with ik_le_jk assms show ?thesis
       by auto
   next
     case False
     show ?thesis
     proof (rule ccontr)
       assume "\<not> i\<bullet>k \<le> j\<bullet>k"
       then have ij: "(i\<bullet>k - j\<bullet>k) / 3 > 0"
         by auto
       obtain B1 where "0 < B1" 
            and B1: "\<And>a b. ball 0 B1 \<subseteq> cbox a b \<Longrightarrow>
                     \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and>
                         norm (z - i) < (i \<bullet> k - j \<bullet> k) / 3"
         using has_integral_altD[OF _ False ij] assms by blast
       obtain B2 where "0 < B2" 
            and B2: "\<And>a b. ball 0 B2 \<subseteq> cbox a b \<Longrightarrow>
                     \<exists>z. ((\<lambda>x. if x \<in> S then g x else 0) has_integral z) (cbox a b) \<and>
                         norm (z - j) < (i \<bullet> k - j \<bullet> k) / 3"
         using has_integral_altD[OF _ False ij] assms by blast
       have "bounded (ball 0 B1 \<union> ball (0::'a) B2)"
         unfolding bounded_Un by(rule conjI bounded_ball)+
       from bounded_subset_cbox_symmetric[OF this] 
       obtain a b::'a where ab: "ball 0 B1 \<subseteq> cbox a b" "ball 0 B2 \<subseteq> cbox a b"
         by (meson Un_subset_iff)
       then obtain w1 w2 where int_w1: "((\<lambda>x. if x \<in> S then f x else 0) has_integral w1) (cbox a b)"
                         and norm_w1:  "norm (w1 - i) < (i \<bullet> k - j \<bullet> k) / 3"
                         and int_w2: "((\<lambda>x. if x \<in> S then g x else 0) has_integral w2) (cbox a b)"
                         and norm_w2: "norm (w2 - j) < (i \<bullet> k - j \<bullet> k) / 3"
         using B1 B2 by blast
       have *: "\<And>w1 w2 j i::real .\<bar>w1 - i\<bar> < (i - j) / 3 \<Longrightarrow> \<bar>w2 - j\<bar> < (i - j) / 3 \<Longrightarrow> w1 \<le> w2 \<Longrightarrow> False"
         by (simp add: abs_real_def split: if_split_asm)
       have "\<bar>(w1 - i) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
            "\<bar>(w2 - j) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
         using Basis_le_norm k le_less_trans norm_w1 norm_w2 by blast+
       moreover
       have "w1\<bullet>k \<le> w2\<bullet>k"
         using ik_le_jk int_w1 int_w2 f_le_g by auto
       ultimately show False
         unfolding inner_simps by(rule *)
     qed
   qed
 qed
 
 lemma integral_component_le:
   fixes g f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "f integrable_on S" "g integrable_on S"
     and "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> (g x)\<bullet>k"
   shows "(integral S f)\<bullet>k \<le> (integral S g)\<bullet>k"
   using has_integral_component_le assms by blast
 
 lemma has_integral_component_nonneg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> (f x)\<bullet>k"
   shows "0 \<le> i\<bullet>k"
   using has_integral_component_le[OF assms(1) has_integral_0 assms(2)]
   using assms(3-)
   by auto
 
 lemma integral_component_nonneg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and  "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> (f x)\<bullet>k"
   shows "0 \<le> (integral S f)\<bullet>k"
 proof (cases "f integrable_on S")
   case True show ?thesis
     using True assms has_integral_component_nonneg by blast
 next
   case False then show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma has_integral_component_neg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> 0"
   shows "i\<bullet>k \<le> 0"
   using has_integral_component_le[OF assms(1,2) has_integral_0] assms(2-)
   by auto
 
 lemma has_integral_component_lbound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>x\<in>cbox a b. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content (cbox a b) \<le> i\<bullet>k"
   using has_integral_component_le[OF assms(3) has_integral_const assms(1),of "(\<Sum>i\<in>Basis. B *\<^sub>R i)::'b"] assms(2-)
   by (auto simp add: field_simps)
 
 lemma has_integral_component_ubound:
   fixes f::"'a::euclidean_space => 'b::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>x\<in>cbox a b. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "i\<bullet>k \<le> B * content (cbox a b)"
   using has_integral_component_le[OF assms(3,1) has_integral_const, of "\<Sum>i\<in>Basis. B *\<^sub>R i"] assms(2-)
   by (auto simp add: field_simps)
 
 lemma integral_component_lbound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on cbox a b"
     and "\<forall>x\<in>cbox a b. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content (cbox a b) \<le> (integral(cbox a b) f)\<bullet>k"
   using assms has_integral_component_lbound by blast
 
 lemma integral_component_lbound_real:
   assumes "f integrable_on {a ::real..b}"
     and "\<forall>x\<in>{a..b}. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content {a..b} \<le> (integral {a..b} f)\<bullet>k"
   using assms
   by (metis box_real(2) integral_component_lbound)
 
 lemma integral_component_ubound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on cbox a b"
     and "\<forall>x\<in>cbox a b. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "(integral (cbox a b) f)\<bullet>k \<le> B * content (cbox a b)"
   using assms has_integral_component_ubound by blast
 
 lemma integral_component_ubound_real:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "f integrable_on {a..b}"
     and "\<forall>x\<in>{a..b}. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "(integral {a..b} f)\<bullet>k \<le> B * content {a..b}"
   using assms
   by (metis box_real(2) integral_component_ubound)
 
 subsection \<open>Uniform limit of integrable functions is integrable\<close>
 
 lemma real_arch_invD:
   "0 < (e::real) \<Longrightarrow> (\<exists>n::nat. n \<noteq> 0 \<and> 0 < inverse (real n) \<and> inverse (real n) < e)"
   by (subst(asm) real_arch_inverse)
 
 
 lemma integrable_uniform_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "\<And>e. e > 0 \<Longrightarrow> \<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
   shows "f integrable_on cbox a b"
 proof (cases "content (cbox a b) > 0")
   case False then show ?thesis
     using has_integral_null by (simp add: content_lt_nz integrable_on_def)
 next
   case True
   have "1 / (real n + 1) > 0" for n
     by auto
   then have "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> 1 / (real n + 1)) \<and> g integrable_on cbox a b" for n
     using assms by blast
   then obtain g where g_near_f: "\<And>n x. x \<in> cbox a b \<Longrightarrow> norm (f x - g n x) \<le> 1 / (real n + 1)"
                   and int_g: "\<And>n. g n integrable_on cbox a b"
     by metis
   then obtain h where h: "\<And>n. (g n has_integral h n) (cbox a b)"
     unfolding integrable_on_def by metis
   have "Cauchy h"
     unfolding Cauchy_def
   proof clarify
     fix e :: real
     assume "e>0"
     then have "e/4 / content (cbox a b) > 0"
       using True by (auto simp: field_simps)
     then obtain M where "M \<noteq> 0" and M: "1 / (real M) < e/4 / content (cbox a b)"
       by (metis inverse_eq_divide real_arch_inverse)
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (h m) (h n) < e"
     proof (rule exI [where x=M], clarify)
       fix m n
       assume m: "M \<le> m" and n: "M \<le> n"
       have "e/4>0" using \<open>e>0\<close> by auto
       then obtain gm gn where "gauge gm" "gauge gn"
               and gm: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> gm fine \<D> 
                             \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x) - h m) < e/4"
               and gn: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> gn fine \<D> \<Longrightarrow>
                       norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - h n) < e/4"
         using h[unfolded has_integral] by meson
       then obtain \<D> where \<D>: "\<D> tagged_division_of cbox a b" "(\<lambda>x. gm x \<inter> gn x) fine \<D>"
         by (metis (full_types) fine_division_exists gauge_Int)
       have triangle3: "norm (i1 - i2) < e"
         if no: "norm(s2 - s1) \<le> e/2" "norm (s1 - i1) < e/4" "norm (s2 - i2) < e/4" for s1 s2 i1 and i2::'b
       proof -
         have "norm (i1 - i2) \<le> norm (i1 - s1) + norm (s1 - s2) + norm (s2 - i2)"
           using norm_triangle_ineq[of "i1 - s1" "s1 - i2"]
           using norm_triangle_ineq[of "s1 - s2" "s2 - i2"]
           by (auto simp: algebra_simps)
         also have "\<dots> < e"
           using no by (auto simp: algebra_simps norm_minus_commute)
         finally show ?thesis .
       qed
       have finep: "gm fine \<D>" "gn fine \<D>"
         using fine_Int \<D>  by auto
       have norm_le: "norm (g n x - g m x) \<le> 2 / real M" if x: "x \<in> cbox a b" for x
       proof -
         have "norm (f x - g n x) + norm (f x - g m x) \<le> 1 / (real n + 1) + 1 / (real m + 1)"          
           using g_near_f[OF x, of n] g_near_f[OF x, of m] by simp
         also have "\<dots> \<le> 1 / (real M) + 1 / (real M)"
           using \<open>M \<noteq> 0\<close> m n by (intro add_mono; force simp: field_split_simps)
         also have "\<dots> = 2 / real M"
           by auto
         finally show "norm (g n x - g m x) \<le> 2 / real M"
           using norm_triangle_le[of "g n x - f x" "f x - g m x" "2 / real M"]
           by (auto simp: algebra_simps simp add: norm_minus_commute)
       qed
       have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x)) \<le> 2 / real M * content (cbox a b)"
         by (blast intro: norm_le rsum_diff_bound[OF \<D>(1), where e="2 / real M"])
       also have "... \<le> e/2"
         using M True
         by (auto simp: field_simps)
       finally have le_e2: "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x)) \<le> e/2" .
       then show "dist (h m) (h n) < e"
         unfolding dist_norm using gm gn \<D> finep by (auto intro!: triangle3)
     qed
   qed
   then obtain s where s: "h \<longlonglongrightarrow> s"
     using convergent_eq_Cauchy[symmetric] by blast
   show ?thesis
     unfolding integrable_on_def has_integral
   proof (rule_tac x=s in exI, clarify)
     fix e::real
     assume e: "0 < e"
     then have "e/3 > 0" by auto
     then obtain N1 where N1: "\<forall>n\<ge>N1. norm (h n - s) < e/3"
       using LIMSEQ_D [OF s] by metis
     from e True have "e/3 / content (cbox a b) > 0"
       by (auto simp: field_simps)
     then obtain N2 :: nat
          where "N2 \<noteq> 0" and N2: "1 / (real N2) < e/3 / content (cbox a b)"
       by (metis inverse_eq_divide real_arch_inverse)
     obtain g' where "gauge g'"
             and g': "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> g' fine \<D> \<Longrightarrow>
                     norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x) - h (N1 + N2)) < e/3"
       by (metis h has_integral \<open>e/3 > 0\<close>)
     have *: "norm (sf - s) < e" 
         if no: "norm (sf - sg) \<le> e/3" "norm(h - s) < e/3" "norm (sg - h) < e/3" for sf sg h
     proof -
       have "norm (sf - s) \<le> norm (sf - sg) + norm (sg - h) + norm (h - s)"
         using norm_triangle_ineq[of "sf - sg" "sg - s"]
         using norm_triangle_ineq[of "sg -  h" " h - s"]
         by (auto simp: algebra_simps)
       also have "\<dots> < e"
         using no by (auto simp: algebra_simps norm_minus_commute)
       finally show ?thesis .
     qed
     { fix \<D>
       assume ptag: "\<D> tagged_division_of (cbox a b)" and "g' fine \<D>"
       then have norm_less: "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x) - h (N1 + N2)) < e/3"
         using g' by blast
       have "content (cbox a b) < e/3 * (of_nat N2)"
         using \<open>N2 \<noteq> 0\<close> N2 using True by (auto simp: field_split_simps)
       moreover have "e/3 * of_nat N2 \<le> e/3 * (of_nat (N1 + N2) + 1)"
         using \<open>e>0\<close> by auto
       ultimately have "content (cbox a b) < e/3 * (of_nat (N1 + N2) + 1)"
         by linarith
       then have le_e3: "1 / (real (N1 + N2) + 1) * content (cbox a b) \<le> e/3"
         unfolding inverse_eq_divide
         by (auto simp: field_simps)
       have ne3: "norm (h (N1 + N2) - s) < e/3"
         using N1 by auto
       have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x))
             \<le> 1 / (real (N1 + N2) + 1) * content (cbox a b)"
         by (blast intro: g_near_f rsum_diff_bound[OF ptag])
       then have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - s) < e"
         by (rule *[OF order_trans [OF _ le_e3] ne3 norm_less])
     }
     then show "\<exists>d. gauge d \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> d fine \<D> \<longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - s) < e)"
       by (blast intro: g' \<open>gauge g'\<close>)
   qed
 qed
 
 lemmas integrable_uniform_limit_real = integrable_uniform_limit [where 'a=real, simplified]
 
 
 subsection \<open>Negligible sets\<close>
 
 definition "negligible (s:: 'a::euclidean_space set) \<longleftrightarrow>
   (\<forall>a b. ((indicator s :: 'a\<Rightarrow>real) has_integral 0) (cbox a b))"
 
 
 subsubsection \<open>Negligibility of hyperplane\<close>
 
 lemma content_doublesplit:
   fixes a :: "'a::euclidean_space"
   assumes "0 < e"
     and k: "k \<in> Basis"
   obtains d where "0 < d" and "content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d}) < e"
 proof cases
   assume *: "a \<bullet> k \<le> c \<and> c \<le> b \<bullet> k \<and> (\<forall>j\<in>Basis. a \<bullet> j \<le> b \<bullet> j)"
   define a' where "a' d = (\<Sum>j\<in>Basis. (if j = k then max (a\<bullet>j) (c - d) else a\<bullet>j) *\<^sub>R j)" for d
   define b' where "b' d = (\<Sum>j\<in>Basis. (if j = k then min (b\<bullet>j) (c + d) else b\<bullet>j) *\<^sub>R j)" for d
 
   have "((\<lambda>d. \<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) \<longlongrightarrow> (\<Prod>j\<in>Basis. (b' 0 - a' 0) \<bullet> j)) (at_right 0)"
     by (auto simp: b'_def a'_def intro!: tendsto_min tendsto_max tendsto_eq_intros)
   also have "(\<Prod>j\<in>Basis. (b' 0 - a' 0) \<bullet> j) = 0"
     using k *
     by (intro prod_zero bexI[OF _ k])
        (auto simp: b'_def a'_def inner_diff inner_sum_left inner_not_same_Basis intro!: sum.cong)
   also have "((\<lambda>d. \<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) \<longlongrightarrow> 0) (at_right 0) =
     ((\<lambda>d. content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d})) \<longlongrightarrow> 0) (at_right 0)"
   proof (intro tendsto_cong eventually_at_rightI)
     fix d :: real assume d: "d \<in> {0<..<1}"
     have "cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d} = cbox (a' d) (b' d)" for d
       using * d k by (auto simp add: cbox_def set_eq_iff Int_def ball_conj_distrib abs_diff_le_iff a'_def b'_def)
     moreover have "j \<in> Basis \<Longrightarrow> a' d \<bullet> j \<le> b' d \<bullet> j" for j
       using * d k by (auto simp: a'_def b'_def)
     ultimately show "(\<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) = content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d})"
       by simp
   qed simp
   finally have "((\<lambda>d. content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) \<longlongrightarrow> 0) (at_right 0)" .
   from order_tendstoD(2)[OF this \<open>0<e\<close>]
   obtain d' where "0 < d'" and d': "\<And>y. y > 0 \<Longrightarrow> y < d' \<Longrightarrow> content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> y}) < e"
     by (subst (asm) eventually_at_right[of _ 1]) auto
   show ?thesis
     by (rule that[of "d'/2"], insert \<open>0<d'\<close> d'[of "d'/2"], auto)
 next
   assume *: "\<not> (a \<bullet> k \<le> c \<and> c \<le> b \<bullet> k \<and> (\<forall>j\<in>Basis. a \<bullet> j \<le> b \<bullet> j))"
   then have "(\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j) \<or> (c < a \<bullet> k \<or> b \<bullet> k < c)"
     by (auto simp: not_le)
   show thesis
   proof cases
     assume "\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j"
     then have [simp]: "cbox a b = {}"
       using box_ne_empty(1)[of a b] by auto
     show ?thesis
       by (rule that[of 1]) (simp_all add: \<open>0<e\<close>)
   next
     assume "\<not> (\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j)"
     with * have "c < a \<bullet> k \<or> b \<bullet> k < c"
       by auto
     then show thesis
     proof
       assume c: "c < a \<bullet> k"
       moreover have "x \<in> cbox a b \<Longrightarrow> c \<le> x \<bullet> k" for x
         using k c by (auto simp: cbox_def)
       ultimately have "cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> (a \<bullet> k - c)/2} = {}"
         using k by (auto simp: cbox_def)
       with \<open>0<e\<close> c that[of "(a \<bullet> k - c)/2"] show ?thesis
         by auto
     next
       assume c: "b \<bullet> k < c"
       moreover have "x \<in> cbox a b \<Longrightarrow> x \<bullet> k \<le> c" for x
         using k c by (auto simp: cbox_def)
       ultimately have "cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> (c - b \<bullet> k)/2} = {}"
         using k by (auto simp: cbox_def)
       with \<open>0<e\<close> c that[of "(c - b \<bullet> k)/2"] show ?thesis
         by auto
     qed
   qed
 qed
 
 
 proposition negligible_standard_hyperplane[intro]:
   fixes k :: "'a::euclidean_space"
   assumes k: "k \<in> Basis"
   shows "negligible {x. x\<bullet>k = c}"
   unfolding negligible_def has_integral
 proof clarsimp
   fix a b and e::real assume "e > 0"
   with k obtain d where "0 < d" and d: "content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) < e"
     by (metis content_doublesplit)
   let ?i = "indicator {x::'a. x\<bullet>k = c} :: 'a\<Rightarrow>real"
   show "\<exists>\<gamma>. gauge \<gamma> \<and>
            (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                  \<bar>\<Sum>(x,K) \<in> \<D>. content K * ?i x\<bar> < e)"
   proof (intro exI, safe)
     show "gauge (\<lambda>x. ball x d)"
       using \<open>0 < d\<close> by blast
   next
     fix \<D>
     assume p: "\<D> tagged_division_of (cbox a b)" "(\<lambda>x. ball x d) fine \<D>"
     have "content L = content (L \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})" 
       if "(x, L) \<in> \<D>" "?i x \<noteq> 0" for x L
     proof -
       have xk: "x\<bullet>k = c"
         using that by (simp add: indicator_def split: if_split_asm)
       have "L \<subseteq> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
       proof 
         fix y
         assume y: "y \<in> L"
         have "L \<subseteq> ball x d"
           using p(2) that(1) by auto
         then have "norm (x - y) < d"
           by (simp add: dist_norm subset_iff y)
         then have "\<bar>(x - y) \<bullet> k\<bar> < d"
           using k norm_bound_Basis_lt by blast
         then show "y \<in> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
           unfolding inner_simps xk by auto
       qed 
       then show "content L = content (L \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})"
         by (metis inf.orderE)
     qed
     then have *: "(\<Sum>(x,K)\<in>\<D>. content K * ?i x) = (\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d}) *\<^sub>R ?i x)"
       by (force simp add: split_paired_all intro!: sum.cong [OF refl])
     note p'= tagged_division_ofD[OF p(1)] and p''=division_of_tagged_division[OF p(1)]
     have "(\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * indicator {x. x \<bullet> k = c} x) < e"
     proof -
       have "(\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * ?i x) \<le> (\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}))"
         by (force simp add: indicator_def intro!: sum_mono)
       also have "\<dots> < e"
       proof (subst sum.over_tagged_division_lemma[OF p(1)])
         fix u v::'a
         assume "box u v = {}"
         then have *: "content (cbox u v) = 0"
           unfolding content_eq_0_interior by simp
         have "cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<subseteq> cbox u v"
           by auto
         then have "content (cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) \<le> content (cbox u v)"
           unfolding interval_doublesplit[OF k] by (rule content_subset)
         then show "content (cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = 0"
           unfolding * interval_doublesplit[OF k]
           by (blast intro: antisym)
       next
         have "(\<Sum>l\<in>snd ` \<D>. content (l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) =
           sum content ((\<lambda>l. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})`{l\<in>snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}})"
         proof (subst (2) sum.reindex_nontrivial)
           fix x y assume "x \<in> {l \<in> snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}" "y \<in> {l \<in> snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}"
             "x \<noteq> y" and eq: "x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} = y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
           then obtain x' y' where "(x', x) \<in> \<D>" "x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}" "(y', y) \<in> \<D>" "y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}"
             by (auto)
           from p'(5)[OF \<open>(x', x) \<in> \<D>\<close> \<open>(y', y) \<in> \<D>\<close>] \<open>x \<noteq> y\<close> have "interior (x \<inter> y) = {}"
             by auto
           moreover have "interior ((x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) \<inter> (y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) \<subseteq> interior (x \<inter> y)"
             by (auto intro: interior_mono)
           ultimately have "interior (x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = {}"
             by (auto simp: eq)
           then show "content (x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = 0"
             using p'(4)[OF \<open>(x', x) \<in> \<D>\<close>] by (auto simp: interval_doublesplit[OF k] content_eq_0_interior simp del: interior_Int)
         qed (insert p'(1), auto intro!: sum.mono_neutral_right)
         also have "\<dots> \<le> norm (\<Sum>l\<in>(\<lambda>l. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})`{l\<in>snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}. content l *\<^sub>R 1::real)"
           by simp
         also have "\<dots> \<le> 1 * content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})"
           using division_doublesplit[OF p'' k, unfolded interval_doublesplit[OF k]]
           unfolding interval_doublesplit[OF k] by (intro dsum_bound) auto
         also have "\<dots> < e"
           using d by simp
         finally show "(\<Sum>K\<in>snd ` \<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) < e" .
       qed
       finally show "(\<Sum>(x, K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * ?i x) < e" .
     qed
     then show "\<bar>\<Sum>(x, K)\<in>\<D>. content K * ?i x\<bar> < e"
       unfolding *  by (simp add: sum_nonneg split: prod.split)
   qed
 qed
 
 corollary negligible_standard_hyperplane_cart:
   fixes k :: "'a::finite"
   shows "negligible {x. x$k = (0::real)}"
   by (simp add: cart_eq_inner_axis negligible_standard_hyperplane)
 
 
 subsubsection \<open>Hence the main theorem about negligible sets\<close>
 
 
 lemma has_integral_negligible_cbox:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes negs: "negligible S"
     and 0: "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) (cbox a b)"
   unfolding has_integral
 proof clarify
   fix e::real
   assume "e > 0"
   then have nn_gt0: "e/2 / ((real n+1) * (2 ^ n)) > 0" for n
     by simp
   then have "\<exists>\<gamma>. gauge \<gamma> \<and>
                  (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                       \<bar>\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R indicator S x\<bar>
                       < e/2 / ((real n + 1) * 2 ^ n))" for n
     using negs [unfolded negligible_def has_integral] by auto
   then obtain \<gamma> where 
     gd: "\<And>n. gauge (\<gamma> n)"
     and \<gamma>: "\<And>n \<D>. \<lbrakk>\<D> tagged_division_of cbox a b; \<gamma> n fine \<D>\<rbrakk>
                   \<Longrightarrow> \<bar>\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R indicator S x\<bar> < e/2 / ((real n + 1) * 2 ^ n)"
     by metis
   show "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                   norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - 0) < e)"
   proof (intro exI, safe)
     show "gauge (\<lambda>x. \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x)"
       using gd by (auto simp: gauge_def)
 
     show "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - 0) < e"
       if "\<D> tagged_division_of (cbox a b)" "(\<lambda>x. \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x) fine \<D>" for \<D>
     proof (cases "\<D> = {}")
       case True with \<open>0 < e\<close> show ?thesis by simp
     next
       case False
       obtain N where "Max ((\<lambda>(x, K). norm (f x)) ` \<D>) \<le> real N"
         using real_arch_simple by blast
       then have N: "\<And>x. x \<in> (\<lambda>(x, K). norm (f x)) ` \<D> \<Longrightarrow> x \<le> real N"
         by (meson Max_ge that(1) dual_order.trans finite_imageI tagged_division_of_finite)
       have "\<forall>i. \<exists>q. q tagged_division_of (cbox a b) \<and> (\<gamma> i) fine q \<and> (\<forall>(x,K) \<in> \<D>. K \<subseteq> (\<gamma> i) x \<longrightarrow> (x, K) \<in> q)"
         by (auto intro: tagged_division_finer[OF that(1) gd])
       from choice[OF this] 
       obtain q where q: "\<And>n. q n tagged_division_of cbox a b"
                         "\<And>n. \<gamma> n fine q n"
                         "\<And>n x K. \<lbrakk>(x, K) \<in> \<D>; K \<subseteq> \<gamma> n x\<rbrakk> \<Longrightarrow> (x, K) \<in> q n"
         by fastforce
       have "finite \<D>"
         using that(1) by blast
       then have sum_le_inc: "\<lbrakk>finite T; \<And>x y. (x,y) \<in> T \<Longrightarrow> (0::real) \<le> g(x,y);
                       \<And>y. y\<in>\<D> \<Longrightarrow> \<exists>x. (x,y) \<in> T \<and> f(y) \<le> g(x,y)\<rbrakk> \<Longrightarrow> sum f \<D> \<le> sum g T" for f g T
         by (rule sum_le_included[of \<D> T g snd f]; force)
       have "norm (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) \<le> (\<Sum>(x,K) \<in> \<D>. norm (content K *\<^sub>R f x))"
         unfolding split_def by (rule norm_sum)
       also have "... \<le> (\<Sum>(i, j) \<in> Sigma {..N + 1} q.
                           (real i + 1) * (case j of (x, K) \<Rightarrow> content K *\<^sub>R indicator S x))"
       proof (rule sum_le_inc, safe)
         show "finite (Sigma {..N+1} q)"
           by (meson finite_SigmaI finite_atMost tagged_division_of_finite q(1)) 
       next
         fix x K
         assume xk: "(x, K) \<in> \<D>"
         define n where "n = nat \<lfloor>norm (f x)\<rfloor>"
         have *: "norm (f x) \<in> (\<lambda>(x, K). norm (f x)) ` \<D>"
           using xk by auto
         have nfx: "real n \<le> norm (f x)" "norm (f x) \<le> real n + 1"
           unfolding n_def by auto
         then have "n \<in> {0..N + 1}"
           using N[OF *] by auto
         moreover have "K \<subseteq> \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x"
           using that(2) xk by auto
         moreover then have "(x, K) \<in> q (nat \<lfloor>norm (f x)\<rfloor>)"
           by (simp add: q(3) xk)
         moreover then have "(x, K) \<in> q n"
           using n_def by blast
         moreover
         have "norm (content K *\<^sub>R f x) \<le> (real n + 1) * (content K * indicator S x)"
         proof (cases "x \<in> S")
           case False
           then show ?thesis by (simp add: 0)
         next
           case True
           have *: "content K \<ge> 0"
             using tagged_division_ofD(4)[OF that(1) xk] by auto
           moreover have "content K * norm (f x) \<le> content K * (real n + 1)"
             by (simp add: mult_left_mono nfx(2))
           ultimately show ?thesis
             using nfx True by (auto simp: field_simps)
         qed
         ultimately show "\<exists>y. (y, x, K) \<in> (Sigma {..N + 1} q) \<and> norm (content K *\<^sub>R f x) \<le>
           (real y + 1) * (content K *\<^sub>R indicator S x)"
           by force
       qed auto
       also have "... = (\<Sum>i\<le>N + 1. \<Sum>j\<in>q i. (real i + 1) * (case j of (x, K) \<Rightarrow> content K *\<^sub>R indicator S x))"
         using q(1) by (intro sum_Sigma_product [symmetric]) auto
       also have "... \<le> (\<Sum>i\<le>N + 1. (real i + 1) * \<bar>\<Sum>(x,K) \<in> q i. content K *\<^sub>R indicator S x\<bar>)"
         by (rule sum_mono) (simp add: sum_distrib_left [symmetric])
       also have "... \<le> (\<Sum>i\<le>N + 1. e/2/2 ^ i)"
       proof (rule sum_mono)
         show "(real i + 1) * \<bar>\<Sum>(x,K) \<in> q i. content K *\<^sub>R indicator S x\<bar> \<le> e/2/2 ^ i"
           if "i \<in> {..N + 1}" for i
           using \<gamma>[of "q i" i] q by (simp add: divide_simps mult.left_commute)
       qed
       also have "... = e/2 * (\<Sum>i\<le>N + 1. (1/2) ^ i)"
         unfolding sum_distrib_left by (metis divide_inverse inverse_eq_divide power_one_over)
       also have "\<dots> < e/2 * 2"
       proof (rule mult_strict_left_mono)
         have "sum (power (1/2)) {..N + 1} = sum (power (1/2::real)) {..<N + 2}"
           using lessThan_Suc_atMost by auto
         also have "... < 2"
           by (auto simp: geometric_sum)
         finally show "sum (power (1/2::real)) {..N + 1} < 2" .
       qed (use \<open>0 < e\<close> in auto)
       finally  show ?thesis by auto
     qed
   qed
 qed
 
 
 proposition has_integral_negligible:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes negs: "negligible S"
     and "\<And>x. x \<in> (T - S) \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) T"
 proof (cases "\<exists>a b. T = cbox a b")
   case True
   then have "((\<lambda>x. if x \<in> T then f x else 0) has_integral 0) T"
     using assms by (auto intro!: has_integral_negligible_cbox)
   then show ?thesis
     by (rule has_integral_eq [rotated]) auto
 next
   case False
   let ?f = "(\<lambda>x. if x \<in> T then f x else 0)"
   have "((\<lambda>x. if x \<in> T then f x else 0) has_integral 0) T"
     apply (auto simp: False has_integral_alt [of ?f])
     apply (rule_tac x=1 in exI, auto)
     apply (rule_tac x=0 in exI, simp add: has_integral_negligible_cbox [OF negs] assms)
     done
   then show ?thesis
     by (rule_tac f="?f" in has_integral_eq) auto
 qed
 
 lemma
   assumes "negligible S"
   shows integrable_negligible: "f integrable_on S" and integral_negligible: "integral S f = 0"
   using has_integral_negligible [OF assms]
   by (auto simp: has_integral_iff)
 
 lemma has_integral_spike:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "negligible S"
     and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and fint: "(f has_integral y) T"
   shows "(g has_integral y) T"
 proof -
   have *: "(g has_integral y) (cbox a b)"
        if "(f has_integral y) (cbox a b)" "\<forall>x \<in> cbox a b - S. g x = f x" for a b f and g:: "'b \<Rightarrow> 'a" and y
   proof -
     have "((\<lambda>x. f x + (g x - f x)) has_integral (y + 0)) (cbox a b)"
       using that by (intro has_integral_add has_integral_negligible) (auto intro!: \<open>negligible S\<close>)
     then show ?thesis
       by auto
   qed
   have \<section>: "\<And>a b z. \<lbrakk>\<And>x. x \<in> T \<and> x \<notin> S \<Longrightarrow> g x = f x;
                      ((\<lambda>x. if x \<in> T then f x else 0) has_integral z) (cbox a b)\<rbrakk>
                     \<Longrightarrow> ((\<lambda>x. if x \<in> T then g x else 0) has_integral z) (cbox a b)"
       by (auto dest!: *[where f="\<lambda>x. if x\<in>T then f x else 0" and g="\<lambda>x. if x \<in> T then g x else 0"])
   show ?thesis
     using fint gf
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (auto split: if_split_asm)
      apply (blast dest: *)
     using \<section> by meson
 qed
 
 lemma has_integral_spike_eq:
   assumes "negligible S"
     and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "(f has_integral y) T \<longleftrightarrow> (g has_integral y) T"
     using has_integral_spike [OF \<open>negligible S\<close>] gf
     by metis
 
 lemma integrable_spike:
   assumes "f integrable_on T" "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     shows "g integrable_on T"
   using assms unfolding integrable_on_def by (blast intro: has_integral_spike)
 
 lemma integral_spike:
   assumes "negligible S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "integral T f = integral T g"
   using has_integral_spike_eq[OF assms]
     by (auto simp: integral_def integrable_on_def)
 
 
 subsection \<open>Some other trivialities about negligible sets\<close>
 
 lemma negligible_subset:
   assumes "negligible s" "t \<subseteq> s"
   shows "negligible t"
   unfolding negligible_def
     by (metis (no_types) Diff_iff assms contra_subsetD has_integral_negligible indicator_simps(2))
 
 lemma negligible_diff[intro?]:
   assumes "negligible s"
   shows "negligible (s - t)"
   using assms by (meson Diff_subset negligible_subset)
 
 lemma negligible_Int:
   assumes "negligible s \<or> negligible t"
   shows "negligible (s \<inter> t)"
   using assms negligible_subset by force
 
 lemma negligible_Un:
   assumes "negligible S" and T: "negligible T"
   shows "negligible (S \<union> T)"
 proof -
   have "(indicat_real (S \<union> T) has_integral 0) (cbox a b)"
     if S0: "(indicat_real S has_integral 0) (cbox a b)" 
       and  "(indicat_real T has_integral 0) (cbox a b)" for a b
   proof (subst has_integral_spike_eq[OF T])
     show "indicat_real S x = indicat_real (S \<union> T) x" if "x \<in> cbox a b - T" for x
       using that by (simp add: indicator_def)
     show "(indicat_real S has_integral 0) (cbox a b)"
       by (simp add: S0)
   qed
   with assms show ?thesis
     unfolding negligible_def by blast
 qed
 
 lemma negligible_Un_eq[simp]: "negligible (s \<union> t) \<longleftrightarrow> negligible s \<and> negligible t"
   using negligible_Un negligible_subset by blast
 
 lemma negligible_sing[intro]: "negligible {a::'a::euclidean_space}"
   using negligible_standard_hyperplane[OF SOME_Basis, of "a \<bullet> (SOME i. i \<in> Basis)"] negligible_subset by blast
 
 lemma negligible_insert[simp]: "negligible (insert a s) \<longleftrightarrow> negligible s"
   by (metis insert_is_Un negligible_Un_eq negligible_sing)
 
 lemma negligible_empty[iff]: "negligible {}"
   using negligible_insert by blast
 
 text\<open>Useful in this form for backchaining\<close>
 lemma empty_imp_negligible: "S = {} \<Longrightarrow> negligible S"
   by simp
 
 lemma negligible_finite[intro]:
   assumes "finite s"
   shows "negligible s"
   using assms by (induct s) auto
 
 lemma negligible_Union[intro]:
   assumes "finite \<T>"
     and "\<And>t. t \<in> \<T> \<Longrightarrow> negligible t"
   shows "negligible(\<Union>\<T>)"
   using assms by induct auto
 
 lemma negligible: "negligible S \<longleftrightarrow> (\<forall>T. (indicat_real S has_integral 0) T)"
 proof (intro iffI allI)
   fix T
   assume "negligible S"
   then show "(indicator S has_integral 0) T"
     by (meson Diff_iff has_integral_negligible indicator_simps(2))
 qed (simp add: negligible_def)
 
 subsection \<open>Finite case of the spike theorem is quite commonly needed\<close>
 
 lemma has_integral_spike_finite:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and "(f has_integral y) T"
   shows "(g has_integral y) T"
   using assms has_integral_spike negligible_finite by blast
 
 lemma has_integral_spike_finite_eq:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "((f has_integral y) T \<longleftrightarrow> (g has_integral y) T)"
   by (metis assms has_integral_spike_finite)
 
 lemma integrable_spike_finite:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and "f integrable_on T"
   shows "g integrable_on T"
   using assms has_integral_spike_finite by blast
 
 lemma has_integral_bound_spike_finite:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B" "finite S"
       and f: "(f has_integral i) (cbox a b)"
       and leB: "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content (cbox a b)"
 proof -
   define g where "g \<equiv> (\<lambda>x. if x \<in> S then 0 else f x)"
   then have "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (g x) \<le> B"
     using leB by simp
   moreover have "(g has_integral i) (cbox a b)"
     using has_integral_spike_finite [OF \<open>finite S\<close> _ f]
     by (simp add: g_def)
   ultimately show ?thesis
     by (simp add: \<open>0 \<le> B\<close> g_def has_integral_bound)
 qed
 
 corollary has_integral_bound_real:
   fixes f :: "real \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B" "finite S"
       and "(f has_integral i) {a..b}"
       and "\<And>x. x \<in> {a..b} - S \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content {a..b}"
   by (metis assms box_real(2) has_integral_bound_spike_finite)
 
 
 subsection \<open>In particular, the boundary of an interval is negligible\<close>
 
 lemma negligible_frontier_interval: "negligible(cbox (a::'a::euclidean_space) b - box a b)"
 proof -
   let ?A = "\<Union>((\<lambda>k. {x. x\<bullet>k = a\<bullet>k} \<union> {x::'a. x\<bullet>k = b\<bullet>k}) ` Basis)"
   have "negligible ?A"
     by (force simp add: negligible_Union[OF finite_imageI])
   moreover have "cbox a b - box a b \<subseteq> ?A"
     by (force simp add: mem_box)
   ultimately show ?thesis
     by (rule negligible_subset)
 qed
 
 lemma has_integral_spike_interior:
   assumes f: "(f has_integral y) (cbox a b)" and gf: "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
   shows "(g has_integral y) (cbox a b)"
   by (meson Diff_iff gf has_integral_spike[OF negligible_frontier_interval _ f])
   
 lemma has_integral_spike_interior_eq:
   assumes "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
   shows "(f has_integral y) (cbox a b) \<longleftrightarrow> (g has_integral y) (cbox a b)"
   by (metis assms has_integral_spike_interior)
 
 lemma integrable_spike_interior:
   assumes "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
     and "f integrable_on cbox a b"
   shows "g integrable_on cbox a b"
   using assms has_integral_spike_interior_eq by blast
 
 
 subsection \<open>Integrability of continuous functions\<close>
 
 lemma operative_approximableI:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
   shows "operative conj True (\<lambda>i. \<exists>g. (\<forall>x\<in>i. norm (f x - g (x::'b)) \<le> e) \<and> g integrable_on i)"
 proof -
   interpret comm_monoid conj True
     by standard auto
   show ?thesis
   proof (standard, safe)
     fix a b :: 'b
     show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       if "box a b = {}" for a b
       using assms that
       by (metis content_eq_0_interior integrable_on_null interior_cbox norm_zero right_minus_eq)
     {
       fix c g and k :: 'b
       assume fg: "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e" and g: "g integrable_on cbox a b"
       assume k: "k \<in> Basis"
       show "\<exists>g. (\<forall>x\<in>cbox a b \<inter> {x. x \<bullet> k \<le> c}. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}"
            "\<exists>g. (\<forall>x\<in>cbox a b \<inter> {x. c \<le> x \<bullet> k}. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}"
         using fg g k by auto
     }
     show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       if fg1: "\<forall>x\<in>cbox a b \<inter> {x. x \<bullet> k \<le> c}. norm (f x - g1 x) \<le> e" 
         and g1: "g1 integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}"
         and fg2: "\<forall>x\<in>cbox a b \<inter> {x. c \<le> x \<bullet> k}. norm (f x - g2 x) \<le> e" 
         and g2: "g2 integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}" 
         and k: "k \<in> Basis"
       for c k g1 g2
     proof -
       let ?g = "\<lambda>x. if x\<bullet>k = c then f x else if x\<bullet>k \<le> c then g1 x else g2 x"
       show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       proof (intro exI conjI ballI)
         show "norm (f x - ?g x) \<le> e" if "x \<in> cbox a b" for x
           by (auto simp: that assms fg1 fg2)
         show "?g integrable_on cbox a b"
         proof -
           have "?g integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}" "?g integrable_on cbox a b \<inter> {x. x \<bullet> k \<ge> c}"
             by(rule integrable_spike[OF _ negligible_standard_hyperplane[of k c]], use k g1 g2 in auto)+
           with has_integral_split[OF _ _ k] show ?thesis
             unfolding integrable_on_def by blast
         qed
       qed
     qed
   qed
 qed
 
 lemma comm_monoid_set_F_and: "comm_monoid_set.F (\<and>) True f s \<longleftrightarrow> (finite s \<longrightarrow> (\<forall>x\<in>s. f x))"
 proof -
   interpret bool: comm_monoid_set \<open>(\<and>)\<close> True ..
   show ?thesis
     by (induction s rule: infinite_finite_induct) auto
 qed
 
 lemma approximable_on_division:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
     and d: "d division_of (cbox a b)"
     and f: "\<forall>i\<in>d. \<exists>g. (\<forall>x\<in>i. norm (f x - g x) \<le> e) \<and> g integrable_on i"
   obtains g where "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e" "g integrable_on cbox a b"
 proof -
   interpret operative conj True "\<lambda>i. \<exists>g. (\<forall>x\<in>i. norm (f x - g (x::'b)) \<le> e) \<and> g integrable_on i"
     using \<open>0 \<le> e\<close> by (rule operative_approximableI)
   from f local.division [OF d] that show thesis
     by auto
 qed
 
 lemma integrable_continuous:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "continuous_on (cbox a b) f"
   shows "f integrable_on cbox a b"
 proof (rule integrable_uniform_limit)
   fix e :: real
   assume e: "e > 0"
   then obtain d where "0 < d" and d: "\<And>x x'. \<lbrakk>x \<in> cbox a b; x' \<in> cbox a b; dist x' x < d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
     using compact_uniformly_continuous[OF assms compact_cbox] unfolding uniformly_continuous_on_def by metis
   obtain p where ptag: "p tagged_division_of cbox a b" and finep: "(\<lambda>x. ball x d) fine p"
     using fine_division_exists[OF gauge_ball[OF \<open>0 < d\<close>], of a b] .
   have *: "\<forall>i\<in>snd ` p. \<exists>g. (\<forall>x\<in>i. norm (f x - g x) \<le> e) \<and> g integrable_on i"
   proof (safe, unfold snd_conv)
     fix x l
     assume as: "(x, l) \<in> p"
     obtain a b where l: "l = cbox a b"
       using as ptag by blast
     then have x: "x \<in> cbox a b"
       using as ptag by auto
     show "\<exists>g. (\<forall>x\<in>l. norm (f x - g x) \<le> e) \<and> g integrable_on l"
     proof (intro exI conjI strip)
       show "(\<lambda>y. f x) integrable_on l"
         unfolding integrable_on_def l by blast
     next
       fix y
       assume y: "y \<in> l"
       then have "y \<in> ball x d"
         using as finep by fastforce
       then show "norm (f y - f x) \<le> e"
         using d x y as l
         by (metis dist_commute dist_norm less_imp_le mem_ball ptag subsetCE tagged_division_ofD(3))
     qed
   qed
   from e have "e \<ge> 0"
     by auto
   from approximable_on_division[OF this division_of_tagged_division[OF ptag] *]
   show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
     by metis
 qed
 
 lemma integrable_continuous_interval:
   fixes f :: "'b::ordered_euclidean_space \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
   shows "f integrable_on {a..b}"
   by (metis assms integrable_continuous interval_cbox)
 
 lemmas integrable_continuous_real = integrable_continuous_interval[where 'b=real]
 
 lemma integrable_continuous_closed_segment:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on (closed_segment a b) f"
   shows "f integrable_on (closed_segment a b)"
   using assms
   by (auto intro!: integrable_continuous_interval simp: closed_segment_eq_real_ivl)
 
 
 subsection \<open>Specialization of additivity to one dimension\<close>
 
 
 subsection \<open>A useful lemma allowing us to factor out the content size\<close>
 
 lemma has_integral_factor_content:
   "(f has_integral i) (cbox a b) \<longleftrightarrow>
     (\<forall>e>0. \<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow>
       norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - i) \<le> e * content (cbox a b)))"
 proof (cases "content (cbox a b) = 0")
   case True
   have "\<And>e p. p tagged_division_of cbox a b \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x)) \<le> e * content (cbox a b)"
     unfolding sum_content_null[OF True] True by force
   moreover have "i = 0" 
     if "\<And>e. e > 0 \<Longrightarrow> \<exists>d. gauge d \<and>
               (\<forall>p. p tagged_division_of cbox a b \<and>
                    d fine p \<longrightarrow>
                    norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) \<le> e * content (cbox a b))"
     using that [of 1]
     by (force simp add: True sum_content_null[OF True] intro: fine_division_exists[of _ a b])
   ultimately show ?thesis
     unfolding has_integral_null_eq[OF True]
     by (force simp add: )
 next
   case False
   then have F: "0 < content (cbox a b)"
     using zero_less_measure_iff by blast
   let ?P = "\<lambda>e opp. \<exists>d. gauge d \<and>
     (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow> opp (norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i)) e)"
   show ?thesis
   proof (subst has_integral, safe)
     fix e :: real
     assume e: "e > 0"
     show "?P (e * content (cbox a b)) (\<le>)" if \<section>[rule_format]: "\<forall>\<epsilon>>0. ?P \<epsilon> (<)"
       using \<section> [of "e * content (cbox a b)"]
       by (meson F e less_imp_le mult_pos_pos)
     show "?P e (<)" if \<section>[rule_format]:  "\<forall>\<epsilon>>0. ?P (\<epsilon> * content (cbox a b)) (\<le>)"
       using \<section> [of "e/2 / content (cbox a b)"]
         using F e by (force simp add: algebra_simps)
   qed
 qed
 
 lemma has_integral_factor_content_real:
   "(f has_integral i) {a..b::real} \<longleftrightarrow>
     (\<forall>e>0. \<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of {a..b}  \<and> d fine p \<longrightarrow>
       norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - i) \<le> e * content {a..b} ))"
   unfolding box_real[symmetric]
   by (rule has_integral_factor_content)
 
 
 subsection \<open>Fundamental theorem of calculus\<close>
 
 lemma interval_bounds_real:
   fixes q b :: real
   assumes "a \<le> b"
   shows "Sup {a..b} = b"
     and "Inf {a..b} = a"
   using assms by auto
 
 theorem fundamental_theorem_of_calculus:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> b" 
       and vecd: "\<And>x. x \<in> {a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x within {a..b})"
   shows "(f' has_integral (f b - f a)) {a..b}"
   unfolding has_integral_factor_content box_real[symmetric]
 proof safe
   fix e :: real
   assume "e > 0"
   then have "\<forall>x. \<exists>d>0. x \<in> {a..b} \<longrightarrow>
          (\<forall>y\<in>{a..b}. norm (y-x) < d \<longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e * norm (y-x))"
     using vecd[unfolded has_vector_derivative_def has_derivative_within_alt] by blast
   then obtain d where d: "\<And>x. 0 < d x"
                  "\<And>x y. \<lbrakk>x \<in> {a..b}; y \<in> {a..b}; norm (y-x) < d x\<rbrakk>
                         \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e * norm (y-x)"
     by metis  
   show "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow>
     norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f' x) - (f b - f a)) \<le> e * content (cbox a b))"
   proof (rule exI, safe)
     show "gauge (\<lambda>x. ball x (d x))"
       using d(1) gauge_ball_dependent by blast
   next
     fix p
     assume ptag: "p tagged_division_of cbox a b" and finep: "(\<lambda>x. ball x (d x)) fine p"
     have ba: "b - a = (\<Sum>(x,K)\<in>p. Sup K - Inf K)" "f b - f a = (\<Sum>(x,K)\<in>p. f(Sup K) - f(Inf K))"
       using additive_tagged_division_1[where f= "\<lambda>x. x"] additive_tagged_division_1[where f= f]
             \<open>a \<le> b\<close> ptag by auto
     have "norm (\<Sum>(x, K) \<in> p. (content K *\<^sub>R f' x) - (f (Sup K) - f (Inf K)))
           \<le> (\<Sum>n\<in>p. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))"
     proof (rule sum_norm_le,safe)
       fix x K
       assume "(x, K) \<in> p"
       then have "x \<in> K" and kab: "K \<subseteq> cbox a b"
         using ptag by blast+
       then obtain u v where k: "K = cbox u v" and "x \<in> K" and kab: "K \<subseteq> cbox a b"
         using ptag \<open>(x, K) \<in> p\<close> by auto 
       have "u \<le> v"
         using \<open>x \<in> K\<close> unfolding k by auto
       have ball: "\<forall>y\<in>K. y \<in> ball x (d x)"
         using finep \<open>(x, K) \<in> p\<close> by blast
       have "u \<in> K" "v \<in> K"
         by (simp_all add: \<open>u \<le> v\<close> k)
       have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) = norm (f u - f x - (u - x) *\<^sub>R f' x - (f v - f x - (v - x) *\<^sub>R f' x))"
         by (auto simp add: algebra_simps)
       also have "... \<le> norm (f u - f x - (u - x) *\<^sub>R f' x) + norm (f v - f x - (v - x) *\<^sub>R f' x)"
         by (rule norm_triangle_ineq4)
       finally have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) \<le>
         norm (f u - f x - (u - x) *\<^sub>R f' x) + norm (f v - f x - (v - x) *\<^sub>R f' x)" .
       also have "\<dots> \<le> e * norm (u - x) + e * norm (v - x)"
       proof (rule add_mono)
         show "norm (f u - f x - (u - x) *\<^sub>R f' x) \<le> e * norm (u - x)"
         proof (rule d)
           show "norm (u - x) < d x"
             using \<open>u \<in> K\<close> ball by (auto simp add: dist_real_def)
         qed (use \<open>x \<in> K\<close> \<open>u \<in> K\<close> kab in auto)
         show "norm (f v - f x - (v - x) *\<^sub>R f' x) \<le> e * norm (v - x)"
         proof (rule d)
           show "norm (v - x) < d x"
             using \<open>v \<in> K\<close> ball by (auto simp add: dist_real_def)
         qed (use \<open>x \<in> K\<close> \<open>v \<in> K\<close> kab in auto)
       qed
       also have "\<dots> \<le> e * (Sup K - Inf K)"
         using \<open>x \<in> K\<close> by (auto simp: k interval_bounds_real[OF \<open>u \<le> v\<close>] field_simps)
       finally show "norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (Sup K - Inf K)"
         using \<open>u \<le> v\<close> by (simp add: k)
     qed
     with \<open>a \<le> b\<close> show "norm ((\<Sum>(x, K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content (cbox a b)"
       by (auto simp: ba split_def sum_subtractf [symmetric] sum_distrib_left)
   qed
 qed
 
+lemma has_complex_derivative_imp_has_vector_derivative:
+  fixes f :: "complex \<Rightarrow> complex"
+  assumes "(f has_field_derivative f') (at (of_real a) within (cbox (of_real x) (of_real y)))"
+  shows "((f o of_real) has_vector_derivative f') (at a within {x..y})"
+  using has_derivative_in_compose[of of_real of_real a "{x..y}" f "(*) f'"] assms
+  by (simp add: scaleR_conv_of_real ac_simps has_vector_derivative_def has_field_derivative_def o_def cbox_complex_of_real)
+
 lemma ident_has_integral:
   fixes a::real
   assumes "a \<le> b"
   shows "((\<lambda>x. x) has_integral (b\<^sup>2 - a\<^sup>2)/2) {a..b}"
 proof -
   have "((\<lambda>x. x) has_integral inverse 2 * b\<^sup>2 - inverse 2 * a\<^sup>2) {a..b}"
     unfolding power2_eq_square
     by (rule fundamental_theorem_of_calculus [OF assms] derivative_eq_intros | simp)+
   then show ?thesis
     by (simp add: field_simps)
 qed
 
 lemma integral_ident [simp]:
   fixes a::real
   assumes "a \<le> b"
   shows "integral {a..b} (\<lambda>x. x) = (if a \<le> b then (b\<^sup>2 - a\<^sup>2)/2 else 0)"
   by (metis assms ident_has_integral integral_unique)
 
 lemma ident_integrable_on:
   fixes a::real
   shows "(\<lambda>x. x) integrable_on {a..b}"
 by (metis atLeastatMost_empty_iff integrable_on_def has_integral_empty ident_has_integral)
 
 lemma integral_sin [simp]:
   fixes a::real
   assumes "a \<le> b" shows "integral {a..b} sin = cos a - cos b"
 proof -
   have "(sin has_integral (- cos b - - cos a)) {a..b}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>a. - cos a) has_vector_derivative sin x) (at x within {a..b})" for x
-      unfolding has_field_derivative_iff_has_vector_derivative [symmetric]
+      unfolding has_real_derivative_iff_has_vector_derivative [symmetric]
       by (rule derivative_eq_intros | force)+
   qed (use assms in auto)
   then show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma integral_cos [simp]:
   fixes a::real
   assumes "a \<le> b" shows "integral {a..b} cos = sin b - sin a"
 proof -
   have "(cos has_integral (sin b - sin a)) {a..b}"
   proof (rule fundamental_theorem_of_calculus)
     show "(sin has_vector_derivative cos x) (at x within {a..b})" for x
-      unfolding has_field_derivative_iff_has_vector_derivative [symmetric]
+      unfolding has_real_derivative_iff_has_vector_derivative [symmetric]
       by (rule derivative_eq_intros | force)+
   qed (use assms in auto)
   then show ?thesis
     by (simp add: integral_unique)
 qed
 
+lemma integral_exp [simp]:
+  fixes a::real
+  assumes "a \<le> b" shows "integral {a..b} exp = exp b - exp a"
+  by (meson DERIV_exp assms fundamental_theorem_of_calculus has_real_derivative_iff_has_vector_derivative
+       has_vector_derivative_at_within integral_unique)
+
+
 lemma has_integral_sin_nx: "((\<lambda>x. sin(real_of_int n * x)) has_integral 0) {-pi..pi}"
 proof (cases "n = 0")
   case False
   have "((\<lambda>x. sin (n * x)) has_integral (- cos (n * pi)/n - - cos (n * - pi)/n)) {-pi..pi}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>x. - cos (n * x) / n) has_vector_derivative sin (n * a)) (at a within {-pi..pi})"
       if "a \<in> {-pi..pi}" for a :: real
       using that False
       unfolding has_vector_derivative_def
       by (intro derivative_eq_intros | force)+
   qed auto
   then show ?thesis
     by simp
 qed auto
 
 lemma integral_sin_nx:
    "integral {-pi..pi} (\<lambda>x. sin(x * real_of_int n)) = 0"
   using has_integral_sin_nx [of n] by (force simp: mult.commute)
 
 lemma has_integral_cos_nx:
   "((\<lambda>x. cos(real_of_int n * x)) has_integral (if n = 0 then 2 * pi else 0)) {-pi..pi}"
 proof (cases "n = 0")
   case True
   then show ?thesis
     using has_integral_const_real [of "1::real" "-pi" pi] by auto
 next
   case False
   have "((\<lambda>x. cos (n * x)) has_integral (sin (n * pi)/n - sin (n * - pi)/n)) {-pi..pi}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>x. sin (n * x) / n) has_vector_derivative cos (n * x)) (at x within {-pi..pi})"
       if "x \<in> {-pi..pi}"
       for x :: real
       using that False
       unfolding has_vector_derivative_def
       by (intro derivative_eq_intros | force)+
   qed auto
   with False show ?thesis
     by (simp add: mult.commute)
 qed
 
 lemma integral_cos_nx:
    "integral {-pi..pi} (\<lambda>x. cos(x * real_of_int n)) = (if n = 0 then 2 * pi else 0)"
   using has_integral_cos_nx [of n] by (force simp: mult.commute)
 
 
 subsection \<open>Taylor series expansion\<close>
 
 lemma mvt_integral:
   fixes f::"'a::real_normed_vector\<Rightarrow>'b::banach"
   assumes f'[derivative_intros]:
     "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   assumes line_in: "\<And>t. t \<in> {0..1} \<Longrightarrow> x + t *\<^sub>R y \<in> S"
   shows "f (x + y) - f x = integral {0..1} (\<lambda>t. f' (x + t *\<^sub>R y) y)" (is ?th1)
 proof -
   from assms have subset: "(\<lambda>xa. x + xa *\<^sub>R y) ` {0..1} \<subseteq> S" by auto
   note [derivative_intros] =
     has_derivative_subset[OF _ subset]
     has_derivative_in_compose[where f="(\<lambda>xa. x + xa *\<^sub>R y)" and g = f]
   note [continuous_intros] =
     continuous_on_compose2[where f="(\<lambda>xa. x + xa *\<^sub>R y)"]
     continuous_on_subset[OF _ subset]
   have "\<And>t. t \<in> {0..1} \<Longrightarrow>
     ((\<lambda>t. f (x + t *\<^sub>R y)) has_vector_derivative f' (x + t *\<^sub>R y) y)
     (at t within {0..1})"
     using assms
     by (auto simp: has_vector_derivative_def
         linear_cmul[OF has_derivative_linear[OF f'], symmetric]
       intro!: derivative_eq_intros)
   from fundamental_theorem_of_calculus[rule_format, OF _ this]
   show ?th1
     by (auto intro!: integral_unique[symmetric])
 qed
 
 lemma (in bounded_bilinear) sum_prod_derivatives_has_vector_derivative:
   assumes "p>0"
   and f0: "Df 0 = f"
   and Df: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Df m has_vector_derivative Df (Suc m) t) (at t within {a..b})"
   and g0: "Dg 0 = g"
   and Dg: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Dg m has_vector_derivative Dg (Suc m) t) (at t within {a..b})"
   and ivl: "a \<le> t" "t \<le> b"
   shows "((\<lambda>t. \<Sum>i<p. (-1)^i *\<^sub>R prod (Df i t) (Dg (p - Suc i) t))
     has_vector_derivative
       prod (f t) (Dg p t) - (-1)^p *\<^sub>R prod (Df p t) (g t))
     (at t within {a..b})"
   using assms
 proof cases
   assume p: "p \<noteq> 1"
   define p' where "p' = p - 2"
   from assms p have p': "{..<p} = {..Suc p'}" "p = Suc (Suc p')"
     by (auto simp: p'_def)
   have *: "\<And>i. i \<le> p' \<Longrightarrow> Suc (Suc p' - i) = (Suc (Suc p') - i)"
     by auto
   let ?f = "\<lambda>i. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg ((p - i)) t))"
   have "(\<Sum>i<p. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg (Suc (p - Suc i)) t) +
     prod (Df (Suc i) t) (Dg (p - Suc i) t))) =
     (\<Sum>i\<le>(Suc p'). ?f i - ?f (Suc i))"
     by (auto simp: algebra_simps p'(2) numeral_2_eq_2 * lessThan_Suc_atMost)
   also note sum_telescope
   finally
   have "(\<Sum>i<p. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg (Suc (p - Suc i)) t) +
     prod (Df (Suc i) t) (Dg (p - Suc i) t)))
     = prod (f t) (Dg p t) - (- 1) ^ p *\<^sub>R prod (Df p t) (g t)"
     unfolding p'[symmetric]
     by (simp add: assms)
   thus ?thesis
     using assms
     by (auto intro!: derivative_eq_intros has_vector_derivative)
 qed (auto intro!: derivative_eq_intros has_vector_derivative)
 
 lemma
   fixes f::"real\<Rightarrow>'a::banach"
   assumes "p>0"
   and f0: "Df 0 = f"
   and Df: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Df m has_vector_derivative Df (Suc m) t) (at t within {a..b})"
   and ivl: "a \<le> b"
   defines "i \<equiv> \<lambda>x. ((b - x) ^ (p - 1) / fact (p - 1)) *\<^sub>R Df p x"
   shows Taylor_has_integral:
     "(i has_integral f b - (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a)) {a..b}"
   and Taylor_integral:
     "f b = (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a) + integral {a..b} i"
   and Taylor_integrable:
     "i integrable_on {a..b}"
 proof goal_cases
   case 1
   interpret bounded_bilinear "scaleR::real\<Rightarrow>'a\<Rightarrow>'a"
     by (rule bounded_bilinear_scaleR)
   define g where "g s = (b - s)^(p - 1)/fact (p - 1)" for s
   define Dg where [abs_def]:
     "Dg n s = (if n < p then (-1)^n * (b - s)^(p - 1 - n) / fact (p - 1 - n) else 0)" for n s
   have g0: "Dg 0 = g"
     using \<open>p > 0\<close>
     by (auto simp add: Dg_def field_split_simps g_def split: if_split_asm)
   {
     fix m
     assume "p > Suc m"
     hence "p - Suc m = Suc (p - Suc (Suc m))"
       by auto
     hence "real (p - Suc m) * fact (p - Suc (Suc m)) = fact (p - Suc m)"
       by auto
   } note fact_eq = this
   have Dg: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Dg m has_vector_derivative Dg (Suc m) t) (at t within {a..b})"
     unfolding Dg_def
     by (auto intro!: derivative_eq_intros simp: has_vector_derivative_def fact_eq field_split_simps)
   let ?sum = "\<lambda>t. \<Sum>i<p. (- 1) ^ i *\<^sub>R Dg i t *\<^sub>R Df (p - Suc i) t"
   from sum_prod_derivatives_has_vector_derivative[of _ Dg _ _ _ Df,
       OF \<open>p > 0\<close> g0 Dg f0 Df]
   have deriv: "\<And>t. a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (?sum has_vector_derivative
       g t *\<^sub>R Df p t - (- 1) ^ p *\<^sub>R Dg p t *\<^sub>R f t) (at t within {a..b})"
     by auto
   from fundamental_theorem_of_calculus[rule_format, OF \<open>a \<le> b\<close> deriv]
   have "(i has_integral ?sum b - ?sum a) {a..b}"
     using atLeastatMost_empty'[simp del]
     by (simp add: i_def g_def Dg_def)
   also
   have one: "(- 1) ^ p' * (- 1) ^ p' = (1::real)"
     and "{..<p} \<inter> {i. p = Suc i} = {p - 1}"
     for p'
     using \<open>p > 0\<close>
     by (auto simp: power_mult_distrib[symmetric])
   then have "?sum b = f b"
     using Suc_pred'[OF \<open>p > 0\<close>]
     by (simp add: diff_eq_eq Dg_def power_0_left le_Suc_eq if_distrib
         if_distribR sum.If_cases f0)
   also
   have "{..<p} = (\<lambda>x. p - x - 1) ` {..<p}"
   proof safe
     fix x
     assume "x < p"
     thus "x \<in> (\<lambda>x. p - x - 1) ` {..<p}"
       by (auto intro!: image_eqI[where x = "p - x - 1"])
   qed simp
   from _ this
   have "?sum a = (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a)"
     by (rule sum.reindex_cong) (auto simp add: inj_on_def Dg_def one)
   finally show c: ?case .
   case 2 show ?case using c integral_unique
     by (metis (lifting) add.commute diff_eq_eq integral_unique)
   case 3 show ?case using c by force
 qed
 
 
 subsection \<open>Only need trivial subintervals if the interval itself is trivial\<close>
 
 proposition division_of_nontrivial:
   fixes \<D> :: "'a::euclidean_space set set"
   assumes sdiv: "\<D> division_of (cbox a b)"
      and cont0: "content (cbox a b) \<noteq> 0"
   shows "{k. k \<in> \<D> \<and> content k \<noteq> 0} division_of (cbox a b)"
   using sdiv
 proof (induction "card \<D>" arbitrary: \<D> rule: less_induct)
   case less
   note \<D> = division_ofD[OF less.prems]
   {
     presume *: "{k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D> \<Longrightarrow> ?case"
     then show ?case
       using less.prems by fastforce
   }
   assume noteq: "{k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D>"
   then obtain K c d where "K \<in> \<D>" and contk: "content K = 0" and keq: "K = cbox c d"
     using \<D>(4) by blast 
   then have "card \<D> > 0"
     unfolding card_gt_0_iff using less by auto
   then have card: "card (\<D> - {K}) < card \<D>"
     using less \<open>K \<in> \<D>\<close> by (simp add: \<D>(1))
   have closed: "closed (\<Union>(\<D> - {K}))"
     using less.prems by auto
   have "x islimpt \<Union>(\<D> - {K})" if "x \<in> K" for x 
     unfolding islimpt_approachable
   proof (intro allI impI)
     fix e::real
     assume "e > 0"
     obtain i where i: "c\<bullet>i = d\<bullet>i" "i\<in>Basis"
       using contk \<D>(3) [OF \<open>K \<in> \<D>\<close>] unfolding box_ne_empty keq
       by (meson content_eq_0 dual_order.antisym)
     then have xi: "x\<bullet>i = d\<bullet>i"
       using \<open>x \<in> K\<close> unfolding keq mem_box by (metis antisym)
     define y where "y = (\<Sum>j\<in>Basis. (if j = i then if c\<bullet>i \<le> (a\<bullet>i + b\<bullet>i)/2 then c\<bullet>i +
       min e (b\<bullet>i - c\<bullet>i)/2 else c\<bullet>i - min e (c\<bullet>i - a\<bullet>i)/2 else x\<bullet>j) *\<^sub>R j)"
     show "\<exists>x'\<in>\<Union>(\<D> - {K}). x' \<noteq> x \<and> dist x' x < e"
     proof (intro bexI conjI)
       have "d \<in> cbox c d"
         using \<D>(3)[OF \<open>K \<in> \<D>\<close>] by (simp add: box_ne_empty(1) keq mem_box(2))
       then have "d \<in> cbox a b"
         using \<D>(2)[OF \<open>K \<in> \<D>\<close>] by (auto simp: keq)
       then have di: "a \<bullet> i \<le> d \<bullet> i \<and> d \<bullet> i \<le> b \<bullet> i"
         using \<open>i \<in> Basis\<close> mem_box(2) by blast
       then have xyi: "y\<bullet>i \<noteq> x\<bullet>i"
         unfolding y_def i xi using \<open>e > 0\<close> cont0 \<open>i \<in> Basis\<close>
         by (auto simp: content_eq_0 elim!: ballE[of _ _ i])
       then show "y \<noteq> x"
         unfolding euclidean_eq_iff[where 'a='a] using i by auto
       have "norm (y-x) \<le> (\<Sum>b\<in>Basis. \<bar>(y - x) \<bullet> b\<bar>)"
         by (rule norm_le_l1)
       also have "... = \<bar>(y - x) \<bullet> i\<bar> + (\<Sum>b \<in> Basis - {i}. \<bar>(y - x) \<bullet> b\<bar>)"
         by (meson finite_Basis i(2) sum.remove)
       also have "... <  e + sum (\<lambda>i. 0) Basis"
       proof (rule add_less_le_mono)
         show "\<bar>(y-x) \<bullet> i\<bar> < e"
           using di \<open>e > 0\<close> y_def i xi by (auto simp: inner_simps)
         show "(\<Sum>i\<in>Basis - {i}. \<bar>(y-x) \<bullet> i\<bar>) \<le> (\<Sum>i\<in>Basis. 0)"
           unfolding y_def by (auto simp: inner_simps)
       qed 
       finally have "norm (y-x) < e + sum (\<lambda>i. 0) Basis" .
       then show "dist y x < e"
         unfolding dist_norm by auto
       have "y \<notin> K"
         unfolding keq mem_box using i(1) i(2) xi xyi by fastforce
       moreover have "y \<in> \<Union>\<D>"
         using subsetD[OF \<D>(2)[OF \<open>K \<in> \<D>\<close>] \<open>x \<in> K\<close>] \<open>e > 0\<close> di i
         by (auto simp: \<D> mem_box y_def field_simps elim!: ballE[of _ _ i])
       ultimately show "y \<in> \<Union>(\<D> - {K})" by auto
     qed
   qed
   then have "K \<subseteq> \<Union>(\<D> - {K})"
     using closed closed_limpt by blast
   then have "\<Union>(\<D> - {K}) = cbox a b"
     unfolding \<D>(6)[symmetric] by auto
   then have "\<D> - {K} division_of cbox a b"
     by (metis Diff_subset less.prems division_of_subset \<D>(6))
   then have "{ka \<in> \<D> - {K}. content ka \<noteq> 0} division_of (cbox a b)"
     using card less.hyps by blast
   moreover have "{ka \<in> \<D> - {K}. content ka \<noteq> 0} = {K \<in> \<D>. content K \<noteq> 0}"
     using contk by auto
   ultimately show ?case by auto
 qed
 
 
 subsection \<open>Integrability on subintervals\<close>
 
 lemma operative_integrableI:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
   shows "operative conj True (\<lambda>i. f integrable_on i)"
 proof -
   interpret comm_monoid conj True
   proof qed
   show ?thesis
   proof
     show "\<And>a b. box a b = {} \<Longrightarrow> (f integrable_on cbox a b) = True"
       by (simp add: content_eq_0_interior integrable_on_null)
     show "\<And>a b c k.
              k \<in> Basis \<Longrightarrow>
              (f integrable_on cbox a b) \<longleftrightarrow>
              (f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k})"
       unfolding integrable_on_def by (auto intro!: has_integral_split)
   qed
 qed
 
 lemma integrable_subinterval:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on cbox a b"
     and cd: "cbox c d \<subseteq> cbox a b"
   shows "f integrable_on cbox c d"
 proof -
   interpret operative conj True "\<lambda>i. f integrable_on i"
     using order_refl by (rule operative_integrableI)
   show ?thesis
   proof (cases "cbox c d = {}")
     case True
     then show ?thesis
       using division [symmetric] f by (auto simp: comm_monoid_set_F_and)
   next
     case False
     then show ?thesis
       by (metis cd comm_monoid_set_F_and division division_of_finite f partial_division_extend_1)
   qed
 qed
 
 lemma integrable_subinterval_real:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
     and "{c..d} \<subseteq> {a..b}"
   shows "f integrable_on {c..d}"
   by (metis assms box_real(2) integrable_subinterval)
 
 subsection \<open>Combining adjacent intervals in 1 dimension\<close>
 
 lemma has_integral_combine:
   fixes a b c :: real and j :: "'a::banach"
   assumes "a \<le> c"
       and "c \<le> b"
       and ac: "(f has_integral i) {a..c}"
       and cb: "(f has_integral j) {c..b}"
   shows "(f has_integral (i + j)) {a..b}"
 proof -
   interpret operative_real "lift_option plus" "Some 0"
     "\<lambda>i. if f integrable_on i then Some (integral i f) else None"
     using operative_integralI by (rule operative_realI)
   from \<open>a \<le> c\<close> \<open>c \<le> b\<close> ac cb coalesce_less_eq
   have *: "lift_option (+)
              (if f integrable_on {a..c} then Some (integral {a..c} f) else None)
              (if f integrable_on {c..b} then Some (integral {c..b} f) else None) =
             (if f integrable_on {a..b} then Some (integral {a..b} f) else None)"
     by (auto simp: split: if_split_asm)
   then have "f integrable_on cbox a b"
     using ac cb by (auto split: if_split_asm)
   with *
   show ?thesis
     using ac cb by (auto simp add: integrable_on_def integral_unique split: if_split_asm)
 qed
 
 lemma integral_combine:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> c"
     and "c \<le> b"
     and ab: "f integrable_on {a..b}"
   shows "integral {a..c} f + integral {c..b} f = integral {a..b} f"
 proof -
   have "(f has_integral integral {a..c} f) {a..c}"
     using ab \<open>c \<le> b\<close> integrable_subinterval_real by fastforce
   moreover
   have "(f has_integral integral {c..b} f) {c..b}"
     using ab \<open>a \<le> c\<close> integrable_subinterval_real by fastforce
   ultimately have "(f has_integral integral {a..c} f + integral {c..b} f) {a..b}"
     using \<open>a \<le> c\<close> \<open>c \<le> b\<close> has_integral_combine by blast
   then show ?thesis
     by (simp add: has_integral_integrable_integral)
 qed
 
 lemma integrable_combine:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> c"
     and "c \<le> b"
     and "f integrable_on {a..c}"
     and "f integrable_on {c..b}"
   shows "f integrable_on {a..b}"
   using assms
   unfolding integrable_on_def
   by (auto intro!: has_integral_combine)
 
 lemma integral_minus_sets:
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "c \<le> a \<Longrightarrow> c \<le> b \<Longrightarrow> f integrable_on {c .. max a b} \<Longrightarrow>
     integral {c .. a} f - integral {c .. b} f =
     (if a \<le> b then - integral {a .. b} f else integral {b .. a} f)"
   using integral_combine[of c a b f]  integral_combine[of c b a f]
   by (auto simp: algebra_simps max_def)
 
 lemma integral_minus_sets':
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "c \<ge> a \<Longrightarrow> c \<ge> b \<Longrightarrow> f integrable_on {min a b .. c} \<Longrightarrow>
     integral {a .. c} f - integral {b .. c} f =
     (if a \<le> b then integral {a .. b} f else - integral {b .. a} f)"
   using integral_combine[of b a c f] integral_combine[of a b c f]
   by (auto simp: algebra_simps min_def)
 
 subsection \<open>Reduce integrability to "local" integrability\<close>
 
 lemma integrable_on_little_subintervals:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<forall>x\<in>cbox a b. \<exists>d>0. \<forall>u v. x \<in> cbox u v \<and> cbox u v \<subseteq> ball x d \<and> cbox u v \<subseteq> cbox a b \<longrightarrow>
     f integrable_on cbox u v"
   shows "f integrable_on cbox a b"
 proof -
   interpret operative conj True "\<lambda>i. f integrable_on i"
     using order_refl by (rule operative_integrableI)
   have "\<forall>x. \<exists>d>0. x\<in>cbox a b \<longrightarrow> (\<forall>u v. x \<in> cbox u v \<and> cbox u v \<subseteq> ball x d \<and> cbox u v \<subseteq> cbox a b \<longrightarrow>
     f integrable_on cbox u v)"
     using assms by (metis zero_less_one)
   then obtain d where d: "\<And>x. 0 < d x"
      "\<And>x u v. \<lbrakk>x \<in> cbox a b; x \<in> cbox u v; cbox u v \<subseteq> ball x (d x); cbox u v \<subseteq> cbox a b\<rbrakk> 
                \<Longrightarrow> f integrable_on cbox u v"
     by metis
   obtain p where p: "p tagged_division_of cbox a b" "(\<lambda>x. ball x (d x)) fine p"
     using fine_division_exists[OF gauge_ball_dependent,of d a b] d(1) by blast 
   then have sndp: "snd ` p division_of cbox a b"
     by (metis division_of_tagged_division)
   have "f integrable_on k" if "(x, k) \<in> p" for x k
     using tagged_division_ofD(2-4)[OF p(1) that] fineD[OF p(2) that] d[of x] by auto
   then show ?thesis
     unfolding division [symmetric, OF sndp] comm_monoid_set_F_and
     by auto
 qed
 
 
 subsection \<open>Second FTC or existence of antiderivative\<close>
 
 lemma integrable_const[intro]: "(\<lambda>x. c) integrable_on cbox a b"
   unfolding integrable_on_def by blast
 
 lemma integral_has_vector_derivative_continuous_at:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on {a..b}"
      and x: "x \<in> {a..b} - S"
      and "finite S"
      and fx: "continuous (at x within ({a..b} - S)) f"
  shows "((\<lambda>u. integral {a..u} f) has_vector_derivative f x) (at x within ({a..b} - S))"
 proof -
   let ?I = "\<lambda>a b. integral {a..b} f"
   { fix e::real
     assume "e > 0"
     obtain d where "d>0" and d: "\<And>x'. \<lbrakk>x' \<in> {a..b} - S; \<bar>x' - x\<bar> < d\<rbrakk> \<Longrightarrow> norm(f x' - f x) \<le> e"
       using \<open>e>0\<close> fx by (auto simp: continuous_within_eps_delta dist_norm less_imp_le)
     have "norm (integral {a..y} f - integral {a..x} f - (y-x) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>" (is "?lhs \<le> ?rhs")
            if y: "y \<in> {a..b} - S" and yx: "\<bar>y - x\<bar> < d" for y
     proof (cases "y < x")
       case False
       have "f integrable_on {a..y}"
         using f y by (simp add: integrable_subinterval_real)
       then have Idiff: "?I a y - ?I a x = ?I x y"
         using False x by (simp add: algebra_simps integral_combine)
       have fux_int: "((\<lambda>u. f u - f x) has_integral integral {x..y} f - (y-x) *\<^sub>R f x) {x..y}"
       proof (rule has_integral_diff)
         show "(f has_integral integral {x..y} f) {x..y}"
           using x y by (auto intro: integrable_integral [OF integrable_subinterval_real [OF f]])
         show "((\<lambda>u. f x) has_integral (y - x) *\<^sub>R f x) {x..y}"
           using has_integral_const_real [of "f x" x y] False by simp
       qed
       have "?lhs \<le> e * content {x..y}"
         using yx False d x y \<open>e>0\<close> assms 
         by (intro has_integral_bound_real[where f="(\<lambda>u. f u - f x)"]) (auto simp: Idiff fux_int)
       also have "... \<le> ?rhs"
         using False by auto
       finally show ?thesis .
     next
       case True
       have "f integrable_on {a..x}"
         using f x by (simp add: integrable_subinterval_real)
       then have Idiff: "?I a x - ?I a y = ?I y x"
         using True x y by (simp add: algebra_simps integral_combine)
       have fux_int: "((\<lambda>u. f u - f x) has_integral integral {y..x} f - (x - y) *\<^sub>R f x) {y..x}"
       proof (rule has_integral_diff)
         show "(f has_integral integral {y..x} f) {y..x}"
           using x y by (auto intro: integrable_integral [OF integrable_subinterval_real [OF f]])
         show "((\<lambda>u. f x) has_integral (x - y) *\<^sub>R f x) {y..x}"
           using has_integral_const_real [of "f x" y x] True by simp
       qed
       have "norm (integral {a..x} f - integral {a..y} f - (x - y) *\<^sub>R f x) \<le> e * content {y..x}"
         using yx True d x y \<open>e>0\<close> assms 
         by (intro has_integral_bound_real[where f="(\<lambda>u. f u - f x)"]) (auto simp: Idiff fux_int)
       also have "... \<le> e * \<bar>y - x\<bar>"
         using True by auto
       finally have "norm (integral {a..x} f - integral {a..y} f - (x - y) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>" .
       then show ?thesis
         by (simp add: algebra_simps norm_minus_commute)
     qed
     then have "\<exists>d>0. \<forall>y\<in>{a..b} - S. \<bar>y - x\<bar> < d \<longrightarrow> norm (integral {a..y} f - integral {a..x} f - (y-x) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>"
       using \<open>d>0\<close> by blast
   }
   then show ?thesis
     by (simp add: has_vector_derivative_def has_derivative_within_alt bounded_linear_scaleR_left)
 qed
 
 
 lemma integral_has_vector_derivative:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
     and "x \<in> {a..b}"
   shows "((\<lambda>u. integral {a..u} f) has_vector_derivative f(x)) (at x within {a..b})"
 using assms integral_has_vector_derivative_continuous_at [OF integrable_continuous_real]
   by (fastforce simp: continuous_on_eq_continuous_within)
 
 lemma integral_has_real_derivative:
   assumes "continuous_on {a..b} g"
   assumes "t \<in> {a..b}"
   shows "((\<lambda>x. integral {a..x} g) has_real_derivative g t) (at t within {a..b})"
   using integral_has_vector_derivative[of a b g t] assms
-  by (auto simp: has_field_derivative_iff_has_vector_derivative)
+  by (auto simp: has_real_derivative_iff_has_vector_derivative)
 
 lemma antiderivative_continuous:
   fixes q b :: real
   assumes "continuous_on {a..b} f"
   obtains g where "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative (f x::_::banach)) (at x within {a..b})"
   using integral_has_vector_derivative[OF assms] by auto
 
 subsection \<open>Combined fundamental theorem of calculus\<close>
 
 lemma antiderivative_integral_continuous:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
   obtains g where "\<forall>u\<in>{a..b}. \<forall>v \<in> {a..b}. u \<le> v \<longrightarrow> (f has_integral (g v - g u)) {u..v}"
 proof -
   obtain g 
     where g: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative f x) (at x within {a..b})" 
     using  antiderivative_continuous[OF assms] by metis
   have "(f has_integral g v - g u) {u..v}" if "u \<in> {a..b}" "v \<in> {a..b}" "u \<le> v" for u v
   proof -
     have "\<And>x. x \<in> cbox u v \<Longrightarrow> (g has_vector_derivative f x) (at x within cbox u v)"
       by (metis atLeastAtMost_iff atLeastatMost_subset_iff box_real(2) g
           has_vector_derivative_within_subset subsetCE that(1,2))
     then show ?thesis
       by (metis box_real(2) that(3) fundamental_theorem_of_calculus)
   qed
   then show ?thesis
     using that by blast
 qed
 
 
 subsection \<open>General "twiddling" for interval-to-interval function image\<close>
 
 lemma has_integral_twiddle:
   assumes "0 < r"
     and hg: "\<And>x. h(g x) = x"
     and gh: "\<And>x. g(h x) = x"
     and contg: "\<And>x. continuous (at x) g"
     and g: "\<And>u v. \<exists>w z. g ` cbox u v = cbox w z"
     and h: "\<And>u v. \<exists>w z. h ` cbox u v = cbox w z"
     and r: "\<And>u v. content(g ` cbox u v) = r * content (cbox u v)"
     and intfi: "(f has_integral i) (cbox a b)"
   shows "((\<lambda>x. f(g x)) has_integral (1 / r) *\<^sub>R i) (h ` cbox a b)"
 proof (cases "cbox a b = {}")
   case True
   then show ?thesis 
     using intfi by auto
 next
   case False
   obtain w z where wz: "h ` cbox a b = cbox w z"
     using h by blast
   have inj: "inj g" "inj h"
     using hg gh injI by metis+
   from h obtain ha hb where h_eq: "h ` cbox a b = cbox ha hb" by blast
   have "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of h ` cbox a b \<and> d fine p 
               \<longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i) < e)"
     if "e > 0" for e
   proof -
     have "e * r > 0" using that \<open>0 < r\<close> by simp
     with intfi[unfolded has_integral]
     obtain d where "gauge d"
                and d: "\<And>p. p tagged_division_of cbox a b \<and> d fine p 
                         \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < e * r" 
       by metis
     define d' where "d' x = g -` d (g x)" for x
     show ?thesis
     proof (rule_tac x=d' in exI, safe)
       show "gauge d'"
         using \<open>gauge d\<close> continuous_open_vimage[OF _ contg] by (auto simp: gauge_def d'_def)
     next
       fix p
       assume ptag: "p tagged_division_of h ` cbox a b" and finep: "d' fine p"
       note p = tagged_division_ofD[OF ptag]
       have gab: "g y \<in> cbox a b" if "y \<in> K" "(x, K) \<in> p" for x y K
         by (metis hg inj(2) inj_image_mem_iff p(3) subsetCE that that)
       have gimp: "(\<lambda>(x,K). (g x, g ` K)) ` p tagged_division_of (cbox a b) \<and> 
                   d fine (\<lambda>(x, k). (g x, g ` k)) ` p"
         unfolding tagged_division_of
       proof safe
         show "finite ((\<lambda>(x, k). (g x, g ` k)) ` p)"
           using ptag by auto
         show "d fine (\<lambda>(x, k). (g x, g ` k)) ` p"
           using finep unfolding fine_def d'_def by auto
       next
         fix x k
         assume xk: "(x, k) \<in> p"
         show "g x \<in> g ` k"
           using p(2)[OF xk] by auto
         show "\<exists>u v. g ` k = cbox u v"
           using p(4)[OF xk] using assms(5-6) by auto
         fix x' K' u
         assume xk': "(x', K') \<in> p" and u: "u \<in> interior (g ` k)" "u \<in> interior (g ` K')"
         have "interior k \<inter> interior K' \<noteq> {}"
         proof 
           assume "interior k \<inter> interior K' = {}"
           moreover have "u \<in> g ` (interior k \<inter> interior K')"
             using interior_image_subset[OF \<open>inj g\<close> contg] u
             unfolding image_Int[OF inj(1)] by blast
           ultimately show False by blast
         qed
         then have same: "(x, k) = (x', K')"
           using ptag xk' xk by blast
         then show "g x = g x'"
           by auto
         show "g u \<in> g ` K'"if "u \<in> k" for u
           using that same by auto
         show "g u \<in> g ` k"if "u \<in> K'" for u
           using that same by auto
       next
         fix x
         assume "x \<in> cbox a b"
         then have "h x \<in>  \<Union>{k. \<exists>x. (x, k) \<in> p}"
           using p(6) by auto
         then obtain X y where "h x \<in> X" "(y, X) \<in> p" by blast
         then show "x \<in> \<Union>{k. \<exists>x. (x, k) \<in> (\<lambda>(x, k). (g x, g ` k)) ` p}"
           by clarsimp (metis (no_types, lifting) gh image_eqI pair_imageI)
       qed (use gab in auto)
       have *: "inj_on (\<lambda>(x, k). (g x, g ` k)) p"
         using inj(1) unfolding inj_on_def by fastforce
       have "(\<Sum>(x,K)\<in>(\<lambda>(y,L). (g y, g ` L)) ` p. content K *\<^sub>R f x) 
           = (\<Sum>u\<in>p. case case u of (x,K) \<Rightarrow> (g x, g ` K) of (y,L) \<Rightarrow> content L *\<^sub>R f y)"
         by (metis (mono_tags, lifting) "*" sum.reindex_cong)
       also have "... = (\<Sum>(x,K)\<in>p. r *\<^sub>R content K *\<^sub>R f (g x))"
         using r by (auto intro!: * sum.cong simp: bij_betw_def dest!: p(4))
       finally
       have "(\<Sum>(x, K)\<in>(\<lambda>(x,K). (g x, g ` K)) ` p. content K *\<^sub>R f x) - i = r *\<^sub>R (\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - i" 
         by (simp add: scaleR_right.sum split_def)
       also have "\<dots> = r *\<^sub>R ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i)" 
         using \<open>0 < r\<close> by (auto simp: scaleR_diff_right)
       finally show "norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i) < e"
         using d[OF gimp] \<open>0 < r\<close> by auto
     qed
   qed
   then show ?thesis
     by (auto simp: h_eq has_integral)
 qed
 
 
 subsection \<open>Special case of a basic affine transformation\<close>
 
 lemma AE_lborel_inner_neq:
   assumes k: "k \<in> Basis"
   shows "AE x in lborel. x \<bullet> k \<noteq> c"
 proof -
   interpret finite_product_sigma_finite "\<lambda>_. lborel" Basis
     proof qed simp
     have "emeasure lborel {x\<in>space lborel. x \<bullet> k = c} 
         = emeasure (\<Pi>\<^sub>M j::'a\<in>Basis. lborel) (\<Pi>\<^sub>E j\<in>Basis. if j = k then {c} else UNIV)"
     using k
     by (auto simp add: lborel_eq[where 'a='a] emeasure_distr intro!: arg_cong2[where f=emeasure])
        (auto simp: space_PiM PiE_iff extensional_def split: if_split_asm)
   also have "\<dots> = (\<Prod>j\<in>Basis. emeasure lborel (if j = k then {c} else UNIV))"
     by (intro measure_times) auto
   also have "\<dots> = 0"
     by (intro prod_zero bexI[OF _ k]) auto
   finally show ?thesis
     by (subst AE_iff_measurable[OF _ refl]) auto
 qed
 
 lemma content_image_stretch_interval:
   fixes m :: "'a::euclidean_space \<Rightarrow> real"
   defines "s f x \<equiv> (\<Sum>k::'a\<in>Basis. (f k * (x\<bullet>k)) *\<^sub>R k)"
   shows "content (s m ` cbox a b) = \<bar>\<Prod>k\<in>Basis. m k\<bar> * content (cbox a b)"
 proof cases
   have s[measurable]: "s f \<in> borel \<rightarrow>\<^sub>M borel" for f
     by (auto simp: s_def[abs_def])
   assume m: "\<forall>k\<in>Basis. m k \<noteq> 0"
   then have s_comp_s: "s (\<lambda>k. 1 / m k) \<circ> s m = id" "s m \<circ> s (\<lambda>k. 1 / m k) = id"
     by (auto simp: s_def[abs_def] fun_eq_iff euclidean_representation)
   then have "inv (s (\<lambda>k. 1 / m k)) = s m" "bij (s (\<lambda>k. 1 / m k))"
     by (auto intro: inv_unique_comp o_bij)
   then have eq: "s m ` cbox a b = s (\<lambda>k. 1 / m k) -` cbox a b"
     using bij_vimage_eq_inv_image[OF \<open>bij (s (\<lambda>k. 1 / m k))\<close>, of "cbox a b"] by auto
   show ?thesis
     using m unfolding eq measure_def
     by (subst lborel_affine_euclidean[where c=m and t=0])
        (simp_all add: emeasure_density measurable_sets_borel[OF s] abs_prod nn_integral_cmult
                       s_def[symmetric] emeasure_distr vimage_comp s_comp_s enn2real_mult prod_nonneg)
 next
   assume "\<not> (\<forall>k\<in>Basis. m k \<noteq> 0)"
   then obtain k where k: "k \<in> Basis" "m k = 0" by auto
   then have [simp]: "(\<Prod>k\<in>Basis. m k) = 0"
     by (intro prod_zero) auto
   have "emeasure lborel {x\<in>space lborel. x \<in> s m ` cbox a b} = 0"
   proof (rule emeasure_eq_0_AE)
     show "AE x in lborel. x \<notin> s m ` cbox a b"
       using AE_lborel_inner_neq[OF \<open>k\<in>Basis\<close>]
     proof eventually_elim
       show "x \<bullet> k \<noteq> 0 \<Longrightarrow> x \<notin> s m ` cbox a b " for x
         using k by (auto simp: s_def[abs_def] cbox_def)
     qed
   qed
   then show ?thesis
     by (simp add: measure_def)
 qed
 
 lemma interval_image_affinity_interval:
   "\<exists>u v. (\<lambda>x. m *\<^sub>R (x::'a::euclidean_space) + c) ` cbox a b = cbox u v"
   unfolding image_affinity_cbox
   by auto
 
 lemma content_image_affinity_cbox:
   "content((\<lambda>x::'a::euclidean_space. m *\<^sub>R x + c) ` cbox a b) =
     \<bar>m\<bar> ^ DIM('a) * content (cbox a b)" (is "?l = ?r")
 proof (cases "cbox a b = {}")
   case True then show ?thesis by simp
 next
   case False
   show ?thesis
   proof (cases "m \<ge> 0")
     case True
     with \<open>cbox a b \<noteq> {}\<close> have "cbox (m *\<^sub>R a + c) (m *\<^sub>R b + c) \<noteq> {}"
       by (simp add: box_ne_empty inner_left_distrib mult_left_mono)
     moreover from True have *: "\<And>i. (m *\<^sub>R b + c) \<bullet> i - (m *\<^sub>R a + c) \<bullet> i = m *\<^sub>R (b-a) \<bullet> i"
       by (simp add: inner_simps field_simps)
     ultimately show ?thesis
       by (simp add: image_affinity_cbox True content_cbox'
         prod.distrib inner_diff_left)
   next
     case False
     with \<open>cbox a b \<noteq> {}\<close> have "cbox (m *\<^sub>R b + c) (m *\<^sub>R a + c) \<noteq> {}"
       by (simp add: box_ne_empty inner_left_distrib mult_left_mono)
     moreover from False have *: "\<And>i. (m *\<^sub>R a + c) \<bullet> i - (m *\<^sub>R b + c) \<bullet> i = (-m) *\<^sub>R (b-a) \<bullet> i"
       by (simp add: inner_simps field_simps)
     ultimately show ?thesis using False
       by (simp add: image_affinity_cbox content_cbox'
         prod.distrib[symmetric] inner_diff_left flip: prod_constant)
   qed
 qed
 
 lemma has_integral_affinity:
   fixes a :: "'a::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
       and "m \<noteq> 0"
   shows "((\<lambda>x. f(m *\<^sub>R x + c)) has_integral (1 / (\<bar>m\<bar> ^ DIM('a))) *\<^sub>R i) ((\<lambda>x. (1 / m) *\<^sub>R x + -((1 / m) *\<^sub>R c)) ` cbox a b)"
 proof (rule has_integral_twiddle)
   show "\<exists>w z. (\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox u v = cbox w z" 
        "\<exists>w z. (\<lambda>x. m *\<^sub>R x + c) ` cbox u v = cbox w z" for u v
     using interval_image_affinity_interval by blast+
   show "content ((\<lambda>x. m *\<^sub>R x + c) ` cbox u v) = \<bar>m\<bar> ^ DIM('a) * content (cbox u v)" for u v
     using content_image_affinity_cbox by blast
 qed (use assms zero_less_power in \<open>auto simp: field_simps\<close>)
 
 lemma integrable_affinity:
   assumes "f integrable_on cbox a b"
     and "m \<noteq> 0"
   shows "(\<lambda>x. f(m *\<^sub>R x + c)) integrable_on ((\<lambda>x. (1 / m) *\<^sub>R x + -((1/m) *\<^sub>R c)) ` cbox a b)"
   using has_integral_affinity assms
   unfolding integrable_on_def by blast
 
 lemmas has_integral_affinity01 = has_integral_affinity [of _ _ 0 "1::real", simplified]
 
 lemma integrable_on_affinity:
   assumes "m \<noteq> 0" "f integrable_on (cbox a b)"
   shows   "(\<lambda>x. f (m *\<^sub>R x + c)) integrable_on ((\<lambda>x. (1 / m) *\<^sub>R x - ((1 / m) *\<^sub>R c)) ` cbox a b)"
 proof -
   from assms obtain I where "(f has_integral I) (cbox a b)"
     by (auto simp: integrable_on_def)
   from has_integral_affinity[OF this assms(1), of c] show ?thesis
     by (auto simp: integrable_on_def)
 qed
 
 lemma has_integral_cmul_iff:
   assumes "c \<noteq> 0"
   shows   "((\<lambda>x. c *\<^sub>R f x) has_integral (c *\<^sub>R I)) A \<longleftrightarrow> (f has_integral I) A"
   using assms has_integral_cmul[of f I A c]
         has_integral_cmul[of "\<lambda>x. c *\<^sub>R f x" "c *\<^sub>R I" A "inverse c"] by (auto simp: field_simps)
 
+lemma has_integral_cmul_iff':
+  assumes "c \<noteq> 0"
+  shows   "((\<lambda>x. c *\<^sub>R f x) has_integral I) A \<longleftrightarrow> (f has_integral I /\<^sub>R c) A"
+  using assms by (metis divideR_right has_integral_cmul_iff)
+
 lemma has_integral_affinity':
   fixes a :: "'a::euclidean_space"
   assumes "(f has_integral i) (cbox a b)" and "m > 0"
   shows "((\<lambda>x. f(m *\<^sub>R x + c)) has_integral (i /\<^sub>R m ^ DIM('a)))
            (cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m))"
 proof (cases "cbox a b = {}")
   case True
   hence "(cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)) = {}"
     using \<open>m > 0\<close> unfolding box_eq_empty by (auto simp: algebra_simps)
   with True and assms show ?thesis by simp
 next
   case False
   have "((\<lambda>x. f (m *\<^sub>R x + c)) has_integral (1 / \<bar>m\<bar> ^ DIM('a)) *\<^sub>R i)
           ((\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox a b)"
     using assms by (intro has_integral_affinity) auto
   also have "((\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox a b) =
                ((\<lambda>x.  - ((1 / m) *\<^sub>R c) + x) ` (\<lambda>x. (1 / m) *\<^sub>R x) ` cbox a b)"
     by (simp add: image_image algebra_simps)
   also have "(\<lambda>x. (1 / m) *\<^sub>R x) ` cbox a b = cbox ((1 / m) *\<^sub>R a) ((1 / m) *\<^sub>R b)" using \<open>m > 0\<close> False
     by (subst image_smult_cbox) simp_all
   also have "(\<lambda>x. - ((1 / m) *\<^sub>R c) + x) ` \<dots> = cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)"
     by (subst cbox_translation [symmetric]) (simp add: field_simps vector_add_divide_simps)
   finally show ?thesis using \<open>m > 0\<close> by (simp add: field_simps)
 qed
 
 lemma has_integral_affinity_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: real_normed_vector"
   assumes "m > 0"
   shows   "((\<lambda>x. f (m *\<^sub>R x + c)) has_integral (I /\<^sub>R m ^ DIM('a)))
                (cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)) \<longleftrightarrow>
            (f has_integral I) (cbox a b)" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   from has_integral_affinity'[OF this, of "1 / m" "-c /\<^sub>R m"] and \<open>m > 0\<close>
     show ?rhs by (simp add: vector_add_divide_simps) (simp add: field_simps)
 next
   assume ?rhs
   from has_integral_affinity'[OF this, of m c] and \<open>m > 0\<close>
   show ?lhs by simp
 qed
 
 
 subsection \<open>Special case of stretching coordinate axes separately\<close>
 
 lemma has_integral_stretch:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>k\<in>Basis. m k \<noteq> 0"
   shows "((\<lambda>x. f (\<Sum>k\<in>Basis. (m k * (x\<bullet>k))*\<^sub>R k)) has_integral
          ((1/ \<bar>prod m Basis\<bar>) *\<^sub>R i)) ((\<lambda>x. (\<Sum>k\<in>Basis. (1 / m k * (x\<bullet>k))*\<^sub>R k)) ` cbox a b)"
   apply (rule has_integral_twiddle[where f=f])
   unfolding zero_less_abs_iff content_image_stretch_interval
   unfolding image_stretch_interval empty_as_interval euclidean_eq_iff[where 'a='a]
   using assms
   by auto
 
 lemma has_integral_stretch_real:
   fixes f :: "real \<Rightarrow> 'b::real_normed_vector"
   assumes "(f has_integral i) {a..b}" and "m \<noteq> 0"
   shows "((\<lambda>x. f (m * x)) has_integral (1 / \<bar>m\<bar>) *\<^sub>R i) ((\<lambda>x. x / m) ` {a..b})"
   using has_integral_stretch [of f i a b "\<lambda>b. m"] assms by simp
 
 lemma integrable_stretch:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "f integrable_on cbox a b"
     and "\<forall>k\<in>Basis. m k \<noteq> 0"
   shows "(\<lambda>x::'a. f (\<Sum>k\<in>Basis. (m k * (x\<bullet>k))*\<^sub>R k)) integrable_on
     ((\<lambda>x. \<Sum>k\<in>Basis. (1 / m k * (x\<bullet>k))*\<^sub>R k) ` cbox a b)"
   using assms unfolding integrable_on_def
   by (force dest: has_integral_stretch)
 
 lemma vec_lambda_eq_sum:
      "(\<chi> k. f k (x $ k)) = (\<Sum>k\<in>Basis. (f (axis_index k) (x \<bullet> k)) *\<^sub>R k)" (is "?lhs = ?rhs")
 proof -
   have "?lhs = (\<chi> k. f k (x \<bullet> axis k 1))"
     by (simp add: cart_eq_inner_axis)
   also have "... = (\<Sum>u\<in>UNIV. f u (x \<bullet> axis u 1) *\<^sub>R axis u 1)"
     by (simp add: vec_eq_iff axis_def if_distrib cong: if_cong)
   also have "... = ?rhs"
     by (simp add: Basis_vec_def UNION_singleton_eq_range sum.reindex axis_eq_axis inj_on_def)
   finally show ?thesis .
 qed
 
 lemma has_integral_stretch_cart:
   fixes m :: "'n::finite \<Rightarrow> real"
   assumes f: "(f has_integral i) (cbox a b)" and m: "\<And>k. m k \<noteq> 0"
   shows "((\<lambda>x. f(\<chi> k. m k * x$k)) has_integral i /\<^sub>R \<bar>prod m UNIV\<bar>)
             ((\<lambda>x. \<chi> k. x$k / m k) ` (cbox a b))"
 proof -
   have *: "\<forall>k:: real^'n \<in> Basis. m (axis_index k) \<noteq> 0"
     using axis_index by (simp add: m)
   have eqp: "(\<Prod>k:: real^'n \<in> Basis. m (axis_index k)) = prod m UNIV"
     by (simp add: Basis_vec_def UNION_singleton_eq_range prod.reindex axis_eq_axis inj_on_def)
   show ?thesis
     using has_integral_stretch [OF f *] vec_lambda_eq_sum [where f="\<lambda>i x. m i * x"] vec_lambda_eq_sum [where f="\<lambda>i x. x / m i"]
     by (simp add: field_simps eqp)
 qed
 
 lemma image_stretch_interval_cart:
   fixes m :: "'n::finite \<Rightarrow> real"
   shows "(\<lambda>x. \<chi> k. m k * x$k) ` cbox a b =
             (if cbox a b = {} then {}
             else cbox (\<chi> k. min (m k * a$k) (m k * b$k)) (\<chi> k. max (m k * a$k) (m k * b$k)))"
 proof -
   have *: "(\<Sum>k\<in>Basis. min (m (axis_index k) * (a \<bullet> k)) (m (axis_index k) * (b \<bullet> k)) *\<^sub>R k)
            = (\<chi> k. min (m k * a $ k) (m k * b $ k))"
           "(\<Sum>k\<in>Basis. max (m (axis_index k) * (a \<bullet> k)) (m (axis_index k) * (b \<bullet> k)) *\<^sub>R k)
            = (\<chi> k. max (m k * a $ k) (m k * b $ k))"
     apply (simp_all add: Basis_vec_def cart_eq_inner_axis UNION_singleton_eq_range sum.reindex axis_eq_axis inj_on_def)
     apply (simp_all add: vec_eq_iff axis_def if_distrib cong: if_cong)
     done
   show ?thesis
     by (simp add: vec_lambda_eq_sum [where f="\<lambda>i x. m i * x"] image_stretch_interval eq_cbox *)
 qed
 
 
 subsection \<open>even more special cases\<close>
 
 lemma uminus_interval_vector[simp]:
   fixes a b :: "'a::euclidean_space"
   shows "uminus ` cbox a b = cbox (-b) (-a)"
 proof -
   have "x \<in> uminus ` cbox a b" if "x \<in> cbox (- b) (- a)" for x
   proof -
     have "-x \<in> cbox a b"
       using that by (auto simp: mem_box)
     then show ?thesis
       by force
   qed
   then show ?thesis
     by (auto simp: mem_box)
 qed
 
 lemma has_integral_reflect_lemma[intro]:
   assumes "(f has_integral i) (cbox a b)"
   shows "((\<lambda>x. f(-x)) has_integral i) (cbox (-b) (-a))"
   using has_integral_affinity[OF assms, of "-1" 0]
   by auto
 
 lemma has_integral_reflect_lemma_real[intro]:
   assumes "(f has_integral i) {a..b::real}"
   shows "((\<lambda>x. f(-x)) has_integral i) {-b .. -a}"
   using assms
   unfolding box_real[symmetric]
   by (rule has_integral_reflect_lemma)
 
 lemma has_integral_reflect[simp]:
   "((\<lambda>x. f (-x)) has_integral i) (cbox (-b) (-a)) \<longleftrightarrow> (f has_integral i) (cbox a b)"
   by (auto dest: has_integral_reflect_lemma)
 
 lemma has_integral_reflect_real[simp]:
   fixes a b::real
   shows "((\<lambda>x. f (-x)) has_integral i) {-b..-a} \<longleftrightarrow> (f has_integral i) {a..b}"
   by (metis has_integral_reflect interval_cbox)
 
 lemma integrable_reflect[simp]: "(\<lambda>x. f(-x)) integrable_on cbox (-b) (-a) \<longleftrightarrow> f integrable_on cbox a b"
   unfolding integrable_on_def by auto
 
 lemma integrable_reflect_real[simp]: "(\<lambda>x. f(-x)) integrable_on {-b .. -a} \<longleftrightarrow> f integrable_on {a..b::real}"
   unfolding box_real[symmetric]
   by (rule integrable_reflect)
 
 lemma integral_reflect[simp]: "integral (cbox (-b) (-a)) (\<lambda>x. f (-x)) = integral (cbox a b) f"
   unfolding integral_def by auto
 
 lemma integral_reflect_real[simp]: "integral {-b .. -a} (\<lambda>x. f (-x)) = integral {a..b::real} f"
   unfolding box_real[symmetric]
   by (rule integral_reflect)
 
 subsection \<open>Stronger form of FCT; quite a tedious proof\<close>
 
 lemma split_minus[simp]: "(\<lambda>(x, k). f x k) x - (\<lambda>(x, k). g x k) x = (\<lambda>(x, k). f x k - g x k) x"
   by (simp add: split_def)
 
 theorem fundamental_theorem_of_calculus_interior:
   fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
   assumes "a \<le> b"
     and contf: "continuous_on {a..b} f"
     and derf: "\<And>x. x \<in> {a <..< b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
   shows "(f' has_integral (f b - f a)) {a..b}"
 proof (cases "a = b")
   case True
   then have *: "cbox a b = {b}" "f b - f a = 0"
     by (auto simp add:  order_antisym)
   with True show ?thesis by auto
 next
   case False
   with \<open>a \<le> b\<close> have ab: "a < b" by arith
   show ?thesis
     unfolding has_integral_factor_content_real
   proof (intro allI impI)
     fix e :: real
     assume e: "e > 0"
     then have eba8: "(e * (b-a)) / 8 > 0"
       using ab by (auto simp add: field_simps)
     note derf_exp = derf[unfolded has_vector_derivative_def has_derivative_at_alt, THEN conjunct2, rule_format]
     have bounded: "\<And>x. x \<in> {a<..<b} \<Longrightarrow> bounded_linear (\<lambda>u. u *\<^sub>R f' x)"
       by (simp add: bounded_linear_scaleR_left)
     have "\<forall>x \<in> box a b. \<exists>d>0. \<forall>y. norm (y-x) < d \<longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
       (is "\<forall>x \<in> box a b. ?Q x") \<comment>\<open>The explicit quantifier is required by the following step\<close>
     proof
       fix x assume "x \<in> box a b"
       with e show "?Q x"
         using derf_exp [of x "e/2"] by auto
     qed
     then obtain d where d: "\<And>x. 0 < d x"
       "\<And>x y. \<lbrakk>x \<in> box a b; norm (y-x) < d x\<rbrakk> \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
       unfolding bgauge_existence_lemma by metis
     have "bounded (f ` cbox a b)"
       using compact_cbox assms by (auto simp: compact_imp_bounded compact_continuous_image)
     then obtain B 
       where "0 < B" and B: "\<And>x. x \<in> f ` cbox a b \<Longrightarrow> norm x \<le> B"
       unfolding bounded_pos by metis
     obtain da where "0 < da"
       and da: "\<And>c. \<lbrakk>a \<le> c; {a..c} \<subseteq> {a..b}; {a..c} \<subseteq> ball a da\<rbrakk>
                           \<Longrightarrow> norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> (e * (b-a)) / 4"
     proof -
       have "continuous (at a within {a..b}) f"
         using contf continuous_on_eq_continuous_within by force
       with eba8 obtain k where "0 < k"
         and k: "\<And>x. \<lbrakk>x \<in> {a..b}; 0 < norm (x-a); norm (x-a) < k\<rbrakk> \<Longrightarrow> norm (f x - f a) < e * (b-a) / 8"
         unfolding continuous_within Lim_within dist_norm by metis
       obtain l where l: "0 < l" "norm (l *\<^sub>R f' a) \<le> e * (b-a) / 8" 
       proof (cases "f' a = 0")
         case True with ab e that show ?thesis by auto
       next
         case False
         show ?thesis
         proof
           show "norm ((e * (b - a) / 8 / norm (f' a)) *\<^sub>R f' a) \<le> e * (b - a) / 8"
                "0 < e * (b - a) / 8 / norm (f' a)"
             using False ab e by (auto simp add: field_simps)
         qed 
       qed
       have "norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> e * (b-a) / 4"
         if "a \<le> c" "{a..c} \<subseteq> {a..b}" and bmin: "{a..c} \<subseteq> ball a (min k l)" for c
       proof -
         have minkl: "\<bar>a - x\<bar> < min k l" if "x \<in> {a..c}" for x
           using bmin dist_real_def that by auto
         then have lel: "\<bar>c - a\<bar> \<le> \<bar>l\<bar>"
           using that by force
         have "norm ((c - a) *\<^sub>R f' a - (f c - f a)) \<le> norm ((c - a) *\<^sub>R f' a) + norm (f c - f a)"
           by (rule norm_triangle_ineq4)
         also have "\<dots> \<le> e * (b-a) / 8 + e * (b-a) / 8"
         proof (rule add_mono)
           have "norm ((c - a) *\<^sub>R f' a) \<le> norm (l *\<^sub>R f' a)"
             by (auto intro: mult_right_mono [OF lel])
           also have "... \<le> e * (b-a) / 8"
             by (rule l)
           finally show "norm ((c - a) *\<^sub>R f' a) \<le> e * (b-a) / 8" .
         next
           have "norm (f c - f a) < e * (b-a) / 8"
           proof (cases "a = c")
             case True then show ?thesis
               using eba8 by auto
           next
             case False show ?thesis
               by (rule k) (use minkl \<open>a \<le> c\<close> that False in auto)
           qed
           then show "norm (f c - f a) \<le> e * (b-a) / 8" by simp
         qed
         finally show "norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> e * (b-a) / 4"
           unfolding content_real[OF \<open>a \<le> c\<close>] by auto
       qed
       then show ?thesis
         by (rule_tac da="min k l" in that) (auto simp: l \<open>0 < k\<close>)
     qed
     obtain db where "0 < db"
       and db: "\<And>c. \<lbrakk>c \<le> b; {c..b} \<subseteq> {a..b}; {c..b} \<subseteq> ball b db\<rbrakk>
                           \<Longrightarrow> norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> (e * (b-a)) / 4"
     proof -
       have "continuous (at b within {a..b}) f"
         using contf continuous_on_eq_continuous_within by force
       with eba8 obtain k
         where "0 < k"
           and k: "\<And>x. \<lbrakk>x \<in> {a..b}; 0 < norm(x-b); norm(x-b) < k\<rbrakk>
                      \<Longrightarrow> norm (f b - f x) < e * (b-a) / 8"
         unfolding continuous_within Lim_within dist_norm norm_minus_commute by metis
       obtain l where l: "0 < l" "norm (l *\<^sub>R f' b) \<le> (e * (b-a)) / 8"
       proof (cases "f' b = 0")
         case True thus ?thesis 
           using ab e that by auto
       next
         case False show ?thesis
         proof
           show "norm ((e * (b - a) / 8 / norm (f' b)) *\<^sub>R f' b) \<le> e * (b - a) / 8" 
                "0 < e * (b - a) / 8 / norm (f' b)"
             using False ab e by (auto simp add: field_simps)
         qed
       qed
       have "norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> e * (b-a) / 4" 
         if "c \<le> b" "{c..b} \<subseteq> {a..b}" and bmin: "{c..b} \<subseteq> ball b (min k l)" for c
       proof -
         have minkl: "\<bar>b - x\<bar> < min k l" if "x \<in> {c..b}" for x
           using bmin dist_real_def that by auto
         then have lel: "\<bar>b - c\<bar> \<le> \<bar>l\<bar>"
           using that by force
         have "norm ((b - c) *\<^sub>R f' b - (f b - f c)) \<le> norm ((b - c) *\<^sub>R f' b) + norm (f b - f c)"
           by (rule norm_triangle_ineq4)
         also have "\<dots> \<le> e * (b-a) / 8 + e * (b-a) / 8"
         proof (rule add_mono)
           have "norm ((b - c) *\<^sub>R f' b) \<le> norm (l *\<^sub>R f' b)"
             by (auto intro: mult_right_mono [OF lel])
           also have "... \<le> e * (b-a) / 8"
             by (rule l)
           finally show "norm ((b - c) *\<^sub>R f' b) \<le> e * (b-a) / 8" .
         next
           have "norm (f b - f c) < e * (b-a) / 8"
           proof (cases "b = c")
             case True with eba8 show ?thesis
               by auto
           next
             case False show ?thesis
               by (rule k) (use minkl \<open>c \<le> b\<close> that False in auto)
           qed
           then show "norm (f b - f c) \<le> e * (b-a) / 8" by simp
         qed
         finally show "norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> e * (b-a) / 4"
           unfolding content_real[OF \<open>c \<le> b\<close>] by auto
       qed
       then show ?thesis
         by (rule_tac db="min k l" in that) (auto simp: l \<open>0 < k\<close>)
     qed
     let ?d = "(\<lambda>x. ball x (if x=a then da else if x=b then db else d x))"
     show "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of {a..b} \<and> d fine p \<longrightarrow>
               norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content {a..b})"
     proof (rule exI, safe)
       show "gauge ?d"
         using ab \<open>db > 0\<close> \<open>da > 0\<close> d(1) by (auto intro: gauge_ball_dependent)
     next
       fix p
       assume ptag: "p tagged_division_of {a..b}" and fine: "?d fine p"
       let ?A = "{t. fst t \<in> {a, b}}"
       note p = tagged_division_ofD[OF ptag]
       have pA: "p = (p \<inter> ?A) \<union> (p - ?A)" "finite (p \<inter> ?A)" "finite (p - ?A)" "(p \<inter> ?A) \<inter> (p - ?A) = {}"
         using ptag fine by auto
       have le_xz: "\<And>w x y z::real. y \<le> z/2 \<Longrightarrow> w - x \<le> z/2 \<Longrightarrow> w + y \<le> x + z"
         by arith
       have non: False if xk: "(x,K) \<in> p" and "x \<noteq> a" "x \<noteq> b"
         and less: "e * (Sup K - Inf K)/2 < norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))"
       for x K
       proof -
         obtain u v where k: "K = cbox u v"
           using p(4) xk by blast
         then have "u \<le> v" and uv: "{u, v} \<subseteq> cbox u v"
           using p(2)[OF xk] by auto
         then have result: "e * (v - u)/2 < norm ((v - u) *\<^sub>R f' x - (f v - f u))"
           using less[unfolded k box_real interval_bounds_real content_real] by auto
         then have "x \<in> box a b"
           using p(2) p(3) \<open>x \<noteq> a\<close> \<open>x \<noteq> b\<close> xk by fastforce
         with d have *: "\<And>y. norm (y-x) < d x 
                 \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
           by metis
         have xd: "norm (u - x) < d x" "norm (v - x) < d x"
           using fineD[OF fine xk] \<open>x \<noteq> a\<close> \<open>x \<noteq> b\<close> uv 
           by (auto simp add: k subset_eq dist_commute dist_real_def)
         have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) =
               norm ((f u - f x - (u - x) *\<^sub>R f' x) - (f v - f x - (v - x) *\<^sub>R f' x))"
           by (rule arg_cong[where f=norm]) (auto simp: scaleR_left.diff)
         also have "\<dots> \<le> e/2 * norm (u - x) + e/2 * norm (v - x)"
           by (metis norm_triangle_le_diff add_mono * xd)
         also have "\<dots> \<le> e/2 * norm (v - u)"
           using p(2)[OF xk] by (auto simp add: field_simps k)
         also have "\<dots> < norm ((v - u) *\<^sub>R f' x - (f v - f u))"
           using result by (simp add: \<open>u \<le> v\<close>)
         finally have "e * (v - u)/2 < e * (v - u)/2"
           using uv by auto
         then show False by auto
       qed
       have "norm (\<Sum>(x, K)\<in>p - ?A. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
           \<le> (\<Sum>(x, K)\<in>p - ?A. norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))))"
         by (auto intro: sum_norm_le)
       also have "... \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k)/2)"
         using non by (fastforce intro: sum_mono)
       finally have I: "norm (\<Sum>(x, k)\<in>p - ?A.
                   content k *\<^sub>R f' x - (f (Sup k) - f (Inf k)))
              \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
         by (simp add: sum_divide_distrib)
       have II: "norm (\<Sum>(x, k)\<in>p \<inter> ?A. content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) -
              (\<Sum>n\<in>p \<inter> ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))
              \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
       proof -
         have ge0: "0 \<le> e * (Sup k - Inf k)" if xkp: "(x, k) \<in> p \<inter> ?A" for x k
         proof -
           obtain u v where uv: "k = cbox u v"
             by (meson Int_iff xkp p(4))
           with p(2) that uv have "cbox u v \<noteq> {}"
             by blast
           then show "0 \<le> e * ((Sup k) - (Inf k))"
             unfolding uv using e by (auto simp add: field_simps)
         qed
         let ?B = "\<lambda>x. {t \<in> p. fst t = x \<and> content (snd t) \<noteq> 0}"
         let ?C = "{t \<in> p. fst t \<in> {a, b} \<and> content (snd t) \<noteq> 0}"
         have "norm (\<Sum>(x, k)\<in>p \<inter> {t. fst t \<in> {a, b}}. content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) \<le> e * (b-a)/2"
         proof -
           have *: "\<And>S f e. sum f S = sum f (p \<inter> ?C) \<Longrightarrow> norm (sum f (p \<inter> ?C)) \<le> e \<Longrightarrow> norm (sum f S) \<le> e"
             by auto
           have 1: "content K *\<^sub>R (f' x) - (f ((Sup K)) - f ((Inf K))) = 0"
             if "(x,K) \<in> p \<inter> {t. fst t \<in> {a, b}} - p \<inter> ?C" for x K
           proof -
             have xk: "(x,K) \<in> p" and k0: "content K = 0"
               using that by auto
             then obtain u v where uv: "K = cbox u v"
               using p(4) by blast
             then have "u = v"
               using xk k0 p(2) by force
             then show "content K *\<^sub>R (f' x) - (f ((Sup K)) - f ((Inf K))) = 0"
               using xk unfolding uv by auto
           qed
           have 2: "norm(\<Sum>(x,K)\<in>p \<inter> ?C. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))  \<le> e * (b-a)/2"
           proof -
             have norm_le: "norm (sum f S) \<le> e"
               if "\<And>x y. \<lbrakk>x \<in> S; y \<in> S\<rbrakk> \<Longrightarrow> x = y" "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> e" "e > 0"
               for S f and e :: real
             proof (cases "S = {}")
               case True
               with that show ?thesis by auto
             next
               case False then obtain x where "x \<in> S"
                 by auto
               then have "S = {x}"
                 using that(1) by auto
               then show ?thesis
                 using \<open>x \<in> S\<close> that(2) by auto
             qed
             have *: "p \<inter> ?C = ?B a \<union> ?B b"
               by blast
             then have "norm (\<Sum>(x,K)\<in>p \<inter> ?C. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) =
                        norm (\<Sum>(x,K) \<in> ?B a \<union> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))"
               by simp
             also have "... = norm ((\<Sum>(x,K) \<in> ?B a. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) + 
                                    (\<Sum>(x,K) \<in> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))))"
               using p(1) ab e by (subst sum.union_disjoint) auto
             also have "... \<le> e * (b - a) / 4 + e * (b - a) / 4"
             proof (rule norm_triangle_le [OF add_mono])
               have pa: "\<exists>v. k = cbox a v \<and> a \<le> v" if "(a, k) \<in> p" for k
                 using p(2) p(3) p(4) that by fastforce
               show "norm (\<Sum>(x,K) \<in> ?B a. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (b - a) / 4"
               proof (intro norm_le; clarsimp)
                 fix K K'
                 assume K: "(a, K) \<in> p" "(a, K') \<in> p" and ne0: "content K \<noteq> 0" "content K' \<noteq> 0"
                 with pa obtain v v' where v: "K = cbox a v" "a \<le> v" and v': "K' = cbox a v'" "a \<le> v'"
                   by blast
                 let ?v = "min v v'"
                 have "box a ?v \<subseteq> K \<inter> K'"
                   unfolding v v' by (auto simp add: mem_box)
                 then have "interior (box a (min v v')) \<subseteq> interior K \<inter> interior K'"
                   using interior_Int interior_mono by blast
                 moreover have "(a + ?v)/2 \<in> box a ?v"
                   using ne0  unfolding v v' content_eq_0 not_le
                   by (auto simp add: mem_box)
                 ultimately have "(a + ?v)/2 \<in> interior K \<inter> interior K'"
                   unfolding interior_open[OF open_box] by auto
                 then show "K = K'"
                   using p(5)[OF K] by auto
               next
                 fix K 
                 assume K: "(a, K) \<in> p" and ne0: "content K \<noteq> 0"
                 show "norm (content c *\<^sub>R f' a - (f (Sup c) - f (Inf c))) * 4 \<le> e * (b-a)"
                   if "(a, c) \<in> p" and ne0: "content c \<noteq> 0" for c
                 proof -
                   obtain v where v: "c = cbox a v" and "a \<le> v"
                     using pa[OF \<open>(a, c) \<in> p\<close>] by metis 
                   then have "a \<in> {a..v}" "v \<le> b"
                     using p(3)[OF \<open>(a, c) \<in> p\<close>] by auto
                   moreover have "{a..v} \<subseteq> ball a da"
                     using fineD[OF \<open>?d fine p\<close> \<open>(a, c) \<in> p\<close>] by (simp add: v split: if_split_asm)
                   ultimately show ?thesis
                     unfolding v interval_bounds_real[OF \<open>a \<le> v\<close>] box_real
                     using da \<open>a \<le> v\<close> by auto
                 qed
               qed (use ab e in auto)
             next
               have pb: "\<exists>v. k = cbox v b \<and> b \<ge> v" if "(b, k) \<in> p" for k
                 using p(2) p(3) p(4) that by fastforce
               show "norm (\<Sum>(x,K) \<in> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (b - a) / 4"
               proof (intro norm_le; clarsimp)
                 fix K K'
                 assume K: "(b, K) \<in> p" "(b, K') \<in> p" and ne0: "content K \<noteq> 0" "content K' \<noteq> 0"
                 with pb obtain v v' where v: "K = cbox v b" "v \<le> b" and v': "K' = cbox v' b" "v' \<le> b"
                   by blast
                 let ?v = "max v v'"
                 have "box ?v b \<subseteq> K \<inter> K'"
                   unfolding v v' by (auto simp: mem_box)
                 then have "interior (box (max v v') b) \<subseteq> interior K \<inter> interior K'"
                   using interior_Int interior_mono by blast
                 moreover have " ((b + ?v)/2) \<in> box ?v b"
                   using ne0 unfolding v v' content_eq_0 not_le by (auto simp: mem_box)
                 ultimately have "((b + ?v)/2) \<in> interior K \<inter> interior K'"
                   unfolding interior_open[OF open_box] by auto
                 then show "K = K'"
                   using p(5)[OF K] by auto
               next
                 fix K 
                 assume K: "(b, K) \<in> p" and ne0: "content K \<noteq> 0"
                 show "norm (content c *\<^sub>R f' b - (f (Sup c) - f (Inf c))) * 4 \<le> e * (b-a)"
                   if "(b, c) \<in> p" and ne0: "content c \<noteq> 0" for c
                 proof -
                 obtain v where v: "c = cbox v b" and "v \<le> b"
                   using \<open>(b, c) \<in> p\<close> pb by blast
                 then have "v \<ge> a""b \<in> {v.. b}"  
                   using p(3)[OF \<open>(b, c) \<in> p\<close>] by auto
                 moreover have "{v..b} \<subseteq> ball b db"
                   using fineD[OF \<open>?d fine p\<close> \<open>(b, c) \<in> p\<close>] box_real(2) v False by force
                 ultimately show ?thesis
                   using db v by auto
                 qed
               qed (use ab e in auto)
             qed
             also have "... = e * (b-a)/2"
               by simp
             finally show "norm (\<Sum>(x,k)\<in>p \<inter> ?C.
                         content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) \<le> e * (b-a)/2" .
           qed
           show "norm (\<Sum>(x, k)\<in>p \<inter> ?A. content k *\<^sub>R f' x - (f ((Sup k)) - f ((Inf k)))) \<le> e * (b-a)/2"
             apply (rule * [OF sum.mono_neutral_right[OF pA(2)]])
             using 1 2 by (auto simp: split_paired_all)
         qed
         also have "... = (\<Sum>n\<in>p. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
           unfolding sum_distrib_left[symmetric]
           by (subst additive_tagged_division_1[OF \<open>a \<le> b\<close> ptag]) auto
         finally have norm_le: "norm (\<Sum>(x,K)\<in>p \<inter> {t. fst t \<in> {a, b}}. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
                 \<le> (\<Sum>n\<in>p. e * (case n of (x, K) \<Rightarrow> Sup K - Inf K))/2" .
         have le2: "\<And>x s1 s2::real. 0 \<le> s1 \<Longrightarrow> x \<le> (s1 + s2)/2 \<Longrightarrow> x - s1 \<le> s2/2"
           by auto
         show ?thesis
           apply (rule le2 [OF sum_nonneg])
           using ge0 apply force
           by (metis (no_types, lifting) Diff_Diff_Int Diff_subset norm_le p(1) sum.subset_diff)
       qed
       note * = additive_tagged_division_1[OF assms(1) ptag, symmetric]
       have "norm (\<Sum>(x,K)\<in>p \<inter> ?A \<union> (p - ?A). content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
                \<le> e * (\<Sum>(x,K)\<in>p \<inter> ?A \<union> (p - ?A). Sup K - Inf K)"
         unfolding sum_distrib_left
         unfolding sum.union_disjoint[OF pA(2-)]
         using le_xz norm_triangle_le I II by blast
       then
       show "norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content {a..b}"
         by (simp only: content_real[OF \<open>a \<le> b\<close>] *[of "\<lambda>x. x"] *[of f] sum_subtractf[symmetric] split_minus pA(1) [symmetric])
     qed
   qed
 qed
 
 
 subsection \<open>Stronger form with finite number of exceptional points\<close>
 
 lemma fundamental_theorem_of_calculus_interior_strong:
  fixes f :: "real \<Rightarrow> 'a::banach"
  assumes "finite S"
    and "a \<le> b" "\<And>x. x \<in> {a <..< b} - S \<Longrightarrow> (f has_vector_derivative f'(x)) (at x)"
    and "continuous_on {a .. b} f"
  shows "(f' has_integral (f b - f a)) {a .. b}"
   using assms
 proof (induction arbitrary: a b)
 case empty
   then show ?case
     using fundamental_theorem_of_calculus_interior by force
 next
 case (insert x S)
   show ?case
   proof (cases "x \<in> {a<..<b}")
     case False then show ?thesis
       using insert by blast
   next
     case True then have "a < x" "x < b"
       by auto
     have "(f' has_integral f x - f a) {a..x}" "(f' has_integral f b - f x) {x..b}"
       using \<open>continuous_on {a..b} f\<close> \<open>a < x\<close> \<open>x < b\<close> continuous_on_subset by (force simp: intro!: insert)+
     then have "(f' has_integral f x - f a + (f b - f x)) {a..b}"
       using \<open>a < x\<close> \<open>x < b\<close> has_integral_combine less_imp_le by blast
     then show ?thesis
       by simp
   qed
 qed
 
 corollary fundamental_theorem_of_calculus_strong:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "finite S"
     and "a \<le> b"
     and vec: "\<And>x. x \<in> {a..b} - S \<Longrightarrow> (f has_vector_derivative f'(x)) (at x)"
     and "continuous_on {a..b} f"
   shows "(f' has_integral (f b - f a)) {a..b}"
   by (rule fundamental_theorem_of_calculus_interior_strong [OF \<open>finite S\<close>]) (force simp: assms)+
 
 proposition indefinite_integral_continuous_left:
   fixes f:: "real \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on {a..b}" and "a < c" "c \<le> b" "e > 0"
   obtains d where "d > 0"
     and "\<forall>t. c - d < t \<and> t \<le> c \<longrightarrow> norm (integral {a..c} f - integral {a..t} f) < e"
 proof -
   obtain w where "w > 0" and w: "\<And>t. \<lbrakk>c - w < t; t < c\<rbrakk> \<Longrightarrow> norm (f c) * norm(c - t) < e/3"
   proof (cases "f c = 0")
     case False
     hence e3: "0 < e/3 / norm (f c)" using \<open>e>0\<close> by simp
     moreover have "norm (f c) * norm (c - t) < e/3" 
       if "t < c" and "c - e/3 / norm (f c) < t" for t
     proof -
       have "norm (c - t) < e/3 / norm (f c)"
         using that by auto
       then show "norm (f c) * norm (c - t) < e/3"
         by (metis e3 mult.commute norm_not_less_zero pos_less_divide_eq zero_less_divide_iff)
     qed
     ultimately show ?thesis
       using that by auto
   next
     case True then show ?thesis
       using \<open>e > 0\<close> that by auto
   qed
 
   let ?SUM = "\<lambda>p. (\<Sum>(x,K) \<in> p. content K *\<^sub>R f x)"
   have e3: "e/3 > 0"
     using \<open>e > 0\<close> by auto
   have "f integrable_on {a..c}"
     using \<open>a < c\<close> \<open>c \<le> b\<close> by (auto intro: integrable_subinterval_real[OF intf])
   then obtain d1 where "gauge d1" and d1:
     "\<And>p. \<lbrakk>p tagged_division_of {a..c}; d1 fine p\<rbrakk> \<Longrightarrow> norm (?SUM p - integral {a..c} f) < e/3"
     using integrable_integral has_integral_real e3 by metis
   define d where [abs_def]: "d x = ball x w \<inter> d1 x" for x
   have "gauge d"
     unfolding d_def using \<open>w > 0\<close> \<open>gauge d1\<close> by auto
   then obtain k where "0 < k" and k: "ball c k \<subseteq> d c"
     by (meson gauge_def open_contains_ball)
 
   let ?d = "min k (c - a)/2"
   show thesis
   proof (intro that[of ?d] allI impI, safe)
     show "?d > 0"
       using \<open>0 < k\<close> \<open>a < c\<close> by auto
   next
     fix t
     assume t: "c - ?d < t" "t \<le> c"
     show "norm (integral ({a..c}) f - integral ({a..t}) f) < e"
     proof (cases "t < c")
       case False with \<open>t \<le> c\<close> show ?thesis
         by (simp add: \<open>e > 0\<close>)
     next
       case True
       have "f integrable_on {a..t}"
         using \<open>t < c\<close> \<open>c \<le> b\<close> by (auto intro: integrable_subinterval_real[OF intf])
       then obtain d2 where d2: "gauge d2"
         "\<And>p. p tagged_division_of {a..t} \<and> d2 fine p \<Longrightarrow> norm (?SUM p - integral {a..t} f) < e/3"
         using integrable_integral has_integral_real e3 by metis
       define d3 where "d3 x = (if x \<le> t then d1 x \<inter> d2 x else d1 x)" for x
       have "gauge d3"
         using \<open>gauge d1\<close> \<open>gauge d2\<close> unfolding d3_def gauge_def by auto
       then obtain p where ptag: "p tagged_division_of {a..t}" and pfine: "d3 fine p"
         by (metis box_real(2) fine_division_exists)
       note p' = tagged_division_ofD[OF ptag]
       have pt: "(x,K)\<in>p \<Longrightarrow> x \<le> t" for x K
         by (meson atLeastAtMost_iff p'(2) p'(3) subsetCE)
       with pfine have "d2 fine p"
         unfolding fine_def d3_def by fastforce
       then have d2_fin: "norm (?SUM p - integral {a..t} f) < e/3"
         using d2(2) ptag by auto
       have eqs: "{a..c} \<inter> {x. x \<le> t} = {a..t}" "{a..c} \<inter> {x. x \<ge> t} = {t..c}"
         using t by (auto simp add: field_simps)
       have "p \<union> {(c, {t..c})} tagged_division_of {a..c}"
       proof (intro tagged_division_Un_interval_real)
         show "{(c, {t..c})} tagged_division_of {a..c} \<inter> {x. t \<le> x \<bullet> 1}"
           using \<open>t \<le> c\<close> by (auto simp: eqs tagged_division_of_self_real)
       qed (auto simp: eqs ptag)
       moreover
       have "d1 fine p \<union> {(c, {t..c})}"
         unfolding fine_def
       proof safe
         fix x K y
         assume "(x,K) \<in> p" and "y \<in> K" then show "y \<in> d1 x"
           by (metis Int_iff d3_def subsetD fineD pfine)
       next
         fix x assume "x \<in> {t..c}"
         then have "dist c x < k"
           using t(1) by (auto simp add: field_simps dist_real_def)
         with k show "x \<in> d1 c"
           unfolding d_def by auto
       qed  
       ultimately have d1_fin: "norm (?SUM(p \<union> {(c, {t..c})}) - integral {a..c} f) < e/3"
         using d1 by metis
       have SUMEQ: "?SUM(p \<union> {(c, {t..c})}) = (c - t) *\<^sub>R f c + ?SUM p"
       proof -
         have "?SUM(p \<union> {(c, {t..c})}) = (content{t..c} *\<^sub>R f c) + ?SUM p"
         proof (subst sum.union_disjoint)
           show "p \<inter> {(c, {t..c})} = {}"
             using \<open>t < c\<close> pt by force
         qed (use p'(1) in auto)
         also have "... = (c - t) *\<^sub>R f c + ?SUM p"
           using \<open>t \<le> c\<close> by auto
         finally show ?thesis .
       qed
       have "c - k < t"
         using \<open>k>0\<close> t(1) by (auto simp add: field_simps)
       moreover have "k \<le> w"
       proof (rule ccontr)
         assume "\<not> k \<le> w"
         then have "c + (k + w) / 2 \<notin> d c"
           by (auto simp add: field_simps not_le not_less dist_real_def d_def)
         then have "c + (k + w) / 2 \<notin> ball c k"
           using k by blast
         then show False
           using \<open>0 < w\<close> \<open>\<not> k \<le> w\<close> dist_real_def by auto
       qed
       ultimately have cwt: "c - w < t"
         by (auto simp add: field_simps)
       have eq: "integral {a..c} f - integral {a..t} f = -(((c - t) *\<^sub>R f c + ?SUM p) -
              integral {a..c} f) + (?SUM p - integral {a..t} f) + (c - t) *\<^sub>R f c"
         by auto
       have "norm (integral {a..c} f - integral {a..t} f) < e/3 + e/3 + e/3"
         unfolding eq
       proof (intro norm_triangle_lt add_strict_mono)
         show "norm (- ((c - t) *\<^sub>R f c + ?SUM p - integral {a..c} f)) < e/3"
           by (metis SUMEQ d1_fin norm_minus_cancel)
         show "norm (?SUM p - integral {a..t} f) < e/3"
           using d2_fin by blast
         show "norm ((c - t) *\<^sub>R f c) < e/3"
           using w cwt \<open>t < c\<close> by simp (simp add: field_simps)
       qed
       then show ?thesis by simp
     qed
   qed
 qed
 
 lemma indefinite_integral_continuous_right:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
     and "a \<le> c"
     and "c < b"
     and "e > 0"
   obtains d where "0 < d"
     and "\<forall>t. c \<le> t \<and> t < c + d \<longrightarrow> norm (integral {a..c} f - integral {a..t} f) < e"
 proof -
   have intm: "(\<lambda>x. f (- x)) integrable_on {-b .. -a}" "- b < - c" "- c \<le> - a"
     using assms by auto
   from indefinite_integral_continuous_left[OF intm \<open>e>0\<close>]
   obtain d where "0 < d"
     and d: "\<And>t. \<lbrakk>- c - d < t; t \<le> -c\<rbrakk> 
              \<Longrightarrow> norm (integral {- b..- c} (\<lambda>x. f (-x)) - integral {- b..t} (\<lambda>x. f (-x))) < e"
     by metis
   let ?d = "min d (b - c)" 
   show ?thesis
   proof (intro that[of "?d"] allI impI)
     show "0 < ?d"
       using \<open>0 < d\<close> \<open>c < b\<close> by auto
     fix t :: real
     assume t: "c \<le> t \<and> t < c + ?d"
     have *: "integral {a..c} f = integral {a..b} f - integral {c..b} f"
             "integral {a..t} f = integral {a..b} f - integral {t..b} f"
       using assms t by (auto simp: algebra_simps integral_combine)
     have "(- c) - d < (- t)" "- t \<le> - c"
       using t by auto 
     from d[OF this] show "norm (integral {a..c} f - integral {a..t} f) < e"
       by (auto simp add: algebra_simps norm_minus_commute *)
   qed
 qed
 
 lemma indefinite_integral_continuous_1:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
   shows "continuous_on {a..b} (\<lambda>x. integral {a..x} f)"
 proof -
   have "\<exists>d>0. \<forall>x'\<in>{a..b}. dist x' x < d \<longrightarrow> dist (integral {a..x'} f) (integral {a..x} f) < e" 
        if x: "x \<in> {a..b}" and "e > 0" for x e :: real
   proof (cases "a = b")
     case True
     with that show ?thesis by force
   next
     case False
     with x have "a < b" by force
     with x consider "x = a" | "x = b" | "a < x" "x < b"
       by force
     then show ?thesis 
     proof cases
       case 1 then show ?thesis
         by (force simp: dist_norm algebra_simps intro: indefinite_integral_continuous_right [OF assms _ \<open>a < b\<close> \<open>e > 0\<close>])
     next
       case 2 then show ?thesis
         by (force simp: dist_norm norm_minus_commute algebra_simps intro: indefinite_integral_continuous_left [OF assms \<open>a < b\<close> _ \<open>e > 0\<close>])
     next
       case 3
       obtain d1 where "0 < d1" 
         and d1: "\<And>t. \<lbrakk>x - d1 < t; t \<le> x\<rbrakk> \<Longrightarrow> norm (integral {a..x} f - integral {a..t} f) < e"
         using 3 by (auto intro: indefinite_integral_continuous_left [OF assms \<open>a < x\<close> _ \<open>e > 0\<close>])
       obtain d2 where "0 < d2" 
         and d2: "\<And>t. \<lbrakk>x \<le> t; t < x + d2\<rbrakk> \<Longrightarrow> norm (integral {a..x} f - integral {a..t} f) < e"
         using 3 by (auto intro: indefinite_integral_continuous_right [OF assms _ \<open>x < b\<close> \<open>e > 0\<close>])
       show ?thesis
       proof (intro exI ballI conjI impI)
         show "0 < min d1 d2"
           using \<open>0 < d1\<close> \<open>0 < d2\<close> by simp
         show "dist (integral {a..y} f) (integral {a..x} f) < e"
              if "y \<in> {a..b}" "dist y x < min d1 d2" for y
         proof (cases "y < x")
           case True
           with that d1 show ?thesis by (auto simp: dist_commute dist_norm)
         next
           case False
           with that d2 show ?thesis
             by (auto simp: dist_commute dist_norm)
         qed
       qed
     qed
   qed
   then show ?thesis
     by (auto simp: continuous_on_iff)
 qed
 
 lemma indefinite_integral_continuous_1':
   fixes f::"real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
   shows "continuous_on {a..b} (\<lambda>x. integral {x..b} f)"
 proof -
   have "integral {a..b} f - integral {a..x} f = integral {x..b} f" if "x \<in> {a..b}" for x
     using integral_combine[OF _ _ assms, of x] that
     by (auto simp: algebra_simps)
   with _ show ?thesis
     by (rule continuous_on_eq) (auto intro!: continuous_intros indefinite_integral_continuous_1 assms)
 qed
 
 theorem integral_has_vector_derivative':
   fixes f :: "real \<Rightarrow> 'b::banach"
   assumes "continuous_on {a..b} f"
     and "x \<in> {a..b}"
   shows "((\<lambda>u. integral {u..b} f) has_vector_derivative - f x) (at x within {a..b})"
 proof -
   have *: "integral {x..b} f = integral {a .. b} f - integral {a .. x} f" if "a \<le> x" "x \<le> b" for x
     using integral_combine[of a x b for x, OF that integrable_continuous_real[OF assms(1)]]
     by (simp add: algebra_simps)
   show ?thesis
     using \<open>x \<in> _\<close> *
     by (rule has_vector_derivative_transform)
       (auto intro!: derivative_eq_intros assms integral_has_vector_derivative)
 qed
 
 lemma integral_has_real_derivative':
   assumes "continuous_on {a..b} g"
   assumes "t \<in> {a..b}"
   shows "((\<lambda>x. integral {x..b} g) has_real_derivative -g t) (at t within {a..b})"
   using integral_has_vector_derivative'[OF assms]
-  by (auto simp: has_field_derivative_iff_has_vector_derivative)
+  by (auto simp: has_real_derivative_iff_has_vector_derivative)
 
 
 subsection \<open>This doesn't directly involve integration, but that gives an easy proof\<close>
 
 lemma has_derivative_zero_unique_strong_interval:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "finite k"
     and contf: "continuous_on {a..b} f"
     and "f a = y"
     and fder: "\<And>x. x \<in> {a..b} - k \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within {a..b})"
     and x: "x \<in> {a..b}"
   shows "f x = y"
 proof -
   have "a \<le> b" "a \<le> x"
     using assms by auto
   have "((\<lambda>x. 0::'a) has_integral f x - f a) {a..x}"
   proof (rule fundamental_theorem_of_calculus_interior_strong[OF \<open>finite k\<close> \<open>a \<le> x\<close>]; clarify?)
     have "{a..x} \<subseteq> {a..b}"
       using x by auto
     then show "continuous_on {a..x} f"
       by (rule continuous_on_subset[OF contf])
     show "(f has_vector_derivative 0) (at z)" if z: "z \<in> {a<..<x}" and notin: "z \<notin> k" for z
       unfolding has_vector_derivative_def
     proof (simp add: at_within_open[OF z, symmetric])
       show "(f has_derivative (\<lambda>x. 0)) (at z within {a<..<x})"
         by (rule has_derivative_subset [OF fder]) (use x z notin in auto)
     qed
   qed
   from has_integral_unique[OF has_integral_0 this]
   show ?thesis
     unfolding assms by auto
 qed
 
 
 subsection \<open>Generalize a bit to any convex set\<close>
 
 lemma has_derivative_zero_unique_strong_convex:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "convex S" "finite K"
     and contf: "continuous_on S f"
     and "c \<in> S" "f c = y"
     and derf: "\<And>x. x \<in> S - K \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within S)"
     and "x \<in> S"
   shows "f x = y"
 proof (cases "x = c")
   case True with \<open>f c = y\<close> show ?thesis
     by blast
 next
   case False
   let ?\<phi> = "\<lambda>u. (1 - u) *\<^sub>R c + u *\<^sub>R x"
   have contf': "continuous_on {0 ..1} (f \<circ> ?\<phi>)"
   proof (rule continuous_intros continuous_on_subset[OF contf])+
     show "(\<lambda>u. (1 - u) *\<^sub>R c + u *\<^sub>R x) ` {0..1} \<subseteq> S"
       using \<open>convex S\<close> \<open>x \<in> S\<close> \<open>c \<in> S\<close> by (auto simp add: convex_alt algebra_simps)
   qed
   have "t = u" if "?\<phi> t = ?\<phi> u" for t u
   proof -
     from that have "(t - u) *\<^sub>R x = (t - u) *\<^sub>R c"
       by (auto simp add: algebra_simps)
     then show ?thesis
       using \<open>x \<noteq> c\<close> by auto
   qed
   then have eq: "(SOME t. ?\<phi> t = ?\<phi> u) = u" for u
     by blast
   then have "(?\<phi> -` K) \<subseteq> (\<lambda>z. SOME t. ?\<phi> t = z) ` K"
     by (clarsimp simp: image_iff) (metis (no_types) eq)
   then have fin: "finite (?\<phi> -` K)"
     by (rule finite_surj[OF \<open>finite K\<close>])
 
   have derf': "((\<lambda>u. f (?\<phi> u)) has_derivative (\<lambda>h. 0)) (at t within {0..1})"
                if "t \<in> {0..1} - {t. ?\<phi> t \<in> K}" for t
   proof -
     have df: "(f has_derivative (\<lambda>h. 0)) (at (?\<phi> t) within ?\<phi> ` {0..1})"
       using \<open>convex S\<close> \<open>x \<in> S\<close> \<open>c \<in> S\<close> that 
       by (auto simp add: convex_alt algebra_simps intro: has_derivative_subset [OF derf])
     have "(f \<circ> ?\<phi> has_derivative (\<lambda>x. 0) \<circ> (\<lambda>z. (0 - z *\<^sub>R c) + z *\<^sub>R x)) (at t within {0..1})"
       by (rule derivative_eq_intros df | simp)+
     then show ?thesis
       unfolding o_def .
   qed
   have "(f \<circ> ?\<phi>) 1 = y"
     apply (rule has_derivative_zero_unique_strong_interval[OF fin contf'])
     unfolding o_def using \<open>f c = y\<close> derf' by auto
   then show ?thesis
     by auto
 qed
 
 
 text \<open>Also to any open connected set with finite set of exceptions. Could
  generalize to locally convex set with limpt-free set of exceptions.\<close>
 
 lemma has_derivative_zero_unique_strong_connected:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "connected S"
     and "open S"
     and "finite K"
     and contf: "continuous_on S f"
     and "c \<in> S"
     and "f c = y"
     and derf: "\<And>x. x \<in> S - K \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within S)"
     and "x \<in> S"
   shows "f x = y"
 proof -
   have "\<exists>e>0. ball x e \<subseteq> (S \<inter> f -` {f x})" if "x \<in> S" for x
   proof -
     obtain e where "0 < e" and e: "ball x e \<subseteq> S"
       using \<open>x \<in> S\<close> \<open>open S\<close> open_contains_ball by blast
     have "ball x e \<subseteq> {u \<in> S. f u \<in> {f x}}"
     proof safe
       fix y
       assume y: "y \<in> ball x e"
       then show "y \<in> S"
         using e by auto
       show "f y = f x"
       proof (rule has_derivative_zero_unique_strong_convex[OF convex_ball \<open>finite K\<close>])
         show "continuous_on (ball x e) f"
           using contf continuous_on_subset e by blast
         show "(f has_derivative (\<lambda>h. 0)) (at u within ball x e)"
              if "u \<in> ball x e - K" for u
           by (metis Diff_iff contra_subsetD derf e has_derivative_subset that)
       qed (use y e \<open>0 < e\<close> in auto)
     qed
     then show "\<exists>e>0. ball x e \<subseteq> (S \<inter> f -` {f x})"
       using \<open>0 < e\<close> by blast
   qed
   then have "openin (top_of_set S) (S \<inter> f -` {y})"
     by (auto intro!: open_openin_trans[OF \<open>open S\<close>] simp: open_contains_ball)
   moreover have "closedin (top_of_set S) (S \<inter> f -` {y})"
     by (force intro!: continuous_closedin_preimage [OF contf])
   ultimately have "(S \<inter> f -` {y}) = {} \<or> (S \<inter> f -` {y}) = S"
     using \<open>connected S\<close> by (simp add: connected_clopen)
   then show ?thesis
     using \<open>x \<in> S\<close> \<open>f c = y\<close> \<open>c \<in> S\<close> by auto
 qed
 
 lemma has_derivative_zero_connected_constant:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "connected S"
       and "open S"
       and "finite k"
       and "continuous_on S f"
       and "\<forall>x\<in>(S - k). (f has_derivative (\<lambda>h. 0)) (at x within S)"
     obtains c where "\<And>x. x \<in> S \<Longrightarrow> f(x) = c"
 proof (cases "S = {}")
   case True
   then show ?thesis
     by (metis empty_iff that)
 next
   case False
   then obtain c where "c \<in> S"
     by (metis equals0I)
   then show ?thesis
     by (metis has_derivative_zero_unique_strong_connected assms that)
 qed
 
 lemma DERIV_zero_connected_constant:
   fixes f :: "'a::{real_normed_field,euclidean_space} \<Rightarrow> 'a"
   assumes "connected S"
       and "open S"
       and "finite K"
       and "continuous_on S f"
       and "\<forall>x\<in>(S - K). DERIV f x :> 0"
     obtains c where "\<And>x. x \<in> S \<Longrightarrow> f(x) = c"
   using has_derivative_zero_connected_constant [OF assms(1-4)] assms
   by (metis DERIV_const has_derivative_const Diff_iff at_within_open frechet_derivative_at has_field_derivative_def)
 
 
 subsection \<open>Integrating characteristic function of an interval\<close>
 
 lemma has_integral_restrict_open_subinterval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "(f has_integral i) (cbox c d)"
     and cb: "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> box c d then f x else 0) has_integral i) (cbox a b)"
 proof (cases "cbox c d = {}")
   case True
   then have "box c d = {}"
     by (metis bot.extremum_uniqueI box_subset_cbox)
   then show ?thesis
     using True intf by auto
 next
   case False
   then obtain p where pdiv: "p division_of cbox a b" and inp: "cbox c d \<in> p"
     using cb partial_division_extend_1 by blast
   define g where [abs_def]: "g x = (if x \<in>box c d then f x else 0)" for x
   interpret operative "lift_option plus" "Some (0 :: 'b)"
     "\<lambda>i. if g integrable_on i then Some (integral i g) else None"
     by (fact operative_integralI)
   note operat = division [OF pdiv, symmetric]
   show ?thesis
   proof (cases "(g has_integral i) (cbox a b)")
     case True then show ?thesis
       by (simp add: g_def)
   next
     case False
     have iterate:"F (\<lambda>i. if g integrable_on i then Some (integral i g) else None) (p - {cbox c d}) = Some 0"
     proof (intro neutral ballI)
       fix x
       assume x: "x \<in> p - {cbox c d}"
       then have "x \<in> p"
         by auto
       then obtain u v where uv: "x = cbox u v"
         using pdiv by blast
       have "interior x \<inter> interior (cbox c d) = {}"
         using pdiv inp x by blast 
       then have "(g has_integral 0) x"
         unfolding uv using has_integral_spike_interior[where f="\<lambda>x. 0"]
         by (metis (no_types, lifting) disjoint_iff_not_equal g_def has_integral_0_eq interior_cbox)
       then show "(if g integrable_on x then Some (integral x g) else None) = Some 0"
         by auto
     qed
     interpret comm_monoid_set "lift_option plus" "Some (0 :: 'b)"
       by (intro comm_monoid_set.intro comm_monoid_lift_option add.comm_monoid_axioms)
     have intg: "g integrable_on cbox c d"
       using integrable_spike_interior[where f=f]
       by (meson g_def has_integral_integrable intf)
     moreover have "integral (cbox c d) g = i"
     proof (rule has_integral_unique[OF has_integral_spike_interior intf])
       show "\<And>x. x \<in> box c d \<Longrightarrow> f x = g x"
         by (auto simp: g_def)
       show "(g has_integral integral (cbox c d) g) (cbox c d)"
         by (rule integrable_integral[OF intg])
     qed
     ultimately have "F (\<lambda>A. if g integrable_on A then Some (integral A g) else None) p = Some i"
       by (metis (full_types, lifting) division_of_finite inp iterate pdiv remove right_neutral)
     then
     have "(g has_integral i) (cbox a b)"
       by (metis integrable_on_def integral_unique operat option.inject option.simps(3))
     with False show ?thesis
       by blast
   qed
 qed
 
 
 lemma has_integral_restrict_closed_subinterval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "(f has_integral i) (cbox c d)"
     and "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b)"
 proof -
   note has_integral_restrict_open_subinterval[OF assms]
   note * = has_integral_spike[OF negligible_frontier_interval _ this]
   show ?thesis
     by (rule *[of c d]) (use box_subset_cbox[of c d] in auto)
 qed
 
 lemma has_integral_restrict_closed_subintervals_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b) \<longleftrightarrow> (f has_integral i) (cbox c d)"
   (is "?l = ?r")
 proof (cases "cbox c d = {}")
   case False
   let ?g = "\<lambda>x. if x \<in> cbox c d then f x else 0"
   show ?thesis
   proof 
     assume ?l
     then have "?g integrable_on cbox c d"
       using assms has_integral_integrable integrable_subinterval by blast
     then have "f integrable_on cbox c d"
       by (rule integrable_eq) auto
     moreover then have "i = integral (cbox c d) f"
       by (meson \<open>((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b)\<close> assms has_integral_restrict_closed_subinterval has_integral_unique integrable_integral)
     ultimately show ?r by auto
   next
     assume ?r then show ?l
       by (rule has_integral_restrict_closed_subinterval[OF _ assms])
   qed
 qed auto
 
 
 text \<open>Hence we can apply the limit process uniformly to all integrals.\<close>
 
 lemma has_integral':
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(f has_integral i) S \<longleftrightarrow>
     (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> S then f(x) else 0) has_integral z) (cbox a b) \<and> norm(z - i) < e))"
   (is "?l \<longleftrightarrow> (\<forall>e>0. ?r e)")
 proof (cases "\<exists>a b. S = cbox a b")
   case False then show ?thesis 
     by (simp add: has_integral_alt)
 next
   case True
   then obtain a b where S: "S = cbox a b"
     by blast 
   obtain B where " 0 < B" and B: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm x \<le> B"
     using bounded_cbox[unfolded bounded_pos] by blast
   show ?thesis
   proof safe
     fix e :: real
     assume ?l and "e > 0"
     have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) (cbox c d)"
       if "ball 0 (B+1) \<subseteq> cbox c d" for c d
         unfolding S using B that
         by (force intro: \<open>?l\<close>[unfolded S] has_integral_restrict_closed_subinterval)
     then show "?r e"
       by (meson \<open>0 < B\<close> \<open>0 < e\<close> add_pos_pos le_less_trans zero_less_one norm_pths(2))
   next
     assume as: "\<forall>e>0. ?r e"
     then obtain C 
       where C: "\<And>a b. ball 0 C \<subseteq> cbox a b \<Longrightarrow>
                 \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b)"
       by (meson zero_less_one)
     define c :: 'n where "c = (\<Sum>i\<in>Basis. (- max B C) *\<^sub>R i)"
     define d :: 'n where "d = (\<Sum>i\<in>Basis. max B C *\<^sub>R i)"
     have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" if "norm x \<le> B" "i \<in> Basis" for x i
       using that and Basis_le_norm[OF \<open>i\<in>Basis\<close>, of x]
       by (auto simp add: field_simps sum_negf c_def d_def)
     then have c_d: "cbox a b \<subseteq> cbox c d"
       by (meson B mem_box(2) subsetI)
     have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i"
       if x: "norm (0 - x) < C" and i: "i \<in> Basis" for x i
         using Basis_le_norm[OF i, of x] x i by (auto simp: sum_negf c_def d_def)
       then have "ball 0 C \<subseteq> cbox c d"
         by (auto simp: mem_box dist_norm)
     with C obtain y where y: "(f has_integral y) (cbox a b)"
       using c_d has_integral_restrict_closed_subintervals_eq S by blast
     have "y = i"
     proof (rule ccontr)
       assume "y \<noteq> i"
       then have "0 < norm (y - i)"
         by auto
       from as[rule_format,OF this]
       obtain C where C: "\<And>a b. ball 0 C \<subseteq> cbox a b \<Longrightarrow> 
            \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z-i) < norm (y-i)"
         by auto
       define c :: 'n where "c = (\<Sum>i\<in>Basis. (- max B C) *\<^sub>R i)"
       define d :: 'n where "d = (\<Sum>i\<in>Basis. max B C *\<^sub>R i)"
       have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i"
         if "norm x \<le> B" and "i \<in> Basis" for x i
           using that Basis_le_norm[of i x] by (auto simp add: field_simps sum_negf c_def d_def)
         then have c_d: "cbox a b \<subseteq> cbox c d"
         by (simp add: B mem_box(2) subset_eq)
       have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" if "norm (0 - x) < C" and "i \<in> Basis" for x i
         using Basis_le_norm[of i x] that by (auto simp: sum_negf c_def d_def)
       then have "ball 0 C \<subseteq> cbox c d"
         by (auto simp: mem_box dist_norm)
       with C obtain z where z: "(f has_integral z) (cbox a b)" "norm (z-i) < norm (y-i)"
         using has_integral_restrict_closed_subintervals_eq[OF c_d] S by blast
       moreover then have "z = y" 
         by (blast intro: has_integral_unique[OF _ y])
       ultimately show False
         by auto
     qed
     then show ?l
       using y by (auto simp: S)
   qed
 qed
 
 lemma has_integral_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes fg: "(f has_integral i) S" "(g has_integral j) S"
     and le: "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "i \<le> j"
   using has_integral_component_le[OF _ fg, of 1] le  by auto
 
 lemma integral_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f integrable_on S"
     and "g integrable_on S"
     and "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "integral S f \<le> integral S g"
   by (rule has_integral_le[OF assms(1,2)[unfolded has_integral_integral] assms(3)])
 
 lemma has_integral_nonneg:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
   shows "0 \<le> i"
   using has_integral_component_nonneg[of 1 f i S]
   unfolding o_def
   using assms
   by auto
 
 lemma integral_nonneg:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on S" and 0: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
   shows "0 \<le> integral S f"
   by (rule has_integral_nonneg[OF f[unfolded has_integral_integral] 0])
 
 
 text \<open>Hence a general restriction property.\<close>
 
 lemma has_integral_restrict [simp]:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   assumes "S \<subseteq> T"
   shows "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) T \<longleftrightarrow> (f has_integral i) S"
 proof -
   have *: "\<And>x. (if x \<in> T then if x \<in> S then f x else 0 else 0) =  (if x\<in>S then f x else 0)"
     using assms by auto
   show ?thesis
     apply (subst(2) has_integral')
     apply (subst has_integral')
       apply (simp add: *)
     done
 qed
 
 corollary has_integral_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "((\<lambda>x. if x \<in> s then f x else 0) has_integral i) UNIV \<longleftrightarrow> (f has_integral i) s"
   by auto
 
 lemma has_integral_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) T \<longleftrightarrow> (f has_integral i) (S \<inter> T)"
 proof -
   have "((\<lambda>x. if x \<in> T then if x \<in> S then f x else 0 else 0) has_integral i) UNIV =
         ((\<lambda>x. if x \<in> S \<inter> T then f x else 0) has_integral i) UNIV"
     by (rule has_integral_cong) auto
   then show ?thesis
     using has_integral_restrict_UNIV by fastforce
 qed
 
 lemma integral_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "integral T (\<lambda>x. if x \<in> S then f x else 0) = integral (S \<inter> T) f"
   by (metis (no_types, lifting) has_integral_cong has_integral_restrict_Int integrable_integral integral_unique not_integrable_integral)
 
 lemma integrable_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "(\<lambda>x. if x \<in> S then f x else 0) integrable_on T \<longleftrightarrow> f integrable_on (S \<inter> T)"
   using has_integral_restrict_Int by fastforce
 
 lemma has_integral_on_superset:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "(f has_integral i) S"
       and "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
       and "S \<subseteq> T"
     shows "(f has_integral i) T"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) = (\<lambda>x. if x \<in> T then f x else 0)"
     using assms by fastforce
   with f show ?thesis
     by (simp only: has_integral_restrict_UNIV [symmetric, of f])
 qed
 
 lemma integrable_on_superset:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S"
     and "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
     and "S \<subseteq> t"
   shows "f integrable_on t"
   using assms
   unfolding integrable_on_def
   by (auto intro:has_integral_on_superset)
 
 lemma integral_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "integral UNIV (\<lambda>x. if x \<in> S then f x else 0) = integral S f"
   by (simp add: integral_restrict_Int)
 
 lemma integrable_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(\<lambda>x. if x \<in> s then f x else 0) integrable_on UNIV \<longleftrightarrow> f integrable_on s"
   unfolding integrable_on_def
   by auto
 
 lemma has_integral_subset_component_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes k: "k \<in> Basis"
     and as: "S \<subseteq> T" "(f has_integral i) S" "(f has_integral j) T" "\<And>x. x\<in>T \<Longrightarrow> 0 \<le> f(x)\<bullet>k"
   shows "i\<bullet>k \<le> j\<bullet>k"
 proof -
   have \<section>: "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) UNIV"
           "((\<lambda>x. if x \<in> T then f x else 0) has_integral j) UNIV"
     by (simp_all add: assms)
   show ?thesis
     using as by (force intro!: has_integral_component_le[OF k \<section>])
 qed
 
 subsection\<open>Integrals on set differences\<close>
 
 lemma has_integral_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes S: "(f has_integral i) S" and T: "(f has_integral j) T"
     and neg: "negligible (T - S)"
   shows "(f has_integral (i - j)) (S - T)"
 proof -
   show ?thesis
     unfolding has_integral_restrict_UNIV [symmetric, of f]
   proof (rule has_integral_spike [OF neg])
     have eq: "(\<lambda>x. (if x \<in> S then f x else 0) - (if x \<in> T then f x else 0)) =
             (\<lambda>x. if x \<in> T - S then - f x else if x \<in> S - T then f x else 0)"
       by (force simp add: )
     have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) UNIV"
       "((\<lambda>x. if x \<in> T then f x else 0) has_integral j) UNIV"
       using S T has_integral_restrict_UNIV by auto
     from has_integral_diff [OF this]
     show "((\<lambda>x. if x \<in> T - S then - f x else if x \<in> S - T then f x else 0)
                    has_integral i-j) UNIV"
       by (simp add: eq)
   qed force
 qed
 
 lemma integral_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "f integrable_on S" "f integrable_on T" "negligible(T - S)"
  shows "integral (S - T) f = integral S f - integral T f"
   by (rule integral_unique) (simp add: assms has_integral_setdiff integrable_integral)
 
 lemma integrable_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "(f has_integral i) S" "(f has_integral j) T" "negligible (T - S)"
   shows "f integrable_on (S - T)"
   using has_integral_setdiff [OF assms]
   by (simp add: has_integral_iff)
 
 lemma negligible_setdiff [simp]: "T \<subseteq> S \<Longrightarrow> negligible (T - S)"
   by (metis Diff_eq_empty_iff negligible_empty)
 
 lemma negligible_on_intervals: "negligible s \<longleftrightarrow> (\<forall>a b. negligible(s \<inter> cbox a b))" (is "?l \<longleftrightarrow> ?r")
 proof
   assume R: ?r
   show ?l
     unfolding negligible_def
   proof safe
     fix a b
     have "negligible (s \<inter> cbox a b)"
       by (simp add: R)
     then show "(indicator s has_integral 0) (cbox a b)"
       by (meson Diff_iff Int_iff has_integral_negligible indicator_simps(2))
   qed
 qed (simp add: negligible_Int)
 
 lemma negligible_translation:
   assumes "negligible S"
     shows "negligible ((+) c ` S)"
 proof -
   have inj: "inj ((+) c)"
     by simp
   show ?thesis
   using assms
   proof (clarsimp simp: negligible_def)
     fix a b
     assume "\<forall>x y. (indicator S has_integral 0) (cbox x y)"
     then have *: "(indicator S has_integral 0) (cbox (a-c) (b-c))"
       by (meson Diff_iff assms has_integral_negligible indicator_simps(2))
     have eq: "indicator ((+) c ` S) = (\<lambda>x. indicator S (x - c))"
       by (force simp add: indicator_def)
     show "(indicator ((+) c ` S) has_integral 0) (cbox a b)"
       using has_integral_affinity [OF *, of 1 "-c"]
             cbox_translation [of "c" "-c+a" "-c+b"]
       by (simp add: eq) (simp add: ac_simps)
   qed
 qed
 
 lemma negligible_translation_rev:
   assumes "negligible ((+) c ` S)"
     shows "negligible S"
 by (metis negligible_translation [OF assms, of "-c"] translation_galois)
 
 lemma negligible_atLeastAtMostI: "b \<le> a \<Longrightarrow> negligible {a..(b::real)}"
   using negligible_insert by fastforce
 
 lemma has_integral_spike_set_eq:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "(f has_integral y) S \<longleftrightarrow> (f has_integral y) T"
 proof -
   have "((\<lambda>x. if x \<in> S then f x else 0) has_integral y) UNIV =
         ((\<lambda>x. if x \<in> T then f x else 0) has_integral y) UNIV"
   proof (rule has_integral_spike_eq)
     show "negligible ({x \<in> S - T. f x \<noteq> 0} \<union> {x \<in> T - S. f x \<noteq> 0})"
       by (rule negligible_Un [OF assms])
   qed auto
   then show ?thesis
     by (simp add: has_integral_restrict_UNIV)
 qed
 
 corollary integral_spike_set:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "integral S f = integral T f"
   using has_integral_spike_set_eq [OF assms]
   by (metis eq_integralD integral_unique)
 
 lemma integrable_spike_set:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on S" and neg: "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "f integrable_on T"
   using has_integral_spike_set_eq [OF neg] f by blast
 
 lemma integrable_spike_set_eq:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible ((S - T) \<union> (T - S))"
   shows "f integrable_on S \<longleftrightarrow> f integrable_on T"
   by (blast intro: integrable_spike_set assms negligible_subset)
 
 lemma integrable_on_insert_iff: "f integrable_on (insert x X) \<longleftrightarrow> f integrable_on X"
   for f::"_ \<Rightarrow> 'a::banach"
   by (rule integrable_spike_set_eq) (auto simp: insert_Diff_if)
 
 lemma has_integral_interior:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "negligible(frontier S) \<Longrightarrow> (f has_integral y) (interior S) \<longleftrightarrow> (f has_integral y) S"
   by (rule has_integral_spike_set_eq [OF empty_imp_negligible negligible_subset])
      (use interior_subset in \<open>auto simp: frontier_def closure_def\<close>)
 
 lemma has_integral_closure:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "negligible(frontier S) \<Longrightarrow> (f has_integral y) (closure S) \<longleftrightarrow> (f has_integral y) S"
   by (rule has_integral_spike_set_eq [OF negligible_subset empty_imp_negligible]) (auto simp: closure_Un_frontier )
 
 lemma has_integral_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "(f has_integral y) (box a b) \<longleftrightarrow> (f has_integral y) (cbox a b)"
   unfolding interior_cbox [symmetric]
   by (metis frontier_cbox has_integral_interior negligible_frontier_interval)
 
 lemma integrable_on_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "f integrable_on box a b \<longleftrightarrow> f integrable_on cbox a b"
   by (simp add: has_integral_open_interval integrable_on_def)
 
 lemma integral_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "integral(box a b) f = integral(cbox a b) f"
   by (metis has_integral_integrable_integral has_integral_open_interval not_integrable_integral)
 
+lemma has_integral_Icc_iff_Ioo:
+  fixes f :: "real \<Rightarrow> 'a :: banach"
+  shows "(f has_integral I) {a..b} \<longleftrightarrow> (f has_integral I) {a<..<b}"
+proof (rule has_integral_spike_set_eq)
+  show "negligible {x \<in> {a..b} - {a<..<b}. f x \<noteq> 0}"
+    by (rule negligible_subset [of "{a,b}"]) auto
+  show "negligible {x \<in> {a<..<b} - {a..b}. f x \<noteq> 0}"
+    by (rule negligible_subset [of "{}"]) auto
+qed
+
+lemma integrable_on_Icc_iff_Ioo:
+  fixes f :: "real \<Rightarrow> 'a :: banach"
+  shows "f integrable_on {a..b} \<longleftrightarrow> f integrable_on {a<..<b}"
+  using has_integral_Icc_iff_Ioo by blast
+
 
 subsection \<open>More lemmas that are useful later\<close>
 
 lemma has_integral_subset_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "s \<subseteq> t"
     and "(f has_integral i) s"
     and "(f has_integral j) t"
     and "\<forall>x\<in>t. 0 \<le> f x"
   shows "i \<le> j"
   using has_integral_subset_component_le[OF _ assms(1), of 1 f i j]
   using assms
   by auto
 
 lemma integral_subset_component_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "k \<in> Basis"
     and "s \<subseteq> t"
     and "f integrable_on s"
     and "f integrable_on t"
     and "\<forall>x \<in> t. 0 \<le> f x \<bullet> k"
   shows "(integral s f)\<bullet>k \<le> (integral t f)\<bullet>k"
   by (meson assms has_integral_subset_component_le integrable_integral)
 
 lemma integral_subset_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "s \<subseteq> t"
     and "f integrable_on s"
     and "f integrable_on t"
     and "\<forall>x \<in> t. 0 \<le> f x"
   shows "integral s f \<le> integral t f"
   using assms has_integral_subset_le by blast
 
 lemma has_integral_alt':
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(f has_integral i) s \<longleftrightarrow> 
           (\<forall>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b) \<and>
           (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
             norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - i) < e)"
   (is "?l = ?r")
 proof
   assume rhs: ?r
   show ?l
   proof (subst has_integral', intro allI impI)
     fix e::real
     assume "e > 0"
     from rhs[THEN conjunct2,rule_format,OF this] 
     show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                    (\<exists>z. ((\<lambda>x. if x \<in> s then f x else 0) has_integral z)
                          (cbox a b) \<and> norm (z - i) < e)"
       by (simp add: has_integral_iff rhs)
   qed
 next
   let ?\<Phi> = "\<lambda>e a b. \<exists>z. ((\<lambda>x. if x \<in> s then f x else 0) has_integral z) (cbox a b) \<and> norm (z - i) < e"
   assume ?l 
   then have lhs: "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> ?\<Phi> e a b" if "e > 0" for e
     using that has_integral'[of f] by auto
   let ?f = "\<lambda>x. if x \<in> s then f x else 0"
   show ?r
   proof (intro conjI allI impI)
     fix a b :: 'n
     from lhs[OF zero_less_one]
     obtain B where "0 < B" and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> ?\<Phi> 1 a b"
       by blast
     let ?a = "\<Sum>i\<in>Basis. min (a\<bullet>i) (-B) *\<^sub>R i::'n"
     let ?b = "\<Sum>i\<in>Basis. max (b\<bullet>i) B *\<^sub>R i::'n"
     show "?f integrable_on cbox a b"
     proof (rule integrable_subinterval[of _ ?a ?b])
       have "?a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> ?b \<bullet> i" if "norm (0 - x) < B" "i \<in> Basis" for x i
         using Basis_le_norm[of i x] that by (auto simp add:field_simps)
       then have "ball 0 B \<subseteq> cbox ?a ?b"
         by (auto simp: mem_box dist_norm)
       then show "?f integrable_on cbox ?a ?b"
         unfolding integrable_on_def using B by blast
       show "cbox a b \<subseteq> cbox ?a ?b"
         by (force simp: mem_box)
     qed
   
     fix e :: real
     assume "e > 0"
     with lhs show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - i) < e"
       by (metis (no_types, lifting) has_integral_integrable_integral)
   qed
 qed
 
 
 subsection \<open>Continuity of the integral (for a 1-dimensional interval)\<close>
 
 lemma integrable_alt:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "f integrable_on s \<longleftrightarrow>
     (\<forall>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b) \<and>
     (\<forall>e>0. \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
     norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) -
       integral (cbox c d)  (\<lambda>x. if x \<in> s then f x else 0)) < e)"
   (is "?l = ?r")
 proof
   let ?F = "\<lambda>x. if x \<in> s then f x else 0"
   assume ?l
   then obtain y where intF: "\<And>a b. ?F integrable_on cbox a b"
           and y: "\<And>e. 0 < e \<Longrightarrow>
               \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?F - y) < e"
     unfolding integrable_on_def has_integral_alt'[of f] by auto
   show ?r
   proof (intro conjI allI impI intF)
     fix e::real
     assume "e > 0"
     then have "e/2 > 0"
       by auto
     obtain B where "0 < B" 
        and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> norm (integral (cbox a b) ?F - y) < e/2"
       using \<open>0 < e/2\<close> y by blast
     show "\<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                   norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
     proof (intro conjI exI impI allI, rule \<open>0 < B\<close>)
       fix a b c d::'n
       assume sub: "ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d"
       show "norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
         using sub by (auto intro: norm_triangle_half_l dest: B)
     qed
   qed
 next
   let ?F = "\<lambda>x. if x \<in> s then f x else 0"
   assume rhs: ?r
   let ?cube = "\<lambda>n. cbox (\<Sum>i\<in>Basis. - real n *\<^sub>R i::'n) (\<Sum>i\<in>Basis. real n *\<^sub>R i)"
   have "Cauchy (\<lambda>n. integral (?cube n) ?F)"
     unfolding Cauchy_def
   proof (intro allI impI)
     fix e::real
     assume "e > 0"
     with rhs obtain B where "0 < B" 
       and B: "\<And>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d 
                         \<Longrightarrow> norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
       by blast
     obtain N where N: "B \<le> real N"
       using real_arch_simple by blast
     have "ball 0 B \<subseteq> ?cube n" if n: "n \<ge> N" for n
     proof -
       have "sum ((*\<^sub>R) (- real n)) Basis \<bullet> i \<le> x \<bullet> i \<and>
             x \<bullet> i \<le> sum ((*\<^sub>R) (real n)) Basis \<bullet> i"
         if "norm x < B" "i \<in> Basis" for x i::'n
           using Basis_le_norm[of i x] n N that by (auto simp add: field_simps sum_negf)
       then show ?thesis
         by (auto simp: mem_box dist_norm)
     qed
     then show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (integral (?cube m) ?F) (integral (?cube n) ?F) < e"
       by (fastforce simp add: dist_norm intro!: B)
   qed
   then obtain i where i: "(\<lambda>n. integral (?cube n) ?F) \<longlonglongrightarrow> i"
     using convergent_eq_Cauchy by blast
   have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?F - i) < e"
     if "e > 0" for e
   proof -
     have *: "e/2 > 0" using that by auto
     then obtain N where N: "\<And>n. N \<le> n \<Longrightarrow> norm (i - integral (?cube n) ?F) < e/2"
       using i[THEN LIMSEQ_D, simplified norm_minus_commute] by meson
     obtain B where "0 < B" 
       and B: "\<And>a b c d. \<lbrakk>ball 0 B \<subseteq> cbox a b; ball 0 B \<subseteq> cbox c d\<rbrakk> \<Longrightarrow>
                   norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e/2"
       using rhs * by meson
     let ?B = "max (real N) B"
     show ?thesis
     proof (intro exI conjI allI impI)
       show "0 < ?B"
         using \<open>B > 0\<close> by auto
       fix a b :: 'n
       assume "ball 0 ?B \<subseteq> cbox a b"
       moreover obtain n where n: "max (real N) B \<le> real n"
         using real_arch_simple by blast
       moreover have "ball 0 B \<subseteq> ?cube n"
       proof 
         fix x :: 'n
         assume x: "x \<in> ball 0 B"
         have "\<lbrakk>norm (0 - x) < B; i \<in> Basis\<rbrakk>
               \<Longrightarrow> sum ((*\<^sub>R) (-n)) Basis \<bullet> i\<le> x \<bullet> i \<and> x \<bullet> i \<le> sum ((*\<^sub>R) n) Basis \<bullet> i" for i
           using Basis_le_norm[of i x] n by (auto simp add: field_simps sum_negf)
         then show "x \<in> ?cube n"
           using x by (auto simp: mem_box dist_norm)
       qed 
       ultimately show "norm (integral (cbox a b) ?F - i) < e"
         using norm_triangle_half_l [OF B N] by force
     qed
   qed
   then show ?l unfolding integrable_on_def has_integral_alt'[of f]
     using rhs by blast
 qed
 
 lemma integrable_altD:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on s"
   shows "\<And>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b"
     and "\<And>e. e > 0 \<Longrightarrow> \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
       norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - integral (cbox c d)  (\<lambda>x. if x \<in> s then f x else 0)) < e"
   using assms[unfolded integrable_alt[of f]] by auto
 
 lemma integrable_alt_subset:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   shows
      "f integrable_on S \<longleftrightarrow>
       (\<forall>a b. (\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b) \<and>
       (\<forall>e>0. \<exists>B>0. \<forall>a b c d.
                       ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d
                       \<longrightarrow> norm(integral (cbox a b) (\<lambda>x. if x \<in> S then f x else 0) -
                                integral (cbox c d) (\<lambda>x. if x \<in> S then f x else 0)) < e)"
       (is "_ = ?rhs")
 proof -
   let ?g = "\<lambda>x. if x \<in> S then f x else 0"
   have "f integrable_on S \<longleftrightarrow>
         (\<forall>a b. ?g integrable_on cbox a b) \<and>
         (\<forall>e>0. \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
            norm (integral (cbox a b) ?g - integral (cbox c d)  ?g) < e)"
     by (rule integrable_alt)
   also have "\<dots> = ?rhs"
   proof -
     { fix e :: "real"
       assume e: "\<And>e. e>0 \<Longrightarrow> \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d \<longrightarrow>
                                    norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
         and "e > 0"
       obtain B where "B > 0"
         and B: "\<And>a b c d. \<lbrakk>ball 0 B \<subseteq> cbox a b; cbox a b \<subseteq> cbox c d\<rbrakk> \<Longrightarrow>
                            norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e/2"
         using \<open>e > 0\<close> e [of "e/2"] by force
       have "\<exists>B>0. \<forall>a b c d.
                ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
       proof (intro exI allI conjI impI)
         fix a b c d :: "'a"
         let ?\<alpha> = "\<Sum>i\<in>Basis. max (a \<bullet> i) (c \<bullet> i) *\<^sub>R i"
         let ?\<beta> = "\<Sum>i\<in>Basis. min (b \<bullet> i) (d \<bullet> i) *\<^sub>R i"
         show "norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
           if ball: "ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d"
         proof -
           have B': "norm (integral (cbox a b \<inter> cbox c d) ?g - integral (cbox x y) ?g) < e/2"
             if "cbox a b \<inter> cbox c d \<subseteq> cbox x y" for x y
             using B [of ?\<alpha> ?\<beta> x y] ball that by (simp add: Int_interval [symmetric])
           show ?thesis
             using B' [of a b] B' [of c d] norm_triangle_half_r by blast
         qed
       qed (use \<open>B > 0\<close> in auto)}
     then show ?thesis
       by force
   qed
   finally show ?thesis .
 qed
 
 lemma integrable_on_subcbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on S"
     and sub: "cbox a b \<subseteq> S"
   shows "f integrable_on cbox a b"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b"
     by (simp add: intf integrable_altD(1))
 then show ?thesis
   by (metis (mono_tags) sub integrable_restrict_Int le_inf_iff order_refl subset_antisym)
 qed
 
 
 subsection \<open>A straddling criterion for integrability\<close>
 
 lemma integrable_straddle_interval:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "\<And>e. e>0 \<Longrightarrow> \<exists>g h i j. (g has_integral i) (cbox a b) \<and> (h has_integral j) (cbox a b) \<and>
                             \<bar>i - j\<bar> < e \<and> (\<forall>x\<in>cbox a b. (g x) \<le> f x \<and> f x \<le> h x)"
   shows "f integrable_on cbox a b"
 proof -
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<and> d fine p2 \<longrightarrow>
                      \<bar>(\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) - (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x)\<bar> < e)"
     if "e > 0" for e
   proof -
     have e: "e/3 > 0"
       using that by auto
     then obtain g h i j where ij: "\<bar>i - j\<bar> < e/3"
             and "(g has_integral i) (cbox a b)"
             and "(h has_integral j) (cbox a b)"
             and fgh: "\<And>x. x \<in> cbox a b \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       using assms real_norm_def by metis
     then obtain d1 d2 where "gauge d1" "gauge d2"
             and d1: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; d1 fine p\<rbrakk> \<Longrightarrow>
                           \<bar>(\<Sum>(x,K)\<in>p. content K *\<^sub>R g x) - i\<bar> < e/3"
             and d2: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; d2 fine p\<rbrakk> \<Longrightarrow>
                           \<bar>(\<Sum>(x,K) \<in> p. content K *\<^sub>R h x) - j\<bar> < e/3"
       by (metis e has_integral real_norm_def)
     have "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)\<bar> < e"
       if p1: "p1 tagged_division_of cbox a b" and 11: "d1 fine p1" and 21: "d2 fine p1"
        and p2: "p2 tagged_division_of cbox a b" and 12: "d1 fine p2" and 22: "d2 fine p2" for p1 p2
     proof -
       have *: "\<And>g1 g2 h1 h2 f1 f2.
                   \<lbrakk>\<bar>g2 - i\<bar> < e/3; \<bar>g1 - i\<bar> < e/3; \<bar>h2 - j\<bar> < e/3; \<bar>h1 - j\<bar> < e/3;
                    g1 - h2 \<le> f1 - f2; f1 - f2 \<le> h1 - g2\<rbrakk>
                   \<Longrightarrow> \<bar>f1 - f2\<bar> < e"
         using \<open>e > 0\<close> ij by arith
       have 0: "(\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p1. content k *\<^sub>R g x) \<ge> 0"
               "0 \<le> (\<Sum>(x, k)\<in>p2. content k *\<^sub>R h x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)"
               "(\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R g x) \<ge> 0"
               "0 \<le> (\<Sum>(x, k)\<in>p1. content k *\<^sub>R h x) - (\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x)"
         unfolding sum_subtractf[symmetric]
            apply (auto intro!: sum_nonneg)
            apply (meson fgh measure_nonneg mult_left_mono tag_in_interval that sum_nonneg)+
         done
       show ?thesis
       proof (rule *)
         show "\<bar>(\<Sum>(x,K) \<in> p2. content K *\<^sub>R g x) - i\<bar> < e/3"
           by (rule d1[OF p2 12])
         show "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R g x) - i\<bar> < e/3"
           by (rule d1[OF p1 11])
         show "\<bar>(\<Sum>(x,K) \<in> p2. content K *\<^sub>R h x) - j\<bar> < e/3"
           by (rule d2[OF p2 22])
         show "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R h x) - j\<bar> < e/3"
           by (rule d2[OF p1 21])
       qed (use 0 in auto)
     qed
     then show ?thesis
       by (rule_tac x="\<lambda>x. d1 x \<inter> d2 x" in exI)
         (auto simp: fine_Int intro: \<open>gauge d1\<close> \<open>gauge d2\<close> d1 d2)
   qed
   then show ?thesis
     by (simp add: integrable_Cauchy)
 qed
 
 lemma integrable_straddle:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "\<And>e. e>0 \<Longrightarrow> \<exists>g h i j. (g has_integral i) s \<and> (h has_integral j) s \<and>
                      \<bar>i - j\<bar> < e \<and> (\<forall>x\<in>s. g x \<le> f x \<and> f x \<le> h x)"
   shows "f integrable_on s"
 proof -
   let ?fs = "(\<lambda>x. if x \<in> s then f x else 0)"
   have "?fs integrable_on cbox a b" for a b
   proof (rule integrable_straddle_interval)
     fix e::real
     assume "e > 0"
     then have *: "e/4 > 0"
       by auto
     with assms obtain g h i j where g: "(g has_integral i) s" and h: "(h has_integral j) s"
                  and ij: "\<bar>i - j\<bar> < e/4"
                  and fgh: "\<And>x. x \<in> s \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       by metis
     let ?gs = "(\<lambda>x. if x \<in> s then g x else 0)"
     let ?hs = "(\<lambda>x. if x \<in> s then h x else 0)"
     obtain Bg where Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?gs - i\<bar> < e/4"
               and int_g: "\<And>a b. ?gs integrable_on cbox a b"
       using g * unfolding has_integral_alt' real_norm_def by meson
     obtain Bh where
           Bh: "\<And>a b. ball 0 Bh \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?hs - j\<bar> < e/4"
          and int_h: "\<And>a b. ?hs integrable_on cbox a b"
       using h * unfolding has_integral_alt' real_norm_def by meson
     define c where "c = (\<Sum>i\<in>Basis. min (a\<bullet>i) (- (max Bg Bh)) *\<^sub>R i)"
     define d where "d = (\<Sum>i\<in>Basis. max (b\<bullet>i) (max Bg Bh) *\<^sub>R i)"
     have "\<lbrakk>norm (0 - x) < Bg; i \<in> Basis\<rbrakk> \<Longrightarrow> c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" for x i
       using Basis_le_norm[of i x] unfolding c_def d_def by auto
     then have ballBg: "ball 0 Bg \<subseteq> cbox c d"
       by (auto simp: mem_box dist_norm)
     have "\<lbrakk>norm (0 - x) < Bh; i \<in> Basis\<rbrakk> \<Longrightarrow> c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" for x i
       using Basis_le_norm[of i x] unfolding c_def d_def by auto
     then have ballBh: "ball 0 Bh \<subseteq> cbox c d"
       by (auto simp: mem_box dist_norm)
     have ab_cd: "cbox a b \<subseteq> cbox c d"
       by (auto simp: c_def d_def subset_box_imp)
     have **: "\<And>ch cg ag ah::real. \<lbrakk>\<bar>ah - ag\<bar> \<le> \<bar>ch - cg\<bar>; \<bar>cg - i\<bar> < e/4; \<bar>ch - j\<bar> < e/4\<rbrakk>
        \<Longrightarrow> \<bar>ag - ah\<bar> < e"
       using ij by arith
     show "\<exists>g h i j. (g has_integral i) (cbox a b) \<and> (h has_integral j) (cbox a b) \<and> \<bar>i - j\<bar> < e \<and>
           (\<forall>x\<in>cbox a b. g x \<le> (if x \<in> s then f x else 0) \<and>
                         (if x \<in> s then f x else 0) \<le> h x)"
     proof (intro exI ballI conjI)
       have eq: "\<And>x f g. (if x \<in> s then f x else 0) - (if x \<in> s then g x else 0) =
                        (if x \<in> s then f x - g x else (0::real))"
         by auto
       have int_hg: "(\<lambda>x. if x \<in> s then h x - g x else 0) integrable_on cbox a b"
                    "(\<lambda>x. if x \<in> s then h x - g x else 0) integrable_on cbox c d"
         by (metis (no_types) integrable_diff g h has_integral_integrable integrable_altD(1))+
       show "(?gs has_integral integral (cbox a b) ?gs) (cbox a b)"
            "(?hs has_integral integral (cbox a b) ?hs) (cbox a b)"
         by (intro integrable_integral int_g int_h)+
       then have "integral (cbox a b) ?gs \<le> integral (cbox a b) ?hs"
         using fgh by (force intro: has_integral_le)
       then have "0 \<le> integral (cbox a b) ?hs - integral (cbox a b) ?gs"
         by simp
       then have "\<bar>integral (cbox a b) ?hs - integral (cbox a b) ?gs\<bar>
               \<le> \<bar>integral (cbox c d) ?hs - integral (cbox c d) ?gs\<bar>"
         apply (simp add: integral_diff [symmetric] int_g int_h)
         apply (subst abs_of_nonneg[OF integral_nonneg[OF integrable_diff, OF int_h int_g]])
         using fgh apply (force simp: eq intro!: integral_subset_le [OF ab_cd int_hg])+
         done
       then show "\<bar>integral (cbox a b) ?gs - integral (cbox a b) ?hs\<bar> < e"
         using ** Bg ballBg Bh ballBh by blast
       show "\<And>x. x \<in> cbox a b \<Longrightarrow> ?gs x \<le> ?fs x" "\<And>x. x \<in> cbox a b \<Longrightarrow> ?fs x \<le> ?hs x"
         using fgh by auto
     qed
   qed
   then have int_f: "?fs integrable_on cbox a b" for a b
     by simp
   have "\<exists>B>0. \<forall>a b c d.
                   ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                   abs (integral (cbox a b) ?fs - integral (cbox c d) ?fs) < e"
       if "0 < e" for e
   proof -
     have *: "e/3 > 0"
       using that by auto
     with assms obtain g h i j where g: "(g has_integral i) s" and h: "(h has_integral j) s"
                  and ij: "\<bar>i - j\<bar> < e/3"
                  and fgh: "\<And>x. x \<in> s \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       by metis
     let ?gs = "(\<lambda>x. if x \<in> s then g x else 0)"
     let ?hs = "(\<lambda>x. if x \<in> s then h x else 0)"
     obtain Bg where "Bg > 0"
               and Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?gs - i\<bar> < e/3"
               and int_g: "\<And>a b. ?gs integrable_on cbox a b"
       using g * unfolding has_integral_alt' real_norm_def by meson
     obtain Bh where "Bh > 0"
               and Bh: "\<And>a b. ball 0 Bh \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?hs - j\<bar> < e/3"
               and int_h: "\<And>a b. ?hs integrable_on cbox a b"
       using h * unfolding has_integral_alt' real_norm_def by meson
     { fix a b c d :: 'n
       assume as: "ball 0 (max Bg Bh) \<subseteq> cbox a b" "ball 0 (max Bg Bh) \<subseteq> cbox c d"
       have **: "ball 0 Bg \<subseteq> ball (0::'n) (max Bg Bh)" "ball 0 Bh \<subseteq> ball (0::'n) (max Bg Bh)"
         by auto
       have *: "\<And>ga gc ha hc fa fc. \<lbrakk>\<bar>ga - i\<bar> < e/3; \<bar>gc - i\<bar> < e/3; \<bar>ha - j\<bar> < e/3;
                      \<bar>hc - j\<bar> < e/3; ga \<le> fa; fa \<le> ha; gc \<le> fc; fc \<le> hc\<rbrakk> \<Longrightarrow>
         \<bar>fa - fc\<bar> < e"
         using ij by arith
       have "abs (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - integral (cbox c d)
         (\<lambda>x. if x \<in> s then f x else 0)) < e"
       proof (rule *)
         show "\<bar>integral (cbox a b) ?gs - i\<bar> < e/3"
           using "**" Bg as by blast
         show "\<bar>integral (cbox c d) ?gs - i\<bar> < e/3"
           using "**" Bg as by blast
         show "\<bar>integral (cbox a b) ?hs - j\<bar> < e/3"
           using "**" Bh as by blast
         show "\<bar>integral (cbox c d) ?hs - j\<bar> < e/3"
           using "**" Bh as by blast
       qed (use int_f int_g int_h fgh in \<open>simp_all add: integral_le\<close>)
     }
     then show ?thesis
       apply (rule_tac x="max Bg Bh" in exI)
         using \<open>Bg > 0\<close> by auto
   qed
   then show ?thesis
     unfolding integrable_alt[of f] real_norm_def by (blast intro: int_f)
 qed
 
 
 subsection \<open>Adding integrals over several sets\<close>
 
 lemma has_integral_Un:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "(f has_integral i) S" "(f has_integral j) T"
     and neg: "negligible (S \<inter> T)"
   shows "(f has_integral (i + j)) (S \<union> T)"
   unfolding has_integral_restrict_UNIV[symmetric, of f]
 proof (rule has_integral_spike[OF neg])
   let ?f = "\<lambda>x. (if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)"
   show "(?f has_integral i + j) UNIV"
     by (simp add: f has_integral_add)
 qed auto
 
 lemma integral_Un [simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S" "f integrable_on T" "negligible (S \<inter> T)"
   shows "integral (S \<union> T) f = integral S f + integral T f"
   by (simp add: has_integral_Un assms integrable_integral integral_unique)
 
 lemma integrable_Un:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b :: banach"
   assumes "negligible (A \<inter> B)" "f integrable_on A" "f integrable_on B"
   shows   "f integrable_on (A \<union> B)"
 proof -
   from assms obtain y z where "(f has_integral y) A" "(f has_integral z) B"
      by (auto simp: integrable_on_def)
   from has_integral_Un[OF this assms(1)] show ?thesis by (auto simp: integrable_on_def)
 qed
 
 lemma integrable_Un':
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b :: banach"
   assumes "f integrable_on A" "f integrable_on B" "negligible (A \<inter> B)" "C = A \<union> B"
   shows   "f integrable_on C"
   using integrable_Un[of A B f] assms by simp
 
 lemma has_integral_UN:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "finite I"
     and int: "\<And>i. i \<in> I \<Longrightarrow> (f has_integral (g i)) (\<T> i)"
     and neg: "pairwise (\<lambda>i i'. negligible (\<T> i \<inter> \<T> i')) I"
   shows "(f has_integral (sum g I)) (\<Union>i\<in>I. \<T> i)"
 proof -
   let ?\<U> = "((\<lambda>(a,b). \<T> a \<inter> \<T> b) ` {(a,b). a \<in> I \<and> b \<in> I-{a}})"
   have "((\<lambda>x. if x \<in> (\<Union>i\<in>I. \<T> i) then f x else 0) has_integral sum g I) UNIV"
   proof (rule has_integral_spike)
     show "negligible (\<Union>?\<U>)"
     proof (rule negligible_Union)
       have "finite (I \<times> I)"
         by (simp add: \<open>finite I\<close>)
       moreover have "{(a,b). a \<in> I \<and> b \<in> I-{a}} \<subseteq> I \<times> I"
         by auto
       ultimately show "finite ?\<U>"
         by (simp add: finite_subset)
       show "\<And>t. t \<in> ?\<U> \<Longrightarrow> negligible t"
         using neg unfolding pairwise_def by auto
     qed
   next
     show "(if x \<in> (\<Union>i\<in>I. \<T> i) then f x else 0) = (\<Sum>i\<in>I. if x \<in> \<T> i then f x else 0)"
       if "x \<in> UNIV - (\<Union>?\<U>)" for x
     proof clarsimp
       fix i assume i: "i \<in> I" "x \<in> \<T> i"
       then have "\<forall>j\<in>I. x \<in> \<T> j \<longleftrightarrow> j = i"
         using that by blast
       with i show "f x = (\<Sum>i\<in>I. if x \<in> \<T> i then f x else 0)"
         by (simp add: sum.delta[OF \<open>finite I\<close>])
     qed
   next
     show "((\<lambda>x. (\<Sum>i\<in>I. if x \<in> \<T> i then f x else 0)) has_integral sum g I) UNIV"
       using int by (simp add: has_integral_restrict_UNIV has_integral_sum [OF \<open>finite I\<close>])
   qed
   then show ?thesis
     using has_integral_restrict_UNIV by blast
 qed
 
 lemma has_integral_Union:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "finite \<T>"
     and "\<And>S. S \<in> \<T> \<Longrightarrow> (f has_integral (i S)) S"
     and "pairwise (\<lambda>S S'. negligible (S \<inter> S')) \<T>"
   shows "(f has_integral (sum i \<T>)) (\<Union>\<T>)"
 proof -
   have "(f has_integral (sum i \<T>)) (\<Union>S\<in>\<T>. S)"
     by (intro has_integral_UN assms)
   then show ?thesis
     by force
 qed
 
 text \<open>In particular adding integrals over a division, maybe not of an interval.\<close>
 
 lemma has_integral_combine_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<D> division_of S"
     and "\<And>k. k \<in> \<D> \<Longrightarrow> (f has_integral (i k)) k"
   shows "(f has_integral (sum i \<D>)) S"
 proof -
   note \<D> = division_ofD[OF assms(1)]
   have neg: "negligible (S \<inter> s')" if "S \<in> \<D>" "s' \<in> \<D>" "S \<noteq> s'" for S s'
   proof -
     obtain a c b \<D> where obt: "S = cbox a b" "s' = cbox c \<D>"
       by (meson \<open>S \<in> \<D>\<close> \<open>s' \<in> \<D>\<close> \<D>(4))
     from \<D>(5)[OF that] show ?thesis
       unfolding obt interior_cbox
       by (metis (no_types, lifting) Diff_empty Int_interval box_Int_box negligible_frontier_interval)
   qed
   show ?thesis
     unfolding \<D>(6)[symmetric]
     by (auto intro: \<D> neg assms has_integral_Union pairwiseI)
 qed
 
 lemma integral_combine_division_bottomup:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<D> division_of S" "\<And>k. k \<in> \<D> \<Longrightarrow> f integrable_on k"
   shows "integral S f = sum (\<lambda>i. integral i f) \<D>"
   by (meson assms integral_unique has_integral_combine_division has_integral_integrable_integral)
 
 lemma has_integral_combine_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on S"
     and \<D>: "\<D> division_of K"
     and "K \<subseteq> S"
   shows "(f has_integral (sum (\<lambda>i. integral i f) \<D>)) K"
 proof -
   have "f integrable_on L" if "L \<in> \<D>" for L
   proof -
     have "L \<subseteq> S"
       using \<open>K \<subseteq> S\<close> \<D> that by blast
     then show "f integrable_on L"
       using that by (metis (no_types) f \<D> division_ofD(4) integrable_on_subcbox)
   qed
   then show ?thesis
     by (meson \<D> has_integral_combine_division has_integral_integrable_integral)
 qed
 
 lemma integral_combine_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S"
     and "\<D> division_of S"
   shows "integral S f = sum (\<lambda>i. integral i f) \<D>"
   using assms has_integral_combine_division_topdown by blast
 
 lemma integrable_combine_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<D>: "\<D> division_of S"
     and f: "\<And>i. i \<in> \<D> \<Longrightarrow> f integrable_on i"
   shows "f integrable_on S"
   using f unfolding integrable_on_def by (metis has_integral_combine_division[OF \<D>])
 
 lemma integrable_on_subdivision:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<D>: "\<D> division_of i"
     and f: "f integrable_on S"
     and "i \<subseteq> S"
   shows "f integrable_on i"
 proof -
   have "f integrable_on i" if "i \<in> \<D>" for i
 proof -
   have "i \<subseteq> S"
     using assms that by auto
   then show "f integrable_on i"
     using that by (metis (no_types) \<D> f division_ofD(4) integrable_on_subcbox)
 qed
   then show ?thesis
     using \<D> integrable_combine_division by blast
 qed
 
 
 subsection \<open>Also tagged divisions\<close>
 
 lemma has_integral_combine_tagged_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "p tagged_division_of S"
     and "\<And>x k. (x,k) \<in> p \<Longrightarrow> (f has_integral (i k)) k"
   shows "(f has_integral (\<Sum>(x,k)\<in>p. i k)) S"
 proof -
   have *: "(f has_integral (\<Sum>k\<in>snd`p. integral k f)) S"
   proof -
     have "snd ` p division_of S"
       by (simp add: assms(1) division_of_tagged_division)
     with assms show ?thesis
       by (metis (mono_tags, lifting) has_integral_combine_division has_integral_integrable_integral imageE prod.collapse)
   qed
   also have "(\<Sum>k\<in>snd`p. integral k f) = (\<Sum>(x, k)\<in>p. integral k f)"
     by (intro sum.over_tagged_division_lemma[OF assms(1), symmetric] integral_null)
        (simp add: content_eq_0_interior)
   finally show ?thesis
     using assms by (auto simp add: has_integral_iff intro!: sum.cong)
 qed
 
 lemma integral_combine_tagged_division_bottomup:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes p: "p tagged_division_of (cbox a b)"
     and f: "\<And>x k. (x,k)\<in>p \<Longrightarrow> f integrable_on k"
   shows "integral (cbox a b) f = sum (\<lambda>(x,k). integral k f) p"
   by (simp add: has_integral_combine_tagged_division[OF p] integral_unique f integrable_integral)
 
 lemma has_integral_combine_tagged_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on cbox a b"
     and p: "p tagged_division_of (cbox a b)"
   shows "(f has_integral (sum (\<lambda>(x,K). integral K f) p)) (cbox a b)"
 proof -
   have "(f has_integral integral K f) K" if "(x,K) \<in> p" for x K
     by (metis assms integrable_integral integrable_on_subcbox tagged_division_ofD(3,4) that)
   then show ?thesis
     by (simp add: has_integral_combine_tagged_division p)
 qed
 
 lemma integral_combine_tagged_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on cbox a b"
     and "p tagged_division_of (cbox a b)"
   shows "integral (cbox a b) f = sum (\<lambda>(x,k). integral k f) p"
   using assms by (auto intro: integral_unique [OF has_integral_combine_tagged_division_topdown])
 
 
 subsection \<open>Henstock's lemma\<close>
 
 lemma Henstock_lemma_part1:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on cbox a b"
     and "e > 0"
     and "gauge d"
     and less_e: "\<And>p. \<lbrakk>p tagged_division_of (cbox a b); d fine p\<rbrakk> \<Longrightarrow>
                      norm (sum (\<lambda>(x,K). content K *\<^sub>R f x) p - integral(cbox a b) f) < e"
     and p: "p tagged_partial_division_of (cbox a b)" "d fine p"
   shows "norm (sum (\<lambda>(x,K). content K *\<^sub>R f x - integral K f) p) \<le> e" (is "?lhs \<le> e")
 proof (rule field_le_epsilon)
   fix k :: real
   assume "k > 0"
   let ?SUM = "\<lambda>p. (\<Sum>(x,K) \<in> p. content K *\<^sub>R f x)"
   note p' = tagged_partial_division_ofD[OF p(1)]
   have "\<Union>(snd ` p) \<subseteq> cbox a b"
     using p'(3) by fastforce
   then obtain q where q: "snd ` p \<subseteq> q" and qdiv: "q division_of cbox a b"
     by (meson p(1) partial_division_extend_interval partial_division_of_tagged_division)
   note q' = division_ofD[OF qdiv]
   define r where "r = q - snd ` p"
   have "snd ` p \<inter> r = {}"
     unfolding r_def by auto
   have "finite r"
     using q' unfolding r_def by auto
   have "\<exists>p. p tagged_division_of i \<and> d fine p \<and>
         norm (?SUM p - integral i f) < k / (real (card r) + 1)"
     if "i\<in>r" for i
   proof -
     have gt0: "k / (real (card r) + 1) > 0" using \<open>k > 0\<close> by simp
     have i: "i \<in> q"
       using that unfolding r_def by auto
     then obtain u v where uv: "i = cbox u v"
       using q'(4) by blast
     then have "cbox u v \<subseteq> cbox a b"
       using i q'(2) by auto  
     then have "f integrable_on cbox u v"
       by (rule integrable_subinterval[OF intf])
     with integrable_integral[OF this, unfolded has_integral[of f]]
     obtain dd where "gauge dd" and dd:
       "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox u v; dd fine \<D>\<rbrakk> \<Longrightarrow>
     norm (?SUM \<D> - integral (cbox u v) f) < k / (real (card r) + 1)"
       using gt0 by auto
     with gauge_Int[OF \<open>gauge d\<close> \<open>gauge dd\<close>]
     obtain qq where qq: "qq tagged_division_of cbox u v" "(\<lambda>x. d x \<inter> dd x) fine qq"
       using fine_division_exists by blast
     with dd[of qq]  show ?thesis
       by (auto simp: fine_Int uv)
   qed
   then obtain qq where qq: "\<And>i. i \<in> r \<Longrightarrow> qq i tagged_division_of i \<and>
       d fine qq i \<and> norm (?SUM (qq i) - integral i f) < k / (real (card r) + 1)"
     by metis
 
   let ?p = "p \<union> \<Union>(qq ` r)"
   have "norm (?SUM ?p - integral (cbox a b) f) < e"
   proof (rule less_e)
     show "d fine ?p"
       by (metis (mono_tags, opaque_lifting) qq fine_Un fine_Union imageE p(2))
     note ptag = tagged_partial_division_of_Union_self[OF p(1)]
     have "p \<union> \<Union>(qq ` r) tagged_division_of \<Union>(snd ` p) \<union> \<Union>r"
     proof (rule tagged_division_Un[OF ptag tagged_division_Union [OF \<open>finite r\<close>]])
       show "\<And>i. i \<in> r \<Longrightarrow> qq i tagged_division_of i"
         using qq by auto
       show "\<And>i1 i2. \<lbrakk>i1 \<in> r; i2 \<in> r; i1 \<noteq> i2\<rbrakk> \<Longrightarrow> interior i1 \<inter> interior i2 = {}"
         by (simp add: q'(5) r_def)
       show "interior (\<Union>(snd ` p)) \<inter> interior (\<Union>r) = {}"
       proof (rule Int_interior_Union_intervals [OF \<open>finite r\<close>])
         show "open (interior (\<Union>(snd ` p)))"
           by blast
         show "\<And>T. T \<in> r \<Longrightarrow> \<exists>a b. T = cbox a b"
           by (simp add: q'(4) r_def)
         have "interior T \<inter> interior (\<Union>(snd ` p)) = {}" if "T \<in> r" for T
         proof (rule Int_interior_Union_intervals)
           show "\<And>U. U \<in> snd ` p \<Longrightarrow> \<exists>a b. U = cbox a b"
             using q q'(4) by blast
           show "\<And>U. U \<in> snd ` p \<Longrightarrow> interior T \<inter> interior U = {}"
             by (metis DiffE q q'(5) r_def subsetD that)
         qed (use p' in auto)
         then show "\<And>T. T \<in> r \<Longrightarrow> interior (\<Union>(snd ` p)) \<inter> interior T = {}"
           by (metis Int_commute)
       qed
     qed
     moreover have "\<Union>(snd ` p) \<union> \<Union>r = cbox a b" and "{qq i |i. i \<in> r} = qq ` r"
       using qdiv q unfolding Union_Un_distrib[symmetric] r_def by auto
     ultimately show "?p tagged_division_of (cbox a b)"
       by fastforce
   qed
   then have "norm (?SUM p + (?SUM (\<Union>(qq ` r))) - integral (cbox a b) f) < e"
   proof (subst sum.union_inter_neutral[symmetric, OF \<open>finite p\<close>], safe)
     show "content L *\<^sub>R f x = 0" if "(x, L) \<in> p" "(x, L) \<in> qq K" "K \<in> r" for x K L 
     proof -
       obtain u v where uv: "L = cbox u v"
         using \<open>(x,L) \<in> p\<close> p'(4) by blast
       have "L \<subseteq> K"
         using  qq[OF that(3)] tagged_division_ofD(3) \<open>(x,L) \<in> qq K\<close> by metis
       have "L \<in> snd ` p" 
         using \<open>(x,L) \<in> p\<close> image_iff by fastforce 
       then have "L \<in> q" "K \<in> q" "L \<noteq> K"
         using that(1,3) q(1) unfolding r_def by auto
       with q'(5) have "interior L = {}"
         using interior_mono[OF \<open>L \<subseteq> K\<close>] by blast
       then show "content L *\<^sub>R f x = 0"
         unfolding uv content_eq_0_interior[symmetric] by auto
     qed
     show "finite (\<Union>(qq ` r))"
       by (meson finite_UN qq \<open>finite r\<close> tagged_division_of_finite)
   qed
   moreover have "content M *\<^sub>R f x = 0" 
       if x: "(x,M) \<in> qq K" "(x,M) \<in> qq L" and KL: "qq K \<noteq> qq L" and r: "K \<in> r" "L \<in> r"
     for x M K L
   proof -
     note kl = tagged_division_ofD(3,4)[OF qq[THEN conjunct1]]
     obtain u v where uv: "M = cbox u v"
       using \<open>(x, M) \<in> qq L\<close> \<open>L \<in> r\<close> kl(2) by blast
     have empty: "interior (K \<inter> L) = {}"
       by (metis DiffD1 interior_Int q'(5) r_def KL r)
     have "interior M = {}"
       by (metis (no_types, lifting) Int_assoc empty inf.absorb_iff2 interior_Int kl(1) subset_empty x r)
     then show "content M *\<^sub>R f x = 0"
       unfolding uv content_eq_0_interior[symmetric]
       by auto
   qed 
   ultimately have "norm (?SUM p + sum ?SUM (qq ` r) - integral (cbox a b) f) < e"
     apply (subst (asm) sum.Union_comp)
     using qq by (force simp: split_paired_all)+
   moreover have "content M *\<^sub>R f x = 0" 
        if "K \<in> r" "L \<in> r" "K \<noteq> L" "qq K = qq L" "(x, M) \<in> qq K" for K L x M
     using tagged_division_ofD(6) qq that by (metis (no_types, lifting)) 
   ultimately have less_e: "norm (?SUM p + sum (?SUM \<circ> qq) r - integral (cbox a b) f) < e"
   proof (subst (asm) sum.reindex_nontrivial [OF \<open>finite r\<close>])
     qed (auto simp: split_paired_all sum.neutral)
   have norm_le: "norm (cp - ip) \<le> e + k"
                   if "norm ((cp + cr) - i) < e" "norm (cr - ir) < k" "ip + ir = i"
                   for ir ip i cr cp::'a
   proof -
     from that show ?thesis
       using norm_triangle_le[of "cp + cr - i" "- (cr - ir)"]
       unfolding that(3)[symmetric] norm_minus_cancel
       by (auto simp add: algebra_simps)
   qed
 
   have "?lhs =  norm (?SUM p - (\<Sum>(x, k)\<in>p. integral k f))"
     unfolding split_def sum_subtractf ..
   also have "\<dots> \<le> e + k"
   proof (rule norm_le[OF less_e])
     have lessk: "k * real (card r) / (1 + real (card r)) < k"
       using \<open>k>0\<close> by (auto simp add: field_simps)
     have "norm (sum (?SUM \<circ> qq) r - (\<Sum>k\<in>r. integral k f)) \<le> (\<Sum>x\<in>r. k / (real (card r) + 1))"
       unfolding sum_subtractf[symmetric] by (force dest: qq intro!: sum_norm_le)
     also have "... < k"
       by (simp add: lessk add.commute mult.commute)
     finally show "norm (sum (?SUM \<circ> qq) r - (\<Sum>k\<in>r. integral k f)) < k" .
   next
     from q(1) have [simp]: "snd ` p \<union> q = q" by auto
     have "integral l f = 0"
       if inp: "(x, l) \<in> p" "(y, m) \<in> p" and ne: "(x, l) \<noteq> (y, m)" and "l = m" for x l y m
     proof -
       obtain u v where uv: "l = cbox u v"
         using inp p'(4) by blast
       have "content (cbox u v) = 0"
         unfolding content_eq_0_interior using that p(1) uv
         by (auto dest: tagged_partial_division_ofD)
       then show ?thesis
         using uv by blast
     qed
     then have "(\<Sum>(x, K)\<in>p. integral K f) = (\<Sum>K\<in>snd ` p. integral K f)"
       apply (subst sum.reindex_nontrivial [OF \<open>finite p\<close>])
       unfolding split_paired_all split_def by auto
     then show "(\<Sum>(x, k)\<in>p. integral k f) + (\<Sum>k\<in>r. integral k f) = integral (cbox a b) f"
       unfolding integral_combine_division_topdown[OF intf qdiv] r_def
       using q'(1) p'(1) sum.union_disjoint [of "snd ` p" "q - snd ` p", symmetric]
         by simp
   qed
   finally show "?lhs \<le> e + k" .
 qed
 
 lemma Henstock_lemma_part2:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes fed: "f integrable_on cbox a b" "e > 0" "gauge d"
     and less_e: "\<And>\<D>. \<lbrakk>\<D> tagged_division_of (cbox a b); d fine \<D>\<rbrakk> \<Longrightarrow>
                      norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) \<D> - integral (cbox a b) f) < e"
     and tag: "p tagged_partial_division_of (cbox a b)"
     and "d fine p"
   shows "sum (\<lambda>(x,k). norm (content k *\<^sub>R f x - integral k f)) p \<le> 2 * real (DIM('n)) * e"
 proof -
   have "finite p"
     using tag tagged_partial_division_ofD by blast
   then show ?thesis
     unfolding split_def
   proof (rule sum_norm_allsubsets_bound)
     fix Q
     assume Q: "Q \<subseteq> p"
     then have fine: "d fine Q"
       by (simp add: \<open>d fine p\<close> fine_subset)
     show "norm (\<Sum>x\<in>Q. content (snd x) *\<^sub>R f (fst x) - integral (snd x) f) \<le> e"
       apply (rule Henstock_lemma_part1[OF fed less_e, unfolded split_def])
       using Q tag tagged_partial_division_subset by (force simp add: fine)+
   qed
 qed
 
 lemma Henstock_lemma:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes intf: "f integrable_on cbox a b"
     and "e > 0"
   obtains \<gamma> where "gauge \<gamma>"
     and "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox a b); \<gamma> fine p\<rbrakk> \<Longrightarrow>
              sum (\<lambda>(x,k). norm(content k *\<^sub>R f x - integral k f)) p < e"
 proof -
   have *: "e/(2 * (real DIM('n) + 1)) > 0" using \<open>e > 0\<close> by simp
   with integrable_integral[OF intf, unfolded has_integral]
   obtain \<gamma> where "gauge \<gamma>"
     and \<gamma>: "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b; \<gamma> fine \<D>\<rbrakk> \<Longrightarrow>
          norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f x) - integral (cbox a b) f)
          < e/(2 * (real DIM('n) + 1))"
     by metis
   show thesis
   proof (rule that [OF \<open>gauge \<gamma>\<close>])
     fix p
     assume p: "p tagged_partial_division_of cbox a b" "\<gamma> fine p"
     have "(\<Sum>(x,K)\<in>p. norm (content K *\<^sub>R f x - integral K f)) 
           \<le> 2 * real DIM('n) * (e/(2 * (real DIM('n) + 1)))"
       using Henstock_lemma_part2[OF intf * \<open>gauge \<gamma>\<close> \<gamma> p] by metis
     also have "... < e"
       using \<open>e > 0\<close> by (auto simp add: field_simps)
     finally
     show "(\<Sum>(x,K)\<in>p. norm (content K *\<^sub>R f x - integral K f)) < e" .
   qed
 qed
 
 
 subsection \<open>Monotone convergence (bounded interval first)\<close>
 
 lemma bounded_increasing_convergent:
   fixes f :: "nat \<Rightarrow> real"
   shows "\<lbrakk>bounded (range f); \<And>n. f n \<le> f (Suc n)\<rbrakk> \<Longrightarrow> \<exists>l. f \<longlonglongrightarrow> l"
   using Bseq_mono_convergent[of f] incseq_Suc_iff[of f]
   by (auto simp: image_def Bseq_eq_bounded convergent_def incseq_def)
 
 lemma monotone_convergence_interval:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes intf: "\<And>k. (f k) integrable_on cbox a b"
     and le: "\<And>k x. x \<in> cbox a b \<Longrightarrow> (f k x) \<le> f (Suc k) x"
     and fg: "\<And>x. x \<in> cbox a b \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range (\<lambda>k. integral (cbox a b) (f k)))"
   shows "g integrable_on cbox a b \<and> ((\<lambda>k. integral (cbox a b) (f k)) \<longlongrightarrow> integral (cbox a b) g) sequentially"
 proof (cases "content (cbox a b) = 0")
   case True then show ?thesis
     by auto
 next
   case False
   have fg1: "(f k x) \<le> (g x)" if x: "x \<in> cbox a b" for x k
   proof -
     have "\<forall>\<^sub>F j in sequentially. f k x \<le> f j x"
     proof (rule eventually_sequentiallyI [of k])
       show "\<And>j. k \<le> j \<Longrightarrow> f k x \<le> f j x"
         using le x by (force intro: transitive_stepwise_le)
     qed
     then show "f k x \<le> g x"
       using tendsto_lowerbound [OF fg] x trivial_limit_sequentially by blast
   qed
   have int_inc: "\<And>n. integral (cbox a b) (f n) \<le> integral (cbox a b) (f (Suc n))"
     by (metis integral_le intf le)
   then obtain i where i: "(\<lambda>k. integral (cbox a b) (f k)) \<longlonglongrightarrow> i"
     using bounded_increasing_convergent bou by blast
   have "\<And>k. \<forall>\<^sub>F x in sequentially. integral (cbox a b) (f k) \<le> integral (cbox a b) (f x)"
     unfolding eventually_sequentially
     by (force intro: transitive_stepwise_le int_inc)
   then have i': "\<And>k. (integral(cbox a b) (f k)) \<le> i"
     using tendsto_le [OF trivial_limit_sequentially i] by blast
   have "(g has_integral i) (cbox a b)"
     unfolding has_integral real_norm_def
   proof clarify
     fix e::real
     assume e: "e > 0"
     have "\<And>k. (\<exists>\<gamma>. gauge \<gamma> \<and> (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
       abs ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f k x) - integral (cbox a b) (f k)) < e/2 ^ (k + 2)))"
       using intf e by (auto simp: has_integral_integral has_integral)
     then obtain c where c: "\<And>x. gauge (c x)"
           "\<And>x \<D>. \<lbrakk>\<D> tagged_division_of cbox a b; c x fine \<D>\<rbrakk> \<Longrightarrow>
               abs ((\<Sum>(u,K)\<in>\<D>. content K *\<^sub>R f x u) - integral (cbox a b) (f x))
               < e/2 ^ (x + 2)"
       by metis
 
     have "\<exists>r. \<forall>k\<ge>r. 0 \<le> i - (integral (cbox a b) (f k)) \<and> i - (integral (cbox a b) (f k)) < e/4"
     proof -
       have "e/4 > 0"
         using e by auto
       show ?thesis
         using LIMSEQ_D [OF i \<open>e/4 > 0\<close>] i' by auto
     qed
     then obtain r where r: "\<And>k. r \<le> k \<Longrightarrow> 0 \<le> i - integral (cbox a b) (f k)"
                        "\<And>k. r \<le> k \<Longrightarrow> i - integral (cbox a b) (f k) < e/4" 
       by metis
     have "\<exists>n\<ge>r. \<forall>k\<ge>n. 0 \<le> (g x) - (f k x) \<and> (g x) - (f k x) < e/(4 * content(cbox a b))"
       if "x \<in> cbox a b" for x
     proof -
       have "e/(4 * content (cbox a b)) > 0"
         by (simp add: False content_lt_nz e)
       with fg that LIMSEQ_D
       obtain N where "\<forall>n\<ge>N. norm (f n x - g x) < e/(4 * content (cbox a b))"
         by metis
       then show "\<exists>n\<ge>r. \<forall>k\<ge>n. 0 \<le> g x - f k x \<and> g x - f k x < e/(4 * content (cbox a b))"
         apply (rule_tac x="N + r" in exI)
         using fg1[OF that] by (auto simp add: field_simps)
     qed
     then obtain m where r_le_m: "\<And>x. x \<in> cbox a b \<Longrightarrow> r \<le> m x"
        and m: "\<And>x k. \<lbrakk>x \<in> cbox a b; m x \<le> k\<rbrakk>
                      \<Longrightarrow> 0 \<le> g x - f k x \<and> g x - f k x < e/(4 * content (cbox a b))"
       by metis
     define d where "d x = c (m x) x" for x
     show "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and>
                   \<gamma> fine \<D> \<longrightarrow> abs ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - i) < e)"
     proof (rule exI, safe)
       show "gauge d"
         using c(1) unfolding gauge_def d_def by auto
     next
       fix \<D>
       assume ptag: "\<D> tagged_division_of (cbox a b)" and "d fine \<D>"
       note p'=tagged_division_ofD[OF ptag]
       obtain s where s: "\<And>x. x \<in> \<D> \<Longrightarrow> m (fst x) \<le> s"
         by (metis finite_imageI finite_nat_set_iff_bounded_le p'(1) rev_image_eqI)
       have *: "\<bar>a - d\<bar> < e" if "\<bar>a - b\<bar> \<le> e/4" "\<bar>b - c\<bar> < e/2" "\<bar>c - d\<bar> < e/4" for a b c d
         using that norm_triangle_lt[of "a - b" "b - c" "3* e/4"]
           norm_triangle_lt[of "a - b + (b - c)" "c - d" e]
         by (auto simp add: algebra_simps)
       show "\<bar>(\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - i\<bar> < e"
       proof (rule *)
         have "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - (\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x)\<bar> 
               \<le> (\<Sum>i\<in>\<D>. \<bar>(case i of (x, K) \<Rightarrow> content K *\<^sub>R g x) - (case i of (x, K) \<Rightarrow> content K *\<^sub>R f (m x) x)\<bar>)"
           by (metis (mono_tags) sum_subtractf sum_abs) 
         also have "... \<le> (\<Sum>(x, k)\<in>\<D>. content k * (e/(4 * content (cbox a b))))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xk: "(x,K) \<in> \<D>"
           with ptag have x: "x \<in> cbox a b"
             by blast
           then have "abs (content K * (g x - f (m x) x)) \<le> content K * (e/(4 * content (cbox a b)))"
             by (metis m[OF x] mult_nonneg_nonneg abs_of_nonneg less_eq_real_def measure_nonneg mult_left_mono order_refl)
           then show "\<bar>content K * g x - content K * f (m x) x\<bar> \<le> content K * e/(4 * content (cbox a b))"
             by (simp add: algebra_simps)
         qed
         also have "... = (e/(4 * content (cbox a b))) * (\<Sum>(x, k)\<in>\<D>. content k)"
           by (simp add: sum_distrib_left sum_divide_distrib split_def mult.commute)
         also have "... \<le> e/4"
           by (metis False additive_content_tagged_division [OF ptag] nonzero_mult_divide_mult_cancel_right order_refl times_divide_eq_left)
         finally show "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - (\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x)\<bar> \<le> e/4" .
 
       next
         have "norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x) - (\<Sum>(x,K)\<in>\<D>. integral K (f (m x))))
               \<le> norm (\<Sum>j = 0..s. \<Sum>(x,K)\<in>{xk \<in> \<D>. m (fst xk) = j}. content K *\<^sub>R f (m x) x - integral K (f (m x)))"
           apply (subst sum.group)
           using s by (auto simp: sum_subtractf split_def p'(1))
         also have "\<dots> < e/2"
         proof -
           have "norm (\<Sum>j = 0..s. \<Sum>(x, k)\<in>{xk \<in> \<D>. m (fst xk) = j}. content k *\<^sub>R f (m x) x - integral k (f (m x)))
                 \<le> (\<Sum>i = 0..s. e/2 ^ (i + 2))"
           proof (rule sum_norm_le)
             fix t
             assume "t \<in> {0..s}"
             have "norm (\<Sum>(x,k)\<in>{xk \<in> \<D>. m (fst xk) = t}. content k *\<^sub>R f (m x) x - integral k (f (m x))) =
                   norm (\<Sum>(x,k)\<in>{xk \<in> \<D>. m (fst xk) = t}. content k *\<^sub>R f t x - integral k (f t))"
               by (force intro!: sum.cong arg_cong[where f=norm])
             also have "... \<le> e/2 ^ (t + 2)"
             proof (rule Henstock_lemma_part1 [OF intf])
               show "{xk \<in> \<D>. m (fst xk) = t} tagged_partial_division_of cbox a b"
               proof (rule tagged_partial_division_subset[of \<D>])
                 show "\<D> tagged_partial_division_of cbox a b"
                   using ptag tagged_division_of_def by blast
               qed auto
               show "c t fine {xk \<in> \<D>. m (fst xk) = t}"
                 using \<open>d fine \<D>\<close> by (auto simp: fine_def d_def)
             qed (use c e in auto)
             finally show "norm (\<Sum>(x,K)\<in>{xk \<in> \<D>. m (fst xk) = t}. content K *\<^sub>R f (m x) x -
                                 integral K (f (m x))) \<le> e/2 ^ (t + 2)" .
           qed
           also have "... = (e/2/2) * (\<Sum>i = 0..s. (1/2) ^ i)"
             by (simp add: sum_distrib_left field_simps)
           also have "\<dots> < e/2"
             by (simp add: sum_gp mult_strict_left_mono[OF _ e])
           finally show "norm (\<Sum>j = 0..s. \<Sum>(x, k)\<in>{xk \<in> \<D>.
             m (fst xk) = j}. content k *\<^sub>R f (m x) x - integral k (f (m x))) < e/2" .
         qed 
         finally show "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x) - (\<Sum>(x,K)\<in>\<D>. integral K (f (m x)))\<bar> < e/2"
           by simp
       next
         have comb: "integral (cbox a b) (f y) = (\<Sum>(x, k)\<in>\<D>. integral k (f y))" for y
           using integral_combine_tagged_division_topdown[OF intf ptag] by metis
         have f_le: "\<And>y m n. \<lbrakk>y \<in> cbox a b; n\<ge>m\<rbrakk> \<Longrightarrow> f m y \<le> f n y"
           using le by (auto intro: transitive_stepwise_le)        
         have "(\<Sum>(x, k)\<in>\<D>. integral k (f r)) \<le> (\<Sum>(x, K)\<in>\<D>. integral K (f (m x)))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xK: "(x, K) \<in> \<D>"
           show "integral K (f r) \<le> integral K (f (m x))"
           proof (rule integral_le)
             show "f r integrable_on K"
               by (metis integrable_on_subcbox intf p'(3) p'(4) xK)
             show "f (m x) integrable_on K"
               by (metis elementary_interval integrable_on_subdivision intf p'(3) p'(4) xK)
             show "f r y \<le> f (m x) y" if "y \<in> K" for y
               using that r_le_m[of x] p'(2-3)[OF xK] f_le by auto
           qed
         qed
         moreover have "(\<Sum>(x, K)\<in>\<D>. integral K (f (m x))) \<le> (\<Sum>(x, k)\<in>\<D>. integral k (f s))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xK: "(x, K) \<in> \<D>"
           show "integral K (f (m x)) \<le> integral K (f s)"
           proof (rule integral_le)
             show "f (m x) integrable_on K"
               by (metis elementary_interval integrable_on_subdivision intf p'(3) p'(4) xK)
             show "f s integrable_on K"
               by (metis integrable_on_subcbox intf p'(3) p'(4) xK)
             show "f (m x) y \<le> f s y" if "y \<in> K" for y
               using that s xK f_le p'(3) by fastforce
           qed
         qed
         moreover have "0 \<le> i - integral (cbox a b) (f r)" "i - integral (cbox a b) (f r) < e/4"
           using r by auto
         ultimately show "\<bar>(\<Sum>(x,K)\<in>\<D>. integral K (f (m x))) - i\<bar> < e/4"
           using comb i'[of s] by auto
       qed
     qed
   qed 
   with i integral_unique show ?thesis
     by blast
 qed
 
 lemma monotone_convergence_increasing:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes int_f: "\<And>k. (f k) integrable_on S"
     and "\<And>k x. x \<in> S \<Longrightarrow> (f k x) \<le> (f (Suc k) x)"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range (\<lambda>k. integral S (f k)))"
   shows "g integrable_on S \<and> ((\<lambda>k. integral S (f k)) \<longlongrightarrow> integral S g) sequentially"
 proof -
   have lem: "g integrable_on S \<and> ((\<lambda>k. integral S (f k)) \<longlongrightarrow> integral S g) sequentially"
     if f0: "\<And>k x. x \<in> S \<Longrightarrow> 0 \<le> f k x"
     and int_f: "\<And>k. (f k) integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> f k x \<le> f (Suc k) x"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range(\<lambda>k. integral S (f k)))"
     for f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real" and g S
   proof -
     have fg: "(f k x) \<le> (g x)" if "x \<in> S" for x k
     proof -
       have "\<And>xa. k \<le> xa \<Longrightarrow> f k x \<le> f xa x"
         using le  by (force intro: transitive_stepwise_le that)
       then show ?thesis
         using tendsto_lowerbound [OF lim [OF that]] eventually_sequentiallyI by force
     qed
     obtain i where i: "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> i"
       using bounded_increasing_convergent [OF bou] le int_f integral_le by blast
     have i': "(integral S (f k)) \<le> i" for k
     proof -
       have "\<And>k. \<And>x. x \<in> S \<Longrightarrow> \<forall>n\<ge>k. f k x \<le> f n x"
         using le  by (force intro: transitive_stepwise_le)
       then show ?thesis
         using tendsto_lowerbound [OF i eventually_sequentiallyI trivial_limit_sequentially]
         by (meson int_f integral_le)
     qed
     let ?f = "(\<lambda>k x. if x \<in> S then f k x else 0)"
     let ?g = "(\<lambda>x. if x \<in> S then g x else 0)"
     have int: "?f k integrable_on cbox a b" for a b k
       by (simp add: int_f integrable_altD(1))
     have int': "\<And>k a b. f k integrable_on cbox a b \<inter> S"
       using int by (simp add: Int_commute integrable_restrict_Int) 
     have g: "?g integrable_on cbox a b \<and>
              (\<lambda>k. integral (cbox a b) (?f k)) \<longlonglongrightarrow> integral (cbox a b) ?g" for a b
     proof (rule monotone_convergence_interval)
       have "norm (integral (cbox a b) (?f k)) \<le> norm (integral S (f k))" for k
       proof -
         have "0 \<le> integral (cbox a b) (?f k)"
           by (metis (no_types) integral_nonneg Int_iff f0 inf_commute integral_restrict_Int int')
         moreover have "0 \<le> integral S (f k)"
           by (simp add: integral_nonneg f0 int_f)
         moreover have "integral (S \<inter> cbox a b) (f k) \<le> integral S (f k)"
           by (metis f0 inf_commute int' int_f integral_subset_le le_inf_iff order_refl)
         ultimately show ?thesis
           by (simp add: integral_restrict_Int)
       qed
       moreover obtain B where "\<And>x. x \<in> range (\<lambda>k. integral S (f k)) \<Longrightarrow> norm x \<le> B"
         using bou unfolding bounded_iff by blast
       ultimately show "bounded (range (\<lambda>k. integral (cbox a b) (?f k)))"
         unfolding bounded_iff by (blast intro: order_trans)
     qed (use int le lim in auto)
     moreover have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?g - i) < e"
       if "0 < e" for e
     proof -
       have "e/4>0"
         using that by auto
       with LIMSEQ_D [OF i] obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> norm (integral S (f n) - i) < e/4"
         by metis
       with int_f[of N, unfolded has_integral_integral has_integral_alt'[of "f N"]] 
       obtain B where "0 < B" and B: 
         "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> norm (integral (cbox a b) (?f N) - integral S (f N)) < e/4"
         by (meson \<open>0 < e/4\<close>)
       have "norm (integral (cbox a b) ?g - i) < e" if  ab: "ball 0 B \<subseteq> cbox a b" for a b
       proof -
         obtain M where M: "\<And>n. n \<ge> M \<Longrightarrow> abs (integral (cbox a b) (?f n) - integral (cbox a b) ?g) < e/2"
           using \<open>e > 0\<close> g by (fastforce simp add: dest!: LIMSEQ_D [where r = "e/2"])
         have *: "\<And>\<alpha> \<beta> g. \<lbrakk>\<bar>\<alpha> - i\<bar> < e/2; \<bar>\<beta> - g\<bar> < e/2; \<alpha> \<le> \<beta>; \<beta> \<le> i\<rbrakk> \<Longrightarrow> \<bar>g - i\<bar> < e"
           unfolding real_inner_1_right by arith
         show "norm (integral (cbox a b) ?g - i) < e"
           unfolding real_norm_def
         proof (rule *)
           show "\<bar>integral (cbox a b) (?f N) - i\<bar> < e/2"
           proof (rule abs_triangle_half_l)
             show "\<bar>integral (cbox a b) (?f N) - integral S (f N)\<bar> < e/2/2"
               using B[OF ab] by simp
             show "abs (i - integral S (f N)) < e/2/2"
               using N by (simp add: abs_minus_commute)
           qed
           show "\<bar>integral (cbox a b) (?f (M + N)) - integral (cbox a b) ?g\<bar> < e/2"
             by (metis le_add1 M[of "M + N"])
           show "integral (cbox a b) (?f N) \<le> integral (cbox a b) (?f (M + N))"
           proof (intro ballI integral_le[OF int int])
             fix x assume "x \<in> cbox a b"
             have "(f m x) \<le> (f n x)" if "x \<in> S" "n \<ge> m" for m n
             proof (rule transitive_stepwise_le [OF \<open>n \<ge> m\<close> order_refl])
               show "\<And>u y z. \<lbrakk>f u x \<le> f y x; f y x \<le> f z x\<rbrakk> \<Longrightarrow> f u x \<le> f z x"
                 using dual_order.trans by blast
             qed (simp add: le \<open>x \<in> S\<close>)
             then show "(?f N)x \<le> (?f (M+N))x"
               by auto
           qed
           have "integral (cbox a b \<inter> S) (f (M + N)) \<le> integral S (f (M + N))"
             by (metis Int_lower1 f0 inf_commute int' int_f integral_subset_le)
           then have "integral (cbox a b) (?f (M + N)) \<le> integral S (f (M + N))"
             by (metis (no_types) inf_commute integral_restrict_Int)
           also have "... \<le> i"
             using i'[of "M + N"] by auto
           finally show "integral (cbox a b) (?f (M + N)) \<le> i" .
         qed
       qed
       then show ?thesis
         using \<open>0 < B\<close> by blast
     qed
     ultimately have "(g has_integral i) S"
       unfolding has_integral_alt' by auto
     then show ?thesis
       using has_integral_integrable_integral i integral_unique by metis
   qed
 
   have sub: "\<And>k. integral S (\<lambda>x. f k x - f 0 x) = integral S (f k) - integral S (f 0)"
     by (simp add: integral_diff int_f)
   have *: "\<And>x m n. x \<in> S \<Longrightarrow> n\<ge>m \<Longrightarrow> f m x \<le> f n x"
     using assms(2) by (force intro: transitive_stepwise_le)
   have gf: "(\<lambda>x. g x - f 0 x) integrable_on S \<and> ((\<lambda>k. integral S (\<lambda>x. f (Suc k) x - f 0 x)) \<longlongrightarrow>
     integral S (\<lambda>x. g x - f 0 x)) sequentially"
   proof (rule lem)
     show "\<And>k. (\<lambda>x. f (Suc k) x - f 0 x) integrable_on S"
       by (simp add: integrable_diff int_f)
     show "(\<lambda>k. f (Suc k) x - f 0 x) \<longlonglongrightarrow> g x - f 0 x" if "x \<in> S" for x
     proof -
       have "(\<lambda>n. f (Suc n) x) \<longlonglongrightarrow> g x"
         using LIMSEQ_ignore_initial_segment[OF fg[OF \<open>x \<in> S\<close>], of 1] by simp
       then show ?thesis
         by (simp add: tendsto_diff)
     qed
     show "bounded (range (\<lambda>k. integral S (\<lambda>x. f (Suc k) x - f 0 x)))"
     proof -
       obtain B where B: "\<And>k. norm (integral S (f k)) \<le> B"
         using  bou by (auto simp: bounded_iff)
       then have "norm (integral S (\<lambda>x. f (Suc k) x - f 0 x))
               \<le> B + norm (integral S (f 0))" for k
         unfolding sub by (meson add_le_cancel_right norm_triangle_le_diff)
       then show ?thesis
         unfolding bounded_iff by blast
     qed
   qed (use * in auto)
   then have "(\<lambda>x. integral S (\<lambda>xa. f (Suc x) xa - f 0 xa) + integral S (f 0))
              \<longlonglongrightarrow> integral S (\<lambda>x. g x - f 0 x) + integral S (f 0)"
     by (auto simp add: tendsto_add)
   moreover have "(\<lambda>x. g x - f 0 x + f 0 x) integrable_on S"
     using gf integrable_add int_f [of 0] by metis
   ultimately show ?thesis
     by (simp add: integral_diff int_f LIMSEQ_imp_Suc sub)
 qed
 
 lemma has_integral_monotone_convergence_increasing:
   fixes f :: "nat \<Rightarrow> 'a::euclidean_space \<Rightarrow> real"
   assumes f: "\<And>k. (f k has_integral x k) s"
   assumes "\<And>k x. x \<in> s \<Longrightarrow> f k x \<le> f (Suc k) x"
   assumes "\<And>x. x \<in> s \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   assumes "x \<longlonglongrightarrow> x'"
   shows "(g has_integral x') s"
 proof -
   have x_eq: "x = (\<lambda>i. integral s (f i))"
     by (simp add: integral_unique[OF f])
   then have x: "range(\<lambda>k. integral s (f k)) = range x"
     by auto
   have *: "g integrable_on s \<and> (\<lambda>k. integral s (f k)) \<longlonglongrightarrow> integral s g"
   proof (intro monotone_convergence_increasing allI ballI assms)
     show "bounded (range(\<lambda>k. integral s (f k)))"
       using x convergent_imp_bounded assms by metis
   qed (use f in auto)
   then have "integral s g = x'"
     by (intro LIMSEQ_unique[OF _ \<open>x \<longlonglongrightarrow> x'\<close>]) (simp add: x_eq)
   with * show ?thesis
     by (simp add: has_integral_integral)
 qed
 
 lemma monotone_convergence_decreasing:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes intf: "\<And>k. (f k) integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> f (Suc k) x \<le> f k x"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range(\<lambda>k. integral S (f k)))"
   shows "g integrable_on S \<and> (\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
 proof -
   have *: "range(\<lambda>k. integral S (\<lambda>x. - f k x)) = (*\<^sub>R) (- 1) ` (range(\<lambda>k. integral S (f k)))"
     by force
   have "(\<lambda>x. - g x) integrable_on S \<and> (\<lambda>k. integral S (\<lambda>x. - f k x)) \<longlonglongrightarrow> integral S (\<lambda>x. - g x)"
   proof (rule monotone_convergence_increasing)
     show "\<And>k. (\<lambda>x. - f k x) integrable_on S"
       by (blast intro: integrable_neg intf)
     show "\<And>k x. x \<in> S \<Longrightarrow> - f k x \<le> - f (Suc k) x"
       by (simp add: le)
     show "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. - f k x) \<longlonglongrightarrow> - g x"
       by (simp add: fg tendsto_minus)
     show "bounded (range(\<lambda>k. integral S (\<lambda>x. - f k x)))"
       using "*" bou bounded_scaling by auto
   qed
   then show ?thesis
     by (force dest: integrable_neg tendsto_minus)
 qed
 
 lemma integral_norm_bound_integral:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes int_f: "f integrable_on S"
     and int_g: "g integrable_on S"
     and le_g: "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> g x"
   shows "norm (integral S f) \<le> integral S g"
 proof -
   have norm: "norm \<eta> \<le> y + e"
     if "norm \<zeta> \<le> x" and "\<bar>x - y\<bar> < e/2" and "norm (\<zeta> - \<eta>) < e/2"
     for e x y and \<zeta> \<eta> :: 'a
   proof -
     have "norm (\<eta> - \<zeta>) < e/2"
       by (metis norm_minus_commute that(3))
     moreover have "x \<le> y + e/2"
       using that(2) by linarith
     ultimately show ?thesis
       using that(1) le_less_trans[OF norm_triangle_sub[of \<eta> \<zeta>]] by (auto simp: less_imp_le)
   qed
   have lem: "norm (integral(cbox a b) f) \<le> integral (cbox a b) g"
     if f: "f integrable_on cbox a b"
     and g: "g integrable_on cbox a b"
     and nle: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm (f x) \<le> g x"
     for f :: "'n \<Rightarrow> 'a" and g a b
   proof (rule field_le_epsilon)
     fix e :: real
     assume "e > 0"
     then have e: "e/2 > 0"
       by auto
     with integrable_integral[OF f,unfolded has_integral[of f]]
     obtain \<gamma> where \<gamma>: "gauge \<gamma>"
               "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> 
            \<Longrightarrow> norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - integral (cbox a b) f) < e/2"
       by meson 
     moreover
     from integrable_integral[OF g,unfolded has_integral[of g]] e
     obtain \<delta> where \<delta>: "gauge \<delta>"
               "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<delta> fine \<D> 
            \<Longrightarrow> norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - integral (cbox a b) g) < e/2"
       by meson
     ultimately have "gauge (\<lambda>x. \<gamma> x \<inter> \<delta> x)"
       using gauge_Int by blast
     with fine_division_exists obtain \<D> 
       where p: "\<D> tagged_division_of cbox a b" "(\<lambda>x. \<gamma> x \<inter> \<delta> x) fine \<D>" 
       by metis
     have "\<gamma> fine \<D>" "\<delta> fine \<D>"
       using fine_Int p(2) by blast+
     show "norm (integral (cbox a b) f) \<le> integral (cbox a b) g + e"
     proof (rule norm)
       have "norm (content K *\<^sub>R f x) \<le> content K *\<^sub>R g x" if  "(x, K) \<in> \<D>" for x K
       proof-
         have K: "x \<in> K" "K \<subseteq> cbox a b"
           using \<open>(x, K) \<in> \<D>\<close> p(1) by blast+
         obtain u v where  "K = cbox u v"
           using \<open>(x, K) \<in> \<D>\<close> p(1) by blast
         moreover have "content K * norm (f x) \<le> content K * g x"
           by (meson K(1) K(2) content_pos_le mult_left_mono nle subsetD)
         then show ?thesis
           by simp
       qed
       then show "norm (\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) \<le> (\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x)"
         by (simp add: sum_norm_le split_def)
       show "norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - integral (cbox a b) f) < e/2"
         using \<open>\<gamma> fine \<D>\<close> \<gamma> p(1) by simp
       show "\<bar>(\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - integral (cbox a b) g\<bar> < e/2"
         using \<open>\<delta> fine \<D>\<close> \<delta> p(1) by simp
     qed
   qed
   show ?thesis
   proof (rule field_le_epsilon)
     fix e :: real
     assume "e > 0"
     then have e: "e/2 > 0"
       by auto
     let ?f = "(\<lambda>x. if x \<in> S then f x else 0)"
     let ?g = "(\<lambda>x. if x \<in> S then g x else 0)"
     have f: "?f integrable_on cbox a b" and g: "?g integrable_on cbox a b" for a b
       using int_f int_g integrable_altD by auto
     obtain Bf where "0 < Bf"
       and Bf: "\<And>a b. ball 0 Bf \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?f has_integral z) (cbox a b) \<and> norm (z - integral S f) < e/2"
       using integrable_integral [OF int_f,unfolded has_integral'[of f]] e that by blast
     obtain Bg where "0 < Bg"
       and Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?g has_integral z) (cbox a b) \<and> norm (z - integral S g) < e/2"
       using integrable_integral [OF int_g,unfolded has_integral'[of g]] e that by blast
     obtain a b::'n where ab: "ball 0 Bf \<union> ball 0 Bg \<subseteq> cbox a b"
       using ball_max_Un  by (metis bounded_ball bounded_subset_cbox_symmetric)
     have "ball 0 Bf \<subseteq> cbox a b"
       using ab by auto
     with Bf obtain z where int_fz: "(?f has_integral z) (cbox a b)" and z: "norm (z - integral S f) < e/2"
       by meson
     have "ball 0 Bg \<subseteq> cbox a b"
       using ab by auto
     with Bg obtain w where int_gw: "(?g has_integral w) (cbox a b)" and w: "norm (w - integral S g) < e/2"
       by meson
     show "norm (integral S f) \<le> integral S g + e"
     proof (rule norm)
       show "norm (integral (cbox a b) ?f) \<le> integral (cbox a b) ?g"
         by (simp add: le_g lem[OF f g, of a b])
       show "\<bar>integral (cbox a b) ?g - integral S g\<bar> < e/2"
         using int_gw integral_unique w by auto
       show "norm (integral (cbox a b) ?f - integral S f) < e/2"
         using int_fz integral_unique z by blast
     qed
   qed
 qed
 
 lemma continuous_on_imp_absolutely_integrable_on:
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "continuous_on {a..b} f \<Longrightarrow>
     norm (integral {a..b} f) \<le> integral {a..b} (\<lambda>x. norm (f x))"
   by (intro integral_norm_bound_integral integrable_continuous_real continuous_on_norm) auto
 
 lemma integral_bound:
   fixes f::"real \<Rightarrow> 'a::banach"
   assumes "a \<le> b"
   assumes "continuous_on {a .. b} f"
   assumes "\<And>t. t \<in> {a .. b} \<Longrightarrow> norm (f t) \<le> B"
   shows "norm (integral {a .. b} f) \<le> B * (b - a)"
 proof -
   note continuous_on_imp_absolutely_integrable_on[OF assms(2)]
   also have "integral {a..b} (\<lambda>x. norm (f x)) \<le> integral {a..b} (\<lambda>_. B)"
     by (rule integral_le)
       (auto intro!: integrable_continuous_real continuous_intros assms)
   also have "\<dots> = B * (b - a)" using assms by simp
   finally show ?thesis .
 qed
 
 lemma integral_norm_bound_integral_component:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   fixes g :: "'n \<Rightarrow> 'b::euclidean_space"
   assumes f: "f integrable_on S" and g: "g integrable_on S"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> (g x)\<bullet>k"
   shows "norm (integral S f) \<le> (integral S g)\<bullet>k"
 proof -
   have "norm (integral S f) \<le> integral S ((\<lambda>x. x \<bullet> k) \<circ> g)"
     using integral_norm_bound_integral[OF f integrable_linear[OF g]]
     by (simp add: bounded_linear_inner_left fg)
   then show ?thesis
     unfolding o_def integral_component_eq[OF g] .
 qed
 
 lemma has_integral_norm_bound_integral_component:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   fixes g :: "'n \<Rightarrow> 'b::euclidean_space"
   assumes f: "(f has_integral i) S"
     and g: "(g has_integral j) S"
     and "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> (g x)\<bullet>k"
   shows "norm i \<le> j\<bullet>k"
   using integral_norm_bound_integral_component[of f S g k] 
   unfolding integral_unique[OF f] integral_unique[OF g]
   using assms
   by auto
 
 
 lemma uniformly_convergent_improper_integral:
   fixes f :: "'b \<Rightarrow> real \<Rightarrow> 'a :: {banach}"
   assumes deriv: "\<And>x. x \<ge> a \<Longrightarrow> (G has_field_derivative g x) (at x within {a..})"
   assumes integrable: "\<And>a' b x. x \<in> A \<Longrightarrow> a' \<ge> a \<Longrightarrow> b \<ge> a' \<Longrightarrow> f x integrable_on {a'..b}"
   assumes G: "convergent G"
   assumes le: "\<And>y x. y \<in> A \<Longrightarrow> x \<ge> a \<Longrightarrow> norm (f y x) \<le> g x"
   shows   "uniformly_convergent_on A (\<lambda>b x. integral {a..b} (f x))"
 proof (intro Cauchy_uniformly_convergent uniformly_Cauchy_onI', goal_cases)
   case (1 \<epsilon>)
   from G have "Cauchy G"
     by (auto intro!: convergent_Cauchy)
   with 1 obtain M where M: "dist (G (real m)) (G (real n)) < \<epsilon>" if "m \<ge> M" "n \<ge> M" for m n
     by (force simp: Cauchy_def)
   define M' where "M' = max (nat \<lceil>a\<rceil>) M"
 
   show ?case
   proof (rule exI[of _ M'], safe, goal_cases)
     case (1 x m n)
     have M': "M' \<ge> a" "M' \<ge> M" unfolding M'_def by linarith+
     have int_g: "(g has_integral (G (real n) - G (real m))) {real m..real n}"
       using 1 M' by (intro fundamental_theorem_of_calculus) 
-                    (auto simp: has_field_derivative_iff_has_vector_derivative [symmetric] 
+                    (auto simp: has_real_derivative_iff_has_vector_derivative [symmetric] 
                           intro!: DERIV_subset[OF deriv])
     have int_f: "f x integrable_on {a'..real n}" if "a' \<ge> a" for a'
       using that 1 by (cases "a' \<le> real n") (auto intro: integrable)
 
     have "dist (integral {a..real m} (f x)) (integral {a..real n} (f x)) =
             norm (integral {a..real n} (f x) - integral {a..real m} (f x))"
       by (simp add: dist_norm norm_minus_commute)
     also have "integral {a..real m} (f x) + integral {real m..real n} (f x) = 
                  integral {a..real n} (f x)"
       using M' and 1 by (intro integral_combine int_f) auto
     hence "integral {a..real n} (f x) - integral {a..real m} (f x) = 
              integral {real m..real n} (f x)"
       by (simp add: algebra_simps)
     also have "norm \<dots> \<le> integral {real m..real n} g"
       using le 1 M' int_f int_g by (intro integral_norm_bound_integral) auto 
     also from int_g have "integral {real m..real n} g = G (real n) - G (real m)"
       by (simp add: has_integral_iff)
     also have "\<dots> \<le> dist (G m) (G n)" 
       by (simp add: dist_norm)
     also from 1 and M' have "\<dots> < \<epsilon>"
       by (intro M) auto
     finally show ?case .
   qed
 qed
 
 lemma uniformly_convergent_improper_integral':
   fixes f :: "'b \<Rightarrow> real \<Rightarrow> 'a :: {banach, real_normed_algebra}"
   assumes deriv: "\<And>x. x \<ge> a \<Longrightarrow> (G has_field_derivative g x) (at x within {a..})"
   assumes integrable: "\<And>a' b x. x \<in> A \<Longrightarrow> a' \<ge> a \<Longrightarrow> b \<ge> a' \<Longrightarrow> f x integrable_on {a'..b}"
   assumes G: "convergent G"
   assumes le: "eventually (\<lambda>x. \<forall>y\<in>A. norm (f y x) \<le> g x) at_top"
   shows   "uniformly_convergent_on A (\<lambda>b x. integral {a..b} (f x))"
 proof -
   from le obtain a'' where le: "\<And>y x. y \<in> A \<Longrightarrow> x \<ge> a'' \<Longrightarrow> norm (f y x) \<le> g x"
     by (auto simp: eventually_at_top_linorder)
   define a' where "a' = max a a''"
 
   have "uniformly_convergent_on A (\<lambda>b x. integral {a'..real b} (f x))"
   proof (rule uniformly_convergent_improper_integral)
     fix t assume t: "t \<ge> a'"
     hence "(G has_field_derivative g t) (at t within {a..})"
       by (intro deriv) (auto simp: a'_def)
     moreover have "{a'..} \<subseteq> {a..}" unfolding a'_def by auto
     ultimately show "(G has_field_derivative g t) (at t within {a'..})"
       by (rule DERIV_subset)
   qed (insert le, auto simp: a'_def intro: integrable G)
   hence "uniformly_convergent_on A (\<lambda>b x. integral {a..a'} (f x) + integral {a'..real b} (f x))" 
     (is ?P) by (intro uniformly_convergent_add) auto
   also have "eventually (\<lambda>x. \<forall>y\<in>A. integral {a..a'} (f y) + integral {a'..x} (f y) =
                    integral {a..x} (f y)) sequentially"
     by (intro eventually_mono [OF eventually_ge_at_top[of "nat \<lceil>a'\<rceil>"]] ballI integral_combine)
        (auto simp: a'_def intro: integrable)
   hence "?P \<longleftrightarrow> ?thesis"
     by (intro uniformly_convergent_cong) simp_all
   finally show ?thesis .
 qed
 
 subsection \<open>differentiation under the integral sign\<close>
 
 lemma integral_continuous_on_param:
   fixes f::"'a::topological_space \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes cont_fx: "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). f x t)"
   shows "continuous_on U (\<lambda>x. integral (cbox a b) (f x))"
 proof cases
   assume "content (cbox a b) \<noteq> 0"
   then have ne: "cbox a b \<noteq> {}" by auto
 
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
 
   show ?thesis
     unfolding continuous_on_def
   proof (safe intro!: tendstoI)
     fix e'::real and x
     assume "e' > 0"
     define e where "e = e' / (content (cbox a b) + 1)"
     have "e > 0" using \<open>e' > 0\<close> by (auto simp: e_def intro!: divide_pos_pos add_nonneg_pos)
     assume "x \<in> U"
     from continuous_on_prod_compactE[OF cont_fx compact_cbox \<open>x \<in> U\<close> \<open>0 < e\<close>]
     obtain X0 where X0: "x \<in> X0" "open X0"
       and fx_bound: "\<And>y t. y \<in> X0 \<inter> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> norm (f y t - f x t) \<le> e"
       unfolding split_beta fst_conv snd_conv dist_norm
       by metis
     have "\<forall>\<^sub>F y in at x within U. y \<in> X0 \<inter> U"
       using X0(1) X0(2) eventually_at_topological by auto
     then show "\<forall>\<^sub>F y in at x within U. dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) < e'"
     proof eventually_elim
       case (elim y)
       have "dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) =
         norm (integral (cbox a b) (\<lambda>t. f y t - f x t))"
         using elim \<open>x \<in> U\<close>
         unfolding dist_norm
         by (subst integral_diff)
            (auto intro!: integrable_continuous continuous_intros)
       also have "\<dots> \<le> e * content (cbox a b)"
         using elim \<open>x \<in> U\<close>
         by (intro integrable_bound)
            (auto intro!: fx_bound \<open>x \<in> U \<close> less_imp_le[OF \<open>0 < e\<close>]
               integrable_continuous continuous_intros)
       also have "\<dots> < e'"
         using \<open>0 < e'\<close> \<open>e > 0\<close>
         by (auto simp: e_def field_split_simps)
       finally show "dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) < e'" .
     qed
   qed
 qed (auto intro!: continuous_on_const)
 
 lemma leibniz_rule:
   fixes f::"'a::banach \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow>
     ((\<lambda>x. f x t) has_derivative blinfun_apply (fx x t)) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> f x integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes [intro]: "x0 \<in> U"
   assumes "convex U"
   shows
     "((\<lambda>x. integral (cbox a b) (f x)) has_derivative integral (cbox a b) (fx x0)) (at x0 within U)"
     (is "(?F has_derivative ?dF) _")
 proof cases
   assume "content (cbox a b) \<noteq> 0"
   then have ne: "cbox a b \<noteq> {}" by auto
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   show ?thesis
   proof (intro has_derivativeI bounded_linear_scaleR_left tendstoI, fold norm_conv_dist)
     have cont_f1: "\<And>t. t \<in> cbox a b \<Longrightarrow> continuous_on U (\<lambda>x. f x t)"
       by (auto simp: continuous_on_eq_continuous_within intro!: has_derivative_continuous fx)
     note [continuous_intros] = continuous_on_compose2[OF cont_f1]
     fix e'::real
     assume "e' > 0"
     define e where "e = e' / (content (cbox a b) + 1)"
     have "e > 0" using \<open>e' > 0\<close> by (auto simp: e_def intro!: divide_pos_pos add_nonneg_pos)
     from continuous_on_prod_compactE[OF cont_fx compact_cbox \<open>x0 \<in> U\<close> \<open>e > 0\<close>]
     obtain X0 where X0: "x0 \<in> X0" "open X0"
       and fx_bound: "\<And>x t. x \<in> X0 \<inter> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> norm (fx x t - fx x0 t) \<le> e"
       unfolding split_beta fst_conv snd_conv
       by (metis dist_norm)
 
     note eventually_closed_segment[OF \<open>open X0\<close> \<open>x0 \<in> X0\<close>, of U]
     moreover
     have "\<forall>\<^sub>F x in at x0 within U. x \<in> X0"
       using \<open>open X0\<close> \<open>x0 \<in> X0\<close> eventually_at_topological by blast
     moreover have "\<forall>\<^sub>F x in at x0 within U. x \<noteq> x0"
       by (auto simp: eventually_at_filter)
     moreover have "\<forall>\<^sub>F x in at x0 within U. x \<in> U"
       by (auto simp: eventually_at_filter)
     ultimately
     show "\<forall>\<^sub>F x in at x0 within U. norm ((?F x - ?F x0 - ?dF (x - x0)) /\<^sub>R norm (x - x0)) < e'"
     proof eventually_elim
       case (elim x)
       from elim have "0 < norm (x - x0)" by simp
       have "closed_segment x0 x \<subseteq> U"
         by (rule \<open>convex U\<close>[unfolded convex_contains_segment, rule_format, OF \<open>x0 \<in> U\<close> \<open>x \<in> U\<close>])
       from elim have [intro]: "x \<in> U" by auto
       have "?F x - ?F x0 - ?dF (x - x0) =
         integral (cbox a b) (\<lambda>y. f x y - f x0 y - fx x0 y (x - x0))"
         (is "_ = ?id")
         using \<open>x \<noteq> x0\<close>
         by (subst blinfun_apply_integral integral_diff,
             auto intro!: integrable_diff integrable_f2 continuous_intros
               intro: integrable_continuous)+
       also
       {
         fix t assume t: "t \<in> (cbox a b)"
         have seg: "\<And>t. t \<in> {0..1} \<Longrightarrow> x0 + t *\<^sub>R (x - x0) \<in> X0 \<inter> U"
           using \<open>closed_segment x0 x \<subseteq> U\<close>
             \<open>closed_segment x0 x \<subseteq> X0\<close>
           by (force simp: closed_segment_def algebra_simps)
         from t have deriv:
           "((\<lambda>x. f x t) has_derivative (fx y t)) (at y within X0 \<inter> U)"
           if "y \<in> X0 \<inter> U" for y
           unfolding has_vector_derivative_def[symmetric]
           using that \<open>x \<in> X0\<close>
           by (intro has_derivative_subset[OF fx]) auto
         have "\<And>x. x \<in> X0 \<inter> U \<Longrightarrow> onorm (blinfun_apply (fx x t) - (fx x0 t)) \<le> e"
           using fx_bound t
           by (auto simp add: norm_blinfun_def fun_diff_def blinfun.bilinear_simps[symmetric])
         from differentiable_bound_linearization[OF seg deriv this] X0
         have "norm (f x t - f x0 t - fx x0 t (x - x0)) \<le> e * norm (x - x0)"
           by (auto simp add: ac_simps)
       }
       then have "norm ?id \<le> integral (cbox a b) (\<lambda>_. e * norm (x - x0))"
         by (intro integral_norm_bound_integral)
           (auto intro!: continuous_intros integrable_diff integrable_f2
             intro: integrable_continuous)
       also have "\<dots> = content (cbox a b) * e * norm (x - x0)"
         by simp
       also have "\<dots> < e' * norm (x - x0)"
       proof (intro mult_strict_right_mono[OF _ \<open>0 < norm (x - x0)\<close>])
         show "content (cbox a b) * e < e'"
           using \<open>e' > 0\<close> by (simp add: divide_simps e_def not_less)
       qed
       finally have "norm (?F x - ?F x0 - ?dF (x - x0)) < e' * norm (x - x0)" .
       then show ?case
         by (auto simp: divide_simps)
     qed
   qed (rule blinfun.bounded_linear_right)
 qed (auto intro!: derivative_eq_intros simp: blinfun.bilinear_simps)
 
 lemma has_vector_derivative_eq_has_derivative_blinfun:
   "(f has_vector_derivative f') (at x within U) \<longleftrightarrow>
     (f has_derivative blinfun_scaleR_left f') (at x within U)"
   by (simp add: has_vector_derivative_def)
 
 lemma leibniz_rule_vector_derivative:
   fixes f::"real \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow>
       ((\<lambda>x. f x t) has_vector_derivative (fx x t)) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). fx x t)"
   assumes U: "x0 \<in> U" "convex U"
   shows "((\<lambda>x. integral (cbox a b) (f x)) has_vector_derivative integral (cbox a b) (fx x0))
       (at x0 within U)"
 proof -
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   show ?thesis
     unfolding has_vector_derivative_eq_has_derivative_blinfun
   proof (rule has_derivative_eq_rhs [OF leibniz_rule[OF _ integrable_f2 _ U]])
     show "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). blinfun_scaleR_left (fx x t))"
       using cont_fx by (auto simp: split_beta intro!: continuous_intros)
     show "blinfun_apply (integral (cbox a b) (\<lambda>t. blinfun_scaleR_left (fx x0 t))) =
           blinfun_apply (blinfun_scaleR_left (integral (cbox a b) (fx x0)))"
     by (subst integral_linear[symmetric])
        (auto simp: has_vector_derivative_def o_def
          intro!: integrable_continuous U continuous_intros bounded_linear_intros)
     qed (use fx in \<open>auto simp: has_vector_derivative_def\<close>)
 qed
 
 lemma has_field_derivative_eq_has_derivative_blinfun:
   "(f has_field_derivative f') (at x within U) \<longleftrightarrow> (f has_derivative blinfun_mult_right f') (at x within U)"
   by (simp add: has_field_derivative_def)
 
 lemma leibniz_rule_field_derivative:
   fixes f::"'a::{real_normed_field, banach} \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'a"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> ((\<lambda>x. f x t) has_field_derivative fx x t) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes U: "x0 \<in> U" "convex U"
   shows "((\<lambda>x. integral (cbox a b) (f x)) has_field_derivative integral (cbox a b) (fx x0)) (at x0 within U)"
 proof -
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   have *: "blinfun_mult_right (integral (cbox a b) (fx x0)) =
     integral (cbox a b) (\<lambda>t. blinfun_mult_right (fx x0 t))"
     by (subst integral_linear[symmetric])
       (auto simp: has_vector_derivative_def o_def
         intro!: integrable_continuous U continuous_intros bounded_linear_intros)
   show ?thesis
     unfolding has_field_derivative_eq_has_derivative_blinfun
   proof (rule has_derivative_eq_rhs [OF leibniz_rule[OF _ integrable_f2 _ U, where fx="\<lambda>x t. blinfun_mult_right (fx x t)"]])
     show "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). blinfun_mult_right (fx x t))"
       using cont_fx by (auto simp: split_beta intro!: continuous_intros)
     show "blinfun_apply (integral (cbox a b) (\<lambda>t. blinfun_mult_right (fx x0 t))) =
           blinfun_apply (blinfun_mult_right (integral (cbox a b) (fx x0)))"
       by (subst integral_linear[symmetric])
         (auto simp: has_vector_derivative_def o_def
           intro!: integrable_continuous U continuous_intros bounded_linear_intros)
   qed (use fx in \<open>auto simp: has_field_derivative_def\<close>)
 qed
 
 lemma leibniz_rule_field_differentiable:
   fixes f::"'a::{real_normed_field, banach} \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'a"
   assumes "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> ((\<lambda>x. f x t) has_field_derivative fx x t) (at x within U)"
   assumes "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes "x0 \<in> U" "convex U"
   shows "(\<lambda>x. integral (cbox a b) (f x)) field_differentiable at x0 within U"
   using leibniz_rule_field_derivative[OF assms] by (auto simp: field_differentiable_def)
 
 
 subsection \<open>Exchange uniform limit and integral\<close>
 
 lemma uniform_limit_integral_cbox:
   fixes f::"'a \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes u: "uniform_limit (cbox a b) f g F"
   assumes c: "\<And>n. continuous_on (cbox a b) (f n)"
   assumes [simp]: "F \<noteq> bot"
   obtains I J where
     "\<And>n. (f n has_integral I n) (cbox a b)"
     "(g has_integral J) (cbox a b)"
     "(I \<longlongrightarrow> J) F"
 proof -
   have fi[simp]: "f n integrable_on (cbox a b)" for n
     by (auto intro!: integrable_continuous assms)
   then obtain I where I: "\<And>n. (f n has_integral I n) (cbox a b)"
     by atomize_elim (auto simp: integrable_on_def intro!: choice)
 
   moreover
   have gi[simp]: "g integrable_on (cbox a b)"
     by (auto intro!: integrable_continuous uniform_limit_theorem[OF _ u] eventuallyI c)
   then obtain J where J: "(g has_integral J) (cbox a b)"
     by blast
 
   moreover
   have "(I \<longlongrightarrow> J) F"
   proof cases
     assume "content (cbox a b) = 0"
     hence "I = (\<lambda>_. 0)" "J = 0"
       by (auto intro!: has_integral_unique I J)
     thus ?thesis by simp
   next
     assume content_nonzero: "content (cbox a b) \<noteq> 0"
     show ?thesis
     proof (rule tendstoI)
       fix e::real
       assume "e > 0"
       define e' where "e' = e/2"
       with \<open>e > 0\<close> have "e' > 0" by simp
       then have "\<forall>\<^sub>F n in F. \<forall>x\<in>cbox a b. norm (f n x - g x) < e' / content (cbox a b)"
         using u content_nonzero by (auto simp: uniform_limit_iff dist_norm zero_less_measure_iff)
       then show "\<forall>\<^sub>F n in F. dist (I n) J < e"
       proof eventually_elim
         case (elim n)
         have "I n = integral (cbox a b) (f n)"
             "J = integral (cbox a b) g"
           using I[of n] J by (simp_all add: integral_unique)
         then have "dist (I n) J = norm (integral (cbox a b) (\<lambda>x. f n x - g x))"
           by (simp add: integral_diff dist_norm)
         also have "\<dots> \<le> integral (cbox a b) (\<lambda>x. (e' / content (cbox a b)))"
           using elim
           by (intro integral_norm_bound_integral) (auto intro!: integrable_diff)
         also have "\<dots> < e"
           using \<open>0 < e\<close>
           by (simp add: e'_def)
         finally show ?case .
       qed
     qed
   qed
   ultimately show ?thesis ..
 qed
 
 lemma uniform_limit_integral:
   fixes f::"'a \<Rightarrow> 'b::ordered_euclidean_space \<Rightarrow> 'c::banach"
   assumes u: "uniform_limit {a..b} f g F"
   assumes c: "\<And>n. continuous_on {a..b} (f n)"
   assumes [simp]: "F \<noteq> bot"
   obtains I J where
     "\<And>n. (f n has_integral I n) {a..b}"
     "(g has_integral J) {a..b}"
     "(I \<longlongrightarrow> J) F"
   by (metis interval_cbox assms uniform_limit_integral_cbox)
 
 
 subsection \<open>Integration by parts\<close>
 
 lemma integration_by_parts_interior_strong:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes bilinear: "bounded_bilinear (prod)"
   assumes s: "finite s" and le: "a \<le> b"
   assumes cont [continuous_intros]: "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes deriv: "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
                  "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes int: "((\<lambda>x. prod (f x) (g' x)) has_integral
                   (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
 proof -
   interpret bounded_bilinear prod by fact
   have "((\<lambda>x. prod (f x) (g' x) + prod (f' x) (g x)) has_integral
           (prod (f b) (g b) - prod (f a) (g a))) {a..b}"
     using deriv by (intro fundamental_theorem_of_calculus_interior_strong[OF s le])
                    (auto intro!: continuous_intros continuous_on has_vector_derivative)
   from has_integral_diff[OF this int] show ?thesis by (simp add: algebra_simps)
 qed
 
 lemma integration_by_parts_interior:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
   by (rule integration_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integration_by_parts:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
   by (rule integration_by_parts_interior[of _ _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integrable_by_parts_interior_strong:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes bilinear: "bounded_bilinear (prod)"
   assumes s: "finite s" and le: "a \<le> b"
   assumes cont [continuous_intros]: "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes deriv: "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
                  "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes int: "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
 proof -
   from int obtain I where "((\<lambda>x. prod (f x) (g' x)) has_integral I) {a..b}"
     unfolding integrable_on_def by blast
   hence "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) -
            (prod (f b) (g b) - prod (f a) (g a) - I))) {a..b}" by simp
   from integration_by_parts_interior_strong[OF assms(1-7) this]
     show ?thesis unfolding integrable_on_def by blast
 qed
 
 lemma integrable_by_parts_interior:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
   by (rule integrable_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integrable_by_parts:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
   by (rule integrable_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 
 subsection \<open>Integration by substitution\<close>
 
 lemma has_integral_substitution_general:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes s: "finite s" and le: "a \<le> b"
       and subset: "g ` {a..b} \<subseteq> {c..d}"
       and f [continuous_intros]: "continuous_on {c..d} f"
       and g [continuous_intros]: "continuous_on {a..b} g"
       and deriv [derivative_intros]:
               "\<And>x. x \<in> {a..b} - s \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
     shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f - integral {g b..g a} f)) {a..b}"
 proof -
   let ?F = "\<lambda>x. integral {c..g x} f"
   have cont_int: "continuous_on {a..b} ?F"
     by (rule continuous_on_compose2[OF _ g subset] indefinite_integral_continuous_1
           f integrable_continuous_real)+
   have deriv: "(((\<lambda>x. integral {c..x} f) \<circ> g) has_vector_derivative g' x *\<^sub>R f (g x))
                  (at x within {a..b})" if "x \<in> {a..b} - s" for x
   proof (rule has_vector_derivative_eq_rhs [OF vector_diff_chain_within refl])
     show "(g has_vector_derivative g' x) (at x within {a..b})"
-      using deriv has_field_derivative_iff_has_vector_derivative that by blast
+      using deriv has_real_derivative_iff_has_vector_derivative that by blast
     show "((\<lambda>x. integral {c..x} f) has_vector_derivative f (g x)) 
           (at (g x) within g ` {a..b})"
       using that le subset
       by (blast intro: has_vector_derivative_within_subset integral_has_vector_derivative f)
   qed
   have deriv: "(?F has_vector_derivative g' x *\<^sub>R f (g x))
                   (at x)" if "x \<in> {a..b} - (s \<union> {a,b})" for x
     using deriv[of x] that by (simp add: at_within_Icc_at o_def)
   have "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (?F b - ?F a)) {a..b}"
     using le cont_int s deriv cont_int
     by (intro fundamental_theorem_of_calculus_interior_strong[of "s \<union> {a,b}"]) simp_all
   also
   from subset have "g x \<in> {c..d}" if "x \<in> {a..b}" for x using that by blast
   from this[of a] this[of b] le have cd: "c \<le> g a" "g b \<le> d" "c \<le> g b" "g a \<le> d" by auto
   have "integral {c..g b} f - integral {c..g a} f = integral {g a..g b} f - integral {g b..g a} f"
   proof cases
     assume "g a \<le> g b"
     note le = le this
     from cd have "integral {c..g a} f + integral {g a..g b} f = integral {c..g b} f"
       by (intro integral_combine integrable_continuous_real continuous_on_subset[OF f] le) simp_all
     with le show ?thesis
       by (cases "g a = g b") (simp_all add: algebra_simps)
   next
     assume less: "\<not>g a \<le> g b"
     then have "g a \<ge> g b" by simp
     note le = le this
     from cd have "integral {c..g b} f + integral {g b..g a} f = integral {c..g a} f"
       by (intro integral_combine integrable_continuous_real continuous_on_subset[OF f] le) simp_all
     with less show ?thesis
       by (simp_all add: algebra_simps)
   qed
   finally show ?thesis .
 qed
 
 lemma has_integral_substitution_strong:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes s: "finite s" and le: "a \<le> b" "g a \<le> g b"
     and subset: "g ` {a..b} \<subseteq> {c..d}"
     and f [continuous_intros]: "continuous_on {c..d} f"
     and g [continuous_intros]: "continuous_on {a..b} g"
     and deriv [derivative_intros]:
     "\<And>x. x \<in> {a..b} - s \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
   shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f)) {a..b}"
   using has_integral_substitution_general[OF s le(1) subset f g deriv] le(2)
   by (cases "g a = g b") auto
 
 lemma has_integral_substitution:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes "a \<le> b" "g a \<le> g b" "g ` {a..b} \<subseteq> {c..d}"
       and "continuous_on {c..d} f"
       and "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
     shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f)) {a..b}"
   by (intro has_integral_substitution_strong[of "{}" a b g c d] assms)
      (auto intro: DERIV_continuous_on assms)
 
 lemma integral_shift:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes cont: "continuous_on {a + c..b + c} f"
   shows "integral {a..b} (f \<circ> (\<lambda>x. x + c)) = integral {a + c..b + c} f"
 proof (cases "a \<le> b")
   case True
   have "((\<lambda>x. 1 *\<^sub>R f (x + c)) has_integral integral {a+c..b+c} f) {a..b}"
     using True cont
     by (intro has_integral_substitution[where c = "a + c" and d = "b + c"])
        (auto intro!: derivative_eq_intros)
   thus ?thesis by (simp add: has_integral_iff o_def)
 qed auto
 
 
 subsection \<open>Compute a double integral using iterated integrals and switching the order of integration\<close>
 
 lemma continuous_on_imp_integrable_on_Pair1:
   fixes f :: "_ \<Rightarrow> 'b::banach"
   assumes con: "continuous_on (cbox (a,c) (b,d)) f" and x: "x \<in> cbox a b"
   shows "(\<lambda>y. f (x, y)) integrable_on (cbox c d)"
 proof -
   have "f \<circ> (\<lambda>y. (x, y)) integrable_on (cbox c d)"
   proof (intro integrable_continuous continuous_on_compose [OF _ continuous_on_subset [OF con]])
     show "continuous_on (cbox c d) (Pair x)"
       by (simp add: continuous_on_Pair)
     show "Pair x ` cbox c d \<subseteq> cbox (a,c) (b,d)"
       using x by blast
   qed
   then show ?thesis
     by (simp add: o_def)
 qed
 
 lemma integral_integrable_2dim:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) f"
     shows "(\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y))) integrable_on cbox a b"
 proof (cases "content(cbox c d) = 0")
 case True
   then show ?thesis
     by (simp add: True integrable_const)
 next
   case False
   have uc: "uniformly_continuous_on (cbox (a,c) (b,d)) f"
     by (simp add: assms compact_cbox compact_uniformly_continuous)
   { fix x::'a and e::real
     assume x: "x \<in> cbox a b" and e: "0 < e"
     then have e2_gt: "0 < e/2 / content (cbox c d)" and e2_less: "e/2 / content (cbox c d) * content (cbox c d) < e"
       by (auto simp: False content_lt_nz e)
     then obtain dd
     where dd: "\<And>x x'. \<lbrakk>x\<in>cbox (a, c) (b, d); x'\<in>cbox (a, c) (b, d); norm (x' - x) < dd\<rbrakk>
                        \<Longrightarrow> norm (f x' - f x) \<le> e/(2 * content (cbox c d))"  "dd>0"
       using uc [unfolded uniformly_continuous_on_def, THEN spec, of "e/(2 * content (cbox c d))"]
       by (auto simp: dist_norm intro: less_imp_le)
     have "\<exists>delta>0. \<forall>x'\<in>cbox a b. norm (x' - x) < delta \<longrightarrow> norm (integral (cbox c d) (\<lambda>u. f (x', u) - f (x, u))) < e"
       using dd e2_gt assms x
       apply (rule_tac x=dd in exI)
       apply clarify
       apply (rule le_less_trans [OF integrable_bound e2_less])
       apply (auto intro: integrable_diff continuous_on_imp_integrable_on_Pair1)
       done
   } note * = this
   show ?thesis
   proof (rule integrable_continuous)
     show "continuous_on (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y)))"
       by (simp add: * continuous_on_iff dist_norm integral_diff [symmetric] continuous_on_imp_integrable_on_Pair1 [OF assms])
   qed
 qed
 
 lemma integral_split:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{real_normed_vector,complete_space}"
   assumes f: "f integrable_on (cbox a b)"
       and k: "k \<in> Basis"
   shows "integral (cbox a b) f =
            integral (cbox a b \<inter> {x. x\<bullet>k \<le> c}) f +
            integral (cbox a b \<inter> {x. x\<bullet>k \<ge> c}) f"
   using k f
   by (auto simp: has_integral_integral intro: integral_unique [OF has_integral_split])
 
 lemma integral_swap_operativeI:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes f: "continuous_on s f" and e: "0 < e"
     shows "operative conj True
            (\<lambda>k. \<forall>a b c d.
                 cbox (a,c) (b,d) \<subseteq> k \<and> cbox (a,c) (b,d) \<subseteq> s
                 \<longrightarrow> norm(integral (cbox (a,c) (b,d)) f -
                          integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f((x,y)))))
                     \<le> e * content (cbox (a,c) (b,d)))"
 proof (standard, auto)
   fix a::'a and c::'b and b::'a and d::'b and u::'a and v::'a and w::'b and z::'b
   assume *: "box (a, c) (b, d) = {}"
      and cb1: "cbox (u, w) (v, z) \<subseteq> cbox (a, c) (b, d)"
      and cb2: "cbox (u, w) (v, z) \<subseteq> s"
   then have c0: "content (cbox (a, c) (b, d)) = 0"
     using * unfolding content_eq_0_interior by simp
   have c0': "content (cbox (u, w) (v, z)) = 0"
     by (fact content_0_subset [OF c0 cb1])
   show "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
           \<le> e * content (cbox (u,w) (v,z))"
     using content_cbox_pair_eq0_D [OF c0']
     by (force simp add: c0')
 next
   fix a::'a and c::'b and b::'a and d::'b
   and M::real and i::'a and j::'b
   and u::'a and v::'a and w::'b and z::'b
   assume ij: "(i,j) \<in> Basis"
      and n1: "\<forall>a' b' c' d'.
                 cbox (a',c') (b',d') \<subseteq> cbox (a,c) (b,d) \<and>
                 cbox (a',c') (b',d') \<subseteq> {x. x \<bullet> (i,j) \<le> M} \<and> cbox (a',c') (b',d') \<subseteq> s \<longrightarrow>
                 norm (integral (cbox (a',c') (b',d')) f - integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f (x,y))))
                 \<le> e * content (cbox (a',c') (b',d'))"
      and n2: "\<forall>a' b' c' d'.
                 cbox (a',c') (b',d') \<subseteq> cbox (a,c) (b,d) \<and>
                 cbox (a',c') (b',d') \<subseteq> {x. M \<le> x \<bullet> (i,j)} \<and> cbox (a',c') (b',d') \<subseteq> s \<longrightarrow>
                 norm (integral (cbox (a',c') (b',d')) f - integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f (x,y))))
                 \<le> e * content (cbox (a',c') (b',d'))"
      and subs: "cbox (u,w) (v,z) \<subseteq> cbox (a,c) (b,d)"  "cbox (u,w) (v,z) \<subseteq> s"
   have fcont: "continuous_on (cbox (u, w) (v, z)) f"
     using assms(1) continuous_on_subset  subs(2) by blast
   then have fint: "f integrable_on cbox (u, w) (v, z)"
     by (metis integrable_continuous)
   consider "i \<in> Basis" "j=0" | "j \<in> Basis" "i=0"  using ij
     by (auto simp: Euclidean_Space.Basis_prod_def)
   then show "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))))
              \<le> e * content (cbox (u,w) (v,z))" (is ?normle)
   proof cases
     case 1
     then have e: "e * content (cbox (u, w) (v, z)) =
                   e * (content (cbox u v \<inter> {x. x \<bullet> i \<le> M}) * content (cbox w z)) +
                   e * (content (cbox u v \<inter> {x. M \<le> x \<bullet> i}) * content (cbox w z))"
       by (simp add: content_split [where c=M] content_Pair algebra_simps)
     have *: "integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) =
                 integral (cbox u v \<inter> {x. x \<bullet> i \<le> M}) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) +
                 integral (cbox u v \<inter> {x. M \<le> x \<bullet> i}) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y)))"
       using 1 f subs integral_integrable_2dim continuous_on_subset
       by (blast intro: integral_split)
     show ?normle
       apply (rule norm_diff2 [OF integral_split [where c=M, OF fint ij] * e])
       using 1 subs
       apply (simp_all add: cbox_Pair_eq setcomp_dot1 [of "\<lambda>u. M\<le>u"] setcomp_dot1 [of "\<lambda>u. u\<le>M"] Sigma_Int_Paircomp1)
       apply (simp_all add: interval_split ij flip: cbox_Pair_eq content_Pair)
       apply (force simp flip: interval_split intro!: n1 [rule_format])
       apply (force simp flip: interval_split intro!: n2 [rule_format])
       done
   next
     case 2
     then have e: "e * content (cbox (u, w) (v, z)) =
                   e * (content (cbox u v) * content (cbox w z \<inter> {x. x \<bullet> j \<le> M})) +
                   e * (content (cbox u v) * content (cbox w z \<inter> {x. M \<le> x \<bullet> j}))"
       by (simp add: content_split [where c=M] content_Pair algebra_simps)
     have "(\<lambda>x. integral (cbox w z \<inter> {x. x \<bullet> j \<le> M}) (\<lambda>y. f (x, y))) integrable_on cbox u v"
          "(\<lambda>x. integral (cbox w z \<inter> {x. M \<le> x \<bullet> j}) (\<lambda>y. f (x, y))) integrable_on cbox u v"
       using 2 subs
       apply (simp_all add: interval_split)
       apply (rule integral_integrable_2dim [OF continuous_on_subset [OF f]]; auto simp: cbox_Pair_eq interval_split [symmetric])+
       done
     with 2 have *: "integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) =
                    integral (cbox u v) (\<lambda>x. integral (cbox w z \<inter> {x. x \<bullet> j \<le> M}) (\<lambda>y. f (x, y))) +
                    integral (cbox u v) (\<lambda>x. integral (cbox w z \<inter> {x. M \<le> x \<bullet> j}) (\<lambda>y. f (x, y)))"
       by (simp add: integral_add [symmetric] integral_split [symmetric]
                     continuous_on_imp_integrable_on_Pair1 [OF fcont] cong: integral_cong)
     show ?normle
       apply (rule norm_diff2 [OF integral_split [where c=M, OF fint ij] * e])
       using 2 subs
       apply (simp_all add: cbox_Pair_eq setcomp_dot2 [of "\<lambda>u. M\<le>u"] setcomp_dot2 [of "\<lambda>u. u\<le>M"] Sigma_Int_Paircomp2)
       apply (simp_all add: interval_split ij flip: cbox_Pair_eq content_Pair)
       apply (force simp flip: interval_split intro!: n1 [rule_format])
       apply (force simp flip: interval_split intro!: n2 [rule_format])
       done
   qed
 qed
 
 lemma integral_Pair_const:
     "integral (cbox (a,c) (b,d)) (\<lambda>x. k) =
      integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. k))"
   by (simp add: content_Pair)
 
 lemma integral_prod_continuous:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a, c) (b, d)) f" (is "continuous_on ?CBOX f")
     shows "integral (cbox (a, c) (b, d)) f = integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y)))"
 proof (cases "content ?CBOX = 0")
   case True
   then show ?thesis
     by (auto simp: content_Pair)
 next
   case False
   then have cbp: "content ?CBOX > 0"
     using content_lt_nz by blast
   have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) = 0"
   proof (rule dense_eq0_I, simp)
     fix e :: real 
     assume "0 < e"
     with \<open>content ?CBOX > 0\<close> have "0 < e/content ?CBOX"
       by simp
     have f_int_acbd: "f integrable_on ?CBOX"
       by (rule integrable_continuous [OF assms])
     { fix p
       assume p: "p division_of ?CBOX"
       then have "finite p"
         by blast
       define e' where "e' = e/content ?CBOX"
       with \<open>0 < e\<close> \<open>0 < e/content ?CBOX\<close>
       have "0 < e'"
         by simp
       interpret operative conj True
            "\<lambda>k. \<forall>a' b' c' d'.
                 cbox (a', c') (b', d') \<subseteq> k \<and> cbox (a', c') (b', d') \<subseteq> ?CBOX
                 \<longrightarrow> norm (integral (cbox (a', c') (b', d')) f -
                          integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f ((x, y)))))
                     \<le> e' * content (cbox (a', c') (b', d'))"
         using assms \<open>0 < e'\<close> by (rule integral_swap_operativeI)
       have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y))))
           \<le> e' * content ?CBOX"
         if "\<And>t u v w z. t \<in> p \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> t \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> ?CBOX
           \<Longrightarrow> norm (integral (cbox (u, w) (v, z)) f -
               integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
               \<le> e' * content (cbox (u, w) (v, z))"
         using that division [of p "(a, c)" "(b, d)"] p \<open>finite p\<close> by (auto simp add: comm_monoid_set_F_and)
       with False have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y))))
           \<le> e"
         if "\<And>t u v w z. t \<in> p \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> t \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> ?CBOX
           \<Longrightarrow> norm (integral (cbox (u, w) (v, z)) f -
               integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
               \<le> e * content (cbox (u, w) (v, z)) / content ?CBOX"
         using that by (simp add: e'_def)
     } note op_acbd = this
     { fix k::real and \<D> and u::'a and v w and z::'b and t1 t2 l
       assume k: "0 < k"
          and nf: "\<And>x y u v.
                   \<lbrakk>x \<in> cbox a b; y \<in> cbox c d; u \<in> cbox a b; v\<in>cbox c d; norm (u-x, v-y) < k\<rbrakk>
                   \<Longrightarrow> norm (f(u,v) - f(x,y)) < e/(2 * (content ?CBOX))"
          and p_acbd: "\<D> tagged_division_of cbox (a,c) (b,d)"
          and fine: "(\<lambda>x. ball x k) fine \<D>"  "((t1,t2), l) \<in> \<D>"
          and uwvz_sub: "cbox (u,w) (v,z) \<subseteq> l" "cbox (u,w) (v,z) \<subseteq> cbox (a,c) (b,d)"
       have t: "t1 \<in> cbox a b" "t2 \<in> cbox c d"
         by (meson fine p_acbd cbox_Pair_iff tag_in_interval)+
       have ls: "l \<subseteq> ball (t1,t2) k"
         using fine by (simp add: fine_def Ball_def)
       { fix x1 x2
         assume xuvwz: "x1 \<in> cbox u v" "x2 \<in> cbox w z"
         then have x: "x1 \<in> cbox a b" "x2 \<in> cbox c d"
           using uwvz_sub by auto
         have "norm (x1 - t1, x2 - t2) = norm (t1 - x1, t2 - x2)"
           by (simp add: norm_Pair norm_minus_commute)
         also have "norm (t1 - x1, t2 - x2) < k"
           using xuvwz ls uwvz_sub unfolding ball_def
           by (force simp add: cbox_Pair_eq dist_norm )
         finally have "norm (f (x1,x2) - f (t1,t2)) \<le> e/content ?CBOX/2"
           using nf [OF t x]  by simp
       } note nf' = this
       have f_int_uwvz: "f integrable_on cbox (u,w) (v,z)"
         using f_int_acbd uwvz_sub integrable_on_subcbox by blast
       have f_int_uv: "\<And>x. x \<in> cbox u v \<Longrightarrow> (\<lambda>y. f (x,y)) integrable_on cbox w z"
         using assms continuous_on_subset uwvz_sub
         by (blast intro: continuous_on_imp_integrable_on_Pair1)
       have 1: "norm (integral (cbox (u,w) (v,z)) f - integral (cbox (u,w) (v,z)) (\<lambda>x. f (t1,t2)))
              \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         using cbp \<open>0 < e/content ?CBOX\<close> nf'
         apply (simp only: integral_diff [symmetric] f_int_uwvz integrable_const)
         apply (auto simp: integrable_diff f_int_uwvz integrable_const intro: order_trans [OF integrable_bound [of "e/content ?CBOX/2"]])
         done
       have int_integrable: "(\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) integrable_on cbox u v"
         using assms integral_integrable_2dim continuous_on_subset uwvz_sub(2) by blast
       have normint_wz:
          "\<And>x. x \<in> cbox u v \<Longrightarrow>
                norm (integral (cbox w z) (\<lambda>y. f (x, y)) - integral (cbox w z) (\<lambda>y. f (t1, t2)))
                \<le> e * content (cbox w z) / content (cbox (a, c) (b, d))/2"
         using cbp \<open>0 < e/content ?CBOX\<close> nf'
         apply (simp only: integral_diff [symmetric] f_int_uv integrable_const)
         apply (auto simp: integrable_diff f_int_uv integrable_const intro: order_trans [OF integrable_bound [of "e/content ?CBOX/2"]])
         done
       have "norm (integral (cbox u v)
                (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y)) - integral (cbox w z) (\<lambda>y. f (t1,t2))))
             \<le> e * content (cbox w z) / content ?CBOX/2 * content (cbox u v)"
         using cbp \<open>0 < e/content ?CBOX\<close>
         apply (intro integrable_bound [OF _ _ normint_wz])
         apply (auto simp: field_split_simps integrable_diff int_integrable integrable_const)
         done
       also have "... \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         by (simp add: content_Pair field_split_simps)
       finally have 2: "norm (integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))) -
                       integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (t1,t2))))
                 \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         by (simp only: integral_diff [symmetric] int_integrable integrable_const)
       have norm_xx: "\<lbrakk>x' = y'; norm(x - x') \<le> e/2; norm(y - y') \<le> e/2\<rbrakk> \<Longrightarrow> norm(x - y) \<le> e" for x::'c and y x' y' e
         using norm_triangle_mono [of "x-y'" "e/2" "y'-y" "e/2"] field_sum_of_halves
         by (simp add: norm_minus_commute)
       have "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))))
             \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX"
         by (rule norm_xx [OF integral_Pair_const 1 2])
     } note * = this
     have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) \<le> e" 
       if "\<forall>x\<in>?CBOX. \<forall>x'\<in>?CBOX. norm (x' - x) < k \<longrightarrow> norm (f x' - f x) < e /(2 * content (?CBOX))" "0 < k" for k
     proof -
       obtain p where ptag: "p tagged_division_of cbox (a, c) (b, d)" 
                  and fine: "(\<lambda>x. ball x k) fine p"
         using fine_division_exists \<open>0 < k\<close> by blast
       show ?thesis
         using that fine ptag \<open>0 < k\<close> 
         by (auto simp: * intro: op_acbd [OF division_of_tagged_division [OF ptag]])
     qed
     then show "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) \<le> e"
       using compact_uniformly_continuous [OF assms compact_cbox]
       apply (simp add: uniformly_continuous_on_def dist_norm)
       apply (drule_tac x="e/2 / content?CBOX" in spec)
       using cbp \<open>0 < e\<close> by (auto simp: zero_less_mult_iff)
   qed
   then show ?thesis
     by simp
 qed
 
 lemma integral_swap_2dim:
   fixes f :: "['a::euclidean_space, 'b::euclidean_space] \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "integral (cbox (a, c) (b, d)) (\<lambda>(x, y). f x y) = integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)"
 proof -
   have "((\<lambda>(x, y). f x y) has_integral integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)) (prod.swap ` (cbox (c, a) (d, b)))"
   proof (rule has_integral_twiddle [of 1 prod.swap prod.swap "\<lambda>(x,y). f y x" "integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)", simplified])
     show "\<And>u v. content (prod.swap ` cbox u v) = content (cbox u v)"
       by (metis content_Pair mult.commute old.prod.exhaust swap_cbox_Pair)
     show "((\<lambda>(x, y). f y x) has_integral integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)) (cbox (c, a) (d, b))"
       by (simp add: assms integrable_continuous integrable_integral swap_continuous)
   qed (use isCont_swap in \<open>fastforce+\<close>)
  then show ?thesis
    by force
 qed
 
 theorem integral_swap_continuous:
   fixes f :: "['a::euclidean_space, 'b::euclidean_space] \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "integral (cbox a b) (\<lambda>x. integral (cbox c d) (f x)) =
            integral (cbox c d) (\<lambda>y. integral (cbox a b) (\<lambda>x. f x y))"
 proof -
   have "integral (cbox a b) (\<lambda>x. integral (cbox c d) (f x)) = integral (cbox (a, c) (b, d)) (\<lambda>(x, y). f x y)"
     using integral_prod_continuous [OF assms] by auto
   also have "... = integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)"
     by (rule integral_swap_2dim [OF assms])
   also have "... = integral (cbox c d) (\<lambda>y. integral (cbox a b) (\<lambda>x. f x y))"
     using integral_prod_continuous [OF swap_continuous] assms
     by auto
   finally show ?thesis .
 qed
 
 
 subsection \<open>Definite integrals for exponential and power function\<close>
 
 lemma has_integral_exp_minus_to_infinity:
   assumes a: "a > 0"
   shows   "((\<lambda>x::real. exp (-a*x)) has_integral exp (-a*c)/a) {c..}"
 proof -
   define f where "f = (\<lambda>k x. if x \<in> {c..real k} then exp (-a*x) else 0)"
   {
     fix k :: nat assume k: "of_nat k \<ge> c"
     from k a
       have "((\<lambda>x. exp (-a*x)) has_integral (-exp (-a*real k)/a - (-exp (-a*c)/a))) {c..real k}"
       by (intro fundamental_theorem_of_calculus)
          (auto intro!: derivative_eq_intros
-               simp: has_field_derivative_iff_has_vector_derivative [symmetric])
+               simp: has_real_derivative_iff_has_vector_derivative [symmetric])
     hence "(f k has_integral (exp (-a*c)/a - exp (-a*real k)/a)) {c..}" unfolding f_def
       by (subst has_integral_restrict) simp_all
   } note has_integral_f = this
 
   have [simp]: "f k = (\<lambda>_. 0)" if "of_nat k < c" for k using that by (auto simp: fun_eq_iff f_def)
   have integral_f: "integral {c..} (f k) =
                       (if real k \<ge> c then exp (-a*c)/a - exp (-a*real k)/a else 0)"
     for k using integral_unique[OF has_integral_f[of k]] by simp
 
   have A: "(\<lambda>x. exp (-a*x)) integrable_on {c..} \<and>
              (\<lambda>k. integral {c..} (f k)) \<longlonglongrightarrow> integral {c..} (\<lambda>x. exp (-a*x))"
   proof (intro monotone_convergence_increasing allI ballI)
     fix k ::nat
     have "(\<lambda>x. exp (-a*x)) integrable_on {c..of_real k}" (is ?P)
       unfolding f_def by (auto intro!: continuous_intros integrable_continuous_real)
     hence  "(f k) integrable_on {c..of_real k}"
       by (rule integrable_eq) (simp add: f_def)
     then show "f k integrable_on {c..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix x assume x: "x \<in> {c..}"
     have "sequentially \<le> principal {nat \<lceil>x\<rceil>..}" unfolding at_top_def by (simp add: Inf_lower)
     also have "{nat \<lceil>x\<rceil>..} \<subseteq> {k. x \<le> real k}" by auto
     also have "inf (principal \<dots>) (principal {k. \<not>x \<le> real k}) =
                  principal ({k. x \<le> real k} \<inter> {k. \<not>x \<le> real k})" by simp
     also have "{k. x \<le> real k} \<inter> {k. \<not>x \<le> real k} = {}" by blast
     finally have "inf sequentially (principal {k. \<not>x \<le> real k}) = bot"
       by (simp add: inf.coboundedI1 bot_unique)
     with x show "(\<lambda>k. f k x) \<longlonglongrightarrow> exp (-a*x)" unfolding f_def
       by (intro filterlim_If) auto
   next
     have "\<bar>integral {c..} (f k)\<bar> \<le> exp (-a*c)/a" for k
     proof (cases "c > of_nat k")
       case False
       hence "abs (integral {c..} (f k)) = abs (exp (- (a * c)) / a - exp (- (a * real k)) / a)"
         by (simp add: integral_f)
       also have "abs (exp (- (a * c)) / a - exp (- (a * real k)) / a) =
                    exp (- (a * c)) / a - exp (- (a * real k)) / a"
         using False a by (intro abs_of_nonneg) (simp_all add: field_simps)
       also have "\<dots> \<le> exp (- a * c) / a" using a by simp
       finally show ?thesis .
     qed (insert a, simp_all add: integral_f)
     thus "bounded (range(\<lambda>k. integral {c..} (f k)))"
       by (intro boundedI[of _ "exp (-a*c)/a"]) auto
   qed (auto simp: f_def)
   have "(\<lambda>k. exp (-a*c)/a - exp (-a * of_nat k)/a) \<longlonglongrightarrow> exp (-a*c)/a - 0/a"
     by (intro tendsto_intros filterlim_compose[OF exp_at_bot]
         filterlim_tendsto_neg_mult_at_bot[OF tendsto_const] filterlim_real_sequentially)+
       (insert a, simp_all)
   moreover
   from eventually_gt_at_top[of "nat \<lceil>c\<rceil>"] have "eventually (\<lambda>k. of_nat k > c) sequentially"
     by eventually_elim linarith
   hence "eventually (\<lambda>k. exp (-a*c)/a - exp (-a * of_nat k)/a = integral {c..} (f k)) sequentially"
     by eventually_elim (simp add: integral_f) 
   ultimately have "(\<lambda>k. integral {c..} (f k)) \<longlonglongrightarrow> exp (-a*c)/a - 0/a"
     by (rule Lim_transform_eventually)
   from LIMSEQ_unique[OF conjunct2[OF A] this]
   have "integral {c..} (\<lambda>x. exp (-a*x)) = exp (-a*c)/a" by simp
   with conjunct1[OF A] show ?thesis
     by (simp add: has_integral_integral)
 qed
 
 lemma integrable_on_exp_minus_to_infinity: "a > 0 \<Longrightarrow> (\<lambda>x. exp (-a*x) :: real) integrable_on {c..}"
   using has_integral_exp_minus_to_infinity[of a c] unfolding integrable_on_def by blast
 
 lemma has_integral_powr_from_0:
   assumes a: "a > (-1::real)" and c: "c \<ge> 0"
   shows   "((\<lambda>x. x powr a) has_integral (c powr (a+1) / (a+1))) {0..c}"
 proof (cases "c = 0")
   case False
   define f where "f = (\<lambda>k x. if x \<in> {inverse (of_nat (Suc k))..c} then x powr a else 0)"
   define F where "F = (\<lambda>k. if inverse (of_nat (Suc k)) \<le> c then
                              c powr (a+1)/(a+1) - inverse (real (Suc k)) powr (a+1)/(a+1) else 0)"
   {
     fix k :: nat
     have "(f k has_integral F k) {0..c}"
     proof (cases "inverse (of_nat (Suc k)) \<le> c")
       case True
       {
         fix x assume x: "x \<ge> inverse (1 + real k)"
         have "0 < inverse (1 + real k)" by simp
         also note x
         finally have "x > 0" .
       } note x = this
       hence "((\<lambda>x. x powr a) has_integral c powr (a + 1) / (a + 1) -
                inverse (real (Suc k)) powr (a + 1) / (a + 1)) {inverse (real (Suc k))..c}"
         using True a by (intro fundamental_theorem_of_calculus)
            (auto intro!: derivative_eq_intros continuous_on_powr' continuous_on_const
-              simp: has_field_derivative_iff_has_vector_derivative [symmetric])
+              simp: has_real_derivative_iff_has_vector_derivative [symmetric])
       with True show ?thesis unfolding f_def F_def by (subst has_integral_restrict) simp_all
     next
       case False
       thus ?thesis unfolding f_def F_def by (subst has_integral_restrict) auto
     qed
   } note has_integral_f = this
   have integral_f: "integral {0..c} (f k) = F k" for k
     using has_integral_f[of k] by (rule integral_unique)
 
   have A: "(\<lambda>x. x powr a) integrable_on {0..c} \<and>
            (\<lambda>k. integral {0..c} (f k)) \<longlonglongrightarrow> integral {0..c} (\<lambda>x. x powr a)"
   proof (intro monotone_convergence_increasing ballI allI)
     fix k from has_integral_f[of k] show "f k integrable_on {0..c}"
       by (auto simp: integrable_on_def)
   next
     fix k :: nat and x :: real
     {
       assume x: "inverse (real (Suc k)) \<le> x"
       have "inverse (real (Suc (Suc k))) \<le> inverse (real (Suc k))" by (simp add: field_simps)
       also note x
       finally have "inverse (real (Suc (Suc k))) \<le> x" .
     }
     thus "f k x \<le> f (Suc k) x" by (auto simp: f_def simp del: of_nat_Suc)
   next
     fix x assume x: "x \<in> {0..c}"
     show "(\<lambda>k. f k x) \<longlonglongrightarrow> x powr a"
     proof (cases "x = 0")
       case False
       with x have "x > 0" by simp
       from order_tendstoD(2)[OF LIMSEQ_inverse_real_of_nat this]
         have "eventually (\<lambda>k. x powr a = f k x) sequentially"
         by eventually_elim (insert x, simp add: f_def)
       moreover have "(\<lambda>_. x powr a) \<longlonglongrightarrow> x powr a" by simp
       ultimately show ?thesis by (blast intro: Lim_transform_eventually)
     qed (simp_all add: f_def)
   next
     {
       fix k
       from a have "F k \<le> c powr (a + 1) / (a + 1)"
         by (auto simp add: F_def divide_simps)
       also from a have "F k \<ge> 0"
         by (auto simp: F_def divide_simps simp del: of_nat_Suc intro!: powr_mono2)
       hence "F k = abs (F k)" by simp
       finally have "abs (F k) \<le>  c powr (a + 1) / (a + 1)" .
     }
     thus "bounded (range(\<lambda>k. integral {0..c} (f k)))"
       by (intro boundedI[of _ "c powr (a+1) / (a+1)"]) (auto simp: integral_f)
   qed
 
   from False c have "c > 0" by simp
   from order_tendstoD(2)[OF LIMSEQ_inverse_real_of_nat this]
     have "eventually (\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a+1) / (a+1) =
             integral {0..c} (f k)) sequentially"
     by eventually_elim (simp add: integral_f F_def)
   moreover have "(\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a + 1) / (a + 1))
                    \<longlonglongrightarrow> c powr (a + 1) / (a + 1) - 0 powr (a + 1) / (a + 1)"
     using a by (intro tendsto_intros LIMSEQ_inverse_real_of_nat) auto
   hence "(\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a + 1) / (a + 1))
           \<longlonglongrightarrow> c powr (a + 1) / (a + 1)" by simp
   ultimately have "(\<lambda>k. integral {0..c} (f k)) \<longlonglongrightarrow> c powr (a+1) / (a+1)"
     by (blast intro: Lim_transform_eventually)
   with A have "integral {0..c} (\<lambda>x. x powr a) = c powr (a+1) / (a+1)"
     by (blast intro: LIMSEQ_unique)
   with A show ?thesis by (simp add: has_integral_integral)
 qed (simp_all add: has_integral_refl)
 
 lemma integrable_on_powr_from_0:
   assumes a: "a > (-1::real)" and c: "c \<ge> 0"
   shows   "(\<lambda>x. x powr a) integrable_on {0..c}"
   using has_integral_powr_from_0[OF assms] unfolding integrable_on_def by blast
 
 lemma has_integral_powr_to_inf:
   fixes a e :: real
   assumes "e < -1" "a > 0"
   shows   "((\<lambda>x. x powr e) has_integral -(a powr (e + 1)) / (e + 1)) {a..}"
 proof -
   define f :: "nat \<Rightarrow> real \<Rightarrow> real" where "f = (\<lambda>n x. if x \<in> {a..n} then x powr e else 0)"
   define F where "F = (\<lambda>x. x powr (e + 1) / (e + 1))"
 
   have has_integral_f: "(f n has_integral (F n - F a)) {a..}"
     if n: "n \<ge> a" for n :: nat
   proof -
     from n assms have "((\<lambda>x. x powr e) has_integral (F n - F a)) {a..n}"
       by (intro fundamental_theorem_of_calculus) (auto intro!: derivative_eq_intros
-            simp: has_field_derivative_iff_has_vector_derivative [symmetric] F_def)
+            simp: has_real_derivative_iff_has_vector_derivative [symmetric] F_def)
     hence "(f n has_integral (F n - F a)) {a..n}"
       by (rule has_integral_eq [rotated]) (simp add: f_def)
     thus "(f n has_integral (F n - F a)) {a..}"
       by (rule has_integral_on_superset) (auto simp: f_def)
   qed
   have integral_f: "integral {a..} (f n) = (if n \<ge> a then F n - F a else 0)" for n :: nat
   proof (cases "n \<ge> a")
     case True
     with has_integral_f[OF this] show ?thesis by (simp add: integral_unique)
   next
     case False
     have "(f n has_integral 0) {a}" by (rule has_integral_refl)
     hence "(f n has_integral 0) {a..}"
       by (rule has_integral_on_superset) (insert False, simp_all add: f_def)
     with False show ?thesis by (simp add: integral_unique)
   qed
 
   have *: "(\<lambda>x. x powr e) integrable_on {a..} \<and>
            (\<lambda>n. integral {a..} (f n)) \<longlonglongrightarrow> integral {a..} (\<lambda>x. x powr e)"
   proof (intro monotone_convergence_increasing allI ballI)
     fix n :: nat
     from assms have "(\<lambda>x. x powr e) integrable_on {a..n}"
       by (auto intro!: integrable_continuous_real continuous_intros)
     hence "f n integrable_on {a..n}"
       by (rule integrable_eq) (auto simp: f_def)
     thus "f n integrable_on {a..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix n :: nat and x :: real
     show "f n x \<le> f (Suc n) x" by (auto simp: f_def)
   next
     fix x :: real assume x: "x \<in> {a..}"
     from filterlim_real_sequentially
       have "eventually (\<lambda>n. real n \<ge> x) at_top"
       by (simp add: filterlim_at_top)
     with x have "eventually (\<lambda>n. f n x = x powr e) at_top"
       by (auto elim!: eventually_mono simp: f_def)
     thus "(\<lambda>n. f n x) \<longlonglongrightarrow> x powr e" by (simp add: tendsto_eventually)
   next
     have "norm (integral {a..} (f n)) \<le> -F a" for n :: nat
     proof (cases "n \<ge> a")
       case True
       with assms have "a powr (e + 1) \<ge> n powr (e + 1)"
         by (intro powr_mono2') simp_all
       with assms show ?thesis by (auto simp: divide_simps F_def integral_f)
     qed (insert assms, simp add: integral_f F_def field_split_simps)
     thus "bounded (range(\<lambda>k. integral {a..} (f k)))"
       unfolding bounded_iff by (intro exI[of _ "-F a"]) auto
   qed
 
   from filterlim_real_sequentially
     have "eventually (\<lambda>n. real n \<ge> a) at_top"
     by (simp add: filterlim_at_top)
   hence "eventually (\<lambda>n. F n - F a = integral {a..} (f n)) at_top"
     by eventually_elim (simp add: integral_f)
   moreover have "(\<lambda>n. F n - F a) \<longlonglongrightarrow> 0 / (e + 1) - F a" unfolding F_def
     by (insert assms, (rule tendsto_intros filterlim_compose[OF tendsto_neg_powr]
           filterlim_ident filterlim_real_sequentially | simp)+)
   hence "(\<lambda>n. F n - F a) \<longlonglongrightarrow> -F a" by simp
   ultimately have "(\<lambda>n. integral {a..} (f n)) \<longlonglongrightarrow> -F a" by (blast intro: Lim_transform_eventually)
   from conjunct2[OF *] and this
     have "integral {a..} (\<lambda>x. x powr e) = -F a" by (rule LIMSEQ_unique)
   with conjunct1[OF *] show ?thesis
     by (simp add: has_integral_integral F_def)
 qed
 
 lemma has_integral_inverse_power_to_inf:
   fixes a :: real and n :: nat
   assumes "n > 1" "a > 0"
   shows   "((\<lambda>x. 1 / x ^ n) has_integral 1 / (real (n - 1) * a ^ (n - 1))) {a..}"
 proof -
   from assms have "real_of_int (-int n) < -1" by simp
   note has_integral_powr_to_inf[OF this \<open>a > 0\<close>]
   also have "- (a powr (real_of_int (- int n) + 1)) / (real_of_int (- int n) + 1) =
                  1 / (real (n - 1) * a powr (real (n - 1)))" using assms
     by (simp add: field_split_simps powr_add [symmetric] of_nat_diff)
   also from assms have "a powr (real (n - 1)) = a ^ (n - 1)"
     by (intro powr_realpow)
   finally show ?thesis
     by (rule has_integral_eq [rotated])
        (insert assms, simp_all add: powr_minus powr_realpow field_split_simps)
 qed
 
 subsubsection \<open>Adaption to ordered Euclidean spaces and the Cartesian Euclidean space\<close>
 
 lemma integral_component_eq_cart[simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> real^'m"
   assumes "f integrable_on s"
   shows "integral s (\<lambda>x. f x $ k) = integral s f $ k"
   using integral_linear[OF assms(1) bounded_linear_vec_nth,unfolded o_def] .
 
 lemma content_closed_interval:
   fixes a :: "'a::ordered_euclidean_space"
   assumes "a \<le> b"
   shows "content {a..b} = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   using content_cbox[of a b] assms by (simp add: cbox_interval eucl_le[where 'a='a])
 
 lemma integrable_const_ivl[intro]:
   fixes a::"'a::ordered_euclidean_space"
   shows "(\<lambda>x. c) integrable_on {a..b}"
   unfolding cbox_interval[symmetric] by (rule integrable_const)
 
 lemma integrable_on_subinterval:
   fixes f :: "'n::ordered_euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S" "{a..b} \<subseteq> S"
   shows "f integrable_on {a..b}"
   using integrable_on_subcbox[of f S a b] assms by (simp add: cbox_interval)
 
 end
diff --git a/src/HOL/Analysis/Infinite_Sum.thy b/src/HOL/Analysis/Infinite_Sum.thy
--- a/src/HOL/Analysis/Infinite_Sum.thy
+++ b/src/HOL/Analysis/Infinite_Sum.thy
@@ -1,2576 +1,2610 @@
 (*
   Title:    HOL/Analysis/Infinite_Sum.thy
   Author:   Dominique Unruh, University of Tartu
             Manuel Eberl, University of Innsbruck
 
   A theory of sums over possibly infinite sets.
 *)
 
 section \<open>Infinite sums\<close>
 \<^latex>\<open>\label{section:Infinite_Sum}\<close>
 
 text \<open>In this theory, we introduce the definition of infinite sums, i.e., sums ranging over an
 infinite, potentially uncountable index set with no particular ordering.
 (This is different from series. Those are sums indexed by natural numbers,
 and the order of the index set matters.)
 
 Our definition is quite standard: $s:=\sum_{x\in A} f(x)$ is the limit of finite sums $s_F:=\sum_{x\in F} f(x)$ for increasing $F$.
 That is, $s$ is the limit of the net $s_F$ where $F$ are finite subsets of $A$ ordered by inclusion.
 We believe that this is the standard definition for such sums.
 See, e.g., Definition 4.11 in \cite{conway2013course}.
 This definition is quite general: it is well-defined whenever $f$ takes values in some
 commutative monoid endowed with a Hausdorff topology.
 (Examples are reals, complex numbers, normed vector spaces, and more.)\<close>
 
 theory Infinite_Sum
   imports
     Elementary_Topology
     "HOL-Library.Extended_Nonnegative_Real"
     "HOL-Library.Complex_Order"
 begin
 
 subsection \<open>Definition and syntax\<close>
 
 definition has_sum :: \<open>('a \<Rightarrow> 'b :: {comm_monoid_add, topological_space}) \<Rightarrow> 'a set \<Rightarrow> 'b \<Rightarrow> bool\<close> where
   \<open>has_sum f A x \<longleftrightarrow> (sum f \<longlongrightarrow> x) (finite_subsets_at_top A)\<close>
 
 definition summable_on :: "('a \<Rightarrow> 'b::{comm_monoid_add, topological_space}) \<Rightarrow> 'a set \<Rightarrow> bool" (infixr "summable'_on" 46) where
   "f summable_on A \<longleftrightarrow> (\<exists>x. has_sum f A x)"
 
 definition infsum :: "('a \<Rightarrow> 'b::{comm_monoid_add,t2_space}) \<Rightarrow> 'a set \<Rightarrow> 'b" where
   "infsum f A = (if f summable_on A then Lim (finite_subsets_at_top A) (sum f) else 0)"
 
 abbreviation abs_summable_on :: "('a \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'a set \<Rightarrow> bool" (infixr "abs'_summable'_on" 46) where
   "f abs_summable_on A \<equiv> (\<lambda>x. norm (f x)) summable_on A"
 
 syntax (ASCII)
   "_infsum" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'b \<Rightarrow> 'b::topological_comm_monoid_add"  ("(3INFSUM (_/:_)./ _)" [0, 51, 10] 10)
 syntax
   "_infsum" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'b \<Rightarrow> 'b::topological_comm_monoid_add"  ("(2\<Sum>\<^sub>\<infinity>(_/\<in>_)./ _)" [0, 51, 10] 10)
 translations \<comment> \<open>Beware of argument permutation!\<close>
   "\<Sum>\<^sub>\<infinity>i\<in>A. b" \<rightleftharpoons> "CONST infsum (\<lambda>i. b) A"
 
 syntax (ASCII)
   "_univinfsum" :: "pttrn \<Rightarrow> 'a \<Rightarrow> 'a"  ("(3INFSUM _./ _)" [0, 10] 10)
 syntax
   "_univinfsum" :: "pttrn \<Rightarrow> 'a \<Rightarrow> 'a"  ("(2\<Sum>\<^sub>\<infinity>_./ _)" [0, 10] 10)
 translations
   "\<Sum>\<^sub>\<infinity>x. t" \<rightleftharpoons> "CONST infsum (\<lambda>x. t) (CONST UNIV)"
 
 syntax (ASCII)
   "_qinfsum" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a \<Rightarrow> 'a"  ("(3INFSUM _ |/ _./ _)" [0, 0, 10] 10)
 syntax
   "_qinfsum" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a \<Rightarrow> 'a"  ("(2\<Sum>\<^sub>\<infinity>_ | (_)./ _)" [0, 0, 10] 10)
 translations
   "\<Sum>\<^sub>\<infinity>x|P. t" => "CONST infsum (\<lambda>x. t) {x. P}"
 
 print_translation \<open>
 let
   fun sum_tr' [Abs (x, Tx, t), Const (@{const_syntax Collect}, _) $ Abs (y, Ty, P)] =
         if x <> y then raise Match
         else
           let
             val x' = Syntax_Trans.mark_bound_body (x, Tx);
             val t' = subst_bound (x', t);
             val P' = subst_bound (x', P);
           in
             Syntax.const @{syntax_const "_qinfsum"} $ Syntax_Trans.mark_bound_abs (x, Tx) $ P' $ t'
           end
     | sum_tr' _ = raise Match;
 in [(@{const_syntax infsum}, K sum_tr')] end
 \<close>
 
 subsection \<open>General properties\<close>
 
 lemma infsumI:
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>has_sum f A x\<close>
   shows \<open>infsum f A = x\<close>
   by (metis assms finite_subsets_at_top_neq_bot infsum_def summable_on_def has_sum_def tendsto_Lim)
 
 lemma infsum_eqI:
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>x = y\<close>
   assumes \<open>has_sum f A x\<close>
   assumes \<open>has_sum g B y\<close>
   shows \<open>infsum f A = infsum g B\<close>
   by (metis assms(1) assms(2) assms(3) finite_subsets_at_top_neq_bot infsum_def summable_on_def has_sum_def tendsto_Lim)
 
 lemma infsum_eqI':
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>\<And>x. has_sum f A x \<longleftrightarrow> has_sum g B x\<close>
   shows \<open>infsum f A = infsum g B\<close>
   by (metis assms infsum_def infsum_eqI summable_on_def)
 
 lemma infsum_not_exists:
   fixes f :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>\<not> f summable_on A\<close>
   shows \<open>infsum f A = 0\<close>
   by (simp add: assms infsum_def)
 
 lemma summable_iff_has_sum_infsum: "f summable_on A \<longleftrightarrow> has_sum f A (infsum f A)"
   using infsumI summable_on_def by blast
 
 lemma has_sum_infsum[simp]:
   assumes \<open>f summable_on S\<close>
   shows \<open>has_sum f S (infsum f S)\<close>
   using assms by (auto simp: summable_on_def infsum_def has_sum_def tendsto_Lim)
 
 lemma has_sum_cong_neutral:
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, topological_space}\<close>
   assumes \<open>\<And>x. x\<in>T-S \<Longrightarrow> g x = 0\<close>
   assumes \<open>\<And>x. x\<in>S-T \<Longrightarrow> f x = 0\<close>
   assumes \<open>\<And>x. x\<in>S\<inter>T \<Longrightarrow> f x = g x\<close>
   shows "has_sum f S x \<longleftrightarrow> has_sum g T x"
 proof -
   have \<open>eventually P (filtermap (sum f) (finite_subsets_at_top S))
       = eventually P (filtermap (sum g) (finite_subsets_at_top T))\<close> for P
   proof 
     assume \<open>eventually P (filtermap (sum f) (finite_subsets_at_top S))\<close>
     then obtain F0 where \<open>finite F0\<close> and \<open>F0 \<subseteq> S\<close> and F0_P: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> F \<supseteq> F0 \<Longrightarrow> P (sum f F)\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
     define F0' where \<open>F0' = F0 \<inter> T\<close>
     have [simp]: \<open>finite F0'\<close> \<open>F0' \<subseteq> T\<close>
       by (simp_all add: F0'_def \<open>finite F0\<close>)
     have \<open>P (sum g F)\<close> if \<open>finite F\<close> \<open>F \<subseteq> T\<close> \<open>F \<supseteq> F0'\<close> for F
     proof -
       have \<open>P (sum f ((F\<inter>S) \<union> (F0\<inter>S)))\<close>
         apply (rule F0_P)
         using \<open>F0 \<subseteq> S\<close>  \<open>finite F0\<close> that by auto
       also have \<open>sum f ((F\<inter>S) \<union> (F0\<inter>S)) = sum g F\<close>
         apply (rule sum.mono_neutral_cong)
         using that \<open>finite F0\<close> F0'_def assms by auto
       finally show ?thesis .
     qed
     with \<open>F0' \<subseteq> T\<close> \<open>finite F0'\<close> show \<open>eventually P (filtermap (sum g) (finite_subsets_at_top T))\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
   next
     assume \<open>eventually P (filtermap (sum g) (finite_subsets_at_top T))\<close>
     then obtain F0 where \<open>finite F0\<close> and \<open>F0 \<subseteq> T\<close> and F0_P: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> T \<Longrightarrow> F \<supseteq> F0 \<Longrightarrow> P (sum g F)\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
     define F0' where \<open>F0' = F0 \<inter> S\<close>
     have [simp]: \<open>finite F0'\<close> \<open>F0' \<subseteq> S\<close>
       by (simp_all add: F0'_def \<open>finite F0\<close>)
     have \<open>P (sum f F)\<close> if \<open>finite F\<close> \<open>F \<subseteq> S\<close> \<open>F \<supseteq> F0'\<close> for F
     proof -
       have \<open>P (sum g ((F\<inter>T) \<union> (F0\<inter>T)))\<close>
         apply (rule F0_P)
         using \<open>F0 \<subseteq> T\<close>  \<open>finite F0\<close> that by auto
       also have \<open>sum g ((F\<inter>T) \<union> (F0\<inter>T)) = sum f F\<close>
         apply (rule sum.mono_neutral_cong)
         using that \<open>finite F0\<close> F0'_def assms by auto
       finally show ?thesis .
     qed
     with \<open>F0' \<subseteq> S\<close> \<open>finite F0'\<close> show \<open>eventually P (filtermap (sum f) (finite_subsets_at_top S))\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
   qed
 
   then have tendsto_x: "(sum f \<longlongrightarrow> x) (finite_subsets_at_top S) \<longleftrightarrow> (sum g \<longlongrightarrow> x) (finite_subsets_at_top T)" for x
     by (simp add: le_filter_def filterlim_def)
 
   then show ?thesis
     by (simp add: has_sum_def)
 qed
 
 lemma summable_on_cong_neutral: 
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, topological_space}\<close>
   assumes \<open>\<And>x. x\<in>T-S \<Longrightarrow> g x = 0\<close>
   assumes \<open>\<And>x. x\<in>S-T \<Longrightarrow> f x = 0\<close>
   assumes \<open>\<And>x. x\<in>S\<inter>T \<Longrightarrow> f x = g x\<close>
   shows "f summable_on S \<longleftrightarrow> g summable_on T"
   using has_sum_cong_neutral[of T S g f, OF assms]
   by (simp add: summable_on_def)
 
 lemma infsum_cong_neutral: 
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>\<And>x. x\<in>T-S \<Longrightarrow> g x = 0\<close>
   assumes \<open>\<And>x. x\<in>S-T \<Longrightarrow> f x = 0\<close>
   assumes \<open>\<And>x. x\<in>S\<inter>T \<Longrightarrow> f x = g x\<close>
   shows \<open>infsum f S = infsum g T\<close>
   apply (rule infsum_eqI')
   using assms by (rule has_sum_cong_neutral)
 
 lemma has_sum_cong: 
   assumes "\<And>x. x\<in>A \<Longrightarrow> f x = g x"
   shows "has_sum f A x \<longleftrightarrow> has_sum g A x"
   using assms by (intro has_sum_cong_neutral) auto
 
 lemma summable_on_cong:
   assumes "\<And>x. x\<in>A \<Longrightarrow> f x = g x"
   shows "f summable_on A \<longleftrightarrow> g summable_on A"
   by (metis assms summable_on_def has_sum_cong)
 
 lemma infsum_cong:
   assumes "\<And>x. x\<in>A \<Longrightarrow> f x = g x"
   shows "infsum f A = infsum g A"
   using assms infsum_eqI' has_sum_cong by blast
 
 lemma summable_on_cofin_subset:
   fixes f :: "'a \<Rightarrow> 'b::topological_ab_group_add"
   assumes "f summable_on A" and [simp]: "finite F"
   shows "f summable_on (A - F)"
 proof -
   from assms(1) obtain x where lim_f: "(sum f \<longlongrightarrow> x) (finite_subsets_at_top A)"
     unfolding summable_on_def has_sum_def by auto
   define F' where "F' = F\<inter>A"
   with assms have "finite F'" and "A-F = A-F'"
     by auto
   have "filtermap ((\<union>)F') (finite_subsets_at_top (A-F))
       \<le> finite_subsets_at_top A"
   proof (rule filter_leI)
     fix P assume "eventually P (finite_subsets_at_top A)"
     then obtain X where [simp]: "finite X" and XA: "X \<subseteq> A" 
       and P: "\<forall>Y. finite Y \<and> X \<subseteq> Y \<and> Y \<subseteq> A \<longrightarrow> P Y"
       unfolding eventually_finite_subsets_at_top by auto
     define X' where "X' = X-F"
     hence [simp]: "finite X'" and [simp]: "X' \<subseteq> A-F"
       using XA by auto
     hence "finite Y \<and> X' \<subseteq> Y \<and> Y \<subseteq> A - F \<longrightarrow> P (F' \<union> Y)" for Y
       using P XA unfolding X'_def using F'_def \<open>finite F'\<close> by blast
     thus "eventually P (filtermap ((\<union>) F') (finite_subsets_at_top (A - F)))"
       unfolding eventually_filtermap eventually_finite_subsets_at_top
       by (rule_tac x=X' in exI, simp)
   qed
   with lim_f have "(sum f \<longlongrightarrow> x) (filtermap ((\<union>)F') (finite_subsets_at_top (A-F)))"
     using tendsto_mono by blast
   have "((\<lambda>G. sum f (F' \<union> G)) \<longlongrightarrow> x) (finite_subsets_at_top (A - F))"
     if "((sum f \<circ> (\<union>) F') \<longlongrightarrow> x) (finite_subsets_at_top (A - F))"
     using that unfolding o_def by auto
   hence "((\<lambda>G. sum f (F' \<union> G)) \<longlongrightarrow> x) (finite_subsets_at_top (A-F))"
     using tendsto_compose_filtermap [symmetric]
     by (simp add: \<open>(sum f \<longlongrightarrow> x) (filtermap ((\<union>) F') (finite_subsets_at_top (A - F)))\<close> 
         tendsto_compose_filtermap)
   have "\<forall>Y. finite Y \<and> Y \<subseteq> A - F \<longrightarrow> sum f (F' \<union> Y) = sum f F' + sum f Y"
     by (metis Diff_disjoint Int_Diff \<open>A - F = A - F'\<close> \<open>finite F'\<close> inf.orderE sum.union_disjoint)
   hence "\<forall>\<^sub>F x in finite_subsets_at_top (A - F). sum f (F' \<union> x) = sum f F' + sum f x"
     unfolding eventually_finite_subsets_at_top
     using exI [where x = "{}"]
     by (simp add: \<open>\<And>P. P {} \<Longrightarrow> \<exists>x. P x\<close>) 
   hence "((\<lambda>G. sum f F' + sum f G) \<longlongrightarrow> x) (finite_subsets_at_top (A-F))"
     using tendsto_cong [THEN iffD1 , rotated]
       \<open>((\<lambda>G. sum f (F' \<union> G)) \<longlongrightarrow> x) (finite_subsets_at_top (A - F))\<close> by fastforce
   hence "((\<lambda>G. sum f F' + sum f G) \<longlongrightarrow> sum f F' + (x-sum f F')) (finite_subsets_at_top (A-F))"
     by simp
   hence "(sum f \<longlongrightarrow> x - sum f F') (finite_subsets_at_top (A-F))"
     using tendsto_add_const_iff by blast    
   thus "f summable_on (A - F)"
     unfolding summable_on_def has_sum_def by auto
 qed
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add}"
   assumes \<open>has_sum f B b\<close> and \<open>has_sum f A a\<close> and AB: "A \<subseteq> B"
   shows has_sum_Diff: "has_sum f (B - A) (b - a)"
 proof -
   have finite_subsets1:
     "finite_subsets_at_top (B - A) \<le> filtermap (\<lambda>F. F - A) (finite_subsets_at_top B)"
   proof (rule filter_leI)
     fix P assume "eventually P (filtermap (\<lambda>F. F - A) (finite_subsets_at_top B))"
     then obtain X where "finite X" and "X \<subseteq> B" 
       and P: "finite Y \<and> X \<subseteq> Y \<and> Y \<subseteq> B \<longrightarrow> P (Y - A)" for Y
       unfolding eventually_filtermap eventually_finite_subsets_at_top by auto
 
     hence "finite (X-A)" and "X-A \<subseteq> B - A"
       by auto
     moreover have "finite Y \<and> X-A \<subseteq> Y \<and> Y \<subseteq> B - A \<longrightarrow> P Y" for Y
       using P[where Y="Y\<union>X"] \<open>finite X\<close> \<open>X \<subseteq> B\<close>
       by (metis Diff_subset Int_Diff Un_Diff finite_Un inf.orderE le_sup_iff sup.orderE sup_ge2)
     ultimately show "eventually P (finite_subsets_at_top (B - A))"
       unfolding eventually_finite_subsets_at_top by meson
   qed
   have finite_subsets2: 
     "filtermap (\<lambda>F. F \<inter> A) (finite_subsets_at_top B) \<le> finite_subsets_at_top A"
     apply (rule filter_leI)
       using assms unfolding eventually_filtermap eventually_finite_subsets_at_top
       by (metis Int_subset_iff finite_Int inf_le2 subset_trans)
 
   from assms(1) have limB: "(sum f \<longlongrightarrow> b) (finite_subsets_at_top B)"
     using has_sum_def by auto
   from assms(2) have limA: "(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)"
     using has_sum_def by blast
   have "((\<lambda>F. sum f (F\<inter>A)) \<longlongrightarrow> a) (finite_subsets_at_top B)"
   proof (subst asm_rl [of "(\<lambda>F. sum f (F\<inter>A)) = sum f o (\<lambda>F. F\<inter>A)"])
     show "(\<lambda>F. sum f (F \<inter> A)) = sum f \<circ> (\<lambda>F. F \<inter> A)"
       unfolding o_def by auto
     show "((sum f \<circ> (\<lambda>F. F \<inter> A)) \<longlongrightarrow> a) (finite_subsets_at_top B)"
       unfolding o_def 
       using tendsto_compose_filtermap finite_subsets2 limA tendsto_mono
         \<open>(\<lambda>F. sum f (F \<inter> A)) = sum f \<circ> (\<lambda>F. F \<inter> A)\<close> by fastforce
   qed
 
   with limB have "((\<lambda>F. sum f F - sum f (F\<inter>A)) \<longlongrightarrow> b - a) (finite_subsets_at_top B)"
     using tendsto_diff by blast
   have "sum f X - sum f (X \<inter> A) = sum f (X - A)" if "finite X" and "X \<subseteq> B" for X :: "'a set"
     using that by (metis add_diff_cancel_left' sum.Int_Diff)
   hence "\<forall>\<^sub>F x in finite_subsets_at_top B. sum f x - sum f (x \<inter> A) = sum f (x - A)"
     by (rule eventually_finite_subsets_at_top_weakI)  
   hence "((\<lambda>F. sum f (F-A)) \<longlongrightarrow> b - a) (finite_subsets_at_top B)"
     using tendsto_cong [THEN iffD1 , rotated]
       \<open>((\<lambda>F. sum f F - sum f (F \<inter> A)) \<longlongrightarrow> b - a) (finite_subsets_at_top B)\<close> by fastforce
   hence "(sum f \<longlongrightarrow> b - a) (filtermap (\<lambda>F. F-A) (finite_subsets_at_top B))"
     by (subst tendsto_compose_filtermap[symmetric], simp add: o_def)
   hence limBA: "(sum f \<longlongrightarrow> b - a) (finite_subsets_at_top (B-A))"
     apply (rule tendsto_mono[rotated])
     by (rule finite_subsets1)
   thus ?thesis
     by (simp add: has_sum_def)
 qed
 
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add}"
   assumes "f summable_on B" and "f summable_on A" and "A \<subseteq> B"
   shows summable_on_Diff: "f summable_on (B-A)"
   by (meson assms summable_on_def has_sum_Diff)
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add,t2_space}"
   assumes "f summable_on B" and "f summable_on A" and AB: "A \<subseteq> B"
   shows infsum_Diff: "infsum f (B - A) = infsum f B - infsum f A"
   by (metis AB assms has_sum_Diff infsumI summable_on_def)
 
 lemma has_sum_mono_neutral:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   (* Does this really require a linorder topology? (Instead of order topology.) *)
   assumes \<open>has_sum f A a\<close> and "has_sum g B b"
   assumes \<open>\<And>x. x \<in> A\<inter>B \<Longrightarrow> f x \<le> g x\<close>
   assumes \<open>\<And>x. x \<in> A-B \<Longrightarrow> f x \<le> 0\<close>
   assumes \<open>\<And>x. x \<in> B-A \<Longrightarrow> g x \<ge> 0\<close>
   shows "a \<le> b"
 proof -
   define f' g' where \<open>f' x = (if x \<in> A then f x else 0)\<close> and \<open>g' x = (if x \<in> B then g x else 0)\<close> for x
   have [simp]: \<open>f summable_on A\<close> \<open>g summable_on B\<close>
     using assms(1,2) summable_on_def by auto
   have \<open>has_sum f' (A\<union>B) a\<close>
     apply (subst has_sum_cong_neutral[where g=f and T=A])
     by (auto simp: f'_def assms(1))
   then have f'_lim: \<open>(sum f' \<longlongrightarrow> a) (finite_subsets_at_top (A\<union>B))\<close>
     by (meson has_sum_def)
   have \<open>has_sum g' (A\<union>B) b\<close>
     apply (subst has_sum_cong_neutral[where g=g and T=B])
     by (auto simp: g'_def assms(2))
   then have g'_lim: \<open>(sum g' \<longlongrightarrow> b) (finite_subsets_at_top (A\<union>B))\<close>
     using has_sum_def by blast
 
   have *: \<open>\<forall>\<^sub>F x in finite_subsets_at_top (A \<union> B). sum f' x \<le> sum g' x\<close>
     apply (rule eventually_finite_subsets_at_top_weakI)
     apply (rule sum_mono)
     using assms by (auto simp: f'_def g'_def)
   show ?thesis
     apply (rule tendsto_le)
     using * g'_lim f'_lim by auto
 qed
 
 lemma infsum_mono_neutral:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" and "g summable_on B"
   assumes \<open>\<And>x. x \<in> A\<inter>B \<Longrightarrow> f x \<le> g x\<close>
   assumes \<open>\<And>x. x \<in> A-B \<Longrightarrow> f x \<le> 0\<close>
   assumes \<open>\<And>x. x \<in> B-A \<Longrightarrow> g x \<ge> 0\<close>
   shows "infsum f A \<le> infsum g B"
   by (rule has_sum_mono_neutral[of f A _ g B _]) (use assms in \<open>auto intro: has_sum_infsum\<close>)
 
 lemma has_sum_mono:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f A x" and "has_sum g A y"
   assumes \<open>\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x\<close>
   shows "x \<le> y"
   apply (rule has_sum_mono_neutral)
   using assms by auto
 
 lemma infsum_mono:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" and "g summable_on A"
   assumes \<open>\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x\<close>
   shows "infsum f A \<le> infsum g A"
   apply (rule infsum_mono_neutral)
   using assms by auto
 
 lemma has_sum_finite[simp]:
   assumes "finite F"
   shows "has_sum f F (sum f F)"
   using assms
   by (auto intro: tendsto_Lim simp: finite_subsets_at_top_finite infsum_def has_sum_def principal_eq_bot_iff)
 
 lemma summable_on_finite[simp]:
   fixes f :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add,topological_space}\<close>
   assumes "finite F"
   shows "f summable_on F"
   using assms summable_on_def has_sum_finite by blast
 
 lemma infsum_finite[simp]:
   assumes "finite F"
   shows "infsum f F = sum f F"
   using assms by (auto intro: tendsto_Lim simp: finite_subsets_at_top_finite infsum_def principal_eq_bot_iff)
 
 lemma has_sum_finite_approximation:
   fixes f :: "'a \<Rightarrow> 'b::{comm_monoid_add,metric_space}"
   assumes "has_sum f A x" and "\<epsilon> > 0"
   shows "\<exists>F. finite F \<and> F \<subseteq> A \<and> dist (sum f F) x \<le> \<epsilon>"
 proof -
   have "(sum f \<longlongrightarrow> x) (finite_subsets_at_top A)"
     by (meson assms(1) has_sum_def)
   hence *: "\<forall>\<^sub>F F in (finite_subsets_at_top A). dist (sum f F) x < \<epsilon>"
     using assms(2) by (rule tendstoD)
   thus ?thesis
     unfolding eventually_finite_subsets_at_top by fastforce
 qed
 
 lemma infsum_finite_approximation:
   fixes f :: "'a \<Rightarrow> 'b::{comm_monoid_add,metric_space}"
   assumes "f summable_on A" and "\<epsilon> > 0"
   shows "\<exists>F. finite F \<and> F \<subseteq> A \<and> dist (sum f F) (infsum f A) \<le> \<epsilon>"
 proof -
   from assms have "has_sum f A (infsum f A)"
     by (simp add: summable_iff_has_sum_infsum)
   from this and \<open>\<epsilon> > 0\<close> show ?thesis
     by (rule has_sum_finite_approximation)
 qed
 
 lemma abs_summable_summable:
   fixes f :: \<open>'a \<Rightarrow> 'b :: banach\<close>
   assumes \<open>f abs_summable_on A\<close>
   shows \<open>f summable_on A\<close>
 proof -
   from assms obtain L where lim: \<open>(sum (\<lambda>x. norm (f x)) \<longlongrightarrow> L) (finite_subsets_at_top A)\<close>
     unfolding has_sum_def summable_on_def by blast
   then have *: \<open>cauchy_filter (filtermap (sum (\<lambda>x. norm (f x))) (finite_subsets_at_top A))\<close>
     by (auto intro!: nhds_imp_cauchy_filter simp: filterlim_def)
   have \<open>\<exists>P. eventually P (finite_subsets_at_top A) \<and>
               (\<forall>F F'. P F \<and> P F' \<longrightarrow> dist (sum f F) (sum f F') < e)\<close> if \<open>e>0\<close> for e
   proof -
     define d P where \<open>d = e/4\<close> and \<open>P F \<longleftrightarrow> finite F \<and> F \<subseteq> A \<and> dist (sum (\<lambda>x. norm (f x)) F) L < d\<close> for F
     then have \<open>d > 0\<close>
       by (simp add: d_def that)
     have ev_P: \<open>eventually P (finite_subsets_at_top A)\<close>
       using lim
       by (auto simp add: P_def[abs_def] \<open>0 < d\<close> eventually_conj_iff eventually_finite_subsets_at_top_weakI tendsto_iff)
     
     moreover have \<open>dist (sum f F1) (sum f F2) < e\<close> if \<open>P F1\<close> and \<open>P F2\<close> for F1 F2
     proof -
       from ev_P
       obtain F' where \<open>finite F'\<close> and \<open>F' \<subseteq> A\<close> and P_sup_F': \<open>finite F \<and> F \<supseteq> F' \<and> F \<subseteq> A \<Longrightarrow> P F\<close> for F
         by atomize_elim (simp add: eventually_finite_subsets_at_top)
       define F where \<open>F = F' \<union> F1 \<union> F2\<close>
       have \<open>finite F\<close> and \<open>F \<subseteq> A\<close>
         using F_def P_def[abs_def] that \<open>finite F'\<close> \<open>F' \<subseteq> A\<close> by auto
       have dist_F: \<open>dist (sum (\<lambda>x. norm (f x)) F) L < d\<close>
         by (metis F_def \<open>F \<subseteq> A\<close> P_def P_sup_F' \<open>finite F\<close> le_supE order_refl)
 
       have dist_F_subset: \<open>dist (sum f F) (sum f F') < 2*d\<close> if F': \<open>F' \<subseteq> F\<close> \<open>P F'\<close> for F'
       proof -
         have \<open>dist (sum f F) (sum f F') = norm (sum f (F-F'))\<close>
           unfolding dist_norm using \<open>finite F\<close> F' by (subst sum_diff) auto
         also have \<open>\<dots> \<le> norm (\<Sum>x\<in>F-F'. norm (f x))\<close>
           by (rule order.trans[OF sum_norm_le[OF order.refl]]) auto
         also have \<open>\<dots> = dist (\<Sum>x\<in>F. norm (f x)) (\<Sum>x\<in>F'. norm (f x))\<close>
           unfolding dist_norm using \<open>finite F\<close> F' by (subst sum_diff) auto
         also have \<open>\<dots> < 2 * d\<close>
           using dist_F F' unfolding P_def dist_norm real_norm_def by linarith
         finally show \<open>dist (sum f F) (sum f F') < 2*d\<close> .
       qed
 
       have \<open>dist (sum f F1) (sum f F2) \<le> dist (sum f F) (sum f F1) + dist (sum f F) (sum f F2)\<close>
         by (rule dist_triangle3)
       also have \<open>\<dots> < 2 * d + 2 * d\<close>
         by (intro add_strict_mono dist_F_subset that) (auto simp: F_def)
       also have \<open>\<dots> \<le> e\<close>
         by (auto simp: d_def)
       finally show \<open>dist (sum f F1) (sum f F2) < e\<close> .
     qed
     then show ?thesis
       using ev_P by blast
   qed
   then have \<open>cauchy_filter (filtermap (sum f) (finite_subsets_at_top A))\<close>
     by (simp add: cauchy_filter_metric_filtermap)
   then obtain L' where \<open>(sum f \<longlongrightarrow> L') (finite_subsets_at_top A)\<close>
     apply atomize_elim unfolding filterlim_def
     apply (rule complete_uniform[where S=UNIV, simplified, THEN iffD1, rule_format])
       apply (auto simp add: filtermap_bot_iff)
     by (meson Cauchy_convergent UNIV_I complete_def convergent_def)
   then show ?thesis
     using summable_on_def has_sum_def by blast
 qed
 
 text \<open>The converse of @{thm [source] abs_summable_summable} does not hold:
   Consider the Hilbert space of square-summable sequences.
   Let $e_i$ denote the sequence with 1 in the $i$th position and 0 elsewhere.
   Let $f(i) := e_i/i$ for $i\geq1$. We have \<^term>\<open>\<not> f abs_summable_on UNIV\<close> because $\lVert f(i)\rVert=1/i$
   and thus the sum over $\lVert f(i)\rVert$ diverges. On the other hand, we have \<^term>\<open>f summable_on UNIV\<close>;
   the limit is the sequence with $1/i$ in the $i$th position.
 
   (We have not formalized this separating example here because to the best of our knowledge,
   this Hilbert space has not been formalized in Isabelle/HOL yet.)\<close>
 
 lemma norm_has_sum_bound:
   fixes f :: "'b \<Rightarrow> 'a::real_normed_vector"
     and A :: "'b set"
   assumes "has_sum (\<lambda>x. norm (f x)) A n"
   assumes "has_sum f A a"
   shows "norm a \<le> n"
 proof -
   have "norm a \<le> n + \<epsilon>" if "\<epsilon>>0" for \<epsilon>
   proof-
     have "\<exists>F. norm (a - sum f F) \<le> \<epsilon> \<and> finite F \<and> F \<subseteq> A"
       using has_sum_finite_approximation[where A=A and f=f and \<epsilon>="\<epsilon>"] assms \<open>0 < \<epsilon>\<close>
       by (metis dist_commute dist_norm)
     then obtain F where "norm (a - sum f F) \<le> \<epsilon>"
       and "finite F" and "F \<subseteq> A"
       by (simp add: atomize_elim)
     hence "norm a \<le> norm (sum f F) + \<epsilon>"
       by (metis add.commute diff_add_cancel dual_order.refl norm_triangle_mono)
     also have "\<dots> \<le> sum (\<lambda>x. norm (f x)) F + \<epsilon>"
       using norm_sum by auto
     also have "\<dots> \<le> n + \<epsilon>"
       apply (rule add_right_mono)
       apply (rule has_sum_mono_neutral[where A=F and B=A and f=\<open>\<lambda>x. norm (f x)\<close> and g=\<open>\<lambda>x. norm (f x)\<close>])
       using \<open>finite F\<close> \<open>F \<subseteq> A\<close> assms by auto
     finally show ?thesis 
       by assumption
   qed
   thus ?thesis
     using linordered_field_class.field_le_epsilon by blast
 qed
 
 lemma norm_infsum_bound:
   fixes f :: "'b \<Rightarrow> 'a::real_normed_vector"
     and A :: "'b set"
   assumes "f abs_summable_on A"
   shows "norm (infsum f A) \<le> infsum (\<lambda>x. norm (f x)) A"
 proof (cases "f summable_on A")
   case True
   show ?thesis
     apply (rule norm_has_sum_bound[where A=A and f=f and a=\<open>infsum f A\<close> and n=\<open>infsum (\<lambda>x. norm (f x)) A\<close>])
     using assms True
     by (metis finite_subsets_at_top_neq_bot infsum_def summable_on_def has_sum_def tendsto_Lim)+
 next
   case False
   obtain t where t_def: "(sum (\<lambda>x. norm (f x)) \<longlongrightarrow> t) (finite_subsets_at_top A)"
     using assms unfolding summable_on_def has_sum_def by blast
   have sumpos: "sum (\<lambda>x. norm (f x)) X \<ge> 0"
     for X
     by (simp add: sum_nonneg)
   have tgeq0:"t \<ge> 0"
   proof(rule ccontr)
     define S::"real set" where "S = {s. s < 0}"
     assume "\<not> 0 \<le> t"
     hence "t < 0" by simp
     hence "t \<in> S"
       unfolding S_def by blast
     moreover have "open S"
     proof-
       have "closed {s::real. s \<ge> 0}"
         using Elementary_Topology.closed_sequential_limits[where S = "{s::real. s \<ge> 0}"]
         by (metis Lim_bounded2 mem_Collect_eq)
       moreover have "{s::real. s \<ge> 0} = UNIV - S"
         unfolding S_def by auto
       ultimately have "closed (UNIV - S)"
         by simp
       thus ?thesis
         by (simp add: Compl_eq_Diff_UNIV open_closed) 
     qed
     ultimately have "\<forall>\<^sub>F X in finite_subsets_at_top A. (\<Sum>x\<in>X. norm (f x)) \<in> S"
       using t_def unfolding tendsto_def by blast
     hence "\<exists>X. (\<Sum>x\<in>X. norm (f x)) \<in> S"
       by (metis (no_types, lifting) eventually_mono filterlim_iff finite_subsets_at_top_neq_bot tendsto_Lim)
     then obtain X where "(\<Sum>x\<in>X. norm (f x)) \<in> S"
       by blast
     hence "(\<Sum>x\<in>X. norm (f x)) < 0"
       unfolding S_def by auto      
     thus False by (simp add: leD sumpos)
   qed
   have "\<exists>!h. (sum (\<lambda>x. norm (f x)) \<longlongrightarrow> h) (finite_subsets_at_top A)"
     using t_def finite_subsets_at_top_neq_bot tendsto_unique by blast
   hence "t = (Topological_Spaces.Lim (finite_subsets_at_top A) (sum (\<lambda>x. norm (f x))))"
     using t_def unfolding Topological_Spaces.Lim_def
     by (metis the_equality)     
   hence "Lim (finite_subsets_at_top A) (sum (\<lambda>x. norm (f x))) \<ge> 0"
     using tgeq0 by blast
   thus ?thesis unfolding infsum_def 
     using False by auto
 qed
 
 lemma infsum_tendsto:
   assumes \<open>f summable_on S\<close>
   shows \<open>((\<lambda>F. sum f F) \<longlongrightarrow> infsum f S) (finite_subsets_at_top S)\<close>
   using assms by (simp flip: has_sum_def)
 
 
 lemma has_sum_0: 
   assumes \<open>\<And>x. x\<in>M \<Longrightarrow> f x = 0\<close>
   shows \<open>has_sum f M 0\<close>
   unfolding has_sum_def
   apply (subst tendsto_cong[where g=\<open>\<lambda>_. 0\<close>])
    apply (rule eventually_finite_subsets_at_top_weakI)
   using assms by (auto simp add: subset_iff)
 
 lemma summable_on_0:
   assumes \<open>\<And>x. x\<in>M \<Longrightarrow> f x = 0\<close>
   shows \<open>f summable_on M\<close>
   using assms summable_on_def has_sum_0 by blast
 
 lemma infsum_0:
   assumes \<open>\<And>x. x\<in>M \<Longrightarrow> f x = 0\<close>
   shows \<open>infsum f M = 0\<close>
   by (metis assms finite_subsets_at_top_neq_bot infsum_def has_sum_0 has_sum_def tendsto_Lim)
 
 text \<open>Variants of @{thm [source] infsum_0} etc. suitable as simp-rules\<close>
 lemma infsum_0_simp[simp]: \<open>infsum (\<lambda>_. 0) M = 0\<close>
   by (simp_all add: infsum_0)
 lemma summable_on_0_simp[simp]: \<open>(\<lambda>_. 0) summable_on M\<close>
   by (simp_all add: summable_on_0)
 lemma has_sum_0_simp[simp]: \<open>has_sum (\<lambda>_. 0) M 0\<close>
   by (simp_all add: has_sum_0)
 
 
 lemma has_sum_add:
   fixes f g :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add}"
   assumes \<open>has_sum f A a\<close>
   assumes \<open>has_sum g A b\<close>
   shows \<open>has_sum (\<lambda>x. f x + g x) A (a + b)\<close>
 proof -
   from assms have lim_f: \<open>(sum f \<longlongrightarrow> a)  (finite_subsets_at_top A)\<close>
     and lim_g: \<open>(sum g \<longlongrightarrow> b)  (finite_subsets_at_top A)\<close>
     by (simp_all add: has_sum_def)
   then have lim: \<open>(sum (\<lambda>x. f x + g x) \<longlongrightarrow> a + b) (finite_subsets_at_top A)\<close>
     unfolding sum.distrib by (rule tendsto_add)
   then show ?thesis
     by (simp_all add: has_sum_def)
 qed
 
 lemma summable_on_add:
   fixes f g :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add}"
   assumes \<open>f summable_on A\<close>
   assumes \<open>g summable_on A\<close>
   shows \<open>(\<lambda>x. f x + g x) summable_on A\<close>
   by (metis (full_types) assms(1) assms(2) summable_on_def has_sum_add)
 
 lemma infsum_add:
   fixes f g :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add, t2_space}"
   assumes \<open>f summable_on A\<close>
   assumes \<open>g summable_on A\<close>
   shows \<open>infsum (\<lambda>x. f x + g x) A = infsum f A + infsum g A\<close>
 proof -
   have \<open>has_sum (\<lambda>x. f x + g x) A (infsum f A + infsum g A)\<close>
     by (simp add: assms(1) assms(2) has_sum_add)
   then show ?thesis
     using infsumI by blast
 qed
 
 
 lemma has_sum_Un_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes "has_sum f A a"
   assumes "has_sum f B b"
   assumes disj: "A \<inter> B = {}"
   shows \<open>has_sum f (A \<union> B) (a + b)\<close>
 proof -
   define fA fB where \<open>fA x = (if x \<in> A then f x else 0)\<close>
     and \<open>fB x = (if x \<notin> A then f x else 0)\<close> for x
   have fA: \<open>has_sum fA (A \<union> B) a\<close>
     apply (subst has_sum_cong_neutral[where T=A and g=f])
     using assms by (auto simp: fA_def)
   have fB: \<open>has_sum fB (A \<union> B) b\<close>
     apply (subst has_sum_cong_neutral[where T=B and g=f])
     using assms by (auto simp: fB_def)
   have fAB: \<open>f x = fA x + fB x\<close> for x
     unfolding fA_def fB_def by simp
   show ?thesis
     unfolding fAB
     using fA fB by (rule has_sum_add)
 qed
 
 lemma summable_on_Un_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes "f summable_on A"
   assumes "f summable_on B"
   assumes disj: "A \<inter> B = {}"
   shows \<open>f summable_on (A \<union> B)\<close>
   by (meson assms(1) assms(2) disj summable_on_def has_sum_Un_disjoint)
 
 lemma infsum_Un_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add, t2_space}"
   assumes "f summable_on A"
   assumes "f summable_on B"
   assumes disj: "A \<inter> B = {}"
   shows \<open>infsum f (A \<union> B) = infsum f A + infsum f B\<close>
   by (intro infsumI has_sum_Un_disjoint has_sum_infsum assms)  
 
-(* TODO move *)
-lemma (in uniform_space) cauchy_filter_complete_converges:
-  assumes "cauchy_filter F" "complete A" "F \<le> principal A" "F \<noteq> bot"
-  shows   "\<exists>c. F \<le> nhds c"
-  using assms unfolding complete_uniform by blast
+lemma norm_summable_imp_has_sum:
+  fixes f :: "nat \<Rightarrow> 'a :: banach"
+  assumes "summable (\<lambda>n. norm (f n))" and "f sums S"
+  shows   "has_sum f (UNIV :: nat set) S"
+  unfolding has_sum_def tendsto_iff eventually_finite_subsets_at_top
+proof (safe, goal_cases)
+  case (1 \<epsilon>)
+  from assms(1) obtain S' where S': "(\<lambda>n. norm (f n)) sums S'"
+    by (auto simp: summable_def)
+  with 1 obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> \<bar>S' - (\<Sum>i<n. norm (f i))\<bar> < \<epsilon>"
+    by (auto simp: tendsto_iff eventually_at_top_linorder sums_def dist_norm abs_minus_commute)
+  
+  show ?case
+  proof (rule exI[of _ "{..<N}"], safe, goal_cases)
+    case (2 Y)
+    from 2 have "(\<lambda>n. if n \<in> Y then 0 else f n) sums (S - sum f Y)"
+      by (intro sums_If_finite_set'[OF \<open>f sums S\<close>]) (auto simp: sum_negf)
+    hence "S - sum f Y = (\<Sum>n. if n \<in> Y then 0 else f n)"
+      by (simp add: sums_iff)
+    also have "norm \<dots> \<le> (\<Sum>n. norm (if n \<in> Y then 0 else f n))"
+      by (rule summable_norm[OF summable_comparison_test'[OF assms(1)]]) auto
+    also have "\<dots> \<le> (\<Sum>n. if n < N then 0 else norm (f n))"
+      using 2 by (intro suminf_le summable_comparison_test'[OF assms(1)]) auto
+    also have "(\<lambda>n. if n \<in> {..<N} then 0 else norm (f n)) sums (S' - (\<Sum>i<N. norm (f i)))" 
+      by (intro sums_If_finite_set'[OF S']) (auto simp: sum_negf)
+    hence "(\<Sum>n. if n < N then 0 else norm (f n)) = S' - (\<Sum>i<N. norm (f i))"
+      by (simp add: sums_iff)
+    also have "S' - (\<Sum>i<N. norm (f i)) \<le> \<bar>S' - (\<Sum>i<N. norm (f i))\<bar>" by simp
+    also have "\<dots> < \<epsilon>" by (rule N) auto
+    finally show ?case by (simp add: dist_norm norm_minus_commute)
+  qed auto
+qed
+
+lemma norm_summable_imp_summable_on:
+  fixes f :: "nat \<Rightarrow> 'a :: banach"
+  assumes "summable (\<lambda>n. norm (f n))"
+  shows   "f summable_on UNIV"
+  using norm_summable_imp_has_sum[OF assms, of "suminf f"] assms
+  by (auto simp: sums_iff summable_on_def dest: summable_norm_cancel)
 
 text \<open>The following lemma indeed needs a complete space (as formalized by the premise \<^term>\<open>complete UNIV\<close>).
   The following two counterexamples show this:
   \begin{itemize}
   \item Consider the real vector space $V$ of sequences with finite support, and with the $\ell_2$-norm (sum of squares).
       Let $e_i$ denote the sequence with a $1$ at position $i$.
       Let $f : \mathbb Z \to V$ be defined as $f(n) := e_{\lvert n\rvert} / n$ (with $f(0) := 0$).
       We have that $\sum_{n\in\mathbb Z} f(n) = 0$ (it even converges absolutely). 
       But $\sum_{n\in\mathbb N} f(n)$ does not exist (it would converge against a sequence with infinite support).
   
   \item Let $f$ be a positive rational valued function such that $\sum_{x\in B} f(x)$ is $\sqrt 2$ and $\sum_{x\in A} f(x)$ is 1 (over the reals, with $A\subseteq B$).
       Then $\sum_{x\in B} f(x)$ does not exist over the rationals. But $\sum_{x\in A} f(x)$ exists.
   \end{itemize}
 
   The lemma also requires uniform continuity of the addition. And example of a topological group with continuous 
   but not uniformly continuous addition would be the positive reals with the usual multiplication as the addition.
   We do not know whether the lemma would also hold for such topological groups.\<close>
 
 lemma summable_on_subset:
   fixes A B and f :: \<open>'a \<Rightarrow> 'b::{ab_group_add, uniform_space}\<close>
   assumes \<open>complete (UNIV :: 'b set)\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'b,y). x+y)\<close>
   assumes \<open>f summable_on A\<close>
   assumes \<open>B \<subseteq> A\<close>
   shows \<open>f summable_on B\<close>
 proof -
   let ?filter_fB = \<open>filtermap (sum f) (finite_subsets_at_top B)\<close>
   from \<open>f summable_on A\<close>
   obtain S where \<open>(sum f \<longlongrightarrow> S) (finite_subsets_at_top A)\<close> (is \<open>(sum f \<longlongrightarrow> S) ?filter_A\<close>)
     using summable_on_def has_sum_def by blast
   then have cauchy_fA: \<open>cauchy_filter (filtermap (sum f) (finite_subsets_at_top A))\<close> (is \<open>cauchy_filter ?filter_fA\<close>)
     by (auto intro!: nhds_imp_cauchy_filter simp: filterlim_def)
 
   have \<open>cauchy_filter (filtermap (sum f) (finite_subsets_at_top B))\<close>
   proof (unfold cauchy_filter_def, rule filter_leI)
     fix E :: \<open>('b\<times>'b) \<Rightarrow> bool\<close> assume \<open>eventually E uniformity\<close>
     then obtain E' where \<open>eventually E' uniformity\<close> and E'E'E: \<open>E' (x, y) \<longrightarrow> E' (y, z) \<longrightarrow> E (x, z)\<close> for x y z
       using uniformity_trans by blast
     obtain D where \<open>eventually D uniformity\<close> and DE: \<open>D (x, y) \<Longrightarrow> E' (x+c, y+c)\<close> for x y c
       using plus_cont \<open>eventually E' uniformity\<close>
       unfolding uniformly_continuous_on_uniformity filterlim_def le_filter_def uniformity_prod_def
       by (auto simp: case_prod_beta eventually_filtermap eventually_prod_same uniformity_refl)
     have DE': "E' (x, y)" if "D (x + c, y + c)" for x y c
       using DE[of "x + c" "y + c" "-c"] that by simp
 
     from \<open>eventually D uniformity\<close> and cauchy_fA have \<open>eventually D (?filter_fA \<times>\<^sub>F ?filter_fA)\<close>
       unfolding cauchy_filter_def le_filter_def by simp
     then obtain P1 P2
       where ev_P1: \<open>eventually (\<lambda>F. P1 (sum f F)) ?filter_A\<close> 
         and ev_P2: \<open>eventually (\<lambda>F. P2 (sum f F)) ?filter_A\<close>
         and P1P2E: \<open>P1 x \<Longrightarrow> P2 y \<Longrightarrow> D (x, y)\<close> for x y
       unfolding eventually_prod_filter eventually_filtermap
       by auto
     from ev_P1 obtain F1 where F1: \<open>finite F1\<close> \<open>F1 \<subseteq> A\<close> \<open>\<And>F. F\<supseteq>F1 \<Longrightarrow> finite F \<Longrightarrow> F\<subseteq>A \<Longrightarrow> P1 (sum f F)\<close>
       by (metis eventually_finite_subsets_at_top)
     from ev_P2 obtain F2 where F2: \<open>finite F2\<close> \<open>F2 \<subseteq> A\<close> \<open>\<And>F. F\<supseteq>F2 \<Longrightarrow> finite F \<Longrightarrow> F\<subseteq>A \<Longrightarrow> P2 (sum f F)\<close>
       by (metis eventually_finite_subsets_at_top)
     define F0 F0A F0B where \<open>F0 \<equiv> F1 \<union> F2\<close> and \<open>F0A \<equiv> F0 - B\<close> and \<open>F0B \<equiv> F0 \<inter> B\<close>
     have [simp]: \<open>finite F0\<close>  \<open>F0 \<subseteq> A\<close>
       using \<open>F1 \<subseteq> A\<close> \<open>F2 \<subseteq> A\<close> \<open>finite F1\<close> \<open>finite F2\<close> unfolding F0_def by blast+
  
     have *: "E' (sum f F1', sum f F2')"
       if "F1'\<supseteq>F0B" "F2'\<supseteq>F0B" "finite F1'" "finite F2'" "F1'\<subseteq>B" "F2'\<subseteq>B" for F1' F2'
     proof (intro DE'[where c = "sum f F0A"] P1P2E)
       have "P1 (sum f (F1' \<union> F0A))"
         using that assms F1(1,2) F2(1,2) by (intro F1) (auto simp: F0A_def F0B_def F0_def)
       thus "P1 (sum f F1' + sum f F0A)"
         by (subst (asm) sum.union_disjoint) (use that in \<open>auto simp: F0A_def\<close>)
     next
       have "P2 (sum f (F2' \<union> F0A))"
         using that assms F1(1,2) F2(1,2) by (intro F2) (auto simp: F0A_def F0B_def F0_def)
       thus "P2 (sum f F2' + sum f F0A)"
         by (subst (asm) sum.union_disjoint) (use that in \<open>auto simp: F0A_def\<close>)      
     qed
 
     show \<open>eventually E (?filter_fB \<times>\<^sub>F ?filter_fB)\<close>
       unfolding eventually_prod_filter
     proof (safe intro!: exI)
       show "eventually (\<lambda>x. E' (x, sum f F0B)) (filtermap (sum f) (finite_subsets_at_top B))"
        and "eventually (\<lambda>x. E' (sum f F0B, x)) (filtermap (sum f) (finite_subsets_at_top B))"
         unfolding eventually_filtermap eventually_finite_subsets_at_top
         by (rule exI[of _ F0B]; use * in \<open>force simp: F0B_def\<close>)+
     next
       show "E (x, y)" if "E' (x, sum f F0B)" and "E' (sum f F0B, y)" for x y
         using E'E'E that by blast
     qed
   qed
 
   then obtain x where \<open>?filter_fB \<le> nhds x\<close>
     using cauchy_filter_complete_converges[of ?filter_fB UNIV] \<open>complete (UNIV :: _)\<close>
     by (auto simp: filtermap_bot_iff)
   then have \<open>(sum f \<longlongrightarrow> x) (finite_subsets_at_top B)\<close>
     by (auto simp: filterlim_def)
   then show ?thesis
     by (auto simp: summable_on_def has_sum_def)
 qed
 
 text \<open>A special case of @{thm [source] summable_on_subset} for Banach spaces with less premises.\<close>
 
 lemma summable_on_subset_banach:
   fixes A B and f :: \<open>'a \<Rightarrow> 'b::banach\<close>
   assumes \<open>f summable_on A\<close>
   assumes \<open>B \<subseteq> A\<close>
   shows \<open>f summable_on B\<close>
   by (rule summable_on_subset[OF _ _ assms])
      (auto simp: complete_def convergent_def dest!: Cauchy_convergent)
 
 lemma has_sum_empty[simp]: \<open>has_sum f {} 0\<close>
   by (meson ex_in_conv has_sum_0)
 
 lemma summable_on_empty[simp]: \<open>f summable_on {}\<close>
   by auto
 
 lemma infsum_empty[simp]: \<open>infsum f {} = 0\<close>
   by simp
 
 lemma sum_has_sum:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes finite: \<open>finite A\<close>
   assumes conv: \<open>\<And>a. a \<in> A \<Longrightarrow> has_sum f (B a) (s a)\<close>
   assumes disj: \<open>\<And>a a'. a\<in>A \<Longrightarrow> a'\<in>A \<Longrightarrow> a\<noteq>a' \<Longrightarrow> B a \<inter> B a' = {}\<close>
   shows \<open>has_sum f (\<Union>a\<in>A. B a) (sum s A)\<close>
   using assms
 proof (insert finite conv disj, induction)
   case empty
   then show ?case 
     by simp
 next
   case (insert x A)
   have \<open>has_sum f (B x) (s x)\<close>
     by (simp add: insert.prems)
   moreover have IH: \<open>has_sum f (\<Union>a\<in>A. B a) (sum s A)\<close>
     using insert by simp
   ultimately have \<open>has_sum f (B x \<union> (\<Union>a\<in>A. B a)) (s x + sum s A)\<close>
     apply (rule has_sum_Un_disjoint)
     using insert by auto
   then show ?case
     using insert.hyps by auto
 qed
 
 
 lemma summable_on_finite_union_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes finite: \<open>finite A\<close>
   assumes conv: \<open>\<And>a. a \<in> A \<Longrightarrow> f summable_on (B a)\<close>
   assumes disj: \<open>\<And>a a'. a\<in>A \<Longrightarrow> a'\<in>A \<Longrightarrow> a\<noteq>a' \<Longrightarrow> B a \<inter> B a' = {}\<close>
   shows \<open>f summable_on (\<Union>a\<in>A. B a)\<close>
   using finite conv disj apply induction by (auto intro!: summable_on_Un_disjoint)
 
 lemma sum_infsum:
   fixes f :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add, t2_space}"
   assumes finite: \<open>finite A\<close>
   assumes conv: \<open>\<And>a. a \<in> A \<Longrightarrow> f summable_on (B a)\<close>
   assumes disj: \<open>\<And>a a'. a\<in>A \<Longrightarrow> a'\<in>A \<Longrightarrow> a\<noteq>a' \<Longrightarrow> B a \<inter> B a' = {}\<close>
   shows \<open>sum (\<lambda>a. infsum f (B a)) A = infsum f (\<Union>a\<in>A. B a)\<close>
   by (rule sym, rule infsumI)
      (use sum_has_sum[of A f B \<open>\<lambda>a. infsum f (B a)\<close>] assms in auto)
 
 text \<open>The lemmas \<open>infsum_comm_additive_general\<close> and \<open>infsum_comm_additive\<close> (and variants) below both state that the infinite sum commutes with
   a continuous additive function. \<open>infsum_comm_additive_general\<close> is stated more for more general type classes
   at the expense of a somewhat less compact formulation of the premises.
   E.g., by avoiding the constant \<^const>\<open>additive\<close> which introduces an additional sort constraint
   (group instead of monoid). For example, extended reals (\<^typ>\<open>ereal\<close>, \<^typ>\<open>ennreal\<close>) are not covered
   by \<open>infsum_comm_additive\<close>.\<close>
 
 
 lemma has_sum_comm_additive_general: 
   fixes f :: \<open>'b :: {comm_monoid_add,topological_space} \<Rightarrow> 'c :: {comm_monoid_add,topological_space}\<close>
   assumes f_sum: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> sum (f o g) F = f (sum g F)\<close>
       \<comment> \<open>Not using \<^const>\<open>additive\<close> because it would add sort constraint \<^class>\<open>ab_group_add\<close>\<close>
   assumes cont: \<open>f \<midarrow>x\<rightarrow> f x\<close>
     \<comment> \<open>For \<^class>\<open>t2_space\<close>, this is equivalent to \<open>isCont f x\<close> by @{thm [source] isCont_def}.\<close>
   assumes infsum: \<open>has_sum g S x\<close>
   shows \<open>has_sum (f o g) S (f x)\<close> 
 proof -
   have \<open>(sum g \<longlongrightarrow> x) (finite_subsets_at_top S)\<close>
     using infsum has_sum_def by blast
   then have \<open>((f o sum g) \<longlongrightarrow> f x) (finite_subsets_at_top S)\<close>
     apply (rule tendsto_compose_at)
     using assms by auto
   then have \<open>(sum (f o g) \<longlongrightarrow> f x) (finite_subsets_at_top S)\<close>
     apply (rule tendsto_cong[THEN iffD1, rotated])
     using f_sum by fastforce
   then show \<open>has_sum (f o g) S (f x)\<close>
     using has_sum_def by blast 
 qed
 
 lemma summable_on_comm_additive_general:
   fixes f :: \<open>'b :: {comm_monoid_add,topological_space} \<Rightarrow> 'c :: {comm_monoid_add,topological_space}\<close>
   assumes \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> sum (f o g) F = f (sum g F)\<close>
     \<comment> \<open>Not using \<^const>\<open>additive\<close> because it would add sort constraint \<^class>\<open>ab_group_add\<close>\<close>
   assumes \<open>\<And>x. has_sum g S x \<Longrightarrow> f \<midarrow>x\<rightarrow> f x\<close>
     \<comment> \<open>For \<^class>\<open>t2_space\<close>, this is equivalent to \<open>isCont f x\<close> by @{thm [source] isCont_def}.\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>(f o g) summable_on S\<close>
   by (meson assms summable_on_def has_sum_comm_additive_general has_sum_def infsum_tendsto)
 
 lemma infsum_comm_additive_general:
   fixes f :: \<open>'b :: {comm_monoid_add,t2_space} \<Rightarrow> 'c :: {comm_monoid_add,t2_space}\<close>
   assumes f_sum: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> sum (f o g) F = f (sum g F)\<close>
       \<comment> \<open>Not using \<^const>\<open>additive\<close> because it would add sort constraint \<^class>\<open>ab_group_add\<close>\<close>
   assumes \<open>isCont f (infsum g S)\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>infsum (f o g) S = f (infsum g S)\<close>
   using assms
   by (intro infsumI has_sum_comm_additive_general has_sum_infsum) (auto simp: isCont_def)
 
 lemma has_sum_comm_additive: 
   fixes f :: \<open>'b :: {ab_group_add,topological_space} \<Rightarrow> 'c :: {ab_group_add,topological_space}\<close>
   assumes \<open>additive f\<close>
   assumes \<open>f \<midarrow>x\<rightarrow> f x\<close>
     \<comment> \<open>For \<^class>\<open>t2_space\<close>, this is equivalent to \<open>isCont f x\<close> by @{thm [source] isCont_def}.\<close>
   assumes infsum: \<open>has_sum g S x\<close>
   shows \<open>has_sum (f o g) S (f x)\<close>
   using assms
   by (intro has_sum_comm_additive_general has_sum_infsum) (auto simp: isCont_def additive.sum) 
 
 lemma summable_on_comm_additive:
   fixes f :: \<open>'b :: {ab_group_add,t2_space} \<Rightarrow> 'c :: {ab_group_add,topological_space}\<close>
   assumes \<open>additive f\<close>
   assumes \<open>isCont f (infsum g S)\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>(f o g) summable_on S\<close>
   by (meson assms(1) assms(2) assms(3) summable_on_def has_sum_comm_additive has_sum_infsum isContD)
 
 lemma infsum_comm_additive:
   fixes f :: \<open>'b :: {ab_group_add,t2_space} \<Rightarrow> 'c :: {ab_group_add,t2_space}\<close>
   assumes \<open>additive f\<close>
   assumes \<open>isCont f (infsum g S)\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>infsum (f o g) S = f (infsum g S)\<close>
   by (rule infsum_comm_additive_general; auto simp: assms additive.sum)
 
 lemma nonneg_bdd_above_has_sum:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {conditionally_complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   assumes \<open>bdd_above (sum f ` {F. F\<subseteq>A \<and> finite F})\<close>
   shows \<open>has_sum f A (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
 proof -
   have \<open>(sum f \<longlongrightarrow> (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)) (finite_subsets_at_top A)\<close>
   proof (rule order_tendstoI)
     fix a assume \<open>a < (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
     then obtain F where \<open>a < sum f F\<close> and \<open>finite F\<close> and \<open>F \<subseteq> A\<close>
       by (metis (mono_tags, lifting) Collect_cong Collect_empty_eq assms(2) empty_subsetI finite.emptyI less_cSUP_iff mem_Collect_eq)
     show \<open>\<forall>\<^sub>F x in finite_subsets_at_top A. a < sum f x\<close>
       unfolding eventually_finite_subsets_at_top
     proof (rule exI[of _ F], safe)
       fix Y assume Y: "finite Y" "F \<subseteq> Y" "Y \<subseteq> A"
       have "a < sum f F"
         by fact
       also have "\<dots> \<le> sum f Y"
         using assms Y by (intro sum_mono2) auto
       finally show "a < sum f Y" .
     qed (use \<open>finite F\<close> \<open>F \<subseteq> A\<close> in auto)
   next
     fix a assume *: \<open>(SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F) < a\<close>
     have \<open>sum f F < a\<close> if \<open>F\<subseteq>A\<close> and \<open>finite F\<close> for F
     proof -
       have "sum f F \<le> (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)"
         by (rule cSUP_upper) (use that assms(2) in \<open>auto simp: conj_commute\<close>)
       also have "\<dots> < a"
         by fact
       finally show ?thesis .
     qed
     then show \<open>\<forall>\<^sub>F x in finite_subsets_at_top A. sum f x < a\<close>
       by (rule eventually_finite_subsets_at_top_weakI)
   qed
   then show ?thesis
     using has_sum_def by blast
 qed
 
 lemma nonneg_bdd_above_summable_on:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {conditionally_complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   assumes \<open>bdd_above (sum f ` {F. F\<subseteq>A \<and> finite F})\<close>
   shows \<open>f summable_on A\<close>
   using assms(1) assms(2) summable_on_def nonneg_bdd_above_has_sum by blast
 
 lemma nonneg_bdd_above_infsum:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {conditionally_complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   assumes \<open>bdd_above (sum f ` {F. F\<subseteq>A \<and> finite F})\<close>
   shows \<open>infsum f A = (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
   using assms by (auto intro!: infsumI nonneg_bdd_above_has_sum)
 
 lemma nonneg_has_sum_complete:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   shows \<open>has_sum f A (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
   using assms nonneg_bdd_above_has_sum by blast
 
 lemma nonneg_summable_on_complete:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   shows \<open>f summable_on A\<close>
   using assms nonneg_bdd_above_summable_on by blast
 
 lemma nonneg_infsum_complete:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   shows \<open>infsum f A = (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
   using assms nonneg_bdd_above_infsum by blast
 
 lemma has_sum_nonneg:
   fixes f :: "'a \<Rightarrow> 'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f M a"
     and "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "a \<ge> 0"
   by (metis (no_types, lifting) DiffD1 assms(1) assms(2) empty_iff has_sum_0 has_sum_mono_neutral order_refl)
 
 lemma infsum_nonneg:
   fixes f :: "'a \<Rightarrow> 'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "infsum f M \<ge> 0" (is "?lhs \<ge> _")
   apply (cases \<open>f summable_on M\<close>)
    apply (metis assms infsum_0_simp summable_on_0_simp infsum_mono)
   using assms by (auto simp add: infsum_not_exists)
 
 lemma has_sum_mono2:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f A S" "has_sum f B S'" "A \<subseteq> B"
   assumes "\<And>x. x \<in> B - A \<Longrightarrow> f x \<ge> 0"
   shows   "S \<le> S'"
 proof -
   have "has_sum f (B - A) (S' - S)"
     by (rule has_sum_Diff) fact+
   hence "S' - S \<ge> 0"
     by (rule has_sum_nonneg) (use assms(4) in auto)
   thus ?thesis
     by (metis add_0 add_mono_thms_linordered_semiring(3) diff_add_cancel)
 qed
 
 lemma infsum_mono2:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" "f summable_on B" "A \<subseteq> B"
   assumes "\<And>x. x \<in> B - A \<Longrightarrow> f x \<ge> 0"
   shows   "infsum f A \<le> infsum f B"
   by (rule has_sum_mono2[OF has_sum_infsum has_sum_infsum]) (use assms in auto)
 
 lemma finite_sum_le_has_sum:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f A S" "finite B" "B \<subseteq> A"
   assumes "\<And>x. x \<in> A - B \<Longrightarrow> f x \<ge> 0"
   shows   "sum f B \<le> S"
 proof (rule has_sum_mono2)
   show "has_sum f A S"
     by fact
   show "has_sum f B (sum f B)"
     by (rule has_sum_finite) fact+
 qed (use assms in auto)
 
 lemma finite_sum_le_infsum:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" "finite B" "B \<subseteq> A"
   assumes "\<And>x. x \<in> A - B \<Longrightarrow> f x \<ge> 0"
   shows   "sum f B \<le> infsum f A"
   by (rule finite_sum_le_has_sum[OF has_sum_infsum]) (use assms in auto)
 
 lemma has_sum_reindex:
   assumes \<open>inj_on h A\<close>
   shows \<open>has_sum g (h ` A) x \<longleftrightarrow> has_sum (g \<circ> h) A x\<close>
 proof -
   have \<open>has_sum g (h ` A) x \<longleftrightarrow> (sum g \<longlongrightarrow> x) (finite_subsets_at_top (h ` A))\<close>
     by (simp add: has_sum_def)
   also have \<open>\<dots> \<longleftrightarrow> ((\<lambda>F. sum g (h ` F)) \<longlongrightarrow> x) (finite_subsets_at_top A)\<close>
     apply (subst filtermap_image_finite_subsets_at_top[symmetric])
     using assms by (auto simp: filterlim_def filtermap_filtermap)
   also have \<open>\<dots> \<longleftrightarrow> (sum (g \<circ> h) \<longlongrightarrow> x) (finite_subsets_at_top A)\<close>
     apply (rule tendsto_cong)
     apply (rule eventually_finite_subsets_at_top_weakI)
     apply (rule sum.reindex)
     using assms subset_inj_on by blast
   also have \<open>\<dots> \<longleftrightarrow> has_sum (g \<circ> h) A x\<close>
     by (simp add: has_sum_def)
   finally show ?thesis .
 qed
 
 lemma summable_on_reindex:
   assumes \<open>inj_on h A\<close>
   shows \<open>g summable_on (h ` A) \<longleftrightarrow> (g \<circ> h) summable_on A\<close>
   by (simp add: assms summable_on_def has_sum_reindex)
 
 lemma infsum_reindex:
   assumes \<open>inj_on h A\<close>
   shows \<open>infsum g (h ` A) = infsum (g \<circ> h) A\<close>
   by (metis (no_types, opaque_lifting) assms finite_subsets_at_top_neq_bot infsum_def 
         summable_on_reindex has_sum_def has_sum_infsum has_sum_reindex tendsto_Lim)
 
 lemma summable_on_reindex_bij_betw:
   assumes "bij_betw g A B"
   shows   "(\<lambda>x. f (g x)) summable_on A \<longleftrightarrow> f summable_on B"
 proof -
   thm summable_on_reindex
   have \<open>(\<lambda>x. f (g x)) summable_on A \<longleftrightarrow> f summable_on g ` A\<close>
     apply (rule summable_on_reindex[symmetric, unfolded o_def])
     using assms bij_betw_imp_inj_on by blast
   also have \<open>\<dots> \<longleftrightarrow> f summable_on B\<close>
     using assms bij_betw_imp_surj_on by blast
   finally show ?thesis .
 qed
 
 lemma infsum_reindex_bij_betw:
   assumes "bij_betw g A B"
   shows   "infsum (\<lambda>x. f (g x)) A = infsum f B"
 proof -
   have \<open>infsum (\<lambda>x. f (g x)) A = infsum f (g ` A)\<close>
     by (metis (mono_tags, lifting) assms bij_betw_imp_inj_on infsum_cong infsum_reindex o_def)
   also have \<open>\<dots> = infsum f B\<close>
     using assms bij_betw_imp_surj_on by blast
   finally show ?thesis .
 qed
 
 lemma sum_uniformity:
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'b::{uniform_space,comm_monoid_add},y). x+y)\<close>
   assumes \<open>eventually E uniformity\<close>
   obtains D where \<open>eventually D uniformity\<close> 
     and \<open>\<And>M::'a set. \<And>f f' :: 'a \<Rightarrow> 'b. card M \<le> n \<and> (\<forall>m\<in>M. D (f m, f' m)) \<Longrightarrow> E (sum f M, sum f' M)\<close>
 proof (atomize_elim, insert \<open>eventually E uniformity\<close>, induction n arbitrary: E rule:nat_induct)
   case 0
   then show ?case
     by (metis card_eq_0_iff equals0D le_zero_eq sum.infinite sum.not_neutral_contains_not_neutral uniformity_refl)
 next
   case (Suc n)
   from plus_cont[unfolded uniformly_continuous_on_uniformity filterlim_def le_filter_def, rule_format, OF Suc.prems]
   obtain D1 D2 where \<open>eventually D1 uniformity\<close> and \<open>eventually D2 uniformity\<close> 
     and D1D2E: \<open>D1 (x, y) \<Longrightarrow> D2 (x', y') \<Longrightarrow> E (x + x', y + y')\<close> for x y x' y'
     apply atomize_elim
     by (auto simp: eventually_prod_filter case_prod_beta uniformity_prod_def eventually_filtermap)
 
   from Suc.IH[OF \<open>eventually D2 uniformity\<close>]
   obtain D3 where \<open>eventually D3 uniformity\<close> and D3: \<open>card M \<le> n \<Longrightarrow> (\<forall>m\<in>M. D3 (f m, f' m)) \<Longrightarrow> D2 (sum f M, sum f' M)\<close> 
     for M :: \<open>'a set\<close> and f f'
     by metis
 
   define D where \<open>D x \<equiv> D1 x \<and> D3 x\<close> for x
   have \<open>eventually D uniformity\<close>
     using D_def \<open>eventually D1 uniformity\<close> \<open>eventually D3 uniformity\<close> eventually_elim2 by blast
 
   have \<open>E (sum f M, sum f' M)\<close> 
     if \<open>card M \<le> Suc n\<close> and DM: \<open>\<forall>m\<in>M. D (f m, f' m)\<close>
     for M :: \<open>'a set\<close> and f f'
   proof (cases \<open>card M = 0\<close>)
     case True
     then show ?thesis
       by (metis Suc.prems card_eq_0_iff sum.empty sum.infinite uniformity_refl) 
   next
     case False
     with \<open>card M \<le> Suc n\<close> obtain N x where \<open>card N \<le> n\<close> and \<open>x \<notin> N\<close> and \<open>M = insert x N\<close>
       by (metis card_Suc_eq less_Suc_eq_0_disj less_Suc_eq_le)
 
     from DM have \<open>\<And>m. m\<in>N \<Longrightarrow> D (f m, f' m)\<close>
       using \<open>M = insert x N\<close> by blast
     with D3[OF \<open>card N \<le> n\<close>]
     have D2_N: \<open>D2 (sum f N, sum f' N)\<close>
       using D_def by blast
 
     from DM 
     have \<open>D (f x, f' x)\<close>
       using \<open>M = insert x N\<close> by blast
     then have \<open>D1 (f x, f' x)\<close>
       by (simp add: D_def)
 
     with D2_N
     have \<open>E (f x + sum f N, f' x + sum f' N)\<close>
       using D1D2E by presburger
 
     then show \<open>E (sum f M, sum f' M)\<close>
       by (metis False \<open>M = insert x N\<close> \<open>x \<notin> N\<close> card.infinite finite_insert sum.insert)
   qed
   with \<open>eventually D uniformity\<close>
   show ?case 
     by auto
 qed
 
 lemma has_sum_Sigma:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<times> 'b \<Rightarrow> 'c::{comm_monoid_add,uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "has_sum f (Sigma A B) a"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> has_sum (\<lambda>y. f (x, y)) (B x) (b x)\<close>
   shows "has_sum b A a"
 proof -
   define F FB FA where \<open>F = finite_subsets_at_top (Sigma A B)\<close> and \<open>FB x = finite_subsets_at_top (B x)\<close>
     and \<open>FA = finite_subsets_at_top A\<close> for x
 
   from summableB
   have sum_b: \<open>(sum (\<lambda>y. f (x, y)) \<longlongrightarrow> b x) (FB x)\<close> if \<open>x \<in> A\<close> for x
     using FB_def[abs_def] has_sum_def that by auto
   from summableAB
   have sum_S: \<open>(sum f \<longlongrightarrow> a) F\<close>
     using F_def has_sum_def by blast
 
   have finite_proj: \<open>finite {b| b. (a,b) \<in> H}\<close> if \<open>finite H\<close> for H :: \<open>('a\<times>'b) set\<close> and a
     apply (subst asm_rl[of \<open>{b| b. (a,b) \<in> H} = snd ` {ab. ab \<in> H \<and> fst ab = a}\<close>])
     by (auto simp: image_iff that)
 
   have \<open>(sum b \<longlongrightarrow> a) FA\<close>
   proof (rule tendsto_iff_uniformity[THEN iffD2, rule_format])
     fix E :: \<open>('c \<times> 'c) \<Rightarrow> bool\<close>
     assume \<open>eventually E uniformity\<close>
     then obtain D where D_uni: \<open>eventually D uniformity\<close> and DDE': \<open>\<And>x y z. D (x, y) \<Longrightarrow> D (y, z) \<Longrightarrow> E (x, z)\<close>
       by (metis (no_types, lifting) \<open>eventually E uniformity\<close> uniformity_transE)
     from sum_S obtain G where \<open>finite G\<close> and \<open>G \<subseteq> Sigma A B\<close>
       and G_sum: \<open>G \<subseteq> H \<Longrightarrow> H \<subseteq> Sigma A B \<Longrightarrow> finite H \<Longrightarrow> D (sum f H, a)\<close> for H
       unfolding tendsto_iff_uniformity
       by (metis (mono_tags, lifting) D_uni F_def eventually_finite_subsets_at_top)
     have \<open>finite (fst ` G)\<close> and \<open>fst ` G \<subseteq> A\<close>
       using \<open>finite G\<close> \<open>G \<subseteq> Sigma A B\<close> by auto
     thm uniformity_prod_def
     define Ga where \<open>Ga a = {b. (a,b) \<in> G}\<close> for a
     have Ga_fin: \<open>finite (Ga a)\<close> and Ga_B: \<open>Ga a \<subseteq> B a\<close> for a
       using \<open>finite G\<close> \<open>G \<subseteq> Sigma A B\<close> finite_proj by (auto simp: Ga_def finite_proj)
 
     have \<open>E (sum b M, a)\<close> if \<open>M \<supseteq> fst ` G\<close> and \<open>finite M\<close> and \<open>M \<subseteq> A\<close> for M
     proof -
       define FMB where \<open>FMB = finite_subsets_at_top (Sigma M B)\<close>
       have \<open>eventually (\<lambda>H. D (\<Sum>a\<in>M. b a, \<Sum>(a,b)\<in>H. f (a,b))) FMB\<close>
       proof -
         obtain D' where D'_uni: \<open>eventually D' uniformity\<close> 
           and \<open>card M' \<le> card M \<and> (\<forall>m\<in>M'. D' (g m, g' m)) \<Longrightarrow> D (sum g M', sum g' M')\<close>
             for M' :: \<open>'a set\<close> and g g'
           apply (rule sum_uniformity[OF plus_cont \<open>eventually D uniformity\<close>, where n=\<open>card M\<close>])
           by auto
         then have D'_sum_D: \<open>(\<forall>m\<in>M. D' (g m, g' m)) \<Longrightarrow> D (sum g M, sum g' M)\<close> for g g'
           by auto
 
         obtain Ha where \<open>Ha a \<supseteq> Ga a\<close> and Ha_fin: \<open>finite (Ha a)\<close> and Ha_B: \<open>Ha a \<subseteq> B a\<close>
           and D'_sum_Ha: \<open>Ha a \<subseteq> L \<Longrightarrow> L \<subseteq> B a \<Longrightarrow> finite L \<Longrightarrow> D' (b a, sum (\<lambda>b. f (a,b)) L)\<close> if \<open>a \<in> A\<close> for a L
         proof -
           from sum_b[unfolded tendsto_iff_uniformity, rule_format, OF _ D'_uni[THEN uniformity_sym]]
           obtain Ha0 where \<open>finite (Ha0 a)\<close> and \<open>Ha0 a \<subseteq> B a\<close>
             and \<open>Ha0 a \<subseteq> L \<Longrightarrow> L \<subseteq> B a \<Longrightarrow> finite L \<Longrightarrow> D' (b a, sum (\<lambda>b. f (a,b)) L)\<close> if \<open>a \<in> A\<close> for a L
             unfolding FB_def eventually_finite_subsets_at_top unfolding prod.case by metis
           moreover define Ha where \<open>Ha a = Ha0 a \<union> Ga a\<close> for a
           ultimately show ?thesis
             using that[where Ha=Ha]
             using Ga_fin Ga_B by auto
         qed
 
         have \<open>D (\<Sum>a\<in>M. b a, \<Sum>(a,b)\<in>H. f (a,b))\<close> if \<open>finite H\<close> and \<open>H \<subseteq> Sigma M B\<close> and \<open>H \<supseteq> Sigma M Ha\<close> for H
         proof -
           define Ha' where \<open>Ha' a = {b| b. (a,b) \<in> H}\<close> for a
           have [simp]: \<open>finite (Ha' a)\<close> and [simp]: \<open>Ha' a \<supseteq> Ha a\<close> and [simp]: \<open>Ha' a \<subseteq> B a\<close> if \<open>a \<in> M\<close> for a
             unfolding Ha'_def using \<open>finite H\<close> \<open>H \<subseteq> Sigma M B\<close> \<open>Sigma M Ha \<subseteq> H\<close> that finite_proj by auto
           have \<open>Sigma M Ha' = H\<close>
             using that by (auto simp: Ha'_def)
           then have *: \<open>(\<Sum>(a,b)\<in>H. f (a,b)) = (\<Sum>a\<in>M. \<Sum>b\<in>Ha' a. f (a,b))\<close>
             apply (subst sum.Sigma)
             using \<open>finite M\<close> by auto
           have \<open>D' (b a, sum (\<lambda>b. f (a,b)) (Ha' a))\<close> if \<open>a \<in> M\<close> for a
             apply (rule D'_sum_Ha)
             using that \<open>M \<subseteq> A\<close> by auto
           then have \<open>D (\<Sum>a\<in>M. b a, \<Sum>a\<in>M. sum (\<lambda>b. f (a,b)) (Ha' a))\<close>
             by (rule_tac D'_sum_D, auto)
           with * show ?thesis
             by auto
         qed
         moreover have \<open>Sigma M Ha \<subseteq> Sigma M B\<close>
           using Ha_B \<open>M \<subseteq> A\<close> by auto
         ultimately show ?thesis
           unfolding FMB_def eventually_finite_subsets_at_top
           by (intro exI[of _ "Sigma M Ha"])
              (use Ha_fin that(2,3) in \<open>fastforce intro!: finite_SigmaI\<close>)
       qed
       moreover have \<open>eventually (\<lambda>H. D (\<Sum>(a,b)\<in>H. f (a,b), a)) FMB\<close>
         unfolding FMB_def eventually_finite_subsets_at_top
       proof (rule exI[of _ G], safe)
         fix Y assume Y: "finite Y" "G \<subseteq> Y" "Y \<subseteq> Sigma M B"
         have "Y \<subseteq> Sigma A B"
           using Y \<open>M \<subseteq> A\<close> by blast
         thus "D (\<Sum>(a,b)\<in>Y. f (a, b), a)"
           using G_sum[of Y] Y by auto
       qed (use \<open>finite G\<close> \<open>G \<subseteq> Sigma A B\<close> that in auto)
       ultimately have \<open>\<forall>\<^sub>F x in FMB. E (sum b M, a)\<close>
         by eventually_elim (use DDE' in auto)
       then show \<open>E (sum b M, a)\<close>
         by (rule eventually_const[THEN iffD1, rotated]) (force simp: FMB_def)
     qed
     then show \<open>\<forall>\<^sub>F x in FA. E (sum b x, a)\<close>
       using \<open>finite (fst ` G)\<close> and \<open>fst ` G \<subseteq> A\<close>
       by (auto intro!: exI[of _ \<open>fst ` G\<close>] simp add: FA_def eventually_finite_subsets_at_top)
   qed
   then show ?thesis
     by (simp add: FA_def has_sum_def)
 qed
 
 lemma summable_on_Sigma:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<Rightarrow> 'b \<Rightarrow> 'c::{comm_monoid_add, t2_space, uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "(\<lambda>(x,y). f x y) summable_on (Sigma A B)"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> (f x) summable_on (B x)\<close>
   shows \<open>(\<lambda>x. infsum (f x) (B x)) summable_on A\<close>
 proof -
   from summableAB obtain a where a: \<open>has_sum (\<lambda>(x,y). f x y) (Sigma A B) a\<close>
     using has_sum_infsum by blast
   from summableB have b: \<open>\<And>x. x\<in>A \<Longrightarrow> has_sum (f x) (B x) (infsum (f x) (B x))\<close>
     by (auto intro!: has_sum_infsum)
   show ?thesis
     using plus_cont a b 
     by (auto intro: has_sum_Sigma[where f=\<open>\<lambda>(x,y). f x y\<close>, simplified] simp: summable_on_def)
 qed
 
 lemma infsum_Sigma:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<times> 'b \<Rightarrow> 'c::{comm_monoid_add, t2_space, uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "f summable_on (Sigma A B)"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> (\<lambda>y. f (x, y)) summable_on (B x)\<close>
   shows "infsum f (Sigma A B) = infsum (\<lambda>x. infsum (\<lambda>y. f (x, y)) (B x)) A"
 proof -
   from summableAB have a: \<open>has_sum f (Sigma A B) (infsum f (Sigma A B))\<close>
     using has_sum_infsum by blast
   from summableB have b: \<open>\<And>x. x\<in>A \<Longrightarrow> has_sum (\<lambda>y. f (x, y)) (B x) (infsum (\<lambda>y. f (x, y)) (B x))\<close>
     by (auto intro!: has_sum_infsum)
   show ?thesis
     using plus_cont a b by (auto intro: infsumI[symmetric] has_sum_Sigma simp: summable_on_def)
 qed
 
 lemma infsum_Sigma':
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<Rightarrow> 'b \<Rightarrow> 'c::{comm_monoid_add, t2_space, uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "(\<lambda>(x,y). f x y) summable_on (Sigma A B)"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> (f x) summable_on (B x)\<close>
   shows \<open>infsum (\<lambda>x. infsum (f x) (B x)) A = infsum (\<lambda>(x,y). f x y) (Sigma A B)\<close>
   using infsum_Sigma[of \<open>\<lambda>(x,y). f x y\<close> A B]
   using assms by auto
 
 text \<open>A special case of @{thm [source] infsum_Sigma} etc. for Banach spaces. It has less premises.\<close>
 lemma
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<Rightarrow> 'b \<Rightarrow> 'c::banach\<close>
   assumes [simp]: "(\<lambda>(x,y). f x y) summable_on (Sigma A B)"
   shows infsum_Sigma'_banach: \<open>infsum (\<lambda>x. infsum (f x) (B x)) A = infsum (\<lambda>(x,y). f x y) (Sigma A B)\<close> (is ?thesis1)
     and summable_on_Sigma_banach: \<open>(\<lambda>x. infsum (f x) (B x)) summable_on A\<close> (is ?thesis2)
 proof -
   have [simp]: \<open>(f x) summable_on (B x)\<close> if \<open>x \<in> A\<close> for x
   proof -
     from assms
     have \<open>(\<lambda>(x,y). f x y) summable_on (Pair x ` B x)\<close>
       by (meson image_subset_iff summable_on_subset_banach mem_Sigma_iff that)
     then have \<open>((\<lambda>(x,y). f x y) o Pair x) summable_on (B x)\<close>
       apply (rule_tac summable_on_reindex[THEN iffD1])
       by (simp add: inj_on_def)
     then show ?thesis
       by (auto simp: o_def)
   qed
   show ?thesis1
     apply (rule infsum_Sigma')
     by auto
   show ?thesis2
     apply (rule summable_on_Sigma)
     by auto
 qed
 
 lemma infsum_Sigma_banach:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<times> 'b \<Rightarrow> 'c::banach\<close>
   assumes [simp]: "f summable_on (Sigma A B)"
   shows \<open>infsum (\<lambda>x. infsum (\<lambda>y. f (x,y)) (B x)) A = infsum f (Sigma A B)\<close>
   using assms
   by (subst infsum_Sigma'_banach) auto
 
 lemma infsum_swap:
   fixes A :: "'a set" and B :: "'b set"
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c::{comm_monoid_add,t2_space,uniform_space}"
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes \<open>(\<lambda>(x, y). f x y) summable_on (A \<times> B)\<close>
   assumes \<open>\<And>a. a\<in>A \<Longrightarrow> (f a) summable_on B\<close>
   assumes \<open>\<And>b. b\<in>B \<Longrightarrow> (\<lambda>a. f a b) summable_on A\<close>
   shows \<open>infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B\<close>
 proof -
   have [simp]: \<open>(\<lambda>(x, y). f y x) summable_on (B \<times> A)\<close>
     apply (subst product_swap[symmetric])
     apply (subst summable_on_reindex)
     using assms by (auto simp: o_def)
   have \<open>infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>(x,y). f x y) (A \<times> B)\<close>
     apply (subst infsum_Sigma)
     using assms by auto
   also have \<open>\<dots> = infsum (\<lambda>(x,y). f y x) (B \<times> A)\<close>
     apply (subst product_swap[symmetric])
     apply (subst infsum_reindex)
     using assms by (auto simp: o_def)
   also have \<open>\<dots> = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B\<close>
     apply (subst infsum_Sigma)
     using assms by auto
   finally show ?thesis .
 qed
 
 lemma infsum_swap_banach:
   fixes A :: "'a set" and B :: "'b set"
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c::banach"
   assumes \<open>(\<lambda>(x, y). f x y) summable_on (A \<times> B)\<close>
   shows "infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B"
 proof -
   have [simp]: \<open>(\<lambda>(x, y). f y x) summable_on (B \<times> A)\<close>
     apply (subst product_swap[symmetric])
     apply (subst summable_on_reindex)
     using assms by (auto simp: o_def)
   have \<open>infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>(x,y). f x y) (A \<times> B)\<close>
     apply (subst infsum_Sigma'_banach)
     using assms by auto
   also have \<open>\<dots> = infsum (\<lambda>(x,y). f y x) (B \<times> A)\<close>
     apply (subst product_swap[symmetric])
     apply (subst infsum_reindex)
     using assms by (auto simp: o_def)
   also have \<open>\<dots> = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B\<close>
     apply (subst infsum_Sigma'_banach)
     using assms by auto
   finally show ?thesis .
 qed
 
 lemma nonneg_infsum_le_0D:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add,ordered_ab_group_add,linorder_topology}"
   assumes "infsum f A \<le> 0"
     and abs_sum: "f summable_on A"
     and nneg: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0"
     and "x \<in> A"
   shows "f x = 0"
 proof (rule ccontr)
   assume \<open>f x \<noteq> 0\<close>
   have ex: \<open>f summable_on (A-{x})\<close>
     by (rule summable_on_cofin_subset) (use assms in auto)
   have pos: \<open>infsum f (A - {x}) \<ge> 0\<close>
     by (rule infsum_nonneg) (use nneg in auto)
 
   have [trans]: \<open>x \<ge> y \<Longrightarrow> y > z \<Longrightarrow> x > z\<close> for x y z :: 'b by auto
 
   have \<open>infsum f A = infsum f (A-{x}) + infsum f {x}\<close>
     by (subst infsum_Un_disjoint[symmetric]) (use assms ex in \<open>auto simp: insert_absorb\<close>)
   also have \<open>\<dots> \<ge> infsum f {x}\<close> (is \<open>_ \<ge> \<dots>\<close>)
     using pos by (rule add_increasing) simp
   also have \<open>\<dots> = f x\<close> (is \<open>_ = \<dots>\<close>)
     by (subst infsum_finite) auto
   also have \<open>\<dots> > 0\<close>
     using \<open>f x \<noteq> 0\<close> assms(4) nneg by fastforce
   finally show False
     using assms by auto
 qed
 
 lemma nonneg_has_sum_le_0D:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add,ordered_ab_group_add,linorder_topology}"
   assumes "has_sum f A a" \<open>a \<le> 0\<close>
     and nneg: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0"
     and "x \<in> A"
   shows "f x = 0"
   by (metis assms(1) assms(2) assms(4) infsumI nonneg_infsum_le_0D summable_on_def nneg)
 
 lemma has_sum_cmult_left:
   fixes f :: "'a \<Rightarrow> 'b :: {topological_semigroup_mult, semiring_0}"
   assumes \<open>has_sum f A a\<close>
   shows "has_sum (\<lambda>x. f x * c) A (a * c)"
 proof -
   from assms have \<open>(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)\<close>
     using has_sum_def by blast
   then have \<open>((\<lambda>F. sum f F * c) \<longlongrightarrow> a * c) (finite_subsets_at_top A)\<close>
     by (simp add: tendsto_mult_right)
   then have \<open>(sum (\<lambda>x. f x * c) \<longlongrightarrow> a * c) (finite_subsets_at_top A)\<close>
     apply (rule tendsto_cong[THEN iffD1, rotated])
     apply (rule eventually_finite_subsets_at_top_weakI)
     using sum_distrib_right by blast
   then show ?thesis
     using infsumI has_sum_def by blast
 qed
 
 lemma infsum_cmult_left:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>c \<noteq> 0 \<Longrightarrow> f summable_on A\<close>
   shows "infsum (\<lambda>x. f x * c) A = infsum f A * c"
 proof (cases \<open>c=0\<close>)
   case True
   then show ?thesis by auto
 next
   case False
   then have \<open>has_sum f A (infsum f A)\<close>
     by (simp add: assms)
   then show ?thesis
     by (auto intro!: infsumI has_sum_cmult_left)
 qed
 
 lemma summable_on_cmult_left:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>f summable_on A\<close>
   shows "(\<lambda>x. f x * c) summable_on A"
   using assms summable_on_def has_sum_cmult_left by blast
 
 lemma has_sum_cmult_right:
   fixes f :: "'a \<Rightarrow> 'b :: {topological_semigroup_mult, semiring_0}"
   assumes \<open>has_sum f A a\<close>
   shows "has_sum (\<lambda>x. c * f x) A (c * a)"
 proof -
   from assms have \<open>(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)\<close>
     using has_sum_def by blast
   then have \<open>((\<lambda>F. c * sum f F) \<longlongrightarrow> c * a) (finite_subsets_at_top A)\<close>
     by (simp add: tendsto_mult_left)
   then have \<open>(sum (\<lambda>x. c * f x) \<longlongrightarrow> c * a) (finite_subsets_at_top A)\<close>
     apply (rule tendsto_cong[THEN iffD1, rotated])
     apply (rule eventually_finite_subsets_at_top_weakI)
     using sum_distrib_left by blast
   then show ?thesis
     using infsumI has_sum_def by blast
 qed
 
 lemma infsum_cmult_right:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>c \<noteq> 0 \<Longrightarrow> f summable_on A\<close>
   shows \<open>infsum (\<lambda>x. c * f x) A = c * infsum f A\<close>
 proof (cases \<open>c=0\<close>)
   case True
   then show ?thesis by auto
 next
   case False
   then have \<open>has_sum f A (infsum f A)\<close>
     by (simp add: assms)
   then show ?thesis
     by (auto intro!: infsumI has_sum_cmult_right)
 qed
 
 lemma summable_on_cmult_right:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>f summable_on A\<close>
   shows "(\<lambda>x. c * f x) summable_on A"
   using assms summable_on_def has_sum_cmult_right by blast
 
 lemma summable_on_cmult_left':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, division_ring}"
   assumes \<open>c \<noteq> 0\<close>
   shows "(\<lambda>x. f x * c) summable_on A \<longleftrightarrow> f summable_on A"
 proof
   assume \<open>f summable_on A\<close>
   then show \<open>(\<lambda>x. f x * c) summable_on A\<close>
     by (rule summable_on_cmult_left)
 next
   assume \<open>(\<lambda>x. f x * c) summable_on A\<close>
   then have \<open>(\<lambda>x. f x * c * inverse c) summable_on A\<close>
     by (rule summable_on_cmult_left)
   then show \<open>f summable_on A\<close>
     by (metis (no_types, lifting) assms summable_on_cong mult.assoc mult.right_neutral right_inverse)
 qed
 
 lemma summable_on_cmult_right':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, division_ring}"
   assumes \<open>c \<noteq> 0\<close>
   shows "(\<lambda>x. c * f x) summable_on A \<longleftrightarrow> f summable_on A"
 proof
   assume \<open>f summable_on A\<close>
   then show \<open>(\<lambda>x. c * f x) summable_on A\<close>
     by (rule summable_on_cmult_right)
 next
   assume \<open>(\<lambda>x. c * f x) summable_on A\<close>
   then have \<open>(\<lambda>x. inverse c * (c * f x)) summable_on A\<close>
     by (rule summable_on_cmult_right)
   then show \<open>f summable_on A\<close>
     by (metis (no_types, lifting) assms summable_on_cong left_inverse mult.assoc mult.left_neutral)
 qed
 
 lemma infsum_cmult_left':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, division_ring}"
   shows "infsum (\<lambda>x. f x * c) A = infsum f A * c"
 proof (cases \<open>c \<noteq> 0 \<longrightarrow> f summable_on A\<close>)
   case True
   then show ?thesis
     apply (rule_tac infsum_cmult_left) by auto
 next
   case False
   note asm = False
   then show ?thesis
   proof (cases \<open>c=0\<close>)
     case True
     then show ?thesis by auto
   next
     case False
     with asm have nex: \<open>\<not> f summable_on A\<close>
       by simp
     moreover have nex': \<open>\<not> (\<lambda>x. f x * c) summable_on A\<close>
       using asm False apply (subst summable_on_cmult_left') by auto
     ultimately show ?thesis
       unfolding infsum_def by simp
   qed
 qed
 
 lemma infsum_cmult_right':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space,topological_semigroup_mult,division_ring}"
   shows "infsum (\<lambda>x. c * f x) A = c * infsum f A"
 proof (cases \<open>c \<noteq> 0 \<longrightarrow> f summable_on A\<close>)
   case True
   then show ?thesis
     apply (rule_tac infsum_cmult_right) by auto
 next
   case False
   note asm = False
   then show ?thesis
   proof (cases \<open>c=0\<close>)
     case True
     then show ?thesis by auto
   next
     case False
     with asm have nex: \<open>\<not> f summable_on A\<close>
       by simp
     moreover have nex': \<open>\<not> (\<lambda>x. c * f x) summable_on A\<close>
       using asm False apply (subst summable_on_cmult_right') by auto
     ultimately show ?thesis
       unfolding infsum_def by simp
   qed
 qed
 
 
 lemma has_sum_constant[simp]:
   assumes \<open>finite F\<close>
   shows \<open>has_sum (\<lambda>_. c) F (of_nat (card F) * c)\<close>
   by (metis assms has_sum_finite sum_constant)
 
 lemma infsum_constant[simp]:
   assumes \<open>finite F\<close>
   shows \<open>infsum (\<lambda>_. c) F = of_nat (card F) * c\<close>
   apply (subst infsum_finite[OF assms]) by simp
 
 lemma infsum_diverge_constant:
   \<comment> \<open>This probably does not really need all of \<^class>\<open>archimedean_field\<close> but Isabelle/HOL
        has no type class such as, e.g., "archimedean ring".\<close>
   fixes c :: \<open>'a::{archimedean_field, comm_monoid_add, linorder_topology, topological_semigroup_mult}\<close>
   assumes \<open>infinite A\<close> and \<open>c \<noteq> 0\<close>
   shows \<open>\<not> (\<lambda>_. c) summable_on A\<close>
 proof (rule notI)
   assume \<open>(\<lambda>_. c) summable_on A\<close>
   then have \<open>(\<lambda>_. inverse c * c) summable_on A\<close>
     by (rule summable_on_cmult_right)
   then have [simp]: \<open>(\<lambda>_. 1::'a) summable_on A\<close>
     using assms by auto
   have \<open>infsum (\<lambda>_. 1) A \<ge> d\<close> for d :: 'a
   proof -
     obtain n :: nat where \<open>of_nat n \<ge> d\<close>
       by (meson real_arch_simple)
     from assms
     obtain F where \<open>F \<subseteq> A\<close> and \<open>finite F\<close> and \<open>card F = n\<close>
       by (meson infinite_arbitrarily_large)
     note \<open>d \<le> of_nat n\<close>
     also have \<open>of_nat n = infsum (\<lambda>_. 1::'a) F\<close>
       by (simp add: \<open>card F = n\<close> \<open>finite F\<close>)
     also have \<open>\<dots> \<le> infsum (\<lambda>_. 1::'a) A\<close>
       apply (rule infsum_mono_neutral)
       using \<open>finite F\<close> \<open>F \<subseteq> A\<close> by auto
     finally show ?thesis .
   qed
   then show False
     by (meson linordered_field_no_ub not_less)
 qed
 
 lemma has_sum_constant_archimedean[simp]:
   \<comment> \<open>This probably does not really need all of \<^class>\<open>archimedean_field\<close> but Isabelle/HOL
        has no type class such as, e.g., "archimedean ring".\<close>
   fixes c :: \<open>'a::{archimedean_field, comm_monoid_add, linorder_topology, topological_semigroup_mult}\<close>
   shows \<open>infsum (\<lambda>_. c) A = of_nat (card A) * c\<close>
   apply (cases \<open>finite A\<close>)
    apply simp
   apply (cases \<open>c = 0\<close>)
    apply simp
   by (simp add: infsum_diverge_constant infsum_not_exists)
 
 lemma has_sum_uminus:
   fixes f :: \<open>'a \<Rightarrow> 'b::topological_ab_group_add\<close>
   shows \<open>has_sum (\<lambda>x. - f x) A a \<longleftrightarrow> has_sum f A (- a)\<close>
   by (auto simp add: sum_negf[abs_def] tendsto_minus_cancel_left has_sum_def)
 
 lemma summable_on_uminus:
   fixes f :: \<open>'a \<Rightarrow> 'b::topological_ab_group_add\<close>
   shows\<open>(\<lambda>x. - f x) summable_on A \<longleftrightarrow> f summable_on A\<close>
   by (metis summable_on_def has_sum_uminus verit_minus_simplify(4))
 
 lemma infsum_uminus:
   fixes f :: \<open>'a \<Rightarrow> 'b::{topological_ab_group_add, t2_space}\<close>
   shows \<open>infsum (\<lambda>x. - f x) A = - infsum f A\<close>
   by (metis (full_types) add.inverse_inverse add.inverse_neutral infsumI infsum_def has_sum_infsum has_sum_uminus)
 
 lemma has_sum_le_finite_sums:
   fixes a :: \<open>'a::{comm_monoid_add,topological_space,linorder_topology}\<close>
   assumes \<open>has_sum f A a\<close>
   assumes \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> A \<Longrightarrow> sum f F \<le> b\<close>
   shows \<open>a \<le> b\<close>
 proof -
   from assms(1)
   have 1: \<open>(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)\<close>
     unfolding has_sum_def .
   from assms(2)
   have 2: \<open>\<forall>\<^sub>F F in finite_subsets_at_top A. sum f F \<le> b\<close>
     by (rule_tac eventually_finite_subsets_at_top_weakI)
   show \<open>a \<le> b\<close>
     using _ _ 1 2
     apply (rule tendsto_le[where f=\<open>\<lambda>_. b\<close>])
     by auto
 qed
 
 lemma infsum_le_finite_sums:
   fixes b :: \<open>'a::{comm_monoid_add,topological_space,linorder_topology}\<close>
   assumes \<open>f summable_on A\<close>
   assumes \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> A \<Longrightarrow> sum f F \<le> b\<close>
   shows \<open>infsum f A \<le> b\<close>
   by (meson assms(1) assms(2) has_sum_infsum has_sum_le_finite_sums)
 
 
 lemma summable_on_scaleR_left [intro]:
   fixes c :: \<open>'a :: real_normed_vector\<close>
   assumes "c \<noteq> 0 \<Longrightarrow> f summable_on A"
   shows   "(\<lambda>x. f x *\<^sub>R c) summable_on A"
   apply (cases \<open>c \<noteq> 0\<close>)
    apply (subst asm_rl[of \<open>(\<lambda>x. f x *\<^sub>R c) = (\<lambda>y. y *\<^sub>R c) o f\<close>], simp add: o_def)
    apply (rule summable_on_comm_additive)
   using assms by (auto simp add: scaleR_left.additive_axioms)
 
 
 lemma summable_on_scaleR_right [intro]:
   fixes f :: \<open>'a \<Rightarrow> 'b :: real_normed_vector\<close>
   assumes "c \<noteq> 0 \<Longrightarrow> f summable_on A"
   shows   "(\<lambda>x. c *\<^sub>R f x) summable_on A"
   apply (cases \<open>c \<noteq> 0\<close>)
    apply (subst asm_rl[of \<open>(\<lambda>x. c *\<^sub>R f x) = (\<lambda>y. c *\<^sub>R y) o f\<close>], simp add: o_def)
    apply (rule summable_on_comm_additive)
   using assms by (auto simp add: scaleR_right.additive_axioms)
 
 lemma infsum_scaleR_left:
   fixes c :: \<open>'a :: real_normed_vector\<close>
   assumes "c \<noteq> 0 \<Longrightarrow> f summable_on A"
   shows   "infsum (\<lambda>x. f x *\<^sub>R c) A = infsum f A *\<^sub>R c"
   apply (cases \<open>c \<noteq> 0\<close>)
    apply (subst asm_rl[of \<open>(\<lambda>x. f x *\<^sub>R c) = (\<lambda>y. y *\<^sub>R c) o f\<close>], simp add: o_def)
    apply (rule infsum_comm_additive)
   using assms by (auto simp add: scaleR_left.additive_axioms)
 
 lemma infsum_scaleR_right:
   fixes f :: \<open>'a \<Rightarrow> 'b :: real_normed_vector\<close>
   shows   "infsum (\<lambda>x. c *\<^sub>R f x) A = c *\<^sub>R infsum f A"
 proof -
   consider (summable) \<open>f summable_on A\<close> | (c0) \<open>c = 0\<close> | (not_summable) \<open>\<not> f summable_on A\<close> \<open>c \<noteq> 0\<close>
     by auto
   then show ?thesis
   proof cases
     case summable
     then show ?thesis
       apply (subst asm_rl[of \<open>(\<lambda>x. c *\<^sub>R f x) = (\<lambda>y. c *\<^sub>R y) o f\<close>], simp add: o_def)
       apply (rule infsum_comm_additive)
       using summable by (auto simp add: scaleR_right.additive_axioms)
   next
     case c0
     then show ?thesis by auto
   next
     case not_summable
     have \<open>\<not> (\<lambda>x. c *\<^sub>R f x) summable_on A\<close>
     proof (rule notI)
       assume \<open>(\<lambda>x. c *\<^sub>R f x) summable_on A\<close>
       then have \<open>(\<lambda>x. inverse c *\<^sub>R c *\<^sub>R f x) summable_on A\<close>
         using summable_on_scaleR_right by blast
       then have \<open>f summable_on A\<close>
         using not_summable by auto
       with not_summable show False
         by simp
     qed
     then show ?thesis
       by (simp add: infsum_not_exists not_summable(1)) 
   qed
 qed
 
 
 lemma infsum_Un_Int:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, t2_space}"
   assumes [simp]: "f summable_on A - B" "f summable_on B - A" \<open>f summable_on A \<inter> B\<close>
   shows   "infsum f (A \<union> B) = infsum f A + infsum f B - infsum f (A \<inter> B)"
 proof -
   have [simp]: \<open>f summable_on A\<close>
     apply (subst asm_rl[of \<open>A = (A-B) \<union> (A\<inter>B)\<close>]) apply auto[1]
     apply (rule summable_on_Un_disjoint)
     by auto
   have \<open>infsum f (A \<union> B) = infsum f A + infsum f (B - A)\<close>
     apply (subst infsum_Un_disjoint[symmetric])
     by auto
   moreover have \<open>infsum f (B - A \<union> A \<inter> B) = infsum f (B - A) + infsum f (A \<inter> B)\<close>
     by (rule infsum_Un_disjoint) auto
   moreover have "B - A \<union> A \<inter> B = B"
     by blast
   ultimately show ?thesis
     by auto
 qed
 
 lemma inj_combinator':
   assumes "x \<notin> F"
   shows \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B \<times> B x)\<close>
 proof -
   have "inj_on ((\<lambda>(y, g). g(x := y)) \<circ> prod.swap) (Pi\<^sub>E F B \<times> B x)"
     using inj_combinator[of x F B] assms by (intro comp_inj_on) (auto simp: product_swap)
   thus ?thesis
     by (simp add: o_def)
 qed
 
 lemma infsum_prod_PiE:
   \<comment> \<open>See also \<open>infsum_prod_PiE_abs\<close> below with incomparable premises.\<close>
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c :: {comm_monoid_mult, topological_semigroup_mult, division_ring, banach}"
   assumes finite: "finite A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x summable_on B x"
   assumes "(\<lambda>g. \<Prod>x\<in>A. f x (g x)) summable_on (PiE A B)"
   shows   "infsum (\<lambda>g. \<Prod>x\<in>A. f x (g x)) (PiE A B) = (\<Prod>x\<in>A. infsum (f x) (B x))"
 proof (use finite assms(2-) in induction)
   case empty
   then show ?case 
     by auto
 next
   case (insert x F)
   have pi: \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close>
     unfolding PiE_insert_eq 
     by (subst swap_product [symmetric]) (simp add: image_image case_prod_unfold)
   have prod: \<open>(\<Prod>x'\<in>F. f x' ((p(x:=y)) x')) = (\<Prod>x'\<in>F. f x' (p x'))\<close> for p y
     by (rule prod.cong) (use insert.hyps in auto)
   have inj: \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B \<times> B x)\<close>
     using \<open>x \<notin> F\<close> by (rule inj_combinator')
 
   have summable1: \<open>(\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) summable_on Pi\<^sub>E (insert x F) B\<close>
     using insert.prems(2) .
   also have \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close>
     by (simp only: pi)
   also have "(\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) summable_on \<dots> \<longleftrightarrow>
                ((\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) summable_on (Pi\<^sub>E F B \<times> B x)"
     using inj by (rule summable_on_reindex)
   also have "(\<Prod>z\<in>F. f z ((g(x := y)) z)) = (\<Prod>z\<in>F. f z (g z))" for g y
     using insert.hyps by (intro prod.cong) auto
   hence "((\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) =
              (\<lambda>(p, y). f x y * (\<Prod>x'\<in>F. f x' (p x')))"
     using insert.hyps by (auto simp: fun_eq_iff cong: prod.cong_simp)
   finally have summable2: \<open>(\<lambda>(p, y). f x y * (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B \<times> B x\<close> .
 
   then have \<open>(\<lambda>p. \<Sum>\<^sub>\<infinity>y\<in>B x. f x y * (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B\<close>
     by (rule summable_on_Sigma_banach)
   then have \<open>(\<lambda>p. (\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) * (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B\<close>
     apply (subst infsum_cmult_left[symmetric])
     using insert.prems(1) by blast
   then have summable3: \<open>(\<lambda>p. (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B\<close> if \<open>(\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) \<noteq> 0\<close>
     apply (subst (asm) summable_on_cmult_right')
     using that by auto
 
   have \<open>(\<Sum>\<^sub>\<infinity>g\<in>Pi\<^sub>E (insert x F) B. \<Prod>x\<in>insert x F. f x (g x))
      = (\<Sum>\<^sub>\<infinity>(p,y)\<in>Pi\<^sub>E F B \<times> B x. \<Prod>x'\<in>insert x F. f x' ((p(x:=y)) x'))\<close>
     apply (subst pi)
     apply (subst infsum_reindex)
     using inj by (auto simp: o_def case_prod_unfold)
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p, y)\<in>Pi\<^sub>E F B \<times> B x. f x y * (\<Prod>x'\<in>F. f x' ((p(x:=y)) x')))\<close>
     apply (subst prod.insert)
     using insert by auto
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p, y)\<in>Pi\<^sub>E F B \<times> B x. f x y * (\<Prod>x'\<in>F. f x' (p x')))\<close>
     apply (subst prod) by rule
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E F B. \<Sum>\<^sub>\<infinity>y\<in>B x. f x y * (\<Prod>x'\<in>F. f x' (p x')))\<close>
     apply (subst infsum_Sigma_banach[symmetric])
     using summable2 apply blast
     by fastforce
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) * (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E F B. \<Prod>x'\<in>F. f x' (p x'))\<close>
     apply (subst infsum_cmult_left')
     apply (subst infsum_cmult_right')
     by (rule refl)
   also have \<open>\<dots> = (\<Prod>x\<in>insert x F. infsum (f x) (B x))\<close>
     apply (subst prod.insert)
     using \<open>finite F\<close> \<open>x \<notin> F\<close> apply auto[2]
     apply (cases \<open>infsum (f x) (B x) = 0\<close>)
      apply simp
     apply (subst insert.IH)
       apply (simp add: insert.prems(1))
      apply (rule summable3)
     by auto
   finally show ?case
     by simp
 qed
 
 lemma infsum_prod_PiE_abs:
   \<comment> \<open>See also @{thm [source] infsum_prod_PiE} above with incomparable premises.\<close>
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c :: {banach, real_normed_div_algebra, comm_semiring_1}"
   assumes finite: "finite A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x abs_summable_on B x"
   shows   "infsum (\<lambda>g. \<Prod>x\<in>A. f x (g x)) (PiE A B) = (\<Prod>x\<in>A. infsum (f x) (B x))"
 proof (use finite assms(2) in induction)
   case empty
   then show ?case 
     by auto
 next
   case (insert x F)
   
   have pi: \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close> for x F and B :: "'a \<Rightarrow> 'b set"
     unfolding PiE_insert_eq 
     by (subst swap_product [symmetric]) (simp add: image_image case_prod_unfold)
   have prod: \<open>(\<Prod>x'\<in>F. f x' ((p(x:=y)) x')) = (\<Prod>x'\<in>F. f x' (p x'))\<close> for p y
     by (rule prod.cong) (use insert.hyps in auto)
   have inj: \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B \<times> B x)\<close>
     using \<open>x \<notin> F\<close> by (rule inj_combinator')
 
   define s where \<open>s x = infsum (\<lambda>y. norm (f x y)) (B x)\<close> for x
 
   have *: \<open>(\<Sum>p\<in>P. norm (\<Prod>x\<in>F. f x (p x))) \<le> prod s F\<close> 
     if P: \<open>P \<subseteq> Pi\<^sub>E F B\<close> and [simp]: \<open>finite P\<close> \<open>finite F\<close> 
       and sum: \<open>\<And>x. x \<in> F \<Longrightarrow> f x abs_summable_on B x\<close> for P F
   proof -
     define B' where \<open>B' x = {p x| p. p\<in>P}\<close> for x
     have [simp]: \<open>finite (B' x)\<close> for x
       using that by (auto simp: B'_def)
     have [simp]: \<open>finite (Pi\<^sub>E F B')\<close>
       by (simp add: finite_PiE)
     have [simp]: \<open>P \<subseteq> Pi\<^sub>E F B'\<close>
       using that by (auto simp: B'_def)
     have B'B: \<open>B' x \<subseteq> B x\<close> if \<open>x \<in> F\<close> for x
       unfolding B'_def using P that 
       by auto
     have s_bound: \<open>(\<Sum>y\<in>B' x. norm (f x y)) \<le> s x\<close> if \<open>x \<in> F\<close> for x
       apply (simp_all add: s_def flip: infsum_finite)
       apply (rule infsum_mono_neutral)
       using that sum B'B by auto
     have \<open>(\<Sum>p\<in>P. norm (\<Prod>x\<in>F. f x (p x))) \<le> (\<Sum>p\<in>Pi\<^sub>E F B'. norm (\<Prod>x\<in>F. f x (p x)))\<close>
       apply (rule sum_mono2)
       by auto
     also have \<open>\<dots> = (\<Sum>p\<in>Pi\<^sub>E F B'. \<Prod>x\<in>F. norm (f x (p x)))\<close>
       apply (subst prod_norm[symmetric])
       by simp
     also have \<open>\<dots> = (\<Prod>x\<in>F. \<Sum>y\<in>B' x. norm (f x y))\<close>
     proof (use \<open>finite F\<close> in induction)
       case empty
       then show ?case by simp
     next
       case (insert x F)
       have aux: \<open>a = b \<Longrightarrow> c * a = c * b\<close> for a b c :: real
         by auto
       have inj: \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B' \<times> B' x)\<close>
         by (rule inj_combinator') (use insert.hyps in auto)
       have \<open>(\<Sum>p\<in>Pi\<^sub>E (insert x F) B'. \<Prod>x\<in>insert x F. norm (f x (p x)))
          =  (\<Sum>(p,y)\<in>Pi\<^sub>E F B' \<times> B' x. \<Prod>x'\<in>insert x F. norm (f x' ((p(x := y)) x')))\<close>
         apply (subst pi)
         apply (subst sum.reindex)
         using inj by (auto simp: case_prod_unfold)
       also have \<open>\<dots> = (\<Sum>(p,y)\<in>Pi\<^sub>E F B' \<times> B' x. norm (f x y) * (\<Prod>x'\<in>F. norm (f x' ((p(x := y)) x'))))\<close>
         apply (subst prod.insert)
         using insert.hyps by (auto simp: case_prod_unfold)
       also have \<open>\<dots> = (\<Sum>(p, y)\<in>Pi\<^sub>E F B' \<times> B' x. norm (f x y) * (\<Prod>x'\<in>F. norm (f x' (p x'))))\<close>
         apply (rule sum.cong)
          apply blast
         unfolding case_prod_unfold
         apply (rule aux)
         apply (rule prod.cong)
         using insert.hyps(2) by auto
       also have \<open>\<dots> = (\<Sum>y\<in>B' x. norm (f x y)) * (\<Sum>p\<in>Pi\<^sub>E F B'. \<Prod>x'\<in>F. norm (f x' (p x')))\<close>
         apply (subst sum_product)
         apply (subst sum.swap)
         apply (subst sum.cartesian_product)
         by simp
       also have \<open>\<dots> = (\<Sum>y\<in>B' x. norm (f x y)) * (\<Prod>x\<in>F. \<Sum>y\<in>B' x. norm (f x y))\<close>
         by (simp add: insert.IH)
       also have \<open>\<dots> = (\<Prod>x\<in>insert x F. \<Sum>y\<in>B' x. norm (f x y))\<close>
         using insert.hyps(1) insert.hyps(2) by force
       finally show ?case .
     qed
     also have \<open>\<dots> = (\<Prod>x\<in>F. \<Sum>\<^sub>\<infinity>y\<in>B' x. norm (f x y))\<close>
       by auto
     also have \<open>\<dots> \<le> (\<Prod>x\<in>F. s x)\<close>
       apply (rule prod_mono)
       apply auto
       apply (simp add: sum_nonneg)
       using s_bound by presburger
     finally show ?thesis .
   qed
   have \<open>(\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) abs_summable_on Pi\<^sub>E (insert x F) B\<close>
     apply (rule nonneg_bdd_above_summable_on)
      apply (simp; fail)
     apply (rule bdd_aboveI[where M=\<open>\<Prod>x'\<in>insert x F. s x'\<close>])
     using * insert.hyps insert.prems by blast
 
   also have \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close>
     by (simp only: pi)
   also have "(\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) abs_summable_on \<dots> \<longleftrightarrow>
                ((\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) abs_summable_on (Pi\<^sub>E F B \<times> B x)"
     using inj by (subst summable_on_reindex) (auto simp: o_def)
   also have "(\<Prod>z\<in>F. f z ((g(x := y)) z)) = (\<Prod>z\<in>F. f z (g z))" for g y
     using insert.hyps by (intro prod.cong) auto
   hence "((\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) =
              (\<lambda>(p, y). f x y * (\<Prod>x'\<in>F. f x' (p x')))"
     using insert.hyps by (auto simp: fun_eq_iff cong: prod.cong_simp)
   finally have summable2: \<open>(\<lambda>(p, y). f x y * (\<Prod>x'\<in>F. f x' (p x'))) abs_summable_on Pi\<^sub>E F B \<times> B x\<close> .
 
   have \<open>(\<Sum>\<^sub>\<infinity>g\<in>Pi\<^sub>E (insert x F) B. \<Prod>x\<in>insert x F. f x (g x))
      = (\<Sum>\<^sub>\<infinity>(p,y)\<in>Pi\<^sub>E F B \<times> B x. \<Prod>x'\<in>insert x F. f x' ((p(x:=y)) x'))\<close>
     apply (subst pi)
     apply (subst infsum_reindex)
     using inj by (auto simp: o_def case_prod_unfold)
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p, y)\<in>Pi\<^sub>E F B \<times> B x. f x y * (\<Prod>x'\<in>F. f x' ((p(x:=y)) x')))\<close>
     apply (subst prod.insert)
     using insert by auto
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p, y)\<in>Pi\<^sub>E F B \<times> B x. f x y * (\<Prod>x'\<in>F. f x' (p x')))\<close>
     apply (subst prod) by rule
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E F B. \<Sum>\<^sub>\<infinity>y\<in>B x. f x y * (\<Prod>x'\<in>F. f x' (p x')))\<close>
     apply (subst infsum_Sigma_banach[symmetric])
     using summable2 abs_summable_summable apply blast
     by fastforce
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) * (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E F B. \<Prod>x'\<in>F. f x' (p x'))\<close>
     apply (subst infsum_cmult_left')
     apply (subst infsum_cmult_right')
     by (rule refl)
   also have \<open>\<dots> = (\<Prod>x\<in>insert x F. infsum (f x) (B x))\<close>
     apply (subst prod.insert)
     using \<open>finite F\<close> \<open>x \<notin> F\<close> apply auto[2]
     apply (cases \<open>infsum (f x) (B x) = 0\<close>)
      apply (simp; fail)
     apply (subst insert.IH)
       apply (auto simp add: insert.prems(1))
     done
   finally show ?case
     by simp
 qed
 
 
 
 subsection \<open>Absolute convergence\<close>
 
 lemma abs_summable_countable:
   assumes \<open>f abs_summable_on A\<close>
   shows \<open>countable {x\<in>A. f x \<noteq> 0}\<close>
 proof -
   have fin: \<open>finite {x\<in>A. norm (f x) \<ge> t}\<close> if \<open>t > 0\<close> for t
   proof (rule ccontr)
     assume *: \<open>infinite {x \<in> A. t \<le> norm (f x)}\<close>
     have \<open>infsum (\<lambda>x. norm (f x)) A \<ge> b\<close> for b
     proof -
       obtain b' where b': \<open>of_nat b' \<ge> b / t\<close>
         by (meson real_arch_simple)
       from *
       obtain F where cardF: \<open>card F \<ge> b'\<close> and \<open>finite F\<close> and F: \<open>F \<subseteq> {x \<in> A. t \<le> norm (f x)}\<close>
         by (meson finite_if_finite_subsets_card_bdd nle_le)
       have \<open>b \<le> of_nat b' * t\<close>
         using b' \<open>t > 0\<close> by (simp add: field_simps split: if_splits)
       also have \<open>\<dots> \<le> of_nat (card F) * t\<close>
         by (simp add: cardF that)
       also have \<open>\<dots> = sum (\<lambda>x. t) F\<close>
         by simp
       also have \<open>\<dots> \<le> sum (\<lambda>x. norm (f x)) F\<close>
         by (metis (mono_tags, lifting) F in_mono mem_Collect_eq sum_mono)
       also have \<open>\<dots> = infsum (\<lambda>x. norm (f x)) F\<close>
         using \<open>finite F\<close> by (rule infsum_finite[symmetric])
       also have \<open>\<dots> \<le> infsum (\<lambda>x. norm (f x)) A\<close>
         by (rule infsum_mono_neutral) (use \<open>finite F\<close> assms F in auto)
       finally show ?thesis .
     qed
     then show False
       by (meson gt_ex linorder_not_less)
   qed
   have \<open>countable (\<Union>i\<in>{1..}. {x\<in>A. norm (f x) \<ge> 1/of_nat i})\<close>
     by (rule countable_UN) (use fin in \<open>auto intro!: countable_finite\<close>)
   also have \<open>\<dots> = {x\<in>A. f x \<noteq> 0}\<close>
   proof safe
     fix x assume x: "x \<in> A" "f x \<noteq> 0"
     define i where "i = max 1 (nat (ceiling (1 / norm (f x))))"
     have "i \<ge> 1"
       by (simp add: i_def)
     moreover have "real i \<ge> 1 / norm (f x)"
       unfolding i_def by linarith
     hence "1 / real i \<le> norm (f x)" using \<open>f x \<noteq> 0\<close>
       by (auto simp: divide_simps mult_ac)
     ultimately show "x \<in> (\<Union>i\<in>{1..}. {x \<in> A. 1 / real i \<le> norm (f x)})"
       using \<open>x \<in> A\<close> by auto
   qed auto
   finally show ?thesis .
 qed
 
 (* Logically belongs in the section about reals, but needed as a dependency here *)
 lemma summable_on_iff_abs_summable_on_real:
   fixes f :: \<open>'a \<Rightarrow> real\<close>
   shows \<open>f summable_on A \<longleftrightarrow> f abs_summable_on A\<close>
 proof (rule iffI)
   assume \<open>f summable_on A\<close>
   define n A\<^sub>p A\<^sub>n
     where \<open>n x = norm (f x)\<close> and \<open>A\<^sub>p = {x\<in>A. f x \<ge> 0}\<close> and \<open>A\<^sub>n = {x\<in>A. f x < 0}\<close> for x
   have [simp]: \<open>A\<^sub>p \<union> A\<^sub>n = A\<close> \<open>A\<^sub>p \<inter> A\<^sub>n = {}\<close>
     by (auto simp: A\<^sub>p_def A\<^sub>n_def)
   from \<open>f summable_on A\<close> have [simp]: \<open>f summable_on A\<^sub>p\<close> \<open>f summable_on A\<^sub>n\<close>
     using A\<^sub>p_def A\<^sub>n_def summable_on_subset_banach by fastforce+
   then have [simp]: \<open>n summable_on A\<^sub>p\<close>
     apply (subst summable_on_cong[where g=f])
     by (simp_all add: A\<^sub>p_def n_def)
   moreover have [simp]: \<open>n summable_on A\<^sub>n\<close>
     apply (subst summable_on_cong[where g=\<open>\<lambda>x. - f x\<close>])
      apply (simp add: A\<^sub>n_def n_def[abs_def])
     by (simp add: summable_on_uminus)
   ultimately have [simp]: \<open>n summable_on (A\<^sub>p \<union> A\<^sub>n)\<close>
     apply (rule summable_on_Un_disjoint) by simp
   then show \<open>n summable_on A\<close>
     by simp
 next
   show \<open>f abs_summable_on A \<Longrightarrow> f summable_on A\<close>
     using abs_summable_summable by blast
 qed
 
 lemma abs_summable_on_Sigma_iff:
   shows   "f abs_summable_on Sigma A B \<longleftrightarrow>
              (\<forall>x\<in>A. (\<lambda>y. f (x, y)) abs_summable_on B x) \<and>
              ((\<lambda>x. infsum (\<lambda>y. norm (f (x, y))) (B x)) abs_summable_on A)"
 proof (intro iffI conjI ballI)
   assume asm: \<open>f abs_summable_on Sigma A B\<close>
   then have \<open>(\<lambda>x. infsum (\<lambda>y. norm (f (x,y))) (B x)) summable_on A\<close>
     apply (rule_tac summable_on_Sigma_banach)
     by (auto simp: case_prod_unfold)
   then show \<open>(\<lambda>x. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x, y))) abs_summable_on A\<close>
     using summable_on_iff_abs_summable_on_real by force
 
   show \<open>(\<lambda>y. f (x, y)) abs_summable_on B x\<close> if \<open>x \<in> A\<close> for x
   proof -
     from asm have \<open>f abs_summable_on Pair x ` B x\<close>
       apply (rule summable_on_subset_banach)
       using that by auto
     then show ?thesis
       apply (subst (asm) summable_on_reindex)
       by (auto simp: o_def inj_on_def)
   qed
 next
   assume asm: \<open>(\<forall>x\<in>A. (\<lambda>xa. f (x, xa)) abs_summable_on B x) \<and>
     (\<lambda>x. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x, y))) abs_summable_on A\<close>
   have \<open>(\<Sum>xy\<in>F. norm (f xy)) \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x, y)))\<close>
     if \<open>F \<subseteq> Sigma A B\<close> and [simp]: \<open>finite F\<close> for F
   proof -
     have [simp]: \<open>(SIGMA x:fst ` F. {y. (x, y) \<in> F}) = F\<close>
       by (auto intro!: set_eqI simp add: Domain.DomainI fst_eq_Domain)
     have [simp]: \<open>finite {y. (x, y) \<in> F}\<close> for x
       by (metis \<open>finite F\<close> Range.intros finite_Range finite_subset mem_Collect_eq subsetI)
     have \<open>(\<Sum>xy\<in>F. norm (f xy)) = (\<Sum>x\<in>fst ` F. \<Sum>y\<in>{y. (x,y)\<in>F}. norm (f (x,y)))\<close>
       apply (subst sum.Sigma)
       by auto
     also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>x\<in>fst ` F. \<Sum>\<^sub>\<infinity>y\<in>{y. (x,y)\<in>F}. norm (f (x,y)))\<close>
       apply (subst infsum_finite)
       by auto
     also have \<open>\<dots> \<le> (\<Sum>\<^sub>\<infinity>x\<in>fst ` F. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x,y)))\<close>
       apply (rule infsum_mono)
         apply (simp; fail)
        apply (simp; fail)
       apply (rule infsum_mono_neutral)
       using asm that(1) by auto
     also have \<open>\<dots> \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x,y)))\<close>
       by (rule infsum_mono_neutral) (use asm that(1) in \<open>auto simp add: infsum_nonneg\<close>)
     finally show ?thesis .
   qed
   then show \<open>f abs_summable_on Sigma A B\<close>
     by (intro nonneg_bdd_above_summable_on) (auto simp: bdd_above_def)
 qed
 
 lemma abs_summable_on_comparison_test:
   assumes "g abs_summable_on A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> norm (f x) \<le> norm (g x)"
   shows   "f abs_summable_on A"
 proof (rule nonneg_bdd_above_summable_on)
   show "bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F \<subseteq> A \<and> finite F})"
   proof (rule bdd_aboveI2)
     fix F assume F: "F \<in> {F. F \<subseteq> A \<and> finite F}"
     have \<open>sum (\<lambda>x. norm (f x)) F \<le> sum (\<lambda>x. norm (g x)) F\<close>
       using assms F by (intro sum_mono) auto
     also have \<open>\<dots> = infsum (\<lambda>x. norm (g x)) F\<close>
       using F by simp
     also have \<open>\<dots> \<le> infsum (\<lambda>x. norm (g x)) A\<close>
     proof (rule infsum_mono_neutral)
       show "g abs_summable_on F"
         by (rule summable_on_subset_banach[OF assms(1)]) (use F in auto)
     qed (use F assms in auto)
     finally show "(\<Sum>x\<in>F. norm (f x)) \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. norm (g x))" .
   qed
 qed auto
 
 lemma abs_summable_iff_bdd_above:
   fixes f :: \<open>'a \<Rightarrow> 'b::real_normed_vector\<close>
   shows \<open>f abs_summable_on A \<longleftrightarrow> bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F\<subseteq>A \<and> finite F})\<close>
 proof (rule iffI)
   assume \<open>f abs_summable_on A\<close>
   show \<open>bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F \<subseteq> A \<and> finite F})\<close>
   proof (rule bdd_aboveI2)
     fix F assume F: "F \<in> {F. F \<subseteq> A \<and> finite F}"
     show "(\<Sum>x\<in>F. norm (f x)) \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. norm (f x))"
       by (rule finite_sum_le_infsum) (use \<open>f abs_summable_on A\<close> F in auto)
   qed
 next
   assume \<open>bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F\<subseteq>A \<and> finite F})\<close>
   then show \<open>f abs_summable_on A\<close>
     by (simp add: nonneg_bdd_above_summable_on)
 qed
 
 lemma abs_summable_product:
   fixes x :: "'a \<Rightarrow> 'b::{real_normed_div_algebra,banach,second_countable_topology}"
   assumes x2_sum: "(\<lambda>i. (x i) * (x i)) abs_summable_on A"
     and y2_sum: "(\<lambda>i. (y i) * (y i)) abs_summable_on A"
   shows "(\<lambda>i. x i * y i) abs_summable_on A"
 proof (rule nonneg_bdd_above_summable_on)
   show "bdd_above (sum (\<lambda>xa. norm (x xa * y xa)) ` {F. F \<subseteq> A \<and> finite F})"
   proof (rule bdd_aboveI2)
     fix F assume F: \<open>F \<in> {F. F \<subseteq> A \<and> finite F}\<close>
     then have r1: "finite F" and b4: "F \<subseteq> A"
       by auto
   
     have a1: "(\<Sum>\<^sub>\<infinity>i\<in>F. norm (x i * x i)) \<le> (\<Sum>\<^sub>\<infinity>i\<in>A. norm (x i * x i))"
       apply (rule infsum_mono_neutral)
       using b4 r1 x2_sum by auto
 
     have "norm (x i * y i) \<le> norm (x i * x i) + norm (y i * y i)" for i
       unfolding norm_mult by (smt mult_left_mono mult_nonneg_nonneg mult_right_mono norm_ge_zero)
     hence "(\<Sum>i\<in>F. norm (x i * y i)) \<le> (\<Sum>i\<in>F. norm (x i * x i) + norm (y i * y i))"
       by (simp add: sum_mono)
     also have "\<dots> = (\<Sum>i\<in>F. norm (x i * x i)) + (\<Sum>i\<in>F. norm (y i * y i))"
       by (simp add: sum.distrib)
     also have "\<dots> = (\<Sum>\<^sub>\<infinity>i\<in>F. norm (x i * x i)) + (\<Sum>\<^sub>\<infinity>i\<in>F. norm (y i * y i))"
       by (simp add: \<open>finite F\<close>)
     also have "\<dots> \<le> (\<Sum>\<^sub>\<infinity>i\<in>A. norm (x i * x i)) + (\<Sum>\<^sub>\<infinity>i\<in>A. norm (y i * y i))"
       using F assms
       by (intro add_mono infsum_mono2) auto
     finally show \<open>(\<Sum>xa\<in>F. norm (x xa * y xa)) \<le> (\<Sum>\<^sub>\<infinity>i\<in>A. norm (x i * x i)) + (\<Sum>\<^sub>\<infinity>i\<in>A. norm (y i * y i))\<close>
       by simp
   qed
 qed auto
 
 subsection \<open>Extended reals and nats\<close>
 
 lemma summable_on_ennreal[simp]: \<open>(f::_ \<Rightarrow> ennreal) summable_on S\<close>
   by (rule nonneg_summable_on_complete) simp
 
 lemma summable_on_enat[simp]: \<open>(f::_ \<Rightarrow> enat) summable_on S\<close>
   by (rule nonneg_summable_on_complete) simp
 
 lemma has_sum_superconst_infinite_ennreal:
   fixes f :: \<open>'a \<Rightarrow> ennreal\<close>
   assumes geqb: \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes b: \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "has_sum f S \<infinity>"
 proof -
   have \<open>(sum f \<longlongrightarrow> \<infinity>) (finite_subsets_at_top S)\<close>
   proof (rule order_tendstoI[rotated], simp)
     fix y :: ennreal assume \<open>y < \<infinity>\<close>
     then have \<open>y / b < \<infinity>\<close>
       by (metis b ennreal_divide_eq_top_iff gr_implies_not_zero infinity_ennreal_def top.not_eq_extremum)
     then obtain F where \<open>finite F\<close> and \<open>F \<subseteq> S\<close> and cardF: \<open>card F > y / b\<close>
       using \<open>infinite S\<close>
       by (metis ennreal_Ex_less_of_nat infinite_arbitrarily_large infinity_ennreal_def)
     moreover have \<open>sum f Y > y\<close> if \<open>finite Y\<close> and \<open>F \<subseteq> Y\<close> and \<open>Y \<subseteq> S\<close> for Y
     proof -
       have \<open>y < b * card F\<close>
         by (metis \<open>y < \<infinity>\<close> b cardF divide_less_ennreal ennreal_mult_eq_top_iff gr_implies_not_zero infinity_ennreal_def mult.commute top.not_eq_extremum)
       also have \<open>\<dots> \<le> b * card Y\<close>
         by (meson b card_mono less_imp_le mult_left_mono of_nat_le_iff that(1) that(2))
       also have \<open>\<dots> = sum (\<lambda>_. b) Y\<close>
         by (simp add: mult.commute)
       also have \<open>\<dots> \<le> sum f Y\<close>
         using geqb by (meson subset_eq sum_mono that(3))
       finally show ?thesis .
     qed
     ultimately show \<open>\<forall>\<^sub>F x in finite_subsets_at_top S. y < sum f x\<close>
       unfolding eventually_finite_subsets_at_top 
       by auto
   qed
   then show ?thesis
     by (simp add: has_sum_def)
 qed
 
 lemma infsum_superconst_infinite_ennreal:
   fixes f :: \<open>'a \<Rightarrow> ennreal\<close>
   assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "infsum f S = \<infinity>"
   using assms infsumI has_sum_superconst_infinite_ennreal by blast
 
 lemma infsum_superconst_infinite_ereal:
   fixes f :: \<open>'a \<Rightarrow> ereal\<close>
   assumes geqb: \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes b: \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "infsum f S = \<infinity>"
 proof -
   obtain b' where b': \<open>e2ennreal b' = b\<close> and \<open>b' > 0\<close>
     using b by blast
   have "0 < e2ennreal b"
     using b' b
     by (metis dual_order.refl enn2ereal_e2ennreal gr_zeroI order_less_le zero_ennreal.abs_eq)
   hence *: \<open>infsum (e2ennreal o f) S = \<infinity>\<close>
     using assms b'
     by (intro infsum_superconst_infinite_ennreal[where b=b']) (auto intro!: e2ennreal_mono)
   have \<open>infsum f S = infsum (enn2ereal o (e2ennreal o f)) S\<close>
     using geqb b by (intro infsum_cong) (fastforce simp: enn2ereal_e2ennreal)
   also have \<open>\<dots> = enn2ereal \<infinity>\<close>
     apply (subst infsum_comm_additive_general)
     using * by (auto simp: continuous_at_enn2ereal)
   also have \<open>\<dots> = \<infinity>\<close>
     by simp
   finally show ?thesis .
 qed
 
 lemma has_sum_superconst_infinite_ereal:
   fixes f :: \<open>'a \<Rightarrow> ereal\<close>
   assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "has_sum f S \<infinity>"
   by (metis Infty_neq_0(1) assms infsum_def has_sum_infsum infsum_superconst_infinite_ereal)
 
 lemma infsum_superconst_infinite_enat:
   fixes f :: \<open>'a \<Rightarrow> enat\<close>
   assumes geqb: \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes b: \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "infsum f S = \<infinity>"
 proof -
   have \<open>ennreal_of_enat (infsum f S) = infsum (ennreal_of_enat o f) S\<close>
     apply (rule infsum_comm_additive_general[symmetric])
     by auto
   also have \<open>\<dots> = \<infinity>\<close>
     by (metis assms(3) b comp_apply ennreal_of_enat_0 ennreal_of_enat_inj ennreal_of_enat_le_iff geqb infsum_superconst_infinite_ennreal not_gr_zero)
   also have \<open>\<dots> = ennreal_of_enat \<infinity>\<close>
     by simp
   finally show ?thesis
     by (rule ennreal_of_enat_inj[THEN iffD1])
 qed
 
 lemma has_sum_superconst_infinite_enat:
   fixes f :: \<open>'a \<Rightarrow> enat\<close>
   assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "has_sum f S \<infinity>"
   by (metis assms i0_lb has_sum_infsum infsum_superconst_infinite_enat nonneg_summable_on_complete)
 
 text \<open>This lemma helps to relate a real-valued infsum to a supremum over extended nonnegative reals.\<close>
 
 lemma infsum_nonneg_is_SUPREMUM_ennreal:
   fixes f :: "'a \<Rightarrow> real"
   assumes summable: "f summable_on A"
     and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "ennreal (infsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ennreal (sum f F)))"
 proof -
   have \<open>ennreal (infsum f A) = infsum (ennreal o f) A\<close>
     apply (rule infsum_comm_additive_general[symmetric])
     apply (subst sum_ennreal[symmetric])
     using assms by auto
   also have \<open>\<dots> = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ennreal (sum f F)))\<close>
     apply (subst nonneg_infsum_complete, simp)
     apply (rule SUP_cong, blast)
     apply (subst sum_ennreal[symmetric])
     using fnn by auto
   finally show ?thesis .
 qed
 
 text \<open>This lemma helps to related a real-valued infsum to a supremum over extended reals.\<close>
 
 lemma infsum_nonneg_is_SUPREMUM_ereal:
   fixes f :: "'a \<Rightarrow> real"
   assumes summable: "f summable_on A"
     and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "ereal (infsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))"
 proof -
   have \<open>ereal (infsum f A) = infsum (ereal o f) A\<close>
     apply (rule infsum_comm_additive_general[symmetric])
     using assms by auto
   also have \<open>\<dots> = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))\<close>
     by (subst nonneg_infsum_complete) (simp_all add: assms)
   finally show ?thesis .
 qed
 
 
 subsection \<open>Real numbers\<close>
 
 text \<open>Most lemmas in the general property section already apply to real numbers.
       A few ones that are specific to reals are given here.\<close>
 
 lemma infsum_nonneg_is_SUPREMUM_real:
   fixes f :: "'a \<Rightarrow> real"
   assumes summable: "f summable_on A"
     and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "infsum f A = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (sum f F))"
 proof -
   have "ereal (infsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))"
     using assms by (rule infsum_nonneg_is_SUPREMUM_ereal)
   also have "\<dots> = ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (sum f F))"
   proof (subst ereal_SUP)
     show "\<bar>SUP a\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f a)\<bar> \<noteq> \<infinity>"
       using calculation by fastforce      
     show "(SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F)) = (SUP a\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f a))"
       by simp      
   qed
   finally show ?thesis by simp
 qed
 
 
 lemma has_sum_nonneg_SUPREMUM_real:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f summable_on A" and "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "has_sum f A (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (sum f F))"
   by (metis (mono_tags, lifting) assms has_sum_infsum infsum_nonneg_is_SUPREMUM_real)
 
 lemma summable_countable_real:
   fixes f :: \<open>'a \<Rightarrow> real\<close>
   assumes \<open>f summable_on A\<close>
   shows \<open>countable {x\<in>A. f x \<noteq> 0}\<close>
   using abs_summable_countable assms summable_on_iff_abs_summable_on_real by blast
 
 subsection \<open>Complex numbers\<close>
 
 lemma has_sum_cnj_iff[simp]: 
   fixes f :: \<open>'a \<Rightarrow> complex\<close>
   shows \<open>has_sum (\<lambda>x. cnj (f x)) M (cnj a) \<longleftrightarrow> has_sum f M a\<close>
   by (simp add: has_sum_def lim_cnj del: cnj_sum add: cnj_sum[symmetric, abs_def, of f])
 
 lemma summable_on_cnj_iff[simp]:
   "(\<lambda>i. cnj (f i)) summable_on A \<longleftrightarrow> f summable_on A"
   by (metis complex_cnj_cnj summable_on_def has_sum_cnj_iff)
 
 lemma infsum_cnj[simp]: \<open>infsum (\<lambda>x. cnj (f x)) M = cnj (infsum f M)\<close>
   by (metis complex_cnj_zero infsumI has_sum_cnj_iff infsum_def summable_on_cnj_iff has_sum_infsum)
 
 lemma infsum_Re:
   assumes "f summable_on M"
   shows "infsum (\<lambda>x. Re (f x)) M = Re (infsum f M)"
   apply (rule infsum_comm_additive[where f=Re, unfolded o_def])
   using assms by (auto intro!: additive.intro)
 
 lemma has_sum_Re:
   assumes "has_sum f M a"
   shows "has_sum (\<lambda>x. Re (f x)) M (Re a)"
   apply (rule has_sum_comm_additive[where f=Re, unfolded o_def])
   using assms by (auto intro!: additive.intro tendsto_Re)
 
 lemma summable_on_Re: 
   assumes "f summable_on M"
   shows "(\<lambda>x. Re (f x)) summable_on M"
   apply (rule summable_on_comm_additive[where f=Re, unfolded o_def])
   using assms by (auto intro!: additive.intro)
 
 lemma infsum_Im: 
   assumes "f summable_on M"
   shows "infsum (\<lambda>x. Im (f x)) M = Im (infsum f M)"
   apply (rule infsum_comm_additive[where f=Im, unfolded o_def])
   using assms by (auto intro!: additive.intro)
 
 lemma has_sum_Im:
   assumes "has_sum f M a"
   shows "has_sum (\<lambda>x. Im (f x)) M (Im a)"
   apply (rule has_sum_comm_additive[where f=Im, unfolded o_def])
   using assms by (auto intro!: additive.intro tendsto_Im)
 
 lemma summable_on_Im: 
   assumes "f summable_on M"
   shows "(\<lambda>x. Im (f x)) summable_on M"
   apply (rule summable_on_comm_additive[where f=Im, unfolded o_def])
   using assms by (auto intro!: additive.intro)
 
 lemma nonneg_infsum_le_0D_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes "infsum f A \<le> 0"
     and abs_sum: "f summable_on A"
     and nneg: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0"
     and "x \<in> A"
   shows "f x = 0"
 proof -
   have \<open>Im (f x) = 0\<close>
     apply (rule nonneg_infsum_le_0D[where A=A])
     using assms
     by (auto simp add: infsum_Im summable_on_Im less_eq_complex_def)
   moreover have \<open>Re (f x) = 0\<close>
     apply (rule nonneg_infsum_le_0D[where A=A])
     using assms by (auto simp add: summable_on_Re infsum_Re less_eq_complex_def)
   ultimately show ?thesis
     by (simp add: complex_eqI)
 qed
 
 lemma nonneg_has_sum_le_0D_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes "has_sum f A a" and \<open>a \<le> 0\<close>
     and "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0" and "x \<in> A"
   shows "f x = 0"
   by (metis assms infsumI nonneg_infsum_le_0D_complex summable_on_def)
 
 text \<open>The lemma @{thm [source] infsum_mono_neutral} above applies to various linear ordered monoids such as the reals but not to the complex numbers.
       Thus we have a separate corollary for those:\<close>
 
 lemma infsum_mono_neutral_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes [simp]: "f summable_on A"
     and [simp]: "g summable_on B"
   assumes \<open>\<And>x. x \<in> A\<inter>B \<Longrightarrow> f x \<le> g x\<close>
   assumes \<open>\<And>x. x \<in> A-B \<Longrightarrow> f x \<le> 0\<close>
   assumes \<open>\<And>x. x \<in> B-A \<Longrightarrow> g x \<ge> 0\<close>
   shows \<open>infsum f A \<le> infsum g B\<close>
 proof -
   have \<open>infsum (\<lambda>x. Re (f x)) A \<le> infsum (\<lambda>x. Re (g x)) B\<close>
     apply (rule infsum_mono_neutral)
     using assms(3-5) by (auto simp add: summable_on_Re less_eq_complex_def)
   then have Re: \<open>Re (infsum f A) \<le> Re (infsum g B)\<close>
     by (metis assms(1-2) infsum_Re)
   have \<open>infsum (\<lambda>x. Im (f x)) A = infsum (\<lambda>x. Im (g x)) B\<close>
     apply (rule infsum_cong_neutral)
     using assms(3-5) by (auto simp add: summable_on_Re less_eq_complex_def)
   then have Im: \<open>Im (infsum f A) = Im (infsum g B)\<close>
     by (metis assms(1-2) infsum_Im)
   from Re Im show ?thesis
     by (auto simp: less_eq_complex_def)
 qed
 
 lemma infsum_mono_complex:
   \<comment> \<open>For \<^typ>\<open>real\<close>, @{thm [source] infsum_mono} can be used. 
       But \<^typ>\<open>complex\<close> does not have the right typeclass.\<close>
   fixes f g :: "'a \<Rightarrow> complex"
   assumes f_sum: "f summable_on A" and g_sum: "g summable_on A"
   assumes leq: "\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x"
   shows   "infsum f A \<le> infsum g A"
   by (metis DiffE IntD1 f_sum g_sum infsum_mono_neutral_complex leq)
 
 
 lemma infsum_nonneg_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes "f summable_on M"
     and "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "infsum f M \<ge> 0" (is "?lhs \<ge> _")
   by (metis assms(1) assms(2) infsum_0_simp summable_on_0_simp infsum_mono_complex)
 
 lemma infsum_cmod:
   assumes "f summable_on M"
     and fnn: "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "infsum (\<lambda>x. cmod (f x)) M = cmod (infsum f M)"
 proof -
   have \<open>complex_of_real (infsum (\<lambda>x. cmod (f x)) M) = infsum (\<lambda>x. complex_of_real (cmod (f x))) M\<close>
   proof (rule infsum_comm_additive[symmetric, unfolded o_def])
     have "(\<lambda>z. Re (f z)) summable_on M"
       using assms summable_on_Re by blast
     also have "?this \<longleftrightarrow> f abs_summable_on M"
       using fnn by (intro summable_on_cong) (auto simp: less_eq_complex_def cmod_def)
     finally show \<dots> .
   qed (auto simp: additive_def)
   also have \<open>\<dots> = infsum f M\<close>
     apply (rule infsum_cong)
     using fnn cmod_eq_Re complex_is_Real_iff less_eq_complex_def by force
   finally show ?thesis
     by (metis abs_of_nonneg infsum_def le_less_trans norm_ge_zero norm_infsum_bound norm_of_real not_le order_refl)
 qed
 
 
 lemma summable_on_iff_abs_summable_on_complex:
   fixes f :: \<open>'a \<Rightarrow> complex\<close>
   shows \<open>f summable_on A \<longleftrightarrow> f abs_summable_on A\<close>
 proof (rule iffI)
   assume \<open>f summable_on A\<close>
   define i r ni nr n where \<open>i x = Im (f x)\<close> and \<open>r x = Re (f x)\<close>
     and \<open>ni x = norm (i x)\<close> and \<open>nr x = norm (r x)\<close> and \<open>n x = norm (f x)\<close> for x
   from \<open>f summable_on A\<close> have \<open>i summable_on A\<close>
     by (simp add: i_def[abs_def] summable_on_Im)
   then have [simp]: \<open>ni summable_on A\<close>
     using ni_def[abs_def] summable_on_iff_abs_summable_on_real by force
 
   from \<open>f summable_on A\<close> have \<open>r summable_on A\<close>
     by (simp add: r_def[abs_def] summable_on_Re)
   then have [simp]: \<open>nr summable_on A\<close>
     by (metis nr_def summable_on_cong summable_on_iff_abs_summable_on_real)
 
   have n_sum: \<open>n x \<le> nr x + ni x\<close> for x
     by (simp add: n_def nr_def ni_def r_def i_def cmod_le)
 
   have *: \<open>(\<lambda>x. nr x + ni x) summable_on A\<close>
     apply (rule summable_on_add) by auto
   show \<open>n summable_on A\<close>
     apply (rule nonneg_bdd_above_summable_on)
      apply (simp add: n_def; fail)
     apply (rule bdd_aboveI[where M=\<open>infsum (\<lambda>x. nr x + ni x) A\<close>])
     using * n_sum by (auto simp flip: infsum_finite simp: ni_def[abs_def] nr_def[abs_def] intro!: infsum_mono_neutral)
 next
   show \<open>f abs_summable_on A \<Longrightarrow> f summable_on A\<close>
     using abs_summable_summable by blast
 qed
 
 lemma summable_countable_complex:
   fixes f :: \<open>'a \<Rightarrow> complex\<close>
   assumes \<open>f summable_on A\<close>
   shows \<open>countable {x\<in>A. f x \<noteq> 0}\<close>
   using abs_summable_countable assms summable_on_iff_abs_summable_on_complex by blast
 
 end
 
diff --git a/src/HOL/Analysis/Interval_Integral.thy b/src/HOL/Analysis/Interval_Integral.thy
--- a/src/HOL/Analysis/Interval_Integral.thy
+++ b/src/HOL/Analysis/Interval_Integral.thy
@@ -1,1129 +1,1129 @@
 (*  Title:      HOL/Analysis/Interval_Integral.thy
     Author:     Jeremy Avigad (CMU), Johannes Hölzl (TUM), Luke Serafin (CMU)
 
 Lebesgue integral over an interval (with endpoints possibly +-\<infinity>)
 *)
 
 theory Interval_Integral (*FIX ME rename? Lebesgue  *)
   imports Equivalence_Lebesgue_Henstock_Integration
 begin
 
 definition "einterval a b = {x. a < ereal x \<and> ereal x < b}"
 
 lemma einterval_eq[simp]:
   shows einterval_eq_Icc: "einterval (ereal a) (ereal b) = {a <..< b}"
     and einterval_eq_Ici: "einterval (ereal a) \<infinity> = {a <..}"
     and einterval_eq_Iic: "einterval (- \<infinity>) (ereal b) = {..< b}"
     and einterval_eq_UNIV: "einterval (- \<infinity>) \<infinity> = UNIV"
   by (auto simp: einterval_def)
 
 lemma einterval_same: "einterval a a = {}"
   by (auto simp: einterval_def)
 
 lemma einterval_iff: "x \<in> einterval a b \<longleftrightarrow> a < ereal x \<and> ereal x < b"
   by (simp add: einterval_def)
 
 lemma einterval_nonempty: "a < b \<Longrightarrow> \<exists>c. c \<in> einterval a b"
   by (cases a b rule: ereal2_cases, auto simp: einterval_def intro!: dense gt_ex lt_ex)
 
 lemma open_einterval[simp]: "open (einterval a b)"
   by (cases a b rule: ereal2_cases)
      (auto simp: einterval_def intro!: open_Collect_conj open_Collect_less continuous_intros)
 
 lemma borel_einterval[measurable]: "einterval a b \<in> sets borel"
   unfolding einterval_def by measurable
 
 subsection \<open>Approximating a (possibly infinite) interval\<close>
 
 lemma filterlim_sup1: "(LIM x F. f x :> G1) \<Longrightarrow> (LIM x F. f x :> (sup G1 G2))"
  unfolding filterlim_def by (auto intro: le_supI1)
 
 lemma ereal_incseq_approx:
   fixes a b :: ereal
   assumes "a < b"
   obtains X :: "nat \<Rightarrow> real" where "incseq X" "\<And>i. a < X i" "\<And>i. X i < b" "X \<longlonglongrightarrow> b"
 proof (cases b)
   case PInf
   with \<open>a < b\<close> have "a = -\<infinity> \<or> (\<exists>r. a = ereal r)"
     by (cases a) auto
   moreover have "(\<lambda>x. ereal (real (Suc x))) \<longlonglongrightarrow> \<infinity>"
     by (simp add: Lim_PInfty filterlim_sequentially_Suc) (metis le_SucI of_nat_Suc of_nat_mono order_trans real_arch_simple)
   moreover have "\<And>r. (\<lambda>x. ereal (r + real (Suc x))) \<longlonglongrightarrow> \<infinity>"
     by (simp add: filterlim_sequentially_Suc Lim_PInfty) (metis add.commute diff_le_eq nat_ceiling_le_eq)
   ultimately show thesis
     by (intro that[of "\<lambda>i. real_of_ereal a + Suc i"])
        (auto simp: incseq_def PInf)
 next
   case (real b')
   define d where "d = b' - (if a = -\<infinity> then b' - 1 else real_of_ereal a)"
   with \<open>a < b\<close> have a': "0 < d"
     by (cases a) (auto simp: real)
   moreover
   have "\<And>i r. r < b' \<Longrightarrow> (b' - r) * 1 < (b' - r) * real (Suc (Suc i))"
     by (intro mult_strict_left_mono) auto
   with \<open>a < b\<close> a' have "\<And>i. a < ereal (b' - d / real (Suc (Suc i)))"
     by (cases a) (auto simp: real d_def field_simps)
   moreover
   have "(\<lambda>i. b' - d / real i) \<longlonglongrightarrow> b'"
     by (force intro: tendsto_eq_intros tendsto_divide_0[OF tendsto_const] filterlim_sup1
               simp: at_infinity_eq_at_top_bot filterlim_real_sequentially)
   then have "(\<lambda>i. b' - d / Suc (Suc i)) \<longlonglongrightarrow> b'"
     by (blast intro: dest: filterlim_sequentially_Suc [THEN iffD2])
   ultimately show thesis
     by (intro that[of "\<lambda>i. b' - d / Suc (Suc i)"])
        (auto simp: real incseq_def intro!: divide_left_mono)
 qed (use \<open>a < b\<close> in auto)
 
 lemma ereal_decseq_approx:
   fixes a b :: ereal
   assumes "a < b"
   obtains X :: "nat \<Rightarrow> real" where
     "decseq X" "\<And>i. a < X i" "\<And>i. X i < b" "X \<longlonglongrightarrow> a"
 proof -
   have "-b < -a" using \<open>a < b\<close> by simp
   from ereal_incseq_approx[OF this] obtain X where
     "incseq X"
     "\<And>i. - b < ereal (X i)"
     "\<And>i. ereal (X i) < - a"
     "(\<lambda>x. ereal (X x)) \<longlonglongrightarrow> - a"
     by auto
   then show thesis
     apply (intro that[of "\<lambda>i. - X i"])
     apply (auto simp: decseq_def incseq_def simp flip: uminus_ereal.simps)
     apply (metis ereal_minus_less_minus ereal_uminus_uminus ereal_Lim_uminus)+
     done
 qed
 
 proposition einterval_Icc_approximation:
   fixes a b :: ereal
   assumes "a < b"
   obtains u l :: "nat \<Rightarrow> real" where
     "einterval a b = (\<Union>i. {l i .. u i})"
     "incseq u" "decseq l" "\<And>i. l i < u i" "\<And>i. a < l i" "\<And>i. u i < b"
     "l \<longlonglongrightarrow> a" "u \<longlonglongrightarrow> b"
 proof -
   from dense[OF \<open>a < b\<close>] obtain c where "a < c" "c < b" by safe
   from ereal_incseq_approx[OF \<open>c < b\<close>] obtain u where u:
     "incseq u"
     "\<And>i. c < ereal (u i)"
     "\<And>i. ereal (u i) < b"
     "(\<lambda>x. ereal (u x)) \<longlonglongrightarrow> b"
     by auto
   from ereal_decseq_approx[OF \<open>a < c\<close>] obtain l where l:
     "decseq l"
     "\<And>i. a < ereal (l i)"
     "\<And>i. ereal (l i) < c"
     "(\<lambda>x. ereal (l x)) \<longlonglongrightarrow> a"
     by auto
   { fix i from less_trans[OF \<open>l i < c\<close> \<open>c < u i\<close>] have "l i < u i" by simp }
   have "einterval a b = (\<Union>i. {l i .. u i})"
   proof (auto simp: einterval_iff)
     fix x assume "a < ereal x" "ereal x < b"
     have "eventually (\<lambda>i. ereal (l i) < ereal x) sequentially"
       using l(4) \<open>a < ereal x\<close> by (rule order_tendstoD)
     moreover
     have "eventually (\<lambda>i. ereal x < ereal (u i)) sequentially"
       using u(4) \<open>ereal x< b\<close> by (rule order_tendstoD)
     ultimately have "eventually (\<lambda>i. l i < x \<and> x < u i) sequentially"
       by eventually_elim auto
     then show "\<exists>i. l i \<le> x \<and> x \<le> u i"
       by (auto intro: less_imp_le simp: eventually_sequentially)
   next
     fix x i assume "l i \<le> x" "x \<le> u i"
     with \<open>a < ereal (l i)\<close> \<open>ereal (u i) < b\<close>
     show "a < ereal x" "ereal x < b"
       by (auto simp flip: ereal_less_eq(3))
   qed
   show thesis
     by (intro that) fact+
 qed
 
 (* TODO: in this definition, it would be more natural if einterval a b included a and b when
    they are real. *)
 definition\<^marker>\<open>tag important\<close> interval_lebesgue_integral :: "real measure \<Rightarrow> ereal \<Rightarrow> ereal \<Rightarrow> (real \<Rightarrow> 'a) \<Rightarrow> 'a::{banach, second_countable_topology}" where
   "interval_lebesgue_integral M a b f =
     (if a \<le> b then (LINT x:einterval a b|M. f x) else - (LINT x:einterval b a|M. f x))"
 
 syntax
   "_ascii_interval_lebesgue_integral" :: "pttrn \<Rightarrow> real \<Rightarrow> real \<Rightarrow> real measure \<Rightarrow> real \<Rightarrow> real"
   ("(5LINT _=_.._|_. _)" [0,60,60,61,100] 60)
 
 translations
   "LINT x=a..b|M. f" == "CONST interval_lebesgue_integral M a b (\<lambda>x. f)"
 
 definition\<^marker>\<open>tag important\<close> interval_lebesgue_integrable :: "real measure \<Rightarrow> ereal \<Rightarrow> ereal \<Rightarrow> (real \<Rightarrow> 'a::{banach, second_countable_topology}) \<Rightarrow> bool" where
   "interval_lebesgue_integrable M a b f =
     (if a \<le> b then set_integrable M (einterval a b) f else set_integrable M (einterval b a) f)"
 
 syntax
   "_ascii_interval_lebesgue_borel_integral" :: "pttrn \<Rightarrow> real \<Rightarrow> real \<Rightarrow> real \<Rightarrow> real"
   ("(4LBINT _=_.._. _)" [0,60,60,61] 60)
 
 translations
   "LBINT x=a..b. f" == "CONST interval_lebesgue_integral CONST lborel a b (\<lambda>x. f)"
 
 subsection\<open>Basic properties of integration over an interval\<close>
 
 lemma interval_lebesgue_integral_cong:
   "a \<le> b \<Longrightarrow> (\<And>x. x \<in> einterval a b \<Longrightarrow> f x = g x) \<Longrightarrow> einterval a b \<in> sets M \<Longrightarrow>
     interval_lebesgue_integral M a b f = interval_lebesgue_integral M a b g"
   by (auto intro: set_lebesgue_integral_cong simp: interval_lebesgue_integral_def)
 
 lemma interval_lebesgue_integral_cong_AE:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow>
     a \<le> b \<Longrightarrow> AE x \<in> einterval a b in M. f x = g x \<Longrightarrow> einterval a b \<in> sets M \<Longrightarrow>
     interval_lebesgue_integral M a b f = interval_lebesgue_integral M a b g"
   by (auto intro: set_lebesgue_integral_cong_AE simp: interval_lebesgue_integral_def)
 
 lemma interval_integrable_mirror:
   shows "interval_lebesgue_integrable lborel a b (\<lambda>x. f (-x)) \<longleftrightarrow>
     interval_lebesgue_integrable lborel (-b) (-a) f"
 proof -
   have *: "indicator (einterval a b) (- x) = (indicator (einterval (-b) (-a)) x :: real)"
     for a b :: ereal and x :: real
     by (cases a b rule: ereal2_cases) (auto simp: einterval_def split: split_indicator)
   show ?thesis
     unfolding interval_lebesgue_integrable_def
     using lborel_integrable_real_affine_iff[symmetric, of "-1" "\<lambda>x. indicator (einterval _ _) x *\<^sub>R f x" 0]
     by (simp add: * set_integrable_def)
 qed
 
 lemma interval_lebesgue_integral_add [intro, simp]:
   fixes M a b f
   assumes "interval_lebesgue_integrable M a b f" "interval_lebesgue_integrable M a b g"
   shows "interval_lebesgue_integrable M a b (\<lambda>x. f x + g x)" and
     "interval_lebesgue_integral M a b (\<lambda>x. f x + g x) =
    interval_lebesgue_integral M a b f + interval_lebesgue_integral M a b g"
 using assms by (auto simp: interval_lebesgue_integral_def interval_lebesgue_integrable_def
     field_simps)
 
 lemma interval_lebesgue_integral_diff [intro, simp]:
   fixes M a b f
   assumes "interval_lebesgue_integrable M a b f"
     "interval_lebesgue_integrable M a b g"
   shows "interval_lebesgue_integrable M a b (\<lambda>x. f x - g x)" and
     "interval_lebesgue_integral M a b (\<lambda>x. f x - g x) =
    interval_lebesgue_integral M a b f - interval_lebesgue_integral M a b g"
 using assms by (auto simp: interval_lebesgue_integral_def interval_lebesgue_integrable_def
     field_simps)
 
 lemma interval_lebesgue_integrable_mult_right [intro, simp]:
   fixes M a b c and f :: "real \<Rightarrow> 'a::{banach, real_normed_field, second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> interval_lebesgue_integrable M a b f) \<Longrightarrow>
     interval_lebesgue_integrable M a b (\<lambda>x. c * f x)"
   by (simp add: interval_lebesgue_integrable_def)
 
 lemma interval_lebesgue_integrable_mult_left [intro, simp]:
   fixes M a b c and f :: "real \<Rightarrow> 'a::{banach, real_normed_field, second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> interval_lebesgue_integrable M a b f) \<Longrightarrow>
     interval_lebesgue_integrable M a b (\<lambda>x. f x * c)"
   by (simp add: interval_lebesgue_integrable_def)
 
 lemma interval_lebesgue_integrable_divide [intro, simp]:
   fixes M a b c and f :: "real \<Rightarrow> 'a::{banach, real_normed_field, field, second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> interval_lebesgue_integrable M a b f) \<Longrightarrow>
     interval_lebesgue_integrable M a b (\<lambda>x. f x / c)"
   by (simp add: interval_lebesgue_integrable_def)
 
 lemma interval_lebesgue_integral_mult_right [simp]:
   fixes M a b c and f :: "real \<Rightarrow> 'a::{banach, real_normed_field, second_countable_topology}"
   shows "interval_lebesgue_integral M a b (\<lambda>x. c * f x) =
     c * interval_lebesgue_integral M a b f"
   by (simp add: interval_lebesgue_integral_def)
 
 lemma interval_lebesgue_integral_mult_left [simp]:
   fixes M a b c and f :: "real \<Rightarrow> 'a::{banach, real_normed_field, second_countable_topology}"
   shows "interval_lebesgue_integral M a b (\<lambda>x. f x * c) =
     interval_lebesgue_integral M a b f * c"
   by (simp add: interval_lebesgue_integral_def)
 
 lemma interval_lebesgue_integral_divide [simp]:
   fixes M a b c and f :: "real \<Rightarrow> 'a::{banach, real_normed_field, field, second_countable_topology}"
   shows "interval_lebesgue_integral M a b (\<lambda>x. f x / c) =
     interval_lebesgue_integral M a b f / c"
   by (simp add: interval_lebesgue_integral_def)
 
 lemma interval_lebesgue_integral_uminus:
   "interval_lebesgue_integral M a b (\<lambda>x. - f x) = - interval_lebesgue_integral M a b f"
   by (auto simp: interval_lebesgue_integral_def interval_lebesgue_integrable_def set_lebesgue_integral_def)
 
 lemma interval_lebesgue_integral_of_real:
   "interval_lebesgue_integral M a b (\<lambda>x. complex_of_real (f x)) =
     of_real (interval_lebesgue_integral M a b f)"
   unfolding interval_lebesgue_integral_def
   by (auto simp: interval_lebesgue_integral_def set_integral_complex_of_real)
 
 lemma interval_lebesgue_integral_le_eq:
   fixes a b f
   assumes "a \<le> b"
   shows "interval_lebesgue_integral M a b f = (LINT x : einterval a b | M. f x)"
   using assms by (auto simp: interval_lebesgue_integral_def)
 
 lemma interval_lebesgue_integral_gt_eq:
   fixes a b f
   assumes "a > b"
   shows "interval_lebesgue_integral M a b f = -(LINT x : einterval b a | M. f x)"
 using assms by (auto simp: interval_lebesgue_integral_def less_imp_le einterval_def)
 
 lemma interval_lebesgue_integral_gt_eq':
   fixes a b f
   assumes "a > b"
   shows "interval_lebesgue_integral M a b f = - interval_lebesgue_integral M b a f"
 using assms by (auto simp: interval_lebesgue_integral_def less_imp_le einterval_def)
 
 lemma interval_integral_endpoints_same [simp]: "(LBINT x=a..a. f x) = 0"
   by (simp add: interval_lebesgue_integral_def set_lebesgue_integral_def einterval_same)
 
 lemma interval_integral_endpoints_reverse: "(LBINT x=a..b. f x) = -(LBINT x=b..a. f x)"
   by (cases a b rule: linorder_cases) (auto simp: interval_lebesgue_integral_def set_lebesgue_integral_def einterval_same)
 
 lemma interval_integrable_endpoints_reverse:
   "interval_lebesgue_integrable lborel a b f \<longleftrightarrow>
     interval_lebesgue_integrable lborel b a f"
   by (cases a b rule: linorder_cases) (auto simp: interval_lebesgue_integrable_def einterval_same)
 
 lemma interval_integral_reflect:
   "(LBINT x=a..b. f x) = (LBINT x=-b..-a. f (-x))"
 proof (induct a b rule: linorder_wlog)
   case (sym a b) then show ?case
     by (auto simp: interval_lebesgue_integral_def interval_integrable_endpoints_reverse
              split: if_split_asm)
 next
   case (le a b) 
   have "LBINT x:{x. - x \<in> einterval a b}. f (- x) = LBINT x:einterval (- b) (- a). f (- x)"
     unfolding interval_lebesgue_integrable_def set_lebesgue_integral_def
     apply (rule Bochner_Integration.integral_cong [OF refl])
     by (auto simp: einterval_iff ereal_uminus_le_reorder ereal_uminus_less_reorder not_less
              simp flip: uminus_ereal.simps
              split: split_indicator)
   then show ?case
     unfolding interval_lebesgue_integral_def 
     by (subst set_integral_reflect) (simp add: le)
 qed
 
 lemma interval_lebesgue_integral_0_infty:
   "interval_lebesgue_integrable M 0 \<infinity> f \<longleftrightarrow> set_integrable M {0<..} f"
   "interval_lebesgue_integral M 0 \<infinity> f = (LINT x:{0<..}|M. f x)"
   unfolding zero_ereal_def
   by (auto simp: interval_lebesgue_integral_le_eq interval_lebesgue_integrable_def)
 
 lemma interval_integral_to_infinity_eq: "(LINT x=ereal a..\<infinity> | M. f x) = (LINT x : {a<..} | M. f x)"
   unfolding interval_lebesgue_integral_def by auto
 
 proposition interval_integrable_to_infinity_eq: "(interval_lebesgue_integrable M a \<infinity> f) =
   (set_integrable M {a<..} f)"
   unfolding interval_lebesgue_integrable_def by auto
 
 subsection\<open>Basic properties of integration over an interval wrt lebesgue measure\<close>
 
 lemma interval_integral_zero [simp]:
   fixes a b :: ereal
   shows "LBINT x=a..b. 0 = 0"
 unfolding interval_lebesgue_integral_def set_lebesgue_integral_def einterval_eq
 by simp
 
 lemma interval_integral_const [intro, simp]:
   fixes a b c :: real
   shows "interval_lebesgue_integrable lborel a b (\<lambda>x. c)" and "LBINT x=a..b. c = c * (b - a)"
   unfolding interval_lebesgue_integral_def interval_lebesgue_integrable_def einterval_eq
   by (auto simp: less_imp_le field_simps measure_def set_integrable_def set_lebesgue_integral_def)
 
 lemma interval_integral_cong_AE:
   assumes [measurable]: "f \<in> borel_measurable borel" "g \<in> borel_measurable borel"
   assumes "AE x \<in> einterval (min a b) (max a b) in lborel. f x = g x"
   shows "interval_lebesgue_integral lborel a b f = interval_lebesgue_integral lborel a b g"
   using assms
 proof (induct a b rule: linorder_wlog)
   case (sym a b) then show ?case
     by (simp add: min.commute max.commute interval_integral_endpoints_reverse[of a b])
 next
   case (le a b) then show ?case
     by (auto simp: interval_lebesgue_integral_def max_def min_def
              intro!: set_lebesgue_integral_cong_AE)
 qed
 
 lemma interval_integral_cong:
   assumes "\<And>x. x \<in> einterval (min a b) (max a b) \<Longrightarrow> f x = g x"
   shows "interval_lebesgue_integral lborel a b f = interval_lebesgue_integral lborel a b g"
   using assms
 proof (induct a b rule: linorder_wlog)
   case (sym a b) then show ?case
     by (simp add: min.commute max.commute interval_integral_endpoints_reverse[of a b])
 next
   case (le a b) then show ?case
     by (auto simp: interval_lebesgue_integral_def max_def min_def
              intro!: set_lebesgue_integral_cong)
 qed
 
 lemma interval_lebesgue_integrable_cong_AE:
     "f \<in> borel_measurable lborel \<Longrightarrow> g \<in> borel_measurable lborel \<Longrightarrow>
     AE x \<in> einterval (min a b) (max a b) in lborel. f x = g x \<Longrightarrow>
     interval_lebesgue_integrable lborel a b f = interval_lebesgue_integrable lborel a b g"
   apply (simp add: interval_lebesgue_integrable_def)
   apply (intro conjI impI set_integrable_cong_AE)
   apply (auto simp: min_def max_def)
   done
 
 lemma interval_integrable_abs_iff:
   fixes f :: "real \<Rightarrow> real"
   shows  "f \<in> borel_measurable lborel \<Longrightarrow>
     interval_lebesgue_integrable lborel a b (\<lambda>x. \<bar>f x\<bar>) = interval_lebesgue_integrable lborel a b f"
   unfolding interval_lebesgue_integrable_def
   by (subst (1 2) set_integrable_abs_iff') simp_all
 
 lemma interval_integral_Icc:
   fixes a b :: real
   shows "a \<le> b \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {a..b}. f x)"
   by (auto intro!: set_integral_discrete_difference[where X="{a, b}"]
            simp add: interval_lebesgue_integral_def)
 
 lemma interval_integral_Icc':
   "a \<le> b \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {x. a \<le> ereal x \<and> ereal x \<le> b}. f x)"
   by (auto intro!: set_integral_discrete_difference[where X="{real_of_ereal a, real_of_ereal b}"]
            simp add: interval_lebesgue_integral_def einterval_iff)
 
 lemma interval_integral_Ioc:
   "a \<le> b \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {a<..b}. f x)"
   by (auto intro!: set_integral_discrete_difference[where X="{a, b}"]
            simp add: interval_lebesgue_integral_def einterval_iff)
 
 (* TODO: other versions as well? *) (* Yes: I need the Icc' version. *)
 lemma interval_integral_Ioc':
   "a \<le> b \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {x. a < ereal x \<and> ereal x \<le> b}. f x)"
   by (auto intro!: set_integral_discrete_difference[where X="{real_of_ereal a, real_of_ereal b}"]
            simp add: interval_lebesgue_integral_def einterval_iff)
 
 lemma interval_integral_Ico:
   "a \<le> b \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {a..<b}. f x)"
   by (auto intro!: set_integral_discrete_difference[where X="{a, b}"]
            simp add: interval_lebesgue_integral_def einterval_iff)
 
 lemma interval_integral_Ioi:
   "\<bar>a\<bar> < \<infinity> \<Longrightarrow> (LBINT x=a..\<infinity>. f x) = (LBINT x : {real_of_ereal a <..}. f x)"
   by (auto simp: interval_lebesgue_integral_def einterval_iff)
 
 lemma interval_integral_Ioo:
   "a \<le> b \<Longrightarrow> \<bar>a\<bar> < \<infinity> ==> \<bar>b\<bar> < \<infinity> \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {real_of_ereal a <..< real_of_ereal b}. f x)"
   by (auto simp: interval_lebesgue_integral_def einterval_iff)
 
 lemma interval_integral_discrete_difference:
   fixes f :: "real \<Rightarrow> 'b::{banach, second_countable_topology}" and a b :: ereal
   assumes "countable X"
   and eq: "\<And>x. a \<le> b \<Longrightarrow> a < x \<Longrightarrow> x < b \<Longrightarrow> x \<notin> X \<Longrightarrow> f x = g x"
   and anti_eq: "\<And>x. b \<le> a \<Longrightarrow> b < x \<Longrightarrow> x < a \<Longrightarrow> x \<notin> X \<Longrightarrow> f x = g x"
   assumes "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0" "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   shows "interval_lebesgue_integral M a b f = interval_lebesgue_integral M a b g"
   unfolding interval_lebesgue_integral_def set_lebesgue_integral_def
   apply (intro if_cong refl arg_cong[where f="\<lambda>x. - x"] integral_discrete_difference[of X] assms)
   apply (auto simp: eq anti_eq einterval_iff split: split_indicator)
   done
 
 lemma interval_integral_sum:
   fixes a b c :: ereal
   assumes integrable: "interval_lebesgue_integrable lborel (min a (min b c)) (max a (max b c)) f"
   shows "(LBINT x=a..b. f x) + (LBINT x=b..c. f x) = (LBINT x=a..c. f x)"
 proof -
   let ?I = "\<lambda>a b. LBINT x=a..b. f x"
   { fix a b c :: ereal assume "interval_lebesgue_integrable lborel a c f" "a \<le> b" "b \<le> c"
     then have ord: "a \<le> b" "b \<le> c" "a \<le> c" and f': "set_integrable lborel (einterval a c) f"
       by (auto simp: interval_lebesgue_integrable_def)
     then have f: "set_borel_measurable borel (einterval a c) f"
       unfolding set_integrable_def set_borel_measurable_def
       by (drule_tac borel_measurable_integrable) simp
     have "(LBINT x:einterval a c. f x) = (LBINT x:einterval a b \<union> einterval b c. f x)"
     proof (rule set_integral_cong_set)
       show "AE x in lborel. (x \<in> einterval a b \<union> einterval b c) = (x \<in> einterval a c)"
         using AE_lborel_singleton[of "real_of_ereal b"] ord
         by (cases a b c rule: ereal3_cases) (auto simp: einterval_iff)
       show "set_borel_measurable lborel (einterval a c) f" "set_borel_measurable lborel (einterval a b \<union> einterval b c) f"
         unfolding set_borel_measurable_def
         using ord by (auto simp: einterval_iff intro!: set_borel_measurable_subset[OF f, unfolded set_borel_measurable_def])
     qed
     also have "\<dots> = (LBINT x:einterval a b. f x) + (LBINT x:einterval b c. f x)"
       using ord
       by (intro set_integral_Un_AE) (auto intro!: set_integrable_subset[OF f'] simp: einterval_iff not_less)
     finally have "?I a b + ?I b c = ?I a c"
       using ord by (simp add: interval_lebesgue_integral_def)
   } note 1 = this
   { fix a b c :: ereal assume "interval_lebesgue_integrable lborel a c f" "a \<le> b" "b \<le> c"
     from 1[OF this] have "?I b c + ?I a b = ?I a c"
       by (metis add.commute)
   } note 2 = this
   have 3: "\<And>a b. b \<le> a \<Longrightarrow> (LBINT x=a..b. f x) = - (LBINT x=b..a. f x)"
     by (rule interval_integral_endpoints_reverse)
   show ?thesis
     using integrable
     apply (cases a b b c a c rule: linorder_le_cases[case_product linorder_le_cases linorder_cases])
     apply simp_all (* remove some looping cases *)
     by (simp_all add: min_absorb1 min_absorb2 max_absorb1 max_absorb2 field_simps 1 2 3)
 qed
 
 lemma interval_integrable_isCont:
   fixes a b and f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   shows "(\<And>x. min a b \<le> x \<Longrightarrow> x \<le> max a b \<Longrightarrow> isCont f x) \<Longrightarrow>
     interval_lebesgue_integrable lborel a b f"
 proof (induct a b rule: linorder_wlog)
   case (le a b) then show ?case
     unfolding interval_lebesgue_integrable_def set_integrable_def
     by (auto simp: interval_lebesgue_integrable_def
         intro!: set_integrable_subset[unfolded set_integrable_def, OF borel_integrable_compact[of "{a .. b}"]]
         continuous_at_imp_continuous_on)
 qed (auto intro: interval_integrable_endpoints_reverse[THEN iffD1])
 
 lemma interval_integrable_continuous_on:
   fixes a b :: real and f
   assumes "a \<le> b" and "continuous_on {a..b} f"
   shows "interval_lebesgue_integrable lborel a b f"
 using assms unfolding interval_lebesgue_integrable_def apply simp
   by (rule set_integrable_subset, rule borel_integrable_atLeastAtMost' [of a b], auto)
 
 lemma interval_integral_eq_integral:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "a \<le> b \<Longrightarrow> set_integrable lborel {a..b} f \<Longrightarrow> LBINT x=a..b. f x = integral {a..b} f"
   by (subst interval_integral_Icc, simp) (rule set_borel_integral_eq_integral)
 
 lemma interval_integral_eq_integral':
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "a \<le> b \<Longrightarrow> set_integrable lborel (einterval a b) f \<Longrightarrow> LBINT x=a..b. f x = integral (einterval a b) f"
   by (subst interval_lebesgue_integral_le_eq, simp) (rule set_borel_integral_eq_integral)
 
 
 subsection\<open>General limit approximation arguments\<close>
 
 proposition interval_integral_Icc_approx_nonneg:
   fixes a b :: ereal
   assumes "a < b"
   fixes u l :: "nat \<Rightarrow> real"
   assumes  approx: "einterval a b = (\<Union>i. {l i .. u i})"
     "incseq u" "decseq l" "\<And>i. l i < u i" "\<And>i. a < l i" "\<And>i. u i < b"
     "l \<longlonglongrightarrow> a" "u \<longlonglongrightarrow> b"
   fixes f :: "real \<Rightarrow> real"
   assumes f_integrable: "\<And>i. set_integrable lborel {l i..u i} f"
   assumes f_nonneg: "AE x in lborel. a < ereal x \<longrightarrow> ereal x < b \<longrightarrow> 0 \<le> f x"
   assumes f_measurable: "set_borel_measurable lborel (einterval a b) f"
   assumes lbint_lim: "(\<lambda>i. LBINT x=l i.. u i. f x) \<longlonglongrightarrow> C"
   shows
     "set_integrable lborel (einterval a b) f"
     "(LBINT x=a..b. f x) = C"
 proof -
   have 1 [unfolded set_integrable_def]: "\<And>i. set_integrable lborel {l i..u i} f" by (rule f_integrable)
   have 2: "AE x in lborel. mono (\<lambda>n. indicator {l n..u n} x *\<^sub>R f x)"
   proof -
      from f_nonneg have "AE x in lborel. \<forall>i. l i \<le> x \<longrightarrow> x \<le> u i \<longrightarrow> 0 \<le> f x"
       by eventually_elim
          (metis approx(5) approx(6) dual_order.strict_trans1 ereal_less_eq(3) le_less_trans)
     then show ?thesis
       apply eventually_elim
       apply (auto simp: mono_def split: split_indicator)
       apply (metis approx(3) decseqD order_trans)
       apply (metis approx(2) incseqD order_trans)
       done
   qed
   have 3: "AE x in lborel. (\<lambda>i. indicator {l i..u i} x *\<^sub>R f x) \<longlonglongrightarrow> indicator (einterval a b) x *\<^sub>R f x"
   proof -
     { fix x i assume "l i \<le> x" "x \<le> u i"
       then have "eventually (\<lambda>i. l i \<le> x \<and> x \<le> u i) sequentially"
         apply (auto simp: eventually_sequentially intro!: exI[of _ i])
         apply (metis approx(3) decseqD order_trans)
         apply (metis approx(2) incseqD order_trans)
         done
       then have "eventually (\<lambda>i. f x * indicator {l i..u i} x = f x) sequentially"
         by eventually_elim auto }
     then show ?thesis
       unfolding approx(1) by (auto intro!: AE_I2 tendsto_eventually split: split_indicator)
   qed
   have 4: "(\<lambda>i. \<integral> x. indicator {l i..u i} x *\<^sub>R f x \<partial>lborel) \<longlonglongrightarrow> C"
     using lbint_lim by (simp add: interval_integral_Icc [unfolded set_lebesgue_integral_def] approx less_imp_le)
   have 5: "(\<lambda>x. indicat_real (einterval a b) x *\<^sub>R f x) \<in> borel_measurable lborel"
     using f_measurable set_borel_measurable_def by blast
   have "(LBINT x=a..b. f x) = lebesgue_integral lborel (\<lambda>x. indicator (einterval a b) x *\<^sub>R f x)"
     using assms by (simp add: interval_lebesgue_integral_def set_lebesgue_integral_def less_imp_le)
   also have "\<dots> = C"
     by (rule integral_monotone_convergence [OF 1 2 3 4 5])
   finally show "(LBINT x=a..b. f x) = C" .
   show "set_integrable lborel (einterval a b) f"
     unfolding set_integrable_def
     by (rule integrable_monotone_convergence[OF 1 2 3 4 5])
 qed
 
 proposition interval_integral_Icc_approx_integrable:
   fixes u l :: "nat \<Rightarrow> real" and a b :: ereal
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes "a < b"
   assumes  approx: "einterval a b = (\<Union>i. {l i .. u i})"
     "incseq u" "decseq l" "\<And>i. l i < u i" "\<And>i. a < l i" "\<And>i. u i < b"
     "l \<longlonglongrightarrow> a" "u \<longlonglongrightarrow> b"
   assumes f_integrable: "set_integrable lborel (einterval a b) f"
   shows "(\<lambda>i. LBINT x=l i.. u i. f x) \<longlonglongrightarrow> (LBINT x=a..b. f x)"
 proof -
   have "(\<lambda>i. LBINT x:{l i.. u i}. f x) \<longlonglongrightarrow> (LBINT x:einterval a b. f x)"
     unfolding set_lebesgue_integral_def
   proof (rule integral_dominated_convergence)
     show "integrable lborel (\<lambda>x. norm (indicator (einterval a b) x *\<^sub>R f x))"
       using f_integrable integrable_norm set_integrable_def by blast
     show "(\<lambda>x. indicat_real (einterval a b) x *\<^sub>R f x) \<in> borel_measurable lborel"
       using f_integrable by (simp add: set_integrable_def)
     then show "\<And>i. (\<lambda>x. indicat_real {l i..u i} x *\<^sub>R f x) \<in> borel_measurable lborel"
       by (rule set_borel_measurable_subset [unfolded set_borel_measurable_def]) (auto simp: approx)
     show "\<And>i. AE x in lborel. norm (indicator {l i..u i} x *\<^sub>R f x) \<le> norm (indicator (einterval a b) x *\<^sub>R f x)"
       by (intro AE_I2) (auto simp: approx split: split_indicator)
     show "AE x in lborel. (\<lambda>i. indicator {l i..u i} x *\<^sub>R f x) \<longlonglongrightarrow> indicator (einterval a b) x *\<^sub>R f x"
     proof (intro AE_I2 tendsto_intros tendsto_eventually)
       fix x
       { fix i assume "l i \<le> x" "x \<le> u i"
         with \<open>incseq u\<close>[THEN incseqD, of i] \<open>decseq l\<close>[THEN decseqD, of i]
         have "eventually (\<lambda>i. l i \<le> x \<and> x \<le> u i) sequentially"
           by (auto simp: eventually_sequentially decseq_def incseq_def intro: order_trans) }
       then show "eventually (\<lambda>xa. indicator {l xa..u xa} x = (indicator (einterval a b) x::real)) sequentially"
         using approx order_tendstoD(2)[OF \<open>l \<longlonglongrightarrow> a\<close>, of x] order_tendstoD(1)[OF \<open>u \<longlonglongrightarrow> b\<close>, of x]
         by (auto split: split_indicator)
     qed
   qed
   with \<open>a < b\<close> \<open>\<And>i. l i < u i\<close> show ?thesis
     by (simp add: interval_lebesgue_integral_le_eq[symmetric] interval_integral_Icc less_imp_le)
 qed
 
 subsection\<open>A slightly stronger Fundamental Theorem of Calculus\<close>
 
 text\<open>Three versions: first, for finite intervals, and then two versions for
     arbitrary intervals.\<close>
 
 (*
   TODO: make the older versions corollaries of these (using continuous_at_imp_continuous_on, etc.)
 *)
 
 lemma interval_integral_FTC_finite:
   fixes f F :: "real \<Rightarrow> 'a::euclidean_space" and a b :: real
   assumes f: "continuous_on {min a b..max a b} f"
   assumes F: "\<And>x. min a b \<le> x \<Longrightarrow> x \<le> max a b \<Longrightarrow> (F has_vector_derivative (f x)) (at x within
     {min a b..max a b})"
   shows "(LBINT x=a..b. f x) = F b - F a"
 proof (cases "a \<le> b")
   case True
   have "(LBINT x=a..b. f x) = (LBINT x. indicat_real {a..b} x *\<^sub>R f x)"
     by (simp add: True interval_integral_Icc set_lebesgue_integral_def)
   also have "\<dots> = F b - F a"
   proof (rule integral_FTC_atLeastAtMost [OF True])
     show "continuous_on {a..b} f"
       using True f by linarith
     show "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> (F has_vector_derivative f x) (at x within {a..b})"
       by (metis F True max.commute max_absorb1 min_def)
   qed
   finally show ?thesis .
 next
   case False
   then have "b \<le> a"
     by simp
   have "- interval_lebesgue_integral lborel (ereal b) (ereal a) f = - (LBINT x. indicat_real {b..a} x *\<^sub>R f x)"
     by (simp add: \<open>b \<le> a\<close> interval_integral_Icc set_lebesgue_integral_def)
   also have "\<dots> = F b - F a"
   proof (subst integral_FTC_atLeastAtMost [OF \<open>b \<le> a\<close>])
     show "continuous_on {b..a} f"
       using False f by linarith
     show "\<And>x. \<lbrakk>b \<le> x; x \<le> a\<rbrakk>
          \<Longrightarrow> (F has_vector_derivative f x) (at x within {b..a})"
       by (metis F False max_def min_def)
   qed auto
   finally show ?thesis
     by (metis interval_integral_endpoints_reverse)
 qed
 
 
 lemma interval_integral_FTC_nonneg:
   fixes f F :: "real \<Rightarrow> real" and a b :: ereal
   assumes "a < b"
   assumes F: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> DERIV F x :> f x"
   assumes f: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> isCont f x"
   assumes f_nonneg: "AE x in lborel. a < ereal x \<longrightarrow> ereal x < b \<longrightarrow> 0 \<le> f x"
   assumes A: "((F \<circ> real_of_ereal) \<longlongrightarrow> A) (at_right a)"
   assumes B: "((F \<circ> real_of_ereal) \<longlongrightarrow> B) (at_left b)"
   shows
     "set_integrable lborel (einterval a b) f"
     "(LBINT x=a..b. f x) = B - A"
 proof -
   obtain u l where approx:
     "einterval a b = (\<Union>i. {l i .. u i})"
     "incseq u" "decseq l" "\<And>i. l i < u i" "\<And>i. a < l i" "\<And>i. u i < b"
     "l \<longlonglongrightarrow> a" "u \<longlonglongrightarrow> b" 
     by (blast intro: einterval_Icc_approximation[OF \<open>a < b\<close>])
   have [simp]: "\<And>x i. l i \<le> x \<Longrightarrow> a < ereal x"
     by (rule order_less_le_trans, rule approx, force)
   have [simp]: "\<And>x i. x \<le> u i \<Longrightarrow> ereal x < b"
     by (rule order_le_less_trans, subst ereal_less_eq(3), assumption, rule approx)
   have FTCi: "\<And>i. (LBINT x=l i..u i. f x) = F (u i) - F (l i)"
     using assms approx apply (intro interval_integral_FTC_finite)
     apply (auto simp: less_imp_le min_def max_def
-      has_field_derivative_iff_has_vector_derivative[symmetric])
+      has_real_derivative_iff_has_vector_derivative[symmetric])
     apply (rule continuous_at_imp_continuous_on, auto intro!: f)
     by (rule DERIV_subset [OF F], auto)
   have 1: "\<And>i. set_integrable lborel {l i..u i} f"
   proof -
     fix i show "set_integrable lborel {l i .. u i} f"
       using \<open>a < l i\<close> \<open>u i < b\<close> unfolding set_integrable_def
       by (intro borel_integrable_compact f continuous_at_imp_continuous_on compact_Icc ballI)
          (auto simp flip: ereal_less_eq)
   qed
   have 2: "set_borel_measurable lborel (einterval a b) f"
     unfolding set_borel_measurable_def
     by (auto simp del: real_scaleR_def intro!: borel_measurable_continuous_on_indicator
              simp: continuous_on_eq_continuous_at einterval_iff f)
   have 3: "(\<lambda>i. LBINT x=l i..u i. f x) \<longlonglongrightarrow> B - A"
     apply (subst FTCi)
     apply (intro tendsto_intros)
     using B approx unfolding tendsto_at_iff_sequentially comp_def
     using tendsto_at_iff_sequentially[where 'a=real]
     apply (elim allE[of _ "\<lambda>i. ereal (u i)"], auto)
     using A approx unfolding tendsto_at_iff_sequentially comp_def
     by (elim allE[of _ "\<lambda>i. ereal (l i)"], auto)
   show "(LBINT x=a..b. f x) = B - A"
     by (rule interval_integral_Icc_approx_nonneg [OF \<open>a < b\<close> approx 1 f_nonneg 2 3])
   show "set_integrable lborel (einterval a b) f"
     by (rule interval_integral_Icc_approx_nonneg [OF \<open>a < b\<close> approx 1 f_nonneg 2 3])
 qed
 
 theorem interval_integral_FTC_integrable:
   fixes f F :: "real \<Rightarrow> 'a::euclidean_space" and a b :: ereal
   assumes "a < b"
   assumes F: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> (F has_vector_derivative f x) (at x)"
   assumes f: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> isCont f x"
   assumes f_integrable: "set_integrable lborel (einterval a b) f"
   assumes A: "((F \<circ> real_of_ereal) \<longlongrightarrow> A) (at_right a)"
   assumes B: "((F \<circ> real_of_ereal) \<longlongrightarrow> B) (at_left b)"
   shows "(LBINT x=a..b. f x) = B - A"
 proof -
   obtain u l where approx:
     "einterval a b = (\<Union>i. {l i .. u i})"
     "incseq u" "decseq l" "\<And>i. l i < u i" "\<And>i. a < l i" "\<And>i. u i < b"
     "l \<longlonglongrightarrow> a" "u \<longlonglongrightarrow> b" 
     by (blast intro: einterval_Icc_approximation[OF \<open>a < b\<close>])
   have [simp]: "\<And>x i. l i \<le> x \<Longrightarrow> a < ereal x"
     by (rule order_less_le_trans, rule approx, force)
   have [simp]: "\<And>x i. x \<le> u i \<Longrightarrow> ereal x < b"
     by (rule order_le_less_trans, subst ereal_less_eq(3), assumption, rule approx)
   have FTCi: "\<And>i. (LBINT x=l i..u i. f x) = F (u i) - F (l i)"
     using assms approx
     by (auto simp: less_imp_le min_def max_def
              intro!: f continuous_at_imp_continuous_on interval_integral_FTC_finite
              intro: has_vector_derivative_at_within)
   have "(\<lambda>i. LBINT x=l i..u i. f x) \<longlonglongrightarrow> B - A"
     unfolding FTCi
   proof (intro tendsto_intros)
     show "(\<lambda>x. F (l x)) \<longlonglongrightarrow> A"
       using A approx unfolding tendsto_at_iff_sequentially comp_def
       by (elim allE[of _ "\<lambda>i. ereal (l i)"], auto)
     show "(\<lambda>x. F (u x)) \<longlonglongrightarrow> B"
       using B approx unfolding tendsto_at_iff_sequentially comp_def
       by (elim allE[of _ "\<lambda>i. ereal (u i)"], auto)
   qed
   moreover have "(\<lambda>i. LBINT x=l i..u i. f x) \<longlonglongrightarrow> (LBINT x=a..b. f x)"
     by (rule interval_integral_Icc_approx_integrable [OF \<open>a < b\<close> approx f_integrable])
   ultimately show ?thesis
     by (elim LIMSEQ_unique)
 qed
 
 (*
   The second Fundamental Theorem of Calculus and existence of antiderivatives on an
   einterval.
 *)
 
 theorem interval_integral_FTC2:
   fixes a b c :: real and f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "a \<le> c" "c \<le> b"
   and contf: "continuous_on {a..b} f"
   fixes x :: real
   assumes "a \<le> x" and "x \<le> b"
   shows "((\<lambda>u. LBINT y=c..u. f y) has_vector_derivative (f x)) (at x within {a..b})"
 proof -
   let ?F = "(\<lambda>u. LBINT y=a..u. f y)"
   have intf: "set_integrable lborel {a..b} f"
     by (rule borel_integrable_atLeastAtMost', rule contf)
   have "((\<lambda>u. integral {a..u} f) has_vector_derivative f x) (at x within {a..b})"
     using \<open>a \<le> x\<close> \<open>x \<le> b\<close> 
     by (auto intro: integral_has_vector_derivative continuous_on_subset [OF contf])
   then have "((\<lambda>u. integral {a..u} f) has_vector_derivative (f x)) (at x within {a..b})"
     by simp
   then have "(?F has_vector_derivative (f x)) (at x within {a..b})"
     by (rule has_vector_derivative_weaken)
        (auto intro!: assms interval_integral_eq_integral[symmetric] set_integrable_subset [OF intf])
   then have "((\<lambda>x. (LBINT y=c..a. f y) + ?F x) has_vector_derivative (f x)) (at x within {a..b})"
     by (auto intro!: derivative_eq_intros)
   then show ?thesis
   proof (rule has_vector_derivative_weaken)
     fix u assume "u \<in> {a .. b}"
     then show "(LBINT y=c..a. f y) + (LBINT y=a..u. f y) = (LBINT y=c..u. f y)"
       using assms
       apply (intro interval_integral_sum)
       apply (auto simp: interval_lebesgue_integrable_def simp del: real_scaleR_def)
       by (rule set_integrable_subset [OF intf], auto simp: min_def max_def)
   qed (insert assms, auto)
 qed
 
 proposition einterval_antiderivative:
   fixes a b :: ereal and f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "a < b" and contf: "\<And>x :: real. a < x \<Longrightarrow> x < b \<Longrightarrow> isCont f x"
   shows "\<exists>F. \<forall>x :: real. a < x \<longrightarrow> x < b \<longrightarrow> (F has_vector_derivative f x) (at x)"
 proof -
   from einterval_nonempty [OF \<open>a < b\<close>] obtain c :: real where [simp]: "a < c" "c < b"
     by (auto simp: einterval_def)
   let ?F = "(\<lambda>u. LBINT y=c..u. f y)"
   show ?thesis
   proof (rule exI, clarsimp)
     fix x :: real
     assume [simp]: "a < x" "x < b"
     have 1: "a < min c x" by simp
     from einterval_nonempty [OF 1] obtain d :: real where [simp]: "a < d" "d < c" "d < x"
       by (auto simp: einterval_def)
     have 2: "max c x < b" by simp
     from einterval_nonempty [OF 2] obtain e :: real where [simp]: "c < e" "x < e" "e < b"
       by (auto simp: einterval_def)
     have "(?F has_vector_derivative f x) (at x within {d<..<e})"
     proof (rule has_vector_derivative_within_subset [of _ _ _ "{d..e}"])
       have "continuous_on {d..e} f"
       proof (intro continuous_at_imp_continuous_on ballI contf; clarsimp)
         show "\<And>x. \<lbrakk>d \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> a < ereal x"
           using \<open>a < ereal d\<close> ereal_less_ereal_Ex by auto
         show "\<And>x. \<lbrakk>d \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> ereal x < b"
           using \<open>ereal e < b\<close> ereal_less_eq(3) le_less_trans by blast
       qed
       then show "(?F has_vector_derivative f x) (at x within {d..e})"
         by (intro interval_integral_FTC2) (use \<open>d < c\<close> \<open>c < e\<close> \<open>d < x\<close> \<open>x < e\<close> in \<open>linarith+\<close>)
     qed auto
     then show "(?F has_vector_derivative f x) (at x)"
       by (force simp: has_vector_derivative_within_open [of _ "{d<..<e}"])
   qed
 qed
 
 subsection\<open>The substitution theorem\<close>
 
 text\<open>Once again, three versions: first, for finite intervals, and then two versions for
     arbitrary intervals.\<close>
 
 theorem interval_integral_substitution_finite:
   fixes a b :: real and f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "a \<le> b"
   and derivg: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (g has_real_derivative (g' x)) (at x within {a..b})"
   and contf : "continuous_on (g ` {a..b}) f"
   and contg': "continuous_on {a..b} g'"
   shows "LBINT x=a..b. g' x *\<^sub>R f (g x) = LBINT y=g a..g b. f y"
 proof-
   have v_derivg: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (g has_vector_derivative (g' x)) (at x within {a..b})"
-    using derivg unfolding has_field_derivative_iff_has_vector_derivative .
+    using derivg unfolding has_real_derivative_iff_has_vector_derivative .
   then have contg [simp]: "continuous_on {a..b} g"
     by (rule continuous_on_vector_derivative) auto
   have 1: "\<exists>x\<in>{a..b}. u = g x" if "min (g a) (g b) \<le> u" "u \<le> max (g a) (g b)" for u
     by (cases "g a \<le> g b") (use that assms IVT' [of g a u b]  IVT2' [of g b u a]  in \<open>auto simp: min_def max_def\<close>)
   obtain c d where g_im: "g ` {a..b} = {c..d}" and "c \<le> d"
     by (metis continuous_image_closed_interval contg \<open>a \<le> b\<close>)
   obtain F where derivF:
          "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> (F has_vector_derivative (f (g x))) (at (g x) within (g ` {a..b}))" 
     using continuous_on_subset [OF contf] g_im
       by (metis antiderivative_continuous atLeastAtMost_iff image_subset_iff set_eq_subset)
   have contfg: "continuous_on {a..b} (\<lambda>x. f (g x))"
     by (blast intro: continuous_on_compose2 contf contg)
   have "LBINT x. indicat_real {a..b} x *\<^sub>R g' x *\<^sub>R f (g x) = F (g b) - F (g a)"
     apply (rule integral_FTC_atLeastAtMost
                 [OF \<open>a \<le> b\<close> vector_diff_chain_within[OF v_derivg derivF, unfolded comp_def]])
     apply (auto intro!: continuous_on_scaleR contg' contfg)
     done
   then have "LBINT x=a..b. g' x *\<^sub>R f (g x) = F (g b) - F (g a)"
     by (simp add: assms interval_integral_Icc set_lebesgue_integral_def)
   moreover have "LBINT y=(g a)..(g b). f y = F (g b) - F (g a)"
   proof (rule interval_integral_FTC_finite)
     show "continuous_on {min (g a) (g b)..max (g a) (g b)} f"
       by (rule continuous_on_subset [OF contf]) (auto simp: image_def 1)
     show "(F has_vector_derivative f y) (at y within {min (g a) (g b)..max (g a) (g b)})" 
       if y: "min (g a) (g b) \<le> y" "y \<le> max (g a) (g b)" for y
     proof -
       obtain x where "a \<le> x" "x \<le> b" "y = g x"
         using 1 y by force
       then show ?thesis
         by (auto simp: image_def intro!: 1  has_vector_derivative_within_subset [OF derivF])
     qed
   qed
   ultimately show ?thesis by simp
 qed
 
 (* TODO: is it possible to lift the assumption here that g' is nonnegative? *)
 
 theorem interval_integral_substitution_integrable:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and a b u v :: ereal
   assumes "a < b"
   and deriv_g: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> DERIV g x :> g' x"
   and contf: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> isCont f (g x)"
   and contg': "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> isCont g' x"
   and g'_nonneg: "\<And>x. a \<le> ereal x \<Longrightarrow> ereal x \<le> b \<Longrightarrow> 0 \<le> g' x"
   and A: "((ereal \<circ> g \<circ> real_of_ereal) \<longlongrightarrow> A) (at_right a)"
   and B: "((ereal \<circ> g \<circ> real_of_ereal) \<longlongrightarrow> B) (at_left b)"
   and integrable: "set_integrable lborel (einterval a b) (\<lambda>x. g' x *\<^sub>R f (g x))"
   and integrable2: "set_integrable lborel (einterval A B) (\<lambda>x. f x)"
   shows "(LBINT x=A..B. f x) = (LBINT x=a..b. g' x *\<^sub>R f (g x))"
 proof -
   obtain u l where approx [simp]:
     "einterval a b = (\<Union>i. {l i .. u i})"
     "incseq u" "decseq l" "\<And>i. l i < u i" "\<And>i. a < l i" "\<And>i. u i < b"
     "l \<longlonglongrightarrow> a" "u \<longlonglongrightarrow> b" 
     by (blast intro: einterval_Icc_approximation[OF \<open>a < b\<close>])
   note less_imp_le [simp]
   have [simp]: "\<And>x i. l i \<le> x \<Longrightarrow> a < ereal x"
     by (rule order_less_le_trans, rule approx, force)
   have [simp]: "\<And>x i. x \<le> u i \<Longrightarrow> ereal x < b"
     by (rule order_le_less_trans, subst ereal_less_eq(3), assumption, rule approx)
   then have lessb[simp]: "\<And>i. l i < b"
     using approx(4) less_eq_real_def by blast
   have [simp]: "\<And>i. a < u i"
     by (rule order_less_trans, rule approx, auto, rule approx)
   have lle[simp]: "\<And>i j. i \<le> j \<Longrightarrow> l j \<le> l i" by (rule decseqD, rule approx)
   have [simp]: "\<And>i j. i \<le> j \<Longrightarrow> u i \<le> u j" by (rule incseqD, rule approx)
   have g_nondec [simp]: "g x \<le> g y" if "a < x" "x \<le> y" "y < b" for x y
   proof (rule DERIV_nonneg_imp_nondecreasing [OF \<open>x \<le> y\<close>], intro exI conjI)
     show "\<And>u. x \<le> u \<Longrightarrow> u \<le> y \<Longrightarrow> (g has_real_derivative g' u) (at u)"
       by (meson deriv_g ereal_less_eq(3) le_less_trans less_le_trans that)
     show "\<And>u. x \<le> u \<Longrightarrow> u \<le> y \<Longrightarrow> 0 \<le> g' u"
       by (meson assms(5) dual_order.trans le_ereal_le less_imp_le order_refl that)
   qed
   have "A \<le> B" and un: "einterval A B = (\<Union>i. {g(l i)<..<g(u i)})"
   proof -
     have A2: "(\<lambda>i. g (l i)) \<longlonglongrightarrow> A"
       using A apply (auto simp: einterval_def tendsto_at_iff_sequentially comp_def)
       by (drule_tac x = "\<lambda>i. ereal (l i)" in spec, auto)
     hence A3: "\<And>i. g (l i) \<ge> A"
       by (intro decseq_ge, auto simp: decseq_def)
     have B2: "(\<lambda>i. g (u i)) \<longlonglongrightarrow> B"
       using B apply (auto simp: einterval_def tendsto_at_iff_sequentially comp_def)
       by (drule_tac x = "\<lambda>i. ereal (u i)" in spec, auto)
     hence B3: "\<And>i. g (u i) \<le> B"
       by (intro incseq_le, auto simp: incseq_def)
     have "ereal (g (l 0)) \<le> ereal (g (u 0))"
       by auto
     then show "A \<le> B"
       by (meson A3 B3 order.trans)
     { fix x :: real
       assume "A < x" and "x < B"
       then have "eventually (\<lambda>i. ereal (g (l i)) < x \<and> x < ereal (g (u i))) sequentially"
         by (fast intro: eventually_conj order_tendstoD A2 B2)
       hence "\<exists>i. g (l i) < x \<and> x < g (u i)"
         by (simp add: eventually_sequentially, auto)
     } note AB = this
     show "einterval A B = (\<Union>i. {g(l i)<..<g(u i)})"
     proof
       show "einterval A B \<subseteq> (\<Union>i. {g(l i)<..<g(u i)})"
         by (auto simp: einterval_def AB)
       show "(\<Union>i. {g(l i)<..<g(u i)}) \<subseteq> einterval A B"
       proof (clarsimp simp add: einterval_def, intro conjI)
         show "\<And>x i. \<lbrakk>g (l i) < x; x < g (u i)\<rbrakk> \<Longrightarrow> A < ereal x"
           using A3 le_ereal_less by blast
         show "\<And>x i. \<lbrakk>g (l i) < x; x < g (u i)\<rbrakk> \<Longrightarrow> ereal x < B"
           using B3 ereal_le_less by blast
       qed
     qed
   qed
   (* finally, the main argument *)
   have eq1: "(LBINT x=l i.. u i. g' x *\<^sub>R f (g x)) = (LBINT y=g (l i)..g (u i). f y)" for i
     apply (rule interval_integral_substitution_finite [OF _ DERIV_subset [OF deriv_g]])
-    unfolding has_field_derivative_iff_has_vector_derivative[symmetric]
+    unfolding has_real_derivative_iff_has_vector_derivative[symmetric]
          apply (auto intro!: continuous_at_imp_continuous_on contf contg')
     done
   have "(\<lambda>i. LBINT x=l i..u i. g' x *\<^sub>R f (g x)) \<longlonglongrightarrow> (LBINT x=a..b. g' x *\<^sub>R f (g x))"
     apply (rule interval_integral_Icc_approx_integrable [OF \<open>a < b\<close> approx])
     by (rule assms)
   hence 2: "(\<lambda>i. (LBINT y=g (l i)..g (u i). f y)) \<longlonglongrightarrow> (LBINT x=a..b. g' x *\<^sub>R f (g x))"
     by (simp add: eq1)
   have incseq: "incseq (\<lambda>i. {g (l i)<..<g (u i)})"
     apply (auto simp: incseq_def)
     using lessb lle approx(5) g_nondec le_less_trans apply blast
     by (force intro: less_le_trans)
   have "(\<lambda>i. set_lebesgue_integral lborel {g (l i)<..<g (u i)} f)
         \<longlonglongrightarrow> set_lebesgue_integral lborel (einterval A B) f"
     unfolding un  by (rule set_integral_cont_up) (use incseq  integrable2 un in auto)
   then have "(\<lambda>i. (LBINT y=g (l i)..g (u i). f y)) \<longlonglongrightarrow> (LBINT x = A..B. f x)"
     by (simp add: interval_lebesgue_integral_le_eq \<open>A \<le> B\<close>)
   thus ?thesis by (intro LIMSEQ_unique [OF _ 2])
 qed
 
 (* TODO: the last two proofs are only slightly different. Factor out common part?
    An alternative: make the second one the main one, and then have another lemma
    that says that if f is nonnegative and all the other hypotheses hold, then it is integrable. *)
 
 theorem interval_integral_substitution_nonneg:
   fixes f g g':: "real \<Rightarrow> real" and a b u v :: ereal
   assumes "a < b"
   and deriv_g: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> DERIV g x :> g' x"
   and contf: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> isCont f (g x)"
   and contg': "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> isCont g' x"
   and f_nonneg: "\<And>x. a < ereal x \<Longrightarrow> ereal x < b \<Longrightarrow> 0 \<le> f (g x)" (* TODO: make this AE? *)
   and g'_nonneg: "\<And>x. a \<le> ereal x \<Longrightarrow> ereal x \<le> b \<Longrightarrow> 0 \<le> g' x"
   and A: "((ereal \<circ> g \<circ> real_of_ereal) \<longlongrightarrow> A) (at_right a)"
   and B: "((ereal \<circ> g \<circ> real_of_ereal) \<longlongrightarrow> B) (at_left b)"
   and integrable_fg: "set_integrable lborel (einterval a b) (\<lambda>x. f (g x) * g' x)"
   shows
     "set_integrable lborel (einterval A B) f"
     "(LBINT x=A..B. f x) = (LBINT x=a..b. (f (g x) * g' x))"
 proof -
   from einterval_Icc_approximation[OF \<open>a < b\<close>] obtain u l where approx [simp]:
     "einterval a b = (\<Union>i. {l i..u i})"
     "incseq u"
     "decseq l"
     "\<And>i. l i < u i"
     "\<And>i. a < ereal (l i)"
     "\<And>i. ereal (u i) < b"
     "(\<lambda>x. ereal (l x)) \<longlonglongrightarrow> a"
     "(\<lambda>x. ereal (u x)) \<longlonglongrightarrow> b" by this auto
   have aless[simp]: "\<And>x i. l i \<le> x \<Longrightarrow> a < ereal x"
     by (rule order_less_le_trans, rule approx, force)
   have lessb[simp]: "\<And>x i. x \<le> u i \<Longrightarrow> ereal x < b"
     by (rule order_le_less_trans, subst ereal_less_eq(3), assumption, rule approx)
   have llb[simp]: "\<And>i. l i < b"
     using lessb approx(4) less_eq_real_def by blast
   have alu[simp]: "\<And>i. a < u i"
     by (rule order_less_trans, rule approx, auto, rule approx)
   have [simp]: "\<And>i j. i \<le> j \<Longrightarrow> l j \<le> l i" by (rule decseqD, rule approx)
   have uleu[simp]: "\<And>i j. i \<le> j \<Longrightarrow> u i \<le> u j" by (rule incseqD, rule approx)
   have g_nondec [simp]: "g x \<le> g y" if "a < x" "x \<le> y" "y < b" for x y
   proof (rule DERIV_nonneg_imp_nondecreasing [OF \<open>x \<le> y\<close>], intro exI conjI)
     show "\<And>u. x \<le> u \<Longrightarrow> u \<le> y \<Longrightarrow> (g has_real_derivative g' u) (at u)"
       by (meson deriv_g ereal_less_eq(3) le_less_trans less_le_trans that)
     show "\<And>u. x \<le> u \<Longrightarrow> u \<le> y \<Longrightarrow> 0 \<le> g' u"
       by (meson g'_nonneg less_ereal.simps(1) less_trans not_less that)
   qed
   have "A \<le> B" and un: "einterval A B = (\<Union>i. {g(l i)<..<g(u i)})"
   proof -
     have A2: "(\<lambda>i. g (l i)) \<longlonglongrightarrow> A"
       using A apply (auto simp: einterval_def tendsto_at_iff_sequentially comp_def)
       by (drule_tac x = "\<lambda>i. ereal (l i)" in spec, auto)
     hence A3: "\<And>i. g (l i) \<ge> A"
       by (intro decseq_ge, auto simp: decseq_def)
     have B2: "(\<lambda>i. g (u i)) \<longlonglongrightarrow> B"
       using B apply (auto simp: einterval_def tendsto_at_iff_sequentially comp_def)
       by (drule_tac x = "\<lambda>i. ereal (u i)" in spec, auto)
     hence B3: "\<And>i. g (u i) \<le> B"
       by (intro incseq_le, auto simp: incseq_def)
     have "ereal (g (l 0)) \<le> ereal (g (u 0))"
       by (auto simp: less_imp_le)
     then show "A \<le> B"
       by (meson A3 B3 order.trans)
     { fix x :: real
       assume "A < x" and "x < B"
       then have "eventually (\<lambda>i. ereal (g (l i)) < x \<and> x < ereal (g (u i))) sequentially"
         by (fast intro: eventually_conj order_tendstoD A2 B2)
       hence "\<exists>i. g (l i) < x \<and> x < g (u i)"
         by (simp add: eventually_sequentially, auto)
     } note AB = this
     show "einterval A B = (\<Union>i. {g(l i)<..<g(u i)})"
     proof
       show "einterval A B \<subseteq> (\<Union>i. {g (l i)<..<g (u i)})"
         by (auto simp: einterval_def AB)
       show "(\<Union>i. {g (l i)<..<g (u i)}) \<subseteq> einterval A B"
         apply (clarsimp simp: einterval_def, intro conjI)
         using A3 le_ereal_less apply blast
         using B3 ereal_le_less by blast
     qed
   qed
     (* finally, the main argument *)
   have eq1: "(LBINT x=l i.. u i. (f (g x) * g' x)) = (LBINT y=g (l i)..g (u i). f y)" for i
   proof -
     have "(LBINT x=l i.. u i. g' x *\<^sub>R f (g x)) = (LBINT y=g (l i)..g (u i). f y)"
       apply (rule interval_integral_substitution_finite [OF _ DERIV_subset [OF deriv_g]])
-      unfolding has_field_derivative_iff_has_vector_derivative[symmetric]
+      unfolding has_real_derivative_iff_has_vector_derivative[symmetric]
            apply (auto simp: less_imp_le intro!: continuous_at_imp_continuous_on contf contg')
       done
     then show ?thesis
       by (simp add: ac_simps)
   qed
   have incseq: "incseq (\<lambda>i. {g (l i)<..<g (u i)})"
     apply (clarsimp simp add: incseq_def, intro conjI)
     apply (meson llb antimono_def approx(3) approx(5) g_nondec le_less_trans)
     using alu uleu approx(6) g_nondec less_le_trans by blast
   have img: "\<exists>c \<ge> l i. c \<le> u i \<and> x = g c" if "g (l i) \<le> x" "x \<le> g (u i)" for x i
   proof -
     have "continuous_on {l i..u i} g"
       by (force intro!: DERIV_isCont deriv_g continuous_at_imp_continuous_on)
     with that show ?thesis
       using IVT' [of g] approx(4) dual_order.strict_implies_order by blast
   qed
   have "continuous_on {g (l i)..g (u i)} f" for i
     apply (intro continuous_intros continuous_at_imp_continuous_on)
     using contf img by force
   then have int_f: "\<And>i. set_integrable lborel {g (l i)<..<g (u i)} f"
     by (rule set_integrable_subset [OF borel_integrable_atLeastAtMost']) (auto intro: less_imp_le)
   have integrable: "set_integrable lborel (\<Union>i. {g (l i)<..<g (u i)}) f"
   proof (intro pos_integrable_to_top incseq int_f)
     let ?l = "(LBINT x=a..b. f (g x) * g' x)"
     have "(\<lambda>i. LBINT x=l i..u i. f (g x) * g' x) \<longlonglongrightarrow> ?l"
       by (intro assms interval_integral_Icc_approx_integrable [OF \<open>a < b\<close> approx])
     hence "(\<lambda>i. (LBINT y=g (l i)..g (u i). f y)) \<longlonglongrightarrow> ?l"
       by (simp add: eq1)
     then show "(\<lambda>i. set_lebesgue_integral lborel {g (l i)<..<g (u i)} f) \<longlonglongrightarrow> ?l"
       unfolding interval_lebesgue_integral_def by (auto simp: less_imp_le)
     have "\<And>x i. g (l i) \<le> x \<Longrightarrow> x \<le> g (u i) \<Longrightarrow> 0 \<le> f x"
       using aless f_nonneg img lessb by blast
     then show "\<And>x i. x \<in> {g (l i)<..<g (u i)} \<Longrightarrow> 0 \<le> f x"
       using less_eq_real_def by auto
   qed (auto simp: greaterThanLessThan_borel)
   thus "set_integrable lborel (einterval A B) f"
     by (simp add: un)
 
   have "(LBINT x=A..B. f x) = (LBINT x=a..b. g' x *\<^sub>R f (g x))"
   proof (rule interval_integral_substitution_integrable)
     show "set_integrable lborel (einterval a b) (\<lambda>x. g' x *\<^sub>R f (g x))"
       using integrable_fg by (simp add: ac_simps)
   qed fact+
   then show "(LBINT x=A..B. f x) = (LBINT x=a..b. (f (g x) * g' x))"
     by (simp add: ac_simps)
 qed
 
 
 syntax "_complex_lebesgue_borel_integral" :: "pttrn \<Rightarrow> real \<Rightarrow> complex"
   ("(2CLBINT _. _)" [0,60] 60)
 
 translations "CLBINT x. f" == "CONST complex_lebesgue_integral CONST lborel (\<lambda>x. f)"
 
 syntax "_complex_set_lebesgue_borel_integral" :: "pttrn \<Rightarrow> real set \<Rightarrow> real \<Rightarrow> complex"
   ("(3CLBINT _:_. _)" [0,60,61] 60)
 
 translations
   "CLBINT x:A. f" == "CONST complex_set_lebesgue_integral CONST lborel A (\<lambda>x. f)"
 
 abbreviation complex_interval_lebesgue_integral ::
     "real measure \<Rightarrow> ereal \<Rightarrow> ereal \<Rightarrow> (real \<Rightarrow> complex) \<Rightarrow> complex" where
   "complex_interval_lebesgue_integral M a b f \<equiv> interval_lebesgue_integral M a b f"
 
 abbreviation complex_interval_lebesgue_integrable ::
   "real measure \<Rightarrow> ereal \<Rightarrow> ereal \<Rightarrow> (real \<Rightarrow> complex) \<Rightarrow> bool" where
   "complex_interval_lebesgue_integrable M a b f \<equiv> interval_lebesgue_integrable M a b f"
 
 syntax
   "_ascii_complex_interval_lebesgue_borel_integral" :: "pttrn \<Rightarrow> ereal \<Rightarrow> ereal \<Rightarrow> real \<Rightarrow> complex"
   ("(4CLBINT _=_.._. _)" [0,60,60,61] 60)
 
 translations
   "CLBINT x=a..b. f" == "CONST complex_interval_lebesgue_integral CONST lborel a b (\<lambda>x. f)"
 
 proposition interval_integral_norm:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "interval_lebesgue_integrable lborel a b f \<Longrightarrow> a \<le> b \<Longrightarrow>
     norm (LBINT t=a..b. f t) \<le> LBINT t=a..b. norm (f t)"
   using integral_norm_bound[of lborel "\<lambda>x. indicator (einterval a b) x *\<^sub>R f x"]
   by (auto simp: interval_lebesgue_integral_def interval_lebesgue_integrable_def set_lebesgue_integral_def)
 
 proposition interval_integral_norm2:
   "interval_lebesgue_integrable lborel a b f \<Longrightarrow>
     norm (LBINT t=a..b. f t) \<le> \<bar>LBINT t=a..b. norm (f t)\<bar>"
 proof (induct a b rule: linorder_wlog)
   case (sym a b) then show ?case
     by (simp add: interval_integral_endpoints_reverse[of a b] interval_integrable_endpoints_reverse[of a b])
 next
   case (le a b)
   then have "\<bar>LBINT t=a..b. norm (f t)\<bar> = LBINT t=a..b. norm (f t)"
     using integrable_norm[of lborel "\<lambda>x. indicator (einterval a b) x *\<^sub>R f x"]
     by (auto simp: interval_lebesgue_integral_def interval_lebesgue_integrable_def set_lebesgue_integral_def
              intro!: integral_nonneg_AE abs_of_nonneg)
   then show ?case
     using le by (simp add: interval_integral_norm)
 qed
 
 (* TODO: should we have a library of facts like these? *)
 lemma integral_cos: "t \<noteq> 0 \<Longrightarrow> LBINT x=a..b. cos (t * x) = sin (t * b) / t - sin (t * a) / t"
   apply (intro interval_integral_FTC_finite continuous_intros)
-  by (auto intro!: derivative_eq_intros simp: has_field_derivative_iff_has_vector_derivative[symmetric])
+  by (auto intro!: derivative_eq_intros simp: has_real_derivative_iff_has_vector_derivative[symmetric])
 
 end
diff --git a/src/HOL/Analysis/Lebesgue_Integral_Substitution.thy b/src/HOL/Analysis/Lebesgue_Integral_Substitution.thy
--- a/src/HOL/Analysis/Lebesgue_Integral_Substitution.thy
+++ b/src/HOL/Analysis/Lebesgue_Integral_Substitution.thy
@@ -1,406 +1,406 @@
 (*  Title:      HOL/Analysis/Lebesgue_Integral_Substitution.thy
     Author:     Manuel Eberl
 
     Provides lemmas for integration by substitution for the basic integral types.
     Note that the substitution function must have a nonnegative derivative.
     This could probably be weakened somehow.
 *)
 
 section \<open>Integration by Substition for the Lebesgue Integral\<close>
 
 theory Lebesgue_Integral_Substitution
 imports Interval_Integral
 begin
 
 
 lemma nn_integral_substitution_aux:
   fixes f :: "real \<Rightarrow> ennreal"
   assumes Mf: "f \<in> borel_measurable borel"
   assumes nonnegf: "\<And>x. f x \<ge> 0"
   assumes derivg: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_real_derivative g' x) (at x)"
   assumes contg': "continuous_on {a..b} g'"
   assumes derivg_nonneg: "\<And>x. x \<in> {a..b} \<Longrightarrow> g' x \<ge> 0"
   assumes "a < b"
   shows "(\<integral>\<^sup>+x. f x * indicator {g a..g b} x \<partial>lborel) =
              (\<integral>\<^sup>+x. f (g x) * g' x * indicator {a..b} x \<partial>lborel)"
 proof-
   from \<open>a < b\<close> have [simp]: "a \<le> b" by simp
   from derivg have contg: "continuous_on {a..b} g" by (rule has_real_derivative_imp_continuous_on)
   from this and contg' have Mg: "set_borel_measurable borel {a..b} g" and
                              Mg': "set_borel_measurable borel {a..b} g'"
       by (simp_all only: set_measurable_continuous_on_ivl)
   from derivg have derivg': "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
-    by (simp only: has_field_derivative_iff_has_vector_derivative)
+    by (simp only: has_real_derivative_iff_has_vector_derivative)
 
   have real_ind[simp]: "\<And>A x. enn2real (indicator A x) = indicator A x"
       by (auto split: split_indicator)
   have ennreal_ind[simp]: "\<And>A x. ennreal (indicator A x) = indicator A x"
       by (auto split: split_indicator)
   have [simp]: "\<And>x A. indicator A (g x) = indicator (g -` A) x"
       by (auto split: split_indicator)
 
   from derivg derivg_nonneg have monog: "\<And>x y. a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b \<Longrightarrow> g x \<le> g y"
     by (rule deriv_nonneg_imp_mono) simp_all
   with monog have [simp]: "g a \<le> g b" by (auto intro: mono_onD)
 
   show ?thesis
   proof (induction rule: borel_measurable_induct[OF Mf, case_names cong set mult add sup])
     case (cong f1 f2)
     from cong.hyps(3) have "f1 = f2" by auto
     with cong show ?case by simp
   next
     case (set A)
     from set.hyps show ?case
     proof (induction rule: borel_set_induct)
       case empty
       thus ?case by simp
     next
       case (interval c d)
       {
         fix u v :: real assume asm: "{u..v} \<subseteq> {g a..g b}" "u \<le> v"
 
         obtain u' v' where u'v': "{a..b} \<inter> g-`{u..v} = {u'..v'}" "u' \<le> v'" "g u' = u" "g v' = v"
              using asm by (rule_tac continuous_interval_vimage_Int[OF contg monog, of u v]) simp_all
         hence "{u'..v'} \<subseteq> {a..b}" "{u'..v'} \<subseteq> g -` {u..v}" by blast+
         with u'v'(2) have "u' \<in> g -` {u..v}" "v' \<in> g -` {u..v}" by auto
         from u'v'(1) have [simp]: "{a..b} \<inter> g -` {u..v} \<in> sets borel" by simp
 
         have A: "continuous_on {min u' v'..max u' v'} g'"
             by (simp only: u'v' max_absorb2 min_absorb1)
                (intro continuous_on_subset[OF contg'], insert u'v', auto)
         have "\<And>x. x \<in> {u'..v'} \<Longrightarrow> (g has_real_derivative g' x) (at x within {u'..v'})"
            using asm by (intro has_field_derivative_subset[OF derivg] subsetD[OF \<open>{u'..v'} \<subseteq> {a..b}\<close>]) auto
         hence B: "\<And>x. min u' v' \<le> x \<Longrightarrow> x \<le> max u' v' \<Longrightarrow>
                       (g has_vector_derivative g' x) (at x within {min u' v'..max u' v'})"
             by (simp only: u'v' max_absorb2 min_absorb1)
-               (auto simp: has_field_derivative_iff_has_vector_derivative)
+               (auto simp: has_real_derivative_iff_has_vector_derivative)
           have "integrable lborel (\<lambda>x. indicator ({a..b} \<inter> g -` {u..v}) x *\<^sub>R g' x)"
             using set_integrable_subset borel_integrable_atLeastAtMost'[OF contg']
             by (metis \<open>{u'..v'} \<subseteq> {a..b}\<close> eucl_ivals(5) set_integrable_def sets_lborel u'v'(1))
         hence "(\<integral>\<^sup>+x. ennreal (g' x) * indicator ({a..b} \<inter> g-` {u..v}) x \<partial>lborel) =
                    LBINT x:{a..b} \<inter> g-`{u..v}. g' x"
           unfolding set_lebesgue_integral_def
           by (subst nn_integral_eq_integral[symmetric])
              (auto intro!: derivg_nonneg nn_integral_cong split: split_indicator)
         also from interval_integral_FTC_finite[OF A B]
             have "LBINT x:{a..b} \<inter> g-`{u..v}. g' x = v - u"
                 by (simp add: u'v' interval_integral_Icc \<open>u \<le> v\<close>)
         finally have "(\<integral>\<^sup>+ x. ennreal (g' x) * indicator ({a..b} \<inter> g -` {u..v}) x \<partial>lborel) =
                            ennreal (v - u)" .
       } note A = this
 
       have "(\<integral>\<^sup>+x. indicator {c..d} (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel) =
                (\<integral>\<^sup>+ x. ennreal (g' x) * indicator ({a..b} \<inter> g -` {c..d}) x \<partial>lborel)"
         by (intro nn_integral_cong) (simp split: split_indicator)
       also have "{a..b} \<inter> g-`{c..d} = {a..b} \<inter> g-`{max (g a) c..min (g b) d}"
         using \<open>a \<le> b\<close> \<open>c \<le> d\<close>
         by (auto intro!: monog intro: order.trans)
       also have "(\<integral>\<^sup>+ x. ennreal (g' x) * indicator ... x \<partial>lborel) =
         (if max (g a) c \<le> min (g b) d then min (g b) d - max (g a) c else 0)"
          using \<open>c \<le> d\<close> by (simp add: A)
       also have "... = (\<integral>\<^sup>+ x. indicator ({g a..g b} \<inter> {c..d}) x \<partial>lborel)"
         by (subst nn_integral_indicator) (auto intro!: measurable_sets Mg simp:)
       also have "... = (\<integral>\<^sup>+ x. indicator {c..d} x * indicator {g a..g b} x \<partial>lborel)"
         by (intro nn_integral_cong) (auto split: split_indicator)
       finally show ?case ..
 
       next
 
       case (compl A)
       note \<open>A \<in> sets borel\<close>[measurable]
       from emeasure_mono[of "A \<inter> {g a..g b}" "{g a..g b}" lborel]
       have [simp]: "emeasure lborel (A \<inter> {g a..g b}) \<noteq> top" by (auto simp: top_unique)
       have [simp]: "g -` A \<inter> {a..b} \<in> sets borel"
         by (rule set_borel_measurable_sets[OF Mg]) auto
       have [simp]: "g -` (-A) \<inter> {a..b} \<in> sets borel"
         by (rule set_borel_measurable_sets[OF Mg]) auto
 
       have "(\<integral>\<^sup>+x. indicator (-A) x * indicator {g a..g b} x \<partial>lborel) =
                 (\<integral>\<^sup>+x. indicator (-A \<inter> {g a..g b}) x \<partial>lborel)"
         by (rule nn_integral_cong) (simp split: split_indicator)
       also from compl have "... = emeasure lborel ({g a..g b} - A)" using derivg_nonneg
         by (simp add: vimage_Compl diff_eq Int_commute[of "-A"])
       also have "{g a..g b} - A = {g a..g b} - A \<inter> {g a..g b}" by blast
       also have "emeasure lborel ... = g b - g a - emeasure lborel (A \<inter> {g a..g b})"
              using \<open>A \<in> sets borel\<close> by (subst emeasure_Diff) auto
      also have "emeasure lborel (A \<inter> {g a..g b}) =
                     \<integral>\<^sup>+x. indicator A x * indicator {g a..g b} x \<partial>lborel"
        using \<open>A \<in> sets borel\<close>
        by (subst nn_integral_indicator[symmetric], simp, intro nn_integral_cong)
           (simp split: split_indicator)
       also have "... = \<integral>\<^sup>+ x. indicator (g-`A \<inter> {a..b}) x * ennreal (g' x * indicator {a..b} x) \<partial>lborel" (is "_ = ?I")
         by (subst compl.IH, intro nn_integral_cong) (simp split: split_indicator)
       also have "g b - g a = LBINT x:{a..b}. g' x" using derivg'
         unfolding set_lebesgue_integral_def
         by (intro integral_FTC_atLeastAtMost[symmetric])
            (auto intro: continuous_on_subset[OF contg'] has_field_derivative_subset[OF derivg]
                  has_vector_derivative_at_within)
       also have "ennreal ... = \<integral>\<^sup>+ x. g' x * indicator {a..b} x \<partial>lborel"
         using borel_integrable_atLeastAtMost'[OF contg'] unfolding set_lebesgue_integral_def
         by (subst nn_integral_eq_integral)
            (simp_all add: mult.commute derivg_nonneg set_integrable_def split: split_indicator)
       also have Mg'': "(\<lambda>x. indicator (g -` A \<inter> {a..b}) x * ennreal (g' x * indicator {a..b} x))
                             \<in> borel_measurable borel" using Mg'
         by (intro borel_measurable_times_ennreal borel_measurable_indicator)
            (simp_all add: mult.commute set_borel_measurable_def)
       have le: "(\<integral>\<^sup>+x. indicator (g-`A \<inter> {a..b}) x * ennreal (g' x * indicator {a..b} x) \<partial>lborel) \<le>
                         (\<integral>\<^sup>+x. ennreal (g' x) * indicator {a..b} x \<partial>lborel)"
          by (intro nn_integral_mono) (simp split: split_indicator add: derivg_nonneg)
       note integrable = borel_integrable_atLeastAtMost'[OF contg']
       with le have notinf: "(\<integral>\<^sup>+x. indicator (g-`A \<inter> {a..b}) x * ennreal (g' x * indicator {a..b} x) \<partial>lborel) \<noteq> top"
           by (auto simp: real_integrable_def nn_integral_set_ennreal mult.commute top_unique set_integrable_def)
       have "(\<integral>\<^sup>+ x. g' x * indicator {a..b} x \<partial>lborel) - ?I =
                   \<integral>\<^sup>+ x. ennreal (g' x * indicator {a..b} x) -
                         indicator (g -` A \<inter> {a..b}) x * ennreal (g' x * indicator {a..b} x) \<partial>lborel"
         apply (intro nn_integral_diff[symmetric])
         apply (insert Mg', simp add: mult.commute set_borel_measurable_def) []
         apply (insert Mg'', simp) []
         apply (simp split: split_indicator add: derivg_nonneg)
         apply (rule notinf)
         apply (simp split: split_indicator add: derivg_nonneg)
         done
       also have "... = \<integral>\<^sup>+ x. indicator (-A) (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel"
         by (intro nn_integral_cong) (simp split: split_indicator)
       finally show ?case .
 
     next
       case (union f)
       then have [simp]: "\<And>i. {a..b} \<inter> g -` f i \<in> sets borel"
         by (subst Int_commute, intro set_borel_measurable_sets[OF Mg]) auto
       have "g -` (\<Union>i. f i) \<inter> {a..b} = (\<Union>i. {a..b} \<inter> g -` f i)" by auto
       hence "g -` (\<Union>i. f i) \<inter> {a..b} \<in> sets borel" by (auto simp del: UN_simps)
 
       have "(\<integral>\<^sup>+x. indicator (\<Union>i. f i) x * indicator {g a..g b} x \<partial>lborel) =
                 \<integral>\<^sup>+x. indicator (\<Union>i. {g a..g b} \<inter> f i) x \<partial>lborel"
           by (intro nn_integral_cong) (simp split: split_indicator)
       also from union have "... = emeasure lborel (\<Union>i. {g a..g b} \<inter> f i)" by simp
       also from union have "... = (\<Sum>i. emeasure lborel ({g a..g b} \<inter> f i))"
         by (intro suminf_emeasure[symmetric]) (auto simp: disjoint_family_on_def)
       also from union have "... = (\<Sum>i. \<integral>\<^sup>+x. indicator ({g a..g b} \<inter> f i) x \<partial>lborel)" by simp
       also have "(\<lambda>i. \<integral>\<^sup>+x. indicator ({g a..g b} \<inter> f i) x \<partial>lborel) =
                            (\<lambda>i. \<integral>\<^sup>+x. indicator (f i) x * indicator {g a..g b} x \<partial>lborel)"
         by (intro ext nn_integral_cong) (simp split: split_indicator)
       also from union.IH have "(\<Sum>i. \<integral>\<^sup>+x. indicator (f i) x * indicator {g a..g b} x \<partial>lborel) =
           (\<Sum>i. \<integral>\<^sup>+ x. indicator (f i) (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel)" by simp
       also have "(\<lambda>i. \<integral>\<^sup>+ x. indicator (f i) (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel) =
                          (\<lambda>i. \<integral>\<^sup>+ x. ennreal (g' x * indicator {a..b} x) * indicator ({a..b} \<inter> g -` f i) x \<partial>lborel)"
         by (intro ext nn_integral_cong) (simp split: split_indicator)
       also have "(\<Sum>i. ... i) = \<integral>\<^sup>+ x. (\<Sum>i. ennreal (g' x * indicator {a..b} x) * indicator ({a..b} \<inter> g -` f i) x) \<partial>lborel"
         using Mg'
         apply (intro nn_integral_suminf[symmetric])
         apply (rule borel_measurable_times_ennreal, simp add: mult.commute set_borel_measurable_def)
         apply (rule borel_measurable_indicator, subst sets_lborel)
         apply (simp_all split: split_indicator add: derivg_nonneg)
         done
       also have "(\<lambda>x i. ennreal (g' x * indicator {a..b} x) * indicator ({a..b} \<inter> g -` f i) x) =
                       (\<lambda>x i. ennreal (g' x * indicator {a..b} x) * indicator (g -` f i) x)"
         by (intro ext) (simp split: split_indicator)
       also have "(\<integral>\<^sup>+ x. (\<Sum>i. ennreal (g' x * indicator {a..b} x) * indicator (g -` f i) x) \<partial>lborel) =
                      \<integral>\<^sup>+ x. ennreal (g' x * indicator {a..b} x) * (\<Sum>i. indicator (g -` f i) x) \<partial>lborel"
         by (intro nn_integral_cong) (auto split: split_indicator simp: derivg_nonneg)
       also from union have "(\<lambda>x. \<Sum>i. indicator (g -` f i) x :: ennreal) = (\<lambda>x. indicator (\<Union>i. g -` f i) x)"
         by (intro ext suminf_indicator) (auto simp: disjoint_family_on_def)
       also have "(\<integral>\<^sup>+x. ennreal (g' x * indicator {a..b} x) * ... x \<partial>lborel) =
                     (\<integral>\<^sup>+x. indicator (\<Union>i. f i) (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel)"
        by (intro nn_integral_cong) (simp split: split_indicator)
       finally show ?case .
   qed
 
 next
   case (mult f c)
     note Mf[measurable] = \<open>f \<in> borel_measurable borel\<close>
     let ?I = "indicator {a..b}"
     have "(\<lambda>x. f (g x * ?I x) * ennreal (g' x * ?I x)) \<in> borel_measurable borel" using Mg Mg'
       by (intro borel_measurable_times_ennreal measurable_compose[OF _ Mf])
          (simp_all add: mult.commute set_borel_measurable_def)
     also have "(\<lambda>x. f (g x * ?I x) * ennreal (g' x * ?I x)) = (\<lambda>x. f (g x) * ennreal (g' x) * ?I x)"
       by (intro ext) (simp split: split_indicator)
     finally have Mf': "(\<lambda>x. f (g x) * ennreal (g' x) * ?I x) \<in> borel_measurable borel" .
     with mult show ?case
       by (subst (1 2 3) mult_ac, subst (1 2) nn_integral_cmult) (simp_all add: mult_ac)
 
 next
   case (add f2 f1)
     let ?I = "indicator {a..b}"
     {
       fix f :: "real \<Rightarrow> ennreal" assume Mf: "f \<in> borel_measurable borel"
       have "(\<lambda>x. f (g x * ?I x) * ennreal (g' x * ?I x)) \<in> borel_measurable borel" using Mg Mg'
         by (intro borel_measurable_times_ennreal measurable_compose[OF _ Mf])
            (simp_all add:  mult.commute set_borel_measurable_def)
       also have "(\<lambda>x. f (g x * ?I x) * ennreal (g' x * ?I x)) = (\<lambda>x. f (g x) * ennreal (g' x) * ?I x)"
         by (intro ext) (simp split: split_indicator)
       finally have "(\<lambda>x. f (g x) * ennreal (g' x) * ?I x) \<in> borel_measurable borel" .
     } note Mf' = this[OF \<open>f1 \<in> borel_measurable borel\<close>] this[OF \<open>f2 \<in> borel_measurable borel\<close>]
 
     have "(\<integral>\<^sup>+ x. (f1 x + f2 x) * indicator {g a..g b} x \<partial>lborel) =
              (\<integral>\<^sup>+ x. f1 x * indicator {g a..g b} x + f2 x * indicator {g a..g b} x \<partial>lborel)"
       by (intro nn_integral_cong) (simp split: split_indicator)
     also from add have "... = (\<integral>\<^sup>+ x. f1 (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel) +
                                 (\<integral>\<^sup>+ x. f2 (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel)"
       by (simp_all add: nn_integral_add)
     also from add have "... = (\<integral>\<^sup>+ x. f1 (g x) * ennreal (g' x) * indicator {a..b} x +
                                       f2 (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel)"
       by (intro nn_integral_add[symmetric])
          (auto simp add: Mf' derivg_nonneg split: split_indicator)
     also have "... = \<integral>\<^sup>+ x. (f1 (g x) + f2 (g x)) * ennreal (g' x) * indicator {a..b} x \<partial>lborel"
       by (intro nn_integral_cong) (simp split: split_indicator add: distrib_right)
     finally show ?case .
 
 next
   case (sup F)
   {
     fix i
     let ?I = "indicator {a..b}"
     have "(\<lambda>x. F i (g x * ?I x) * ennreal (g' x * ?I x)) \<in> borel_measurable borel" using Mg Mg'
       by (rule_tac borel_measurable_times_ennreal, rule_tac measurable_compose[OF _ sup.hyps(1)])
          (simp_all add: mult.commute set_borel_measurable_def)
     also have "(\<lambda>x. F i (g x * ?I x) * ennreal (g' x * ?I x)) = (\<lambda>x. F i (g x) * ennreal (g' x) * ?I x)"
       by (intro ext) (simp split: split_indicator)
      finally have "... \<in> borel_measurable borel" .
   } note Mf' = this
 
     have "(\<integral>\<^sup>+x. (SUP i. F i x) * indicator {g a..g b} x \<partial>lborel) =
                \<integral>\<^sup>+x. (SUP i. F i x* indicator {g a..g b} x) \<partial>lborel"
       by (intro nn_integral_cong) (simp split: split_indicator)
     also from sup have "... = (SUP i. \<integral>\<^sup>+x. F i x* indicator {g a..g b} x \<partial>lborel)"
       by (intro nn_integral_monotone_convergence_SUP)
          (auto simp: incseq_def le_fun_def split: split_indicator)
     also from sup have "... = (SUP i. \<integral>\<^sup>+x. F i (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel)"
       by simp
     also from sup have "... =  \<integral>\<^sup>+x. (SUP i. F i (g x) * ennreal (g' x) * indicator {a..b} x) \<partial>lborel"
       by (intro nn_integral_monotone_convergence_SUP[symmetric])
          (auto simp: incseq_def le_fun_def derivg_nonneg Mf' split: split_indicator
                intro!: mult_right_mono)
     also from sup have "... = \<integral>\<^sup>+x. (SUP i. F i (g x)) * ennreal (g' x) * indicator {a..b} x \<partial>lborel"
       by (subst mult.assoc, subst mult.commute, subst SUP_mult_left_ennreal)
          (auto split: split_indicator simp: derivg_nonneg mult_ac)
     finally show ?case by (simp add: image_comp)
   qed
 qed
 
 theorem nn_integral_substitution:
   fixes f :: "real \<Rightarrow> real"
   assumes Mf[measurable]: "set_borel_measurable borel {g a..g b} f"
   assumes derivg: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_real_derivative g' x) (at x)"
   assumes contg': "continuous_on {a..b} g'"
   assumes derivg_nonneg: "\<And>x. x \<in> {a..b} \<Longrightarrow> g' x \<ge> 0"
   assumes "a \<le> b"
   shows "(\<integral>\<^sup>+x. f x * indicator {g a..g b} x \<partial>lborel) =
              (\<integral>\<^sup>+x. f (g x) * g' x * indicator {a..b} x \<partial>lborel)"
 proof (cases "a = b")
   assume "a \<noteq> b"
   with \<open>a \<le> b\<close> have "a < b" by auto
   let ?f' = "\<lambda>x. f x * indicator {g a..g b} x"
 
   from derivg derivg_nonneg have monog: "\<And>x y. a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b \<Longrightarrow> g x \<le> g y"
     by (rule deriv_nonneg_imp_mono) simp_all
   have bounds: "\<And>x. x \<ge> a \<Longrightarrow> x \<le> b \<Longrightarrow> g x \<ge> g a" "\<And>x. x \<ge> a \<Longrightarrow> x \<le> b \<Longrightarrow> g x \<le> g b"
     by (auto intro: monog)
 
   from derivg_nonneg have nonneg:
     "\<And>f x. x \<ge> a \<Longrightarrow> x \<le> b \<Longrightarrow> g' x \<noteq> 0 \<Longrightarrow> f x * ennreal (g' x) \<ge> 0 \<Longrightarrow> f x \<ge> 0"
     by (force simp: field_simps)
   have nonneg': "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> \<not> 0 \<le> f (g x) \<Longrightarrow> 0 \<le> f (g x) * g' x \<Longrightarrow> g' x = 0"
     by (metis atLeastAtMost_iff derivg_nonneg eq_iff mult_eq_0_iff mult_le_0_iff)
 
   have "(\<integral>\<^sup>+x. f x * indicator {g a..g b} x \<partial>lborel) =
             (\<integral>\<^sup>+x. ennreal (?f' x) * indicator {g a..g b} x \<partial>lborel)"
     by (intro nn_integral_cong)
        (auto split: split_indicator split_max simp: zero_ennreal.rep_eq ennreal_neg)
   also have "... = \<integral>\<^sup>+ x. ?f' (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel" using Mf
     by (subst nn_integral_substitution_aux[OF _ _ derivg contg' derivg_nonneg \<open>a < b\<close>])
        (auto simp add: mult.commute set_borel_measurable_def)
   also have "... = \<integral>\<^sup>+ x. f (g x) * ennreal (g' x) * indicator {a..b} x \<partial>lborel"
     by (intro nn_integral_cong) (auto split: split_indicator simp: max_def dest: bounds)
   also have "... = \<integral>\<^sup>+x. ennreal (f (g x) * g' x * indicator {a..b} x) \<partial>lborel"
     by (intro nn_integral_cong) (auto simp: mult.commute derivg_nonneg ennreal_mult' split: split_indicator)
   finally show ?thesis .
 qed auto
 
 theorem integral_substitution:
   assumes integrable: "set_integrable lborel {g a..g b} f"
   assumes derivg: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_real_derivative g' x) (at x)"
   assumes contg': "continuous_on {a..b} g'"
   assumes derivg_nonneg: "\<And>x. x \<in> {a..b} \<Longrightarrow> g' x \<ge> 0"
   assumes "a \<le> b"
   shows "set_integrable lborel {a..b} (\<lambda>x. f (g x) * g' x)"
     and "(LBINT x. f x * indicator {g a..g b} x) = (LBINT x. f (g x) * g' x * indicator {a..b} x)"
 proof-
   from derivg have contg: "continuous_on {a..b} g" by (rule has_real_derivative_imp_continuous_on)
   with contg' have Mg: "set_borel_measurable borel {a..b} g"
     and Mg': "set_borel_measurable borel {a..b} g'"
     by (simp_all only: set_measurable_continuous_on_ivl)
   from derivg derivg_nonneg have monog: "\<And>x y. a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b \<Longrightarrow> g x \<le> g y"
     by (rule deriv_nonneg_imp_mono) simp_all
 
   have "(\<lambda>x. ennreal (f x) * indicator {g a..g b} x) =
            (\<lambda>x. ennreal (f x * indicator {g a..g b} x))"
     by (intro ext) (simp split: split_indicator)
   with integrable have M1: "(\<lambda>x. f x * indicator {g a..g b} x) \<in> borel_measurable borel"
     by (force simp: mult.commute set_integrable_def)
   from integrable have M2: "(\<lambda>x. -f x * indicator {g a..g b} x) \<in> borel_measurable borel"
     by (force simp: mult.commute set_integrable_def)
 
   have "LBINT x. (f x :: real) * indicator {g a..g b} x =
           enn2real (\<integral>\<^sup>+ x. ennreal (f x) * indicator {g a..g b} x \<partial>lborel) -
           enn2real (\<integral>\<^sup>+ x. ennreal (- (f x)) * indicator {g a..g b} x \<partial>lborel)" using integrable
     unfolding set_integrable_def
     by (subst real_lebesgue_integral_def) (simp_all add: nn_integral_set_ennreal mult.commute)
   also have *: "(\<integral>\<^sup>+x. ennreal (f x) * indicator {g a..g b} x \<partial>lborel) =
       (\<integral>\<^sup>+x. ennreal (f x * indicator {g a..g b} x) \<partial>lborel)"
     by (intro nn_integral_cong) (simp split: split_indicator)
   also from M1 * have A: "(\<integral>\<^sup>+ x. ennreal (f x * indicator {g a..g b} x) \<partial>lborel) =
                             (\<integral>\<^sup>+ x. ennreal (f (g x) * g' x * indicator {a..b} x) \<partial>lborel)"
     by (subst nn_integral_substitution[OF _ derivg contg' derivg_nonneg \<open>a \<le> b\<close>])
        (auto simp: nn_integral_set_ennreal mult.commute set_borel_measurable_def)
   also have **: "(\<integral>\<^sup>+ x. ennreal (- (f x)) * indicator {g a..g b} x \<partial>lborel) =
       (\<integral>\<^sup>+ x. ennreal (- (f x) * indicator {g a..g b} x) \<partial>lborel)"
     by (intro nn_integral_cong) (simp split: split_indicator)
   also from M2 ** have B: "(\<integral>\<^sup>+ x. ennreal (- (f x) * indicator {g a..g b} x) \<partial>lborel) =
         (\<integral>\<^sup>+ x. ennreal (- (f (g x)) * g' x * indicator {a..b} x) \<partial>lborel)"
     by (subst nn_integral_substitution[OF _ derivg contg' derivg_nonneg \<open>a \<le> b\<close>])
        (auto simp: nn_integral_set_ennreal mult.commute set_borel_measurable_def)
 
   also {
     from integrable have Mf: "set_borel_measurable borel {g a..g b} f"
       unfolding set_borel_measurable_def set_integrable_def by simp
     from measurable_compose Mg Mf Mg' borel_measurable_times
     have "(\<lambda>x. f (g x * indicator {a..b} x) * indicator {g a..g b} (g x * indicator {a..b} x) *
                      (g' x * indicator {a..b} x)) \<in> borel_measurable borel"  (is "?f \<in> _")
       by (simp add: mult.commute set_borel_measurable_def)
     also have "?f = (\<lambda>x. f (g x) * g' x * indicator {a..b} x)"
       using monog by (intro ext) (auto split: split_indicator)
     finally show "set_integrable lborel {a..b} (\<lambda>x. f (g x) * g' x)"
       using A B integrable unfolding real_integrable_def set_integrable_def
       by (simp_all add: nn_integral_set_ennreal mult.commute)
   } note integrable' = this
 
   have "enn2real (\<integral>\<^sup>+ x. ennreal (f (g x) * g' x * indicator {a..b} x) \<partial>lborel) -
                   enn2real (\<integral>\<^sup>+ x. ennreal (-f (g x) * g' x * indicator {a..b} x) \<partial>lborel) =
                 (LBINT x. f (g x) * g' x * indicator {a..b} x)" 
     using integrable' unfolding set_integrable_def
     by (subst real_lebesgue_integral_def) (simp_all add: field_simps)
   finally show "(LBINT x. f x * indicator {g a..g b} x) =
                      (LBINT x. f (g x) * g' x * indicator {a..b} x)" .
 qed
 
 theorem interval_integral_substitution:
   assumes integrable: "set_integrable lborel {g a..g b} f"
   assumes derivg: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_real_derivative g' x) (at x)"
   assumes contg': "continuous_on {a..b} g'"
   assumes derivg_nonneg: "\<And>x. x \<in> {a..b} \<Longrightarrow> g' x \<ge> 0"
   assumes "a \<le> b"
   shows "set_integrable lborel {a..b} (\<lambda>x. f (g x) * g' x)"
     and "(LBINT x=g a..g b. f x) = (LBINT x=a..b. f (g x) * g' x)"
   apply (rule integral_substitution[OF assms], simp, simp)
   apply (subst (1 2) interval_integral_Icc, fact)
   apply (rule deriv_nonneg_imp_mono[OF derivg derivg_nonneg], simp, simp, fact)
   using integral_substitution(2)[OF assms]
   apply (simp add: mult.commute set_lebesgue_integral_def)
   done
 
 lemma set_borel_integrable_singleton[simp]: "set_integrable lborel {x} (f :: real \<Rightarrow> real)"
   unfolding set_integrable_def
   by (subst integrable_discrete_difference[where X="{x}" and g="\<lambda>_. 0"]) auto
 
 end
diff --git a/src/HOL/Analysis/Topology_Euclidean_Space.thy b/src/HOL/Analysis/Topology_Euclidean_Space.thy
--- a/src/HOL/Analysis/Topology_Euclidean_Space.thy
+++ b/src/HOL/Analysis/Topology_Euclidean_Space.thy
@@ -1,2579 +1,2590 @@
 (*  Author:     L C Paulson, University of Cambridge
     Author:     Amine Chaieb, University of Cambridge
     Author:     Robert Himmelmann, TU Muenchen
     Author:     Brian Huffman, Portland State University
 *)
 
 chapter \<open>Vector Analysis\<close>
 
 theory Topology_Euclidean_Space
   imports
     Elementary_Normed_Spaces
     Linear_Algebra
     Norm_Arith
 begin
 
 section \<open>Elementary Topology in Euclidean Space\<close>
 
 lemma euclidean_dist_l2:
   fixes x y :: "'a :: euclidean_space"
   shows "dist x y = L2_set (\<lambda>i. dist (x \<bullet> i) (y \<bullet> i)) Basis"
   unfolding dist_norm norm_eq_sqrt_inner L2_set_def
   by (subst euclidean_inner) (simp add: power2_eq_square inner_diff_left)
 
 lemma norm_nth_le: "norm (x \<bullet> i) \<le> norm x" if "i \<in> Basis"
 proof -
   have "(x \<bullet> i)\<^sup>2 = (\<Sum>i\<in>{i}. (x \<bullet> i)\<^sup>2)"
     by simp
   also have "\<dots> \<le> (\<Sum>i\<in>Basis. (x \<bullet> i)\<^sup>2)"
     by (intro sum_mono2) (auto simp: that)
   finally show ?thesis
     unfolding norm_conv_dist euclidean_dist_l2[of x] L2_set_def
     by (auto intro!: real_le_rsqrt)
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Continuity of the representation WRT an orthogonal basis\<close>
 
 lemma orthogonal_Basis: "pairwise orthogonal Basis"
   by (simp add: inner_not_same_Basis orthogonal_def pairwise_def)
 
 lemma representation_bound:
   fixes B :: "'N::real_inner set"
   assumes "finite B" "independent B" "b \<in> B" and orth: "pairwise orthogonal B"
   obtains m where "m > 0" "\<And>x. x \<in> span B \<Longrightarrow> \<bar>representation B x b\<bar> \<le> m * norm x"
 proof 
   fix x
   assume x: "x \<in> span B"
   have "b \<noteq> 0"
     using \<open>independent B\<close> \<open>b \<in> B\<close> dependent_zero by blast
   have [simp]: "b \<bullet> b' = (if b' = b then (norm b)\<^sup>2 else 0)"
     if "b \<in> B" "b' \<in> B" for b b'
     using orth by (simp add: orthogonal_def pairwise_def norm_eq_sqrt_inner that)
   have "norm x = norm (\<Sum>b\<in>B. representation B x b *\<^sub>R b)"
     using real_vector.sum_representation_eq [OF \<open>independent B\<close> x \<open>finite B\<close> order_refl]
     by simp
   also have "\<dots> = sqrt ((\<Sum>b\<in>B. representation B x b *\<^sub>R b) \<bullet> (\<Sum>b\<in>B. representation B x b *\<^sub>R b))"
     by (simp add: norm_eq_sqrt_inner)
   also have "\<dots> = sqrt (\<Sum>b\<in>B. (representation B x b *\<^sub>R b) \<bullet> (representation B x b *\<^sub>R b))"
     using \<open>finite B\<close>
     by (simp add: inner_sum_left inner_sum_right if_distrib [of "\<lambda>x. _ * x"] cong: if_cong sum.cong_simp)
   also have "\<dots> = sqrt (\<Sum>b\<in>B. (norm (representation B x b *\<^sub>R b))\<^sup>2)"
     by (simp add: mult.commute mult.left_commute power2_eq_square)
   also have "\<dots> = sqrt (\<Sum>b\<in>B. (representation B x b)\<^sup>2 * (norm b)\<^sup>2)"
     by (simp add: norm_mult power_mult_distrib)
   finally have "norm x = sqrt (\<Sum>b\<in>B. (representation B x b)\<^sup>2 * (norm b)\<^sup>2)" .
   moreover
   have "sqrt ((representation B x b)\<^sup>2 * (norm b)\<^sup>2) \<le> sqrt (\<Sum>b\<in>B. (representation B x b)\<^sup>2 * (norm b)\<^sup>2)"
     using \<open>b \<in> B\<close> \<open>finite B\<close> by (auto intro: member_le_sum)
   then have "\<bar>representation B x b\<bar> \<le> (1 / norm b) * sqrt (\<Sum>b\<in>B. (representation B x b)\<^sup>2 * (norm b)\<^sup>2)"
     using \<open>b \<noteq> 0\<close> by (simp add: field_split_simps real_sqrt_mult del: real_sqrt_le_iff)
   ultimately show "\<bar>representation B x b\<bar> \<le> (1 / norm b) * norm x"
     by simp
 next
   show "0 < 1 / norm b"
     using \<open>independent B\<close> \<open>b \<in> B\<close> dependent_zero by auto
 qed 
 
 lemma continuous_on_representation:
   fixes B :: "'N::euclidean_space set"
   assumes "finite B" "independent B" "b \<in> B" "pairwise orthogonal B" 
   shows "continuous_on (span B) (\<lambda>x. representation B x b)"
 proof
   show "\<exists>d>0. \<forall>x'\<in>span B. dist x' x < d \<longrightarrow> dist (representation B x' b) (representation B x b) \<le> e"
     if "e > 0" "x \<in> span B" for x e
   proof -
     obtain m where "m > 0" and m: "\<And>x. x \<in> span B \<Longrightarrow> \<bar>representation B x b\<bar> \<le> m * norm x"
       using assms representation_bound by blast
     show ?thesis
       unfolding dist_norm
     proof (intro exI conjI ballI impI)
       show "e/m > 0"
         by (simp add: \<open>e > 0\<close> \<open>m > 0\<close>)
       show "norm (representation B x' b - representation B x b) \<le> e"
         if x': "x' \<in> span B" and less: "norm (x'-x) < e/m" for x' 
       proof -
         have "\<bar>representation B (x'-x) b\<bar> \<le> m * norm (x'-x)"
           using m [of "x'-x"] \<open>x \<in> span B\<close> span_diff x' by blast
         also have "\<dots> < e"
           by (metis \<open>m > 0\<close> less mult.commute pos_less_divide_eq)
         finally have "\<bar>representation B (x'-x) b\<bar> \<le> e" by simp
         then show ?thesis
           by (simp add: \<open>x \<in> span B\<close> \<open>independent B\<close> representation_diff x')
       qed
     qed
   qed
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open>Balls in Euclidean Space\<close>
 
 lemma cball_subset_cball_iff:
   fixes a :: "'a :: euclidean_space"
   shows "cball a r \<subseteq> cball a' r' \<longleftrightarrow> dist a a' + r \<le> r' \<or> r < 0"
     (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   assume ?lhs
   then show ?rhs
   proof (cases "r < 0")
     case True
     then show ?rhs by simp
   next
     case False
     then have [simp]: "r \<ge> 0" by simp
     have "norm (a - a') + r \<le> r'"
     proof (cases "a = a'")
       case True
       then show ?thesis
         using subsetD [where c = "a + r *\<^sub>R (SOME i. i \<in> Basis)", OF \<open>?lhs\<close>] subsetD [where c = a, OF \<open>?lhs\<close>]
         by (force simp: SOME_Basis dist_norm)
     next
       case False
       have "norm (a' - (a + (r / norm (a - a')) *\<^sub>R (a - a'))) = norm (a' - a - (r / norm (a - a')) *\<^sub>R (a - a'))"
         by (simp add: algebra_simps)
       also have "... = norm ((-1 - (r / norm (a - a'))) *\<^sub>R (a - a'))"
         by (simp add: algebra_simps)
       also from \<open>a \<noteq> a'\<close> have "... = \<bar>- norm (a - a') - r\<bar>"
         by simp (simp add: field_simps)
       finally have [simp]: "norm (a' - (a + (r / norm (a - a')) *\<^sub>R (a - a'))) = \<bar>norm (a - a') + r\<bar>"
         by linarith
       from \<open>a \<noteq> a'\<close> show ?thesis
         using subsetD [where c = "a' + (1 + r / norm(a - a')) *\<^sub>R (a - a')", OF \<open>?lhs\<close>]
         by (simp add: dist_norm scaleR_add_left)
     qed
     then show ?rhs
       by (simp add: dist_norm)
   qed
 qed metric
 
 lemma cball_subset_ball_iff: "cball a r \<subseteq> ball a' r' \<longleftrightarrow> dist a a' + r < r' \<or> r < 0"
   (is "?lhs \<longleftrightarrow> ?rhs")
   for a :: "'a::euclidean_space"
 proof
   assume ?lhs
   then show ?rhs
   proof (cases "r < 0")
     case True then
     show ?rhs by simp
   next
     case False
     then have [simp]: "r \<ge> 0" by simp
     have "norm (a - a') + r < r'"
     proof (cases "a = a'")
       case True
       then show ?thesis
         using subsetD [where c = "a + r *\<^sub>R (SOME i. i \<in> Basis)", OF \<open>?lhs\<close>] subsetD [where c = a, OF \<open>?lhs\<close>]
         by (force simp: SOME_Basis dist_norm)
     next
       case False
       have False if "norm (a - a') + r \<ge> r'"
       proof -
         from that have "\<bar>r' - norm (a - a')\<bar> \<le> r"
           by (simp split: abs_split)
             (metis \<open>0 \<le> r\<close> \<open>?lhs\<close> centre_in_cball dist_commute dist_norm less_asym mem_ball subset_eq)
         then show ?thesis
           using subsetD [where c = "a + (r' / norm(a - a') - 1) *\<^sub>R (a - a')", OF \<open>?lhs\<close>] \<open>a \<noteq> a'\<close>
           apply (simp add: dist_norm)
           apply (simp add: scaleR_left_diff_distrib)
           apply (simp add: field_simps)
           done
       qed
       then show ?thesis by force
     qed
     then show ?rhs by (simp add: dist_norm)
   qed
 next
   assume ?rhs
   then show ?lhs
     by metric
 qed
 
 lemma ball_subset_cball_iff: "ball a r \<subseteq> cball a' r' \<longleftrightarrow> dist a a' + r \<le> r' \<or> r \<le> 0"
   (is "?lhs = ?rhs")
   for a :: "'a::euclidean_space"
 proof (cases "r \<le> 0")
   case True
   then show ?thesis
     by metric
 next
   case False
   show ?thesis
   proof
     assume ?lhs
     then have "(cball a r \<subseteq> cball a' r')"
       by (metis False closed_cball closure_ball closure_closed closure_mono not_less)
     with False show ?rhs
       by (fastforce iff: cball_subset_cball_iff)
   next
     assume ?rhs
     with False show ?lhs
       by metric
   qed
 qed
 
 lemma ball_subset_ball_iff:
   fixes a :: "'a :: euclidean_space"
   shows "ball a r \<subseteq> ball a' r' \<longleftrightarrow> dist a a' + r \<le> r' \<or> r \<le> 0"
         (is "?lhs = ?rhs")
 proof (cases "r \<le> 0")
   case True then show ?thesis
     by metric
 next
   case False show ?thesis
   proof
     assume ?lhs
     then have "0 < r'"
       using False by metric
     then have "(cball a r \<subseteq> cball a' r')"
       by (metis False\<open>?lhs\<close> closure_ball closure_mono not_less)
     then show ?rhs
       using False cball_subset_cball_iff by fastforce
   qed metric
 qed
 
 
 lemma ball_eq_ball_iff:
   fixes x :: "'a :: euclidean_space"
   shows "ball x d = ball y e \<longleftrightarrow> d \<le> 0 \<and> e \<le> 0 \<or> x=y \<and> d=e"
         (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
   proof (cases "d \<le> 0 \<or> e \<le> 0")
     case True
       with \<open>?lhs\<close> show ?rhs
         by safe (simp_all only: ball_eq_empty [of y e, symmetric] ball_eq_empty [of x d, symmetric])
   next
     case False
     with \<open>?lhs\<close> show ?rhs
       apply (auto simp: set_eq_subset ball_subset_ball_iff dist_norm norm_minus_commute algebra_simps)
       apply (metis add_le_same_cancel1 le_add_same_cancel1 norm_ge_zero norm_pths(2) order_trans)
       apply (metis add_increasing2 add_le_imp_le_right eq_iff norm_ge_zero)
       done
   qed
 next
   assume ?rhs then show ?lhs
     by (auto simp: set_eq_subset ball_subset_ball_iff)
 qed
 
 lemma cball_eq_cball_iff:
   fixes x :: "'a :: euclidean_space"
   shows "cball x d = cball y e \<longleftrightarrow> d < 0 \<and> e < 0 \<or> x=y \<and> d=e"
         (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
   proof (cases "d < 0 \<or> e < 0")
     case True
       with \<open>?lhs\<close> show ?rhs
         by safe (simp_all only: cball_eq_empty [of y e, symmetric] cball_eq_empty [of x d, symmetric])
   next
     case False
     with \<open>?lhs\<close> show ?rhs
       apply (auto simp: set_eq_subset cball_subset_cball_iff dist_norm norm_minus_commute algebra_simps)
       apply (metis add_le_same_cancel1 le_add_same_cancel1 norm_ge_zero norm_pths(2) order_trans)
       apply (metis add_increasing2 add_le_imp_le_right eq_iff norm_ge_zero)
       done
   qed
 next
   assume ?rhs then show ?lhs
     by (auto simp: set_eq_subset cball_subset_cball_iff)
 qed
 
 lemma ball_eq_cball_iff:
   fixes x :: "'a :: euclidean_space"
   shows "ball x d = cball y e \<longleftrightarrow> d \<le> 0 \<and> e < 0" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
     apply (auto simp: set_eq_subset ball_subset_cball_iff cball_subset_ball_iff algebra_simps)
     apply (metis add_increasing2 add_le_cancel_right add_less_same_cancel1 dist_not_less_zero less_le_trans zero_le_dist)
     apply (metis add_less_same_cancel1 dist_not_less_zero less_le_trans not_le)
     using \<open>?lhs\<close> ball_eq_empty cball_eq_empty apply blast+
     done
 next
   assume ?rhs then show ?lhs by auto
 qed
 
 lemma cball_eq_ball_iff:
   fixes x :: "'a :: euclidean_space"
   shows "cball x d = ball y e \<longleftrightarrow> d < 0 \<and> e \<le> 0"
   using ball_eq_cball_iff by blast
 
 lemma finite_ball_avoid:
   fixes S :: "'a :: euclidean_space set"
   assumes "open S" "finite X" "p \<in> S"
   shows "\<exists>e>0. \<forall>w\<in>ball p e. w\<in>S \<and> (w\<noteq>p \<longrightarrow> w\<notin>X)"
 proof -
   obtain e1 where "0 < e1" and e1_b:"ball p e1 \<subseteq> S"
     using open_contains_ball_eq[OF \<open>open S\<close>] assms by auto
   obtain e2 where "0 < e2" and "\<forall>x\<in>X. x \<noteq> p \<longrightarrow> e2 \<le> dist p x"
     using finite_set_avoid[OF \<open>finite X\<close>,of p] by auto
   hence "\<forall>w\<in>ball p (min e1 e2). w\<in>S \<and> (w\<noteq>p \<longrightarrow> w\<notin>X)" using e1_b by auto
   thus "\<exists>e>0. \<forall>w\<in>ball p e. w \<in> S \<and> (w \<noteq> p \<longrightarrow> w \<notin> X)" using \<open>e2>0\<close> \<open>e1>0\<close>
     apply (rule_tac x="min e1 e2" in exI)
     by auto
 qed
 
 lemma finite_cball_avoid:
   fixes S :: "'a :: euclidean_space set"
   assumes "open S" "finite X" "p \<in> S"
   shows "\<exists>e>0. \<forall>w\<in>cball p e. w\<in>S \<and> (w\<noteq>p \<longrightarrow> w\<notin>X)"
 proof -
   obtain e1 where "e1>0" and e1: "\<forall>w\<in>ball p e1. w\<in>S \<and> (w\<noteq>p \<longrightarrow> w\<notin>X)"
     using finite_ball_avoid[OF assms] by auto
   define e2 where "e2 \<equiv> e1/2"
   have "e2>0" and "e2 < e1" unfolding e2_def using \<open>e1>0\<close> by auto
   then have "cball p e2 \<subseteq> ball p e1" by (subst cball_subset_ball_iff,auto)
   then show "\<exists>e>0. \<forall>w\<in>cball p e. w \<in> S \<and> (w \<noteq> p \<longrightarrow> w \<notin> X)" using \<open>e2>0\<close> e1 by auto
 qed
 
 lemma dim_cball:
   assumes "e > 0"
   shows "dim (cball (0 :: 'n::euclidean_space) e) = DIM('n)"
 proof -
   {
     fix x :: "'n::euclidean_space"
     define y where "y = (e / norm x) *\<^sub>R x"
     then have "y \<in> cball 0 e"
       using assms by auto
     moreover have *: "x = (norm x / e) *\<^sub>R y"
       using y_def assms by simp
     moreover from * have "x = (norm x/e) *\<^sub>R y"
       by auto
     ultimately have "x \<in> span (cball 0 e)"
       using span_scale[of y "cball 0 e" "norm x/e"]
         span_superset[of "cball 0 e"]
       by (simp add: span_base)
   }
   then have "span (cball 0 e) = (UNIV :: 'n::euclidean_space set)"
     by auto
   then show ?thesis
     using dim_span[of "cball (0 :: 'n::euclidean_space) e"] by (auto)
 qed
 
 
 subsection \<open>Boxes\<close>
 
 abbreviation\<^marker>\<open>tag important\<close> One :: "'a::euclidean_space" where
 "One \<equiv> \<Sum>Basis"
 
 lemma One_non_0: assumes "One = (0::'a::euclidean_space)" shows False
 proof -
   have "dependent (Basis :: 'a set)"
     apply (simp add: dependent_finite)
     apply (rule_tac x="\<lambda>i. 1" in exI)
     using SOME_Basis apply (auto simp: assms)
     done
   with independent_Basis show False by force
 qed
 
 corollary\<^marker>\<open>tag unimportant\<close> One_neq_0[iff]: "One \<noteq> 0"
   by (metis One_non_0)
 
 corollary\<^marker>\<open>tag unimportant\<close> Zero_neq_One[iff]: "0 \<noteq> One"
   by (metis One_non_0)
 
 definition\<^marker>\<open>tag important\<close> (in euclidean_space) eucl_less (infix "<e" 50) where 
 "eucl_less a b \<longleftrightarrow> (\<forall>i\<in>Basis. a \<bullet> i < b \<bullet> i)"
 
 definition\<^marker>\<open>tag important\<close> box_eucl_less: "box a b = {x. a <e x \<and> x <e b}"
 definition\<^marker>\<open>tag important\<close> "cbox a b = {x. \<forall>i\<in>Basis. a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> b \<bullet> i}"
 
 lemma box_def: "box a b = {x. \<forall>i\<in>Basis. a \<bullet> i < x \<bullet> i \<and> x \<bullet> i < b \<bullet> i}"
   and in_box_eucl_less: "x \<in> box a b \<longleftrightarrow> a <e x \<and> x <e b"
   and mem_box: "x \<in> box a b \<longleftrightarrow> (\<forall>i\<in>Basis. a \<bullet> i < x \<bullet> i \<and> x \<bullet> i < b \<bullet> i)"
     "x \<in> cbox a b \<longleftrightarrow> (\<forall>i\<in>Basis. a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> b \<bullet> i)"
   by (auto simp: box_eucl_less eucl_less_def cbox_def)
 
 lemma cbox_Pair_eq: "cbox (a, c) (b, d) = cbox a b \<times> cbox c d"
   by (force simp: cbox_def Basis_prod_def)
 
 lemma cbox_Pair_iff [iff]: "(x, y) \<in> cbox (a, c) (b, d) \<longleftrightarrow> x \<in> cbox a b \<and> y \<in> cbox c d"
   by (force simp: cbox_Pair_eq)
 
 lemma cbox_Complex_eq: "cbox (Complex a c) (Complex b d) = (\<lambda>(x,y). Complex x y) ` (cbox a b \<times> cbox c d)"
   apply (auto simp: cbox_def Basis_complex_def)
   apply (rule_tac x = "(Re x, Im x)" in image_eqI)
   using complex_eq by auto
 
 lemma cbox_Pair_eq_0: "cbox (a, c) (b, d) = {} \<longleftrightarrow> cbox a b = {} \<or> cbox c d = {}"
   by (force simp: cbox_Pair_eq)
 
 lemma swap_cbox_Pair [simp]: "prod.swap ` cbox (c, a) (d, b) = cbox (a,c) (b,d)"
   by auto
 
 lemma mem_box_real[simp]:
   "(x::real) \<in> box a b \<longleftrightarrow> a < x \<and> x < b"
   "(x::real) \<in> cbox a b \<longleftrightarrow> a \<le> x \<and> x \<le> b"
   by (auto simp: mem_box)
 
 lemma box_real[simp]:
   fixes a b:: real
   shows "box a b = {a <..< b}" "cbox a b = {a .. b}"
   by auto
 
 lemma box_Int_box:
   fixes a :: "'a::euclidean_space"
   shows "box a b \<inter> box c d =
     box (\<Sum>i\<in>Basis. max (a\<bullet>i) (c\<bullet>i) *\<^sub>R i) (\<Sum>i\<in>Basis. min (b\<bullet>i) (d\<bullet>i) *\<^sub>R i)"
   unfolding set_eq_iff and Int_iff and mem_box by auto
 
 lemma rational_boxes:
   fixes x :: "'a::euclidean_space"
   assumes "e > 0"
   shows "\<exists>a b. (\<forall>i\<in>Basis. a \<bullet> i \<in> \<rat> \<and> b \<bullet> i \<in> \<rat>) \<and> x \<in> box a b \<and> box a b \<subseteq> ball x e"
 proof -
   define e' where "e' = e / (2 * sqrt (real (DIM ('a))))"
   then have e: "e' > 0"
     using assms by (auto)
   have "\<forall>i. \<exists>y. y \<in> \<rat> \<and> y < x \<bullet> i \<and> x \<bullet> i - y < e'" (is "\<forall>i. ?th i")
   proof
     fix i
     from Rats_dense_in_real[of "x \<bullet> i - e'" "x \<bullet> i"] e
     show "?th i" by auto
   qed
   from choice[OF this] obtain a where
     a: "\<forall>xa. a xa \<in> \<rat> \<and> a xa < x \<bullet> xa \<and> x \<bullet> xa - a xa < e'" ..
   have "\<forall>i. \<exists>y. y \<in> \<rat> \<and> x \<bullet> i < y \<and> y - x \<bullet> i < e'" (is "\<forall>i. ?th i")
   proof
     fix i
     from Rats_dense_in_real[of "x \<bullet> i" "x \<bullet> i + e'"] e
     show "?th i" by auto
   qed
   from choice[OF this] obtain b where
     b: "\<forall>xa. b xa \<in> \<rat> \<and> x \<bullet> xa < b xa \<and> b xa - x \<bullet> xa < e'" ..
   let ?a = "\<Sum>i\<in>Basis. a i *\<^sub>R i" and ?b = "\<Sum>i\<in>Basis. b i *\<^sub>R i"
   show ?thesis
   proof (rule exI[of _ ?a], rule exI[of _ ?b], safe)
     fix y :: 'a
     assume *: "y \<in> box ?a ?b"
     have "dist x y = sqrt (\<Sum>i\<in>Basis. (dist (x \<bullet> i) (y \<bullet> i))\<^sup>2)"
       unfolding L2_set_def[symmetric] by (rule euclidean_dist_l2)
     also have "\<dots> < sqrt (\<Sum>(i::'a)\<in>Basis. e^2 / real (DIM('a)))"
     proof (rule real_sqrt_less_mono, rule sum_strict_mono)
       fix i :: "'a"
       assume i: "i \<in> Basis"
       have "a i < y\<bullet>i \<and> y\<bullet>i < b i"
         using * i by (auto simp: box_def)
       moreover have "a i < x\<bullet>i" "x\<bullet>i - a i < e'"
         using a by auto
       moreover have "x\<bullet>i < b i" "b i - x\<bullet>i < e'"
         using b by auto
       ultimately have "\<bar>x\<bullet>i - y\<bullet>i\<bar> < 2 * e'"
         by auto
       then have "dist (x \<bullet> i) (y \<bullet> i) < e/sqrt (real (DIM('a)))"
         unfolding e'_def by (auto simp: dist_real_def)
       then have "(dist (x \<bullet> i) (y \<bullet> i))\<^sup>2 < (e/sqrt (real (DIM('a))))\<^sup>2"
         by (rule power_strict_mono) auto
       then show "(dist (x \<bullet> i) (y \<bullet> i))\<^sup>2 < e\<^sup>2 / real DIM('a)"
         by (simp add: power_divide)
     qed auto
     also have "\<dots> = e"
       using \<open>0 < e\<close> by simp
     finally show "y \<in> ball x e"
       by (auto simp: ball_def)
   qed (insert a b, auto simp: box_def)
 qed
 
 lemma open_UNION_box:
   fixes M :: "'a::euclidean_space set"
   assumes "open M"
   defines "a' \<equiv> \<lambda>f :: 'a \<Rightarrow> real \<times> real. (\<Sum>(i::'a)\<in>Basis. fst (f i) *\<^sub>R i)"
   defines "b' \<equiv> \<lambda>f :: 'a \<Rightarrow> real \<times> real. (\<Sum>(i::'a)\<in>Basis. snd (f i) *\<^sub>R i)"
   defines "I \<equiv> {f\<in>Basis \<rightarrow>\<^sub>E \<rat> \<times> \<rat>. box (a' f) (b' f) \<subseteq> M}"
   shows "M = (\<Union>f\<in>I. box (a' f) (b' f))"
 proof -
   have "x \<in> (\<Union>f\<in>I. box (a' f) (b' f))" if "x \<in> M" for x
   proof -
     obtain e where e: "e > 0" "ball x e \<subseteq> M"
       using openE[OF \<open>open M\<close> \<open>x \<in> M\<close>] by auto
     moreover obtain a b where ab:
       "x \<in> box a b"
       "\<forall>i \<in> Basis. a \<bullet> i \<in> \<rat>"
       "\<forall>i\<in>Basis. b \<bullet> i \<in> \<rat>"
       "box a b \<subseteq> ball x e"
       using rational_boxes[OF e(1)] by metis
     ultimately show ?thesis
        by (intro UN_I[of "\<lambda>i\<in>Basis. (a \<bullet> i, b \<bullet> i)"])
           (auto simp: euclidean_representation I_def a'_def b'_def)
   qed
   then show ?thesis by (auto simp: I_def)
 qed
 
 corollary open_countable_Union_open_box:
   fixes S :: "'a :: euclidean_space set"
   assumes "open S"
   obtains \<D> where "countable \<D>" "\<D> \<subseteq> Pow S" "\<And>X. X \<in> \<D> \<Longrightarrow> \<exists>a b. X = box a b" "\<Union>\<D> = S"
 proof -
   let ?a = "\<lambda>f. (\<Sum>(i::'a)\<in>Basis. fst (f i) *\<^sub>R i)"
   let ?b = "\<lambda>f. (\<Sum>(i::'a)\<in>Basis. snd (f i) *\<^sub>R i)"
   let ?I = "{f\<in>Basis \<rightarrow>\<^sub>E \<rat> \<times> \<rat>. box (?a f) (?b f) \<subseteq> S}"
   let ?\<D> = "(\<lambda>f. box (?a f) (?b f)) ` ?I"
   show ?thesis
   proof
     have "countable ?I"
       by (simp add: countable_PiE countable_rat)
     then show "countable ?\<D>"
       by blast
     show "\<Union>?\<D> = S"
       using open_UNION_box [OF assms] by metis
   qed auto
 qed
 
 lemma rational_cboxes:
   fixes x :: "'a::euclidean_space"
   assumes "e > 0"
   shows "\<exists>a b. (\<forall>i\<in>Basis. a \<bullet> i \<in> \<rat> \<and> b \<bullet> i \<in> \<rat>) \<and> x \<in> cbox a b \<and> cbox a b \<subseteq> ball x e"
 proof -
   define e' where "e' = e / (2 * sqrt (real (DIM ('a))))"
   then have e: "e' > 0"
     using assms by auto
   have "\<forall>i. \<exists>y. y \<in> \<rat> \<and> y < x \<bullet> i \<and> x \<bullet> i - y < e'" (is "\<forall>i. ?th i")
   proof
     fix i
     from Rats_dense_in_real[of "x \<bullet> i - e'" "x \<bullet> i"] e
     show "?th i" by auto
   qed
   from choice[OF this] obtain a where
     a: "\<forall>u. a u \<in> \<rat> \<and> a u < x \<bullet> u \<and> x \<bullet> u - a u < e'" ..
   have "\<forall>i. \<exists>y. y \<in> \<rat> \<and> x \<bullet> i < y \<and> y - x \<bullet> i < e'" (is "\<forall>i. ?th i")
   proof
     fix i
     from Rats_dense_in_real[of "x \<bullet> i" "x \<bullet> i + e'"] e
     show "?th i" by auto
   qed
   from choice[OF this] obtain b where
     b: "\<forall>u. b u \<in> \<rat> \<and> x \<bullet> u < b u \<and> b u - x \<bullet> u < e'" ..
   let ?a = "\<Sum>i\<in>Basis. a i *\<^sub>R i" and ?b = "\<Sum>i\<in>Basis. b i *\<^sub>R i"
   show ?thesis
   proof (rule exI[of _ ?a], rule exI[of _ ?b], safe)
     fix y :: 'a
     assume *: "y \<in> cbox ?a ?b"
     have "dist x y = sqrt (\<Sum>i\<in>Basis. (dist (x \<bullet> i) (y \<bullet> i))\<^sup>2)"
       unfolding L2_set_def[symmetric] by (rule euclidean_dist_l2)
     also have "\<dots> < sqrt (\<Sum>(i::'a)\<in>Basis. e^2 / real (DIM('a)))"
     proof (rule real_sqrt_less_mono, rule sum_strict_mono)
       fix i :: "'a"
       assume i: "i \<in> Basis"
       have "a i \<le> y\<bullet>i \<and> y\<bullet>i \<le> b i"
         using * i by (auto simp: cbox_def)
       moreover have "a i < x\<bullet>i" "x\<bullet>i - a i < e'"
         using a by auto
       moreover have "x\<bullet>i < b i" "b i - x\<bullet>i < e'"
         using b by auto
       ultimately have "\<bar>x\<bullet>i - y\<bullet>i\<bar> < 2 * e'"
         by auto
       then have "dist (x \<bullet> i) (y \<bullet> i) < e/sqrt (real (DIM('a)))"
         unfolding e'_def by (auto simp: dist_real_def)
       then have "(dist (x \<bullet> i) (y \<bullet> i))\<^sup>2 < (e/sqrt (real (DIM('a))))\<^sup>2"
         by (rule power_strict_mono) auto
       then show "(dist (x \<bullet> i) (y \<bullet> i))\<^sup>2 < e\<^sup>2 / real DIM('a)"
         by (simp add: power_divide)
     qed auto
     also have "\<dots> = e"
       using \<open>0 < e\<close> by simp
     finally show "y \<in> ball x e"
       by (auto simp: ball_def)
   next
     show "x \<in> cbox (\<Sum>i\<in>Basis. a i *\<^sub>R i) (\<Sum>i\<in>Basis. b i *\<^sub>R i)"
       using a b less_imp_le by (auto simp: cbox_def)
   qed (use a b cbox_def in auto)
 qed
 
 lemma open_UNION_cbox:
   fixes M :: "'a::euclidean_space set"
   assumes "open M"
   defines "a' \<equiv> \<lambda>f. (\<Sum>(i::'a)\<in>Basis. fst (f i) *\<^sub>R i)"
   defines "b' \<equiv> \<lambda>f. (\<Sum>(i::'a)\<in>Basis. snd (f i) *\<^sub>R i)"
   defines "I \<equiv> {f\<in>Basis \<rightarrow>\<^sub>E \<rat> \<times> \<rat>. cbox (a' f) (b' f) \<subseteq> M}"
   shows "M = (\<Union>f\<in>I. cbox (a' f) (b' f))"
 proof -
   have "x \<in> (\<Union>f\<in>I. cbox (a' f) (b' f))" if "x \<in> M" for x
   proof -
     obtain e where e: "e > 0" "ball x e \<subseteq> M"
       using openE[OF \<open>open M\<close> \<open>x \<in> M\<close>] by auto
     moreover obtain a b where ab: "x \<in> cbox a b" "\<forall>i \<in> Basis. a \<bullet> i \<in> \<rat>"
                                   "\<forall>i \<in> Basis. b \<bullet> i \<in> \<rat>" "cbox a b \<subseteq> ball x e"
       using rational_cboxes[OF e(1)] by metis
     ultimately show ?thesis
        by (intro UN_I[of "\<lambda>i\<in>Basis. (a \<bullet> i, b \<bullet> i)"])
           (auto simp: euclidean_representation I_def a'_def b'_def)
   qed
   then show ?thesis by (auto simp: I_def)
 qed
 
 corollary open_countable_Union_open_cbox:
   fixes S :: "'a :: euclidean_space set"
   assumes "open S"
   obtains \<D> where "countable \<D>" "\<D> \<subseteq> Pow S" "\<And>X. X \<in> \<D> \<Longrightarrow> \<exists>a b. X = cbox a b" "\<Union>\<D> = S"
 proof -
   let ?a = "\<lambda>f. (\<Sum>(i::'a)\<in>Basis. fst (f i) *\<^sub>R i)"
   let ?b = "\<lambda>f. (\<Sum>(i::'a)\<in>Basis. snd (f i) *\<^sub>R i)"
   let ?I = "{f\<in>Basis \<rightarrow>\<^sub>E \<rat> \<times> \<rat>. cbox (?a f) (?b f) \<subseteq> S}"
   let ?\<D> = "(\<lambda>f. cbox (?a f) (?b f)) ` ?I"
   show ?thesis
   proof
     have "countable ?I"
       by (simp add: countable_PiE countable_rat)
     then show "countable ?\<D>"
       by blast
     show "\<Union>?\<D> = S"
       using open_UNION_cbox [OF assms] by metis
   qed auto
 qed
 
 lemma box_eq_empty:
   fixes a :: "'a::euclidean_space"
   shows "(box a b = {} \<longleftrightarrow> (\<exists>i\<in>Basis. b\<bullet>i \<le> a\<bullet>i))" (is ?th1)
     and "(cbox a b = {} \<longleftrightarrow> (\<exists>i\<in>Basis. b\<bullet>i < a\<bullet>i))" (is ?th2)
 proof -
   {
     fix i x
     assume i: "i\<in>Basis" and as:"b\<bullet>i \<le> a\<bullet>i" and x:"x\<in>box a b"
     then have "a \<bullet> i < x \<bullet> i \<and> x \<bullet> i < b \<bullet> i"
       unfolding mem_box by (auto simp: box_def)
     then have "a\<bullet>i < b\<bullet>i" by auto
     then have False using as by auto
   }
   moreover
   {
     assume as: "\<forall>i\<in>Basis. \<not> (b\<bullet>i \<le> a\<bullet>i)"
     let ?x = "(1/2) *\<^sub>R (a + b)"
     {
       fix i :: 'a
       assume i: "i \<in> Basis"
       have "a\<bullet>i < b\<bullet>i"
         using as[THEN bspec[where x=i]] i by auto
       then have "a\<bullet>i < ((1/2) *\<^sub>R (a+b)) \<bullet> i" "((1/2) *\<^sub>R (a+b)) \<bullet> i < b\<bullet>i"
         by (auto simp: inner_add_left)
     }
     then have "box a b \<noteq> {}"
       using mem_box(1)[of "?x" a b] by auto
   }
   ultimately show ?th1 by blast
 
   {
     fix i x
     assume i: "i \<in> Basis" and as:"b\<bullet>i < a\<bullet>i" and x:"x\<in>cbox a b"
     then have "a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> b \<bullet> i"
       unfolding mem_box by auto
     then have "a\<bullet>i \<le> b\<bullet>i" by auto
     then have False using as by auto
   }
   moreover
   {
     assume as:"\<forall>i\<in>Basis. \<not> (b\<bullet>i < a\<bullet>i)"
     let ?x = "(1/2) *\<^sub>R (a + b)"
     {
       fix i :: 'a
       assume i:"i \<in> Basis"
       have "a\<bullet>i \<le> b\<bullet>i"
         using as[THEN bspec[where x=i]] i by auto
       then have "a\<bullet>i \<le> ((1/2) *\<^sub>R (a+b)) \<bullet> i" "((1/2) *\<^sub>R (a+b)) \<bullet> i \<le> b\<bullet>i"
         by (auto simp: inner_add_left)
     }
     then have "cbox a b \<noteq> {}"
       using mem_box(2)[of "?x" a b] by auto
   }
   ultimately show ?th2 by blast
 qed
 
 lemma box_ne_empty:
   fixes a :: "'a::euclidean_space"
   shows "cbox a b \<noteq> {} \<longleftrightarrow> (\<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i)"
   and "box a b \<noteq> {} \<longleftrightarrow> (\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i)"
   unfolding box_eq_empty[of a b] by fastforce+
 
 lemma
   fixes a :: "'a::euclidean_space"
   shows cbox_sing [simp]: "cbox a a = {a}"
     and box_sing [simp]: "box a a = {}"
   unfolding set_eq_iff mem_box eq_iff [symmetric]
   by (auto intro!: euclidean_eqI[where 'a='a])
      (metis all_not_in_conv nonempty_Basis)
 
 lemma subset_box_imp:
   fixes a :: "'a::euclidean_space"
   shows "(\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i) \<Longrightarrow> cbox c d \<subseteq> cbox a b"
     and "(\<forall>i\<in>Basis. a\<bullet>i < c\<bullet>i \<and> d\<bullet>i < b\<bullet>i) \<Longrightarrow> cbox c d \<subseteq> box a b"
     and "(\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i) \<Longrightarrow> box c d \<subseteq> cbox a b"
      and "(\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i) \<Longrightarrow> box c d \<subseteq> box a b"
   unfolding subset_eq[unfolded Ball_def] unfolding mem_box
   by (best intro: order_trans less_le_trans le_less_trans less_imp_le)+
 
 lemma box_subset_cbox:
   fixes a :: "'a::euclidean_space"
   shows "box a b \<subseteq> cbox a b"
   unfolding subset_eq [unfolded Ball_def] mem_box
   by (fast intro: less_imp_le)
 
 lemma subset_box:
   fixes a :: "'a::euclidean_space"
   shows "cbox c d \<subseteq> cbox a b \<longleftrightarrow> (\<forall>i\<in>Basis. c\<bullet>i \<le> d\<bullet>i) \<longrightarrow> (\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i)" (is ?th1)
     and "cbox c d \<subseteq> box a b \<longleftrightarrow> (\<forall>i\<in>Basis. c\<bullet>i \<le> d\<bullet>i) \<longrightarrow> (\<forall>i\<in>Basis. a\<bullet>i < c\<bullet>i \<and> d\<bullet>i < b\<bullet>i)" (is ?th2)
     and "box c d \<subseteq> cbox a b \<longleftrightarrow> (\<forall>i\<in>Basis. c\<bullet>i < d\<bullet>i) \<longrightarrow> (\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i)" (is ?th3)
     and "box c d \<subseteq> box a b \<longleftrightarrow> (\<forall>i\<in>Basis. c\<bullet>i < d\<bullet>i) \<longrightarrow> (\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i)" (is ?th4)
 proof -
   let ?lesscd = "\<forall>i\<in>Basis. c\<bullet>i < d\<bullet>i"
   let ?lerhs = "\<forall>i\<in>Basis. a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i"
   show ?th1 ?th2
     by (fastforce simp: mem_box)+
   have acdb: "a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i"
     if i: "i \<in> Basis" and box: "box c d \<subseteq> cbox a b" and cd: "\<And>i. i \<in> Basis \<Longrightarrow> c\<bullet>i < d\<bullet>i" for i
   proof -
     have "box c d \<noteq> {}"
       using that
       unfolding box_eq_empty by force
     { let ?x = "(\<Sum>j\<in>Basis. (if j=i then ((min (a\<bullet>j) (d\<bullet>j))+c\<bullet>j)/2 else (c\<bullet>j+d\<bullet>j)/2) *\<^sub>R j)::'a"
       assume *: "a\<bullet>i > c\<bullet>i"
       then have "c \<bullet> j < ?x \<bullet> j \<and> ?x \<bullet> j < d \<bullet> j" if "j \<in> Basis" for j
         using cd that by (fastforce simp add: i *)
       then have "?x \<in> box c d"
         unfolding mem_box by auto
       moreover have "?x \<notin> cbox a b"
         using i cd * by (force simp: mem_box)
       ultimately have False using box by auto
     }
     then have "a\<bullet>i \<le> c\<bullet>i" by force
     moreover
     { let ?x = "(\<Sum>j\<in>Basis. (if j=i then ((max (b\<bullet>j) (c\<bullet>j))+d\<bullet>j)/2 else (c\<bullet>j+d\<bullet>j)/2) *\<^sub>R j)::'a"
       assume *: "b\<bullet>i < d\<bullet>i"
       then have "d \<bullet> j > ?x \<bullet> j \<and> ?x \<bullet> j > c \<bullet> j" if "j \<in> Basis" for j
         using cd that by (fastforce simp add: i *)
       then have "?x \<in> box c d"
         unfolding mem_box by auto
       moreover have "?x \<notin> cbox a b"
         using i cd * by (force simp: mem_box)
       ultimately have False using box by auto
     }
     then have "b\<bullet>i \<ge> d\<bullet>i" by (rule ccontr) auto
     ultimately show ?thesis by auto
   qed
   show ?th3
     using acdb by (fastforce simp add: mem_box)
   have acdb': "a\<bullet>i \<le> c\<bullet>i \<and> d\<bullet>i \<le> b\<bullet>i"
     if "i \<in> Basis" "box c d \<subseteq> box a b" "\<And>i. i \<in> Basis \<Longrightarrow> c\<bullet>i < d\<bullet>i" for i
       using box_subset_cbox[of a b] that acdb by auto
   show ?th4
     using acdb' by (fastforce simp add: mem_box)
 qed
 
 lemma eq_cbox: "cbox a b = cbox c d \<longleftrightarrow> cbox a b = {} \<and> cbox c d = {} \<or> a = c \<and> b = d"
       (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then have "cbox a b \<subseteq> cbox c d" "cbox c d \<subseteq> cbox a b"
     by auto
   then show ?rhs
     by (force simp: subset_box box_eq_empty intro: antisym euclidean_eqI)
 next
   assume ?rhs
   then show ?lhs
     by force
 qed
 
 lemma eq_cbox_box [simp]: "cbox a b = box c d \<longleftrightarrow> cbox a b = {} \<and> box c d = {}"
   (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   assume L: ?lhs
   then have "cbox a b \<subseteq> box c d" "box c d \<subseteq> cbox a b"
     by auto
   then show ?rhs
     apply (simp add: subset_box)
     using L box_ne_empty box_sing apply (fastforce simp add:)
     done
 qed force
 
 lemma eq_box_cbox [simp]: "box a b = cbox c d \<longleftrightarrow> box a b = {} \<and> cbox c d = {}"
   by (metis eq_cbox_box)
 
 lemma eq_box: "box a b = box c d \<longleftrightarrow> box a b = {} \<and> box c d = {} \<or> a = c \<and> b = d"
   (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   assume L: ?lhs
   then have "box a b \<subseteq> box c d" "box c d \<subseteq> box a b"
     by auto
   then show ?rhs
     apply (simp add: subset_box)
     using box_ne_empty(2) L
     apply auto
      apply (meson euclidean_eqI less_eq_real_def not_less)+
     done
 qed force
 
 lemma subset_box_complex:
    "cbox a b \<subseteq> cbox c d \<longleftrightarrow>
       (Re a \<le> Re b \<and> Im a \<le> Im b) \<longrightarrow> Re a \<ge> Re c \<and> Im a \<ge> Im c \<and> Re b \<le> Re d \<and> Im b \<le> Im d"
    "cbox a b \<subseteq> box c d \<longleftrightarrow>
       (Re a \<le> Re b \<and> Im a \<le> Im b) \<longrightarrow> Re a > Re c \<and> Im a > Im c \<and> Re b < Re d \<and> Im b < Im d"
    "box a b \<subseteq> cbox c d \<longleftrightarrow>
       (Re a < Re b \<and> Im a < Im b) \<longrightarrow> Re a \<ge> Re c \<and> Im a \<ge> Im c \<and> Re b \<le> Re d \<and> Im b \<le> Im d"
    "box a b \<subseteq> box c d \<longleftrightarrow>
       (Re a < Re b \<and> Im a < Im b) \<longrightarrow> Re a \<ge> Re c \<and> Im a \<ge> Im c \<and> Re b \<le> Re d \<and> Im b \<le> Im d"
   by (subst subset_box; force simp: Basis_complex_def)+
 
 lemma in_cbox_complex_iff:
   "x \<in> cbox a b \<longleftrightarrow> Re x \<in> {Re a..Re b} \<and> Im x \<in> {Im a..Im b}"
   by (cases x; cases a; cases b) (auto simp: cbox_Complex_eq)
 
+lemma cbox_complex_of_real: "cbox (complex_of_real x) (complex_of_real y) = complex_of_real ` {x..y}"
+proof -
+  have "(x \<le> Re z \<and> Re z \<le> y \<and> Im z = 0) = (z \<in> complex_of_real ` {x..y})" for z
+    by (cases z) (simp add: complex_eq_cancel_iff2 image_iff)
+  then show ?thesis
+    by (auto simp: in_cbox_complex_iff)
+qed
+
 lemma box_Complex_eq:
   "box (Complex a c) (Complex b d) = (\<lambda>(x,y). Complex x y) ` (box a b \<times> box c d)"
   by (auto simp: box_def Basis_complex_def image_iff complex_eq_iff)
 
 lemma in_box_complex_iff:
   "x \<in> box a b \<longleftrightarrow> Re x \<in> {Re a<..<Re b} \<and> Im x \<in> {Im a<..<Im b}"
   by (cases x; cases a; cases b) (auto simp: box_Complex_eq)
 
+lemma box_complex_of_real [simp]: "box (complex_of_real x) (complex_of_real y) = {}"
+  by (auto simp: in_box_complex_iff)
+
 lemma Int_interval:
   fixes a :: "'a::euclidean_space"
   shows "cbox a b \<inter> cbox c d =
     cbox (\<Sum>i\<in>Basis. max (a\<bullet>i) (c\<bullet>i) *\<^sub>R i) (\<Sum>i\<in>Basis. min (b\<bullet>i) (d\<bullet>i) *\<^sub>R i)"
   unfolding set_eq_iff and Int_iff and mem_box
   by auto
 
 lemma disjoint_interval:
   fixes a::"'a::euclidean_space"
   shows "cbox a b \<inter> cbox c d = {} \<longleftrightarrow> (\<exists>i\<in>Basis. (b\<bullet>i < a\<bullet>i \<or> d\<bullet>i < c\<bullet>i \<or> b\<bullet>i < c\<bullet>i \<or> d\<bullet>i < a\<bullet>i))" (is ?th1)
     and "cbox a b \<inter> box c d = {} \<longleftrightarrow> (\<exists>i\<in>Basis. (b\<bullet>i < a\<bullet>i \<or> d\<bullet>i \<le> c\<bullet>i \<or> b\<bullet>i \<le> c\<bullet>i \<or> d\<bullet>i \<le> a\<bullet>i))" (is ?th2)
     and "box a b \<inter> cbox c d = {} \<longleftrightarrow> (\<exists>i\<in>Basis. (b\<bullet>i \<le> a\<bullet>i \<or> d\<bullet>i < c\<bullet>i \<or> b\<bullet>i \<le> c\<bullet>i \<or> d\<bullet>i \<le> a\<bullet>i))" (is ?th3)
     and "box a b \<inter> box c d = {} \<longleftrightarrow> (\<exists>i\<in>Basis. (b\<bullet>i \<le> a\<bullet>i \<or> d\<bullet>i \<le> c\<bullet>i \<or> b\<bullet>i \<le> c\<bullet>i \<or> d\<bullet>i \<le> a\<bullet>i))" (is ?th4)
 proof -
   let ?z = "(\<Sum>i\<in>Basis. (((max (a\<bullet>i) (c\<bullet>i)) + (min (b\<bullet>i) (d\<bullet>i))) / 2) *\<^sub>R i)::'a"
   have **: "\<And>P Q. (\<And>i :: 'a. i \<in> Basis \<Longrightarrow> Q ?z i \<Longrightarrow> P i) \<Longrightarrow>
       (\<And>i x :: 'a. i \<in> Basis \<Longrightarrow> P i \<Longrightarrow> Q x i) \<Longrightarrow> (\<forall>x. \<exists>i\<in>Basis. Q x i) \<longleftrightarrow> (\<exists>i\<in>Basis. P i)"
     by blast
   note * = set_eq_iff Int_iff empty_iff mem_box ball_conj_distrib[symmetric] eq_False ball_simps(10)
   show ?th1 unfolding * by (intro **) auto
   show ?th2 unfolding * by (intro **) auto
   show ?th3 unfolding * by (intro **) auto
   show ?th4 unfolding * by (intro **) auto
 qed
 
 lemma UN_box_eq_UNIV: "(\<Union>i::nat. box (- (real i *\<^sub>R One)) (real i *\<^sub>R One)) = UNIV"
 proof -
   have "\<bar>x \<bullet> b\<bar> < real_of_int (\<lceil>Max ((\<lambda>b. \<bar>x \<bullet> b\<bar>)`Basis)\<rceil> + 1)"
     if [simp]: "b \<in> Basis" for x b :: 'a
   proof -
     have "\<bar>x \<bullet> b\<bar> \<le> real_of_int \<lceil>\<bar>x \<bullet> b\<bar>\<rceil>"
       by (rule le_of_int_ceiling)
     also have "\<dots> \<le> real_of_int \<lceil>Max ((\<lambda>b. \<bar>x \<bullet> b\<bar>)`Basis)\<rceil>"
       by (auto intro!: ceiling_mono)
     also have "\<dots> < real_of_int (\<lceil>Max ((\<lambda>b. \<bar>x \<bullet> b\<bar>)`Basis)\<rceil> + 1)"
       by simp
     finally show ?thesis .
   qed
   then have "\<exists>n::nat. \<forall>b\<in>Basis. \<bar>x \<bullet> b\<bar> < real n" for x :: 'a
     by (metis order.strict_trans reals_Archimedean2)
   moreover have "\<And>x b::'a. \<And>n::nat.  \<bar>x \<bullet> b\<bar> < real n \<longleftrightarrow> - real n < x \<bullet> b \<and> x \<bullet> b < real n"
     by auto
   ultimately show ?thesis
     by (auto simp: box_def inner_sum_left inner_Basis sum.If_cases)
 qed
 
 lemma image_affinity_cbox: fixes m::real
   fixes a b c :: "'a::euclidean_space"
   shows "(\<lambda>x. m *\<^sub>R x + c) ` cbox a b =
     (if cbox a b = {} then {}
      else (if 0 \<le> m then cbox (m *\<^sub>R a + c) (m *\<^sub>R b + c)
      else cbox (m *\<^sub>R b + c) (m *\<^sub>R a + c)))"
 proof (cases "m = 0")
   case True
   {
     fix x
     assume "\<forall>i\<in>Basis. x \<bullet> i \<le> c \<bullet> i" "\<forall>i\<in>Basis. c \<bullet> i \<le> x \<bullet> i"
     then have "x = c"
       by (simp add: dual_order.antisym euclidean_eqI)
   }
   moreover have "c \<in> cbox (m *\<^sub>R a + c) (m *\<^sub>R b + c)"
     unfolding True by (auto)
   ultimately show ?thesis using True by (auto simp: cbox_def)
 next
   case False
   {
     fix y
     assume "\<forall>i\<in>Basis. a \<bullet> i \<le> y \<bullet> i" "\<forall>i\<in>Basis. y \<bullet> i \<le> b \<bullet> i" "m > 0"
     then have "\<forall>i\<in>Basis. (m *\<^sub>R a + c) \<bullet> i \<le> (m *\<^sub>R y + c) \<bullet> i" and "\<forall>i\<in>Basis. (m *\<^sub>R y + c) \<bullet> i \<le> (m *\<^sub>R b + c) \<bullet> i"
       by (auto simp: inner_distrib)
   }
   moreover
   {
     fix y
     assume "\<forall>i\<in>Basis. a \<bullet> i \<le> y \<bullet> i" "\<forall>i\<in>Basis. y \<bullet> i \<le> b \<bullet> i" "m < 0"
     then have "\<forall>i\<in>Basis. (m *\<^sub>R b + c) \<bullet> i \<le> (m *\<^sub>R y + c) \<bullet> i" and "\<forall>i\<in>Basis. (m *\<^sub>R y + c) \<bullet> i \<le> (m *\<^sub>R a + c) \<bullet> i"
       by (auto simp: mult_left_mono_neg inner_distrib)
   }
   moreover
   {
     fix y
     assume "m > 0" and "\<forall>i\<in>Basis. (m *\<^sub>R a + c) \<bullet> i \<le> y \<bullet> i" and "\<forall>i\<in>Basis. y \<bullet> i \<le> (m *\<^sub>R b + c) \<bullet> i"
     then have "y \<in> (\<lambda>x. m *\<^sub>R x + c) ` cbox a b"
       unfolding image_iff Bex_def mem_box
       apply (intro exI[where x="(1 / m) *\<^sub>R (y - c)"])
       apply (auto simp: pos_le_divide_eq pos_divide_le_eq mult.commute inner_distrib inner_diff_left)
       done
   }
   moreover
   {
     fix y
     assume "\<forall>i\<in>Basis. (m *\<^sub>R b + c) \<bullet> i \<le> y \<bullet> i" "\<forall>i\<in>Basis. y \<bullet> i \<le> (m *\<^sub>R a + c) \<bullet> i" "m < 0"
     then have "y \<in> (\<lambda>x. m *\<^sub>R x + c) ` cbox a b"
       unfolding image_iff Bex_def mem_box
       apply (intro exI[where x="(1 / m) *\<^sub>R (y - c)"])
       apply (auto simp: neg_le_divide_eq neg_divide_le_eq mult.commute inner_distrib inner_diff_left)
       done
   }
   ultimately show ?thesis using False by (auto simp: cbox_def)
 qed
 
 lemma image_smult_cbox:"(\<lambda>x. m *\<^sub>R (x::_::euclidean_space)) ` cbox a b =
   (if cbox a b = {} then {} else if 0 \<le> m then cbox (m *\<^sub>R a) (m *\<^sub>R b) else cbox (m *\<^sub>R b) (m *\<^sub>R a))"
   using image_affinity_cbox[of m 0 a b] by auto
 
 lemma swap_continuous:
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "continuous_on (cbox (c,a) (d,b)) (\<lambda>(x, y). f y x)"
 proof -
   have "(\<lambda>(x, y). f y x) = (\<lambda>(x, y). f x y) \<circ> prod.swap"
     by auto
   then show ?thesis
     apply (rule ssubst)
     apply (rule continuous_on_compose)
     apply (simp add: split_def)
     apply (rule continuous_intros | simp add: assms)+
     done
 qed
 
 
 subsection \<open>General Intervals\<close>
 
 definition\<^marker>\<open>tag important\<close> "is_interval (s::('a::euclidean_space) set) \<longleftrightarrow>
   (\<forall>a\<in>s. \<forall>b\<in>s. \<forall>x. (\<forall>i\<in>Basis. ((a\<bullet>i \<le> x\<bullet>i \<and> x\<bullet>i \<le> b\<bullet>i) \<or> (b\<bullet>i \<le> x\<bullet>i \<and> x\<bullet>i \<le> a\<bullet>i))) \<longrightarrow> x \<in> s)"
 
 lemma is_interval_1:
   "is_interval (s::real set) \<longleftrightarrow> (\<forall>a\<in>s. \<forall>b\<in>s. \<forall> x. a \<le> x \<and> x \<le> b \<longrightarrow> x \<in> s)"
   unfolding is_interval_def by auto
 
 lemma is_interval_Int: "is_interval X \<Longrightarrow> is_interval Y \<Longrightarrow> is_interval (X \<inter> Y)"
   unfolding is_interval_def
   by blast
 
 lemma is_interval_cbox [simp]: "is_interval (cbox a (b::'a::euclidean_space))" (is ?th1)
   and is_interval_box [simp]: "is_interval (box a b)" (is ?th2)
   unfolding is_interval_def mem_box Ball_def atLeastAtMost_iff
   by (meson order_trans le_less_trans less_le_trans less_trans)+
 
 lemma is_interval_empty [iff]: "is_interval {}"
   unfolding is_interval_def  by simp
 
 lemma is_interval_univ [iff]: "is_interval UNIV"
   unfolding is_interval_def  by simp
 
 lemma mem_is_intervalI:
   assumes "is_interval s"
     and "a \<in> s" "b \<in> s"
     and "\<And>i. i \<in> Basis \<Longrightarrow> a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> b \<bullet> i \<or> b \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> a \<bullet> i"
   shows "x \<in> s"
   by (rule assms(1)[simplified is_interval_def, rule_format, OF assms(2,3,4)])
 
 lemma interval_subst:
   fixes S::"'a::euclidean_space set"
   assumes "is_interval S"
     and "x \<in> S" "y j \<in> S"
     and "j \<in> Basis"
   shows "(\<Sum>i\<in>Basis. (if i = j then y i \<bullet> i else x \<bullet> i) *\<^sub>R i) \<in> S"
   by (rule mem_is_intervalI[OF assms(1,2)]) (auto simp: assms)
 
 lemma mem_box_componentwiseI:
   fixes S::"'a::euclidean_space set"
   assumes "is_interval S"
   assumes "\<And>i. i \<in> Basis \<Longrightarrow> x \<bullet> i \<in> ((\<lambda>x. x \<bullet> i) ` S)"
   shows "x \<in> S"
 proof -
   from assms have "\<forall>i \<in> Basis. \<exists>s \<in> S. x \<bullet> i = s \<bullet> i"
     by auto
   with finite_Basis obtain s and bs::"'a list"
     where s: "\<And>i. i \<in> Basis \<Longrightarrow> x \<bullet> i = s i \<bullet> i" "\<And>i. i \<in> Basis \<Longrightarrow> s i \<in> S"
       and bs: "set bs = Basis" "distinct bs"
     by (metis finite_distinct_list)
   from nonempty_Basis s obtain j where j: "j \<in> Basis" "s j \<in> S"
     by blast
   define y where
     "y = rec_list (s j) (\<lambda>j _ Y. (\<Sum>i\<in>Basis. (if i = j then s i \<bullet> i else Y \<bullet> i) *\<^sub>R i))"
   have "x = (\<Sum>i\<in>Basis. (if i \<in> set bs then s i \<bullet> i else s j \<bullet> i) *\<^sub>R i)"
     using bs by (auto simp: s(1)[symmetric] euclidean_representation)
   also have [symmetric]: "y bs = \<dots>"
     using bs(2) bs(1)[THEN equalityD1]
     by (induct bs) (auto simp: y_def euclidean_representation intro!: euclidean_eqI[where 'a='a])
   also have "y bs \<in> S"
     using bs(1)[THEN equalityD1]
     apply (induct bs)
      apply (auto simp: y_def j)
     apply (rule interval_subst[OF assms(1)])
       apply (auto simp: s)
     done
   finally show ?thesis .
 qed
 
 lemma cbox01_nonempty [simp]: "cbox 0 One \<noteq> {}"
   by (simp add: box_ne_empty inner_Basis inner_sum_left sum_nonneg)
 
 lemma box01_nonempty [simp]: "box 0 One \<noteq> {}"
   by (simp add: box_ne_empty inner_Basis inner_sum_left)
 
 lemma empty_as_interval: "{} = cbox One (0::'a::euclidean_space)"
   using nonempty_Basis box01_nonempty box_eq_empty(1) box_ne_empty(1) by blast
 
 lemma interval_subset_is_interval:
   assumes "is_interval S"
   shows "cbox a b \<subseteq> S \<longleftrightarrow> cbox a b = {} \<or> a \<in> S \<and> b \<in> S" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs  using box_ne_empty(1) mem_box(2) by fastforce
 next
   assume ?rhs
   have "cbox a b \<subseteq> S" if "a \<in> S" "b \<in> S"
     using assms unfolding is_interval_def
     apply (clarsimp simp add: mem_box)
     using that by blast
   with \<open>?rhs\<close> show ?lhs
     by blast
 qed
 
 lemma is_real_interval_union:
   "is_interval (X \<union> Y)"
   if X: "is_interval X" and Y: "is_interval Y" and I: "(X \<noteq> {} \<Longrightarrow> Y \<noteq> {} \<Longrightarrow> X \<inter> Y \<noteq> {})"
   for X Y::"real set"
 proof -
   consider "X \<noteq> {}" "Y \<noteq> {}" | "X = {}" | "Y = {}" by blast
   then show ?thesis
   proof cases
     case 1
     then obtain r where "r \<in> X \<or> X \<inter> Y = {}" "r \<in> Y \<or> X \<inter> Y = {}"
       by blast
     then show ?thesis
       using I 1 X Y unfolding is_interval_1
       by (metis (full_types) Un_iff le_cases)
   qed (use that in auto)
 qed
 
 lemma is_interval_translationI:
   assumes "is_interval X"
   shows "is_interval ((+) x ` X)"
   unfolding is_interval_def
 proof safe
   fix b d e
   assume "b \<in> X" "d \<in> X"
     "\<forall>i\<in>Basis. (x + b) \<bullet> i \<le> e \<bullet> i \<and> e \<bullet> i \<le> (x + d) \<bullet> i \<or>
        (x + d) \<bullet> i \<le> e \<bullet> i \<and> e \<bullet> i \<le> (x + b) \<bullet> i"
   hence "e - x \<in> X"
     by (intro mem_is_intervalI[OF assms \<open>b \<in> X\<close> \<open>d \<in> X\<close>, of "e - x"])
       (auto simp: algebra_simps)
   thus "e \<in> (+) x ` X" by force
 qed
 
 lemma is_interval_uminusI:
   assumes "is_interval X"
   shows "is_interval (uminus ` X)"
   unfolding is_interval_def
 proof safe
   fix b d e
   assume "b \<in> X" "d \<in> X"
     "\<forall>i\<in>Basis. (- b) \<bullet> i \<le> e \<bullet> i \<and> e \<bullet> i \<le> (- d) \<bullet> i \<or>
        (- d) \<bullet> i \<le> e \<bullet> i \<and> e \<bullet> i \<le> (- b) \<bullet> i"
   hence "- e \<in> X"
     by (intro mem_is_intervalI[OF assms \<open>b \<in> X\<close> \<open>d \<in> X\<close>, of "- e"])
       (auto simp: algebra_simps)
   thus "e \<in> uminus ` X" by force
 qed
 
 lemma is_interval_uminus[simp]: "is_interval (uminus ` x) = is_interval x"
   using is_interval_uminusI[of x] is_interval_uminusI[of "uminus ` x"]
   by (auto simp: image_image)
 
 lemma is_interval_neg_translationI:
   assumes "is_interval X"
   shows "is_interval ((-) x ` X)"
 proof -
   have "(-) x ` X = (+) x ` uminus ` X"
     by (force simp: algebra_simps)
   also have "is_interval \<dots>"
     by (metis is_interval_uminusI is_interval_translationI assms)
   finally show ?thesis .
 qed
 
 lemma is_interval_translation[simp]:
   "is_interval ((+) x ` X) = is_interval X"
   using is_interval_neg_translationI[of "(+) x ` X" x]
   by (auto intro!: is_interval_translationI simp: image_image)
 
 lemma is_interval_minus_translation[simp]:
   shows "is_interval ((-) x ` X) = is_interval X"
 proof -
   have "(-) x ` X = (+) x ` uminus ` X"
     by (force simp: algebra_simps)
   also have "is_interval \<dots> = is_interval X"
     by simp
   finally show ?thesis .
 qed
 
 lemma is_interval_minus_translation'[simp]:
   shows "is_interval ((\<lambda>x. x - c) ` X) = is_interval X"
   using is_interval_translation[of "-c" X]
   by (metis image_cong uminus_add_conv_diff)
 
 lemma is_interval_cball_1[intro, simp]: "is_interval (cball a b)" for a b::real
   by (simp add: cball_eq_atLeastAtMost is_interval_def)
 
 lemma is_interval_ball_real: "is_interval (ball a b)" for a b::real
   by (simp add: ball_eq_greaterThanLessThan is_interval_def)
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Bounded Projections\<close>
 
 lemma bounded_inner_imp_bdd_above:
   assumes "bounded s"
     shows "bdd_above ((\<lambda>x. x \<bullet> a) ` s)"
 by (simp add: assms bounded_imp_bdd_above bounded_linear_image bounded_linear_inner_left)
 
 lemma bounded_inner_imp_bdd_below:
   assumes "bounded s"
     shows "bdd_below ((\<lambda>x. x \<bullet> a) ` s)"
 by (simp add: assms bounded_imp_bdd_below bounded_linear_image bounded_linear_inner_left)
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Structural rules for pointwise continuity\<close>
 
 lemma continuous_infnorm[continuous_intros]:
   "continuous F f \<Longrightarrow> continuous F (\<lambda>x. infnorm (f x))"
   unfolding continuous_def by (rule tendsto_infnorm)
 
 lemma continuous_inner[continuous_intros]:
   assumes "continuous F f"
     and "continuous F g"
   shows "continuous F (\<lambda>x. inner (f x) (g x))"
   using assms unfolding continuous_def by (rule tendsto_inner)
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Structural rules for setwise continuity\<close>
 
 lemma continuous_on_infnorm[continuous_intros]:
   "continuous_on s f \<Longrightarrow> continuous_on s (\<lambda>x. infnorm (f x))"
   unfolding continuous_on by (fast intro: tendsto_infnorm)
 
 lemma continuous_on_inner[continuous_intros]:
   fixes g :: "'a::topological_space \<Rightarrow> 'b::real_inner"
   assumes "continuous_on s f"
     and "continuous_on s g"
   shows "continuous_on s (\<lambda>x. inner (f x) (g x))"
   using bounded_bilinear_inner assms
   by (rule bounded_bilinear.continuous_on)
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Openness of halfspaces.\<close>
 
 lemma open_halfspace_lt: "open {x. inner a x < b}"
   by (simp add: open_Collect_less continuous_on_inner)
 
 lemma open_halfspace_gt: "open {x. inner a x > b}"
   by (simp add: open_Collect_less continuous_on_inner)
 
 lemma open_halfspace_component_lt: "open {x::'a::euclidean_space. x\<bullet>i < a}"
   by (simp add: open_Collect_less continuous_on_inner)
 
 lemma open_halfspace_component_gt: "open {x::'a::euclidean_space. x\<bullet>i > a}"
   by (simp add: open_Collect_less continuous_on_inner)
 
 lemma eucl_less_eq_halfspaces:
   fixes a :: "'a::euclidean_space"
   shows "{x. x <e a} = (\<Inter>i\<in>Basis. {x. x \<bullet> i < a \<bullet> i})"
         "{x. a <e x} = (\<Inter>i\<in>Basis. {x. a \<bullet> i < x \<bullet> i})"
   by (auto simp: eucl_less_def)
 
 lemma open_Collect_eucl_less[simp, intro]:
   fixes a :: "'a::euclidean_space"
   shows "open {x. x <e a}" "open {x. a <e x}"
   by (auto simp: eucl_less_eq_halfspaces open_halfspace_component_lt open_halfspace_component_gt)
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Closure and Interior of halfspaces and hyperplanes\<close>
 
 lemma continuous_at_inner: "continuous (at x) (inner a)"
   unfolding continuous_at by (intro tendsto_intros)
 
 lemma closed_halfspace_le: "closed {x. inner a x \<le> b}"
   by (simp add: closed_Collect_le continuous_on_inner)
 
 lemma closed_halfspace_ge: "closed {x. inner a x \<ge> b}"
   by (simp add: closed_Collect_le continuous_on_inner)
 
 lemma closed_hyperplane: "closed {x. inner a x = b}"
   by (simp add: closed_Collect_eq continuous_on_inner)
 
 lemma closed_halfspace_component_le: "closed {x::'a::euclidean_space. x\<bullet>i \<le> a}"
   by (simp add: closed_Collect_le continuous_on_inner)
 
 lemma closed_halfspace_component_ge: "closed {x::'a::euclidean_space. x\<bullet>i \<ge> a}"
   by (simp add: closed_Collect_le continuous_on_inner)
 
 lemma closed_interval_left:
   fixes b :: "'a::euclidean_space"
   shows "closed {x::'a. \<forall>i\<in>Basis. x\<bullet>i \<le> b\<bullet>i}"
   by (simp add: Collect_ball_eq closed_INT closed_Collect_le continuous_on_inner)
 
 lemma closed_interval_right:
   fixes a :: "'a::euclidean_space"
   shows "closed {x::'a. \<forall>i\<in>Basis. a\<bullet>i \<le> x\<bullet>i}"
   by (simp add: Collect_ball_eq closed_INT closed_Collect_le continuous_on_inner)
 
 lemma interior_halfspace_le [simp]:
   assumes "a \<noteq> 0"
     shows "interior {x. a \<bullet> x \<le> b} = {x. a \<bullet> x < b}"
 proof -
   have *: "a \<bullet> x < b" if x: "x \<in> S" and S: "S \<subseteq> {x. a \<bullet> x \<le> b}" and "open S" for S x
   proof -
     obtain e where "e>0" and e: "cball x e \<subseteq> S"
       using \<open>open S\<close> open_contains_cball x by blast
     then have "x + (e / norm a) *\<^sub>R a \<in> cball x e"
       by (simp add: dist_norm)
     then have "x + (e / norm a) *\<^sub>R a \<in> S"
       using e by blast
     then have "x + (e / norm a) *\<^sub>R a \<in> {x. a \<bullet> x \<le> b}"
       using S by blast
     moreover have "e * (a \<bullet> a) / norm a > 0"
       by (simp add: \<open>0 < e\<close> assms)
     ultimately show ?thesis
       by (simp add: algebra_simps)
   qed
   show ?thesis
     by (rule interior_unique) (auto simp: open_halfspace_lt *)
 qed
 
 lemma interior_halfspace_ge [simp]:
    "a \<noteq> 0 \<Longrightarrow> interior {x. a \<bullet> x \<ge> b} = {x. a \<bullet> x > b}"
 using interior_halfspace_le [of "-a" "-b"] by simp
 
 lemma closure_halfspace_lt [simp]:
   assumes "a \<noteq> 0"
     shows "closure {x. a \<bullet> x < b} = {x. a \<bullet> x \<le> b}"
 proof -
   have [simp]: "-{x. a \<bullet> x < b} = {x. a \<bullet> x \<ge> b}"
     by (force simp:)
   then show ?thesis
     using interior_halfspace_ge [of a b] assms
     by (force simp: closure_interior)
 qed
 
 lemma closure_halfspace_gt [simp]:
    "a \<noteq> 0 \<Longrightarrow> closure {x. a \<bullet> x > b} = {x. a \<bullet> x \<ge> b}"
 using closure_halfspace_lt [of "-a" "-b"] by simp
 
 lemma interior_hyperplane [simp]:
   assumes "a \<noteq> 0"
     shows "interior {x. a \<bullet> x = b} = {}"
 proof -
   have [simp]: "{x. a \<bullet> x = b} = {x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x \<ge> b}"
     by (force simp:)
   then show ?thesis
     by (auto simp: assms)
 qed
 
 lemma frontier_halfspace_le:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0"
     shows "frontier {x. a \<bullet> x \<le> b} = {x. a \<bullet> x = b}"
 proof (cases "a = 0")
   case True with assms show ?thesis by simp
 next
   case False then show ?thesis
     by (force simp: frontier_def closed_halfspace_le)
 qed
 
 lemma frontier_halfspace_ge:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0"
     shows "frontier {x. a \<bullet> x \<ge> b} = {x. a \<bullet> x = b}"
 proof (cases "a = 0")
   case True with assms show ?thesis by simp
 next
   case False then show ?thesis
     by (force simp: frontier_def closed_halfspace_ge)
 qed
 
 lemma frontier_halfspace_lt:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0"
     shows "frontier {x. a \<bullet> x < b} = {x. a \<bullet> x = b}"
 proof (cases "a = 0")
   case True with assms show ?thesis by simp
 next
   case False then show ?thesis
     by (force simp: frontier_def interior_open open_halfspace_lt)
 qed
 
 lemma frontier_halfspace_gt:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0"
     shows "frontier {x. a \<bullet> x > b} = {x. a \<bullet> x = b}"
 proof (cases "a = 0")
   case True with assms show ?thesis by simp
 next
   case False then show ?thesis
     by (force simp: frontier_def interior_open open_halfspace_gt)
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open>Some more convenient intermediate-value theorem formulations\<close>
 
 lemma connected_ivt_hyperplane:
   assumes "connected S" and xy: "x \<in> S" "y \<in> S" and b: "inner a x \<le> b" "b \<le> inner a y"
   shows "\<exists>z \<in> S. inner a z = b"
 proof (rule ccontr)
   assume as:"\<not> (\<exists>z\<in>S. inner a z = b)"
   let ?A = "{x. inner a x < b}"
   let ?B = "{x. inner a x > b}"
   have "open ?A" "open ?B"
     using open_halfspace_lt and open_halfspace_gt by auto
   moreover have "?A \<inter> ?B = {}" by auto
   moreover have "S \<subseteq> ?A \<union> ?B" using as by auto
   ultimately show False
     using \<open>connected S\<close>[unfolded connected_def not_ex,
       THEN spec[where x="?A"], THEN spec[where x="?B"]]
     using xy b by auto
 qed
 
 lemma connected_ivt_component:
   fixes x::"'a::euclidean_space"
   shows "connected S \<Longrightarrow> x \<in> S \<Longrightarrow> y \<in> S \<Longrightarrow> x\<bullet>k \<le> a \<Longrightarrow> a \<le> y\<bullet>k \<Longrightarrow> (\<exists>z\<in>S.  z\<bullet>k = a)"
   using connected_ivt_hyperplane[of S x y "k::'a" a]
   by (auto simp: inner_commute)
 
 
 subsection \<open>Limit Component Bounds\<close>
 
 lemma Lim_component_le:
   fixes f :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes "(f \<longlongrightarrow> l) net"
     and "\<not> (trivial_limit net)"
     and "eventually (\<lambda>x. f(x)\<bullet>i \<le> b) net"
   shows "l\<bullet>i \<le> b"
   by (rule tendsto_le[OF assms(2) tendsto_const tendsto_inner[OF assms(1) tendsto_const] assms(3)])
 
 lemma Lim_component_ge:
   fixes f :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes "(f \<longlongrightarrow> l) net"
     and "\<not> (trivial_limit net)"
     and "eventually (\<lambda>x. b \<le> (f x)\<bullet>i) net"
   shows "b \<le> l\<bullet>i"
   by (rule tendsto_le[OF assms(2) tendsto_inner[OF assms(1) tendsto_const] tendsto_const assms(3)])
 
 lemma Lim_component_eq:
   fixes f :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes net: "(f \<longlongrightarrow> l) net" "\<not> trivial_limit net"
     and ev:"eventually (\<lambda>x. f(x)\<bullet>i = b) net"
   shows "l\<bullet>i = b"
   using ev[unfolded order_eq_iff eventually_conj_iff]
   using Lim_component_ge[OF net, of b i]
   using Lim_component_le[OF net, of i b]
   by auto
 
 lemma open_box[intro]: "open (box a b)"
 proof -
   have "open (\<Inter>i\<in>Basis. ((\<bullet>) i) -` {a \<bullet> i <..< b \<bullet> i})"
     by (auto intro!: continuous_open_vimage continuous_inner continuous_ident continuous_const)
   also have "(\<Inter>i\<in>Basis. ((\<bullet>) i) -` {a \<bullet> i <..< b \<bullet> i}) = box a b"
     by (auto simp: box_def inner_commute)
   finally show ?thesis .
 qed
 
 lemma closed_cbox[intro]:
   fixes a b :: "'a::euclidean_space"
   shows "closed (cbox a b)"
 proof -
   have "closed (\<Inter>i\<in>Basis. (\<lambda>x. x\<bullet>i) -` {a\<bullet>i .. b\<bullet>i})"
     by (intro closed_INT ballI continuous_closed_vimage allI
       linear_continuous_at closed_real_atLeastAtMost finite_Basis bounded_linear_inner_left)
   also have "(\<Inter>i\<in>Basis. (\<lambda>x. x\<bullet>i) -` {a\<bullet>i .. b\<bullet>i}) = cbox a b"
     by (auto simp: cbox_def)
   finally show "closed (cbox a b)" .
 qed
 
 lemma interior_cbox [simp]:
   fixes a b :: "'a::euclidean_space"
   shows "interior (cbox a b) = box a b" (is "?L = ?R")
 proof(rule subset_antisym)
   show "?R \<subseteq> ?L"
     using box_subset_cbox open_box
     by (rule interior_maximal)
   {
     fix x
     assume "x \<in> interior (cbox a b)"
     then obtain s where s: "open s" "x \<in> s" "s \<subseteq> cbox a b" ..
     then obtain e where "e>0" and e:"\<forall>x'. dist x' x < e \<longrightarrow> x' \<in> cbox a b"
       unfolding open_dist and subset_eq by auto
     {
       fix i :: 'a
       assume i: "i \<in> Basis"
       have "dist (x - (e / 2) *\<^sub>R i) x < e"
         and "dist (x + (e / 2) *\<^sub>R i) x < e"
         unfolding dist_norm
         apply auto
         unfolding norm_minus_cancel
         using norm_Basis[OF i] \<open>e>0\<close>
         apply auto
         done
       then have "a \<bullet> i \<le> (x - (e / 2) *\<^sub>R i) \<bullet> i" and "(x + (e / 2) *\<^sub>R i) \<bullet> i \<le> b \<bullet> i"
         using e[THEN spec[where x="x - (e/2) *\<^sub>R i"]]
           and e[THEN spec[where x="x + (e/2) *\<^sub>R i"]]
         unfolding mem_box
         using i
         by blast+
       then have "a \<bullet> i < x \<bullet> i" and "x \<bullet> i < b \<bullet> i"
         using \<open>e>0\<close> i
         by (auto simp: inner_diff_left inner_Basis inner_add_left)
     }
     then have "x \<in> box a b"
       unfolding mem_box by auto
   }
   then show "?L \<subseteq> ?R" ..
 qed
 
 lemma bounded_cbox [simp]:
   fixes a :: "'a::euclidean_space"
   shows "bounded (cbox a b)"
 proof -
   let ?b = "\<Sum>i\<in>Basis. \<bar>a\<bullet>i\<bar> + \<bar>b\<bullet>i\<bar>"
   {
     fix x :: "'a"
     assume "\<And>i. i\<in>Basis \<Longrightarrow> a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> b \<bullet> i"
     then have "(\<Sum>i\<in>Basis. \<bar>x \<bullet> i\<bar>) \<le> ?b"
       by (force simp: intro!: sum_mono)
     then have "norm x \<le> ?b"
       using norm_le_l1[of x] by auto
   }
   then show ?thesis
     unfolding cbox_def bounded_iff by force
 qed
 
 lemma bounded_box [simp]:
   fixes a :: "'a::euclidean_space"
   shows "bounded (box a b)"
   using bounded_cbox[of a b] box_subset_cbox[of a b] bounded_subset[of "cbox a b" "box a b"]
   by simp
 
 lemma not_interval_UNIV [simp]:
   fixes a :: "'a::euclidean_space"
   shows "cbox a b \<noteq> UNIV" "box a b \<noteq> UNIV"
   using bounded_box[of a b] bounded_cbox[of a b] by force+
 
 lemma not_interval_UNIV2 [simp]:
   fixes a :: "'a::euclidean_space"
   shows "UNIV \<noteq> cbox a b" "UNIV \<noteq> box a b"
   using bounded_box[of a b] bounded_cbox[of a b] by force+
 
 lemma box_midpoint:
   fixes a :: "'a::euclidean_space"
   assumes "box a b \<noteq> {}"
   shows "((1/2) *\<^sub>R (a + b)) \<in> box a b"
 proof -
   have "a \<bullet> i < ((1 / 2) *\<^sub>R (a + b)) \<bullet> i \<and> ((1 / 2) *\<^sub>R (a + b)) \<bullet> i < b \<bullet> i" if "i \<in> Basis" for i
     using assms that by (auto simp: inner_add_left box_ne_empty)
   then show ?thesis unfolding mem_box by auto
 qed
 
 lemma open_cbox_convex:
   fixes x :: "'a::euclidean_space"
   assumes x: "x \<in> box a b"
     and y: "y \<in> cbox a b"
     and e: "0 < e" "e \<le> 1"
   shows "(e *\<^sub>R x + (1 - e) *\<^sub>R y) \<in> box a b"
 proof -
   {
     fix i :: 'a
     assume i: "i \<in> Basis"
     have "a \<bullet> i = e * (a \<bullet> i) + (1 - e) * (a \<bullet> i)"
       unfolding left_diff_distrib by simp
     also have "\<dots> < e * (x \<bullet> i) + (1 - e) * (y \<bullet> i)"
     proof (rule add_less_le_mono)
       show "e * (a \<bullet> i) < e * (x \<bullet> i)"
         using \<open>0 < e\<close> i mem_box(1) x by auto
       show "(1 - e) * (a \<bullet> i) \<le> (1 - e) * (y \<bullet> i)"
         by (meson diff_ge_0_iff_ge \<open>e \<le> 1\<close> i mem_box(2) mult_left_mono y)
     qed
     finally have "a \<bullet> i < (e *\<^sub>R x + (1 - e) *\<^sub>R y) \<bullet> i"
       unfolding inner_simps by auto
     moreover
     {
       have "b \<bullet> i = e * (b\<bullet>i) + (1 - e) * (b\<bullet>i)"
         unfolding left_diff_distrib by simp
       also have "\<dots> > e * (x \<bullet> i) + (1 - e) * (y \<bullet> i)"
       proof (rule add_less_le_mono)
         show "e * (x \<bullet> i) < e * (b \<bullet> i)"
           using \<open>0 < e\<close> i mem_box(1) x by auto
         show "(1 - e) * (y \<bullet> i) \<le> (1 - e) * (b \<bullet> i)"
           by (meson diff_ge_0_iff_ge \<open>e \<le> 1\<close> i mem_box(2) mult_left_mono y)
       qed
       finally have "(e *\<^sub>R x + (1 - e) *\<^sub>R y) \<bullet> i < b \<bullet> i"
         unfolding inner_simps by auto
     }
     ultimately have "a \<bullet> i < (e *\<^sub>R x + (1 - e) *\<^sub>R y) \<bullet> i \<and> (e *\<^sub>R x + (1 - e) *\<^sub>R y) \<bullet> i < b \<bullet> i"
       by auto
   }
   then show ?thesis
     unfolding mem_box by auto
 qed
 
 lemma closure_cbox [simp]: "closure (cbox a b) = cbox a b"
   by (simp add: closed_cbox)
 
 lemma closure_box [simp]:
   fixes a :: "'a::euclidean_space"
    assumes "box a b \<noteq> {}"
   shows "closure (box a b) = cbox a b"
 proof -
   have ab: "a <e b"
     using assms by (simp add: eucl_less_def box_ne_empty)
   let ?c = "(1 / 2) *\<^sub>R (a + b)"
   {
     fix x
     assume as:"x \<in> cbox a b"
     define f where [abs_def]: "f n = x + (inverse (real n + 1)) *\<^sub>R (?c - x)" for n
     {
       fix n
       assume fn: "f n <e b \<longrightarrow> a <e f n \<longrightarrow> f n = x" and xc: "x \<noteq> ?c"
       have *: "0 < inverse (real n + 1)" "inverse (real n + 1) \<le> 1"
         unfolding inverse_le_1_iff by auto
       have "(inverse (real n + 1)) *\<^sub>R ((1 / 2) *\<^sub>R (a + b)) + (1 - inverse (real n + 1)) *\<^sub>R x =
         x + (inverse (real n + 1)) *\<^sub>R (((1 / 2) *\<^sub>R (a + b)) - x)"
         by (auto simp: algebra_simps)
       then have "f n <e b" and "a <e f n"
         using open_cbox_convex[OF box_midpoint[OF assms] as *]
         unfolding f_def by (auto simp: box_def eucl_less_def)
       then have False
         using fn unfolding f_def using xc by auto
     }
     moreover
     {
       assume "\<not> (f \<longlongrightarrow> x) sequentially"
       {
         fix e :: real
         assume "e > 0"
         then obtain N :: nat where N: "inverse (real (N + 1)) < e"
           using reals_Archimedean by auto
         have "inverse (real n + 1) < e" if "N \<le> n" for n
           by (auto intro!: that le_less_trans [OF _ N])
         then have "\<exists>N::nat. \<forall>n\<ge>N. inverse (real n + 1) < e" by auto
       }
       then have "((\<lambda>n. inverse (real n + 1)) \<longlongrightarrow> 0) sequentially"
         unfolding lim_sequentially by(auto simp: dist_norm)
       then have "(f \<longlongrightarrow> x) sequentially"
         unfolding f_def
         using tendsto_add[OF tendsto_const, of "\<lambda>n::nat. (inverse (real n + 1)) *\<^sub>R ((1 / 2) *\<^sub>R (a + b) - x)" 0 sequentially x]
         using tendsto_scaleR [OF _ tendsto_const, of "\<lambda>n::nat. inverse (real n + 1)" 0 sequentially "((1 / 2) *\<^sub>R (a + b) - x)"]
         by auto
     }
     ultimately have "x \<in> closure (box a b)"
       using as box_midpoint[OF assms]
       unfolding closure_def islimpt_sequential
       by (cases "x=?c") (auto simp: in_box_eucl_less)
   }
   then show ?thesis
     using closure_minimal[OF box_subset_cbox, of a b] by blast
 qed
 
 lemma bounded_subset_box_symmetric:
   fixes S :: "('a::euclidean_space) set"
   assumes "bounded S"
   obtains a where "S \<subseteq> box (-a) a"
 proof -
   obtain b where "b>0" and b: "\<forall>x\<in>S. norm x \<le> b"
     using assms[unfolded bounded_pos] by auto
   define a :: 'a where "a = (\<Sum>i\<in>Basis. (b + 1) *\<^sub>R i)"
   have "(-a)\<bullet>i < x\<bullet>i" and "x\<bullet>i < a\<bullet>i" if "x \<in> S" and i: "i \<in> Basis" for x i
     using b Basis_le_norm[OF i, of x] that by (auto simp: a_def)
   then have "S \<subseteq> box (-a) a"
     by (auto simp: simp add: box_def)
   then show ?thesis ..
 qed
 
 lemma bounded_subset_cbox_symmetric:
   fixes S :: "('a::euclidean_space) set"
   assumes "bounded S"
   obtains a where "S \<subseteq> cbox (-a) a"
 proof -
   obtain a where "S \<subseteq> box (-a) a"
     using bounded_subset_box_symmetric[OF assms] by auto
   then show ?thesis
     by (meson box_subset_cbox dual_order.trans that)
 qed
 
 lemma frontier_cbox:
   fixes a b :: "'a::euclidean_space"
   shows "frontier (cbox a b) = cbox a b - box a b"
   unfolding frontier_def unfolding interior_cbox and closure_closed[OF closed_cbox] ..
 
 lemma frontier_box:
   fixes a b :: "'a::euclidean_space"
   shows "frontier (box a b) = (if box a b = {} then {} else cbox a b - box a b)"
 proof (cases "box a b = {}")
   case True
   then show ?thesis
     using frontier_empty by auto
 next
   case False
   then show ?thesis
     unfolding frontier_def and closure_box[OF False] and interior_open[OF open_box]
     by auto
 qed
 
 lemma Int_interval_mixed_eq_empty:
   fixes a :: "'a::euclidean_space"
    assumes "box c d \<noteq> {}"
   shows "box a b \<inter> cbox c d = {} \<longleftrightarrow> box a b \<inter> box c d = {}"
   unfolding closure_box[OF assms, symmetric]
   unfolding open_Int_closure_eq_empty[OF open_box] ..
 
 subsection \<open>Class Instances\<close>
 
 lemma compact_lemma:
   fixes f :: "nat \<Rightarrow> 'a::euclidean_space"
   assumes "bounded (range f)"
   shows "\<forall>d\<subseteq>Basis. \<exists>l::'a. \<exists> r.
     strict_mono r \<and> (\<forall>e>0. eventually (\<lambda>n. \<forall>i\<in>d. dist (f (r n) \<bullet> i) (l \<bullet> i) < e) sequentially)"
   by (rule compact_lemma_general[where unproj="\<lambda>e. \<Sum>i\<in>Basis. e i *\<^sub>R i"])
      (auto intro!: assms bounded_linear_inner_left bounded_linear_image
        simp: euclidean_representation)
 
 instance\<^marker>\<open>tag important\<close> euclidean_space \<subseteq> heine_borel
 proof
   fix f :: "nat \<Rightarrow> 'a"
   assume f: "bounded (range f)"
   then obtain l::'a and r where r: "strict_mono r"
     and l: "\<forall>e>0. eventually (\<lambda>n. \<forall>i\<in>Basis. dist (f (r n) \<bullet> i) (l \<bullet> i) < e) sequentially"
     using compact_lemma [OF f] by blast
   {
     fix e::real
     assume "e > 0"
     hence "e / real_of_nat DIM('a) > 0" by (simp)
     with l have "eventually (\<lambda>n. \<forall>i\<in>Basis. dist (f (r n) \<bullet> i) (l \<bullet> i) < e / (real_of_nat DIM('a))) sequentially"
       by simp
     moreover
     {
       fix n
       assume n: "\<forall>i\<in>Basis. dist (f (r n) \<bullet> i) (l \<bullet> i) < e / (real_of_nat DIM('a))"
       have "dist (f (r n)) l \<le> (\<Sum>i\<in>Basis. dist (f (r n) \<bullet> i) (l \<bullet> i))"
         apply (subst euclidean_dist_l2)
         using zero_le_dist
         apply (rule L2_set_le_sum)
         done
       also have "\<dots> < (\<Sum>i\<in>(Basis::'a set). e / (real_of_nat DIM('a)))"
         apply (rule sum_strict_mono)
         using n
         apply auto
         done
       finally have "dist (f (r n)) l < e"
         by auto
     }
     ultimately have "eventually (\<lambda>n. dist (f (r n)) l < e) sequentially"
       by (rule eventually_mono)
   }
   then have *: "((f \<circ> r) \<longlongrightarrow> l) sequentially"
     unfolding o_def tendsto_iff by simp
   with r show "\<exists>l r. strict_mono r \<and> ((f \<circ> r) \<longlongrightarrow> l) sequentially"
     by auto
 qed
 
 instance\<^marker>\<open>tag important\<close> euclidean_space \<subseteq> banach ..
 
 instance euclidean_space \<subseteq> second_countable_topology
 proof
   define a where "a f = (\<Sum>i\<in>Basis. fst (f i) *\<^sub>R i)" for f :: "'a \<Rightarrow> real \<times> real"
   then have a: "\<And>f. (\<Sum>i\<in>Basis. fst (f i) *\<^sub>R i) = a f"
     by simp
   define b where "b f = (\<Sum>i\<in>Basis. snd (f i) *\<^sub>R i)" for f :: "'a \<Rightarrow> real \<times> real"
   then have b: "\<And>f. (\<Sum>i\<in>Basis. snd (f i) *\<^sub>R i) = b f"
     by simp
   define B where "B = (\<lambda>f. box (a f) (b f)) ` (Basis \<rightarrow>\<^sub>E (\<rat> \<times> \<rat>))"
 
   have "Ball B open" by (simp add: B_def open_box)
   moreover have "(\<forall>A. open A \<longrightarrow> (\<exists>B'\<subseteq>B. \<Union>B' = A))"
   proof safe
     fix A::"'a set"
     assume "open A"
     show "\<exists>B'\<subseteq>B. \<Union>B' = A"
       apply (rule exI[of _ "{b\<in>B. b \<subseteq> A}"])
       apply (subst (3) open_UNION_box[OF \<open>open A\<close>])
       apply (auto simp: a b B_def)
       done
   qed
   ultimately
   have "topological_basis B"
     unfolding topological_basis_def by blast
   moreover
   have "countable B"
     unfolding B_def
     by (intro countable_image countable_PiE finite_Basis countable_SIGMA countable_rat)
   ultimately show "\<exists>B::'a set set. countable B \<and> open = generate_topology B"
     by (blast intro: topological_basis_imp_subbasis)
 qed
 
 instance euclidean_space \<subseteq> polish_space ..
 
 
 subsection \<open>Compact Boxes\<close>
 
 lemma compact_cbox [simp]:
   fixes a :: "'a::euclidean_space"
   shows "compact (cbox a b)"
   using bounded_closed_imp_seq_compact[of "cbox a b"] using bounded_cbox[of a b]
   by (auto simp: compact_eq_seq_compact_metric)
 
 proposition is_interval_compact:
    "is_interval S \<and> compact S \<longleftrightarrow> (\<exists>a b. S = cbox a b)"   (is "?lhs = ?rhs")
 proof (cases "S = {}")
   case True
   with empty_as_interval show ?thesis by auto
 next
   case False
   show ?thesis
   proof
     assume L: ?lhs
     then have "is_interval S" "compact S" by auto
     define a where "a \<equiv> \<Sum>i\<in>Basis. (INF x\<in>S. x \<bullet> i) *\<^sub>R i"
     define b where "b \<equiv> \<Sum>i\<in>Basis. (SUP x\<in>S. x \<bullet> i) *\<^sub>R i"
     have 1: "\<And>x i. \<lbrakk>x \<in> S; i \<in> Basis\<rbrakk> \<Longrightarrow> (INF x\<in>S. x \<bullet> i) \<le> x \<bullet> i"
       by (simp add: cInf_lower bounded_inner_imp_bdd_below compact_imp_bounded L)
     have 2: "\<And>x i. \<lbrakk>x \<in> S; i \<in> Basis\<rbrakk> \<Longrightarrow> x \<bullet> i \<le> (SUP x\<in>S. x \<bullet> i)"
       by (simp add: cSup_upper bounded_inner_imp_bdd_above compact_imp_bounded L)
     have 3: "x \<in> S" if inf: "\<And>i. i \<in> Basis \<Longrightarrow> (INF x\<in>S. x \<bullet> i) \<le> x \<bullet> i"
                    and sup: "\<And>i. i \<in> Basis \<Longrightarrow> x \<bullet> i \<le> (SUP x\<in>S. x \<bullet> i)" for x
     proof (rule mem_box_componentwiseI [OF \<open>is_interval S\<close>])
       fix i::'a
       assume i: "i \<in> Basis"
       have cont: "continuous_on S (\<lambda>x. x \<bullet> i)"
         by (intro continuous_intros)
       obtain a where "a \<in> S" and a: "\<And>y. y\<in>S \<Longrightarrow> a \<bullet> i \<le> y \<bullet> i"
         using continuous_attains_inf [OF \<open>compact S\<close> False cont] by blast
       obtain b where "b \<in> S" and b: "\<And>y. y\<in>S \<Longrightarrow> y \<bullet> i \<le> b \<bullet> i"
         using continuous_attains_sup [OF \<open>compact S\<close> False cont] by blast
       have "a \<bullet> i \<le> (INF x\<in>S. x \<bullet> i)"
         by (simp add: False a cINF_greatest)
       also have "\<dots> \<le> x \<bullet> i"
         by (simp add: i inf)
       finally have ai: "a \<bullet> i \<le> x \<bullet> i" .
       have "x \<bullet> i \<le> (SUP x\<in>S. x \<bullet> i)"
         by (simp add: i sup)
       also have "(SUP x\<in>S. x \<bullet> i) \<le> b \<bullet> i"
         by (simp add: False b cSUP_least)
       finally have bi: "x \<bullet> i \<le> b \<bullet> i" .
       show "x \<bullet> i \<in> (\<lambda>x. x \<bullet> i) ` S"
         apply (rule_tac x="\<Sum>j\<in>Basis. (if j = i then x \<bullet> i else a \<bullet> j) *\<^sub>R j" in image_eqI)
         apply (simp add: i)
         apply (rule mem_is_intervalI [OF \<open>is_interval S\<close> \<open>a \<in> S\<close> \<open>b \<in> S\<close>])
         using i ai bi apply force
         done
     qed
     have "S = cbox a b"
       by (auto simp: a_def b_def mem_box intro: 1 2 3)
     then show ?rhs
       by blast
   next
     assume R: ?rhs
     then show ?lhs
       using compact_cbox is_interval_cbox by blast
   qed
 qed
 
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open>Componentwise limits and continuity\<close>
 
 text\<open>But is the premise really necessary? Need to generalise @{thm euclidean_dist_l2}\<close>
 lemma Euclidean_dist_upper: "i \<in> Basis \<Longrightarrow> dist (x \<bullet> i) (y \<bullet> i) \<le> dist x y"
   by (metis (no_types) member_le_L2_set euclidean_dist_l2 finite_Basis)
 
 text\<open>But is the premise \<^term>\<open>i \<in> Basis\<close> really necessary?\<close>
 lemma open_preimage_inner:
   assumes "open S" "i \<in> Basis"
     shows "open {x. x \<bullet> i \<in> S}"
 proof (rule openI, simp)
   fix x
   assume x: "x \<bullet> i \<in> S"
   with assms obtain e where "0 < e" and e: "ball (x \<bullet> i) e \<subseteq> S"
     by (auto simp: open_contains_ball_eq)
   have "\<exists>e>0. ball (y \<bullet> i) e \<subseteq> S" if dxy: "dist x y < e / 2" for y
   proof (intro exI conjI)
     have "dist (x \<bullet> i) (y \<bullet> i) < e / 2"
       by (meson \<open>i \<in> Basis\<close> dual_order.trans Euclidean_dist_upper not_le that)
     then have "dist (x \<bullet> i) z < e" if "dist (y \<bullet> i) z < e / 2" for z
       by (metis dist_commute dist_triangle_half_l that)
     then have "ball (y \<bullet> i) (e / 2) \<subseteq> ball (x \<bullet> i) e"
       using mem_ball by blast
       with e show "ball (y \<bullet> i) (e / 2) \<subseteq> S"
         by (metis order_trans)
   qed (simp add: \<open>0 < e\<close>)
   then show "\<exists>e>0. ball x e \<subseteq> {s. s \<bullet> i \<in> S}"
     by (metis (no_types, lifting) \<open>0 < e\<close> \<open>open S\<close> half_gt_zero_iff mem_Collect_eq mem_ball open_contains_ball_eq subsetI)
 qed
 
 proposition tendsto_componentwise_iff:
   fixes f :: "_ \<Rightarrow> 'b::euclidean_space"
   shows "(f \<longlongrightarrow> l) F \<longleftrightarrow> (\<forall>i \<in> Basis. ((\<lambda>x. (f x \<bullet> i)) \<longlongrightarrow> (l \<bullet> i)) F)"
          (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
     unfolding tendsto_def
     apply clarify
     apply (drule_tac x="{s. s \<bullet> i \<in> S}" in spec)
     apply (auto simp: open_preimage_inner)
     done
 next
   assume R: ?rhs
   then have "\<And>e. e > 0 \<Longrightarrow> \<forall>i\<in>Basis. \<forall>\<^sub>F x in F. dist (f x \<bullet> i) (l \<bullet> i) < e"
     unfolding tendsto_iff by blast
   then have R': "\<And>e. e > 0 \<Longrightarrow> \<forall>\<^sub>F x in F. \<forall>i\<in>Basis. dist (f x \<bullet> i) (l \<bullet> i) < e"
       by (simp add: eventually_ball_finite_distrib [symmetric])
   show ?lhs
   unfolding tendsto_iff
   proof clarify
     fix e::real
     assume "0 < e"
     have *: "L2_set (\<lambda>i. dist (f x \<bullet> i) (l \<bullet> i)) Basis < e"
              if "\<forall>i\<in>Basis. dist (f x \<bullet> i) (l \<bullet> i) < e / real DIM('b)" for x
     proof -
       have "L2_set (\<lambda>i. dist (f x \<bullet> i) (l \<bullet> i)) Basis \<le> sum (\<lambda>i. dist (f x \<bullet> i) (l \<bullet> i)) Basis"
         by (simp add: L2_set_le_sum)
       also have "... < DIM('b) * (e / real DIM('b))"
         apply (rule sum_bounded_above_strict)
         using that by auto
       also have "... = e"
         by (simp add: field_simps)
       finally show "L2_set (\<lambda>i. dist (f x \<bullet> i) (l \<bullet> i)) Basis < e" .
     qed
     have "\<forall>\<^sub>F x in F. \<forall>i\<in>Basis. dist (f x \<bullet> i) (l \<bullet> i) < e / DIM('b)"
       apply (rule R')
       using \<open>0 < e\<close> by simp
     then show "\<forall>\<^sub>F x in F. dist (f x) l < e"
       apply (rule eventually_mono)
       apply (subst euclidean_dist_l2)
       using * by blast
   qed
 qed
 
 
 corollary continuous_componentwise:
    "continuous F f \<longleftrightarrow> (\<forall>i \<in> Basis. continuous F (\<lambda>x. (f x \<bullet> i)))"
 by (simp add: continuous_def tendsto_componentwise_iff [symmetric])
 
 corollary continuous_on_componentwise:
   fixes S :: "'a :: t2_space set"
   shows "continuous_on S f \<longleftrightarrow> (\<forall>i \<in> Basis. continuous_on S (\<lambda>x. (f x \<bullet> i)))"
   apply (simp add: continuous_on_eq_continuous_within)
   using continuous_componentwise by blast
 
 lemma linear_componentwise_iff:
      "(linear f') \<longleftrightarrow> (\<forall>i\<in>Basis. linear (\<lambda>x. f' x \<bullet> i))"
   apply (auto simp: linear_iff inner_left_distrib)
    apply (metis inner_left_distrib euclidean_eq_iff)
   by (metis euclidean_eqI inner_scaleR_left)
 
 lemma bounded_linear_componentwise_iff:
      "(bounded_linear f') \<longleftrightarrow> (\<forall>i\<in>Basis. bounded_linear (\<lambda>x. f' x \<bullet> i))"
      (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     by (simp add: bounded_linear_inner_left_comp)
 next
   assume ?rhs
   then have "(\<forall>i\<in>Basis. \<exists>K. \<forall>x. \<bar>f' x \<bullet> i\<bar> \<le> norm x * K)" "linear f'"
     by (auto simp: bounded_linear_def bounded_linear_axioms_def linear_componentwise_iff [symmetric] ball_conj_distrib)
   then obtain F where F: "\<And>i x. i \<in> Basis \<Longrightarrow> \<bar>f' x \<bullet> i\<bar> \<le> norm x * F i"
     by metis
   have "norm (f' x) \<le> norm x * sum F Basis" for x
   proof -
     have "norm (f' x) \<le> (\<Sum>i\<in>Basis. \<bar>f' x \<bullet> i\<bar>)"
       by (rule norm_le_l1)
     also have "... \<le> (\<Sum>i\<in>Basis. norm x * F i)"
       by (metis F sum_mono)
     also have "... = norm x * sum F Basis"
       by (simp add: sum_distrib_left)
     finally show ?thesis .
   qed
   then show ?lhs
     by (force simp: bounded_linear_def bounded_linear_axioms_def \<open>linear f'\<close>)
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Continuous Extension\<close>
 
 definition clamp :: "'a::euclidean_space \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> 'a" where
   "clamp a b x = (if (\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i)
     then (\<Sum>i\<in>Basis. (if x\<bullet>i < a\<bullet>i then a\<bullet>i else if x\<bullet>i \<le> b\<bullet>i then x\<bullet>i else b\<bullet>i) *\<^sub>R i)
     else a)"
 
 lemma clamp_in_interval[simp]:
   assumes "\<And>i. i \<in> Basis \<Longrightarrow> a \<bullet> i \<le> b \<bullet> i"
   shows "clamp a b x \<in> cbox a b"
   unfolding clamp_def
   using box_ne_empty(1)[of a b] assms by (auto simp: cbox_def)
 
 lemma clamp_cancel_cbox[simp]:
   fixes x a b :: "'a::euclidean_space"
   assumes x: "x \<in> cbox a b"
   shows "clamp a b x = x"
   using assms
   by (auto simp: clamp_def mem_box intro!: euclidean_eqI[where 'a='a])
 
 lemma clamp_empty_interval:
   assumes "i \<in> Basis" "a \<bullet> i > b \<bullet> i"
   shows "clamp a b = (\<lambda>_. a)"
   using assms
   by (force simp: clamp_def[abs_def] split: if_splits intro!: ext)
 
 lemma dist_clamps_le_dist_args:
   fixes x :: "'a::euclidean_space"
   shows "dist (clamp a b y) (clamp a b x) \<le> dist y x"
 proof cases
   assume le: "(\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i)"
   then have "(\<Sum>i\<in>Basis. (dist (clamp a b y \<bullet> i) (clamp a b x \<bullet> i))\<^sup>2) \<le>
     (\<Sum>i\<in>Basis. (dist (y \<bullet> i) (x \<bullet> i))\<^sup>2)"
     by (auto intro!: sum_mono simp: clamp_def dist_real_def abs_le_square_iff[symmetric])
   then show ?thesis
     by (auto intro: real_sqrt_le_mono
       simp: euclidean_dist_l2[where y=x] euclidean_dist_l2[where y="clamp a b x"] L2_set_def)
 qed (auto simp: clamp_def)
 
 lemma clamp_continuous_at:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::metric_space"
     and x :: 'a
   assumes f_cont: "continuous_on (cbox a b) f"
   shows "continuous (at x) (\<lambda>x. f (clamp a b x))"
 proof cases
   assume le: "(\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i)"
   show ?thesis
     unfolding continuous_at_eps_delta
   proof safe
     fix x :: 'a
     fix e :: real
     assume "e > 0"
     moreover have "clamp a b x \<in> cbox a b"
       by (simp add: le)
     moreover note f_cont[simplified continuous_on_iff]
     ultimately
     obtain d where d: "0 < d"
       "\<And>x'. x' \<in> cbox a b \<Longrightarrow> dist x' (clamp a b x) < d \<Longrightarrow> dist (f x') (f (clamp a b x)) < e"
       by force
     show "\<exists>d>0. \<forall>x'. dist x' x < d \<longrightarrow>
       dist (f (clamp a b x')) (f (clamp a b x)) < e"
       using le
       by (auto intro!: d clamp_in_interval dist_clamps_le_dist_args[THEN le_less_trans])
   qed
 qed (auto simp: clamp_empty_interval)
 
 lemma clamp_continuous_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::metric_space"
   assumes f_cont: "continuous_on (cbox a b) f"
   shows "continuous_on S (\<lambda>x. f (clamp a b x))"
   using assms
   by (auto intro: continuous_at_imp_continuous_on clamp_continuous_at)
 
 lemma clamp_bounded:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::metric_space"
   assumes bounded: "bounded (f ` (cbox a b))"
   shows "bounded (range (\<lambda>x. f (clamp a b x)))"
 proof cases
   assume le: "(\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i)"
   from bounded obtain c where f_bound: "\<forall>x\<in>f ` cbox a b. dist undefined x \<le> c"
     by (auto simp: bounded_any_center[where a=undefined])
   then show ?thesis
     by (auto intro!: exI[where x=c] clamp_in_interval[OF le[rule_format]]
         simp: bounded_any_center[where a=undefined])
 qed (auto simp: clamp_empty_interval image_def)
 
 
 definition ext_cont :: "('a::euclidean_space \<Rightarrow> 'b::metric_space) \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> 'b"
   where "ext_cont f a b = (\<lambda>x. f (clamp a b x))"
 
 lemma ext_cont_cancel_cbox[simp]:
   fixes x a b :: "'a::euclidean_space"
   assumes x: "x \<in> cbox a b"
   shows "ext_cont f a b x = f x"
   using assms
   unfolding ext_cont_def
   by (auto simp: clamp_def mem_box intro!: euclidean_eqI[where 'a='a] arg_cong[where f=f])
 
 lemma continuous_on_ext_cont[continuous_intros]:
   "continuous_on (cbox a b) f \<Longrightarrow> continuous_on S (ext_cont f a b)"
   by (auto intro!: clamp_continuous_on simp: ext_cont_def)
 
 
 subsection \<open>Separability\<close>
 
 lemma univ_second_countable_sequence:
   obtains B :: "nat \<Rightarrow> 'a::euclidean_space set"
     where "inj B" "\<And>n. open(B n)" "\<And>S. open S \<Longrightarrow> \<exists>k. S = \<Union>{B n |n. n \<in> k}"
 proof -
   obtain \<B> :: "'a set set"
   where "countable \<B>"
     and opn: "\<And>C. C \<in> \<B> \<Longrightarrow> open C"
     and Un: "\<And>S. open S \<Longrightarrow> \<exists>U. U \<subseteq> \<B> \<and> S = \<Union>U"
     using univ_second_countable by blast
   have *: "infinite (range (\<lambda>n. ball (0::'a) (inverse(Suc n))))"
     apply (rule Infinite_Set.range_inj_infinite)
     apply (simp add: inj_on_def ball_eq_ball_iff)
     done
   have "infinite \<B>"
   proof
     assume "finite \<B>"
     then have "finite (Union ` (Pow \<B>))"
       by simp
     then have "finite (range (\<lambda>n. ball (0::'a) (inverse(Suc n))))"
       apply (rule rev_finite_subset)
       by (metis (no_types, lifting) PowI image_eqI image_subset_iff Un [OF open_ball])
     with * show False by simp
   qed
   obtain f :: "nat \<Rightarrow> 'a set" where "\<B> = range f" "inj f"
     by (blast intro: countable_as_injective_image [OF \<open>countable \<B>\<close> \<open>infinite \<B>\<close>])
   have *: "\<exists>k. S = \<Union>{f n |n. n \<in> k}" if "open S" for S
     using Un [OF that]
     apply clarify
     apply (rule_tac x="f-`U" in exI)
     using \<open>inj f\<close> \<open>\<B> = range f\<close> apply force
     done
   show ?thesis
     apply (rule that [OF \<open>inj f\<close> _ *])
     apply (auto simp: \<open>\<B> = range f\<close> opn)
     done
 qed
 
 proposition separable:
   fixes S :: "'a::{metric_space, second_countable_topology} set"
   obtains T where "countable T" "T \<subseteq> S" "S \<subseteq> closure T"
 proof -
   obtain \<B> :: "'a set set"
     where "countable \<B>"
       and "{} \<notin> \<B>"
       and ope: "\<And>C. C \<in> \<B> \<Longrightarrow> openin(top_of_set S) C"
       and if_ope: "\<And>T. openin(top_of_set S) T \<Longrightarrow> \<exists>\<U>. \<U> \<subseteq> \<B> \<and> T = \<Union>\<U>"
     by (meson subset_second_countable)
   then obtain f where f: "\<And>C. C \<in> \<B> \<Longrightarrow> f C \<in> C"
     by (metis equals0I)
   show ?thesis
   proof
     show "countable (f ` \<B>)"
       by (simp add: \<open>countable \<B>\<close>)
     show "f ` \<B> \<subseteq> S"
       using ope f openin_imp_subset by blast
     show "S \<subseteq> closure (f ` \<B>)"
     proof (clarsimp simp: closure_approachable)
       fix x and e::real
       assume "x \<in> S" "0 < e"
       have "openin (top_of_set S) (S \<inter> ball x e)"
         by (simp add: openin_Int_open)
       with if_ope obtain \<U> where  \<U>: "\<U> \<subseteq> \<B>" "S \<inter> ball x e = \<Union>\<U>"
         by meson
       show "\<exists>C \<in> \<B>. dist (f C) x < e"
       proof (cases "\<U> = {}")
         case True
         then show ?thesis
           using \<open>0 < e\<close>  \<U> \<open>x \<in> S\<close> by auto
       next
         case False
         then obtain C where "C \<in> \<U>" by blast
         show ?thesis
         proof
           show "dist (f C) x < e"
             by (metis Int_iff Union_iff \<U> \<open>C \<in> \<U>\<close> dist_commute f mem_ball subsetCE)
           show "C \<in> \<B>"
             using \<open>\<U> \<subseteq> \<B>\<close> \<open>C \<in> \<U>\<close> by blast
         qed
       qed
     qed
   qed
 qed
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Diameter\<close>
 
 lemma diameter_cball [simp]:
   fixes a :: "'a::euclidean_space"
   shows "diameter(cball a r) = (if r < 0 then 0 else 2*r)"
 proof -
   have "diameter(cball a r) = 2*r" if "r \<ge> 0"
   proof (rule order_antisym)
     show "diameter (cball a r) \<le> 2*r"
     proof (rule diameter_le)
       fix x y assume "x \<in> cball a r" "y \<in> cball a r"
       then have "norm (x - a) \<le> r" "norm (a - y) \<le> r"
         by (auto simp: dist_norm norm_minus_commute)
       then have "norm (x - y) \<le> r+r"
         using norm_diff_triangle_le by blast
       then show "norm (x - y) \<le> 2*r" by simp
     qed (simp add: that)
     have "2*r = dist (a + r *\<^sub>R (SOME i. i \<in> Basis)) (a - r *\<^sub>R (SOME i. i \<in> Basis))"
       apply (simp add: dist_norm)
       by (metis abs_of_nonneg mult.right_neutral norm_numeral norm_scaleR norm_some_Basis real_norm_def scaleR_2 that)
     also have "... \<le> diameter (cball a r)"
       apply (rule diameter_bounded_bound)
       using that by (auto simp: dist_norm)
     finally show "2*r \<le> diameter (cball a r)" .
   qed
   then show ?thesis by simp
 qed
 
 lemma diameter_ball [simp]:
   fixes a :: "'a::euclidean_space"
   shows "diameter(ball a r) = (if r < 0 then 0 else 2*r)"
 proof -
   have "diameter(ball a r) = 2*r" if "r > 0"
     by (metis bounded_ball diameter_closure closure_ball diameter_cball less_eq_real_def linorder_not_less that)
   then show ?thesis
     by (simp add: diameter_def)
 qed
 
 lemma diameter_closed_interval [simp]: "diameter {a..b} = (if b < a then 0 else b-a)"
 proof -
   have "{a .. b} = cball ((a+b)/2) ((b-a)/2)"
     by (auto simp: dist_norm abs_if field_split_simps split: if_split_asm)
   then show ?thesis
     by simp
 qed
 
 lemma diameter_open_interval [simp]: "diameter {a<..<b} = (if b < a then 0 else b-a)"
 proof -
   have "{a <..< b} = ball ((a+b)/2) ((b-a)/2)"
     by (auto simp: dist_norm abs_if field_split_simps split: if_split_asm)
   then show ?thesis
     by simp
 qed
 
 lemma diameter_cbox:
   fixes a b::"'a::euclidean_space"
   shows "(\<forall>i \<in> Basis. a \<bullet> i \<le> b \<bullet> i) \<Longrightarrow> diameter (cbox a b) = dist a b"
   by (force simp: diameter_def intro!: cSup_eq_maximum L2_set_mono
      simp: euclidean_dist_l2[where 'a='a] cbox_def dist_norm)
 
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open>Relating linear images to open/closed/interior/closure/connected\<close>
 
 proposition open_surjective_linear_image:
   fixes f :: "'a::real_normed_vector \<Rightarrow> 'b::euclidean_space"
   assumes "open A" "linear f" "surj f"
     shows "open(f ` A)"
 unfolding open_dist
 proof clarify
   fix x
   assume "x \<in> A"
   have "bounded (inv f ` Basis)"
     by (simp add: finite_imp_bounded)
   with bounded_pos obtain B where "B > 0" and B: "\<And>x. x \<in> inv f ` Basis \<Longrightarrow> norm x \<le> B"
     by metis
   obtain e where "e > 0" and e: "\<And>z. dist z x < e \<Longrightarrow> z \<in> A"
     by (metis open_dist \<open>x \<in> A\<close> \<open>open A\<close>)
   define \<delta> where "\<delta> \<equiv> e / B / DIM('b)"
   show "\<exists>e>0. \<forall>y. dist y (f x) < e \<longrightarrow> y \<in> f ` A"
   proof (intro exI conjI)
     show "\<delta> > 0"
       using \<open>e > 0\<close> \<open>B > 0\<close>  by (simp add: \<delta>_def field_split_simps)
     have "y \<in> f ` A" if "dist y (f x) * (B * real DIM('b)) < e" for y
     proof -
       define u where "u \<equiv> y - f x"
       show ?thesis
       proof (rule image_eqI)
         show "y = f (x + (\<Sum>i\<in>Basis. (u \<bullet> i) *\<^sub>R inv f i))"
           apply (simp add: linear_add linear_sum linear.scaleR \<open>linear f\<close> surj_f_inv_f \<open>surj f\<close>)
           apply (simp add: euclidean_representation u_def)
           done
         have "dist (x + (\<Sum>i\<in>Basis. (u \<bullet> i) *\<^sub>R inv f i)) x \<le> (\<Sum>i\<in>Basis. norm ((u \<bullet> i) *\<^sub>R inv f i))"
           by (simp add: dist_norm sum_norm_le)
         also have "... = (\<Sum>i\<in>Basis. \<bar>u \<bullet> i\<bar> * norm (inv f i))"
           by simp
         also have "... \<le> (\<Sum>i\<in>Basis. \<bar>u \<bullet> i\<bar>) * B"
           by (simp add: B sum_distrib_right sum_mono mult_left_mono)
         also have "... \<le> DIM('b) * dist y (f x) * B"
           apply (rule mult_right_mono [OF sum_bounded_above])
           using \<open>0 < B\<close> by (auto simp: Basis_le_norm dist_norm u_def)
         also have "... < e"
           by (metis mult.commute mult.left_commute that)
         finally show "x + (\<Sum>i\<in>Basis. (u \<bullet> i) *\<^sub>R inv f i) \<in> A"
           by (rule e)
       qed
     qed
     then show "\<forall>y. dist y (f x) < \<delta> \<longrightarrow> y \<in> f ` A"
       using \<open>e > 0\<close> \<open>B > 0\<close>
       by (auto simp: \<delta>_def field_split_simps)
   qed
 qed
 
 corollary open_bijective_linear_image_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" "bij f"
     shows "open(f ` A) \<longleftrightarrow> open A"
 proof
   assume "open(f ` A)"
   then have "open(f -` (f ` A))"
     using assms by (force simp: linear_continuous_at linear_conv_bounded_linear continuous_open_vimage)
   then show "open A"
     by (simp add: assms bij_is_inj inj_vimage_image_eq)
 next
   assume "open A"
   then show "open(f ` A)"
     by (simp add: assms bij_is_surj open_surjective_linear_image)
 qed
 
 corollary interior_bijective_linear_image:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" "bij f"
   shows "interior (f ` S) = f ` interior S"  (is "?lhs = ?rhs")
 proof safe
   fix x
   assume x: "x \<in> ?lhs"
   then obtain T where "open T" and "x \<in> T" and "T \<subseteq> f ` S"
     by (metis interiorE)
   then show "x \<in> ?rhs"
     by (metis (no_types, opaque_lifting) assms subsetD interior_maximal open_bijective_linear_image_eq subset_image_iff)
 next
   fix x
   assume x: "x \<in> interior S"
   then show "f x \<in> interior (f ` S)"
     by (meson assms imageI image_mono interiorI interior_subset open_bijective_linear_image_eq open_interior)
 qed
 
 lemma interior_injective_linear_image:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'a::euclidean_space"
   assumes "linear f" "inj f"
    shows "interior(f ` S) = f ` (interior S)"
   by (simp add: linear_injective_imp_surjective assms bijI interior_bijective_linear_image)
 
 lemma interior_surjective_linear_image:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'a::euclidean_space"
   assumes "linear f" "surj f"
    shows "interior(f ` S) = f ` (interior S)"
   by (simp add: assms interior_injective_linear_image linear_surjective_imp_injective)
 
 lemma interior_negations:
   fixes S :: "'a::euclidean_space set"
   shows "interior(uminus ` S) = image uminus (interior S)"
   by (simp add: bij_uminus interior_bijective_linear_image linear_uminus)
 
 lemma connected_linear_image:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "linear f" and "connected s"
   shows "connected (f ` s)"
 using connected_continuous_image assms linear_continuous_on linear_conv_bounded_linear by blast
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>"Isometry" (up to constant bounds) of Injective Linear Map\<close>
 
 proposition injective_imp_isometric:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes s: "closed s" "subspace s"
     and f: "bounded_linear f" "\<forall>x\<in>s. f x = 0 \<longrightarrow> x = 0"
   shows "\<exists>e>0. \<forall>x\<in>s. norm (f x) \<ge> e * norm x"
 proof (cases "s \<subseteq> {0::'a}")
   case True
   have "norm x \<le> norm (f x)" if "x \<in> s" for x
   proof -
     from True that have "x = 0" by auto
     then show ?thesis by simp
   qed
   then show ?thesis
     by (auto intro!: exI[where x=1])
 next
   case False
   interpret f: bounded_linear f by fact
   from False obtain a where a: "a \<noteq> 0" "a \<in> s"
     by auto
   from False have "s \<noteq> {}"
     by auto
   let ?S = "{f x| x. x \<in> s \<and> norm x = norm a}"
   let ?S' = "{x::'a. x\<in>s \<and> norm x = norm a}"
   let ?S'' = "{x::'a. norm x = norm a}"
 
   have "?S'' = frontier (cball 0 (norm a))"
     by (simp add: sphere_def dist_norm)
   then have "compact ?S''" by (metis compact_cball compact_frontier)
   moreover have "?S' = s \<inter> ?S''" by auto
   ultimately have "compact ?S'"
     using closed_Int_compact[of s ?S''] using s(1) by auto
   moreover have *:"f ` ?S' = ?S" by auto
   ultimately have "compact ?S"
     using compact_continuous_image[OF linear_continuous_on[OF f(1)], of ?S'] by auto
   then have "closed ?S"
     using compact_imp_closed by auto
   moreover from a have "?S \<noteq> {}" by auto
   ultimately obtain b' where "b'\<in>?S" "\<forall>y\<in>?S. norm b' \<le> norm y"
     using distance_attains_inf[of ?S 0] unfolding dist_0_norm by auto
   then obtain b where "b\<in>s"
     and ba: "norm b = norm a"
     and b: "\<forall>x\<in>{x \<in> s. norm x = norm a}. norm (f b) \<le> norm (f x)"
     unfolding *[symmetric] unfolding image_iff by auto
 
   let ?e = "norm (f b) / norm b"
   have "norm b > 0"
     using ba and a and norm_ge_zero by auto
   moreover have "norm (f b) > 0"
     using f(2)[THEN bspec[where x=b], OF \<open>b\<in>s\<close>]
     using \<open>norm b >0\<close> by simp
   ultimately have "0 < norm (f b) / norm b" by simp
   moreover
   have "norm (f b) / norm b * norm x \<le> norm (f x)" if "x\<in>s" for x
   proof (cases "x = 0")
     case True
     then show "norm (f b) / norm b * norm x \<le> norm (f x)"
       by auto
   next
     case False
     with \<open>a \<noteq> 0\<close> have *: "0 < norm a / norm x"
       unfolding zero_less_norm_iff[symmetric] by simp
     have "\<forall>x\<in>s. c *\<^sub>R x \<in> s" for c
       using s[unfolded subspace_def] by simp
     with \<open>x \<in> s\<close> \<open>x \<noteq> 0\<close> have "(norm a / norm x) *\<^sub>R x \<in> {x \<in> s. norm x = norm a}"
       by simp
     with \<open>x \<noteq> 0\<close> \<open>a \<noteq> 0\<close> show "norm (f b) / norm b * norm x \<le> norm (f x)"
       using b[THEN bspec[where x="(norm a / norm x) *\<^sub>R x"]]
       unfolding f.scaleR and ba
       by (auto simp: mult.commute pos_le_divide_eq pos_divide_le_eq)
   qed
   ultimately show ?thesis by auto
 qed
 
 proposition closed_injective_image_subspace:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "subspace s" "bounded_linear f" "\<forall>x\<in>s. f x = 0 \<longrightarrow> x = 0" "closed s"
   shows "closed(f ` s)"
 proof -
   obtain e where "e > 0" and e: "\<forall>x\<in>s. e * norm x \<le> norm (f x)"
     using injective_imp_isometric[OF assms(4,1,2,3)] by auto
   show ?thesis
     using complete_isometric_image[OF \<open>e>0\<close> assms(1,2) e] and assms(4)
     unfolding complete_eq_closed[symmetric] by auto
 qed
                                
 
 lemma closure_bounded_linear_image_subset:
   assumes f: "bounded_linear f"
   shows "f ` closure S \<subseteq> closure (f ` S)"
   using linear_continuous_on [OF f] closed_closure closure_subset
   by (rule image_closure_subset)
 
 lemma closure_linear_image_subset:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::real_normed_vector"
   assumes "linear f"
   shows "f ` (closure S) \<subseteq> closure (f ` S)"
   using assms unfolding linear_conv_bounded_linear
   by (rule closure_bounded_linear_image_subset)
 
 lemma closed_injective_linear_image:
     fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     assumes S: "closed S" and f: "linear f" "inj f"
     shows "closed (f ` S)"
 proof -
   obtain g where g: "linear g" "g \<circ> f = id"
     using linear_injective_left_inverse [OF f] by blast
   then have confg: "continuous_on (range f) g"
     using linear_continuous_on linear_conv_bounded_linear by blast
   have [simp]: "g ` f ` S = S"
     using g by (simp add: image_comp)
   have cgf: "closed (g ` f ` S)"
     by (simp add: \<open>g \<circ> f = id\<close> S image_comp)
   have [simp]: "(range f \<inter> g -` S) = f ` S"
     using g unfolding o_def id_def image_def by auto metis+
   show ?thesis
   proof (rule closedin_closed_trans [of "range f"])
     show "closedin (top_of_set (range f)) (f ` S)"
       using continuous_closedin_preimage [OF confg cgf] by simp
     show "closed (range f)"
       apply (rule closed_injective_image_subspace)
       using f apply (auto simp: linear_linear linear_injective_0)
       done
   qed
 qed
 
 lemma closed_injective_linear_image_eq:
     fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     assumes f: "linear f" "inj f"
       shows "(closed(image f s) \<longleftrightarrow> closed s)"
   by (metis closed_injective_linear_image closure_eq closure_linear_image_subset closure_subset_eq f(1) f(2) inj_image_subset_iff)
 
 lemma closure_injective_linear_image:
     fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     shows "\<lbrakk>linear f; inj f\<rbrakk> \<Longrightarrow> f ` (closure S) = closure (f ` S)"
   apply (rule subset_antisym)
   apply (simp add: closure_linear_image_subset)
   by (simp add: closure_minimal closed_injective_linear_image closure_subset image_mono)
 
 lemma closure_bounded_linear_image:
     fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     shows "\<lbrakk>linear f; bounded S\<rbrakk> \<Longrightarrow> f ` (closure S) = closure (f ` S)"
   apply (rule subset_antisym, simp add: closure_linear_image_subset)
   apply (rule closure_minimal, simp add: closure_subset image_mono)
   by (meson bounded_closure closed_closure compact_continuous_image compact_eq_bounded_closed linear_continuous_on linear_conv_bounded_linear)
 
 lemma closure_scaleR:
   fixes S :: "'a::real_normed_vector set"
   shows "((*\<^sub>R) c) ` (closure S) = closure (((*\<^sub>R) c) ` S)"
 proof
   show "((*\<^sub>R) c) ` (closure S) \<subseteq> closure (((*\<^sub>R) c) ` S)"
     using bounded_linear_scaleR_right
     by (rule closure_bounded_linear_image_subset)
   show "closure (((*\<^sub>R) c) ` S) \<subseteq> ((*\<^sub>R) c) ` (closure S)"
     by (intro closure_minimal image_mono closure_subset closed_scaling closed_closure)
 qed
 
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Some properties of a canonical subspace\<close>
 
 lemma closed_substandard: "closed {x::'a::euclidean_space. \<forall>i\<in>Basis. P i \<longrightarrow> x\<bullet>i = 0}"
   (is "closed ?A")
 proof -
   let ?D = "{i\<in>Basis. P i}"
   have "closed (\<Inter>i\<in>?D. {x::'a. x\<bullet>i = 0})"
     by (simp add: closed_INT closed_Collect_eq continuous_on_inner)
   also have "(\<Inter>i\<in>?D. {x::'a. x\<bullet>i = 0}) = ?A"
     by auto
   finally show "closed ?A" .
 qed
 
 lemma closed_subspace:
   fixes s :: "'a::euclidean_space set"
   assumes "subspace s"
   shows "closed s"
 proof -
   have "dim s \<le> card (Basis :: 'a set)"
     using dim_subset_UNIV by auto
   with ex_card[OF this] obtain d :: "'a set" where t: "card d = dim s" and d: "d \<subseteq> Basis"
     by auto
   let ?t = "{x::'a. \<forall>i\<in>Basis. i \<notin> d \<longrightarrow> x\<bullet>i = 0}"
   have "\<exists>f. linear f \<and> f ` {x::'a. \<forall>i\<in>Basis. i \<notin> d \<longrightarrow> x \<bullet> i = 0} = s \<and>
       inj_on f {x::'a. \<forall>i\<in>Basis. i \<notin> d \<longrightarrow> x \<bullet> i = 0}"
     using dim_substandard[of d] t d assms
     by (intro subspace_isomorphism[OF subspace_substandard[of "\<lambda>i. i \<notin> d"]]) (auto simp: inner_Basis)
   then obtain f where f:
       "linear f"
       "f ` {x. \<forall>i\<in>Basis. i \<notin> d \<longrightarrow> x \<bullet> i = 0} = s"
       "inj_on f {x. \<forall>i\<in>Basis. i \<notin> d \<longrightarrow> x \<bullet> i = 0}"
     by blast
   interpret f: bounded_linear f
     using f by (simp add: linear_conv_bounded_linear)
   have "x \<in> ?t \<Longrightarrow> f x = 0 \<Longrightarrow> x = 0" for x
     using f.zero d f(3)[THEN inj_onD, of x 0] by auto
   moreover have "closed ?t" by (rule closed_substandard)
   moreover have "subspace ?t" by (rule subspace_substandard)
   ultimately show ?thesis
     using closed_injective_image_subspace[of ?t f]
     unfolding f(2) using f(1) unfolding linear_conv_bounded_linear by auto
 qed
 
 lemma complete_subspace: "subspace s \<Longrightarrow> complete s"
   for s :: "'a::euclidean_space set"
   using complete_eq_closed closed_subspace by auto
 
 lemma closed_span [iff]: "closed (span s)"
   for s :: "'a::euclidean_space set"
   by (simp add: closed_subspace)
 
 lemma dim_closure [simp]: "dim (closure s) = dim s" (is "?dc = ?d")
   for s :: "'a::euclidean_space set"
 proof -
   have "?dc \<le> ?d"
     using closure_minimal[OF span_superset, of s]
     using closed_subspace[OF subspace_span, of s]
     using dim_subset[of "closure s" "span s"]
     by simp
   then show ?thesis
     using dim_subset[OF closure_subset, of s]
     by simp
 qed
 
 
 subsection \<open>Set Distance\<close>
 
 lemma setdist_compact_closed:
   fixes A :: "'a::heine_borel set"
   assumes A: "compact A" and B: "closed B"
     and "A \<noteq> {}" "B \<noteq> {}"
   shows "\<exists>x \<in> A. \<exists>y \<in> B. dist x y = setdist A B"
 proof -
   obtain x where "x \<in> A" "setdist A B = infdist x B"
     by (metis A assms(3) setdist_attains_inf setdist_sym)
   moreover
   obtain y where"y \<in> B" "infdist x B = dist x y"
     using B \<open>B \<noteq> {}\<close> infdist_attains_inf by blast
   ultimately show ?thesis
     using \<open>x \<in> A\<close> \<open>y \<in> B\<close> by auto
 qed
 
 lemma setdist_closed_compact:
   fixes S :: "'a::heine_borel set"
   assumes S: "closed S" and T: "compact T"
       and "S \<noteq> {}" "T \<noteq> {}"
     shows "\<exists>x \<in> S. \<exists>y \<in> T. dist x y = setdist S T"
   using setdist_compact_closed [OF T S \<open>T \<noteq> {}\<close> \<open>S \<noteq> {}\<close>]
   by (metis dist_commute setdist_sym)
 
 lemma setdist_eq_0_compact_closed:
   assumes S: "compact S" and T: "closed T"
     shows "setdist S T = 0 \<longleftrightarrow> S = {} \<or> T = {} \<or> S \<inter> T \<noteq> {}"
 proof (cases "S = {} \<or> T = {}")
   case True
   then show ?thesis
     by force
 next
   case False
   then show ?thesis
     by (metis S T disjoint_iff_not_equal in_closed_iff_infdist_zero setdist_attains_inf setdist_eq_0I setdist_sym)
 qed
 
 corollary setdist_gt_0_compact_closed:
   assumes S: "compact S" and T: "closed T"
     shows "setdist S T > 0 \<longleftrightarrow> (S \<noteq> {} \<and> T \<noteq> {} \<and> S \<inter> T = {})"
   using setdist_pos_le [of S T] setdist_eq_0_compact_closed [OF assms] by linarith
 
 lemma setdist_eq_0_closed_compact:
   assumes S: "closed S" and T: "compact T"
     shows "setdist S T = 0 \<longleftrightarrow> S = {} \<or> T = {} \<or> S \<inter> T \<noteq> {}"
   using setdist_eq_0_compact_closed [OF T S]
   by (metis Int_commute setdist_sym)
 
 lemma setdist_eq_0_bounded:
   fixes S :: "'a::heine_borel set"
   assumes "bounded S \<or> bounded T"
   shows "setdist S T = 0 \<longleftrightarrow> S = {} \<or> T = {} \<or> closure S \<inter> closure T \<noteq> {}"
 proof (cases "S = {} \<or> T = {}")
   case False
   then show ?thesis
     using setdist_eq_0_compact_closed [of "closure S" "closure T"]
           setdist_eq_0_closed_compact [of "closure S" "closure T"] assms
     by (force simp:  bounded_closure compact_eq_bounded_closed)
 qed force
 
 lemma setdist_eq_0_sing_1:
   "setdist {x} S = 0 \<longleftrightarrow> S = {} \<or> x \<in> closure S"
   by (metis in_closure_iff_infdist_zero infdist_def infdist_eq_setdist)
 
 lemma setdist_eq_0_sing_2:
   "setdist S {x} = 0 \<longleftrightarrow> S = {} \<or> x \<in> closure S"
   by (metis setdist_eq_0_sing_1 setdist_sym)
 
 lemma setdist_neq_0_sing_1:
   "\<lbrakk>setdist {x} S = a; a \<noteq> 0\<rbrakk> \<Longrightarrow> S \<noteq> {} \<and> x \<notin> closure S"
   by (metis setdist_closure_2 setdist_empty2 setdist_eq_0I singletonI)
 
 lemma setdist_neq_0_sing_2:
   "\<lbrakk>setdist S {x} = a; a \<noteq> 0\<rbrakk> \<Longrightarrow> S \<noteq> {} \<and> x \<notin> closure S"
   by (simp add: setdist_neq_0_sing_1 setdist_sym)
 
 lemma setdist_sing_in_set:
    "x \<in> S \<Longrightarrow> setdist {x} S = 0"
   by (simp add: setdist_eq_0I)
 
 lemma setdist_eq_0_closed:
    "closed S \<Longrightarrow> (setdist {x} S = 0 \<longleftrightarrow> S = {} \<or> x \<in> S)"
 by (simp add: setdist_eq_0_sing_1)
 
 lemma setdist_eq_0_closedin:
   shows "\<lbrakk>closedin (top_of_set U) S; x \<in> U\<rbrakk>
          \<Longrightarrow> (setdist {x} S = 0 \<longleftrightarrow> S = {} \<or> x \<in> S)"
   by (auto simp: closedin_limpt setdist_eq_0_sing_1 closure_def)
 
 lemma setdist_gt_0_closedin:
   shows "\<lbrakk>closedin (top_of_set U) S; x \<in> U; S \<noteq> {}; x \<notin> S\<rbrakk>
          \<Longrightarrow> setdist {x} S > 0"
   using less_eq_real_def setdist_eq_0_closedin by fastforce
 
 no_notation
   eucl_less (infix "<e" 50)
 
 end
diff --git a/src/HOL/Deriv.thy b/src/HOL/Deriv.thy
--- a/src/HOL/Deriv.thy
+++ b/src/HOL/Deriv.thy
@@ -1,2426 +1,2427 @@
 (*  Title:      HOL/Deriv.thy
     Author:     Jacques D. Fleuriot, University of Cambridge, 1998
     Author:     Brian Huffman
     Author:     Lawrence C Paulson, 2004
     Author:     Benjamin Porter, 2005
 *)
 
 section \<open>Differentiation\<close>
 
 theory Deriv
   imports Limits
 begin
 
 subsection \<open>Frechet derivative\<close>
 
 definition has_derivative :: "('a::real_normed_vector \<Rightarrow> 'b::real_normed_vector) \<Rightarrow>
     ('a \<Rightarrow> 'b) \<Rightarrow> 'a filter \<Rightarrow> bool"  (infix "(has'_derivative)" 50)
   where "(f has_derivative f') F \<longleftrightarrow>
     bounded_linear f' \<and>
     ((\<lambda>y. ((f y - f (Lim F (\<lambda>x. x))) - f' (y - Lim F (\<lambda>x. x))) /\<^sub>R norm (y - Lim F (\<lambda>x. x))) \<longlongrightarrow> 0) F"
 
 text \<open>
   Usually the filter \<^term>\<open>F\<close> is \<^term>\<open>at x within s\<close>.  \<^term>\<open>(f has_derivative D)
   (at x within s)\<close> means: \<^term>\<open>D\<close> is the derivative of function \<^term>\<open>f\<close> at point \<^term>\<open>x\<close>
   within the set \<^term>\<open>s\<close>. Where \<^term>\<open>s\<close> is used to express left or right sided derivatives. In
   most cases \<^term>\<open>s\<close> is either a variable or \<^term>\<open>UNIV\<close>.
 \<close>
 
 text \<open>These are the only cases we'll care about, probably.\<close>
 
 lemma has_derivative_within: "(f has_derivative f') (at x within s) \<longleftrightarrow>
     bounded_linear f' \<and> ((\<lambda>y. (1 / norm(y - x)) *\<^sub>R (f y - (f x + f' (y - x)))) \<longlongrightarrow> 0) (at x within s)"
   unfolding has_derivative_def tendsto_iff
   by (subst eventually_Lim_ident_at) (auto simp add: field_simps)
 
 lemma has_derivative_eq_rhs: "(f has_derivative f') F \<Longrightarrow> f' = g' \<Longrightarrow> (f has_derivative g') F"
   by simp
 
 definition has_field_derivative :: "('a::real_normed_field \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a filter \<Rightarrow> bool"
     (infix "(has'_field'_derivative)" 50)
   where "(f has_field_derivative D) F \<longleftrightarrow> (f has_derivative (*) D) F"
 
 lemma DERIV_cong: "(f has_field_derivative X) F \<Longrightarrow> X = Y \<Longrightarrow> (f has_field_derivative Y) F"
   by simp
 
 definition has_vector_derivative :: "(real \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'b \<Rightarrow> real filter \<Rightarrow> bool"
     (infix "has'_vector'_derivative" 50)
   where "(f has_vector_derivative f') net \<longleftrightarrow> (f has_derivative (\<lambda>x. x *\<^sub>R f')) net"
 
 lemma has_vector_derivative_eq_rhs:
   "(f has_vector_derivative X) F \<Longrightarrow> X = Y \<Longrightarrow> (f has_vector_derivative Y) F"
   by simp
 
 named_theorems derivative_intros "structural introduction rules for derivatives"
 setup \<open>
   let
     val eq_thms = @{thms has_derivative_eq_rhs DERIV_cong has_vector_derivative_eq_rhs}
     fun eq_rule thm = get_first (try (fn eq_thm => eq_thm OF [thm])) eq_thms
   in
     Global_Theory.add_thms_dynamic
       (\<^binding>\<open>derivative_eq_intros\<close>,
         fn context =>
           Named_Theorems.get (Context.proof_of context) \<^named_theorems>\<open>derivative_intros\<close>
           |> map_filter eq_rule)
   end
 \<close>
 
 text \<open>
   The following syntax is only used as a legacy syntax.
 \<close>
 abbreviation (input)
   FDERIV :: "('a::real_normed_vector \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'a \<Rightarrow>  ('a \<Rightarrow> 'b) \<Rightarrow> bool"
   ("(FDERIV (_)/ (_)/ :> (_))" [1000, 1000, 60] 60)
   where "FDERIV f x :> f' \<equiv> (f has_derivative f') (at x)"
 
 lemma has_derivative_bounded_linear: "(f has_derivative f') F \<Longrightarrow> bounded_linear f'"
   by (simp add: has_derivative_def)
 
 lemma has_derivative_linear: "(f has_derivative f') F \<Longrightarrow> linear f'"
   using bounded_linear.linear[OF has_derivative_bounded_linear] .
 
 lemma has_derivative_ident[derivative_intros, simp]: "((\<lambda>x. x) has_derivative (\<lambda>x. x)) F"
   by (simp add: has_derivative_def)
 
 lemma has_derivative_id [derivative_intros, simp]: "(id has_derivative id) (at a)"
   by (metis eq_id_iff has_derivative_ident)
 
 lemma has_derivative_const[derivative_intros, simp]: "((\<lambda>x. c) has_derivative (\<lambda>x. 0)) F"
   by (simp add: has_derivative_def)
 
 lemma (in bounded_linear) bounded_linear: "bounded_linear f" ..
 
 lemma (in bounded_linear) has_derivative:
   "(g has_derivative g') F \<Longrightarrow> ((\<lambda>x. f (g x)) has_derivative (\<lambda>x. f (g' x))) F"
   unfolding has_derivative_def
   by (auto simp add: bounded_linear_compose [OF bounded_linear] scaleR diff dest: tendsto)
 
 lemmas has_derivative_scaleR_right [derivative_intros] =
   bounded_linear.has_derivative [OF bounded_linear_scaleR_right]
 
 lemmas has_derivative_scaleR_left [derivative_intros] =
   bounded_linear.has_derivative [OF bounded_linear_scaleR_left]
 
 lemmas has_derivative_mult_right [derivative_intros] =
   bounded_linear.has_derivative [OF bounded_linear_mult_right]
 
 lemmas has_derivative_mult_left [derivative_intros] =
   bounded_linear.has_derivative [OF bounded_linear_mult_left]
 
 lemmas has_derivative_of_real[derivative_intros, simp] = 
   bounded_linear.has_derivative[OF bounded_linear_of_real] 
 
 lemma has_derivative_add[simp, derivative_intros]:
   assumes f: "(f has_derivative f') F"
     and g: "(g has_derivative g') F"
   shows "((\<lambda>x. f x + g x) has_derivative (\<lambda>x. f' x + g' x)) F"
   unfolding has_derivative_def
 proof safe
   let ?x = "Lim F (\<lambda>x. x)"
   let ?D = "\<lambda>f f' y. ((f y - f ?x) - f' (y - ?x)) /\<^sub>R norm (y - ?x)"
   have "((\<lambda>x. ?D f f' x + ?D g g' x) \<longlongrightarrow> (0 + 0)) F"
     using f g by (intro tendsto_add) (auto simp: has_derivative_def)
   then show "(?D (\<lambda>x. f x + g x) (\<lambda>x. f' x + g' x) \<longlongrightarrow> 0) F"
     by (simp add: field_simps scaleR_add_right scaleR_diff_right)
 qed (blast intro: bounded_linear_add f g has_derivative_bounded_linear)
 
 lemma has_derivative_sum[simp, derivative_intros]:
   "(\<And>i. i \<in> I \<Longrightarrow> (f i has_derivative f' i) F) \<Longrightarrow>
     ((\<lambda>x. \<Sum>i\<in>I. f i x) has_derivative (\<lambda>x. \<Sum>i\<in>I. f' i x)) F"
   by (induct I rule: infinite_finite_induct) simp_all
 
 lemma has_derivative_minus[simp, derivative_intros]:
   "(f has_derivative f') F \<Longrightarrow> ((\<lambda>x. - f x) has_derivative (\<lambda>x. - f' x)) F"
   using has_derivative_scaleR_right[of f f' F "-1"] by simp
 
 lemma has_derivative_diff[simp, derivative_intros]:
   "(f has_derivative f') F \<Longrightarrow> (g has_derivative g') F \<Longrightarrow>
     ((\<lambda>x. f x - g x) has_derivative (\<lambda>x. f' x - g' x)) F"
   by (simp only: diff_conv_add_uminus has_derivative_add has_derivative_minus)
 
 lemma has_derivative_at_within:
   "(f has_derivative f') (at x within s) \<longleftrightarrow>
     (bounded_linear f' \<and> ((\<lambda>y. ((f y - f x) - f' (y - x)) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within s))"
 proof (cases "at x within s = bot")
   case True
   then show ?thesis
     by (metis (no_types, lifting) has_derivative_within tendsto_bot)
 next
   case False
   then show ?thesis
   by (simp add: Lim_ident_at has_derivative_def)
 qed
 
 lemma has_derivative_iff_norm:
   "(f has_derivative f') (at x within s) \<longleftrightarrow>
     bounded_linear f' \<and> ((\<lambda>y. norm ((f y - f x) - f' (y - x)) / norm (y - x)) \<longlongrightarrow> 0) (at x within s)"
   using tendsto_norm_zero_iff[of _ "at x within s", where 'b="'b", symmetric]
   by (simp add: has_derivative_at_within divide_inverse ac_simps)
 
 lemma has_derivative_at:
   "(f has_derivative D) (at x) \<longleftrightarrow>
     (bounded_linear D \<and> (\<lambda>h. norm (f (x + h) - f x - D h) / norm h) \<midarrow>0\<rightarrow> 0)"
   by (simp add: has_derivative_iff_norm LIM_offset_zero_iff)
 
 lemma field_has_derivative_at:
   fixes x :: "'a::real_normed_field"
   shows "(f has_derivative (*) D) (at x) \<longleftrightarrow> (\<lambda>h. (f (x + h) - f x) / h) \<midarrow>0\<rightarrow> D" (is "?lhs = ?rhs")
 proof -
   have "?lhs = (\<lambda>h. norm (f (x + h) - f x - D * h) / norm h) \<midarrow>0 \<rightarrow> 0"
     by (simp add: bounded_linear_mult_right has_derivative_at)
   also have "... = (\<lambda>y. norm ((f (x + y) - f x - D * y) / y)) \<midarrow>0\<rightarrow> 0"
     by (simp cong: LIM_cong flip: nonzero_norm_divide)
   also have "... = (\<lambda>y. norm ((f (x + y) - f x) / y - D / y * y)) \<midarrow>0\<rightarrow> 0"
     by (simp only: diff_divide_distrib times_divide_eq_left [symmetric])
   also have "... = ?rhs"
     by (simp add: tendsto_norm_zero_iff LIM_zero_iff cong: LIM_cong)
   finally show ?thesis .
 qed
 
 lemma has_derivative_iff_Ex:
   "(f has_derivative f') (at x) \<longleftrightarrow>
     bounded_linear f' \<and> (\<exists>e. (\<forall>h. f (x+h) = f x + f' h + e h) \<and> ((\<lambda>h. norm (e h) / norm h) \<longlongrightarrow> 0) (at 0))"
   unfolding has_derivative_at by force
 
 lemma has_derivative_at_within_iff_Ex:
   assumes "x \<in> S" "open S"
   shows "(f has_derivative f') (at x within S) \<longleftrightarrow>
          bounded_linear f' \<and> (\<exists>e. (\<forall>h. x+h \<in> S \<longrightarrow> f (x+h) = f x + f' h + e h) \<and> ((\<lambda>h. norm (e h) / norm h) \<longlongrightarrow> 0) (at 0))"
     (is "?lhs = ?rhs")
 proof safe
   show "bounded_linear f'"
     if "(f has_derivative f') (at x within S)"
     using has_derivative_bounded_linear that by blast
   show "\<exists>e. (\<forall>h. x + h \<in> S \<longrightarrow> f (x + h) = f x + f' h + e h) \<and> (\<lambda>h. norm (e h) / norm h) \<midarrow>0\<rightarrow> 0"
     if "(f has_derivative f') (at x within S)"
     by (metis (full_types) assms that has_derivative_iff_Ex at_within_open)
   show "(f has_derivative f') (at x within S)"
     if "bounded_linear f'"
       and eq [rule_format]: "\<forall>h. x + h \<in> S \<longrightarrow> f (x + h) = f x + f' h + e h"
       and 0: "(\<lambda>h. norm (e (h::'a)::'b) / norm h) \<midarrow>0\<rightarrow> 0"
     for e 
   proof -
     have 1: "f y - f x = f' (y-x) + e (y-x)" if "y \<in> S" for y
       using eq [of "y-x"] that by simp
     have 2: "((\<lambda>y. norm (e (y-x)) / norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
       by (simp add: "0" assms tendsto_offset_zero_iff)
     have "((\<lambda>y. norm (f y - f x - f' (y - x)) / norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
       by (simp add: Lim_cong_within 1 2)
     then show ?thesis
       by (simp add: has_derivative_iff_norm \<open>bounded_linear f'\<close>)
   qed
 qed
 
 lemma has_derivativeI:
   "bounded_linear f' \<Longrightarrow>
     ((\<lambda>y. ((f y - f x) - f' (y - x)) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within s) \<Longrightarrow>
     (f has_derivative f') (at x within s)"
   by (simp add: has_derivative_at_within)
 
 lemma has_derivativeI_sandwich:
   assumes e: "0 < e"
     and bounded: "bounded_linear f'"
     and sandwich: "(\<And>y. y \<in> s \<Longrightarrow> y \<noteq> x \<Longrightarrow> dist y x < e \<Longrightarrow>
       norm ((f y - f x) - f' (y - x)) / norm (y - x) \<le> H y)"
     and "(H \<longlongrightarrow> 0) (at x within s)"
   shows "(f has_derivative f') (at x within s)"
   unfolding has_derivative_iff_norm
 proof safe
   show "((\<lambda>y. norm (f y - f x - f' (y - x)) / norm (y - x)) \<longlongrightarrow> 0) (at x within s)"
   proof (rule tendsto_sandwich[where f="\<lambda>x. 0"])
     show "(H \<longlongrightarrow> 0) (at x within s)" by fact
     show "eventually (\<lambda>n. norm (f n - f x - f' (n - x)) / norm (n - x) \<le> H n) (at x within s)"
       unfolding eventually_at using e sandwich by auto
   qed (auto simp: le_divide_eq)
 qed fact
 
 lemma has_derivative_subset:
   "(f has_derivative f') (at x within s) \<Longrightarrow> t \<subseteq> s \<Longrightarrow> (f has_derivative f') (at x within t)"
   by (auto simp add: has_derivative_iff_norm intro: tendsto_within_subset)
 
 lemma has_derivative_within_singleton_iff:
   "(f has_derivative g) (at x within {x}) \<longleftrightarrow> bounded_linear g"
   by (auto intro!: has_derivativeI_sandwich[where e=1] has_derivative_bounded_linear)
 
 
 subsubsection \<open>Limit transformation for derivatives\<close>
 
 lemma has_derivative_transform_within:
   assumes "(f has_derivative f') (at x within s)"
     and "0 < d"
     and "x \<in> s"
     and "\<And>x'. \<lbrakk>x' \<in> s; dist x' x < d\<rbrakk> \<Longrightarrow> f x' = g x'"
   shows "(g has_derivative f') (at x within s)"
   using assms
   unfolding has_derivative_within
   by (force simp add: intro: Lim_transform_within)
 
 lemma has_derivative_transform_within_open:
   assumes "(f has_derivative f') (at x within t)"
     and "open s"
     and "x \<in> s"
     and "\<And>x. x\<in>s \<Longrightarrow> f x = g x"
   shows "(g has_derivative f') (at x within t)"
   using assms unfolding has_derivative_within
   by (force simp add: intro: Lim_transform_within_open)
 
 lemma has_derivative_transform:
   assumes "x \<in> s" "\<And>x. x \<in> s \<Longrightarrow> g x = f x"
   assumes "(f has_derivative f') (at x within s)"
   shows "(g has_derivative f') (at x within s)"
   using assms
   by (intro has_derivative_transform_within[OF _ zero_less_one, where g=g]) auto
 
 lemma has_derivative_transform_eventually:
   assumes "(f has_derivative f') (at x within s)"
     "(\<forall>\<^sub>F x' in at x within s. f x' = g x')"
   assumes "f x = g x" "x \<in> s"
   shows "(g has_derivative f') (at x within s)"
   using assms
 proof -
   from assms(2,3) obtain d where "d > 0" "\<And>x'. x' \<in> s \<Longrightarrow> dist x' x < d \<Longrightarrow> f x' = g x'"
     by (force simp: eventually_at)
   from has_derivative_transform_within[OF assms(1) this(1) assms(4) this(2)]
   show ?thesis .
 qed
 
 lemma has_field_derivative_transform_within:
   assumes "(f has_field_derivative f') (at a within S)"
     and "0 < d"
     and "a \<in> S"
     and "\<And>x. \<lbrakk>x \<in> S; dist x a < d\<rbrakk> \<Longrightarrow> f x = g x"
   shows "(g has_field_derivative f') (at a within S)"
   using assms unfolding has_field_derivative_def
   by (metis has_derivative_transform_within)
 
 lemma has_field_derivative_transform_within_open:
   assumes "(f has_field_derivative f') (at a)"
     and "open S" "a \<in> S"
     and "\<And>x. x \<in> S \<Longrightarrow> f x = g x"
   shows "(g has_field_derivative f') (at a)"
   using assms unfolding has_field_derivative_def
   by (metis has_derivative_transform_within_open)
 
 
 subsection \<open>Continuity\<close>
 
 lemma has_derivative_continuous:
   assumes f: "(f has_derivative f') (at x within s)"
   shows "continuous (at x within s) f"
 proof -
   from f interpret F: bounded_linear f'
     by (rule has_derivative_bounded_linear)
   note F.tendsto[tendsto_intros]
   let ?L = "\<lambda>f. (f \<longlongrightarrow> 0) (at x within s)"
   have "?L (\<lambda>y. norm ((f y - f x) - f' (y - x)) / norm (y - x))"
     using f unfolding has_derivative_iff_norm by blast
   then have "?L (\<lambda>y. norm ((f y - f x) - f' (y - x)) / norm (y - x) * norm (y - x))" (is ?m)
     by (rule tendsto_mult_zero) (auto intro!: tendsto_eq_intros)
   also have "?m \<longleftrightarrow> ?L (\<lambda>y. norm ((f y - f x) - f' (y - x)))"
     by (intro filterlim_cong) (simp_all add: eventually_at_filter)
   finally have "?L (\<lambda>y. (f y - f x) - f' (y - x))"
     by (rule tendsto_norm_zero_cancel)
   then have "?L (\<lambda>y. ((f y - f x) - f' (y - x)) + f' (y - x))"
     by (rule tendsto_eq_intros) (auto intro!: tendsto_eq_intros simp: F.zero)
   then have "?L (\<lambda>y. f y - f x)"
     by simp
   from tendsto_add[OF this tendsto_const, of "f x"] show ?thesis
     by (simp add: continuous_within)
 qed
 
 
 subsection \<open>Composition\<close>
 
 lemma tendsto_at_iff_tendsto_nhds_within:
   "f x = y \<Longrightarrow> (f \<longlongrightarrow> y) (at x within s) \<longleftrightarrow> (f \<longlongrightarrow> y) (inf (nhds x) (principal s))"
   unfolding tendsto_def eventually_inf_principal eventually_at_filter
   by (intro ext all_cong imp_cong) (auto elim!: eventually_mono)
 
 lemma has_derivative_in_compose:
   assumes f: "(f has_derivative f') (at x within s)"
     and g: "(g has_derivative g') (at (f x) within (f`s))"
   shows "((\<lambda>x. g (f x)) has_derivative (\<lambda>x. g' (f' x))) (at x within s)"
 proof -
   from f interpret F: bounded_linear f'
     by (rule has_derivative_bounded_linear)
   from g interpret G: bounded_linear g'
     by (rule has_derivative_bounded_linear)
   from F.bounded obtain kF where kF: "\<And>x. norm (f' x) \<le> norm x * kF"
     by fast
   from G.bounded obtain kG where kG: "\<And>x. norm (g' x) \<le> norm x * kG"
     by fast
   note G.tendsto[tendsto_intros]
 
   let ?L = "\<lambda>f. (f \<longlongrightarrow> 0) (at x within s)"
   let ?D = "\<lambda>f f' x y. (f y - f x) - f' (y - x)"
   let ?N = "\<lambda>f f' x y. norm (?D f f' x y) / norm (y - x)"
   let ?gf = "\<lambda>x. g (f x)" and ?gf' = "\<lambda>x. g' (f' x)"
   define Nf where "Nf = ?N f f' x"
   define Ng where [abs_def]: "Ng y = ?N g g' (f x) (f y)" for y
 
   show ?thesis
   proof (rule has_derivativeI_sandwich[of 1])
     show "bounded_linear (\<lambda>x. g' (f' x))"
       using f g by (blast intro: bounded_linear_compose has_derivative_bounded_linear)
   next
     fix y :: 'a
     assume neq: "y \<noteq> x"
     have "?N ?gf ?gf' x y = norm (g' (?D f f' x y) + ?D g g' (f x) (f y)) / norm (y - x)"
       by (simp add: G.diff G.add field_simps)
     also have "\<dots> \<le> norm (g' (?D f f' x y)) / norm (y - x) + Ng y * (norm (f y - f x) / norm (y - x))"
       by (simp add: add_divide_distrib[symmetric] divide_right_mono norm_triangle_ineq G.zero Ng_def)
     also have "\<dots> \<le> Nf y * kG + Ng y * (Nf y + kF)"
     proof (intro add_mono mult_left_mono)
       have "norm (f y - f x) = norm (?D f f' x y + f' (y - x))"
         by simp
       also have "\<dots> \<le> norm (?D f f' x y) + norm (f' (y - x))"
         by (rule norm_triangle_ineq)
       also have "\<dots> \<le> norm (?D f f' x y) + norm (y - x) * kF"
         using kF by (intro add_mono) simp
       finally show "norm (f y - f x) / norm (y - x) \<le> Nf y + kF"
         by (simp add: neq Nf_def field_simps)
     qed (use kG in \<open>simp_all add: Ng_def Nf_def neq zero_le_divide_iff field_simps\<close>)
     finally show "?N ?gf ?gf' x y \<le> Nf y * kG + Ng y * (Nf y + kF)" .
   next
     have [tendsto_intros]: "?L Nf"
       using f unfolding has_derivative_iff_norm Nf_def ..
     from f have "(f \<longlongrightarrow> f x) (at x within s)"
       by (blast intro: has_derivative_continuous continuous_within[THEN iffD1])
     then have f': "LIM x at x within s. f x :> inf (nhds (f x)) (principal (f`s))"
       unfolding filterlim_def
       by (simp add: eventually_filtermap eventually_at_filter le_principal)
 
     have "((?N g  g' (f x)) \<longlongrightarrow> 0) (at (f x) within f`s)"
       using g unfolding has_derivative_iff_norm ..
     then have g': "((?N g  g' (f x)) \<longlongrightarrow> 0) (inf (nhds (f x)) (principal (f`s)))"
       by (rule tendsto_at_iff_tendsto_nhds_within[THEN iffD1, rotated]) simp
 
     have [tendsto_intros]: "?L Ng"
       unfolding Ng_def by (rule filterlim_compose[OF g' f'])
     show "((\<lambda>y. Nf y * kG + Ng y * (Nf y + kF)) \<longlongrightarrow> 0) (at x within s)"
       by (intro tendsto_eq_intros) auto
   qed simp
 qed
 
 lemma has_derivative_compose:
   "(f has_derivative f') (at x within s) \<Longrightarrow> (g has_derivative g') (at (f x)) \<Longrightarrow>
   ((\<lambda>x. g (f x)) has_derivative (\<lambda>x. g' (f' x))) (at x within s)"
   by (blast intro: has_derivative_in_compose has_derivative_subset)
 
 lemma has_derivative_in_compose2:
   assumes "\<And>x. x \<in> t \<Longrightarrow> (g has_derivative g' x) (at x within t)"
   assumes "f ` s \<subseteq> t" "x \<in> s"
   assumes "(f has_derivative f') (at x within s)"
   shows "((\<lambda>x. g (f x)) has_derivative (\<lambda>y. g' (f x) (f' y))) (at x within s)"
   using assms
   by (auto intro: has_derivative_subset intro!: has_derivative_in_compose[of f f' x s g])
 
 lemma (in bounded_bilinear) FDERIV:
   assumes f: "(f has_derivative f') (at x within s)" and g: "(g has_derivative g') (at x within s)"
   shows "((\<lambda>x. f x ** g x) has_derivative (\<lambda>h. f x ** g' h + f' h ** g x)) (at x within s)"
 proof -
   from bounded_linear.bounded [OF has_derivative_bounded_linear [OF f]]
   obtain KF where norm_F: "\<And>x. norm (f' x) \<le> norm x * KF" by fast
 
   from pos_bounded obtain K
     where K: "0 < K" and norm_prod: "\<And>a b. norm (a ** b) \<le> norm a * norm b * K"
     by fast
   let ?D = "\<lambda>f f' y. f y - f x - f' (y - x)"
   let ?N = "\<lambda>f f' y. norm (?D f f' y) / norm (y - x)"
   define Ng where "Ng = ?N g g'"
   define Nf where "Nf = ?N f f'"
 
   let ?fun1 = "\<lambda>y. norm (f y ** g y - f x ** g x - (f x ** g' (y - x) + f' (y - x) ** g x)) / norm (y - x)"
   let ?fun2 = "\<lambda>y. norm (f x) * Ng y * K + Nf y * norm (g y) * K + KF * norm (g y - g x) * K"
   let ?F = "at x within s"
 
   show ?thesis
   proof (rule has_derivativeI_sandwich[of 1])
     show "bounded_linear (\<lambda>h. f x ** g' h + f' h ** g x)"
       by (intro bounded_linear_add
         bounded_linear_compose [OF bounded_linear_right] bounded_linear_compose [OF bounded_linear_left]
         has_derivative_bounded_linear [OF g] has_derivative_bounded_linear [OF f])
   next
     from g have "(g \<longlongrightarrow> g x) ?F"
       by (intro continuous_within[THEN iffD1] has_derivative_continuous)
     moreover from f g have "(Nf \<longlongrightarrow> 0) ?F" "(Ng \<longlongrightarrow> 0) ?F"
       by (simp_all add: has_derivative_iff_norm Ng_def Nf_def)
     ultimately have "(?fun2 \<longlongrightarrow> norm (f x) * 0 * K + 0 * norm (g x) * K + KF * norm (0::'b) * K) ?F"
       by (intro tendsto_intros) (simp_all add: LIM_zero_iff)
     then show "(?fun2 \<longlongrightarrow> 0) ?F"
       by simp
   next
     fix y :: 'd
     assume "y \<noteq> x"
     have "?fun1 y =
         norm (f x ** ?D g g' y + ?D f f' y ** g y + f' (y - x) ** (g y - g x)) / norm (y - x)"
       by (simp add: diff_left diff_right add_left add_right field_simps)
     also have "\<dots> \<le> (norm (f x) * norm (?D g g' y) * K + norm (?D f f' y) * norm (g y) * K +
         norm (y - x) * KF * norm (g y - g x) * K) / norm (y - x)"
       by (intro divide_right_mono mult_mono'
                 order_trans [OF norm_triangle_ineq add_mono]
                 order_trans [OF norm_prod mult_right_mono]
                 mult_nonneg_nonneg order_refl norm_ge_zero norm_F
                 K [THEN order_less_imp_le])
     also have "\<dots> = ?fun2 y"
       by (simp add: add_divide_distrib Ng_def Nf_def)
     finally show "?fun1 y \<le> ?fun2 y" .
   qed simp
 qed
 
 lemmas has_derivative_mult[simp, derivative_intros] = bounded_bilinear.FDERIV[OF bounded_bilinear_mult]
 lemmas has_derivative_scaleR[simp, derivative_intros] = bounded_bilinear.FDERIV[OF bounded_bilinear_scaleR]
 
 lemma has_derivative_prod[simp, derivative_intros]:
   fixes f :: "'i \<Rightarrow> 'a::real_normed_vector \<Rightarrow> 'b::real_normed_field"
   shows "(\<And>i. i \<in> I \<Longrightarrow> (f i has_derivative f' i) (at x within S)) \<Longrightarrow>
     ((\<lambda>x. \<Prod>i\<in>I. f i x) has_derivative (\<lambda>y. \<Sum>i\<in>I. f' i y * (\<Prod>j\<in>I - {i}. f j x))) (at x within S)"
 proof (induct I rule: infinite_finite_induct)
   case infinite
   then show ?case by simp
 next
   case empty
   then show ?case by simp
 next
   case (insert i I)
   let ?P = "\<lambda>y. f i x * (\<Sum>i\<in>I. f' i y * (\<Prod>j\<in>I - {i}. f j x)) + (f' i y) * (\<Prod>i\<in>I. f i x)"
   have "((\<lambda>x. f i x * (\<Prod>i\<in>I. f i x)) has_derivative ?P) (at x within S)"
     using insert by (intro has_derivative_mult) auto
   also have "?P = (\<lambda>y. \<Sum>i'\<in>insert i I. f' i' y * (\<Prod>j\<in>insert i I - {i'}. f j x))"
     using insert(1,2)
     by (auto simp add: sum_distrib_left insert_Diff_if intro!: ext sum.cong)
   finally show ?case
     using insert by simp
 qed
 
 lemma has_derivative_power[simp, derivative_intros]:
   fixes f :: "'a :: real_normed_vector \<Rightarrow> 'b :: real_normed_field"
   assumes f: "(f has_derivative f') (at x within S)"
   shows "((\<lambda>x. f x^n) has_derivative (\<lambda>y. of_nat n * f' y * f x^(n - 1))) (at x within S)"
   using has_derivative_prod[OF f, of "{..< n}"] by (simp add: prod_constant ac_simps)
 
 lemma has_derivative_inverse':
   fixes x :: "'a::real_normed_div_algebra"
   assumes x: "x \<noteq> 0"
   shows "(inverse has_derivative (\<lambda>h. - (inverse x * h * inverse x))) (at x within S)"
     (is "(_ has_derivative ?f) _")
 proof (rule has_derivativeI_sandwich)
   show "bounded_linear (\<lambda>h. - (inverse x * h * inverse x))"
     by (simp add: bounded_linear_minus bounded_linear_mult_const bounded_linear_mult_right)
   show "0 < norm x" using x by simp
   have "(inverse \<longlongrightarrow> inverse x) (at x within S)"
     using tendsto_inverse tendsto_ident_at x by auto
   then show "((\<lambda>y. norm (inverse y - inverse x) * norm (inverse x)) \<longlongrightarrow> 0) (at x within S)"
     by (simp add: LIM_zero_iff tendsto_mult_left_zero tendsto_norm_zero)
 next
   fix y :: 'a
   assume h: "y \<noteq> x" "dist y x < norm x"
   then have "y \<noteq> 0" by auto
   have "norm (inverse y - inverse x - ?f (y -x)) / norm (y - x) 
         = norm (- (inverse y * (y - x) * inverse x - inverse x * (y - x) * inverse x)) /
                 norm (y - x)"
     by (simp add: \<open>y \<noteq> 0\<close> inverse_diff_inverse x)
   also have "... = norm ((inverse y - inverse x) * (y - x) * inverse x) / norm (y - x)"
     by (simp add: left_diff_distrib norm_minus_commute)
   also have "\<dots> \<le> norm (inverse y - inverse x) * norm (y - x) * norm (inverse x) / norm (y - x)"
     by (simp add: norm_mult)
   also have "\<dots> = norm (inverse y - inverse x) * norm (inverse x)"
     by simp
   finally show "norm (inverse y - inverse x - ?f (y -x)) / norm (y - x) \<le>
     norm (inverse y - inverse x) * norm (inverse x)" .
 qed
 
 lemma has_derivative_inverse[simp, derivative_intros]:
   fixes f :: "_ \<Rightarrow> 'a::real_normed_div_algebra"
   assumes x:  "f x \<noteq> 0"
     and f: "(f has_derivative f') (at x within S)"
   shows "((\<lambda>x. inverse (f x)) has_derivative (\<lambda>h. - (inverse (f x) * f' h * inverse (f x))))
     (at x within S)"
   using has_derivative_compose[OF f has_derivative_inverse', OF x] .
 
 lemma has_derivative_divide[simp, derivative_intros]:
   fixes f :: "_ \<Rightarrow> 'a::real_normed_div_algebra"
   assumes f: "(f has_derivative f') (at x within S)"
     and g: "(g has_derivative g') (at x within S)"
   assumes x: "g x \<noteq> 0"
   shows "((\<lambda>x. f x / g x) has_derivative
                 (\<lambda>h. - f x * (inverse (g x) * g' h * inverse (g x)) + f' h / g x)) (at x within S)"
   using has_derivative_mult[OF f has_derivative_inverse[OF x g]]
   by (simp add: field_simps)
 
 lemma has_derivative_power_int':
   fixes x :: "'a::real_normed_field"
   assumes x: "x \<noteq> 0"
   shows "((\<lambda>x. power_int x n) has_derivative (\<lambda>y. y * (of_int n * power_int x (n - 1)))) (at x within S)"
 proof (cases n rule: int_cases4)
   case (nonneg n)
   thus ?thesis using x
     by (cases "n = 0") (auto intro!: derivative_eq_intros simp: field_simps power_int_diff fun_eq_iff
                              simp flip: power_Suc)
 next
   case (neg n)
   thus ?thesis using x
     by (auto intro!: derivative_eq_intros simp: field_simps power_int_diff power_int_minus
              simp flip: power_Suc power_Suc2 power_add)
 qed
 
 lemma has_derivative_power_int[simp, derivative_intros]:
   fixes f :: "_ \<Rightarrow> 'a::real_normed_field"
   assumes x:  "f x \<noteq> 0"
     and f: "(f has_derivative f') (at x within S)"
   shows "((\<lambda>x. power_int (f x) n) has_derivative (\<lambda>h. f' h * (of_int n * power_int (f x) (n - 1))))
            (at x within S)"
   using has_derivative_compose[OF f has_derivative_power_int', OF x] .
 
 
 text \<open>Conventional form requires mult-AC laws. Types real and complex only.\<close>
 
 lemma has_derivative_divide'[derivative_intros]:
   fixes f :: "_ \<Rightarrow> 'a::real_normed_field"
   assumes f: "(f has_derivative f') (at x within S)"
     and g: "(g has_derivative g') (at x within S)"
     and x: "g x \<noteq> 0"
   shows "((\<lambda>x. f x / g x) has_derivative (\<lambda>h. (f' h * g x - f x * g' h) / (g x * g x))) (at x within S)"
 proof -
   have "f' h / g x - f x * (inverse (g x) * g' h * inverse (g x)) =
       (f' h * g x - f x * g' h) / (g x * g x)" for h
     by (simp add: field_simps x)
   then show ?thesis
     using has_derivative_divide [OF f g] x
     by simp
 qed
 
 
 subsection \<open>Uniqueness\<close>
 
 text \<open>
 This can not generally shown for \<^const>\<open>has_derivative\<close>, as we need to approach the point from
 all directions. There is a proof in \<open>Analysis\<close> for \<open>euclidean_space\<close>.
 \<close>
 
 lemma has_derivative_at2: "(f has_derivative f') (at x) \<longleftrightarrow>
     bounded_linear f' \<and> ((\<lambda>y. (1 / (norm(y - x))) *\<^sub>R (f y - (f x + f' (y - x)))) \<longlongrightarrow> 0) (at x)"
   using has_derivative_within [of f f' x UNIV]
   by simp
 
 lemma has_derivative_zero_unique:
   assumes "((\<lambda>x. 0) has_derivative F) (at x)"
   shows "F = (\<lambda>h. 0)"
 proof -
   interpret F: bounded_linear F
     using assms by (rule has_derivative_bounded_linear)
   let ?r = "\<lambda>h. norm (F h) / norm h"
   have *: "?r \<midarrow>0\<rightarrow> 0"
     using assms unfolding has_derivative_at by simp
   show "F = (\<lambda>h. 0)"
   proof
     show "F h = 0" for h
     proof (rule ccontr)
       assume **: "\<not> ?thesis"
       then have h: "h \<noteq> 0"
         by (auto simp add: F.zero)
       with ** have "0 < ?r h"
         by simp
       from LIM_D [OF * this] obtain S
         where S: "0 < S" and r: "\<And>x. x \<noteq> 0 \<Longrightarrow> norm x < S \<Longrightarrow> ?r x < ?r h"
         by auto
       from dense [OF S] obtain t where t: "0 < t \<and> t < S" ..
       let ?x = "scaleR (t / norm h) h"
       have "?x \<noteq> 0" and "norm ?x < S"
         using t h by simp_all
       then have "?r ?x < ?r h"
         by (rule r)
       then show False
         using t h by (simp add: F.scaleR)
     qed
   qed
 qed
 
 lemma has_derivative_unique:
   assumes "(f has_derivative F) (at x)"
     and "(f has_derivative F') (at x)"
   shows "F = F'"
 proof -
   have "((\<lambda>x. 0) has_derivative (\<lambda>h. F h - F' h)) (at x)"
     using has_derivative_diff [OF assms] by simp
   then have "(\<lambda>h. F h - F' h) = (\<lambda>h. 0)"
     by (rule has_derivative_zero_unique)
   then show "F = F'"
     unfolding fun_eq_iff right_minus_eq .
 qed
 
 lemma has_derivative_Uniq: "\<exists>\<^sub>\<le>\<^sub>1F. (f has_derivative F) (at x)"
   by (simp add: Uniq_def has_derivative_unique)
 
 
 subsection \<open>Differentiability predicate\<close>
 
 definition differentiable :: "('a::real_normed_vector \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'a filter \<Rightarrow> bool"
     (infix "differentiable" 50)
   where "f differentiable F \<longleftrightarrow> (\<exists>D. (f has_derivative D) F)"
 
 lemma differentiable_subset:
   "f differentiable (at x within s) \<Longrightarrow> t \<subseteq> s \<Longrightarrow> f differentiable (at x within t)"
   unfolding differentiable_def by (blast intro: has_derivative_subset)
 
 lemmas differentiable_within_subset = differentiable_subset
 
 lemma differentiable_ident [simp, derivative_intros]: "(\<lambda>x. x) differentiable F"
   unfolding differentiable_def by (blast intro: has_derivative_ident)
 
 lemma differentiable_const [simp, derivative_intros]: "(\<lambda>z. a) differentiable F"
   unfolding differentiable_def by (blast intro: has_derivative_const)
 
 lemma differentiable_in_compose:
   "f differentiable (at (g x) within (g`s)) \<Longrightarrow> g differentiable (at x within s) \<Longrightarrow>
     (\<lambda>x. f (g x)) differentiable (at x within s)"
   unfolding differentiable_def by (blast intro: has_derivative_in_compose)
 
 lemma differentiable_compose:
   "f differentiable (at (g x)) \<Longrightarrow> g differentiable (at x within s) \<Longrightarrow>
     (\<lambda>x. f (g x)) differentiable (at x within s)"
   by (blast intro: differentiable_in_compose differentiable_subset)
 
 lemma differentiable_add [simp, derivative_intros]:
   "f differentiable F \<Longrightarrow> g differentiable F \<Longrightarrow> (\<lambda>x. f x + g x) differentiable F"
   unfolding differentiable_def by (blast intro: has_derivative_add)
 
 lemma differentiable_sum[simp, derivative_intros]:
   assumes "finite s" "\<forall>a\<in>s. (f a) differentiable net"
   shows "(\<lambda>x. sum (\<lambda>a. f a x) s) differentiable net"
 proof -
   from bchoice[OF assms(2)[unfolded differentiable_def]]
   show ?thesis
     by (auto intro!: has_derivative_sum simp: differentiable_def)
 qed
 
 lemma differentiable_minus [simp, derivative_intros]:
   "f differentiable F \<Longrightarrow> (\<lambda>x. - f x) differentiable F"
   unfolding differentiable_def by (blast intro: has_derivative_minus)
 
 lemma differentiable_diff [simp, derivative_intros]:
   "f differentiable F \<Longrightarrow> g differentiable F \<Longrightarrow> (\<lambda>x. f x - g x) differentiable F"
   unfolding differentiable_def by (blast intro: has_derivative_diff)
 
 lemma differentiable_mult [simp, derivative_intros]:
   fixes f g :: "'a::real_normed_vector \<Rightarrow> 'b::real_normed_algebra"
   shows "f differentiable (at x within s) \<Longrightarrow> g differentiable (at x within s) \<Longrightarrow>
     (\<lambda>x. f x * g x) differentiable (at x within s)"
   unfolding differentiable_def by (blast intro: has_derivative_mult)
 
 lemma differentiable_cmult_left_iff [simp]:
   fixes c::"'a::real_normed_field" 
   shows "(\<lambda>t. c * q t) differentiable at t \<longleftrightarrow> c = 0 \<or> (\<lambda>t. q t) differentiable at t" (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   {assume "c \<noteq> 0"
     then have "q differentiable at t"
       using differentiable_mult [OF differentiable_const L, of concl: "1/c"] by auto
   } then show ?rhs
     by auto
 qed auto
 
 lemma differentiable_cmult_right_iff [simp]:
   fixes c::"'a::real_normed_field" 
   shows "(\<lambda>t. q t * c) differentiable at t \<longleftrightarrow> c = 0 \<or> (\<lambda>t. q t) differentiable at t" (is "?lhs = ?rhs")
   by (simp add: mult.commute flip: differentiable_cmult_left_iff)
 
 lemma differentiable_inverse [simp, derivative_intros]:
   fixes f :: "'a::real_normed_vector \<Rightarrow> 'b::real_normed_field"
   shows "f differentiable (at x within s) \<Longrightarrow> f x \<noteq> 0 \<Longrightarrow>
     (\<lambda>x. inverse (f x)) differentiable (at x within s)"
   unfolding differentiable_def by (blast intro: has_derivative_inverse)
 
 lemma differentiable_divide [simp, derivative_intros]:
   fixes f g :: "'a::real_normed_vector \<Rightarrow> 'b::real_normed_field"
   shows "f differentiable (at x within s) \<Longrightarrow> g differentiable (at x within s) \<Longrightarrow>
     g x \<noteq> 0 \<Longrightarrow> (\<lambda>x. f x / g x) differentiable (at x within s)"
   unfolding divide_inverse by simp
 
 lemma differentiable_power [simp, derivative_intros]:
   fixes f g :: "'a::real_normed_vector \<Rightarrow> 'b::real_normed_field"
   shows "f differentiable (at x within s) \<Longrightarrow> (\<lambda>x. f x ^ n) differentiable (at x within s)"
   unfolding differentiable_def by (blast intro: has_derivative_power)
 
 lemma differentiable_power_int [simp, derivative_intros]:
   fixes f :: "'a::real_normed_vector \<Rightarrow> 'b::real_normed_field"
   shows "f differentiable (at x within s) \<Longrightarrow> f x \<noteq> 0 \<Longrightarrow>
            (\<lambda>x. power_int (f x) n) differentiable (at x within s)"
   unfolding differentiable_def by (blast intro: has_derivative_power_int)
 
 lemma differentiable_scaleR [simp, derivative_intros]:
   "f differentiable (at x within s) \<Longrightarrow> g differentiable (at x within s) \<Longrightarrow>
     (\<lambda>x. f x *\<^sub>R g x) differentiable (at x within s)"
   unfolding differentiable_def by (blast intro: has_derivative_scaleR)
 
 lemma has_derivative_imp_has_field_derivative:
   "(f has_derivative D) F \<Longrightarrow> (\<And>x. x * D' = D x) \<Longrightarrow> (f has_field_derivative D') F"
   unfolding has_field_derivative_def
   by (rule has_derivative_eq_rhs[of f D]) (simp_all add: fun_eq_iff mult.commute)
 
 lemma has_field_derivative_imp_has_derivative:
   "(f has_field_derivative D) F \<Longrightarrow> (f has_derivative (*) D) F"
   by (simp add: has_field_derivative_def)
 
 lemma DERIV_subset:
   "(f has_field_derivative f') (at x within s) \<Longrightarrow> t \<subseteq> s \<Longrightarrow>
     (f has_field_derivative f') (at x within t)"
   by (simp add: has_field_derivative_def has_derivative_subset)
 
 lemma has_field_derivative_at_within:
   "(f has_field_derivative f') (at x) \<Longrightarrow> (f has_field_derivative f') (at x within s)"
   using DERIV_subset by blast
 
 abbreviation (input)
   DERIV :: "('a::real_normed_field \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> bool"
     ("(DERIV (_)/ (_)/ :> (_))" [1000, 1000, 60] 60)
   where "DERIV f x :> D \<equiv> (f has_field_derivative D) (at x)"
 
 abbreviation has_real_derivative :: "(real \<Rightarrow> real) \<Rightarrow> real \<Rightarrow> real filter \<Rightarrow> bool"
     (infix "(has'_real'_derivative)" 50)
   where "(f has_real_derivative D) F \<equiv> (f has_field_derivative D) F"
 
 lemma real_differentiable_def:
   "f differentiable at x within s \<longleftrightarrow> (\<exists>D. (f has_real_derivative D) (at x within s))"
 proof safe
   assume "f differentiable at x within s"
   then obtain f' where *: "(f has_derivative f') (at x within s)"
     unfolding differentiable_def by auto
   then obtain c where "f' = ((*) c)"
     by (metis real_bounded_linear has_derivative_bounded_linear mult.commute fun_eq_iff)
   with * show "\<exists>D. (f has_real_derivative D) (at x within s)"
     unfolding has_field_derivative_def by auto
 qed (auto simp: differentiable_def has_field_derivative_def)
 
 lemma real_differentiableE [elim?]:
   assumes f: "f differentiable (at x within s)"
   obtains df where "(f has_real_derivative df) (at x within s)"
   using assms by (auto simp: real_differentiable_def)
 
 lemma has_field_derivative_iff:
   "(f has_field_derivative D) (at x within S) \<longleftrightarrow>
     ((\<lambda>y. (f y - f x) / (y - x)) \<longlongrightarrow> D) (at x within S)"
 proof -
   have "((\<lambda>y. norm (f y - f x - D * (y - x)) / norm (y - x)) \<longlongrightarrow> 0) (at x within S) 
       = ((\<lambda>y. (f y - f x) / (y - x) - D) \<longlongrightarrow> 0) (at x within S)"
     by (smt (verit, best) Lim_cong_within divide_diff_eq_iff norm_divide right_minus_eq tendsto_norm_zero_iff)
   then show ?thesis
     by (simp add: has_field_derivative_def has_derivative_iff_norm bounded_linear_mult_right LIM_zero_iff)
 qed
 
 lemma DERIV_def: "DERIV f x :> D \<longleftrightarrow> (\<lambda>h. (f (x + h) - f x) / h) \<midarrow>0\<rightarrow> D"
   unfolding field_has_derivative_at has_field_derivative_def has_field_derivative_iff ..
 
 text \<open>due to Christian Pardillo Laursen, replacing a proper epsilon-delta horror\<close>
 lemma field_derivative_lim_unique:
   assumes f: "(f has_field_derivative df) (at z)"
     and s: "s \<longlonglongrightarrow> 0"  "\<And>n. s n \<noteq> 0" 
     and a: "(\<lambda>n. (f (z + s n) - f z) / s n) \<longlonglongrightarrow> a"
   shows "df = a"
 proof -
   have "((\<lambda>k. (f (z + k) - f z) / k) \<longlongrightarrow> df) (at 0)"
     using f by (simp add: DERIV_def)
   with s have "((\<lambda>n. (f (z + s n) - f z) / s n) \<longlonglongrightarrow> df)"
     by (simp flip: LIMSEQ_SEQ_conv)
   then show ?thesis
     using a by (rule LIMSEQ_unique)
 qed
 
 lemma mult_commute_abs: "(\<lambda>x. x * c) = (*) c"
   for c :: "'a::ab_semigroup_mult"
   by (simp add: fun_eq_iff mult.commute)
 
 lemma DERIV_compose_FDERIV:
   fixes f::"real\<Rightarrow>real"
   assumes "DERIV f (g x) :> f'"
   assumes "(g has_derivative g') (at x within s)"
   shows "((\<lambda>x. f (g x)) has_derivative (\<lambda>x. g' x * f')) (at x within s)"
   using assms has_derivative_compose[of g g' x s f "(*) f'"]
   by (auto simp: has_field_derivative_def ac_simps)
 
 
 subsection \<open>Vector derivative\<close>
 
-lemma has_field_derivative_iff_has_vector_derivative:
-  "(f has_field_derivative y) F \<longleftrightarrow> (f has_vector_derivative y) F"
+text \<open>It's for real derivatives only, and not obviously generalisable to field derivatives\<close>
+lemma has_real_derivative_iff_has_vector_derivative:
+  "(f has_real_derivative y) F \<longleftrightarrow> (f has_vector_derivative y) F"
   unfolding has_vector_derivative_def has_field_derivative_def real_scaleR_def mult_commute_abs ..
 
 lemma has_field_derivative_subset:
   "(f has_field_derivative y) (at x within s) \<Longrightarrow> t \<subseteq> s \<Longrightarrow>
     (f has_field_derivative y) (at x within t)"
-  unfolding has_field_derivative_def by (rule has_derivative_subset)
+  by (fact DERIV_subset)
 
 lemma has_vector_derivative_const[simp, derivative_intros]: "((\<lambda>x. c) has_vector_derivative 0) net"
   by (auto simp: has_vector_derivative_def)
 
 lemma has_vector_derivative_id[simp, derivative_intros]: "((\<lambda>x. x) has_vector_derivative 1) net"
   by (auto simp: has_vector_derivative_def)
 
 lemma has_vector_derivative_minus[derivative_intros]:
   "(f has_vector_derivative f') net \<Longrightarrow> ((\<lambda>x. - f x) has_vector_derivative (- f')) net"
   by (auto simp: has_vector_derivative_def)
 
 lemma has_vector_derivative_add[derivative_intros]:
   "(f has_vector_derivative f') net \<Longrightarrow> (g has_vector_derivative g') net \<Longrightarrow>
     ((\<lambda>x. f x + g x) has_vector_derivative (f' + g')) net"
   by (auto simp: has_vector_derivative_def scaleR_right_distrib)
 
 lemma has_vector_derivative_sum[derivative_intros]:
   "(\<And>i. i \<in> I \<Longrightarrow> (f i has_vector_derivative f' i) net) \<Longrightarrow>
     ((\<lambda>x. \<Sum>i\<in>I. f i x) has_vector_derivative (\<Sum>i\<in>I. f' i)) net"
   by (auto simp: has_vector_derivative_def fun_eq_iff scaleR_sum_right intro!: derivative_eq_intros)
 
 lemma has_vector_derivative_diff[derivative_intros]:
   "(f has_vector_derivative f') net \<Longrightarrow> (g has_vector_derivative g') net \<Longrightarrow>
     ((\<lambda>x. f x - g x) has_vector_derivative (f' - g')) net"
   by (auto simp: has_vector_derivative_def scaleR_diff_right)
 
 lemma has_vector_derivative_add_const:
   "((\<lambda>t. g t + z) has_vector_derivative f') net = ((\<lambda>t. g t) has_vector_derivative f') net"
   apply (intro iffI)
    apply (force dest: has_vector_derivative_diff [where g = "\<lambda>t. z", OF _ has_vector_derivative_const])
   apply (force dest: has_vector_derivative_add [OF _ has_vector_derivative_const])
   done
 
 lemma has_vector_derivative_diff_const:
   "((\<lambda>t. g t - z) has_vector_derivative f') net = ((\<lambda>t. g t) has_vector_derivative f') net"
   using has_vector_derivative_add_const [where z = "-z"]
   by simp
 
 lemma (in bounded_linear) has_vector_derivative:
   assumes "(g has_vector_derivative g') F"
   shows "((\<lambda>x. f (g x)) has_vector_derivative f g') F"
   using has_derivative[OF assms[unfolded has_vector_derivative_def]]
   by (simp add: has_vector_derivative_def scaleR)
 
 lemma (in bounded_bilinear) has_vector_derivative:
   assumes "(f has_vector_derivative f') (at x within s)"
     and "(g has_vector_derivative g') (at x within s)"
   shows "((\<lambda>x. f x ** g x) has_vector_derivative (f x ** g' + f' ** g x)) (at x within s)"
   using FDERIV[OF assms(1-2)[unfolded has_vector_derivative_def]]
   by (simp add: has_vector_derivative_def scaleR_right scaleR_left scaleR_right_distrib)
 
 lemma has_vector_derivative_scaleR[derivative_intros]:
   "(f has_field_derivative f') (at x within s) \<Longrightarrow> (g has_vector_derivative g') (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x *\<^sub>R g x) has_vector_derivative (f x *\<^sub>R g' + f' *\<^sub>R g x)) (at x within s)"
-  unfolding has_field_derivative_iff_has_vector_derivative
+  unfolding has_real_derivative_iff_has_vector_derivative
   by (rule bounded_bilinear.has_vector_derivative[OF bounded_bilinear_scaleR])
 
 lemma has_vector_derivative_mult[derivative_intros]:
   "(f has_vector_derivative f') (at x within s) \<Longrightarrow> (g has_vector_derivative g') (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x * g x) has_vector_derivative (f x * g' + f' * g x)) (at x within s)"
   for f g :: "real \<Rightarrow> 'a::real_normed_algebra"
   by (rule bounded_bilinear.has_vector_derivative[OF bounded_bilinear_mult])
 
 lemma has_vector_derivative_of_real[derivative_intros]:
   "(f has_field_derivative D) F \<Longrightarrow> ((\<lambda>x. of_real (f x)) has_vector_derivative (of_real D)) F"
   by (rule bounded_linear.has_vector_derivative[OF bounded_linear_of_real])
-    (simp add: has_field_derivative_iff_has_vector_derivative)
+    (simp add: has_real_derivative_iff_has_vector_derivative)
 
 lemma has_vector_derivative_real_field:
   "(f has_field_derivative f') (at (of_real a)) \<Longrightarrow> ((\<lambda>x. f (of_real x)) has_vector_derivative f') (at a within s)"
   using has_derivative_compose[of of_real of_real a _ f "(*) f'"] 
   by (simp add: scaleR_conv_of_real ac_simps has_vector_derivative_def has_field_derivative_def)
 
 lemma has_vector_derivative_continuous:
   "(f has_vector_derivative D) (at x within s) \<Longrightarrow> continuous (at x within s) f"
   by (auto intro: has_derivative_continuous simp: has_vector_derivative_def)
 
 lemma continuous_on_vector_derivative:
   "(\<And>x. x \<in> S \<Longrightarrow> (f has_vector_derivative f' x) (at x within S)) \<Longrightarrow> continuous_on S f"
   by (auto simp: continuous_on_eq_continuous_within intro!: has_vector_derivative_continuous)
 
 lemma has_vector_derivative_mult_right[derivative_intros]:
   fixes a :: "'a::real_normed_algebra"
   shows "(f has_vector_derivative x) F \<Longrightarrow> ((\<lambda>x. a * f x) has_vector_derivative (a * x)) F"
   by (rule bounded_linear.has_vector_derivative[OF bounded_linear_mult_right])
 
 lemma has_vector_derivative_mult_left[derivative_intros]:
   fixes a :: "'a::real_normed_algebra"
   shows "(f has_vector_derivative x) F \<Longrightarrow> ((\<lambda>x. f x * a) has_vector_derivative (x * a)) F"
   by (rule bounded_linear.has_vector_derivative[OF bounded_linear_mult_left])
 
 lemma has_vector_derivative_divide[derivative_intros]:
   fixes a :: "'a::real_normed_field"
   shows "(f has_vector_derivative x) F \<Longrightarrow> ((\<lambda>x. f x / a) has_vector_derivative (x / a)) F"
   using has_vector_derivative_mult_left [of f x F "inverse a"]
   by (simp add: field_class.field_divide_inverse)
 
 
 subsection \<open>Derivatives\<close>
 
 lemma DERIV_D: "DERIV f x :> D \<Longrightarrow> (\<lambda>h. (f (x + h) - f x) / h) \<midarrow>0\<rightarrow> D"
   by (simp add: DERIV_def)
 
 lemma has_field_derivativeD:
   "(f has_field_derivative D) (at x within S) \<Longrightarrow>
     ((\<lambda>y. (f y - f x) / (y - x)) \<longlongrightarrow> D) (at x within S)"
   by (simp add: has_field_derivative_iff)
 
 lemma DERIV_const [simp, derivative_intros]: "((\<lambda>x. k) has_field_derivative 0) F"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_const]) auto
 
 lemma DERIV_ident [simp, derivative_intros]: "((\<lambda>x. x) has_field_derivative 1) F"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_ident]) auto
 
 lemma field_differentiable_add[derivative_intros]:
   "(f has_field_derivative f') F \<Longrightarrow> (g has_field_derivative g') F \<Longrightarrow>
     ((\<lambda>z. f z + g z) has_field_derivative f' + g') F"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_add])
      (auto simp: has_field_derivative_def field_simps mult_commute_abs)
 
 corollary DERIV_add:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow> (g has_field_derivative E) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x + g x) has_field_derivative D + E) (at x within s)"
   by (rule field_differentiable_add)
 
 lemma field_differentiable_minus[derivative_intros]:
   "(f has_field_derivative f') F \<Longrightarrow> ((\<lambda>z. - (f z)) has_field_derivative -f') F"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_minus])
      (auto simp: has_field_derivative_def field_simps mult_commute_abs)
 
 corollary DERIV_minus:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     ((\<lambda>x. - f x) has_field_derivative -D) (at x within s)"
   by (rule field_differentiable_minus)
 
 lemma field_differentiable_diff[derivative_intros]:
   "(f has_field_derivative f') F \<Longrightarrow>
     (g has_field_derivative g') F \<Longrightarrow> ((\<lambda>z. f z - g z) has_field_derivative f' - g') F"
   by (simp only: diff_conv_add_uminus field_differentiable_add field_differentiable_minus)
 
 corollary DERIV_diff:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     (g has_field_derivative E) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x - g x) has_field_derivative D - E) (at x within s)"
   by (rule field_differentiable_diff)
 
 lemma DERIV_continuous: "(f has_field_derivative D) (at x within s) \<Longrightarrow> continuous (at x within s) f"
   by (drule has_derivative_continuous[OF has_field_derivative_imp_has_derivative]) simp
 
 corollary DERIV_isCont: "DERIV f x :> D \<Longrightarrow> isCont f x"
   by (rule DERIV_continuous)
 
 lemma DERIV_atLeastAtMost_imp_continuous_on:
   assumes "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> \<exists>y. DERIV f x :> y"
   shows "continuous_on {a..b} f"
   by (meson DERIV_isCont assms atLeastAtMost_iff continuous_at_imp_continuous_at_within continuous_on_eq_continuous_within)
 
 lemma DERIV_continuous_on:
   "(\<And>x. x \<in> s \<Longrightarrow> (f has_field_derivative (D x)) (at x within s)) \<Longrightarrow> continuous_on s f"
   unfolding continuous_on_eq_continuous_within
   by (intro continuous_at_imp_continuous_on ballI DERIV_continuous)
 
 lemma DERIV_mult':
   "(f has_field_derivative D) (at x within s) \<Longrightarrow> (g has_field_derivative E) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x * g x) has_field_derivative f x * E + D * g x) (at x within s)"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_mult])
      (auto simp: field_simps mult_commute_abs dest: has_field_derivative_imp_has_derivative)
 
 lemma DERIV_mult[derivative_intros]:
   "(f has_field_derivative Da) (at x within s) \<Longrightarrow> (g has_field_derivative Db) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x * g x) has_field_derivative Da * g x + Db * f x) (at x within s)"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_mult])
      (auto simp: field_simps dest: has_field_derivative_imp_has_derivative)
 
 text \<open>Derivative of linear multiplication\<close>
 
 lemma DERIV_cmult:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     ((\<lambda>x. c * f x) has_field_derivative c * D) (at x within s)"
   by (drule DERIV_mult' [OF DERIV_const]) simp
 
 lemma DERIV_cmult_right:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x * c) has_field_derivative D * c) (at x within s)"
   using DERIV_cmult by (auto simp add: ac_simps)
 
 lemma DERIV_cmult_Id [simp]: "((*) c has_field_derivative c) (at x within s)"
   using DERIV_ident [THEN DERIV_cmult, where c = c and x = x] by simp
 
 lemma DERIV_cdivide:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x / c) has_field_derivative D / c) (at x within s)"
   using DERIV_cmult_right[of f D x s "1 / c"] by simp
 
 lemma DERIV_unique: "DERIV f x :> D \<Longrightarrow> DERIV f x :> E \<Longrightarrow> D = E"
   unfolding DERIV_def by (rule LIM_unique)
 
 lemma DERIV_Uniq: "\<exists>\<^sub>\<le>\<^sub>1D. DERIV f x :> D"
   by (simp add: DERIV_unique Uniq_def)
 
 lemma DERIV_sum[derivative_intros]:
   "(\<And> n. n \<in> S \<Longrightarrow> ((\<lambda>x. f x n) has_field_derivative (f' x n)) F) \<Longrightarrow>
     ((\<lambda>x. sum (f x) S) has_field_derivative sum (f' x) S) F"
   by (rule has_derivative_imp_has_field_derivative [OF has_derivative_sum])
      (auto simp: sum_distrib_left mult_commute_abs dest: has_field_derivative_imp_has_derivative)
 
 lemma DERIV_inverse'[derivative_intros]:
   assumes "(f has_field_derivative D) (at x within s)"
     and "f x \<noteq> 0"
   shows "((\<lambda>x. inverse (f x)) has_field_derivative - (inverse (f x) * D * inverse (f x)))
     (at x within s)"
 proof -
   have "(f has_derivative (\<lambda>x. x * D)) = (f has_derivative (*) D)"
     by (rule arg_cong [of "\<lambda>x. x * D"]) (simp add: fun_eq_iff)
   with assms have "(f has_derivative (\<lambda>x. x * D)) (at x within s)"
     by (auto dest!: has_field_derivative_imp_has_derivative)
   then show ?thesis using \<open>f x \<noteq> 0\<close>
     by (auto intro: has_derivative_imp_has_field_derivative has_derivative_inverse)
 qed
 
 text \<open>Power of \<open>-1\<close>\<close>
 
 lemma DERIV_inverse:
   "x \<noteq> 0 \<Longrightarrow> ((\<lambda>x. inverse(x)) has_field_derivative - (inverse x ^ Suc (Suc 0))) (at x within s)"
   by (drule DERIV_inverse' [OF DERIV_ident]) simp
 
 text \<open>Derivative of inverse\<close>
 
 lemma DERIV_inverse_fun:
   "(f has_field_derivative d) (at x within s) \<Longrightarrow> f x \<noteq> 0 \<Longrightarrow>
     ((\<lambda>x. inverse (f x)) has_field_derivative (- (d * inverse(f x ^ Suc (Suc 0))))) (at x within s)"
   by (drule (1) DERIV_inverse') (simp add: ac_simps nonzero_inverse_mult_distrib)
 
 text \<open>Derivative of quotient\<close>
 
 lemma DERIV_divide[derivative_intros]:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     (g has_field_derivative E) (at x within s) \<Longrightarrow> g x \<noteq> 0 \<Longrightarrow>
     ((\<lambda>x. f x / g x) has_field_derivative (D * g x - f x * E) / (g x * g x)) (at x within s)"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_divide])
      (auto dest: has_field_derivative_imp_has_derivative simp: field_simps)
 
 lemma DERIV_quotient:
   "(f has_field_derivative d) (at x within s) \<Longrightarrow>
     (g has_field_derivative e) (at x within s)\<Longrightarrow> g x \<noteq> 0 \<Longrightarrow>
     ((\<lambda>y. f y / g y) has_field_derivative (d * g x - (e * f x)) / (g x ^ Suc (Suc 0))) (at x within s)"
   by (drule (2) DERIV_divide) (simp add: mult.commute)
 
 lemma DERIV_power_Suc:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x ^ Suc n) has_field_derivative (1 + of_nat n) * (D * f x ^ n)) (at x within s)"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_power])
      (auto simp: has_field_derivative_def)
 
 lemma DERIV_power[derivative_intros]:
   "(f has_field_derivative D) (at x within s) \<Longrightarrow>
     ((\<lambda>x. f x ^ n) has_field_derivative of_nat n * (D * f x ^ (n - Suc 0))) (at x within s)"
   by (rule has_derivative_imp_has_field_derivative[OF has_derivative_power])
      (auto simp: has_field_derivative_def)
 
 lemma DERIV_pow: "((\<lambda>x. x ^ n) has_field_derivative real n * (x ^ (n - Suc 0))) (at x within s)"
   using DERIV_power [OF DERIV_ident] by simp
 
 lemma DERIV_power_int [derivative_intros]:
   assumes [derivative_intros]: "(f has_field_derivative d) (at x within s)" and [simp]: "f x \<noteq> 0"
   shows   "((\<lambda>x. power_int (f x) n) has_field_derivative
              (of_int n * power_int (f x) (n - 1) * d)) (at x within s)"
 proof (cases n rule: int_cases4)
   case (nonneg n)
   thus ?thesis 
     by (cases "n = 0")
        (auto intro!: derivative_eq_intros simp: field_simps power_int_diff
              simp flip: power_Suc power_Suc2 power_add)
 next
   case (neg n)
   thus ?thesis
     by (auto intro!: derivative_eq_intros simp: field_simps power_int_diff power_int_minus
              simp flip: power_Suc power_Suc2 power_add)
 qed
 
 lemma DERIV_chain': "(f has_field_derivative D) (at x within s) \<Longrightarrow> DERIV g (f x) :> E \<Longrightarrow>
   ((\<lambda>x. g (f x)) has_field_derivative E * D) (at x within s)"
   using has_derivative_compose[of f "(*) D" x s g "(*) E"]
   by (simp only: has_field_derivative_def mult_commute_abs ac_simps)
 
 corollary DERIV_chain2: "DERIV f (g x) :> Da \<Longrightarrow> (g has_field_derivative Db) (at x within s) \<Longrightarrow>
   ((\<lambda>x. f (g x)) has_field_derivative Da * Db) (at x within s)"
   by (rule DERIV_chain')
 
 text \<open>Standard version\<close>
 
 lemma DERIV_chain:
   "DERIV f (g x) :> Da \<Longrightarrow> (g has_field_derivative Db) (at x within s) \<Longrightarrow>
     (f \<circ> g has_field_derivative Da * Db) (at x within s)"
   by (drule (1) DERIV_chain', simp add: o_def mult.commute)
 
 lemma DERIV_image_chain:
   "(f has_field_derivative Da) (at (g x) within (g ` s)) \<Longrightarrow>
     (g has_field_derivative Db) (at x within s) \<Longrightarrow>
     (f \<circ> g has_field_derivative Da * Db) (at x within s)"
   using has_derivative_in_compose [of g "(*) Db" x s f "(*) Da "]
   by (simp add: has_field_derivative_def o_def mult_commute_abs ac_simps)
 
 (*These two are from HOL Light: HAS_COMPLEX_DERIVATIVE_CHAIN*)
 lemma DERIV_chain_s:
   assumes "(\<And>x. x \<in> s \<Longrightarrow> DERIV g x :> g'(x))"
     and "DERIV f x :> f'"
     and "f x \<in> s"
   shows "DERIV (\<lambda>x. g(f x)) x :> f' * g'(f x)"
   by (metis (full_types) DERIV_chain' mult.commute assms)
 
 lemma DERIV_chain3: (*HAS_COMPLEX_DERIVATIVE_CHAIN_UNIV*)
   assumes "(\<And>x. DERIV g x :> g'(x))"
     and "DERIV f x :> f'"
   shows "DERIV (\<lambda>x. g(f x)) x :> f' * g'(f x)"
   by (metis UNIV_I DERIV_chain_s [of UNIV] assms)
 
 text \<open>Alternative definition for differentiability\<close>
 
 lemma DERIV_LIM_iff:
   fixes f :: "'a::{real_normed_vector,inverse} \<Rightarrow> 'a"
   shows "((\<lambda>h. (f (a + h) - f a) / h) \<midarrow>0\<rightarrow> D) = ((\<lambda>x. (f x - f a) / (x - a)) \<midarrow>a\<rightarrow> D)" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then have "(\<lambda>x. (f (a + (x + - a)) - f a) / (x + - a)) \<midarrow>0 - - a\<rightarrow> D"
     by (rule LIM_offset)
   then show ?rhs
     by simp
 next
   assume ?rhs
   then have "(\<lambda>x. (f (x+a) - f a) / ((x+a) - a)) \<midarrow>a-a\<rightarrow> D"
     by (rule LIM_offset)
   then show ?lhs
     by (simp add: add.commute)
 qed
 
 lemma has_field_derivative_cong_ev:
   assumes "x = y"
     and *: "eventually (\<lambda>x. x \<in> S \<longrightarrow> f x = g x) (nhds x)"
     and "u = v" "S = t" "x \<in> S"
   shows "(f has_field_derivative u) (at x within S) = (g has_field_derivative v) (at y within t)"
   unfolding has_field_derivative_iff
 proof (rule filterlim_cong)
   from assms have "f y = g y"
     by (auto simp: eventually_nhds)
   with * show "\<forall>\<^sub>F z in at x within S. (f z - f x) / (z - x) = (g z - g y) / (z - y)"
     unfolding eventually_at_filter
     by eventually_elim (auto simp: assms \<open>f y = g y\<close>)
 qed (simp_all add: assms)
 
 lemma has_field_derivative_cong_eventually:
   assumes "eventually (\<lambda>x. f x = g x) (at x within S)" "f x = g x"
   shows "(f has_field_derivative u) (at x within S) = (g has_field_derivative u) (at x within S)"
   unfolding has_field_derivative_iff
 proof (rule tendsto_cong)
   show "\<forall>\<^sub>F y in at x within S. (f y - f x) / (y - x) = (g y - g x) / (y - x)"
     using assms by (auto elim: eventually_mono)
 qed
 
 lemma DERIV_cong_ev:
   "x = y \<Longrightarrow> eventually (\<lambda>x. f x = g x) (nhds x) \<Longrightarrow> u = v \<Longrightarrow>
     DERIV f x :> u \<longleftrightarrow> DERIV g y :> v"
   by (rule has_field_derivative_cong_ev) simp_all
 
 lemma DERIV_mirror: "(DERIV f (- x) :> y) \<longleftrightarrow> (DERIV (\<lambda>x. f (- x)) x :> - y)"
   for f :: "real \<Rightarrow> real" and x y :: real
   by (simp add: DERIV_def filterlim_at_split filterlim_at_left_to_right
       tendsto_minus_cancel_left field_simps conj_commute)
 
 lemma DERIV_shift:
   "(f has_field_derivative y) (at (x + z)) = ((\<lambda>x. f (x + z)) has_field_derivative y) (at x)"
   by (simp add: DERIV_def field_simps)
 
 lemma DERIV_at_within_shift_lemma:
   assumes "(f has_field_derivative y) (at (z+x) within (+) z ` S)"
   shows "(f \<circ> (+)z has_field_derivative y) (at x within S)"
 proof -
   have "((+)z has_field_derivative 1) (at x within S)"
     by (rule derivative_eq_intros | simp)+
   with assms DERIV_image_chain show ?thesis
     by (metis mult.right_neutral)
 qed
 
 lemma DERIV_at_within_shift:
   "(f has_field_derivative y) (at (z+x) within (+) z ` S) \<longleftrightarrow> 
    ((\<lambda>x. f (z+x)) has_field_derivative y) (at x within S)"   (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     using DERIV_at_within_shift_lemma unfolding o_def by blast
 next
   have [simp]: "(\<lambda>x. x - z) ` (+) z ` S = S"
     by force
   assume R: ?rhs
   have "(f \<circ> (+) z \<circ> (+) (- z) has_field_derivative y) (at (z + x) within (+) z ` S)"
     by (rule DERIV_at_within_shift_lemma) (use R in \<open>simp add: o_def\<close>)
   then show ?lhs
     by (simp add: o_def)
 qed
 
 lemma floor_has_real_derivative:
   fixes f :: "real \<Rightarrow> 'a::{floor_ceiling,order_topology}"
   assumes "isCont f x"
     and "f x \<notin> \<int>"
   shows "((\<lambda>x. floor (f x)) has_real_derivative 0) (at x)"
 proof (subst DERIV_cong_ev[OF refl _ refl])
   show "((\<lambda>_. floor (f x)) has_real_derivative 0) (at x)"
     by simp
   have "\<forall>\<^sub>F y in at x. \<lfloor>f y\<rfloor> = \<lfloor>f x\<rfloor>"
     by (rule eventually_floor_eq[OF assms[unfolded continuous_at]])
   then show "\<forall>\<^sub>F y in nhds x. real_of_int \<lfloor>f y\<rfloor> = real_of_int \<lfloor>f x\<rfloor>"
     unfolding eventually_at_filter
     by eventually_elim auto
 qed
 
 lemmas has_derivative_floor[derivative_intros] =
   floor_has_real_derivative[THEN DERIV_compose_FDERIV]
 
 lemma continuous_floor:
   fixes x::real
   shows "x \<notin> \<int> \<Longrightarrow> continuous (at x) (real_of_int \<circ> floor)"
   using floor_has_real_derivative [where f=id]
   by (auto simp: o_def has_field_derivative_def intro: has_derivative_continuous)
 
 lemma continuous_frac:
   fixes x::real
   assumes "x \<notin> \<int>"
   shows "continuous (at x) frac"
 proof -
   have "isCont (\<lambda>x. real_of_int \<lfloor>x\<rfloor>) x"
     using continuous_floor [OF assms] by (simp add: o_def)
   then have *: "continuous (at x) (\<lambda>x. x - real_of_int \<lfloor>x\<rfloor>)"
     by (intro continuous_intros)
   moreover have "\<forall>\<^sub>F x in nhds x. frac x = x - real_of_int \<lfloor>x\<rfloor>"
     by (simp add: frac_def)
   ultimately show ?thesis
     by (simp add: LIM_imp_LIM frac_def isCont_def)
 qed
 
 text \<open>Caratheodory formulation of derivative at a point\<close>
 
 lemma CARAT_DERIV:
   "(DERIV f x :> l) \<longleftrightarrow> (\<exists>g. (\<forall>z. f z - f x = g z * (z - x)) \<and> isCont g x \<and> g x = l)"
   (is "?lhs = ?rhs")
 proof
   assume ?lhs
   show "\<exists>g. (\<forall>z. f z - f x = g z * (z - x)) \<and> isCont g x \<and> g x = l"
   proof (intro exI conjI)
     let ?g = "(\<lambda>z. if z = x then l else (f z - f x) / (z-x))"
     show "\<forall>z. f z - f x = ?g z * (z - x)"
       by simp
     show "isCont ?g x"
       using \<open>?lhs\<close> by (simp add: isCont_iff DERIV_def cong: LIM_equal [rule_format])
     show "?g x = l"
       by simp
   qed
 next
   assume ?rhs
   then show ?lhs
     by (auto simp add: isCont_iff DERIV_def cong: LIM_cong)
 qed
 
 
 subsection \<open>Local extrema\<close>
 
 text \<open>If \<^term>\<open>0 < f' x\<close> then \<^term>\<open>x\<close> is Locally Strictly Increasing At The Right.\<close>
 
 lemma has_real_derivative_pos_inc_right:
   fixes f :: "real \<Rightarrow> real"
   assumes der: "(f has_real_derivative l) (at x within S)"
     and l: "0 < l"
   shows "\<exists>d > 0. \<forall>h > 0. x + h \<in> S \<longrightarrow> h < d \<longrightarrow> f x < f (x + h)"
   using assms
 proof -
   from der [THEN has_field_derivativeD, THEN tendstoD, OF l, unfolded eventually_at]
   obtain s where s: "0 < s"
     and all: "\<And>xa. xa\<in>S \<Longrightarrow> xa \<noteq> x \<and> dist xa x < s \<longrightarrow> \<bar>(f xa - f x) / (xa - x) - l\<bar> < l"
     by (auto simp: dist_real_def)
   then show ?thesis
   proof (intro exI conjI strip)
     show "0 < s" by (rule s)
   next
     fix h :: real
     assume "0 < h" "h < s" "x + h \<in> S"
     with all [of "x + h"] show "f x < f (x+h)"
     proof (simp add: abs_if dist_real_def pos_less_divide_eq split: if_split_asm)
       assume "\<not> (f (x + h) - f x) / h < l" and h: "0 < h"
       with l have "0 < (f (x + h) - f x) / h"
         by arith
       then show "f x < f (x + h)"
         by (simp add: pos_less_divide_eq h)
     qed
   qed
 qed
 
 lemma DERIV_pos_inc_right:
   fixes f :: "real \<Rightarrow> real"
   assumes der: "DERIV f x :> l"
     and l: "0 < l"
   shows "\<exists>d > 0. \<forall>h > 0. h < d \<longrightarrow> f x < f (x + h)"
   using has_real_derivative_pos_inc_right[OF assms]
   by auto
 
 lemma has_real_derivative_neg_dec_left:
   fixes f :: "real \<Rightarrow> real"
   assumes der: "(f has_real_derivative l) (at x within S)"
     and "l < 0"
   shows "\<exists>d > 0. \<forall>h > 0. x - h \<in> S \<longrightarrow> h < d \<longrightarrow> f x < f (x - h)"
 proof -
   from \<open>l < 0\<close> have l: "- l > 0"
     by simp
   from der [THEN has_field_derivativeD, THEN tendstoD, OF l, unfolded eventually_at]
   obtain s where s: "0 < s"
     and all: "\<And>xa. xa\<in>S \<Longrightarrow> xa \<noteq> x \<and> dist xa x < s \<longrightarrow> \<bar>(f xa - f x) / (xa - x) - l\<bar> < - l"
     by (auto simp: dist_real_def)
   then show ?thesis
   proof (intro exI conjI strip)
     show "0 < s" by (rule s)
   next
     fix h :: real
     assume "0 < h" "h < s" "x - h \<in> S"
     with all [of "x - h"] show "f x < f (x-h)"
     proof (simp add: abs_if pos_less_divide_eq dist_real_def split: if_split_asm)
       assume "- ((f (x-h) - f x) / h) < l" and h: "0 < h"
       with l have "0 < (f (x-h) - f x) / h"
         by arith
       then show "f x < f (x - h)"
         by (simp add: pos_less_divide_eq h)
     qed
   qed
 qed
 
 lemma DERIV_neg_dec_left:
   fixes f :: "real \<Rightarrow> real"
   assumes der: "DERIV f x :> l"
     and l: "l < 0"
   shows "\<exists>d > 0. \<forall>h > 0. h < d \<longrightarrow> f x < f (x - h)"
   using has_real_derivative_neg_dec_left[OF assms]
   by auto
 
 lemma has_real_derivative_pos_inc_left:
   fixes f :: "real \<Rightarrow> real"
   shows "(f has_real_derivative l) (at x within S) \<Longrightarrow> 0 < l \<Longrightarrow>
     \<exists>d>0. \<forall>h>0. x - h \<in> S \<longrightarrow> h < d \<longrightarrow> f (x - h) < f x"
   by (rule has_real_derivative_neg_dec_left [of "\<lambda>x. - f x" "-l" x S, simplified])
       (auto simp add: DERIV_minus)
 
 lemma DERIV_pos_inc_left:
   fixes f :: "real \<Rightarrow> real"
   shows "DERIV f x :> l \<Longrightarrow> 0 < l \<Longrightarrow> \<exists>d > 0. \<forall>h > 0. h < d \<longrightarrow> f (x - h) < f x"
   using has_real_derivative_pos_inc_left
   by blast
 
 lemma has_real_derivative_neg_dec_right:
   fixes f :: "real \<Rightarrow> real"
   shows "(f has_real_derivative l) (at x within S) \<Longrightarrow> l < 0 \<Longrightarrow>
     \<exists>d > 0. \<forall>h > 0. x + h \<in> S \<longrightarrow> h < d \<longrightarrow> f x > f (x + h)"
   by (rule has_real_derivative_pos_inc_right [of "\<lambda>x. - f x" "-l" x S, simplified])
       (auto simp add: DERIV_minus)
 
 lemma DERIV_neg_dec_right:
   fixes f :: "real \<Rightarrow> real"
   shows "DERIV f x :> l \<Longrightarrow> l < 0 \<Longrightarrow> \<exists>d > 0. \<forall>h > 0. h < d \<longrightarrow> f x > f (x + h)"
   using has_real_derivative_neg_dec_right by blast
 
 lemma DERIV_local_max:
   fixes f :: "real \<Rightarrow> real"
   assumes der: "DERIV f x :> l"
     and d: "0 < d"
     and le: "\<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> f y \<le> f x"
   shows "l = 0"
 proof (cases rule: linorder_cases [of l 0])
   case equal
   then show ?thesis .
 next
   case less
   from DERIV_neg_dec_left [OF der less]
   obtain d' where d': "0 < d'" and lt: "\<forall>h > 0. h < d' \<longrightarrow> f x < f (x - h)"
     by blast
   obtain e where "0 < e \<and> e < d \<and> e < d'"
     using field_lbound_gt_zero [OF d d']  ..
   with lt le [THEN spec [where x="x - e"]] show ?thesis
     by (auto simp add: abs_if)
 next
   case greater
   from DERIV_pos_inc_right [OF der greater]
   obtain d' where d': "0 < d'" and lt: "\<forall>h > 0. h < d' \<longrightarrow> f x < f (x + h)"
     by blast
   obtain e where "0 < e \<and> e < d \<and> e < d'"
     using field_lbound_gt_zero [OF d d'] ..
   with lt le [THEN spec [where x="x + e"]] show ?thesis
     by (auto simp add: abs_if)
 qed
 
 text \<open>Similar theorem for a local minimum\<close>
 lemma DERIV_local_min:
   fixes f :: "real \<Rightarrow> real"
   shows "DERIV f x :> l \<Longrightarrow> 0 < d \<Longrightarrow> \<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> f x \<le> f y \<Longrightarrow> l = 0"
   by (drule DERIV_minus [THEN DERIV_local_max]) auto
 
 
 text\<open>In particular, if a function is locally flat\<close>
 lemma DERIV_local_const:
   fixes f :: "real \<Rightarrow> real"
   shows "DERIV f x :> l \<Longrightarrow> 0 < d \<Longrightarrow> \<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> f x = f y \<Longrightarrow> l = 0"
   by (auto dest!: DERIV_local_max)
 
 
 subsection \<open>Rolle's Theorem\<close>
 
 text \<open>Lemma about introducing open ball in open interval\<close>
 lemma lemma_interval_lt: 
   fixes a b x :: real
   assumes "a < x" "x < b"
   shows "\<exists>d. 0 < d \<and> (\<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> a < y \<and> y < b)"
   using linorder_linear [of "x - a" "b - x"]
 proof 
   assume "x - a \<le> b - x"
   with assms show ?thesis
     by (rule_tac x = "x - a" in exI) auto
 next
   assume "b - x \<le> x - a"
   with assms show ?thesis
     by (rule_tac x = "b - x" in exI) auto
 qed
 
 lemma lemma_interval: "a < x \<Longrightarrow> x < b \<Longrightarrow> \<exists>d. 0 < d \<and> (\<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> a \<le> y \<and> y \<le> b)"
   for a b x :: real
   by (force dest: lemma_interval_lt)
 
 text \<open>Rolle's Theorem.
    If \<^term>\<open>f\<close> is defined and continuous on the closed interval
    \<open>[a,b]\<close> and differentiable on the open interval \<open>(a,b)\<close>,
    and \<^term>\<open>f a = f b\<close>,
    then there exists \<open>x0 \<in> (a,b)\<close> such that \<^term>\<open>f' x0 = 0\<close>\<close>
 theorem Rolle_deriv:
   fixes f :: "real \<Rightarrow> real"
   assumes "a < b"
     and fab: "f a = f b"
     and contf: "continuous_on {a..b} f"
     and derf: "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> (f has_derivative f' x) (at x)"
   shows "\<exists>z. a < z \<and> z < b \<and> f' z = (\<lambda>v. 0)"
 proof -
   have le: "a \<le> b"
     using \<open>a < b\<close> by simp
     have "(a + b) / 2 \<in> {a..b}"
       using assms(1) by auto
     then have *: "{a..b} \<noteq> {}"
       by auto
   obtain x where x_max: "\<forall>z. a \<le> z \<and> z \<le> b \<longrightarrow> f z \<le> f x" and "a \<le> x" "x \<le> b"
     using continuous_attains_sup[OF compact_Icc * contf]
     by (meson atLeastAtMost_iff)
   obtain x' where x'_min: "\<forall>z. a \<le> z \<and> z \<le> b \<longrightarrow> f x' \<le> f z" and "a \<le> x'" "x' \<le> b"
     using continuous_attains_inf[OF compact_Icc * contf] by (meson atLeastAtMost_iff)
   consider "a < x" "x < b" | "x = a \<or> x = b"
     using \<open>a \<le> x\<close> \<open>x \<le> b\<close> by arith
   then show ?thesis
   proof cases
     case 1
     \<comment> \<open>\<^term>\<open>f\<close> attains its maximum within the interval\<close>
     then obtain l where der: "DERIV f x :> l"
       using derf differentiable_def real_differentiable_def by blast
     obtain d where d: "0 < d" and bound: "\<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> a \<le> y \<and> y \<le> b"
       using lemma_interval [OF 1] by blast
     then have bound': "\<forall>y. \<bar>x - y\<bar> < d \<longrightarrow> f y \<le> f x"
       using x_max by blast
     \<comment> \<open>the derivative at a local maximum is zero\<close>
     have "l = 0"
       by (rule DERIV_local_max [OF der d bound'])
     with 1 der derf [of x] show ?thesis
       by (metis has_derivative_unique has_field_derivative_def mult_zero_left)
   next
     case 2
     then have fx: "f b = f x" by (auto simp add: fab)
     consider "a < x'" "x' < b" | "x' = a \<or> x' = b"
       using \<open>a \<le> x'\<close> \<open>x' \<le> b\<close> by arith
     then show ?thesis
     proof cases
       case 1
         \<comment> \<open>\<^term>\<open>f\<close> attains its minimum within the interval\<close>
       then obtain l where der: "DERIV f x' :> l"
         using derf differentiable_def real_differentiable_def by blast 
       from lemma_interval [OF 1]
       obtain d where d: "0<d" and bound: "\<forall>y. \<bar>x'-y\<bar> < d \<longrightarrow> a \<le> y \<and> y \<le> b"
         by blast
       then have bound': "\<forall>y. \<bar>x' - y\<bar> < d \<longrightarrow> f x' \<le> f y"
         using x'_min by blast
       have "l = 0" by (rule DERIV_local_min [OF der d bound'])
         \<comment> \<open>the derivative at a local minimum is zero\<close>
       then show ?thesis using 1 der derf [of x'] 
         by (metis has_derivative_unique has_field_derivative_def mult_zero_left)
     next
       case 2
         \<comment> \<open>\<^term>\<open>f\<close> is constant throughout the interval\<close>
       then have fx': "f b = f x'" by (auto simp: fab)
       from dense [OF \<open>a < b\<close>] obtain r where r: "a < r" "r < b" by blast
       obtain d where d: "0 < d" and bound: "\<forall>y. \<bar>r - y\<bar> < d \<longrightarrow> a \<le> y \<and> y \<le> b"
         using lemma_interval [OF r] by blast
       have eq_fb: "f z = f b" if "a \<le> z" and "z \<le> b" for z
       proof (rule order_antisym)
         show "f z \<le> f b" by (simp add: fx x_max that)
         show "f b \<le> f z" by (simp add: fx' x'_min that)
       qed
       have bound': "\<forall>y. \<bar>r - y\<bar> < d \<longrightarrow> f r = f y"
       proof (intro strip)
         fix y :: real
         assume lt: "\<bar>r - y\<bar> < d"
         then have "f y = f b" by (simp add: eq_fb bound)
         then show "f r = f y" by (simp add: eq_fb r order_less_imp_le)
       qed
       obtain l where der: "DERIV f r :> l"
         using derf differentiable_def r(1) r(2) real_differentiable_def by blast
       have "l = 0"
         by (rule DERIV_local_const [OF der d bound'])
         \<comment> \<open>the derivative of a constant function is zero\<close>
       with r der derf [of r] show ?thesis
         by (metis has_derivative_unique has_field_derivative_def mult_zero_left)
     qed
   qed
 qed
 
 corollary Rolle:
   fixes a b :: real
   assumes ab: "a < b" "f a = f b" "continuous_on {a..b} f"
     and dif [rule_format]: "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> f differentiable (at x)"
   shows "\<exists>z. a < z \<and> z < b \<and> DERIV f z :> 0"
 proof -
   obtain f' where f': "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> (f has_derivative f' x) (at x)"
     using dif unfolding differentiable_def by metis
   then have "\<exists>z. a < z \<and> z < b \<and> f' z = (\<lambda>v. 0)"
     by (metis Rolle_deriv [OF ab])
   then show ?thesis
     using f' has_derivative_imp_has_field_derivative by fastforce
 qed
 
 subsection \<open>Mean Value Theorem\<close>
 
 theorem mvt:
   fixes f :: "real \<Rightarrow> real"
   assumes "a < b"
     and contf: "continuous_on {a..b} f"
     and derf: "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> (f has_derivative f' x) (at x)"
   obtains \<xi> where "a < \<xi>" "\<xi> < b" "f b - f a = (f' \<xi>) (b - a)"
 proof -
   have "\<exists>\<xi>. a < \<xi> \<and> \<xi> < b \<and> (\<lambda>y. f' \<xi> y - (f b - f a) / (b - a) * y) = (\<lambda>v. 0)"
   proof (intro Rolle_deriv[OF \<open>a < b\<close>])
     fix x
     assume x: "a < x" "x < b"
     show "((\<lambda>x. f x - (f b - f a) / (b - a) * x) 
           has_derivative (\<lambda>y. f' x y - (f b - f a) / (b - a) * y)) (at x)"
       by (intro derivative_intros derf[OF x])
   qed (use assms in \<open>auto intro!: continuous_intros simp: field_simps\<close>)
   then show ?thesis
     by (smt (verit, ccfv_SIG) pos_le_divide_eq pos_less_divide_eq that)
 qed
 
 theorem MVT:
   fixes a b :: real
   assumes lt: "a < b"
     and contf: "continuous_on {a..b} f"
     and dif: "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> f differentiable (at x)"
   shows "\<exists>l z. a < z \<and> z < b \<and> DERIV f z :> l \<and> f b - f a = (b - a) * l"
 proof -
   obtain f' :: "real \<Rightarrow> real \<Rightarrow> real"
     where derf: "\<And>x. a < x \<Longrightarrow> x < b \<Longrightarrow> (f has_derivative f' x) (at x)"
     using dif unfolding differentiable_def by metis
   then obtain z where "a < z" "z < b" "f b - f a = (f' z) (b - a)"
     using mvt [OF lt contf] by blast
   then show ?thesis
     by (simp add: ac_simps)
       (metis derf dif has_derivative_unique has_field_derivative_imp_has_derivative real_differentiable_def)
 qed
 
 corollary MVT2:
   assumes "a < b" and der: "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> DERIV f x :> f' x"
   shows "\<exists>z::real. a < z \<and> z < b \<and> (f b - f a = (b - a) * f' z)"
 proof -
   have "\<exists>l z. a < z \<and>
            z < b \<and>
            (f has_real_derivative l) (at z) \<and>
            f b - f a = (b - a) * l"
   proof (rule MVT [OF \<open>a < b\<close>])
     show "continuous_on {a..b} f"
       by (meson DERIV_continuous atLeastAtMost_iff continuous_at_imp_continuous_on der) 
     show "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> f differentiable (at x)"
       using assms by (force dest: order_less_imp_le simp add: real_differentiable_def)
   qed
   with assms show ?thesis
     by (blast dest: DERIV_unique order_less_imp_le)
 qed
 
 lemma pos_deriv_imp_strict_mono:
   assumes "\<And>x. (f has_real_derivative f' x) (at x)"
   assumes "\<And>x. f' x > 0"
   shows   "strict_mono f"
 proof (rule strict_monoI)
   fix x y :: real assume xy: "x < y"
   from assms and xy have "\<exists>z>x. z < y \<and> f y - f x = (y - x) * f' z"
     by (intro MVT2) (auto dest: connectedD_interval)
   then obtain z where z: "z > x" "z < y" "f y - f x = (y - x) * f' z" by blast
   note \<open>f y - f x = (y - x) * f' z\<close>
   also have "(y - x) * f' z > 0" using xy assms by (intro mult_pos_pos) auto
   finally show "f x < f y" by simp
 qed
 
 proposition  deriv_nonneg_imp_mono:
   assumes deriv: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_real_derivative g' x) (at x)"
   assumes nonneg: "\<And>x. x \<in> {a..b} \<Longrightarrow> g' x \<ge> 0"
   assumes ab: "a \<le> b"
   shows "g a \<le> g b"
 proof (cases "a < b")
   assume "a < b"
   from deriv have "\<And>x. \<lbrakk>x \<ge> a; x \<le> b\<rbrakk> \<Longrightarrow> (g has_real_derivative g' x) (at x)" by simp
   with MVT2[OF \<open>a < b\<close>] and deriv
     obtain \<xi> where \<xi>_ab: "\<xi> > a" "\<xi> < b" and g_ab: "g b - g a = (b - a) * g' \<xi>" by blast
   from \<xi>_ab ab nonneg have "(b - a) * g' \<xi> \<ge> 0" by simp
   with g_ab show ?thesis by simp
 qed (insert ab, simp)
 
 
 subsubsection \<open>A function is constant if its derivative is 0 over an interval.\<close>
 
 lemma DERIV_isconst_end:
   fixes f :: "real \<Rightarrow> real"
   assumes "a < b" and contf: "continuous_on {a..b} f"
     and 0: "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> DERIV f x :> 0"
   shows "f b = f a"
   using MVT [OF \<open>a < b\<close>] "0" DERIV_unique contf real_differentiable_def
   by (fastforce simp: algebra_simps)
 
 lemma DERIV_isconst2:
   fixes f :: "real \<Rightarrow> real"
   assumes "a < b" and contf: "continuous_on {a..b} f" and derf: "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> DERIV f x :> 0"
     and "a \<le> x" "x \<le> b"
 shows "f x = f a"
 proof (cases "a < x")
   case True
   have *: "continuous_on {a..x} f"
     using \<open>x \<le> b\<close> contf continuous_on_subset by fastforce
   show ?thesis
     by (rule DERIV_isconst_end [OF True *]) (use \<open>x \<le> b\<close> derf in auto)
 qed (use \<open>a \<le> x\<close> in auto)
 
 lemma DERIV_isconst3:
   fixes a b x y :: real
   assumes "a < b"
     and "x \<in> {a <..< b}"
     and "y \<in> {a <..< b}"
     and derivable: "\<And>x. x \<in> {a <..< b} \<Longrightarrow> DERIV f x :> 0"
   shows "f x = f y"
 proof (cases "x = y")
   case False
   let ?a = "min x y"
   let ?b = "max x y"
   have *: "DERIV f z :> 0" if "?a \<le> z" "z \<le> ?b" for z
   proof -
     have "a < z" and "z < b"
       using that \<open>x \<in> {a <..< b}\<close> and \<open>y \<in> {a <..< b}\<close> by auto
     then have "z \<in> {a<..<b}" by auto
     then show "DERIV f z :> 0" by (rule derivable)
   qed
   have isCont: "continuous_on {?a..?b} f"
     by (meson * DERIV_continuous_on atLeastAtMost_iff has_field_derivative_at_within)
   have DERIV: "\<And>z. \<lbrakk>?a < z; z < ?b\<rbrakk> \<Longrightarrow> DERIV f z :> 0"
     using * by auto
   have "?a < ?b" using \<open>x \<noteq> y\<close> by auto
   from DERIV_isconst2[OF this isCont DERIV, of x] and DERIV_isconst2[OF this isCont DERIV, of y]
   show ?thesis by auto
 qed auto
 
 lemma DERIV_isconst_all:
   fixes f :: "real \<Rightarrow> real"
   shows "\<forall>x. DERIV f x :> 0 \<Longrightarrow> f x = f y"
   apply (rule linorder_cases [of x y])
   apply (metis DERIV_continuous DERIV_isconst_end continuous_at_imp_continuous_on)+
   done
 
 lemma DERIV_const_ratio_const:
   fixes f :: "real \<Rightarrow> real"
   assumes "a \<noteq> b" and df: "\<And>x. DERIV f x :> k"
   shows "f b - f a = (b - a) * k"
 proof (cases a b rule: linorder_cases)
   case less
   show ?thesis
     using MVT [OF less] df
     by (metis DERIV_continuous DERIV_unique continuous_at_imp_continuous_on real_differentiable_def)
 next
   case greater
   have  "f a - f b = (a - b) * k"
     using MVT [OF greater] df
     by (metis DERIV_continuous DERIV_unique continuous_at_imp_continuous_on real_differentiable_def)
   then show ?thesis
     by (simp add: algebra_simps)
 qed auto
 
 lemma DERIV_const_ratio_const2:
   fixes f :: "real \<Rightarrow> real"
   assumes "a \<noteq> b" and df: "\<And>x. DERIV f x :> k"
   shows "(f b - f a) / (b - a) = k"
   using DERIV_const_ratio_const [OF assms] \<open>a \<noteq> b\<close> by auto
 
 lemma real_average_minus_first [simp]: "(a + b) / 2 - a = (b - a) / 2"
   for a b :: real
   by simp
 
 lemma real_average_minus_second [simp]: "(b + a) / 2 - a = (b - a) / 2"
   for a b :: real
   by simp
 
 text \<open>Gallileo's "trick": average velocity = av. of end velocities.\<close>
 
 lemma DERIV_const_average:
   fixes v :: "real \<Rightarrow> real"
     and a b :: real
   assumes neq: "a \<noteq> b"
     and der: "\<And>x. DERIV v x :> k"
   shows "v ((a + b) / 2) = (v a + v b) / 2"
 proof (cases rule: linorder_cases [of a b])
   case equal
   with neq show ?thesis by simp
 next
   case less
   have "(v b - v a) / (b - a) = k"
     by (rule DERIV_const_ratio_const2 [OF neq der])
   then have "(b - a) * ((v b - v a) / (b - a)) = (b - a) * k"
     by simp
   moreover have "(v ((a + b) / 2) - v a) / ((a + b) / 2 - a) = k"
     by (rule DERIV_const_ratio_const2 [OF _ der]) (simp add: neq)
   ultimately show ?thesis
     using neq by force
 next
   case greater
   have "(v b - v a) / (b - a) = k"
     by (rule DERIV_const_ratio_const2 [OF neq der])
   then have "(b - a) * ((v b - v a) / (b - a)) = (b - a) * k"
     by simp
   moreover have " (v ((b + a) / 2) - v a) / ((b + a) / 2 - a) = k"
     by (rule DERIV_const_ratio_const2 [OF _ der]) (simp add: neq)
   ultimately show ?thesis
     using neq by (force simp add: add.commute)
 qed
 
 subsubsection\<open>A function with positive derivative is increasing\<close>
 text \<open>A simple proof using the MVT, by Jeremy Avigad. And variants.\<close>
 lemma DERIV_pos_imp_increasing_open:
   fixes a b :: real
     and f :: "real \<Rightarrow> real"
   assumes "a < b"
     and "\<And>x. a < x \<Longrightarrow> x < b \<Longrightarrow> (\<exists>y. DERIV f x :> y \<and> y > 0)"
     and con: "continuous_on {a..b} f"
   shows "f a < f b"
 proof (rule ccontr)
   assume f: "\<not> ?thesis"
   have "\<exists>l z. a < z \<and> z < b \<and> DERIV f z :> l \<and> f b - f a = (b - a) * l"
     by (rule MVT) (use assms real_differentiable_def in \<open>force+\<close>)
   then obtain l z where z: "a < z" "z < b" "DERIV f z :> l" and "f b - f a = (b - a) * l"
     by auto
   with assms f have "\<not> l > 0"
     by (metis linorder_not_le mult_le_0_iff diff_le_0_iff_le)
   with assms z show False
     by (metis DERIV_unique)
 qed
 
 lemma DERIV_pos_imp_increasing:
   fixes a b :: real and f :: "real \<Rightarrow> real"
   assumes "a < b"
     and der: "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y > 0"
   shows "f a < f b"
   by (metis less_le_not_le DERIV_atLeastAtMost_imp_continuous_on DERIV_pos_imp_increasing_open [OF \<open>a < b\<close>] der)
 
 lemma DERIV_nonneg_imp_nondecreasing:
   fixes a b :: real
     and f :: "real \<Rightarrow> real"
   assumes "a \<le> b"
     and "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y \<ge> 0"
   shows "f a \<le> f b"
 proof (rule ccontr, cases "a = b")
   assume "\<not> ?thesis" and "a = b"
   then show False by auto
 next
   assume *: "\<not> ?thesis"
   assume "a \<noteq> b"
   with \<open>a \<le> b\<close> have "a < b"
     by linarith
   moreover have "continuous_on {a..b} f"
     by (meson DERIV_isCont assms(2) atLeastAtMost_iff continuous_at_imp_continuous_on)
   ultimately have "\<exists>l z. a < z \<and> z < b \<and> DERIV f z :> l \<and> f b - f a = (b - a) * l"
     using assms MVT [OF \<open>a < b\<close>, of f] real_differentiable_def less_eq_real_def by blast
   then obtain l z where lz: "a < z" "z < b" "DERIV f z :> l" and **: "f b - f a = (b - a) * l"
     by auto
   with * have "a < b" "f b < f a" by auto
   with ** have "\<not> l \<ge> 0" by (auto simp add: not_le algebra_simps)
     (metis * add_le_cancel_right assms(1) less_eq_real_def mult_right_mono add_left_mono linear order_refl)
   with assms lz show False
     by (metis DERIV_unique order_less_imp_le)
 qed
 
 lemma DERIV_neg_imp_decreasing_open:
   fixes a b :: real
     and f :: "real \<Rightarrow> real"
   assumes "a < b"
     and "\<And>x. a < x \<Longrightarrow> x < b \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y < 0"
     and con: "continuous_on {a..b} f"
   shows "f a > f b"
 proof -
   have "(\<lambda>x. -f x) a < (\<lambda>x. -f x) b"
   proof (rule DERIV_pos_imp_increasing_open [of a b])
     show "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> \<exists>y. ((\<lambda>x. - f x) has_real_derivative y) (at x) \<and> 0 < y"
       using assms
       by simp (metis field_differentiable_minus neg_0_less_iff_less)
     show "continuous_on {a..b} (\<lambda>x. - f x)"
       using con continuous_on_minus by blast
   qed (use assms in auto)
   then show ?thesis
     by simp
 qed
 
 lemma DERIV_neg_imp_decreasing:
   fixes a b :: real and f :: "real \<Rightarrow> real"
   assumes "a < b"
     and der: "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y < 0"
   shows "f a > f b"
   by (metis less_le_not_le DERIV_atLeastAtMost_imp_continuous_on DERIV_neg_imp_decreasing_open [OF \<open>a < b\<close>] der)
 
 lemma DERIV_nonpos_imp_nonincreasing:
   fixes a b :: real
     and f :: "real \<Rightarrow> real"
   assumes "a \<le> b"
     and "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y \<le> 0"
   shows "f a \<ge> f b"
 proof -
   have "(\<lambda>x. -f x) a \<le> (\<lambda>x. -f x) b"
     using DERIV_nonneg_imp_nondecreasing [of a b "\<lambda>x. -f x"] assms DERIV_minus by fastforce
   then show ?thesis
     by simp
 qed
 
 lemma DERIV_pos_imp_increasing_at_bot:
   fixes f :: "real \<Rightarrow> real"
   assumes "\<And>x. x \<le> b \<Longrightarrow> (\<exists>y. DERIV f x :> y \<and> y > 0)"
     and lim: "(f \<longlongrightarrow> flim) at_bot"
   shows "flim < f b"
 proof -
   have "\<exists>N. \<forall>n\<le>N. f n \<le> f (b - 1)"
     by (rule_tac x="b - 2" in exI) (force intro: order.strict_implies_order DERIV_pos_imp_increasing assms)
   then have "flim \<le> f (b - 1)"
      by (auto simp: eventually_at_bot_linorder tendsto_upperbound [OF lim])
   also have "\<dots> < f b"
     by (force intro: DERIV_pos_imp_increasing [where f=f] assms)
   finally show ?thesis .
 qed
 
 lemma DERIV_neg_imp_decreasing_at_top:
   fixes f :: "real \<Rightarrow> real"
   assumes der: "\<And>x. x \<ge> b \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y < 0"
     and lim: "(f \<longlongrightarrow> flim) at_top"
   shows "flim < f b"
   apply (rule DERIV_pos_imp_increasing_at_bot [where f = "\<lambda>i. f (-i)" and b = "-b", simplified])
    apply (metis DERIV_mirror der le_minus_iff neg_0_less_iff_less)
   apply (metis filterlim_at_top_mirror lim)
   done
 
 text \<open>Derivative of inverse function\<close>
 
 lemma DERIV_inverse_function:
   fixes f g :: "real \<Rightarrow> real"
   assumes der: "DERIV f (g x) :> D"
     and neq: "D \<noteq> 0"
     and x: "a < x" "x < b"
     and inj: "\<And>y. \<lbrakk>a < y; y < b\<rbrakk> \<Longrightarrow> f (g y) = y"
     and cont: "isCont g x"
   shows "DERIV g x :> inverse D"
 unfolding has_field_derivative_iff
 proof (rule LIM_equal2)
   show "0 < min (x - a) (b - x)"
     using x by arith
 next
   fix y
   assume "norm (y - x) < min (x - a) (b - x)"
   then have "a < y" and "y < b"
     by (simp_all add: abs_less_iff)
   then show "(g y - g x) / (y - x) = inverse ((f (g y) - x) / (g y - g x))"
     by (simp add: inj)
 next
   have "(\<lambda>z. (f z - f (g x)) / (z - g x)) \<midarrow>g x\<rightarrow> D"
     by (rule der [unfolded has_field_derivative_iff])
   then have 1: "(\<lambda>z. (f z - x) / (z - g x)) \<midarrow>g x\<rightarrow> D"
     using inj x by simp
   have 2: "\<exists>d>0. \<forall>y. y \<noteq> x \<and> norm (y - x) < d \<longrightarrow> g y \<noteq> g x"
   proof (rule exI, safe)
     show "0 < min (x - a) (b - x)"
       using x by simp
   next
     fix y
     assume "norm (y - x) < min (x - a) (b - x)"
     then have y: "a < y" "y < b"
       by (simp_all add: abs_less_iff)
     assume "g y = g x"
     then have "f (g y) = f (g x)" by simp
     then have "y = x" using inj y x by simp
     also assume "y \<noteq> x"
     finally show False by simp
   qed
   have "(\<lambda>y. (f (g y) - x) / (g y - g x)) \<midarrow>x\<rightarrow> D"
     using cont 1 2 by (rule isCont_LIM_compose2)
   then show "(\<lambda>y. inverse ((f (g y) - x) / (g y - g x))) \<midarrow>x\<rightarrow> inverse D"
     using neq by (rule tendsto_inverse)
 qed
 
 subsection \<open>Generalized Mean Value Theorem\<close>
 
 theorem GMVT:
   fixes a b :: real
   assumes alb: "a < b"
     and fc: "\<forall>x. a \<le> x \<and> x \<le> b \<longrightarrow> isCont f x"
     and fd: "\<forall>x. a < x \<and> x < b \<longrightarrow> f differentiable (at x)"
     and gc: "\<forall>x. a \<le> x \<and> x \<le> b \<longrightarrow> isCont g x"
     and gd: "\<forall>x. a < x \<and> x < b \<longrightarrow> g differentiable (at x)"
   shows "\<exists>g'c f'c c.
     DERIV g c :> g'c \<and> DERIV f c :> f'c \<and> a < c \<and> c < b \<and> (f b - f a) * g'c = (g b - g a) * f'c"
 proof -
   let ?h = "\<lambda>x. (f b - f a) * g x - (g b - g a) * f x"
   have "\<exists>l z. a < z \<and> z < b \<and> DERIV ?h z :> l \<and> ?h b - ?h a = (b - a) * l"
   proof (rule MVT)
     from assms show "a < b" by simp
     show "continuous_on {a..b} ?h"
       by (simp add: continuous_at_imp_continuous_on fc gc)
     show "\<And>x. \<lbrakk>a < x; x < b\<rbrakk> \<Longrightarrow> ?h differentiable (at x)"
       using fd gd by simp
   qed
   then obtain l where l: "\<exists>z. a < z \<and> z < b \<and> DERIV ?h z :> l \<and> ?h b - ?h a = (b - a) * l" ..
   then obtain c where c: "a < c \<and> c < b \<and> DERIV ?h c :> l \<and> ?h b - ?h a = (b - a) * l" ..
 
   from c have cint: "a < c \<and> c < b" by auto
   then obtain g'c where g'c: "DERIV g c :> g'c"
     using gd real_differentiable_def by blast 
   from c have "a < c \<and> c < b" by auto
   then obtain f'c where f'c: "DERIV f c :> f'c"
     using fd real_differentiable_def by blast 
 
   from c have "DERIV ?h c :> l" by auto
   moreover have "DERIV ?h c :>  g'c * (f b - f a) - f'c * (g b - g a)"
     using g'c f'c by (auto intro!: derivative_eq_intros)
   ultimately have leq: "l =  g'c * (f b - f a) - f'c * (g b - g a)" by (rule DERIV_unique)
 
   have "?h b - ?h a = (b - a) * (g'c * (f b - f a) - f'c * (g b - g a))"
   proof -
     from c have "?h b - ?h a = (b - a) * l" by auto
     also from leq have "\<dots> = (b - a) * (g'c * (f b - f a) - f'c * (g b - g a))" by simp
     finally show ?thesis by simp
   qed
   moreover have "?h b - ?h a = 0"
   proof -
     have "?h b - ?h a =
       ((f b)*(g b) - (f a)*(g b) - (g b)*(f b) + (g a)*(f b)) -
       ((f b)*(g a) - (f a)*(g a) - (g b)*(f a) + (g a)*(f a))"
       by (simp add: algebra_simps)
     then show ?thesis  by auto
   qed
   ultimately have "(b - a) * (g'c * (f b - f a) - f'c * (g b - g a)) = 0" by auto
   with alb have "g'c * (f b - f a) - f'c * (g b - g a) = 0" by simp
   then have "g'c * (f b - f a) = f'c * (g b - g a)" by simp
   then have "(f b - f a) * g'c = (g b - g a) * f'c" by (simp add: ac_simps)
   with g'c f'c cint show ?thesis by auto
 qed
 
 lemma GMVT':
   fixes f g :: "real \<Rightarrow> real"
   assumes "a < b"
     and isCont_f: "\<And>z. a \<le> z \<Longrightarrow> z \<le> b \<Longrightarrow> isCont f z"
     and isCont_g: "\<And>z. a \<le> z \<Longrightarrow> z \<le> b \<Longrightarrow> isCont g z"
     and DERIV_g: "\<And>z. a < z \<Longrightarrow> z < b \<Longrightarrow> DERIV g z :> (g' z)"
     and DERIV_f: "\<And>z. a < z \<Longrightarrow> z < b \<Longrightarrow> DERIV f z :> (f' z)"
   shows "\<exists>c. a < c \<and> c < b \<and> (f b - f a) * g' c = (g b - g a) * f' c"
 proof -
   have "\<exists>g'c f'c c. DERIV g c :> g'c \<and> DERIV f c :> f'c \<and>
       a < c \<and> c < b \<and> (f b - f a) * g'c = (g b - g a) * f'c"
     using assms by (intro GMVT) (force simp: real_differentiable_def)+
   then obtain c where "a < c" "c < b" "(f b - f a) * g' c = (g b - g a) * f' c"
     using DERIV_f DERIV_g by (force dest: DERIV_unique)
   then show ?thesis
     by auto
 qed
 
 
 subsection \<open>L'Hopitals rule\<close>
 
 lemma isCont_If_ge:
   fixes a :: "'a :: linorder_topology"
   assumes "continuous (at_left a) g" and f: "(f \<longlongrightarrow> g a) (at_right a)"
   shows "isCont (\<lambda>x. if x \<le> a then g x else f x) a" (is "isCont ?gf a")
 proof -
   have g: "(g \<longlongrightarrow> g a) (at_left a)"
     using assms continuous_within by blast
   show ?thesis
     unfolding isCont_def continuous_within
   proof (intro filterlim_split_at; simp)
     show "(?gf \<longlongrightarrow> g a) (at_left a)"
       by (subst filterlim_cong[OF refl refl, where g=g]) (simp_all add: eventually_at_filter less_le g)
     show "(?gf \<longlongrightarrow> g a) (at_right a)"
       by (subst filterlim_cong[OF refl refl, where g=f]) (simp_all add: eventually_at_filter less_le f)
   qed
 qed
 
 lemma lhopital_right_0:
   fixes f0 g0 :: "real \<Rightarrow> real"
   assumes f_0: "(f0 \<longlongrightarrow> 0) (at_right 0)"
     and g_0: "(g0 \<longlongrightarrow> 0) (at_right 0)"
     and ev:
       "eventually (\<lambda>x. g0 x \<noteq> 0) (at_right 0)"
       "eventually (\<lambda>x. g' x \<noteq> 0) (at_right 0)"
       "eventually (\<lambda>x. DERIV f0 x :> f' x) (at_right 0)"
       "eventually (\<lambda>x. DERIV g0 x :> g' x) (at_right 0)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) F (at_right 0)"
   shows "filterlim (\<lambda> x. f0 x / g0 x) F (at_right 0)"
 proof -
   define f where [abs_def]: "f x = (if x \<le> 0 then 0 else f0 x)" for x
   then have "f 0 = 0" by simp
 
   define g where [abs_def]: "g x = (if x \<le> 0 then 0 else g0 x)" for x
   then have "g 0 = 0" by simp
 
   have "eventually (\<lambda>x. g0 x \<noteq> 0 \<and> g' x \<noteq> 0 \<and>
       DERIV f0 x :> (f' x) \<and> DERIV g0 x :> (g' x)) (at_right 0)"
     using ev by eventually_elim auto
   then obtain a where [arith]: "0 < a"
     and g0_neq_0: "\<And>x. 0 < x \<Longrightarrow> x < a \<Longrightarrow> g0 x \<noteq> 0"
     and g'_neq_0: "\<And>x. 0 < x \<Longrightarrow> x < a \<Longrightarrow> g' x \<noteq> 0"
     and f0: "\<And>x. 0 < x \<Longrightarrow> x < a \<Longrightarrow> DERIV f0 x :> (f' x)"
     and g0: "\<And>x. 0 < x \<Longrightarrow> x < a \<Longrightarrow> DERIV g0 x :> (g' x)"
     unfolding eventually_at by (auto simp: dist_real_def)
 
   have g_neq_0: "\<And>x. 0 < x \<Longrightarrow> x < a \<Longrightarrow> g x \<noteq> 0"
     using g0_neq_0 by (simp add: g_def)
 
   have f: "DERIV f x :> (f' x)" if x: "0 < x" "x < a" for x
     using that
     by (intro DERIV_cong_ev[THEN iffD1, OF _ _ _ f0[OF x]])
       (auto simp: f_def eventually_nhds_metric dist_real_def intro!: exI[of _ x])
 
   have g: "DERIV g x :> (g' x)" if x: "0 < x" "x < a" for x
     using that
     by (intro DERIV_cong_ev[THEN iffD1, OF _ _ _ g0[OF x]])
          (auto simp: g_def eventually_nhds_metric dist_real_def intro!: exI[of _ x])
 
   have "isCont f 0"
     unfolding f_def by (intro isCont_If_ge f_0 continuous_const)
 
   have "isCont g 0"
     unfolding g_def by (intro isCont_If_ge g_0 continuous_const)
 
   have "\<exists>\<zeta>. \<forall>x\<in>{0 <..< a}. 0 < \<zeta> x \<and> \<zeta> x < x \<and> f x / g x = f' (\<zeta> x) / g' (\<zeta> x)"
   proof (rule bchoice, rule ballI)
     fix x
     assume "x \<in> {0 <..< a}"
     then have x[arith]: "0 < x" "x < a" by auto
     with g'_neq_0 g_neq_0 \<open>g 0 = 0\<close> have g': "\<And>x. 0 < x \<Longrightarrow> x < a  \<Longrightarrow> 0 \<noteq> g' x" "g 0 \<noteq> g x"
       by auto
     have "\<And>x. 0 \<le> x \<Longrightarrow> x < a \<Longrightarrow> isCont f x"
       using \<open>isCont f 0\<close> f by (auto intro: DERIV_isCont simp: le_less)
     moreover have "\<And>x. 0 \<le> x \<Longrightarrow> x < a \<Longrightarrow> isCont g x"
       using \<open>isCont g 0\<close> g by (auto intro: DERIV_isCont simp: le_less)
     ultimately have "\<exists>c. 0 < c \<and> c < x \<and> (f x - f 0) * g' c = (g x - g 0) * f' c"
       using f g \<open>x < a\<close> by (intro GMVT') auto
     then obtain c where *: "0 < c" "c < x" "(f x - f 0) * g' c = (g x - g 0) * f' c"
       by blast
     moreover
     from * g'(1)[of c] g'(2) have "(f x - f 0)  / (g x - g 0) = f' c / g' c"
       by (simp add: field_simps)
     ultimately show "\<exists>y. 0 < y \<and> y < x \<and> f x / g x = f' y / g' y"
       using \<open>f 0 = 0\<close> \<open>g 0 = 0\<close> by (auto intro!: exI[of _ c])
   qed
   then obtain \<zeta> where "\<forall>x\<in>{0 <..< a}. 0 < \<zeta> x \<and> \<zeta> x < x \<and> f x / g x = f' (\<zeta> x) / g' (\<zeta> x)" ..
   then have \<zeta>: "eventually (\<lambda>x. 0 < \<zeta> x \<and> \<zeta> x < x \<and> f x / g x = f' (\<zeta> x) / g' (\<zeta> x)) (at_right 0)"
     unfolding eventually_at by (intro exI[of _ a]) (auto simp: dist_real_def)
   moreover
   from \<zeta> have "eventually (\<lambda>x. norm (\<zeta> x) \<le> x) (at_right 0)"
     by eventually_elim auto
   then have "((\<lambda>x. norm (\<zeta> x)) \<longlongrightarrow> 0) (at_right 0)"
     by (rule_tac real_tendsto_sandwich[where f="\<lambda>x. 0" and h="\<lambda>x. x"]) auto
   then have "(\<zeta> \<longlongrightarrow> 0) (at_right 0)"
     by (rule tendsto_norm_zero_cancel)
   with \<zeta> have "filterlim \<zeta> (at_right 0) (at_right 0)"
     by (auto elim!: eventually_mono simp: filterlim_at)
   from this lim have "filterlim (\<lambda>t. f' (\<zeta> t) / g' (\<zeta> t)) F (at_right 0)"
     by (rule_tac filterlim_compose[of _ _ _ \<zeta>])
   ultimately have "filterlim (\<lambda>t. f t / g t) F (at_right 0)" (is ?P)
     by (rule_tac filterlim_cong[THEN iffD1, OF refl refl])
        (auto elim: eventually_mono)
   also have "?P \<longleftrightarrow> ?thesis"
     by (rule filterlim_cong) (auto simp: f_def g_def eventually_at_filter)
   finally show ?thesis .
 qed
 
 lemma lhopital_right:
   "(f \<longlongrightarrow> 0) (at_right x) \<Longrightarrow> (g \<longlongrightarrow> 0) (at_right x) \<Longrightarrow>
     eventually (\<lambda>x. g x \<noteq> 0) (at_right x) \<Longrightarrow>
     eventually (\<lambda>x. g' x \<noteq> 0) (at_right x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV f x :> f' x) (at_right x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV g x :> g' x) (at_right x) \<Longrightarrow>
     filterlim (\<lambda> x. (f' x / g' x)) F (at_right x) \<Longrightarrow>
   filterlim (\<lambda> x. f x / g x) F (at_right x)"
   for x :: real
   unfolding eventually_at_right_to_0[of _ x] filterlim_at_right_to_0[of _ _ x] DERIV_shift
   by (rule lhopital_right_0)
 
 lemma lhopital_left:
   "(f \<longlongrightarrow> 0) (at_left x) \<Longrightarrow> (g \<longlongrightarrow> 0) (at_left x) \<Longrightarrow>
     eventually (\<lambda>x. g x \<noteq> 0) (at_left x) \<Longrightarrow>
     eventually (\<lambda>x. g' x \<noteq> 0) (at_left x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV f x :> f' x) (at_left x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV g x :> g' x) (at_left x) \<Longrightarrow>
     filterlim (\<lambda> x. (f' x / g' x)) F (at_left x) \<Longrightarrow>
   filterlim (\<lambda> x. f x / g x) F (at_left x)"
   for x :: real
   unfolding eventually_at_left_to_right filterlim_at_left_to_right DERIV_mirror
   by (rule lhopital_right[where f'="\<lambda>x. - f' (- x)"]) (auto simp: DERIV_mirror)
 
 lemma lhopital:
   "(f \<longlongrightarrow> 0) (at x) \<Longrightarrow> (g \<longlongrightarrow> 0) (at x) \<Longrightarrow>
     eventually (\<lambda>x. g x \<noteq> 0) (at x) \<Longrightarrow>
     eventually (\<lambda>x. g' x \<noteq> 0) (at x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV f x :> f' x) (at x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV g x :> g' x) (at x) \<Longrightarrow>
     filterlim (\<lambda> x. (f' x / g' x)) F (at x) \<Longrightarrow>
   filterlim (\<lambda> x. f x / g x) F (at x)"
   for x :: real
   unfolding eventually_at_split filterlim_at_split
   by (auto intro!: lhopital_right[of f x g g' f'] lhopital_left[of f x g g' f'])
 
 
 lemma lhopital_right_0_at_top:
   fixes f g :: "real \<Rightarrow> real"
   assumes g_0: "LIM x at_right 0. g x :> at_top"
     and ev:
       "eventually (\<lambda>x. g' x \<noteq> 0) (at_right 0)"
       "eventually (\<lambda>x. DERIV f x :> f' x) (at_right 0)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at_right 0)"
     and lim: "((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> x) (at_right 0)"
   shows "((\<lambda> x. f x / g x) \<longlongrightarrow> x) (at_right 0)"
   unfolding tendsto_iff
 proof safe
   fix e :: real
   assume "0 < e"
   with lim[unfolded tendsto_iff, rule_format, of "e / 4"]
   have "eventually (\<lambda>t. dist (f' t / g' t) x < e / 4) (at_right 0)"
     by simp
   from eventually_conj[OF eventually_conj[OF ev(1) ev(2)] eventually_conj[OF ev(3) this]]
   obtain a where [arith]: "0 < a"
     and g'_neq_0: "\<And>x. 0 < x \<Longrightarrow> x < a \<Longrightarrow> g' x \<noteq> 0"
     and f0: "\<And>x. 0 < x \<Longrightarrow> x \<le> a \<Longrightarrow> DERIV f x :> (f' x)"
     and g0: "\<And>x. 0 < x \<Longrightarrow> x \<le> a \<Longrightarrow> DERIV g x :> (g' x)"
     and Df: "\<And>t. 0 < t \<Longrightarrow> t < a \<Longrightarrow> dist (f' t / g' t) x < e / 4"
     unfolding eventually_at_le by (auto simp: dist_real_def)
 
   from Df have "eventually (\<lambda>t. t < a) (at_right 0)" "eventually (\<lambda>t::real. 0 < t) (at_right 0)"
     unfolding eventually_at by (auto intro!: exI[of _ a] simp: dist_real_def)
 
   moreover
   have "eventually (\<lambda>t. 0 < g t) (at_right 0)" "eventually (\<lambda>t. g a < g t) (at_right 0)"
     using g_0 by (auto elim: eventually_mono simp: filterlim_at_top_dense)
 
   moreover
   have inv_g: "((\<lambda>x. inverse (g x)) \<longlongrightarrow> 0) (at_right 0)"
     using tendsto_inverse_0 filterlim_mono[OF g_0 at_top_le_at_infinity order_refl]
     by (rule filterlim_compose)
   then have "((\<lambda>x. norm (1 - g a * inverse (g x))) \<longlongrightarrow> norm (1 - g a * 0)) (at_right 0)"
     by (intro tendsto_intros)
   then have "((\<lambda>x. norm (1 - g a / g x)) \<longlongrightarrow> 1) (at_right 0)"
     by (simp add: inverse_eq_divide)
   from this[unfolded tendsto_iff, rule_format, of 1]
   have "eventually (\<lambda>x. norm (1 - g a / g x) < 2) (at_right 0)"
     by (auto elim!: eventually_mono simp: dist_real_def)
 
   moreover
   from inv_g have "((\<lambda>t. norm ((f a - x * g a) * inverse (g t))) \<longlongrightarrow> norm ((f a - x * g a) * 0))
       (at_right 0)"
     by (intro tendsto_intros)
   then have "((\<lambda>t. norm (f a - x * g a) / norm (g t)) \<longlongrightarrow> 0) (at_right 0)"
     by (simp add: inverse_eq_divide)
   from this[unfolded tendsto_iff, rule_format, of "e / 2"] \<open>0 < e\<close>
   have "eventually (\<lambda>t. norm (f a - x * g a) / norm (g t) < e / 2) (at_right 0)"
     by (auto simp: dist_real_def)
 
   ultimately show "eventually (\<lambda>t. dist (f t / g t) x < e) (at_right 0)"
   proof eventually_elim
     fix t assume t[arith]: "0 < t" "t < a" "g a < g t" "0 < g t"
     assume ineq: "norm (1 - g a / g t) < 2" "norm (f a - x * g a) / norm (g t) < e / 2"
 
     have "\<exists>y. t < y \<and> y < a \<and> (g a - g t) * f' y = (f a - f t) * g' y"
       using f0 g0 t(1,2) by (intro GMVT') (force intro!: DERIV_isCont)+
     then obtain y where [arith]: "t < y" "y < a"
       and D_eq0: "(g a - g t) * f' y = (f a - f t) * g' y"
       by blast
     from D_eq0 have D_eq: "(f t - f a) / (g t - g a) = f' y / g' y"
       using \<open>g a < g t\<close> g'_neq_0[of y] by (auto simp add: field_simps)
 
     have *: "f t / g t - x = ((f t - f a) / (g t - g a) - x) * (1 - g a / g t) + (f a - x * g a) / g t"
       by (simp add: field_simps)
     have "norm (f t / g t - x) \<le>
         norm (((f t - f a) / (g t - g a) - x) * (1 - g a / g t)) + norm ((f a - x * g a) / g t)"
       unfolding * by (rule norm_triangle_ineq)
     also have "\<dots> = dist (f' y / g' y) x * norm (1 - g a / g t) + norm (f a - x * g a) / norm (g t)"
       by (simp add: abs_mult D_eq dist_real_def)
     also have "\<dots> < (e / 4) * 2 + e / 2"
       using ineq Df[of y] \<open>0 < e\<close> by (intro add_le_less_mono mult_mono) auto
     finally show "dist (f t / g t) x < e"
       by (simp add: dist_real_def)
   qed
 qed
 
 lemma lhopital_right_at_top:
   "LIM x at_right x. (g::real \<Rightarrow> real) x :> at_top \<Longrightarrow>
     eventually (\<lambda>x. g' x \<noteq> 0) (at_right x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV f x :> f' x) (at_right x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV g x :> g' x) (at_right x) \<Longrightarrow>
     ((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> y) (at_right x) \<Longrightarrow>
     ((\<lambda> x. f x / g x) \<longlongrightarrow> y) (at_right x)"
   unfolding eventually_at_right_to_0[of _ x] filterlim_at_right_to_0[of _ _ x] DERIV_shift
   by (rule lhopital_right_0_at_top)
 
 lemma lhopital_left_at_top:
   "LIM x at_left x. g x :> at_top \<Longrightarrow>
     eventually (\<lambda>x. g' x \<noteq> 0) (at_left x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV f x :> f' x) (at_left x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV g x :> g' x) (at_left x) \<Longrightarrow>
     ((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> y) (at_left x) \<Longrightarrow>
     ((\<lambda> x. f x / g x) \<longlongrightarrow> y) (at_left x)"
   for x :: real
   unfolding eventually_at_left_to_right filterlim_at_left_to_right DERIV_mirror
   by (rule lhopital_right_at_top[where f'="\<lambda>x. - f' (- x)"]) (auto simp: DERIV_mirror)
 
 lemma lhopital_at_top:
   "LIM x at x. (g::real \<Rightarrow> real) x :> at_top \<Longrightarrow>
     eventually (\<lambda>x. g' x \<noteq> 0) (at x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV f x :> f' x) (at x) \<Longrightarrow>
     eventually (\<lambda>x. DERIV g x :> g' x) (at x) \<Longrightarrow>
     ((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> y) (at x) \<Longrightarrow>
     ((\<lambda> x. f x / g x) \<longlongrightarrow> y) (at x)"
   unfolding eventually_at_split filterlim_at_split
   by (auto intro!: lhopital_right_at_top[of g x g' f f'] lhopital_left_at_top[of g x g' f f'])
 
 lemma lhospital_at_top_at_top:
   fixes f g :: "real \<Rightarrow> real"
   assumes g_0: "LIM x at_top. g x :> at_top"
     and g': "eventually (\<lambda>x. g' x \<noteq> 0) at_top"
     and Df: "eventually (\<lambda>x. DERIV f x :> f' x) at_top"
     and Dg: "eventually (\<lambda>x. DERIV g x :> g' x) at_top"
     and lim: "((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> x) at_top"
   shows "((\<lambda> x. f x / g x) \<longlongrightarrow> x) at_top"
   unfolding filterlim_at_top_to_right
 proof (rule lhopital_right_0_at_top)
   let ?F = "\<lambda>x. f (inverse x)"
   let ?G = "\<lambda>x. g (inverse x)"
   let ?R = "at_right (0::real)"
   let ?D = "\<lambda>f' x. f' (inverse x) * - (inverse x ^ Suc (Suc 0))"
   show "LIM x ?R. ?G x :> at_top"
     using g_0 unfolding filterlim_at_top_to_right .
   show "eventually (\<lambda>x. DERIV ?G x  :> ?D g' x) ?R"
     unfolding eventually_at_right_to_top
     using Dg eventually_ge_at_top[where c=1]
     by eventually_elim (rule derivative_eq_intros DERIV_chain'[where f=inverse] | simp)+
   show "eventually (\<lambda>x. DERIV ?F x  :> ?D f' x) ?R"
     unfolding eventually_at_right_to_top
     using Df eventually_ge_at_top[where c=1]
     by eventually_elim (rule derivative_eq_intros DERIV_chain'[where f=inverse] | simp)+
   show "eventually (\<lambda>x. ?D g' x \<noteq> 0) ?R"
     unfolding eventually_at_right_to_top
     using g' eventually_ge_at_top[where c=1]
     by eventually_elim auto
   show "((\<lambda>x. ?D f' x / ?D g' x) \<longlongrightarrow> x) ?R"
     unfolding filterlim_at_right_to_top
     apply (intro filterlim_cong[THEN iffD2, OF refl refl _ lim])
     using eventually_ge_at_top[where c=1]
     by eventually_elim simp
 qed
 
 lemma lhopital_right_at_top_at_top:
   fixes f g :: "real \<Rightarrow> real"
   assumes f_0: "LIM x at_right a. f x :> at_top"
   assumes g_0: "LIM x at_right a. g x :> at_top"
     and ev:
       "eventually (\<lambda>x. DERIV f x :> f' x) (at_right a)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at_right a)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_top (at_right a)"
   shows "filterlim (\<lambda> x. f x / g x) at_top (at_right a)"
 proof -
   from lim have pos: "eventually (\<lambda>x. f' x / g' x > 0) (at_right a)"
     unfolding filterlim_at_top_dense by blast
   have "((\<lambda>x. g x / f x) \<longlongrightarrow> 0) (at_right a)"
   proof (rule lhopital_right_at_top)
     from pos show "eventually (\<lambda>x. f' x \<noteq> 0) (at_right a)" by eventually_elim auto
     from tendsto_inverse_0_at_top[OF lim]
       show "((\<lambda>x. g' x / f' x) \<longlongrightarrow> 0) (at_right a)" by simp
   qed fact+
   moreover from f_0 g_0 
     have "eventually (\<lambda>x. f x > 0) (at_right a)" "eventually (\<lambda>x. g x > 0) (at_right a)"
     unfolding filterlim_at_top_dense by blast+
   hence "eventually (\<lambda>x. g x / f x > 0) (at_right a)" by eventually_elim simp
   ultimately have "filterlim (\<lambda>x. inverse (g x / f x)) at_top (at_right a)"
     by (rule filterlim_inverse_at_top)
   thus ?thesis by simp
 qed
 
 lemma lhopital_right_at_top_at_bot:
   fixes f g :: "real \<Rightarrow> real"
   assumes f_0: "LIM x at_right a. f x :> at_top"
   assumes g_0: "LIM x at_right a. g x :> at_bot"
     and ev:
       "eventually (\<lambda>x. DERIV f x :> f' x) (at_right a)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at_right a)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_bot (at_right a)"
   shows "filterlim (\<lambda> x. f x / g x) at_bot (at_right a)"
 proof -
   from ev(2) have ev': "eventually (\<lambda>x. DERIV (\<lambda>x. -g x) x :> -g' x) (at_right a)"
     by eventually_elim (auto intro: derivative_intros)
   have "filterlim (\<lambda>x. f x / (-g x)) at_top (at_right a)"
     by (rule lhopital_right_at_top_at_top[where f' = f' and g' = "\<lambda>x. -g' x"])
        (insert assms ev', auto simp: filterlim_uminus_at_bot)
   hence "filterlim (\<lambda>x. -(f x / g x)) at_top (at_right a)" by simp
   thus ?thesis by (simp add: filterlim_uminus_at_bot)
 qed
 
 lemma lhopital_left_at_top_at_top:
   fixes f g :: "real \<Rightarrow> real"
   assumes f_0: "LIM x at_left a. f x :> at_top"
   assumes g_0: "LIM x at_left a. g x :> at_top"
     and ev:
       "eventually (\<lambda>x. DERIV f x :> f' x) (at_left a)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at_left a)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_top (at_left a)"
   shows "filterlim (\<lambda> x. f x / g x) at_top (at_left a)"
   by (insert assms, unfold eventually_at_left_to_right filterlim_at_left_to_right DERIV_mirror,
       rule lhopital_right_at_top_at_top[where f'="\<lambda>x. - f' (- x)"]) 
      (insert assms, auto simp: DERIV_mirror)
 
 lemma lhopital_left_at_top_at_bot:
   fixes f g :: "real \<Rightarrow> real"
   assumes f_0: "LIM x at_left a. f x :> at_top"
   assumes g_0: "LIM x at_left a. g x :> at_bot"
     and ev:
       "eventually (\<lambda>x. DERIV f x :> f' x) (at_left a)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at_left a)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_bot (at_left a)"
   shows "filterlim (\<lambda> x. f x / g x) at_bot (at_left a)"
   by (insert assms, unfold eventually_at_left_to_right filterlim_at_left_to_right DERIV_mirror,
       rule lhopital_right_at_top_at_bot[where f'="\<lambda>x. - f' (- x)"]) 
      (insert assms, auto simp: DERIV_mirror)
 
 lemma lhopital_at_top_at_top:
   fixes f g :: "real \<Rightarrow> real"
   assumes f_0: "LIM x at a. f x :> at_top"
   assumes g_0: "LIM x at a. g x :> at_top"
     and ev:
       "eventually (\<lambda>x. DERIV f x :> f' x) (at a)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at a)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_top (at a)"
   shows "filterlim (\<lambda> x. f x / g x) at_top (at a)"
   using assms unfolding eventually_at_split filterlim_at_split
   by (auto intro!: lhopital_right_at_top_at_top[of f a g f' g'] 
                    lhopital_left_at_top_at_top[of f a g f' g'])
 
 lemma lhopital_at_top_at_bot:
   fixes f g :: "real \<Rightarrow> real"
   assumes f_0: "LIM x at a. f x :> at_top"
   assumes g_0: "LIM x at a. g x :> at_bot"
     and ev:
       "eventually (\<lambda>x. DERIV f x :> f' x) (at a)"
       "eventually (\<lambda>x. DERIV g x :> g' x) (at a)"
     and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_bot (at a)"
   shows "filterlim (\<lambda> x. f x / g x) at_bot (at a)"
   using assms unfolding eventually_at_split filterlim_at_split
   by (auto intro!: lhopital_right_at_top_at_bot[of f a g f' g'] 
                    lhopital_left_at_top_at_bot[of f a g f' g'])
 
 end
diff --git a/src/HOL/Library/Landau_Symbols.thy b/src/HOL/Library/Landau_Symbols.thy
--- a/src/HOL/Library/Landau_Symbols.thy
+++ b/src/HOL/Library/Landau_Symbols.thy
@@ -1,2188 +1,2198 @@
 (*
   File:   Landau_Symbols_Definition.thy
   Author: Manuel Eberl <manuel@pruvisto.org>
 
   Landau symbols for reasoning about the asymptotic growth of functions.
 *)
 section \<open>Definition of Landau symbols\<close>
 
 theory Landau_Symbols
 imports
   Complex_Main
 begin
 
 lemma eventually_subst':
   "eventually (\<lambda>x. f x = g x) F \<Longrightarrow> eventually (\<lambda>x. P x (f x)) F = eventually (\<lambda>x. P x (g x)) F"
   by (rule eventually_subst, erule eventually_rev_mp) simp
 
 
 subsection \<open>Definition of Landau symbols\<close>
 
 text \<open>
   Our Landau symbols are sign-oblivious, i.e. any function always has the same growth
   as its absolute. This has the advantage of making some cancelling rules for sums nicer, but
   introduces some problems in other places. Nevertheless, we found this definition more convenient
   to work with.
 \<close>
 
 definition bigo :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
     (\<open>(1O[_]'(_'))\<close>)
   where "bigo F g = {f. (\<exists>c>0. eventually (\<lambda>x. norm (f x) \<le> c * norm (g x)) F)}"
 
 definition smallo :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
     (\<open>(1o[_]'(_'))\<close>)
   where "smallo F g = {f. (\<forall>c>0. eventually (\<lambda>x. norm (f x) \<le> c * norm (g x)) F)}"
 
 definition bigomega :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
     (\<open>(1\<Omega>[_]'(_'))\<close>)
   where "bigomega F g = {f. (\<exists>c>0. eventually (\<lambda>x. norm (f x) \<ge> c * norm (g x)) F)}"
 
 definition smallomega :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
     (\<open>(1\<omega>[_]'(_'))\<close>)
   where "smallomega F g = {f. (\<forall>c>0. eventually (\<lambda>x. norm (f x) \<ge> c * norm (g x)) F)}"
 
 definition bigtheta :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
     (\<open>(1\<Theta>[_]'(_'))\<close>)
   where "bigtheta F g = bigo F g \<inter> bigomega F g"
 
 abbreviation bigo_at_top (\<open>(2O'(_'))\<close>) where
   "O(g) \<equiv> bigo at_top g"
 
 abbreviation smallo_at_top (\<open>(2o'(_'))\<close>) where
   "o(g) \<equiv> smallo at_top g"
 
 abbreviation bigomega_at_top (\<open>(2\<Omega>'(_'))\<close>) where
   "\<Omega>(g) \<equiv> bigomega at_top g"
 
 abbreviation smallomega_at_top (\<open>(2\<omega>'(_'))\<close>) where
   "\<omega>(g) \<equiv> smallomega at_top g"
 
 abbreviation bigtheta_at_top (\<open>(2\<Theta>'(_'))\<close>) where
   "\<Theta>(g) \<equiv> bigtheta at_top g"
 
 
 text \<open>The following is a set of properties that all Landau symbols satisfy.\<close>
 
 named_theorems landau_divide_simps
 
 locale landau_symbol =
   fixes L  :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
   and   L'  :: "'c filter \<Rightarrow> ('c \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('c \<Rightarrow> 'b) set"
   and   Lr  :: "'a filter \<Rightarrow> ('a \<Rightarrow> real) \<Rightarrow> ('a \<Rightarrow> real) set"
   assumes bot': "L bot f = UNIV"
   assumes filter_mono': "F1 \<le> F2 \<Longrightarrow> L F2 f \<subseteq> L F1 f"
   assumes in_filtermap_iff:
     "f' \<in> L (filtermap h' F') g' \<longleftrightarrow> (\<lambda>x. f' (h' x)) \<in> L' F' (\<lambda>x. g' (h' x))"
   assumes filtercomap:
     "f' \<in> L F'' g' \<Longrightarrow> (\<lambda>x. f' (h' x)) \<in> L' (filtercomap h' F'') (\<lambda>x. g' (h' x))"
   assumes sup: "f \<in> L F1 g \<Longrightarrow> f \<in> L F2 g \<Longrightarrow> f \<in> L (sup F1 F2) g"
   assumes in_cong: "eventually (\<lambda>x. f x = g x) F \<Longrightarrow> f \<in> L F (h) \<longleftrightarrow> g \<in> L F (h)"
   assumes cong: "eventually (\<lambda>x. f x = g x) F \<Longrightarrow> L F (f) = L F (g)"
   assumes cong_bigtheta: "f \<in> \<Theta>[F](g) \<Longrightarrow> L F (f) = L F (g)"
   assumes in_cong_bigtheta: "f \<in> \<Theta>[F](g) \<Longrightarrow> f \<in> L F (h) \<longleftrightarrow> g \<in> L F (h)"
   assumes cmult [simp]: "c \<noteq> 0 \<Longrightarrow> L F (\<lambda>x. c * f x) = L F (f)"
   assumes cmult_in_iff [simp]: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. c * f x) \<in> L F (g) \<longleftrightarrow> f \<in> L F (g)"
   assumes mult_left [simp]: "f \<in> L F (g) \<Longrightarrow> (\<lambda>x. h x * f x) \<in> L F (\<lambda>x. h x * g x)"
   assumes inverse: "eventually (\<lambda>x. f x \<noteq> 0) F \<Longrightarrow> eventually (\<lambda>x. g x \<noteq> 0) F \<Longrightarrow>
                         f \<in> L F (g) \<Longrightarrow> (\<lambda>x. inverse (g x)) \<in> L F (\<lambda>x. inverse (f x))"
   assumes subsetI: "f \<in> L F (g) \<Longrightarrow> L F (f) \<subseteq> L F (g)"
   assumes plus_subset1: "f \<in> o[F](g) \<Longrightarrow> L F (g) \<subseteq> L F (\<lambda>x. f x + g x)"
   assumes trans: "f \<in> L F (g) \<Longrightarrow> g \<in> L F (h) \<Longrightarrow> f \<in> L F (h)"
   assumes compose: "f \<in> L F (g) \<Longrightarrow> filterlim h' F G \<Longrightarrow> (\<lambda>x. f (h' x)) \<in> L' G (\<lambda>x. g (h' x))"
   assumes norm_iff [simp]: "(\<lambda>x. norm (f x)) \<in> Lr F (\<lambda>x. norm (g x)) \<longleftrightarrow> f \<in> L F (g)"
   assumes abs [simp]: "Lr Fr (\<lambda>x. \<bar>fr x\<bar>) = Lr Fr fr"
   assumes abs_in_iff [simp]: "(\<lambda>x. \<bar>fr x\<bar>) \<in> Lr Fr gr \<longleftrightarrow> fr \<in> Lr Fr gr"
 begin
 
 lemma bot [simp]: "f \<in> L bot g" by (simp add: bot')
 
 lemma filter_mono: "F1 \<le> F2 \<Longrightarrow> f \<in> L F2 g \<Longrightarrow> f \<in> L F1 g"
   using filter_mono'[of F1 F2] by blast
 
 lemma cong_ex:
   "eventually (\<lambda>x. f1 x = f2 x) F \<Longrightarrow> eventually (\<lambda>x. g1 x = g2 x) F \<Longrightarrow>
      f1 \<in> L F (g1) \<longleftrightarrow> f2 \<in> L F (g2)"
   by (subst cong, assumption, subst in_cong, assumption, rule refl)
 
 lemma cong_ex_bigtheta:
   "f1 \<in> \<Theta>[F](f2) \<Longrightarrow> g1 \<in> \<Theta>[F](g2) \<Longrightarrow> f1 \<in> L F (g1) \<longleftrightarrow> f2 \<in> L F (g2)"
   by (subst cong_bigtheta, assumption, subst in_cong_bigtheta, assumption, rule refl)
 
 lemma bigtheta_trans1:
   "f \<in> L F (g) \<Longrightarrow> g \<in> \<Theta>[F](h) \<Longrightarrow> f \<in> L F (h)"
   by (subst cong_bigtheta[symmetric])
 
 lemma bigtheta_trans2:
   "f \<in> \<Theta>[F](g) \<Longrightarrow> g \<in> L F (h) \<Longrightarrow> f \<in> L F (h)"
   by (subst in_cong_bigtheta)
 
 lemma cmult' [simp]: "c \<noteq> 0 \<Longrightarrow> L F (\<lambda>x. f x * c) = L F (f)"
   by (subst mult.commute) (rule cmult)
 
 lemma cmult_in_iff' [simp]: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. f x * c) \<in> L F (g) \<longleftrightarrow> f \<in> L F (g)"
   by (subst mult.commute) (rule cmult_in_iff)
 
 lemma cdiv [simp]: "c \<noteq> 0 \<Longrightarrow> L F (\<lambda>x. f x / c) = L F (f)"
   using cmult'[of "inverse c" F f] by (simp add: field_simps)
 
 lemma cdiv_in_iff' [simp]: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. f x / c) \<in> L F (g) \<longleftrightarrow> f \<in> L F (g)"
   using cmult_in_iff'[of "inverse c" f] by (simp add: field_simps)
 
 lemma uminus [simp]: "L F (\<lambda>x. -g x) = L F (g)" using cmult[of "-1"] by simp
 
 lemma uminus_in_iff [simp]: "(\<lambda>x. -f x) \<in> L F (g) \<longleftrightarrow> f \<in> L F (g)"
   using cmult_in_iff[of "-1"] by simp
 
 lemma const: "c \<noteq> 0 \<Longrightarrow> L F (\<lambda>_. c) = L F (\<lambda>_. 1)"
   by (subst (2) cmult[symmetric]) simp_all
 
 (* Simplifier loops without the NO_MATCH *)
 lemma const' [simp]: "NO_MATCH 1 c \<Longrightarrow> c \<noteq> 0 \<Longrightarrow> L F (\<lambda>_. c) = L F (\<lambda>_. 1)"
   by (rule const)
 
 lemma const_in_iff: "c \<noteq> 0 \<Longrightarrow> (\<lambda>_. c) \<in> L F (f) \<longleftrightarrow> (\<lambda>_. 1) \<in> L F (f)"
   using cmult_in_iff'[of c "\<lambda>_. 1"] by simp
 
 lemma const_in_iff' [simp]: "NO_MATCH 1 c \<Longrightarrow> c \<noteq> 0 \<Longrightarrow> (\<lambda>_. c) \<in> L F (f) \<longleftrightarrow> (\<lambda>_. 1) \<in> L F (f)"
   by (rule const_in_iff)
 
 lemma plus_subset2: "g \<in> o[F](f) \<Longrightarrow> L F (f) \<subseteq> L F (\<lambda>x. f x + g x)"
   by (subst add.commute) (rule plus_subset1)
 
 lemma mult_right [simp]: "f \<in> L F (g) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> L F (\<lambda>x. g x * h x)"
   using mult_left by (simp add: mult.commute)
 
 lemma mult: "f1 \<in> L F (g1) \<Longrightarrow> f2 \<in> L F (g2) \<Longrightarrow> (\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. g1 x * g2 x)"
   by (rule trans, erule mult_left, erule mult_right)
 
 lemma inverse_cancel:
   assumes "eventually (\<lambda>x. f x \<noteq> 0) F"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "(\<lambda>x. inverse (f x)) \<in> L F (\<lambda>x. inverse (g x)) \<longleftrightarrow> g \<in> L F (f)"
 proof
   assume "(\<lambda>x. inverse (f x)) \<in> L F (\<lambda>x. inverse (g x))"
   from inverse[OF _ _ this] assms show "g \<in> L F (f)" by simp
 qed (intro inverse assms)
 
 lemma divide_right:
   assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
   assumes "f \<in> L F (g)"
   shows   "(\<lambda>x. f x / h x) \<in> L F (\<lambda>x. g x / h x)"
   by (subst (1 2) divide_inverse) (intro mult_right inverse assms)
 
 lemma divide_right_iff:
   assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
   shows   "(\<lambda>x. f x / h x) \<in> L F (\<lambda>x. g x / h x) \<longleftrightarrow> f \<in> L F (g)"
 proof
   assume "(\<lambda>x. f x / h x) \<in> L F (\<lambda>x. g x / h x)"
   from mult_right[OF this, of h] assms show "f \<in> L F (g)"
     by (subst (asm) cong_ex[of _ f F _ g]) (auto elim!: eventually_mono)
 qed (simp add: divide_right assms)
 
 lemma divide_left:
   assumes "eventually (\<lambda>x. f x \<noteq> 0) F"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   assumes "g \<in> L F(f)"
   shows   "(\<lambda>x. h x / f x) \<in> L F (\<lambda>x. h x / g x)"
   by (subst (1 2) divide_inverse) (intro mult_left inverse assms)
 
 lemma divide_left_iff:
   assumes "eventually (\<lambda>x. f x \<noteq> 0) F"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
   shows   "(\<lambda>x. h x / f x) \<in> L F (\<lambda>x. h x / g x) \<longleftrightarrow> g \<in> L F (f)"
 proof
   assume A: "(\<lambda>x. h x / f x) \<in> L F (\<lambda>x. h x / g x)"
   from assms have B: "eventually (\<lambda>x. h x / f x / h x = inverse (f x)) F"
     by eventually_elim (simp add: divide_inverse)
   from assms have C: "eventually (\<lambda>x. h x / g x / h x = inverse (g x)) F"
     by eventually_elim (simp add: divide_inverse)
   from divide_right[OF assms(3) A] assms show "g \<in> L F (f)"
     by (subst (asm) cong_ex[OF B C]) (simp add: inverse_cancel)
 qed (simp add: divide_left assms)
 
 lemma divide:
   assumes "eventually (\<lambda>x. g1 x \<noteq> 0) F"
   assumes "eventually (\<lambda>x. g2 x \<noteq> 0) F"
   assumes "f1 \<in> L F (f2)" "g2 \<in> L F (g1)"
   shows   "(\<lambda>x. f1 x / g1 x) \<in> L F (\<lambda>x. f2 x / g2 x)"
   by (subst (1 2) divide_inverse) (intro mult inverse assms)
 
 lemma divide_eq1:
   assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
   shows   "f \<in> L F (\<lambda>x. g x / h x) \<longleftrightarrow> (\<lambda>x. f x * h x) \<in> L F (g)"
 proof-
   have "f \<in> L F (\<lambda>x. g x / h x) \<longleftrightarrow> (\<lambda>x. f x * h x / h x) \<in> L F (\<lambda>x. g x / h x)"
     using assms by (intro in_cong) (auto elim: eventually_mono)
   thus ?thesis by (simp only: divide_right_iff assms)
 qed
 
 lemma divide_eq2:
   assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
   shows   "(\<lambda>x. f x / h x) \<in> L F (\<lambda>x. g x) \<longleftrightarrow> f \<in> L F (\<lambda>x. g x * h x)"
 proof-
   have "L F (\<lambda>x. g x) = L F (\<lambda>x. g x * h x / h x)"
     using assms by (intro cong) (auto elim: eventually_mono)
   thus ?thesis by (simp only: divide_right_iff assms)
 qed
 
 lemma inverse_eq1:
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "f \<in> L F (\<lambda>x. inverse (g x)) \<longleftrightarrow> (\<lambda>x. f x * g x) \<in> L F (\<lambda>_. 1)"
   using divide_eq1[of g F f "\<lambda>_. 1"] by (simp add: divide_inverse assms)
 
 lemma inverse_eq2:
   assumes "eventually (\<lambda>x. f x \<noteq> 0) F"
   shows   "(\<lambda>x. inverse (f x)) \<in> L F (g) \<longleftrightarrow> (\<lambda>x. 1) \<in> L F (\<lambda>x. f x * g x)"
   using divide_eq2[of f F "\<lambda>_. 1" g] by (simp add: divide_inverse assms mult_ac)
 
 lemma inverse_flip:
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
   assumes "(\<lambda>x. inverse (g x)) \<in> L F (h)"
   shows   "(\<lambda>x. inverse (h x)) \<in> L F (g)"
 using assms by (simp add: divide_eq1 divide_eq2 inverse_eq_divide mult.commute)
 
 lemma lift_trans:
   assumes "f \<in> L F (g)"
   assumes "(\<lambda>x. t x (g x)) \<in> L F (h)"
   assumes "\<And>f g. f \<in> L F (g) \<Longrightarrow> (\<lambda>x. t x (f x)) \<in> L F (\<lambda>x. t x (g x))"
   shows   "(\<lambda>x. t x (f x)) \<in> L F (h)"
   by (rule trans[OF assms(3)[OF assms(1)] assms(2)])
 
 lemma lift_trans':
   assumes "f \<in> L F (\<lambda>x. t x (g x))"
   assumes "g \<in> L F (h)"
   assumes "\<And>g h. g \<in> L F (h) \<Longrightarrow> (\<lambda>x. t x (g x)) \<in> L F (\<lambda>x. t x (h x))"
   shows   "f \<in> L F (\<lambda>x. t x (h x))"
   by (rule trans[OF assms(1) assms(3)[OF assms(2)]])
 
 lemma lift_trans_bigtheta:
   assumes "f \<in> L F (g)"
   assumes "(\<lambda>x. t x (g x)) \<in> \<Theta>[F](h)"
   assumes "\<And>f g. f \<in> L F (g) \<Longrightarrow> (\<lambda>x. t x (f x)) \<in> L F (\<lambda>x. t x (g x))"
   shows   "(\<lambda>x. t x (f x)) \<in> L F (h)"
   using cong_bigtheta[OF assms(2)] assms(3)[OF assms(1)] by simp
 
 lemma lift_trans_bigtheta':
   assumes "f \<in> L F (\<lambda>x. t x (g x))"
   assumes "g \<in> \<Theta>[F](h)"
   assumes "\<And>g h. g \<in> \<Theta>[F](h) \<Longrightarrow> (\<lambda>x. t x (g x)) \<in> \<Theta>[F](\<lambda>x. t x (h x))"
   shows   "f \<in> L F (\<lambda>x. t x (h x))"
   using cong_bigtheta[OF assms(3)[OF assms(2)]] assms(1)  by simp
 
 lemma (in landau_symbol) mult_in_1:
   assumes "f \<in> L F (\<lambda>_. 1)" "g \<in> L F (\<lambda>_. 1)"
   shows   "(\<lambda>x. f x * g x) \<in> L F (\<lambda>_. 1)"
   using mult[OF assms] by simp
 
 lemma (in landau_symbol) of_real_cancel:
   "(\<lambda>x. of_real (f x)) \<in> L F (\<lambda>x. of_real (g x)) \<Longrightarrow> f \<in> Lr F g"
   by (subst (asm) norm_iff [symmetric], subst (asm) (1 2) norm_of_real) simp_all
 
 lemma (in landau_symbol) of_real_iff:
   "(\<lambda>x. of_real (f x)) \<in> L F (\<lambda>x. of_real (g x)) \<longleftrightarrow> f \<in> Lr F g"
   by (subst norm_iff [symmetric], subst (1 2) norm_of_real) simp_all
 
 lemmas [landau_divide_simps] =
   inverse_cancel divide_left_iff divide_eq1 divide_eq2 inverse_eq1 inverse_eq2
 
 end
 
 
 text \<open>
   The symbols $O$ and $o$ and $\Omega$ and $\omega$ are dual, so for many rules, replacing $O$ with
   $\Omega$, $o$ with $\omega$, and $\leq$ with $\geq$ in a theorem yields another valid theorem.
   The following locale captures this fact.
 \<close>
 
 locale landau_pair =
   fixes L l :: "'a filter \<Rightarrow> ('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('a \<Rightarrow> 'b) set"
   fixes L' l' :: "'c filter \<Rightarrow> ('c \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> ('c \<Rightarrow> 'b) set"
   fixes Lr lr :: "'a filter \<Rightarrow> ('a \<Rightarrow> real) \<Rightarrow> ('a \<Rightarrow> real) set"
   and   R :: "real \<Rightarrow> real \<Rightarrow> bool"
   assumes L_def: "L F g = {f. \<exists>c>0. eventually (\<lambda>x. R (norm (f x)) (c * norm (g x))) F}"
   and     l_def: "l F g = {f. \<forall>c>0. eventually (\<lambda>x. R (norm (f x)) (c * norm (g x))) F}"
   and     L'_def: "L' F' g' = {f. \<exists>c>0. eventually (\<lambda>x. R (norm (f x)) (c * norm (g' x))) F'}"
   and     l'_def: "l' F' g' = {f. \<forall>c>0. eventually (\<lambda>x. R (norm (f x)) (c * norm (g' x))) F'}"
   and     Lr_def: "Lr F'' g'' = {f. \<exists>c>0. eventually (\<lambda>x. R (norm (f x)) (c * norm (g'' x))) F''}"
   and     lr_def: "lr F'' g'' = {f. \<forall>c>0. eventually (\<lambda>x. R (norm (f x)) (c * norm (g'' x))) F''}"
   and     R:     "R = (\<le>) \<or> R = (\<ge>)"
 
 interpretation landau_o:
     landau_pair bigo smallo bigo smallo bigo smallo "(\<le>)"
   by unfold_locales (auto simp: bigo_def smallo_def intro!: ext)
 
 interpretation landau_omega:
     landau_pair bigomega smallomega bigomega smallomega bigomega smallomega "(\<ge>)"
   by unfold_locales (auto simp: bigomega_def smallomega_def intro!: ext)
 
 
 context landau_pair
 begin
 
 lemmas R_E = disjE [OF R, case_names le ge]
 
 lemma bigI:
   "c > 0 \<Longrightarrow> eventually (\<lambda>x. R (norm (f x)) (c * norm (g x))) F \<Longrightarrow> f \<in> L F (g)"
   unfolding L_def by blast
 
 lemma bigE:
   assumes "f \<in> L F (g)"
   obtains c where "c > 0" "eventually (\<lambda>x. R (norm (f x)) (c * (norm (g x)))) F"
   using assms unfolding L_def by blast
 
 lemma smallI:
   "(\<And>c. c > 0 \<Longrightarrow> eventually (\<lambda>x. R (norm (f x)) (c * (norm (g x)))) F) \<Longrightarrow> f \<in> l F (g)"
   unfolding l_def by blast
 
 lemma smallD:
   "f \<in> l F (g) \<Longrightarrow> c > 0 \<Longrightarrow> eventually (\<lambda>x. R (norm (f x)) (c * (norm (g x)))) F"
   unfolding l_def by blast
 
 lemma bigE_nonneg_real:
   assumes "f \<in> Lr F (g)" "eventually (\<lambda>x. f x \<ge> 0) F"
   obtains c where "c > 0" "eventually (\<lambda>x. R (f x) (c * \<bar>g x\<bar>)) F"
 proof-
   from assms(1) obtain c where c: "c > 0" "eventually (\<lambda>x. R (norm (f x)) (c * norm (g x))) F"
     by (auto simp: Lr_def)
   from c(2) assms(2) have "eventually (\<lambda>x. R (f x) (c * \<bar>g x\<bar>)) F"
     by eventually_elim simp
   from c(1) and this show ?thesis by (rule that)
 qed
 
 lemma smallD_nonneg_real:
   assumes "f \<in> lr F (g)" "eventually (\<lambda>x. f x \<ge> 0) F" "c > 0"
   shows   "eventually (\<lambda>x. R (f x) (c * \<bar>g x\<bar>)) F"
   using assms by (auto simp: lr_def dest!: spec[of _ c] elim: eventually_elim2)
 
 lemma small_imp_big: "f \<in> l F (g) \<Longrightarrow> f \<in> L F (g)"
   by (rule bigI[OF _ smallD, of 1]) simp_all
 
 lemma small_subset_big: "l F (g) \<subseteq> L F (g)"
   using small_imp_big by blast
 
 lemma R_refl [simp]: "R x x" using R by auto
 
 lemma R_linear: "\<not>R x y \<Longrightarrow> R y x"
   using R by auto
 
 lemma R_trans [trans]: "R a b \<Longrightarrow> R b c \<Longrightarrow> R a c"
   using R by auto
 
 lemma R_mult_left_mono: "R a b \<Longrightarrow> c \<ge> 0 \<Longrightarrow> R (c*a) (c*b)"
   using R by (auto simp: mult_left_mono)
 
 lemma R_mult_right_mono: "R a b \<Longrightarrow> c \<ge> 0 \<Longrightarrow> R (a*c) (b*c)"
   using R by (auto simp: mult_right_mono)
 
 lemma big_trans:
   assumes "f \<in> L F (g)" "g \<in> L F (h)"
   shows   "f \<in> L F (h)"
 proof-
   from assms obtain c d where *: "0 < c" "0 < d"
     and **: "\<forall>\<^sub>F x in F. R (norm (f x)) (c * norm (g x))"
             "\<forall>\<^sub>F x in F. R (norm (g x)) (d * norm (h x))"
     by (elim bigE)
   from ** have "eventually (\<lambda>x. R (norm (f x)) (c * d * (norm (h x)))) F"
   proof eventually_elim
     fix x assume "R (norm (f x)) (c * (norm (g x)))"
     also assume "R (norm (g x)) (d * (norm (h x)))"
     with \<open>0 < c\<close> have "R (c * (norm (g x))) (c * (d * (norm (h x))))"
       by (intro R_mult_left_mono) simp_all
     finally show "R (norm (f x)) (c * d * (norm (h x)))"
       by (simp add: algebra_simps)
   qed
   with * show ?thesis by (intro bigI[of "c*d"]) simp_all
 qed
 
 lemma big_small_trans:
   assumes "f \<in> L F (g)" "g \<in> l F (h)"
   shows   "f \<in> l F (h)"
 proof (rule smallI)
   fix c :: real assume c: "c > 0"
   from assms(1) obtain d where d: "d > 0" and *: "\<forall>\<^sub>F x in F. R (norm (f x)) (d * norm (g x))"
     by (elim bigE)
   from assms(2) c d have "eventually (\<lambda>x. R (norm (g x)) (c * inverse d * norm (h x))) F"
     by (intro smallD) simp_all
   with * show "eventually (\<lambda>x. R (norm (f x)) (c * (norm (h x)))) F"
   proof eventually_elim
     case (elim x)
     show ?case
       by (use elim(1) in \<open>rule R_trans\<close>) (use elim(2) R d in \<open>auto simp: field_simps\<close>)
   qed
 qed
 
 lemma small_big_trans:
   assumes "f \<in> l F (g)" "g \<in> L F (h)"
   shows   "f \<in> l F (h)"
 proof (rule smallI)
   fix c :: real assume c: "c > 0"
   from assms(2) obtain d where d: "d > 0" and *: "\<forall>\<^sub>F x in F. R (norm (g x)) (d * norm (h x))"
     by (elim bigE)
   from assms(1) c d have "eventually (\<lambda>x. R (norm (f x)) (c * inverse d * norm (g x))) F"
     by (intro smallD) simp_all
   with * show "eventually (\<lambda>x. R (norm (f x)) (c * norm (h x))) F"
     by eventually_elim (rotate_tac 2, erule R_trans, insert R c d, auto simp: field_simps)
 qed
 
 lemma small_trans:
   "f \<in> l F (g) \<Longrightarrow> g \<in> l F (h) \<Longrightarrow> f \<in> l F (h)"
   by (rule big_small_trans[OF small_imp_big])
 
 lemma small_big_trans':
   "f \<in> l F (g) \<Longrightarrow> g \<in> L F (h) \<Longrightarrow> f \<in> L F (h)"
   by (rule small_imp_big[OF small_big_trans])
 
 lemma big_small_trans':
   "f \<in> L F (g) \<Longrightarrow> g \<in> l F (h) \<Longrightarrow> f \<in> L F (h)"
   by (rule small_imp_big[OF big_small_trans])
 
 lemma big_subsetI [intro]: "f \<in> L F (g) \<Longrightarrow> L F (f) \<subseteq> L F (g)"
   by (intro subsetI) (drule (1) big_trans)
 
 lemma small_subsetI [intro]: "f \<in> L F (g) \<Longrightarrow> l F (f) \<subseteq> l F (g)"
   by (intro subsetI) (drule (1) small_big_trans)
 
 lemma big_refl [simp]: "f \<in> L F (f)"
   by (rule bigI[of 1]) simp_all
 
 lemma small_refl_iff: "f \<in> l F (f) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
 proof (rule iffI[OF _ smallI])
   assume f: "f \<in> l F f"
   have "(1/2::real) > 0" "(2::real) > 0" by simp_all
   from smallD[OF f this(1)] smallD[OF f this(2)]
     show "eventually (\<lambda>x. f x = 0) F" by eventually_elim (insert R, auto)
 next
   fix c :: real assume "c > 0" "eventually (\<lambda>x. f x = 0) F"
   from this(2) show "eventually (\<lambda>x. R (norm (f x)) (c * norm (f x))) F"
     by eventually_elim simp_all
 qed
 
 lemma big_small_asymmetric: "f \<in> L F (g) \<Longrightarrow> g \<in> l F (f) \<Longrightarrow> eventually (\<lambda>x. f x = 0) F"
   by (drule (1) big_small_trans) (simp add: small_refl_iff)
 
 lemma small_big_asymmetric: "f \<in> l F (g) \<Longrightarrow> g \<in> L F (f) \<Longrightarrow> eventually (\<lambda>x. f x = 0) F"
   by (drule (1) small_big_trans) (simp add: small_refl_iff)
 
 lemma small_asymmetric: "f \<in> l F (g) \<Longrightarrow> g \<in> l F (f) \<Longrightarrow> eventually (\<lambda>x. f x = 0) F"
   by (drule (1) small_trans) (simp add: small_refl_iff)
 
 
 lemma plus_aux:
   assumes "f \<in> o[F](g)"
   shows "g \<in> L F (\<lambda>x. f x + g x)"
 proof (rule R_E)
   assume R: "R = (\<le>)"
   have A: "1/2 > (0::real)" by simp
   have B: "1/2 * (norm (g x)) \<le> norm (f x + g x)"
     if "norm (f x) \<le> 1/2 * norm (g x)" for x
   proof -
     from that have "1/2 * (norm (g x)) \<le> (norm (g x)) - (norm (f x))"
       by simp
     also have "norm (g x) - norm (f x) \<le> norm (f x + g x)"
       by (subst add.commute) (rule norm_diff_ineq)
     finally show ?thesis by simp
   qed
   show "g \<in> L F (\<lambda>x. f x + g x)"
     apply (rule bigI[of "2"])
      apply simp
     apply (use landau_o.smallD[OF assms A] in eventually_elim)
     apply (use B in \<open>simp add: R algebra_simps\<close>)
     done
 next
   assume R: "R = (\<lambda>x y. x \<ge> y)"
   show "g \<in> L F (\<lambda>x. f x + g x)"
   proof (rule bigI[of "1/2"])
     show "eventually (\<lambda>x. R (norm (g x)) (1/2 * norm (f x + g x))) F"
       using landau_o.smallD[OF assms zero_less_one]
     proof eventually_elim
       case (elim x)
       have "norm (f x + g x) \<le> norm (f x) + norm (g x)"
         by (rule norm_triangle_ineq)
       also note elim
       finally show ?case by (simp add: R)
     qed
   qed simp_all
 qed
 
 end
 
+lemma summable_comparison_test_bigo:
+  fixes f :: "nat \<Rightarrow> real"
+  assumes "summable (\<lambda>n. norm (g n))" "f \<in> O(g)"
+  shows   "summable f"
+proof -
+  from \<open>f \<in> O(g)\<close> obtain C where C: "eventually (\<lambda>x. norm (f x) \<le> C * norm (g x)) at_top"
+    by (auto elim: landau_o.bigE)
+  thus ?thesis
+    by (rule summable_comparison_test_ev) (insert assms, auto intro: summable_mult)
+qed
 
 lemma bigomega_iff_bigo: "g \<in> \<Omega>[F](f) \<longleftrightarrow> f \<in> O[F](g)"
 proof
   assume "f \<in> O[F](g)"
   then obtain c where "0 < c" "\<forall>\<^sub>F x in F. norm (f x) \<le> c * norm (g x)"
     by (rule landau_o.bigE)
   then show "g \<in> \<Omega>[F](f)"
     by (intro landau_omega.bigI[of "inverse c"]) (simp_all add: field_simps)
 next
   assume "g \<in> \<Omega>[F](f)"
   then obtain c where "0 < c" "\<forall>\<^sub>F x in F. c * norm (f x) \<le> norm (g x)"
     by (rule landau_omega.bigE)
   then show "f \<in> O[F](g)"
     by (intro landau_o.bigI[of "inverse c"]) (simp_all add: field_simps)
 qed
 
 lemma smallomega_iff_smallo: "g \<in> \<omega>[F](f) \<longleftrightarrow> f \<in> o[F](g)"
 proof
   assume "f \<in> o[F](g)"
   from landau_o.smallD[OF this, of "inverse c" for c]
     show "g \<in> \<omega>[F](f)" by (intro landau_omega.smallI) (simp_all add: field_simps)
 next
   assume "g \<in> \<omega>[F](f)"
   from landau_omega.smallD[OF this, of "inverse c" for c]
     show "f \<in> o[F](g)" by (intro landau_o.smallI) (simp_all add: field_simps)
 qed
 
 
 context landau_pair
 begin
 
 lemma big_mono:
   "eventually (\<lambda>x. R (norm (f x)) (norm (g x))) F \<Longrightarrow> f \<in> L F (g)"
   by (rule bigI[OF zero_less_one]) simp
 
 lemma big_mult:
   assumes "f1 \<in> L F (g1)" "f2 \<in> L F (g2)"
   shows   "(\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. g1 x * g2 x)"
 proof-
   from assms obtain c1 c2 where *: "c1 > 0" "c2 > 0"
     and **: "\<forall>\<^sub>F x in F. R (norm (f1 x)) (c1 * norm (g1 x))"
             "\<forall>\<^sub>F x in F. R (norm (f2 x)) (c2 * norm (g2 x))"
     by (elim bigE)
   from * have "c1 * c2 > 0" by simp
   moreover have "eventually (\<lambda>x. R (norm (f1 x * f2 x)) (c1 * c2 * norm (g1 x * g2 x))) F"
     using **
   proof eventually_elim
     case (elim x)
     show ?case
     proof (cases rule: R_E)
       case le
       have "norm (f1 x) * norm (f2 x) \<le> (c1 * norm (g1 x)) * (c2 * norm (g2 x))"
         using elim le * by (intro mult_mono mult_nonneg_nonneg) auto
       with le show ?thesis by (simp add: le norm_mult mult_ac)
     next
       case ge
       have "(c1 * norm (g1 x)) * (c2 * norm (g2 x)) \<le> norm (f1 x) * norm (f2 x)"
         using elim ge * by (intro mult_mono mult_nonneg_nonneg) auto
       with ge show ?thesis by (simp_all add: norm_mult mult_ac)
     qed
   qed
   ultimately show ?thesis by (rule bigI)
 qed
 
 lemma small_big_mult:
   assumes "f1 \<in> l F (g1)" "f2 \<in> L F (g2)"
   shows   "(\<lambda>x. f1 x * f2 x) \<in> l F (\<lambda>x. g1 x * g2 x)"
 proof (rule smallI)
   fix c1 :: real assume c1: "c1 > 0"
   from assms(2) obtain c2 where c2: "c2 > 0"
     and *: "\<forall>\<^sub>F x in F. R (norm (f2 x)) (c2 * norm (g2 x))" by (elim bigE)
   from assms(1) c1 c2 have "eventually (\<lambda>x. R (norm (f1 x)) (c1 * inverse c2 * norm (g1 x))) F"
     by (auto intro!: smallD)
   with * show "eventually (\<lambda>x. R (norm (f1 x * f2 x)) (c1 * norm (g1 x * g2 x))) F"
   proof eventually_elim
     case (elim x)
     show ?case
     proof (cases rule: R_E)
       case le
       have "norm (f1 x) * norm (f2 x) \<le> (c1 * inverse c2 * norm (g1 x)) * (c2 * norm (g2 x))"
         using elim le c1 c2 by (intro mult_mono mult_nonneg_nonneg) auto
       with le c2 show ?thesis by (simp add: le norm_mult field_simps)
     next
       case ge
       have "norm (f1 x) * norm (f2 x) \<ge> (c1 * inverse c2 * norm (g1 x)) * (c2 * norm (g2 x))"
         using elim ge c1 c2 by (intro mult_mono mult_nonneg_nonneg) auto
       with ge c2 show ?thesis by (simp add: ge norm_mult field_simps)
     qed
   qed
 qed
 
 lemma big_small_mult:
   "f1 \<in> L F (g1) \<Longrightarrow> f2 \<in> l F (g2) \<Longrightarrow> (\<lambda>x. f1 x * f2 x) \<in> l F (\<lambda>x. g1 x * g2 x)"
   by (subst (1 2) mult.commute) (rule small_big_mult)
 
 lemma small_mult: "f1 \<in> l F (g1) \<Longrightarrow> f2 \<in> l F (g2) \<Longrightarrow> (\<lambda>x. f1 x * f2 x) \<in> l F (\<lambda>x. g1 x * g2 x)"
   by (rule small_big_mult, assumption, rule small_imp_big)
 
 lemmas mult = big_mult small_big_mult big_small_mult small_mult
 
 
 sublocale big: landau_symbol L L' Lr
 proof
   have L: "L = bigo \<or> L = bigomega"
     by (rule R_E) (auto simp: bigo_def L_def bigomega_def fun_eq_iff)
   have A: "(\<lambda>x. c * f x) \<in> L F f" if "c \<noteq> 0" for c :: 'b and F and f :: "'a \<Rightarrow> 'b"
     using that by (intro bigI[of "norm c"]) (simp_all add: norm_mult)
   show "L F (\<lambda>x. c * f x) = L F f" if "c \<noteq> 0" for c :: 'b and F and f :: "'a \<Rightarrow> 'b"
     using \<open>c \<noteq> 0\<close> and A[of c f] and A[of "inverse c" "\<lambda>x. c * f x"]
     by (intro equalityI big_subsetI) (simp_all add: field_simps)
   show "((\<lambda>x. c * f x) \<in> L F g) = (f \<in> L F g)" if "c \<noteq> 0"
     for c :: 'b and F and f g :: "'a \<Rightarrow> 'b"
   proof -
     from \<open>c \<noteq> 0\<close> and A[of c f] and A[of "inverse c" "\<lambda>x. c * f x"]
     have "(\<lambda>x. c * f x) \<in> L F f" "f \<in> L F (\<lambda>x. c * f x)"
       by (simp_all add: field_simps)
     then show ?thesis by (intro iffI) (erule (1) big_trans)+
   qed
   show "(\<lambda>x. inverse (g x)) \<in> L F (\<lambda>x. inverse (f x))"
     if *: "f \<in> L F (g)" and **: "eventually (\<lambda>x. f x \<noteq> 0) F" "eventually (\<lambda>x. g x \<noteq> 0) F"
     for f g :: "'a \<Rightarrow> 'b" and F
   proof -
     from * obtain c where c: "c > 0" and ***: "\<forall>\<^sub>F x in F. R (norm (f x)) (c * norm (g x))"
       by (elim bigE)
     from ** *** have "eventually (\<lambda>x. R (norm (inverse (g x))) (c * norm (inverse (f x)))) F"
       by eventually_elim (rule R_E, simp_all add: field_simps norm_inverse norm_divide c)
     with c show ?thesis by (rule bigI)
   qed
   show "L F g \<subseteq> L F (\<lambda>x. f x + g x)" if "f \<in> o[F](g)" for f g :: "'a \<Rightarrow> 'b" and F
     using plus_aux that by (blast intro!: big_subsetI)
   show "L F (f) = L F (g)" if "eventually (\<lambda>x. f x = g x) F" for f g :: "'a \<Rightarrow> 'b" and F
     unfolding L_def by (subst eventually_subst'[OF that]) (rule refl)
   show "f \<in> L F (h) \<longleftrightarrow> g \<in> L F (h)" if "eventually (\<lambda>x. f x = g x) F"
     for f g h :: "'a \<Rightarrow> 'b" and F
     unfolding L_def mem_Collect_eq
     by (subst (1) eventually_subst'[OF that]) (rule refl)
   show "L F f \<subseteq> L F g" if "f \<in> L F g" for f g :: "'a \<Rightarrow> 'b" and F
     using that by (rule big_subsetI)
   show "L F (f) = L F (g)" if "f \<in> \<Theta>[F](g)" for f g :: "'a \<Rightarrow> 'b" and F
     using L that unfolding bigtheta_def
     by (intro equalityI big_subsetI) (auto simp: bigomega_iff_bigo)
   show "f \<in> L F (h) \<longleftrightarrow> g \<in> L F (h)" if "f \<in> \<Theta>[F](g)" for f g h :: "'a \<Rightarrow> 'b" and F
     by (rule disjE[OF L])
       (use that in \<open>auto simp: bigtheta_def bigomega_iff_bigo intro: landau_o.big_trans\<close>)
   show "(\<lambda>x. h x * f x) \<in> L F (\<lambda>x. h x * g x)" if "f \<in> L F g" for f g h :: "'a \<Rightarrow> 'b" and F
     using that by (intro big_mult) simp
   show "f \<in> L F (h)" if "f \<in> L F g" "g \<in> L F h" for f g h :: "'a \<Rightarrow> 'b" and F
     using that by (rule big_trans)
   show "(\<lambda>x. f (h x)) \<in> L' G (\<lambda>x. g (h x))"
     if "f \<in> L F g" and "filterlim h F G"
     for f g :: "'a \<Rightarrow> 'b" and h :: "'c \<Rightarrow> 'a" and F G
     using that by (auto simp: L_def L'_def filterlim_iff)
   show "f \<in> L (sup F G) g" if "f \<in> L F g" "f \<in> L G g"
     for f g :: "'a \<Rightarrow> 'b" and F G :: "'a filter"
   proof -
     from that [THEN bigE] obtain c1 c2
       where *: "c1 > 0" "c2 > 0"
         and **: "\<forall>\<^sub>F x in F. R (norm (f x)) (c1 * norm (g x))"
                 "\<forall>\<^sub>F x in G. R (norm (f x)) (c2 * norm (g x))" .
     define c where "c = (if R c1 c2 then c2 else c1)"
     from * have c: "R c1 c" "R c2 c" "c > 0"
       by (auto simp: c_def dest: R_linear)
     with ** have "eventually (\<lambda>x. R (norm (f x)) (c * norm (g x))) F"
                  "eventually (\<lambda>x. R (norm (f x)) (c * norm (g x))) G"
       by (force elim: eventually_mono intro: R_trans[OF _ R_mult_right_mono])+
     with c show "f \<in> L (sup F G) g"
       by (auto simp: L_def eventually_sup)
   qed
   show "((\<lambda>x. f (h x)) \<in> L' (filtercomap h F) (\<lambda>x. g (h x)))" if "(f \<in> L F g)"
     for f g :: "'a \<Rightarrow> 'b" and h :: "'c \<Rightarrow> 'a" and F G :: "'a filter"
     using that unfolding L_def L'_def by auto
 qed (auto simp: L_def Lr_def eventually_filtermap L'_def
           intro: filter_leD exI[of _ "1::real"])
 
 sublocale small: landau_symbol l l' lr
 proof
   have A: "(\<lambda>x. c * f x) \<in> L F f" if "c \<noteq> 0" for c :: 'b and f :: "'a \<Rightarrow> 'b" and F
     using that by (intro bigI[of "norm c"]) (simp_all add: norm_mult)
   show "l F (\<lambda>x. c * f x) = l F f" if "c \<noteq> 0" for c :: 'b and f :: "'a \<Rightarrow> 'b" and F
     using that and A[of c f] and A[of "inverse c" "\<lambda>x. c * f x"]
     by (intro equalityI small_subsetI) (simp_all add: field_simps)
   show "((\<lambda>x. c * f x) \<in> l F g) = (f \<in> l F g)" if "c \<noteq> 0" for c :: 'b and f g :: "'a \<Rightarrow> 'b" and F
   proof -
     from that and A[of c f] and A[of "inverse c" "\<lambda>x. c * f x"]
     have "(\<lambda>x. c * f x) \<in> L F f" "f \<in> L F (\<lambda>x. c * f x)"
       by (simp_all add: field_simps)
     then show ?thesis
       by (intro iffI) (erule (1) big_small_trans)+
   qed
   show "l F g \<subseteq> l F (\<lambda>x. f x + g x)" if "f \<in> o[F](g)" for f g :: "'a \<Rightarrow> 'b" and F
     using plus_aux that by (blast intro!: small_subsetI)
   show "(\<lambda>x. inverse (g x)) \<in> l F (\<lambda>x. inverse (f x))"
     if A: "f \<in> l F (g)" and B: "eventually (\<lambda>x. f x \<noteq> 0) F" "eventually (\<lambda>x. g x \<noteq> 0) F"
     for f g :: "'a \<Rightarrow> 'b" and F
   proof (rule smallI)
     fix c :: real assume c: "c > 0"
     from B smallD[OF A c]
     show "eventually (\<lambda>x. R (norm (inverse (g x))) (c * norm (inverse (f x)))) F"
       by eventually_elim (rule R_E, simp_all add: field_simps norm_inverse norm_divide)
   qed
   show "l F (f) = l F (g)" if "eventually (\<lambda>x. f x = g x) F" for f g :: "'a \<Rightarrow> 'b" and F
     unfolding l_def by (subst eventually_subst'[OF that]) (rule refl)
   show "f \<in> l F (h) \<longleftrightarrow> g \<in> l F (h)" if "eventually (\<lambda>x. f x = g x) F" for f g h :: "'a \<Rightarrow> 'b" and F
     unfolding l_def mem_Collect_eq by (subst (1) eventually_subst'[OF that]) (rule refl)
   show "l F f \<subseteq> l F g" if "f \<in> l F g" for f g :: "'a \<Rightarrow> 'b" and F
     using that by (intro small_subsetI small_imp_big)
   show "l F (f) = l F (g)" if "f \<in> \<Theta>[F](g)" for f g :: "'a \<Rightarrow> 'b" and F
   proof -
     have L: "L = bigo \<or> L = bigomega"
       by (rule R_E) (auto simp: bigo_def L_def bigomega_def fun_eq_iff)
     with that show ?thesis unfolding bigtheta_def
       by (intro equalityI small_subsetI) (auto simp: bigomega_iff_bigo)
   qed
   show "f \<in> l F (h) \<longleftrightarrow> g \<in> l F (h)" if "f \<in> \<Theta>[F](g)" for f g h :: "'a \<Rightarrow> 'b" and F
   proof -
     have l: "l = smallo \<or> l = smallomega"
       by (rule R_E) (auto simp: smallo_def l_def smallomega_def fun_eq_iff)
     show ?thesis
       by (rule disjE[OF l])
         (use that in \<open>auto simp: bigtheta_def bigomega_iff_bigo smallomega_iff_smallo
           intro: landau_o.big_small_trans landau_o.small_big_trans\<close>)
   qed
   show "(\<lambda>x. h x * f x) \<in> l F (\<lambda>x. h x * g x)" if "f \<in> l F g" for f g h :: "'a \<Rightarrow> 'b" and F
     using that by (intro big_small_mult) simp
   show "f \<in> l F (h)" if "f \<in> l F g" "g \<in> l F h" for f g h :: "'a \<Rightarrow> 'b" and F
     using that by (rule small_trans)
   show "(\<lambda>x. f (h x)) \<in> l' G (\<lambda>x. g (h x))" if "f \<in> l F g" and "filterlim h F G"
     for f g :: "'a \<Rightarrow> 'b" and h :: "'c \<Rightarrow> 'a" and F G
     using that by (auto simp: l_def l'_def filterlim_iff)
   show "((\<lambda>x. f (h x)) \<in> l' (filtercomap h F) (\<lambda>x. g (h x)))" if "f \<in> l F g"
     for f g :: "'a \<Rightarrow> 'b" and h :: "'c \<Rightarrow> 'a" and F G :: "'a filter"
     using that unfolding l_def l'_def by auto
 qed (auto simp: l_def lr_def eventually_filtermap l'_def eventually_sup intro: filter_leD)
 
 
 text \<open>These rules allow chaining of Landau symbol propositions in Isar with "also".\<close>
 
 lemma big_mult_1:    "f \<in> L F (g) \<Longrightarrow> (\<lambda>_. 1) \<in> L F (h) \<Longrightarrow> f \<in> L F (\<lambda>x. g x * h x)"
   and big_mult_1':   "(\<lambda>_. 1) \<in> L F (g) \<Longrightarrow> f \<in> L F (h) \<Longrightarrow> f \<in> L F (\<lambda>x. g x * h x)"
   and small_mult_1:  "f \<in> l F (g) \<Longrightarrow> (\<lambda>_. 1) \<in> L F (h) \<Longrightarrow> f \<in> l F (\<lambda>x. g x * h x)"
   and small_mult_1': "(\<lambda>_. 1) \<in> L F (g) \<Longrightarrow> f \<in> l F (h) \<Longrightarrow> f \<in> l F (\<lambda>x. g x * h x)"
   and small_mult_1'':  "f \<in> L F (g) \<Longrightarrow> (\<lambda>_. 1) \<in> l F (h) \<Longrightarrow> f \<in> l F (\<lambda>x. g x * h x)"
   and small_mult_1''': "(\<lambda>_. 1) \<in> l F (g) \<Longrightarrow> f \<in> L F (h) \<Longrightarrow> f \<in> l F (\<lambda>x. g x * h x)"
   by (drule (1) big.mult big_small_mult small_big_mult, simp)+
 
 lemma big_1_mult:    "f \<in> L F (g) \<Longrightarrow> h \<in> L F (\<lambda>_. 1) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> L F (g)"
   and big_1_mult':   "h \<in> L F (\<lambda>_. 1) \<Longrightarrow> f \<in> L F (g) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> L F (g)"
   and small_1_mult:  "f \<in> l F (g) \<Longrightarrow> h \<in> L F (\<lambda>_. 1) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> l F (g)"
   and small_1_mult': "h \<in> L F (\<lambda>_. 1) \<Longrightarrow> f \<in> l F (g) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> l F (g)"
   and small_1_mult'':  "f \<in> L F (g) \<Longrightarrow> h \<in> l F (\<lambda>_. 1) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> l F (g)"
   and small_1_mult''': "h \<in> l F (\<lambda>_. 1) \<Longrightarrow> f \<in> L F (g) \<Longrightarrow> (\<lambda>x. f x * h x) \<in> l F (g)"
   by (drule (1) big.mult big_small_mult small_big_mult, simp)+
 
 lemmas mult_1_trans =
   big_mult_1 big_mult_1' small_mult_1 small_mult_1' small_mult_1'' small_mult_1'''
   big_1_mult big_1_mult' small_1_mult small_1_mult' small_1_mult'' small_1_mult'''
 
 lemma big_equal_iff_bigtheta: "L F (f) = L F (g) \<longleftrightarrow> f \<in> \<Theta>[F](g)"
 proof
   have L: "L = bigo \<or> L = bigomega"
     by (rule R_E) (auto simp: fun_eq_iff L_def bigo_def bigomega_def)
   fix f g :: "'a \<Rightarrow> 'b" assume "L F (f) = L F (g)"
   with big_refl[of f F] big_refl[of g F] have "f \<in> L F (g)" "g \<in> L F (f)" by simp_all
   thus "f \<in> \<Theta>[F](g)" using L unfolding bigtheta_def by (auto simp: bigomega_iff_bigo)
 qed (rule big.cong_bigtheta)
 
 lemma big_prod:
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x \<in> L F (g x)"
   shows   "(\<lambda>y. \<Prod>x\<in>A. f x y) \<in> L F (\<lambda>y. \<Prod>x\<in>A. g x y)"
   using assms by (induction A rule: infinite_finite_induct) (auto intro!: big.mult)
 
 lemma big_prod_in_1:
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x \<in> L F (\<lambda>_. 1)"
   shows   "(\<lambda>y. \<Prod>x\<in>A. f x y) \<in> L F (\<lambda>_. 1)"
   using assms by (induction A rule: infinite_finite_induct) (auto intro!: big.mult_in_1)
 
 end
 
 
 context landau_symbol
 begin
 
 lemma plus_absorb1:
   assumes "f \<in> o[F](g)"
   shows   "L F (\<lambda>x. f x + g x) = L F (g)"
 proof (intro equalityI)
   from plus_subset1 and assms show "L F g \<subseteq> L F (\<lambda>x. f x + g x)" .
   from landau_o.small.plus_subset1[OF assms] and assms have "(\<lambda>x. -f x) \<in> o[F](\<lambda>x. f x + g x)"
     by (auto simp: landau_o.small.uminus_in_iff)
   from plus_subset1[OF this] show "L F (\<lambda>x. f x + g x) \<subseteq> L F (g)" by simp
 qed
 
 lemma plus_absorb2: "g \<in> o[F](f) \<Longrightarrow> L F (\<lambda>x. f x + g x) = L F (f)"
   using plus_absorb1[of g F f] by (simp add: add.commute)
 
 lemma diff_absorb1: "f \<in> o[F](g) \<Longrightarrow> L F (\<lambda>x. f x - g x) = L F (g)"
   by (simp only: diff_conv_add_uminus plus_absorb1 landau_o.small.uminus uminus)
 
 lemma diff_absorb2: "g \<in> o[F](f) \<Longrightarrow> L F (\<lambda>x. f x - g x) = L F (f)"
   by (simp only: diff_conv_add_uminus plus_absorb2 landau_o.small.uminus_in_iff)
 
 lemmas absorb = plus_absorb1 plus_absorb2 diff_absorb1 diff_absorb2
 
 end
 
 
 lemma bigthetaI [intro]: "f \<in> O[F](g) \<Longrightarrow> f \<in> \<Omega>[F](g) \<Longrightarrow> f \<in> \<Theta>[F](g)"
   unfolding bigtheta_def bigomega_def by blast
 
 lemma bigthetaD1 [dest]: "f \<in> \<Theta>[F](g) \<Longrightarrow> f \<in> O[F](g)"
   and bigthetaD2 [dest]: "f \<in> \<Theta>[F](g) \<Longrightarrow> f \<in> \<Omega>[F](g)"
   unfolding bigtheta_def bigo_def bigomega_def by blast+
 
 lemma bigtheta_refl [simp]: "f \<in> \<Theta>[F](f)"
   unfolding bigtheta_def by simp
 
 lemma bigtheta_sym: "f \<in> \<Theta>[F](g) \<longleftrightarrow> g \<in> \<Theta>[F](f)"
   unfolding bigtheta_def by (auto simp: bigomega_iff_bigo)
 
 lemmas landau_flip =
   bigomega_iff_bigo[symmetric] smallomega_iff_smallo[symmetric]
   bigomega_iff_bigo smallomega_iff_smallo bigtheta_sym
 
 
 interpretation landau_theta: landau_symbol bigtheta bigtheta bigtheta
 proof
   fix f g :: "'a \<Rightarrow> 'b" and F
   assume "f \<in> o[F](g)"
   hence "O[F](g) \<subseteq> O[F](\<lambda>x. f x + g x)" "\<Omega>[F](g) \<subseteq> \<Omega>[F](\<lambda>x. f x + g x)"
     by (rule landau_o.big.plus_subset1 landau_omega.big.plus_subset1)+
   thus "\<Theta>[F](g) \<subseteq> \<Theta>[F](\<lambda>x. f x + g x)" unfolding bigtheta_def by blast
 next
   fix f g :: "'a \<Rightarrow> 'b" and F
   assume "f \<in> \<Theta>[F](g)"
   thus A: "\<Theta>[F](f) = \<Theta>[F](g)"
     apply (subst (1 2) bigtheta_def)
     apply (subst landau_o.big.cong_bigtheta landau_omega.big.cong_bigtheta, assumption)+
     apply (rule refl)
     done
   thus "\<Theta>[F](f) \<subseteq> \<Theta>[F](g)" by simp
   fix h :: "'a \<Rightarrow> 'b"
   show "f \<in> \<Theta>[F](h) \<longleftrightarrow> g \<in> \<Theta>[F](h)" by (subst (1 2) bigtheta_sym) (simp add: A)
 next
   fix f g h :: "'a \<Rightarrow> 'b" and F
   assume "f \<in> \<Theta>[F](g)" "g \<in> \<Theta>[F](h)"
   thus "f \<in> \<Theta>[F](h)" unfolding bigtheta_def
     by (blast intro: landau_o.big.trans landau_omega.big.trans)
 next
   fix f :: "'a \<Rightarrow> 'b" and F1 F2 :: "'a filter"
   assume "F1 \<le> F2"
   thus "\<Theta>[F2](f) \<subseteq> \<Theta>[F1](f)"
     by (auto simp: bigtheta_def intro: landau_o.big.filter_mono landau_omega.big.filter_mono)
 qed (auto simp: bigtheta_def landau_o.big.norm_iff
                 landau_o.big.cmult landau_omega.big.cmult
                 landau_o.big.cmult_in_iff landau_omega.big.cmult_in_iff
                 landau_o.big.in_cong landau_omega.big.in_cong
                 landau_o.big.mult landau_omega.big.mult
                 landau_o.big.inverse landau_omega.big.inverse
                 landau_o.big.compose landau_omega.big.compose
                 landau_o.big.bot' landau_omega.big.bot'
                 landau_o.big.in_filtermap_iff landau_omega.big.in_filtermap_iff
                 landau_o.big.sup landau_omega.big.sup
                 landau_o.big.filtercomap landau_omega.big.filtercomap
           dest: landau_o.big.cong landau_omega.big.cong)
 
 lemmas landau_symbols =
   landau_o.big.landau_symbol_axioms landau_o.small.landau_symbol_axioms
   landau_omega.big.landau_symbol_axioms landau_omega.small.landau_symbol_axioms
   landau_theta.landau_symbol_axioms
 
 lemma bigoI [intro]:
   assumes "eventually (\<lambda>x. (norm (f x)) \<le> c * (norm (g x))) F"
   shows   "f \<in> O[F](g)"
 proof (rule landau_o.bigI)
   show "max 1 c > 0" by simp
   have "c * (norm (g x)) \<le> max 1 c * (norm (g x))" for x
     by (simp add: mult_right_mono)
   with assms show "eventually (\<lambda>x. (norm (f x)) \<le> max 1 c * (norm (g x))) F"
     by (auto elim!: eventually_mono dest: order.trans)
 qed
 
 lemma smallomegaD [dest]:
   assumes "f \<in> \<omega>[F](g)"
   shows   "eventually (\<lambda>x. (norm (f x)) \<ge> c * (norm (g x))) F"
 proof (cases "c > 0")
   case False
   show ?thesis
     by (intro always_eventually allI, rule order.trans[of _ 0])
        (insert False, auto intro!: mult_nonpos_nonneg)
 qed (blast dest: landau_omega.smallD[OF assms, of c])
 
 
 lemma bigthetaI':
   assumes "c1 > 0" "c2 > 0"
   assumes "eventually (\<lambda>x. c1 * (norm (g x)) \<le> (norm (f x)) \<and> (norm (f x)) \<le> c2 * (norm (g x))) F"
   shows   "f \<in> \<Theta>[F](g)"
 apply (rule bigthetaI)
 apply (rule landau_o.bigI[OF assms(2)]) using assms(3) apply (eventually_elim, simp)
 apply (rule landau_omega.bigI[OF assms(1)]) using assms(3) apply (eventually_elim, simp)
 done
 
 lemma bigthetaI_cong: "eventually (\<lambda>x. f x = g x) F \<Longrightarrow> f \<in> \<Theta>[F](g)"
   by (intro bigthetaI'[of 1 1]) (auto elim!: eventually_mono)
 
 lemma (in landau_symbol) ev_eq_trans1:
   "f \<in> L F (\<lambda>x. g x (h x)) \<Longrightarrow> eventually (\<lambda>x. h x = h' x) F \<Longrightarrow> f \<in> L F (\<lambda>x. g x (h' x))"
   by (rule bigtheta_trans1[OF _ bigthetaI_cong]) (auto elim!: eventually_mono)
 
 lemma (in landau_symbol) ev_eq_trans2:
   "eventually (\<lambda>x. f x = f' x) F \<Longrightarrow> (\<lambda>x. g x (f' x)) \<in> L F (h) \<Longrightarrow> (\<lambda>x. g x (f x)) \<in> L F (h)"
   by (rule bigtheta_trans2[OF bigthetaI_cong]) (auto elim!: eventually_mono)
 
 declare landau_o.smallI landau_omega.bigI landau_omega.smallI [intro]
 declare landau_o.bigE landau_omega.bigE [elim]
 declare landau_o.smallD
 
 lemma (in landau_symbol) bigtheta_trans1':
   "f \<in> L F (g) \<Longrightarrow> h \<in> \<Theta>[F](g) \<Longrightarrow> f \<in> L F (h)"
   by (subst cong_bigtheta[symmetric]) (simp add: bigtheta_sym)
 
 lemma (in landau_symbol) bigtheta_trans2':
   "g \<in> \<Theta>[F](f) \<Longrightarrow> g \<in> L F (h) \<Longrightarrow> f \<in> L F (h)"
   by (rule bigtheta_trans2, subst bigtheta_sym)
 
 lemma bigo_bigomega_trans:      "f \<in> O[F](g) \<Longrightarrow> h \<in> \<Omega>[F](g) \<Longrightarrow> f \<in> O[F](h)"
   and bigo_smallomega_trans:    "f \<in> O[F](g) \<Longrightarrow> h \<in> \<omega>[F](g) \<Longrightarrow> f \<in> o[F](h)"
   and smallo_bigomega_trans:    "f \<in> o[F](g) \<Longrightarrow> h \<in> \<Omega>[F](g) \<Longrightarrow> f \<in> o[F](h)"
   and smallo_smallomega_trans:  "f \<in> o[F](g) \<Longrightarrow> h \<in> \<omega>[F](g) \<Longrightarrow> f \<in> o[F](h)"
   and bigomega_bigo_trans:      "f \<in> \<Omega>[F](g) \<Longrightarrow> h \<in> O[F](g) \<Longrightarrow> f \<in> \<Omega>[F](h)"
   and bigomega_smallo_trans:    "f \<in> \<Omega>[F](g) \<Longrightarrow> h \<in> o[F](g) \<Longrightarrow> f \<in> \<omega>[F](h)"
   and smallomega_bigo_trans:    "f \<in> \<omega>[F](g) \<Longrightarrow> h \<in> O[F](g) \<Longrightarrow> f \<in> \<omega>[F](h)"
   and smallomega_smallo_trans:  "f \<in> \<omega>[F](g) \<Longrightarrow> h \<in> o[F](g) \<Longrightarrow> f \<in> \<omega>[F](h)"
   by (unfold bigomega_iff_bigo smallomega_iff_smallo)
      (erule (1) landau_o.big_trans landau_o.big_small_trans landau_o.small_big_trans
                 landau_o.big_trans landau_o.small_trans)+
 
 lemmas landau_trans_lift [trans] =
   landau_symbols[THEN landau_symbol.lift_trans]
   landau_symbols[THEN landau_symbol.lift_trans']
   landau_symbols[THEN landau_symbol.lift_trans_bigtheta]
   landau_symbols[THEN landau_symbol.lift_trans_bigtheta']
 
 lemmas landau_mult_1_trans [trans] =
   landau_o.mult_1_trans landau_omega.mult_1_trans
 
 lemmas landau_trans [trans] =
   landau_symbols[THEN landau_symbol.bigtheta_trans1]
   landau_symbols[THEN landau_symbol.bigtheta_trans2]
   landau_symbols[THEN landau_symbol.bigtheta_trans1']
   landau_symbols[THEN landau_symbol.bigtheta_trans2']
   landau_symbols[THEN landau_symbol.ev_eq_trans1]
   landau_symbols[THEN landau_symbol.ev_eq_trans2]
 
   landau_o.big_trans landau_o.small_trans landau_o.small_big_trans landau_o.big_small_trans
   landau_omega.big_trans landau_omega.small_trans
     landau_omega.small_big_trans landau_omega.big_small_trans
 
   bigo_bigomega_trans bigo_smallomega_trans smallo_bigomega_trans smallo_smallomega_trans
   bigomega_bigo_trans bigomega_smallo_trans smallomega_bigo_trans smallomega_smallo_trans
 
 lemma bigtheta_inverse [simp]:
   shows "(\<lambda>x. inverse (f x)) \<in> \<Theta>[F](\<lambda>x. inverse (g x)) \<longleftrightarrow> f \<in> \<Theta>[F](g)"
 proof -
   have "(\<lambda>x. inverse (f x)) \<in> O[F](\<lambda>x. inverse (g x))"
     if A: "f \<in> \<Theta>[F](g)"
     for f g :: "'a \<Rightarrow> 'b" and F
   proof -
     from A obtain c1 c2 :: real where *: "c1 > 0" "c2 > 0"
       and **: "\<forall>\<^sub>F x in F. norm (f x) \<le> c1 * norm (g x)"
               "\<forall>\<^sub>F x in F. c2 * norm (g x) \<le> norm (f x)"
       unfolding bigtheta_def by (elim landau_o.bigE landau_omega.bigE IntE)
     from \<open>c2 > 0\<close> have c2: "inverse c2 > 0" by simp
     from ** have "eventually (\<lambda>x. norm (inverse (f x)) \<le> inverse c2 * norm (inverse (g x))) F"
     proof eventually_elim
       fix x assume A: "norm (f x) \<le> c1 * norm (g x)" "c2 * norm (g x) \<le> norm (f x)"
       from A * have "f x = 0 \<longleftrightarrow> g x = 0"
         by (auto simp: field_simps mult_le_0_iff)
       with A * show "norm (inverse (f x)) \<le> inverse c2 * norm (inverse (g x))"
         by (force simp: field_simps norm_inverse norm_divide)
     qed
     with c2 show ?thesis by (rule landau_o.bigI)
   qed
   then show ?thesis
     unfolding bigtheta_def
     by (force simp: bigomega_iff_bigo bigtheta_sym)
 qed
 
 lemma bigtheta_divide:
   assumes "f1 \<in> \<Theta>(f2)" "g1 \<in> \<Theta>(g2)"
   shows   "(\<lambda>x. f1 x / g1 x) \<in> \<Theta>(\<lambda>x. f2 x / g2 x)"
   by (subst (1 2) divide_inverse, intro landau_theta.mult) (simp_all add: bigtheta_inverse assms)
 
 lemma eventually_nonzero_bigtheta:
   assumes "f \<in> \<Theta>[F](g)"
   shows   "eventually (\<lambda>x. f x \<noteq> 0) F \<longleftrightarrow> eventually (\<lambda>x. g x \<noteq> 0) F"
 proof -
   have "eventually (\<lambda>x. g x \<noteq> 0) F"
     if A: "f \<in> \<Theta>[F](g)" and B: "eventually (\<lambda>x. f x \<noteq> 0) F"
     for f g :: "'a \<Rightarrow> 'b"
   proof -
     from A obtain c1 c2 where
       "\<forall>\<^sub>F x in F. norm (f x) \<le> c1 * norm (g x)"
       "\<forall>\<^sub>F x in F. c2 * norm (g x) \<le> norm (f x)"
       unfolding bigtheta_def by (elim landau_o.bigE landau_omega.bigE IntE)
     with B show ?thesis by eventually_elim auto
   qed
   with assms show ?thesis by (force simp: bigtheta_sym)
 qed
 
 
 subsection \<open>Landau symbols and limits\<close>
 
 lemma bigoI_tendsto_norm:
   fixes f g
   assumes "((\<lambda>x. norm (f x / g x)) \<longlongrightarrow> c) F"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "f \<in> O[F](g)"
 proof (rule bigoI)
   from assms have "eventually (\<lambda>x. dist (norm (f x / g x)) c < 1) F"
     using tendstoD by force
   thus "eventually (\<lambda>x. (norm (f x)) \<le> (norm c + 1) * (norm (g x))) F"
     unfolding dist_real_def using assms(2)
   proof eventually_elim
     case (elim x)
     have "(norm (f x)) - norm c * (norm (g x)) \<le> norm ((norm (f x)) - c * (norm (g x)))"
       unfolding norm_mult [symmetric] using norm_triangle_ineq2[of "norm (f x)" "c * norm (g x)"]
       by (simp add: norm_mult abs_mult)
     also from elim have "\<dots> = norm (norm (g x)) * norm (norm (f x / g x) - c)"
       unfolding norm_mult [symmetric] by (simp add: algebra_simps norm_divide)
     also from elim have "norm (norm (f x / g x) - c) \<le> 1" by simp
     hence "norm (norm (g x)) * norm (norm (f x / g x) - c) \<le> norm (norm (g x)) * 1"
       by (rule mult_left_mono) simp_all
     finally show ?case by (simp add: algebra_simps)
   qed
 qed
 
 lemma bigoI_tendsto:
   assumes "((\<lambda>x. f x / g x) \<longlongrightarrow> c) F"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "f \<in> O[F](g)"
   using assms by (rule bigoI_tendsto_norm[OF tendsto_norm])
 
 lemma bigomegaI_tendsto_norm:
   assumes c_not_0:  "(c::real) \<noteq> 0"
   assumes lim:      "((\<lambda>x. norm (f x / g x)) \<longlongrightarrow> c) F"
   shows   "f \<in> \<Omega>[F](g)"
 proof (cases "F = bot")
   case False
   show ?thesis
   proof (rule landau_omega.bigI)
     from lim  have "c \<ge> 0" by (rule tendsto_lowerbound) (insert False, simp_all)
     with c_not_0 have "c > 0" by simp
     with c_not_0 show "c/2 > 0" by simp
     from lim have ev: "\<And>\<epsilon>. \<epsilon> > 0 \<Longrightarrow> eventually (\<lambda>x. norm (norm (f x / g x) - c) < \<epsilon>) F"
       by (subst (asm) tendsto_iff) (simp add: dist_real_def)
     from ev[OF \<open>c/2 > 0\<close>] show "eventually (\<lambda>x. (norm (f x)) \<ge> c/2 * (norm (g x))) F"
     proof (eventually_elim)
       fix x assume B: "norm (norm (f x / g x) - c) < c / 2"
       from B have g: "g x \<noteq> 0" by auto
       from B have "-c/2 < -norm (norm (f x / g x) - c)" by simp
       also have "... \<le> norm (f x / g x) - c" by simp
       finally show "(norm (f x)) \<ge> c/2 * (norm (g x))" using g
         by (simp add: field_simps norm_mult norm_divide)
     qed
   qed
 qed simp
 
 lemma bigomegaI_tendsto:
   assumes c_not_0:  "(c::real) \<noteq> 0"
   assumes lim:      "((\<lambda>x. f x / g x) \<longlongrightarrow> c) F"
   shows   "f \<in> \<Omega>[F](g)"
   by (rule bigomegaI_tendsto_norm[OF _ tendsto_norm, of c]) (insert assms, simp_all)
 
 lemma smallomegaI_filterlim_at_top_norm:
   assumes lim: "filterlim (\<lambda>x. norm (f x / g x)) at_top F"
   shows   "f \<in> \<omega>[F](g)"
 proof (rule landau_omega.smallI)
   fix c :: real assume c_pos: "c > 0"
   from lim have ev: "eventually (\<lambda>x. norm (f x / g x) \<ge> c) F"
     by (subst (asm) filterlim_at_top) simp
   thus "eventually (\<lambda>x. (norm (f x)) \<ge> c * (norm (g x))) F"
   proof eventually_elim
     fix x assume A: "norm (f x / g x) \<ge> c"
     from A c_pos have "g x \<noteq> 0" by auto
     with A show "(norm (f x)) \<ge> c * (norm (g x))" by (simp add: field_simps norm_divide)
   qed
 qed
 
 lemma smallomegaI_filterlim_at_infinity:
   assumes lim: "filterlim (\<lambda>x. f x / g x) at_infinity F"
   shows   "f \<in> \<omega>[F](g)"
 proof (rule smallomegaI_filterlim_at_top_norm)
   from lim show "filterlim (\<lambda>x. norm (f x / g x)) at_top F"
     by (rule filterlim_at_infinity_imp_norm_at_top)
 qed
 
 lemma smallomegaD_filterlim_at_top_norm:
   assumes "f \<in> \<omega>[F](g)"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "LIM x F. norm (f x / g x) :> at_top"
 proof (subst filterlim_at_top_gt, clarify)
   fix c :: real assume c: "c > 0"
   from landau_omega.smallD[OF assms(1) this] assms(2)
     show "eventually (\<lambda>x. norm (f x / g x) \<ge> c) F"
     by eventually_elim (simp add: field_simps norm_divide)
 qed
 
 lemma smallomegaD_filterlim_at_infinity:
   assumes "f \<in> \<omega>[F](g)"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "LIM x F. f x / g x :> at_infinity"
   using assms by (intro filterlim_norm_at_top_imp_at_infinity smallomegaD_filterlim_at_top_norm)
 
 lemma smallomega_1_conv_filterlim: "f \<in> \<omega>[F](\<lambda>_. 1) \<longleftrightarrow> filterlim f at_infinity F"
   by (auto intro: smallomegaI_filterlim_at_infinity dest: smallomegaD_filterlim_at_infinity)
 
 lemma smalloI_tendsto:
   assumes lim: "((\<lambda>x. f x / g x) \<longlongrightarrow> 0) F"
   assumes "eventually (\<lambda>x. g x \<noteq> 0) F"
   shows   "f \<in> o[F](g)"
 proof (rule landau_o.smallI)
   fix c :: real assume c_pos: "c > 0"
   from c_pos and lim have ev: "eventually (\<lambda>x. norm (f x / g x) < c) F"
     by (subst (asm) tendsto_iff) (simp add: dist_real_def)
   with assms(2) show "eventually (\<lambda>x. (norm (f x)) \<le> c * (norm (g x))) F"
     by eventually_elim (simp add: field_simps norm_divide)
 qed
 
 lemma smalloD_tendsto:
   assumes "f \<in> o[F](g)"
   shows   "((\<lambda>x. f x / g x) \<longlongrightarrow> 0) F"
 unfolding tendsto_iff
 proof clarify
   fix e :: real assume e: "e > 0"
   hence "e/2 > 0" by simp
   from landau_o.smallD[OF assms this] show "eventually (\<lambda>x. dist (f x / g x) 0 < e) F"
   proof eventually_elim
     fix x assume "(norm (f x)) \<le> e/2 * (norm (g x))"
     with e have "dist (f x / g x) 0 \<le> e/2"
       by (cases "g x = 0") (simp_all add: dist_real_def norm_divide field_simps)
     also from e have "... < e" by simp
     finally show "dist (f x / g x) 0 < e" by simp
   qed
 qed
 
 lemma bigthetaI_tendsto_norm:
   assumes c_not_0: "(c::real) \<noteq> 0"
   assumes lim:     "((\<lambda>x. norm (f x / g x)) \<longlongrightarrow> c) F"
   shows   "f \<in> \<Theta>[F](g)"
 proof (rule bigthetaI)
   from c_not_0 have "\<bar>c\<bar> > 0" by simp
   with lim have "eventually (\<lambda>x. norm (norm (f x / g x) - c) < \<bar>c\<bar>) F"
     by (subst (asm) tendsto_iff) (simp add: dist_real_def)
   hence g: "eventually (\<lambda>x. g x \<noteq> 0) F" by eventually_elim (auto simp add: field_simps)
 
   from lim g show "f \<in> O[F](g)" by (rule bigoI_tendsto_norm)
   from c_not_0 and lim show "f \<in> \<Omega>[F](g)" by (rule bigomegaI_tendsto_norm)
 qed
 
 lemma bigthetaI_tendsto:
   assumes c_not_0: "(c::real) \<noteq> 0"
   assumes lim:     "((\<lambda>x. f x / g x) \<longlongrightarrow> c) F"
   shows   "f \<in> \<Theta>[F](g)"
   using assms by (intro bigthetaI_tendsto_norm[OF _ tendsto_norm, of "c"]) simp_all
 
 lemma tendsto_add_smallo:
   assumes "(f1 \<longlongrightarrow> a) F"
   assumes "f2 \<in> o[F](f1)"
   shows   "((\<lambda>x. f1 x + f2 x) \<longlongrightarrow> a) F"
 proof (subst filterlim_cong[OF refl refl])
   from landau_o.smallD[OF assms(2) zero_less_one]
     have "eventually (\<lambda>x. norm (f2 x) \<le> norm (f1 x)) F" by simp
   thus "eventually (\<lambda>x. f1 x + f2 x = f1 x * (1 + f2 x / f1 x)) F"
     by eventually_elim (auto simp: field_simps)
 next
   from assms(1) show "((\<lambda>x. f1 x * (1 + f2 x / f1 x)) \<longlongrightarrow> a) F"
     by (force intro: tendsto_eq_intros smalloD_tendsto[OF assms(2)])
 qed
 
 lemma tendsto_diff_smallo:
   shows "(f1 \<longlongrightarrow> a) F \<Longrightarrow> f2 \<in> o[F](f1) \<Longrightarrow> ((\<lambda>x. f1 x - f2 x) \<longlongrightarrow> a) F"
   using tendsto_add_smallo[of f1 a F "\<lambda>x. -f2 x"] by simp
 
 lemma tendsto_add_smallo_iff:
   assumes "f2 \<in> o[F](f1)"
   shows   "(f1 \<longlongrightarrow> a) F \<longleftrightarrow> ((\<lambda>x. f1 x + f2 x) \<longlongrightarrow> a) F"
 proof
   assume "((\<lambda>x. f1 x + f2 x) \<longlongrightarrow> a) F"
   hence "((\<lambda>x. f1 x + f2 x - f2 x) \<longlongrightarrow> a) F"
     by (rule tendsto_diff_smallo) (simp add: landau_o.small.plus_absorb2 assms)
   thus "(f1 \<longlongrightarrow> a) F" by simp
 qed (rule tendsto_add_smallo[OF _ assms])
 
 lemma tendsto_diff_smallo_iff:
   shows "f2 \<in> o[F](f1) \<Longrightarrow> (f1 \<longlongrightarrow> a) F \<longleftrightarrow> ((\<lambda>x. f1 x - f2 x) \<longlongrightarrow> a) F"
   using tendsto_add_smallo_iff[of "\<lambda>x. -f2 x" F f1 a] by simp
 
 lemma tendsto_divide_smallo:
   assumes "((\<lambda>x. f1 x / g1 x) \<longlongrightarrow> a) F"
   assumes "f2 \<in> o[F](f1)" "g2 \<in> o[F](g1)"
   assumes "eventually (\<lambda>x. g1 x \<noteq> 0) F"
   shows   "((\<lambda>x. (f1 x + f2 x) / (g1 x + g2 x)) \<longlongrightarrow> a) F" (is "(?f \<longlongrightarrow> _) _")
 proof (subst tendsto_cong)
   let ?f' = "\<lambda>x. (f1 x / g1 x) * (1 + f2 x / f1 x) / (1 + g2 x / g1 x)"
 
   have "(?f' \<longlongrightarrow> a * (1 + 0) / (1 + 0)) F"
   by (rule tendsto_mult tendsto_divide tendsto_add assms tendsto_const
         smalloD_tendsto[OF assms(2)] smalloD_tendsto[OF assms(3)])+ simp_all
   thus "(?f' \<longlongrightarrow> a) F" by simp
 
   have "(1/2::real) > 0" by simp
   from landau_o.smallD[OF assms(2) this] landau_o.smallD[OF assms(3) this]
     have "eventually (\<lambda>x. norm (f2 x) \<le> norm (f1 x)/2) F"
          "eventually (\<lambda>x. norm (g2 x) \<le> norm (g1 x)/2) F" by simp_all
   with assms(4) show "eventually (\<lambda>x. ?f x = ?f' x) F"
   proof eventually_elim
     fix x assume A: "norm (f2 x) \<le> norm (f1 x)/2" and
                  B: "norm (g2 x) \<le> norm (g1 x)/2" and C: "g1 x \<noteq> 0"
     show "?f x = ?f' x"
     proof (cases "f1 x = 0")
       assume D: "f1 x \<noteq> 0"
       from D have "f1 x + f2 x = f1 x * (1 + f2 x/f1 x)" by (simp add: field_simps)
       moreover from C have "g1 x + g2 x = g1 x * (1 + g2 x/g1 x)" by (simp add: field_simps)
       ultimately have "?f x = (f1 x * (1 + f2 x/f1 x)) / (g1 x * (1 + g2 x/g1 x))" by (simp only:)
       also have "... = ?f' x" by simp
       finally show ?thesis .
     qed (insert A, simp)
   qed
 qed
 
 
 lemma bigo_powr:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f \<in> O[F](g)" "p \<ge> 0"
   shows   "(\<lambda>x. \<bar>f x\<bar> powr p) \<in> O[F](\<lambda>x. \<bar>g x\<bar> powr p)"
 proof-
   from assms(1) obtain c where c: "c > 0" and *: "\<forall>\<^sub>F x in F. norm (f x) \<le> c * norm (g x)"
     by (elim landau_o.bigE landau_omega.bigE IntE)
   from assms(2) * have "eventually (\<lambda>x. (norm (f x)) powr p \<le> (c * norm (g x)) powr p) F"
     by (auto elim!: eventually_mono intro!: powr_mono2)
   with c show "(\<lambda>x. \<bar>f x\<bar> powr p) \<in> O[F](\<lambda>x. \<bar>g x\<bar> powr p)"
     by (intro bigoI[of _ "c powr p"]) (simp_all add: powr_mult)
 qed
 
 lemma smallo_powr:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f \<in> o[F](g)" "p > 0"
   shows   "(\<lambda>x. \<bar>f x\<bar> powr p) \<in> o[F](\<lambda>x. \<bar>g x\<bar> powr p)"
 proof (rule landau_o.smallI)
   fix c :: real assume c: "c > 0"
   hence "c powr (1/p) > 0" by simp
   from landau_o.smallD[OF assms(1) this]
   show "eventually (\<lambda>x. norm (\<bar>f x\<bar> powr p) \<le> c * norm (\<bar>g x\<bar> powr p)) F"
   proof eventually_elim
     fix x assume "(norm (f x)) \<le> c powr (1 / p) * (norm (g x))"
     with assms(2) have "(norm (f x)) powr p \<le> (c powr (1 / p) * (norm (g x))) powr p"
       by (intro powr_mono2) simp_all
     also from assms(2) c have "... = c * (norm (g x)) powr p"
       by (simp add: field_simps powr_mult powr_powr)
     finally show "norm (\<bar>f x\<bar> powr p) \<le> c * norm (\<bar>g x\<bar> powr p)" by simp
   qed
 qed
 
 lemma smallo_powr_nonneg:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f \<in> o[F](g)" "p > 0" "eventually (\<lambda>x. f x \<ge> 0) F" "eventually (\<lambda>x. g x \<ge> 0) F"
   shows   "(\<lambda>x. f x powr p) \<in> o[F](\<lambda>x. g x powr p)"
 proof -
   from assms(3) have "(\<lambda>x. f x powr p) \<in> \<Theta>[F](\<lambda>x. \<bar>f x\<bar> powr p)"
     by (intro bigthetaI_cong) (auto elim!: eventually_mono)
   also have "(\<lambda>x. \<bar>f x\<bar> powr p) \<in> o[F](\<lambda>x. \<bar>g x\<bar> powr p)" by (intro smallo_powr) fact+
   also from assms(4) have "(\<lambda>x. \<bar>g x\<bar> powr p) \<in> \<Theta>[F](\<lambda>x. g x powr p)"
     by (intro bigthetaI_cong) (auto elim!: eventually_mono)
   finally show ?thesis .
 qed
 
 lemma bigtheta_powr:
   fixes f :: "'a \<Rightarrow> real"
   shows "f \<in> \<Theta>[F](g) \<Longrightarrow> (\<lambda>x. \<bar>f x\<bar> powr p) \<in> \<Theta>[F](\<lambda>x. \<bar>g x\<bar> powr p)"
 apply (cases "p < 0")
 apply (subst bigtheta_inverse[symmetric], subst (1 2) powr_minus[symmetric])
 unfolding bigtheta_def apply (auto simp: bigomega_iff_bigo intro!: bigo_powr)
 done
 
 lemma bigo_powr_nonneg:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f \<in> O[F](g)" "p \<ge> 0" "eventually (\<lambda>x. f x \<ge> 0) F" "eventually (\<lambda>x. g x \<ge> 0) F"
   shows   "(\<lambda>x. f x powr p) \<in> O[F](\<lambda>x. g x powr p)"
 proof -
   from assms(3) have "(\<lambda>x. f x powr p) \<in> \<Theta>[F](\<lambda>x. \<bar>f x\<bar> powr p)"
     by (intro bigthetaI_cong) (auto elim!: eventually_mono)
   also have "(\<lambda>x. \<bar>f x\<bar> powr p) \<in> O[F](\<lambda>x. \<bar>g x\<bar> powr p)" by (intro bigo_powr) fact+
   also from assms(4) have "(\<lambda>x. \<bar>g x\<bar> powr p) \<in> \<Theta>[F](\<lambda>x. g x powr p)"
     by (intro bigthetaI_cong) (auto elim!: eventually_mono)
   finally show ?thesis .
 qed
 
 lemma zero_in_smallo [simp]: "(\<lambda>_. 0) \<in> o[F](f)"
   by (intro landau_o.smallI) simp_all
 
 lemma zero_in_bigo [simp]: "(\<lambda>_. 0) \<in> O[F](f)"
   by (intro landau_o.bigI[of 1]) simp_all
 
 lemma in_bigomega_zero [simp]: "f \<in> \<Omega>[F](\<lambda>x. 0)"
   by (rule landau_omega.bigI[of 1]) simp_all
 
 lemma in_smallomega_zero [simp]: "f \<in> \<omega>[F](\<lambda>x. 0)"
   by (simp add: smallomega_iff_smallo)
 
 
 lemma in_smallo_zero_iff [simp]: "f \<in> o[F](\<lambda>_. 0) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
 proof
   assume "f \<in> o[F](\<lambda>_. 0)"
   from landau_o.smallD[OF this, of 1] show "eventually (\<lambda>x. f x = 0) F" by simp
 next
   assume "eventually (\<lambda>x. f x = 0) F"
   hence "\<forall>c>0. eventually (\<lambda>x. (norm (f x)) \<le> c * \<bar>0\<bar>) F" by simp
   thus "f \<in> o[F](\<lambda>_. 0)" unfolding smallo_def by simp
 qed
 
 lemma in_bigo_zero_iff [simp]: "f \<in> O[F](\<lambda>_. 0) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
 proof
   assume "f \<in> O[F](\<lambda>_. 0)"
   thus "eventually (\<lambda>x. f x = 0) F" by (elim landau_o.bigE) simp
 next
   assume "eventually (\<lambda>x. f x = 0) F"
   hence "eventually (\<lambda>x. (norm (f x)) \<le> 1 * \<bar>0\<bar>) F" by simp
   thus "f \<in> O[F](\<lambda>_. 0)" by (intro landau_o.bigI[of 1]) simp_all
 qed
 
 lemma zero_in_smallomega_iff [simp]: "(\<lambda>_. 0) \<in> \<omega>[F](f) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
   by (simp add: smallomega_iff_smallo)
 
 lemma zero_in_bigomega_iff [simp]: "(\<lambda>_. 0) \<in> \<Omega>[F](f) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
   by (simp add: bigomega_iff_bigo)
 
 lemma zero_in_bigtheta_iff [simp]: "(\<lambda>_. 0) \<in> \<Theta>[F](f) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
   unfolding bigtheta_def by simp
 
 lemma in_bigtheta_zero_iff [simp]: "f \<in> \<Theta>[F](\<lambda>x. 0) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
   unfolding bigtheta_def by simp
 
 
 lemma cmult_in_bigo_iff    [simp]:  "(\<lambda>x. c * f x) \<in> O[F](g) \<longleftrightarrow> c = 0 \<or> f \<in> O[F](g)"
   and cmult_in_bigo_iff'   [simp]:  "(\<lambda>x. f x * c) \<in> O[F](g) \<longleftrightarrow> c = 0 \<or> f \<in> O[F](g)"
   and cmult_in_smallo_iff  [simp]:  "(\<lambda>x. c * f x) \<in> o[F](g) \<longleftrightarrow> c = 0 \<or> f \<in> o[F](g)"
   and cmult_in_smallo_iff' [simp]: "(\<lambda>x. f x * c) \<in> o[F](g) \<longleftrightarrow> c = 0 \<or> f \<in> o[F](g)"
   by (cases "c = 0", simp, simp)+
 
 lemma bigo_const [simp]: "(\<lambda>_. c) \<in> O[F](\<lambda>_. 1)" by (rule bigoI[of _ "norm c"]) simp
 
 lemma bigo_const_iff [simp]: "(\<lambda>_. c1) \<in> O[F](\<lambda>_. c2) \<longleftrightarrow> F = bot \<or> c1 = 0 \<or> c2 \<noteq> 0"
   by (cases "c1 = 0"; cases "c2 = 0")
      (auto simp: bigo_def eventually_False intro: exI[of _ 1] exI[of _ "norm c1 / norm c2"])
 
 lemma bigomega_const_iff [simp]: "(\<lambda>_. c1) \<in> \<Omega>[F](\<lambda>_. c2) \<longleftrightarrow> F = bot \<or> c1 \<noteq> 0 \<or> c2 = 0"
   by (cases "c1 = 0"; cases "c2 = 0")
      (auto simp: bigomega_def eventually_False mult_le_0_iff
            intro: exI[of _ 1] exI[of _ "norm c1 / norm c2"])
 
 lemma smallo_real_nat_transfer:
   "(f :: real \<Rightarrow> real) \<in> o(g) \<Longrightarrow> (\<lambda>x::nat. f (real x)) \<in> o(\<lambda>x. g (real x))"
   by (rule landau_o.small.compose[OF _ filterlim_real_sequentially])
 
 lemma bigo_real_nat_transfer:
   "(f :: real \<Rightarrow> real) \<in> O(g) \<Longrightarrow> (\<lambda>x::nat. f (real x)) \<in> O(\<lambda>x. g (real x))"
   by (rule landau_o.big.compose[OF _ filterlim_real_sequentially])
 
 lemma smallomega_real_nat_transfer:
   "(f :: real \<Rightarrow> real) \<in> \<omega>(g) \<Longrightarrow> (\<lambda>x::nat. f (real x)) \<in> \<omega>(\<lambda>x. g (real x))"
   by (rule landau_omega.small.compose[OF _ filterlim_real_sequentially])
 
 lemma bigomega_real_nat_transfer:
   "(f :: real \<Rightarrow> real) \<in> \<Omega>(g) \<Longrightarrow> (\<lambda>x::nat. f (real x)) \<in> \<Omega>(\<lambda>x. g (real x))"
   by (rule landau_omega.big.compose[OF _ filterlim_real_sequentially])
 
 lemma bigtheta_real_nat_transfer:
   "(f :: real \<Rightarrow> real) \<in> \<Theta>(g) \<Longrightarrow> (\<lambda>x::nat. f (real x)) \<in> \<Theta>(\<lambda>x. g (real x))"
   unfolding bigtheta_def using bigo_real_nat_transfer bigomega_real_nat_transfer by blast
 
 lemmas landau_real_nat_transfer [intro] =
   bigo_real_nat_transfer smallo_real_nat_transfer bigomega_real_nat_transfer
   smallomega_real_nat_transfer bigtheta_real_nat_transfer
 
 
 lemma landau_symbol_if_at_top_eq [simp]:
   assumes "landau_symbol L L' Lr"
   shows   "L at_top (\<lambda>x::'a::linordered_semidom. if x = a then f x else g x) = L at_top (g)"
 apply (rule landau_symbol.cong[OF assms])
 using less_add_one[of a] apply (auto intro: eventually_mono  eventually_ge_at_top[of "a + 1"])
 done
 
 lemmas landau_symbols_if_at_top_eq [simp] = landau_symbols[THEN landau_symbol_if_at_top_eq]
 
 
 
 lemma sum_in_smallo:
   assumes "f \<in> o[F](h)" "g \<in> o[F](h)"
   shows   "(\<lambda>x. f x + g x) \<in> o[F](h)" "(\<lambda>x. f x - g x) \<in> o[F](h)"
 proof -
   have "(\<lambda>x. f x + g x) \<in> o[F](h)" if "f \<in> o[F](h)" "g \<in> o[F](h)" for f g
   proof (rule landau_o.smallI)
     fix c :: real assume "c > 0"
     hence "c/2 > 0" by simp
     from that[THEN landau_o.smallD[OF _ this]]
     show "eventually (\<lambda>x. norm (f x + g x) \<le> c * (norm (h x))) F"
       by eventually_elim (auto intro: order.trans[OF norm_triangle_ineq])
   qed
   from this[of f g] this[of f "\<lambda>x. -g x"] assms
     show "(\<lambda>x. f x + g x) \<in> o[F](h)" "(\<lambda>x. f x - g x) \<in> o[F](h)" by simp_all
 qed
 
 lemma big_sum_in_smallo:
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x \<in> o[F](g)"
   shows   "(\<lambda>x. sum (\<lambda>y. f y x) A) \<in> o[F](g)"
   using assms by (induction A rule: infinite_finite_induct) (auto intro: sum_in_smallo)
 
 lemma sum_in_bigo:
   assumes "f \<in> O[F](h)" "g \<in> O[F](h)"
   shows   "(\<lambda>x. f x + g x) \<in> O[F](h)" "(\<lambda>x. f x - g x) \<in> O[F](h)"
 proof -
   have "(\<lambda>x. f x + g x) \<in> O[F](h)" if "f \<in> O[F](h)" "g \<in> O[F](h)" for f g
   proof -
     from that obtain c1 c2 where *: "c1 > 0" "c2 > 0"
       and **: "\<forall>\<^sub>F x in F. norm (f x) \<le> c1 * norm (h x)"
               "\<forall>\<^sub>F x in F. norm (g x) \<le> c2 * norm (h x)"
       by (elim landau_o.bigE)
     from ** have "eventually (\<lambda>x. norm (f x + g x) \<le> (c1 + c2) * (norm (h x))) F"
       by eventually_elim (auto simp: algebra_simps intro: order.trans[OF norm_triangle_ineq])
     then show ?thesis by (rule bigoI)
   qed
   from assms this[of f g] this[of f "\<lambda>x. - g x"]
   show "(\<lambda>x. f x + g x) \<in> O[F](h)" "(\<lambda>x. f x - g x) \<in> O[F](h)" by simp_all
 qed
 
 lemma big_sum_in_bigo:
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x \<in> O[F](g)"
   shows   "(\<lambda>x. sum (\<lambda>y. f y x) A) \<in> O[F](g)"
   using assms by (induction A rule: infinite_finite_induct) (auto intro: sum_in_bigo)
 
 context landau_symbol
 begin
 
 lemma mult_cancel_left:
   assumes "f1 \<in> \<Theta>[F](g1)" and "eventually (\<lambda>x. g1 x \<noteq> 0) F"
   notes   [trans] = bigtheta_trans1 bigtheta_trans2
   shows   "(\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. g1 x * g2 x) \<longleftrightarrow> f2 \<in> L F (g2)"
 proof
   assume A: "(\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. g1 x * g2 x)"
   from assms have nz: "eventually (\<lambda>x. f1 x \<noteq> 0) F" by (simp add: eventually_nonzero_bigtheta)
   hence "f2 \<in> \<Theta>[F](\<lambda>x. f1 x * f2 x / f1 x)"
     by (intro bigthetaI_cong) (auto elim!: eventually_mono)
   also from A assms nz have "(\<lambda>x. f1 x * f2 x / f1 x) \<in> L F (\<lambda>x. g1 x * g2 x / f1 x)"
     by (intro divide_right) simp_all
   also from assms nz have "(\<lambda>x. g1 x * g2 x / f1 x) \<in> \<Theta>[F](\<lambda>x. g1 x * g2 x / g1 x)"
     by (intro landau_theta.mult landau_theta.divide) (simp_all add: bigtheta_sym)
   also from assms have "(\<lambda>x. g1 x * g2 x / g1 x) \<in> \<Theta>[F](g2)"
     by (intro bigthetaI_cong) (auto elim!: eventually_mono)
   finally show "f2 \<in> L F (g2)" .
 next
   assume "f2 \<in> L F (g2)"
   hence "(\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. f1 x * g2 x)" by (rule mult_left)
   also have "(\<lambda>x. f1 x * g2 x) \<in> \<Theta>[F](\<lambda>x. g1 x * g2 x)"
     by (intro landau_theta.mult_right assms)
   finally show "(\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. g1 x * g2 x)" .
 qed
 
 lemma mult_cancel_right:
   assumes "f2 \<in> \<Theta>[F](g2)" and "eventually (\<lambda>x. g2 x \<noteq> 0) F"
   shows   "(\<lambda>x. f1 x * f2 x) \<in> L F (\<lambda>x. g1 x * g2 x) \<longleftrightarrow> f1 \<in> L F (g1)"
   by (subst (1 2) mult.commute) (rule mult_cancel_left[OF assms])
 
 lemma divide_cancel_right:
   assumes "f2 \<in> \<Theta>[F](g2)" and "eventually (\<lambda>x. g2 x \<noteq> 0) F"
   shows   "(\<lambda>x. f1 x / f2 x) \<in> L F (\<lambda>x. g1 x / g2 x) \<longleftrightarrow> f1 \<in> L F (g1)"
   by (subst (1 2) divide_inverse, intro mult_cancel_right bigtheta_inverse) (simp_all add: assms)
 
 lemma divide_cancel_left:
   assumes "f1 \<in> \<Theta>[F](g1)" and "eventually (\<lambda>x. g1 x \<noteq> 0) F"
   shows   "(\<lambda>x. f1 x / f2 x) \<in> L F (\<lambda>x. g1 x / g2 x) \<longleftrightarrow>
              (\<lambda>x. inverse (f2 x)) \<in> L F (\<lambda>x. inverse (g2 x))"
   by (simp only: divide_inverse mult_cancel_left[OF assms])
 
 end
 
 
 lemma powr_smallo_iff:
   assumes "filterlim g at_top F" "F \<noteq> bot"
   shows   "(\<lambda>x. g x powr p :: real) \<in> o[F](\<lambda>x. g x powr q) \<longleftrightarrow> p < q"
 proof-
   from assms have "eventually (\<lambda>x. g x \<ge> 1) F" by (force simp: filterlim_at_top)
   hence A: "eventually (\<lambda>x. g x \<noteq> 0) F" by eventually_elim simp
   have B: "(\<lambda>x. g x powr q) \<in> O[F](\<lambda>x. g x powr p) \<Longrightarrow> (\<lambda>x. g x powr p) \<notin> o[F](\<lambda>x. g x powr q)"
   proof
     assume "(\<lambda>x. g x powr q) \<in> O[F](\<lambda>x. g x powr p)" "(\<lambda>x. g x powr p) \<in> o[F](\<lambda>x. g x powr q)"
     from landau_o.big_small_asymmetric[OF this] have "eventually (\<lambda>x. g x = 0) F" by simp
     with A have "eventually (\<lambda>_::'a. False) F" by eventually_elim simp
     thus False by (simp add: eventually_False assms)
   qed
   show ?thesis
   proof (cases p q rule: linorder_cases)
     assume "p < q"
     hence "(\<lambda>x. g x powr p) \<in> o[F](\<lambda>x. g x powr q)" using assms A
       by (auto intro!: smalloI_tendsto tendsto_neg_powr simp flip: powr_diff)
     with \<open>p < q\<close> show ?thesis by auto
   next
     assume "p = q"
     hence "(\<lambda>x. g x powr q) \<in> O[F](\<lambda>x. g x powr p)" by (auto intro!: bigthetaD1)
     with B \<open>p = q\<close> show ?thesis by auto
   next
     assume "p > q"
     hence "(\<lambda>x. g x powr q) \<in> O[F](\<lambda>x. g x powr p)" using assms A
       by (auto intro!: smalloI_tendsto tendsto_neg_powr landau_o.small_imp_big simp flip: powr_diff)
     with B \<open>p > q\<close> show ?thesis by auto
   qed
 qed
 
 lemma powr_bigo_iff:
   assumes "filterlim g at_top F" "F \<noteq> bot"
   shows   "(\<lambda>x. g x powr p :: real) \<in> O[F](\<lambda>x. g x powr q) \<longleftrightarrow> p \<le> q"
 proof-
   from assms have "eventually (\<lambda>x. g x \<ge> 1) F" by (force simp: filterlim_at_top)
   hence A: "eventually (\<lambda>x. g x \<noteq> 0) F" by eventually_elim simp
   have B: "(\<lambda>x. g x powr q) \<in> o[F](\<lambda>x. g x powr p) \<Longrightarrow> (\<lambda>x. g x powr p) \<notin> O[F](\<lambda>x. g x powr q)"
   proof
     assume "(\<lambda>x. g x powr q) \<in> o[F](\<lambda>x. g x powr p)" "(\<lambda>x. g x powr p) \<in> O[F](\<lambda>x. g x powr q)"
     from landau_o.small_big_asymmetric[OF this] have "eventually (\<lambda>x. g x = 0) F" by simp
     with A have "eventually (\<lambda>_::'a. False) F" by eventually_elim simp
     thus False by (simp add: eventually_False assms)
   qed
   show ?thesis
   proof (cases p q rule: linorder_cases)
     assume "p < q"
     hence "(\<lambda>x. g x powr p) \<in> o[F](\<lambda>x. g x powr q)" using assms A
       by (auto intro!: smalloI_tendsto tendsto_neg_powr simp flip: powr_diff)
     with \<open>p < q\<close> show ?thesis by (auto intro: landau_o.small_imp_big)
   next
     assume "p = q"
     hence "(\<lambda>x. g x powr q) \<in> O[F](\<lambda>x. g x powr p)" by (auto intro!: bigthetaD1)
     with B \<open>p = q\<close> show ?thesis by auto
   next
     assume "p > q"
     hence "(\<lambda>x. g x powr q) \<in> o[F](\<lambda>x. g x powr p)" using assms A
       by (auto intro!: smalloI_tendsto tendsto_neg_powr simp flip: powr_diff)
     with B \<open>p > q\<close> show ?thesis by (auto intro: landau_o.small_imp_big)
   qed
 qed
 
 lemma powr_bigtheta_iff:
   assumes "filterlim g at_top F" "F \<noteq> bot"
   shows   "(\<lambda>x. g x powr p :: real) \<in> \<Theta>[F](\<lambda>x. g x powr q) \<longleftrightarrow> p = q"
   using assms unfolding bigtheta_def by (auto simp: bigomega_iff_bigo powr_bigo_iff)
 
 
 subsection \<open>Flatness of real functions\<close>
 
 text \<open>
   Given two real-valued functions $f$ and $g$, we say that $f$ is flatter than $g$ if
   any power of $f(x)$ is asymptotically dominated by any positive power of $g(x)$. This is
   a useful notion since, given two products of powers of functions sorted by flatness, we can
   compare them asymptotically by simply comparing the exponent lists lexicographically.
 
   A simple sufficient criterion for flatness it that $\ln f(x) \in o(\ln g(x))$, which we show
   now.
 \<close>
 lemma ln_smallo_imp_flat:
   fixes f g :: "real \<Rightarrow> real"
   assumes lim_f: "filterlim f at_top at_top"
   assumes lim_g: "filterlim g at_top at_top"
   assumes ln_o_ln: "(\<lambda>x. ln (f x)) \<in> o(\<lambda>x. ln (g x))"
   assumes q: "q > 0"
   shows   "(\<lambda>x. f x powr p) \<in> o(\<lambda>x. g x powr q)"
 proof (rule smalloI_tendsto)
   from lim_f have "eventually (\<lambda>x. f x > 0) at_top"
     by (simp add: filterlim_at_top_dense)
   hence f_nz: "eventually (\<lambda>x. f x \<noteq> 0) at_top" by eventually_elim simp
 
   from lim_g have g_gt_1: "eventually (\<lambda>x. g x > 1) at_top"
     by (simp add: filterlim_at_top_dense)
   hence g_nz: "eventually (\<lambda>x. g x \<noteq> 0) at_top" by eventually_elim simp
   thus "eventually (\<lambda>x. g x powr q \<noteq> 0) at_top"
     by eventually_elim simp
 
   have eq: "eventually (\<lambda>x. q * (p/q * (ln (f x) / ln (g x)) - 1) * ln (g x) =
                           p * ln (f x) - q * ln (g x)) at_top"
     using g_gt_1 by eventually_elim (insert q, simp_all add: field_simps)
   have "filterlim (\<lambda>x. q * (p/q * (ln (f x) / ln (g x)) - 1) * ln (g x)) at_bot at_top"
     by (insert q)
        (rule filterlim_tendsto_neg_mult_at_bot tendsto_mult
               tendsto_const tendsto_diff smalloD_tendsto[OF ln_o_ln] lim_g
               filterlim_compose[OF ln_at_top] | simp)+
   hence "filterlim (\<lambda>x. p * ln (f x) - q * ln (g x)) at_bot at_top"
     by (subst (asm) filterlim_cong[OF refl refl eq])
   hence *: "((\<lambda>x. exp (p * ln (f x) - q * ln (g x))) \<longlongrightarrow> 0) at_top"
     by (rule filterlim_compose[OF exp_at_bot])
   have eq: "eventually (\<lambda>x. exp (p * ln (f x) - q * ln (g x)) = f x powr p / g x powr q) at_top"
     using f_nz g_nz by eventually_elim (simp add: powr_def exp_diff)
   show "((\<lambda>x. f x powr p / g x powr q) \<longlongrightarrow> 0) at_top"
     using * by (subst (asm) filterlim_cong[OF refl refl eq])
 qed
 
 lemma ln_smallo_imp_flat':
   fixes f g :: "real \<Rightarrow> real"
   assumes lim_f: "filterlim f at_top at_top"
   assumes lim_g: "filterlim g at_top at_top"
   assumes ln_o_ln: "(\<lambda>x. ln (f x)) \<in> o(\<lambda>x. ln (g x))"
   assumes q: "q < 0"
   shows   "(\<lambda>x. g x powr q) \<in> o(\<lambda>x. f x powr p)"
 proof -
   from lim_f lim_g have "eventually (\<lambda>x. f x > 0) at_top" "eventually (\<lambda>x. g x > 0) at_top"
     by (simp_all add: filterlim_at_top_dense)
   hence "eventually (\<lambda>x. f x \<noteq> 0) at_top" "eventually (\<lambda>x. g x \<noteq> 0) at_top"
     by (auto elim: eventually_mono)
   moreover from assms have "(\<lambda>x. f x powr -p) \<in> o(\<lambda>x. g x powr -q)"
     by (intro ln_smallo_imp_flat assms) simp_all
   ultimately show ?thesis unfolding powr_minus
     by (simp add: landau_o.small.inverse_cancel)
 qed
 
 
 subsection \<open>Asymptotic Equivalence\<close>
 
 named_theorems asymp_equiv_intros
 named_theorems asymp_equiv_simps
 
 definition asymp_equiv :: "('a \<Rightarrow> ('b :: real_normed_field)) \<Rightarrow> 'a filter \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> bool"
   (\<open>_ \<sim>[_] _\<close> [51, 10, 51] 50)
   where "f \<sim>[F] g \<longleftrightarrow> ((\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else f x / g x) \<longlongrightarrow> 1) F"
 
 abbreviation (input) asymp_equiv_at_top where
   "asymp_equiv_at_top f g \<equiv> f \<sim>[at_top] g"
 
 bundle asymp_equiv_notation
 begin
 notation asymp_equiv_at_top (infix \<open>\<sim>\<close> 50)
 end
 
 lemma asymp_equivI: "((\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else f x / g x) \<longlongrightarrow> 1) F \<Longrightarrow> f \<sim>[F] g"
   by (simp add: asymp_equiv_def)
 
 lemma asymp_equivD: "f \<sim>[F] g \<Longrightarrow> ((\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else f x / g x) \<longlongrightarrow> 1) F"
   by (simp add: asymp_equiv_def)
 
 lemma asymp_equiv_filtermap_iff:
   "f \<sim>[filtermap h F] g \<longleftrightarrow> (\<lambda>x. f (h x)) \<sim>[F] (\<lambda>x. g (h x))"
   by (simp add: asymp_equiv_def filterlim_filtermap)
 
 lemma asymp_equiv_refl [simp, asymp_equiv_intros]: "f \<sim>[F] f"
 proof (intro asymp_equivI)
   have "eventually (\<lambda>x. 1 = (if f x = 0 \<and> f x = 0 then 1 else f x / f x)) F"
     by (intro always_eventually) simp
   moreover have "((\<lambda>_. 1) \<longlongrightarrow> 1) F" by simp
   ultimately show "((\<lambda>x. if f x = 0 \<and> f x = 0 then 1 else f x / f x) \<longlongrightarrow> 1) F"
     by (simp add: tendsto_eventually)
 qed
 
 lemma asymp_equiv_symI:
   assumes "f \<sim>[F] g"
   shows   "g \<sim>[F] f"
   using tendsto_inverse[OF asymp_equivD[OF assms]]
   by (auto intro!: asymp_equivI simp: if_distrib conj_commute cong: if_cong)
 
 lemma asymp_equiv_sym: "f \<sim>[F] g \<longleftrightarrow> g \<sim>[F] f"
   by (blast intro: asymp_equiv_symI)
 
 lemma asymp_equivI':
   assumes "((\<lambda>x. f x / g x) \<longlongrightarrow> 1) F"
   shows   "f \<sim>[F] g"
 proof (cases "F = bot")
   case False
   have "eventually (\<lambda>x. f x \<noteq> 0) F"
   proof (rule ccontr)
     assume "\<not>eventually (\<lambda>x. f x \<noteq> 0) F"
     hence "frequently (\<lambda>x. f x = 0) F" by (simp add: frequently_def)
     hence "frequently (\<lambda>x. f x / g x = 0) F" by (auto elim!: frequently_elim1)
     from limit_frequently_eq[OF False this assms] show False by simp_all
   qed
   hence "eventually (\<lambda>x. f x / g x = (if f x = 0 \<and> g x = 0 then 1 else f x / g x)) F"
     by eventually_elim simp
   with assms show "f \<sim>[F] g" unfolding asymp_equiv_def
     by (rule Lim_transform_eventually)
 qed (simp_all add: asymp_equiv_def)
 
 
 lemma asymp_equiv_cong:
   assumes "eventually (\<lambda>x. f1 x = f2 x) F" "eventually (\<lambda>x. g1 x = g2 x) F"
   shows   "f1 \<sim>[F] g1 \<longleftrightarrow> f2 \<sim>[F] g2"
   unfolding asymp_equiv_def
 proof (rule tendsto_cong, goal_cases)
   case 1
   from assms show ?case by eventually_elim simp
 qed
 
 lemma asymp_equiv_eventually_zeros:
   fixes f g :: "'a \<Rightarrow> 'b :: real_normed_field"
   assumes "f \<sim>[F] g"
   shows   "eventually (\<lambda>x. f x = 0 \<longleftrightarrow> g x = 0) F"
 proof -
   let ?h = "\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   have "eventually (\<lambda>x. x \<noteq> 0) (nhds (1::'b))"
     by (rule t1_space_nhds) auto
   hence "eventually (\<lambda>x. x \<noteq> 0) (filtermap ?h F)"
     using assms unfolding asymp_equiv_def filterlim_def
     by (rule filter_leD [rotated])
   hence "eventually (\<lambda>x. ?h x \<noteq> 0) F" by (simp add: eventually_filtermap)
   thus ?thesis by eventually_elim (auto split: if_splits)
 qed
 
 lemma asymp_equiv_transfer:
   assumes "f1 \<sim>[F] g1" "eventually (\<lambda>x. f1 x = f2 x) F" "eventually (\<lambda>x. g1 x = g2 x) F"
   shows   "f2 \<sim>[F] g2"
   using assms(1) asymp_equiv_cong[OF assms(2,3)] by simp
 
 lemma asymp_equiv_transfer_trans [trans]:
   assumes "(\<lambda>x. f x (h1 x)) \<sim>[F] (\<lambda>x. g x (h1 x))"
   assumes "eventually (\<lambda>x. h1 x = h2 x) F"
   shows   "(\<lambda>x. f x (h2 x)) \<sim>[F] (\<lambda>x. g x (h2 x))"
   by (rule asymp_equiv_transfer[OF assms(1)]) (insert assms(2), auto elim!: eventually_mono)
 
 lemma asymp_equiv_trans [trans]:
   fixes f g h
   assumes "f \<sim>[F] g" "g \<sim>[F] h"
   shows   "f \<sim>[F] h"
 proof -
   let ?T = "\<lambda>f g x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   from tendsto_mult[OF assms[THEN asymp_equivD]]
   have "((\<lambda>x. ?T f g x * ?T g h x) \<longlongrightarrow> 1) F" by simp
   moreover from assms[THEN asymp_equiv_eventually_zeros]
   have "eventually (\<lambda>x. ?T f g x * ?T g h x = ?T f h x) F" by eventually_elim simp
   ultimately show ?thesis unfolding asymp_equiv_def by (rule Lim_transform_eventually)
 qed
 
 lemma asymp_equiv_trans_lift1 [trans]:
   assumes "a \<sim>[F] f b" "b \<sim>[F] c" "\<And>c d. c \<sim>[F] d \<Longrightarrow> f c \<sim>[F] f d"
   shows   "a \<sim>[F] f c"
   using assms by (blast intro: asymp_equiv_trans)
 
 lemma asymp_equiv_trans_lift2 [trans]:
   assumes "f a \<sim>[F] b" "a \<sim>[F] c" "\<And>c d. c \<sim>[F] d \<Longrightarrow> f c \<sim>[F] f d"
   shows   "f c \<sim>[F] b"
   using asymp_equiv_symI[OF assms(3)[OF assms(2)]] assms(1)
   by (blast intro: asymp_equiv_trans)
 
 lemma asymp_equivD_const:
   assumes "f \<sim>[F] (\<lambda>_. c)"
   shows   "(f \<longlongrightarrow> c) F"
 proof (cases "c = 0")
   case False
   with tendsto_mult_right[OF asymp_equivD[OF assms], of c] show ?thesis by simp
 next
   case True
   with asymp_equiv_eventually_zeros[OF assms] show ?thesis
     by (simp add: tendsto_eventually)
 qed
 
 lemma asymp_equiv_refl_ev:
   assumes "eventually (\<lambda>x. f x = g x) F"
   shows   "f \<sim>[F] g"
   by (intro asymp_equivI tendsto_eventually)
      (insert assms, auto elim!: eventually_mono)
 
 lemma asymp_equiv_sandwich:
   fixes f g h :: "'a \<Rightarrow> 'b :: {real_normed_field, order_topology, linordered_field}"
   assumes "eventually (\<lambda>x. f x \<ge> 0) F"
   assumes "eventually (\<lambda>x. f x \<le> g x) F"
   assumes "eventually (\<lambda>x. g x \<le> h x) F"
   assumes "f \<sim>[F] h"
   shows   "g \<sim>[F] f" "g \<sim>[F] h"
 proof -
   show "g \<sim>[F] f"
   proof (rule asymp_equivI, rule tendsto_sandwich)
     from assms(1-3) asymp_equiv_eventually_zeros[OF assms(4)]
       show "eventually (\<lambda>n. (if h n = 0 \<and> f n = 0 then 1 else h n / f n) \<ge>
                               (if g n = 0 \<and> f n = 0 then 1 else g n / f n)) F"
         by eventually_elim (auto intro!: divide_right_mono)
     from assms(1-3) asymp_equiv_eventually_zeros[OF assms(4)]
       show "eventually (\<lambda>n. 1 \<le>
                               (if g n = 0 \<and> f n = 0 then 1 else g n / f n)) F"
         by eventually_elim (auto intro!: divide_right_mono)
   qed (insert asymp_equiv_symI[OF assms(4)], simp_all add: asymp_equiv_def)
   also note \<open>f \<sim>[F] h\<close>
   finally show "g \<sim>[F] h" .
 qed
 
 lemma asymp_equiv_imp_eventually_same_sign:
   fixes f g :: "real \<Rightarrow> real"
   assumes "f \<sim>[F] g"
   shows   "eventually (\<lambda>x. sgn (f x) = sgn (g x)) F"
 proof -
   from assms have "((\<lambda>x. sgn (if f x = 0 \<and> g x = 0 then 1 else f x / g x)) \<longlongrightarrow> sgn 1) F"
     unfolding asymp_equiv_def by (rule tendsto_sgn) simp_all
   from order_tendstoD(1)[OF this, of "1/2"]
     have "eventually (\<lambda>x. sgn (if f x = 0 \<and> g x = 0 then 1 else f x / g x) > 1/2) F"
     by simp
   thus "eventually (\<lambda>x. sgn (f x) = sgn (g x)) F"
   proof eventually_elim
     case (elim x)
     thus ?case
       by (cases "f x" "0 :: real" rule: linorder_cases;
           cases "g x" "0 :: real" rule: linorder_cases) simp_all
   qed
 qed
 
 lemma
   fixes f g :: "_ \<Rightarrow> real"
   assumes "f \<sim>[F] g"
   shows   asymp_equiv_eventually_same_sign: "eventually (\<lambda>x. sgn (f x) = sgn (g x)) F" (is ?th1)
     and   asymp_equiv_eventually_neg_iff:   "eventually (\<lambda>x. f x < 0 \<longleftrightarrow> g x < 0) F" (is ?th2)
     and   asymp_equiv_eventually_pos_iff:   "eventually (\<lambda>x. f x > 0 \<longleftrightarrow> g x > 0) F" (is ?th3)
 proof -
   from assms have "filterlim (\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else f x / g x) (nhds 1) F"
     by (rule asymp_equivD)
   from order_tendstoD(1)[OF this zero_less_one]
     show ?th1 ?th2 ?th3
     by (eventually_elim; force simp: sgn_if field_split_simps split: if_splits)+
 qed
 
 lemma asymp_equiv_tendsto_transfer:
   assumes "f \<sim>[F] g" and "(f \<longlongrightarrow> c) F"
   shows   "(g \<longlongrightarrow> c) F"
 proof -
   let ?h = "\<lambda>x. (if g x = 0 \<and> f x = 0 then 1 else g x / f x) * f x"
   from assms(1) have "g \<sim>[F] f" by (rule asymp_equiv_symI)
   hence "filterlim (\<lambda>x. if g x = 0 \<and> f x = 0 then 1 else g x / f x) (nhds 1) F"
     by (rule asymp_equivD)
   from tendsto_mult[OF this assms(2)] have "(?h \<longlongrightarrow> c) F" by simp
   moreover
   have "eventually (\<lambda>x. ?h x = g x) F"
     using asymp_equiv_eventually_zeros[OF assms(1)] by eventually_elim simp
   ultimately show ?thesis
     by (rule Lim_transform_eventually)
 qed
 
 lemma tendsto_asymp_equiv_cong:
   assumes "f \<sim>[F] g"
   shows   "(f \<longlongrightarrow> c) F \<longleftrightarrow> (g \<longlongrightarrow> c) F"
 proof -
   have "(f \<longlongrightarrow> c * 1) F" if fg: "f \<sim>[F] g" and "(g \<longlongrightarrow> c) F" for f g :: "'a \<Rightarrow> 'b"
   proof -
     from that have *: "((\<lambda>x. g x * (if f x = 0 \<and> g x = 0 then 1 else f x / g x)) \<longlongrightarrow> c * 1) F"
       by (intro tendsto_intros asymp_equivD)
     have "eventually (\<lambda>x. g x * (if f x = 0 \<and> g x = 0 then 1 else f x / g x) = f x) F"
       using asymp_equiv_eventually_zeros[OF fg] by eventually_elim simp
     with * show ?thesis by (rule Lim_transform_eventually)
   qed
   from this[of f g] this[of g f] assms show ?thesis by (auto simp: asymp_equiv_sym)
 qed
 
 
 lemma smallo_imp_eventually_sgn:
   fixes f g :: "real \<Rightarrow> real"
   assumes "g \<in> o(f)"
   shows   "eventually (\<lambda>x. sgn (f x + g x) = sgn (f x)) at_top"
 proof -
   have "0 < (1/2 :: real)" by simp
   from landau_o.smallD[OF assms, OF this]
     have "eventually (\<lambda>x. \<bar>g x\<bar> \<le> 1/2 * \<bar>f x\<bar>) at_top" by simp
   thus ?thesis
   proof eventually_elim
     case (elim x)
     thus ?case
       by (cases "f x" "0::real" rule: linorder_cases;
           cases "f x + g x" "0::real" rule: linorder_cases) simp_all
   qed
 qed
 
 context
 begin
 
 private lemma asymp_equiv_add_rightI:
   assumes "f \<sim>[F] g" "h \<in> o[F](g)"
   shows   "(\<lambda>x. f x + h x) \<sim>[F] g"
 proof -
   let ?T = "\<lambda>f g x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   from landau_o.smallD[OF assms(2) zero_less_one]
     have ev: "eventually (\<lambda>x. g x = 0 \<longrightarrow> h x = 0) F" by eventually_elim auto
   have "(\<lambda>x. f x + h x) \<sim>[F] g \<longleftrightarrow> ((\<lambda>x. ?T f g x + h x / g x) \<longlongrightarrow> 1) F"
     unfolding asymp_equiv_def using ev
     by (intro tendsto_cong) (auto elim!: eventually_mono simp: field_split_simps)
   also have "\<dots> \<longleftrightarrow> ((\<lambda>x. ?T f g x + h x / g x) \<longlongrightarrow> 1 + 0) F" by simp
   also have \<dots> by (intro tendsto_intros asymp_equivD assms smalloD_tendsto)
   finally show "(\<lambda>x. f x + h x) \<sim>[F] g" .
 qed
 
 lemma asymp_equiv_add_right [asymp_equiv_simps]:
   assumes "h \<in> o[F](g)"
   shows   "(\<lambda>x. f x + h x) \<sim>[F] g \<longleftrightarrow> f \<sim>[F] g"
 proof
   assume "(\<lambda>x. f x + h x) \<sim>[F] g"
   from asymp_equiv_add_rightI[OF this, of "\<lambda>x. -h x"] assms show "f \<sim>[F] g"
     by simp
 qed (simp_all add: asymp_equiv_add_rightI assms)
 
 end
 
 lemma asymp_equiv_add_left [asymp_equiv_simps]:
   assumes "h \<in> o[F](g)"
   shows   "(\<lambda>x. h x + f x) \<sim>[F] g \<longleftrightarrow> f \<sim>[F] g"
   using asymp_equiv_add_right[OF assms] by (simp add: add.commute)
 
 lemma asymp_equiv_add_right' [asymp_equiv_simps]:
   assumes "h \<in> o[F](g)"
   shows   "g \<sim>[F] (\<lambda>x. f x + h x) \<longleftrightarrow> g \<sim>[F] f"
   using asymp_equiv_add_right[OF assms] by (simp add: asymp_equiv_sym)
 
 lemma asymp_equiv_add_left' [asymp_equiv_simps]:
   assumes "h \<in> o[F](g)"
   shows   "g \<sim>[F] (\<lambda>x. h x + f x) \<longleftrightarrow> g \<sim>[F] f"
   using asymp_equiv_add_left[OF assms] by (simp add: asymp_equiv_sym)
 
 lemma smallo_imp_asymp_equiv:
   assumes "(\<lambda>x. f x - g x) \<in> o[F](g)"
   shows   "f \<sim>[F] g"
 proof -
   from assms have "(\<lambda>x. f x - g x + g x) \<sim>[F] g"
     by (subst asymp_equiv_add_left) simp_all
   thus ?thesis by simp
 qed
 
 lemma asymp_equiv_uminus [asymp_equiv_intros]:
   "f \<sim>[F] g \<Longrightarrow> (\<lambda>x. -f x) \<sim>[F] (\<lambda>x. -g x)"
   by (simp add: asymp_equiv_def cong: if_cong)
 
 lemma asymp_equiv_uminus_iff [asymp_equiv_simps]:
   "(\<lambda>x. -f x) \<sim>[F] g \<longleftrightarrow> f \<sim>[F] (\<lambda>x. -g x)"
   by (simp add: asymp_equiv_def cong: if_cong)
 
 lemma asymp_equiv_mult [asymp_equiv_intros]:
   fixes f1 f2 g1 g2 :: "'a \<Rightarrow> 'b :: real_normed_field"
   assumes "f1 \<sim>[F] g1" "f2 \<sim>[F] g2"
   shows   "(\<lambda>x. f1 x * f2 x) \<sim>[F] (\<lambda>x. g1 x * g2 x)"
 proof -
   let ?T = "\<lambda>f g x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   let ?S = "\<lambda>x. (if f1 x = 0 \<and> g1 x = 0 then 1 - ?T f2 g2 x
                    else if f2 x = 0 \<and> g2 x = 0 then 1 - ?T f1 g1 x else 0)"
   let ?S' = "\<lambda>x. ?T (\<lambda>x. f1 x * f2 x) (\<lambda>x. g1 x * g2 x) x - ?T f1 g1 x * ?T f2 g2 x"
   have A: "((\<lambda>x. 1 - ?T f g x) \<longlongrightarrow> 0) F" if "f \<sim>[F] g" for f g :: "'a \<Rightarrow> 'b"
     by (rule tendsto_eq_intros refl asymp_equivD[OF that])+ simp_all
 
   from assms have *: "((\<lambda>x. ?T f1 g1 x * ?T f2 g2 x) \<longlongrightarrow> 1 * 1) F"
     by (intro tendsto_mult asymp_equivD)
   {
     have "(?S \<longlongrightarrow> 0) F"
       by (intro filterlim_If assms[THEN A, THEN tendsto_mono[rotated]])
          (auto intro: le_infI1 le_infI2)
     moreover have "eventually (\<lambda>x. ?S x = ?S' x) F"
       using assms[THEN asymp_equiv_eventually_zeros] by eventually_elim auto
     ultimately have "(?S' \<longlongrightarrow> 0) F" by (rule Lim_transform_eventually)
   }
   with * have "(?T (\<lambda>x. f1 x * f2 x) (\<lambda>x. g1 x * g2 x) \<longlongrightarrow> 1 * 1) F"
     by (rule Lim_transform)
   then show ?thesis by (simp add: asymp_equiv_def)
 qed
 
 lemma asymp_equiv_power [asymp_equiv_intros]:
   "f \<sim>[F] g \<Longrightarrow> (\<lambda>x. f x ^ n) \<sim>[F] (\<lambda>x. g x ^ n)"
   by (induction n) (simp_all add: asymp_equiv_mult)
 
 lemma asymp_equiv_inverse [asymp_equiv_intros]:
   assumes "f \<sim>[F] g"
   shows   "(\<lambda>x. inverse (f x)) \<sim>[F] (\<lambda>x. inverse (g x))"
 proof -
   from tendsto_inverse[OF asymp_equivD[OF assms]]
     have "((\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else g x / f x) \<longlongrightarrow> 1) F"
     by (simp add: if_distrib cong: if_cong)
   also have "(\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else g x / f x) =
                (\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else inverse (f x) / inverse (g x))"
     by (intro ext) (simp add: field_simps)
   finally show ?thesis by (simp add: asymp_equiv_def)
 qed
 
 lemma asymp_equiv_inverse_iff [asymp_equiv_simps]:
   "(\<lambda>x. inverse (f x)) \<sim>[F] (\<lambda>x. inverse (g x)) \<longleftrightarrow> f \<sim>[F] g"
 proof
   assume "(\<lambda>x. inverse (f x)) \<sim>[F] (\<lambda>x. inverse (g x))"
   hence "(\<lambda>x. inverse (inverse (f x))) \<sim>[F] (\<lambda>x. inverse (inverse (g x)))" (is ?P)
     by (rule asymp_equiv_inverse)
   also have "?P \<longleftrightarrow> f \<sim>[F] g" by (intro asymp_equiv_cong) simp_all
   finally show "f \<sim>[F] g" .
 qed (simp_all add: asymp_equiv_inverse)
 
 lemma asymp_equiv_divide [asymp_equiv_intros]:
   assumes "f1 \<sim>[F] g1" "f2 \<sim>[F] g2"
   shows   "(\<lambda>x. f1 x / f2 x) \<sim>[F] (\<lambda>x. g1 x / g2 x)"
   using asymp_equiv_mult[OF assms(1) asymp_equiv_inverse[OF assms(2)]] by (simp add: field_simps)
 
 lemma asymp_equiv_compose [asymp_equiv_intros]:
   assumes "f \<sim>[G] g" "filterlim h G F"
   shows   "f \<circ> h \<sim>[F] g \<circ> h"
 proof -
   let ?T = "\<lambda>f g x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   have "f \<circ> h \<sim>[F] g \<circ> h \<longleftrightarrow> ((?T f g \<circ> h) \<longlongrightarrow> 1) F"
     by (simp add: asymp_equiv_def o_def)
   also have "\<dots> \<longleftrightarrow> (?T f g \<longlongrightarrow> 1) (filtermap h F)"
     by (rule tendsto_compose_filtermap)
   also have "\<dots>"
     by (rule tendsto_mono[of _ G]) (insert assms, simp_all add: asymp_equiv_def filterlim_def)
   finally show ?thesis .
 qed
 
 lemma asymp_equiv_compose':
   assumes "f \<sim>[G] g" "filterlim h G F"
   shows   "(\<lambda>x. f (h x)) \<sim>[F] (\<lambda>x. g (h x))"
   using asymp_equiv_compose[OF assms] by (simp add: o_def)
 
 lemma asymp_equiv_powr_real [asymp_equiv_intros]:
   fixes f g :: "'a \<Rightarrow> real"
   assumes "f \<sim>[F] g" "eventually (\<lambda>x. f x \<ge> 0) F" "eventually (\<lambda>x. g x \<ge> 0) F"
   shows   "(\<lambda>x. f x powr y) \<sim>[F] (\<lambda>x. g x powr y)"
 proof -
   let ?T = "\<lambda>f g x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   have "((\<lambda>x. ?T f g x powr y) \<longlongrightarrow> 1 powr y) F"
     by (intro tendsto_intros asymp_equivD[OF assms(1)]) simp_all
   hence "((\<lambda>x. ?T f g x powr y) \<longlongrightarrow> 1) F" by simp
   moreover have "eventually (\<lambda>x. ?T f g x powr y = ?T (\<lambda>x. f x powr y) (\<lambda>x. g x powr y) x) F"
     using asymp_equiv_eventually_zeros[OF assms(1)] assms(2,3)
     by eventually_elim (auto simp: powr_divide)
   ultimately show ?thesis unfolding asymp_equiv_def by (rule Lim_transform_eventually)
 qed
 
 lemma asymp_equiv_norm [asymp_equiv_intros]:
   fixes f g :: "'a \<Rightarrow> 'b :: real_normed_field"
   assumes "f \<sim>[F] g"
   shows   "(\<lambda>x. norm (f x)) \<sim>[F] (\<lambda>x. norm (g x))"
   using tendsto_norm[OF asymp_equivD[OF assms]]
   by (simp add: if_distrib asymp_equiv_def norm_divide cong: if_cong)
 
 lemma asymp_equiv_abs_real [asymp_equiv_intros]:
   fixes f g :: "'a \<Rightarrow> real"
   assumes "f \<sim>[F] g"
   shows   "(\<lambda>x. \<bar>f x\<bar>) \<sim>[F] (\<lambda>x. \<bar>g x\<bar>)"
   using tendsto_rabs[OF asymp_equivD[OF assms]]
   by (simp add: if_distrib asymp_equiv_def cong: if_cong)
 
 lemma asymp_equiv_imp_eventually_le:
   assumes "f \<sim>[F] g" "c > 1"
   shows   "eventually (\<lambda>x. norm (f x) \<le> c * norm (g x)) F"
 proof -
   from order_tendstoD(2)[OF asymp_equivD[OF asymp_equiv_norm[OF assms(1)]] assms(2)]
        asymp_equiv_eventually_zeros[OF assms(1)]
     show ?thesis by eventually_elim (auto split: if_splits simp: field_simps)
 qed
 
 lemma asymp_equiv_imp_eventually_ge:
   assumes "f \<sim>[F] g" "c < 1"
   shows   "eventually (\<lambda>x. norm (f x) \<ge> c * norm (g x)) F"
 proof -
   from order_tendstoD(1)[OF asymp_equivD[OF asymp_equiv_norm[OF assms(1)]] assms(2)]
        asymp_equiv_eventually_zeros[OF assms(1)]
     show ?thesis by eventually_elim (auto split: if_splits simp: field_simps)
 qed
 
 lemma asymp_equiv_imp_bigo:
   assumes "f \<sim>[F] g"
   shows   "f \<in> O[F](g)"
 proof (rule bigoI)
   have "(3/2::real) > 1" by simp
   from asymp_equiv_imp_eventually_le[OF assms this]
     show "eventually (\<lambda>x. norm (f x) \<le> 3/2 * norm (g x)) F"
     by eventually_elim simp
 qed
 
 lemma asymp_equiv_imp_bigomega:
   "f \<sim>[F] g \<Longrightarrow> f \<in> \<Omega>[F](g)"
   using asymp_equiv_imp_bigo[of g F f] by (simp add: asymp_equiv_sym bigomega_iff_bigo)
 
 lemma asymp_equiv_imp_bigtheta:
   "f \<sim>[F] g \<Longrightarrow> f \<in> \<Theta>[F](g)"
   by (intro bigthetaI asymp_equiv_imp_bigo asymp_equiv_imp_bigomega)
 
 lemma asymp_equiv_at_infinity_transfer:
   assumes "f \<sim>[F] g" "filterlim f at_infinity F"
   shows   "filterlim g at_infinity F"
 proof -
   from assms(1) have "g \<in> \<Theta>[F](f)" by (rule asymp_equiv_imp_bigtheta[OF asymp_equiv_symI])
   also from assms have "f \<in> \<omega>[F](\<lambda>_. 1)" by (simp add: smallomega_1_conv_filterlim)
   finally show ?thesis by (simp add: smallomega_1_conv_filterlim)
 qed
 
 lemma asymp_equiv_at_top_transfer:
   fixes f g :: "_ \<Rightarrow> real"
   assumes "f \<sim>[F] g" "filterlim f at_top F"
   shows   "filterlim g at_top F"
 proof (rule filterlim_at_infinity_imp_filterlim_at_top)
   show "filterlim g at_infinity F"
     by (rule asymp_equiv_at_infinity_transfer[OF assms(1) filterlim_mono[OF assms(2)]])
        (auto simp: at_top_le_at_infinity)
   from assms(2) have "eventually (\<lambda>x. f x > 0) F"
     using filterlim_at_top_dense by blast
   with asymp_equiv_eventually_pos_iff[OF assms(1)] show "eventually (\<lambda>x. g x > 0) F"
     by eventually_elim blast
 qed
 
 lemma asymp_equiv_at_bot_transfer:
   fixes f g :: "_ \<Rightarrow> real"
   assumes "f \<sim>[F] g" "filterlim f at_bot F"
   shows   "filterlim g at_bot F"
   unfolding filterlim_uminus_at_bot
   by (rule asymp_equiv_at_top_transfer[of "\<lambda>x. -f x" F "\<lambda>x. -g x"])
      (insert assms, auto simp: filterlim_uminus_at_bot asymp_equiv_uminus)
 
 lemma asymp_equivI'_const:
   assumes "((\<lambda>x. f x / g x) \<longlongrightarrow> c) F" "c \<noteq> 0"
   shows   "f \<sim>[F] (\<lambda>x. c * g x)"
   using tendsto_mult[OF assms(1) tendsto_const[of "inverse c"]] assms(2)
   by (intro asymp_equivI') (simp add: field_simps)
 
 lemma asymp_equivI'_inverse_const:
   assumes "((\<lambda>x. f x / g x) \<longlongrightarrow> inverse c) F" "c \<noteq> 0"
   shows   "(\<lambda>x. c * f x) \<sim>[F] g"
   using tendsto_mult[OF assms(1) tendsto_const[of "c"]] assms(2)
   by (intro asymp_equivI') (simp add: field_simps)
 
 lemma filterlim_at_bot_imp_at_infinity: "filterlim f at_bot F \<Longrightarrow> filterlim f at_infinity F"
   for f :: "_ \<Rightarrow> real" using at_bot_le_at_infinity filterlim_mono by blast
 
 lemma asymp_equiv_imp_diff_smallo:
   assumes "f \<sim>[F] g"
   shows   "(\<lambda>x. f x - g x) \<in> o[F](g)"
 proof (rule landau_o.smallI)
   fix c :: real assume "c > 0"
   hence c: "min c 1 > 0" by simp
   let ?h = "\<lambda>x. if f x = 0 \<and> g x = 0 then 1 else f x / g x"
   from assms have "((\<lambda>x. ?h x - 1) \<longlongrightarrow> 1 - 1) F"
     by (intro tendsto_diff asymp_equivD tendsto_const)
   from tendstoD[OF this c] show "eventually (\<lambda>x. norm (f x - g x) \<le> c * norm (g x)) F"
   proof eventually_elim
     case (elim x)
     from elim have "norm (f x - g x) \<le> norm (f x / g x - 1) * norm (g x)"
       by (subst norm_mult [symmetric]) (auto split: if_splits simp add: algebra_simps)
     also have "norm (f x / g x - 1) * norm (g x) \<le> c * norm (g x)" using elim
       by (auto split: if_splits simp: mult_right_mono)
     finally show ?case .
   qed
 qed
 
 lemma asymp_equiv_altdef:
   "f \<sim>[F] g \<longleftrightarrow> (\<lambda>x. f x - g x) \<in> o[F](g)"
   by (rule iffI[OF asymp_equiv_imp_diff_smallo smallo_imp_asymp_equiv])
 
 lemma asymp_equiv_0_left_iff [simp]: "(\<lambda>_. 0) \<sim>[F] f \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
   and asymp_equiv_0_right_iff [simp]: "f \<sim>[F] (\<lambda>_. 0) \<longleftrightarrow> eventually (\<lambda>x. f x = 0) F"
   by (simp_all add: asymp_equiv_altdef landau_o.small_refl_iff)
 
 lemma asymp_equiv_sandwich_real:
   fixes f g l u :: "'a \<Rightarrow> real"
   assumes "l \<sim>[F] g" "u \<sim>[F] g" "eventually (\<lambda>x. f x \<in> {l x..u x}) F"
   shows   "f \<sim>[F] g"
   unfolding asymp_equiv_altdef
 proof (rule landau_o.smallI)
   fix c :: real assume c: "c > 0"
   have "eventually (\<lambda>x. norm (f x - g x) \<le> max (norm (l x - g x)) (norm (u x - g x))) F"
     using assms(3) by eventually_elim auto
   moreover have "eventually (\<lambda>x. norm (l x - g x) \<le> c * norm (g x)) F"
                 "eventually (\<lambda>x. norm (u x - g x) \<le> c * norm (g x)) F"
     using assms(1,2) by (auto simp: asymp_equiv_altdef dest: landau_o.smallD[OF _ c])
   hence "eventually (\<lambda>x. max (norm (l x - g x)) (norm (u x - g x)) \<le> c * norm (g x)) F"
     by eventually_elim simp
   ultimately show "eventually (\<lambda>x. norm (f x - g x) \<le> c * norm (g x)) F"
     by eventually_elim (rule order.trans)
 qed
 
 lemma asymp_equiv_sandwich_real':
   fixes f g l u :: "'a \<Rightarrow> real"
   assumes "f \<sim>[F] l" "f \<sim>[F] u" "eventually (\<lambda>x. g x \<in> {l x..u x}) F"
   shows   "f \<sim>[F] g"
   using asymp_equiv_sandwich_real[of l F f u g] assms by (simp add: asymp_equiv_sym)
 
 lemma asymp_equiv_sandwich_real'':
   fixes f g l u :: "'a \<Rightarrow> real"
   assumes "l1 \<sim>[F] u1" "u1 \<sim>[F] l2" "l2 \<sim>[F] u2"
           "eventually (\<lambda>x. f x \<in> {l1 x..u1 x}) F" "eventually (\<lambda>x. g x \<in> {l2 x..u2 x}) F"
   shows   "f \<sim>[F] g"
   by (rule asymp_equiv_sandwich_real[OF asymp_equiv_sandwich_real'[OF _ _ assms(5)]
              asymp_equiv_sandwich_real'[OF _ _ assms(5)] assms(4)];
       blast intro: asymp_equiv_trans assms(1,2,3))+
 
 end
diff --git a/src/HOL/Probability/Characteristic_Functions.thy b/src/HOL/Probability/Characteristic_Functions.thy
--- a/src/HOL/Probability/Characteristic_Functions.thy
+++ b/src/HOL/Probability/Characteristic_Functions.thy
@@ -1,554 +1,554 @@
 (*  Title:     HOL/Probability/Characteristic_Functions.thy
     Authors:   Jeremy Avigad (CMU), Luke Serafin (CMU), Johannes Hölzl (TUM)
 *)
 
 section \<open>Characteristic Functions\<close>
 
 theory Characteristic_Functions
   imports Weak_Convergence Independent_Family Distributions
 begin
 
 lemma mult_min_right: "a \<ge> 0 \<Longrightarrow> (a :: real) * min b c = min (a * b) (a * c)"
   by (metis min.absorb_iff2 min_def mult_left_mono)
 
 lemma sequentially_even_odd:
   assumes E: "eventually (\<lambda>n. P (2 * n)) sequentially" and O: "eventually (\<lambda>n. P (2 * n + 1)) sequentially"
   shows "eventually P sequentially"
 proof -
   from E obtain n_e where [intro]: "\<And>n. n \<ge> n_e \<Longrightarrow> P (2 * n)"
     by (auto simp: eventually_sequentially)
   moreover
   from O obtain n_o where [intro]: "\<And>n. n \<ge> n_o \<Longrightarrow> P (Suc (2 * n))"
     by (auto simp: eventually_sequentially)
   show ?thesis
     unfolding eventually_sequentially
   proof (intro exI allI impI)
     fix n assume "max (2 * n_e) (2 * n_o + 1) \<le> n" then show "P n"
       by (cases "even n") (auto elim!: evenE oddE )
   qed
 qed
 
 lemma limseq_even_odd:
   assumes "(\<lambda>n. f (2 * n)) \<longlonglongrightarrow> (l :: 'a :: topological_space)"
       and "(\<lambda>n. f (2 * n + 1)) \<longlonglongrightarrow> l"
   shows "f \<longlonglongrightarrow> l"
   using assms by (auto simp: filterlim_iff intro: sequentially_even_odd)
 
 subsection \<open>Application of the FTC: integrating $e^ix$\<close>
 
 abbreviation iexp :: "real \<Rightarrow> complex" where
   "iexp \<equiv> (\<lambda>x. exp (\<i> * complex_of_real x))"
 
 lemma isCont_iexp [simp]: "isCont iexp x"
   by (intro continuous_intros)
 
 lemma has_vector_derivative_iexp[derivative_intros]:
   "(iexp has_vector_derivative \<i> * iexp x) (at x within s)"
   by (auto intro!: derivative_eq_intros simp: Re_exp Im_exp has_vector_derivative_complex_iff)
 
 lemma interval_integral_iexp:
   fixes a b :: real
   shows "(CLBINT x=a..b. iexp x) = \<i> * iexp a - \<i> * iexp b"
   by (subst interval_integral_FTC_finite [where F = "\<lambda>x. -\<i> * iexp x"])
      (auto intro!: derivative_eq_intros continuous_intros)
 
 subsection \<open>The Characteristic Function of a Real Measure.\<close>
 
 definition
   char :: "real measure \<Rightarrow> real \<Rightarrow> complex"
 where
   "char M t = CLINT x|M. iexp (t * x)"
 
 lemma (in real_distribution) char_zero: "char M 0 = 1"
   unfolding char_def by (simp del: space_eq_univ add: prob_space)
 
 lemma (in prob_space) integrable_iexp:
   assumes f: "f \<in> borel_measurable M" "\<And>x. Im (f x) = 0"
   shows "integrable M (\<lambda>x. exp (\<i> * (f x)))"
 proof (intro integrable_const_bound [of _ 1])
   from f have "\<And>x. of_real (Re (f x)) = f x"
     by (simp add: complex_eq_iff)
   then show "AE x in M. cmod (exp (\<i> * f x)) \<le> 1"
     using norm_exp_i_times[of "Re (f x)" for x] by simp
 qed (insert f, simp)
 
 lemma (in real_distribution) cmod_char_le_1: "norm (char M t) \<le> 1"
 proof -
   have "norm (char M t) \<le> (\<integral>x. norm (iexp (t * x)) \<partial>M)"
     unfolding char_def by (intro integral_norm_bound)
   also have "\<dots> \<le> 1"
     by (simp del: of_real_mult)
   finally show ?thesis .
 qed
 
 lemma (in real_distribution) isCont_char: "isCont (char M) t"
   unfolding continuous_at_sequentially
 proof safe
   fix X assume X: "X \<longlonglongrightarrow> t"
   show "(char M \<circ> X) \<longlonglongrightarrow> char M t"
     unfolding comp_def char_def
     by (rule integral_dominated_convergence[where w="\<lambda>_. 1"]) (auto intro!: tendsto_intros X)
 qed
 
 lemma (in real_distribution) char_measurable [measurable]: "char M \<in> borel_measurable borel"
   by (auto intro!: borel_measurable_continuous_onI continuous_at_imp_continuous_on isCont_char)
 
 subsection \<open>Independence\<close>
 
 (* the automation can probably be improved *)
 lemma (in prob_space) char_distr_add:
   fixes X1 X2 :: "'a \<Rightarrow> real" and t :: real
   assumes "indep_var borel X1 borel X2"
   shows "char (distr M borel (\<lambda>\<omega>. X1 \<omega> + X2 \<omega>)) t =
     char (distr M borel X1) t * char (distr M borel X2) t"
 proof -
   from assms have [measurable]: "random_variable borel X1" by (elim indep_var_rv1)
   from assms have [measurable]: "random_variable borel X2" by (elim indep_var_rv2)
 
   have "char (distr M borel (\<lambda>\<omega>. X1 \<omega> + X2 \<omega>)) t = (CLINT x|M. iexp (t * (X1 x + X2 x)))"
     by (simp add: char_def integral_distr)
   also have "\<dots> = (CLINT x|M. iexp (t * (X1 x)) * iexp (t * (X2 x))) "
     by (simp add: field_simps exp_add)
   also have "\<dots> = (CLINT x|M. iexp (t * (X1 x))) * (CLINT x|M. iexp (t * (X2 x)))"
     by (intro indep_var_lebesgue_integral indep_var_compose[unfolded comp_def, OF assms])
        (auto intro!: integrable_iexp)
   also have "\<dots> = char (distr M borel X1) t * char (distr M borel X2) t"
     by (simp add: char_def integral_distr)
   finally show ?thesis .
 qed
 
 lemma (in prob_space) char_distr_sum:
   "indep_vars (\<lambda>i. borel) X A \<Longrightarrow>
     char (distr M borel (\<lambda>\<omega>. \<Sum>i\<in>A. X i \<omega>)) t = (\<Prod>i\<in>A. char (distr M borel (X i)) t)"
 proof (induct A rule: infinite_finite_induct)
   case (insert x F) with indep_vars_subset[of "\<lambda>_. borel" X "insert x F" F] show ?case
     by (auto simp add: char_distr_add indep_vars_sum)
 qed (simp_all add: char_def integral_distr prob_space del: distr_const)
 
 subsection \<open>Approximations to $e^{ix}$\<close>
 
 text \<open>Proofs from Billingsley, page 343.\<close>
 
 lemma CLBINT_I0c_power_mirror_iexp:
   fixes x :: real and n :: nat
   defines "f s m \<equiv> complex_of_real ((x - s) ^ m)"
   shows "(CLBINT s=0..x. f s n * iexp s) =
     x^Suc n / Suc n + (\<i> / Suc n) * (CLBINT s=0..x. f s (Suc n) * iexp s)"
 proof -
   have 1:
     "((\<lambda>s. complex_of_real(-((x - s) ^ (Suc n) / (Suc n))) * iexp s)
       has_vector_derivative complex_of_real((x - s)^n) * iexp s + (\<i> * iexp s) * complex_of_real(-((x - s) ^ (Suc n) / (Suc n))))
       (at s within A)" for s A
     by (intro derivative_eq_intros) auto
 
   let ?F = "\<lambda>s. complex_of_real(-((x - s) ^ (Suc n) / (Suc n))) * iexp s"
   have "x^(Suc n) / (Suc n) = (CLBINT s=0..x. (f s n * iexp s + (\<i> * iexp s) * -(f s (Suc n) / (Suc n))))" (is "?LHS = ?RHS")
   proof -
     have "?RHS = (CLBINT s=0..x. (f s n * iexp s + (\<i> * iexp s) *
       complex_of_real(-((x - s) ^ (Suc n) / (Suc n)))))"
       by (cases "0 \<le> x") (auto intro!: simp: f_def[abs_def])
     also have "... = ?F x - ?F 0"
       unfolding zero_ereal_def using 1
       by (intro interval_integral_FTC_finite)
          (auto simp: f_def add_nonneg_eq_0_iff complex_eq_iff
                intro!: continuous_at_imp_continuous_on continuous_intros)
     finally show ?thesis
       by auto
   qed
   show ?thesis
     unfolding \<open>?LHS = ?RHS\<close> f_def interval_lebesgue_integral_mult_right [symmetric]
     by (subst interval_lebesgue_integral_add(2) [symmetric])
        (auto intro!: interval_integrable_isCont continuous_intros simp: zero_ereal_def complex_eq_iff)
 qed
 
 lemma iexp_eq1:
   fixes x :: real
   defines "f s m \<equiv> complex_of_real ((x - s) ^ m)"
   shows "iexp x =
     (\<Sum>k \<le> n. (\<i> * x)^k / (fact k)) + ((\<i> ^ (Suc n)) / (fact n)) * (CLBINT s=0..x. (f s n) * (iexp s))" (is "?P n")
 proof (induction n)
   show "?P 0"
     by (auto simp add: field_simps interval_integral_iexp f_def zero_ereal_def)
 next
   fix n assume ih: "?P n"
   have **: "\<And>a b :: real. a = -b \<longleftrightarrow> a + b = 0"
     by linarith
   have *: "of_nat n * of_nat (fact n) \<noteq> - (of_nat (fact n)::complex)"
     unfolding of_nat_mult[symmetric]
     by (simp add: complex_eq_iff ** of_nat_add[symmetric] del: of_nat_mult of_nat_fact of_nat_add)
   show "?P (Suc n)"
     unfolding sum.atMost_Suc ih f_def CLBINT_I0c_power_mirror_iexp[of _ n]
     by (simp add: divide_simps add_eq_0_iff *) (simp add: field_simps)
 qed
 
 lemma iexp_eq2:
   fixes x :: real
   defines "f s m \<equiv> complex_of_real ((x - s) ^ m)"
   shows "iexp x = (\<Sum>k\<le>Suc n. (\<i>*x)^k/fact k) + \<i>^Suc n/fact n * (CLBINT s=0..x. f s n*(iexp s - 1))"
 proof -
   have isCont_f: "isCont (\<lambda>s. f s n) x" for n x
     by (auto simp: f_def)
   let ?F = "\<lambda>s. complex_of_real (-((x - s) ^ (Suc n) / real (Suc n)))"
   have calc1: "(CLBINT s=0..x. f s n * (iexp s - 1)) =
     (CLBINT s=0..x. f s n * iexp s) - (CLBINT s=0..x. f s n)"
     unfolding zero_ereal_def
     by (subst interval_lebesgue_integral_diff(2) [symmetric])
        (simp_all add: interval_integrable_isCont isCont_f field_simps)
 
   have calc2: "(CLBINT s=0..x. f s n) = x^Suc n / Suc n"
     unfolding zero_ereal_def
   proof (subst interval_integral_FTC_finite [where a = 0 and b = x and f = "\<lambda>s. f s n" and F = ?F])
     show "(?F has_vector_derivative f y n) (at y within {min 0 x..max 0 x})" for y
       unfolding f_def
       by (intro has_vector_derivative_of_real)
          (auto intro!: derivative_eq_intros simp del: power_Suc simp add: add_nonneg_eq_0_iff)
   qed (auto intro: continuous_at_imp_continuous_on isCont_f)
 
   have calc3: "\<i> ^ (Suc (Suc n)) / (fact (Suc n)) = (\<i> ^ (Suc n) / (fact n)) * (\<i> / (Suc n))"
     by (simp add: field_simps)
 
   show ?thesis
     unfolding iexp_eq1 [where n = "Suc n" and x=x] calc1 calc2 calc3 unfolding f_def
     by (subst CLBINT_I0c_power_mirror_iexp [where n = n]) auto
 qed
 
 lemma abs_LBINT_I0c_abs_power_diff:
   "\<bar>LBINT s=0..x. \<bar>(x - s)^n\<bar>\<bar> = \<bar>x ^ (Suc n) / (Suc n)\<bar>"
 proof -
  have "\<bar>LBINT s=0..x. \<bar>(x - s)^n\<bar>\<bar> = \<bar>LBINT s=0..x. (x - s)^n\<bar>"
   proof cases
     assume "0 \<le> x \<or> even n"
     then have "(LBINT s=0..x. \<bar>(x - s)^n\<bar>) = LBINT s=0..x. (x - s)^n"
       by (auto simp add: zero_ereal_def power_even_abs power_abs min_absorb1 max_absorb2
                intro!: interval_integral_cong)
     then show ?thesis by simp
   next
     assume "\<not> (0 \<le> x \<or> even n)"
     then have "(LBINT s=0..x. \<bar>(x - s)^n\<bar>) = LBINT s=0..x. -((x - s)^n)"
       by (auto simp add: zero_ereal_def power_abs min_absorb1 max_absorb2
                          ereal_min[symmetric] ereal_max[symmetric] power_minus_odd[symmetric]
                simp del: ereal_min ereal_max intro!: interval_integral_cong)
     also have "\<dots> = - (LBINT s=0..x. (x - s)^n)"
       by (subst interval_lebesgue_integral_uminus, rule refl)
     finally show ?thesis by simp
   qed
   also have "LBINT s=0..x. (x - s)^n = x^Suc n / Suc n"
   proof -
     let ?F = "\<lambda>t. - ((x - t)^(Suc n) / Suc n)"
     have "LBINT s=0..x. (x - s)^n = ?F x - ?F 0"
       unfolding zero_ereal_def
       by (intro interval_integral_FTC_finite continuous_at_imp_continuous_on
-                has_field_derivative_iff_has_vector_derivative[THEN iffD1])
+                has_real_derivative_iff_has_vector_derivative[THEN iffD1])
          (auto simp del: power_Suc intro!: derivative_eq_intros simp add: add_nonneg_eq_0_iff)
     also have "\<dots> = x ^ (Suc n) / (Suc n)" by simp
     finally show ?thesis .
   qed
   finally show ?thesis .
 qed
 
 lemma iexp_approx1: "cmod (iexp x - (\<Sum>k \<le> n. (\<i> * x)^k / fact k)) \<le> \<bar>x\<bar>^(Suc n) / fact (Suc n)"
 proof -
   have "iexp x - (\<Sum>k \<le> n. (\<i> * x)^k / fact k) =
       ((\<i> ^ (Suc n)) / (fact n)) * (CLBINT s=0..x. (x - s)^n * (iexp s))" (is "?t1 = ?t2")
     by (subst iexp_eq1 [of _ n], simp add: field_simps)
   then have "cmod (?t1) = cmod (?t2)"
     by simp
   also have "\<dots> =  (1 / of_nat (fact n)) * cmod (CLBINT s=0..x. (x - s)^n * (iexp s))"
     by (simp add: norm_mult norm_divide norm_power)
   also have "\<dots> \<le> (1 / of_nat (fact n)) * \<bar>LBINT s=0..x. cmod ((x - s)^n * (iexp s))\<bar>"
     by (intro mult_left_mono interval_integral_norm2)
        (auto simp: zero_ereal_def intro: interval_integrable_isCont)
   also have "\<dots> \<le> (1 / of_nat (fact n)) * \<bar>LBINT s=0..x. \<bar>(x - s)^n\<bar>\<bar>"
     by (simp add: norm_mult del: of_real_diff of_real_power)
   also have "\<dots> \<le> (1 / of_nat (fact n)) * \<bar>x ^ (Suc n) / (Suc n)\<bar>"
     by (simp add: abs_LBINT_I0c_abs_power_diff)
   also have "1 / real_of_nat (fact n::nat) * \<bar>x ^ Suc n / real (Suc n)\<bar> =
       \<bar>x\<bar> ^ Suc n / fact (Suc n)"
     by (simp add: abs_mult power_abs)
   finally show ?thesis .
 qed
 
 lemma iexp_approx2: "cmod (iexp x - (\<Sum>k \<le> n. (\<i> * x)^k / fact k)) \<le> 2 * \<bar>x\<bar>^n / fact n"
 proof (induction n) \<comment> \<open>really cases\<close>
   case (Suc n)
   have *: "\<And>a b. interval_lebesgue_integrable lborel a b f \<Longrightarrow> interval_lebesgue_integrable lborel a b g \<Longrightarrow>
       \<bar>LBINT s=a..b. f s\<bar> \<le> \<bar>LBINT s=a..b. g s\<bar>"
     if f: "\<And>s. 0 \<le> f s" and g: "\<And>s. f s \<le> g s" for f g :: "_ \<Rightarrow> real"
     using order_trans[OF f g] f g 
     unfolding interval_lebesgue_integral_def interval_lebesgue_integrable_def set_lebesgue_integral_def set_integrable_def
     by (auto simp: integral_nonneg_AE[OF AE_I2] intro!: integral_mono mult_mono)
 
   have "iexp x - (\<Sum>k \<le> Suc n. (\<i> * x)^k / fact k) =
       ((\<i> ^ (Suc n)) / (fact n)) * (CLBINT s=0..x. (x - s)^n * (iexp s - 1))" (is "?t1 = ?t2")
     unfolding iexp_eq2 [of x n] by (simp add: field_simps)
   then have "cmod (?t1) = cmod (?t2)"
     by simp
   also have "\<dots> =  (1 / (fact n)) * cmod (CLBINT s=0..x. (x - s)^n * (iexp s - 1))"
     by (simp add: norm_mult norm_divide norm_power)
   also have "\<dots> \<le> (1 / (fact n)) * \<bar>LBINT s=0..x. cmod ((x - s)^n * (iexp s - 1))\<bar>"
     by (intro mult_left_mono interval_integral_norm2)
        (auto intro!: interval_integrable_isCont simp: zero_ereal_def)
   also have "\<dots> = (1 / (fact n)) * \<bar>LBINT s=0..x. abs ((x - s)^n) * cmod((iexp s - 1))\<bar>"
     by (simp add: norm_mult del: of_real_diff of_real_power)
   also have "\<dots> \<le> (1 / (fact n)) * \<bar>LBINT s=0..x. abs ((x - s)^n) * 2\<bar>"
     by (intro mult_left_mono * order_trans [OF norm_triangle_ineq4])
        (auto simp: mult_ac zero_ereal_def intro!: interval_integrable_isCont)
   also have "\<dots> = (2 / (fact n)) * \<bar>x ^ (Suc n) / (Suc n)\<bar>"
    by (simp add: abs_LBINT_I0c_abs_power_diff abs_mult)
   also have "2 / fact n * \<bar>x ^ Suc n / real (Suc n)\<bar> = 2 * \<bar>x\<bar> ^ Suc n / (fact (Suc n))"
     by (simp add: abs_mult power_abs)
   finally show ?case .
 qed (insert norm_triangle_ineq4[of "iexp x" 1], simp)
 
 lemma (in real_distribution) char_approx1:
   assumes integrable_moments: "\<And>k. k \<le> n \<Longrightarrow> integrable M (\<lambda>x. x^k)"
   shows "cmod (char M t - (\<Sum>k \<le> n. ((\<i> * t)^k / fact k) * expectation (\<lambda>x. x^k))) \<le>
     (2*\<bar>t\<bar>^n / fact n) * expectation (\<lambda>x. \<bar>x\<bar>^n)" (is "cmod (char M t - ?t1) \<le> _")
 proof -
   have integ_iexp: "integrable M (\<lambda>x. iexp (t * x))"
     by (intro integrable_const_bound) auto
 
   define c where [abs_def]: "c k x = (\<i> * t)^k / fact k * complex_of_real (x^k)" for k x
   have integ_c: "\<And>k. k \<le> n \<Longrightarrow> integrable M (\<lambda>x. c k x)"
     unfolding c_def by (intro integrable_mult_right integrable_of_real integrable_moments)
 
   have "k \<le> n \<Longrightarrow> expectation (c k) = (\<i>*t) ^ k * (expectation (\<lambda>x. x ^ k)) / fact k" for k
     unfolding c_def integral_mult_right_zero integral_complex_of_real by simp
   then have "norm (char M t - ?t1) = norm (char M t - (CLINT x | M. (\<Sum>k \<le> n. c k x)))"
     by (simp add: integ_c)
   also have "\<dots> = norm ((CLINT x | M. iexp (t * x) - (\<Sum>k \<le> n. c k x)))"
     unfolding char_def by (subst Bochner_Integration.integral_diff[OF integ_iexp]) (auto intro!: integ_c)
   also have "\<dots> \<le> expectation (\<lambda>x. cmod (iexp (t * x) - (\<Sum>k \<le> n. c k x)))"
     by (intro integral_norm_bound)
   also have "\<dots> \<le> expectation (\<lambda>x. 2 * \<bar>t\<bar> ^ n / fact n * \<bar>x\<bar> ^ n)"
   proof (rule integral_mono)
     show "integrable M (\<lambda>x. cmod (iexp (t * x) - (\<Sum>k\<le>n. c k x)))"
       by (intro integrable_norm Bochner_Integration.integrable_diff integ_iexp Bochner_Integration.integrable_sum integ_c) simp
     show "integrable M (\<lambda>x. 2 * \<bar>t\<bar> ^ n / fact n * \<bar>x\<bar> ^ n)"
       unfolding power_abs[symmetric]
       by (intro integrable_mult_right integrable_abs integrable_moments) simp
     show "cmod (iexp (t * x) - (\<Sum>k\<le>n. c k x)) \<le> 2 * \<bar>t\<bar> ^ n / fact n * \<bar>x\<bar> ^ n" for x
       using iexp_approx2[of "t * x" n] by (auto simp add: abs_mult field_simps c_def)
   qed
   finally show ?thesis
     unfolding integral_mult_right_zero .
 qed
 
 lemma (in real_distribution) char_approx2:
   assumes integrable_moments: "\<And>k. k \<le> n \<Longrightarrow> integrable M (\<lambda>x. x ^ k)"
   shows "cmod (char M t - (\<Sum>k \<le> n. ((\<i> * t)^k / fact k) * expectation (\<lambda>x. x^k))) \<le>
     (\<bar>t\<bar>^n / fact (Suc n)) * expectation (\<lambda>x. min (2 * \<bar>x\<bar>^n * Suc n) (\<bar>t\<bar> * \<bar>x\<bar>^Suc n))"
     (is "cmod (char M t - ?t1) \<le> _")
 proof -
   have integ_iexp: "integrable M (\<lambda>x. iexp (t * x))"
     by (intro integrable_const_bound) auto
 
   define c where [abs_def]: "c k x = (\<i> * t)^k / fact k * complex_of_real (x^k)" for k x
   have integ_c: "\<And>k. k \<le> n \<Longrightarrow> integrable M (\<lambda>x. c k x)"
     unfolding c_def by (intro integrable_mult_right integrable_of_real integrable_moments)
 
   have *: "min (2 * \<bar>t * x\<bar>^n / fact n) (\<bar>t * x\<bar>^Suc n / fact (Suc n)) =
       \<bar>t\<bar>^n / fact (Suc n) * min (2 * \<bar>x\<bar>^n * real (Suc n)) (\<bar>t\<bar> * \<bar>x\<bar>^(Suc n))" for x
     apply (subst mult_min_right)
     apply simp
     apply (rule arg_cong2[where f=min])
     apply (simp_all add: field_simps abs_mult del: fact_Suc)
     apply (simp_all add: field_simps)
     done
 
   have "k \<le> n \<Longrightarrow> expectation (c k) = (\<i>*t) ^ k * (expectation (\<lambda>x. x ^ k)) / fact k" for k
     unfolding c_def integral_mult_right_zero integral_complex_of_real by simp
   then have "norm (char M t - ?t1) = norm (char M t - (CLINT x | M. (\<Sum>k \<le> n. c k x)))"
     by (simp add: integ_c)
   also have "\<dots> = norm ((CLINT x | M. iexp (t * x) - (\<Sum>k \<le> n. c k x)))"
     unfolding char_def by (subst Bochner_Integration.integral_diff[OF integ_iexp]) (auto intro!: integ_c)
   also have "\<dots> \<le> expectation (\<lambda>x. cmod (iexp (t * x) - (\<Sum>k \<le> n. c k x)))"
     by (rule integral_norm_bound)
   also have "\<dots> \<le> expectation (\<lambda>x. min (2 * \<bar>t * x\<bar>^n / fact n) (\<bar>t * x\<bar>^(Suc n) / fact (Suc n)))"
     (is "_ \<le> expectation ?f")
   proof (rule integral_mono)
     show "integrable M (\<lambda>x. cmod (iexp (t * x) - (\<Sum>k\<le>n. c k x)))"
       by (intro integrable_norm Bochner_Integration.integrable_diff integ_iexp Bochner_Integration.integrable_sum integ_c) simp
     show "integrable M ?f"
       by (rule Bochner_Integration.integrable_bound[where f="\<lambda>x. 2 * \<bar>t * x\<bar> ^ n / fact n"])
          (auto simp: integrable_moments power_abs[symmetric] power_mult_distrib)
     show "cmod (iexp (t * x) - (\<Sum>k\<le>n. c k x)) \<le> ?f x" for x
       using iexp_approx1[of "t * x" n] iexp_approx2[of "t * x" n]
       by (auto simp add: abs_mult field_simps c_def intro!: min.boundedI)
   qed
   also have "\<dots> = (\<bar>t\<bar>^n / fact (Suc n)) * expectation (\<lambda>x. min (2 * \<bar>x\<bar>^n * Suc n) (\<bar>t\<bar> * \<bar>x\<bar>^Suc n))"
     unfolding *
   proof (rule Bochner_Integration.integral_mult_right)
     show "integrable M (\<lambda>x. min (2 * \<bar>x\<bar> ^ n * real (Suc n)) (\<bar>t\<bar> * \<bar>x\<bar> ^ Suc n))"
       by (rule Bochner_Integration.integrable_bound[where f="\<lambda>x. 2 * \<bar>x\<bar> ^ n * real (Suc n)"])
          (auto simp: integrable_moments power_abs[symmetric] power_mult_distrib)
   qed
   finally show ?thesis
     unfolding integral_mult_right_zero .
 qed
 
 lemma (in real_distribution) char_approx3:
   fixes t
   assumes
     integrable_1: "integrable M (\<lambda>x. x)" and
     integral_1: "expectation (\<lambda>x. x) = 0" and
     integrable_2: "integrable M (\<lambda>x. x^2)" and
     integral_2: "variance (\<lambda>x. x) = \<sigma>2"
   shows "cmod (char M t - (1 - t^2 * \<sigma>2 / 2)) \<le>
     (t^2 / 6) * expectation (\<lambda>x. min (6 * x^2) (abs t * (abs x)^3) )"
 proof -
   note real_distribution.char_approx2 [of M 2 t, simplified]
   have [simp]: "prob UNIV = 1" by (metis prob_space space_eq_univ)
   from integral_2 have [simp]: "expectation (\<lambda>x. x * x) = \<sigma>2"
     by (simp add: integral_1 numeral_eq_Suc)
   have 1: "k \<le> 2 \<Longrightarrow> integrable M (\<lambda>x. x^k)" for k
     using assms by (auto simp: eval_nat_numeral le_Suc_eq)
   note char_approx1
   note 2 = char_approx1 [of 2 t, OF 1, simplified]
   have "cmod (char M t - (\<Sum>k\<le>2. (\<i> * t) ^ k * (expectation (\<lambda>x. x ^ k)) / (fact k))) \<le>
       t\<^sup>2 * expectation (\<lambda>x. min (6 * x\<^sup>2) (\<bar>t\<bar> * \<bar>x\<bar> ^ 3)) / fact (3::nat)"
     using char_approx2 [of 2 t, OF 1] by simp
   also have "(\<Sum>k\<le>2. (\<i> * t) ^ k * expectation (\<lambda>x. x ^ k) / (fact k)) = 1 - t^2 * \<sigma>2 / 2"
     by (simp add: complex_eq_iff numeral_eq_Suc integral_1 Re_divide Im_divide)
   also have "fact 3 = 6" by (simp add: eval_nat_numeral)
   also have "t\<^sup>2 * expectation (\<lambda>x. min (6 * x\<^sup>2) (\<bar>t\<bar> * \<bar>x\<bar> ^ 3)) / 6 =
      t\<^sup>2 / 6 * expectation (\<lambda>x. min (6 * x\<^sup>2) (\<bar>t\<bar> * \<bar>x\<bar> ^ 3))" by (simp add: field_simps)
   finally show ?thesis .
 qed
 
 text \<open>
   This is a more familiar textbook formulation in terms of random variables, but
   we will use the previous version for the CLT.
 \<close>
 
 lemma (in prob_space) char_approx3':
   fixes \<mu> :: "real measure" and X
   assumes rv_X [simp]: "random_variable borel X"
     and [simp]: "integrable M X" "integrable M (\<lambda>x. (X x)^2)" "expectation X = 0"
     and var_X: "variance X = \<sigma>2"
     and \<mu>_def: "\<mu> = distr M borel X"
   shows "cmod (char \<mu> t - (1 - t^2 * \<sigma>2 / 2)) \<le>
     (t^2 / 6) * expectation (\<lambda>x. min (6 * (X x)^2) (\<bar>t\<bar> * \<bar>X x\<bar>^3))"
   using var_X unfolding \<mu>_def
   apply (subst integral_distr [symmetric, OF rv_X], simp)
   apply (intro real_distribution.char_approx3)
   apply (auto simp add: integrable_distr_eq integral_distr)
   done
 
 text \<open>
   this is the formulation in the book -- in terms of a random variable *with* the distribution,
   rather the distribution itself. I don't know which is more useful, though in principal we can
   go back and forth between them.
 \<close>
 
 lemma (in prob_space) char_approx1':
   fixes \<mu> :: "real measure" and X
   assumes integrable_moments : "\<And>k. k \<le> n \<Longrightarrow> integrable M (\<lambda>x. X x ^ k)"
     and rv_X[measurable]: "random_variable borel X"
     and \<mu>_distr : "distr M borel X = \<mu>"
   shows "cmod (char \<mu> t - (\<Sum>k \<le> n. ((\<i> * t)^k / fact k) * expectation (\<lambda>x. (X x)^k))) \<le>
     (2 * \<bar>t\<bar>^n / fact n) * expectation (\<lambda>x. \<bar>X x\<bar>^n)"
   unfolding \<mu>_distr[symmetric]
   apply (subst (1 2) integral_distr [symmetric, OF rv_X], simp, simp)
   apply (intro real_distribution.char_approx1[of "distr M borel X" n t] real_distribution_distr rv_X)
   apply (auto simp: integrable_distr_eq integrable_moments)
   done
 
 subsection \<open>Calculation of the Characteristic Function of the Standard Distribution\<close>
 
 abbreviation
   "std_normal_distribution \<equiv> density lborel std_normal_density"
 
 (* TODO: should this be an instance statement? *)
 lemma real_dist_normal_dist: "real_distribution std_normal_distribution"
   using prob_space_normal_density by (auto simp: real_distribution_def real_distribution_axioms_def)
 
 lemma std_normal_distribution_even_moments:
   fixes k :: nat
   shows "(LINT x|std_normal_distribution. x^(2 * k)) = fact (2 * k) / (2^k * fact k)"
     and "integrable std_normal_distribution (\<lambda>x. x^(2 * k))"
   using integral_std_normal_moment_even[of k]
   by (subst integral_density)
      (auto simp: normal_density_nonneg integrable_density
            intro: integrable.intros std_normal_moment_even)
 
 lemma integrable_std_normal_distribution_moment: "integrable std_normal_distribution (\<lambda>x. x^k)"
   by (auto simp: normal_density_nonneg integrable_std_normal_moment integrable_density)
 
 lemma integral_std_normal_distribution_moment_odd:
   "odd k \<Longrightarrow> integral\<^sup>L std_normal_distribution (\<lambda>x. x^k) = 0"
   using integral_std_normal_moment_odd[of "(k - 1) div 2"]
   by (auto simp: integral_density normal_density_nonneg elim: oddE)
 
 lemma std_normal_distribution_even_moments_abs:
   fixes k :: nat
   shows "(LINT x|std_normal_distribution. \<bar>x\<bar>^(2 * k)) = fact (2 * k) / (2^k * fact k)"
   using integral_std_normal_moment_even[of k]
   by (subst integral_density) (auto simp: normal_density_nonneg power_even_abs)
 
 lemma std_normal_distribution_odd_moments_abs:
   fixes k :: nat
   shows "(LINT x|std_normal_distribution. \<bar>x\<bar>^(2 * k + 1)) = sqrt (2 / pi) * 2 ^ k * fact k"
   using integral_std_normal_moment_abs_odd[of k]
   by (subst integral_density) (auto simp: normal_density_nonneg)
 
 theorem char_std_normal_distribution:
   "char std_normal_distribution = (\<lambda>t. complex_of_real (exp (- (t^2) / 2)))"
 proof (intro ext LIMSEQ_unique)
   fix t :: real
   let ?f' = "\<lambda>k. (\<i> * t)^k / fact k * (LINT x | std_normal_distribution. x^k)"
   let ?f = "\<lambda>n. (\<Sum>k \<le> n. ?f' k)"
   show "?f \<longlonglongrightarrow> exp (-(t^2) / 2)"
   proof (rule limseq_even_odd)
     have "(\<i> * complex_of_real t) ^ (2 * a) / (2 ^ a * fact a) = (- ((complex_of_real t)\<^sup>2 / 2)) ^ a / fact a" for a
       by (subst power_mult) (simp add: field_simps uminus_power_if power_mult)
     then have *: "?f (2 * n) = complex_of_real (\<Sum>k < Suc n. (1 / fact k) * (- (t^2) / 2)^k)" for n :: nat
       unfolding of_real_sum
       by (intro sum.reindex_bij_witness_not_neutral[symmetric, where
            i="\<lambda>n. n div 2" and j="\<lambda>n. 2 * n" and T'="{i. i \<le> 2 * n \<and> odd i}" and S'="{}"])
          (auto simp: integral_std_normal_distribution_moment_odd std_normal_distribution_even_moments)
     show "(\<lambda>n. ?f (2 * n)) \<longlonglongrightarrow> exp (-(t^2) / 2)"
       unfolding * using exp_converges[where 'a=real]
       by (intro tendsto_of_real LIMSEQ_Suc) (auto simp: inverse_eq_divide sums_def [symmetric])
     have **: "?f (2 * n + 1) = ?f (2 * n)" for n
     proof -
       have "?f (2 * n + 1) = ?f (2 * n) + ?f' (2 * n + 1)"
         by simp
       also have "?f' (2 * n + 1) = 0"
         by (subst integral_std_normal_distribution_moment_odd) simp_all
       finally show "?f (2 * n + 1) = ?f (2 * n)"
         by simp
     qed
     show "(\<lambda>n. ?f (2 * n + 1)) \<longlonglongrightarrow> exp (-(t^2) / 2)"
       unfolding ** by fact
   qed
 
   have **: "(\<lambda>n. x ^ n / fact n) \<longlonglongrightarrow> 0" for x :: real
     using summable_LIMSEQ_zero [OF summable_exp] by (auto simp add: inverse_eq_divide)
 
   let ?F = "\<lambda>n. 2 * \<bar>t\<bar> ^ n / fact n * (LINT x|std_normal_distribution. \<bar>x\<bar> ^ n)"
 
   show "?f \<longlonglongrightarrow> char std_normal_distribution t"
   proof (rule metric_tendsto_imp_tendsto[OF limseq_even_odd])
     show "(\<lambda>n. ?F (2 * n)) \<longlonglongrightarrow> 0"
     proof (rule Lim_transform_eventually)
       show "\<forall>\<^sub>F n in sequentially. 2 * ((t^2 / 2)^n / fact n) = ?F (2 * n)"
         unfolding std_normal_distribution_even_moments_abs by (simp add: power_mult power_divide)
     qed (intro tendsto_mult_right_zero **)
 
     have *: "?F (2 * n + 1) = (2 * \<bar>t\<bar> * sqrt (2 / pi)) * ((2 * t^2)^n * fact n / fact (2 * n + 1))" for n
       unfolding std_normal_distribution_odd_moments_abs
       by (simp add: field_simps power_mult[symmetric] power_even_abs)
     have "norm ((2 * t\<^sup>2) ^ n * fact n / fact (2 * n + 1)) \<le> (2 * t\<^sup>2) ^ n / fact n" for n
       using mult_mono[OF _ square_fact_le_2_fact, of 1 "1 + 2 * real n" n]
       by (auto simp add: divide_simps intro!: mult_left_mono)
     then show "(\<lambda>n. ?F (2 * n + 1)) \<longlonglongrightarrow> 0"
       unfolding * by (intro tendsto_mult_right_zero Lim_null_comparison [OF _ ** [of "2 * t\<^sup>2"]]) auto
 
     show "\<forall>\<^sub>F n in sequentially. dist (?f n) (char std_normal_distribution t) \<le> dist (?F n) 0"
       using real_distribution.char_approx1[OF real_dist_normal_dist integrable_std_normal_distribution_moment]
       by (auto simp: dist_norm integral_nonneg_AE norm_minus_commute)
   qed
 qed
 
 end
diff --git a/src/HOL/Probability/Sinc_Integral.thy b/src/HOL/Probability/Sinc_Integral.thy
--- a/src/HOL/Probability/Sinc_Integral.thy
+++ b/src/HOL/Probability/Sinc_Integral.thy
@@ -1,403 +1,403 @@
 (*  Title:     HOL/Probability/Sinc_Integral.thy
     Authors:   Jeremy Avigad (CMU), Luke Serafin (CMU)
     Authors:   Johannes Hölzl, TU München
 *)
 
 section \<open>Integral of sinc\<close>
 
 theory Sinc_Integral
   imports Distributions
 begin
 
 subsection \<open>Various preparatory integrals\<close>
 
 text \<open> Naming convention
 The theorem name consists of the following parts:
   \<^item> Kind of integral: \<open>has_bochner_integral\<close> / \<open>integrable\<close> / \<open>LBINT\<close>
   \<^item> Interval: Interval (0 / infinity / open / closed) (infinity / open / closed)
   \<^item> Name of the occurring constants: power, exp, m (for minus), scale, sin, $\ldots$
 \<close>
 
 lemma has_bochner_integral_I0i_power_exp_m':
   "has_bochner_integral lborel (\<lambda>x. x^k * exp (-x) * indicator {0 ..} x::real) (fact k)"
   using nn_intergal_power_times_exp_Ici[of k]
   by (intro has_bochner_integral_nn_integral)
      (auto simp: nn_integral_set_ennreal split: split_indicator)
 
 lemma has_bochner_integral_I0i_power_exp_m:
   "has_bochner_integral lborel (\<lambda>x. x^k * exp (-x) * indicator {0 <..} x::real) (fact k)"
   using AE_lborel_singleton[of 0]
   by (intro has_bochner_integral_cong_AE[THEN iffD1, OF _ _ _ has_bochner_integral_I0i_power_exp_m'])
      (auto split: split_indicator)
 
 lemma integrable_I0i_exp_mscale: "0 < (u::real) \<Longrightarrow> set_integrable lborel {0 <..} (\<lambda>x. exp (-(x * u)))"
   using lborel_integrable_real_affine_iff[of u "\<lambda>x. indicator {0 <..} x *\<^sub>R exp (- x)" 0]
         has_bochner_integral_I0i_power_exp_m[of 0]
   by (simp add: indicator_def zero_less_mult_iff mult_ac integrable.intros set_integrable_def)
 
 lemma LBINT_I0i_exp_mscale: "0 < (u::real) \<Longrightarrow> LBINT x=0..\<infinity>. exp (-(x * u)) = 1 / u"
   using lborel_integral_real_affine[of u "\<lambda>x. indicator {0<..} x *\<^sub>R exp (- x)" 0]
         has_bochner_integral_I0i_power_exp_m[of 0]
   by (auto simp: indicator_def zero_less_mult_iff interval_lebesgue_integral_0_infty set_lebesgue_integral_def field_simps
            dest!: has_bochner_integral_integral_eq)
 
 lemma LBINT_I0c_exp_mscale_sin:
   "LBINT x=0..t. exp (-(u * x)) * sin x =
     (1 / (1 + u^2)) * (1 - exp (-(u * t)) * (u * sin t + cos t))" (is "_ = ?F t")
   unfolding zero_ereal_def
 proof (subst interval_integral_FTC_finite)
   show "(?F has_vector_derivative exp (- (u * x)) * sin x) (at x within {min 0 t..max 0 t})" for x
     by (auto intro!: derivative_eq_intros
-             simp: has_field_derivative_iff_has_vector_derivative[symmetric] power2_eq_square)
+             simp: has_real_derivative_iff_has_vector_derivative[symmetric] power2_eq_square)
        (simp_all add: field_simps add_nonneg_eq_0_iff)
 qed (auto intro: continuous_at_imp_continuous_on)
 
 lemma LBINT_I0i_exp_mscale_sin:
   assumes "0 < x"
   shows "LBINT u=0..\<infinity>. \<bar>exp (-u * x) * sin x\<bar> = \<bar>sin x\<bar> / x"
 proof (subst interval_integral_FTC_nonneg)
   let ?F = "\<lambda>u. 1 / x * (1 - exp (- u * x)) * \<bar>sin x\<bar>"
   show "\<And>t. (?F has_real_derivative \<bar>exp (- t * x) * sin x\<bar>) (at t)"
     using \<open>0 < x\<close> by (auto intro!: derivative_eq_intros simp: abs_mult)
   show "((?F \<circ> real_of_ereal) \<longlongrightarrow> 0) (at_right 0)"
     using \<open>0 < x\<close> by (auto simp: zero_ereal_def ereal_tendsto_simps intro!: tendsto_eq_intros)
   have *: "((\<lambda>t. exp (- t * x)) \<longlongrightarrow> 0) at_top"
     using \<open>0 < x\<close>
     by (auto intro!: exp_at_bot[THEN filterlim_compose] filterlim_tendsto_pos_mult_at_top filterlim_ident
              simp: filterlim_uminus_at_bot mult.commute[of _ x])
   show "((?F \<circ> real_of_ereal) \<longlongrightarrow> \<bar>sin x\<bar> / x) (at_left \<infinity>)"
     using \<open>0 < x\<close> unfolding ereal_tendsto_simps
     by (intro filterlim_compose[OF _ *]) (auto intro!: tendsto_eq_intros filterlim_ident)
 qed auto
 
 lemma
   shows integrable_inverse_1_plus_square:
       "set_integrable lborel (einterval (-\<infinity>) \<infinity>) (\<lambda>x. inverse (1 + x^2))"
   and LBINT_inverse_1_plus_square:
       "LBINT x=-\<infinity>..\<infinity>. inverse (1 + x^2) = pi"
 proof -
   have 1: "- (pi / 2) < x \<Longrightarrow> x * 2 < pi \<Longrightarrow> (tan has_real_derivative 1 + (tan x)\<^sup>2) (at x)" for x
     using cos_gt_zero_pi[of x] by (subst tan_sec) (auto intro!: DERIV_tan simp: power_inverse)
   have 2: "- (pi / 2) < x \<Longrightarrow> x * 2 < pi \<Longrightarrow> isCont (\<lambda>x. 1 + (tan x)\<^sup>2) x" for x
     using cos_gt_zero_pi[of x] by auto
   have 3: "\<lbrakk>- (pi / 2) < x; x * 2 < pi\<rbrakk>  \<Longrightarrow> isCont (\<lambda>x. inverse (1 + x\<^sup>2)) (tan x)" for x
     by (rule continuous_intros | simp add: add_nonneg_eq_0_iff)+
   show "LBINT x=-\<infinity>..\<infinity>. inverse (1 + x^2) = pi"
     by (subst interval_integral_substitution_nonneg[of "-pi/2" "pi/2" tan "\<lambda>x. 1 + (tan x)^2"])
        (auto intro: derivative_eq_intros 1 2 3 filterlim_tan_at_right
              simp add: ereal_tendsto_simps filterlim_tan_at_left add_nonneg_eq_0_iff set_integrable_def)
   show "set_integrable lborel (einterval (-\<infinity>) \<infinity>) (\<lambda>x. inverse (1 + x^2))"
     by (subst interval_integral_substitution_nonneg[of "-pi/2" "pi/2" tan "\<lambda>x. 1 + (tan x)^2"])
        (auto intro: derivative_eq_intros 1 2 3 filterlim_tan_at_right
              simp add: ereal_tendsto_simps filterlim_tan_at_left add_nonneg_eq_0_iff set_integrable_def)
 qed
 
 lemma
   shows integrable_I0i_1_div_plus_square:
     "interval_lebesgue_integrable lborel 0 \<infinity> (\<lambda>x. 1 / (1 + x^2))"
   and LBINT_I0i_1_div_plus_square:
     "LBINT x=0..\<infinity>. 1 / (1 + x^2) = pi / 2"
 proof -
   have 1: "0 < x \<Longrightarrow> x * 2 < pi \<Longrightarrow> (tan has_real_derivative 1 + (tan x)\<^sup>2) (at x)" for x
     using cos_gt_zero_pi[of x] by (subst tan_sec) (auto intro!: DERIV_tan simp: power_inverse)
   have 2: "0 < x \<Longrightarrow> x * 2 < pi \<Longrightarrow> isCont (\<lambda>x. 1 + (tan x)\<^sup>2) x" for x
     using cos_gt_zero_pi[of x] by auto
   show "LBINT x=0..\<infinity>. 1 / (1 + x^2) = pi / 2"
     by (subst interval_integral_substitution_nonneg[of "0" "pi/2" tan "\<lambda>x. 1 + (tan x)^2"])
        (auto intro: derivative_eq_intros 1 2 tendsto_eq_intros
              simp add: ereal_tendsto_simps filterlim_tan_at_left zero_ereal_def add_nonneg_eq_0_iff set_integrable_def)
   show "interval_lebesgue_integrable lborel 0 \<infinity> (\<lambda>x. 1 / (1 + x^2))"
     unfolding interval_lebesgue_integrable_def
     by (subst interval_integral_substitution_nonneg[of "0" "pi/2" tan "\<lambda>x. 1 + (tan x)^2"])
        (auto intro: derivative_eq_intros 1 2 tendsto_eq_intros
              simp add: ereal_tendsto_simps filterlim_tan_at_left zero_ereal_def add_nonneg_eq_0_iff set_integrable_def)
 qed
 
 section \<open>The sinc function, and the sine integral (Si)\<close>
 
 abbreviation sinc :: "real \<Rightarrow> real" where
   "sinc \<equiv> (\<lambda>x. if x = 0 then 1 else sin x / x)"
 
 lemma sinc_at_0: "((\<lambda>x. sin x / x::real) \<longlongrightarrow> 1) (at 0)"
   using DERIV_sin [of 0] by (auto simp add: has_field_derivative_def field_has_derivative_at)
 
 lemma isCont_sinc: "isCont sinc x"
 proof cases
   assume "x = 0" then show ?thesis
     using LIM_equal [where g = "\<lambda>x. sin x / x" and a=0 and f=sinc and l=1]
     by (auto simp: isCont_def sinc_at_0)
 next
   assume "x \<noteq> 0" show ?thesis
     by (rule continuous_transform_within [where d = "abs x" and f = "\<lambda>x. sin x / x"])
        (auto simp add: dist_real_def \<open>x \<noteq> 0\<close>)
 qed
 
 lemma continuous_on_sinc[continuous_intros]:
   "continuous_on S f \<Longrightarrow> continuous_on S (\<lambda>x. sinc (f x))"
   using continuous_on_compose[of S f sinc, OF _ continuous_at_imp_continuous_on]
   by (auto simp: isCont_sinc)
 
 lemma borel_measurable_sinc[measurable]: "sinc \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_at_imp_continuous_on ballI isCont_sinc)
 
 lemma sinc_AE: "AE x in lborel. sin x / x = sinc x"
   by (rule AE_I [where N = "{0}"], auto)
 
 definition Si :: "real \<Rightarrow> real" where "Si t \<equiv> LBINT x=0..t. sin x / x"
 
 lemma sinc_neg [simp]: "sinc (- x) = sinc x"
   by auto
 
 (* TODO: Determine whether this can reasonably be eliminated by redefining Si. *)
 lemma Si_alt_def : "Si t = LBINT x=0..t. sinc x"
 proof cases
   assume "0 \<le> t" then show ?thesis
     using AE_lborel_singleton[of 0]
     by (auto simp: Si_def intro!: interval_lebesgue_integral_cong_AE)
 next
   assume "\<not> 0 \<le> t" then show ?thesis
     unfolding Si_def using AE_lborel_singleton[of 0]
     by (subst (1 2) interval_integral_endpoints_reverse)
        (auto simp: Si_def intro!: interval_lebesgue_integral_cong_AE)
 qed
 
 lemma Si_neg:
   assumes "T \<ge> 0" shows "Si (- T) = - Si T"
 proof -
   have "LBINT x=ereal 0..T. -1 *\<^sub>R sinc (- x) = LBINT y= ereal (- 0)..ereal (- T). sinc y"
     by (rule interval_integral_substitution_finite [OF assms])
        (auto intro: derivative_intros continuous_at_imp_continuous_on isCont_sinc)
   also have "(LBINT x=ereal 0..T. -1 *\<^sub>R sinc (- x)) = -(LBINT x=ereal 0..T. sinc x)"
     by (subst sinc_neg) (simp_all add: interval_lebesgue_integral_uminus)
   finally have *: "-(LBINT x=ereal 0..T. sinc x) = LBINT y= ereal 0..ereal (- T). sinc y"
     by simp
   show ?thesis
     using assms unfolding Si_alt_def
     by (subst zero_ereal_def)+ (auto simp add: * [symmetric])
 qed
 
 lemma integrable_sinc':
   "interval_lebesgue_integrable lborel (ereal 0) (ereal T) (\<lambda>t. sin (t * \<theta>) / t)"
 proof -
   have *: "interval_lebesgue_integrable lborel (ereal 0) (ereal T) (\<lambda>t. \<theta> * sinc (t * \<theta>))"
     by (intro interval_lebesgue_integrable_mult_right interval_integrable_isCont continuous_within_compose3 [OF isCont_sinc])
        auto
   show ?thesis
     by (rule interval_lebesgue_integrable_cong_AE[THEN iffD1, OF _ _ _ *])
        (insert AE_lborel_singleton[of 0], auto)
 qed
 
 (* TODO: need a better version of FTC2 *)
 lemma DERIV_Si: "(Si has_real_derivative sinc x) (at x)"
 proof -
   have "(at x within {min 0 (x - 1)..max 0 (x + 1)}) = at x"
     by (intro at_within_interior) auto
   moreover have "min 0 (x - 1) \<le> x" "x \<le> max 0 (x + 1)"
     by auto
   ultimately show ?thesis
     using interval_integral_FTC2[of "min 0 (x - 1)" 0 "max 0 (x + 1)" sinc x]
     by (auto simp: continuous_at_imp_continuous_on isCont_sinc Si_alt_def[abs_def] zero_ereal_def
-                   has_field_derivative_iff_has_vector_derivative
+                   has_real_derivative_iff_has_vector_derivative
              split del: if_split)
 qed
 
 lemma isCont_Si: "isCont Si x"
   using DERIV_Si by (rule DERIV_isCont)
 
 lemma borel_measurable_Si[measurable]: "Si \<in> borel_measurable borel"
   by (auto intro: isCont_Si continuous_at_imp_continuous_on borel_measurable_continuous_onI)
 
 lemma Si_at_top_LBINT:
   "((\<lambda>t. (LBINT x=0..\<infinity>. exp (-(x * t)) * (x * sin t + cos t) / (1 + x^2))) \<longlongrightarrow> 0) at_top"
 proof -
   let ?F = "\<lambda>x t. exp (- (x * t)) * (x * sin t + cos t) / (1 + x\<^sup>2) :: real"
   have int: "set_integrable lborel {0<..} (\<lambda>x. exp (- x) * (x + 1) :: real)"
     unfolding distrib_left
     using has_bochner_integral_I0i_power_exp_m[of 0] has_bochner_integral_I0i_power_exp_m[of 1]
     by (intro set_integral_add) (auto dest!: integrable.intros simp: ac_simps set_integrable_def)
 
   have "((\<lambda>t::real. LBINT x:{0<..}. ?F x t) \<longlongrightarrow> LBINT x::real:{0<..}. 0) at_top"
     unfolding set_lebesgue_integral_def
   proof (rule integral_dominated_convergence_at_top[OF _ _ int [unfolded set_integrable_def]], 
          simp_all del: abs_divide split: split_indicator)
     have *: "0 < x \<Longrightarrow> \<bar>x * sin t + cos t\<bar> / (1 + x\<^sup>2) \<le> (x * 1 + 1) / 1" for x t :: real
       by (intro frac_le abs_triangle_ineq[THEN order_trans] add_mono)
          (auto simp add: abs_mult simp del: mult_1_right intro!: mult_mono)
     then have "1 \<le> t \<Longrightarrow> 0 < x \<Longrightarrow> \<bar>?F x t\<bar> \<le> exp (- x) * (x + 1)" for x t :: real
         by (auto simp add: abs_mult times_divide_eq_right[symmetric] simp del: times_divide_eq_right
                  intro!:  mult_mono)
     then show "\<forall>\<^sub>F i in at_top. AE x in lborel. 0 < x \<longrightarrow> \<bar>?F x i\<bar> \<le> exp (- x) * (x + 1)"
       by (auto intro: eventually_mono eventually_ge_at_top[of "1::real"])
     show "AE x in lborel. 0 < x \<longrightarrow> (?F x \<longlongrightarrow> 0) at_top"
     proof (intro always_eventually impI allI)
       fix x :: real assume "0 < x"
       show "((\<lambda>t. exp (- (x * t)) * (x * sin t + cos t) / (1 + x\<^sup>2)) \<longlongrightarrow> 0) at_top"
       proof (rule Lim_null_comparison)
         show "\<forall>\<^sub>F t in at_top. norm (?F x t) \<le> exp (- (x * t)) * (x + 1)"
           using eventually_ge_at_top[of "1::real"] * \<open>0 < x\<close>
           by (auto simp add: abs_mult times_divide_eq_right[symmetric] simp del: times_divide_eq_right
                    intro!: mult_mono elim: eventually_mono)
         show "((\<lambda>t. exp (- (x * t)) * (x + 1)) \<longlongrightarrow> 0) at_top"
           by (auto simp: filterlim_uminus_at_top [symmetric]
                    intro!: filterlim_tendsto_pos_mult_at_top[OF tendsto_const] \<open>0<x\<close> filterlim_ident
                            tendsto_mult_left_zero filterlim_compose[OF exp_at_bot])
       qed
     qed
   qed
   then show "((\<lambda>t. (LBINT x=0..\<infinity>. exp (-(x * t)) * (x * sin t + cos t) / (1 + x^2))) \<longlongrightarrow> 0) at_top"
     by (simp add: interval_lebesgue_integral_0_infty set_lebesgue_integral_def)
 qed
 
 lemma Si_at_top_integrable:
   assumes "t \<ge> 0"
   shows "interval_lebesgue_integrable lborel 0 \<infinity> (\<lambda>x. exp (- (x * t)) * (x * sin t + cos t) / (1 + x\<^sup>2))"
   using \<open>0 \<le> t\<close> unfolding le_less
 proof
   assume "0 = t" then show ?thesis
     using integrable_I0i_1_div_plus_square by simp
 next
   assume [arith]: "0 < t"
   have *: "0 \<le> a \<Longrightarrow> 0 < x \<Longrightarrow> a / (1 + x\<^sup>2) \<le> a" for a x :: real
     using zero_le_power2[of x, arith] using divide_left_mono[of 1 "1+x\<^sup>2" a] by auto
   have "set_integrable lborel {0<..} (\<lambda>x. (exp (- x) * x) * (sin t/t) + exp (- x) * cos t)"
     using has_bochner_integral_I0i_power_exp_m[of 0] has_bochner_integral_I0i_power_exp_m[of 1]
     by (intro set_integral_add set_integrable_mult_left)
        (auto dest!: integrable.intros simp: ac_simps set_integrable_def)
   from lborel_integrable_real_affine[OF this [unfolded set_integrable_def], of t 0]
   show ?thesis
     unfolding interval_lebesgue_integral_0_infty set_integrable_def
     by (rule Bochner_Integration.integrable_bound) (auto simp: field_simps * split: split_indicator)
 qed
 
 lemma Si_at_top: "(Si \<longlongrightarrow> pi / 2) at_top"
 proof -
   have \<dagger>: "\<forall>\<^sub>F t in at_top. pi / 2 - (LBINT u=0..\<infinity>. exp (-(u * t)) * (u * sin t + cos t) / (1 + u^2)) = Si t"
     using eventually_ge_at_top[of 0]
   proof eventually_elim
     fix t :: real assume "t \<ge> 0"
     have "Si t = LBINT x=0..t. sin x * (LBINT u=0..\<infinity>. exp (-(u * x)))"
       unfolding Si_def using \<open>0 \<le> t\<close>
       by (intro interval_integral_discrete_difference[where X="{0}"]) (auto simp: LBINT_I0i_exp_mscale)
     also have "\<dots> = LBINT x. (LBINT u=ereal 0..\<infinity>. indicator {0 <..< t} x *\<^sub>R sin x * exp (-(u * x)))"
       using \<open>0\<le>t\<close> by (simp add: zero_ereal_def interval_lebesgue_integral_le_eq mult_ac set_lebesgue_integral_def)
     also have "\<dots> = LBINT x. (LBINT u. indicator ({0<..} \<times> {0 <..< t}) (u, x) *\<^sub>R (sin x * exp (-(u * x))))"
       apply (subst interval_integral_Ioi)
       unfolding set_lebesgue_integral_def  by(simp_all add: indicator_times ac_simps )
     also have "\<dots> = LBINT u. (LBINT x. indicator ({0<..} \<times> {0 <..< t}) (u, x) *\<^sub>R (sin x * exp (-(u * x))))"
     proof (intro lborel_pair.Fubini_integral[symmetric] lborel_pair.Fubini_integrable)
       show "(\<lambda>(x, y). indicator ({0<..} \<times> {0<..<t}) (y, x) *\<^sub>R (sin x * exp (- (y * x))))
           \<in> borel_measurable (lborel \<Otimes>\<^sub>M lborel)" (is "?f \<in> borel_measurable _")
         by measurable
 
       have "AE x in lborel. indicator {0..t} x *\<^sub>R abs (sinc x) = LBINT y. norm (?f (x, y))"
         using AE_lborel_singleton[of 0] AE_lborel_singleton[of t]
       proof eventually_elim
         fix x :: real assume x: "x \<noteq> 0" "x \<noteq> t"
         have "LBINT y. \<bar>indicator ({0<..} \<times> {0<..<t}) (y, x) *\<^sub>R (sin x * exp (- (y * x)))\<bar> =
             LBINT y. \<bar>sin x\<bar> * exp (- (y * x)) * indicator {0<..} y * indicator {0<..<t} x"
           by (intro Bochner_Integration.integral_cong) (auto split: split_indicator simp: abs_mult)
         also have "\<dots> = \<bar>sin x\<bar> * indicator {0<..<t} x * (LBINT y=0..\<infinity>.  exp (- (y * x)))"
           by (cases "x > 0")
              (auto simp: field_simps interval_lebesgue_integral_0_infty set_lebesgue_integral_def split: split_indicator)
         also have "\<dots> = \<bar>sin x\<bar> * indicator {0<..<t} x * (1 / x)"
           by (cases "x > 0") (auto simp add: LBINT_I0i_exp_mscale)
         also have "\<dots> = indicator {0..t} x *\<^sub>R \<bar>sinc x\<bar>"
           using x by (simp add: field_simps split: split_indicator)
         finally show "indicator {0..t} x *\<^sub>R abs (sinc x) = LBINT y. norm (?f (x, y))"
           by simp
       qed
       moreover have "integrable lborel (\<lambda>x. indicat_real {0..t} x *\<^sub>R \<bar>sinc x\<bar>)"
         by (auto intro!: borel_integrable_compact continuous_intros simp del: real_scaleR_def)
       ultimately show "integrable lborel (\<lambda>x. LBINT y. norm (?f (x, y)))"
         by (rule integrable_cong_AE_imp[rotated 2]) simp
 
       have "0 < x \<Longrightarrow> set_integrable lborel {0<..} (\<lambda>y. sin x * exp (- (y * x)))" for x :: real
           by (intro set_integrable_mult_right integrable_I0i_exp_mscale)
       then show "AE x in lborel. integrable lborel (\<lambda>y. ?f (x, y))"
         by (intro AE_I2) (auto simp: indicator_times set_integrable_def split: split_indicator)
     qed
     also have "... = LBINT u=0..\<infinity>. (LBINT x=0..t. exp (-(u * x)) * sin x)"
       using \<open>0\<le>t\<close>
       by (auto simp: interval_lebesgue_integral_def set_lebesgue_integral_def zero_ereal_def ac_simps
                split: split_indicator intro!: Bochner_Integration.integral_cong)
     also have "\<dots> = LBINT u=0..\<infinity>. 1 / (1 + u\<^sup>2) - 1 / (1 + u\<^sup>2) * (exp (- (u * t)) * (u * sin t + cos t))"
       by (auto simp: divide_simps LBINT_I0c_exp_mscale_sin intro!: interval_integral_cong)
     also have "... = pi / 2 - (LBINT u=0..\<infinity>. exp (- (u * t)) * (u * sin t + cos t) / (1 + u^2))"
       using Si_at_top_integrable[OF \<open>0\<le>t\<close>] by (simp add: integrable_I0i_1_div_plus_square LBINT_I0i_1_div_plus_square)
     finally show "pi / 2 - (LBINT u=0..\<infinity>. exp (-(u * t)) * (u * sin t + cos t) / (1 + u^2)) = Si t" ..
   qed
   show ?thesis
     by (rule Lim_transform_eventually [OF _ \<dagger>])
        (auto intro!: tendsto_eq_intros Si_at_top_LBINT)
 qed
 
 subsection \<open>The final theorems: boundedness and scalability\<close>
 
 lemma bounded_Si: "\<exists>B. \<forall>T. \<bar>Si T\<bar> \<le> B"
 proof -
   have *: "0 \<le> y \<Longrightarrow> dist x y < z \<Longrightarrow> abs x \<le> y + z" for x y z :: real
     by (simp add: dist_real_def)
 
   have "eventually (\<lambda>T. dist (Si T) (pi / 2) < 1) at_top"
     using Si_at_top by (elim tendstoD) simp
   then have "eventually (\<lambda>T. 0 \<le> T \<and> \<bar>Si T\<bar> \<le> pi / 2 + 1) at_top"
     using eventually_ge_at_top[of 0] by eventually_elim (insert *[of "pi/2" "Si _" 1], auto)
   then have "\<exists>T. 0 \<le> T \<and> (\<forall>t \<ge> T. \<bar>Si t\<bar> \<le> pi / 2 + 1)"
     by (auto simp add: eventually_at_top_linorder)
   then obtain T where T: "0 \<le> T" "\<And>t. t \<ge> T \<Longrightarrow> \<bar>Si t\<bar> \<le> pi / 2 + 1"
     by auto
   moreover have "t \<le> - T \<Longrightarrow> \<bar>Si t\<bar> \<le> pi / 2 + 1" for t
     using T(1) T(2)[of "-t"] Si_neg[of "- t"] by simp
   moreover have "\<exists>M. \<forall>t. -T \<le> t \<and> t \<le> T \<longrightarrow> \<bar>Si t\<bar> \<le> M"
     by (rule isCont_bounded) (auto intro!: isCont_Si continuous_intros \<open>0 \<le> T\<close>)
   then obtain M where M: "\<And>t. -T \<le> t \<and> t \<le> T \<Longrightarrow> \<bar>Si t\<bar> \<le> M"
     by auto
   ultimately show ?thesis
     by (intro exI[of _ "max M (pi/2 + 1)"]) (meson le_max_iff_disj linorder_not_le order_le_less)
 qed
 
 lemma LBINT_I0c_sin_scale_divide:
   assumes "T \<ge> 0"
   shows "LBINT t=0..T. sin (t * \<theta>) / t = sgn \<theta> * Si (T * \<bar>\<theta>\<bar>)"
 proof -
   { assume "0 < \<theta>"
     have "(LBINT t=ereal 0..T. sin (t * \<theta>) / t) = (LBINT t=ereal 0..T. \<theta> *\<^sub>R sinc (t * \<theta>))"
       by (rule interval_integral_discrete_difference[of "{0}"]) auto
     also have "\<dots> = (LBINT t=ereal (0 * \<theta>)..T * \<theta>. sinc t)"
       apply (rule interval_integral_substitution_finite [OF assms])
       apply (subst mult.commute, rule DERIV_subset)
       by (auto intro!: derivative_intros continuous_at_imp_continuous_on isCont_sinc)
     also have "\<dots> = (LBINT t=ereal (0 * \<theta>)..T * \<theta>. sin t / t)"
       by (rule interval_integral_discrete_difference[of "{0}"]) auto
     finally have "(LBINT t=ereal 0..T. sin (t * \<theta>) / t) = (LBINT t=ereal 0..T * \<theta>. sin t / t)"
       by simp
     hence "LBINT x. indicator {0<..<T} x * sin (x * \<theta>) / x =
         LBINT x. indicator {0<..<T * \<theta>} x * sin x / x"
       using assms \<open>0 < \<theta>\<close> unfolding interval_lebesgue_integral_def einterval_eq zero_ereal_def
         by (auto simp: ac_simps set_lebesgue_integral_def)
   } note aux1 = this
   { assume "0 > \<theta>"
     have [simp]: "integrable lborel (\<lambda>x. sin (x * \<theta>) * indicator {0<..<T} x / x)"
       using integrable_sinc' [of T \<theta>] assms
       by (simp add: interval_lebesgue_integrable_def set_integrable_def ac_simps)
     have "(LBINT t=ereal 0..T. sin (t * -\<theta>) / t) = (LBINT t=ereal 0..T. -\<theta> *\<^sub>R sinc (t * -\<theta>))"
       by (rule interval_integral_discrete_difference[of "{0}"]) auto
     also have "\<dots> = (LBINT t=ereal (0 * -\<theta>)..T * -\<theta>. sinc t)"
       apply (rule interval_integral_substitution_finite [OF assms])
       apply (subst mult.commute, rule DERIV_subset)
       by (auto intro!: derivative_intros continuous_at_imp_continuous_on isCont_sinc)
     also have "\<dots> = (LBINT t=ereal (0 * -\<theta>)..T * -\<theta>. sin t / t)"
       by (rule interval_integral_discrete_difference[of "{0}"]) auto
     finally have "(LBINT t=ereal 0..T. sin (t * -\<theta>) / t) = (LBINT t=ereal 0..T * -\<theta>. sin t / t)"
       by simp
     hence "LBINT x. indicator {0<..<T} x * sin (x * \<theta>) / x =
        - (LBINT x. indicator {0<..<- (T * \<theta>)} x * sin x / x)"
       using assms \<open>0 > \<theta>\<close> unfolding interval_lebesgue_integral_def einterval_eq zero_ereal_def
         by (auto simp add: field_simps mult_le_0_iff set_lebesgue_integral_def split: if_split_asm)
   } note aux2 = this
   show ?thesis
     using assms unfolding Si_def interval_lebesgue_integral_def set_lebesgue_integral_def sgn_real_def einterval_eq zero_ereal_def
     by (auto simp: aux1 aux2)
 qed
 
 end
diff --git a/src/HOL/Topological_Spaces.thy b/src/HOL/Topological_Spaces.thy
--- a/src/HOL/Topological_Spaces.thy
+++ b/src/HOL/Topological_Spaces.thy
@@ -1,3814 +1,3819 @@
 (*  Title:      HOL/Topological_Spaces.thy
     Author:     Brian Huffman
     Author:     Johannes Hölzl
 *)
 
 section \<open>Topological Spaces\<close>
 
 theory Topological_Spaces
   imports Main
 begin
 
 named_theorems continuous_intros "structural introduction rules for continuity"
 
 subsection \<open>Topological space\<close>
 
 class "open" =
   fixes "open" :: "'a set \<Rightarrow> bool"
 
 class topological_space = "open" +
   assumes open_UNIV [simp, intro]: "open UNIV"
   assumes open_Int [intro]: "open S \<Longrightarrow> open T \<Longrightarrow> open (S \<inter> T)"
   assumes open_Union [intro]: "\<forall>S\<in>K. open S \<Longrightarrow> open (\<Union>K)"
 begin
 
 definition closed :: "'a set \<Rightarrow> bool"
   where "closed S \<longleftrightarrow> open (- S)"
 
 lemma open_empty [continuous_intros, intro, simp]: "open {}"
   using open_Union [of "{}"] by simp
 
 lemma open_Un [continuous_intros, intro]: "open S \<Longrightarrow> open T \<Longrightarrow> open (S \<union> T)"
   using open_Union [of "{S, T}"] by simp
 
 lemma open_UN [continuous_intros, intro]: "\<forall>x\<in>A. open (B x) \<Longrightarrow> open (\<Union>x\<in>A. B x)"
   using open_Union [of "B ` A"] by simp
 
 lemma open_Inter [continuous_intros, intro]: "finite S \<Longrightarrow> \<forall>T\<in>S. open T \<Longrightarrow> open (\<Inter>S)"
   by (induction set: finite) auto
 
 lemma open_INT [continuous_intros, intro]: "finite A \<Longrightarrow> \<forall>x\<in>A. open (B x) \<Longrightarrow> open (\<Inter>x\<in>A. B x)"
   using open_Inter [of "B ` A"] by simp
 
 lemma openI:
   assumes "\<And>x. x \<in> S \<Longrightarrow> \<exists>T. open T \<and> x \<in> T \<and> T \<subseteq> S"
   shows "open S"
 proof -
   have "open (\<Union>{T. open T \<and> T \<subseteq> S})" by auto
   moreover have "\<Union>{T. open T \<and> T \<subseteq> S} = S" by (auto dest!: assms)
   ultimately show "open S" by simp
 qed
 
 lemma open_subopen: "open S \<longleftrightarrow> (\<forall>x\<in>S. \<exists>T. open T \<and> x \<in> T \<and> T \<subseteq> S)"
 by (auto intro: openI)
 
 lemma closed_empty [continuous_intros, intro, simp]: "closed {}"
   unfolding closed_def by simp
 
 lemma closed_Un [continuous_intros, intro]: "closed S \<Longrightarrow> closed T \<Longrightarrow> closed (S \<union> T)"
   unfolding closed_def by auto
 
 lemma closed_UNIV [continuous_intros, intro, simp]: "closed UNIV"
   unfolding closed_def by simp
 
 lemma closed_Int [continuous_intros, intro]: "closed S \<Longrightarrow> closed T \<Longrightarrow> closed (S \<inter> T)"
   unfolding closed_def by auto
 
 lemma closed_INT [continuous_intros, intro]: "\<forall>x\<in>A. closed (B x) \<Longrightarrow> closed (\<Inter>x\<in>A. B x)"
   unfolding closed_def by auto
 
 lemma closed_Inter [continuous_intros, intro]: "\<forall>S\<in>K. closed S \<Longrightarrow> closed (\<Inter>K)"
   unfolding closed_def uminus_Inf by auto
 
 lemma closed_Union [continuous_intros, intro]: "finite S \<Longrightarrow> \<forall>T\<in>S. closed T \<Longrightarrow> closed (\<Union>S)"
   by (induct set: finite) auto
 
 lemma closed_UN [continuous_intros, intro]:
   "finite A \<Longrightarrow> \<forall>x\<in>A. closed (B x) \<Longrightarrow> closed (\<Union>x\<in>A. B x)"
   using closed_Union [of "B ` A"] by simp
 
 lemma open_closed: "open S \<longleftrightarrow> closed (- S)"
   by (simp add: closed_def)
 
 lemma closed_open: "closed S \<longleftrightarrow> open (- S)"
   by (rule closed_def)
 
 lemma open_Diff [continuous_intros, intro]: "open S \<Longrightarrow> closed T \<Longrightarrow> open (S - T)"
   by (simp add: closed_open Diff_eq open_Int)
 
 lemma closed_Diff [continuous_intros, intro]: "closed S \<Longrightarrow> open T \<Longrightarrow> closed (S - T)"
   by (simp add: open_closed Diff_eq closed_Int)
 
 lemma open_Compl [continuous_intros, intro]: "closed S \<Longrightarrow> open (- S)"
   by (simp add: closed_open)
 
 lemma closed_Compl [continuous_intros, intro]: "open S \<Longrightarrow> closed (- S)"
   by (simp add: open_closed)
 
 lemma open_Collect_neg: "closed {x. P x} \<Longrightarrow> open {x. \<not> P x}"
   unfolding Collect_neg_eq by (rule open_Compl)
 
 lemma open_Collect_conj:
   assumes "open {x. P x}" "open {x. Q x}"
   shows "open {x. P x \<and> Q x}"
   using open_Int[OF assms] by (simp add: Int_def)
 
 lemma open_Collect_disj:
   assumes "open {x. P x}" "open {x. Q x}"
   shows "open {x. P x \<or> Q x}"
   using open_Un[OF assms] by (simp add: Un_def)
 
 lemma open_Collect_ex: "(\<And>i. open {x. P i x}) \<Longrightarrow> open {x. \<exists>i. P i x}"
   using open_UN[of UNIV "\<lambda>i. {x. P i x}"] unfolding Collect_ex_eq by simp
 
 lemma open_Collect_imp: "closed {x. P x} \<Longrightarrow> open {x. Q x} \<Longrightarrow> open {x. P x \<longrightarrow> Q x}"
   unfolding imp_conv_disj by (intro open_Collect_disj open_Collect_neg)
 
 lemma open_Collect_const: "open {x. P}"
   by (cases P) auto
 
 lemma closed_Collect_neg: "open {x. P x} \<Longrightarrow> closed {x. \<not> P x}"
   unfolding Collect_neg_eq by (rule closed_Compl)
 
 lemma closed_Collect_conj:
   assumes "closed {x. P x}" "closed {x. Q x}"
   shows "closed {x. P x \<and> Q x}"
   using closed_Int[OF assms] by (simp add: Int_def)
 
 lemma closed_Collect_disj:
   assumes "closed {x. P x}" "closed {x. Q x}"
   shows "closed {x. P x \<or> Q x}"
   using closed_Un[OF assms] by (simp add: Un_def)
 
 lemma closed_Collect_all: "(\<And>i. closed {x. P i x}) \<Longrightarrow> closed {x. \<forall>i. P i x}"
   using closed_INT[of UNIV "\<lambda>i. {x. P i x}"] by (simp add: Collect_all_eq)
 
 lemma closed_Collect_imp: "open {x. P x} \<Longrightarrow> closed {x. Q x} \<Longrightarrow> closed {x. P x \<longrightarrow> Q x}"
   unfolding imp_conv_disj by (intro closed_Collect_disj closed_Collect_neg)
 
 lemma closed_Collect_const: "closed {x. P}"
   by (cases P) auto
 
 end
 
 
 subsection \<open>Hausdorff and other separation properties\<close>
 
 class t0_space = topological_space +
   assumes t0_space: "x \<noteq> y \<Longrightarrow> \<exists>U. open U \<and> \<not> (x \<in> U \<longleftrightarrow> y \<in> U)"
 
 class t1_space = topological_space +
   assumes t1_space: "x \<noteq> y \<Longrightarrow> \<exists>U. open U \<and> x \<in> U \<and> y \<notin> U"
 
 instance t1_space \<subseteq> t0_space
   by standard (fast dest: t1_space)
 
 context t1_space begin
 
 lemma separation_t1: "x \<noteq> y \<longleftrightarrow> (\<exists>U. open U \<and> x \<in> U \<and> y \<notin> U)"
   using t1_space[of x y] by blast
 
 lemma closed_singleton [iff]: "closed {a}"
 proof -
   let ?T = "\<Union>{S. open S \<and> a \<notin> S}"
   have "open ?T"
     by (simp add: open_Union)
   also have "?T = - {a}"
     by (auto simp add: set_eq_iff separation_t1)
   finally show "closed {a}"
     by (simp only: closed_def)
 qed
 
 lemma closed_insert [continuous_intros, simp]:
   assumes "closed S"
   shows "closed (insert a S)"
 proof -
   from closed_singleton assms have "closed ({a} \<union> S)"
     by (rule closed_Un)
   then show "closed (insert a S)"
     by simp
 qed
 
 lemma finite_imp_closed: "finite S \<Longrightarrow> closed S"
   by (induct pred: finite) simp_all
 
 end
 
 text \<open>T2 spaces are also known as Hausdorff spaces.\<close>
 
 class t2_space = topological_space +
   assumes hausdorff: "x \<noteq> y \<Longrightarrow> \<exists>U V. open U \<and> open V \<and> x \<in> U \<and> y \<in> V \<and> U \<inter> V = {}"
 
 instance t2_space \<subseteq> t1_space
   by standard (fast dest: hausdorff)
 
 lemma (in t2_space) separation_t2: "x \<noteq> y \<longleftrightarrow> (\<exists>U V. open U \<and> open V \<and> x \<in> U \<and> y \<in> V \<and> U \<inter> V = {})"
   using hausdorff [of x y] by blast
 
 lemma (in t0_space) separation_t0: "x \<noteq> y \<longleftrightarrow> (\<exists>U. open U \<and> \<not> (x \<in> U \<longleftrightarrow> y \<in> U))"
   using t0_space [of x y] by blast
 
 
 text \<open>A classical separation axiom for topological space, the T3 axiom -- also called regularity:
 if a point is not in a closed set, then there are open sets separating them.\<close>
 
 class t3_space = t2_space +
   assumes t3_space: "closed S \<Longrightarrow> y \<notin> S \<Longrightarrow> \<exists>U V. open U \<and> open V \<and> y \<in> U \<and> S \<subseteq> V \<and> U \<inter> V = {}"
 
 text \<open>A classical separation axiom for topological space, the T4 axiom -- also called normality:
 if two closed sets are disjoint, then there are open sets separating them.\<close>
 
 class t4_space = t2_space +
   assumes t4_space: "closed S \<Longrightarrow> closed T \<Longrightarrow> S \<inter> T = {} \<Longrightarrow> \<exists>U V. open U \<and> open V \<and> S \<subseteq> U \<and> T \<subseteq> V \<and> U \<inter> V = {}"
 
 text \<open>T4 is stronger than T3, and weaker than metric.\<close>
 
 instance t4_space \<subseteq> t3_space
 proof
   fix S and y::'a assume "closed S" "y \<notin> S"
   then show "\<exists>U V. open U \<and> open V \<and> y \<in> U \<and> S \<subseteq> V \<and> U \<inter> V = {}"
     using t4_space[of "{y}" S] by auto
 qed
 
 text \<open>A perfect space is a topological space with no isolated points.\<close>
 
 class perfect_space = topological_space +
   assumes not_open_singleton: "\<not> open {x}"
 
 lemma (in perfect_space) UNIV_not_singleton: "UNIV \<noteq> {x}"
   for x::'a
   by (metis (no_types) open_UNIV not_open_singleton)
 
 
 subsection \<open>Generators for toplogies\<close>
 
 inductive generate_topology :: "'a set set \<Rightarrow> 'a set \<Rightarrow> bool" for S :: "'a set set"
   where
     UNIV: "generate_topology S UNIV"
   | Int: "generate_topology S (a \<inter> b)" if "generate_topology S a" and "generate_topology S b"
   | UN: "generate_topology S (\<Union>K)" if "(\<And>k. k \<in> K \<Longrightarrow> generate_topology S k)"
   | Basis: "generate_topology S s" if "s \<in> S"
 
 hide_fact (open) UNIV Int UN Basis
 
 lemma generate_topology_Union:
   "(\<And>k. k \<in> I \<Longrightarrow> generate_topology S (K k)) \<Longrightarrow> generate_topology S (\<Union>k\<in>I. K k)"
   using generate_topology.UN [of "K ` I"] by auto
 
 lemma topological_space_generate_topology: "class.topological_space (generate_topology S)"
   by standard (auto intro: generate_topology.intros)
 
 
 subsection \<open>Order topologies\<close>
 
 class order_topology = order + "open" +
   assumes open_generated_order: "open = generate_topology (range (\<lambda>a. {..< a}) \<union> range (\<lambda>a. {a <..}))"
 begin
 
 subclass topological_space
   unfolding open_generated_order
   by (rule topological_space_generate_topology)
 
 lemma open_greaterThan [continuous_intros, simp]: "open {a <..}"
   unfolding open_generated_order by (auto intro: generate_topology.Basis)
 
 lemma open_lessThan [continuous_intros, simp]: "open {..< a}"
   unfolding open_generated_order by (auto intro: generate_topology.Basis)
 
 lemma open_greaterThanLessThan [continuous_intros, simp]: "open {a <..< b}"
    unfolding greaterThanLessThan_eq by (simp add: open_Int)
 
 end
 
 class linorder_topology = linorder + order_topology
 
 lemma closed_atMost [continuous_intros, simp]: "closed {..a}"
   for a :: "'a::linorder_topology"
   by (simp add: closed_open)
 
 lemma closed_atLeast [continuous_intros, simp]: "closed {a..}"
   for a :: "'a::linorder_topology"
   by (simp add: closed_open)
 
 lemma closed_atLeastAtMost [continuous_intros, simp]: "closed {a..b}"
   for a b :: "'a::linorder_topology"
 proof -
   have "{a .. b} = {a ..} \<inter> {.. b}"
     by auto
   then show ?thesis
     by (simp add: closed_Int)
 qed
 
 lemma (in order) less_separate:
   assumes "x < y"
   shows "\<exists>a b. x \<in> {..< a} \<and> y \<in> {b <..} \<and> {..< a} \<inter> {b <..} = {}"
 proof (cases "\<exists>z. x < z \<and> z < y")
   case True
   then obtain z where "x < z \<and> z < y" ..
   then have "x \<in> {..< z} \<and> y \<in> {z <..} \<and> {z <..} \<inter> {..< z} = {}"
     by auto
   then show ?thesis by blast
 next
   case False
   with \<open>x < y\<close> have "x \<in> {..< y}" "y \<in> {x <..}" "{x <..} \<inter> {..< y} = {}"
     by auto
   then show ?thesis by blast
 qed
 
 instance linorder_topology \<subseteq> t2_space
 proof
   fix x y :: 'a
   show "x \<noteq> y \<Longrightarrow> \<exists>U V. open U \<and> open V \<and> x \<in> U \<and> y \<in> V \<and> U \<inter> V = {}"
     using less_separate [of x y] less_separate [of y x]
     by (elim neqE; metis open_lessThan open_greaterThan Int_commute)
 qed
 
 lemma (in linorder_topology) open_right:
   assumes "open S" "x \<in> S"
     and gt_ex: "x < y"
   shows "\<exists>b>x. {x ..< b} \<subseteq> S"
   using assms unfolding open_generated_order
 proof induct
   case UNIV
   then show ?case by blast
 next
   case (Int A B)
   then obtain a b where "a > x" "{x ..< a} \<subseteq> A"  "b > x" "{x ..< b} \<subseteq> B"
     by auto
   then show ?case
     by (auto intro!: exI[of _ "min a b"])
 next
   case UN
   then show ?case by blast
 next
   case Basis
   then show ?case
     by (fastforce intro: exI[of _ y] gt_ex)
 qed
 
 lemma (in linorder_topology) open_left:
   assumes "open S" "x \<in> S"
     and lt_ex: "y < x"
   shows "\<exists>b<x. {b <.. x} \<subseteq> S"
   using assms unfolding open_generated_order
 proof induction
   case UNIV
   then show ?case by blast
 next
   case (Int A B)
   then obtain a b where "a < x" "{a <.. x} \<subseteq> A"  "b < x" "{b <.. x} \<subseteq> B"
     by auto
   then show ?case
     by (auto intro!: exI[of _ "max a b"])
 next
   case UN
   then show ?case by blast
 next
   case Basis
   then show ?case
     by (fastforce intro: exI[of _ y] lt_ex)
 qed
 
 
 subsection \<open>Setup some topologies\<close>
 
 subsubsection \<open>Boolean is an order topology\<close>
 
 class discrete_topology = topological_space +
   assumes open_discrete: "\<And>A. open A"
 
 instance discrete_topology < t2_space
 proof
   fix x y :: 'a
   assume "x \<noteq> y"
   then show "\<exists>U V. open U \<and> open V \<and> x \<in> U \<and> y \<in> V \<and> U \<inter> V = {}"
     by (intro exI[of _ "{_}"]) (auto intro!: open_discrete)
 qed
 
 instantiation bool :: linorder_topology
 begin
 
 definition open_bool :: "bool set \<Rightarrow> bool"
   where "open_bool = generate_topology (range (\<lambda>a. {..< a}) \<union> range (\<lambda>a. {a <..}))"
 
 instance
   by standard (rule open_bool_def)
 
 end
 
 instance bool :: discrete_topology
 proof
   fix A :: "bool set"
   have *: "{False <..} = {True}" "{..< True} = {False}"
     by auto
   have "A = UNIV \<or> A = {} \<or> A = {False <..} \<or> A = {..< True}"
     using subset_UNIV[of A] unfolding UNIV_bool * by blast
   then show "open A"
     by auto
 qed
 
 instantiation nat :: linorder_topology
 begin
 
 definition open_nat :: "nat set \<Rightarrow> bool"
   where "open_nat = generate_topology (range (\<lambda>a. {..< a}) \<union> range (\<lambda>a. {a <..}))"
 
 instance
   by standard (rule open_nat_def)
 
 end
 
 instance nat :: discrete_topology
 proof
   fix A :: "nat set"
   have "open {n}" for n :: nat
   proof (cases n)
     case 0
     moreover have "{0} = {..<1::nat}"
       by auto
     ultimately show ?thesis
        by auto
   next
     case (Suc n')
     then have "{n} = {..<Suc n} \<inter> {n' <..}"
       by auto
     with Suc show ?thesis
       by (auto intro: open_lessThan open_greaterThan)
   qed
   then have "open (\<Union>a\<in>A. {a})"
     by (intro open_UN) auto
   then show "open A"
     by simp
 qed
 
 instantiation int :: linorder_topology
 begin
 
 definition open_int :: "int set \<Rightarrow> bool"
   where "open_int = generate_topology (range (\<lambda>a. {..< a}) \<union> range (\<lambda>a. {a <..}))"
 
 instance
   by standard (rule open_int_def)
 
 end
 
 instance int :: discrete_topology
 proof
   fix A :: "int set"
   have "{..<i + 1} \<inter> {i-1 <..} = {i}" for i :: int
     by auto
   then have "open {i}" for i :: int
     using open_Int[OF open_lessThan[of "i + 1"] open_greaterThan[of "i - 1"]] by auto
   then have "open (\<Union>a\<in>A. {a})"
     by (intro open_UN) auto
   then show "open A"
     by simp
 qed
 
 
 subsubsection \<open>Topological filters\<close>
 
 definition (in topological_space) nhds :: "'a \<Rightarrow> 'a filter"
   where "nhds a = (INF S\<in>{S. open S \<and> a \<in> S}. principal S)"
 
 definition (in topological_space) at_within :: "'a \<Rightarrow> 'a set \<Rightarrow> 'a filter"
     ("at (_)/ within (_)" [1000, 60] 60)
   where "at a within s = inf (nhds a) (principal (s - {a}))"
 
 abbreviation (in topological_space) at :: "'a \<Rightarrow> 'a filter"  ("at")
   where "at x \<equiv> at x within (CONST UNIV)"
 
 abbreviation (in order_topology) at_right :: "'a \<Rightarrow> 'a filter"
   where "at_right x \<equiv> at x within {x <..}"
 
 abbreviation (in order_topology) at_left :: "'a \<Rightarrow> 'a filter"
   where "at_left x \<equiv> at x within {..< x}"
 
 lemma (in topological_space) nhds_generated_topology:
   "open = generate_topology T \<Longrightarrow> nhds x = (INF S\<in>{S\<in>T. x \<in> S}. principal S)"
   unfolding nhds_def
 proof (safe intro!: antisym INF_greatest)
   fix S
   assume "generate_topology T S" "x \<in> S"
   then show "(INF S\<in>{S \<in> T. x \<in> S}. principal S) \<le> principal S"
     by induct
       (auto intro: INF_lower order_trans simp: inf_principal[symmetric] simp del: inf_principal)
 qed (auto intro!: INF_lower intro: generate_topology.intros)
 
 lemma (in topological_space) eventually_nhds:
   "eventually P (nhds a) \<longleftrightarrow> (\<exists>S. open S \<and> a \<in> S \<and> (\<forall>x\<in>S. P x))"
   unfolding nhds_def by (subst eventually_INF_base) (auto simp: eventually_principal)
 
 lemma eventually_eventually:
   "eventually (\<lambda>y. eventually P (nhds y)) (nhds x) = eventually P (nhds x)"
   by (auto simp: eventually_nhds)
 
 lemma (in topological_space) eventually_nhds_in_open:
   "open s \<Longrightarrow> x \<in> s \<Longrightarrow> eventually (\<lambda>y. y \<in> s) (nhds x)"
   by (subst eventually_nhds) blast
 
 lemma (in topological_space) eventually_nhds_x_imp_x: "eventually P (nhds x) \<Longrightarrow> P x"
   by (subst (asm) eventually_nhds) blast
 
 lemma (in topological_space) nhds_neq_bot [simp]: "nhds a \<noteq> bot"
   by (simp add: trivial_limit_def eventually_nhds)
 
 lemma (in t1_space) t1_space_nhds: "x \<noteq> y \<Longrightarrow> (\<forall>\<^sub>F x in nhds x. x \<noteq> y)"
   by (drule t1_space) (auto simp: eventually_nhds)
 
 lemma (in topological_space) nhds_discrete_open: "open {x} \<Longrightarrow> nhds x = principal {x}"
   by (auto simp: nhds_def intro!: antisym INF_greatest INF_lower2[of "{x}"])
 
 lemma (in discrete_topology) nhds_discrete: "nhds x = principal {x}"
   by (simp add: nhds_discrete_open open_discrete)
 
 lemma (in discrete_topology) at_discrete: "at x within S = bot"
   unfolding at_within_def nhds_discrete by simp
 
 lemma (in discrete_topology) tendsto_discrete:
   "filterlim (f :: 'b \<Rightarrow> 'a) (nhds y) F \<longleftrightarrow> eventually (\<lambda>x. f x = y) F"
   by (auto simp: nhds_discrete filterlim_principal)
 
 lemma (in topological_space) at_within_eq:
   "at x within s = (INF S\<in>{S. open S \<and> x \<in> S}. principal (S \<inter> s - {x}))"
   unfolding nhds_def at_within_def
   by (subst INF_inf_const2[symmetric]) (auto simp: Diff_Int_distrib)
 
 lemma (in topological_space) eventually_at_filter:
   "eventually P (at a within s) \<longleftrightarrow> eventually (\<lambda>x. x \<noteq> a \<longrightarrow> x \<in> s \<longrightarrow> P x) (nhds a)"
   by (simp add: at_within_def eventually_inf_principal imp_conjL[symmetric] conj_commute)
 
 lemma (in topological_space) at_le: "s \<subseteq> t \<Longrightarrow> at x within s \<le> at x within t"
   unfolding at_within_def by (intro inf_mono) auto
 
 lemma (in topological_space) eventually_at_topological:
   "eventually P (at a within s) \<longleftrightarrow> (\<exists>S. open S \<and> a \<in> S \<and> (\<forall>x\<in>S. x \<noteq> a \<longrightarrow> x \<in> s \<longrightarrow> P x))"
   by (simp add: eventually_nhds eventually_at_filter)
 
 lemma (in topological_space) at_within_open: "a \<in> S \<Longrightarrow> open S \<Longrightarrow> at a within S = at a"
   unfolding filter_eq_iff eventually_at_topological by (metis open_Int Int_iff UNIV_I)
 
 lemma (in topological_space) at_within_open_NO_MATCH:
   "a \<in> s \<Longrightarrow> open s \<Longrightarrow> NO_MATCH UNIV s \<Longrightarrow> at a within s = at a"
   by (simp only: at_within_open)
 
 lemma (in topological_space) at_within_open_subset:
   "a \<in> S \<Longrightarrow> open S \<Longrightarrow> S \<subseteq> T \<Longrightarrow> at a within T = at a"
   by (metis at_le at_within_open dual_order.antisym subset_UNIV)
 
 lemma (in topological_space) at_within_nhd:
   assumes "x \<in> S" "open S" "T \<inter> S - {x} = U \<inter> S - {x}"
   shows "at x within T = at x within U"
   unfolding filter_eq_iff eventually_at_filter
 proof (intro allI eventually_subst)
   have "eventually (\<lambda>x. x \<in> S) (nhds x)"
     using \<open>x \<in> S\<close> \<open>open S\<close> by (auto simp: eventually_nhds)
   then show "\<forall>\<^sub>F n in nhds x. (n \<noteq> x \<longrightarrow> n \<in> T \<longrightarrow> P n) = (n \<noteq> x \<longrightarrow> n \<in> U \<longrightarrow> P n)" for P
     by eventually_elim (insert \<open>T \<inter> S - {x} = U \<inter> S - {x}\<close>, blast)
 qed
 
 lemma (in topological_space) at_within_empty [simp]: "at a within {} = bot"
   unfolding at_within_def by simp
 
 lemma (in topological_space) at_within_union:
   "at x within (S \<union> T) = sup (at x within S) (at x within T)"
   unfolding filter_eq_iff eventually_sup eventually_at_filter
   by (auto elim!: eventually_rev_mp)
 
 lemma (in topological_space) at_eq_bot_iff: "at a = bot \<longleftrightarrow> open {a}"
   unfolding trivial_limit_def eventually_at_topological
   by (metis UNIV_I empty_iff is_singletonE is_singletonI' singleton_iff)
 
 lemma (in perfect_space) at_neq_bot [simp]: "at a \<noteq> bot"
   by (simp add: at_eq_bot_iff not_open_singleton)
 
 lemma (in order_topology) nhds_order:
   "nhds x = inf (INF a\<in>{x <..}. principal {..< a}) (INF a\<in>{..< x}. principal {a <..})"
 proof -
   have 1: "{S \<in> range lessThan \<union> range greaterThan. x \<in> S} =
       (\<lambda>a. {..< a}) ` {x <..} \<union> (\<lambda>a. {a <..}) ` {..< x}"
     by auto
   show ?thesis
     by (simp only: nhds_generated_topology[OF open_generated_order] INF_union 1 INF_image comp_def)
 qed
 
 lemma (in topological_space) filterlim_at_within_If:
   assumes "filterlim f G (at x within (A \<inter> {x. P x}))"
     and "filterlim g G (at x within (A \<inter> {x. \<not>P x}))"
   shows "filterlim (\<lambda>x. if P x then f x else g x) G (at x within A)"
 proof (rule filterlim_If)
   note assms(1)
   also have "at x within (A \<inter> {x. P x}) = inf (nhds x) (principal (A \<inter> Collect P - {x}))"
     by (simp add: at_within_def)
   also have "A \<inter> Collect P - {x} = (A - {x}) \<inter> Collect P"
     by blast
   also have "inf (nhds x) (principal \<dots>) = inf (at x within A) (principal (Collect P))"
     by (simp add: at_within_def inf_assoc)
   finally show "filterlim f G (inf (at x within A) (principal (Collect P)))" .
 next
   note assms(2)
   also have "at x within (A \<inter> {x. \<not> P x}) = inf (nhds x) (principal (A \<inter> {x. \<not> P x} - {x}))"
     by (simp add: at_within_def)
   also have "A \<inter> {x. \<not> P x} - {x} = (A - {x}) \<inter> {x. \<not> P x}"
     by blast
   also have "inf (nhds x) (principal \<dots>) = inf (at x within A) (principal {x. \<not> P x})"
     by (simp add: at_within_def inf_assoc)
   finally show "filterlim g G (inf (at x within A) (principal {x. \<not> P x}))" .
 qed
 
 lemma (in topological_space) filterlim_at_If:
   assumes "filterlim f G (at x within {x. P x})"
     and "filterlim g G (at x within {x. \<not>P x})"
   shows "filterlim (\<lambda>x. if P x then f x else g x) G (at x)"
   using assms by (intro filterlim_at_within_If) simp_all
 lemma (in linorder_topology) at_within_order:
   assumes "UNIV \<noteq> {x}"
   shows "at x within s =
     inf (INF a\<in>{x <..}. principal ({..< a} \<inter> s - {x}))
         (INF a\<in>{..< x}. principal ({a <..} \<inter> s - {x}))"
 proof (cases "{x <..} = {}" "{..< x} = {}" rule: case_split [case_product case_split])
   case True_True
   have "UNIV = {..< x} \<union> {x} \<union> {x <..}"
     by auto
   with assms True_True show ?thesis
     by auto
 qed (auto simp del: inf_principal simp: at_within_def nhds_order Int_Diff
       inf_principal[symmetric] INF_inf_const2 inf_sup_aci[where 'a="'a filter"])
 
 lemma (in linorder_topology) at_left_eq:
   "y < x \<Longrightarrow> at_left x = (INF a\<in>{..< x}. principal {a <..< x})"
   by (subst at_within_order)
      (auto simp: greaterThan_Int_greaterThan greaterThanLessThan_eq[symmetric] min.absorb2 INF_constant
            intro!: INF_lower2 inf_absorb2)
 
 lemma (in linorder_topology) eventually_at_left:
   "y < x \<Longrightarrow> eventually P (at_left x) \<longleftrightarrow> (\<exists>b<x. \<forall>y>b. y < x \<longrightarrow> P y)"
   unfolding at_left_eq
   by (subst eventually_INF_base) (auto simp: eventually_principal Ball_def)
 
 lemma (in linorder_topology) at_right_eq:
   "x < y \<Longrightarrow> at_right x = (INF a\<in>{x <..}. principal {x <..< a})"
   by (subst at_within_order)
      (auto simp: lessThan_Int_lessThan greaterThanLessThan_eq[symmetric] max.absorb2 INF_constant Int_commute
            intro!: INF_lower2 inf_absorb1)
 
 lemma (in linorder_topology) eventually_at_right:
   "x < y \<Longrightarrow> eventually P (at_right x) \<longleftrightarrow> (\<exists>b>x. \<forall>y>x. y < b \<longrightarrow> P y)"
   unfolding at_right_eq
   by (subst eventually_INF_base) (auto simp: eventually_principal Ball_def)
 
 lemma eventually_at_right_less: "\<forall>\<^sub>F y in at_right (x::'a::{linorder_topology, no_top}). x < y"
   using gt_ex[of x] eventually_at_right[of x] by auto
 
 lemma trivial_limit_at_right_top: "at_right (top::_::{order_top,linorder_topology}) = bot"
   by (auto simp: filter_eq_iff eventually_at_topological)
 
 lemma trivial_limit_at_left_bot: "at_left (bot::_::{order_bot,linorder_topology}) = bot"
   by (auto simp: filter_eq_iff eventually_at_topological)
 
 lemma trivial_limit_at_left_real [simp]: "\<not> trivial_limit (at_left x)"
   for x :: "'a::{no_bot,dense_order,linorder_topology}"
   using lt_ex [of x]
   by safe (auto simp add: trivial_limit_def eventually_at_left dest: dense)
 
 lemma trivial_limit_at_right_real [simp]: "\<not> trivial_limit (at_right x)"
   for x :: "'a::{no_top,dense_order,linorder_topology}"
   using gt_ex[of x]
   by safe (auto simp add: trivial_limit_def eventually_at_right dest: dense)
 
 lemma (in linorder_topology) at_eq_sup_left_right: "at x = sup (at_left x) (at_right x)"
   by (auto simp: eventually_at_filter filter_eq_iff eventually_sup
       elim: eventually_elim2 eventually_mono)
 
 lemma (in linorder_topology) eventually_at_split:
   "eventually P (at x) \<longleftrightarrow> eventually P (at_left x) \<and> eventually P (at_right x)"
   by (subst at_eq_sup_left_right) (simp add: eventually_sup)
 
 lemma (in order_topology) eventually_at_leftI:
   assumes "\<And>x. x \<in> {a<..<b} \<Longrightarrow> P x" "a < b"
   shows   "eventually P (at_left b)"
   using assms unfolding eventually_at_topological by (intro exI[of _ "{a<..}"]) auto
 
 lemma (in order_topology) eventually_at_rightI:
   assumes "\<And>x. x \<in> {a<..<b} \<Longrightarrow> P x" "a < b"
   shows   "eventually P (at_right a)"
   using assms unfolding eventually_at_topological by (intro exI[of _ "{..<b}"]) auto
 
 lemma eventually_filtercomap_nhds:
   "eventually P (filtercomap f (nhds x)) \<longleftrightarrow> (\<exists>S. open S \<and> x \<in> S \<and> (\<forall>x. f x \<in> S \<longrightarrow> P x))"
   unfolding eventually_filtercomap eventually_nhds by auto
 
 lemma eventually_filtercomap_at_topological:
   "eventually P (filtercomap f (at A within B)) \<longleftrightarrow> 
      (\<exists>S. open S \<and> A \<in> S \<and> (\<forall>x. f x \<in> S \<inter> B - {A} \<longrightarrow> P x))" (is "?lhs = ?rhs")
   unfolding at_within_def filtercomap_inf eventually_inf_principal filtercomap_principal 
           eventually_filtercomap_nhds eventually_principal by blast
 
 lemma eventually_at_right_field:
   "eventually P (at_right x) \<longleftrightarrow> (\<exists>b>x. \<forall>y>x. y < b \<longrightarrow> P y)"
   for x :: "'a::{linordered_field, linorder_topology}"
   using linordered_field_no_ub[rule_format, of x]
   by (auto simp: eventually_at_right)
 
 lemma eventually_at_left_field:
   "eventually P (at_left x) \<longleftrightarrow> (\<exists>b<x. \<forall>y>b. y < x \<longrightarrow> P y)"
   for x :: "'a::{linordered_field, linorder_topology}"
   using linordered_field_no_lb[rule_format, of x]
   by (auto simp: eventually_at_left)
 
 
 subsubsection \<open>Tendsto\<close>
 
 abbreviation (in topological_space)
   tendsto :: "('b \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'b filter \<Rightarrow> bool"  (infixr "\<longlongrightarrow>" 55)
   where "(f \<longlongrightarrow> l) F \<equiv> filterlim f (nhds l) F"
 
 definition (in t2_space) Lim :: "'f filter \<Rightarrow> ('f \<Rightarrow> 'a) \<Rightarrow> 'a"
   where "Lim A f = (THE l. (f \<longlongrightarrow> l) A)"
 
 lemma (in topological_space) tendsto_eq_rhs: "(f \<longlongrightarrow> x) F \<Longrightarrow> x = y \<Longrightarrow> (f \<longlongrightarrow> y) F"
   by simp
 
 named_theorems tendsto_intros "introduction rules for tendsto"
 setup \<open>
   Global_Theory.add_thms_dynamic (\<^binding>\<open>tendsto_eq_intros\<close>,
     fn context =>
       Named_Theorems.get (Context.proof_of context) \<^named_theorems>\<open>tendsto_intros\<close>
       |> map_filter (try (fn thm => @{thm tendsto_eq_rhs} OF [thm])))
 \<close>
 
 context topological_space begin
 
 lemma tendsto_def:
    "(f \<longlongrightarrow> l) F \<longleftrightarrow> (\<forall>S. open S \<longrightarrow> l \<in> S \<longrightarrow> eventually (\<lambda>x. f x \<in> S) F)"
    unfolding nhds_def filterlim_INF filterlim_principal by auto
 
 lemma tendsto_cong: "(f \<longlongrightarrow> c) F \<longleftrightarrow> (g \<longlongrightarrow> c) F" if "eventually (\<lambda>x. f x = g x) F"
   by (rule filterlim_cong [OF refl refl that])
 
 lemma tendsto_mono: "F \<le> F' \<Longrightarrow> (f \<longlongrightarrow> l) F' \<Longrightarrow> (f \<longlongrightarrow> l) F"
   unfolding tendsto_def le_filter_def by fast
 
 lemma tendsto_ident_at [tendsto_intros, simp, intro]: "((\<lambda>x. x) \<longlongrightarrow> a) (at a within s)"
   by (auto simp: tendsto_def eventually_at_topological)
 
 lemma tendsto_const [tendsto_intros, simp, intro]: "((\<lambda>x. k) \<longlongrightarrow> k) F"
   by (simp add: tendsto_def)
 
 lemma filterlim_at:
   "(LIM x F. f x :> at b within s) \<longleftrightarrow> eventually (\<lambda>x. f x \<in> s \<and> f x \<noteq> b) F \<and> (f \<longlongrightarrow> b) F"
   by (simp add: at_within_def filterlim_inf filterlim_principal conj_commute)
 
 lemma (in -)
   assumes "filterlim f (nhds L) F"
   shows tendsto_imp_filterlim_at_right:
           "eventually (\<lambda>x. f x > L) F \<Longrightarrow> filterlim f (at_right L) F"
     and tendsto_imp_filterlim_at_left:
           "eventually (\<lambda>x. f x < L) F \<Longrightarrow> filterlim f (at_left L) F"
   using assms by (auto simp: filterlim_at elim: eventually_mono)
 
 lemma  filterlim_at_withinI:
   assumes "filterlim f (nhds c) F"
   assumes "eventually (\<lambda>x. f x \<in> A - {c}) F"
   shows   "filterlim f (at c within A) F"
   using assms by (simp add: filterlim_at)
 
 lemma filterlim_atI:
   assumes "filterlim f (nhds c) F"
   assumes "eventually (\<lambda>x. f x \<noteq> c) F"
   shows   "filterlim f (at c) F"
   using assms by (intro filterlim_at_withinI) simp_all
 
 lemma topological_tendstoI:
   "(\<And>S. open S \<Longrightarrow> l \<in> S \<Longrightarrow> eventually (\<lambda>x. f x \<in> S) F) \<Longrightarrow> (f \<longlongrightarrow> l) F"
   by (auto simp: tendsto_def)
 
 lemma topological_tendstoD:
   "(f \<longlongrightarrow> l) F \<Longrightarrow> open S \<Longrightarrow> l \<in> S \<Longrightarrow> eventually (\<lambda>x. f x \<in> S) F"
   by (auto simp: tendsto_def)
 
 lemma tendsto_bot [simp]: "(f \<longlongrightarrow> a) bot"
   by (simp add: tendsto_def)
 
 lemma tendsto_eventually: "eventually (\<lambda>x. f x = l) net \<Longrightarrow> ((\<lambda>x. f x) \<longlongrightarrow> l) net"
   by (rule topological_tendstoI) (auto elim: eventually_mono)
 
 (* Contributed by Dominique Unruh *)
 lemma tendsto_principal_singleton[simp]:
   shows "(f \<longlongrightarrow> f x) (principal {x})"
   unfolding tendsto_def eventually_principal by simp
 
 end
 
 lemma (in topological_space) filterlim_within_subset:
   "filterlim f l (at x within S) \<Longrightarrow> T \<subseteq> S \<Longrightarrow> filterlim f l (at x within T)"
   by (blast intro: filterlim_mono at_le)
 
 lemmas tendsto_within_subset = filterlim_within_subset
 
 lemma (in order_topology) order_tendsto_iff:
   "(f \<longlongrightarrow> x) F \<longleftrightarrow> (\<forall>l<x. eventually (\<lambda>x. l < f x) F) \<and> (\<forall>u>x. eventually (\<lambda>x. f x < u) F)"
   by (auto simp: nhds_order filterlim_inf filterlim_INF filterlim_principal)
 
 lemma (in order_topology) order_tendstoI:
   "(\<And>a. a < y \<Longrightarrow> eventually (\<lambda>x. a < f x) F) \<Longrightarrow> (\<And>a. y < a \<Longrightarrow> eventually (\<lambda>x. f x < a) F) \<Longrightarrow>
     (f \<longlongrightarrow> y) F"
   by (auto simp: order_tendsto_iff)
 
 lemma (in order_topology) order_tendstoD:
   assumes "(f \<longlongrightarrow> y) F"
   shows "a < y \<Longrightarrow> eventually (\<lambda>x. a < f x) F"
     and "y < a \<Longrightarrow> eventually (\<lambda>x. f x < a) F"
   using assms by (auto simp: order_tendsto_iff)
 
 lemma (in linorder_topology) tendsto_max[tendsto_intros]:
   assumes X: "(X \<longlongrightarrow> x) net"
     and Y: "(Y \<longlongrightarrow> y) net"
   shows "((\<lambda>x. max (X x) (Y x)) \<longlongrightarrow> max x y) net"
 proof (rule order_tendstoI)
   fix a
   assume "a < max x y"
   then show "eventually (\<lambda>x. a < max (X x) (Y x)) net"
     using order_tendstoD(1)[OF X, of a] order_tendstoD(1)[OF Y, of a]
     by (auto simp: less_max_iff_disj elim: eventually_mono)
 next
   fix a
   assume "max x y < a"
   then show "eventually (\<lambda>x. max (X x) (Y x) < a) net"
     using order_tendstoD(2)[OF X, of a] order_tendstoD(2)[OF Y, of a]
     by (auto simp: eventually_conj_iff)
 qed
 
 lemma (in linorder_topology) tendsto_min[tendsto_intros]:
   assumes X: "(X \<longlongrightarrow> x) net"
     and Y: "(Y \<longlongrightarrow> y) net"
   shows "((\<lambda>x. min (X x) (Y x)) \<longlongrightarrow> min x y) net"
 proof (rule order_tendstoI)
   fix a
   assume "a < min x y"
   then show "eventually (\<lambda>x. a < min (X x) (Y x)) net"
     using order_tendstoD(1)[OF X, of a] order_tendstoD(1)[OF Y, of a]
     by (auto simp: eventually_conj_iff)
 next
   fix a
   assume "min x y < a"
   then show "eventually (\<lambda>x. min (X x) (Y x) < a) net"
     using order_tendstoD(2)[OF X, of a] order_tendstoD(2)[OF Y, of a]
     by (auto simp: min_less_iff_disj elim: eventually_mono)
 qed
 
 lemma (in order_topology)
   assumes "a < b"
   shows at_within_Icc_at_right: "at a within {a..b} = at_right a"
     and at_within_Icc_at_left:  "at b within {a..b} = at_left b"
   using order_tendstoD(2)[OF tendsto_ident_at assms, of "{a<..}"]
   using order_tendstoD(1)[OF tendsto_ident_at assms, of "{..<b}"]
   by (auto intro!: order_class.order_antisym filter_leI
       simp: eventually_at_filter less_le
       elim: eventually_elim2)
 
 lemma (in order_topology) at_within_Icc_at: "a < x \<Longrightarrow> x < b \<Longrightarrow> at x within {a..b} = at x"
   by (rule at_within_open_subset[where S="{a<..<b}"]) auto
 
 lemma (in t2_space) tendsto_unique:
   assumes "F \<noteq> bot"
     and "(f \<longlongrightarrow> a) F"
     and "(f \<longlongrightarrow> b) F"
   shows "a = b"
 proof (rule ccontr)
   assume "a \<noteq> b"
   obtain U V where "open U" "open V" "a \<in> U" "b \<in> V" "U \<inter> V = {}"
     using hausdorff [OF \<open>a \<noteq> b\<close>] by fast
   have "eventually (\<lambda>x. f x \<in> U) F"
     using \<open>(f \<longlongrightarrow> a) F\<close> \<open>open U\<close> \<open>a \<in> U\<close> by (rule topological_tendstoD)
   moreover
   have "eventually (\<lambda>x. f x \<in> V) F"
     using \<open>(f \<longlongrightarrow> b) F\<close> \<open>open V\<close> \<open>b \<in> V\<close> by (rule topological_tendstoD)
   ultimately
   have "eventually (\<lambda>x. False) F"
   proof eventually_elim
     case (elim x)
     then have "f x \<in> U \<inter> V" by simp
     with \<open>U \<inter> V = {}\<close> show ?case by simp
   qed
   with \<open>\<not> trivial_limit F\<close> show "False"
     by (simp add: trivial_limit_def)
 qed
 
 lemma (in t2_space) tendsto_const_iff:
   fixes a b :: 'a
   assumes "\<not> trivial_limit F"
   shows "((\<lambda>x. a) \<longlongrightarrow> b) F \<longleftrightarrow> a = b"
   by (auto intro!: tendsto_unique [OF assms tendsto_const])
 
 lemma (in t2_space) tendsto_unique':
  assumes "F \<noteq> bot"
  shows "\<exists>\<^sub>\<le>\<^sub>1l. (f \<longlongrightarrow> l) F"
  using Uniq_def assms local.tendsto_unique by fastforce
 
 lemma Lim_in_closed_set:
   assumes "closed S" "eventually (\<lambda>x. f(x) \<in> S) F" "F \<noteq> bot" "(f \<longlongrightarrow> l) F"
   shows "l \<in> S"
 proof (rule ccontr)
   assume "l \<notin> S"
   with \<open>closed S\<close> have "open (- S)" "l \<in> - S"
     by (simp_all add: open_Compl)
   with assms(4) have "eventually (\<lambda>x. f x \<in> - S) F"
     by (rule topological_tendstoD)
   with assms(2) have "eventually (\<lambda>x. False) F"
     by (rule eventually_elim2) simp
   with assms(3) show "False"
     by (simp add: eventually_False)
 qed
 
 lemma (in t3_space) nhds_closed:
   assumes "x \<in> A" and "open A"
   shows   "\<exists>A'. x \<in> A' \<and> closed A' \<and> A' \<subseteq> A \<and> eventually (\<lambda>y. y \<in> A') (nhds x)"
 proof -
   from assms have "\<exists>U V. open U \<and> open V \<and> x \<in> U \<and> - A \<subseteq> V \<and> U \<inter> V = {}"
     by (intro t3_space) auto
   then obtain U V where UV: "open U" "open V" "x \<in> U" "-A \<subseteq> V" "U \<inter> V = {}"
     by auto
   have "eventually (\<lambda>y. y \<in> U) (nhds x)"
     using \<open>open U\<close> and \<open>x \<in> U\<close> by (intro eventually_nhds_in_open)
   hence "eventually (\<lambda>y. y \<in> -V) (nhds x)"
     by eventually_elim (use UV in auto)
   with UV show ?thesis by (intro exI[of _ "-V"]) auto
 qed
 
 lemma (in order_topology) increasing_tendsto:
   assumes bdd: "eventually (\<lambda>n. f n \<le> l) F"
     and en: "\<And>x. x < l \<Longrightarrow> eventually (\<lambda>n. x < f n) F"
   shows "(f \<longlongrightarrow> l) F"
   using assms by (intro order_tendstoI) (auto elim!: eventually_mono)
 
 lemma (in order_topology) decreasing_tendsto:
   assumes bdd: "eventually (\<lambda>n. l \<le> f n) F"
     and en: "\<And>x. l < x \<Longrightarrow> eventually (\<lambda>n. f n < x) F"
   shows "(f \<longlongrightarrow> l) F"
   using assms by (intro order_tendstoI) (auto elim!: eventually_mono)
 
 lemma (in order_topology) tendsto_sandwich:
   assumes ev: "eventually (\<lambda>n. f n \<le> g n) net" "eventually (\<lambda>n. g n \<le> h n) net"
   assumes lim: "(f \<longlongrightarrow> c) net" "(h \<longlongrightarrow> c) net"
   shows "(g \<longlongrightarrow> c) net"
 proof (rule order_tendstoI)
   fix a
   show "a < c \<Longrightarrow> eventually (\<lambda>x. a < g x) net"
     using order_tendstoD[OF lim(1), of a] ev by (auto elim: eventually_elim2)
 next
   fix a
   show "c < a \<Longrightarrow> eventually (\<lambda>x. g x < a) net"
     using order_tendstoD[OF lim(2), of a] ev by (auto elim: eventually_elim2)
 qed
 
 lemma (in t1_space) limit_frequently_eq:
   assumes "F \<noteq> bot"
     and "frequently (\<lambda>x. f x = c) F"
     and "(f \<longlongrightarrow> d) F"
   shows "d = c"
 proof (rule ccontr)
   assume "d \<noteq> c"
   from t1_space[OF this] obtain U where "open U" "d \<in> U" "c \<notin> U"
     by blast
   with assms have "eventually (\<lambda>x. f x \<in> U) F"
     unfolding tendsto_def by blast
   then have "eventually (\<lambda>x. f x \<noteq> c) F"
     by eventually_elim (insert \<open>c \<notin> U\<close>, blast)
   with assms(2) show False
     unfolding frequently_def by contradiction
 qed
 
 lemma (in t1_space) tendsto_imp_eventually_ne:
   assumes  "(f \<longlongrightarrow> c) F" "c \<noteq> c'"
   shows "eventually (\<lambda>z. f z \<noteq> c') F"
 proof (cases "F=bot")
   case True
   thus ?thesis by auto
 next
   case False
   show ?thesis
   proof (rule ccontr)
     assume "\<not> eventually (\<lambda>z. f z \<noteq> c') F"
     then have "frequently (\<lambda>z. f z = c') F"
       by (simp add: frequently_def)
     from limit_frequently_eq[OF False this \<open>(f \<longlongrightarrow> c) F\<close>] and \<open>c \<noteq> c'\<close> show False
       by contradiction
   qed
 qed
 
 lemma (in linorder_topology) tendsto_le:
   assumes F: "\<not> trivial_limit F"
     and x: "(f \<longlongrightarrow> x) F"
     and y: "(g \<longlongrightarrow> y) F"
     and ev: "eventually (\<lambda>x. g x \<le> f x) F"
   shows "y \<le> x"
 proof (rule ccontr)
   assume "\<not> y \<le> x"
   with less_separate[of x y] obtain a b where xy: "x < a" "b < y" "{..<a} \<inter> {b<..} = {}"
     by (auto simp: not_le)
   then have "eventually (\<lambda>x. f x < a) F" "eventually (\<lambda>x. b < g x) F"
     using x y by (auto intro: order_tendstoD)
   with ev have "eventually (\<lambda>x. False) F"
     by eventually_elim (insert xy, fastforce)
   with F show False
     by (simp add: eventually_False)
 qed
 
 lemma (in linorder_topology) tendsto_lowerbound:
   assumes x: "(f \<longlongrightarrow> x) F"
       and ev: "eventually (\<lambda>i. a \<le> f i) F"
       and F: "\<not> trivial_limit F"
   shows "a \<le> x"
   using F x tendsto_const ev by (rule tendsto_le)
 
 lemma (in linorder_topology) tendsto_upperbound:
   assumes x: "(f \<longlongrightarrow> x) F"
       and ev: "eventually (\<lambda>i. a \<ge> f i) F"
       and F: "\<not> trivial_limit F"
   shows "a \<ge> x"
   by (rule tendsto_le [OF F tendsto_const x ev])
 
 lemma filterlim_at_within_not_equal:
   fixes f::"'a \<Rightarrow> 'b::t2_space"
   assumes "filterlim f (at a within s) F"
   shows "eventually (\<lambda>w. f w\<in>s \<and> f w \<noteq>b) F"
 proof (cases "a=b")
   case True
   then show ?thesis using assms by (simp add: filterlim_at)
 next
   case False
   from hausdorff[OF this] obtain U V where UV:"open U" "open V" "a \<in> U" "b \<in> V" "U \<inter> V = {}"
     by auto  
   have "(f \<longlongrightarrow> a) F" using assms filterlim_at by auto
   then have "\<forall>\<^sub>F x in F. f x \<in> U" using UV unfolding tendsto_def by auto
   moreover have  "\<forall>\<^sub>F x in F. f x \<in> s \<and> f x\<noteq>a" using assms filterlim_at by auto
   ultimately show ?thesis 
     apply eventually_elim
     using UV by auto
 qed
 
 subsubsection \<open>Rules about \<^const>\<open>Lim\<close>\<close>
 
 lemma tendsto_Lim: "\<not> trivial_limit net \<Longrightarrow> (f \<longlongrightarrow> l) net \<Longrightarrow> Lim net f = l"
   unfolding Lim_def using tendsto_unique [of net f] by auto
 
 lemma Lim_ident_at: "\<not> trivial_limit (at x within s) \<Longrightarrow> Lim (at x within s) (\<lambda>x. x) = x"
   by (rule tendsto_Lim[OF _ tendsto_ident_at]) auto
 
 lemma eventually_Lim_ident_at:
   "(\<forall>\<^sub>F y in at x within X. P (Lim (at x within X) (\<lambda>x. x)) y) \<longleftrightarrow>
     (\<forall>\<^sub>F y in at x within X. P x y)" for x::"'a::t2_space"
   by (cases "at x within X = bot") (auto simp: Lim_ident_at)
 
 lemma filterlim_at_bot_at_right:
   fixes f :: "'a::linorder_topology \<Rightarrow> 'b::linorder"
   assumes mono: "\<And>x y. Q x \<Longrightarrow> Q y \<Longrightarrow> x \<le> y \<Longrightarrow> f x \<le> f y"
     and bij: "\<And>x. P x \<Longrightarrow> f (g x) = x" "\<And>x. P x \<Longrightarrow> Q (g x)"
     and Q: "eventually Q (at_right a)"
     and bound: "\<And>b. Q b \<Longrightarrow> a < b"
     and P: "eventually P at_bot"
   shows "filterlim f at_bot (at_right a)"
 proof -
   from P obtain x where x: "\<And>y. y \<le> x \<Longrightarrow> P y"
     unfolding eventually_at_bot_linorder by auto
   show ?thesis
   proof (intro filterlim_at_bot_le[THEN iffD2] allI impI)
     fix z
     assume "z \<le> x"
     with x have "P z" by auto
     have "eventually (\<lambda>x. x \<le> g z) (at_right a)"
       using bound[OF bij(2)[OF \<open>P z\<close>]]
       unfolding eventually_at_right[OF bound[OF bij(2)[OF \<open>P z\<close>]]]
       by (auto intro!: exI[of _ "g z"])
     with Q show "eventually (\<lambda>x. f x \<le> z) (at_right a)"
       by eventually_elim (metis bij \<open>P z\<close> mono)
   qed
 qed
 
 lemma filterlim_at_top_at_left:
   fixes f :: "'a::linorder_topology \<Rightarrow> 'b::linorder"
   assumes mono: "\<And>x y. Q x \<Longrightarrow> Q y \<Longrightarrow> x \<le> y \<Longrightarrow> f x \<le> f y"
     and bij: "\<And>x. P x \<Longrightarrow> f (g x) = x" "\<And>x. P x \<Longrightarrow> Q (g x)"
     and Q: "eventually Q (at_left a)"
     and bound: "\<And>b. Q b \<Longrightarrow> b < a"
     and P: "eventually P at_top"
   shows "filterlim f at_top (at_left a)"
 proof -
   from P obtain x where x: "\<And>y. x \<le> y \<Longrightarrow> P y"
     unfolding eventually_at_top_linorder by auto
   show ?thesis
   proof (intro filterlim_at_top_ge[THEN iffD2] allI impI)
     fix z
     assume "x \<le> z"
     with x have "P z" by auto
     have "eventually (\<lambda>x. g z \<le> x) (at_left a)"
       using bound[OF bij(2)[OF \<open>P z\<close>]]
       unfolding eventually_at_left[OF bound[OF bij(2)[OF \<open>P z\<close>]]]
       by (auto intro!: exI[of _ "g z"])
     with Q show "eventually (\<lambda>x. z \<le> f x) (at_left a)"
       by eventually_elim (metis bij \<open>P z\<close> mono)
   qed
 qed
 
 lemma filterlim_split_at:
   "filterlim f F (at_left x) \<Longrightarrow> filterlim f F (at_right x) \<Longrightarrow>
     filterlim f F (at x)"
   for x :: "'a::linorder_topology"
   by (subst at_eq_sup_left_right) (rule filterlim_sup)
 
 lemma filterlim_at_split:
   "filterlim f F (at x) \<longleftrightarrow> filterlim f F (at_left x) \<and> filterlim f F (at_right x)"
   for x :: "'a::linorder_topology"
   by (subst at_eq_sup_left_right) (simp add: filterlim_def filtermap_sup)
 
 lemma eventually_nhds_top:
   fixes P :: "'a :: {order_top,linorder_topology} \<Rightarrow> bool"
     and b :: 'a
   assumes "b < top"
   shows "eventually P (nhds top) \<longleftrightarrow> (\<exists>b<top. (\<forall>z. b < z \<longrightarrow> P z))"
   unfolding eventually_nhds
 proof safe
   fix S :: "'a set"
   assume "open S" "top \<in> S"
   note open_left[OF this \<open>b < top\<close>]
   moreover assume "\<forall>s\<in>S. P s"
   ultimately show "\<exists>b<top. \<forall>z>b. P z"
     by (auto simp: subset_eq Ball_def)
 next
   fix b
   assume "b < top" "\<forall>z>b. P z"
   then show "\<exists>S. open S \<and> top \<in> S \<and> (\<forall>xa\<in>S. P xa)"
     by (intro exI[of _ "{b <..}"]) auto
 qed
 
 lemma tendsto_at_within_iff_tendsto_nhds:
   "(g \<longlongrightarrow> g l) (at l within S) \<longleftrightarrow> (g \<longlongrightarrow> g l) (inf (nhds l) (principal S))"
   unfolding tendsto_def eventually_at_filter eventually_inf_principal
   by (intro ext all_cong imp_cong) (auto elim!: eventually_mono)
 
 
 subsection \<open>Limits on sequences\<close>
 
 abbreviation (in topological_space)
   LIMSEQ :: "[nat \<Rightarrow> 'a, 'a] \<Rightarrow> bool"  ("((_)/ \<longlonglongrightarrow> (_))" [60, 60] 60)
   where "X \<longlonglongrightarrow> L \<equiv> (X \<longlongrightarrow> L) sequentially"
 
 abbreviation (in t2_space) lim :: "(nat \<Rightarrow> 'a) \<Rightarrow> 'a"
   where "lim X \<equiv> Lim sequentially X"
 
 definition (in topological_space) convergent :: "(nat \<Rightarrow> 'a) \<Rightarrow> bool"
   where "convergent X = (\<exists>L. X \<longlonglongrightarrow> L)"
 
 lemma lim_def: "lim X = (THE L. X \<longlonglongrightarrow> L)"
   unfolding Lim_def ..
 
 lemma lim_explicit:
   "f \<longlonglongrightarrow> f0 \<longleftrightarrow> (\<forall>S. open S \<longrightarrow> f0 \<in> S \<longrightarrow> (\<exists>N. \<forall>n\<ge>N. f n \<in> S))"
   unfolding tendsto_def eventually_sequentially by auto
 
 
 subsection \<open>Monotone sequences and subsequences\<close>
 
 text \<open>
   Definition of monotonicity.
   The use of disjunction here complicates proofs considerably.
   One alternative is to add a Boolean argument to indicate the direction.
   Another is to develop the notions of increasing and decreasing first.
 \<close>
 definition monoseq :: "(nat \<Rightarrow> 'a::order) \<Rightarrow> bool"
   where "monoseq X \<longleftrightarrow> (\<forall>m. \<forall>n\<ge>m. X m \<le> X n) \<or> (\<forall>m. \<forall>n\<ge>m. X n \<le> X m)"
 
 abbreviation incseq :: "(nat \<Rightarrow> 'a::order) \<Rightarrow> bool"
   where "incseq X \<equiv> mono X"
 
 lemma incseq_def: "incseq X \<longleftrightarrow> (\<forall>m. \<forall>n\<ge>m. X n \<ge> X m)"
   unfolding mono_def ..
 
 abbreviation decseq :: "(nat \<Rightarrow> 'a::order) \<Rightarrow> bool"
   where "decseq X \<equiv> antimono X"
 
 lemma decseq_def: "decseq X \<longleftrightarrow> (\<forall>m. \<forall>n\<ge>m. X n \<le> X m)"
   unfolding antimono_def ..
 
 subsubsection \<open>Definition of subsequence.\<close>
 
 (* For compatibility with the old "subseq" *)
 lemma strict_mono_leD: "strict_mono r \<Longrightarrow> m \<le> n \<Longrightarrow> r m \<le> r n"
   by (erule (1) monoD [OF strict_mono_mono])
 
 lemma strict_mono_id: "strict_mono id"
   by (simp add: strict_mono_def)
 
 lemma incseq_SucI: "(\<And>n. X n \<le> X (Suc n)) \<Longrightarrow> incseq X"
   using lift_Suc_mono_le[of X] by (auto simp: incseq_def)
 
 lemma incseqD: "incseq f \<Longrightarrow> i \<le> j \<Longrightarrow> f i \<le> f j"
   by (auto simp: incseq_def)
 
 lemma incseq_SucD: "incseq A \<Longrightarrow> A i \<le> A (Suc i)"
   using incseqD[of A i "Suc i"] by auto
 
 lemma incseq_Suc_iff: "incseq f \<longleftrightarrow> (\<forall>n. f n \<le> f (Suc n))"
   by (auto intro: incseq_SucI dest: incseq_SucD)
 
 lemma incseq_const[simp, intro]: "incseq (\<lambda>x. k)"
   unfolding incseq_def by auto
 
 lemma decseq_SucI: "(\<And>n. X (Suc n) \<le> X n) \<Longrightarrow> decseq X"
   using order.lift_Suc_mono_le[OF dual_order, of X] by (auto simp: decseq_def)
 
 lemma decseqD: "decseq f \<Longrightarrow> i \<le> j \<Longrightarrow> f j \<le> f i"
   by (auto simp: decseq_def)
 
 lemma decseq_SucD: "decseq A \<Longrightarrow> A (Suc i) \<le> A i"
   using decseqD[of A i "Suc i"] by auto
 
 lemma decseq_Suc_iff: "decseq f \<longleftrightarrow> (\<forall>n. f (Suc n) \<le> f n)"
   by (auto intro: decseq_SucI dest: decseq_SucD)
 
 lemma decseq_const[simp, intro]: "decseq (\<lambda>x. k)"
   unfolding decseq_def by auto
 
 lemma monoseq_iff: "monoseq X \<longleftrightarrow> incseq X \<or> decseq X"
   unfolding monoseq_def incseq_def decseq_def ..
 
 lemma monoseq_Suc: "monoseq X \<longleftrightarrow> (\<forall>n. X n \<le> X (Suc n)) \<or> (\<forall>n. X (Suc n) \<le> X n)"
   unfolding monoseq_iff incseq_Suc_iff decseq_Suc_iff ..
 
 lemma monoI1: "\<forall>m. \<forall>n \<ge> m. X m \<le> X n \<Longrightarrow> monoseq X"
   by (simp add: monoseq_def)
 
 lemma monoI2: "\<forall>m. \<forall>n \<ge> m. X n \<le> X m \<Longrightarrow> monoseq X"
   by (simp add: monoseq_def)
 
 lemma mono_SucI1: "\<forall>n. X n \<le> X (Suc n) \<Longrightarrow> monoseq X"
   by (simp add: monoseq_Suc)
 
 lemma mono_SucI2: "\<forall>n. X (Suc n) \<le> X n \<Longrightarrow> monoseq X"
   by (simp add: monoseq_Suc)
 
 lemma monoseq_minus:
   fixes a :: "nat \<Rightarrow> 'a::ordered_ab_group_add"
   assumes "monoseq a"
   shows "monoseq (\<lambda> n. - a n)"
 proof (cases "\<forall>m. \<forall>n \<ge> m. a m \<le> a n")
   case True
   then have "\<forall>m. \<forall>n \<ge> m. - a n \<le> - a m" by auto
   then show ?thesis by (rule monoI2)
 next
   case False
   then have "\<forall>m. \<forall>n \<ge> m. - a m \<le> - a n"
     using \<open>monoseq a\<close>[unfolded monoseq_def] by auto
   then show ?thesis by (rule monoI1)
 qed
 
 
 subsubsection \<open>Subsequence (alternative definition, (e.g. Hoskins)\<close>
 
 lemma strict_mono_Suc_iff: "strict_mono f \<longleftrightarrow> (\<forall>n. f n < f (Suc n))"
 proof (intro iffI strict_monoI)
   assume *: "\<forall>n. f n < f (Suc n)"
   fix m n :: nat assume "m < n"
   thus "f m < f n"
     by (induction rule: less_Suc_induct) (use * in auto)
 qed (auto simp: strict_mono_def)
 
 lemma strict_mono_add: "strict_mono (\<lambda>n::'a::linordered_semidom. n + k)"
   by (auto simp: strict_mono_def)
 
 text \<open>For any sequence, there is a monotonic subsequence.\<close>
 lemma seq_monosub:
   fixes s :: "nat \<Rightarrow> 'a::linorder"
   shows "\<exists>f. strict_mono f \<and> monoseq (\<lambda>n. (s (f n)))"
 proof (cases "\<forall>n. \<exists>p>n. \<forall>m\<ge>p. s m \<le> s p")
   case True
   then have "\<exists>f. \<forall>n. (\<forall>m\<ge>f n. s m \<le> s (f n)) \<and> f n < f (Suc n)"
     by (intro dependent_nat_choice) (auto simp: conj_commute)
   then obtain f :: "nat \<Rightarrow> nat" 
     where f: "strict_mono f" and mono: "\<And>n m. f n \<le> m \<Longrightarrow> s m \<le> s (f n)"
     by (auto simp: strict_mono_Suc_iff)
   then have "incseq f"
     unfolding strict_mono_Suc_iff incseq_Suc_iff by (auto intro: less_imp_le)
   then have "monoseq (\<lambda>n. s (f n))"
     by (auto simp add: incseq_def intro!: mono monoI2)
   with f show ?thesis
     by auto
 next
   case False
   then obtain N where N: "p > N \<Longrightarrow> \<exists>m>p. s p < s m" for p
     by (force simp: not_le le_less)
   have "\<exists>f. \<forall>n. N < f n \<and> f n < f (Suc n) \<and> s (f n) \<le> s (f (Suc n))"
   proof (intro dependent_nat_choice)
     fix x
     assume "N < x" with N[of x]
     show "\<exists>y>N. x < y \<and> s x \<le> s y"
       by (auto intro: less_trans)
   qed auto
   then show ?thesis
     by (auto simp: monoseq_iff incseq_Suc_iff strict_mono_Suc_iff)
 qed
 
 lemma seq_suble:
   assumes sf: "strict_mono (f :: nat \<Rightarrow> nat)"
   shows "n \<le> f n"
 proof (induct n)
   case 0
   show ?case by simp
 next
   case (Suc n)
   with sf [unfolded strict_mono_Suc_iff, rule_format, of n] have "n < f (Suc n)"
      by arith
   then show ?case by arith
 qed
 
 lemma eventually_subseq:
   "strict_mono r \<Longrightarrow> eventually P sequentially \<Longrightarrow> eventually (\<lambda>n. P (r n)) sequentially"
   unfolding eventually_sequentially by (metis seq_suble le_trans)
 
 lemma not_eventually_sequentiallyD:
   assumes "\<not> eventually P sequentially"
   shows "\<exists>r::nat\<Rightarrow>nat. strict_mono r \<and> (\<forall>n. \<not> P (r n))"
 proof -
   from assms have "\<forall>n. \<exists>m\<ge>n. \<not> P m"
     unfolding eventually_sequentially by (simp add: not_less)
   then obtain r where "\<And>n. r n \<ge> n" "\<And>n. \<not> P (r n)"
     by (auto simp: choice_iff)
   then show ?thesis
     by (auto intro!: exI[of _ "\<lambda>n. r (((Suc \<circ> r) ^^ Suc n) 0)"]
              simp: less_eq_Suc_le strict_mono_Suc_iff)
 qed
 
 lemma sequentially_offset: 
   assumes "eventually (\<lambda>i. P i) sequentially"
   shows "eventually (\<lambda>i. P (i + k)) sequentially"
   using assms by (rule eventually_sequentially_seg [THEN iffD2])
 
 lemma seq_offset_neg: 
   "(f \<longlongrightarrow> l) sequentially \<Longrightarrow> ((\<lambda>i. f(i - k)) \<longlongrightarrow> l) sequentially"
   apply (erule filterlim_compose)
   apply (simp add: filterlim_def le_sequentially eventually_filtermap eventually_sequentially, arith)
   done
 
 lemma filterlim_subseq: "strict_mono f \<Longrightarrow> filterlim f sequentially sequentially"
   unfolding filterlim_iff by (metis eventually_subseq)
 
 lemma strict_mono_o: "strict_mono r \<Longrightarrow> strict_mono s \<Longrightarrow> strict_mono (r \<circ> s)"
   unfolding strict_mono_def by simp
 
 lemma strict_mono_compose: "strict_mono r \<Longrightarrow> strict_mono s \<Longrightarrow> strict_mono (\<lambda>x. r (s x))"
   using strict_mono_o[of r s] by (simp add: o_def)
 
 lemma incseq_imp_monoseq:  "incseq X \<Longrightarrow> monoseq X"
   by (simp add: incseq_def monoseq_def)
 
 lemma decseq_imp_monoseq:  "decseq X \<Longrightarrow> monoseq X"
   by (simp add: decseq_def monoseq_def)
 
 lemma decseq_eq_incseq: "decseq X = incseq (\<lambda>n. - X n)"
   for X :: "nat \<Rightarrow> 'a::ordered_ab_group_add"
   by (simp add: decseq_def incseq_def)
 
 lemma INT_decseq_offset:
   assumes "decseq F"
   shows "(\<Inter>i. F i) = (\<Inter>i\<in>{n..}. F i)"
 proof safe
   fix x i
   assume x: "x \<in> (\<Inter>i\<in>{n..}. F i)"
   show "x \<in> F i"
   proof cases
     from x have "x \<in> F n" by auto
     also assume "i \<le> n" with \<open>decseq F\<close> have "F n \<subseteq> F i"
       unfolding decseq_def by simp
     finally show ?thesis .
   qed (insert x, simp)
 qed auto
 
 lemma LIMSEQ_const_iff: "(\<lambda>n. k) \<longlonglongrightarrow> l \<longleftrightarrow> k = l"
   for k l :: "'a::t2_space"
   using trivial_limit_sequentially by (rule tendsto_const_iff)
 
 lemma LIMSEQ_SUP: "incseq X \<Longrightarrow> X \<longlonglongrightarrow> (SUP i. X i :: 'a::{complete_linorder,linorder_topology})"
   by (intro increasing_tendsto)
     (auto simp: SUP_upper less_SUP_iff incseq_def eventually_sequentially intro: less_le_trans)
 
 lemma LIMSEQ_INF: "decseq X \<Longrightarrow> X \<longlonglongrightarrow> (INF i. X i :: 'a::{complete_linorder,linorder_topology})"
   by (intro decreasing_tendsto)
     (auto simp: INF_lower INF_less_iff decseq_def eventually_sequentially intro: le_less_trans)
 
 lemma LIMSEQ_ignore_initial_segment: "f \<longlonglongrightarrow> a \<Longrightarrow> (\<lambda>n. f (n + k)) \<longlonglongrightarrow> a"
   unfolding tendsto_def by (subst eventually_sequentially_seg[where k=k])
 
 lemma LIMSEQ_offset: "(\<lambda>n. f (n + k)) \<longlonglongrightarrow> a \<Longrightarrow> f \<longlonglongrightarrow> a"
   unfolding tendsto_def
   by (subst (asm) eventually_sequentially_seg[where k=k])
 
 lemma LIMSEQ_Suc: "f \<longlonglongrightarrow> l \<Longrightarrow> (\<lambda>n. f (Suc n)) \<longlonglongrightarrow> l"
   by (drule LIMSEQ_ignore_initial_segment [where k="Suc 0"]) simp
 
 lemma LIMSEQ_imp_Suc: "(\<lambda>n. f (Suc n)) \<longlonglongrightarrow> l \<Longrightarrow> f \<longlonglongrightarrow> l"
   by (rule LIMSEQ_offset [where k="Suc 0"]) simp
 
 lemma LIMSEQ_lessThan_iff_atMost:
   shows "(\<lambda>n. f {..<n}) \<longlonglongrightarrow> x \<longleftrightarrow> (\<lambda>n. f {..n}) \<longlonglongrightarrow> x"
   apply (subst filterlim_sequentially_Suc [symmetric])
   apply (simp only: lessThan_Suc_atMost)
   done
 
 lemma (in t2_space) LIMSEQ_Uniq: "\<exists>\<^sub>\<le>\<^sub>1l. X \<longlonglongrightarrow> l"
  by (simp add: tendsto_unique')
 
 lemma (in t2_space) LIMSEQ_unique: "X \<longlonglongrightarrow> a \<Longrightarrow> X \<longlonglongrightarrow> b \<Longrightarrow> a = b"
   using trivial_limit_sequentially by (rule tendsto_unique)
 
 lemma LIMSEQ_le_const: "X \<longlonglongrightarrow> x \<Longrightarrow> \<exists>N. \<forall>n\<ge>N. a \<le> X n \<Longrightarrow> a \<le> x"
   for a x :: "'a::linorder_topology"
   by (simp add: eventually_at_top_linorder tendsto_lowerbound)
 
 lemma LIMSEQ_le: "X \<longlonglongrightarrow> x \<Longrightarrow> Y \<longlonglongrightarrow> y \<Longrightarrow> \<exists>N. \<forall>n\<ge>N. X n \<le> Y n \<Longrightarrow> x \<le> y"
   for x y :: "'a::linorder_topology"
   using tendsto_le[of sequentially Y y X x] by (simp add: eventually_sequentially)
 
 lemma LIMSEQ_le_const2: "X \<longlonglongrightarrow> x \<Longrightarrow> \<exists>N. \<forall>n\<ge>N. X n \<le> a \<Longrightarrow> x \<le> a"
   for a x :: "'a::linorder_topology"
   by (rule LIMSEQ_le[of X x "\<lambda>n. a"]) auto
 
 lemma Lim_bounded: "f \<longlonglongrightarrow> l \<Longrightarrow> \<forall>n\<ge>M. f n \<le> C \<Longrightarrow> l \<le> C"
   for l :: "'a::linorder_topology"
   by (intro LIMSEQ_le_const2) auto
 
 lemma Lim_bounded2:
   fixes f :: "nat \<Rightarrow> 'a::linorder_topology"
   assumes lim:"f \<longlonglongrightarrow> l" and ge: "\<forall>n\<ge>N. f n \<ge> C"
   shows "l \<ge> C"
   using ge
   by (intro tendsto_le[OF trivial_limit_sequentially lim tendsto_const])
      (auto simp: eventually_sequentially)
 
 lemma lim_mono:
   fixes X Y :: "nat \<Rightarrow> 'a::linorder_topology"
   assumes "\<And>n. N \<le> n \<Longrightarrow> X n \<le> Y n"
     and "X \<longlonglongrightarrow> x"
     and "Y \<longlonglongrightarrow> y"
   shows "x \<le> y"
   using assms(1) by (intro LIMSEQ_le[OF assms(2,3)]) auto
 
 lemma Sup_lim:
   fixes a :: "'a::{complete_linorder,linorder_topology}"
   assumes "\<And>n. b n \<in> s"
     and "b \<longlonglongrightarrow> a"
   shows "a \<le> Sup s"
   by (metis Lim_bounded assms complete_lattice_class.Sup_upper)
 
 lemma Inf_lim:
   fixes a :: "'a::{complete_linorder,linorder_topology}"
   assumes "\<And>n. b n \<in> s"
     and "b \<longlonglongrightarrow> a"
   shows "Inf s \<le> a"
   by (metis Lim_bounded2 assms complete_lattice_class.Inf_lower)
 
 lemma SUP_Lim:
   fixes X :: "nat \<Rightarrow> 'a::{complete_linorder,linorder_topology}"
   assumes inc: "incseq X"
     and l: "X \<longlonglongrightarrow> l"
   shows "(SUP n. X n) = l"
   using LIMSEQ_SUP[OF inc] tendsto_unique[OF trivial_limit_sequentially l]
   by simp
 
 lemma INF_Lim:
   fixes X :: "nat \<Rightarrow> 'a::{complete_linorder,linorder_topology}"
   assumes dec: "decseq X"
     and l: "X \<longlonglongrightarrow> l"
   shows "(INF n. X n) = l"
   using LIMSEQ_INF[OF dec] tendsto_unique[OF trivial_limit_sequentially l]
   by simp
 
 lemma convergentD: "convergent X \<Longrightarrow> \<exists>L. X \<longlonglongrightarrow> L"
   by (simp add: convergent_def)
 
 lemma convergentI: "X \<longlonglongrightarrow> L \<Longrightarrow> convergent X"
   by (auto simp add: convergent_def)
 
 lemma convergent_LIMSEQ_iff: "convergent X \<longleftrightarrow> X \<longlonglongrightarrow> lim X"
   by (auto intro: theI LIMSEQ_unique simp add: convergent_def lim_def)
 
 lemma convergent_const: "convergent (\<lambda>n. c)"
   by (rule convergentI) (rule tendsto_const)
 
 lemma monoseq_le:
   "monoseq a \<Longrightarrow> a \<longlonglongrightarrow> x \<Longrightarrow>
     (\<forall>n. a n \<le> x) \<and> (\<forall>m. \<forall>n\<ge>m. a m \<le> a n) \<or>
     (\<forall>n. x \<le> a n) \<and> (\<forall>m. \<forall>n\<ge>m. a n \<le> a m)"
   for x :: "'a::linorder_topology"
   by (metis LIMSEQ_le_const LIMSEQ_le_const2 decseq_def incseq_def monoseq_iff)
 
 lemma LIMSEQ_subseq_LIMSEQ: "X \<longlonglongrightarrow> L \<Longrightarrow> strict_mono f \<Longrightarrow> (X \<circ> f) \<longlonglongrightarrow> L"
   unfolding comp_def by (rule filterlim_compose [of X, OF _ filterlim_subseq])
 
 lemma convergent_subseq_convergent: "convergent X \<Longrightarrow> strict_mono f \<Longrightarrow> convergent (X \<circ> f)"
   by (auto simp: convergent_def intro: LIMSEQ_subseq_LIMSEQ)
 
 lemma limI: "X \<longlonglongrightarrow> L \<Longrightarrow> lim X = L"
   by (rule tendsto_Lim) (rule trivial_limit_sequentially)
 
 lemma lim_le: "convergent f \<Longrightarrow> (\<And>n. f n \<le> x) \<Longrightarrow> lim f \<le> x"
   for x :: "'a::linorder_topology"
   using LIMSEQ_le_const2[of f "lim f" x] by (simp add: convergent_LIMSEQ_iff)
 
 lemma lim_const [simp]: "lim (\<lambda>m. a) = a"
   by (simp add: limI)
 
 
 subsubsection \<open>Increasing and Decreasing Series\<close>
 
 lemma incseq_le: "incseq X \<Longrightarrow> X \<longlonglongrightarrow> L \<Longrightarrow> X n \<le> L"
   for L :: "'a::linorder_topology"
   by (metis incseq_def LIMSEQ_le_const)
 
 lemma decseq_ge: "decseq X \<Longrightarrow> X \<longlonglongrightarrow> L \<Longrightarrow> L \<le> X n"
   for L :: "'a::linorder_topology"
   by (metis decseq_def LIMSEQ_le_const2)
 
 
 subsection \<open>First countable topologies\<close>
 
 class first_countable_topology = topological_space +
   assumes first_countable_basis:
     "\<exists>A::nat \<Rightarrow> 'a set. (\<forall>i. x \<in> A i \<and> open (A i)) \<and> (\<forall>S. open S \<and> x \<in> S \<longrightarrow> (\<exists>i. A i \<subseteq> S))"
 
 lemma (in first_countable_topology) countable_basis_at_decseq:
   obtains A :: "nat \<Rightarrow> 'a set" where
     "\<And>i. open (A i)" "\<And>i. x \<in> (A i)"
     "\<And>S. open S \<Longrightarrow> x \<in> S \<Longrightarrow> eventually (\<lambda>i. A i \<subseteq> S) sequentially"
 proof atomize_elim
   from first_countable_basis[of x] obtain A :: "nat \<Rightarrow> 'a set"
     where nhds: "\<And>i. open (A i)" "\<And>i. x \<in> A i"
       and incl: "\<And>S. open S \<Longrightarrow> x \<in> S \<Longrightarrow> \<exists>i. A i \<subseteq> S"
     by auto
   define F where "F n = (\<Inter>i\<le>n. A i)" for n
   show "\<exists>A. (\<forall>i. open (A i)) \<and> (\<forall>i. x \<in> A i) \<and>
     (\<forall>S. open S \<longrightarrow> x \<in> S \<longrightarrow> eventually (\<lambda>i. A i \<subseteq> S) sequentially)"
   proof (safe intro!: exI[of _ F])
     fix i
     show "open (F i)"
       using nhds(1) by (auto simp: F_def)
     show "x \<in> F i"
       using nhds(2) by (auto simp: F_def)
   next
     fix S
     assume "open S" "x \<in> S"
     from incl[OF this] obtain i where "F i \<subseteq> S"
       unfolding F_def by auto
     moreover have "\<And>j. i \<le> j \<Longrightarrow> F j \<subseteq> F i"
       by (simp add: Inf_superset_mono F_def image_mono)
     ultimately show "eventually (\<lambda>i. F i \<subseteq> S) sequentially"
       by (auto simp: eventually_sequentially)
   qed
 qed
 
 lemma (in first_countable_topology) nhds_countable:
   obtains X :: "nat \<Rightarrow> 'a set"
   where "decseq X" "\<And>n. open (X n)" "\<And>n. x \<in> X n" "nhds x = (INF n. principal (X n))"
 proof -
   from first_countable_basis obtain A :: "nat \<Rightarrow> 'a set"
     where *: "\<And>n. x \<in> A n" "\<And>n. open (A n)" "\<And>S. open S \<Longrightarrow> x \<in> S \<Longrightarrow> \<exists>i. A i \<subseteq> S"
     by metis
   show thesis
   proof
     show "decseq (\<lambda>n. \<Inter>i\<le>n. A i)"
       by (simp add: antimono_iff_le_Suc atMost_Suc)
     show "x \<in> (\<Inter>i\<le>n. A i)" "\<And>n. open (\<Inter>i\<le>n. A i)" for n
       using * by auto
     with * show "nhds x = (INF n. principal (\<Inter>i\<le>n. A i))"
       unfolding nhds_def
       apply (intro INF_eq)
        apply fastforce
       apply blast
       done
   qed
 qed
 
 lemma (in first_countable_topology) countable_basis:
   obtains A :: "nat \<Rightarrow> 'a set" where
     "\<And>i. open (A i)" "\<And>i. x \<in> A i"
     "\<And>F. (\<forall>n. F n \<in> A n) \<Longrightarrow> F \<longlonglongrightarrow> x"
 proof atomize_elim
   obtain A :: "nat \<Rightarrow> 'a set" where *:
     "\<And>i. open (A i)"
     "\<And>i. x \<in> A i"
     "\<And>S. open S \<Longrightarrow> x \<in> S \<Longrightarrow> eventually (\<lambda>i. A i \<subseteq> S) sequentially"
     by (rule countable_basis_at_decseq) blast
   have "eventually (\<lambda>n. F n \<in> S) sequentially"
     if "\<forall>n. F n \<in> A n" "open S" "x \<in> S" for F S
     using *(3)[of S] that by (auto elim: eventually_mono simp: subset_eq)
   with * show "\<exists>A. (\<forall>i. open (A i)) \<and> (\<forall>i. x \<in> A i) \<and> (\<forall>F. (\<forall>n. F n \<in> A n) \<longrightarrow> F \<longlonglongrightarrow> x)"
     by (intro exI[of _ A]) (auto simp: tendsto_def)
 qed
 
 lemma (in first_countable_topology) sequentially_imp_eventually_nhds_within:
   assumes "\<forall>f. (\<forall>n. f n \<in> s) \<and> f \<longlonglongrightarrow> a \<longrightarrow> eventually (\<lambda>n. P (f n)) sequentially"
   shows "eventually P (inf (nhds a) (principal s))"
 proof (rule ccontr)
   obtain A :: "nat \<Rightarrow> 'a set" where *:
     "\<And>i. open (A i)"
     "\<And>i. a \<in> A i"
     "\<And>F. \<forall>n. F n \<in> A n \<Longrightarrow> F \<longlonglongrightarrow> a"
     by (rule countable_basis) blast
   assume "\<not> ?thesis"
   with * have "\<exists>F. \<forall>n. F n \<in> s \<and> F n \<in> A n \<and> \<not> P (F n)"
     unfolding eventually_inf_principal eventually_nhds
     by (intro choice) fastforce
   then obtain F where F: "\<forall>n. F n \<in> s" and "\<forall>n. F n \<in> A n" and F': "\<forall>n. \<not> P (F n)"
     by blast
   with * have "F \<longlonglongrightarrow> a"
     by auto
   then have "eventually (\<lambda>n. P (F n)) sequentially"
     using assms F by simp
   then show False
     by (simp add: F')
 qed
 
 lemma (in first_countable_topology) eventually_nhds_within_iff_sequentially:
   "eventually P (inf (nhds a) (principal s)) \<longleftrightarrow>
     (\<forall>f. (\<forall>n. f n \<in> s) \<and> f \<longlonglongrightarrow> a \<longrightarrow> eventually (\<lambda>n. P (f n)) sequentially)"
 proof (safe intro!: sequentially_imp_eventually_nhds_within)
   assume "eventually P (inf (nhds a) (principal s))"
   then obtain S where "open S" "a \<in> S" "\<forall>x\<in>S. x \<in> s \<longrightarrow> P x"
     by (auto simp: eventually_inf_principal eventually_nhds)
   moreover
   fix f
   assume "\<forall>n. f n \<in> s" "f \<longlonglongrightarrow> a"
   ultimately show "eventually (\<lambda>n. P (f n)) sequentially"
     by (auto dest!: topological_tendstoD elim: eventually_mono)
 qed
 
 lemma (in first_countable_topology) eventually_nhds_iff_sequentially:
   "eventually P (nhds a) \<longleftrightarrow> (\<forall>f. f \<longlonglongrightarrow> a \<longrightarrow> eventually (\<lambda>n. P (f n)) sequentially)"
   using eventually_nhds_within_iff_sequentially[of P a UNIV] by simp
 
 (*Thanks to Sébastien Gouëzel*)
 lemma Inf_as_limit:
   fixes A::"'a::{linorder_topology, first_countable_topology, complete_linorder} set"
   assumes "A \<noteq> {}"
   shows "\<exists>u. (\<forall>n. u n \<in> A) \<and> u \<longlonglongrightarrow> Inf A"
 proof (cases "Inf A \<in> A")
   case True
   show ?thesis
     by (rule exI[of _ "\<lambda>n. Inf A"], auto simp add: True)
 next
   case False
   obtain y where "y \<in> A" using assms by auto
   then have "Inf A < y" using False Inf_lower less_le by auto
   obtain F :: "nat \<Rightarrow> 'a set" where F: "\<And>i. open (F i)" "\<And>i. Inf A \<in> F i"
                                        "\<And>u. (\<forall>n. u n \<in> F n) \<Longrightarrow> u \<longlonglongrightarrow> Inf A"
     by (metis first_countable_topology_class.countable_basis)
   define u where "u = (\<lambda>n. SOME z. z \<in> F n \<and> z \<in> A)"
   have "\<exists>z. z \<in> U \<and> z \<in> A" if "Inf A \<in> U" "open U" for U
   proof -
     obtain b where "b > Inf A" "{Inf A ..<b} \<subseteq> U"
       using open_right[OF \<open>open U\<close> \<open>Inf A \<in> U\<close> \<open>Inf A < y\<close>] by auto
     obtain z where "z < b" "z \<in> A"
       using \<open>Inf A < b\<close> Inf_less_iff by auto
     then have "z \<in> {Inf A ..<b}"
       by (simp add: Inf_lower)
     then show ?thesis using \<open>z \<in> A\<close> \<open>{Inf A ..<b} \<subseteq> U\<close> by auto
   qed
   then have *: "u n \<in> F n \<and> u n \<in> A" for n
     using \<open>Inf A \<in> F n\<close> \<open>open (F n)\<close> unfolding u_def by (metis (no_types, lifting) someI_ex)
   then have "u \<longlonglongrightarrow> Inf A" using F(3) by simp
   then show ?thesis using * by auto
 qed
 
 lemma tendsto_at_iff_sequentially:
   "(f \<longlongrightarrow> a) (at x within s) \<longleftrightarrow> (\<forall>X. (\<forall>i. X i \<in> s - {x}) \<longrightarrow> X \<longlonglongrightarrow> x \<longrightarrow> ((f \<circ> X) \<longlonglongrightarrow> a))"
   for f :: "'a::first_countable_topology \<Rightarrow> _"
   unfolding filterlim_def[of _ "nhds a"] le_filter_def eventually_filtermap
     at_within_def eventually_nhds_within_iff_sequentially comp_def
   by metis
 
 lemma approx_from_above_dense_linorder:
   fixes x::"'a::{dense_linorder, linorder_topology, first_countable_topology}"
   assumes "x < y"
   shows "\<exists>u. (\<forall>n. u n > x) \<and> (u \<longlonglongrightarrow> x)"
 proof -
   obtain A :: "nat \<Rightarrow> 'a set" where A: "\<And>i. open (A i)" "\<And>i. x \<in> A i"
                                       "\<And>F. (\<forall>n. F n \<in> A n) \<Longrightarrow> F \<longlonglongrightarrow> x"
     by (metis first_countable_topology_class.countable_basis)
   define u where "u = (\<lambda>n. SOME z. z \<in> A n \<and> z > x)"
   have "\<exists>z. z \<in> U \<and> x < z" if "x \<in> U" "open U" for U
     using open_right[OF \<open>open U\<close> \<open>x \<in> U\<close> \<open>x < y\<close>]
     by (meson atLeastLessThan_iff dense less_imp_le subset_eq)
   then have *: "u n \<in> A n \<and> x < u n" for n
     using \<open>x \<in> A n\<close> \<open>open (A n)\<close> unfolding u_def by (metis (no_types, lifting) someI_ex)
   then have "u \<longlonglongrightarrow> x" using A(3) by simp
   then show ?thesis using * by auto
 qed
 
 lemma approx_from_below_dense_linorder:
   fixes x::"'a::{dense_linorder, linorder_topology, first_countable_topology}"
   assumes "x > y"
   shows "\<exists>u. (\<forall>n. u n < x) \<and> (u \<longlonglongrightarrow> x)"
 proof -
   obtain A :: "nat \<Rightarrow> 'a set" where A: "\<And>i. open (A i)" "\<And>i. x \<in> A i"
                                       "\<And>F. (\<forall>n. F n \<in> A n) \<Longrightarrow> F \<longlonglongrightarrow> x"
     by (metis first_countable_topology_class.countable_basis)
   define u where "u = (\<lambda>n. SOME z. z \<in> A n \<and> z < x)"
   have "\<exists>z. z \<in> U \<and> z < x" if "x \<in> U" "open U" for U
     using open_left[OF \<open>open U\<close> \<open>x \<in> U\<close> \<open>x > y\<close>]
     by (meson dense greaterThanAtMost_iff less_imp_le subset_eq)
   then have *: "u n \<in> A n \<and> u n < x" for n
     using \<open>x \<in> A n\<close> \<open>open (A n)\<close> unfolding u_def by (metis (no_types, lifting) someI_ex)
   then have "u \<longlonglongrightarrow> x" using A(3) by simp
   then show ?thesis using * by auto
 qed
 
 
 subsection \<open>Function limit at a point\<close>
 
 abbreviation LIM :: "('a::topological_space \<Rightarrow> 'b::topological_space) \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> bool"
     ("((_)/ \<midarrow>(_)/\<rightarrow> (_))" [60, 0, 60] 60)
   where "f \<midarrow>a\<rightarrow> L \<equiv> (f \<longlongrightarrow> L) (at a)"
 
 lemma tendsto_within_open: "a \<in> S \<Longrightarrow> open S \<Longrightarrow> (f \<longlongrightarrow> l) (at a within S) \<longleftrightarrow> (f \<midarrow>a\<rightarrow> l)"
   by (simp add: tendsto_def at_within_open[where S = S])
 
 lemma tendsto_within_open_NO_MATCH:
   "a \<in> S \<Longrightarrow> NO_MATCH UNIV S \<Longrightarrow> open S \<Longrightarrow> (f \<longlongrightarrow> l)(at a within S) \<longleftrightarrow> (f \<longlongrightarrow> l)(at a)"
   for f :: "'a::topological_space \<Rightarrow> 'b::topological_space"
   using tendsto_within_open by blast
 
 lemma LIM_const_not_eq[tendsto_intros]: "k \<noteq> L \<Longrightarrow> \<not> (\<lambda>x. k) \<midarrow>a\<rightarrow> L"
   for a :: "'a::perfect_space" and k L :: "'b::t2_space"
   by (simp add: tendsto_const_iff)
 
 lemmas LIM_not_zero = LIM_const_not_eq [where L = 0]
 
 lemma LIM_const_eq: "(\<lambda>x. k) \<midarrow>a\<rightarrow> L \<Longrightarrow> k = L"
   for a :: "'a::perfect_space" and k L :: "'b::t2_space"
   by (simp add: tendsto_const_iff)
 
 lemma LIM_unique: "f \<midarrow>a\<rightarrow> L \<Longrightarrow> f \<midarrow>a\<rightarrow> M \<Longrightarrow> L = M"
   for a :: "'a::perfect_space" and L M :: "'b::t2_space"
   using at_neq_bot by (rule tendsto_unique)
 
 lemma LIM_Uniq: "\<exists>\<^sub>\<le>\<^sub>1L::'b::t2_space. f \<midarrow>a\<rightarrow> L"
   for a :: "'a::perfect_space"
  by (auto simp add: Uniq_def LIM_unique)
 
 
 text \<open>Limits are equal for functions equal except at limit point.\<close>
 lemma LIM_equal: "\<forall>x. x \<noteq> a \<longrightarrow> f x = g x \<Longrightarrow> (f \<midarrow>a\<rightarrow> l) \<longleftrightarrow> (g \<midarrow>a\<rightarrow> l)"
   by (simp add: tendsto_def eventually_at_topological)
 
 lemma LIM_cong: "a = b \<Longrightarrow> (\<And>x. x \<noteq> b \<Longrightarrow> f x = g x) \<Longrightarrow> l = m \<Longrightarrow> (f \<midarrow>a\<rightarrow> l) \<longleftrightarrow> (g \<midarrow>b\<rightarrow> m)"
   by (simp add: LIM_equal)
 
 lemma tendsto_cong_limit: "(f \<longlongrightarrow> l) F \<Longrightarrow> k = l \<Longrightarrow> (f \<longlongrightarrow> k) F"
   by simp
 
 lemma tendsto_at_iff_tendsto_nhds: "g \<midarrow>l\<rightarrow> g l \<longleftrightarrow> (g \<longlongrightarrow> g l) (nhds l)"
   unfolding tendsto_def eventually_at_filter
   by (intro ext all_cong imp_cong) (auto elim!: eventually_mono)
 
 lemma tendsto_compose: "g \<midarrow>l\<rightarrow> g l \<Longrightarrow> (f \<longlongrightarrow> l) F \<Longrightarrow> ((\<lambda>x. g (f x)) \<longlongrightarrow> g l) F"
   unfolding tendsto_at_iff_tendsto_nhds by (rule filterlim_compose[of g])
 
 lemma tendsto_compose_eventually:
   "g \<midarrow>l\<rightarrow> m \<Longrightarrow> (f \<longlongrightarrow> l) F \<Longrightarrow> eventually (\<lambda>x. f x \<noteq> l) F \<Longrightarrow> ((\<lambda>x. g (f x)) \<longlongrightarrow> m) F"
   by (rule filterlim_compose[of g _ "at l"]) (auto simp add: filterlim_at)
 
 lemma LIM_compose_eventually:
   assumes "f \<midarrow>a\<rightarrow> b"
     and "g \<midarrow>b\<rightarrow> c"
     and "eventually (\<lambda>x. f x \<noteq> b) (at a)"
   shows "(\<lambda>x. g (f x)) \<midarrow>a\<rightarrow> c"
   using assms(2,1,3) by (rule tendsto_compose_eventually)
 
 lemma tendsto_compose_filtermap: "((g \<circ> f) \<longlongrightarrow> T) F \<longleftrightarrow> (g \<longlongrightarrow> T) (filtermap f F)"
   by (simp add: filterlim_def filtermap_filtermap comp_def)
 
 lemma tendsto_compose_at:
   assumes f: "(f \<longlongrightarrow> y) F" and g: "(g \<longlongrightarrow> z) (at y)" and fg: "eventually (\<lambda>w. f w = y \<longrightarrow> g y = z) F"
   shows "((g \<circ> f) \<longlongrightarrow> z) F"
 proof -
   have "(\<forall>\<^sub>F a in F. f a \<noteq> y) \<or> g y = z"
     using fg by force
   moreover have "(g \<longlongrightarrow> z) (filtermap f F) \<or> \<not> (\<forall>\<^sub>F a in F. f a \<noteq> y)"
     by (metis (no_types) filterlim_atI filterlim_def tendsto_mono f g)
   ultimately show ?thesis
     by (metis (no_types) f filterlim_compose filterlim_filtermap g tendsto_at_iff_tendsto_nhds tendsto_compose_filtermap)
 qed
 
 
 subsubsection \<open>Relation of \<open>LIM\<close> and \<open>LIMSEQ\<close>\<close>
 
 lemma (in first_countable_topology) sequentially_imp_eventually_within:
   "(\<forall>f. (\<forall>n. f n \<in> s \<and> f n \<noteq> a) \<and> f \<longlonglongrightarrow> a \<longrightarrow> eventually (\<lambda>n. P (f n)) sequentially) \<Longrightarrow>
     eventually P (at a within s)"
   unfolding at_within_def
   by (intro sequentially_imp_eventually_nhds_within) auto
 
 lemma (in first_countable_topology) sequentially_imp_eventually_at:
   "(\<forall>f. (\<forall>n. f n \<noteq> a) \<and> f \<longlonglongrightarrow> a \<longrightarrow> eventually (\<lambda>n. P (f n)) sequentially) \<Longrightarrow> eventually P (at a)"
   using sequentially_imp_eventually_within [where s=UNIV] by simp
 
 lemma LIMSEQ_SEQ_conv:
   "(\<forall>S. (\<forall>n. S n \<noteq> a) \<and> S \<longlonglongrightarrow> a \<longrightarrow> (\<lambda>n. X (S n)) \<longlonglongrightarrow> L)  \<longleftrightarrow>  X \<midarrow>a\<rightarrow> L"  (is "?lhs=?rhs")
   for a :: "'a::first_countable_topology" and L :: "'b::topological_space"
 proof
   assume ?lhs then show ?rhs
     by (simp add: sequentially_imp_eventually_within tendsto_def) 
 next
   assume ?rhs then show ?lhs
     using tendsto_compose_eventually eventuallyI by blast
 qed    
 
 lemma sequentially_imp_eventually_at_left:
   fixes a :: "'a::{linorder_topology,first_countable_topology}"
   assumes b[simp]: "b < a"
     and *: "\<And>f. (\<And>n. b < f n) \<Longrightarrow> (\<And>n. f n < a) \<Longrightarrow> incseq f \<Longrightarrow> f \<longlonglongrightarrow> a \<Longrightarrow>
       eventually (\<lambda>n. P (f n)) sequentially"
   shows "eventually P (at_left a)"
 proof (safe intro!: sequentially_imp_eventually_within)
   fix X
   assume X: "\<forall>n. X n \<in> {..< a} \<and> X n \<noteq> a" "X \<longlonglongrightarrow> a"
   show "eventually (\<lambda>n. P (X n)) sequentially"
   proof (rule ccontr)
     assume neg: "\<not> ?thesis"
     have "\<exists>s. \<forall>n. (\<not> P (X (s n)) \<and> b < X (s n)) \<and> (X (s n) \<le> X (s (Suc n)) \<and> Suc (s n) \<le> s (Suc n))"
       (is "\<exists>s. ?P s")
     proof (rule dependent_nat_choice)
       have "\<not> eventually (\<lambda>n. b < X n \<longrightarrow> P (X n)) sequentially"
         by (intro not_eventually_impI neg order_tendstoD(1) [OF X(2) b])
       then show "\<exists>x. \<not> P (X x) \<and> b < X x"
         by (auto dest!: not_eventuallyD)
     next
       fix x n
       have "\<not> eventually (\<lambda>n. Suc x \<le> n \<longrightarrow> b < X n \<longrightarrow> X x < X n \<longrightarrow> P (X n)) sequentially"
         using X
         by (intro not_eventually_impI order_tendstoD(1)[OF X(2)] eventually_ge_at_top neg) auto
       then show "\<exists>n. (\<not> P (X n) \<and> b < X n) \<and> (X x \<le> X n \<and> Suc x \<le> n)"
         by (auto dest!: not_eventuallyD)
     qed
     then obtain s where "?P s" ..
     with X have "b < X (s n)"
       and "X (s n) < a"
       and "incseq (\<lambda>n. X (s n))"
       and "(\<lambda>n. X (s n)) \<longlonglongrightarrow> a"
       and "\<not> P (X (s n))"
       for n
       by (auto simp: strict_mono_Suc_iff Suc_le_eq incseq_Suc_iff
           intro!: LIMSEQ_subseq_LIMSEQ[OF \<open>X \<longlonglongrightarrow> a\<close>, unfolded comp_def])
     from *[OF this(1,2,3,4)] this(5) show False
       by auto
   qed
 qed
 
 lemma tendsto_at_left_sequentially:
   fixes a b :: "'b::{linorder_topology,first_countable_topology}"
   assumes "b < a"
   assumes *: "\<And>S. (\<And>n. S n < a) \<Longrightarrow> (\<And>n. b < S n) \<Longrightarrow> incseq S \<Longrightarrow> S \<longlonglongrightarrow> a \<Longrightarrow>
     (\<lambda>n. X (S n)) \<longlonglongrightarrow> L"
   shows "(X \<longlongrightarrow> L) (at_left a)"
   using assms by (simp add: tendsto_def [where l=L] sequentially_imp_eventually_at_left)
 
 lemma sequentially_imp_eventually_at_right:
   fixes a b :: "'a::{linorder_topology,first_countable_topology}"
   assumes b[simp]: "a < b"
   assumes *: "\<And>f. (\<And>n. a < f n) \<Longrightarrow> (\<And>n. f n < b) \<Longrightarrow> decseq f \<Longrightarrow> f \<longlonglongrightarrow> a \<Longrightarrow>
     eventually (\<lambda>n. P (f n)) sequentially"
   shows "eventually P (at_right a)"
 proof (safe intro!: sequentially_imp_eventually_within)
   fix X
   assume X: "\<forall>n. X n \<in> {a <..} \<and> X n \<noteq> a" "X \<longlonglongrightarrow> a"
   show "eventually (\<lambda>n. P (X n)) sequentially"
   proof (rule ccontr)
     assume neg: "\<not> ?thesis"
     have "\<exists>s. \<forall>n. (\<not> P (X (s n)) \<and> X (s n) < b) \<and> (X (s (Suc n)) \<le> X (s n) \<and> Suc (s n) \<le> s (Suc n))"
       (is "\<exists>s. ?P s")
     proof (rule dependent_nat_choice)
       have "\<not> eventually (\<lambda>n. X n < b \<longrightarrow> P (X n)) sequentially"
         by (intro not_eventually_impI neg order_tendstoD(2) [OF X(2) b])
       then show "\<exists>x. \<not> P (X x) \<and> X x < b"
         by (auto dest!: not_eventuallyD)
     next
       fix x n
       have "\<not> eventually (\<lambda>n. Suc x \<le> n \<longrightarrow> X n < b \<longrightarrow> X n < X x \<longrightarrow> P (X n)) sequentially"
         using X
         by (intro not_eventually_impI order_tendstoD(2)[OF X(2)] eventually_ge_at_top neg) auto
       then show "\<exists>n. (\<not> P (X n) \<and> X n < b) \<and> (X n \<le> X x \<and> Suc x \<le> n)"
         by (auto dest!: not_eventuallyD)
     qed
     then obtain s where "?P s" ..
     with X have "a < X (s n)"
       and "X (s n) < b"
       and "decseq (\<lambda>n. X (s n))"
       and "(\<lambda>n. X (s n)) \<longlonglongrightarrow> a"
       and "\<not> P (X (s n))"
       for n
       by (auto simp: strict_mono_Suc_iff Suc_le_eq decseq_Suc_iff
           intro!: LIMSEQ_subseq_LIMSEQ[OF \<open>X \<longlonglongrightarrow> a\<close>, unfolded comp_def])
     from *[OF this(1,2,3,4)] this(5) show False
       by auto
   qed
 qed
 
 lemma tendsto_at_right_sequentially:
   fixes a :: "_ :: {linorder_topology, first_countable_topology}"
   assumes "a < b"
     and *: "\<And>S. (\<And>n. a < S n) \<Longrightarrow> (\<And>n. S n < b) \<Longrightarrow> decseq S \<Longrightarrow> S \<longlonglongrightarrow> a \<Longrightarrow>
       (\<lambda>n. X (S n)) \<longlonglongrightarrow> L"
   shows "(X \<longlongrightarrow> L) (at_right a)"
   using assms by (simp add: tendsto_def [where l=L] sequentially_imp_eventually_at_right)
 
 
 subsection \<open>Continuity\<close>
 
 subsubsection \<open>Continuity on a set\<close>
 
 definition continuous_on :: "'a set \<Rightarrow> ('a::topological_space \<Rightarrow> 'b::topological_space) \<Rightarrow> bool"
   where "continuous_on s f \<longleftrightarrow> (\<forall>x\<in>s. (f \<longlongrightarrow> f x) (at x within s))"
 
 lemma continuous_on_cong [cong]:
   "s = t \<Longrightarrow> (\<And>x. x \<in> t \<Longrightarrow> f x = g x) \<Longrightarrow> continuous_on s f \<longleftrightarrow> continuous_on t g"
   unfolding continuous_on_def
   by (intro ball_cong filterlim_cong) (auto simp: eventually_at_filter)
 
 lemma continuous_on_cong_simp:
   "s = t \<Longrightarrow> (\<And>x. x \<in> t =simp=> f x = g x) \<Longrightarrow> continuous_on s f \<longleftrightarrow> continuous_on t g"
   unfolding simp_implies_def by (rule continuous_on_cong)
 
 lemma continuous_on_topological:
   "continuous_on s f \<longleftrightarrow>
     (\<forall>x\<in>s. \<forall>B. open B \<longrightarrow> f x \<in> B \<longrightarrow> (\<exists>A. open A \<and> x \<in> A \<and> (\<forall>y\<in>s. y \<in> A \<longrightarrow> f y \<in> B)))"
   unfolding continuous_on_def tendsto_def eventually_at_topological by metis
 
 lemma continuous_on_open_invariant:
   "continuous_on s f \<longleftrightarrow> (\<forall>B. open B \<longrightarrow> (\<exists>A. open A \<and> A \<inter> s = f -` B \<inter> s))"
 proof safe
   fix B :: "'b set"
   assume "continuous_on s f" "open B"
   then have "\<forall>x\<in>f -` B \<inter> s. (\<exists>A. open A \<and> x \<in> A \<and> s \<inter> A \<subseteq> f -` B)"
     by (auto simp: continuous_on_topological subset_eq Ball_def imp_conjL)
   then obtain A where "\<forall>x\<in>f -` B \<inter> s. open (A x) \<and> x \<in> A x \<and> s \<inter> A x \<subseteq> f -` B"
     unfolding bchoice_iff ..
   then show "\<exists>A. open A \<and> A \<inter> s = f -` B \<inter> s"
     by (intro exI[of _ "\<Union>x\<in>f -` B \<inter> s. A x"]) auto
 next
   assume B: "\<forall>B. open B \<longrightarrow> (\<exists>A. open A \<and> A \<inter> s = f -` B \<inter> s)"
   show "continuous_on s f"
     unfolding continuous_on_topological
   proof safe
     fix x B
     assume "x \<in> s" "open B" "f x \<in> B"
     with B obtain A where A: "open A" "A \<inter> s = f -` B \<inter> s"
       by auto
     with \<open>x \<in> s\<close> \<open>f x \<in> B\<close> show "\<exists>A. open A \<and> x \<in> A \<and> (\<forall>y\<in>s. y \<in> A \<longrightarrow> f y \<in> B)"
       by (intro exI[of _ A]) auto
   qed
 qed
 
 lemma continuous_on_open_vimage:
   "open s \<Longrightarrow> continuous_on s f \<longleftrightarrow> (\<forall>B. open B \<longrightarrow> open (f -` B \<inter> s))"
   unfolding continuous_on_open_invariant
   by (metis open_Int Int_absorb Int_commute[of s] Int_assoc[of _ _ s])
 
 corollary continuous_imp_open_vimage:
   assumes "continuous_on s f" "open s" "open B" "f -` B \<subseteq> s"
   shows "open (f -` B)"
   by (metis assms continuous_on_open_vimage le_iff_inf)
 
 corollary open_vimage[continuous_intros]:
   assumes "open s"
     and "continuous_on UNIV f"
   shows "open (f -` s)"
   using assms by (simp add: continuous_on_open_vimage [OF open_UNIV])
 
 lemma continuous_on_closed_invariant:
   "continuous_on s f \<longleftrightarrow> (\<forall>B. closed B \<longrightarrow> (\<exists>A. closed A \<and> A \<inter> s = f -` B \<inter> s))"
 proof -
   have *: "(\<And>A. P A \<longleftrightarrow> Q (- A)) \<Longrightarrow> (\<forall>A. P A) \<longleftrightarrow> (\<forall>A. Q A)"
     for P Q :: "'b set \<Rightarrow> bool"
     by (metis double_compl)
   show ?thesis
     unfolding continuous_on_open_invariant
     by (intro *) (auto simp: open_closed[symmetric])
 qed
 
 lemma continuous_on_closed_vimage:
   "closed s \<Longrightarrow> continuous_on s f \<longleftrightarrow> (\<forall>B. closed B \<longrightarrow> closed (f -` B \<inter> s))"
   unfolding continuous_on_closed_invariant
   by (metis closed_Int Int_absorb Int_commute[of s] Int_assoc[of _ _ s])
 
 corollary closed_vimage_Int[continuous_intros]:
   assumes "closed s"
     and "continuous_on t f"
     and t: "closed t"
   shows "closed (f -` s \<inter> t)"
   using assms by (simp add: continuous_on_closed_vimage [OF t])
 
 corollary closed_vimage[continuous_intros]:
   assumes "closed s"
     and "continuous_on UNIV f"
   shows "closed (f -` s)"
   using closed_vimage_Int [OF assms] by simp
 
 lemma continuous_on_empty [simp]: "continuous_on {} f"
   by (simp add: continuous_on_def)
 
 lemma continuous_on_sing [simp]: "continuous_on {x} f"
   by (simp add: continuous_on_def at_within_def)
 
 lemma continuous_on_open_Union:
   "(\<And>s. s \<in> S \<Longrightarrow> open s) \<Longrightarrow> (\<And>s. s \<in> S \<Longrightarrow> continuous_on s f) \<Longrightarrow> continuous_on (\<Union>S) f"
   unfolding continuous_on_def
   by safe (metis open_Union at_within_open UnionI)
 
 lemma continuous_on_open_UN:
   "(\<And>s. s \<in> S \<Longrightarrow> open (A s)) \<Longrightarrow> (\<And>s. s \<in> S \<Longrightarrow> continuous_on (A s) f) \<Longrightarrow>
     continuous_on (\<Union>s\<in>S. A s) f"
   by (rule continuous_on_open_Union) auto
 
 lemma continuous_on_open_Un:
   "open s \<Longrightarrow> open t \<Longrightarrow> continuous_on s f \<Longrightarrow> continuous_on t f \<Longrightarrow> continuous_on (s \<union> t) f"
   using continuous_on_open_Union [of "{s,t}"] by auto
 
 lemma continuous_on_closed_Un:
   "closed s \<Longrightarrow> closed t \<Longrightarrow> continuous_on s f \<Longrightarrow> continuous_on t f \<Longrightarrow> continuous_on (s \<union> t) f"
   by (auto simp add: continuous_on_closed_vimage closed_Un Int_Un_distrib)
 
 lemma continuous_on_closed_Union:
   assumes "finite I"
     "\<And>i. i \<in> I \<Longrightarrow> closed (U i)"
     "\<And>i. i \<in> I \<Longrightarrow> continuous_on (U i) f"
   shows "continuous_on (\<Union> i \<in> I. U i) f"
   using assms
   by (induction I) (auto intro!: continuous_on_closed_Un)
 
 lemma continuous_on_If:
   assumes closed: "closed s" "closed t"
     and cont: "continuous_on s f" "continuous_on t g"
     and P: "\<And>x. x \<in> s \<Longrightarrow> \<not> P x \<Longrightarrow> f x = g x" "\<And>x. x \<in> t \<Longrightarrow> P x \<Longrightarrow> f x = g x"
   shows "continuous_on (s \<union> t) (\<lambda>x. if P x then f x else g x)"
     (is "continuous_on _ ?h")
 proof-
   from P have "\<forall>x\<in>s. f x = ?h x" "\<forall>x\<in>t. g x = ?h x"
     by auto
   with cont have "continuous_on s ?h" "continuous_on t ?h"
     by simp_all
   with closed show ?thesis
     by (rule continuous_on_closed_Un)
 qed
 
 lemma continuous_on_cases:
   "closed s \<Longrightarrow> closed t \<Longrightarrow> continuous_on s f \<Longrightarrow> continuous_on t g \<Longrightarrow>
     \<forall>x. (x\<in>s \<and> \<not> P x) \<or> (x \<in> t \<and> P x) \<longrightarrow> f x = g x \<Longrightarrow>
     continuous_on (s \<union> t) (\<lambda>x. if P x then f x else g x)"
   by (rule continuous_on_If) auto
 
 lemma continuous_on_id[continuous_intros,simp]: "continuous_on s (\<lambda>x. x)"
   unfolding continuous_on_def by fast
 
 lemma continuous_on_id'[continuous_intros,simp]: "continuous_on s id"
   unfolding continuous_on_def id_def by fast
 
 lemma continuous_on_const[continuous_intros,simp]: "continuous_on s (\<lambda>x. c)"
   unfolding continuous_on_def by auto
 
 lemma continuous_on_subset: "continuous_on s f \<Longrightarrow> t \<subseteq> s \<Longrightarrow> continuous_on t f"
   unfolding continuous_on_def
   by (metis subset_eq tendsto_within_subset)
 
 lemma continuous_on_compose[continuous_intros]:
   "continuous_on s f \<Longrightarrow> continuous_on (f ` s) g \<Longrightarrow> continuous_on s (g \<circ> f)"
   unfolding continuous_on_topological by simp metis
 
 lemma continuous_on_compose2:
   "continuous_on t g \<Longrightarrow> continuous_on s f \<Longrightarrow> f ` s \<subseteq> t \<Longrightarrow> continuous_on s (\<lambda>x. g (f x))"
   using continuous_on_compose[of s f g] continuous_on_subset by (force simp add: comp_def)
 
 lemma continuous_on_generate_topology:
   assumes *: "open = generate_topology X"
     and **: "\<And>B. B \<in> X \<Longrightarrow> \<exists>C. open C \<and> C \<inter> A = f -` B \<inter> A"
   shows "continuous_on A f"
   unfolding continuous_on_open_invariant
 proof safe
   fix B :: "'a set"
   assume "open B"
   then show "\<exists>C. open C \<and> C \<inter> A = f -` B \<inter> A"
     unfolding *
   proof induct
     case (UN K)
     then obtain C where "\<And>k. k \<in> K \<Longrightarrow> open (C k)" "\<And>k. k \<in> K \<Longrightarrow> C k \<inter> A = f -` k \<inter> A"
       by metis
     then show ?case
       by (intro exI[of _ "\<Union>k\<in>K. C k"]) blast
   qed (auto intro: **)
 qed
 
 lemma continuous_onI_mono:
   fixes f :: "'a::linorder_topology \<Rightarrow> 'b::{dense_order,linorder_topology}"
   assumes "open (f`A)"
     and mono: "\<And>x y. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> x \<le> y \<Longrightarrow> f x \<le> f y"
   shows "continuous_on A f"
 proof (rule continuous_on_generate_topology[OF open_generated_order], safe)
   have monoD: "\<And>x y. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> f x < f y \<Longrightarrow> x < y"
     by (auto simp: not_le[symmetric] mono)
   have "\<exists>x. x \<in> A \<and> f x < b \<and> a < x" if a: "a \<in> A" and fa: "f a < b" for a b
   proof -
     obtain y where "f a < y" "{f a ..< y} \<subseteq> f`A"
       using open_right[OF \<open>open (f`A)\<close>, of "f a" b] a fa
       by auto
     obtain z where z: "f a < z" "z < min b y"
       using dense[of "f a" "min b y"] \<open>f a < y\<close> \<open>f a < b\<close> by auto
     then obtain c where "z = f c" "c \<in> A"
       using \<open>{f a ..< y} \<subseteq> f`A\<close>[THEN subsetD, of z] by (auto simp: less_imp_le)
     with a z show ?thesis
       by (auto intro!: exI[of _ c] simp: monoD)
   qed
   then show "\<exists>C. open C \<and> C \<inter> A = f -` {..<b} \<inter> A" for b
     by (intro exI[of _ "(\<Union>x\<in>{x\<in>A. f x < b}. {..< x})"])
        (auto intro: le_less_trans[OF mono] less_imp_le)
 
   have "\<exists>x. x \<in> A \<and> b < f x \<and> x < a" if a: "a \<in> A" and fa: "b < f a" for a b
   proof -
     note a fa
     moreover
     obtain y where "y < f a" "{y <.. f a} \<subseteq> f`A"
       using open_left[OF \<open>open (f`A)\<close>, of "f a" b]  a fa
       by auto
     then obtain z where z: "max b y < z" "z < f a"
       using dense[of "max b y" "f a"] \<open>y < f a\<close> \<open>b < f a\<close> by auto
     then obtain c where "z = f c" "c \<in> A"
       using \<open>{y <.. f a} \<subseteq> f`A\<close>[THEN subsetD, of z] by (auto simp: less_imp_le)
     with a z show ?thesis
       by (auto intro!: exI[of _ c] simp: monoD)
   qed
   then show "\<exists>C. open C \<and> C \<inter> A = f -` {b <..} \<inter> A" for b
     by (intro exI[of _ "(\<Union>x\<in>{x\<in>A. b < f x}. {x <..})"])
        (auto intro: less_le_trans[OF _ mono] less_imp_le)
 qed
 
 lemma continuous_on_IccI:
   "\<lbrakk>(f \<longlongrightarrow> f a) (at_right a);
     (f \<longlongrightarrow> f b) (at_left b);
     (\<And>x. a < x \<Longrightarrow> x < b \<Longrightarrow> f \<midarrow>x\<rightarrow> f x); a < b\<rbrakk> \<Longrightarrow>
     continuous_on {a .. b} f"
   for a::"'a::linorder_topology"
   using at_within_open[of _ "{a<..<b}"]
   by (auto simp: continuous_on_def at_within_Icc_at_right at_within_Icc_at_left le_less
       at_within_Icc_at)
 
 lemma
   fixes a b::"'a::linorder_topology"
   assumes "continuous_on {a .. b} f" "a < b"
   shows continuous_on_Icc_at_rightD: "(f \<longlongrightarrow> f a) (at_right a)"
     and continuous_on_Icc_at_leftD: "(f \<longlongrightarrow> f b) (at_left b)"
   using assms
   by (auto simp: at_within_Icc_at_right at_within_Icc_at_left continuous_on_def
       dest: bspec[where x=a] bspec[where x=b])
 
 lemma continuous_on_discrete [simp]:
   "continuous_on A (f :: 'a :: discrete_topology \<Rightarrow> _)"
   by (auto simp: continuous_on_def at_discrete)
 
 subsubsection \<open>Continuity at a point\<close>
 
 definition continuous :: "'a::t2_space filter \<Rightarrow> ('a \<Rightarrow> 'b::topological_space) \<Rightarrow> bool"
   where "continuous F f \<longleftrightarrow> (f \<longlongrightarrow> f (Lim F (\<lambda>x. x))) F"
 
 lemma continuous_bot[continuous_intros, simp]: "continuous bot f"
   unfolding continuous_def by auto
 
 lemma continuous_trivial_limit: "trivial_limit net \<Longrightarrow> continuous net f"
   by simp
 
 lemma continuous_within: "continuous (at x within s) f \<longleftrightarrow> (f \<longlongrightarrow> f x) (at x within s)"
   by (cases "trivial_limit (at x within s)") (auto simp add: Lim_ident_at continuous_def)
 
 lemma continuous_within_topological:
   "continuous (at x within s) f \<longleftrightarrow>
     (\<forall>B. open B \<longrightarrow> f x \<in> B \<longrightarrow> (\<exists>A. open A \<and> x \<in> A \<and> (\<forall>y\<in>s. y \<in> A \<longrightarrow> f y \<in> B)))"
   unfolding continuous_within tendsto_def eventually_at_topological by metis
 
 lemma continuous_within_compose[continuous_intros]:
   "continuous (at x within s) f \<Longrightarrow> continuous (at (f x) within f ` s) g \<Longrightarrow>
     continuous (at x within s) (g \<circ> f)"
   by (simp add: continuous_within_topological) metis
 
 lemma continuous_within_compose2:
   "continuous (at x within s) f \<Longrightarrow> continuous (at (f x) within f ` s) g \<Longrightarrow>
     continuous (at x within s) (\<lambda>x. g (f x))"
   using continuous_within_compose[of x s f g] by (simp add: comp_def)
 
 lemma continuous_at: "continuous (at x) f \<longleftrightarrow> f \<midarrow>x\<rightarrow> f x"
   using continuous_within[of x UNIV f] by simp
 
 lemma continuous_ident[continuous_intros, simp]: "continuous (at x within S) (\<lambda>x. x)"
   unfolding continuous_within by (rule tendsto_ident_at)
 
 lemma continuous_id[continuous_intros, simp]: "continuous (at x within S) id"
   by (simp add: id_def)
 
 lemma continuous_const[continuous_intros, simp]: "continuous F (\<lambda>x. c)"
   unfolding continuous_def by (rule tendsto_const)
 
 lemma continuous_on_eq_continuous_within:
   "continuous_on s f \<longleftrightarrow> (\<forall>x\<in>s. continuous (at x within s) f)"
   unfolding continuous_on_def continuous_within ..
 
 lemma continuous_discrete [simp]:
   "continuous (at x within A) (f :: 'a :: discrete_topology \<Rightarrow> _)"
   by (auto simp: continuous_def at_discrete)
 
 abbreviation isCont :: "('a::t2_space \<Rightarrow> 'b::topological_space) \<Rightarrow> 'a \<Rightarrow> bool"
   where "isCont f a \<equiv> continuous (at a) f"
 
 lemma isCont_def: "isCont f a \<longleftrightarrow> f \<midarrow>a\<rightarrow> f a"
   by (rule continuous_at)
 
 lemma isContD: "isCont f x \<Longrightarrow> f \<midarrow>x\<rightarrow> f x"
   by (simp add: isCont_def)
 
 lemma isCont_cong:
   assumes "eventually (\<lambda>x. f x = g x) (nhds x)"
   shows "isCont f x \<longleftrightarrow> isCont g x"
 proof -
   from assms have [simp]: "f x = g x"
     by (rule eventually_nhds_x_imp_x)
   from assms have "eventually (\<lambda>x. f x = g x) (at x)"
     by (auto simp: eventually_at_filter elim!: eventually_mono)
   with assms have "isCont f x \<longleftrightarrow> isCont g x" unfolding isCont_def
     by (intro filterlim_cong) (auto elim!: eventually_mono)
   with assms show ?thesis by simp
 qed
 
 lemma continuous_at_imp_continuous_at_within: "isCont f x \<Longrightarrow> continuous (at x within s) f"
   by (auto intro: tendsto_mono at_le simp: continuous_at continuous_within)
 
 lemma continuous_on_eq_continuous_at: "open s \<Longrightarrow> continuous_on s f \<longleftrightarrow> (\<forall>x\<in>s. isCont f x)"
   by (simp add: continuous_on_def continuous_at at_within_open[of _ s])
 
 lemma continuous_within_open: "a \<in> A \<Longrightarrow> open A \<Longrightarrow> continuous (at a within A) f \<longleftrightarrow> isCont f a"
   by (simp add: at_within_open_NO_MATCH)
 
 lemma continuous_at_imp_continuous_on: "\<forall>x\<in>s. isCont f x \<Longrightarrow> continuous_on s f"
   by (auto intro: continuous_at_imp_continuous_at_within simp: continuous_on_eq_continuous_within)
 
 lemma isCont_o2: "isCont f a \<Longrightarrow> isCont g (f a) \<Longrightarrow> isCont (\<lambda>x. g (f x)) a"
   unfolding isCont_def by (rule tendsto_compose)
 
 lemma continuous_at_compose[continuous_intros]: "isCont f a \<Longrightarrow> isCont g (f a) \<Longrightarrow> isCont (g \<circ> f) a"
   unfolding o_def by (rule isCont_o2)
 
 lemma isCont_tendsto_compose: "isCont g l \<Longrightarrow> (f \<longlongrightarrow> l) F \<Longrightarrow> ((\<lambda>x. g (f x)) \<longlongrightarrow> g l) F"
   unfolding isCont_def by (rule tendsto_compose)
 
 lemma continuous_on_tendsto_compose:
   assumes f_cont: "continuous_on s f"
     and g: "(g \<longlongrightarrow> l) F"
     and l: "l \<in> s"
     and ev: "\<forall>\<^sub>Fx in F. g x \<in> s"
   shows "((\<lambda>x. f (g x)) \<longlongrightarrow> f l) F"
 proof -
   from f_cont l have f: "(f \<longlongrightarrow> f l) (at l within s)"
     by (simp add: continuous_on_def)
   have i: "((\<lambda>x. if g x = l then f l else f (g x)) \<longlongrightarrow> f l) F"
     by (rule filterlim_If)
        (auto intro!: filterlim_compose[OF f] eventually_conj tendsto_mono[OF _ g]
              simp: filterlim_at eventually_inf_principal eventually_mono[OF ev])
   show ?thesis
     by (rule filterlim_cong[THEN iffD1[OF _ i]]) auto
 qed
 
 lemma continuous_within_compose3:
   "isCont g (f x) \<Longrightarrow> continuous (at x within s) f \<Longrightarrow> continuous (at x within s) (\<lambda>x. g (f x))"
   using continuous_at_imp_continuous_at_within continuous_within_compose2 by blast
 
 lemma filtermap_nhds_open_map:
   assumes cont: "isCont f a"
     and open_map: "\<And>S. open S \<Longrightarrow> open (f`S)"
   shows "filtermap f (nhds a) = nhds (f a)"
   unfolding filter_eq_iff
 proof safe
   fix P
   assume "eventually P (filtermap f (nhds a))"
   then obtain S where "open S" "a \<in> S" "\<forall>x\<in>S. P (f x)"
     by (auto simp: eventually_filtermap eventually_nhds)
   then show "eventually P (nhds (f a))"
     unfolding eventually_nhds by (intro exI[of _ "f`S"]) (auto intro!: open_map)
 qed (metis filterlim_iff tendsto_at_iff_tendsto_nhds isCont_def eventually_filtermap cont)
 
 lemma continuous_at_split:
   "continuous (at x) f \<longleftrightarrow> continuous (at_left x) f \<and> continuous (at_right x) f"
   for x :: "'a::linorder_topology"
   by (simp add: continuous_within filterlim_at_split)
 
 lemma continuous_on_max [continuous_intros]:
   fixes f g :: "'a::topological_space \<Rightarrow> 'b::linorder_topology"
   shows "continuous_on A f \<Longrightarrow> continuous_on A g \<Longrightarrow> continuous_on A (\<lambda>x. max (f x) (g x))"
   by (auto simp: continuous_on_def intro!: tendsto_max)
 
 lemma continuous_on_min [continuous_intros]:
   fixes f g :: "'a::topological_space \<Rightarrow> 'b::linorder_topology"
   shows "continuous_on A f \<Longrightarrow> continuous_on A g \<Longrightarrow> continuous_on A (\<lambda>x. min (f x) (g x))"
   by (auto simp: continuous_on_def intro!: tendsto_min)
 
 lemma continuous_max [continuous_intros]:
   fixes f :: "'a::t2_space \<Rightarrow> 'b::linorder_topology"
   shows "\<lbrakk>continuous F f; continuous F g\<rbrakk> \<Longrightarrow> continuous F (\<lambda>x. (max (f x) (g x)))"
   by (simp add: tendsto_max continuous_def)
 
 lemma continuous_min [continuous_intros]:
   fixes f :: "'a::t2_space \<Rightarrow> 'b::linorder_topology"
   shows "\<lbrakk>continuous F f; continuous F g\<rbrakk> \<Longrightarrow> continuous F (\<lambda>x. (min (f x) (g x)))"
   by (simp add: tendsto_min continuous_def)
 
 text \<open>
   The following open/closed Collect lemmas are ported from
   Sébastien Gouëzel's \<open>Ergodic_Theory\<close>.
 \<close>
 lemma open_Collect_neq:
   fixes f g :: "'a::topological_space \<Rightarrow> 'b::t2_space"
   assumes f: "continuous_on UNIV f" and g: "continuous_on UNIV g"
   shows "open {x. f x \<noteq> g x}"
 proof (rule openI)
   fix t
   assume "t \<in> {x. f x \<noteq> g x}"
   then obtain U V where *: "open U" "open V" "f t \<in> U" "g t \<in> V" "U \<inter> V = {}"
     by (auto simp add: separation_t2)
   with open_vimage[OF \<open>open U\<close> f] open_vimage[OF \<open>open V\<close> g]
   show "\<exists>T. open T \<and> t \<in> T \<and> T \<subseteq> {x. f x \<noteq> g x}"
     by (intro exI[of _ "f -` U \<inter> g -` V"]) auto
 qed
 
 lemma closed_Collect_eq:
   fixes f g :: "'a::topological_space \<Rightarrow> 'b::t2_space"
   assumes f: "continuous_on UNIV f" and g: "continuous_on UNIV g"
   shows "closed {x. f x = g x}"
   using open_Collect_neq[OF f g] by (simp add: closed_def Collect_neg_eq)
 
 lemma open_Collect_less:
   fixes f g :: "'a::topological_space \<Rightarrow> 'b::linorder_topology"
   assumes f: "continuous_on UNIV f" and g: "continuous_on UNIV g"
   shows "open {x. f x < g x}"
 proof (rule openI)
   fix t
   assume t: "t \<in> {x. f x < g x}"
   show "\<exists>T. open T \<and> t \<in> T \<and> T \<subseteq> {x. f x < g x}"
   proof (cases "\<exists>z. f t < z \<and> z < g t")
     case True
     then obtain z where "f t < z \<and> z < g t" by blast
     then show ?thesis
       using open_vimage[OF _ f, of "{..< z}"] open_vimage[OF _ g, of "{z <..}"]
       by (intro exI[of _ "f -` {..<z} \<inter> g -` {z<..}"]) auto
   next
     case False
     then have *: "{g t ..} = {f t <..}" "{..< g t} = {.. f t}"
       using t by (auto intro: leI)
     show ?thesis
       using open_vimage[OF _ f, of "{..< g t}"] open_vimage[OF _ g, of "{f t <..}"] t
       apply (intro exI[of _ "f -` {..< g t} \<inter> g -` {f t<..}"])
       apply (simp add: open_Int)
       apply (auto simp add: *)
       done
   qed
 qed
 
 lemma closed_Collect_le:
   fixes f g :: "'a :: topological_space \<Rightarrow> 'b::linorder_topology"
   assumes f: "continuous_on UNIV f"
     and g: "continuous_on UNIV g"
   shows "closed {x. f x \<le> g x}"
   using open_Collect_less [OF g f]
   by (simp add: closed_def Collect_neg_eq[symmetric] not_le)
 
 
 subsubsection \<open>Open-cover compactness\<close>
 
 context topological_space
 begin
 
 definition compact :: "'a set \<Rightarrow> bool" where
 compact_eq_Heine_Borel:  (* This name is used for backwards compatibility *)
     "compact S \<longleftrightarrow> (\<forall>C. (\<forall>c\<in>C. open c) \<and> S \<subseteq> \<Union>C \<longrightarrow> (\<exists>D\<subseteq>C. finite D \<and> S \<subseteq> \<Union>D))"
 
 lemma compactI:
   assumes "\<And>C. \<forall>t\<in>C. open t \<Longrightarrow> s \<subseteq> \<Union>C \<Longrightarrow> \<exists>C'. C' \<subseteq> C \<and> finite C' \<and> s \<subseteq> \<Union>C'"
   shows "compact s"
   unfolding compact_eq_Heine_Borel using assms by metis
 
 lemma compact_empty[simp]: "compact {}"
   by (auto intro!: compactI)
 
 lemma compactE: (*related to COMPACT_IMP_HEINE_BOREL in HOL Light*)
   assumes "compact S" "S \<subseteq> \<Union>\<T>" "\<And>B. B \<in> \<T> \<Longrightarrow> open B"
   obtains \<T>' where "\<T>' \<subseteq> \<T>" "finite \<T>'" "S \<subseteq> \<Union>\<T>'"
   by (meson assms compact_eq_Heine_Borel)
 
 lemma compactE_image:
   assumes "compact S"
     and opn: "\<And>T. T \<in> C \<Longrightarrow> open (f T)"
     and S: "S \<subseteq> (\<Union>c\<in>C. f c)"
   obtains C' where "C' \<subseteq> C" and "finite C'" and "S \<subseteq> (\<Union>c\<in>C'. f c)"
     apply (rule compactE[OF \<open>compact S\<close> S])
     using opn apply force
     by (metis finite_subset_image)
 
 lemma compact_Int_closed [intro]:
   assumes "compact S"
     and "closed T"
   shows "compact (S \<inter> T)"
 proof (rule compactI)
   fix C
   assume C: "\<forall>c\<in>C. open c"
   assume cover: "S \<inter> T \<subseteq> \<Union>C"
   from C \<open>closed T\<close> have "\<forall>c\<in>C \<union> {- T}. open c"
     by auto
   moreover from cover have "S \<subseteq> \<Union>(C \<union> {- T})"
     by auto
   ultimately have "\<exists>D\<subseteq>C \<union> {- T}. finite D \<and> S \<subseteq> \<Union>D"
     using \<open>compact S\<close> unfolding compact_eq_Heine_Borel by auto
   then obtain D where "D \<subseteq> C \<union> {- T} \<and> finite D \<and> S \<subseteq> \<Union>D" ..
   then show "\<exists>D\<subseteq>C. finite D \<and> S \<inter> T \<subseteq> \<Union>D"
     by (intro exI[of _ "D - {-T}"]) auto
 qed
 
 lemma compact_diff: "\<lbrakk>compact S; open T\<rbrakk> \<Longrightarrow> compact(S - T)"
   by (simp add: Diff_eq compact_Int_closed open_closed)
 
 lemma inj_setminus: "inj_on uminus (A::'a set set)"
   by (auto simp: inj_on_def)
 
 
 subsection \<open>Finite intersection property\<close>
 
 lemma compact_fip:
   "compact U \<longleftrightarrow>
     (\<forall>A. (\<forall>a\<in>A. closed a) \<longrightarrow> (\<forall>B \<subseteq> A. finite B \<longrightarrow> U \<inter> \<Inter>B \<noteq> {}) \<longrightarrow> U \<inter> \<Inter>A \<noteq> {})"
   (is "_ \<longleftrightarrow> ?R")
 proof (safe intro!: compact_eq_Heine_Borel[THEN iffD2])
   fix A
   assume "compact U"
   assume A: "\<forall>a\<in>A. closed a" "U \<inter> \<Inter>A = {}"
   assume fin: "\<forall>B \<subseteq> A. finite B \<longrightarrow> U \<inter> \<Inter>B \<noteq> {}"
   from A have "(\<forall>a\<in>uminus`A. open a) \<and> U \<subseteq> \<Union>(uminus`A)"
     by auto
   with \<open>compact U\<close> obtain B where "B \<subseteq> A" "finite (uminus`B)" "U \<subseteq> \<Union>(uminus`B)"
     unfolding compact_eq_Heine_Borel by (metis subset_image_iff)
   with fin[THEN spec, of B] show False
     by (auto dest: finite_imageD intro: inj_setminus)
 next
   fix A
   assume ?R
   assume "\<forall>a\<in>A. open a" "U \<subseteq> \<Union>A"
   then have "U \<inter> \<Inter>(uminus`A) = {}" "\<forall>a\<in>uminus`A. closed a"
     by auto
   with \<open>?R\<close> obtain B where "B \<subseteq> A" "finite (uminus`B)" "U \<inter> \<Inter>(uminus`B) = {}"
     by (metis subset_image_iff)
   then show "\<exists>T\<subseteq>A. finite T \<and> U \<subseteq> \<Union>T"
     by (auto intro!: exI[of _ B] inj_setminus dest: finite_imageD)
 qed
 
 lemma compact_imp_fip:
   assumes "compact S"
     and "\<And>T. T \<in> F \<Longrightarrow> closed T"
     and "\<And>F'. finite F' \<Longrightarrow> F' \<subseteq> F \<Longrightarrow> S \<inter> (\<Inter>F') \<noteq> {}"
   shows "S \<inter> (\<Inter>F) \<noteq> {}"
   using assms unfolding compact_fip by auto
 
 lemma compact_imp_fip_image:
   assumes "compact s"
     and P: "\<And>i. i \<in> I \<Longrightarrow> closed (f i)"
     and Q: "\<And>I'. finite I' \<Longrightarrow> I' \<subseteq> I \<Longrightarrow> (s \<inter> (\<Inter>i\<in>I'. f i) \<noteq> {})"
   shows "s \<inter> (\<Inter>i\<in>I. f i) \<noteq> {}"
 proof -
   from P have "\<forall>i \<in> f ` I. closed i"
     by blast
   moreover have "\<forall>A. finite A \<and> A \<subseteq> f ` I \<longrightarrow> (s \<inter> (\<Inter>A) \<noteq> {})"
     by (metis Q finite_subset_image)
   ultimately show "s \<inter> (\<Inter>(f ` I)) \<noteq> {}"
     by (metis \<open>compact s\<close> compact_imp_fip)
 qed
 
 end
 
 lemma (in t2_space) compact_imp_closed:
   assumes "compact s"
   shows "closed s"
   unfolding closed_def
 proof (rule openI)
   fix y
   assume "y \<in> - s"
   let ?C = "\<Union>x\<in>s. {u. open u \<and> x \<in> u \<and> eventually (\<lambda>y. y \<notin> u) (nhds y)}"
   have "s \<subseteq> \<Union>?C"
   proof
     fix x
     assume "x \<in> s"
     with \<open>y \<in> - s\<close> have "x \<noteq> y" by clarsimp
     then have "\<exists>u v. open u \<and> open v \<and> x \<in> u \<and> y \<in> v \<and> u \<inter> v = {}"
       by (rule hausdorff)
     with \<open>x \<in> s\<close> show "x \<in> \<Union>?C"
       unfolding eventually_nhds by auto
   qed
   then obtain D where "D \<subseteq> ?C" and "finite D" and "s \<subseteq> \<Union>D"
     by (rule compactE [OF \<open>compact s\<close>]) auto
   from \<open>D \<subseteq> ?C\<close> have "\<forall>x\<in>D. eventually (\<lambda>y. y \<notin> x) (nhds y)"
     by auto
   with \<open>finite D\<close> have "eventually (\<lambda>y. y \<notin> \<Union>D) (nhds y)"
     by (simp add: eventually_ball_finite)
   with \<open>s \<subseteq> \<Union>D\<close> have "eventually (\<lambda>y. y \<notin> s) (nhds y)"
     by (auto elim!: eventually_mono)
   then show "\<exists>t. open t \<and> y \<in> t \<and> t \<subseteq> - s"
     by (simp add: eventually_nhds subset_eq)
 qed
 
 lemma compact_continuous_image:
   assumes f: "continuous_on s f"
     and s: "compact s"
   shows "compact (f ` s)"
 proof (rule compactI)
   fix C
   assume "\<forall>c\<in>C. open c" and cover: "f`s \<subseteq> \<Union>C"
   with f have "\<forall>c\<in>C. \<exists>A. open A \<and> A \<inter> s = f -` c \<inter> s"
     unfolding continuous_on_open_invariant by blast
   then obtain A where A: "\<forall>c\<in>C. open (A c) \<and> A c \<inter> s = f -` c \<inter> s"
     unfolding bchoice_iff ..
   with cover have "\<And>c. c \<in> C \<Longrightarrow> open (A c)" "s \<subseteq> (\<Union>c\<in>C. A c)"
     by (fastforce simp add: subset_eq set_eq_iff)+
   from compactE_image[OF s this] obtain D where "D \<subseteq> C" "finite D" "s \<subseteq> (\<Union>c\<in>D. A c)" .
   with A show "\<exists>D \<subseteq> C. finite D \<and> f`s \<subseteq> \<Union>D"
     by (intro exI[of _ D]) (fastforce simp add: subset_eq set_eq_iff)+
 qed
 
 lemma continuous_on_inv:
   fixes f :: "'a::topological_space \<Rightarrow> 'b::t2_space"
   assumes "continuous_on s f"
     and "compact s"
     and "\<forall>x\<in>s. g (f x) = x"
   shows "continuous_on (f ` s) g"
   unfolding continuous_on_topological
 proof (clarsimp simp add: assms(3))
   fix x :: 'a and B :: "'a set"
   assume "x \<in> s" and "open B" and "x \<in> B"
   have 1: "\<forall>x\<in>s. f x \<in> f ` (s - B) \<longleftrightarrow> x \<in> s - B"
     using assms(3) by (auto, metis)
   have "continuous_on (s - B) f"
     using \<open>continuous_on s f\<close> Diff_subset
     by (rule continuous_on_subset)
   moreover have "compact (s - B)"
     using \<open>open B\<close> and \<open>compact s\<close>
     unfolding Diff_eq by (intro compact_Int_closed closed_Compl)
   ultimately have "compact (f ` (s - B))"
     by (rule compact_continuous_image)
   then have "closed (f ` (s - B))"
     by (rule compact_imp_closed)
   then have "open (- f ` (s - B))"
     by (rule open_Compl)
   moreover have "f x \<in> - f ` (s - B)"
     using \<open>x \<in> s\<close> and \<open>x \<in> B\<close> by (simp add: 1)
   moreover have "\<forall>y\<in>s. f y \<in> - f ` (s - B) \<longrightarrow> y \<in> B"
     by (simp add: 1)
   ultimately show "\<exists>A. open A \<and> f x \<in> A \<and> (\<forall>y\<in>s. f y \<in> A \<longrightarrow> y \<in> B)"
     by fast
 qed
 
 lemma continuous_on_inv_into:
   fixes f :: "'a::topological_space \<Rightarrow> 'b::t2_space"
   assumes s: "continuous_on s f" "compact s"
     and f: "inj_on f s"
   shows "continuous_on (f ` s) (the_inv_into s f)"
   by (rule continuous_on_inv[OF s]) (auto simp: the_inv_into_f_f[OF f])
 
 lemma (in linorder_topology) compact_attains_sup:
   assumes "compact S" "S \<noteq> {}"
   shows "\<exists>s\<in>S. \<forall>t\<in>S. t \<le> s"
 proof (rule classical)
   assume "\<not> (\<exists>s\<in>S. \<forall>t\<in>S. t \<le> s)"
   then obtain t where t: "\<forall>s\<in>S. t s \<in> S" and "\<forall>s\<in>S. s < t s"
     by (metis not_le)
   then have "\<And>s. s\<in>S \<Longrightarrow> open {..< t s}" "S \<subseteq> (\<Union>s\<in>S. {..< t s})"
     by auto
   with \<open>compact S\<close> obtain C where "C \<subseteq> S" "finite C" and C: "S \<subseteq> (\<Union>s\<in>C. {..< t s})"
     by (metis compactE_image)
   with \<open>S \<noteq> {}\<close> have Max: "Max (t`C) \<in> t`C" and "\<forall>s\<in>t`C. s \<le> Max (t`C)"
     by (auto intro!: Max_in)
   with C have "S \<subseteq> {..< Max (t`C)}"
     by (auto intro: less_le_trans simp: subset_eq)
   with t Max \<open>C \<subseteq> S\<close> show ?thesis
     by fastforce
 qed
 
 lemma (in linorder_topology) compact_attains_inf:
   assumes "compact S" "S \<noteq> {}"
   shows "\<exists>s\<in>S. \<forall>t\<in>S. s \<le> t"
 proof (rule classical)
   assume "\<not> (\<exists>s\<in>S. \<forall>t\<in>S. s \<le> t)"
   then obtain t where t: "\<forall>s\<in>S. t s \<in> S" and "\<forall>s\<in>S. t s < s"
     by (metis not_le)
   then have "\<And>s. s\<in>S \<Longrightarrow> open {t s <..}" "S \<subseteq> (\<Union>s\<in>S. {t s <..})"
     by auto
   with \<open>compact S\<close> obtain C where "C \<subseteq> S" "finite C" and C: "S \<subseteq> (\<Union>s\<in>C. {t s <..})"
     by (metis compactE_image)
   with \<open>S \<noteq> {}\<close> have Min: "Min (t`C) \<in> t`C" and "\<forall>s\<in>t`C. Min (t`C) \<le> s"
     by (auto intro!: Min_in)
   with C have "S \<subseteq> {Min (t`C) <..}"
     by (auto intro: le_less_trans simp: subset_eq)
   with t Min \<open>C \<subseteq> S\<close> show ?thesis
     by fastforce
 qed
 
 lemma continuous_attains_sup:
   fixes f :: "'a::topological_space \<Rightarrow> 'b::linorder_topology"
   shows "compact s \<Longrightarrow> s \<noteq> {} \<Longrightarrow> continuous_on s f \<Longrightarrow> (\<exists>x\<in>s. \<forall>y\<in>s.  f y \<le> f x)"
   using compact_attains_sup[of "f ` s"] compact_continuous_image[of s f] by auto
 
 lemma continuous_attains_inf:
   fixes f :: "'a::topological_space \<Rightarrow> 'b::linorder_topology"
   shows "compact s \<Longrightarrow> s \<noteq> {} \<Longrightarrow> continuous_on s f \<Longrightarrow> (\<exists>x\<in>s. \<forall>y\<in>s. f x \<le> f y)"
   using compact_attains_inf[of "f ` s"] compact_continuous_image[of s f] by auto
 
 
 subsection \<open>Connectedness\<close>
 
 context topological_space
 begin
 
 definition "connected S \<longleftrightarrow>
   \<not> (\<exists>A B. open A \<and> open B \<and> S \<subseteq> A \<union> B \<and> A \<inter> B \<inter> S = {} \<and> A \<inter> S \<noteq> {} \<and> B \<inter> S \<noteq> {})"
 
 lemma connectedI:
   "(\<And>A B. open A \<Longrightarrow> open B \<Longrightarrow> A \<inter> U \<noteq> {} \<Longrightarrow> B \<inter> U \<noteq> {} \<Longrightarrow> A \<inter> B \<inter> U = {} \<Longrightarrow> U \<subseteq> A \<union> B \<Longrightarrow> False)
   \<Longrightarrow> connected U"
   by (auto simp: connected_def)
 
 lemma connected_empty [simp]: "connected {}"
   by (auto intro!: connectedI)
 
 lemma connected_sing [simp]: "connected {x}"
   by (auto intro!: connectedI)
 
 lemma connectedD:
   "connected A \<Longrightarrow> open U \<Longrightarrow> open V \<Longrightarrow> U \<inter> V \<inter> A = {} \<Longrightarrow> A \<subseteq> U \<union> V \<Longrightarrow> U \<inter> A = {} \<or> V \<inter> A = {}"
   by (auto simp: connected_def)
 
 end
 
 lemma connected_closed:
   "connected s \<longleftrightarrow>
     \<not> (\<exists>A B. closed A \<and> closed B \<and> s \<subseteq> A \<union> B \<and> A \<inter> B \<inter> s = {} \<and> A \<inter> s \<noteq> {} \<and> B \<inter> s \<noteq> {})"
   apply (simp add: connected_def del: ex_simps, safe)
    apply (drule_tac x="-A" in spec)
    apply (drule_tac x="-B" in spec)
    apply (fastforce simp add: closed_def [symmetric])
   apply (drule_tac x="-A" in spec)
   apply (drule_tac x="-B" in spec)
   apply (fastforce simp add: open_closed [symmetric])
   done
 
 lemma connected_closedD:
   "\<lbrakk>connected s; A \<inter> B \<inter> s = {}; s \<subseteq> A \<union> B; closed A; closed B\<rbrakk> \<Longrightarrow> A \<inter> s = {} \<or> B \<inter> s = {}"
   by (simp add: connected_closed)
 
 lemma connected_Union:
   assumes cs: "\<And>s. s \<in> S \<Longrightarrow> connected s"
     and ne: "\<Inter>S \<noteq> {}"
   shows "connected(\<Union>S)"
 proof (rule connectedI)
   fix A B
   assume A: "open A" and B: "open B" and Alap: "A \<inter> \<Union>S \<noteq> {}" and Blap: "B \<inter> \<Union>S \<noteq> {}"
     and disj: "A \<inter> B \<inter> \<Union>S = {}" and cover: "\<Union>S \<subseteq> A \<union> B"
   have disjs:"\<And>s. s \<in> S \<Longrightarrow> A \<inter> B \<inter> s = {}"
     using disj by auto
   obtain sa where sa: "sa \<in> S" "A \<inter> sa \<noteq> {}"
     using Alap by auto
   obtain sb where sb: "sb \<in> S" "B \<inter> sb \<noteq> {}"
     using Blap by auto
   obtain x where x: "\<And>s. s \<in> S \<Longrightarrow> x \<in> s"
     using ne by auto
   then have "x \<in> \<Union>S"
     using \<open>sa \<in> S\<close> by blast
   then have "x \<in> A \<or> x \<in> B"
     using cover by auto
   then show False
     using cs [unfolded connected_def]
     by (metis A B IntI Sup_upper sa sb disjs x cover empty_iff subset_trans)
 qed
 
 lemma connected_Un: "connected s \<Longrightarrow> connected t \<Longrightarrow> s \<inter> t \<noteq> {} \<Longrightarrow> connected (s \<union> t)"
   using connected_Union [of "{s,t}"] by auto
 
 lemma connected_diff_open_from_closed:
   assumes st: "s \<subseteq> t"
     and tu: "t \<subseteq> u"
     and s: "open s"
     and t: "closed t"
     and u: "connected u"
     and ts: "connected (t - s)"
   shows "connected(u - s)"
 proof (rule connectedI)
   fix A B
   assume AB: "open A" "open B" "A \<inter> (u - s) \<noteq> {}" "B \<inter> (u - s) \<noteq> {}"
     and disj: "A \<inter> B \<inter> (u - s) = {}"
     and cover: "u - s \<subseteq> A \<union> B"
   then consider "A \<inter> (t - s) = {}" | "B \<inter> (t - s) = {}"
     using st ts tu connectedD [of "t-s" "A" "B"] by auto
   then show False
   proof cases
     case 1
     then have "(A - t) \<inter> (B \<union> s) \<inter> u = {}"
       using disj st by auto
     moreover have "u \<subseteq> (A - t) \<union> (B \<union> s)"
       using 1 cover by auto
     ultimately show False
       using connectedD [of u "A - t" "B \<union> s"] AB s t 1 u by auto
   next
     case 2
     then have "(A \<union> s) \<inter> (B - t) \<inter> u = {}"
       using disj st by auto
     moreover have "u \<subseteq> (A \<union> s) \<union> (B - t)"
       using 2 cover by auto
     ultimately show False
       using connectedD [of u "A \<union> s" "B - t"] AB s t 2 u by auto
   qed
 qed
 
 lemma connected_iff_const:
   fixes S :: "'a::topological_space set"
   shows "connected S \<longleftrightarrow> (\<forall>P::'a \<Rightarrow> bool. continuous_on S P \<longrightarrow> (\<exists>c. \<forall>s\<in>S. P s = c))"
 proof safe
   fix P :: "'a \<Rightarrow> bool"
   assume "connected S" "continuous_on S P"
   then have "\<And>b. \<exists>A. open A \<and> A \<inter> S = P -` {b} \<inter> S"
     unfolding continuous_on_open_invariant by (simp add: open_discrete)
   from this[of True] this[of False]
   obtain t f where "open t" "open f" and *: "f \<inter> S = P -` {False} \<inter> S" "t \<inter> S = P -` {True} \<inter> S"
     by meson
   then have "t \<inter> S = {} \<or> f \<inter> S = {}"
     by (intro connectedD[OF \<open>connected S\<close>])  auto
   then show "\<exists>c. \<forall>s\<in>S. P s = c"
   proof (rule disjE)
     assume "t \<inter> S = {}"
     then show ?thesis
       unfolding * by (intro exI[of _ False]) auto
   next
     assume "f \<inter> S = {}"
     then show ?thesis
       unfolding * by (intro exI[of _ True]) auto
   qed
 next
   assume P: "\<forall>P::'a \<Rightarrow> bool. continuous_on S P \<longrightarrow> (\<exists>c. \<forall>s\<in>S. P s = c)"
   show "connected S"
   proof (rule connectedI)
     fix A B
     assume *: "open A" "open B" "A \<inter> S \<noteq> {}" "B \<inter> S \<noteq> {}" "A \<inter> B \<inter> S = {}" "S \<subseteq> A \<union> B"
     have "continuous_on S (\<lambda>x. x \<in> A)"
       unfolding continuous_on_open_invariant
     proof safe
       fix C :: "bool set"
       have "C = UNIV \<or> C = {True} \<or> C = {False} \<or> C = {}"
         using subset_UNIV[of C] unfolding UNIV_bool by auto
       with * show "\<exists>T. open T \<and> T \<inter> S = (\<lambda>x. x \<in> A) -` C \<inter> S"
         by (intro exI[of _ "(if True \<in> C then A else {}) \<union> (if False \<in> C then B else {})"]) auto
     qed
     from P[rule_format, OF this] obtain c where "\<And>s. s \<in> S \<Longrightarrow> (s \<in> A) = c"
       by blast
     with * show False
       by (cases c) auto
   qed
 qed
 
 lemma connectedD_const: "connected S \<Longrightarrow> continuous_on S P \<Longrightarrow> \<exists>c. \<forall>s\<in>S. P s = c"
   for P :: "'a::topological_space \<Rightarrow> bool"
   by (auto simp: connected_iff_const)
 
 lemma connectedI_const:
   "(\<And>P::'a::topological_space \<Rightarrow> bool. continuous_on S P \<Longrightarrow> \<exists>c. \<forall>s\<in>S. P s = c) \<Longrightarrow> connected S"
   by (auto simp: connected_iff_const)
 
 lemma connected_local_const:
   assumes "connected A" "a \<in> A" "b \<in> A"
     and *: "\<forall>a\<in>A. eventually (\<lambda>b. f a = f b) (at a within A)"
   shows "f a = f b"
 proof -
   obtain S where S: "\<And>a. a \<in> A \<Longrightarrow> a \<in> S a" "\<And>a. a \<in> A \<Longrightarrow> open (S a)"
     "\<And>a x. a \<in> A \<Longrightarrow> x \<in> S a \<Longrightarrow> x \<in> A \<Longrightarrow> f a = f x"
     using * unfolding eventually_at_topological by metis
   let ?P = "\<Union>b\<in>{b\<in>A. f a = f b}. S b" and ?N = "\<Union>b\<in>{b\<in>A. f a \<noteq> f b}. S b"
   have "?P \<inter> A = {} \<or> ?N \<inter> A = {}"
     using \<open>connected A\<close> S \<open>a\<in>A\<close>
     by (intro connectedD) (auto, metis)
   then show "f a = f b"
   proof
     assume "?N \<inter> A = {}"
     then have "\<forall>x\<in>A. f a = f x"
       using S(1) by auto
     with \<open>b\<in>A\<close> show ?thesis by auto
   next
     assume "?P \<inter> A = {}" then show ?thesis
       using \<open>a \<in> A\<close> S(1)[of a] by auto
   qed
 qed
 
 lemma (in linorder_topology) connectedD_interval:
   assumes "connected U"
     and xy: "x \<in> U" "y \<in> U"
     and "x \<le> z" "z \<le> y"
   shows "z \<in> U"
 proof -
   have eq: "{..<z} \<union> {z<..} = - {z}"
     by auto
   have "\<not> connected U" if "z \<notin> U" "x < z" "z < y"
     using xy that
     apply (simp only: connected_def simp_thms)
     apply (rule_tac exI[of _ "{..< z}"])
     apply (rule_tac exI[of _ "{z <..}"])
     apply (auto simp add: eq)
     done
   with assms show "z \<in> U"
     by (metis less_le)
 qed
 
 lemma (in linorder_topology) not_in_connected_cases:
   assumes conn: "connected S"
   assumes nbdd: "x \<notin> S"
   assumes ne: "S \<noteq> {}"
   obtains "bdd_above S" "\<And>y. y \<in> S \<Longrightarrow> x \<ge> y" | "bdd_below S" "\<And>y. y \<in> S \<Longrightarrow> x \<le> y"
 proof -
   obtain s where "s \<in> S" using ne by blast
   {
     assume "s \<le> x"
     have "False" if "x \<le> y" "y \<in> S" for y
       using connectedD_interval[OF conn \<open>s \<in> S\<close> \<open>y \<in> S\<close> \<open>s \<le> x\<close> \<open>x \<le> y\<close>] \<open>x \<notin> S\<close>
       by simp
     then have wit: "y \<in> S \<Longrightarrow> x \<ge> y" for y
       using le_cases by blast
     then have "bdd_above S"
       by (rule local.bdd_aboveI)
     note this wit
   } moreover {
     assume "x \<le> s"
     have "False" if "x \<ge> y" "y \<in> S" for y
       using connectedD_interval[OF conn \<open>y \<in> S\<close> \<open>s \<in> S\<close> \<open>x \<ge> y\<close> \<open>s \<ge> x\<close> ] \<open>x \<notin> S\<close>
       by simp
     then have wit: "y \<in> S \<Longrightarrow> x \<le> y" for y
       using le_cases by blast
     then have "bdd_below S"
       by (rule bdd_belowI)
     note this wit
   } ultimately show ?thesis
     by (meson le_cases that)
 qed
 
 lemma connected_continuous_image:
   assumes *: "continuous_on s f"
     and "connected s"
   shows "connected (f ` s)"
 proof (rule connectedI_const)
   fix P :: "'b \<Rightarrow> bool"
   assume "continuous_on (f ` s) P"
   then have "continuous_on s (P \<circ> f)"
     by (rule continuous_on_compose[OF *])
   from connectedD_const[OF \<open>connected s\<close> this] show "\<exists>c. \<forall>s\<in>f ` s. P s = c"
     by auto
 qed
 
 
 section \<open>Linear Continuum Topologies\<close>
 
 class linear_continuum_topology = linorder_topology + linear_continuum
 begin
 
 lemma Inf_notin_open:
   assumes A: "open A"
     and bnd: "\<forall>a\<in>A. x < a"
   shows "Inf A \<notin> A"
 proof
   assume "Inf A \<in> A"
   then obtain b where "b < Inf A" "{b <.. Inf A} \<subseteq> A"
     using open_left[of A "Inf A" x] assms by auto
   with dense[of b "Inf A"] obtain c where "c < Inf A" "c \<in> A"
     by (auto simp: subset_eq)
   then show False
     using cInf_lower[OF \<open>c \<in> A\<close>] bnd
     by (metis not_le less_imp_le bdd_belowI)
 qed
 
 lemma Sup_notin_open:
   assumes A: "open A"
     and bnd: "\<forall>a\<in>A. a < x"
   shows "Sup A \<notin> A"
 proof
   assume "Sup A \<in> A"
   with assms obtain b where "Sup A < b" "{Sup A ..< b} \<subseteq> A"
     using open_right[of A "Sup A" x] by auto
   with dense[of "Sup A" b] obtain c where "Sup A < c" "c \<in> A"
     by (auto simp: subset_eq)
   then show False
     using cSup_upper[OF \<open>c \<in> A\<close>] bnd
     by (metis less_imp_le not_le bdd_aboveI)
 qed
 
 end
 
 instance linear_continuum_topology \<subseteq> perfect_space
 proof
   fix x :: 'a
   obtain y where "x < y \<or> y < x"
     using ex_gt_or_lt [of x] ..
   with Inf_notin_open[of "{x}" y] Sup_notin_open[of "{x}" y] show "\<not> open {x}"
     by auto
 qed
 
 lemma connectedI_interval:
   fixes U :: "'a :: linear_continuum_topology set"
   assumes *: "\<And>x y z. x \<in> U \<Longrightarrow> y \<in> U \<Longrightarrow> x \<le> z \<Longrightarrow> z \<le> y \<Longrightarrow> z \<in> U"
   shows "connected U"
 proof (rule connectedI)
   {
     fix A B
     assume "open A" "open B" "A \<inter> B \<inter> U = {}" "U \<subseteq> A \<union> B"
     fix x y
     assume "x < y" "x \<in> A" "y \<in> B" "x \<in> U" "y \<in> U"
 
     let ?z = "Inf (B \<inter> {x <..})"
 
     have "x \<le> ?z" "?z \<le> y"
       using \<open>y \<in> B\<close> \<open>x < y\<close> by (auto intro: cInf_lower cInf_greatest)
     with \<open>x \<in> U\<close> \<open>y \<in> U\<close> have "?z \<in> U"
       by (rule *)
     moreover have "?z \<notin> B \<inter> {x <..}"
       using \<open>open B\<close> by (intro Inf_notin_open) auto
     ultimately have "?z \<in> A"
       using \<open>x \<le> ?z\<close> \<open>A \<inter> B \<inter> U = {}\<close> \<open>x \<in> A\<close> \<open>U \<subseteq> A \<union> B\<close> by auto
     have "\<exists>b\<in>B. b \<in> A \<and> b \<in> U" if "?z < y"
     proof -
       obtain a where "?z < a" "{?z ..< a} \<subseteq> A"
         using open_right[OF \<open>open A\<close> \<open>?z \<in> A\<close> \<open>?z < y\<close>] by auto
       moreover obtain b where "b \<in> B" "x < b" "b < min a y"
         using cInf_less_iff[of "B \<inter> {x <..}" "min a y"] \<open>?z < a\<close> \<open>?z < y\<close> \<open>x < y\<close> \<open>y \<in> B\<close>
         by auto
       moreover have "?z \<le> b"
         using \<open>b \<in> B\<close> \<open>x < b\<close>
         by (intro cInf_lower) auto
       moreover have "b \<in> U"
         using \<open>x \<le> ?z\<close> \<open>?z \<le> b\<close> \<open>b < min a y\<close>
         by (intro *[OF \<open>x \<in> U\<close> \<open>y \<in> U\<close>]) (auto simp: less_imp_le)
       ultimately show ?thesis
         by (intro bexI[of _ b]) auto
     qed
     then have False
       using \<open>?z \<le> y\<close> \<open>?z \<in> A\<close> \<open>y \<in> B\<close> \<open>y \<in> U\<close> \<open>A \<inter> B \<inter> U = {}\<close>
       unfolding le_less by blast
   }
   note not_disjoint = this
 
   fix A B assume AB: "open A" "open B" "U \<subseteq> A \<union> B" "A \<inter> B \<inter> U = {}"
   moreover assume "A \<inter> U \<noteq> {}" then obtain x where x: "x \<in> U" "x \<in> A" by auto
   moreover assume "B \<inter> U \<noteq> {}" then obtain y where y: "y \<in> U" "y \<in> B" by auto
   moreover note not_disjoint[of B A y x] not_disjoint[of A B x y]
   ultimately show False
     by (cases x y rule: linorder_cases) auto
 qed
 
 lemma connected_iff_interval: "connected U \<longleftrightarrow> (\<forall>x\<in>U. \<forall>y\<in>U. \<forall>z. x \<le> z \<longrightarrow> z \<le> y \<longrightarrow> z \<in> U)"
   for U :: "'a::linear_continuum_topology set"
   by (auto intro: connectedI_interval dest: connectedD_interval)
 
 lemma connected_UNIV[simp]: "connected (UNIV::'a::linear_continuum_topology set)"
   by (simp add: connected_iff_interval)
 
 lemma connected_Ioi[simp]: "connected {a<..}"
   for a :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_Ici[simp]: "connected {a..}"
   for a :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_Iio[simp]: "connected {..<a}"
   for a :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_Iic[simp]: "connected {..a}"
   for a :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_Ioo[simp]: "connected {a<..<b}"
   for a b :: "'a::linear_continuum_topology"
   unfolding connected_iff_interval by auto
 
 lemma connected_Ioc[simp]: "connected {a<..b}"
   for a b :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_Ico[simp]: "connected {a..<b}"
   for a b :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_Icc[simp]: "connected {a..b}"
   for a b :: "'a::linear_continuum_topology"
   by (auto simp: connected_iff_interval)
 
 lemma connected_contains_Ioo:
   fixes A :: "'a :: linorder_topology set"
   assumes "connected A" "a \<in> A" "b \<in> A" shows "{a <..< b} \<subseteq> A"
   using connectedD_interval[OF assms] by (simp add: subset_eq Ball_def less_imp_le)
 
 lemma connected_contains_Icc:
   fixes A :: "'a::linorder_topology set"
   assumes "connected A" "a \<in> A" "b \<in> A"
   shows "{a..b} \<subseteq> A"
 proof
   fix x assume "x \<in> {a..b}"
   then have "x = a \<or> x = b \<or> x \<in> {a<..<b}"
     by auto
   then show "x \<in> A"
     using assms connected_contains_Ioo[of A a b] by auto
 qed
 
 
 subsection \<open>Intermediate Value Theorem\<close>
 
 lemma IVT':
   fixes f :: "'a::linear_continuum_topology \<Rightarrow> 'b::linorder_topology"
   assumes y: "f a \<le> y" "y \<le> f b" "a \<le> b"
     and *: "continuous_on {a .. b} f"
   shows "\<exists>x. a \<le> x \<and> x \<le> b \<and> f x = y"
 proof -
   have "connected {a..b}"
     unfolding connected_iff_interval by auto
   from connected_continuous_image[OF * this, THEN connectedD_interval, of "f a" "f b" y] y
   show ?thesis
     by (auto simp add: atLeastAtMost_def atLeast_def atMost_def)
 qed
 
 lemma IVT2':
   fixes f :: "'a :: linear_continuum_topology \<Rightarrow> 'b :: linorder_topology"
   assumes y: "f b \<le> y" "y \<le> f a" "a \<le> b"
     and *: "continuous_on {a .. b} f"
   shows "\<exists>x. a \<le> x \<and> x \<le> b \<and> f x = y"
 proof -
   have "connected {a..b}"
     unfolding connected_iff_interval by auto
   from connected_continuous_image[OF * this, THEN connectedD_interval, of "f b" "f a" y] y
   show ?thesis
     by (auto simp add: atLeastAtMost_def atLeast_def atMost_def)
 qed
 
 lemma IVT:
   fixes f :: "'a::linear_continuum_topology \<Rightarrow> 'b::linorder_topology"
   shows "f a \<le> y \<Longrightarrow> y \<le> f b \<Longrightarrow> a \<le> b \<Longrightarrow> (\<forall>x. a \<le> x \<and> x \<le> b \<longrightarrow> isCont f x) \<Longrightarrow>
     \<exists>x. a \<le> x \<and> x \<le> b \<and> f x = y"
   by (rule IVT') (auto intro: continuous_at_imp_continuous_on)
 
 lemma IVT2:
   fixes f :: "'a::linear_continuum_topology \<Rightarrow> 'b::linorder_topology"
   shows "f b \<le> y \<Longrightarrow> y \<le> f a \<Longrightarrow> a \<le> b \<Longrightarrow> (\<forall>x. a \<le> x \<and> x \<le> b \<longrightarrow> isCont f x) \<Longrightarrow>
     \<exists>x. a \<le> x \<and> x \<le> b \<and> f x = y"
   by (rule IVT2') (auto intro: continuous_at_imp_continuous_on)
 
 lemma continuous_inj_imp_mono:
   fixes f :: "'a::linear_continuum_topology \<Rightarrow> 'b::linorder_topology"
   assumes x: "a < x" "x < b"
     and cont: "continuous_on {a..b} f"
     and inj: "inj_on f {a..b}"
   shows "(f a < f x \<and> f x < f b) \<or> (f b < f x \<and> f x < f a)"
 proof -
   note I = inj_on_eq_iff[OF inj]
   {
     assume "f x < f a" "f x < f b"
     then obtain s t where "x \<le> s" "s \<le> b" "a \<le> t" "t \<le> x" "f s = f t" "f x < f s"
       using IVT'[of f x "min (f a) (f b)" b] IVT2'[of f x "min (f a) (f b)" a] x
       by (auto simp: continuous_on_subset[OF cont] less_imp_le)
     with x I have False by auto
   }
   moreover
   {
     assume "f a < f x" "f b < f x"
     then obtain s t where "x \<le> s" "s \<le> b" "a \<le> t" "t \<le> x" "f s = f t" "f s < f x"
       using IVT'[of f a "max (f a) (f b)" x] IVT2'[of f b "max (f a) (f b)" x] x
       by (auto simp: continuous_on_subset[OF cont] less_imp_le)
     with x I have False by auto
   }
   ultimately show ?thesis
     using I[of a x] I[of x b] x less_trans[OF x]
     by (auto simp add: le_less less_imp_neq neq_iff)
 qed
 
 lemma continuous_at_Sup_mono:
   fixes f :: "'a::{linorder_topology,conditionally_complete_linorder} \<Rightarrow>
     'b::{linorder_topology,conditionally_complete_linorder}"
   assumes "mono f"
     and cont: "continuous (at_left (Sup S)) f"
     and S: "S \<noteq> {}" "bdd_above S"
   shows "f (Sup S) = (SUP s\<in>S. f s)"
 proof (rule antisym)
   have f: "(f \<longlongrightarrow> f (Sup S)) (at_left (Sup S))"
     using cont unfolding continuous_within .
   show "f (Sup S) \<le> (SUP s\<in>S. f s)"
   proof cases
     assume "Sup S \<in> S"
     then show ?thesis
       by (rule cSUP_upper) (auto intro: bdd_above_image_mono S \<open>mono f\<close>)
   next
     assume "Sup S \<notin> S"
     from \<open>S \<noteq> {}\<close> obtain s where "s \<in> S"
       by auto
     with \<open>Sup S \<notin> S\<close> S have "s < Sup S"
       unfolding less_le by (blast intro: cSup_upper)
     show ?thesis
     proof (rule ccontr)
       assume "\<not> ?thesis"
       with order_tendstoD(1)[OF f, of "SUP s\<in>S. f s"] obtain b where "b < Sup S"
         and *: "\<And>y. b < y \<Longrightarrow> y < Sup S \<Longrightarrow> (SUP s\<in>S. f s) < f y"
         by (auto simp: not_le eventually_at_left[OF \<open>s < Sup S\<close>])
       with \<open>S \<noteq> {}\<close> obtain c where "c \<in> S" "b < c"
         using less_cSupD[of S b] by auto
       with \<open>Sup S \<notin> S\<close> S have "c < Sup S"
         unfolding less_le by (blast intro: cSup_upper)
       from *[OF \<open>b < c\<close> \<open>c < Sup S\<close>] cSUP_upper[OF \<open>c \<in> S\<close> bdd_above_image_mono[of f]]
       show False
         by (auto simp: assms)
     qed
   qed
 qed (intro cSUP_least \<open>mono f\<close>[THEN monoD] cSup_upper S)
 
 lemma continuous_at_Sup_antimono:
   fixes f :: "'a::{linorder_topology,conditionally_complete_linorder} \<Rightarrow>
     'b::{linorder_topology,conditionally_complete_linorder}"
   assumes "antimono f"
     and cont: "continuous (at_left (Sup S)) f"
     and S: "S \<noteq> {}" "bdd_above S"
   shows "f (Sup S) = (INF s\<in>S. f s)"
 proof (rule antisym)
   have f: "(f \<longlongrightarrow> f (Sup S)) (at_left (Sup S))"
     using cont unfolding continuous_within .
   show "(INF s\<in>S. f s) \<le> f (Sup S)"
   proof cases
     assume "Sup S \<in> S"
     then show ?thesis
       by (intro cINF_lower) (auto intro: bdd_below_image_antimono S \<open>antimono f\<close>)
   next
     assume "Sup S \<notin> S"
     from \<open>S \<noteq> {}\<close> obtain s where "s \<in> S"
       by auto
     with \<open>Sup S \<notin> S\<close> S have "s < Sup S"
       unfolding less_le by (blast intro: cSup_upper)
     show ?thesis
     proof (rule ccontr)
       assume "\<not> ?thesis"
       with order_tendstoD(2)[OF f, of "INF s\<in>S. f s"] obtain b where "b < Sup S"
         and *: "\<And>y. b < y \<Longrightarrow> y < Sup S \<Longrightarrow> f y < (INF s\<in>S. f s)"
         by (auto simp: not_le eventually_at_left[OF \<open>s < Sup S\<close>])
       with \<open>S \<noteq> {}\<close> obtain c where "c \<in> S" "b < c"
         using less_cSupD[of S b] by auto
       with \<open>Sup S \<notin> S\<close> S have "c < Sup S"
         unfolding less_le by (blast intro: cSup_upper)
       from *[OF \<open>b < c\<close> \<open>c < Sup S\<close>] cINF_lower[OF bdd_below_image_antimono, of f S c] \<open>c \<in> S\<close>
       show False
         by (auto simp: assms)
     qed
   qed
 qed (intro cINF_greatest \<open>antimono f\<close>[THEN antimonoD] cSup_upper S)
 
 lemma continuous_at_Inf_mono:
   fixes f :: "'a::{linorder_topology,conditionally_complete_linorder} \<Rightarrow>
     'b::{linorder_topology,conditionally_complete_linorder}"
   assumes "mono f"
     and cont: "continuous (at_right (Inf S)) f"
     and S: "S \<noteq> {}" "bdd_below S"
   shows "f (Inf S) = (INF s\<in>S. f s)"
 proof (rule antisym)
   have f: "(f \<longlongrightarrow> f (Inf S)) (at_right (Inf S))"
     using cont unfolding continuous_within .
   show "(INF s\<in>S. f s) \<le> f (Inf S)"
   proof cases
     assume "Inf S \<in> S"
     then show ?thesis
       by (rule cINF_lower[rotated]) (auto intro: bdd_below_image_mono S \<open>mono f\<close>)
   next
     assume "Inf S \<notin> S"
     from \<open>S \<noteq> {}\<close> obtain s where "s \<in> S"
       by auto
     with \<open>Inf S \<notin> S\<close> S have "Inf S < s"
       unfolding less_le by (blast intro: cInf_lower)
     show ?thesis
     proof (rule ccontr)
       assume "\<not> ?thesis"
       with order_tendstoD(2)[OF f, of "INF s\<in>S. f s"] obtain b where "Inf S < b"
         and *: "\<And>y. Inf S < y \<Longrightarrow> y < b \<Longrightarrow> f y < (INF s\<in>S. f s)"
         by (auto simp: not_le eventually_at_right[OF \<open>Inf S < s\<close>])
       with \<open>S \<noteq> {}\<close> obtain c where "c \<in> S" "c < b"
         using cInf_lessD[of S b] by auto
       with \<open>Inf S \<notin> S\<close> S have "Inf S < c"
         unfolding less_le by (blast intro: cInf_lower)
       from *[OF \<open>Inf S < c\<close> \<open>c < b\<close>] cINF_lower[OF bdd_below_image_mono[of f] \<open>c \<in> S\<close>]
       show False
         by (auto simp: assms)
     qed
   qed
 qed (intro cINF_greatest \<open>mono f\<close>[THEN monoD] cInf_lower \<open>bdd_below S\<close> \<open>S \<noteq> {}\<close>)
 
 lemma continuous_at_Inf_antimono:
   fixes f :: "'a::{linorder_topology,conditionally_complete_linorder} \<Rightarrow>
     'b::{linorder_topology,conditionally_complete_linorder}"
   assumes "antimono f"
     and cont: "continuous (at_right (Inf S)) f"
     and S: "S \<noteq> {}" "bdd_below S"
   shows "f (Inf S) = (SUP s\<in>S. f s)"
 proof (rule antisym)
   have f: "(f \<longlongrightarrow> f (Inf S)) (at_right (Inf S))"
     using cont unfolding continuous_within .
   show "f (Inf S) \<le> (SUP s\<in>S. f s)"
   proof cases
     assume "Inf S \<in> S"
     then show ?thesis
       by (rule cSUP_upper) (auto intro: bdd_above_image_antimono S \<open>antimono f\<close>)
   next
     assume "Inf S \<notin> S"
     from \<open>S \<noteq> {}\<close> obtain s where "s \<in> S"
       by auto
     with \<open>Inf S \<notin> S\<close> S have "Inf S < s"
       unfolding less_le by (blast intro: cInf_lower)
     show ?thesis
     proof (rule ccontr)
       assume "\<not> ?thesis"
       with order_tendstoD(1)[OF f, of "SUP s\<in>S. f s"] obtain b where "Inf S < b"
         and *: "\<And>y. Inf S < y \<Longrightarrow> y < b \<Longrightarrow> (SUP s\<in>S. f s) < f y"
         by (auto simp: not_le eventually_at_right[OF \<open>Inf S < s\<close>])
       with \<open>S \<noteq> {}\<close> obtain c where "c \<in> S" "c < b"
         using cInf_lessD[of S b] by auto
       with \<open>Inf S \<notin> S\<close> S have "Inf S < c"
         unfolding less_le by (blast intro: cInf_lower)
       from *[OF \<open>Inf S < c\<close> \<open>c < b\<close>] cSUP_upper[OF \<open>c \<in> S\<close> bdd_above_image_antimono[of f]]
       show False
         by (auto simp: assms)
     qed
   qed
 qed (intro cSUP_least \<open>antimono f\<close>[THEN antimonoD] cInf_lower S)
 
 
 subsection \<open>Uniform spaces\<close>
 
 class uniformity =
   fixes uniformity :: "('a \<times> 'a) filter"
 begin
 
 abbreviation uniformity_on :: "'a set \<Rightarrow> ('a \<times> 'a) filter"
   where "uniformity_on s \<equiv> inf uniformity (principal (s\<times>s))"
 
 end
 
 lemma uniformity_Abort:
   "uniformity =
     Filter.abstract_filter (\<lambda>u. Code.abort (STR ''uniformity is not executable'') (\<lambda>u. uniformity))"
   by simp
 
 class open_uniformity = "open" + uniformity +
   assumes open_uniformity:
     "\<And>U. open U \<longleftrightarrow> (\<forall>x\<in>U. eventually (\<lambda>(x', y). x' = x \<longrightarrow> y \<in> U) uniformity)"
 begin
 
 subclass topological_space
   by standard (force elim: eventually_mono eventually_elim2 simp: split_beta' open_uniformity)+
 
 end
 
 class uniform_space = open_uniformity +
   assumes uniformity_refl: "eventually E uniformity \<Longrightarrow> E (x, x)"
     and uniformity_sym: "eventually E uniformity \<Longrightarrow> eventually (\<lambda>(x, y). E (y, x)) uniformity"
     and uniformity_trans:
       "eventually E uniformity \<Longrightarrow>
         \<exists>D. eventually D uniformity \<and> (\<forall>x y z. D (x, y) \<longrightarrow> D (y, z) \<longrightarrow> E (x, z))"
 begin
 
 lemma uniformity_bot: "uniformity \<noteq> bot"
   using uniformity_refl by auto
 
 lemma uniformity_trans':
   "eventually E uniformity \<Longrightarrow>
     eventually (\<lambda>((x, y), (y', z)). y = y' \<longrightarrow> E (x, z)) (uniformity \<times>\<^sub>F uniformity)"
   by (drule uniformity_trans) (auto simp add: eventually_prod_same)
 
 lemma uniformity_transE:
   assumes "eventually E uniformity"
   obtains D where "eventually D uniformity" "\<And>x y z. D (x, y) \<Longrightarrow> D (y, z) \<Longrightarrow> E (x, z)"
   using uniformity_trans [OF assms] by auto
 
 lemma eventually_nhds_uniformity:
   "eventually P (nhds x) \<longleftrightarrow> eventually (\<lambda>(x', y). x' = x \<longrightarrow> P y) uniformity"
   (is "_ \<longleftrightarrow> ?N P x")
   unfolding eventually_nhds
 proof safe
   assume *: "?N P x"
   have "?N (?N P) x" if "?N P x" for x
   proof -
     from that obtain D where ev: "eventually D uniformity"
       and D: "D (a, b) \<Longrightarrow> D (b, c) \<Longrightarrow> case (a, c) of (x', y) \<Rightarrow> x' = x \<longrightarrow> P y" for a b c
       by (rule uniformity_transE) simp
     from ev show ?thesis
       by eventually_elim (insert ev D, force elim: eventually_mono split: prod.split)
   qed
   then have "open {x. ?N P x}"
     by (simp add: open_uniformity)
   then show "\<exists>S. open S \<and> x \<in> S \<and> (\<forall>x\<in>S. P x)"
     by (intro exI[of _ "{x. ?N P x}"]) (auto dest: uniformity_refl simp: *)
 qed (force simp add: open_uniformity elim: eventually_mono)
 
 
 subsubsection \<open>Totally bounded sets\<close>
 
 definition totally_bounded :: "'a set \<Rightarrow> bool"
   where "totally_bounded S \<longleftrightarrow>
     (\<forall>E. eventually E uniformity \<longrightarrow> (\<exists>X. finite X \<and> (\<forall>s\<in>S. \<exists>x\<in>X. E (x, s))))"
 
 lemma totally_bounded_empty[iff]: "totally_bounded {}"
   by (auto simp add: totally_bounded_def)
 
 lemma totally_bounded_subset: "totally_bounded S \<Longrightarrow> T \<subseteq> S \<Longrightarrow> totally_bounded T"
   by (fastforce simp add: totally_bounded_def)
 
 lemma totally_bounded_Union[intro]:
   assumes M: "finite M" "\<And>S. S \<in> M \<Longrightarrow> totally_bounded S"
   shows "totally_bounded (\<Union>M)"
   unfolding totally_bounded_def
 proof safe
   fix E
   assume "eventually E uniformity"
   with M obtain X where "\<forall>S\<in>M. finite (X S) \<and> (\<forall>s\<in>S. \<exists>x\<in>X S. E (x, s))"
     by (metis totally_bounded_def)
   with \<open>finite M\<close> show "\<exists>X. finite X \<and> (\<forall>s\<in>\<Union>M. \<exists>x\<in>X. E (x, s))"
     by (intro exI[of _ "\<Union>S\<in>M. X S"]) force
 qed
 
 
 subsubsection \<open>Cauchy filter\<close>
 
 definition cauchy_filter :: "'a filter \<Rightarrow> bool"
   where "cauchy_filter F \<longleftrightarrow> F \<times>\<^sub>F F \<le> uniformity"
 
 definition Cauchy :: "(nat \<Rightarrow> 'a) \<Rightarrow> bool"
   where Cauchy_uniform: "Cauchy X = cauchy_filter (filtermap X sequentially)"
 
 lemma Cauchy_uniform_iff:
   "Cauchy X \<longleftrightarrow> (\<forall>P. eventually P uniformity \<longrightarrow> (\<exists>N. \<forall>n\<ge>N. \<forall>m\<ge>N. P (X n, X m)))"
   unfolding Cauchy_uniform cauchy_filter_def le_filter_def eventually_prod_same
     eventually_filtermap eventually_sequentially
 proof safe
   let ?U = "\<lambda>P. eventually P uniformity"
   {
     fix P
     assume "?U P" "\<forall>P. ?U P \<longrightarrow> (\<exists>Q. (\<exists>N. \<forall>n\<ge>N. Q (X n)) \<and> (\<forall>x y. Q x \<longrightarrow> Q y \<longrightarrow> P (x, y)))"
     then obtain Q N where "\<And>n. n \<ge> N \<Longrightarrow> Q (X n)" "\<And>x y. Q x \<Longrightarrow> Q y \<Longrightarrow> P (x, y)"
       by metis
     then show "\<exists>N. \<forall>n\<ge>N. \<forall>m\<ge>N. P (X n, X m)"
       by blast
   next
     fix P
     assume "?U P" and P: "\<forall>P. ?U P \<longrightarrow> (\<exists>N. \<forall>n\<ge>N. \<forall>m\<ge>N. P (X n, X m))"
     then obtain Q where "?U Q" and Q: "\<And>x y z. Q (x, y) \<Longrightarrow> Q (y, z) \<Longrightarrow> P (x, z)"
       by (auto elim: uniformity_transE)
     then have "?U (\<lambda>x. Q x \<and> (\<lambda>(x, y). Q (y, x)) x)"
       unfolding eventually_conj_iff by (simp add: uniformity_sym)
     from P[rule_format, OF this]
     obtain N where N: "\<And>n m. n \<ge> N \<Longrightarrow> m \<ge> N \<Longrightarrow> Q (X n, X m) \<and> Q (X m, X n)"
       by auto
     show "\<exists>Q. (\<exists>N. \<forall>n\<ge>N. Q (X n)) \<and> (\<forall>x y. Q x \<longrightarrow> Q y \<longrightarrow> P (x, y))"
     proof (safe intro!: exI[of _ "\<lambda>x. \<forall>n\<ge>N. Q (x, X n) \<and> Q (X n, x)"] exI[of _ N] N)
       fix x y
       assume "\<forall>n\<ge>N. Q (x, X n) \<and> Q (X n, x)" "\<forall>n\<ge>N. Q (y, X n) \<and> Q (X n, y)"
       then have "Q (x, X N)" "Q (X N, y)" by auto
       then show "P (x, y)"
         by (rule Q)
     qed
   }
 qed
 
 lemma nhds_imp_cauchy_filter:
   assumes *: "F \<le> nhds x"
   shows "cauchy_filter F"
 proof -
   have "F \<times>\<^sub>F F \<le> nhds x \<times>\<^sub>F nhds x"
     by (intro prod_filter_mono *)
   also have "\<dots> \<le> uniformity"
     unfolding le_filter_def eventually_nhds_uniformity eventually_prod_same
   proof safe
     fix P
     assume "eventually P uniformity"
     then obtain Ql where ev: "eventually Ql uniformity"
       and "Ql (x, y) \<Longrightarrow> Ql (y, z) \<Longrightarrow> P (x, z)" for x y z
       by (rule uniformity_transE) simp
     with ev[THEN uniformity_sym]
     show "\<exists>Q. eventually (\<lambda>(x', y). x' = x \<longrightarrow> Q y) uniformity \<and>
         (\<forall>x y. Q x \<longrightarrow> Q y \<longrightarrow> P (x, y))"
       by (rule_tac exI[of _ "\<lambda>y. Ql (y, x) \<and> Ql (x, y)"]) (fastforce elim: eventually_elim2)
   qed
   finally show ?thesis
     by (simp add: cauchy_filter_def)
 qed
 
 lemma LIMSEQ_imp_Cauchy: "X \<longlonglongrightarrow> x \<Longrightarrow> Cauchy X"
   unfolding Cauchy_uniform filterlim_def by (intro nhds_imp_cauchy_filter)
 
 lemma Cauchy_subseq_Cauchy:
   assumes "Cauchy X" "strict_mono f"
   shows "Cauchy (X \<circ> f)"
   unfolding Cauchy_uniform comp_def filtermap_filtermap[symmetric] cauchy_filter_def
   by (rule order_trans[OF _ \<open>Cauchy X\<close>[unfolded Cauchy_uniform cauchy_filter_def]])
      (intro prod_filter_mono filtermap_mono filterlim_subseq[OF \<open>strict_mono f\<close>, unfolded filterlim_def])
 
 lemma convergent_Cauchy: "convergent X \<Longrightarrow> Cauchy X"
   unfolding convergent_def by (erule exE, erule LIMSEQ_imp_Cauchy)
 
 definition complete :: "'a set \<Rightarrow> bool"
   where complete_uniform: "complete S \<longleftrightarrow>
     (\<forall>F \<le> principal S. F \<noteq> bot \<longrightarrow> cauchy_filter F \<longrightarrow> (\<exists>x\<in>S. F \<le> nhds x))"
 
+lemma (in uniform_space) cauchy_filter_complete_converges:
+  assumes "cauchy_filter F" "complete A" "F \<le> principal A" "F \<noteq> bot"
+  shows   "\<exists>c. F \<le> nhds c"
+  using assms unfolding complete_uniform by blast
+
 end
 
 subsubsection \<open>Uniformly continuous functions\<close>
 
 definition uniformly_continuous_on :: "'a set \<Rightarrow> ('a::uniform_space \<Rightarrow> 'b::uniform_space) \<Rightarrow> bool"
   where uniformly_continuous_on_uniformity: "uniformly_continuous_on s f \<longleftrightarrow>
     (LIM (x, y) (uniformity_on s). (f x, f y) :> uniformity)"
 
 lemma uniformly_continuous_onD:
   "uniformly_continuous_on s f \<Longrightarrow> eventually E uniformity \<Longrightarrow>
     eventually (\<lambda>(x, y). x \<in> s \<longrightarrow> y \<in> s \<longrightarrow> E (f x, f y)) uniformity"
   by (simp add: uniformly_continuous_on_uniformity filterlim_iff
       eventually_inf_principal split_beta' mem_Times_iff imp_conjL)
 
 lemma uniformly_continuous_on_const[continuous_intros]: "uniformly_continuous_on s (\<lambda>x. c)"
   by (auto simp: uniformly_continuous_on_uniformity filterlim_iff uniformity_refl)
 
 lemma uniformly_continuous_on_id[continuous_intros]: "uniformly_continuous_on s (\<lambda>x. x)"
   by (auto simp: uniformly_continuous_on_uniformity filterlim_def)
 
 lemma uniformly_continuous_on_compose[continuous_intros]:
   "uniformly_continuous_on s g \<Longrightarrow> uniformly_continuous_on (g`s) f \<Longrightarrow>
     uniformly_continuous_on s (\<lambda>x. f (g x))"
   using filterlim_compose[of "\<lambda>(x, y). (f x, f y)" uniformity
       "uniformity_on (g`s)"  "\<lambda>(x, y). (g x, g y)" "uniformity_on s"]
   by (simp add: split_beta' uniformly_continuous_on_uniformity
       filterlim_inf filterlim_principal eventually_inf_principal mem_Times_iff)
 
 lemma uniformly_continuous_imp_continuous:
   assumes f: "uniformly_continuous_on s f"
   shows "continuous_on s f"
   by (auto simp: filterlim_iff eventually_at_filter eventually_nhds_uniformity continuous_on_def
            elim: eventually_mono dest!: uniformly_continuous_onD[OF f])
 
 
 section \<open>Product Topology\<close>
 
 subsection \<open>Product is a topological space\<close>
 
 instantiation prod :: (topological_space, topological_space) topological_space
 begin
 
 definition open_prod_def[code del]:
   "open (S :: ('a \<times> 'b) set) \<longleftrightarrow>
     (\<forall>x\<in>S. \<exists>A B. open A \<and> open B \<and> x \<in> A \<times> B \<and> A \<times> B \<subseteq> S)"
 
 lemma open_prod_elim:
   assumes "open S" and "x \<in> S"
   obtains A B where "open A" and "open B" and "x \<in> A \<times> B" and "A \<times> B \<subseteq> S"
   using assms unfolding open_prod_def by fast
 
 lemma open_prod_intro:
   assumes "\<And>x. x \<in> S \<Longrightarrow> \<exists>A B. open A \<and> open B \<and> x \<in> A \<times> B \<and> A \<times> B \<subseteq> S"
   shows "open S"
   using assms unfolding open_prod_def by fast
 
 instance
 proof
   show "open (UNIV :: ('a \<times> 'b) set)"
     unfolding open_prod_def by auto
 next
   fix S T :: "('a \<times> 'b) set"
   assume "open S" "open T"
   show "open (S \<inter> T)"
   proof (rule open_prod_intro)
     fix x
     assume x: "x \<in> S \<inter> T"
     from x have "x \<in> S" by simp
     obtain Sa Sb where A: "open Sa" "open Sb" "x \<in> Sa \<times> Sb" "Sa \<times> Sb \<subseteq> S"
       using \<open>open S\<close> and \<open>x \<in> S\<close> by (rule open_prod_elim)
     from x have "x \<in> T" by simp
     obtain Ta Tb where B: "open Ta" "open Tb" "x \<in> Ta \<times> Tb" "Ta \<times> Tb \<subseteq> T"
       using \<open>open T\<close> and \<open>x \<in> T\<close> by (rule open_prod_elim)
     let ?A = "Sa \<inter> Ta" and ?B = "Sb \<inter> Tb"
     have "open ?A \<and> open ?B \<and> x \<in> ?A \<times> ?B \<and> ?A \<times> ?B \<subseteq> S \<inter> T"
       using A B by (auto simp add: open_Int)
     then show "\<exists>A B. open A \<and> open B \<and> x \<in> A \<times> B \<and> A \<times> B \<subseteq> S \<inter> T"
       by fast
   qed
 next
   fix K :: "('a \<times> 'b) set set"
   assume "\<forall>S\<in>K. open S"
   then show "open (\<Union>K)"
     unfolding open_prod_def by fast
 qed
 
 end
 
 declare [[code abort: "open :: ('a::topological_space \<times> 'b::topological_space) set \<Rightarrow> bool"]]
 
 lemma open_Times: "open S \<Longrightarrow> open T \<Longrightarrow> open (S \<times> T)"
   unfolding open_prod_def by auto
 
 lemma fst_vimage_eq_Times: "fst -` S = S \<times> UNIV"
   by auto
 
 lemma snd_vimage_eq_Times: "snd -` S = UNIV \<times> S"
   by auto
 
 lemma open_vimage_fst: "open S \<Longrightarrow> open (fst -` S)"
   by (simp add: fst_vimage_eq_Times open_Times)
 
 lemma open_vimage_snd: "open S \<Longrightarrow> open (snd -` S)"
   by (simp add: snd_vimage_eq_Times open_Times)
 
 lemma closed_vimage_fst: "closed S \<Longrightarrow> closed (fst -` S)"
   unfolding closed_open vimage_Compl [symmetric]
   by (rule open_vimage_fst)
 
 lemma closed_vimage_snd: "closed S \<Longrightarrow> closed (snd -` S)"
   unfolding closed_open vimage_Compl [symmetric]
   by (rule open_vimage_snd)
 
 lemma closed_Times: "closed S \<Longrightarrow> closed T \<Longrightarrow> closed (S \<times> T)"
 proof -
   have "S \<times> T = (fst -` S) \<inter> (snd -` T)"
     by auto
   then show "closed S \<Longrightarrow> closed T \<Longrightarrow> closed (S \<times> T)"
     by (simp add: closed_vimage_fst closed_vimage_snd closed_Int)
 qed
 
 lemma subset_fst_imageI: "A \<times> B \<subseteq> S \<Longrightarrow> y \<in> B \<Longrightarrow> A \<subseteq> fst ` S"
   unfolding image_def subset_eq by force
 
 lemma subset_snd_imageI: "A \<times> B \<subseteq> S \<Longrightarrow> x \<in> A \<Longrightarrow> B \<subseteq> snd ` S"
   unfolding image_def subset_eq by force
 
 lemma open_image_fst:
   assumes "open S"
   shows "open (fst ` S)"
 proof (rule openI)
   fix x
   assume "x \<in> fst ` S"
   then obtain y where "(x, y) \<in> S"
     by auto
   then obtain A B where "open A" "open B" "x \<in> A" "y \<in> B" "A \<times> B \<subseteq> S"
     using \<open>open S\<close> unfolding open_prod_def by auto
   from \<open>A \<times> B \<subseteq> S\<close> \<open>y \<in> B\<close> have "A \<subseteq> fst ` S"
     by (rule subset_fst_imageI)
   with \<open>open A\<close> \<open>x \<in> A\<close> have "open A \<and> x \<in> A \<and> A \<subseteq> fst ` S"
     by simp
   then show "\<exists>T. open T \<and> x \<in> T \<and> T \<subseteq> fst ` S" ..
 qed
 
 lemma open_image_snd:
   assumes "open S"
   shows "open (snd ` S)"
 proof (rule openI)
   fix y
   assume "y \<in> snd ` S"
   then obtain x where "(x, y) \<in> S"
     by auto
   then obtain A B where "open A" "open B" "x \<in> A" "y \<in> B" "A \<times> B \<subseteq> S"
     using \<open>open S\<close> unfolding open_prod_def by auto
   from \<open>A \<times> B \<subseteq> S\<close> \<open>x \<in> A\<close> have "B \<subseteq> snd ` S"
     by (rule subset_snd_imageI)
   with \<open>open B\<close> \<open>y \<in> B\<close> have "open B \<and> y \<in> B \<and> B \<subseteq> snd ` S"
     by simp
   then show "\<exists>T. open T \<and> y \<in> T \<and> T \<subseteq> snd ` S" ..
 qed
 
 lemma nhds_prod: "nhds (a, b) = nhds a \<times>\<^sub>F nhds b"
   unfolding nhds_def
 proof (subst prod_filter_INF, auto intro!: antisym INF_greatest simp: principal_prod_principal)
   fix S T
   assume "open S" "a \<in> S" "open T" "b \<in> T"
   then show "(INF x \<in> {S. open S \<and> (a, b) \<in> S}. principal x) \<le> principal (S \<times> T)"
     by (intro INF_lower) (auto intro!: open_Times)
 next
   fix S'
   assume "open S'" "(a, b) \<in> S'"
   then obtain S T where "open S" "a \<in> S" "open T" "b \<in> T" "S \<times> T \<subseteq> S'"
     by (auto elim: open_prod_elim)
   then show "(INF x \<in> {S. open S \<and> a \<in> S}. INF y \<in> {S. open S \<and> b \<in> S}.
       principal (x \<times> y)) \<le> principal S'"
     by (auto intro!: INF_lower2)
 qed
 
 
 subsubsection \<open>Continuity of operations\<close>
 
 lemma tendsto_fst [tendsto_intros]:
   assumes "(f \<longlongrightarrow> a) F"
   shows "((\<lambda>x. fst (f x)) \<longlongrightarrow> fst a) F"
 proof (rule topological_tendstoI)
   fix S
   assume "open S" and "fst a \<in> S"
   then have "open (fst -` S)" and "a \<in> fst -` S"
     by (simp_all add: open_vimage_fst)
   with assms have "eventually (\<lambda>x. f x \<in> fst -` S) F"
     by (rule topological_tendstoD)
   then show "eventually (\<lambda>x. fst (f x) \<in> S) F"
     by simp
 qed
 
 lemma tendsto_snd [tendsto_intros]:
   assumes "(f \<longlongrightarrow> a) F"
   shows "((\<lambda>x. snd (f x)) \<longlongrightarrow> snd a) F"
 proof (rule topological_tendstoI)
   fix S
   assume "open S" and "snd a \<in> S"
   then have "open (snd -` S)" and "a \<in> snd -` S"
     by (simp_all add: open_vimage_snd)
   with assms have "eventually (\<lambda>x. f x \<in> snd -` S) F"
     by (rule topological_tendstoD)
   then show "eventually (\<lambda>x. snd (f x) \<in> S) F"
     by simp
 qed
 
 lemma tendsto_Pair [tendsto_intros]:
   assumes "(f \<longlongrightarrow> a) F" and "(g \<longlongrightarrow> b) F"
   shows "((\<lambda>x. (f x, g x)) \<longlongrightarrow> (a, b)) F"
   unfolding nhds_prod using assms by (rule filterlim_Pair)
 
 lemma continuous_fst[continuous_intros]: "continuous F f \<Longrightarrow> continuous F (\<lambda>x. fst (f x))"
   unfolding continuous_def by (rule tendsto_fst)
 
 lemma continuous_snd[continuous_intros]: "continuous F f \<Longrightarrow> continuous F (\<lambda>x. snd (f x))"
   unfolding continuous_def by (rule tendsto_snd)
 
 lemma continuous_Pair[continuous_intros]:
   "continuous F f \<Longrightarrow> continuous F g \<Longrightarrow> continuous F (\<lambda>x. (f x, g x))"
   unfolding continuous_def by (rule tendsto_Pair)
 
 lemma continuous_on_fst[continuous_intros]:
   "continuous_on s f \<Longrightarrow> continuous_on s (\<lambda>x. fst (f x))"
   unfolding continuous_on_def by (auto intro: tendsto_fst)
 
 lemma continuous_on_snd[continuous_intros]:
   "continuous_on s f \<Longrightarrow> continuous_on s (\<lambda>x. snd (f x))"
   unfolding continuous_on_def by (auto intro: tendsto_snd)
 
 lemma continuous_on_Pair[continuous_intros]:
   "continuous_on s f \<Longrightarrow> continuous_on s g \<Longrightarrow> continuous_on s (\<lambda>x. (f x, g x))"
   unfolding continuous_on_def by (auto intro: tendsto_Pair)
 
 lemma continuous_on_swap[continuous_intros]: "continuous_on A prod.swap"
   by (simp add: prod.swap_def continuous_on_fst continuous_on_snd
       continuous_on_Pair continuous_on_id)
 
 lemma continuous_on_swap_args:
   assumes "continuous_on (A\<times>B) (\<lambda>(x,y). d x y)"
     shows "continuous_on (B\<times>A) (\<lambda>(x,y). d y x)"
 proof -
   have "(\<lambda>(x,y). d y x) = (\<lambda>(x,y). d x y) \<circ> prod.swap"
     by force
   then show ?thesis
     by (metis assms continuous_on_compose continuous_on_swap product_swap)
 qed
 
 lemma isCont_fst [simp]: "isCont f a \<Longrightarrow> isCont (\<lambda>x. fst (f x)) a"
   by (fact continuous_fst)
 
 lemma isCont_snd [simp]: "isCont f a \<Longrightarrow> isCont (\<lambda>x. snd (f x)) a"
   by (fact continuous_snd)
 
 lemma isCont_Pair [simp]: "\<lbrakk>isCont f a; isCont g a\<rbrakk> \<Longrightarrow> isCont (\<lambda>x. (f x, g x)) a"
   by (fact continuous_Pair)
 
 lemma continuous_on_compose_Pair:
   assumes f: "continuous_on (Sigma A B) (\<lambda>(a, b). f a b)"
   assumes g: "continuous_on C g"
   assumes h: "continuous_on C h"
   assumes subset: "\<And>c. c \<in> C \<Longrightarrow> g c \<in> A" "\<And>c. c \<in> C \<Longrightarrow> h c \<in> B (g c)"
   shows "continuous_on C (\<lambda>c. f (g c) (h c))"
   using continuous_on_compose2[OF f continuous_on_Pair[OF g h]] subset
   by auto
 
 
 subsubsection \<open>Connectedness of products\<close>
 
 proposition connected_Times:
   assumes S: "connected S" and T: "connected T"
   shows "connected (S \<times> T)"
 proof (rule connectedI_const)
   fix P::"'a \<times> 'b \<Rightarrow> bool"
   assume P[THEN continuous_on_compose2, continuous_intros]: "continuous_on (S \<times> T) P"
   have "continuous_on S (\<lambda>s. P (s, t))" if "t \<in> T" for t
     by (auto intro!: continuous_intros that)
   from connectedD_const[OF S this]
   obtain c1 where c1: "\<And>s t. t \<in> T \<Longrightarrow> s \<in> S \<Longrightarrow> P (s, t) = c1 t"
     by metis
   moreover
   have "continuous_on T (\<lambda>t. P (s, t))" if "s \<in> S" for s
     by (auto intro!: continuous_intros that)
   from connectedD_const[OF T this]
   obtain c2 where "\<And>s t. t \<in> T \<Longrightarrow> s \<in> S \<Longrightarrow> P (s, t) = c2 s"
     by metis
   ultimately show "\<exists>c. \<forall>s\<in>S \<times> T. P s = c"
     by auto
 qed
 
 corollary connected_Times_eq [simp]:
    "connected (S \<times> T) \<longleftrightarrow> S = {} \<or> T = {} \<or> connected S \<and> connected T"  (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   show ?rhs
   proof cases
     assume "S \<noteq> {} \<and> T \<noteq> {}"
     moreover
     have "connected (fst ` (S \<times> T))" "connected (snd ` (S \<times> T))"
       using continuous_on_fst continuous_on_snd continuous_on_id
       by (blast intro: connected_continuous_image [OF _ L])+
     ultimately show ?thesis
       by auto
   qed auto
 qed (auto simp: connected_Times)
 
 
 subsubsection \<open>Separation axioms\<close>
 
 instance prod :: (t0_space, t0_space) t0_space
 proof
   fix x y :: "'a \<times> 'b"
   assume "x \<noteq> y"
   then have "fst x \<noteq> fst y \<or> snd x \<noteq> snd y"
     by (simp add: prod_eq_iff)
   then show "\<exists>U. open U \<and> (x \<in> U) \<noteq> (y \<in> U)"
     by (fast dest: t0_space elim: open_vimage_fst open_vimage_snd)
 qed
 
 instance prod :: (t1_space, t1_space) t1_space
 proof
   fix x y :: "'a \<times> 'b"
   assume "x \<noteq> y"
   then have "fst x \<noteq> fst y \<or> snd x \<noteq> snd y"
     by (simp add: prod_eq_iff)
   then show "\<exists>U. open U \<and> x \<in> U \<and> y \<notin> U"
     by (fast dest: t1_space elim: open_vimage_fst open_vimage_snd)
 qed
 
 instance prod :: (t2_space, t2_space) t2_space
 proof
   fix x y :: "'a \<times> 'b"
   assume "x \<noteq> y"
   then have "fst x \<noteq> fst y \<or> snd x \<noteq> snd y"
     by (simp add: prod_eq_iff)
   then show "\<exists>U V. open U \<and> open V \<and> x \<in> U \<and> y \<in> V \<and> U \<inter> V = {}"
     by (fast dest: hausdorff elim: open_vimage_fst open_vimage_snd)
 qed
 
 lemma isCont_swap[continuous_intros]: "isCont prod.swap a"
   using continuous_on_eq_continuous_within continuous_on_swap by blast
 
 lemma open_diagonal_complement:
   "open {(x,y) |x y. x \<noteq> (y::('a::t2_space))}"
 proof -
   have "open {(x, y). x \<noteq> (y::'a)}"
     unfolding split_def by (intro open_Collect_neq continuous_intros)
   also have "{(x, y). x \<noteq> (y::'a)} = {(x, y) |x y. x \<noteq> (y::'a)}"
     by auto
   finally show ?thesis .
 qed
 
 lemma closed_diagonal:
   "closed {y. \<exists> x::('a::t2_space). y = (x,x)}"
 proof -
   have "{y. \<exists> x::'a. y = (x,x)} = UNIV - {(x,y) | x y. x \<noteq> y}" by auto
   then show ?thesis using open_diagonal_complement closed_Diff by auto
 qed
 
 lemma open_superdiagonal:
   "open {(x,y) | x y. x > (y::'a::{linorder_topology})}"
 proof -
   have "open {(x, y). x > (y::'a)}"
     unfolding split_def by (intro open_Collect_less continuous_intros)
   also have "{(x, y). x > (y::'a)} = {(x, y) |x y. x > (y::'a)}"
     by auto
   finally show ?thesis .
 qed
 
 lemma closed_subdiagonal:
   "closed {(x,y) | x y. x \<le> (y::'a::{linorder_topology})}"
 proof -
   have "{(x,y) | x y. x \<le> (y::'a)} = UNIV - {(x,y) | x y. x > (y::'a)}" by auto
   then show ?thesis using open_superdiagonal closed_Diff by auto
 qed
 
 lemma open_subdiagonal:
   "open {(x,y) | x y. x < (y::'a::{linorder_topology})}"
 proof -
   have "open {(x, y). x < (y::'a)}"
     unfolding split_def by (intro open_Collect_less continuous_intros)
   also have "{(x, y). x < (y::'a)} = {(x, y) |x y. x < (y::'a)}"
     by auto
   finally show ?thesis .
 qed
 
 lemma closed_superdiagonal:
   "closed {(x,y) | x y. x \<ge> (y::('a::{linorder_topology}))}"
 proof -
   have "{(x,y) | x y. x \<ge> (y::'a)} = UNIV - {(x,y) | x y. x < y}" by auto
   then show ?thesis using open_subdiagonal closed_Diff by auto
 qed
 
 
 end