diff --git a/src/HOL/Library/AList.thy b/src/HOL/Library/AList.thy
--- a/src/HOL/Library/AList.thy
+++ b/src/HOL/Library/AList.thy
@@ -1,780 +1,780 @@
 (*  Title:      HOL/Library/AList.thy
     Author:     Norbert Schirmer, Tobias Nipkow, Martin Wildmoser, TU Muenchen
 *)
 
 section \<open>Implementation of Association Lists\<close>
 
 theory AList
   imports Main
 begin
 
 context
 begin
 
 text \<open>
   The operations preserve distinctness of keys and
   function \<^term>\<open>clearjunk\<close> distributes over them. Since
   \<^term>\<open>clearjunk\<close> enforces distinctness of keys it can be used
   to establish the invariant, e.g. for inductive proofs.
 \<close>
 
 subsection \<open>\<open>update\<close> and \<open>updates\<close>\<close>
 
 qualified primrec update :: "'key \<Rightarrow> 'val \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where
     "update k v [] = [(k, v)]"
   | "update k v (p # ps) = (if fst p = k then (k, v) # ps else p # update k v ps)"
 
 lemma update_conv': "map_of (update k v al)  = (map_of al)(k\<mapsto>v)"
   by (induct al) (auto simp add: fun_eq_iff)
 
 corollary update_conv: "map_of (update k v al) k' = ((map_of al)(k\<mapsto>v)) k'"
   by (simp add: update_conv')
 
 lemma dom_update: "fst ` set (update k v al) = {k} \<union> fst ` set al"
   by (induct al) auto
 
 lemma update_keys:
   "map fst (update k v al) =
     (if k \<in> set (map fst al) then map fst al else map fst al @ [k])"
   by (induct al) simp_all
 
 lemma distinct_update:
   assumes "distinct (map fst al)"
   shows "distinct (map fst (update k v al))"
   using assms by (simp add: update_keys)
 
 lemma update_filter:
   "a \<noteq> k \<Longrightarrow> update k v [q\<leftarrow>ps. fst q \<noteq> a] = [q\<leftarrow>update k v ps. fst q \<noteq> a]"
   by (induct ps) auto
 
 lemma update_triv: "map_of al k = Some v \<Longrightarrow> update k v al = al"
   by (induct al) auto
 
 lemma update_nonempty [simp]: "update k v al \<noteq> []"
   by (induct al) auto
 
 lemma update_eqD: "update k v al = update k v' al' \<Longrightarrow> v = v'"
 proof (induct al arbitrary: al')
   case Nil
   then show ?case
     by (cases al') (auto split: if_split_asm)
 next
   case Cons
   then show ?case
     by (cases al') (auto split: if_split_asm)
 qed
 
 lemma update_last [simp]: "update k v (update k v' al) = update k v al"
   by (induct al) auto
 
 text \<open>Note that the lists are not necessarily the same:
         \<^term>\<open>update k v (update k' v' []) = [(k', v'), (k, v)]\<close> and
         \<^term>\<open>update k' v' (update k v []) = [(k, v), (k', v')]\<close>.\<close>
 
 lemma update_swap:
   "k \<noteq> k' \<Longrightarrow> map_of (update k v (update k' v' al)) = map_of (update k' v' (update k v al))"
   by (simp add: update_conv' fun_eq_iff)
 
 lemma update_Some_unfold:
   "map_of (update k v al) x = Some y \<longleftrightarrow>
     x = k \<and> v = y \<or> x \<noteq> k \<and> map_of al x = Some y"
   by (simp add: update_conv' map_upd_Some_unfold)
 
 lemma image_update [simp]: "x \<notin> A \<Longrightarrow> map_of (update x y al) ` A = map_of al ` A"
   by (auto simp add: update_conv')
 
 qualified definition updates ::
     "'key list \<Rightarrow> 'val list \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where "updates ks vs = fold (case_prod update) (zip ks vs)"
 
 lemma updates_simps [simp]:
   "updates [] vs ps = ps"
   "updates ks [] ps = ps"
   "updates (k#ks) (v#vs) ps = updates ks vs (update k v ps)"
   by (simp_all add: updates_def)
 
 lemma updates_key_simp [simp]:
   "updates (k # ks) vs ps =
     (case vs of [] \<Rightarrow> ps | v # vs \<Rightarrow> updates ks vs (update k v ps))"
   by (cases vs) simp_all
 
 lemma updates_conv': "map_of (updates ks vs al) = (map_of al)(ks[\<mapsto>]vs)"
 proof -
   have "map_of \<circ> fold (case_prod update) (zip ks vs) =
       fold (\<lambda>(k, v) f. f(k \<mapsto> v)) (zip ks vs) \<circ> map_of"
     by (rule fold_commute) (auto simp add: fun_eq_iff update_conv')
   then show ?thesis
     by (auto simp add: updates_def fun_eq_iff map_upds_fold_map_upd foldl_conv_fold split_def)
 qed
 
 lemma updates_conv: "map_of (updates ks vs al) k = ((map_of al)(ks[\<mapsto>]vs)) k"
   by (simp add: updates_conv')
 
 lemma distinct_updates:
   assumes "distinct (map fst al)"
   shows "distinct (map fst (updates ks vs al))"
 proof -
   have "distinct (fold
        (\<lambda>(k, v) al. if k \<in> set al then al else al @ [k])
        (zip ks vs) (map fst al))"
     by (rule fold_invariant [of "zip ks vs" "\<lambda>_. True"]) (auto intro: assms)
   moreover have "map fst \<circ> fold (case_prod update) (zip ks vs) =
       fold (\<lambda>(k, v) al. if k \<in> set al then al else al @ [k]) (zip ks vs) \<circ> map fst"
     by (rule fold_commute) (simp add: update_keys split_def case_prod_beta comp_def)
   ultimately show ?thesis
     by (simp add: updates_def fun_eq_iff)
 qed
 
 lemma updates_append1[simp]: "size ks < size vs \<Longrightarrow>
     updates (ks@[k]) vs al = update k (vs!size ks) (updates ks vs al)"
   by (induct ks arbitrary: vs al) (auto split: list.splits)
 
 lemma updates_list_update_drop[simp]:
   "size ks \<le> i \<Longrightarrow> i < size vs \<Longrightarrow>
     updates ks (vs[i:=v]) al = updates ks vs al"
   by (induct ks arbitrary: al vs i) (auto split: list.splits nat.splits)
 
 lemma update_updates_conv_if:
   "map_of (updates xs ys (update x y al)) =
     map_of
      (if x \<in> set (take (length ys) xs)
       then updates xs ys al
       else (update x y (updates xs ys al)))"
   by (simp add: updates_conv' update_conv' map_upd_upds_conv_if)
 
 lemma updates_twist [simp]:
   "k \<notin> set ks \<Longrightarrow>
     map_of (updates ks vs (update k v al)) = map_of (update k v (updates ks vs al))"
   by (simp add: updates_conv' update_conv')
 
 lemma updates_apply_notin [simp]:
   "k \<notin> set ks \<Longrightarrow> map_of (updates ks vs al) k = map_of al k"
   by (simp add: updates_conv)
 
 lemma updates_append_drop [simp]:
   "size xs = size ys \<Longrightarrow> updates (xs @ zs) ys al = updates xs ys al"
   by (induct xs arbitrary: ys al) (auto split: list.splits)
 
 lemma updates_append2_drop [simp]:
   "size xs = size ys \<Longrightarrow> updates xs (ys @ zs) al = updates xs ys al"
   by (induct xs arbitrary: ys al) (auto split: list.splits)
 
 
 subsection \<open>\<open>delete\<close>\<close>
 
 qualified definition delete :: "'key \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where delete_eq: "delete k = filter (\<lambda>(k', _). k \<noteq> k')"
 
 lemma delete_simps [simp]:
   "delete k [] = []"
   "delete k (p # ps) = (if fst p = k then delete k ps else p # delete k ps)"
   by (auto simp add: delete_eq)
 
 lemma delete_conv': "map_of (delete k al) = (map_of al)(k := None)"
   by (induct al) (auto simp add: fun_eq_iff)
 
 corollary delete_conv: "map_of (delete k al) k' = ((map_of al)(k := None)) k'"
   by (simp add: delete_conv')
 
 lemma delete_keys: "map fst (delete k al) = removeAll k (map fst al)"
   by (simp add: delete_eq removeAll_filter_not_eq filter_map split_def comp_def)
 
 lemma distinct_delete:
   assumes "distinct (map fst al)"
   shows "distinct (map fst (delete k al))"
   using assms by (simp add: delete_keys distinct_removeAll)
 
 lemma delete_id [simp]: "k \<notin> fst ` set al \<Longrightarrow> delete k al = al"
   by (auto simp add: image_iff delete_eq filter_id_conv)
 
 lemma delete_idem: "delete k (delete k al) = delete k al"
   by (simp add: delete_eq)
 
 lemma map_of_delete [simp]: "k' \<noteq> k \<Longrightarrow> map_of (delete k al) k' = map_of al k'"
   by (simp add: delete_conv')
 
 lemma delete_notin_dom: "k \<notin> fst ` set (delete k al)"
   by (auto simp add: delete_eq)
 
 lemma dom_delete_subset: "fst ` set (delete k al) \<subseteq> fst ` set al"
   by (auto simp add: delete_eq)
 
 lemma delete_update_same: "delete k (update k v al) = delete k al"
   by (induct al) simp_all
 
 lemma delete_update: "k \<noteq> l \<Longrightarrow> delete l (update k v al) = update k v (delete l al)"
   by (induct al) simp_all
 
 lemma delete_twist: "delete x (delete y al) = delete y (delete x al)"
   by (simp add: delete_eq conj_commute)
 
 lemma length_delete_le: "length (delete k al) \<le> length al"
   by (simp add: delete_eq)
 
 
 subsection \<open>\<open>update_with_aux\<close> and \<open>delete_aux\<close>\<close>
 
 qualified primrec update_with_aux ::
     "'val \<Rightarrow> 'key \<Rightarrow> ('val \<Rightarrow> 'val) \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where
     "update_with_aux v k f [] = [(k, f v)]"
   | "update_with_aux v k f (p # ps) =
       (if (fst p = k) then (k, f (snd p)) # ps else p # update_with_aux v k f ps)"
 
 text \<open>
   The above \<^term>\<open>delete\<close> traverses all the list even if it has found the key.
   This one does not have to keep going because is assumes the invariant that keys are distinct.
 \<close>
 qualified fun delete_aux :: "'key \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where
     "delete_aux k [] = []"
   | "delete_aux k ((k', v) # xs) = (if k = k' then xs else (k', v) # delete_aux k xs)"
 
 lemma map_of_update_with_aux':
   "map_of (update_with_aux v k f ps) k' =
     ((map_of ps)(k \<mapsto> (case map_of ps k of None \<Rightarrow> f v | Some v \<Rightarrow> f v))) k'"
   by (induct ps) auto
 
 lemma map_of_update_with_aux:
   "map_of (update_with_aux v k f ps) =
     (map_of ps)(k \<mapsto> (case map_of ps k of None \<Rightarrow> f v | Some v \<Rightarrow> f v))"
   by (simp add: fun_eq_iff map_of_update_with_aux')
 
 lemma dom_update_with_aux: "fst ` set (update_with_aux v k f ps) = {k} \<union> fst ` set ps"
   by (induct ps) auto
 
 lemma distinct_update_with_aux [simp]:
   "distinct (map fst (update_with_aux v k f ps)) = distinct (map fst ps)"
   by (induct ps) (auto simp add: dom_update_with_aux)
 
 lemma set_update_with_aux:
   "distinct (map fst xs) \<Longrightarrow>
     set (update_with_aux v k f xs) =
       (set xs - {k} \<times> UNIV \<union> {(k, f (case map_of xs k of None \<Rightarrow> v | Some v \<Rightarrow> v))})"
   by (induct xs) (auto intro: rev_image_eqI)
 
 lemma set_delete_aux: "distinct (map fst xs) \<Longrightarrow> set (delete_aux k xs) = set xs - {k} \<times> UNIV"
   apply (induct xs)
    apply simp_all
   apply clarsimp
   apply (fastforce intro: rev_image_eqI)
   done
 
 lemma dom_delete_aux: "distinct (map fst ps) \<Longrightarrow> fst ` set (delete_aux k ps) = fst ` set ps - {k}"
   by (auto simp add: set_delete_aux)
 
 lemma distinct_delete_aux [simp]: "distinct (map fst ps) \<Longrightarrow> distinct (map fst (delete_aux k ps))"
 proof (induct ps)
   case Nil
   then show ?case by simp
 next
   case (Cons a ps)
   obtain k' v where a: "a = (k', v)"
     by (cases a)
   show ?case
   proof (cases "k' = k")
     case True
     with Cons a show ?thesis by simp
   next
     case False
     with Cons a have "k' \<notin> fst ` set ps" "distinct (map fst ps)"
       by simp_all
     with False a have "k' \<notin> fst ` set (delete_aux k ps)"
       by (auto dest!: dom_delete_aux[where k=k])
     with Cons a show ?thesis
       by simp
   qed
 qed
 
 lemma map_of_delete_aux':
   "distinct (map fst xs) \<Longrightarrow> map_of (delete_aux k xs) = (map_of xs)(k := None)"
   apply (induct xs)
    apply (fastforce simp add: map_of_eq_None_iff fun_upd_twist)
   apply (auto intro!: ext)
   apply (simp add: map_of_eq_None_iff)
   done
 
 lemma map_of_delete_aux:
   "distinct (map fst xs) \<Longrightarrow> map_of (delete_aux k xs) k' = ((map_of xs)(k := None)) k'"
   by (simp add: map_of_delete_aux')
 
 lemma delete_aux_eq_Nil_conv: "delete_aux k ts = [] \<longleftrightarrow> ts = [] \<or> (\<exists>v. ts = [(k, v)])"
   by (cases ts) (auto split: if_split_asm)
 
 
 subsection \<open>\<open>restrict\<close>\<close>
 
 qualified definition restrict :: "'key set \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where restrict_eq: "restrict A = filter (\<lambda>(k, v). k \<in> A)"
 
 lemma restr_simps [simp]:
   "restrict A [] = []"
   "restrict A (p#ps) = (if fst p \<in> A then p # restrict A ps else restrict A ps)"
   by (auto simp add: restrict_eq)
 
 lemma restr_conv': "map_of (restrict A al) = ((map_of al)|` A)"
 proof
   show "map_of (restrict A al) k = ((map_of al)|` A) k" for k
     apply (induct al)
      apply simp
     apply (cases "k \<in> A")
      apply auto
     done
 qed
 
 corollary restr_conv: "map_of (restrict A al) k = ((map_of al)|` A) k"
   by (simp add: restr_conv')
 
 lemma distinct_restr: "distinct (map fst al) \<Longrightarrow> distinct (map fst (restrict A al))"
   by (induct al) (auto simp add: restrict_eq)
 
 lemma restr_empty [simp]:
   "restrict {} al = []"
   "restrict A [] = []"
   by (induct al) (auto simp add: restrict_eq)
 
 lemma restr_in [simp]: "x \<in> A \<Longrightarrow> map_of (restrict A al) x = map_of al x"
   by (simp add: restr_conv')
 
 lemma restr_out [simp]: "x \<notin> A \<Longrightarrow> map_of (restrict A al) x = None"
   by (simp add: restr_conv')
 
 lemma dom_restr [simp]: "fst ` set (restrict A al) = fst ` set al \<inter> A"
   by (induct al) (auto simp add: restrict_eq)
 
 lemma restr_upd_same [simp]: "restrict (-{x}) (update x y al) = restrict (-{x}) al"
   by (induct al) (auto simp add: restrict_eq)
 
 lemma restr_restr [simp]: "restrict A (restrict B al) = restrict (A\<inter>B) al"
   by (induct al) (auto simp add: restrict_eq)
 
 lemma restr_update[simp]:
   "map_of (restrict D (update x y al)) =
     map_of ((if x \<in> D then (update x y (restrict (D-{x}) al)) else restrict D al))"
   by (simp add: restr_conv' update_conv')
 
 lemma restr_delete [simp]:
   "delete x (restrict D al) = (if x \<in> D then restrict (D - {x}) al else restrict D al)"
   apply (simp add: delete_eq restrict_eq)
   apply (auto simp add: split_def)
 proof -
   have "y \<noteq> x \<longleftrightarrow> x \<noteq> y" for y
     by auto
   then show "[p \<leftarrow> al. fst p \<in> D \<and> x \<noteq> fst p] = [p \<leftarrow> al. fst p \<in> D \<and> fst p \<noteq> x]"
     by simp
   assume "x \<notin> D"
   then have "y \<in> D \<longleftrightarrow> y \<in> D \<and> x \<noteq> y" for y
     by auto
   then show "[p \<leftarrow> al . fst p \<in> D \<and> x \<noteq> fst p] = [p \<leftarrow> al . fst p \<in> D]"
     by simp
 qed
 
 lemma update_restr:
   "map_of (update x y (restrict D al)) = map_of (update x y (restrict (D - {x}) al))"
   by (simp add: update_conv' restr_conv') (rule fun_upd_restrict)
 
 lemma update_restr_conv [simp]:
   "x \<in> D \<Longrightarrow>
     map_of (update x y (restrict D al)) = map_of (update x y (restrict (D - {x}) al))"
   by (simp add: update_conv' restr_conv')
 
 lemma restr_updates [simp]:
   "length xs = length ys \<Longrightarrow> set xs \<subseteq> D \<Longrightarrow>
     map_of (restrict D (updates xs ys al)) =
       map_of (updates xs ys (restrict (D - set xs) al))"
   by (simp add: updates_conv' restr_conv')
 
 lemma restr_delete_twist: "(restrict A (delete a ps)) = delete a (restrict A ps)"
   by (induct ps) auto
 
 
 subsection \<open>\<open>clearjunk\<close>\<close>
 
 qualified function clearjunk  :: "('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where
     "clearjunk [] = []"
   | "clearjunk (p#ps) = p # clearjunk (delete (fst p) ps)"
   by pat_completeness auto
 termination
   by (relation "measure length") (simp_all add: less_Suc_eq_le length_delete_le)
 
 lemma map_of_clearjunk: "map_of (clearjunk al) = map_of al"
   by (induct al rule: clearjunk.induct) (simp_all add: fun_eq_iff)
 
 lemma clearjunk_keys_set: "set (map fst (clearjunk al)) = set (map fst al)"
   by (induct al rule: clearjunk.induct) (simp_all add: delete_keys)
 
 lemma dom_clearjunk: "fst ` set (clearjunk al) = fst ` set al"
   using clearjunk_keys_set by simp
 
 lemma distinct_clearjunk [simp]: "distinct (map fst (clearjunk al))"
   by (induct al rule: clearjunk.induct) (simp_all del: set_map add: clearjunk_keys_set delete_keys)
 
 lemma ran_clearjunk: "ran (map_of (clearjunk al)) = ran (map_of al)"
   by (simp add: map_of_clearjunk)
 
 lemma ran_map_of: "ran (map_of al) = snd ` set (clearjunk al)"
 proof -
   have "ran (map_of al) = ran (map_of (clearjunk al))"
     by (simp add: ran_clearjunk)
   also have "\<dots> = snd ` set (clearjunk al)"
     by (simp add: ran_distinct)
   finally show ?thesis .
 qed
 
 lemma graph_map_of: "Map.graph (map_of al) = set (clearjunk al)"
-  by (metis distinct_clearjunk graph_map_of_if_distinct_ran map_of_clearjunk)
+  by (metis distinct_clearjunk graph_map_of_if_distinct_dom map_of_clearjunk)
 
 lemma clearjunk_update: "clearjunk (update k v al) = update k v (clearjunk al)"
   by (induct al rule: clearjunk.induct) (simp_all add: delete_update)
 
 lemma clearjunk_updates: "clearjunk (updates ks vs al) = updates ks vs (clearjunk al)"
 proof -
   have "clearjunk \<circ> fold (case_prod update) (zip ks vs) =
       fold (case_prod update) (zip ks vs) \<circ> clearjunk"
     by (rule fold_commute) (simp add: clearjunk_update case_prod_beta o_def)
   then show ?thesis
     by (simp add: updates_def fun_eq_iff)
 qed
 
 lemma clearjunk_delete: "clearjunk (delete x al) = delete x (clearjunk al)"
   by (induct al rule: clearjunk.induct) (auto simp add: delete_idem delete_twist)
 
 lemma clearjunk_restrict: "clearjunk (restrict A al) = restrict A (clearjunk al)"
   by (induct al rule: clearjunk.induct) (auto simp add: restr_delete_twist)
 
 lemma distinct_clearjunk_id [simp]: "distinct (map fst al) \<Longrightarrow> clearjunk al = al"
   by (induct al rule: clearjunk.induct) auto
 
 lemma clearjunk_idem: "clearjunk (clearjunk al) = clearjunk al"
   by simp
 
 lemma length_clearjunk: "length (clearjunk al) \<le> length al"
 proof (induct al rule: clearjunk.induct [case_names Nil Cons])
   case Nil
   then show ?case by simp
 next
   case (Cons kv al)
   moreover have "length (delete (fst kv) al) \<le> length al"
     by (fact length_delete_le)
   ultimately have "length (clearjunk (delete (fst kv) al)) \<le> length al"
     by (rule order_trans)
   then show ?case
     by simp
 qed
 
 lemma delete_map:
   assumes "\<And>kv. fst (f kv) = fst kv"
   shows "delete k (map f ps) = map f (delete k ps)"
   by (simp add: delete_eq filter_map comp_def split_def assms)
 
 lemma clearjunk_map:
   assumes "\<And>kv. fst (f kv) = fst kv"
   shows "clearjunk (map f ps) = map f (clearjunk ps)"
   by (induct ps rule: clearjunk.induct [case_names Nil Cons])
     (simp_all add: clearjunk_delete delete_map assms)
 
 
 subsection \<open>\<open>map_ran\<close>\<close>
 
 definition map_ran :: "('key \<Rightarrow> 'val1 \<Rightarrow> 'val2) \<Rightarrow> ('key \<times> 'val1) list \<Rightarrow> ('key \<times> 'val2) list"
   where "map_ran f = map (\<lambda>(k, v). (k, f k v))"
 
 lemma map_ran_simps [simp]:
   "map_ran f [] = []"
   "map_ran f ((k, v) # ps) = (k, f k v) # map_ran f ps"
   by (simp_all add: map_ran_def)
 
 lemma map_ran_Cons_sel: "map_ran f (p # ps) = (fst p, f (fst p) (snd p)) # map_ran f ps"
   by (simp add: map_ran_def case_prod_beta)
 
 lemma length_map_ran[simp]: "length (map_ran f al) = length al"
   by (simp add: map_ran_def)
 
 lemma map_fst_map_ran[simp]: "map fst (map_ran f al) = map fst al"
   by (simp add: map_ran_def case_prod_beta)
 
 lemma dom_map_ran: "fst ` set (map_ran f al) = fst ` set al"
   by (simp add: map_ran_def image_image split_def)
 
 lemma map_ran_conv: "map_of (map_ran f al) k = map_option (f k) (map_of al k)"
   by (induct al) auto
 
 lemma distinct_map_ran: "distinct (map fst al) \<Longrightarrow> distinct (map fst (map_ran f al))"
   by simp
 
 lemma map_ran_filter: "map_ran f [p\<leftarrow>ps. fst p \<noteq> a] = [p\<leftarrow>map_ran f ps. fst p \<noteq> a]"
   by (simp add: map_ran_def filter_map split_def comp_def)
 
 lemma clearjunk_map_ran: "clearjunk (map_ran f al) = map_ran f (clearjunk al)"
   by (simp add: map_ran_def split_def clearjunk_map)
 
 
 subsection \<open>\<open>merge\<close>\<close>
 
 qualified definition merge :: "('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where "merge qs ps = foldr (\<lambda>(k, v). update k v) ps qs"
 
 lemma merge_simps [simp]:
   "merge qs [] = qs"
   "merge qs (p#ps) = update (fst p) (snd p) (merge qs ps)"
   by (simp_all add: merge_def split_def)
 
 lemma merge_updates: "merge qs ps = updates (rev (map fst ps)) (rev (map snd ps)) qs"
   by (simp add: merge_def updates_def foldr_conv_fold zip_rev zip_map_fst_snd)
 
 lemma dom_merge: "fst ` set (merge xs ys) = fst ` set xs \<union> fst ` set ys"
   by (induct ys arbitrary: xs) (auto simp add: dom_update)
 
 lemma distinct_merge: "distinct (map fst xs) \<Longrightarrow> distinct (map fst (merge xs ys))"
   by (simp add: merge_updates distinct_updates)
 
 lemma clearjunk_merge: "clearjunk (merge xs ys) = merge (clearjunk xs) ys"
   by (simp add: merge_updates clearjunk_updates)
 
 lemma merge_conv': "map_of (merge xs ys) = map_of xs ++ map_of ys"
 proof -
   have "map_of \<circ> fold (case_prod update) (rev ys) =
       fold (\<lambda>(k, v) m. m(k \<mapsto> v)) (rev ys) \<circ> map_of"
     by (rule fold_commute) (simp add: update_conv' case_prod_beta split_def fun_eq_iff)
   then show ?thesis
     by (simp add: merge_def map_add_map_of_foldr foldr_conv_fold fun_eq_iff)
 qed
 
 corollary merge_conv: "map_of (merge xs ys) k = (map_of xs ++ map_of ys) k"
   by (simp add: merge_conv')
 
 lemma merge_empty: "map_of (merge [] ys) = map_of ys"
   by (simp add: merge_conv')
 
 lemma merge_assoc [simp]: "map_of (merge m1 (merge m2 m3)) = map_of (merge (merge m1 m2) m3)"
   by (simp add: merge_conv')
 
 lemma merge_Some_iff:
   "map_of (merge m n) k = Some x \<longleftrightarrow>
     map_of n k = Some x \<or> map_of n k = None \<and> map_of m k = Some x"
   by (simp add: merge_conv' map_add_Some_iff)
 
 lemmas merge_SomeD [dest!] = merge_Some_iff [THEN iffD1]
 
 lemma merge_find_right [simp]: "map_of n k = Some v \<Longrightarrow> map_of (merge m n) k = Some v"
   by (simp add: merge_conv')
 
 lemma merge_None [iff]: "(map_of (merge m n) k = None) = (map_of n k = None \<and> map_of m k = None)"
   by (simp add: merge_conv')
 
 lemma merge_upd [simp]: "map_of (merge m (update k v n)) = map_of (update k v (merge m n))"
   by (simp add: update_conv' merge_conv')
 
 lemma merge_updatess [simp]:
   "map_of (merge m (updates xs ys n)) = map_of (updates xs ys (merge m n))"
   by (simp add: updates_conv' merge_conv')
 
 lemma merge_append: "map_of (xs @ ys) = map_of (merge ys xs)"
   by (simp add: merge_conv')
 
 
 subsection \<open>\<open>compose\<close>\<close>
 
 qualified function compose :: "('key \<times> 'a) list \<Rightarrow> ('a \<times> 'b) list \<Rightarrow> ('key \<times> 'b) list"
   where
     "compose [] ys = []"
   | "compose (x # xs) ys =
       (case map_of ys (snd x) of
         None \<Rightarrow> compose (delete (fst x) xs) ys
       | Some v \<Rightarrow> (fst x, v) # compose xs ys)"
   by pat_completeness auto
 termination
   by (relation "measure (length \<circ> fst)") (simp_all add: less_Suc_eq_le length_delete_le)
 
 lemma compose_first_None [simp]: "map_of xs k = None \<Longrightarrow> map_of (compose xs ys) k = None"
   by (induct xs ys rule: compose.induct) (auto split: option.splits if_split_asm)
 
 lemma compose_conv: "map_of (compose xs ys) k = (map_of ys \<circ>\<^sub>m map_of xs) k"
 proof (induct xs ys rule: compose.induct)
   case 1
   then show ?case by simp
 next
   case (2 x xs ys)
   show ?case
   proof (cases "map_of ys (snd x)")
     case None
     with 2 have hyp: "map_of (compose (delete (fst x) xs) ys) k =
         (map_of ys \<circ>\<^sub>m map_of (delete (fst x) xs)) k"
       by simp
     show ?thesis
     proof (cases "fst x = k")
       case True
       from True delete_notin_dom [of k xs]
       have "map_of (delete (fst x) xs) k = None"
         by (simp add: map_of_eq_None_iff)
       with hyp show ?thesis
         using True None
         by simp
     next
       case False
       from False have "map_of (delete (fst x) xs) k = map_of xs k"
         by simp
       with hyp show ?thesis
         using False None by (simp add: map_comp_def)
     qed
   next
     case (Some v)
     with 2
     have "map_of (compose xs ys) k = (map_of ys \<circ>\<^sub>m map_of xs) k"
       by simp
     with Some show ?thesis
       by (auto simp add: map_comp_def)
   qed
 qed
 
 lemma compose_conv': "map_of (compose xs ys) = (map_of ys \<circ>\<^sub>m map_of xs)"
   by (rule ext) (rule compose_conv)
 
 lemma compose_first_Some [simp]: "map_of xs k = Some v \<Longrightarrow> map_of (compose xs ys) k = map_of ys v"
   by (simp add: compose_conv)
 
 lemma dom_compose: "fst ` set (compose xs ys) \<subseteq> fst ` set xs"
 proof (induct xs ys rule: compose.induct)
   case 1
   then show ?case by simp
 next
   case (2 x xs ys)
   show ?case
   proof (cases "map_of ys (snd x)")
     case None
     with "2.hyps" have "fst ` set (compose (delete (fst x) xs) ys) \<subseteq> fst ` set (delete (fst x) xs)"
       by simp
     also have "\<dots> \<subseteq> fst ` set xs"
       by (rule dom_delete_subset)
     finally show ?thesis
       using None by auto
   next
     case (Some v)
     with "2.hyps" have "fst ` set (compose xs ys) \<subseteq> fst ` set xs"
       by simp
     with Some show ?thesis
       by auto
   qed
 qed
 
 lemma distinct_compose:
   assumes "distinct (map fst xs)"
   shows "distinct (map fst (compose xs ys))"
   using assms
 proof (induct xs ys rule: compose.induct)
   case 1
   then show ?case by simp
 next
   case (2 x xs ys)
   show ?case
   proof (cases "map_of ys (snd x)")
     case None
     with 2 show ?thesis by simp
   next
     case (Some v)
     with 2 dom_compose [of xs ys] show ?thesis
       by auto
   qed
 qed
 
 lemma compose_delete_twist: "compose (delete k xs) ys = delete k (compose xs ys)"
 proof (induct xs ys rule: compose.induct)
   case 1
   then show ?case by simp
 next
   case (2 x xs ys)
   show ?case
   proof (cases "map_of ys (snd x)")
     case None
     with 2 have hyp: "compose (delete k (delete (fst x) xs)) ys =
         delete k (compose (delete (fst x) xs) ys)"
       by simp
     show ?thesis
     proof (cases "fst x = k")
       case True
       with None hyp show ?thesis
         by (simp add: delete_idem)
     next
       case False
       from None False hyp show ?thesis
         by (simp add: delete_twist)
     qed
   next
     case (Some v)
     with 2 have hyp: "compose (delete k xs) ys = delete k (compose xs ys)"
       by simp
     with Some show ?thesis
       by simp
   qed
 qed
 
 lemma compose_clearjunk: "compose xs (clearjunk ys) = compose xs ys"
   by (induct xs ys rule: compose.induct)
     (auto simp add: map_of_clearjunk split: option.splits)
 
 lemma clearjunk_compose: "clearjunk (compose xs ys) = compose (clearjunk xs) ys"
   by (induct xs rule: clearjunk.induct)
     (auto split: option.splits simp add: clearjunk_delete delete_idem compose_delete_twist)
 
 lemma compose_empty [simp]: "compose xs [] = []"
   by (induct xs) (auto simp add: compose_delete_twist)
 
 lemma compose_Some_iff:
   "(map_of (compose xs ys) k = Some v) \<longleftrightarrow>
     (\<exists>k'. map_of xs k = Some k' \<and> map_of ys k' = Some v)"
   by (simp add: compose_conv map_comp_Some_iff)
 
 lemma map_comp_None_iff:
   "map_of (compose xs ys) k = None \<longleftrightarrow>
     (map_of xs k = None \<or> (\<exists>k'. map_of xs k = Some k' \<and> map_of ys k' = None))"
   by (simp add: compose_conv map_comp_None_iff)
 
 
 subsection \<open>\<open>map_entry\<close>\<close>
 
 qualified fun map_entry :: "'key \<Rightarrow> ('val \<Rightarrow> 'val) \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where
     "map_entry k f [] = []"
   | "map_entry k f (p # ps) =
       (if fst p = k then (k, f (snd p)) # ps else p # map_entry k f ps)"
 
 lemma map_of_map_entry:
   "map_of (map_entry k f xs) =
     (map_of xs)(k := case map_of xs k of None \<Rightarrow> None | Some v' \<Rightarrow> Some (f v'))"
   by (induct xs) auto
 
 lemma dom_map_entry: "fst ` set (map_entry k f xs) = fst ` set xs"
   by (induct xs) auto
 
 lemma distinct_map_entry:
   assumes "distinct (map fst xs)"
   shows "distinct (map fst (map_entry k f xs))"
   using assms by (induct xs) (auto simp add: dom_map_entry)
 
 
 subsection \<open>\<open>map_default\<close>\<close>
 
 fun map_default :: "'key \<Rightarrow> 'val \<Rightarrow> ('val \<Rightarrow> 'val) \<Rightarrow> ('key \<times> 'val) list \<Rightarrow> ('key \<times> 'val) list"
   where
     "map_default k v f [] = [(k, v)]"
   | "map_default k v f (p # ps) =
       (if fst p = k then (k, f (snd p)) # ps else p # map_default k v f ps)"
 
 lemma map_of_map_default:
   "map_of (map_default k v f xs) =
     (map_of xs)(k := case map_of xs k of None \<Rightarrow> Some v | Some v' \<Rightarrow> Some (f v'))"
   by (induct xs) auto
 
 lemma dom_map_default: "fst ` set (map_default k v f xs) = insert k (fst ` set xs)"
   by (induct xs) auto
 
 lemma distinct_map_default:
   assumes "distinct (map fst xs)"
   shows "distinct (map fst (map_default k v f xs))"
   using assms by (induct xs) (auto simp add: dom_map_default)
 
 end
 
 end
diff --git a/src/HOL/Library/Mapping.thy b/src/HOL/Library/Mapping.thy
--- a/src/HOL/Library/Mapping.thy
+++ b/src/HOL/Library/Mapping.thy
@@ -1,934 +1,971 @@
 (*  Title:      HOL/Library/Mapping.thy
     Author:     Florian Haftmann and Ondrej Kuncar
 *)
 
 section \<open>An abstract view on maps for code generation.\<close>
 
 theory Mapping
 imports Main AList
 begin
 
 subsection \<open>Parametricity transfer rules\<close>
 
 lemma map_of_foldr: "map_of xs = foldr (\<lambda>(k, v) m. m(k \<mapsto> v)) xs Map.empty"  (* FIXME move *)
   using map_add_map_of_foldr [of Map.empty] by auto
 
 context includes lifting_syntax
 begin
 
 lemma empty_parametric: "(A ===> rel_option B) Map.empty Map.empty"
   by transfer_prover
 
 lemma lookup_parametric: "((A ===> B) ===> A ===> B) (\<lambda>m k. m k) (\<lambda>m k. m k)"
   by transfer_prover
 
 lemma update_parametric:
   assumes [transfer_rule]: "bi_unique A"
   shows "(A ===> B ===> (A ===> rel_option B) ===> A ===> rel_option B)
     (\<lambda>k v m. m(k \<mapsto> v)) (\<lambda>k v m. m(k \<mapsto> v))"
   by transfer_prover
 
 lemma delete_parametric:
   assumes [transfer_rule]: "bi_unique A"
   shows "(A ===> (A ===> rel_option B) ===> A ===> rel_option B)
     (\<lambda>k m. m(k := None)) (\<lambda>k m. m(k := None))"
   by transfer_prover
 
 lemma is_none_parametric [transfer_rule]:
   "(rel_option A ===> HOL.eq) Option.is_none Option.is_none"
   by (auto simp add: Option.is_none_def rel_fun_def rel_option_iff split: option.split)
 
 lemma dom_parametric:
   assumes [transfer_rule]: "bi_total A"
   shows "((A ===> rel_option B) ===> rel_set A) dom dom"
   unfolding dom_def [abs_def] Option.is_none_def [symmetric] by transfer_prover
 
 lemma graph_parametric:
   assumes "bi_total A"
   shows "((A ===> rel_option B) ===> rel_set (rel_prod A B)) Map.graph Map.graph"
 proof
   fix f g assume "(A ===> rel_option B) f g"
   with assms[unfolded bi_total_def] show "rel_set (rel_prod A B) (Map.graph f) (Map.graph g)"
     unfolding graph_def rel_set_def rel_fun_def
     by auto (metis option_rel_Some1 option_rel_Some2)+
 qed
 
 lemma map_of_parametric [transfer_rule]:
   assumes [transfer_rule]: "bi_unique R1"
   shows "(list_all2 (rel_prod R1 R2) ===> R1 ===> rel_option R2) map_of map_of"
   unfolding map_of_def by transfer_prover
 
 lemma map_entry_parametric [transfer_rule]:
   assumes [transfer_rule]: "bi_unique A"
   shows "(A ===> (B ===> B) ===> (A ===> rel_option B) ===> A ===> rel_option B)
     (\<lambda>k f m. (case m k of None \<Rightarrow> m
       | Some v \<Rightarrow> m (k \<mapsto> (f v)))) (\<lambda>k f m. (case m k of None \<Rightarrow> m
       | Some v \<Rightarrow> m (k \<mapsto> (f v))))"
   by transfer_prover
 
 lemma tabulate_parametric:
   assumes [transfer_rule]: "bi_unique A"
   shows "(list_all2 A ===> (A ===> B) ===> A ===> rel_option B)
     (\<lambda>ks f. (map_of (map (\<lambda>k. (k, f k)) ks))) (\<lambda>ks f. (map_of (map (\<lambda>k. (k, f k)) ks)))"
   by transfer_prover
 
 lemma bulkload_parametric:
   "(list_all2 A ===> HOL.eq ===> rel_option A)
     (\<lambda>xs k. if k < length xs then Some (xs ! k) else None)
     (\<lambda>xs k. if k < length xs then Some (xs ! k) else None)"
 proof
   fix xs ys
   assume "list_all2 A xs ys"
   then show
     "(HOL.eq ===> rel_option A)
       (\<lambda>k. if k < length xs then Some (xs ! k) else None)
       (\<lambda>k. if k < length ys then Some (ys ! k) else None)"
     apply induct
      apply auto
     unfolding rel_fun_def
     apply clarsimp
     apply (case_tac xa)
      apply (auto dest: list_all2_lengthD list_all2_nthD)
     done
 qed
 
 lemma map_parametric:
   "((A ===> B) ===> (C ===> D) ===> (B ===> rel_option C) ===> A ===> rel_option D)
      (\<lambda>f g m. (map_option g \<circ> m \<circ> f)) (\<lambda>f g m. (map_option g \<circ> m \<circ> f))"
   by transfer_prover
 
 lemma combine_with_key_parametric:
   "((A ===> B ===> B ===> B) ===> (A ===> rel_option B) ===> (A ===> rel_option B) ===>
     (A ===> rel_option B)) (\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x))
     (\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x))"
   unfolding combine_options_def by transfer_prover
 
 lemma combine_parametric:
   "((B ===> B ===> B) ===> (A ===> rel_option B) ===> (A ===> rel_option B) ===>
     (A ===> rel_option B)) (\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x))
     (\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x))"
   unfolding combine_options_def by transfer_prover
 
 end
 
 
 subsection \<open>Type definition and primitive operations\<close>
 
 typedef ('a, 'b) mapping = "UNIV :: ('a \<rightharpoonup> 'b) set"
   morphisms rep Mapping ..
 
 setup_lifting type_definition_mapping
 
 lift_definition empty :: "('a, 'b) mapping"
   is Map.empty parametric empty_parametric .
 
 lift_definition lookup :: "('a, 'b) mapping \<Rightarrow> 'a \<Rightarrow> 'b option"
   is "\<lambda>m k. m k" parametric lookup_parametric .
 
 definition "lookup_default d m k = (case Mapping.lookup m k of None \<Rightarrow> d | Some v \<Rightarrow> v)"
 
 lift_definition update :: "'a \<Rightarrow> 'b \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping"
   is "\<lambda>k v m. m(k \<mapsto> v)" parametric update_parametric .
 
 lift_definition delete :: "'a \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping"
   is "\<lambda>k m. m(k := None)" parametric delete_parametric .
 
 lift_definition filter :: "('a \<Rightarrow> 'b \<Rightarrow> bool) \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping"
   is "\<lambda>P m k. case m k of None \<Rightarrow> None | Some v \<Rightarrow> if P k v then Some v else None" .
 
 lift_definition keys :: "('a, 'b) mapping \<Rightarrow> 'a set"
   is dom parametric dom_parametric .
 
 lift_definition entries :: "('a, 'b) mapping \<Rightarrow> ('a \<times> 'b) set"
   is Map.graph parametric graph_parametric .
 
 lift_definition tabulate :: "'a list \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> ('a, 'b) mapping"
   is "\<lambda>ks f. (map_of (List.map (\<lambda>k. (k, f k)) ks))" parametric tabulate_parametric .
 
 lift_definition bulkload :: "'a list \<Rightarrow> (nat, 'a) mapping"
   is "\<lambda>xs k. if k < length xs then Some (xs ! k) else None" parametric bulkload_parametric .
 
 lift_definition map :: "('c \<Rightarrow> 'a) \<Rightarrow> ('b \<Rightarrow> 'd) \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('c, 'd) mapping"
   is "\<lambda>f g m. (map_option g \<circ> m \<circ> f)" parametric map_parametric .
 
 lift_definition map_values :: "('c \<Rightarrow> 'a \<Rightarrow> 'b) \<Rightarrow> ('c, 'a) mapping \<Rightarrow> ('c, 'b) mapping"
   is "\<lambda>f m x. map_option (f x) (m x)" .
 
 lift_definition combine_with_key ::
   "('a \<Rightarrow> 'b \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> ('a,'b) mapping \<Rightarrow> ('a,'b) mapping \<Rightarrow> ('a,'b) mapping"
   is "\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x)" parametric combine_with_key_parametric .
 
 lift_definition combine ::
   "('b \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> ('a,'b) mapping \<Rightarrow> ('a,'b) mapping \<Rightarrow> ('a,'b) mapping"
   is "\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x)" parametric combine_parametric .
 
 definition "All_mapping m P \<longleftrightarrow>
   (\<forall>x. case Mapping.lookup m x of None \<Rightarrow> True | Some y \<Rightarrow> P x y)"
 
 declare [[code drop: map]]
 
 
 subsection \<open>Functorial structure\<close>
 
 functor map: map
   by (transfer, auto simp add: fun_eq_iff option.map_comp option.map_id)+
 
 
 subsection \<open>Derived operations\<close>
 
 definition ordered_keys :: "('a::linorder, 'b) mapping \<Rightarrow> 'a list"
   where "ordered_keys m = (if finite (keys m) then sorted_list_of_set (keys m) else [])"
 
 definition ordered_entries :: "('a::linorder, 'b) mapping \<Rightarrow> ('a \<times> 'b) list"
   where "ordered_entries m = (if finite (entries m) then sorted_key_list_of_set fst (entries m)
                                                     else [])"
 
 definition fold :: "('a::linorder \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'c) \<Rightarrow> ('a, 'b) mapping \<Rightarrow> 'c \<Rightarrow> 'c"
   where "fold f m a = List.fold (case_prod f) (ordered_entries m) a"
 
 definition is_empty :: "('a, 'b) mapping \<Rightarrow> bool"
   where "is_empty m \<longleftrightarrow> keys m = {}"
 
 definition size :: "('a, 'b) mapping \<Rightarrow> nat"
   where "size m = (if finite (keys m) then card (keys m) else 0)"
 
 definition replace :: "'a \<Rightarrow> 'b \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping"
   where "replace k v m = (if k \<in> keys m then update k v m else m)"
 
 definition default :: "'a \<Rightarrow> 'b \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping"
   where "default k v m = (if k \<in> keys m then m else update k v m)"
 
 text \<open>Manual derivation of transfer rule is non-trivial\<close>
 
 lift_definition map_entry :: "'a \<Rightarrow> ('b \<Rightarrow> 'b) \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping" is
   "\<lambda>k f m.
     (case m k of
       None \<Rightarrow> m
     | Some v \<Rightarrow> m (k \<mapsto> (f v)))" parametric map_entry_parametric .
 
 lemma map_entry_code [code]:
   "map_entry k f m =
     (case lookup m k of
       None \<Rightarrow> m
     | Some v \<Rightarrow> update k (f v) m)"
   by transfer rule
 
 definition map_default :: "'a \<Rightarrow> 'b \<Rightarrow> ('b \<Rightarrow> 'b) \<Rightarrow> ('a, 'b) mapping \<Rightarrow> ('a, 'b) mapping"
   where "map_default k v f m = map_entry k f (default k v m)"
 
 definition of_alist :: "('k \<times> 'v) list \<Rightarrow> ('k, 'v) mapping"
   where "of_alist xs = foldr (\<lambda>(k, v) m. update k v m) xs empty"
 
 instantiation mapping :: (type, type) equal
 begin
 
 definition "HOL.equal m1 m2 \<longleftrightarrow> (\<forall>k. lookup m1 k = lookup m2 k)"
 
 instance
   apply standard
   unfolding equal_mapping_def
   apply transfer
   apply auto
   done
 
 end
 
 context includes lifting_syntax
 begin
 
 lemma [transfer_rule]:
   assumes [transfer_rule]: "bi_total A"
     and [transfer_rule]: "bi_unique B"
   shows "(pcr_mapping A B ===> pcr_mapping A B ===> (=)) HOL.eq HOL.equal"
   unfolding equal by transfer_prover
 
 lemma of_alist_transfer [transfer_rule]:
   assumes [transfer_rule]: "bi_unique R1"
   shows "(list_all2 (rel_prod R1 R2) ===> pcr_mapping R1 R2) map_of of_alist"
   unfolding of_alist_def [abs_def] map_of_foldr [abs_def] by transfer_prover
 
 end
 
 
 subsection \<open>Properties\<close>
 
 lemma mapping_eqI: "(\<And>x. lookup m x = lookup m' x) \<Longrightarrow> m = m'"
   by transfer (simp add: fun_eq_iff)
 
 lemma mapping_eqI':
   assumes "\<And>x. x \<in> Mapping.keys m \<Longrightarrow> Mapping.lookup_default d m x = Mapping.lookup_default d m' x"
     and "Mapping.keys m = Mapping.keys m'"
   shows "m = m'"
 proof (intro mapping_eqI)
   show "Mapping.lookup m x = Mapping.lookup m' x" for x
   proof (cases "Mapping.lookup m x")
     case None
     then have "x \<notin> Mapping.keys m"
       by transfer (simp add: dom_def)
     then have "x \<notin> Mapping.keys m'"
       by (simp add: assms)
     then have "Mapping.lookup m' x = None"
       by transfer (simp add: dom_def)
     with None show ?thesis
       by simp
   next
     case (Some y)
     then have A: "x \<in> Mapping.keys m"
       by transfer (simp add: dom_def)
     then have "x \<in> Mapping.keys m'"
       by (simp add: assms)
     then have "\<exists>y'. Mapping.lookup m' x = Some y'"
       by transfer (simp add: dom_def)
     with Some assms(1)[OF A] show ?thesis
       by (auto simp add: lookup_default_def)
   qed
 qed
 
-lemma lookup_update: "lookup (update k v m) k = Some v"
+lemma lookup_update[simp]: "lookup (update k v m) k = Some v"
   by transfer simp
 
-lemma lookup_update_neq: "k \<noteq> k' \<Longrightarrow> lookup (update k v m) k' = lookup m k'"
+lemma lookup_update_neq[simp]: "k \<noteq> k' \<Longrightarrow> lookup (update k v m) k' = lookup m k'"
   by transfer simp
 
-lemma lookup_update': "Mapping.lookup (update k v m) k' = (if k = k' then Some v else lookup m k')"
-  by (auto simp: lookup_update lookup_update_neq)
+lemma lookup_update': "lookup (update k v m) k' = (if k = k' then Some v else lookup m k')"
+  by transfer simp
 
-lemma lookup_empty: "lookup empty k = None"
+lemma lookup_empty[simp]: "lookup empty k = None"
+  by transfer simp
+
+lemma lookup_delete[simp]: "lookup (delete k m) k = None"
+  by transfer simp
+
+lemma lookup_delete_neq[simp]: "k \<noteq> k' \<Longrightarrow> lookup (delete k m) k' = lookup m k'"
   by transfer simp
 
 lemma lookup_filter:
   "lookup (filter P m) k =
     (case lookup m k of
       None \<Rightarrow> None
     | Some v \<Rightarrow> if P k v then Some v else None)"
   by transfer simp_all
 
 lemma lookup_map_values: "lookup (map_values f m) k = map_option (f k) (lookup m k)"
   by transfer simp_all
 
 lemma lookup_default_empty: "lookup_default d empty k = d"
   by (simp add: lookup_default_def lookup_empty)
 
 lemma lookup_default_update: "lookup_default d (update k v m) k = v"
-  by (simp add: lookup_default_def lookup_update)
+  by (simp add: lookup_default_def)
 
 lemma lookup_default_update_neq:
   "k \<noteq> k' \<Longrightarrow> lookup_default d (update k v m) k' = lookup_default d m k'"
-  by (simp add: lookup_default_def lookup_update_neq)
+  by (simp add: lookup_default_def)
 
 lemma lookup_default_update':
   "lookup_default d (update k v m) k' = (if k = k' then v else lookup_default d m k')"
   by (auto simp: lookup_default_update lookup_default_update_neq)
 
 lemma lookup_default_filter:
   "lookup_default d (filter P m) k =
      (if P k (lookup_default d m k) then lookup_default d m k else d)"
   by (simp add: lookup_default_def lookup_filter split: option.splits)
 
 lemma lookup_default_map_values:
   "lookup_default (f k d) (map_values f m) k = f k (lookup_default d m k)"
   by (simp add: lookup_default_def lookup_map_values split: option.splits)
 
 lemma lookup_combine_with_key:
   "Mapping.lookup (combine_with_key f m1 m2) x =
     combine_options (f x) (Mapping.lookup m1 x) (Mapping.lookup m2 x)"
   by transfer (auto split: option.splits)
 
 lemma combine_altdef: "combine f m1 m2 = combine_with_key (\<lambda>_. f) m1 m2"
   by transfer' (rule refl)
 
 lemma lookup_combine:
   "Mapping.lookup (combine f m1 m2) x =
      combine_options f (Mapping.lookup m1 x) (Mapping.lookup m2 x)"
   by transfer (auto split: option.splits)
 
 lemma lookup_default_neutral_combine_with_key:
   assumes "\<And>x. f k d x = x" "\<And>x. f k x d = x"
   shows "Mapping.lookup_default d (combine_with_key f m1 m2) k =
     f k (Mapping.lookup_default d m1 k) (Mapping.lookup_default d m2 k)"
   by (auto simp: lookup_default_def lookup_combine_with_key assms split: option.splits)
 
 lemma lookup_default_neutral_combine:
   assumes "\<And>x. f d x = x" "\<And>x. f x d = x"
   shows "Mapping.lookup_default d (combine f m1 m2) x =
     f (Mapping.lookup_default d m1 x) (Mapping.lookup_default d m2 x)"
   by (auto simp: lookup_default_def lookup_combine assms split: option.splits)
 
 lemma lookup_map_entry: "lookup (map_entry x f m) x = map_option f (lookup m x)"
   by transfer (auto split: option.splits)
 
 lemma lookup_map_entry_neq: "x \<noteq> y \<Longrightarrow> lookup (map_entry x f m) y = lookup m y"
   by transfer (auto split: option.splits)
 
 lemma lookup_map_entry':
   "lookup (map_entry x f m) y =
      (if x = y then map_option f (lookup m y) else lookup m y)"
   by transfer (auto split: option.splits)
 
 lemma lookup_default: "lookup (default x d m) x = Some (lookup_default d m x)"
   unfolding lookup_default_def default_def
   by transfer (auto split: option.splits)
 
 lemma lookup_default_neq: "x \<noteq> y \<Longrightarrow> lookup (default x d m) y = lookup m y"
   unfolding lookup_default_def default_def
   by transfer (auto split: option.splits)
 
 lemma lookup_default':
   "lookup (default x d m) y =
     (if x = y then Some (lookup_default d m x) else lookup m y)"
   unfolding lookup_default_def default_def
   by transfer (auto split: option.splits)
 
 lemma lookup_map_default: "lookup (map_default x d f m) x = Some (f (lookup_default d m x))"
   unfolding lookup_default_def default_def
   by (simp add: map_default_def lookup_map_entry lookup_default lookup_default_def)
 
 lemma lookup_map_default_neq: "x \<noteq> y \<Longrightarrow> lookup (map_default x d f m) y = lookup m y"
   unfolding lookup_default_def default_def
   by (simp add: map_default_def lookup_map_entry_neq lookup_default_neq)
 
 lemma lookup_map_default':
   "lookup (map_default x d f m) y =
     (if x = y then Some (f (lookup_default d m x)) else lookup m y)"
   unfolding lookup_default_def default_def
   by (simp add: map_default_def lookup_map_entry' lookup_default' lookup_default_def)
 
 lemma lookup_tabulate:
   assumes "distinct xs"
   shows "Mapping.lookup (Mapping.tabulate xs f) x = (if x \<in> set xs then Some (f x) else None)"
   using assms by transfer (auto simp: map_of_eq_None_iff o_def dest!: map_of_SomeD)
 
-lemma lookup_of_alist: "Mapping.lookup (Mapping.of_alist xs) k = map_of xs k"
+lemma lookup_of_alist: "lookup (of_alist xs) k = map_of xs k"
   by transfer simp_all
 
 lemma keys_is_none_rep [code_unfold]: "k \<in> keys m \<longleftrightarrow> \<not> (Option.is_none (lookup m k))"
   by transfer (auto simp add: Option.is_none_def)
 
 lemma update_update:
   "update k v (update k w m) = update k v m"
   "k \<noteq> l \<Longrightarrow> update k v (update l w m) = update l w (update k v m)"
   by (transfer; simp add: fun_upd_twist)+
 
 lemma update_delete [simp]: "update k v (delete k m) = update k v m"
   by transfer simp
 
 lemma delete_update:
   "delete k (update k v m) = delete k m"
   "k \<noteq> l \<Longrightarrow> delete k (update l v m) = update l v (delete k m)"
   by (transfer; simp add: fun_upd_twist)+
 
 lemma delete_empty [simp]: "delete k empty = empty"
   by transfer simp
 
+lemma Mapping_delete_if_notin_keys[simp]:
+  "k \<notin> keys m \<Longrightarrow> delete k m = m"
+  by transfer simp
+
 lemma replace_update:
   "k \<notin> keys m \<Longrightarrow> replace k v m = m"
   "k \<in> keys m \<Longrightarrow> replace k v m = update k v m"
   by (transfer; auto simp add: replace_def fun_upd_twist)+
 
 lemma map_values_update: "map_values f (update k v m) = update k (f k v) (map_values f m)"
   by transfer (simp_all add: fun_eq_iff)
 
 lemma size_mono: "finite (keys m') \<Longrightarrow> keys m \<subseteq> keys m' \<Longrightarrow> size m \<le> size m'"
   unfolding size_def by (auto intro: card_mono)
 
 lemma size_empty [simp]: "size empty = 0"
   unfolding size_def by transfer simp
 
 lemma size_update:
   "finite (keys m) \<Longrightarrow> size (update k v m) =
     (if k \<in> keys m then size m else Suc (size m))"
   unfolding size_def by transfer (auto simp add: insert_dom)
 
 lemma size_delete: "size (delete k m) = (if k \<in> keys m then size m - 1 else size m)"
   unfolding size_def by transfer simp
 
 lemma size_tabulate [simp]: "size (tabulate ks f) = length (remdups ks)"
   unfolding size_def by transfer (auto simp add: map_of_map_restrict card_set comp_def)
 
 lemma keys_filter: "keys (filter P m) \<subseteq> keys m"
   by transfer (auto split: option.splits)
 
 lemma size_filter: "finite (keys m) \<Longrightarrow> size (filter P m) \<le> size m"
   by (intro size_mono keys_filter)
 
 lemma bulkload_tabulate: "bulkload xs = tabulate [0..<length xs] (nth xs)"
   by transfer (auto simp add: map_of_map_restrict)
 
 lemma is_empty_empty [simp]: "is_empty empty"
   unfolding is_empty_def by transfer simp
 
 lemma is_empty_update [simp]: "\<not> is_empty (update k v m)"
   unfolding is_empty_def by transfer simp
 
 lemma is_empty_delete: "is_empty (delete k m) \<longleftrightarrow> is_empty m \<or> keys m = {k}"
   unfolding is_empty_def by transfer (auto simp del: dom_eq_empty_conv)
 
 lemma is_empty_replace [simp]: "is_empty (replace k v m) \<longleftrightarrow> is_empty m"
   unfolding is_empty_def replace_def by transfer auto
 
 lemma is_empty_default [simp]: "\<not> is_empty (default k v m)"
   unfolding is_empty_def default_def by transfer auto
 
 lemma is_empty_map_entry [simp]: "is_empty (map_entry k f m) \<longleftrightarrow> is_empty m"
   unfolding is_empty_def by transfer (auto split: option.split)
 
 lemma is_empty_map_values [simp]: "is_empty (map_values f m) \<longleftrightarrow> is_empty m"
   unfolding is_empty_def by transfer (auto simp: fun_eq_iff)
 
 lemma is_empty_map_default [simp]: "\<not> is_empty (map_default k v f m)"
   by (simp add: map_default_def)
 
 lemma keys_dom_lookup: "keys m = dom (Mapping.lookup m)"
   by transfer rule
 
 lemma keys_empty [simp]: "keys empty = {}"
   by transfer (fact dom_empty)
 
 lemma in_keysD: "k \<in> keys m \<Longrightarrow> \<exists>v. lookup m k = Some v"
   by transfer (fact domD)
 
-lemma in_entriesI: "lookup m k = Some v \<Longrightarrow> (k, v) \<in> entries m"
-  by transfer (fact in_graphI)
-
 lemma keys_update [simp]: "keys (update k v m) = insert k (keys m)"
   by transfer simp
 
 lemma keys_delete [simp]: "keys (delete k m) = keys m - {k}"
   by transfer simp
 
 lemma keys_replace [simp]: "keys (replace k v m) = keys m"
   unfolding replace_def by transfer (simp add: insert_absorb)
 
 lemma keys_default [simp]: "keys (default k v m) = insert k (keys m)"
   unfolding default_def by transfer (simp add: insert_absorb)
 
 lemma keys_map_entry [simp]: "keys (map_entry k f m) = keys m"
   by transfer (auto split: option.split)
 
 lemma keys_map_default [simp]: "keys (map_default k v f m) = insert k (keys m)"
   by (simp add: map_default_def)
 
 lemma keys_map_values [simp]: "keys (map_values f m) = keys m"
   by transfer (simp_all add: dom_def)
 
 lemma keys_combine_with_key [simp]:
   "Mapping.keys (combine_with_key f m1 m2) = Mapping.keys m1 \<union> Mapping.keys m2"
   by transfer (auto simp: dom_def combine_options_def split: option.splits)
 
 lemma keys_combine [simp]: "Mapping.keys (combine f m1 m2) = Mapping.keys m1 \<union> Mapping.keys m2"
   by (simp add: combine_altdef)
 
 lemma keys_tabulate [simp]: "keys (tabulate ks f) = set ks"
   by transfer (simp add: map_of_map_restrict o_def)
 
 lemma keys_of_alist [simp]: "keys (of_alist xs) = set (List.map fst xs)"
   by transfer (simp_all add: dom_map_of_conv_image_fst)
 
 lemma keys_bulkload [simp]: "keys (bulkload xs) = {0..<length xs}"
   by (simp add: bulkload_tabulate)
 
+lemma finite_keys_update[simp]:
+  "finite (keys (update k v m)) = finite (keys m)"
+  by transfer simp
+
+lemma set_ordered_keys[simp]:
+  "finite (Mapping.keys m) \<Longrightarrow> set (Mapping.ordered_keys m) = Mapping.keys m"
+  unfolding ordered_keys_def by transfer auto
+
 lemma distinct_ordered_keys [simp]: "distinct (ordered_keys m)"
   by (simp add: ordered_keys_def)
 
 lemma ordered_keys_infinite [simp]: "\<not> finite (keys m) \<Longrightarrow> ordered_keys m = []"
   by (simp add: ordered_keys_def)
 
 lemma ordered_keys_empty [simp]: "ordered_keys empty = []"
   by (simp add: ordered_keys_def)
 
+lemma sorted_ordered_keys[simp]: "sorted (ordered_keys m)"
+  unfolding ordered_keys_def by simp
+
 lemma ordered_keys_update [simp]:
   "k \<in> keys m \<Longrightarrow> ordered_keys (update k v m) = ordered_keys m"
   "finite (keys m) \<Longrightarrow> k \<notin> keys m \<Longrightarrow>
     ordered_keys (update k v m) = insort k (ordered_keys m)"
   by (simp_all add: ordered_keys_def)
      (auto simp only: sorted_list_of_set_insert_remove[symmetric] insert_absorb)
 
 lemma ordered_keys_delete [simp]: "ordered_keys (delete k m) = remove1 k (ordered_keys m)"
 proof (cases "finite (keys m)")
   case False
   then show ?thesis by simp
 next
   case fin: True
   show ?thesis
   proof (cases "k \<in> keys m")
     case False
     with fin have "k \<notin> set (sorted_list_of_set (keys m))"
       by simp
     with False show ?thesis
       by (simp add: ordered_keys_def remove1_idem)
   next
     case True
     with fin show ?thesis
       by (simp add: ordered_keys_def sorted_list_of_set_remove)
   qed
 qed
 
 lemma ordered_keys_replace [simp]: "ordered_keys (replace k v m) = ordered_keys m"
   by (simp add: replace_def)
 
 lemma ordered_keys_default [simp]:
   "k \<in> keys m \<Longrightarrow> ordered_keys (default k v m) = ordered_keys m"
   "finite (keys m) \<Longrightarrow> k \<notin> keys m \<Longrightarrow> ordered_keys (default k v m) = insort k (ordered_keys m)"
   by (simp_all add: default_def)
 
 lemma ordered_keys_map_entry [simp]: "ordered_keys (map_entry k f m) = ordered_keys m"
   by (simp add: ordered_keys_def)
 
 lemma ordered_keys_map_default [simp]:
   "k \<in> keys m \<Longrightarrow> ordered_keys (map_default k v f m) = ordered_keys m"
   "finite (keys m) \<Longrightarrow> k \<notin> keys m \<Longrightarrow> ordered_keys (map_default k v f m) = insort k (ordered_keys m)"
   by (simp_all add: map_default_def)
 
 lemma ordered_keys_tabulate [simp]: "ordered_keys (tabulate ks f) = sort (remdups ks)"
   by (simp add: ordered_keys_def sorted_list_of_set_sort_remdups)
 
 lemma ordered_keys_bulkload [simp]: "ordered_keys (bulkload ks) = [0..<length ks]"
   by (simp add: ordered_keys_def)
 
 lemma tabulate_fold: "tabulate xs f = List.fold (\<lambda>k m. update k (f k) m) xs empty"
 proof transfer
   fix f :: "'a \<Rightarrow> 'b" and xs
   have "map_of (List.map (\<lambda>k. (k, f k)) xs) = foldr (\<lambda>k m. m(k \<mapsto> f k)) xs Map.empty"
     by (simp add: foldr_map comp_def map_of_foldr)
   also have "foldr (\<lambda>k m. m(k \<mapsto> f k)) xs = List.fold (\<lambda>k m. m(k \<mapsto> f k)) xs"
     by (rule foldr_fold) (simp add: fun_eq_iff)
   ultimately show "map_of (List.map (\<lambda>k. (k, f k)) xs) = List.fold (\<lambda>k m. m(k \<mapsto> f k)) xs Map.empty"
     by simp
 qed
 
 lemma All_mapping_mono:
   "(\<And>k v. k \<in> keys m \<Longrightarrow> P k v \<Longrightarrow> Q k v) \<Longrightarrow> All_mapping m P \<Longrightarrow> All_mapping m Q"
   unfolding All_mapping_def by transfer (auto simp: All_mapping_def dom_def split: option.splits)
 
 lemma All_mapping_empty [simp]: "All_mapping Mapping.empty P"
   by (auto simp: All_mapping_def lookup_empty)
 
 lemma All_mapping_update_iff:
   "All_mapping (Mapping.update k v m) P \<longleftrightarrow> P k v \<and> All_mapping m (\<lambda>k' v'. k = k' \<or> P k' v')"
   unfolding All_mapping_def
 proof safe
   assume "\<forall>x. case Mapping.lookup (Mapping.update k v m) x of None \<Rightarrow> True | Some y \<Rightarrow> P x y"
   then have *: "case Mapping.lookup (Mapping.update k v m) x of None \<Rightarrow> True | Some y \<Rightarrow> P x y" for x
     by blast
   from *[of k] show "P k v"
     by (simp add: lookup_update)
   show "case Mapping.lookup m x of None \<Rightarrow> True | Some v' \<Rightarrow> k = x \<or> P x v'" for x
     using *[of x] by (auto simp add: lookup_update' split: if_splits option.splits)
 next
   assume "P k v"
   assume "\<forall>x. case Mapping.lookup m x of None \<Rightarrow> True | Some v' \<Rightarrow> k = x \<or> P x v'"
   then have A: "case Mapping.lookup m x of None \<Rightarrow> True | Some v' \<Rightarrow> k = x \<or> P x v'" for x
     by blast
   show "case Mapping.lookup (Mapping.update k v m) x of None \<Rightarrow> True | Some xa \<Rightarrow> P x xa" for x
     using \<open>P k v\<close> A[of x] by (auto simp: lookup_update' split: option.splits)
 qed
 
 lemma All_mapping_update:
   "P k v \<Longrightarrow> All_mapping m (\<lambda>k' v'. k = k' \<or> P k' v') \<Longrightarrow> All_mapping (Mapping.update k v m) P"
   by (simp add: All_mapping_update_iff)
 
 lemma All_mapping_filter_iff: "All_mapping (filter P m) Q \<longleftrightarrow> All_mapping m (\<lambda>k v. P k v \<longrightarrow> Q k v)"
   by (auto simp: All_mapping_def lookup_filter split: option.splits)
 
 lemma All_mapping_filter: "All_mapping m Q \<Longrightarrow> All_mapping (filter P m) Q"
   by (auto simp: All_mapping_filter_iff intro: All_mapping_mono)
 
 lemma All_mapping_map_values: "All_mapping (map_values f m) P \<longleftrightarrow> All_mapping m (\<lambda>k v. P k (f k v))"
   by (auto simp: All_mapping_def lookup_map_values split: option.splits)
 
 lemma All_mapping_tabulate: "(\<forall>x\<in>set xs. P x (f x)) \<Longrightarrow> All_mapping (Mapping.tabulate xs f) P"
   unfolding All_mapping_def
   apply (intro allI)
   apply transfer
   apply (auto split: option.split dest!: map_of_SomeD)
   done
 
 lemma All_mapping_alist:
   "(\<And>k v. (k, v) \<in> set xs \<Longrightarrow> P k v) \<Longrightarrow> All_mapping (Mapping.of_alist xs) P"
   by (auto simp: All_mapping_def lookup_of_alist dest!: map_of_SomeD split: option.splits)
 
 lemma combine_empty [simp]: "combine f Mapping.empty y = y" "combine f y Mapping.empty = y"
   by (transfer; force)+
 
 lemma (in abel_semigroup) comm_monoid_set_combine: "comm_monoid_set (combine f) Mapping.empty"
   by standard (transfer fixing: f, simp add: combine_options_ac[of f] ac_simps)+
 
 locale combine_mapping_abel_semigroup = abel_semigroup
 begin
 
 sublocale combine: comm_monoid_set "combine f" Mapping.empty
   by (rule comm_monoid_set_combine)
 
 lemma fold_combine_code:
   "combine.F g (set xs) = foldr (\<lambda>x. combine f (g x)) (remdups xs) Mapping.empty"
 proof -
   have "combine.F g (set xs) = foldr (\<lambda>x. combine f (g x)) xs Mapping.empty"
     if "distinct xs" for xs
     using that by (induction xs) simp_all
   from this[of "remdups xs"] show ?thesis by simp
 qed
 
 lemma keys_fold_combine: "finite A \<Longrightarrow> Mapping.keys (combine.F g A) = (\<Union>x\<in>A. Mapping.keys (g x))"
   by (induct A rule: finite_induct) simp_all
 
 end
 
 subsubsection \<open>@{term [source] entries}, @{term [source] ordered_entries},
                and @{term [source] fold}\<close>
 
 context linorder
 begin
 
 sublocale folding_Map_graph: folding_insort_key "(\<le>)" "(<)" "Map.graph m" fst for m
   by unfold_locales (fact inj_on_fst_graph)
 
 end
 
 lemma sorted_fst_list_of_set_insort_Map_graph[simp]:
   assumes "finite (dom m)" "fst x \<notin> dom m"
   shows "sorted_key_list_of_set fst (insert x (Map.graph m))
        = insort_key fst x (sorted_key_list_of_set fst (Map.graph m))"
 proof(cases x)
   case (Pair k v)
   with \<open>fst x \<notin> dom m\<close> have "Map.graph m \<subseteq> Map.graph (m(k \<mapsto> v))"
     by(auto simp: graph_def)
   moreover from Pair \<open>fst x \<notin> dom m\<close> have "(k, v) \<notin> Map.graph m"
     using graph_domD by fastforce
   ultimately show ?thesis
     using Pair assms folding_Map_graph.sorted_key_list_of_set_insert[where ?m="m(k \<mapsto> v)"]
     by auto
 qed
 
 lemma sorted_fst_list_of_set_insort_insert_Map_graph[simp]:
   assumes "finite (dom m)" "fst x \<notin> dom m"
   shows "sorted_key_list_of_set fst (insert x (Map.graph m))
        = insort_insert_key fst x (sorted_key_list_of_set fst (Map.graph m))"
 proof(cases x)
   case (Pair k v)
   with \<open>fst x \<notin> dom m\<close> have "Map.graph m \<subseteq> Map.graph (m(k \<mapsto> v))"
     by(auto simp: graph_def)    
   with assms Pair show ?thesis
     unfolding sorted_fst_list_of_set_insort_Map_graph[OF assms] insort_insert_key_def
     using folding_Map_graph.set_sorted_key_list_of_set in_graphD by (fastforce split: if_splits)
 qed
 
 lemma linorder_finite_Map_induct[consumes 1, case_names empty update]:
   fixes m :: "'a::linorder \<rightharpoonup> 'b"
   assumes "finite (dom m)"
   assumes "P Map.empty"
   assumes "\<And>k v m. \<lbrakk> finite (dom m); k \<notin> dom m; (\<And>k'. k' \<in> dom m \<Longrightarrow> k' \<le> k); P m \<rbrakk>
                     \<Longrightarrow> P (m(k \<mapsto> v))"
   shows "P m"
 proof -
   let ?key_list = "\<lambda>m. sorted_list_of_set (dom m)"
   from assms(1,2) show ?thesis
   proof(induction "length (?key_list m)" arbitrary: m)
     case 0
     then have "sorted_list_of_set (dom m) = []"
       by auto
     with \<open>finite (dom m)\<close> have "m = Map.empty"
        by auto
      with \<open>P Map.empty\<close> show ?case by simp
   next
     case (Suc n)
     then obtain x xs where x_xs: "sorted_list_of_set (dom m) = xs @ [x]"
       by (metis append_butlast_last_id length_greater_0_conv zero_less_Suc)
     have "sorted_list_of_set (dom (m(x := None))) = xs"
     proof -
       have "distinct (xs @ [x])"
         by (metis sorted_list_of_set.distinct_sorted_key_list_of_set x_xs)
       then have "remove1 x (xs @ [x]) = xs"
         by (simp add: remove1_append)
       with \<open>finite (dom m)\<close> x_xs show ?thesis
         by (simp add: sorted_list_of_set_remove)
     qed
     moreover have "k \<le> x" if "k \<in> dom (m(x := None))" for k
     proof -
       from x_xs have "sorted (xs @ [x])"
         by (metis sorted_list_of_set.sorted_sorted_key_list_of_set)
       moreover from \<open>k \<in> dom (m(x := None))\<close> have "k \<in> set xs"
         using \<open>finite (dom m)\<close> \<open>sorted_list_of_set (dom (m(x := None))) = xs\<close>
         by auto
       ultimately show "k \<le> x"
         by (simp add: sorted_append)
     qed     
     moreover from \<open>finite (dom m)\<close> have "finite (dom (m(x := None)))" "x \<notin> dom (m(x := None))"
       by simp_all
     moreover have "P (m(x := None))"
       using Suc \<open>sorted_list_of_set (dom (m(x := None))) = xs\<close> x_xs by auto
     ultimately show ?case
       using assms(3)[where ?m="m(x := None)"] by (metis fun_upd_triv fun_upd_upd not_Some_eq)
   qed
 qed
 
 lemma delete_insort_fst[simp]: "AList.delete k (insort_key fst (k, v) xs) = AList.delete k xs"
   by (induction xs) simp_all
 
 lemma insort_fst_delete: "\<lbrakk> fst x \<noteq> k2; sorted (List.map fst xs) \<rbrakk>
   \<Longrightarrow> insort_key fst x (AList.delete k2 xs) = AList.delete k2 (insort_key fst x xs)"
   by (induction xs) (fastforce simp add: insort_is_Cons order_trans)+
 
 lemma sorted_fst_list_of_set_Map_graph_fun_upd_None[simp]:
   "sorted_key_list_of_set fst (Map.graph (m(k := None)))
    = AList.delete k (sorted_key_list_of_set fst (Map.graph m))"
 proof(cases "finite (Map.graph m)")
   assume "finite (Map.graph m)"
   from this[unfolded finite_graph_iff_finite_dom] show ?thesis
   proof(induction rule: finite_Map_induct)
     let ?list_of="sorted_key_list_of_set fst"
     case (update k2 v2 m)
     note [simp] = \<open>k2 \<notin> dom m\<close> \<open>finite (dom m)\<close>
 
     have right_eq: "AList.delete k (?list_of (Map.graph (m(k2 \<mapsto> v2))))
       = AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))"
       by simp
 
     show ?case
     proof(cases "k = k2")
       case True
       then have "?list_of (Map.graph ((m(k2 \<mapsto> v2))(k := None)))
         = AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))"
         using fst_graph_eq_dom update.IH by auto
       then show ?thesis
         using right_eq by metis
     next
       case False
       then have "AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))
         = insort_key fst (k2, v2) (?list_of (Map.graph (m(k := None))))"
         by (auto simp add: insort_fst_delete update.IH
                       folding_Map_graph.sorted_sorted_key_list_of_set[OF subset_refl])
       also have "\<dots> = ?list_of (insert (k2, v2) (Map.graph (m(k := None))))"
         by auto
       also from False \<open>k2 \<notin> dom m\<close> have "\<dots> = ?list_of (Map.graph ((m(k2 \<mapsto> v2))(k := None)))"
         by (metis graph_map_upd domIff fun_upd_triv fun_upd_twist)
       finally show ?thesis using right_eq by metis
     qed
   qed simp
 qed simp
 
+lemma entries_empty[simp]: "entries empty = {}"
+  by transfer (fact graph_empty)
+
 lemma entries_lookup: "entries m = Map.graph (lookup m)"
   by transfer rule
 
-lemma entries_empty[simp]: "entries empty = {}"
-  by transfer (fact graph_empty)
+lemma in_entriesI: "lookup m k = Some v \<Longrightarrow> (k, v) \<in> entries m"
+  by transfer (fact in_graphI)
+
+lemma in_entriesD: "(k, v) \<in> entries m \<Longrightarrow> lookup m k = Some v"
+  by transfer (fact in_graphD)
+
+lemma fst_image_entries_eq_keys[simp]: "fst ` Mapping.entries m = Mapping.keys m"
+  by transfer (fact fst_graph_eq_dom)
 
 lemma finite_entries_iff_finite_keys[simp]:
   "finite (entries m) = finite (keys m)"
   by transfer (fact finite_graph_iff_finite_dom)
 
-lemma entries_update[simp]:
+lemma entries_update:
   "entries (update k v m) = insert (k, v) (entries (delete k m))"
   by transfer (fact graph_map_upd)
 
-lemma Mapping_delete_if_notin_keys[simp]:
-  "k \<notin> Mapping.keys m \<Longrightarrow> delete k m = m"
-  by transfer simp
-
 lemma entries_delete:
   "entries (delete k m) = {e \<in> entries m. fst e \<noteq> k}"
   by transfer (fact graph_fun_upd_None)
 
 lemma entries_of_alist[simp]:
   "distinct (List.map fst xs) \<Longrightarrow> entries (of_alist xs) = set xs"
-  by transfer (fact graph_map_of_if_distinct_ran)
+  by transfer (fact graph_map_of_if_distinct_dom)
 
 lemma entries_keysD:
   "x \<in> entries m \<Longrightarrow> fst x \<in> keys m"
   by transfer (fact graph_domD)
 
-lemma finite_keys_entries[simp]:
-  "finite (keys (update k v m)) = finite (keys m)"
-  by transfer simp
-
 lemma set_ordered_entries[simp]:
-  "finite (Mapping.keys m) \<Longrightarrow> set (ordered_entries m) = entries m"
+  "finite (keys m) \<Longrightarrow> set (ordered_entries m) = entries m"
   unfolding ordered_entries_def
   by transfer (auto simp: folding_Map_graph.set_sorted_key_list_of_set[OF subset_refl])
 
 lemma distinct_ordered_entries[simp]: "distinct (List.map fst (ordered_entries m))"
   unfolding ordered_entries_def
   by transfer (simp add: folding_Map_graph.distinct_sorted_key_list_of_set[OF subset_refl])
 
 lemma sorted_ordered_entries[simp]: "sorted (List.map fst (ordered_entries m))"
   unfolding ordered_entries_def
   by transfer (auto intro: folding_Map_graph.sorted_sorted_key_list_of_set)
 
 lemma ordered_entries_infinite[simp]:
   "\<not> finite (Mapping.keys m) \<Longrightarrow> ordered_entries m = []"
   by (simp add: ordered_entries_def)
 
 lemma ordered_entries_empty[simp]: "ordered_entries empty = []"
   by (simp add: ordered_entries_def)
 
 lemma ordered_entries_update[simp]:
   assumes "finite (keys m)"
   shows "ordered_entries (update k v m)
    = insort_insert_key fst (k, v) (AList.delete k (ordered_entries m))"
 proof -
   let ?list_of="sorted_key_list_of_set fst" and ?insort="insort_insert_key fst"
 
   have *: "?list_of (insert (k, v) (Map.graph (m(k := None))))
     = ?insort (k, v) (AList.delete k (?list_of (Map.graph m)))" if "finite (dom m)" for m
   proof -
     from \<open>finite (dom m)\<close> have "?list_of (insert (k, v) (Map.graph (m(k := None))))
       = ?insort (k, v) (?list_of (Map.graph (m(k := None))))"
       by (intro sorted_fst_list_of_set_insort_insert_Map_graph) (simp_all add: subset_insertI) 
     then show ?thesis by simp
   qed
   from assms show ?thesis
     unfolding ordered_entries_def
     apply (transfer fixing: k v) using "*" by auto
 qed
 
 lemma ordered_entries_delete[simp]:
   "ordered_entries (delete k m) = AList.delete k (ordered_entries m)"
   unfolding ordered_entries_def by transfer auto
 
+lemma map_fst_ordered_entries[simp]:
+  "List.map fst (ordered_entries m) = ordered_keys m"
+proof(cases "finite (Mapping.keys m)")
+  case True
+  then have "set (List.map fst (Mapping.ordered_entries m)) = set (Mapping.ordered_keys m)"
+    unfolding ordered_entries_def ordered_keys_def
+    by (transfer) (simp add: folding_Map_graph.set_sorted_key_list_of_set[OF subset_refl] fst_graph_eq_dom)
+  with True show "List.map fst (Mapping.ordered_entries m) = Mapping.ordered_keys m"
+    by (metis distinct_ordered_entries ordered_keys_def sorted_list_of_set.idem_if_sorted_distinct          
+              sorted_list_of_set.set_sorted_key_list_of_set sorted_ordered_entries)
+next
+  case False
+  then show ?thesis
+    unfolding ordered_entries_def ordered_keys_def by simp
+qed
+
 lemma fold_empty[simp]: "fold f empty a = a"
   unfolding fold_def by simp
 
 lemma insort_key_is_snoc_if_sorted_and_distinct:
   assumes "sorted (List.map f xs)" "f y \<notin> f ` set xs" "\<forall>x \<in> set xs. f x \<le> f y"
   shows "insort_key f y xs = xs @ [y]"
   using assms by (induction xs) (auto dest!: insort_is_Cons)
 
 lemma fold_update:
   assumes "finite (keys m)"
   assumes "k \<notin> keys m" "\<And>k'. k' \<in> keys m \<Longrightarrow> k' \<le> k"
   shows "fold f (update k v m) a = f k v (fold f m a)"
 proof -
   from assms have k_notin_entries: "k \<notin> fst ` set (ordered_entries m)"
     using entries_keysD by fastforce
   with assms have "ordered_entries (update k v m)
     = insort_insert_key fst (k, v) (ordered_entries m)"
     by simp
   also from k_notin_entries have "\<dots> = ordered_entries m @ [(k, v)]"
   proof -
     from assms have "\<forall>x \<in> set (ordered_entries m). fst x \<le> fst (k, v)"
       unfolding ordered_entries_def
       by transfer (fastforce simp: folding_Map_graph.set_sorted_key_list_of_set[OF order_refl]
                              dest: graph_domD)
-    from insort_key_is_snoc_if_sorted_and_distinct[OF _ _ this] k_notin_entries show ?thesis
+    from insort_key_is_snoc_if_sorted_and_distinct[OF _ _ this] k_notin_entries \<open>finite (keys m)\<close>
+    show ?thesis
+      using sorted_ordered_keys
       unfolding insort_insert_key_def by auto
   qed
   finally show ?thesis unfolding fold_def by simp
 qed
 
 lemma linorder_finite_Mapping_induct[consumes 1, case_names empty update]:
   fixes m :: "('a::linorder, 'b) mapping"
   assumes "finite (keys m)"
   assumes "P empty"
   assumes "\<And>k v m.
     \<lbrakk> finite (keys m); k \<notin> keys m; (\<And>k'. k' \<in> keys m \<Longrightarrow> k' \<le> k); P m \<rbrakk>
     \<Longrightarrow> P (update k v m)"
   shows "P m"
   using assms by transfer (simp add: linorder_finite_Map_induct)
 
 
 subsection \<open>Code generator setup\<close>
 
 hide_const (open) empty is_empty rep lookup lookup_default filter update delete ordered_keys
   keys size replace default map_entry map_default tabulate bulkload map map_values combine of_alist
   entries ordered_entries fold
 
 end
diff --git a/src/HOL/Library/RBT_Mapping.thy b/src/HOL/Library/RBT_Mapping.thy
--- a/src/HOL/Library/RBT_Mapping.thy
+++ b/src/HOL/Library/RBT_Mapping.thy
@@ -1,247 +1,247 @@
 (*  Title:      HOL/Library/RBT_Mapping.thy
     Author:     Florian Haftmann and Ondrej Kuncar
 *)
 
 section \<open>Implementation of mappings with Red-Black Trees\<close>
 
 (*<*)
 theory RBT_Mapping
 imports RBT Mapping
 begin
 
 subsection \<open>Implementation of mappings\<close>
 
 context includes rbt.lifting begin
 lift_definition Mapping :: "('a::linorder, 'b) rbt \<Rightarrow> ('a, 'b) mapping" is RBT.lookup .
 end
 
 code_datatype Mapping
 
 context includes rbt.lifting begin
 
 lemma lookup_Mapping [simp, code]:
   "Mapping.lookup (Mapping t) = RBT.lookup t"
    by (transfer fixing: t) rule
 
 lemma empty_Mapping [code]: "Mapping.empty = Mapping RBT.empty"
 proof -
   note RBT.empty.transfer[transfer_rule del]
   show ?thesis by transfer simp
 qed
 
 lemma is_empty_Mapping [code]:
   "Mapping.is_empty (Mapping t) \<longleftrightarrow> RBT.is_empty t"
   unfolding is_empty_def by (transfer fixing: t) simp
 
 lemma insert_Mapping [code]:
   "Mapping.update k v (Mapping t) = Mapping (RBT.insert k v t)"
   by (transfer fixing: t) simp
 
 lemma delete_Mapping [code]:
   "Mapping.delete k (Mapping t) = Mapping (RBT.delete k t)"
   by (transfer fixing: t) simp
 
 lemma map_entry_Mapping [code]:
   "Mapping.map_entry k f (Mapping t) = Mapping (RBT.map_entry k f t)"
   apply (transfer fixing: t)
   apply (case_tac "RBT.lookup t k")
    apply auto
   done
 
 lemma keys_Mapping [code]:
   "Mapping.keys (Mapping t) = set (RBT.keys t)"
 by (transfer fixing: t) (simp add: lookup_keys)
 
 lemma ordered_keys_Mapping [code]:
   "Mapping.ordered_keys (Mapping t) = RBT.keys t"
 unfolding ordered_keys_def 
 by (transfer fixing: t) (auto simp add: lookup_keys intro: sorted_distinct_set_unique)
 
 lemma Map_graph_lookup: "Map.graph (RBT.lookup t) = set (RBT.entries t)"
-  by (metis RBT.distinct_entries RBT.map_of_entries graph_map_of_if_distinct_ran)
+  by (metis RBT.distinct_entries RBT.map_of_entries graph_map_of_if_distinct_dom)
 
 lemma entries_Mapping [code]: "Mapping.entries (Mapping t) = set (RBT.entries t)"
   by (transfer fixing: t) (fact Map_graph_lookup)
 
 lemma ordered_entries_Mapping [code]: "Mapping.ordered_entries (Mapping t) = RBT.entries t"
 proof -
   note folding_Map_graph.idem_if_sorted_distinct[
       where ?m="RBT.lookup t", OF _ _ folding_Map_graph.distinct_if_distinct_map]
   then show ?thesis
     unfolding ordered_entries_def
     by (transfer fixing: t) (auto simp: Map_graph_lookup distinct_entries sorted_entries)
 qed
 
 lemma fold_Mapping [code]: "Mapping.fold f (Mapping t) a = RBT.fold f t a"
   by (simp add: Mapping.fold_def fold_fold ordered_entries_Mapping)
 
 lemma Mapping_size_card_keys: (*FIXME*)
   "Mapping.size m = card (Mapping.keys m)"
 unfolding size_def by transfer simp
 
 lemma size_Mapping [code]:
   "Mapping.size (Mapping t) = length (RBT.keys t)"
 unfolding size_def
 by (transfer fixing: t) (simp add: lookup_keys distinct_card)
 
 context
   notes RBT.bulkload.transfer[transfer_rule del]
 begin
 
 lemma tabulate_Mapping [code]:
   "Mapping.tabulate ks f = Mapping (RBT.bulkload (List.map (\<lambda>k. (k, f k)) ks))"
 by transfer (simp add: map_of_map_restrict)
 
 lemma bulkload_Mapping [code]:
   "Mapping.bulkload vs = Mapping (RBT.bulkload (List.map (\<lambda>n. (n, vs ! n)) [0..<length vs]))"
 by transfer (simp add: map_of_map_restrict fun_eq_iff)
 
 end
 
 lemma map_values_Mapping [code]: 
   "Mapping.map_values f (Mapping t) = Mapping (RBT.map f t)"
   by (transfer fixing: t) (auto simp: fun_eq_iff)
 
 lemma filter_Mapping [code]: 
   "Mapping.filter P (Mapping t) = Mapping (RBT.filter P t)"
   by (transfer' fixing: P t) (simp add: RBT.lookup_filter fun_eq_iff)
 
 lemma combine_with_key_Mapping [code]:
   "Mapping.combine_with_key f (Mapping t1) (Mapping t2) =
      Mapping (RBT.combine_with_key f t1 t2)"
   by (transfer fixing: f t1 t2) (simp_all add: fun_eq_iff)
 
 lemma combine_Mapping [code]:
   "Mapping.combine f (Mapping t1) (Mapping t2) =
      Mapping (RBT.combine f t1 t2)"
   by (transfer fixing: f t1 t2) (simp_all add: fun_eq_iff)
 
 lemma equal_Mapping [code]:
   "HOL.equal (Mapping t1) (Mapping t2) \<longleftrightarrow> RBT.entries t1 = RBT.entries t2"
   by (transfer fixing: t1 t2) (simp add: RBT.entries_lookup)
 
 lemma [code nbe]:
   "HOL.equal (x :: (_, _) mapping) x \<longleftrightarrow> True"
   by (fact equal_refl)
 
 end
 
 (*>*)
 
 text \<open>
   This theory defines abstract red-black trees as an efficient
   representation of finite maps, backed by the implementation
   in \<^theory>\<open>HOL-Library.RBT_Impl\<close>.
 \<close>
 
 subsection \<open>Data type and invariant\<close>
 
 text \<open>
   The type \<^typ>\<open>('k, 'v) RBT_Impl.rbt\<close> denotes red-black trees with
   keys of type \<^typ>\<open>'k\<close> and values of type \<^typ>\<open>'v\<close>. To function
   properly, the key type musorted belong to the \<open>linorder\<close>
   class.
 
   A value \<^term>\<open>t\<close> of this type is a valid red-black tree if it
   satisfies the invariant \<open>is_rbt t\<close>.  The abstract type \<^typ>\<open>('k, 'v) rbt\<close> always obeys this invariant, and for this reason you
   should only use this in our application.  Going back to \<^typ>\<open>('k,
   'v) RBT_Impl.rbt\<close> may be necessary in proofs if not yet proven
   properties about the operations must be established.
 
   The interpretation function \<^const>\<open>RBT.lookup\<close> returns the partial
   map represented by a red-black tree:
   @{term_type[display] "RBT.lookup"}
 
   This function should be used for reasoning about the semantics of the RBT
   operations. Furthermore, it implements the lookup functionality for
   the data structure: It is executable and the lookup is performed in
   $O(\log n)$.  
 \<close>
 
 subsection \<open>Operations\<close>
 
 text \<open>
   Currently, the following operations are supported:
 
   @{term_type [display] "RBT.empty"}
   Returns the empty tree. $O(1)$
 
   @{term_type [display] "RBT.insert"}
   Updates the map at a given position. $O(\log n)$
 
   @{term_type [display] "RBT.delete"}
   Deletes a map entry at a given position. $O(\log n)$
 
   @{term_type [display] "RBT.entries"}
   Return a corresponding key-value list for a tree.
 
   @{term_type [display] "RBT.bulkload"}
   Builds a tree from a key-value list.
 
   @{term_type [display] "RBT.map_entry"}
   Maps a single entry in a tree.
 
   @{term_type [display] "RBT.map"}
   Maps all values in a tree. $O(n)$
 
   @{term_type [display] "RBT.fold"}
   Folds over all entries in a tree. $O(n)$
 \<close>
 
 
 subsection \<open>Invariant preservation\<close>
 
 text \<open>
   \noindent
   @{thm Empty_is_rbt}\hfill(\<open>Empty_is_rbt\<close>)
 
   \noindent
   @{thm rbt_insert_is_rbt}\hfill(\<open>rbt_insert_is_rbt\<close>)
 
   \noindent
   @{thm rbt_delete_is_rbt}\hfill(\<open>delete_is_rbt\<close>)
 
   \noindent
   @{thm rbt_bulkload_is_rbt}\hfill(\<open>bulkload_is_rbt\<close>)
 
   \noindent
   @{thm rbt_map_entry_is_rbt}\hfill(\<open>map_entry_is_rbt\<close>)
 
   \noindent
   @{thm map_is_rbt}\hfill(\<open>map_is_rbt\<close>)
 
   \noindent
   @{thm rbt_union_is_rbt}\hfill(\<open>union_is_rbt\<close>)
 \<close>
 
 
 subsection \<open>Map Semantics\<close>
 
 text \<open>
   \noindent
   \underline{\<open>lookup_empty\<close>}
   @{thm [display] lookup_empty}
   \vspace{1ex}
 
   \noindent
   \underline{\<open>lookup_insert\<close>}
   @{thm [display] lookup_insert}
   \vspace{1ex}
 
   \noindent
   \underline{\<open>lookup_delete\<close>}
   @{thm [display] lookup_delete}
   \vspace{1ex}
 
   \noindent
   \underline{\<open>lookup_bulkload\<close>}
   @{thm [display] lookup_bulkload}
   \vspace{1ex}
 
   \noindent
   \underline{\<open>lookup_map\<close>}
   @{thm [display] lookup_map}
   \vspace{1ex}
 \<close>
 
 end
diff --git a/src/HOL/Map.thy b/src/HOL/Map.thy
--- a/src/HOL/Map.thy
+++ b/src/HOL/Map.thy
@@ -1,942 +1,942 @@
 (*  Title:      HOL/Map.thy
     Author:     Tobias Nipkow, based on a theory by David von Oheimb
     Copyright   1997-2003 TU Muenchen
 
 The datatype of "maps"; strongly resembles maps in VDM.
 *)
 
 section \<open>Maps\<close>
 
 theory Map
   imports List
   abbrevs "(=" = "\<subseteq>\<^sub>m"
 begin
 
 type_synonym ('a, 'b) "map" = "'a \<Rightarrow> 'b option" (infixr "\<rightharpoonup>" 0)
 
 abbreviation
   empty :: "'a \<rightharpoonup> 'b" where
   "empty \<equiv> \<lambda>x. None"
 
 definition
   map_comp :: "('b \<rightharpoonup> 'c) \<Rightarrow> ('a \<rightharpoonup> 'b) \<Rightarrow> ('a \<rightharpoonup> 'c)"  (infixl "\<circ>\<^sub>m" 55) where
   "f \<circ>\<^sub>m g = (\<lambda>k. case g k of None \<Rightarrow> None | Some v \<Rightarrow> f v)"
 
 definition
   map_add :: "('a \<rightharpoonup> 'b) \<Rightarrow> ('a \<rightharpoonup> 'b) \<Rightarrow> ('a \<rightharpoonup> 'b)"  (infixl "++" 100) where
   "m1 ++ m2 = (\<lambda>x. case m2 x of None \<Rightarrow> m1 x | Some y \<Rightarrow> Some y)"
 
 definition
   restrict_map :: "('a \<rightharpoonup> 'b) \<Rightarrow> 'a set \<Rightarrow> ('a \<rightharpoonup> 'b)"  (infixl "|`"  110) where
   "m|`A = (\<lambda>x. if x \<in> A then m x else None)"
 
 notation (latex output)
   restrict_map  ("_\<restriction>\<^bsub>_\<^esub>" [111,110] 110)
 
 definition
   dom :: "('a \<rightharpoonup> 'b) \<Rightarrow> 'a set" where
   "dom m = {a. m a \<noteq> None}"
 
 definition
   ran :: "('a \<rightharpoonup> 'b) \<Rightarrow> 'b set" where
   "ran m = {b. \<exists>a. m a = Some b}"
 
 definition
   graph :: "('a \<rightharpoonup> 'b) \<Rightarrow> ('a \<times> 'b) set" where
   "graph m = {(a, b) | a b. m a = Some b}"
 
 definition
   map_le :: "('a \<rightharpoonup> 'b) \<Rightarrow> ('a \<rightharpoonup> 'b) \<Rightarrow> bool"  (infix "\<subseteq>\<^sub>m" 50) where
   "(m\<^sub>1 \<subseteq>\<^sub>m m\<^sub>2) \<longleftrightarrow> (\<forall>a \<in> dom m\<^sub>1. m\<^sub>1 a = m\<^sub>2 a)"
 
 nonterminal maplets and maplet
 
 syntax
   "_maplet"  :: "['a, 'a] \<Rightarrow> maplet"             ("_ /\<mapsto>/ _")
   "_maplets" :: "['a, 'a] \<Rightarrow> maplet"             ("_ /[\<mapsto>]/ _")
   ""         :: "maplet \<Rightarrow> maplets"             ("_")
   "_Maplets" :: "[maplet, maplets] \<Rightarrow> maplets" ("_,/ _")
   "_MapUpd"  :: "['a \<rightharpoonup> 'b, maplets] \<Rightarrow> 'a \<rightharpoonup> 'b" ("_/'(_')" [900, 0] 900)
   "_Map"     :: "maplets \<Rightarrow> 'a \<rightharpoonup> 'b"            ("(1[_])")
 
 syntax (ASCII)
   "_maplet"  :: "['a, 'a] \<Rightarrow> maplet"             ("_ /|->/ _")
   "_maplets" :: "['a, 'a] \<Rightarrow> maplet"             ("_ /[|->]/ _")
 
 translations
   "_MapUpd m (_Maplets xy ms)"  \<rightleftharpoons> "_MapUpd (_MapUpd m xy) ms"
   "_MapUpd m (_maplet  x y)"    \<rightleftharpoons> "m(x := CONST Some y)"
   "_Map ms"                     \<rightleftharpoons> "_MapUpd (CONST empty) ms"
   "_Map (_Maplets ms1 ms2)"     \<leftharpoondown> "_MapUpd (_Map ms1) ms2"
   "_Maplets ms1 (_Maplets ms2 ms3)" \<leftharpoondown> "_Maplets (_Maplets ms1 ms2) ms3"
 
 primrec map_of :: "('a \<times> 'b) list \<Rightarrow> 'a \<rightharpoonup> 'b"
 where
   "map_of [] = empty"
 | "map_of (p # ps) = (map_of ps)(fst p \<mapsto> snd p)"
 
 definition map_upds :: "('a \<rightharpoonup> 'b) \<Rightarrow> 'a list \<Rightarrow> 'b list \<Rightarrow> 'a \<rightharpoonup> 'b"
   where "map_upds m xs ys = m ++ map_of (rev (zip xs ys))"
 translations
   "_MapUpd m (_maplets x y)" \<rightleftharpoons> "CONST map_upds m x y"
 
 lemma map_of_Cons_code [code]:
   "map_of [] k = None"
   "map_of ((l, v) # ps) k = (if l = k then Some v else map_of ps k)"
   by simp_all
 
 
 subsection \<open>@{term [source] empty}\<close>
 
 lemma empty_upd_none [simp]: "empty(x := None) = empty"
   by (rule ext) simp
 
 
 subsection \<open>@{term [source] map_upd}\<close>
 
 lemma map_upd_triv: "t k = Some x \<Longrightarrow> t(k\<mapsto>x) = t"
   by (rule ext) simp
 
 lemma map_upd_nonempty [simp]: "t(k\<mapsto>x) \<noteq> empty"
 proof
   assume "t(k \<mapsto> x) = empty"
   then have "(t(k \<mapsto> x)) k = None" by simp
   then show False by simp
 qed
 
 lemma map_upd_eqD1:
   assumes "m(a\<mapsto>x) = n(a\<mapsto>y)"
   shows "x = y"
 proof -
   from assms have "(m(a\<mapsto>x)) a = (n(a\<mapsto>y)) a" by simp
   then show ?thesis by simp
 qed
 
 lemma map_upd_Some_unfold:
   "((m(a\<mapsto>b)) x = Some y) = (x = a \<and> b = y \<or> x \<noteq> a \<and> m x = Some y)"
   by auto
 
 lemma image_map_upd [simp]: "x \<notin> A \<Longrightarrow> m(x \<mapsto> y) ` A = m ` A"
   by auto
 
 lemma finite_range_updI:
   assumes "finite (range f)" shows "finite (range (f(a\<mapsto>b)))"
 proof -
   have "range (f(a\<mapsto>b)) \<subseteq> insert (Some b) (range f)"
     by auto
   then show ?thesis
     by (rule finite_subset) (use assms in auto)
 qed
 
 
 subsection \<open>@{term [source] map_of}\<close>
 
 lemma map_of_eq_empty_iff [simp]:
   "map_of xys = empty \<longleftrightarrow> xys = []"
 proof
   show "map_of xys = empty \<Longrightarrow> xys = []"
     by (induction xys) simp_all
 qed simp
 
 lemma empty_eq_map_of_iff [simp]:
   "empty = map_of xys \<longleftrightarrow> xys = []"
 by(subst eq_commute) simp
 
 lemma map_of_eq_None_iff:
   "(map_of xys x = None) = (x \<notin> fst ` (set xys))"
 by (induct xys) simp_all
 
 lemma map_of_eq_Some_iff [simp]:
   "distinct(map fst xys) \<Longrightarrow> (map_of xys x = Some y) = ((x,y) \<in> set xys)"
 proof (induct xys)
   case (Cons xy xys)
   then show ?case
     by (cases xy) (auto simp flip: map_of_eq_None_iff)
 qed auto
 
 lemma Some_eq_map_of_iff [simp]:
   "distinct(map fst xys) \<Longrightarrow> (Some y = map_of xys x) = ((x,y) \<in> set xys)"
 by (auto simp del: map_of_eq_Some_iff simp: map_of_eq_Some_iff [symmetric])
 
 lemma map_of_is_SomeI [simp]: 
   "\<lbrakk>distinct(map fst xys); (x,y) \<in> set xys\<rbrakk> \<Longrightarrow> map_of xys x = Some y"
   by simp
 
 lemma map_of_zip_is_None [simp]:
   "length xs = length ys \<Longrightarrow> (map_of (zip xs ys) x = None) = (x \<notin> set xs)"
 by (induct rule: list_induct2) simp_all
 
 lemma map_of_zip_is_Some:
   assumes "length xs = length ys"
   shows "x \<in> set xs \<longleftrightarrow> (\<exists>y. map_of (zip xs ys) x = Some y)"
 using assms by (induct rule: list_induct2) simp_all
 
 lemma map_of_zip_upd:
   fixes x :: 'a and xs :: "'a list" and ys zs :: "'b list"
   assumes "length ys = length xs"
     and "length zs = length xs"
     and "x \<notin> set xs"
     and "map_of (zip xs ys)(x \<mapsto> y) = map_of (zip xs zs)(x \<mapsto> z)"
   shows "map_of (zip xs ys) = map_of (zip xs zs)"
 proof
   fix x' :: 'a
   show "map_of (zip xs ys) x' = map_of (zip xs zs) x'"
   proof (cases "x = x'")
     case True
     from assms True map_of_zip_is_None [of xs ys x']
       have "map_of (zip xs ys) x' = None" by simp
     moreover from assms True map_of_zip_is_None [of xs zs x']
       have "map_of (zip xs zs) x' = None" by simp
     ultimately show ?thesis by simp
   next
     case False from assms
       have "(map_of (zip xs ys)(x \<mapsto> y)) x' = (map_of (zip xs zs)(x \<mapsto> z)) x'" by auto
     with False show ?thesis by simp
   qed
 qed
 
 lemma map_of_zip_inject:
   assumes "length ys = length xs"
     and "length zs = length xs"
     and dist: "distinct xs"
     and map_of: "map_of (zip xs ys) = map_of (zip xs zs)"
   shows "ys = zs"
   using assms(1) assms(2)[symmetric]
   using dist map_of
 proof (induct ys xs zs rule: list_induct3)
   case Nil show ?case by simp
 next
   case (Cons y ys x xs z zs)
   from \<open>map_of (zip (x#xs) (y#ys)) = map_of (zip (x#xs) (z#zs))\<close>
     have map_of: "map_of (zip xs ys)(x \<mapsto> y) = map_of (zip xs zs)(x \<mapsto> z)" by simp
   from Cons have "length ys = length xs" and "length zs = length xs"
     and "x \<notin> set xs" by simp_all
   then have "map_of (zip xs ys) = map_of (zip xs zs)" using map_of by (rule map_of_zip_upd)
   with Cons.hyps \<open>distinct (x # xs)\<close> have "ys = zs" by simp
   moreover from map_of have "y = z" by (rule map_upd_eqD1)
   ultimately show ?case by simp
 qed
 
 lemma map_of_zip_nth:
   assumes "length xs = length ys"
   assumes "distinct xs"
   assumes "i < length ys"
   shows "map_of (zip xs ys) (xs ! i) = Some (ys ! i)"
 using assms proof (induct arbitrary: i rule: list_induct2)
   case Nil
   then show ?case by simp
 next
   case (Cons x xs y ys)
   then show ?case
     using less_Suc_eq_0_disj by auto
 qed
 
 lemma map_of_zip_map:
   "map_of (zip xs (map f xs)) = (\<lambda>x. if x \<in> set xs then Some (f x) else None)"
   by (induct xs) (simp_all add: fun_eq_iff)
 
 lemma finite_range_map_of: "finite (range (map_of xys))"
 proof (induct xys)
   case (Cons a xys)
   then show ?case
     using finite_range_updI by fastforce
 qed auto
 
 lemma map_of_SomeD: "map_of xs k = Some y \<Longrightarrow> (k, y) \<in> set xs"
   by (induct xs) (auto split: if_splits)
 
 lemma map_of_mapk_SomeI:
   "inj f \<Longrightarrow> map_of t k = Some x \<Longrightarrow>
    map_of (map (case_prod (\<lambda>k. Pair (f k))) t) (f k) = Some x"
 by (induct t) (auto simp: inj_eq)
 
 lemma weak_map_of_SomeI: "(k, x) \<in> set l \<Longrightarrow> \<exists>x. map_of l k = Some x"
 by (induct l) auto
 
 lemma map_of_filter_in:
   "map_of xs k = Some z \<Longrightarrow> P k z \<Longrightarrow> map_of (filter (case_prod P) xs) k = Some z"
 by (induct xs) auto
 
 lemma map_of_map:
   "map_of (map (\<lambda>(k, v). (k, f v)) xs) = map_option f \<circ> map_of xs"
   by (induct xs) (auto simp: fun_eq_iff)
 
 lemma dom_map_option:
   "dom (\<lambda>k. map_option (f k) (m k)) = dom m"
   by (simp add: dom_def)
 
 lemma dom_map_option_comp [simp]:
   "dom (map_option g \<circ> m) = dom m"
   using dom_map_option [of "\<lambda>_. g" m] by (simp add: comp_def)
 
 
 subsection \<open>\<^const>\<open>map_option\<close> related\<close>
 
 lemma map_option_o_empty [simp]: "map_option f \<circ> empty = empty"
 by (rule ext) simp
 
 lemma map_option_o_map_upd [simp]:
   "map_option f \<circ> m(a\<mapsto>b) = (map_option f \<circ> m)(a\<mapsto>f b)"
 by (rule ext) simp
 
 
 subsection \<open>@{term [source] map_comp} related\<close>
 
 lemma map_comp_empty [simp]:
   "m \<circ>\<^sub>m empty = empty"
   "empty \<circ>\<^sub>m m = empty"
 by (auto simp: map_comp_def split: option.splits)
 
 lemma map_comp_simps [simp]:
   "m2 k = None \<Longrightarrow> (m1 \<circ>\<^sub>m m2) k = None"
   "m2 k = Some k' \<Longrightarrow> (m1 \<circ>\<^sub>m m2) k = m1 k'"
 by (auto simp: map_comp_def)
 
 lemma map_comp_Some_iff:
   "((m1 \<circ>\<^sub>m m2) k = Some v) = (\<exists>k'. m2 k = Some k' \<and> m1 k' = Some v)"
 by (auto simp: map_comp_def split: option.splits)
 
 lemma map_comp_None_iff:
   "((m1 \<circ>\<^sub>m m2) k = None) = (m2 k = None \<or> (\<exists>k'. m2 k = Some k' \<and> m1 k' = None)) "
 by (auto simp: map_comp_def split: option.splits)
 
 
 subsection \<open>\<open>++\<close>\<close>
 
 lemma map_add_empty[simp]: "m ++ empty = m"
 by(simp add: map_add_def)
 
 lemma empty_map_add[simp]: "empty ++ m = m"
 by (rule ext) (simp add: map_add_def split: option.split)
 
 lemma map_add_assoc[simp]: "m1 ++ (m2 ++ m3) = (m1 ++ m2) ++ m3"
 by (rule ext) (simp add: map_add_def split: option.split)
 
 lemma map_add_Some_iff:
   "((m ++ n) k = Some x) = (n k = Some x \<or> n k = None \<and> m k = Some x)"
 by (simp add: map_add_def split: option.split)
 
 lemma map_add_SomeD [dest!]:
   "(m ++ n) k = Some x \<Longrightarrow> n k = Some x \<or> n k = None \<and> m k = Some x"
 by (rule map_add_Some_iff [THEN iffD1])
 
 lemma map_add_find_right [simp]: "n k = Some xx \<Longrightarrow> (m ++ n) k = Some xx"
 by (subst map_add_Some_iff) fast
 
 lemma map_add_None [iff]: "((m ++ n) k = None) = (n k = None \<and> m k = None)"
 by (simp add: map_add_def split: option.split)
 
 lemma map_add_upd[simp]: "f ++ g(x\<mapsto>y) = (f ++ g)(x\<mapsto>y)"
 by (rule ext) (simp add: map_add_def)
 
 lemma map_add_upds[simp]: "m1 ++ (m2(xs[\<mapsto>]ys)) = (m1++m2)(xs[\<mapsto>]ys)"
 by (simp add: map_upds_def)
 
 lemma map_add_upd_left: "m\<notin>dom e2 \<Longrightarrow> e1(m \<mapsto> u1) ++ e2 = (e1 ++ e2)(m \<mapsto> u1)"
 by (rule ext) (auto simp: map_add_def dom_def split: option.split)
 
 lemma map_of_append[simp]: "map_of (xs @ ys) = map_of ys ++ map_of xs"
   unfolding map_add_def
 proof (induct xs)
   case (Cons a xs)
   then show ?case
     by (force split: option.split)
 qed auto
 
 lemma finite_range_map_of_map_add:
   "finite (range f) \<Longrightarrow> finite (range (f ++ map_of l))"
 proof (induct l)
 case (Cons a l)
   then show ?case
     by (metis finite_range_updI map_add_upd map_of.simps(2))
 qed auto
 
 lemma inj_on_map_add_dom [iff]:
   "inj_on (m ++ m') (dom m') = inj_on m' (dom m')"
   by (fastforce simp: map_add_def dom_def inj_on_def split: option.splits)
 
 lemma map_upds_fold_map_upd:
   "m(ks[\<mapsto>]vs) = foldl (\<lambda>m (k, v). m(k \<mapsto> v)) m (zip ks vs)"
 unfolding map_upds_def proof (rule sym, rule zip_obtain_same_length)
   fix ks :: "'a list" and vs :: "'b list"
   assume "length ks = length vs"
   then show "foldl (\<lambda>m (k, v). m(k\<mapsto>v)) m (zip ks vs) = m ++ map_of (rev (zip ks vs))"
     by(induct arbitrary: m rule: list_induct2) simp_all
 qed
 
 lemma map_add_map_of_foldr:
   "m ++ map_of ps = foldr (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m"
   by (induct ps) (auto simp: fun_eq_iff map_add_def)
 
 
 subsection \<open>@{term [source] restrict_map}\<close>
 
 lemma restrict_map_to_empty [simp]: "m|`{} = empty"
   by (simp add: restrict_map_def)
 
 lemma restrict_map_insert: "f |` (insert a A) = (f |` A)(a := f a)"
   by (auto simp: restrict_map_def)
 
 lemma restrict_map_empty [simp]: "empty|`D = empty"
   by (simp add: restrict_map_def)
 
 lemma restrict_in [simp]: "x \<in> A \<Longrightarrow> (m|`A) x = m x"
   by (simp add: restrict_map_def)
 
 lemma restrict_out [simp]: "x \<notin> A \<Longrightarrow> (m|`A) x = None"
   by (simp add: restrict_map_def)
 
 lemma ran_restrictD: "y \<in> ran (m|`A) \<Longrightarrow> \<exists>x\<in>A. m x = Some y"
   by (auto simp: restrict_map_def ran_def split: if_split_asm)
 
 lemma dom_restrict [simp]: "dom (m|`A) = dom m \<inter> A"
   by (auto simp: restrict_map_def dom_def split: if_split_asm)
 
 lemma restrict_upd_same [simp]: "m(x\<mapsto>y)|`(-{x}) = m|`(-{x})"
   by (rule ext) (auto simp: restrict_map_def)
 
 lemma restrict_restrict [simp]: "m|`A|`B = m|`(A\<inter>B)"
   by (rule ext) (auto simp: restrict_map_def)
 
 lemma restrict_fun_upd [simp]:
   "m(x := y)|`D = (if x \<in> D then (m|`(D-{x}))(x := y) else m|`D)"
   by (simp add: restrict_map_def fun_eq_iff)
 
 lemma fun_upd_None_restrict [simp]:
   "(m|`D)(x := None) = (if x \<in> D then m|`(D - {x}) else m|`D)"
   by (simp add: restrict_map_def fun_eq_iff)
 
 lemma fun_upd_restrict: "(m|`D)(x := y) = (m|`(D-{x}))(x := y)"
   by (simp add: restrict_map_def fun_eq_iff)
 
 lemma fun_upd_restrict_conv [simp]:
   "x \<in> D \<Longrightarrow> (m|`D)(x := y) = (m|`(D-{x}))(x := y)"
   by (rule fun_upd_restrict)
 
 lemma map_of_map_restrict:
   "map_of (map (\<lambda>k. (k, f k)) ks) = (Some \<circ> f) |` set ks"
   by (induct ks) (simp_all add: fun_eq_iff restrict_map_insert)
 
 lemma restrict_complement_singleton_eq:
   "f |` (- {x}) = f(x := None)"
   by auto
 
 
 subsection \<open>@{term [source] map_upds}\<close>
 
 lemma map_upds_Nil1 [simp]: "m([] [\<mapsto>] bs) = m"
   by (simp add: map_upds_def)
 
 lemma map_upds_Nil2 [simp]: "m(as [\<mapsto>] []) = m"
   by (simp add:map_upds_def)
 
 lemma map_upds_Cons [simp]: "m(a#as [\<mapsto>] b#bs) = (m(a\<mapsto>b))(as[\<mapsto>]bs)"
   by (simp add:map_upds_def)
 
 lemma map_upds_append1 [simp]:
   "size xs < size ys \<Longrightarrow> m(xs@[x] [\<mapsto>] ys) = m(xs [\<mapsto>] ys)(x \<mapsto> ys!size xs)"
 proof (induct xs arbitrary: ys m)
   case Nil
   then show ?case
     by (auto simp: neq_Nil_conv)
 next
   case (Cons a xs)
   then show ?case
     by (cases ys) auto
 qed
 
 lemma map_upds_list_update2_drop [simp]:
   "size xs \<le> i \<Longrightarrow> m(xs[\<mapsto>]ys[i:=y]) = m(xs[\<mapsto>]ys)"
 proof (induct xs arbitrary: m ys i)
   case Nil
   then show ?case
     by auto
 next
   case (Cons a xs)
   then show ?case
     by (cases ys) (use Cons in \<open>auto split: nat.split\<close>)
 qed
 
 text \<open>Something weirdly sensitive about this proof, which needs only four lines in apply style\<close>
 lemma map_upd_upds_conv_if:
   "(f(x\<mapsto>y))(xs [\<mapsto>] ys) =
    (if x \<in> set(take (length ys) xs) then f(xs [\<mapsto>] ys)
                                     else (f(xs [\<mapsto>] ys))(x\<mapsto>y))"
 proof (induct xs arbitrary: x y ys f)
   case (Cons a xs)
   show ?case
   proof (cases ys)
     case (Cons z zs)
     then show ?thesis
       using Cons.hyps
       apply (auto split: if_split simp: fun_upd_twist)
       using Cons.hyps apply fastforce+
       done
   qed auto
 qed auto
 
 
 lemma map_upds_twist [simp]:
   "a \<notin> set as \<Longrightarrow> m(a\<mapsto>b)(as[\<mapsto>]bs) = m(as[\<mapsto>]bs)(a\<mapsto>b)"
 using set_take_subset by (fastforce simp add: map_upd_upds_conv_if)
 
 lemma map_upds_apply_nontin [simp]:
   "x \<notin> set xs \<Longrightarrow> (f(xs[\<mapsto>]ys)) x = f x"
 proof (induct xs arbitrary: ys)
   case (Cons a xs)
   then show ?case
     by (cases ys) (auto simp: map_upd_upds_conv_if)
 qed auto
 
 lemma fun_upds_append_drop [simp]:
   "size xs = size ys \<Longrightarrow> m(xs@zs[\<mapsto>]ys) = m(xs[\<mapsto>]ys)"
 proof (induct xs arbitrary: ys)
   case (Cons a xs)
   then show ?case
     by (cases ys) (auto simp: map_upd_upds_conv_if)
 qed auto
 
 lemma fun_upds_append2_drop [simp]:
   "size xs = size ys \<Longrightarrow> m(xs[\<mapsto>]ys@zs) = m(xs[\<mapsto>]ys)"
 proof (induct xs arbitrary: ys)
   case (Cons a xs)
   then show ?case
     by (cases ys) (auto simp: map_upd_upds_conv_if)
 qed auto
 
 lemma restrict_map_upds[simp]:
   "\<lbrakk> length xs = length ys; set xs \<subseteq> D \<rbrakk>
     \<Longrightarrow> m(xs [\<mapsto>] ys)|`D = (m|`(D - set xs))(xs [\<mapsto>] ys)"
 proof (induct xs arbitrary: m ys)
   case (Cons a xs)
   then show ?case
   proof (cases ys)
     case (Cons z zs)
     with Cons.hyps Cons.prems show ?thesis
       apply (simp add: insert_absorb flip: Diff_insert)
       apply (auto simp add: map_upd_upds_conv_if)
       done
   qed auto
 qed auto
 
 
 subsection \<open>@{term [source] dom}\<close>
 
 lemma dom_eq_empty_conv [simp]: "dom f = {} \<longleftrightarrow> f = empty"
   by (auto simp: dom_def)
 
 lemma domI: "m a = Some b \<Longrightarrow> a \<in> dom m"
   by (simp add: dom_def)
 (* declare domI [intro]? *)
 
 lemma domD: "a \<in> dom m \<Longrightarrow> \<exists>b. m a = Some b"
   by (cases "m a") (auto simp add: dom_def)
 
 lemma domIff [iff, simp del, code_unfold]: "a \<in> dom m \<longleftrightarrow> m a \<noteq> None"
   by (simp add: dom_def)
 
 lemma dom_empty [simp]: "dom empty = {}"
   by (simp add: dom_def)
 
 lemma dom_fun_upd [simp]:
   "dom(f(x := y)) = (if y = None then dom f - {x} else insert x (dom f))"
   by (auto simp: dom_def)
 
 lemma dom_if:
   "dom (\<lambda>x. if P x then f x else g x) = dom f \<inter> {x. P x} \<union> dom g \<inter> {x. \<not> P x}"
   by (auto split: if_splits)
 
 lemma dom_map_of_conv_image_fst:
   "dom (map_of xys) = fst ` set xys"
   by (induct xys) (auto simp add: dom_if)
 
 lemma dom_map_of_zip [simp]: "length xs = length ys \<Longrightarrow> dom (map_of (zip xs ys)) = set xs"
   by (induct rule: list_induct2) (auto simp: dom_if)
 
 lemma finite_dom_map_of: "finite (dom (map_of l))"
   by (induct l) (auto simp: dom_def insert_Collect [symmetric])
 
 lemma dom_map_upds [simp]:
   "dom(m(xs[\<mapsto>]ys)) = set(take (length ys) xs) \<union> dom m"
 proof (induct xs arbitrary: ys)
   case (Cons a xs)
   then show ?case
     by (cases ys) (auto simp: map_upd_upds_conv_if)
 qed auto
 
 
 lemma dom_map_add [simp]: "dom (m ++ n) = dom n \<union> dom m"
   by (auto simp: dom_def)
 
 lemma dom_override_on [simp]:
   "dom (override_on f g A) =
     (dom f  - {a. a \<in> A - dom g}) \<union> {a. a \<in> A \<inter> dom g}"
   by (auto simp: dom_def override_on_def)
 
 lemma map_add_comm: "dom m1 \<inter> dom m2 = {} \<Longrightarrow> m1 ++ m2 = m2 ++ m1"
   by (rule ext) (force simp: map_add_def dom_def split: option.split)
 
 lemma map_add_dom_app_simps:
   "m \<in> dom l2 \<Longrightarrow> (l1 ++ l2) m = l2 m"
   "m \<notin> dom l1 \<Longrightarrow> (l1 ++ l2) m = l2 m"
   "m \<notin> dom l2 \<Longrightarrow> (l1 ++ l2) m = l1 m"
   by (auto simp add: map_add_def split: option.split_asm)
 
 lemma dom_const [simp]:
   "dom (\<lambda>x. Some (f x)) = UNIV"
   by auto
 
 (* Due to John Matthews - could be rephrased with dom *)
 lemma finite_map_freshness:
   "finite (dom (f :: 'a \<rightharpoonup> 'b)) \<Longrightarrow> \<not> finite (UNIV :: 'a set) \<Longrightarrow>
    \<exists>x. f x = None"
   by (bestsimp dest: ex_new_if_finite)
 
 lemma dom_minus:
   "f x = None \<Longrightarrow> dom f - insert x A = dom f - A"
   unfolding dom_def by simp
 
 lemma insert_dom:
   "f x = Some y \<Longrightarrow> insert x (dom f) = dom f"
   unfolding dom_def by auto
 
 lemma map_of_map_keys:
   "set xs = dom m \<Longrightarrow> map_of (map (\<lambda>k. (k, the (m k))) xs) = m"
   by (rule ext) (auto simp add: map_of_map_restrict restrict_map_def)
 
 lemma map_of_eqI:
   assumes set_eq: "set (map fst xs) = set (map fst ys)"
   assumes map_eq: "\<forall>k\<in>set (map fst xs). map_of xs k = map_of ys k"
   shows "map_of xs = map_of ys"
 proof (rule ext)
   fix k show "map_of xs k = map_of ys k"
   proof (cases "map_of xs k")
     case None
     then have "k \<notin> set (map fst xs)" by (simp add: map_of_eq_None_iff)
     with set_eq have "k \<notin> set (map fst ys)" by simp
     then have "map_of ys k = None" by (simp add: map_of_eq_None_iff)
     with None show ?thesis by simp
   next
     case (Some v)
     then have "k \<in> set (map fst xs)" by (auto simp add: dom_map_of_conv_image_fst [symmetric])
     with map_eq show ?thesis by auto
   qed
 qed
 
 lemma map_of_eq_dom:
   assumes "map_of xs = map_of ys"
   shows "fst ` set xs = fst ` set ys"
 proof -
   from assms have "dom (map_of xs) = dom (map_of ys)" by simp
   then show ?thesis by (simp add: dom_map_of_conv_image_fst)
 qed
 
 lemma finite_set_of_finite_maps:
   assumes "finite A" "finite B"
   shows "finite {m. dom m = A \<and> ran m \<subseteq> B}" (is "finite ?S")
 proof -
   let ?S' = "{m. \<forall>x. (x \<in> A \<longrightarrow> m x \<in> Some ` B) \<and> (x \<notin> A \<longrightarrow> m x = None)}"
   have "?S = ?S'"
   proof
     show "?S \<subseteq> ?S'" by (auto simp: dom_def ran_def image_def)
     show "?S' \<subseteq> ?S"
     proof
       fix m assume "m \<in> ?S'"
       hence 1: "dom m = A" by force
       hence 2: "ran m \<subseteq> B" using \<open>m \<in> ?S'\<close> by (auto simp: dom_def ran_def)
       from 1 2 show "m \<in> ?S" by blast
     qed
   qed
   with assms show ?thesis by(simp add: finite_set_of_finite_funs)
 qed
 
 
 subsection \<open>@{term [source] ran}\<close>
 
 lemma ranI: "m a = Some b \<Longrightarrow> b \<in> ran m"
   by (auto simp: ran_def)
 (* declare ranI [intro]? *)
 
 lemma ran_empty [simp]: "ran empty = {}"
   by (auto simp: ran_def)
 
 lemma ran_map_upd [simp]:  "m a = None \<Longrightarrow> ran(m(a\<mapsto>b)) = insert b (ran m)"
   unfolding ran_def
   by force
 
 lemma fun_upd_None_if_notin_dom[simp]: "k \<notin> dom m \<Longrightarrow> m(k := None) = m"
   by auto
 
 lemma ran_map_add:
   assumes "dom m1 \<inter> dom m2 = {}"
   shows "ran (m1 ++ m2) = ran m1 \<union> ran m2"
 proof
   show "ran (m1 ++ m2) \<subseteq> ran m1 \<union> ran m2"
     unfolding ran_def by auto
 next
   show "ran m1 \<union> ran m2 \<subseteq> ran (m1 ++ m2)"
   proof -
     have "(m1 ++ m2) x = Some y" if "m1 x = Some y" for x y
       using assms map_add_comm that by fastforce
     moreover have "(m1 ++ m2) x = Some y" if "m2 x = Some y" for x y
       using assms that by auto
     ultimately show ?thesis
       unfolding ran_def by blast
   qed
 qed
 
 lemma finite_ran:
   assumes "finite (dom p)"
   shows "finite (ran p)"
 proof -
   have "ran p = (\<lambda>x. the (p x)) ` dom p"
     unfolding ran_def by force
   from this \<open>finite (dom p)\<close> show ?thesis by auto
 qed
 
 lemma ran_distinct:
   assumes dist: "distinct (map fst al)"
   shows "ran (map_of al) = snd ` set al"
   using assms
 proof (induct al)
   case Nil
   then show ?case by simp
 next
   case (Cons kv al)
   then have "ran (map_of al) = snd ` set al" by simp
   moreover from Cons.prems have "map_of al (fst kv) = None"
     by (simp add: map_of_eq_None_iff)
   ultimately show ?case by (simp only: map_of.simps ran_map_upd) simp
 qed
 
 lemma ran_map_of_zip:
   assumes "length xs = length ys" "distinct xs"
   shows "ran (map_of (zip xs ys)) = set ys"
 using assms by (simp add: ran_distinct set_map[symmetric])
 
 lemma ran_map_option: "ran (\<lambda>x. map_option f (m x)) = f ` ran m"
   by (auto simp add: ran_def)
 
 subsection \<open>@{term [source] graph}\<close>
 
 lemma graph_empty[simp]: "graph empty = {}"
   unfolding graph_def by simp
 
 lemma in_graphI: "m k = Some v \<Longrightarrow> (k, v) \<in> graph m"
   unfolding graph_def by blast
 
 lemma in_graphD: "(k, v) \<in> graph m \<Longrightarrow> m k = Some v"
   unfolding graph_def by blast
 
 lemma graph_map_upd[simp]: "graph (m(k \<mapsto> v)) = insert (k, v) (graph (m(k := None)))"
   unfolding graph_def by (auto split: if_splits)
 
 lemma graph_fun_upd_None: "graph (m(k := None)) = {e \<in> graph m. fst e \<noteq> k}"
   unfolding graph_def by (auto split: if_splits)
 
 lemma graph_restrictD:
   assumes "(k, v) \<in> graph (m |` A)"
   shows "k \<in> A" and "m k = Some v"
   using assms unfolding graph_def
   by (auto simp: restrict_map_def split: if_splits)
 
 lemma graph_map_comp[simp]: "graph (m1 \<circ>\<^sub>m m2) = graph m2 O graph m1"
   unfolding graph_def by (auto simp: map_comp_Some_iff relcomp_unfold)
 
 lemma graph_map_add: "dom m1 \<inter> dom m2 = {} \<Longrightarrow> graph (m1 ++ m2) = graph m1 \<union> graph m2"
   unfolding graph_def using map_add_comm by force
 
 lemma graph_eq_to_snd_dom: "graph m = (\<lambda>x. (x, the (m x))) ` dom m"
   unfolding graph_def dom_def by force
 
 lemma fst_graph_eq_dom: "fst ` graph m = dom m"
   unfolding graph_eq_to_snd_dom by force
 
 lemma graph_domD: "x \<in> graph m \<Longrightarrow> fst x \<in> dom m"
   using fst_graph_eq_dom by (metis imageI)
 
 lemma snd_graph_ran: "snd ` graph m = ran m"
   unfolding graph_def ran_def by force
 
 lemma graph_ranD: "x \<in> graph m \<Longrightarrow> snd x \<in> ran m"
   using snd_graph_ran by (metis imageI)
 
 lemma finite_graph_map_of: "finite (graph (map_of al))"
   unfolding graph_eq_to_snd_dom finite_dom_map_of
   using finite_dom_map_of by blast
 
-lemma graph_map_of_if_distinct_ran: "distinct (map fst al) \<Longrightarrow> graph (map_of al) = set al"
+lemma graph_map_of_if_distinct_dom: "distinct (map fst al) \<Longrightarrow> graph (map_of al) = set al"
   unfolding graph_def by auto
 
 lemma finite_graph_iff_finite_dom[simp]: "finite (graph m) = finite (dom m)"
   by (metis graph_eq_to_snd_dom finite_imageI fst_graph_eq_dom)
 
 lemma inj_on_fst_graph: "inj_on fst (graph m)"
   unfolding graph_def inj_on_def by force
 
 subsection \<open>\<open>map_le\<close>\<close>
 
 lemma map_le_empty [simp]: "empty \<subseteq>\<^sub>m g"
   by (simp add: map_le_def)
 
 lemma upd_None_map_le [simp]: "f(x := None) \<subseteq>\<^sub>m f"
   by (force simp add: map_le_def)
 
 lemma map_le_upd[simp]: "f \<subseteq>\<^sub>m g ==> f(a := b) \<subseteq>\<^sub>m g(a := b)"
   by (fastforce simp add: map_le_def)
 
 lemma map_le_imp_upd_le [simp]: "m1 \<subseteq>\<^sub>m m2 \<Longrightarrow> m1(x := None) \<subseteq>\<^sub>m m2(x \<mapsto> y)"
   by (force simp add: map_le_def)
 
 lemma map_le_upds [simp]:
   "f \<subseteq>\<^sub>m g \<Longrightarrow> f(as [\<mapsto>] bs) \<subseteq>\<^sub>m g(as [\<mapsto>] bs)"
 proof (induct as arbitrary: f g bs)
   case (Cons a as)
   then show ?case
     by (cases bs) (use Cons in auto)
 qed auto
 
 lemma map_le_implies_dom_le: "(f \<subseteq>\<^sub>m g) \<Longrightarrow> (dom f \<subseteq> dom g)"
   by (fastforce simp add: map_le_def dom_def)
 
 lemma map_le_refl [simp]: "f \<subseteq>\<^sub>m f"
   by (simp add: map_le_def)
 
 lemma map_le_trans[trans]: "\<lbrakk> m1 \<subseteq>\<^sub>m m2; m2 \<subseteq>\<^sub>m m3\<rbrakk> \<Longrightarrow> m1 \<subseteq>\<^sub>m m3"
   by (auto simp add: map_le_def dom_def)
 
 lemma map_le_antisym: "\<lbrakk> f \<subseteq>\<^sub>m g; g \<subseteq>\<^sub>m f \<rbrakk> \<Longrightarrow> f = g"
   unfolding map_le_def
   by (metis ext domIff)
 
 lemma map_le_map_add [simp]: "f \<subseteq>\<^sub>m g ++ f"
   by (fastforce simp: map_le_def)
 
 lemma map_le_iff_map_add_commute: "f \<subseteq>\<^sub>m f ++ g \<longleftrightarrow> f ++ g = g ++ f"
   by (fastforce simp: map_add_def map_le_def fun_eq_iff split: option.splits)
 
 lemma map_add_le_mapE: "f ++ g \<subseteq>\<^sub>m h \<Longrightarrow> g \<subseteq>\<^sub>m h"
   by (fastforce simp: map_le_def map_add_def dom_def)
 
 lemma map_add_le_mapI: "\<lbrakk> f \<subseteq>\<^sub>m h; g \<subseteq>\<^sub>m h \<rbrakk> \<Longrightarrow> f ++ g \<subseteq>\<^sub>m h"
   by (auto simp: map_le_def map_add_def dom_def split: option.splits)
 
 lemma map_add_subsumed1: "f \<subseteq>\<^sub>m g \<Longrightarrow> f++g = g"
 by (simp add: map_add_le_mapI map_le_antisym)
 
 lemma map_add_subsumed2: "f \<subseteq>\<^sub>m g \<Longrightarrow> g++f = g"
 by (metis map_add_subsumed1 map_le_iff_map_add_commute)
 
 lemma dom_eq_singleton_conv: "dom f = {x} \<longleftrightarrow> (\<exists>v. f = [x \<mapsto> v])"
   (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   assume ?rhs
   then show ?lhs by (auto split: if_split_asm)
 next
   assume ?lhs
   then obtain v where v: "f x = Some v" by auto
   show ?rhs
   proof
     show "f = [x \<mapsto> v]"
     proof (rule map_le_antisym)
       show "[x \<mapsto> v] \<subseteq>\<^sub>m f"
         using v by (auto simp add: map_le_def)
       show "f \<subseteq>\<^sub>m [x \<mapsto> v]"
         using \<open>dom f = {x}\<close> \<open>f x = Some v\<close> by (auto simp add: map_le_def)
     qed
   qed
 qed
 
 lemma map_add_eq_empty_iff[simp]:
   "(f++g = empty) \<longleftrightarrow> f = empty \<and> g = empty"
 by (metis map_add_None)
 
 lemma empty_eq_map_add_iff[simp]:
   "(empty = f++g) \<longleftrightarrow> f = empty \<and> g = empty"
 by(subst map_add_eq_empty_iff[symmetric])(rule eq_commute)
 
 
 subsection \<open>Various\<close>
 
 lemma set_map_of_compr:
   assumes distinct: "distinct (map fst xs)"
   shows "set xs = {(k, v). map_of xs k = Some v}"
   using assms
 proof (induct xs)
   case Nil
   then show ?case by simp
 next
   case (Cons x xs)
   obtain k v where "x = (k, v)" by (cases x) blast
   with Cons.prems have "k \<notin> dom (map_of xs)"
     by (simp add: dom_map_of_conv_image_fst)
   then have *: "insert (k, v) {(k, v). map_of xs k = Some v} =
     {(k', v'). (map_of xs(k \<mapsto> v)) k' = Some v'}"
     by (auto split: if_splits)
   from Cons have "set xs = {(k, v). map_of xs k = Some v}" by simp
   with * \<open>x = (k, v)\<close> show ?case by simp
 qed
 
 lemma eq_key_imp_eq_value:
   "v1 = v2"
   if "distinct (map fst xs)" "(k, v1) \<in> set xs" "(k, v2) \<in> set xs"
 proof -
   from that have "inj_on fst (set xs)"
     by (simp add: distinct_map)
   moreover have "fst (k, v1) = fst (k, v2)"
     by simp
   ultimately have "(k, v1) = (k, v2)"
     by (rule inj_onD) (fact that)+
   then show ?thesis
     by simp
 qed
 
 lemma map_of_inject_set:
   assumes distinct: "distinct (map fst xs)" "distinct (map fst ys)"
   shows "map_of xs = map_of ys \<longleftrightarrow> set xs = set ys" (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   assume ?lhs
   moreover from \<open>distinct (map fst xs)\<close> have "set xs = {(k, v). map_of xs k = Some v}"
     by (rule set_map_of_compr)
   moreover from \<open>distinct (map fst ys)\<close> have "set ys = {(k, v). map_of ys k = Some v}"
     by (rule set_map_of_compr)
   ultimately show ?rhs by simp
 next
   assume ?rhs show ?lhs
   proof
     fix k
     show "map_of xs k = map_of ys k"
     proof (cases "map_of xs k")
       case None
       with \<open>?rhs\<close> have "map_of ys k = None"
         by (simp add: map_of_eq_None_iff)
       with None show ?thesis by simp
     next
       case (Some v)
       with distinct \<open>?rhs\<close> have "map_of ys k = Some v"
         by simp
       with Some show ?thesis by simp
     qed
   qed
 qed
 
 lemma finite_Map_induct[consumes 1, case_names empty update]:
   assumes "finite (dom m)"
   assumes "P Map.empty"
   assumes "\<And>k v m. finite (dom m) \<Longrightarrow> k \<notin> dom m \<Longrightarrow> P m \<Longrightarrow> P (m(k \<mapsto> v))"
   shows "P m"
   using assms(1)
 proof(induction "dom m" arbitrary: m rule: finite_induct)
   case empty
   then show ?case using assms(2) unfolding dom_def by simp
 next
   case (insert x F) 
   then have "finite (dom (m(x:=None)))" "x \<notin> dom (m(x:=None))" "P (m(x:=None))"
     by (metis Diff_insert_absorb dom_fun_upd)+
   with assms(3)[OF this] show ?case
     by (metis fun_upd_triv fun_upd_upd option.exhaust)
 qed
 
 hide_const (open) Map.empty Map.graph
 
 end