commit 63c21b43e83f453dfa8f9672fddc0c449f96b764
Author: Achim D. Brucker <adbrucker@0x5f.org>
Date:   Sat Dec 19 15:00:13 2020 +0000

    Initial import from AFP.

diff --git a/SC_DOM_Components/Core_DOM_DOM_Components.thy b/SC_DOM_Components/Core_DOM_DOM_Components.thy
new file mode 100644
index 0000000..a209210
--- /dev/null
+++ b/SC_DOM_Components/Core_DOM_DOM_Components.thy
@@ -0,0 +1,2351 @@
+(***********************************************************************************
+ * Copyright (c) 2016-2020 The University of Sheffield, UK
+ *               2019-2020 University of Exeter, UK
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * * Redistributions of source code must retain the above copyright notice, this
+ *   list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright notice,
+ *   this list of conditions and the following disclaimer in the documentation
+ *   and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ ***********************************************************************************)
+
+section \<open>Core SC DOM Components\<close>
+theory Core_DOM_DOM_Components
+  imports Core_SC_DOM.Core_DOM
+begin
+
+subsection \<open>Components\<close>
+
+locale l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
+  l_get_root_node_defs get_root_node get_root_node_locs +
+  l_to_tree_order_defs to_tree_order
+  for get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
+    and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+begin
+
+definition a_get_dom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
+  where
+    "a_get_dom_component ptr = do {
+      root \<leftarrow> get_root_node ptr;
+      to_tree_order root
+    }"
+
+definition a_is_strongly_dom_component_safe ::
+  "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+  where
+    "a_is_strongly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
+      let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
+      let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
+      let arg_components =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h).  set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) in
+      let arg_components' =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_dom_component ptr|\<^sub>r) in
+      removed_pointers \<subseteq> arg_components \<and>
+      added_pointers \<subseteq> arg_components' \<and>
+      S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<and>
+      (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
+        (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_dom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
+
+definition a_is_weakly_dom_component_safe ::
+  "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+  where
+    "a_is_weakly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
+      let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
+      let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
+      let arg_components =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h).  set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) in
+      let arg_components' =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_dom_component ptr|\<^sub>r) in
+      removed_pointers \<subseteq> arg_components \<and>
+      S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<union> added_pointers  \<and>
+      (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
+        (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_dom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
+
+lemma "a_is_strongly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' \<Longrightarrow> a_is_weakly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h'"
+  by(auto simp add: a_is_strongly_dom_component_safe_def a_is_weakly_dom_component_safe_def Let_def)
+
+definition is_document_component :: "(_) object_ptr list \<Rightarrow> bool"
+  where
+    "is_document_component c = is_document_ptr_kind (hd c)"
+
+definition is_disconnected_component :: "(_) object_ptr list \<Rightarrow> bool"
+  where
+    "is_disconnected_component c = is_node_ptr_kind (hd c)"
+end
+
+global_interpretation l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_root_node get_root_node_locs to_tree_order
+  defines get_dom_component = a_get_dom_component
+    and is_strongly_dom_component_safe = a_is_strongly_dom_component_safe
+    and is_weakly_dom_component_safe = a_is_weakly_dom_component_safe
+  .
+
+
+locale l_get_dom_component_defs =
+  fixes get_dom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
+  fixes is_strongly_dom_component_safe ::
+    "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+  fixes is_weakly_dom_component_safe ::
+    "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+
+locale l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_to_tree_order_wf +
+  l_get_dom_component_defs +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
+  l_get_ancestors +
+  l_get_ancestors_wf +
+  l_get_root_node +
+  l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_parent +
+  l_get_parent_wf +
+  l_get_element_by +
+  l_to_tree_order_wf_get_root_node_wf +
+  (* l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M _ _ _ get_child_nodes +
+  l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M _ _ get_child_nodes+
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M _ _ "l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.a_to_tree_order get_child_nodes"
+  for get_child_nodes :: "(_::linorder) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog" *)
+  assumes get_dom_component_impl: "get_dom_component = a_get_dom_component"
+  assumes is_strongly_dom_component_safe_impl:
+    "is_strongly_dom_component_safe = a_is_strongly_dom_component_safe"
+  assumes is_weakly_dom_component_safe_impl:
+    "is_weakly_dom_component_safe = a_is_weakly_dom_component_safe"
+begin
+lemmas get_dom_component_def = a_get_dom_component_def[folded get_dom_component_impl]
+lemmas is_strongly_dom_component_safe_def =
+  a_is_strongly_dom_component_safe_def[folded is_strongly_dom_component_safe_impl]
+lemmas is_weakly_dom_component_safe_def =
+  a_is_weakly_dom_component_safe_def[folded is_weakly_dom_component_safe_impl]
+
+lemma get_dom_component_ptr_in_heap:
+  assumes "h \<turnstile> ok (get_dom_component ptr)"
+  shows "ptr |\<in>| object_ptr_kinds h"
+  using assms get_root_node_ptr_in_heap
+  by(auto simp add: get_dom_component_def)
+
+lemma get_dom_component_ok:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "ptr |\<in>| object_ptr_kinds h"
+  shows "h \<turnstile> ok (get_dom_component ptr)"
+  using assms
+  apply(auto simp add: get_dom_component_def a_get_root_node_def intro!: bind_is_OK_pure_I)[1]
+  using get_root_node_ok  to_tree_order_ok get_root_node_ptr_in_heap
+   apply blast
+  by (simp add: local.get_root_node_root_in_heap local.to_tree_order_ok)
+
+lemma get_dom_component_ptr:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  shows "ptr \<in> set c"
+proof(insert assms(1) assms(4), induct ptr rule: heap_wellformed_induct_rev )
+  case (step child)
+  then show ?case
+  proof (cases "is_node_ptr_kind child")
+    case True
+    obtain node_ptr where
+      node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = child"
+      using \<open>is_node_ptr_kind child\<close> node_ptr_casts_commute3 by blast
+    have "child |\<in>| object_ptr_kinds h"
+      using \<open>h \<turnstile> get_dom_component child \<rightarrow>\<^sub>r c\<close> get_dom_component_ptr_in_heap by fast
+    with node_ptr have "node_ptr |\<in>| node_ptr_kinds h"
+      by auto
+    then obtain parent_opt where
+      parent: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt"
+      using get_parent_ok \<open>type_wf h\<close> \<open>known_ptrs h\<close>
+      by fast
+    then show ?thesis
+    proof (induct parent_opt)
+      case None
+      then have "h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r cast node_ptr"
+        by (simp add: local.get_root_node_no_parent)
+      then show ?case
+        using \<open>type_wf h\<close> \<open>known_ptrs h\<close> node_ptr step(2)
+        apply(auto simp add: get_dom_component_def a_get_root_node_def elim!: bind_returns_result_E2)[1]
+        using to_tree_order_ptr_in_result returns_result_eq by fastforce
+    next
+      case (Some parent_ptr)
+      then have "h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c"
+        using step(2) node_ptr \<open>type_wf h\<close> \<open>known_ptrs h\<close> \<open>heap_is_wellformed h\<close>
+          get_root_node_parent_same
+        by(auto simp add: get_dom_component_def elim!: bind_returns_result_E2
+            intro!: bind_pure_returns_result_I)
+      then have "parent_ptr \<in> set c"
+        using step node_ptr Some by blast
+      then show ?case
+        using  \<open>type_wf h\<close> \<open>known_ptrs h\<close> \<open>heap_is_wellformed h\<close> step(2) node_ptr Some
+        apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
+        using to_tree_order_parent by blast
+    qed
+  next
+    case False
+    then show ?thesis
+      using \<open>type_wf h\<close> \<open>known_ptrs h\<close> step(2)
+      apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
+      by (metis is_OK_returns_result_I local.get_root_node_not_node_same
+          local.get_root_node_ptr_in_heap local.to_tree_order_ptr_in_result returns_result_eq)
+  qed
+qed
+
+lemma get_dom_component_parent_inside:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "cast node_ptr \<in> set c"
+  assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some parent"
+  shows "parent \<in> set c"
+proof -
+  have "parent |\<in>| object_ptr_kinds h"
+    using assms(6) get_parent_parent_in_heap by blast
+
+  obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr" and c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using assms(4)
+    by (metis (no_types, hide_lams) bind_returns_result_E2 get_dom_component_def get_root_node_pure)
+  then have "h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r root_ptr"
+    using assms(1) assms(2) assms(3) assms(5) to_tree_order_same_root by blast
+  then have "h \<turnstile> get_root_node parent \<rightarrow>\<^sub>r root_ptr"
+    using assms(6)  get_root_node_parent_same by blast
+  then have "h \<turnstile> get_dom_component parent \<rightarrow>\<^sub>r c"
+    using c get_dom_component_def by auto
+  then show ?thesis
+    using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
+qed
+
+lemma get_dom_component_subset:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "ptr' \<in> set c"
+  shows "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+proof(insert assms(1) assms(5), induct ptr' rule: heap_wellformed_induct_rev )
+  case (step child)
+  then show ?case
+  proof (cases "is_node_ptr_kind child")
+    case True
+    obtain node_ptr where
+      node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = child"
+      using \<open>is_node_ptr_kind child\<close> node_ptr_casts_commute3 by blast
+    have "child |\<in>| object_ptr_kinds h"
+      using to_tree_order_ptrs_in_heap assms(1) assms(2) assms(3) assms(4) step(2)
+      unfolding get_dom_component_def
+      by (meson bind_returns_result_E2 get_root_node_pure)
+    with node_ptr have "node_ptr |\<in>| node_ptr_kinds h"
+      by auto
+    then obtain parent_opt where
+      parent: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt"
+      using get_parent_ok \<open>type_wf h\<close> \<open>known_ptrs h\<close>
+      by fast
+    then show ?thesis
+    proof (induct parent_opt)
+      case None
+      then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
+        using assms(1) get_root_node_no_parent node_ptr by blast
+      then show ?case
+        using \<open>type_wf h\<close> \<open>known_ptrs h\<close> node_ptr step(2) assms(4) assms(1)
+        by (metis (no_types) bind_pure_returns_result_I2 bind_returns_result_E2
+            get_dom_component_def get_root_node_pure is_OK_returns_result_I returns_result_eq
+            to_tree_order_same_root)
+    next
+      case (Some parent_ptr)
+      then have "h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c"
+        using step get_dom_component_parent_inside assms node_ptr by blast
+      then show ?case
+        using Some node_ptr
+        apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2
+            del: bind_pure_returns_result_I intro!: bind_pure_returns_result_I)[1]
+        using get_root_node_parent_same by blast
+    qed
+  next
+    case False
+    then have "child |\<in>| object_ptr_kinds h"
+      using assms(1) assms(4) step(2)
+      by (metis (no_types, lifting) assms(2) assms(3) bind_returns_result_E2 get_root_node_pure
+          get_dom_component_def to_tree_order_ptrs_in_heap)
+    then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
+      using assms(1) False get_root_node_not_node_same by blast
+    then show ?thesis
+      using assms(1) assms(2) assms(3) assms(4) step.prems
+      by (metis (no_types) False \<open>child |\<in>| object_ptr_kinds h\<close> bind_pure_returns_result_I2
+          bind_returns_result_E2 get_dom_component_def get_root_node_ok get_root_node_pure returns_result_eq
+          to_tree_order_node_ptrs)
+  qed
+qed
+
+lemma get_dom_component_to_tree_order_subset:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  shows "set nodes \<subseteq> set c"
+  using assms
+  apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
+  by (meson to_tree_order_subset  assms(5) contra_subsetD get_dom_component_ptr)
+
+lemma get_dom_component_to_tree_order:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to"
+  assumes "ptr \<in> set to"
+  shows "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+  by (metis (no_types, hide_lams) assms(1) assms(2) assms(3) assms(4) assms(5) assms(6)
+      get_dom_component_ok get_dom_component_subset get_dom_component_to_tree_order_subset
+      is_OK_returns_result_E local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap
+      select_result_I2 subsetCE)
+
+lemma get_dom_component_root_node_same:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+  assumes "x \<in> set c"
+  shows "h \<turnstile> get_root_node x \<rightarrow>\<^sub>r root_ptr"
+proof(insert assms(1) assms(6), induct x rule: heap_wellformed_induct_rev )
+  case (step child)
+  then show ?case
+  proof (cases "is_node_ptr_kind child")
+    case True
+    obtain node_ptr where
+      node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = child"
+      using \<open>is_node_ptr_kind child\<close> node_ptr_casts_commute3 by blast
+    have "child |\<in>| object_ptr_kinds h"
+      using to_tree_order_ptrs_in_heap assms(1) assms(2) assms(3) assms(4) step(2)
+      unfolding get_dom_component_def
+      by (meson bind_returns_result_E2 get_root_node_pure)
+    with node_ptr have "node_ptr |\<in>| node_ptr_kinds h"
+      by auto
+    then obtain parent_opt where
+      parent: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt"
+      using get_parent_ok \<open>type_wf h\<close> \<open>known_ptrs h\<close>
+      by fast
+    then show ?thesis
+    proof (induct parent_opt)
+      case None
+      then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
+        using assms(1) get_root_node_no_parent  node_ptr by blast
+      then show ?case
+        using \<open>type_wf h\<close> \<open>known_ptrs h\<close> node_ptr step(2) assms(4) assms(1) assms(5)
+        by (metis (no_types) \<open>child |\<in>| object_ptr_kinds h\<close> bind_pure_returns_result_I
+            get_dom_component_def get_dom_component_ptr get_dom_component_subset get_root_node_pure
+            is_OK_returns_result_E returns_result_eq to_tree_order_ok to_tree_order_same_root)
+    next
+      case (Some parent_ptr)
+      then have "h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c"
+        using step get_dom_component_parent_inside assms node_ptr
+        by (meson get_dom_component_subset)
+      then show ?case
+        using Some node_ptr
+        apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
+        using get_root_node_parent_same
+        using \<open>h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c\<close> assms(1) assms(2) assms(3)
+          get_dom_component_ptr step.hyps by blast
+    qed
+  next
+    case False
+    then have "child |\<in>| object_ptr_kinds h"
+      using assms(1) assms(4) step(2)
+      by (metis (no_types, lifting) assms(2) assms(3) bind_returns_result_E2 get_root_node_pure
+          get_dom_component_def to_tree_order_ptrs_in_heap)
+    then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
+      using assms(1) False get_root_node_not_node_same by auto
+    then show ?thesis
+      using assms(1) assms(2) assms(3) assms(4) step.prems assms(5)
+      by (metis (no_types, hide_lams) bind_returns_result_E2 get_dom_component_def
+          get_root_node_pure returns_result_eq to_tree_order_same_root)
+  qed
+qed
+
+
+lemma get_dom_component_no_overlap:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
+  shows "set c \<inter> set c' = {} \<or> c = c'"
+proof (rule ccontr, auto)
+  fix x
+  assume 1: "c \<noteq> c'" and 2: "x \<in> set c" and 3: "x \<in> set c'"
+  obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    using assms(4) unfolding get_dom_component_def
+    by (meson bind_is_OK_E is_OK_returns_result_I)
+  moreover obtain root_ptr' where root_ptr': "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr'"
+    using assms(5) unfolding get_dom_component_def
+    by (meson bind_is_OK_E is_OK_returns_result_I)
+  ultimately have "root_ptr \<noteq> root_ptr'"
+    using 1 assms
+    unfolding get_dom_component_def
+    by (meson bind_returns_result_E3 get_root_node_pure returns_result_eq)
+
+  moreover have "h \<turnstile> get_root_node x \<rightarrow>\<^sub>r root_ptr"
+    using 2 root_ptr get_dom_component_root_node_same assms by blast
+  moreover have "h \<turnstile> get_root_node x \<rightarrow>\<^sub>r root_ptr'"
+    using 3 root_ptr' get_dom_component_root_node_same assms by blast
+  ultimately show False
+    using select_result_I2 by force
+qed
+
+lemma get_dom_component_separates_tree_order:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+  assumes "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
+  assumes "ptr' \<notin> set c"
+  shows "set to \<inter> set c' = {}"
+proof -
+  have "c \<noteq> c'"
+    using assms get_dom_component_ptr by blast
+  then have "set c \<inter> set c' = {}"
+    using assms get_dom_component_no_overlap by blast
+  moreover have "set to \<subseteq> set c"
+    using assms get_dom_component_to_tree_order_subset by blast
+  ultimately show ?thesis
+    by blast
+qed
+
+lemma get_dom_component_separates_tree_order_general:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> to_tree_order ptr'' \<rightarrow>\<^sub>r to''"
+  assumes "ptr'' \<in> set c"
+  assumes "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
+  assumes "ptr' \<notin> set c"
+  shows "set to'' \<inter> set c' = {}"
+proof -
+  obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    using assms(4)
+    by (metis bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  then have c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using assms(4) unfolding get_dom_component_def
+    by (simp add: bind_returns_result_E3)
+  with root_ptr show ?thesis
+    using assms get_dom_component_separates_tree_order get_dom_component_subset
+    by meson
+qed
+end
+
+interpretation i_get_dom_component?: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name
+  by(auto simp add: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def
+      get_dom_component_def is_strongly_dom_component_safe_def is_weakly_dom_component_safe_def instances)
+declare l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_child\_nodes\<close>
+
+locale l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_child_nodes_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+  assumes "child \<in> set children"
+  shows "cast child \<in> set c \<longleftrightarrow> ptr' \<in> set c"
+proof
+  assume 1: "cast child \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  have "h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    using assms(1) assms(2) assms(3) assms(5) assms(6) local.child_parent_dual
+      local.get_root_node_parent_same by blast
+  then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    using "1" assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) local.child_parent_dual
+      local.get_dom_component_parent_inside local.get_dom_component_subset by blast
+  then show "ptr' \<in> set c"
+    using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
+next
+  assume 1: "ptr' \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  then have "h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root_ptr"
+    using assms(1) assms(2) assms(3) assms(5) assms(6) local.child_parent_dual
+      local.get_root_node_parent_same by blast
+  then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    using "1" assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) local.child_parent_dual
+      local.get_dom_component_parent_inside local.get_dom_component_subset by blast
+  then show "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child \<in> set c"
+    by (smt \<open>h \<turnstile> get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root_ptr\<close> assms(1) assms(2) assms(3)
+        assms(5) assms(6) disjoint_iff_not_equal is_OK_returns_result_E is_OK_returns_result_I
+        l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_no_overlap local.child_parent_dual local.get_dom_component_ok
+        local.get_dom_component_parent_inside local.get_dom_component_ptr local.get_root_node_ptr_in_heap
+        local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms)
+qed
+
+
+lemma get_child_nodes_get_dom_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
+  shows "cast ` set children \<subseteq> set c"
+  using assms get_child_nodes_is_strongly_dom_component_safe
+  using local.get_dom_component_ptr by auto
+
+
+lemma
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
+  assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_dom_component_safe {ptr} (cast ` set children) h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_child_nodes_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def)[1]
+    by (smt IntI finite_set_in get_child_nodes_is_strongly_dom_component_safe is_OK_returns_result_E
+        is_OK_returns_result_I local.get_child_nodes_ptr_in_heap local.get_dom_component_impl
+        local.get_dom_component_ok local.get_dom_component_ptr select_result_I2)
+qed
+end
+
+interpretation i_get_dom_component_get_child_nodes?: l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_parent\<close>
+
+locale l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_parent_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_parent ptr' \<rightarrow>\<^sub>r Some parent"
+  shows "parent \<in> set c \<longleftrightarrow> cast ptr' \<in> set c"
+  by (meson assms(1) assms(2) assms(3) assms(4) assms(5) is_OK_returns_result_E
+      l_to_tree_order_wf.to_tree_order_parent local.get_dom_component_parent_inside
+      local.get_dom_component_subset local.get_dom_component_to_tree_order_subset
+      local.get_parent_parent_in_heap local.l_to_tree_order_wf_axioms local.to_tree_order_ok
+      local.to_tree_order_ptr_in_result subsetCE)
+
+
+lemma get_parent_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some parent"
+  assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_dom_component_safe {cast node_ptr} {parent} h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_parent_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def)[1]
+    by (metis IntI finite_set_in local.get_dom_component_impl local.get_dom_component_ok
+        local.get_dom_component_parent_inside local.get_dom_component_ptr local.get_parent_parent_in_heap
+        local.known_ptrs_known_ptr local.parent_child_rel_child_in_heap local.parent_child_rel_parent
+        returns_result_select_result)
+qed
+end
+
+interpretation i_get_dom_component_get_parent?: l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_root\_node\<close>
+
+locale l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_root_node_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root"
+  shows "root \<in> set c \<longleftrightarrow> ptr' \<in> set c"
+proof
+  assume 1: "root \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  have "h \<turnstile> get_root_node root \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  moreover have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    by (metis (no_types, lifting) calculation assms(1) assms(2) assms(3) assms(5)
+        is_OK_returns_result_E local.get_root_node_root_in_heap local.to_tree_order_ok
+        local.to_tree_order_ptr_in_result local.to_tree_order_same_root select_result_I2)
+  ultimately have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    apply(auto simp add: get_dom_component_def)[1]
+    by (smt "1" assms(1) assms(2) assms(3) assms(4) bind_pure_returns_result_I bind_returns_result_E3
+        local.get_dom_component_def local.get_dom_component_subset local.get_root_node_pure)
+  then show "ptr' \<in> set c"
+    using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
+next
+  assume 1: "ptr' \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  then have "h \<turnstile> get_root_node root \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(1) assms(2) assms(3) assms(5) is_OK_returns_result_E
+        local.get_root_node_root_in_heap local.to_tree_order_ok local.to_tree_order_ptr_in_result
+        local.to_tree_order_same_root returns_result_eq)
+  then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    using "1" assms(1) assms(2) assms(3) assms(4) local.get_dom_component_subset by blast
+  then show "root \<in> set c"
+    using assms(5) bind_returns_result_E3 local.get_dom_component_def local.to_tree_order_ptr_in_result
+    by fastforce
+qed
+
+lemma get_root_node_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
+  assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_dom_component_safe {ptr} {root} h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_root_node_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def)[1]
+    by (metis (no_types, lifting) IntI finite_set_in get_root_node_is_strongly_dom_component_safe_step
+        is_OK_returns_result_I local.get_dom_component_impl local.get_dom_component_ok
+        local.get_dom_component_ptr local.get_root_node_ptr_in_heap returns_result_select_result)
+qed
+end
+
+interpretation i_get_dom_component_get_root_node?: l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_element\_by\_id\<close>
+
+locale l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_element_by_id_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result"
+  shows "cast result \<in> set c \<longleftrightarrow> ptr' \<in> set c"
+proof
+  assume 1: "cast result \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  then have "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using \<open>h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c\<close>
+    by (simp add: get_dom_component_def bind_returns_result_E3)
+
+  obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
+    using \<open>h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result\<close>
+    apply(simp add: get_element_by_id_def first_in_tree_order_def)
+    by (meson bind_is_OK_E is_OK_returns_result_I)
+  then have "cast result \<in> set to'"
+    using \<open>h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result\<close> get_element_by_id_result_in_tree_order
+    by blast
+
+  have "h \<turnstile> get_root_node (cast result) \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    using \<open>cast result \<in> set to'\<close> \<open>h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'\<close>
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_ptr get_dom_component_root_node_same
+      get_dom_component_subset get_dom_component_to_tree_order
+    by blast
+  then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    using \<open>h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c\<close>
+    using get_dom_component_def by auto
+  then show "ptr' \<in> set c"
+    using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
+next
+  assume "ptr' \<in> set c"
+  moreover obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
+    by (meson assms(1) assms(2) assms(3) assms(4) calculation get_dom_component_ptr_in_heap
+        get_dom_component_subset is_OK_returns_result_E is_OK_returns_result_I to_tree_order_ok)
+  ultimately have "set to' \<subseteq> set c"
+    using assms(1) assms(2) assms(3) assms(4) get_dom_component_subset
+      get_dom_component_to_tree_order_subset
+    by blast
+  moreover have "cast result \<in> set to'"
+    using assms(5) get_element_by_id_result_in_tree_order to' by blast
+  ultimately show "cast result \<in> set c"
+    by blast
+qed
+
+
+lemma get_element_by_id_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>r Some result"
+  assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_dom_component_safe {ptr} {cast result} h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by(auto simp add: preserved_def get_element_by_id_def first_in_tree_order_def
+        elim!: bind_returns_heap_E2 intro!: map_filter_M_pure bind_pure_I
+        split: option.splits list.splits)
+  have "ptr |\<in>| object_ptr_kinds h"
+    using assms(4)
+    apply(auto simp add: get_element_by_id_def)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
+        local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
+  obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.to_tree_order_ok)
+  then have "cast result \<in> set to"
+    using assms(4) local.get_element_by_id_result_in_tree_order by auto
+  obtain c where c: "h \<turnstile> a_get_dom_component ptr \<rightarrow>\<^sub>r c"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_dom_component_impl
+      local.get_dom_component_ok by blast
+
+  then show ?thesis
+    using assms \<open>h = h'\<close>
+    apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def get_element_by_id_def
+        first_in_tree_order_def elim!: bind_returns_result_E2 intro!: map_filter_M_pure bind_pure_I
+        split: option.splits list.splits)[1]
+    by (metis (no_types, lifting) Int_iff \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
+        get_element_by_id_is_strongly_dom_component_safe_step local.get_dom_component_impl
+        local.get_dom_component_ptr select_result_I2)
+qed
+end
+
+interpretation i_get_dom_component_get_element_by_id?: l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+subsubsection \<open>get\_elements\_by\_class\_name\<close>
+
+locale l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_elements_by_class_name_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_elements_by_class_name ptr' idd \<rightarrow>\<^sub>r results"
+  assumes "result \<in> set results"
+  shows "cast result \<in> set c \<longleftrightarrow> ptr' \<in> set c"
+proof
+  assume 1: "cast result \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  then have "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using \<open>h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c\<close>
+    by (simp add: get_dom_component_def bind_returns_result_E3)
+
+  obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
+    using assms(5)
+    apply(simp add: get_elements_by_class_name_def first_in_tree_order_def)
+    by (meson bind_is_OK_E is_OK_returns_result_I)
+  then have "cast result \<in> set to'"
+    using assms get_elements_by_class_name_result_in_tree_order by blast
+
+  have "h \<turnstile> get_root_node (cast result) \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    using \<open>cast result \<in> set to'\<close> \<open>h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'\<close>
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_ptr get_dom_component_root_node_same
+      get_dom_component_subset get_dom_component_to_tree_order
+    by blast
+  then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    using \<open>h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c\<close>
+    using get_dom_component_def by auto
+  then show "ptr' \<in> set c"
+    using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
+next
+  assume "ptr' \<in> set c"
+  moreover obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
+    by (meson assms(1) assms(2) assms(3) assms(4) calculation get_dom_component_ptr_in_heap
+        get_dom_component_subset is_OK_returns_result_E is_OK_returns_result_I to_tree_order_ok)
+  ultimately have "set to' \<subseteq> set c"
+    using assms(1) assms(2) assms(3) assms(4) get_dom_component_subset
+      get_dom_component_to_tree_order_subset
+    by blast
+  moreover have "cast result \<in> set to'"
+    using assms get_elements_by_class_name_result_in_tree_order to' by blast
+  ultimately show "cast result \<in> set c"
+    by blast
+qed
+
+lemma get_elements_by_class_name_pure [simp]:
+  "pure (get_elements_by_class_name ptr name) h"
+  by(auto simp add: get_elements_by_class_name_def intro!: bind_pure_I map_filter_M_pure
+      split: option.splits)
+
+lemma get_elements_by_class_name_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_elements_by_class_name ptr name \<rightarrow>\<^sub>r results"
+  assumes "h \<turnstile> get_elements_by_class_name ptr name \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_dom_component_safe {ptr} (cast ` set results) h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson get_elements_by_class_name_pure pure_returns_heap_eq)
+  have "ptr |\<in>| object_ptr_kinds h"
+    using assms(4)
+    apply(auto simp add: get_elements_by_class_name_def)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
+        local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
+  obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.to_tree_order_ok)
+  then have "cast ` set results \<subseteq> set to"
+    using assms(4) local.get_elements_by_class_name_result_in_tree_order by auto
+  obtain c where c: "h \<turnstile> a_get_dom_component ptr \<rightarrow>\<^sub>r c"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_dom_component_impl
+      local.get_dom_component_ok by blast
+
+  then show ?thesis
+    using assms \<open>h = h'\<close>
+    apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def
+        get_elements_by_class_name_def first_in_tree_order_def elim!: bind_returns_result_E2
+        intro!: map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
+    by (metis (no_types, lifting) Int_iff \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
+        get_elements_by_class_name_is_strongly_dom_component_safe_step local.get_dom_component_impl
+        local.get_dom_component_ptr select_result_I2)
+qed
+end
+
+interpretation i_get_dom_component_get_elements_by_class_name?:
+  l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_elements\_by\_tag\_name\<close>
+
+locale l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_elements_by_tag_name_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  assumes "h \<turnstile> get_elements_by_tag_name ptr' idd \<rightarrow>\<^sub>r results"
+  assumes "result \<in> set results"
+  shows "cast result \<in> set c \<longleftrightarrow> ptr' \<in> set c"
+proof
+  assume 1: "cast result \<in> set c"
+  obtain root_ptr where
+    root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
+  then have "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using \<open>h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c\<close>
+    by (simp add: get_dom_component_def bind_returns_result_E3)
+
+  obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
+    using assms(5)
+    apply(simp add: get_elements_by_tag_name_def first_in_tree_order_def)
+    by (meson bind_is_OK_E is_OK_returns_result_I)
+  then have "cast result \<in> set to'"
+    using assms get_elements_by_tag_name_result_in_tree_order by blast
+
+  have "h \<turnstile> get_root_node (cast result) \<rightarrow>\<^sub>r root_ptr"
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
+    by blast
+  then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
+    using \<open>cast result \<in> set to'\<close> \<open>h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'\<close>
+    using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_ptr
+      get_dom_component_root_node_same get_dom_component_subset get_dom_component_to_tree_order
+    by blast
+  then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    using \<open>h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c\<close>
+    using get_dom_component_def by auto
+  then show "ptr' \<in> set c"
+    using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
+next
+  assume "ptr' \<in> set c"
+  moreover obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
+    by (meson assms(1) assms(2) assms(3) assms(4) calculation get_dom_component_ptr_in_heap
+        get_dom_component_subset is_OK_returns_result_E is_OK_returns_result_I to_tree_order_ok)
+  ultimately have "set to' \<subseteq> set c"
+    using assms(1) assms(2) assms(3) assms(4) get_dom_component_subset
+      get_dom_component_to_tree_order_subset
+    by blast
+  moreover have "cast result \<in> set to'"
+    using assms get_elements_by_tag_name_result_in_tree_order to' by blast
+  ultimately show "cast result \<in> set c"
+    by blast
+qed
+
+lemma get_elements_by_tag_name_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_elements_by_tag_name ptr name \<rightarrow>\<^sub>r results"
+  assumes "h \<turnstile> get_elements_by_tag_name ptr name \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_dom_component_safe {ptr} (cast ` set results) h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson get_elements_by_tag_name_pure pure_returns_heap_eq)
+  have "ptr |\<in>| object_ptr_kinds h"
+    using assms(4)
+    apply(auto simp add: get_elements_by_tag_name_def)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
+        local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
+  obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.to_tree_order_ok)
+  then have "cast ` set results \<subseteq> set to"
+    using assms(4) local.get_elements_by_tag_name_result_in_tree_order by auto
+  obtain c where c: "h \<turnstile> a_get_dom_component ptr \<rightarrow>\<^sub>r c"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_dom_component_impl
+      local.get_dom_component_ok by blast
+
+  then show ?thesis
+    using assms \<open>h = h'\<close>
+    apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def
+        get_elements_by_class_name_def first_in_tree_order_def elim!: bind_returns_result_E2
+        intro!: map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
+    by (metis (no_types, lifting) IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
+        get_elements_by_tag_name_is_strongly_dom_component_safe_step local.get_dom_component_impl
+        local.get_dom_component_ptr select_result_I2)
+qed
+end
+
+interpretation i_get_dom_component_get_elements_by_tag_name?:
+  l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>remove\_child\<close>
+
+lemma remove_child_unsafe: "\<not>(\<forall>(h
+    :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+  ) h' ptr child. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
+h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h' \<longrightarrow> is_weakly_dom_component_safe {ptr, cast child} {} h h')"
+proof -
+  obtain h document_ptr e1 e2 where h: "Inr ((document_ptr, e1, e2), h) = (Heap (fmempty)
+      :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+    ) \<turnstile> (do {
+      document_ptr \<leftarrow> create_document;
+      e1 \<leftarrow> create_element document_ptr ''div'';
+      e2 \<leftarrow> create_element document_ptr ''div'';
+      append_child (cast e1) (cast e2);
+      return (document_ptr, e1, e2)
+  })"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then obtain h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    h': "h \<turnstile> remove_child (cast e1) (cast e2) \<rightarrow>\<^sub>h h'" and
+    "\<not>(is_weakly_dom_component_safe {cast e1, cast e2} {} h h')"
+    apply(code_simp)
+    apply(clarify)
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then show ?thesis
+    by auto
+qed
+
+
+subsubsection \<open>adopt\_node\<close>
+
+lemma adopt_node_unsafe: "\<not>(\<forall>(h
+    :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+  ) h' document_ptr child. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<longrightarrow> is_weakly_dom_component_safe {cast document_ptr, cast child} {} h h')"
+proof -
+  obtain h document_ptr document_ptr2 e1 where h: "Inr ((document_ptr, document_ptr2, e1), h) = (Heap (fmempty)
+      :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+    ) \<turnstile> (do {
+      document_ptr \<leftarrow> create_document;
+      document_ptr2 \<leftarrow> create_document;
+      e1 \<leftarrow> create_element document_ptr ''div'';
+      adopt_node document_ptr2 (cast e1);
+      return (document_ptr, document_ptr2, e1)
+  })"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then obtain h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    h': "h \<turnstile> adopt_node document_ptr (cast e1) \<rightarrow>\<^sub>h h'" and
+    "\<not>(is_weakly_dom_component_safe {cast document_ptr, cast e1} {} h h')"
+    apply(code_simp)
+    apply(clarify)
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then show ?thesis
+    by auto
+qed
+
+
+subsubsection \<open>create\_element\<close>
+
+lemma create_element_not_strongly_dom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
+    h' and document_ptr and new_element_ptr and tag where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr \<rightarrow>\<^sub>h h'" and
+    "\<not> is_strongly_dom_component_safe {cast document_ptr} {cast new_element_ptr} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
+  let ?P = "create_document"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?document_ptr = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and document_ptr="?document_ptr"])
+    by code_simp+
+qed
+
+
+locale l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name +
+  l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs set_tag_name set_tag_name_locs type_wf create_element known_ptr +
+  l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs +
+  l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_disconnected_nodes set_disconnected_nodes_locs +
+  l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_tag_name set_tag_name_locs +
+  l_new_element_get_disconnected_nodes get_disconnected_nodes get_disconnected_nodes_locs +
+  l_new_element_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs +
+  l_set_tag_name_get_child_nodes type_wf set_tag_name set_tag_name_locs known_ptr
+  get_child_nodes get_child_nodes_locs +
+  l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr known_ptrs type_wf get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs heap_is_wellformed parent_child_rel set_tag_name
+  set_tag_name_locs
+  set_disconnected_nodes set_disconnected_nodes_locs create_element
+  for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and is_strongly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and is_weakly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
+    and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
+    and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and set_tag_name :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and create_element :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr) prog"
+begin
+
+lemma create_element_is_weakly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
+  assumes "ptr \<noteq> cast |h \<turnstile> create_element document_ptr tag|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  obtain new_element_ptr h2 h3 disc_nodes where
+    new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
+    h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile>set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
+    disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes) \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: create_element_def
+        elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])
+  have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
+    using new_element_ptr h2 h3 disc_nodes h'
+    apply(auto simp add: create_element_def intro!: bind_returns_result_I
+        bind_pure_returns_result_I[OF get_disconnected_nodes_pure])[1]
+     apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+    by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+  have "preserved (get_M ptr getter) h h2"
+    using h2 new_element_ptr
+    apply(rule new_element_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t)
+    using new_element_ptr assms(6) \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close>
+    by simp
+
+  have "preserved (get_M ptr getter) h2 h3"
+    using set_tag_name_writes h3
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: set_tag_name_locs_impl a_set_tag_name_locs_def all_args_def)[1]
+    by (metis (no_types, lifting) \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(6)
+        get_M_Element_preserved8 select_result_I2)
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using create_element_document_in_heap
+    using assms(4)
+    by blast
+  then
+  have "ptr \<noteq> (cast document_ptr)"
+    using assms(5) assms(1) assms(2) assms(3) local.get_dom_component_ok local.get_dom_component_ptr
+    by auto
+  have "preserved (get_M ptr getter) h3 h'"
+    using set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: set_disconnected_nodes_locs_def all_args_def)[1]
+    by (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+
+  show ?thesis
+    using \<open>preserved (get_M ptr getter) h h2\<close> \<open>preserved (get_M ptr getter) h2 h3\<close>
+      \<open>preserved (get_M ptr getter) h3 h'\<close>
+    by(auto simp add: preserved_def)
+qed
+
+
+lemma create_element_is_weakly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
+  shows "is_weakly_dom_component_safe {cast document_ptr} {cast result} h h'"
+proof -
+
+  obtain new_element_ptr h2 h3 disc_nodes_h3 where
+    new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
+    h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
+    disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
+    using assms(5)
+    by(auto simp add: create_element_def
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+  then have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
+    apply(auto simp add: create_element_def intro!: bind_returns_result_I)[1]
+      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+     apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
+        pure_returns_heap_eq)
+    by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+
+  have "new_element_ptr \<notin> set |h \<turnstile> element_ptr_kinds_M|\<^sub>r"
+    using new_element_ptr ElementMonad.ptr_kinds_ptr_kinds_M h2
+    using new_element_ptr_not_in_heap by blast
+  then have "cast new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have "cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+
+  have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    using new_element_new_ptr h2 new_element_ptr by blast
+  then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
+    apply(simp add: element_ptr_kinds_def)
+    by force
+  have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_tag_name_writes h3])
+    using set_tag_name_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+  have "known_ptr (cast new_element_ptr)"
+    using \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> local.create_element_known_ptr
+    by blast
+  then
+  have "known_ptrs h2"
+    using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
+    by blast
+  then
+  have "known_ptrs h3"
+    using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
+  then
+  have "known_ptrs h'"
+    using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_element_ptr
+              \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2 get_child_nodes_new_element[rotated, OF new_element_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_element_ptr
+                                    \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+
+  have "h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
+    using new_element_ptr h2 new_element_ptr_in_heap[OF h2 new_element_ptr]
+      new_element_is_element_ptr[OF new_element_ptr] new_element_no_child_nodes
+    by blast
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                             = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads h2 get_disconnected_nodes_new_element[OF new_element_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have disconnected_nodes_eq2_h:
+    "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_tag_name_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_tag_name_get_child_nodes)
+  then have children_eq2_h2: "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                               = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_tag_name_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_tag_name_get_disconnected_nodes)
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have "type_wf h2"
+    using \<open>type_wf h\<close> new_element_types_preserved h2 by blast
+  then have "type_wf h3"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_tag_name_writes h3]
+    using  set_tag_name_types_preserved
+    by(auto simp add: reflp_def transp_def)
+  then have "type_wf h'"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
+    using  set_disconnected_nodes_types_preserved
+    by(auto simp add: reflp_def transp_def)
+
+  have children_eq_h3:
+    "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_child_nodes)
+  then have children_eq2_h3: "\<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h3:
+    "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+       \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                               = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
+  then have disconnected_nodes_eq2_h3:
+    "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
+                \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
+  then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h by auto
+  then have "cast new_element_ptr \<notin> set disc_nodes_h3"
+    using \<open>heap_is_wellformed h\<close>
+    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      a_all_ptrs_in_heap_def heap_is_wellformed_def
+    using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
+
+  have "acyclic (parent_child_rel h)"
+    using \<open>heap_is_wellformed h\<close>
+    by (simp add: heap_is_wellformed_def acyclic_heap_def)
+  also have "parent_child_rel h = parent_child_rel h2"
+  proof(auto simp add: parent_child_rel_def)[1]
+    fix a x
+    assume 0: "a |\<in>| object_ptr_kinds h"
+      and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+    then show "a |\<in>| object_ptr_kinds h2"
+      by (simp add: object_ptr_kinds_eq_h)
+  next
+    fix a x
+    assume 0: "a |\<in>| object_ptr_kinds h"
+      and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+    then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+  next
+    fix a x
+    assume 0: "a |\<in>| object_ptr_kinds h2"
+      and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+    then show "a |\<in>| object_ptr_kinds h"
+      using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+      by(auto)
+  next
+    fix a x
+    assume 0: "a |\<in>| object_ptr_kinds h2"
+      and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+    then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      by (metis (no_types, lifting)
+          \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+          children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+  qed
+  also have "\<dots> = parent_child_rel h3"
+    by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
+  also have "\<dots> = parent_child_rel h'"
+    by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
+  finally have "a_acyclic_heap h'"
+    by (simp add: acyclic_heap_def)
+
+  have "a_all_ptrs_in_heap h"
+    using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
+  then have "a_all_ptrs_in_heap h2"
+    apply(auto simp add: a_all_ptrs_in_heap_def)[1]
+     apply (metis \<open>known_ptrs h2\<close> \<open>parent_child_rel h = parent_child_rel h2\<close> \<open>type_wf h2\<close> assms
+        funion_iff local.get_child_nodes_ok local.known_ptrs_known_ptr local.parent_child_rel_child_in_heap
+        local.parent_child_rel_child_nodes2 node_ptr_kinds_commutes node_ptr_kinds_eq_h
+        returns_result_select_result)
+    by (metis assms disconnected_nodes_eq2_h document_ptr_kinds_eq_h funion_iff
+        local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq_h
+        returns_result_select_result)
+  then have "a_all_ptrs_in_heap h3"
+    by (simp add: children_eq2_h2 disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
+        local.a_all_ptrs_in_heap_def node_ptr_kinds_eq_h2 object_ptr_kinds_eq_h2)
+  then have "a_all_ptrs_in_heap h'"
+    by (smt \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> children_eq2_h3
+        disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h3
+        finite_set_in h' is_OK_returns_result_I
+        l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+        local.a_all_ptrs_in_heap_def local.get_child_nodes_ptr_in_heap
+        local.l_set_disconnected_nodes_get_disconnected_nodes_axioms node_ptr_kinds_commutes
+        object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 select_result_I2 set_ConsD subset_code(1))
+
+  have "\<And>p. p |\<in>| object_ptr_kinds h \<Longrightarrow> cast new_element_ptr \<notin> set |h \<turnstile> get_child_nodes p|\<^sub>r"
+    using \<open>heap_is_wellformed h\<close> \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      heap_is_wellformed_children_in_heap
+    by (meson NodeMonad.ptr_kinds_ptr_kinds_M a_all_ptrs_in_heap_def assms fset_mp
+        fset_of_list_elem get_child_nodes_ok known_ptrs_known_ptr returns_result_select_result)
+  then have "\<And>p. p |\<in>| object_ptr_kinds h2 \<Longrightarrow> cast new_element_ptr \<notin> set |h2 \<turnstile> get_child_nodes p|\<^sub>r"
+    using children_eq2_h
+    apply(auto simp add: object_ptr_kinds_eq_h)[1]
+    using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> apply auto[1]
+    by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>)
+  then have "\<And>p. p |\<in>| object_ptr_kinds h3 \<Longrightarrow> cast new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r"
+    using object_ptr_kinds_eq_h2 children_eq2_h2 by auto
+  then have new_element_ptr_not_in_any_children:
+    "\<And>p. p |\<in>| object_ptr_kinds h' \<Longrightarrow> cast new_element_ptr \<notin> set |h' \<turnstile> get_child_nodes p|\<^sub>r"
+    using object_ptr_kinds_eq_h3 children_eq2_h3 by auto
+
+  have "a_distinct_lists h"
+    using \<open>heap_is_wellformed h\<close>
+    by (simp add: heap_is_wellformed_def)
+  then have "a_distinct_lists h2"
+
+    using \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+    apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h document_ptr_kinds_eq_h
+        disconnected_nodes_eq2_h intro!: distinct_concat_map_I)[1]
+       apply (metis distinct_sorted_list_of_set finite_fset sorted_list_of_set_insert)
+      apply(case_tac "x=cast new_element_ptr")
+       apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
+      apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
+     apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
+     apply (metis IntI assms empty_iff local.get_child_nodes_ok
+        local.heap_is_wellformed_one_parent local.known_ptrs_known_ptr returns_result_select_result)
+    apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
+    by (metis \<open>local.a_distinct_lists h\<close> \<open>type_wf h2\<close> disconnected_nodes_eq_h document_ptr_kinds_eq_h
+        local.distinct_lists_no_parent local.get_disconnected_nodes_ok returns_result_select_result)
+
+  then have "a_distinct_lists h3"
+    by(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
+        children_eq2_h2 object_ptr_kinds_eq_h2)
+  then have "a_distinct_lists h'"
+  proof(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h3 children_eq2_h3
+      object_ptr_kinds_eq_h3 document_ptr_kinds_eq_h3
+      intro!: distinct_concat_map_I)[1]
+    fix x
+    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                                              (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
+      and "x |\<in>| document_ptr_kinds h3"
+    then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
+      using document_ptr_kinds_eq_h3 disconnected_nodes_eq_h3 h' set_disconnected_nodes_get_disconnected_nodes
+      by (metis (no_types, lifting) \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set disc_nodes_h3\<close>
+          \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disc_nodes_h3 distinct.simps(2)
+          distinct_lists_disconnected_nodes get_disconnected_nodes_ok returns_result_eq
+          returns_result_select_result)
+  next
+    fix x y xa
+    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                                            (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
+      and "x |\<in>| document_ptr_kinds h3"
+      and "y |\<in>| document_ptr_kinds h3"
+      and "x \<noteq> y"
+      and "xa \<in> set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
+      and "xa \<in> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r"
+    moreover have "set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h3 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
+      using calculation by(auto dest: distinct_concat_map_E(1))
+    ultimately show "False"
+      apply(-)
+      apply(cases "x = document_ptr")
+       apply (smt NodeMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> \<open>local.a_all_ptrs_in_heap h\<close>
+          disc_nodes_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
+          disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
+          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
+          select_result_I2 set_ConsD subsetD)
+      by (smt NodeMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> \<open>local.a_all_ptrs_in_heap h\<close>
+          disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
+          disconnected_nodes_eq2_h3
+          disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
+          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
+          select_result_I2 set_ConsD subsetD)
+  next
+    fix x xa xb
+    assume 2: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
+                   \<inter> (\<Union>x\<in>fset (document_ptr_kinds h3). set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
+      and 3: "xa |\<in>| object_ptr_kinds h3"
+      and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+      and 5: "xb |\<in>| document_ptr_kinds h3"
+      and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+    show "False"
+      using disc_nodes_document_ptr_h disconnected_nodes_eq2_h3
+      apply -
+      apply(cases "xb = document_ptr")
+       apply (metis (no_types, hide_lams) "3" "4" "6"
+          \<open>\<And>p. p |\<in>| object_ptr_kinds h3
+                      \<Longrightarrow> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r\<close>
+          \<open>a_distinct_lists h3\<close> children_eq2_h3 disc_nodes_h3 distinct_lists_no_parent h'
+          select_result_I2 set_ConsD set_disconnected_nodes_get_disconnected_nodes)
+      by (metis "3" "4" "5" "6" \<open>a_distinct_lists h3\<close> \<open>type_wf h3\<close> children_eq2_h3
+          distinct_lists_no_parent get_disconnected_nodes_ok returns_result_select_result)
+  qed
+
+  have "a_owner_document_valid h"
+    using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
+  then have "a_owner_document_valid h'"
+    using disc_nodes_h3 \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
+    apply(auto simp add: a_owner_document_valid_def)[1]
+    apply(auto simp add:  object_ptr_kinds_eq_h object_ptr_kinds_eq_h3 )[1]
+    apply(auto simp add: object_ptr_kinds_eq_h2)[1]
+    apply(auto simp add:  document_ptr_kinds_eq_h document_ptr_kinds_eq_h3 )[1]
+    apply(auto simp add: document_ptr_kinds_eq_h2)[1]
+    apply(auto simp add:  node_ptr_kinds_eq_h node_ptr_kinds_eq_h3 )[1]
+    apply(auto simp add: node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h )[1]
+     apply(auto simp add: children_eq2_h2[symmetric] children_eq2_h3[symmetric]
+        disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
+        disconnected_nodes_eq2_h3)[1]
+     apply (metis (no_types, lifting) document_ptr_kinds_eq_h h' list.set_intros(1)
+        local.set_disconnected_nodes_get_disconnected_nodes select_result_I2)
+    apply(simp add: object_ptr_kinds_eq_h)
+    by(metis (no_types, lifting) NodeMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> children_eq2_h
+        children_eq2_h2 children_eq2_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
+        disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h finite_set_in h'
+        l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+        list.set_intros(2) local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
+        node_ptr_kinds_commutes select_result_I2)
+
+
+  have "parent_child_rel h = parent_child_rel h'"
+  proof -
+    have "parent_child_rel h = parent_child_rel h2"
+    proof(auto simp add: parent_child_rel_def)[1]
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h2"
+        by (simp add: object_ptr_kinds_eq_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+            \<open>cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h"
+        using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+        by(auto)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+            children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+    qed
+    also have "\<dots> = parent_child_rel h3"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
+    also have "\<dots> = parent_child_rel h'"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
+    finally show ?thesis
+      by simp
+  qed
+  have root: "h \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
+    by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> local.get_root_node_not_node_same)
+  then
+  have root': "h' \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
+    by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
+        local.get_root_node_not_node_same object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3)
+
+  have "heap_is_wellformed h'" and "known_ptrs h'"
+    using create_element_preserves_wellformedness assms
+    by blast+
+
+  have "cast result |\<notin>| object_ptr_kinds h"
+    using \<open>cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+    by (metis (full_types) ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(4) returns_result_eq)
+
+  obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
+    by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        document_ptr_kinds_commutes is_OK_returns_result_E local.to_tree_order_ok)
+  then
+  have "h \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to"
+    using root
+    by(auto simp add: a_get_dom_component_def)
+  moreover
+  obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
+    by (meson \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> is_OK_returns_result_E
+        local.get_root_node_root_in_heap local.to_tree_order_ok root')
+  then
+  have "h' \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to'"
+    using root'
+    by(auto simp add: a_get_dom_component_def)
+  moreover
+  have "\<And>child. child \<in> set to \<longleftrightarrow> child \<in> set to'"
+    by (metis \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>parent_child_rel h = parent_child_rel h'\<close>
+        \<open>type_wf h'\<close> assms(1) assms(2) assms(3) local.to_tree_order_parent_child_rel to to')
+  ultimately
+  have "set |h \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r"
+    by(auto simp add: a_get_dom_component_def)
+
+  show ?thesis
+    apply(auto simp add: is_weakly_dom_component_safe_def Let_def)[1]
+    using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> assms(2) assms(3)
+      children_eq_h local.get_child_nodes_ok local.get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr
+      object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 returns_result_select_result
+       apply (metis is_OK_returns_result_I)
+      apply (metis \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(4)
+        element_ptr_kinds_commutes h2 new_element_ptr new_element_ptr_in_heap node_ptr_kinds_eq_h2
+        node_ptr_kinds_eq_h3 returns_result_eq returns_result_heap_def)
+    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r result |\<notin>| object_ptr_kinds h\<close> element_ptr_kinds_commutes
+      node_ptr_kinds_commutes apply blast
+    using assms(1) assms(2) assms(3) \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'\<close>
+    apply(rule create_element_is_weakly_dom_component_safe_step)
+     apply (simp add: local.get_dom_component_impl)
+    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+      \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close>
+    by auto
+
+qed
+end
+
+interpretation i_get_dom_component_create_element?: l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name get_disconnected_nodes
+  get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs set_tag_name
+  set_tag_name_locs create_element
+  by(auto simp add: l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+
+subsubsection \<open>create\_character\_data\<close>
+
+lemma create_character_data_not_strongly_dom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder},
+'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
+    h' and document_ptr and create_character_datanew_character_data_ptr and tag where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> create_character_data document_ptr tag \<rightarrow>\<^sub>r create_character_datanew_character_data_ptr \<rightarrow>\<^sub>h h'" and
+    "\<not> is_strongly_dom_component_safe {cast document_ptr} {cast create_character_datanew_character_data_ptr} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
+  let ?P = "create_document"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?document_ptr = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and document_ptr="?document_ptr"])
+    by code_simp+
+qed
+
+locale l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name +
+  l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs set_val set_val_locs type_wf create_character_data known_ptr +
+  l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs +
+  l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_disconnected_nodes set_disconnected_nodes_locs +
+  l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_val set_val_locs +
+  l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs heap_is_wellformed parent_child_rel set_val
+  set_val_locs set_disconnected_nodes set_disconnected_nodes_locs
+  create_character_data known_ptrs
+  for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and is_strongly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and is_weakly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
+    and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
+    and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and create_character_data :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) character_data_ptr) prog"
+begin
+
+lemma create_character_data_is_weakly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
+  assumes "ptr \<noteq> cast |h \<turnstile> create_character_data document_ptr text|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  obtain new_character_data_ptr h2 h3 disc_nodes where
+    new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
+    h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
+    disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes) \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: create_character_data_def elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])
+
+  have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
+    using new_character_data_ptr h2 h3 disc_nodes h'
+    apply(auto simp add: create_character_data_def intro!: bind_returns_result_I
+        bind_pure_returns_result_I[OF get_disconnected_nodes_pure])[1]
+     apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+    by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+  have "preserved (get_M ptr getter) h h2"
+    using h2 new_character_data_ptr
+    apply(rule new_character_data_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t)
+    using new_character_data_ptr assms(6)
+      \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
+    by simp
+
+  have "preserved (get_M ptr getter) h2 h3"
+    using set_val_writes h3
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: set_val_locs_impl a_set_val_locs_def all_args_def)[1]
+    by (metis (mono_tags) CharacterData_simp11
+        \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(4) assms(6)
+        is_OK_returns_heap_I is_OK_returns_result_E returns_result_eq select_result_I2)
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using create_character_data_document_in_heap
+    using assms(4)
+    by blast
+  then
+  have "ptr \<noteq> (cast document_ptr)"
+    using assms(5) assms(1) assms(2) assms(3) local.get_dom_component_ok local.get_dom_component_ptr
+    by auto
+  have "preserved (get_M ptr getter) h3 h'"
+    using set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: set_disconnected_nodes_locs_def all_args_def)[1]
+    by (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+
+  show ?thesis
+    using \<open>preserved (get_M ptr getter) h h2\<close> \<open>preserved (get_M ptr getter) h2 h3\<close>
+      \<open>preserved (get_M ptr getter) h3 h'\<close>
+    by(auto simp add: preserved_def)
+qed
+
+lemma create_character_data_is_weakly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
+  shows "is_weakly_dom_component_safe {cast document_ptr} {cast result} h h'"
+proof -
+
+
+  obtain new_character_data_ptr h2 h3 disc_nodes_h3 where
+    new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
+    h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
+    disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
+    using assms(5)
+    by(auto simp add: create_character_data_def
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+  then
+  have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
+    apply(auto simp add: create_character_data_def intro!: bind_returns_result_I)[1]
+      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+     apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
+        pure_returns_heap_eq)
+    by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+
+  have "new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r"
+    using new_character_data_ptr CharacterDataMonad.ptr_kinds_ptr_kinds_M h2
+    using new_character_data_ptr_not_in_heap by blast
+  then have "cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have "cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+
+
+
+  have object_ptr_kinds_eq_h:
+    "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    using new_character_data_new_ptr h2 new_character_data_ptr by blast
+  then have node_ptr_kinds_eq_h:
+    "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have character_data_ptr_kinds_eq_h:
+    "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
+    apply(simp add: character_data_ptr_kinds_def)
+    by force
+  have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
+    using set_val_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr
+                  \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h:
+    "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
+      \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have object_ptr_kinds_eq_h:
+    "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    using new_character_data_new_ptr h2 new_character_data_ptr by blast
+  then have node_ptr_kinds_eq_h:
+    "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have character_data_ptr_kinds_eq_h:
+    "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
+    apply(simp add: character_data_ptr_kinds_def)
+    by force
+  have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
+    using set_val_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr
+                \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
+                                 \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+
+  have "h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
+    using new_character_data_ptr h2 new_character_data_ptr_in_heap[OF h2 new_character_data_ptr]
+      new_character_data_is_character_data_ptr[OF new_character_data_ptr]
+      new_character_data_no_child_nodes
+    by blast
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                             = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads h2
+      get_disconnected_nodes_new_character_data[OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have disconnected_nodes_eq2_h:
+    "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_val_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_val_get_child_nodes)
+  then have children_eq2_h2:
+    "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                              = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_val_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_val_get_disconnected_nodes)
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have "type_wf h2"
+    using \<open>type_wf h\<close> new_character_data_types_preserved h2 by blast
+  then have "type_wf h3"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_val_writes h3]
+    using  set_val_types_preserved
+    by(auto simp add: reflp_def transp_def)
+  then have "type_wf h'"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
+    using  set_disconnected_nodes_types_preserved
+    by(auto simp add: reflp_def transp_def)
+
+  have children_eq_h3:
+    "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_child_nodes)
+  then have children_eq2_h3:
+    " \<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h3: "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+    \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                            = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
+  then have disconnected_nodes_eq2_h3: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
+             \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
+  then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h by auto
+  then have "cast new_character_data_ptr \<notin> set disc_nodes_h3"
+    using \<open>heap_is_wellformed h\<close> using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      a_all_ptrs_in_heap_def heap_is_wellformed_def
+    using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
+
+  have "parent_child_rel h = parent_child_rel h'"
+  proof -
+    have "parent_child_rel h = parent_child_rel h2"
+    proof(auto simp add: parent_child_rel_def)[1]
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h2"
+        by (simp add: object_ptr_kinds_eq_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+            \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h"
+        using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+        by(auto)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+            children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+    qed
+    also have "\<dots> = parent_child_rel h3"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
+    also have "\<dots> = parent_child_rel h'"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
+    finally show ?thesis
+      by simp
+  qed
+  have root: "h \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
+    by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> local.get_root_node_not_node_same)
+  then
+  have root': "h' \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
+    by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
+        local.get_root_node_not_node_same object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3)
+
+
+  have "heap_is_wellformed h'" and "known_ptrs h'"
+    using create_character_data_preserves_wellformedness assms
+    by blast+
+
+  have "cast result |\<notin>| object_ptr_kinds h"
+    using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+    by (metis (full_types) ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(4) returns_result_eq)
+
+  obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
+    by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        document_ptr_kinds_commutes is_OK_returns_result_E local.to_tree_order_ok)
+  then
+  have "h \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to"
+    using root
+    by(auto simp add: a_get_dom_component_def)
+  moreover
+  obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
+    by (meson \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> is_OK_returns_result_E
+        local.get_root_node_root_in_heap local.to_tree_order_ok root')
+  then
+  have "h' \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to'"
+    using root'
+    by(auto simp add: a_get_dom_component_def)
+  moreover
+  have "\<And>child. child \<in> set to \<longleftrightarrow> child \<in> set to'"
+    by (metis \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>parent_child_rel h = parent_child_rel h'\<close>
+        \<open>type_wf h'\<close> assms(1) assms(2) assms(3) local.to_tree_order_parent_child_rel to to')
+  ultimately
+  have "set |h \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r"
+    by(auto simp add: a_get_dom_component_def)
+
+  show ?thesis
+    apply(auto simp add: is_weakly_dom_component_safe_def Let_def)[1]
+    using  assms(2) assms(3) children_eq_h local.get_child_nodes_ok
+      local.get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr object_ptr_kinds_eq_h2
+      object_ptr_kinds_eq_h3 returns_result_select_result
+       apply (metis \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+        is_OK_returns_result_I)
+
+      apply (metis \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(4)
+        character_data_ptr_kinds_commutes h2 new_character_data_ptr new_character_data_ptr_in_heap
+        node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h3 returns_result_eq)
+    using \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
+      \<open>new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r\<close> assms(4) returns_result_eq
+     apply fastforce
+    using  assms(2) assms(3) children_eq_h local.get_child_nodes_ok local.get_child_nodes_ptr_in_heap
+      local.known_ptrs_known_ptr object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 returns_result_select_result
+    apply (smt ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+        \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(1) assms(5)
+        create_character_data_is_weakly_dom_component_safe_step local.get_dom_component_impl select_result_I2)
+    done
+qed
+
+end
+
+interpretation i_get_dom_component_create_character_data?: l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name set_val set_val_locs
+  get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
+  create_character_data
+  by(auto simp add: l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>create\_document\<close>
+
+lemma create_document_unsafe: "\<not>(\<forall>(h
+    :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+  ) h' new_document_ptr. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
+h \<turnstile> create_document \<rightarrow>\<^sub>r new_document_ptr \<longrightarrow> h \<turnstile> create_document \<rightarrow>\<^sub>h h' \<longrightarrow>
+is_strongly_dom_component_safe {} {cast new_document_ptr} h h')"
+proof -
+  obtain h document_ptr where h: "Inr (document_ptr, h) = (Heap (fmempty)
+      :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+    ) \<turnstile> (do {
+      document_ptr \<leftarrow> create_document;
+      return (document_ptr)
+  })"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then obtain h' new_document_ptr where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    h': "h \<turnstile> create_document \<rightarrow>\<^sub>r new_document_ptr" and
+    h': "h \<turnstile> create_document \<rightarrow>\<^sub>h h'" and
+    "\<not>(is_strongly_dom_component_safe {} {cast new_document_ptr} h h')"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then show ?thesis
+    by blast
+qed
+
+locale l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name +
+  l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M create_document
+  for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and is_strongly_dom_component_safe ::
+    "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and is_weakly_dom_component_safe ::
+    "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
+    and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_element_by_id ::
+    "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
+    and get_elements_by_class_name ::
+    "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_elements_by_tag_name ::
+    "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and create_document :: "((_) heap, exception, (_) document_ptr) prog"
+begin
+
+lemma create_document_is_weakly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<noteq> cast |h \<turnstile> create_document|\<^sub>r"
+  shows "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
+  using assms
+  apply(auto simp add: create_document_def)[1]
+  by (metis assms(4) assms(5) is_OK_returns_heap_I local.create_document_def new_document_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
+      select_result_I)
+
+lemma create_document_is_weakly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_document \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
+  shows "is_weakly_dom_component_safe {} {cast result} h h'"
+proof -
+  have "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast result|}"
+    using assms(4) assms(5) local.create_document_def new_document_new_ptr by auto
+  moreover have "result |\<notin>| document_ptr_kinds h"
+    using assms(4) assms(5) local.create_document_def new_document_ptr_not_in_heap by auto
+  ultimately show ?thesis
+    using assms
+    apply(auto simp add: is_weakly_dom_component_safe_def Let_def local.create_document_def
+        new_document_ptr_not_in_heap)[1]
+    by (metis \<open>result |\<notin>| document_ptr_kinds h\<close> document_ptr_kinds_commutes new_document_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t)
+qed
+end
+
+interpretation i_get_dom_component_create_document?: l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name create_document
+  by(auto simp add: l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>insert\_before\<close>
+
+lemma insert_before_unsafe: "\<not>(\<forall>(h
+    :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+  ) h' ptr child. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
+h \<turnstile> insert_before ptr child None \<rightarrow>\<^sub>h h' \<longrightarrow> is_weakly_dom_component_safe {ptr, cast child} {} h h')"
+proof -
+  obtain h document_ptr e1 e2 where h: "Inr ((document_ptr, e1, e2), h) = (Heap (fmempty)
+      :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+    ) \<turnstile> (do {
+      document_ptr \<leftarrow> create_document;
+      e1 \<leftarrow> create_element document_ptr ''div'';
+      e2 \<leftarrow> create_element document_ptr ''div'';
+      return (document_ptr, e1, e2)
+  })"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then obtain h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    h': "h \<turnstile> insert_before (cast e1) (cast e2) None \<rightarrow>\<^sub>h h'" and
+    "\<not>(is_weakly_dom_component_safe {cast e1, cast e2} {} h h')"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then show ?thesis
+    by auto
+qed
+
+lemma insert_before_unsafe2: "\<not>(\<forall>(h
+    :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+  ) h' ptr child ref. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
+h \<turnstile> insert_before ptr child (Some ref) \<rightarrow>\<^sub>h h' \<longrightarrow>
+is_weakly_dom_component_safe {ptr, cast child, cast ref} {} h h')"
+proof -
+  obtain h document_ptr e1 e2 e3 where h: "Inr ((document_ptr, e1, e2, e3), h) = (Heap (fmempty)
+      :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
+    ) \<turnstile> (do {
+      document_ptr \<leftarrow> create_document;
+      e1 \<leftarrow> create_element document_ptr ''div'';
+      e2 \<leftarrow> create_element document_ptr ''div'';
+      e3 \<leftarrow> create_element document_ptr ''div'';
+      append_child (cast e1) (cast e2);
+      return (document_ptr, e1, e2, e3)
+  })"
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then obtain h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    h': "h \<turnstile> insert_before (cast e1) (cast e3) (Some (cast e2)) \<rightarrow>\<^sub>h h'" and
+    "\<not>(is_weakly_dom_component_safe {cast e1, cast e3, cast e2} {} h h')"
+    apply(code_simp)
+    apply(clarify)
+    by(code_simp, auto simp add: equal_eq List.member_def)+
+  then show ?thesis
+    by fast
+qed
+
+
+lemma append_child_unsafe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
+    h' and ptr and child where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_dom_component_safe {ptr, cast child} {} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
+  let ?P = "do {
+      document_ptr \<leftarrow> create_document;
+      e1 \<leftarrow> create_element document_ptr ''div'';
+      e2 \<leftarrow> create_element document_ptr ''div'';
+      return (e1, e2)
+  }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e1 = "fst |?h0 \<turnstile> ?P|\<^sub>r"
+  let ?e2 = "snd |?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e1" and child="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e2"])
+    by code_simp+
+qed
+
+
+subsubsection \<open>get\_owner\_document\<close>
+
+lemma get_owner_document_unsafe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
+    h' and ptr and owner_document where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<rightarrow>\<^sub>h h'" and
+    "\<not>is_weakly_dom_component_safe {ptr} {cast owner_document} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
+  let ?P = "do {
+      document_ptr \<leftarrow> create_document;
+      e1 \<leftarrow> create_element document_ptr ''div'';
+      return (document_ptr, e1)
+  }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?document_ptr = "fst |?h0 \<turnstile> ?P|\<^sub>r"
+  let ?e1 = "snd |?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e1" and owner_document="?document_ptr"])
+    by code_simp+
+qed
+
+end
diff --git a/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy b/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy
new file mode 100644
index 0000000..fd177c3
--- /dev/null
+++ b/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy
@@ -0,0 +1,3758 @@
+(***********************************************************************************
+ * Copyright (c) 2016-2020 The University of Sheffield, UK
+ *               2019-2020 University of Exeter, UK
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * * Redistributions of source code must retain the above copyright notice, this
+ *   list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright notice,
+ *   this list of conditions and the following disclaimer in the documentation
+ *   and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ ***********************************************************************************)
+
+section \<open>Core SC DOM Components II\<close>
+theory Core_DOM_SC_DOM_Components
+  imports
+    Core_DOM_DOM_Components
+begin
+declare [[smt_timeout=2400]]
+
+section \<open>Scope Components\<close>
+
+subsection \<open>Definition\<close>
+
+locale l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
+  l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
+  l_get_owner_document_defs get_owner_document +
+  l_to_tree_order_defs to_tree_order
+  for get_owner_document :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+begin
+definition a_get_scdom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
+  where
+    "a_get_scdom_component ptr = do {
+      document \<leftarrow> get_owner_document ptr;
+      disc_nodes \<leftarrow> get_disconnected_nodes document;
+      tree_order \<leftarrow> to_tree_order (cast document);
+      disconnected_tree_orders \<leftarrow> map_M (to_tree_order \<circ> cast) disc_nodes;
+      return (tree_order @ (concat disconnected_tree_orders))
+    }"
+
+definition a_is_strongly_scdom_component_safe ::
+  "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+  where
+    "a_is_strongly_scdom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
+      let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
+      let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
+      let arg_components =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h).  set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
+      let arg_components' =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
+      removed_pointers \<subseteq> arg_components \<and>
+      added_pointers \<subseteq> arg_components' \<and>
+      S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<and>
+      (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
+        (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_scdom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
+
+definition a_is_weakly_scdom_component_safe ::
+  "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+  where
+    "a_is_weakly_scdom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
+      let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
+      let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
+      let arg_components =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h).  set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
+      let arg_components' =
+        (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
+        fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
+      removed_pointers \<subseteq> arg_components \<and>
+      S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<union> added_pointers  \<and>
+      (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
+        (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_scdom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
+end
+
+global_interpretation l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_owner_document get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order
+  defines get_scdom_component = "l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_scdom_component
+get_owner_document get_disconnected_nodes to_tree_order"
+    and is_strongly_scdom_component_safe = a_is_strongly_scdom_component_safe
+    and is_weakly_scdom_component_safe = a_is_weakly_scdom_component_safe
+  .
+
+locale l_get_scdom_component_defs =
+  fixes get_scdom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
+  fixes is_strongly_scdom_component_safe ::
+    "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+  fixes is_weakly_scdom_component_safe ::
+    "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+
+
+locale l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_scdom_component_defs +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
+  assumes get_scdom_component_impl: "get_scdom_component = a_get_scdom_component"
+  assumes is_strongly_scdom_component_safe_impl:
+    "is_strongly_scdom_component_safe = a_is_strongly_scdom_component_safe"
+  assumes is_weakly_scdom_component_safe_impl:
+    "is_weakly_scdom_component_safe = a_is_weakly_scdom_component_safe"
+begin
+lemmas get_scdom_component_def = a_get_scdom_component_def[folded get_scdom_component_impl]
+lemmas is_strongly_scdom_component_safe_def =
+  a_is_strongly_scdom_component_safe_def[folded is_strongly_scdom_component_safe_impl]
+lemmas is_weakly_scdom_component_safe_def =
+  a_is_weakly_scdom_component_safe_def[folded is_weakly_scdom_component_safe_impl]
+end
+
+interpretation i_get_scdom_component?: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_owner_document get_disconnected_nodes get_disconnected_nodes_locs to_tree_order
+  by(auto simp add: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def get_scdom_component_def
+      is_strongly_scdom_component_safe_def is_weakly_scdom_component_safe_def instances)
+declare l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+locale l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_heap_is_wellformed +
+  l_get_owner_document +
+  l_get_owner_document_wf +
+  l_get_disconnected_nodes +
+  l_to_tree_order +
+  l_known_ptr +
+  l_known_ptrs +
+  l_get_owner_document_wf_get_root_node_wf +
+  assumes known_ptr_impl: "known_ptr = DocumentClass.known_ptr"
+begin
+
+lemma known_ptr_node_or_document: "known_ptr ptr \<Longrightarrow> is_node_ptr_kind ptr \<or> is_document_ptr_kind ptr"
+  by(auto simp add: known_ptr_impl known_ptr_defs DocumentClass.known_ptr_defs
+      CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+      split: option.splits)
+
+lemma get_scdom_component_ptr_in_heap2:
+  assumes "h \<turnstile> ok (get_scdom_component ptr)"
+  shows "ptr |\<in>| object_ptr_kinds h"
+  using assms get_root_node_ptr_in_heap
+  apply(auto simp add: get_scdom_component_def elim!: bind_is_OK_E3 intro!: map_M_pure_I)[1]
+  by (simp add: is_OK_returns_result_I local.get_owner_document_ptr_in_heap)
+
+lemma get_scdom_component_subset_get_dom_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  shows "set c \<subseteq> set sc"
+proof -
+  obtain document disc_nodes tree_order disconnected_tree_orders where
+    document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
+    and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
+    and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
+    and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
+    and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
+    using assms(4)
+    by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
+        elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
+        )
+
+  obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    and c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using assms(5)
+    by(auto simp add: get_dom_component_def elim!: bind_returns_result_E2[rotated, OF get_root_node_pure, rotated])
+
+  show ?thesis
+  proof (cases "is_document_ptr_kind root_ptr")
+    case True
+    then have "cast document = root_ptr"
+      using get_root_node_document assms(1) assms(2) assms(3) root_ptr document
+      by (metis document_ptr_casts_commute3 returns_result_eq)
+    then have "c = tree_order"
+      using tree_order c
+      by auto
+    then show ?thesis
+      by(simp add: sc)
+  next
+    case False
+    moreover have "root_ptr |\<in>| object_ptr_kinds h"
+      using assms(1) assms(2) assms(3) local.get_root_node_root_in_heap root_ptr by blast
+    ultimately have "is_node_ptr_kind root_ptr"
+      using assms(3) known_ptrs_known_ptr known_ptr_node_or_document
+      by auto
+    then obtain root_node_ptr where root_node_ptr: "root_ptr = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr"
+      by (metis node_ptr_casts_commute3)
+    then have "h \<turnstile> get_owner_document root_ptr \<rightarrow>\<^sub>r document"
+      using get_root_node_same_owner_document
+      using assms(1) assms(2) assms(3) document root_ptr by blast
+    then have "root_node_ptr \<in> set disc_nodes"
+      using assms(1) assms(2) assms(3) disc_nodes in_disconnected_nodes_no_parent root_node_ptr
+      using local.get_root_node_same_no_parent root_ptr by blast
+    then have "c \<in> set disconnected_tree_orders"
+      using c root_node_ptr
+      using map_M_pure_E[OF disconnected_tree_orders]
+      by (metis (mono_tags, lifting) comp_apply local.to_tree_order_pure select_result_I2)
+    then show ?thesis
+      by(auto simp add: sc)
+  qed
+qed
+
+lemma get_scdom_component_ptrs_same_owner_document:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
+  shows "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
+proof -
+  obtain document disc_nodes tree_order disconnected_tree_orders where
+    document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
+    and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
+    and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
+    and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
+    and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
+    using assms(4)
+    by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
+        elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
+        )
+  show ?thesis
+  proof (cases "ptr' \<in> set tree_order")
+    case True
+    have "owner_document = document"
+      using assms(6) document by fastforce
+    then show ?thesis
+      by (metis (no_types) True assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document
+          document_ptr_casts_commute3 document_ptr_document_ptr_cast document_ptr_kinds_commutes
+          local.get_owner_document_owner_document_in_heap local.get_root_node_document
+          local.get_root_node_not_node_same local.to_tree_order_same_root node_ptr_no_document_ptr_cast tree_order)
+  next
+    case False
+    then obtain disconnected_tree_order where disconnected_tree_order:
+      "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
+      using sc \<open>ptr' \<in> set sc\<close>
+      by auto
+    obtain root_ptr' where
+      root_ptr': "root_ptr' \<in> set disc_nodes" and
+      "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
+      using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
+      by (metis comp_apply local.to_tree_order_pure)
+    have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
+      using disc_nodes
+      by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
+          local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
+          returns_result_select_result root_ptr')
+    then
+    have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
+      using disc_nodes
+      by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq local.get_parent_child_dual
+          local.get_parent_ok local.get_parent_parent_in_heap local.heap_is_wellformed_disc_nodes_in_heap
+          returns_result_select_result root_ptr' select_result_I2 split_option_ex)
+    then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
+      using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
+        assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent
+        local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result
+      by blast
+    then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
+      using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
+      by blast
+
+    then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
+      using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
+        local.get_root_node_same_owner_document
+      by blast
+    then show ?thesis
+      using assms(6) document returns_result_eq by force
+  qed
+qed
+
+lemma get_scdom_component_ptrs_same_scope_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  shows "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+proof -
+  obtain document disc_nodes tree_order disconnected_tree_orders where
+    document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
+    and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
+    and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
+    and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
+    and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
+    using assms(4)
+    by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
+        elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
+        )
+  show ?thesis
+  proof (cases "ptr' \<in> set tree_order")
+    case True
+    then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
+      by (metis assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document
+          document_ptr_casts_commute3 document_ptr_kinds_commutes known_ptr_node_or_document
+          local.get_owner_document_owner_document_in_heap local.get_root_node_document
+          local.get_root_node_not_node_same local.known_ptrs_known_ptr local.to_tree_order_get_root_node
+          local.to_tree_order_ptr_in_result node_ptr_no_document_ptr_cast tree_order)
+    then show ?thesis
+      using disc_nodes tree_order disconnected_tree_orders sc
+      by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  next
+    case False
+    then obtain disconnected_tree_order where disconnected_tree_order:
+      "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
+      using sc \<open>ptr' \<in> set sc\<close>
+      by auto
+    obtain root_ptr' where
+      root_ptr': "root_ptr' \<in> set disc_nodes" and
+      "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
+      using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
+      by (metis comp_apply local.to_tree_order_pure)
+    have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
+      using disc_nodes
+      by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
+          local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
+          returns_result_select_result root_ptr')
+    then
+    have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
+      using disc_nodes
+      by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq
+          local.get_parent_child_dual local.get_parent_ok local.get_parent_parent_in_heap
+          local.heap_is_wellformed_disc_nodes_in_heap returns_result_select_result root_ptr'
+          select_result_I2 split_option_ex)
+    then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
+      using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
+        assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent
+        local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result
+      by blast
+    then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
+      using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
+      by blast
+
+    then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
+      using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
+        local.get_root_node_same_owner_document
+      by blast
+    then show ?thesis
+      using disc_nodes tree_order disconnected_tree_orders sc
+      by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  qed
+qed
+
+lemma get_scdom_component_ok:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "ptr |\<in>| object_ptr_kinds h"
+  shows "h \<turnstile> ok (get_scdom_component ptr)"
+  using assms
+  apply(auto simp add: get_scdom_component_def intro!: bind_is_OK_pure_I map_M_pure_I map_M_ok_I)[1]
+  using get_owner_document_ok
+     apply blast
+    apply (simp add: local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap)
+   apply (simp add: local.get_owner_document_owner_document_in_heap local.to_tree_order_ok)
+  using local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok node_ptr_kinds_commutes
+  by blast
+
+lemma get_scdom_component_ptr_in_heap:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  shows "ptr' |\<in>| object_ptr_kinds h"
+  apply(insert assms )
+  apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
+  using local.to_tree_order_ptrs_in_heap apply blast
+  by (metis (no_types, lifting) assms(4) assms(5) bind_returns_result_E
+      get_scdom_component_ptrs_same_scope_component is_OK_returns_result_I get_scdom_component_def
+      local.get_owner_document_ptr_in_heap)
+
+lemma get_scdom_component_contains_get_dom_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  obtains c where "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c" and "set c \<subseteq> set sc"
+proof -
+  have "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+    using assms(1) assms(2) assms(3) assms(4) assms(5) get_scdom_component_ptrs_same_scope_component
+    by blast
+  then show ?thesis
+    by (meson assms(1) assms(2) assms(3) assms(5) get_scdom_component_ptr_in_heap
+        get_scdom_component_subset_get_dom_component is_OK_returns_result_E local.get_dom_component_ok that)
+qed
+
+lemma get_scdom_component_owner_document_same:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  obtains owner_document where "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document" and "cast owner_document \<in> set sc"
+  using assms
+  apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
+   apply (metis (no_types, lifting) assms(4) assms(5) document_ptr_casts_commute3
+      document_ptr_document_ptr_cast get_scdom_component_contains_get_dom_component
+      local.get_dom_component_ptr local.get_dom_component_root_node_same local.get_dom_component_to_tree_order
+      local.get_root_node_document local.get_root_node_not_node_same local.to_tree_order_ptr_in_result
+      local.to_tree_order_ptrs_in_heap node_ptr_no_document_ptr_cast)
+  apply(rule map_M_pure_E2)
+     apply(simp)
+    apply(simp)
+   apply(simp)
+  by (smt assms(4) assms(5) comp_apply get_scdom_component_ptr_in_heap is_OK_returns_result_E
+      local.get_owner_document_disconnected_nodes local.get_root_node_ok local.get_root_node_same_owner_document
+      local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result)
+
+lemma get_scdom_component_different_owner_documents:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
+  assumes "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document'"
+  assumes "owner_document \<noteq> owner_document'"
+  shows "set |h \<turnstile> get_scdom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = {}"
+  using assms get_scdom_component_ptrs_same_owner_document
+  by (smt disjoint_iff_not_equal get_scdom_component_ok is_OK_returns_result_I
+      local.get_owner_document_ptr_in_heap returns_result_eq returns_result_select_result)
+
+
+lemma get_scdom_component_ptr:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r c"
+  shows "ptr \<in> set c"
+  using assms
+  by (meson get_scdom_component_ptr_in_heap2 get_scdom_component_subset_get_dom_component
+      is_OK_returns_result_E is_OK_returns_result_I local.get_dom_component_ok local.get_dom_component_ptr
+      subsetD)
+end
+
+locale l_get_dom_component_get_scdom_component = l_get_owner_document_defs + l_heap_is_wellformed_defs +
+  l_type_wf + l_known_ptrs + l_get_scdom_component_defs + l_get_dom_component_defs +
+  assumes get_scdom_component_subset_get_dom_component:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
+h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c \<Longrightarrow> set c \<subseteq> set sc"
+  assumes get_scdom_component_ptrs_same_scope_component:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
+ptr' \<in> set sc \<Longrightarrow> h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+  assumes get_scdom_component_ptrs_same_owner_document:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
+ptr' \<in> set sc \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<Longrightarrow> h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
+  assumes get_scdom_component_ok:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow>
+h \<turnstile> ok (get_scdom_component ptr)"
+  assumes get_scdom_component_ptr_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
+ptr' \<in> set sc \<Longrightarrow> ptr' |\<in>| object_ptr_kinds h"
+  assumes get_scdom_component_contains_get_dom_component:
+    "(\<And>c. h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c \<Longrightarrow> set c \<subseteq> set sc \<Longrightarrow> thesis) \<Longrightarrow> heap_is_wellformed h \<Longrightarrow>
+type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow> ptr' \<in> set sc \<Longrightarrow> thesis"
+  assumes get_scdom_component_owner_document_same:
+    "(\<And>owner_document. h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document \<Longrightarrow> cast owner_document \<in> set sc \<Longrightarrow> thesis) \<Longrightarrow>
+    heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
+ptr' \<in> set sc \<Longrightarrow> thesis"
+  assumes get_scdom_component_different_owner_documents:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<Longrightarrow>
+h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document' \<Longrightarrow> owner_document \<noteq> owner_document' \<Longrightarrow>
+set |h \<turnstile> get_scdom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = {}"
+
+interpretation i_get_dom_component_get_scdom_component?: l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_owner_document
+  get_disconnected_nodes get_disconnected_nodes_locs to_tree_order heap_is_wellformed parent_child_rel
+  type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors
+  get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  by(auto simp add: l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
+declare l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+lemma get_dom_component_get_scdom_component_is_l_get_dom_component_get_scdom_component [instances]:
+  "l_get_dom_component_get_scdom_component get_owner_document heap_is_wellformed type_wf known_ptr
+known_ptrs get_scdom_component get_dom_component"
+  apply(auto simp add: l_get_dom_component_get_scdom_component_def l_get_dom_component_get_scdom_component_axioms_def instances)[1]
+  using get_scdom_component_subset_get_dom_component apply fast
+  using get_scdom_component_ptrs_same_scope_component apply fast
+  using get_scdom_component_ptrs_same_owner_document apply fast
+  using get_scdom_component_ok apply fast
+  using get_scdom_component_ptr_in_heap apply fast
+  using get_scdom_component_contains_get_dom_component apply blast
+  using get_scdom_component_owner_document_same apply blast
+  using get_scdom_component_different_owner_documents apply fast
+  done
+
+
+subsubsection \<open>get\_child\_nodes\<close>
+
+locale l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma get_child_nodes_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+  assumes "child \<in> set children"
+  shows "cast child \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
+  apply(auto)[1]
+   apply (meson assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) contra_subsetD
+      get_scdom_component_ptrs_same_scope_component get_scdom_component_subset_get_dom_component
+      is_OK_returns_result_E local.get_child_nodes_is_strongly_dom_component_safe local.get_dom_component_ok
+      local.get_dom_component_ptr local.heap_is_wellformed_children_in_heap node_ptr_kinds_commutes)
+  by (meson assms(1) assms(2) assms(3) assms(4) assms(5) assms(6)
+      get_scdom_component_contains_get_dom_component is_OK_returns_result_E is_OK_returns_result_I
+      get_child_nodes_is_strongly_dom_component_safe local.get_child_nodes_ptr_in_heap
+      local.get_dom_component_ok local.get_dom_component_ptr set_rev_mp)
+
+lemma get_child_nodes_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
+  assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr} (cast ` set children) h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_child_nodes_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
+    by (smt Int_absorb2 finite_set_in get_child_nodes_is_strongly_scdom_component_safe_step in_mono
+        is_OK_returns_result_I local.get_child_nodes_ptr_in_heap local.get_dom_component_ok
+        local.get_dom_component_ptr local.get_scdom_component_impl local.get_scdom_component_ok
+        local.get_scdom_component_ptr_in_heap local.get_scdom_component_subset_get_dom_component
+        returns_result_select_result subsetI)
+qed
+end
+
+interpretation i_get_scdom_component_get_child_nodes?: l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes
+  get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_parent\<close>
+
+locale l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_parent_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_parent ptr' \<rightarrow>\<^sub>r Some parent"
+  shows "parent \<in> set sc \<longleftrightarrow> cast ptr' \<in> set sc"
+  by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
+      get_scdom_component_contains_get_dom_component local.get_dom_component_ptr
+      local.get_parent_is_strongly_dom_component_safe_step)
+
+lemma get_parent_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some parent"
+  assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {cast node_ptr} {parent} h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_parent_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
+    by (smt IntI finite_set_in in_mono local.get_dom_component_ok local.get_dom_component_ptr
+        local.get_parent_is_strongly_dom_component_safe_step local.get_parent_parent_in_heap
+        local.get_scdom_component_impl local.get_scdom_component_ok local.get_scdom_component_subset_get_dom_component
+        local.to_tree_order_ok local.to_tree_order_parent local.to_tree_order_ptr_in_result
+        local.to_tree_order_ptrs_in_heap returns_result_select_result)
+qed
+end
+
+interpretation i_get_scdom_component_get_parent?: l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_root\_node\<close>
+
+locale l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_root_node_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root"
+  shows "root \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
+  by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
+      get_scdom_component_contains_get_dom_component local.get_dom_component_ptr
+      local.get_root_node_is_strongly_dom_component_safe_step)
+
+lemma get_root_node_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
+  assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr} {root} h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_root_node_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
+    by (smt Int_iff finite_set_in is_OK_returns_result_I local.get_dom_component_ok
+        local.get_dom_component_ptr local.get_root_node_is_strongly_dom_component_safe_step
+        local.get_root_node_ptr_in_heap local.get_scdom_component_impl local.get_scdom_component_ok
+        local.get_scdom_component_subset_get_dom_component returns_result_select_result subset_eq)
+qed
+end
+
+interpretation i_get_scdom_component_get_root_node?: l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes
+  get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name first_in_tree_order
+  get_attribute get_attribute_locs
+  by(auto simp add: l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_element\_by\_id\<close>
+
+locale l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_element_by_id_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result"
+  shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
+  by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
+      get_element_by_id_is_strongly_dom_component_safe_step get_scdom_component_contains_get_dom_component
+      local.get_dom_component_ptr)
+
+lemma get_element_by_id_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>r Some result"
+  assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr} {cast result} h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by(auto simp add: preserved_def get_element_by_id_def first_in_tree_order_def
+        elim!: bind_returns_heap_E2 intro!: map_filter_M_pure bind_pure_I
+        split: option.splits list.splits)
+  have "ptr |\<in>| object_ptr_kinds h"
+    using assms(4)
+    apply(auto simp add: get_element_by_id_def)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
+        local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
+  obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.to_tree_order_ok)
+  then have "cast result \<in> set to"
+    using assms(4) local.get_element_by_id_result_in_tree_order by auto
+  obtain c where c: "h \<turnstile> a_get_scdom_component ptr \<rightarrow>\<^sub>r c"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_scdom_component_impl
+      local.get_scdom_component_ok
+    by blast
+
+  then show ?thesis
+    using assms \<open>h = h'\<close>
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def
+        get_element_by_id_def first_in_tree_order_def elim!: bind_returns_result_E2
+        intro!: map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
+    by (smt IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
+        get_element_by_id_is_strongly_scdom_component_safe_step local.get_dom_component_ok
+        local.get_dom_component_ptr local.get_scdom_component_impl
+        local.get_scdom_component_subset_get_dom_component returns_result_select_result select_result_I2
+        subsetD)
+qed
+end
+
+interpretation i_get_scdom_component_get_element_by_id?: l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes
+  get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name first_in_tree_order
+  get_attribute get_attribute_locs
+  by(auto simp add: l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_elements\_by\_class\_name\<close>
+
+locale l_get_scdom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_elements_by_class_name_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_elements_by_class_name ptr' idd \<rightarrow>\<^sub>r results"
+  assumes "result \<in> set results"
+  shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
+  by (meson assms local.get_dom_component_ptr
+      local.get_elements_by_class_name_is_strongly_dom_component_safe_step
+      local.get_scdom_component_contains_get_dom_component subsetD)
+
+
+lemma get_elements_by_class_name_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_elements_by_class_name ptr idd \<rightarrow>\<^sub>r results"
+  assumes "h \<turnstile> get_elements_by_class_name ptr idd \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr} (cast ` set results) h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_elements_by_class_name_pure pure_returns_heap_eq)
+  have "ptr |\<in>| object_ptr_kinds h"
+    using assms(4)
+    apply(auto simp add: get_elements_by_class_name_def)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
+        local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
+  obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.to_tree_order_ok)
+  then have "cast ` set results \<subseteq> set to"
+    using assms(4) local.get_elements_by_class_name_result_in_tree_order by auto
+  obtain c where c: "h \<turnstile> a_get_scdom_component ptr \<rightarrow>\<^sub>r c"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_scdom_component_impl
+      local.get_scdom_component_ok by blast
+
+  then show ?thesis
+    using assms \<open>h = h'\<close>
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def
+        get_element_by_id_def first_in_tree_order_def elim!: bind_returns_result_E2 intro!: map_filter_M_pure
+        bind_pure_I split: option.splits list.splits)[1]
+    by (smt IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
+        get_elements_by_class_name_is_strongly_scdom_component_safe_step local.get_dom_component_ok
+        local.get_dom_component_ptr local.get_scdom_component_impl
+        local.get_scdom_component_subset_get_dom_component returns_result_select_result select_result_I2 subsetD)
+qed
+end
+
+interpretation i_get_scdom_component_get_elements_by_class_name?: l_get_scdom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_scdom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_elements\_by\_tag\_name\<close>
+
+locale l_get_scdom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_elements_by_tag_name_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_elements_by_tag_name ptr' idd \<rightarrow>\<^sub>r results"
+  assumes "result \<in> set results"
+  shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
+  by (meson assms local.get_dom_component_ptr
+      local.get_elements_by_tag_name_is_strongly_dom_component_safe_step
+      local.get_scdom_component_contains_get_dom_component subsetD)
+
+
+lemma get_elements_by_tag_name_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_elements_by_tag_name ptr idd \<rightarrow>\<^sub>r results"
+  assumes "h \<turnstile> get_elements_by_tag_name ptr idd \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr} (cast ` set results) h h'"
+proof -
+  have "h = h'"
+    using assms(5)
+    by (meson local.get_elements_by_tag_name_pure pure_returns_heap_eq)
+  have "ptr |\<in>| object_ptr_kinds h"
+    using assms(4)
+    apply(auto simp add: get_elements_by_tag_name_def)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
+        local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
+  obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.to_tree_order_ok)
+  then have "cast ` set results \<subseteq> set to"
+    using assms(4) local.get_elements_by_tag_name_result_in_tree_order by auto
+  obtain c where c: "h \<turnstile> a_get_scdom_component ptr \<rightarrow>\<^sub>r c"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_scdom_component_impl
+      local.get_scdom_component_ok by blast
+
+  then show ?thesis
+    using assms \<open>h = h'\<close>
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def
+        get_element_by_id_def first_in_tree_order_def elim!: bind_returns_result_E2 intro!:
+        map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
+    by (smt IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
+        get_elements_by_tag_name_is_strongly_scdom_component_safe_step local.get_dom_component_ok
+        local.get_dom_component_ptr local.get_scdom_component_impl
+        local.get_scdom_component_subset_get_dom_component returns_result_select_result select_result_I2
+        subsetD)
+qed
+end
+
+interpretation i_get_scdom_component_get_elements_by_tag_name?:
+  l_get_scdom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe
+  get_disconnected_nodes get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs
+  get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs get_ancestors
+  get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  first_in_tree_order get_attribute get_attribute_locs
+  by(auto simp add: l_get_scdom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>remove\_child\<close>
+
+locale l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_owner_document_wf +
+  l_remove_child_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs
+  get_parent get_parent_locs get_owner_document get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove type_wf
+  known_ptr known_ptrs heap_is_wellformed parent_child_rel
+begin
+lemma remove_child_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r"
+    (* assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast child)|\<^sub>r" *)
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  have "ptr \<noteq> ptr'"
+    using assms(5)
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) is_OK_returns_heap_I
+        is_OK_returns_result_E local.get_dom_component_ok local.get_dom_component_ptr
+        local.remove_child_ptr_in_heap select_result_I2)
+
+  obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
+    by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_result_E local.get_owner_document_ok
+        local.remove_child_child_in_heap node_ptr_kinds_commutes)
+  then
+  obtain c where "h \<turnstile> get_dom_component (cast owner_document) \<rightarrow>\<^sub>r c"
+    using get_dom_component_ok owner_document assms(1) assms(2) assms(3)
+    by (meson document_ptr_kinds_commutes get_owner_document_owner_document_in_heap select_result_I)
+  then
+  have "ptr \<noteq> cast owner_document"
+    using assms(6) assms(1) assms(2) assms(3) local.get_dom_component_ptr owner_document
+    by auto
+
+  show ?thesis
+    using remove_child_writes assms(4)
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: option.splits)[1]
+         apply (metis \<open>ptr \<noteq> ptr'\<close> document_ptr_casts_commute3 get_M_Mdocument_preserved3)
+        apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+       apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+      apply (metis \<open>ptr \<noteq> ptr'\<close> element_ptr_casts_commute3 get_M_Element_preserved8)
+     apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+    apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+    done
+qed
+
+lemma remove_child_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r"
+    (* assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r" *)
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast child)|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  obtain sc where sc: "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_heap_I local.remove_child_ptr_in_heap
+        returns_result_select_result)
+
+  have "child |\<in>| node_ptr_kinds h"
+    using assms(4) remove_child_child_in_heap by blast
+  then
+  obtain child_sc where child_sc: "h \<turnstile> get_scdom_component (cast child) \<rightarrow>\<^sub>r child_sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) node_ptr_kinds_commutes select_result_I)
+  then obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
+    by (meson \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
+        get_scdom_component_owner_document_same is_OK_returns_result_E
+        get_scdom_component_subset_get_dom_component local.get_dom_component_ok local.get_dom_component_ptr
+        node_ptr_kinds_commutes)
+  then have "h \<turnstile> get_scdom_component (cast owner_document) \<rightarrow>\<^sub>r child_sc"
+    using child_sc
+    by (smt \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
+        get_scdom_component_subset_get_dom_component get_scdom_component_owner_document_same
+        get_scdom_component_ptrs_same_scope_component local.get_dom_component_ok local.get_dom_component_ptr
+        node_ptr_kinds_commutes returns_result_select_result select_result_I2)
+
+  have "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
+        get_scdom_component_subset_get_dom_component is_OK_returns_heap_I local.get_dom_component_ok
+        local.remove_child_ptr_in_heap returns_result_select_result sc select_result_I2)
+
+  moreover have "ptr \<notin> set |h \<turnstile> get_scdom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r"
+    using get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
+    by (metis (no_types, lifting)
+        \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close> assms(6) child_sc
+        owner_document select_result_I2)
+  have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r"
+    using get_scdom_component_owner_document_same
+    by (metis (no_types, lifting)
+        \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close>
+        \<open>ptr \<notin> set |h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r\<close>
+        assms(1) assms(2) assms(3) contra_subsetD document_ptr_kinds_commutes get_scdom_component_subset_get_dom_component
+        is_OK_returns_result_E local.get_dom_component_ok local.get_owner_document_owner_document_in_heap owner_document
+        select_result_I2)
+  ultimately show ?thesis
+    using assms(1) assms(2) assms(3) assms(4) remove_child_is_component_unsafe by blast
+qed
+
+
+
+lemma remove_child_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr, cast child} {} h h'"
+proof -
+  obtain owner_document children_h h2 disconnected_nodes_h where
+    owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document" and
+    children_h: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h" and
+    child_in_children_h: "child \<in> set children_h" and
+    disconnected_nodes_h: "h \<turnstile>  get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h" and
+    h2: "h \<turnstile>  set_disconnected_nodes owner_document (child # disconnected_nodes_h) \<rightarrow>\<^sub>h h2" and
+    h': "h2 \<turnstile> set_child_nodes ptr (remove1 child children_h) \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    apply(auto simp add: remove_child_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_child_nodes_pure] split: if_splits)[1]
+    using pure_returns_heap_eq by fastforce
+
+  have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes assms(4)])
+    unfolding remove_child_locs_def
+    using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have object_ptr_kinds_eq: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    unfolding object_ptr_kinds_M_defs by simp
+  then have object_ptr_kinds_eq2: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    using select_result_eq by force
+  then have node_ptr_kinds_eq2: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    using node_ptr_kinds_M_eq by auto
+  then have node_ptr_kinds_eq3: "node_ptr_kinds h = node_ptr_kinds h'"
+    using node_ptr_kinds_M_eq by auto
+  have document_ptr_kinds_eq2: "|h \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
+    using object_ptr_kinds_eq2 document_ptr_kinds_M_eq by auto
+  then have document_ptr_kinds_eq3: "document_ptr_kinds h = document_ptr_kinds h'"
+    using document_ptr_kinds_M_eq by auto
+  have children_eq:
+    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    apply(rule reads_writes_preserved[OF get_child_nodes_reads remove_child_writes assms(4)])
+    unfolding remove_child_locs_def
+    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers
+    by fast
+  then have children_eq2:
+    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq: "\<And>document_ptr disconnected_nodes. document_ptr \<noteq> owner_document
+         \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes
+             = h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes"
+    apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads remove_child_writes assms(4)])
+    unfolding remove_child_locs_def
+    using set_child_nodes_get_disconnected_nodes set_disconnected_nodes_get_disconnected_nodes_different_pointers
+    by (metis (no_types, lifting) Un_iff owner_document select_result_I2)
+  then have disconnected_nodes_eq2:
+    "\<And>document_ptr. document_ptr \<noteq> owner_document
+    \<Longrightarrow> |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h"
+    apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes h2 children_h] )
+    by (simp add: set_disconnected_nodes_get_child_nodes)
+
+  have "known_ptrs h'"
+    using object_ptr_kinds_eq3 known_ptrs_preserved \<open>known_ptrs h\<close> by blast
+
+  have "known_ptr ptr"
+    using assms(3)
+    using children_h get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr by blast
+  have "type_wf h2"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h2]
+    using set_disconnected_nodes_types_preserved assms(2)
+    by(auto simp add: reflp_def transp_def)
+  then have "type_wf h'"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_child_nodes_writes h']
+    using  set_child_nodes_types_preserved
+    by(auto simp add: reflp_def transp_def)
+
+  have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r remove1 child children_h"
+    using assms(4) owner_document h2 disconnected_nodes_h children_h
+    apply(auto simp add: remove_child_def split: if_splits)[1]
+    apply(drule bind_returns_heap_E3)
+      apply(auto split: if_splits)[1]
+     apply(simp)
+    apply(auto split: if_splits)[1]
+    apply(drule bind_returns_heap_E3)
+      apply(auto)[1]
+     apply(simp)
+    apply(drule bind_returns_heap_E3)
+      apply(auto)[1]
+     apply(simp)
+    apply(drule bind_returns_heap_E4)
+      apply(auto)[1]
+     apply simp
+    using \<open>type_wf h2\<close> set_child_nodes_get_child_nodes \<open>known_ptr ptr\<close> h'
+    by blast
+
+  have disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r child # disconnected_nodes_h"
+    using owner_document assms(4) h2 disconnected_nodes_h
+    apply (auto simp add: remove_child_def  split: if_splits)[1]
+    apply(drule bind_returns_heap_E2)
+      apply(auto split: if_splits)[1]
+     apply(simp)
+    by(auto simp add: local.set_disconnected_nodes_get_disconnected_nodes split: if_splits)
+  then have disconnected_nodes_h': "h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r child # disconnected_nodes_h"
+    apply(rule reads_writes_separate_forwards[OF get_disconnected_nodes_reads set_child_nodes_writes h'])
+    by (simp add: set_child_nodes_get_disconnected_nodes)
+
+  moreover have "a_acyclic_heap h"
+    using assms(1)  by (simp add: heap_is_wellformed_def)
+  have "parent_child_rel h' \<subseteq> parent_child_rel h"
+  proof (standard, safe)
+    fix parent child
+    assume a1: "(parent, child) \<in> parent_child_rel h'"
+    then show "(parent, child) \<in> parent_child_rel h"
+    proof (cases "parent = ptr")
+      case True
+      then show ?thesis
+        using a1 remove_child_removes_parent[OF assms(1) assms(4)] children_h children_h'
+          get_child_nodes_ptr_in_heap
+        apply(auto simp add: parent_child_rel_def object_ptr_kinds_eq )[1]
+        by (metis imageI notin_set_remove1)
+    next
+      case False
+      then show ?thesis
+        using a1
+        by(auto simp add: parent_child_rel_def object_ptr_kinds_eq3 children_eq2)
+    qed
+  qed
+  then have "a_acyclic_heap h'"
+    using \<open>a_acyclic_heap h\<close> acyclic_heap_def acyclic_subset by blast
+
+  moreover have "a_all_ptrs_in_heap h"
+    using assms(1)  by (simp add: heap_is_wellformed_def)
+  then have "a_all_ptrs_in_heap h'"
+    apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3 disconnected_nodes_eq)[1]
+     apply (metis (no_types, lifting) \<open>type_wf h'\<close> assms local.get_child_nodes_ok local.known_ptrs_known_ptr
+        local.remove_child_children_subset notin_fset object_ptr_kinds_eq3 returns_result_select_result subset_code(1))
+    apply (metis (no_types, lifting) assms(4) disconnected_nodes_eq2 disconnected_nodes_h disconnected_nodes_h'
+        document_ptr_kinds_eq3 finite_set_in local.remove_child_child_in_heap node_ptr_kinds_eq3 select_result_I2
+        set_ConsD subset_code(1))
+    done
+  moreover have "a_owner_document_valid h"
+    using assms(1)  by (simp add: heap_is_wellformed_def)
+  then have "a_owner_document_valid h'"
+    apply(auto simp add: a_owner_document_valid_def object_ptr_kinds_eq3 document_ptr_kinds_eq3
+        node_ptr_kinds_eq3)[1]
+  proof -
+    fix node_ptr
+    assume 0: "\<forall>node_ptr\<in>fset (node_ptr_kinds h'). (\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h' \<and>
+node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) \<or> (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<and>
+node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
+      and 1: "node_ptr |\<in>| node_ptr_kinds h'"
+      and 2: "\<forall>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<longrightarrow> node_ptr \<notin> set |h' \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
+    then show "\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h'
+                       \<and> node_ptr \<in> set |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
+    proof (cases "node_ptr = child")
+      case True
+      show ?thesis
+        apply(rule exI[where x=owner_document])
+        using children_eq2 disconnected_nodes_eq2 children_h children_h' disconnected_nodes_h' True
+        by (metis (no_types, lifting) get_disconnected_nodes_ptr_in_heap is_OK_returns_result_I
+            list.set_intros(1) select_result_I2)
+    next
+      case False
+      then show ?thesis
+        using 0 1 2 children_eq2 children_h children_h' disconnected_nodes_eq2 disconnected_nodes_h
+          disconnected_nodes_h'
+        apply(auto simp add: children_eq2 disconnected_nodes_eq2 dest!: select_result_I2)[1]
+        by (metis children_eq2 disconnected_nodes_eq2 finite_set_in in_set_remove1 list.set_intros(2))
+    qed
+  qed
+
+  moreover
+  {
+    have h0: "a_distinct_lists h"
+      using assms(1)  by (simp add: heap_is_wellformed_def)
+    moreover have ha1: "(\<Union>x\<in>set |h \<turnstile> object_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_child_nodes x|\<^sub>r)
+                 \<inter> (\<Union>x\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
+      using \<open>a_distinct_lists h\<close>
+      unfolding a_distinct_lists_def
+      by(auto)
+    have ha2: "ptr |\<in>| object_ptr_kinds h"
+      using children_h get_child_nodes_ptr_in_heap by blast
+    have ha3: "child \<in> set |h \<turnstile> get_child_nodes ptr|\<^sub>r"
+      using child_in_children_h children_h
+      by(simp)
+    have child_not_in: "\<And>document_ptr. document_ptr |\<in>| document_ptr_kinds h
+                          \<Longrightarrow> child \<notin> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
+      using ha1 ha2 ha3
+      apply(simp)
+      using IntI by fastforce
+    moreover have "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+      apply(rule select_result_I)
+      by(auto simp add: object_ptr_kinds_M_defs)
+    moreover have "distinct |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
+      apply(rule select_result_I)
+      by(auto simp add: document_ptr_kinds_M_defs)
+    ultimately have "a_distinct_lists h'"
+    proof(simp (no_asm) add: a_distinct_lists_def, safe)
+      assume 1: "a_distinct_lists h"
+        and 3: "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+
+      assume 1: "a_distinct_lists h"
+        and 3: "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+      have 4: "distinct (concat ((map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r)))"
+        using 1 by(auto simp add: a_distinct_lists_def)
+      show "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
+                     (sorted_list_of_set (fset (object_ptr_kinds h')))))"
+      proof(rule distinct_concat_map_I[OF 3[unfolded object_ptr_kinds_eq2], simplified])
+        fix x
+        assume 5: "x |\<in>| object_ptr_kinds h'"
+        then have 6: "distinct |h \<turnstile> get_child_nodes x|\<^sub>r"
+          using 4 distinct_concat_map_E object_ptr_kinds_eq2 by fastforce
+        obtain children where children: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children"
+          and distinct_children: "distinct children"
+          by (metis "5" "6" assms get_child_nodes_ok local.known_ptrs_known_ptr
+              object_ptr_kinds_eq3 select_result_I)
+        obtain children' where children': "h' \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children'"
+          using children children_eq children_h' by fastforce
+        then have "distinct children'"
+        proof (cases "ptr = x")
+          case True
+          then show ?thesis
+            using children distinct_children children_h children_h'
+            by (metis children' distinct_remove1 returns_result_eq)
+        next
+          case False
+          then show ?thesis
+            using children distinct_children children_eq[OF False]
+            using children' distinct_lists_children h0
+            using select_result_I2 by fastforce
+        qed
+
+        then show "distinct |h' \<turnstile> get_child_nodes x|\<^sub>r"
+          using children' by(auto simp add: )
+      next
+        fix x y
+        assume 5: "x |\<in>| object_ptr_kinds h'" and 6: "y |\<in>| object_ptr_kinds h'" and 7: "x \<noteq> y"
+        obtain children_x where children_x: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children_x"
+          by (metis "5" assms get_child_nodes_ok is_OK_returns_result_E
+              local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+        obtain children_y where children_y: "h \<turnstile> get_child_nodes y \<rightarrow>\<^sub>r children_y"
+          by (metis "6" assms get_child_nodes_ok is_OK_returns_result_E
+              local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+        obtain children_x' where children_x': "h' \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children_x'"
+          using children_eq children_h' children_x by fastforce
+        obtain children_y' where children_y': "h' \<turnstile> get_child_nodes y \<rightarrow>\<^sub>r children_y'"
+          using children_eq children_h' children_y by fastforce
+        have "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r))"
+          using h0 by(auto simp add: a_distinct_lists_def)
+        then have 8: "set children_x \<inter> set children_y = {}"
+          using "7" assms(1) children_x children_y local.heap_is_wellformed_one_parent by blast
+        have "set children_x' \<inter> set children_y' = {}"
+        proof (cases "ptr = x")
+          case True
+          then have "ptr \<noteq> y"
+            by(simp add: 7)
+          have "children_x' = remove1 child children_x"
+            using children_h children_h' children_x children_x' True returns_result_eq by fastforce
+          moreover have "children_y' = children_y"
+            using children_y children_y' children_eq[OF \<open>ptr \<noteq> y\<close>] by auto
+          ultimately show ?thesis
+            using 8 set_remove1_subset by fastforce
+        next
+          case False
+          then show ?thesis
+          proof (cases "ptr = y")
+            case True
+            have "children_y' = remove1 child children_y"
+              using children_h children_h' children_y children_y' True returns_result_eq by fastforce
+            moreover have "children_x' = children_x"
+              using children_x children_x' children_eq[OF \<open>ptr \<noteq> x\<close>] by auto
+            ultimately show ?thesis
+              using 8 set_remove1_subset by fastforce
+          next
+            case False
+            have "children_x' = children_x"
+              using children_x children_x' children_eq[OF \<open>ptr \<noteq> x\<close>] by auto
+            moreover have "children_y' = children_y"
+              using children_y children_y' children_eq[OF \<open>ptr \<noteq> y\<close>] by auto
+            ultimately show ?thesis
+              using 8 by simp
+          qed
+        qed
+        then show "set |h' \<turnstile> get_child_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_child_nodes y|\<^sub>r = {}"
+          using children_x' children_y'
+          by (metis (no_types, lifting) select_result_I2)
+      qed
+    next
+      assume 2: "distinct |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
+      then have 4: "distinct  (sorted_list_of_set (fset (document_ptr_kinds h')))"
+        by simp
+      have 3: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                        (sorted_list_of_set (fset (document_ptr_kinds h')))))"
+        using h0
+        by(simp add: a_distinct_lists_def document_ptr_kinds_eq3)
+
+      show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                         (sorted_list_of_set (fset (document_ptr_kinds h')))))"
+      proof(rule distinct_concat_map_I[OF 4[unfolded document_ptr_kinds_eq3]])
+        fix x
+        assume 4: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
+        have 5: "distinct |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
+          using distinct_lists_disconnected_nodes[OF h0] 4 get_disconnected_nodes_ok
+          by (simp add: assms document_ptr_kinds_eq3 select_result_I)
+        show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
+        proof (cases "x = owner_document")
+          case True
+          have "child \<notin> set |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
+            using child_not_in  document_ptr_kinds_eq2 "4" by fastforce
+          moreover have "|h' \<turnstile> get_disconnected_nodes x|\<^sub>r = child # |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
+            using disconnected_nodes_h' disconnected_nodes_h unfolding True
+            by(simp)
+          ultimately show ?thesis
+            using 5 unfolding True
+            by simp
+        next
+          case False
+          show ?thesis
+            using "5" False disconnected_nodes_eq2 by auto
+        qed
+      next
+        fix x y
+        assume 4: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
+          and 5: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))" and "x \<noteq> y"
+        obtain disc_nodes_x where disc_nodes_x: "h \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r disc_nodes_x"
+          using 4 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of x] document_ptr_kinds_eq2
+          by auto
+        obtain disc_nodes_y where disc_nodes_y: "h \<turnstile> get_disconnected_nodes y \<rightarrow>\<^sub>r disc_nodes_y"
+          using 5 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of y] document_ptr_kinds_eq2
+          by auto
+        obtain disc_nodes_x' where disc_nodes_x': "h' \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r disc_nodes_x'"
+          using 4 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of x] document_ptr_kinds_eq2
+          by auto
+        obtain disc_nodes_y' where disc_nodes_y': "h' \<turnstile> get_disconnected_nodes y \<rightarrow>\<^sub>r disc_nodes_y'"
+          using 5 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of y] document_ptr_kinds_eq2
+          by auto
+        have "distinct
+               (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) |h \<turnstile> document_ptr_kinds_M|\<^sub>r))"
+          using h0 by (simp add: a_distinct_lists_def)
+        then have 6: "set disc_nodes_x \<inter> set disc_nodes_y = {}"
+          using \<open>x \<noteq> y\<close> assms(1) disc_nodes_x disc_nodes_y local.heap_is_wellformed_one_disc_parent
+          by blast
+
+        have "set disc_nodes_x' \<inter> set disc_nodes_y' = {}"
+        proof (cases "x = owner_document")
+          case True
+          then have "y \<noteq> owner_document"
+            using \<open>x \<noteq> y\<close> by simp
+          then have "disc_nodes_y' = disc_nodes_y"
+            using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y'
+            by auto
+          have "disc_nodes_x' = child # disc_nodes_x"
+            using disconnected_nodes_h' disc_nodes_x disc_nodes_x' True disconnected_nodes_h returns_result_eq
+            by fastforce
+          have "child \<notin> set disc_nodes_y"
+            using child_not_in  disc_nodes_y 5
+            using document_ptr_kinds_eq2  by fastforce
+          then show ?thesis
+            apply(unfold \<open>disc_nodes_x' = child # disc_nodes_x\<close> \<open>disc_nodes_y' = disc_nodes_y\<close>)
+            using 6 by auto
+        next
+          case False
+          then show ?thesis
+          proof (cases "y = owner_document")
+            case True
+            then have "disc_nodes_x' = disc_nodes_x"
+              using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x' by auto
+            have "disc_nodes_y' = child # disc_nodes_y"
+              using disconnected_nodes_h' disc_nodes_y disc_nodes_y' True disconnected_nodes_h returns_result_eq
+              by fastforce
+            have "child \<notin> set disc_nodes_x"
+              using child_not_in  disc_nodes_x 4
+              using document_ptr_kinds_eq2  by fastforce
+            then show ?thesis
+              apply(unfold \<open>disc_nodes_y' = child # disc_nodes_y\<close> \<open>disc_nodes_x' = disc_nodes_x\<close>)
+              using 6 by auto
+          next
+            case False
+            have "disc_nodes_x' = disc_nodes_x"
+              using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x' by auto
+            have "disc_nodes_y' = disc_nodes_y"
+              using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y' by auto
+            then show ?thesis
+              apply(unfold \<open>disc_nodes_y' = disc_nodes_y\<close> \<open>disc_nodes_x' = disc_nodes_x\<close>)
+              using 6 by auto
+          qed
+        qed
+        then show "set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
+          using disc_nodes_x' disc_nodes_y' by auto
+      qed
+    next
+      fix x xa xb
+      assume 1: "xa \<in> fset (object_ptr_kinds h')"
+        and 2: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+        and 3: "xb \<in> fset (document_ptr_kinds h')"
+        and 4: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+      obtain disc_nodes where disc_nodes: "h \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r disc_nodes"
+        using 3 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of xb] document_ptr_kinds_eq2 by auto
+      obtain disc_nodes' where disc_nodes': "h' \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r disc_nodes'"
+        using 3 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of xb]  document_ptr_kinds_eq2 by auto
+
+      obtain children where children: "h \<turnstile> get_child_nodes xa \<rightarrow>\<^sub>r children"
+        by (metis "1" assms finite_set_in get_child_nodes_ok is_OK_returns_result_E
+            local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+      obtain children' where children': "h' \<turnstile> get_child_nodes xa \<rightarrow>\<^sub>r children'"
+        using children children_eq children_h' by fastforce
+      have "\<And>x. x \<in> set |h \<turnstile> get_child_nodes xa|\<^sub>r \<Longrightarrow> x \<in> set |h \<turnstile> get_disconnected_nodes xb|\<^sub>r \<Longrightarrow> False"
+        using 1 3
+        apply(fold \<open> object_ptr_kinds h =  object_ptr_kinds h'\<close>)
+        apply(fold \<open> document_ptr_kinds h =  document_ptr_kinds h'\<close>)
+        using children disc_nodes h0 apply(auto simp add: a_distinct_lists_def)[1]
+        by (metis (no_types, lifting) h0 local.distinct_lists_no_parent select_result_I2)
+      then have 5: "\<And>x. x \<in> set children \<Longrightarrow> x \<in> set disc_nodes \<Longrightarrow> False"
+        using children disc_nodes  by fastforce
+      have 6: "|h' \<turnstile> get_child_nodes xa|\<^sub>r = children'"
+        using children' by (simp add: )
+      have 7: "|h' \<turnstile> get_disconnected_nodes xb|\<^sub>r = disc_nodes'"
+        using disc_nodes' by (simp add: )
+      have "False"
+      proof (cases "xa = ptr")
+        case True
+        have "distinct children_h"
+          using children_h distinct_lists_children h0 \<open>known_ptr ptr\<close> by blast
+        have "|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h"
+          using children_h'
+          by(simp add: )
+        have "children = children_h"
+          using True children children_h by auto
+        show ?thesis
+          using disc_nodes' children' 5 2 4 children_h \<open>distinct children_h\<close> disconnected_nodes_h'
+          apply(auto simp add: 6 7
+              \<open>xa = ptr\<close> \<open>|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h\<close> \<open>children = children_h\<close>)[1]
+          by (metis (no_types, lifting) disc_nodes disconnected_nodes_eq2 disconnected_nodes_h
+              select_result_I2 set_ConsD)
+      next
+        case False
+        have "children' = children"
+          using children' children children_eq[OF False[symmetric]]
+          by auto
+        then show ?thesis
+        proof (cases "xb = owner_document")
+          case True
+          then show ?thesis
+            using disc_nodes disconnected_nodes_h disconnected_nodes_h'
+            using "2" "4" "5" "6" "7" False \<open>children' = children\<close> assms(1) child_in_children_h
+              child_parent_dual children children_h disc_nodes' get_child_nodes_ptr_in_heap
+              list.set_cases list.simps(3) option.simps(1) returns_result_eq set_ConsD
+            by (metis (no_types, hide_lams) assms)
+        next
+          case False
+          then show ?thesis
+            using "2" "4" "5" "6" "7" \<open>children' = children\<close> disc_nodes disc_nodes'
+              disconnected_nodes_eq returns_result_eq
+            by metis
+        qed
+      qed
+      then show "x \<in> {}"
+        by simp
+    qed
+  }
+
+  ultimately have "heap_is_wellformed h'"
+    using heap_is_wellformed_def by blast
+
+  show ?thesis
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def object_ptr_kinds_eq3)[1]
+    using assms(1) assms(2) assms(3) assms(4) local.get_scdom_component_impl
+      remove_child_is_strongly_dom_component_safe_step
+    by blast
+qed
+end
+
+interpretation i_get_scdom_component_remove_child?: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs get_ancestors
+  get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name set_child_nodes set_child_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove
+  by(auto simp add: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+
+subsubsection \<open>adopt\_node\<close>
+
+locale l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_adopt_node_wf +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_owner_document_wf +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma adopt_node_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> adopt_node document_ptr node_ptr \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr) \<rightarrow>\<^sub>r owner_document"
+    using assms(4) local.adopt_node_def by auto
+  then
+  obtain c where "h \<turnstile> get_dom_component (cast owner_document) \<rightarrow>\<^sub>r c"
+    using get_dom_component_ok assms(1) assms(2) assms(3) get_owner_document_owner_document_in_heap
+    by (meson document_ptr_kinds_commutes select_result_I)
+  then
+  have "ptr \<noteq> cast owner_document"
+    using assms(6) assms(1) assms(2) assms(3) local.get_dom_component_ptr owner_document
+    by (metis (no_types, lifting) assms(7) select_result_I2)
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using adopt_node_document_in_heap assms(1) assms(2) assms(3) assms(4) by auto
+  then
+  have "ptr \<noteq> cast document_ptr"
+    using assms(5)
+    using assms(1) assms(2) assms(3) local.get_dom_component_ptr get_dom_component_ok
+    by (meson document_ptr_kinds_commutes returns_result_select_result)
+
+  have "\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr"
+    by (metis assms(1) assms(2) assms(3) assms(6) is_OK_returns_result_I local.get_dom_component_ok
+        local.get_dom_component_parent_inside local.get_dom_component_ptr local.get_owner_document_ptr_in_heap
+        local.get_parent_ok node_ptr_kinds_commutes owner_document returns_result_select_result)
+
+  show ?thesis
+    using adopt_node_writes assms(4)
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: adopt_node_locs_def remove_child_locs_def set_child_nodes_locs_def set_disconnected_nodes_locs_def all_args_def)[1]
+                    apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+                   apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+                  apply(drule \<open>\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>)[1] apply (metis element_ptr_casts_commute3 get_M_Element_preserved8 is_node_ptr_kind_none node_ptr_casts_commute3 option.case_eq_if)
+                 apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+                apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+               apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+              apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+             apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+            apply(drule \<open>\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>)[1] apply (metis document_ptr_casts_commute3 get_M_Mdocument_preserved3)
+           apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+          apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+         apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+        apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+       apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+      apply(drule \<open>\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>)[1]
+      apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+     apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
+    apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
+    done
+qed
+
+lemma adopt_node_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> adopt_node document_ptr node_ptr \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast document_ptr)|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast node_ptr)|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_heap_I local.adopt_node_document_in_heap)
+  then
+  obtain sc where sc: "h \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes returns_result_select_result)
+
+  have "node_ptr |\<in>| node_ptr_kinds h"
+    using assms(4)
+    by (meson is_OK_returns_heap_I local.adopt_node_child_in_heap)
+  then
+  obtain child_sc where child_sc: "h \<turnstile> get_scdom_component (cast node_ptr) \<rightarrow>\<^sub>r child_sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E node_ptr_kinds_commutes)
+
+  then obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r owner_document"
+    by (meson \<open>node_ptr |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
+        get_scdom_component_owner_document_same is_OK_returns_result_E
+        get_scdom_component_subset_get_dom_component local.get_dom_component_ok local.get_dom_component_ptr
+        node_ptr_kinds_commutes)
+  then have "h \<turnstile> get_scdom_component (cast owner_document) \<rightarrow>\<^sub>r child_sc"
+    using child_sc
+    by (metis (no_types, lifting) \<open>node_ptr |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
+        get_scdom_component_subset_get_dom_component is_OK_returns_result_E local.get_dom_component_ok
+        local.get_dom_component_ptr node_ptr_kinds_commutes select_result_I2 subset_code(1))
+
+  have "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
+    by (metis (no_types, lifting) \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        assms(5) contra_subsetD document_ptr_kinds_commutes get_scdom_component_subset_get_dom_component
+        local.get_dom_component_ok returns_result_select_result sc select_result_I2)
+
+  moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r"
+    by (metis (no_types, lifting) \<open>node_ptr |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) assms(6)
+        child_sc contra_subsetD get_scdom_component_subset_get_dom_component local.get_dom_component_ok
+        node_ptr_kinds_commutes returns_result_select_result select_result_I2)
+
+  moreover have "ptr \<notin> set |h \<turnstile> get_scdom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r"
+    using get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
+    by (metis (no_types, lifting)
+        \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close> assms(6) child_sc
+        owner_document select_result_I2)
+  have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r"
+    using get_scdom_component_owner_document_same
+    by (metis (no_types, hide_lams)
+        \<open>\<And>thesis. (\<And>owner_document. h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr) \<rightarrow>\<^sub>r owner_document \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
+        \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close>
+        \<open>ptr \<notin> set |h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r\<close>
+        assms(1) assms(2) assms(3) contra_subsetD document_ptr_kinds_commutes get_scdom_component_subset_get_dom_component
+        is_OK_returns_result_E local.get_dom_component_ok local.get_owner_document_owner_document_in_heap owner_document
+        returns_result_eq select_result_I2)
+  ultimately show ?thesis
+    using assms(1) assms(2) assms(3) assms(4) adopt_node_is_component_unsafe
+    by blast
+qed
+
+lemma adopt_node_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and type_wf: "type_wf h" and known_ptrs: "known_ptrs h"
+  assumes "h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {cast document_ptr, cast child} {} h h'"
+proof -
+
+  obtain old_document parent_opt h2 where
+    old_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r old_document"
+    and
+    parent_opt: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r parent_opt"
+    and
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2"
+    and
+    h': "h2 \<turnstile> (if document_ptr \<noteq> old_document then do {
+        old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
+        set_disconnected_nodes old_document (remove1 child old_disc_nodes);
+        disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
+        set_disconnected_nodes document_ptr (child # disc_nodes)
+      } else do {
+        return ()
+      }) \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_parent_pure])
+
+  have object_ptr_kinds_h_eq3: "object_ptr_kinds h = object_ptr_kinds h2"
+    using h2 apply(simp split: option.splits)
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes])
+    using remove_child_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have object_ptr_kinds_M_eq_h:
+    "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    unfolding object_ptr_kinds_M_defs by simp
+  then have object_ptr_kinds_eq_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have node_ptr_kinds_eq_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    using node_ptr_kinds_M_eq by blast
+
+  have wellformed_h2: "heap_is_wellformed h2"
+    using h2 remove_child_heap_is_wellformed_preserved known_ptrs type_wf
+    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
+  have "type_wf h2"
+    using h2 remove_child_preserves_type_wf known_ptrs type_wf
+    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
+  have "known_ptrs h2"
+    using h2 remove_child_preserves_known_ptrs known_ptrs type_wf
+    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
+  have "heap_is_wellformed h' \<and> known_ptrs h' \<and> type_wf h'"
+  proof(cases "document_ptr = old_document")
+    case True
+    then show ?thesis
+      using h' wellformed_h2 \<open>type_wf h2\<close> \<open>known_ptrs h2\<close> by auto
+  next
+    case False
+    then obtain h3 old_disc_nodes disc_nodes_document_ptr_h3 where
+      docs_neq: "document_ptr \<noteq> old_document" and
+      old_disc_nodes: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r old_disc_nodes" and
+      h3: "h2 \<turnstile> set_disconnected_nodes old_document (remove1 child old_disc_nodes) \<rightarrow>\<^sub>h h3" and
+      disc_nodes_document_ptr_h3:
+      "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3" and
+      h': "h3 \<turnstile> set_disconnected_nodes document_ptr (child # disc_nodes_document_ptr_h3) \<rightarrow>\<^sub>h h'"
+      using h'
+      by(auto elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+
+    have object_ptr_kinds_h2_eq3: "object_ptr_kinds h2 = object_ptr_kinds h3"
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+            OF set_disconnected_nodes_writes h3])
+      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
+      by (auto simp add: reflp_def transp_def)
+    then have object_ptr_kinds_M_eq_h2:
+      "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+      by(simp add: object_ptr_kinds_M_defs)
+    then have object_ptr_kinds_eq_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
+      by(simp)
+    then have node_ptr_kinds_eq_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
+      using node_ptr_kinds_M_eq by blast
+    then have node_ptr_kinds_eq3_h2: "node_ptr_kinds h2 = node_ptr_kinds h3"
+      by auto
+    have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
+      using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
+    then have document_ptr_kinds_eq3_h2: "document_ptr_kinds h2 = document_ptr_kinds h3"
+      using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
+    have children_eq_h2:
+      "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
+      using get_child_nodes_reads set_disconnected_nodes_writes h3
+      apply(rule reads_writes_preserved)
+      by (simp add: set_disconnected_nodes_get_child_nodes)
+    then have children_eq2_h2: "\<And>ptr. |h2 \<turnstile> get_child_nodes ptr|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr|\<^sub>r"
+      using select_result_eq by force
+
+    have object_ptr_kinds_h3_eq3: "object_ptr_kinds h3 = object_ptr_kinds h'"
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+            OF set_disconnected_nodes_writes h'])
+      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
+      by (auto simp add: reflp_def transp_def)
+    then have object_ptr_kinds_M_eq_h3:
+      "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+      by(simp add: object_ptr_kinds_M_defs)
+    then have object_ptr_kinds_eq_h3: "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
+      by(simp)
+    then have node_ptr_kinds_eq_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
+      using node_ptr_kinds_M_eq by blast
+    then have node_ptr_kinds_eq3_h3: "node_ptr_kinds h3 = node_ptr_kinds h'"
+      by auto
+    have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
+      using object_ptr_kinds_eq_h3 document_ptr_kinds_M_eq by auto
+    then have document_ptr_kinds_eq3_h3: "document_ptr_kinds h3 = document_ptr_kinds h'"
+      using object_ptr_kinds_eq_h3 document_ptr_kinds_M_eq by auto
+    have children_eq_h3:
+      "\<And>ptr children. h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
+      using get_child_nodes_reads set_disconnected_nodes_writes h'
+      apply(rule reads_writes_preserved)
+      by (simp add: set_disconnected_nodes_get_child_nodes)
+    then have children_eq2_h3: "\<And>ptr. |h3 \<turnstile> get_child_nodes ptr|\<^sub>r = |h' \<turnstile> get_child_nodes ptr|\<^sub>r"
+      using select_result_eq by force
+
+    have disconnected_nodes_eq_h2:
+      "\<And>doc_ptr disc_nodes. old_document \<noteq> doc_ptr
+      \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+      using get_disconnected_nodes_reads set_disconnected_nodes_writes h3
+      apply(rule reads_writes_preserved)
+      by (simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
+    then have disconnected_nodes_eq2_h2:
+      "\<And>doc_ptr. old_document \<noteq> doc_ptr
+       \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+      using select_result_eq by force
+    obtain disc_nodes_old_document_h2 where disc_nodes_old_document_h2:
+      "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
+      using old_disc_nodes by blast
+    then have disc_nodes_old_document_h3:
+      "h3 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r remove1 child disc_nodes_old_document_h2"
+      using h3 old_disc_nodes returns_result_eq set_disconnected_nodes_get_disconnected_nodes
+      by fastforce
+    have "distinct disc_nodes_old_document_h2"
+      using disc_nodes_old_document_h2 local.heap_is_wellformed_disconnected_nodes_distinct wellformed_h2
+      by blast
+
+
+    have "type_wf h2"
+    proof (insert h2, induct  parent_opt)
+      case None
+      then show ?case
+        using type_wf by simp
+    next
+      case (Some option)
+      then show ?case
+        using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF remove_child_writes]
+          type_wf remove_child_types_preserved
+        by (simp add: reflp_def transp_def)
+    qed
+    then have "type_wf h3"
+      using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
+      using  set_disconnected_nodes_types_preserved
+      by(auto simp add: reflp_def transp_def)
+    then have "type_wf h'"
+      using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
+      using  set_disconnected_nodes_types_preserved
+      by(auto simp add: reflp_def transp_def)
+
+    have "known_ptrs h3"
+      using known_ptrs local.known_ptrs_preserved object_ptr_kinds_h2_eq3 object_ptr_kinds_h_eq3 by blast
+    then have "known_ptrs h'"
+      using local.known_ptrs_preserved object_ptr_kinds_h3_eq3 by blast
+
+    have disconnected_nodes_eq_h3:
+      "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+       \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+      using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
+      apply(rule reads_writes_preserved)
+      by (simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
+    then have disconnected_nodes_eq2_h3:
+      "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
+      \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+      using select_result_eq by force
+    have disc_nodes_document_ptr_h2:
+      "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3"
+      using disconnected_nodes_eq_h2 docs_neq disc_nodes_document_ptr_h3 by auto
+    have disc_nodes_document_ptr_h': "
+      h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r child # disc_nodes_document_ptr_h3"
+      using h' disc_nodes_document_ptr_h3
+      using set_disconnected_nodes_get_disconnected_nodes by blast
+
+    have document_ptr_in_heap: "document_ptr |\<in>| document_ptr_kinds h2"
+      using disc_nodes_document_ptr_h3 document_ptr_kinds_eq2_h2 get_disconnected_nodes_ok assms(1)
+      unfolding heap_is_wellformed_def
+      using disc_nodes_document_ptr_h2 get_disconnected_nodes_ptr_in_heap by blast
+    have old_document_in_heap: "old_document |\<in>| document_ptr_kinds h2"
+      using disc_nodes_old_document_h3 document_ptr_kinds_eq2_h2 get_disconnected_nodes_ok assms(1)
+      unfolding heap_is_wellformed_def
+      using get_disconnected_nodes_ptr_in_heap old_disc_nodes by blast
+
+    have "child \<in> set disc_nodes_old_document_h2"
+    proof (insert parent_opt h2, induct parent_opt)
+      case None
+      then have "h = h2"
+        by(auto)
+      moreover have "a_owner_document_valid h"
+        using assms(1) heap_is_wellformed_def by(simp add: heap_is_wellformed_def)
+      ultimately show ?case
+        using old_document disc_nodes_old_document_h2 None(1) child_parent_dual[OF assms(1)]
+          in_disconnected_nodes_no_parent assms(1) known_ptrs type_wf by blast
+    next
+      case (Some option)
+      then show ?case
+        apply(simp split: option.splits)
+        using assms(1) disc_nodes_old_document_h2 old_document remove_child_in_disconnected_nodes known_ptrs
+        by blast
+    qed
+    have "child \<notin> set (remove1 child disc_nodes_old_document_h2)"
+      using disc_nodes_old_document_h3 h3 known_ptrs wellformed_h2 \<open>distinct disc_nodes_old_document_h2\<close>
+      by auto
+    have "child \<notin> set disc_nodes_document_ptr_h3"
+    proof -
+      have "a_distinct_lists h2"
+        using heap_is_wellformed_def wellformed_h2 by blast
+      then have 0: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                                                          |h2 \<turnstile> document_ptr_kinds_M|\<^sub>r))"
+        by(simp add: a_distinct_lists_def)
+      show ?thesis
+        using distinct_concat_map_E(1)[OF 0] \<open>child \<in> set disc_nodes_old_document_h2\<close>
+          disc_nodes_old_document_h2 disc_nodes_document_ptr_h2
+        by (meson \<open>type_wf h2\<close> docs_neq known_ptrs local.get_owner_document_disconnected_nodes
+            local.known_ptrs_preserved object_ptr_kinds_h_eq3 returns_result_eq wellformed_h2)
+    qed
+
+    have child_in_heap: "child |\<in>| node_ptr_kinds h"
+      using get_owner_document_ptr_in_heap[OF is_OK_returns_result_I[OF old_document]]
+        node_ptr_kinds_commutes by blast
+    have "a_acyclic_heap h2"
+      using wellformed_h2 by (simp add: heap_is_wellformed_def)
+    have "parent_child_rel h' \<subseteq> parent_child_rel h2"
+    proof
+      fix x
+      assume "x \<in> parent_child_rel h'"
+      then show "x \<in> parent_child_rel h2"
+        using object_ptr_kinds_h2_eq3  object_ptr_kinds_h3_eq3 children_eq2_h2 children_eq2_h3
+          mem_Collect_eq object_ptr_kinds_M_eq_h3 select_result_eq split_cong
+        unfolding parent_child_rel_def
+        by(simp)
+    qed
+    then have "a_acyclic_heap h'"
+      using \<open>a_acyclic_heap h2\<close> acyclic_heap_def acyclic_subset by blast
+
+    moreover have "a_all_ptrs_in_heap h2"
+      using wellformed_h2 by (simp add: heap_is_wellformed_def)
+    then have "a_all_ptrs_in_heap h3"
+      apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3_h2 children_eq_h2)[1]
+       apply (simp add: children_eq2_h2 object_ptr_kinds_h2_eq3 subset_code(1))
+      by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> \<open>type_wf h2\<close>
+          disc_nodes_old_document_h2 disc_nodes_old_document_h3 disconnected_nodes_eq2_h2 document_ptr_kinds_eq3_h2
+          in_set_remove1 local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2
+          returns_result_select_result select_result_I2 wellformed_h2)
+    then have "a_all_ptrs_in_heap h'"
+      apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3_h3 children_eq_h3)[1]
+       apply (simp add: children_eq2_h3 object_ptr_kinds_h3_eq3 subset_code(1))
+      by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> disc_nodes_document_ptr_h'
+          disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq3_h3
+          finite_set_in local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2 node_ptr_kinds_eq3_h3
+          select_result_I2 set_ConsD subset_code(1) wellformed_h2)
+
+    moreover have "a_owner_document_valid h2"
+      using wellformed_h2 by (simp add: heap_is_wellformed_def)
+    then have "a_owner_document_valid h'"
+      apply(simp add: a_owner_document_valid_def node_ptr_kinds_eq_h2 node_ptr_kinds_eq3_h3
+          object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 document_ptr_kinds_eq2_h2
+          document_ptr_kinds_eq2_h3 children_eq2_h2 children_eq2_h3 )
+      by (smt disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2
+          disc_nodes_old_document_h2 disc_nodes_old_document_h3
+          disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_in_heap
+          document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 in_set_remove1
+          list.set_intros(1) node_ptr_kinds_eq3_h2 node_ptr_kinds_eq3_h3
+          object_ptr_kinds_h2_eq3 object_ptr_kinds_h3_eq3 select_result_I2
+          set_subset_Cons subset_code(1))
+
+    have a_distinct_lists_h2: "a_distinct_lists h2"
+      using wellformed_h2 by (simp add: heap_is_wellformed_def)
+    then have "a_distinct_lists h'"
+      apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h3 object_ptr_kinds_eq_h2
+          children_eq2_h2 children_eq2_h3)[1]
+    proof -
+      assume 1: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
+                          (sorted_list_of_set (fset (object_ptr_kinds h')))))"
+        and 2: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                                             (sorted_list_of_set (fset (document_ptr_kinds h2)))))"
+        and 3: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
+                   \<inter> (\<Union>x\<in>fset (document_ptr_kinds h2). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
+      show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                                              (sorted_list_of_set (fset (document_ptr_kinds h')))))"
+      proof(rule distinct_concat_map_I)
+        show "distinct (sorted_list_of_set (fset (document_ptr_kinds h')))"
+          by(auto simp add: document_ptr_kinds_M_def )
+      next
+        fix x
+        assume a1: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
+        have 4: "distinct |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r"
+          using a_distinct_lists_h2 "2" a1 concat_map_all_distinct document_ptr_kinds_eq2_h2
+            document_ptr_kinds_eq2_h3
+          by fastforce
+        then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
+        proof (cases "old_document \<noteq> x")
+          case True
+          then show ?thesis
+          proof (cases "document_ptr \<noteq> x")
+            case True
+            then show ?thesis
+              using disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>]
+                disconnected_nodes_eq2_h3[OF \<open>document_ptr \<noteq> x\<close>] 4
+              by(auto)
+          next
+            case False
+            then show ?thesis
+              using  disc_nodes_document_ptr_h3 disc_nodes_document_ptr_h' 4
+                \<open>child \<notin> set disc_nodes_document_ptr_h3\<close>
+              by(auto simp add: disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>] )
+          qed
+        next
+          case False
+          then show ?thesis
+            by (metis (no_types, hide_lams) \<open>distinct disc_nodes_old_document_h2\<close>
+                disc_nodes_old_document_h3 disconnected_nodes_eq2_h3
+                distinct_remove1 docs_neq select_result_I2)
+        qed
+      next
+        fix x y
+        assume a0: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
+          and a1: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
+          and a2: "x \<noteq> y"
+
+        moreover have 5: "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
+          using 2 calculation
+          by (auto simp add: document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 dest: distinct_concat_map_E(1))
+        ultimately show "set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
+        proof(cases "old_document = x")
+          case True
+          have "old_document \<noteq> y"
+            using \<open>x \<noteq> y\<close> \<open>old_document = x\<close> by simp
+          have "document_ptr \<noteq> x"
+            using docs_neq \<open>old_document = x\<close> by auto
+          show ?thesis
+          proof(cases "document_ptr = y")
+            case True
+            then show ?thesis
+              using 5 True select_result_I2[OF disc_nodes_document_ptr_h']
+                select_result_I2[OF disc_nodes_document_ptr_h2]
+                select_result_I2[OF disc_nodes_old_document_h2]
+                select_result_I2[OF disc_nodes_old_document_h3] \<open>old_document = x\<close>
+              by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close>
+                  \<open>document_ptr \<noteq> x\<close> disconnected_nodes_eq2_h3 disjoint_iff_not_equal
+                  notin_set_remove1 set_ConsD)
+          next
+            case False
+            then show ?thesis
+              using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                select_result_I2[OF disc_nodes_document_ptr_h2]
+                select_result_I2[OF disc_nodes_old_document_h2]
+                select_result_I2[OF disc_nodes_old_document_h3]
+                disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 \<open>old_document = x\<close>
+                docs_neq \<open>old_document \<noteq> y\<close>
+              by (metis (no_types, lifting) disjoint_iff_not_equal notin_set_remove1)
+          qed
+        next
+          case False
+          then show ?thesis
+          proof(cases "old_document = y")
+            case True
+            then show ?thesis
+            proof(cases "document_ptr = x")
+              case True
+              show ?thesis
+                using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                  select_result_I2[OF disc_nodes_document_ptr_h2]
+                  select_result_I2[OF disc_nodes_old_document_h2]
+                  select_result_I2[OF disc_nodes_old_document_h3]
+                  \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr = x\<close>
+                apply(simp)
+                by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close>
+                    disconnected_nodes_eq2_h3 disjoint_iff_not_equal notin_set_remove1)
+            next
+              case False
+              then show ?thesis
+                using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                  select_result_I2[OF disc_nodes_document_ptr_h2]
+                  select_result_I2[OF disc_nodes_old_document_h2]
+                  select_result_I2[OF disc_nodes_old_document_h3]
+                  \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr \<noteq> x\<close>
+                by (metis (no_types, lifting) disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
+                    disjoint_iff_not_equal docs_neq notin_set_remove1)
+            qed
+          next
+            case False
+            have "set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}"
+              by (metis DocumentMonad.ptr_kinds_M_ok DocumentMonad.ptr_kinds_M_ptr_kinds False
+                  \<open>type_wf h2\<close> a1 disc_nodes_old_document_h2 document_ptr_kinds_M_def
+                  document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
+                  l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok
+                  local.heap_is_wellformed_one_disc_parent returns_result_select_result
+                  wellformed_h2)
+            then show ?thesis
+            proof(cases "document_ptr = x")
+              case True
+              then have "document_ptr \<noteq> y"
+                using \<open>x \<noteq> y\<close> by auto
+              have "set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}"
+                using \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
+                by blast
+              then show ?thesis
+                using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                  select_result_I2[OF disc_nodes_document_ptr_h2]
+                  select_result_I2[OF disc_nodes_old_document_h2]
+                  select_result_I2[OF disc_nodes_old_document_h3]
+                  \<open>old_document \<noteq> x\<close> \<open>old_document \<noteq> y\<close> \<open>document_ptr = x\<close> \<open>document_ptr \<noteq> y\<close>
+                  \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2
+                  disconnected_nodes_eq2_h3
+                  \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
+                by(auto)
+            next
+              case False
+              then show ?thesis
+              proof(cases "document_ptr = y")
+                case True
+                have f1: "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set disc_nodes_document_ptr_h3 = {}"
+                  using 2 a1 document_ptr_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
+                    \<open>document_ptr \<noteq> x\<close> select_result_I2[OF disc_nodes_document_ptr_h3, symmetric]
+                    disconnected_nodes_eq2_h2[OF docs_neq[symmetric], symmetric]
+                  by (simp add: "5" True)
+                moreover have f1:
+                  "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = {}"
+                  using 2 a1 old_document_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
+                    \<open>old_document \<noteq> x\<close>
+                  by (metis (no_types, lifting) a0 distinct_concat_map_E(1) document_ptr_kinds_eq3_h2
+                      document_ptr_kinds_eq3_h3 finite_fset fmember.rep_eq set_sorted_list_of_set)
+                ultimately show ?thesis
+                  using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                    select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>
+                    \<open>document_ptr \<noteq> x\<close> \<open>document_ptr = y\<close>
+                    \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2
+                    disconnected_nodes_eq2_h3
+                  by auto
+              next
+                case False
+                then show ?thesis
+                  using 5
+                    select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>
+                    \<open>document_ptr \<noteq> x\<close> \<open>document_ptr \<noteq> y\<close>
+                    \<open>child \<in> set disc_nodes_old_document_h2\<close>
+                    disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
+                  by (metis \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
+                      empty_iff inf.idem)
+              qed
+            qed
+          qed
+        qed
+      qed
+    next
+      fix x xa xb
+      assume 0: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
+                                  (sorted_list_of_set (fset (object_ptr_kinds h')))))"
+        and 1: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+                                   (sorted_list_of_set (fset (document_ptr_kinds h2)))))"
+        and 2: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
+                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h2). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
+        and 3: "xa |\<in>| object_ptr_kinds h'"
+        and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+        and 5: "xb |\<in>| document_ptr_kinds h'"
+        and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+      then show False
+        using \<open>child \<in> set disc_nodes_old_document_h2\<close> disc_nodes_document_ptr_h'
+          disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disc_nodes_old_document_h3
+          disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq2_h2
+          document_ptr_kinds_eq2_h3  old_document_in_heap
+        apply(auto)[1]
+        apply(cases "xb = old_document")
+      proof -
+        assume a1: "xb = old_document"
+        assume a2: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
+        assume a3: "h3 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r remove1 child disc_nodes_old_document_h2"
+        assume a4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+        assume "document_ptr_kinds h2 = document_ptr_kinds h'"
+        assume a5: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
+                   \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
+        have f6: "old_document |\<in>| document_ptr_kinds h'"
+          using a1 \<open>xb |\<in>| document_ptr_kinds h'\<close> by blast
+        have f7: "|h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = disc_nodes_old_document_h2"
+          using a2 by simp
+        have "x \<in> set disc_nodes_old_document_h2"
+          using f6 a3 a1 by (metis (no_types) \<open>type_wf h'\<close> \<open>x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r\<close>
+              disconnected_nodes_eq_h3 docs_neq get_disconnected_nodes_ok returns_result_eq
+              returns_result_select_result set_remove1_subset subsetCE)
+        then have "set |h' \<turnstile> get_child_nodes xa|\<^sub>r \<inter>  set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r = {}"
+          using f7 f6 a5 a4 \<open>xa |\<in>| object_ptr_kinds h'\<close>
+          by fastforce
+        then show ?thesis
+          using \<open>x \<in> set disc_nodes_old_document_h2\<close> a1 a4 f7 by blast
+      next
+        assume a1: "xb \<noteq> old_document"
+        assume a2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3"
+        assume a3: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
+        assume a4: "xa |\<in>| object_ptr_kinds h'"
+        assume a5: "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r child # disc_nodes_document_ptr_h3"
+        assume a6: "old_document |\<in>| document_ptr_kinds h'"
+        assume a7: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+        assume a8: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+        assume a9: "document_ptr_kinds h2 = document_ptr_kinds h'"
+        assume a10: "\<And>doc_ptr. old_document \<noteq> doc_ptr
+               \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+        assume a11: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
+               \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+        assume a12: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
+                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
+        have f13: "\<And>d. d \<notin> set |h' \<turnstile> document_ptr_kinds_M|\<^sub>r \<or> h2 \<turnstile> ok get_disconnected_nodes d"
+          using a9 \<open>type_wf h2\<close> get_disconnected_nodes_ok
+          by simp
+        then have f14: "|h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = disc_nodes_old_document_h2"
+          using a6 a3 by simp
+        have "x \<notin> set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+          using a12 a8 a4 \<open>xb |\<in>| document_ptr_kinds h'\<close>
+          by (meson UN_I disjoint_iff_not_equal fmember.rep_eq)
+        then have "x = child"
+          using f13 a11 a10 a7 a5 a2 a1
+          by (metis (no_types, lifting) select_result_I2 set_ConsD)
+        then have "child \<notin> set disc_nodes_old_document_h2"
+          using f14 a12 a8 a6 a4
+          by (metis \<open>type_wf h'\<close> adopt_node_removes_child assms type_wf
+              get_child_nodes_ok known_ptrs local.known_ptrs_known_ptr object_ptr_kinds_h2_eq3
+              object_ptr_kinds_h3_eq3 object_ptr_kinds_h_eq3 returns_result_select_result)
+        then show ?thesis
+          using \<open>child \<in> set disc_nodes_old_document_h2\<close> by fastforce
+      qed
+    qed
+    ultimately show ?thesis
+      using \<open>type_wf h'\<close> \<open>known_ptrs h'\<close> \<open>a_owner_document_valid h'\<close> heap_is_wellformed_def by blast
+  qed
+  then have "heap_is_wellformed h'" and "known_ptrs h'" and "type_wf h'"
+    by auto
+
+  have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF adopt_node_writes assms(4)])
+    unfolding adopt_node_locs_def
+    using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
+      remove_child_pointers_preserved
+    by (auto simp add: reflp_def transp_def split: if_splits)
+  show ?thesis
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def object_ptr_kinds_eq3 )[1]
+    using adopt_node_is_strongly_dom_component_safe_step get_scdom_component_impl assms by blast
+qed
+end
+
+interpretation i_get_scdom_component_adopt_node?: l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_parent get_parent_locs remove_child
+  remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs adopt_node adopt_node_locs get_child_nodes get_child_nodes_locs
+  set_child_nodes set_child_nodes_locs remove to_tree_order get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  by(auto simp add: l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+
+subsubsection \<open>create\_element\<close>
+
+locale l_get_scdom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma create_element_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast document_ptr)|\<^sub>r"
+  assumes "ptr \<noteq> cast |h \<turnstile> create_element document_ptr tag|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  obtain new_element_ptr h2 h3 disc_nodes where
+    new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
+    h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile>set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
+    disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes) \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: create_element_def elim!: bind_returns_heap_E bind_returns_heap_E2[rotated,
+          OF get_disconnected_nodes_pure, rotated])
+
+  have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    using new_element_new_ptr h2 new_element_ptr by blast
+  then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
+    apply(simp add: element_ptr_kinds_def)
+    by force
+  have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_tag_name_writes h3])
+    using set_tag_name_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+
+  have "heap_is_wellformed h'"
+    using assms(4)
+    using assms(1) assms(2) assms(3) local.create_element_preserves_wellformedness(1) by blast
+  have "type_wf h'"
+    using assms(1) assms(2) assms(3) assms(4) local.create_element_preserves_wellformedness(2) by blast
+  have "known_ptrs h'"
+    using assms(1) assms(2) assms(3) assms(4) local.create_element_preserves_wellformedness(3) by blast
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    by (meson assms(4) is_OK_returns_heap_I local.create_element_document_in_heap)
+  then
+  obtain sc where sc: "h \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes returns_result_select_result)
+
+  have "document_ptr |\<in>| document_ptr_kinds h'"
+    using \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
+    using document_ptr_kinds_eq_h2 document_ptr_kinds_eq_h3 by blast
+  then
+  obtain sc' where sc': "h' \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc'"
+    using get_scdom_component_ok
+    by (meson \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> document_ptr_kinds_commutes
+        returns_result_select_result)
+
+  obtain c where c: "h \<turnstile> get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r c"
+    by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        document_ptr_kinds_commutes is_OK_returns_result_E local.get_dom_component_ok)
+
+  have "set c \<subseteq> set sc"
+    using assms(1) assms(2) assms(3) c get_scdom_component_subset_get_dom_component sc by blast
+
+  have "ptr \<notin> set c"
+    using \<open>set c \<subseteq> set sc\<close> assms(5) sc
+    by auto
+  then
+  show ?thesis
+    using create_element_is_weakly_dom_component_safe
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) assms(6) c
+        local.create_element_is_weakly_dom_component_safe_step select_result_I2)
+qed
+
+lemma create_element_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {cast document_ptr} {cast result} h h'"
+proof -
+  obtain new_element_ptr h2 h3 disc_nodes_h3 where
+    new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
+    h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
+    disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
+    using assms(5)
+    by(auto simp add: create_element_def returns_result_heap_def
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+  then have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
+    apply(auto simp add: create_element_def intro!: bind_returns_result_I)[1]
+      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+     apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure pure_returns_heap_eq)
+    by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+  then have "result = new_element_ptr"
+    using assms(4) by auto
+
+
+  have "new_element_ptr \<notin> set |h \<turnstile> element_ptr_kinds_M|\<^sub>r"
+    using new_element_ptr ElementMonad.ptr_kinds_ptr_kinds_M h2
+    using new_element_ptr_not_in_heap by blast
+  then have "cast new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have "cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+
+  have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    using new_element_new_ptr h2 new_element_ptr by blast
+  then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
+    apply(simp add: element_ptr_kinds_def)
+    by force
+  have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_tag_name_writes h3])
+    using set_tag_name_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+  have "known_ptr (cast new_element_ptr)"
+    using \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> local.create_element_known_ptr by blast
+  then
+  have "known_ptrs h2"
+    using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
+    by blast
+  then
+  have "known_ptrs h3"
+    using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
+  then
+  have "known_ptrs h'"
+    using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>ptr' children. ptr' \<noteq> cast new_element_ptr
+              \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2 get_child_nodes_new_element[rotated, OF new_element_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_element_ptr
+                                    \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+
+  have "h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
+    using new_element_ptr h2 new_element_ptr_in_heap[OF h2 new_element_ptr]
+      new_element_is_element_ptr[OF new_element_ptr] new_element_no_child_nodes
+    by blast
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                             = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads h2 get_disconnected_nodes_new_element[OF new_element_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have disconnected_nodes_eq2_h:
+    "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_tag_name_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_tag_name_get_child_nodes)
+  then have children_eq2_h2: "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                               = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_tag_name_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_tag_name_get_disconnected_nodes)
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have "type_wf h2"
+    using \<open>type_wf h\<close> new_element_types_preserved h2 by blast
+  then have "type_wf h3"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_tag_name_writes h3]
+    using  set_tag_name_types_preserved
+    by(auto simp add: reflp_def transp_def)
+  then have "type_wf h'"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
+    using  set_disconnected_nodes_types_preserved
+    by(auto simp add: reflp_def transp_def)
+
+  have children_eq_h3:
+    "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_child_nodes)
+  then have children_eq2_h3: "\<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h3:
+    "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+       \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                               = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
+  then have disconnected_nodes_eq2_h3:
+    "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
+                \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
+  then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h by auto
+  then have "cast new_element_ptr \<notin> set disc_nodes_h3"
+    using \<open>heap_is_wellformed h\<close>
+    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      a_all_ptrs_in_heap_def heap_is_wellformed_def
+    using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
+
+
+
+  have "parent_child_rel h = parent_child_rel h'"
+  proof -
+    have "parent_child_rel h = parent_child_rel h2"
+    proof(auto simp add: parent_child_rel_def)[1]
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h2"
+        by (simp add: object_ptr_kinds_eq_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+            \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h"
+        using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+        by(auto)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis (no_types, lifting)
+            \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+            children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+    qed
+    also have "\<dots> = parent_child_rel h3"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
+    also have "\<dots> = parent_child_rel h'"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
+    finally show ?thesis
+      by simp
+  qed
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h'"
+    by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
+        document_ptr_kinds_eq_h2 document_ptr_kinds_eq_h3)
+
+  have "known_ptr (cast document_ptr)"
+    using \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(3) document_ptr_kinds_commutes
+      local.known_ptrs_known_ptr by blast
+  have "h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
+    using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
+    apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
+    apply(split invoke_splits, rule conjI)+
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I split: option.splits)
+  have "h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
+    using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h'\<close>
+    apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
+    apply(split invoke_splits, rule conjI)+
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I split: option.splits)
+
+  obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
+    by (meson \<open>h \<turnstile> get_owner_document (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> assms(1)
+        assms(2) assms(3) is_OK_returns_result_E is_OK_returns_result_I local.get_owner_document_ptr_in_heap
+        local.to_tree_order_ok)
+  obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
+    by (metis \<open>document_ptr |\<in>| document_ptr_kinds h\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> assms(1) assms(2)
+        assms(3) assms(5) document_ptr_kinds_commutes document_ptr_kinds_eq_h document_ptr_kinds_eq_h2
+        document_ptr_kinds_eq_h3 is_OK_returns_result_E local.create_element_preserves_wellformedness(1)
+        local.to_tree_order_ok)
+  have "set to = set to'"
+  proof safe
+    fix x
+    assume "x \<in> set to"
+    show "x \<in> set to'"
+      using to to'
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close> assms(1) assms(2) assms(3) assms(5)
+          local.create_element_preserves_wellformedness(1))
+  next
+    fix x
+    assume "x \<in> set to'"
+    show "x \<in> set to"
+      using to to'
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close> assms(1) assms(2) assms(3) assms(5)
+          local.create_element_preserves_wellformedness(1))
+  qed
+
+  have "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast new_element_ptr # disc_nodes_h3"
+    using h' local.set_disconnected_nodes_get_disconnected_nodes by auto
+  obtain disc_nodes_h' where disc_nodes_h': "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h'"
+    and "cast new_element_ptr \<in> set disc_nodes_h'"
+    and "disc_nodes_h' =  cast new_element_ptr # disc_nodes_h3"
+    by (simp add: \<open>h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close>)
+
+  have "\<And>disc_ptr to to'. disc_ptr \<in> set disc_nodes_h3 \<Longrightarrow> h \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to \<Longrightarrow>
+h' \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to' \<Longrightarrow> set to = set to'"
+  proof safe
+    fix disc_ptr to to' x
+    assume "disc_ptr \<in> set disc_nodes_h3"
+    assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
+    assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
+    assume "x \<in> set to"
+    show "x \<in> set to'"
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
+          \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close>
+          assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1))
+  next
+    fix disc_ptr to to' x
+    assume "disc_ptr \<in> set disc_nodes_h3"
+    assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
+    assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
+    assume "x \<in> set to'"
+    show "x \<in> set to"
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
+          \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close>
+          assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1))
+  qed
+
+  have "heap_is_wellformed h'"
+    using assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1)
+    by blast
+
+  have "cast new_element_ptr |\<in>| object_ptr_kinds h'"
+    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> disc_nodes_h'
+      local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes by blast
+  then
+  have "new_element_ptr |\<in>| element_ptr_kinds h'"
+    by simp
+
+  have "\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'"
+    by (meson \<open>heap_is_wellformed h'\<close> h' local.heap_is_wellformed_disc_nodes_in_heap
+        local.set_disconnected_nodes_get_disconnected_nodes set_subset_Cons subset_code(1))
+
+  have "h \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3)"
+    using assms(1) assms(2) assms(3) to_tree_order_ok
+    apply(auto intro!: map_M_ok_I)[1]
+    using disc_nodes_document_ptr_h local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes
+    by blast
+  then
+  obtain disc_tree_orders where disc_tree_orders:
+    "h \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3 \<rightarrow>\<^sub>r disc_tree_orders"
+    by auto
+
+  have "h' \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h')"
+    apply(auto intro!: map_M_ok_I)[1]
+    apply(simp add: \<open>disc_nodes_h' =  cast new_element_ptr # disc_nodes_h3\<close>)
+    using \<open>\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'\<close>
+      \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close>
+      \<open>type_wf h'\<close> disc_nodes_h' local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok
+      node_ptr_kinds_commutes by blast
+  then
+  obtain disc_tree_orders' where disc_tree_orders':
+    "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h' \<rightarrow>\<^sub>r disc_tree_orders'"
+    by auto
+
+  have "h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
+    using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> children_eq_h2
+      children_eq_h3 by auto
+
+  obtain new_tree_order where new_tree_order:
+    "h' \<turnstile> to_tree_order (cast new_element_ptr) \<rightarrow>\<^sub>r new_tree_order" and
+    "new_tree_order \<in> set disc_tree_orders'"
+    using map_M_pure_E[OF disc_tree_orders' \<open>cast new_element_ptr \<in> set disc_nodes_h'\<close>]
+    by auto
+  then have "new_tree_order = [cast new_element_ptr]"
+    using \<open>h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+    by(auto simp add: to_tree_order_def
+        dest!: bind_returns_result_E3[rotated, OF \<open>h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>, rotated])
+
+  obtain foo where foo: "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)
+(cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>r [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr] # foo"
+    apply(auto intro!: bind_pure_returns_result_I map_M_pure_I)[1]
+    using \<open>new_tree_order = [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr]\<close> new_tree_order apply auto[1]
+    by (smt \<open>disc_nodes_h' = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close>
+        bind_pure_returns_result_I bind_returns_result_E2 comp_apply disc_tree_orders'
+        local.to_tree_order_pure map_M.simps(2) map_M_pure_I return_returns_result returns_result_eq)
+  then have "set (concat foo) = set (concat disc_tree_orders)"
+    apply(auto elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
+     apply (smt \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3;
+h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa; h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk>
+\<Longrightarrow> set toa = set to'\<close> comp_apply disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
+    using \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa;
+h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow> set toa = set to'\<close> comp_apply
+      disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2
+    by smt
+
+  have "disc_tree_orders' = [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr] # foo"
+    using foo disc_tree_orders'
+    by (simp add: \<open>disc_nodes_h' = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close> returns_result_eq)
+
+  have "set (concat disc_tree_orders') = {cast new_element_ptr} \<union> set (concat disc_tree_orders)"
+    apply(auto simp add: \<open>disc_tree_orders' = [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr] # foo\<close>)[1]
+    using \<open>set (concat foo) = set (concat disc_tree_orders)\<close> by auto
+
+  have "h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'"
+    using \<open>h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_h' to' disc_tree_orders'
+    by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  then
+  have "set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to' \<union> set (concat disc_tree_orders')"
+    by auto
+  have "h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to @ concat disc_tree_orders"
+    using \<open>h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_document_ptr_h
+      to disc_tree_orders
+    by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  then
+  have "set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set to \<union> set (concat disc_tree_orders)"
+    by auto
+
+  have "{cast new_element_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r"
+  proof(safe)
+    show "cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr
+         \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+      using \<open>h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'\<close>
+      apply(auto simp add: a_get_scdom_component_def)[1]
+      by (meson \<open>\<And>thesis. (\<And>new_tree_order. \<lbrakk>h' \<turnstile> to_tree_order (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r new_tree_order;
+new_tree_order \<in> set disc_tree_orders'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> local.to_tree_order_ptr_in_result)
+  next
+    fix x
+    assume " x \<in> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+    then
+    show "x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+      using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union>set (concat disc_tree_orders)\<close>
+      using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to' \<union> set (concat disc_tree_orders')\<close>
+      using \<open>set to = set to'\<close>
+      using \<open>set (concat disc_tree_orders') = {cast new_element_ptr} \<union> set (concat disc_tree_orders)\<close>
+      by(auto)
+  next
+    fix x
+    assume " x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+    assume "x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+    show "x = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr"
+      using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close>
+      using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to' \<union> set (concat disc_tree_orders')\<close>
+      using \<open>set to = set to'\<close>
+      using \<open>set (concat disc_tree_orders') = {cast new_element_ptr} \<union> set (concat disc_tree_orders)\<close>
+      using \<open>x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+        \<open>x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+      by auto
+  qed
+
+
+  have "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
+    using object_ptr_kinds_eq_h object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 by auto
+  then
+  show ?thesis
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def)[1]
+       apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
+    using \<open>{cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr} \<union>
+set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+        apply auto[2]
+    using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to'
+        apply auto[1]
+    using \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
+       apply blast
+      apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
+    using \<open>result = new_element_ptr\<close>
+      \<open>{cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close> apply auto[1]
+      apply(auto)[1]
+    using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to' apply auto[1]
+      apply (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close>)
+    using \<open>\<And>thesis. (\<And>new_element_ptr h2 h3 disc_nodes_h3. \<lbrakk>h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr;
+h \<turnstile> new_element \<rightarrow>\<^sub>h h2; h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3;
+h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3;
+h3 \<turnstile> set_disconnected_nodes document_ptr (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
+      new_element_ptr new_element_ptr_not_in_heap
+     apply auto[1]
+    using create_element_is_strongly_scdom_component_safe_step
+    by (smt ObjectMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+        \<open>result = new_element_ptr\<close> assms(1) assms(2) assms(3) assms(4) assms(5) local.get_scdom_component_impl select_result_I2)
+qed
+end
+
+interpretation i_get_scdom_component_remove_child?: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs get_scdom_component
+  is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name set_child_nodes set_child_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove
+  by(auto simp add: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>create\_character\_data\<close>
+
+locale l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma create_character_data_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast document_ptr)|\<^sub>r"
+  assumes "ptr \<noteq> cast |h \<turnstile> create_character_data document_ptr text|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    by (meson assms(4) is_OK_returns_heap_I local.create_character_data_document_in_heap)
+  then
+  obtain sc where sc: "h \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes returns_result_select_result)
+
+  obtain c where c: "h \<turnstile> get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r c"
+    by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        document_ptr_kinds_commutes is_OK_returns_result_E local.get_dom_component_ok)
+
+  have "set c \<subseteq> set sc"
+    using assms(1) assms(2) assms(3) c get_scdom_component_subset_get_dom_component sc by blast
+
+  have "ptr \<notin> set c"
+    using \<open>set c \<subseteq> set sc\<close> assms(5) sc
+    by auto
+  then
+  show ?thesis
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) assms(6) c
+        local.create_character_data_is_weakly_dom_component_safe_step select_result_I2)
+qed
+
+lemma create_character_data_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {cast document_ptr} {cast result} h h'"
+proof -
+
+  obtain new_character_data_ptr h2 h3 disc_nodes_h3 where
+    new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
+    h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
+    h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
+    disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
+    h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
+    using assms(5)
+    by(auto simp add: create_character_data_def
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+  then have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
+    apply(auto simp add: create_character_data_def intro!: bind_returns_result_I)[1]
+      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+     apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
+        pure_returns_heap_eq)
+    by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+  then have "result = new_character_data_ptr"
+    using assms(4) by auto
+
+  have "new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r"
+    using new_character_data_ptr CharacterDataMonad.ptr_kinds_ptr_kinds_M h2
+    using new_character_data_ptr_not_in_heap by blast
+  then have "cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have "cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+
+
+
+  have object_ptr_kinds_eq_h:
+    "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    using new_character_data_new_ptr h2 new_character_data_ptr by blast
+  then have node_ptr_kinds_eq_h:
+    "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have character_data_ptr_kinds_eq_h:
+    "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
+    apply(simp add: character_data_ptr_kinds_def)
+    by force
+  have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
+    using set_val_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>ptr' children. ptr' \<noteq> cast new_character_data_ptr
+                  \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h:
+    "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
+      \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have object_ptr_kinds_eq_h:
+    "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    using new_character_data_new_ptr h2 new_character_data_ptr by blast
+  then have node_ptr_kinds_eq_h:
+    "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have character_data_ptr_kinds_eq_h:
+    "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
+    apply(simp add: character_data_ptr_kinds_def)
+    by force
+  have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
+    using set_val_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>ptr' children. ptr' \<noteq> cast new_character_data_ptr
+                \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
+                                 \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+
+  have "h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
+    using new_character_data_ptr h2 new_character_data_ptr_in_heap[OF h2 new_character_data_ptr]
+      new_character_data_is_character_data_ptr[OF new_character_data_ptr]
+      new_character_data_no_child_nodes
+    by blast
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                             = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads h2
+      get_disconnected_nodes_new_character_data[OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have disconnected_nodes_eq2_h:
+    "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_val_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_val_get_child_nodes)
+  then have children_eq2_h2:
+    "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                                              = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_val_writes h3
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_val_get_disconnected_nodes)
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have "type_wf h2"
+    using \<open>type_wf h\<close> new_character_data_types_preserved h2 by blast
+  then have "type_wf h3"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_val_writes h3]
+    using  set_val_types_preserved
+    by(auto simp add: reflp_def transp_def)
+  then have "type_wf h'"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
+    using  set_disconnected_nodes_types_preserved
+    by(auto simp add: reflp_def transp_def)
+
+  have children_eq_h3:
+    "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_child_nodes)
+  then have children_eq2_h3:
+    " \<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have disconnected_nodes_eq_h3: "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+    \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
+                            = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+    using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
+    apply(rule reads_writes_preserved)
+    by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
+  then have disconnected_nodes_eq2_h3: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
+             \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
+    using select_result_eq by force
+
+  have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
+  then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
+    using disconnected_nodes_eq_h by auto
+  then have "cast new_character_data_ptr \<notin> set disc_nodes_h3"
+    using \<open>heap_is_wellformed h\<close> using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      a_all_ptrs_in_heap_def heap_is_wellformed_def
+    using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
+
+
+
+
+
+  have "parent_child_rel h = parent_child_rel h'"
+  proof -
+    have "parent_child_rel h = parent_child_rel h2"
+    proof(auto simp add: parent_child_rel_def)[1]
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h2"
+        by (simp add: object_ptr_kinds_eq_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h"
+        and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+            \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "a |\<in>| object_ptr_kinds h"
+        using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+        by(auto)
+    next
+      fix a x
+      assume 0: "a |\<in>| object_ptr_kinds h2"
+        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
+        by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+            children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+    qed
+    also have "\<dots> = parent_child_rel h3"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
+    also have "\<dots> = parent_child_rel h'"
+      by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
+    finally show ?thesis
+      by simp
+  qed
+
+  have "known_ptr (cast new_character_data_ptr)"
+    using \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
+      create_character_data_known_ptr by blast
+  then
+  have "known_ptrs h2"
+    using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
+    by blast
+  then
+  have "known_ptrs h3"
+    using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
+  then
+  have "known_ptrs h'"
+    using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
+
+
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h'"
+    by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
+        document_ptr_kinds_eq_h2 document_ptr_kinds_eq_h3)
+
+  have "known_ptr (cast document_ptr)"
+    using \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(3) document_ptr_kinds_commutes
+      local.known_ptrs_known_ptr by blast
+  have "h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
+    using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
+    apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
+    apply(split invoke_splits, rule conjI)+
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        intro!: bind_pure_returns_result_I split: option.splits)
+  have "h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
+    using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h'\<close>
+    apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
+    apply(split invoke_splits, rule conjI)+
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        intro!: bind_pure_returns_result_I split: option.splits)
+
+  obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
+    by (meson \<open>h \<turnstile> get_owner_document (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r document_ptr\<close>
+        assms(1) assms(2) assms(3) is_OK_returns_result_E is_OK_returns_result_I
+        local.get_owner_document_ptr_in_heap local.to_tree_order_ok)
+  obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
+    by (metis \<open>document_ptr |\<in>| document_ptr_kinds h\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> assms(1) assms(2)
+        assms(3) assms(5) document_ptr_kinds_commutes document_ptr_kinds_eq_h document_ptr_kinds_eq_h2
+        document_ptr_kinds_eq_h3 is_OK_returns_result_E local.create_character_data_preserves_wellformedness(1)
+        local.to_tree_order_ok)
+  have "set to = set to'"
+  proof safe
+    fix x
+    assume "x \<in> set to"
+    show "x \<in> set to'"
+      using to to'
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close> assms(1) assms(2) assms(3) assms(5)
+          local.create_character_data_preserves_wellformedness(1))
+  next
+    fix x
+    assume "x \<in> set to'"
+    show "x \<in> set to"
+      using to to'
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close> assms(1) assms(2) assms(3) assms(5)
+          local.create_character_data_preserves_wellformedness(1))
+  qed
+
+  have "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast new_character_data_ptr # disc_nodes_h3"
+    using h' local.set_disconnected_nodes_get_disconnected_nodes by auto
+  obtain disc_nodes_h' where disc_nodes_h': "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h'"
+    and "cast new_character_data_ptr \<in> set disc_nodes_h'"
+    and "disc_nodes_h' =  cast new_character_data_ptr # disc_nodes_h3"
+    by (simp add: \<open>h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast new_character_data_ptr # disc_nodes_h3\<close>)
+
+  have "\<And>disc_ptr to to'. disc_ptr \<in> set disc_nodes_h3 \<Longrightarrow> h \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to \<Longrightarrow>
+h' \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to' \<Longrightarrow> set to = set to'"
+  proof safe
+    fix disc_ptr to to' x
+    assume "disc_ptr \<in> set disc_nodes_h3"
+    assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
+    assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
+    assume "x \<in> set to"
+    show "x \<in> set to'"
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
+          \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close>
+          assms(1) assms(2) assms(3) assms(5) local.create_character_data_preserves_wellformedness(1))
+  next
+    fix disc_ptr to to' x
+    assume "disc_ptr \<in> set disc_nodes_h3"
+    assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
+    assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
+    assume "x \<in> set to'"
+    show "x \<in> set to"
+      using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
+      by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
+          \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close>
+          assms(1) assms(2) assms(3) assms(5) local.create_character_data_preserves_wellformedness(1))
+  qed
+
+  have "heap_is_wellformed h'"
+    using assms(1) assms(2) assms(3) assms(5) local.create_character_data_preserves_wellformedness(1)
+    by blast
+
+  have "cast new_character_data_ptr |\<in>| object_ptr_kinds h'"
+    using \<open>cast new_character_data_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> disc_nodes_h'
+      local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes by blast
+  then
+  have "new_character_data_ptr |\<in>| character_data_ptr_kinds h'"
+    by simp
+
+  have "\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'"
+    by (meson \<open>heap_is_wellformed h'\<close> h' local.heap_is_wellformed_disc_nodes_in_heap
+        local.set_disconnected_nodes_get_disconnected_nodes set_subset_Cons subset_code(1))
+
+  have "h \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3)"
+    using assms(1) assms(2) assms(3) to_tree_order_ok
+    apply(auto intro!: map_M_ok_I)[1]
+    using disc_nodes_document_ptr_h local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes
+    by blast
+  then
+  obtain disc_tree_orders where disc_tree_orders:
+    "h \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3 \<rightarrow>\<^sub>r disc_tree_orders"
+    by auto
+
+  have "h' \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h')"
+    apply(auto intro!: map_M_ok_I)[1]
+    apply(simp add: \<open>disc_nodes_h' =  cast new_character_data_ptr # disc_nodes_h3\<close>)
+    using \<open>\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'\<close>
+      \<open>cast new_character_data_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close>
+      \<open>type_wf h'\<close> disc_nodes_h' local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok
+      node_ptr_kinds_commutes by blast
+  then
+  obtain disc_tree_orders' where disc_tree_orders':
+    "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h' \<rightarrow>\<^sub>r disc_tree_orders'"
+    by auto
+
+  have "h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
+    using \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close> children_eq_h2 children_eq_h3 by auto
+
+  obtain new_tree_order where new_tree_order:
+    "h' \<turnstile> to_tree_order (cast new_character_data_ptr) \<rightarrow>\<^sub>r new_tree_order" and
+    "new_tree_order \<in> set disc_tree_orders'"
+    using map_M_pure_E[OF disc_tree_orders' \<open>cast new_character_data_ptr \<in> set disc_nodes_h'\<close>]
+    by auto
+  then have "new_tree_order = [cast new_character_data_ptr]"
+    using \<open>h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+    by(auto simp add: to_tree_order_def
+        dest!: bind_returns_result_E3[rotated, OF \<open>h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>, rotated])
+
+  obtain foo where foo: "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)
+(cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>r [cast new_character_data_ptr] # foo"
+    apply(auto intro!: bind_pure_returns_result_I map_M_pure_I)[1]
+    using \<open>new_tree_order = [cast new_character_data_ptr]\<close> new_tree_order apply auto[1]
+    using \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> bind_pure_returns_result_I
+      bind_returns_result_E2 comp_apply disc_tree_orders' local.to_tree_order_pure map_M.simps(2)
+      map_M_pure_I return_returns_result returns_result_eq
+    apply simp
+    by (smt \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> bind_pure_returns_result_I
+        bind_returns_result_E2 comp_apply disc_tree_orders' local.to_tree_order_pure map_M.simps(2) map_M_pure_I
+        return_returns_result returns_result_eq)
+  then have "set (concat foo) = set (concat disc_tree_orders)"
+    apply(auto elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
+     apply (smt \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3;
+h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa; h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow>
+set toa = set to'\<close> comp_apply disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
+    using \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa;
+h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow> set toa = set to'\<close> comp_apply disc_tree_orders
+      local.to_tree_order_pure map_M_pure_E map_M_pure_E2
+    by smt
+
+  have "disc_tree_orders' = [cast new_character_data_ptr] # foo"
+    using foo disc_tree_orders'
+    by (simp add: \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> returns_result_eq)
+
+  have "set (concat disc_tree_orders') = {cast new_character_data_ptr} \<union> set (concat disc_tree_orders)"
+    apply(auto simp add: \<open>disc_tree_orders' = [cast new_character_data_ptr] # foo\<close>)[1]
+    using \<open>set (concat foo) = set (concat disc_tree_orders)\<close> by auto
+
+  have "h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'"
+    using \<open>h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_h' to' disc_tree_orders'
+    by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  then
+  have "set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set to' \<union> set (concat disc_tree_orders')"
+    by auto
+  have "h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to @ concat disc_tree_orders"
+    using \<open>h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_document_ptr_h to disc_tree_orders
+    by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  then
+  have "set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set to \<union> set (concat disc_tree_orders)"
+    by auto
+
+  have "{cast new_character_data_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r"
+  proof(safe)
+    show "cast new_character_data_ptr
+         \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+      using \<open>h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'\<close>
+      apply(auto simp add: a_get_scdom_component_def)[1]
+      by (meson \<open>\<And>thesis. (\<And>new_tree_order. \<lbrakk>h' \<turnstile> to_tree_order (cast new_character_data_ptr) \<rightarrow>\<^sub>r new_tree_order;
+new_tree_order \<in> set disc_tree_orders'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> local.to_tree_order_ptr_in_result)
+  next
+    fix x
+    assume " x \<in> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+    then
+    show "x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+      using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close>
+      using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to' \<union> set (concat disc_tree_orders')\<close>
+      using \<open>set to = set to'\<close>
+      using \<open>set (concat disc_tree_orders') = {cast new_character_data_ptr} \<union> set (concat disc_tree_orders)\<close>
+      by(auto)
+  next
+    fix x
+    assume " x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+    assume "x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
+    show "x = cast new_character_data_ptr"
+      using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close>
+      using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to' \<union> set (concat disc_tree_orders')\<close>
+      using \<open>set to = set to'\<close>
+      using \<open>set (concat disc_tree_orders') = {cast new_character_data_ptr} \<union> set (concat disc_tree_orders)\<close>
+      using \<open>x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+        \<open>x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+      by auto
+  qed
+
+
+  have "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    using object_ptr_kinds_eq_h object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 by auto
+  then
+  show ?thesis
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def)[1]
+       apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
+    using \<open>{cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component
+(cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+        apply auto[2]
+    using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to'
+        apply auto[1]
+    using \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
+       apply blast
+      apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
+    using \<open>result = new_character_data_ptr\<close> \<open>{cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr} \<union>
+set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
+       apply auto[1]
+      apply(auto)[1]
+    using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
+set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to' apply auto[1]
+      apply (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close>)
+    using \<open>\<And>thesis. (\<And>new_character_data_ptr h2 h3 disc_nodes_h3. \<lbrakk>h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr;
+h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2; h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3;
+h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3;
+h3 \<turnstile> set_disconnected_nodes document_ptr (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
+      new_character_data_ptr new_character_data_ptr_not_in_heap
+     apply auto[1]
+    using create_character_data_is_strongly_dom_component_safe_step
+    by (smt ObjectMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+        \<open>result = new_character_data_ptr\<close> assms(1) assms(2) assms(3) assms(4) assms(5) local.get_scdom_component_impl select_result_I2)
+qed
+end
+
+interpretation i_get_scdom_component_create_character_data?: l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs get_scdom_component
+  is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name set_val set_val_locs get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs create_character_data
+  by(auto simp add: l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>create\_document\<close>
+
+lemma create_document_not_strongly_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
+    h' and new_document_ptr where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> create_document \<rightarrow>\<^sub>r new_document_ptr \<rightarrow>\<^sub>h h'" and
+    "\<not> is_strongly_scdom_component_safe {} {cast new_document_ptr} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
+  let ?P = "create_document"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?document_ptr = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1"])
+    by code_simp+
+qed
+
+locale l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma create_document_is_weakly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> create_document \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
+  shows "is_weakly_scdom_component_safe {} {cast result} h h'"
+proof -
+  have "object_ptr_kinds h' = {|cast result|} |\<union>| object_ptr_kinds h"
+    using assms(4) assms(5) local.create_document_def new_document_new_ptr by blast
+  have "result |\<notin>| document_ptr_kinds h"
+    using assms(4) assms(5) local.create_document_def new_document_ptr_not_in_heap by auto
+  show ?thesis
+    using assms
+    apply(auto simp add: is_weakly_scdom_component_safe_def Let_def)[1]
+    using \<open>object_ptr_kinds h' = {|cast result|} |\<union>| object_ptr_kinds h\<close> apply(auto)[1]
+      apply (simp add: local.create_document_def new_document_ptr_in_heap)
+    using \<open>result |\<notin>| document_ptr_kinds h\<close> apply auto[1]
+
+    apply (metis (no_types, lifting) \<open>result |\<notin>| document_ptr_kinds h\<close> document_ptr_kinds_commutes
+        local.create_document_is_weakly_dom_component_safe_step select_result_I2)
+    done
+qed
+end
+
+interpretation i_get_scdom_component_create_document?: l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe to_tree_order get_parent get_parent_locs
+  get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name create_document
+  get_disconnected_nodes get_disconnected_nodes_locs
+  by(auto simp add: l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>insert\_before\<close>
+
+locale l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_owner_document_wf +
+  l_get_dom_component_get_scdom_component +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_child_nodes_get_disconnected_nodes +
+  l_remove_child +
+  l_get_root_node_wf +
+  l_set_disconnected_nodes_get_disconnected_nodes_wf +
+  l_set_disconnected_nodes_get_ancestors +
+  l_get_ancestors_wf +
+  l_get_owner_document +
+  l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma insert_before_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> insert_before ptr' child ref \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast child)|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document ptr'|\<^sub>r)|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast child)|\<^sub>r)|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
+    using assms(4)
+    by(auto simp add: local.adopt_node_def insert_before_def elim!:  bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF ensure_pre_insertion_validity_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated] bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated] split: if_splits)
+  then
+  obtain c where "h \<turnstile> get_dom_component (cast owner_document) \<rightarrow>\<^sub>r c"
+    using get_dom_component_ok assms(1) assms(2) assms(3) get_owner_document_owner_document_in_heap
+    by (meson document_ptr_kinds_commutes select_result_I)
+  then
+  have "ptr \<noteq> cast owner_document"
+    using assms(6) assms(1) assms(2) assms(3) local.get_dom_component_ptr owner_document
+    by (metis (no_types, lifting) assms(8) select_result_I2)
+
+  obtain owner_document' where owner_document': "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document'"
+    using assms(4)
+    by(auto simp add: local.adopt_node_def insert_before_def elim!:  bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF ensure_pre_insertion_validity_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated] split: if_splits)
+  then
+  obtain c where "h \<turnstile> get_dom_component (cast owner_document') \<rightarrow>\<^sub>r c"
+    using get_dom_component_ok assms(1) assms(2) assms(3) get_owner_document_owner_document_in_heap
+    by (meson document_ptr_kinds_commutes select_result_I)
+  then
+  have "ptr \<noteq> cast owner_document'"
+    using assms(1) assms(2) assms(3) assms(7) local.get_dom_component_ptr owner_document' by auto
+  then
+  have "ptr \<noteq> cast |h \<turnstile> get_owner_document ptr'|\<^sub>r"
+    using owner_document' by auto
+
+  have "ptr \<noteq> ptr'"
+    by (metis (mono_tags, hide_lams) assms(1) assms(2) assms(3) assms(5) assms(7) is_OK_returns_result_I
+        l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ptr
+        l_get_owner_document.get_owner_document_ptr_in_heap local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
+        local.l_get_owner_document_axioms owner_document' return_returns_result returns_result_select_result)
+  have "\<And>parent. h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent \<Longrightarrow> parent \<noteq> ptr"
+    by (meson assms(1) assms(2) assms(3) assms(6) l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ptr
+        local.get_dom_component_ok local.get_dom_component_to_tree_order local.get_parent_parent_in_heap
+        local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms local.to_tree_order_ok local.to_tree_order_parent
+        local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap returns_result_select_result)
+  then
+  have "\<And>parent. |h \<turnstile> get_parent child|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr"
+    by (metis assms(2) assms(3) assms(4) is_OK_returns_heap_I local.get_parent_ok
+        local.insert_before_child_in_heap select_result_I)
+
+  show ?thesis
+    using insert_before_writes assms(4)
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: insert_before_locs_def adopt_node_locs_def all_args_def)[1]
+            apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+            apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close>
+        get_M_Mdocument_preserved3)
+           apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+           apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+          apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+           apply (metis \<open>ptr \<noteq> ptr'\<close> document_ptr_casts_commute3 get_M_Mdocument_preserved3)
+          apply(auto split: option.splits)[1] 
+          apply (metis \<open>ptr \<noteq> ptr'\<close> element_ptr_casts_commute3 get_M_Element_preserved8)
+         apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def set_disconnected_nodes_locs_def
+        all_args_def split: if_splits)[1]
+         apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close> get_M_Mdocument_preserved3)
+        apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+            apply (metis (no_types, lifting) \<open>\<And>parent. |h \<turnstile> get_parent child|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>
+        element_ptr_casts_commute3 get_M_Element_preserved8 node_ptr_casts_commute option.case_eq_if option.collapse)
+           apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+          apply (metis \<open>\<And>parent. |h \<turnstile> get_parent child|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>
+        document_ptr_casts_commute3 get_M_Mdocument_preserved3)
+         apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+        apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+       apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+       apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close>
+        get_M_Mdocument_preserved3)
+      apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+      apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
+        get_M_Mdocument_preserved3 owner_document select_result_I2)
+     apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+      apply (metis \<open>ptr \<noteq> ptr'\<close> document_ptr_casts_commute3 get_M_Mdocument_preserved3)
+     apply (metis (no_types, lifting) \<open>ptr \<noteq> ptr'\<close> element_ptr_casts_commute3
+        get_M_Element_preserved8 node_ptr_casts_commute option.case_eq_if option.collapse)
+    apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
+        set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
+    by (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close> get_M_Mdocument_preserved3)
+qed
+
+lemma insert_before_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> insert_before ptr' child ref \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast child)|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+proof -
+  have "ptr' |\<in>| object_ptr_kinds h"
+    by (meson assms(4) is_OK_returns_heap_I local.insert_before_ptr_in_heap)
+  then
+  obtain sc' where sc': "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc'"
+    by (meson assms(1) assms(2) assms(3) get_scdom_component_ok is_OK_returns_result_E)
+  moreover
+  obtain c' where c': "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
+    by (meson \<open>ptr' |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.get_dom_component_ok)
+  ultimately have "set c' \<subseteq> set sc'"
+    using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
+
+  have "child |\<in>| node_ptr_kinds h"
+    by (meson assms(4) is_OK_returns_heap_I local.insert_before_child_in_heap)
+  then
+  obtain child_sc where child_sc: "h \<turnstile> get_scdom_component (cast child) \<rightarrow>\<^sub>r child_sc"
+    by (meson assms(1) assms(2) assms(3) get_scdom_component_ok is_OK_returns_result_E
+        node_ptr_kinds_commutes)
+  moreover
+  obtain child_c where child_c: "h \<turnstile> get_dom_component (cast child) \<rightarrow>\<^sub>r child_c"
+    by (meson \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.get_dom_component_ok node_ptr_kinds_commutes)
+  ultimately have "set child_c \<subseteq> set child_sc"
+    using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
+
+  obtain ptr'_owner_document where ptr'_owner_document: "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r ptr'_owner_document"
+    by (meson \<open>set c' \<subseteq> set sc'\<close> assms(1) assms(2) assms(3) c' get_scdom_component_owner_document_same
+        local.get_dom_component_ptr sc' subset_code(1))
+  then
+  have "h \<turnstile> get_scdom_component (cast ptr'_owner_document) \<rightarrow>\<^sub>r sc'"
+    by (metis (no_types, lifting) \<open>set c' \<subseteq> set sc'\<close> assms(1) assms(2) assms(3) c'
+        get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
+        local.get_dom_component_ptr sc' select_result_I2 subset_code(1))
+  moreover
+  obtain ptr'_owner_document_c where ptr'_owner_document_c:
+    "h \<turnstile> get_dom_component (cast ptr'_owner_document) \<rightarrow>\<^sub>r ptr'_owner_document_c"
+    by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes is_OK_returns_result_E
+        local.get_dom_component_ok local.get_owner_document_owner_document_in_heap ptr'_owner_document)
+  ultimately have "set ptr'_owner_document_c \<subseteq> set sc'"
+    using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
+
+  obtain child_owner_document where child_owner_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r child_owner_document"
+    by (meson \<open>set child_c \<subseteq> set child_sc\<close> assms(1) assms(2) assms(3) child_c child_sc
+        get_scdom_component_owner_document_same local.get_dom_component_ptr subset_code(1))
+
+  have "child_owner_document |\<in>| document_ptr_kinds h"
+    using assms(1) assms(2) assms(3) child_owner_document local.get_owner_document_owner_document_in_heap
+    by blast
+  then
+  have "h \<turnstile> get_scdom_component (cast child_owner_document) \<rightarrow>\<^sub>r child_sc"
+    using get_scdom_component_ok assms(1) assms(2) assms(3) child_sc
+    by (metis (no_types, lifting) \<open>set child_c \<subseteq> set child_sc\<close> child_c child_owner_document
+        get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
+        local.get_dom_component_ptr returns_result_eq set_mp)
+  moreover
+  obtain child_owner_document_c where child_owner_document_c:
+    "h \<turnstile> get_dom_component (cast child_owner_document) \<rightarrow>\<^sub>r child_owner_document_c"
+    by (meson assms(1) assms(2) assms(3) child_owner_document document_ptr_kinds_commutes
+        is_OK_returns_result_E local.get_dom_component_ok local.get_owner_document_owner_document_in_heap)
+  ultimately have "set child_owner_document_c \<subseteq> set child_sc"
+    using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
+
+
+  have "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
+    using \<open>set c' \<subseteq> set sc'\<close> assms(5) c' sc' by auto
+  moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast child)|\<^sub>r"
+    using \<open>set child_c \<subseteq> set child_sc\<close> assms(6) child_c child_sc by auto
+  moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document ptr'|\<^sub>r)|\<^sub>r"
+    using \<open>set ptr'_owner_document_c \<subseteq> set sc'\<close> assms(5) ptr'_owner_document ptr'_owner_document_c sc'
+    by auto
+  moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast child)|\<^sub>r)|\<^sub>r"
+    using \<open>set child_owner_document_c \<subseteq> set child_sc\<close> assms(6) child_owner_document child_owner_document_c
+      child_sc by auto
+
+  ultimately show ?thesis
+    using assms insert_before_is_component_unsafe
+    by blast
+qed
+
+lemma insert_before_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe ({ptr, cast node} \<union> (case child of Some ref \<Rightarrow> {cast ref} | None \<Rightarrow> {} )) {} h h'"
+proof -
+  obtain ancestors reference_child owner_document h2 h3 disconnected_nodes_h2 where
+    ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
+    node_not_in_ancestors: "cast node \<notin> set ancestors" and
+    reference_child:
+    "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
+    owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
+    h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
+    disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2" and
+    h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
+    h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        split: if_splits option.splits)
+
+  have object_ptr_kinds_M_eq3_h: "object_ptr_kinds h = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF adopt_node_writes h2])
+    using adopt_node_pointers_preserved
+      apply blast
+    by (auto simp add: reflp_def transp_def)
+  then have object_ptr_kinds_M_eq_h: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    by(simp add: object_ptr_kinds_M_defs )
+  then have object_ptr_kinds_M_eq2_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have node_ptr_kinds_eq2_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    using node_ptr_kinds_M_eq by blast
+
+  have "known_ptrs h2"
+    using assms(3) object_ptr_kinds_M_eq3_h known_ptrs_preserved by blast
+
+  have wellformed_h2: "heap_is_wellformed h2"
+    using adopt_node_preserves_wellformedness[OF assms(1) h2] assms(3) assms(2) .
+
+  have object_ptr_kinds_M_eq3_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_disconnected_nodes_writes h3])
+    unfolding a_remove_child_locs_def
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have object_ptr_kinds_M_eq_h2: "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    by(simp add: object_ptr_kinds_M_defs)
+  then have object_ptr_kinds_M_eq2_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have node_ptr_kinds_eq2_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    using node_ptr_kinds_M_eq by blast
+  have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
+    using object_ptr_kinds_M_eq2_h2 document_ptr_kinds_M_eq by auto
+
+  have "known_ptrs h3"
+    using object_ptr_kinds_M_eq3_h2 known_ptrs_preserved \<open>known_ptrs h2\<close> by blast
+
+  have object_ptr_kinds_M_eq3_h': "object_ptr_kinds h3 = object_ptr_kinds h'"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF insert_node_writes h'])
+    unfolding a_remove_child_locs_def
+    using set_child_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have object_ptr_kinds_M_eq_h3:
+    "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    by(simp add: object_ptr_kinds_M_defs)
+  then have object_ptr_kinds_M_eq2_h3:
+    "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
+    by simp
+  then have node_ptr_kinds_eq2_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
+    using node_ptr_kinds_M_eq by blast
+  have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
+    using object_ptr_kinds_M_eq2_h3 document_ptr_kinds_M_eq by auto
+
+
+  have "object_ptr_kinds h = object_ptr_kinds h'"
+    by (simp add: object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h' object_ptr_kinds_M_eq3_h2)
+  then
+  show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_scdom_component_safe_def)[1]
+    using insert_before_is_strongly_dom_component_safe_step local.get_scdom_component_impl by blast
+qed
+
+lemma append_child_is_strongly_dom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> append_child ptr' child \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast child)|\<^sub>r"
+  shows "preserved (get_M ptr getter) h h'"
+  by (metis assms(1) assms(2) assms(3) assms(4) assms(5) assms(6)
+      insert_before_is_strongly_dom_component_safe_step local.append_child_def)
+
+lemma append_child_is_strongly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr, cast child} {} h h'"
+  using assms unfolding append_child_def
+  using insert_before_is_strongly_dom_component_safe
+  by fastforce
+end
+
+interpretation i_get_dom_component_insert_before?: l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name set_child_nodes set_child_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
+  get_owner_document remove_child remove_child_locs remove adopt_node adopt_node_locs insert_before
+  insert_before_locs append_child get_scdom_component is_strongly_scdom_component_safe
+  is_weakly_scdom_component_safe
+  by(auto simp add: l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_owner\_document\<close>
+
+locale l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_owner_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_scdom_component +
+  l_get_owner_document_wf_get_root_node_wf
+begin
+lemma get_owner_document_is_strongly_scdom_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
+  shows "cast owner_document \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
+proof -
+  have "h \<turnstile> get_owner_document (cast owner_document) \<rightarrow>\<^sub>r owner_document"
+    by (metis assms(1) assms(2) assms(3) assms(5) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
+        document_ptr_casts_commute3 document_ptr_document_ptr_cast document_ptr_kinds_commutes
+        local.get_owner_document_owner_document_in_heap local.get_root_node_document
+        local.get_root_node_not_node_same node_ptr_no_document_ptr_cast)
+  then show ?thesis
+    using assms
+    using bind_returns_result_E contra_subsetD get_scdom_component_ok
+      get_scdom_component_ptrs_same_scope_component get_scdom_component_subset_get_dom_component
+      is_OK_returns_result_E is_OK_returns_result_I local.get_dom_component_ok local.get_dom_component_ptr
+      local.get_owner_document_ptr_in_heap local.get_owner_document_pure local.get_scdom_component_def
+      pure_returns_heap_eq returns_result_eq
+    by (smt local.get_scdom_component_ptrs_same_owner_document subsetD)
+qed
+
+
+lemma get_owner_document_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>h h'"
+  shows "is_strongly_scdom_component_safe {ptr} {cast owner_document} h h'"
+proof -
+  have "h = h'"
+    by (meson assms(5) local.get_owner_document_pure pure_returns_heap_eq)
+  then show ?thesis
+    using assms
+    apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
+    by (smt get_owner_document_is_strongly_scdom_component_safe_step inf.orderE is_OK_returns_result_I
+        local.get_dom_component_ok local.get_dom_component_to_tree_order_subset local.get_owner_document_ptr_in_heap
+        local.get_scdom_component_impl local.get_scdom_component_ok local.get_scdom_component_ptr_in_heap
+        local.get_scdom_component_subset_get_dom_component local.to_tree_order_ok
+        local.to_tree_order_ptr_in_result notin_fset returns_result_select_result subset_eq)
+qed
+end
+
+interpretation i_get_owner_document_scope_component?: l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_owner_document get_disconnected_nodes get_disconnected_nodes_locs to_tree_order known_ptr
+  known_ptrs type_wf heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs
+  get_parent get_parent_locs get_ancestors get_ancestors_locs get_root_node get_root_node_locs
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name
+  by(auto simp add: l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+end
diff --git a/SC_DOM_Components/ROOT b/SC_DOM_Components/ROOT
new file mode 100644
index 0000000..15fca77
--- /dev/null
+++ b/SC_DOM_Components/ROOT
@@ -0,0 +1,13 @@
+chapter AFP
+
+session "SC_DOM_Components" (AFP) = "Shadow_SC_DOM" +
+  options [timeout = 2400]
+  theories
+    Core_DOM_DOM_Components
+    Core_DOM_SC_DOM_Components
+    Shadow_DOM_DOM_Components
+    Shadow_DOM_SC_DOM_Components
+  document_files
+    "root.tex"
+    "root.bib"
+    "fancytabs-normal.jpg"
diff --git a/SC_DOM_Components/Shadow_DOM_DOM_Components.thy b/SC_DOM_Components/Shadow_DOM_DOM_Components.thy
new file mode 100644
index 0000000..cf97539
--- /dev/null
+++ b/SC_DOM_Components/Shadow_DOM_DOM_Components.thy
@@ -0,0 +1,1323 @@
+(***********************************************************************************
+ * Copyright (c) 2016-2020 The University of Sheffield, UK
+ *               2019-2020 University of Exeter, UK
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * * Redistributions of source code must retain the above copyright notice, this
+ *   list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright notice,
+ *   this list of conditions and the following disclaimer in the documentation
+ *   and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ ***********************************************************************************)
+
+section \<open>Shadow SC DOM Components\<close>
+theory Shadow_DOM_DOM_Components
+  imports
+    Shadow_SC_DOM.Shadow_DOM
+    Core_DOM_DOM_Components
+begin
+
+declare [[smt_timeout = 1200]]
+
+section \<open>Shadow root components\<close>
+
+
+subsection \<open>get\_component\<close>
+
+global_interpretation l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_root_node get_root_node_locs to_tree_order
+  defines get_dom_component = a_get_dom_component
+    and is_strongly_dom_component_safe = a_is_strongly_dom_component_safe
+    and is_weakly_dom_component_safe = a_is_weakly_dom_component_safe
+  .
+
+interpretation i_get_dom_component?: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name
+  by(auto simp add: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def
+      get_dom_component_def is_strongly_dom_component_safe_def is_weakly_dom_component_safe_def instances)
+declare l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+
+
+subsection \<open>attach\_shadow\_root\<close>
+
+locale l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name +
+  l_attach_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr set_shadow_root set_shadow_root_locs set_mode set_mode_locs
+  attach_shadow_root type_wf get_tag_name get_tag_name_locs get_shadow_root get_shadow_root_locs +
+  l_set_mode\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_mode set_mode_locs +
+  l_set_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_shadow_root set_shadow_root_locs
+  for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
+    and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
+    and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and set_shadow_root :: "(_) element_ptr \<Rightarrow> (_) shadow_root_ptr option \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_shadow_root_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and set_mode :: "(_) shadow_root_ptr \<Rightarrow> shadow_root_mode \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_mode_locs :: "(_) shadow_root_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and attach_shadow_root :: "(_) element_ptr \<Rightarrow> shadow_root_mode \<Rightarrow> ((_) heap, exception, (_) shadow_root_ptr) prog"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and is_strongly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and is_weakly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
+    and get_tag_name :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, char list) prog"
+    and get_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_shadow_root :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, (_) shadow_root_ptr option) prog"
+    and get_shadow_root_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+begin
+
+lemma attach_shadow_root_is_weakly_dom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<noteq> cast |h \<turnstile> attach_shadow_root element_ptr shadow_root_mode|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast element_ptr)|\<^sub>r"
+  shows "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
+proof -
+  obtain h2 h3 new_shadow_root_ptr where
+    h2: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h2" and
+    new_shadow_root_ptr: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr" and
+    h3: "h2 \<turnstile> set_mode new_shadow_root_ptr shadow_root_mode \<rightarrow>\<^sub>h h3" and
+    h': "h3 \<turnstile> set_shadow_root element_ptr (Some new_shadow_root_ptr) \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: attach_shadow_root_def elim!:  bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
+  have "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr"
+    using new_shadow_root_ptr h2 h3 h'
+    using assms(4)
+    by(auto simp add: attach_shadow_root_def intro!: bind_returns_result_I
+        bind_pure_returns_result_I[OF get_tag_name_pure] bind_pure_returns_result_I[OF get_shadow_root_pure]
+        elim!:  bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
+  have "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h2"
+    using h2 new_shadow_root_ptr
+    by (metis (no_types, lifting) \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close>
+        assms(5) new_shadow_root_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t select_result_I2)
+
+  have "ptr \<noteq> cast new_shadow_root_ptr"
+    using \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close> assms(5)
+    by auto
+
+  have "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h2 h3"
+    using set_mode_writes h3
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: set_mode_locs_def all_args_def)[1]
+    using \<open>ptr \<noteq> cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_shadow_root_ptr\<close>
+    by (metis get_M_Mshadow_root_preserved3a)
+
+  have "element_ptr |\<in>| element_ptr_kinds h"
+    using \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close> attach_shadow_root_element_ptr_in_heap
+    by blast
+  have "ptr \<noteq> cast element_ptr"
+    by (metis (no_types, lifting) \<open>element_ptr |\<in>| element_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        assms(6) element_ptr_kinds_commutes is_OK_returns_result_E l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok
+        local.get_dom_component_ptr local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms node_ptr_kinds_commutes select_result_I2)
+
+  have "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h3 h'"
+    using set_shadow_root_writes h'
+    apply(rule reads_writes_preserved2)
+    apply(auto simp add: set_shadow_root_locs_def all_args_def)[1]
+    by (metis \<open>ptr \<noteq> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r element_ptr\<close> get_M_Element_preserved8)
+
+  show ?thesis
+    using \<open>preserved (get_M ptr getter) h h2\<close> \<open>preserved (get_M ptr getter) h2 h3\<close> \<open>preserved (get_M ptr getter) h3 h'\<close>
+    by(auto simp add: preserved_def)
+qed
+end
+
+interpretation i_get_dom_component_attach_shadow_root?: l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
+  get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  set_shadow_root set_shadow_root_locs set_mode set_mode_locs attach_shadow_root get_disconnected_nodes
+  get_disconnected_nodes_locs is_strongly_dom_component_safe is_weakly_dom_component_safe get_tag_name
+  get_tag_name_locs get_shadow_root get_shadow_root_locs
+  by(auto simp add: l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsection \<open>get\_shadow\_root\<close>
+
+locale l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_shadow_root +
+  l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_shadow_root_get_child_nodes
+begin
+lemma get_shadow_root_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
+  shows "set |h \<turnstile> get_dom_component (cast host)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast shadow_root_ptr)|\<^sub>r = {}"
+proof -
+  have "cast host |\<in>| object_ptr_kinds h"
+    using assms(4) get_shadow_root_ptr_in_heap by auto
+  then obtain host_c where host_c: "h \<turnstile> get_dom_component (cast host) \<rightarrow>\<^sub>r host_c"
+    by (meson  assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E)
+  obtain host_root where host_root: "h \<turnstile> get_root_node (cast host) \<rightarrow>\<^sub>r host_root"
+    by (metis (no_types, lifting) bind_returns_heap_E get_dom_component_def host_c
+        is_OK_returns_result_I pure_def pure_eq_iff)
+
+  have "cast shadow_root_ptr |\<in>| object_ptr_kinds h"
+    using get_shadow_root_shadow_root_ptr_in_heap assms shadow_root_ptr_kinds_commutes
+    using document_ptr_kinds_commutes by blast
+  then obtain shadow_root_ptr_c where shadow_root_ptr_c: "h \<turnstile> get_dom_component (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_ptr_c"
+    by (meson  assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E)
+  have "h \<turnstile> get_root_node (cast shadow_root_ptr) \<rightarrow>\<^sub>r cast shadow_root_ptr"
+    using \<open>cast shadow_root_ptr |\<in>| object_ptr_kinds h\<close>
+    by(auto simp add: get_root_node_def get_ancestors_def intro!: bind_pure_returns_result_I
+        split: option.splits)
+
+  have "host_root \<noteq> cast shadow_root_ptr"
+  proof (rule ccontr, simp)
+    assume "host_root = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr"
+
+    have "(cast shadow_root_ptr, host_root) \<in> (parent_child_rel h)\<^sup>*"
+      using \<open>host_root = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr\<close> by auto
+    moreover have "(host_root, cast host) \<in> (parent_child_rel h)\<^sup>*"
+      using get_root_node_parent_child_rel host_root assms
+      by blast
+    moreover have "(cast host, cast shadow_root_ptr) \<in> (a_host_shadow_root_rel h)"
+      using assms(4) apply(auto simp add: a_host_shadow_root_rel_def)[1]
+      by (metis (mono_tags, lifting) get_shadow_root_ptr_in_heap image_eqI is_OK_returns_result_I
+          mem_Collect_eq prod.simps(2) select_result_I2)
+    moreover have " acyclic (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)"
+      using assms(1)[unfolded heap_is_wellformed_def]
+      by auto
+    ultimately show False
+      using local.parent_child_rel_node_ptr
+      by (metis (no_types, lifting) Un_iff \<open>host_root = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr\<close>
+          acyclic_def in_rtrancl_UnI rtrancl_into_trancl1)
+  qed
+  then have "host_c \<noteq> shadow_root_ptr_c"
+    by (metis \<open>h \<turnstile> get_root_node (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr) \<rightarrow>\<^sub>r cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr\<close>
+        assms(1) assms(2) assms(3) get_dom_component_ptr get_dom_component_root_node_same host_c host_root
+        local.get_root_node_parent_child_rel local.get_root_node_same_no_parent_parent_child_rel rtranclE shadow_root_ptr_c)
+  then have "set host_c \<inter> set shadow_root_ptr_c = {}"
+    using assms get_dom_component_no_overlap Shadow_DOM.a_heap_is_wellformed_def host_c shadow_root_ptr_c
+    by blast
+  then show ?thesis
+    using host_c shadow_root_ptr_c
+    by auto
+qed
+end
+
+interpretation i_get_shadow_root_component?: l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf get_shadow_root get_shadow_root_locs get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_tag_name get_tag_name_locs known_ptr
+  heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs
+  get_disconnected_document get_disconnected_document_locs known_ptrs to_tree_order get_parent
+  get_parent_locs get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe
+  get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name remove_shadow_root remove_shadow_root_locs
+  by(auto simp add: l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsection \<open>get\_host\<close>
+
+locale l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_host +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M  +
+  l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma get_host_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host"
+  shows "set |h \<turnstile> get_dom_component (cast host)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast shadow_root_ptr)|\<^sub>r = {}"
+proof -
+  have "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
+    using assms(1) assms(2) assms(4) local.shadow_root_host_dual by blast
+  then show ?thesis
+    using assms(1) assms(2) assms(3) local.get_shadow_root_is_component_unsafe by blast
+qed
+end
+
+interpretation i_get_host_component?: l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
+  get_shadow_root get_shadow_root_locs get_tag_name get_tag_name_locs known_ptr type_wf heap_is_wellformed
+  parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
+  get_disconnected_document_locs known_ptrs to_tree_order get_parent get_parent_locs get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors
+  get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name remove_shadow_root
+  remove_shadow_root_locs
+  by(auto simp add: l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+
+subsection \<open>get\_root\_node\_si\<close>
+
+locale l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_root_node_si_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma get_root_node_si_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root"
+  shows "set |h \<turnstile> get_dom_component ptr'|\<^sub>r = set |h \<turnstile> get_dom_component root|\<^sub>r \<or>
+set |h \<turnstile> get_dom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_dom_component root|\<^sub>r = {}"
+proof -
+  have "ptr' |\<in>| object_ptr_kinds h"
+    using get_ancestors_si_ptr_in_heap assms(4)
+    by(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)
+  then
+  obtain c where "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
+    by (meson assms(1) assms(2) assms(3) local.get_dom_component_ok select_result_I)
+  moreover
+  have "root |\<in>| object_ptr_kinds h"
+    using get_ancestors_si_ptr assms(4)
+    apply(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) empty_iff empty_set
+        get_ancestors_si_ptrs_in_heap last_in_set)
+  then
+  obtain c' where "h \<turnstile> get_dom_component root \<rightarrow>\<^sub>r c'"
+    by (meson assms(1) assms(2) assms(3) local.get_dom_component_ok select_result_I)
+  ultimately show ?thesis
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) local.get_dom_component_no_overlap select_result_I2)
+qed
+end
+
+interpretation i_get_dom_component_get_root_node_si?: l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_host get_host_locs get_ancestors_si get_ancestors_si_locs get_root_node_si get_root_node_si_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs get_tag_name
+  get_tag_name_locs heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_document
+  get_disconnected_document_locs to_tree_order get_dom_component is_strongly_dom_component_safe
+  is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
+  get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  by(auto simp add: l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+
+subsection \<open>get\_assigned\_nodes\<close>
+
+lemma get_shadow_root_not_weakly_dom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    element_ptr and shadow_root_ptr_opt and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> get_shadow_root element_ptr \<rightarrow>\<^sub>r shadow_root_ptr_opt \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_dom_component_safe {cast element_ptr} (cast ` set_option shadow_root_ptr_opt) h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Open;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e1
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e1 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and element_ptr="?e1"])
+    by code_simp+
+qed
+
+lemma assigned_nodes_not_weakly_dom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
+'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    node_ptr and nodes and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> assigned_nodes node_ptr \<rightarrow>\<^sub>r nodes \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_dom_component_safe {cast node_ptr} (cast ` set nodes) h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Closed;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e3
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and node_ptr="?e3"])
+    by code_simp+
+qed
+
+lemma get_composed_root_node_not_weakly_dom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    ptr and root and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> get_root_node_si ptr \<rightarrow>\<^sub>r root \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_dom_component_safe {ptr} {root} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Closed;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e3
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e3"])
+    by code_simp+
+qed
+
+lemma assigned_slot_not_weakly_dom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
+'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    node_ptr and slot_opt and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> assigned_slot node_ptr \<rightarrow>\<^sub>r slot_opt \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_dom_component_safe {cast node_ptr} (cast ` set_option slot_opt) h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+ 'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Open;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e2
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e2 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and node_ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e2"])
+    by code_simp+
+qed
+
+locale l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_tag_name +
+  l_get_child_nodes +
+  l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_find_slot\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_assigned_nodes\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_assigned_nodes_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_adopt_node\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_child_wf2 +
+  l_insert_before_wf +
+  l_insert_before_wf2 +
+  l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_append_child_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_disconnected_nodes_get_tag_name +
+  l_set_shadow_root_get_child_nodes +
+  l_set_child_nodes_get_tag_name +
+  l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_remove_shadow_root_get_tag_name +
+  l_set_disconnected_nodes_get_shadow_root +
+  l_set_child_nodes_get_shadow_root +
+  l_remove_shadow_root_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma find_slot_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> find_slot open_flag node_ptr \<rightarrow>\<^sub>r Some slot"
+  shows "set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast slot)|\<^sub>r = {}"
+proof -
+  obtain host shadow_root_ptr to where
+    "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)" and
+    "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr" and
+    "h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to" and
+    "cast slot \<in> set to"
+    using assms(4)
+    apply(auto simp add: find_slot_def first_in_tree_order_def elim!: bind_returns_result_E2
+        map_filter_M_pure_E[where y=slot] split: option.splits if_splits list.splits intro!: map_filter_M_pure
+        bind_pure_I)[1]
+    by (metis element_ptr_casts_commute3)+
+
+  have "node_ptr |\<in>| node_ptr_kinds h"
+    using assms(4) find_slot_ptr_in_heap by blast
+  then obtain node_ptr_c where node_ptr_c: "h \<turnstile> get_dom_component (cast node_ptr) \<rightarrow>\<^sub>r node_ptr_c"
+    using assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E
+      node_ptr_kinds_commutes[symmetric]
+    by metis
+
+  then have "cast host \<in> set node_ptr_c"
+    using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> get_dom_component_parent_inside assms(1)
+      assms(2) assms(3) get_dom_component_ptr
+    by blast
+
+  then have "h \<turnstile> get_dom_component (cast host) \<rightarrow>\<^sub>r node_ptr_c"
+    using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> get_dom_component_subset a_heap_is_wellformed_def
+      assms(1) assms(2) assms(3) node_ptr_c
+    by blast
+
+  moreover have "slot |\<in>| element_ptr_kinds h"
+    using assms(4) find_slot_slot_in_heap by blast
+  then obtain slot_c where slot_c: "h \<turnstile> get_dom_component (cast slot) \<rightarrow>\<^sub>r slot_c"
+    using a_heap_is_wellformed_def assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E
+      node_ptr_kinds_commutes[symmetric] element_ptr_kinds_commutes[symmetric]
+    by metis
+  then have "cast shadow_root_ptr \<in> set slot_c"
+    using \<open>h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to\<close> \<open>cast slot \<in> set to\<close> get_dom_component_to_tree_order
+      assms(1) assms(2) assms(3) get_dom_component_ptr
+    by blast
+  then have "h \<turnstile> get_dom_component (cast shadow_root_ptr) \<rightarrow>\<^sub>r slot_c"
+    using  \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close> get_dom_component_subset assms(1) assms(2)
+      assms(3) slot_c
+    by blast
+
+  ultimately show ?thesis
+    using get_shadow_root_is_component_unsafe assms \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close>
+      node_ptr_c slot_c
+    by fastforce
+qed
+
+
+lemma assigned_nodes_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> assigned_nodes element_ptr \<rightarrow>\<^sub>r nodes"
+  assumes "node_ptr \<in> set nodes"
+  shows "set |h \<turnstile> get_dom_component (cast element_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r = {}"
+proof -
+  have "h \<turnstile> find_slot False node_ptr \<rightarrow>\<^sub>r Some element_ptr"
+    using assms(4) assms(5)
+    by(auto simp add: assigned_nodes_def elim!: bind_returns_result_E2
+        dest!: filter_M_holds_for_result[where x=node_ptr] intro!: bind_pure_I split: if_splits)
+  then show ?thesis
+    using assms find_slot_is_component_unsafe
+    by blast
+qed
+
+lemma flatten_dom_assigned_nodes_become_children:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> flatten_dom \<rightarrow>\<^sub>h h'"
+  assumes "h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes"
+  assumes "nodes \<noteq> []"
+  shows "h' \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
+proof -
+  obtain tups h2 element_ptrs shadow_root_ptrs where
+    "h \<turnstile> element_ptr_kinds_M \<rightarrow>\<^sub>r element_ptrs" and
+    tups: "h \<turnstile> map_filter_M2 (\<lambda>element_ptr. do {
+      tag \<leftarrow> get_tag_name element_ptr;
+      assigned_nodes \<leftarrow> assigned_nodes element_ptr;
+      (if tag = ''slot'' \<and> assigned_nodes \<noteq> [] then return (Some (element_ptr, assigned_nodes))
+else return None)}) element_ptrs \<rightarrow>\<^sub>r tups" (is "h \<turnstile> map_filter_M2 ?f element_ptrs \<rightarrow>\<^sub>r tups") and
+    h2: "h \<turnstile> forall_M (\<lambda>(slot, assigned_nodes). do {
+      get_child_nodes (cast slot) \<bind> forall_M remove;
+      forall_M (append_child (cast slot)) assigned_nodes
+    }) tups \<rightarrow>\<^sub>h h2" and
+    "h2 \<turnstile> shadow_root_ptr_kinds_M \<rightarrow>\<^sub>r shadow_root_ptrs" and
+    h': "h2 \<turnstile> forall_M (\<lambda>shadow_root_ptr. do {
+      host \<leftarrow> get_host shadow_root_ptr;
+      get_child_nodes (cast host) \<bind> forall_M remove;
+      get_child_nodes (cast shadow_root_ptr) \<bind> forall_M (append_child (cast host));
+      remove_shadow_root host
+    }) shadow_root_ptrs \<rightarrow>\<^sub>h h'"
+    using \<open>h \<turnstile> flatten_dom \<rightarrow>\<^sub>h h'\<close>
+    apply(auto simp add: flatten_dom_def elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF ElementMonad.ptr_kinds_M_pure, rotated]
+        bind_returns_heap_E2[rotated, OF ShadowRootMonad.ptr_kinds_M_pure, rotated])[1]
+    apply(drule pure_returns_heap_eq)
+    by(auto intro!: map_filter_M2_pure bind_pure_I)
+
+  have all_tups_slot: "\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set tups \<Longrightarrow>
+h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+    using tups
+    apply(induct element_ptrs arbitrary: tups)
+    by(auto elim!: bind_returns_result_E2 split: if_splits intro!: map_filter_M2_pure bind_pure_I)
+
+  have "distinct element_ptrs"
+    using \<open>h \<turnstile> element_ptr_kinds_M \<rightarrow>\<^sub>r element_ptrs\<close>
+    by auto
+  then
+  have "distinct tups"
+    using tups
+    apply(induct element_ptrs arbitrary: tups)
+    by(auto elim!: bind_returns_result_E2 intro!: map_filter_M2_pure bind_pure_I
+        split: option.splits if_splits intro: map_filter_pure_foo[rotated] )
+
+
+  have "slot \<in> set element_ptrs"
+    using assms(5) assigned_nodes_ptr_in_heap \<open>h \<turnstile> element_ptr_kinds_M \<rightarrow>\<^sub>r element_ptrs\<close>
+    by auto
+  then
+  have "(slot, nodes) \<in> set tups"
+    apply(rule map_filter_M2_in_result[OF tups])
+    apply(auto intro!: bind_pure_I)[1]
+    apply(intro bind_pure_returns_result_I)
+    using assms assigned_nodes_slot_is_slot
+    by(auto intro!: bind_pure_returns_result_I)
+
+  have "\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes"
+    using tups
+    apply(induct element_ptrs arbitrary: tups)
+    by(auto elim!: bind_returns_result_E2 intro!: map_filter_M2_pure bind_pure_I split: if_splits)
+  then
+  have elementwise_eq: "\<And>slot slot' nodes nodes'. (slot, nodes) \<in> set tups \<Longrightarrow>
+(slot', nodes') \<in> set tups \<Longrightarrow> slot = slot' \<Longrightarrow> nodes = nodes'"
+    by (meson returns_result_eq)
+
+  have "\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> distinct nodes"
+    using \<open>\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes\<close> assigned_nodes_distinct
+    using assms(1) by blast
+
+  have "\<And>slot slot' nodes nodes'. (slot, nodes) \<in> set tups \<Longrightarrow> (slot', nodes') \<in> set tups \<Longrightarrow> slot \<noteq> slot' \<Longrightarrow> set nodes \<inter> set nodes' = {}"
+    using \<open>\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes\<close>
+      assigned_nodes_different_ptr assms(1) assms(2) assms(3) by blast
+
+  have "h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+    using \<open>(slot, nodes) \<in> set tups\<close> all_tups_slot by blast
+  then have "h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+    using h2
+  proof(induct tups arbitrary: h, simp)
+    case (Cons x xs)
+    obtain xc ha hb slot' nodes' where
+      "x = (slot', nodes')" and
+      "h \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot') \<rightarrow>\<^sub>r xc" and
+      ha: "h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha" and
+      hb: "ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb" and
+      remainder: "hb \<turnstile> forall_M (\<lambda>(slot, assigned_nodes). Heap_Error_Monad.bind
+(get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot))
+(\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
+(\<lambda>_. forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) assigned_nodes))) xs \<rightarrow>\<^sub>h h2"
+      using Cons(3)
+      by (auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+          bind_returns_result_E bind_returns_result_E2[rotated, OF get_child_nodes_pure, rotated] split: prod.splits)
+
+    have "ha \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+      using \<open>h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close> ha
+    proof(induct xc arbitrary: h, simp)
+      case (Cons a yc)
+      obtain hb1 where
+        hb1: "h \<turnstile> remove a \<rightarrow>\<^sub>h hb1" and
+        hba: "hb1 \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h ha"
+        using Cons
+        by (auto elim!: bind_returns_heap_E)
+      have "hb1 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+        using \<open>h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close> hb1
+        by(auto simp add: CD.remove_child_locs_def set_child_nodes_get_tag_name
+            set_disconnected_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads
+              CD.remove_writes])
+      then show ?case
+        using hba Cons(1) by simp
+    qed
+    then
+    have "hb \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+      using hb
+    proof (induct nodes' arbitrary: ha, simp)
+      case (Cons a nodes')
+      obtain ha1 where
+        ha1: "ha \<turnstile> append_child (cast slot') a \<rightarrow>\<^sub>h ha1" and
+        hb: "ha1 \<turnstile> forall_M (append_child (cast slot')) nodes' \<rightarrow>\<^sub>h hb"
+        using Cons
+        by (auto elim!: bind_returns_heap_E)
+      have "ha1 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+        using \<open>ha \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close> ha1
+        by(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def
+            CD.adopt_node_locs_def CD.remove_child_locs_def set_child_nodes_get_tag_name
+            set_disconnected_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads
+              insert_before_writes] split: if_splits)
+      then show ?case
+        using ha1 hb Cons(1)
+        by simp
+    qed
+    then
+    show ?case
+      using Cons(1) remainder by simp
+  qed
+
+  have "h2 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes \<and> heap_is_wellformed h2 \<and> type_wf h2 \<and> known_ptrs h2"
+    using \<open>(slot, nodes) \<in> set tups\<close>
+    using h2 assms(1) assms(2) assms(3) \<open>distinct tups\<close> all_tups_slot elementwise_eq
+    using \<open>\<And>slot slot' assigned_nodes nodes'. (slot, assigned_nodes) \<in> set tups \<Longrightarrow>
+(slot', nodes') \<in> set tups \<Longrightarrow> slot \<noteq> slot' \<Longrightarrow> set assigned_nodes \<inter> set nodes' = {}\<close>
+    using \<open>\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set tups \<Longrightarrow> distinct assigned_nodes\<close>
+  proof(induct tups arbitrary: h, simp)
+    case (Cons x xs)
+    obtain xc ha hb slot' nodes' where
+      "x = (slot', nodes')" and
+      "h \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot') \<rightarrow>\<^sub>r xc" and
+      ha: "h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha" and
+      hb: "ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb" and
+      remainder: "hb \<turnstile> forall_M (\<lambda>(slot, assigned_nodes). Heap_Error_Monad.bind
+(get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) (\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
+(\<lambda>_. forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) assigned_nodes))) xs \<rightarrow>\<^sub>h h2"
+      using Cons(3)
+      by (auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+          bind_returns_result_E bind_returns_result_E2[rotated, OF get_child_nodes_pure, rotated]
+          split: prod.splits)
+
+    have "\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set xs \<Longrightarrow> h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+      using Cons by auto
+
+    have "heap_is_wellformed ha" and "type_wf ha" and "known_ptrs ha"
+      using Cons(4) Cons(5) Cons(6) \<open>h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha\<close>
+      apply(induct xc arbitrary: h)
+      apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          simp add: CD.remove_def split: option.splits)[1]
+      apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          simp add: CD.remove_def split: option.splits)[1]
+      apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          simp add: CD.remove_def split: option.splits)[1]
+      apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          simp add: CD.remove_def split: option.splits)[1]
+      using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf remove_child_preserves_known_ptrs
+      apply metis
+      apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          simp add: CD.remove_def split: option.splits)[1]
+      using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf remove_child_preserves_known_ptrs
+      apply metis
+      apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          simp add: CD.remove_def split: option.splits)[1]
+      using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf remove_child_preserves_known_ptrs
+      apply metis
+      done
+    then
+    have "heap_is_wellformed hb" and "type_wf hb" and "known_ptrs hb"
+      using \<open>ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb\<close>
+      apply(induct nodes' arbitrary: ha)
+      apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
+      apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
+      apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
+      apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
+      using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
+      apply metis
+      apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
+      using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
+      apply metis
+      apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
+      using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
+      apply metis
+      done
+
+    {
+      fix slot assigned_nodes
+      assume "(slot, assigned_nodes) \<in> set xs"
+      then have "h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+        using \<open>\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set xs \<Longrightarrow> h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>
+        by auto
+      then have "ha \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+        using \<open>h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha\<close>
+        apply(induct xc arbitrary: h)
+        by(auto simp add: CD.remove_child_locs_def set_child_nodes_get_tag_name set_disconnected_nodes_get_tag_name
+            dest!: reads_writes_separate_forwards[OF get_tag_name_reads CD.remove_writes]
+            elim!: bind_returns_heap_E)
+      then have "hb \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+        using \<open>ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb\<close>
+        apply(induct nodes' arbitrary: ha)
+        by(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def
+            CD.remove_child_locs_def set_child_nodes_get_tag_name set_disconnected_nodes_get_tag_name
+            dest!: reads_writes_separate_forwards[OF get_tag_name_reads insert_before_writes]
+            elim!: bind_returns_heap_E
+            split: if_splits)
+    } note tag_names_same = this
+
+    show ?case
+    proof(cases "slot' = slot")
+      case True
+      then
+      have "nodes' = nodes"
+        using Cons.prems(1) Cons.prems(8) \<open>x = (slot', nodes')\<close>
+        by (metis list.set_intros(1))
+      then
+      have "(slot, nodes) \<notin> set xs"
+        using Cons.prems(6) True \<open>x = (slot', nodes')\<close> by auto
+
+      have "ha \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r []"
+        using remove_for_all_empty_children Cons.prems(3) Cons.prems(4) Cons.prems(5)
+          True \<open>h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha\<close>
+        using \<open>h \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot') \<rightarrow>\<^sub>r xc\<close>
+        by blast
+      then
+      have "hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
+        using  append_child_for_all_on_no_children[OF \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>]
+          True \<open>nodes' = nodes\<close>
+        using \<open>ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb\<close>
+        using \<open>(slot, nodes) \<in> set tups\<close> \<open>\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set tups \<Longrightarrow>
+distinct assigned_nodes\<close> \<open>heap_is_wellformed ha\<close> \<open>known_ptrs ha\<close> \<open>type_wf ha\<close> local.append_child_for_all_on_no_children
+        by blast
+      with \<open>heap_is_wellformed hb\<close> and \<open>type_wf hb\<close> and \<open>known_ptrs hb\<close>
+      show ?thesis
+        using \<open>(slot, nodes) \<notin> set xs\<close> remainder
+        using \<open>\<And>slot slot' assigned_nodes nodes'. (slot, assigned_nodes) \<in> set (x#xs) \<Longrightarrow>
+(slot', nodes') \<in> set (x#xs) \<Longrightarrow> slot = slot' \<Longrightarrow> assigned_nodes = nodes'\<close>
+        using \<open>(slot, nodes) \<in> set (x # xs)\<close>
+        using \<open>\<And>slot slot' assigned_nodes nodes'. (slot, assigned_nodes) \<in> set (x#xs) \<Longrightarrow>
+(slot', nodes') \<in> set (x#xs) \<Longrightarrow> slot \<noteq> slot' \<Longrightarrow> set assigned_nodes \<inter> set nodes' = {}\<close>
+      proof(induct xs arbitrary: hb, simp)
+        case (Cons y ys)
+        obtain yc hba hbb slot'' nodes'' where
+          "y = (slot'', nodes'')" and
+          "hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r yc" and
+          "hb \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h hba" and
+          "hba \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'')) nodes'' \<rightarrow>\<^sub>h hbb" and
+          remainder: "hbb \<turnstile> forall_M (\<lambda>(slot, assigned_nodes).
+Heap_Error_Monad.bind (get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot))
+(\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
+(\<lambda>_. forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) assigned_nodes))) ys \<rightarrow>\<^sub>h h2"
+          using Cons(7)
+          by (auto elim!: bind_returns_heap_E
+              bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated] split: prod.splits)
+
+        have "slot \<noteq> slot''"
+          by (metis Cons.prems(5) Cons.prems(7) Cons.prems(8) \<open>y = (slot'', nodes'')\<close>
+              list.set_intros(1) list.set_intros(2))
+        then have "set nodes \<inter> set nodes'' = {}"
+          by (metis Cons.prems(8) Cons.prems(9) \<open>y = (slot'', nodes'')\<close> list.set_intros(1)
+              list.set_intros(2))
+
+        have "hba \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes \<and> heap_is_wellformed hba \<and> type_wf hba \<and> known_ptrs hba"
+          using \<open>hb \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes\<close>
+          using \<open>hb \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h hba\<close>
+          using \<open>hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r yc\<close>
+          using \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>
+        proof(induct yc arbitrary: hb, simp)
+          case (Cons a yc)
+          obtain hb1 where
+            hb1: "hb \<turnstile> remove a \<rightarrow>\<^sub>h hb1" and
+            hba: "hb1 \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h hba"
+            using Cons
+            by (auto elim!: bind_returns_heap_E)
+          have "hb \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast slot'')"
+            using Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6) local.child_parent_dual
+            by auto
+
+          moreover
+          have "heap_is_wellformed hb1" and "type_wf hb1" and "known_ptrs hb1"
+            using  \<open>hb \<turnstile> remove a \<rightarrow>\<^sub>h hb1\<close> Cons.prems(4) Cons.prems(5) Cons.prems(6)
+              local.remove_child_heap_is_wellformed_preserved
+            apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+                bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+            using Cons.prems(4) Cons.prems(5) Cons.prems(6) hb1 local.remove_preserves_type_wf
+            apply blast
+            using Cons.prems(4) Cons.prems(5) Cons.prems(6) hb1 local.remove_preserves_known_ptrs
+            by blast
+          moreover have "hb1 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r yc"
+            using \<open>hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r a # yc\<close> hb1
+            using remove_removes_child \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>
+            by simp
+          moreover have "hb1 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
+            using Cons(2) hb1 CD.set_child_nodes_get_child_nodes_different_pointers
+              \<open>hb \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast slot'')\<close> \<open>slot \<noteq> slot''\<close>
+            apply(auto simp add: CD.remove_child_locs_def elim!: bind_returns_heap_E
+                dest!: reads_writes_separate_forwards[OF get_child_nodes_reads CD.remove_writes])[1]
+            by (metis cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject)
+          ultimately show ?thesis
+            using \<open>hb1 \<turnstile> forall_M remove (yc) \<rightarrow>\<^sub>h hba\<close> Cons
+            by auto
+        qed
+
+
+        then have "hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
+heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb"
+          using \<open>hba \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'')) nodes'' \<rightarrow>\<^sub>h hbb\<close>
+          using \<open>set nodes \<inter> set nodes'' = {}\<close>
+        proof(induct nodes'' arbitrary: hba, simp)
+          case (Cons a nodes'')
+          then have "hba \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes" and
+            "heap_is_wellformed hba" and
+            "type_wf hba" and
+            "known_ptrs hba"
+            by auto
+          obtain hba1 where
+            hba1: "hba \<turnstile> append_child (cast slot'') a \<rightarrow>\<^sub>h hba1" and
+            "hba1 \<turnstile> forall_M (append_child (cast slot'')) nodes'' \<rightarrow>\<^sub>h hbb"
+            using Cons(3)
+            by (auto elim!: bind_returns_heap_E)
+
+          have "heap_is_wellformed hba1" and "type_wf hba1" and "known_ptrs hba1"
+            using Cons.prems(1) hba1 local.append_child_heap_is_wellformed_preserved(1)
+            apply blast
+            using \<open>heap_is_wellformed hba\<close> \<open>known_ptrs hba\<close> \<open>type_wf hba\<close> hba1 local.append_child_preserves_type_wf
+            apply blast
+            using Cons.prems(1) hba1 local.append_child_preserves_known_ptrs
+            by blast
+
+          moreover
+          have "a \<notin> set nodes"
+            using \<open>set nodes \<inter> set (a # nodes'') = {}\<close>
+            by auto
+
+
+          moreover
+          obtain parent_opt where "hba \<turnstile> get_parent a \<rightarrow>\<^sub>r parent_opt"
+            using insert_before_child_in_heap hba1 get_parent_ok unfolding append_child_def
+            by (meson Cons.prems(1) is_OK_returns_heap_I is_OK_returns_result_E)
+          then
+          have "hba1 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
+          proof (induct parent_opt)
+            case None
+            then show ?case
+              using \<open>hba \<turnstile> append_child (cast slot'') a \<rightarrow>\<^sub>h hba1\<close>
+              using \<open>hba \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes\<close>
+              using \<open>slot \<noteq> slot''\<close>
+              apply(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def
+                  CD.adopt_node_locs_def remove_child_locs_def elim!: reads_writes_separate_forwards[OF get_child_nodes_reads
+                    insert_before_writes])[1]
+              by (metis cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
+                  CD.set_child_nodes_get_child_nodes_different_pointers)
+          next
+            case (Some parent)
+            have "parent \<noteq> cast slot"
+              apply(rule ccontr, simp)
+              using Cons(2)
+              apply -
+              apply(rule get_parent_child_dual[OF \<open>hba \<turnstile> get_parent a \<rightarrow>\<^sub>r Some parent\<close>])
+              apply(auto)[1]
+              using \<open>a \<notin> set nodes\<close> returns_result_eq
+              by fastforce
+            show ?case
+              apply(rule reads_writes_separate_forwards)
+              apply(fact get_child_nodes_reads)
+              apply(fact insert_before_writes)
+              apply(fact \<open>hba \<turnstile> append_child (cast slot'') a \<rightarrow>\<^sub>h hba1\<close>[unfolded append_child_def])
+              apply(fact \<open>hba \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes\<close>)
+              using \<open>hba \<turnstile> get_parent a \<rightarrow>\<^sub>r Some parent\<close> \<open>parent \<noteq> cast slot\<close> \<open>slot \<noteq> slot''\<close>
+              apply(auto simp add: insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def
+                  CD.remove_child_locs_def)[1]
+              apply (simp_all add: CD.set_child_nodes_get_child_nodes_different_pointers
+                  CD.set_disconnected_nodes_get_child_nodes)
+              by (metis cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
+                  CD.set_child_nodes_get_child_nodes_different_pointers)
+          qed
+          moreover
+          have "set nodes \<inter> set nodes'' = {}"
+            using Cons.prems(3) by auto
+          ultimately show ?case
+            using Cons.hyps  \<open>hba1 \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'')) nodes'' \<rightarrow>\<^sub>h hbb\<close>
+            by blast
+        qed
+        show ?case
+          apply(rule Cons(1))
+          using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
+heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
+          apply(auto)[1]
+          using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
+heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
+          apply(auto)[1]
+          using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
+heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
+          apply(auto)[1]
+          using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
+heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
+          apply(auto)[1]
+          using Cons.prems(5) apply auto[1]
+          apply (simp add: remainder)
+          using Cons.prems(7) apply auto[1]
+          apply (simp add: True \<open>nodes' = nodes\<close> \<open>x = (slot', nodes')\<close>)
+          by (metis Cons.prems(9) insert_iff list.simps(15))
+      qed
+    next
+      case False
+      then have "nodes' \<noteq> nodes"
+        using Cons.prems(1) Cons.prems(9) \<open>x = (slot', nodes')\<close>
+        by (metis assms(6) inf.idem list.set_intros(1) set_empty2)
+      then
+      have "(slot, nodes) \<in> set xs"
+        using Cons.prems(1) \<open>x = (slot', nodes')\<close>
+        by auto
+      then show ?thesis
+        using Cons(1)[simplified, OF \<open>(slot, nodes) \<in> set xs\<close> remainder
+            \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>]
+        using Cons.prems(6) tag_names_same  Cons.prems(8) Cons.prems(9)
+        by (smt Cons.prems(10) distinct.simps(2) list.set_intros(2))
+    qed
+  qed
+  then
+  show ?thesis
+    using h' \<open>h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>
+  proof(induct shadow_root_ptrs arbitrary: h2, simp)
+    case (Cons shadow_root_ptr shadow_root_ptrs)
+    then have "h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes" and
+      "heap_is_wellformed h2" and
+      "type_wf h2" and
+      "known_ptrs h2"
+      by auto
+    obtain host h2a h2b h2c host_children shadow_root_children where
+      "h2 \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host" and
+      "h2 \<turnstile> get_child_nodes (cast host) \<rightarrow>\<^sub>r host_children" and
+      h2a: "h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a" and
+      "h2a \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_children" and
+      h2b: "h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b" and
+      "h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c" and
+      remainder: "h2c \<turnstile> forall_M(\<lambda>shadow_root_ptr. Heap_Error_Monad.bind (get_host shadow_root_ptr)
+        (\<lambda>host. Heap_Error_Monad.bind (get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host))
+                     (\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
+                            (\<lambda>_. Heap_Error_Monad.bind (get_child_nodes (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr))
+                                   (\<lambda>x. Heap_Error_Monad.bind (forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host)) x)
+                                          (\<lambda>_. remove_shadow_root host))))))
+           shadow_root_ptrs
+       \<rightarrow>\<^sub>h h'"
+      using Cons(3)
+      by(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_host_pure, rotated]
+          bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated])
+
+
+    have "h2 \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
+      using \<open>h2 \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host\<close> shadow_root_host_dual
+      using \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close> by blast
+    then have "h2a \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
+      using \<open>h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close>
+      apply(induct host_children arbitrary: h2)
+      by(auto simp add: set_disconnected_nodes_get_shadow_root set_child_nodes_get_shadow_root
+          CD.remove_child_locs_def elim!: bind_returns_heap_E
+          dest!: reads_writes_separate_forwards[OF get_shadow_root_reads CD.remove_writes])
+    then have "h2b \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
+      using \<open>h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
+      apply(induct shadow_root_children arbitrary: h2a)
+      by(auto simp add: set_disconnected_nodes_get_shadow_root set_child_nodes_get_shadow_root
+          append_child_def insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def
+          CD.remove_child_locs_def elim!: bind_returns_heap_E
+          dest!: reads_writes_separate_forwards[OF get_shadow_root_reads insert_before_writes]
+          split: if_splits)
+
+    have "host \<noteq> slot"
+    proof (rule ccontr, simp)
+      assume "host = slot"
+      show False
+        using get_host_valid_tag_name[OF \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close>
+            \<open>h2 \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host\<close>[unfolded \<open>host = slot\<close>] \<open>h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>]
+        by(simp)
+    qed
+
+    have "heap_is_wellformed h2a" and "type_wf h2a" and "known_ptrs h2a"
+      using \<open>heap_is_wellformed h2\<close> and \<open>type_wf h2\<close> and \<open>known_ptrs h2\<close> \<open>h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close>
+      apply(induct host_children arbitrary: h2)
+      apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+      apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+      apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+      apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+      using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf
+        remove_child_preserves_known_ptrs apply metis
+      apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+      using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf
+        remove_child_preserves_known_ptrs apply metis
+      apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
+      using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf
+        remove_child_preserves_known_ptrs apply metis
+      done
+    then
+    have "heap_is_wellformed h2b" and "type_wf h2b" and "known_ptrs h2b"
+      using \<open>h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
+      apply(induct shadow_root_children arbitrary: h2a)
+      apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
+      apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
+      apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
+      apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
+      using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
+      apply(metis)
+      apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
+      using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
+      apply(metis)
+      apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
+      using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
+      apply(metis)
+      done
+    then
+    have "heap_is_wellformed h2c" and "type_wf h2c" and "known_ptrs h2c"
+      using remove_shadow_root_preserves \<open>h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c\<close>
+      by blast+
+
+    moreover
+    have "h2a \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
+      using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes\<close>
+      using \<open>h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close>
+      using \<open>h2 \<turnstile> get_child_nodes (cast host) \<rightarrow>\<^sub>r host_children\<close>
+      using \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close> \<open>known_ptrs h2\<close>
+    proof (induct host_children arbitrary: h2, simp)
+      case (Cons a host_children)
+      obtain h21 where "h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21" and
+        "h21 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a"
+        using Cons(3)
+        by(auto elim!: bind_returns_heap_E)
+
+      have "heap_is_wellformed h21" and "type_wf h21" and "known_ptrs h21"
+        using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> local.remove_heap_is_wellformed_preserved
+        apply blast
+        using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> local.remove_preserves_type_wf
+        apply blast
+        using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> local.remove_preserves_known_ptrs
+        by blast
+      have "h2 \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast host)"
+        using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) \<rightarrow>\<^sub>r a # host_children\<close>
+        using \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close> \<open>known_ptrs h2\<close> child_parent_dual
+        using heap_is_wellformed_def by auto
+      then have "h21 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
+        using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes\<close> \<open>host \<noteq> slot\<close>
+        using \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close>
+        apply(auto simp add: CD.remove_child_locs_def CD.set_disconnected_nodes_get_child_nodes
+            dest!: reads_writes_preserved[OF get_child_nodes_reads CD.remove_writes])[1]
+        by (meson cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
+            CD.set_child_nodes_get_child_nodes_different_pointers)
+      moreover have "h21 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) \<rightarrow>\<^sub>r host_children"
+        using \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close>  remove_removes_child[OF \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close>
+            \<open>known_ptrs h2\<close> \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) \<rightarrow>\<^sub>r a # host_children\<close>]
+        by blast
+      ultimately show ?case
+        using \<open>heap_is_wellformed h21\<close> and \<open>type_wf h21\<close> and \<open>known_ptrs h21\<close>
+          \<open>h21 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close> Cons(1)
+        using Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6) heap_is_wellformed_def
+          \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> remove_removes_child
+        by blast
+    qed
+
+    then
+    have "h2b \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
+      using \<open>h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
+      using \<open>h2a \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_children\<close>
+      using \<open>heap_is_wellformed h2a\<close> \<open>type_wf h2a\<close> \<open>known_ptrs h2a\<close>
+    proof(induct shadow_root_children arbitrary: h2a, simp)
+      case (Cons a shadow_root_children)
+      obtain h2a1 where "h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1" and
+        "h2a1 \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host)) (shadow_root_children) \<rightarrow>\<^sub>h h2b"
+        using Cons(3)
+        by(auto elim!: bind_returns_heap_E)
+
+      have "heap_is_wellformed h2a1" and "type_wf h2a1" and "known_ptrs h2a1"
+        using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1\<close>
+          local.append_child_heap_is_wellformed_preserved by blast+
+      moreover have "h2a1 \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_children"
+        using \<open>h2a \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r a # shadow_root_children\<close>
+        using insert_before_removes_child \<open>h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1\<close>[unfolded append_child_def]
+        using \<open>heap_is_wellformed h2a\<close> \<open>type_wf h2a\<close> \<open>known_ptrs h2a\<close>
+        using cast_document_ptr_not_node_ptr(2) by blast
+      moreover have "h2a \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast shadow_root_ptr)"
+        using \<open>h2a \<turnstile> get_child_nodes (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr) \<rightarrow>\<^sub>r a # shadow_root_children\<close>
+        using \<open>heap_is_wellformed h2a\<close> \<open>type_wf h2a\<close> \<open>known_ptrs h2a\<close> child_parent_dual
+        using heap_is_wellformed_def by auto
+      then have "h2a1 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
+        using \<open>h2a \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes\<close>
+        using \<open>h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1\<close> \<open>host \<noteq> slot\<close>
+        apply(auto simp add:  set_disconnected_nodes_get_child_nodes append_child_def
+            insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def CD.remove_child_locs_def
+            elim!: bind_returns_heap_E dest!: reads_writes_preserved[OF get_child_nodes_reads insert_before_writes])[1]
+        using CD.set_child_nodes_get_child_nodes_different_pointers cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
+          cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast_document_ptr_not_node_ptr(2)
+        by metis+
+      ultimately
+      show ?case
+        using Cons(1) \<open>h2a1 \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
+        by blast
+    qed
+    then
+    have "h2c \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
+      using \<open>h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c\<close>
+      by(auto simp add: remove_shadow_root_get_child_nodes_different_pointers[OF
+            cast_document_ptr_not_node_ptr(2)] dest!: reads_writes_separate_forwards[OF get_child_nodes_reads
+            remove_shadow_root_writes])
+
+    moreover
+    have "h2a \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+      using h2a \<open>h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>
+      apply(induct host_children arbitrary: h2)
+      by(auto simp add: CD.remove_child_locs_def set_disconnected_nodes_get_tag_name
+          set_child_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads CD.remove_writes]
+          elim!: bind_returns_heap_E)
+    then
+    have "h2b \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+      using h2b
+      apply(induct shadow_root_children arbitrary: h2a)
+      by(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def
+          CD.adopt_node_locs_def CD.remove_child_locs_def set_disconnected_nodes_get_tag_name
+          set_child_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads insert_before_writes]
+          elim!: bind_returns_heap_E split: if_splits)
+    then
+    have "h2c \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
+      using \<open>h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c\<close>
+      by(auto simp add: remove_shadow_root_get_tag_name dest!:
+          reads_writes_separate_forwards[OF get_tag_name_reads remove_shadow_root_writes])
+
+    ultimately show ?case
+      using Cons(1) remainder
+      by auto
+  qed
+qed
+end
+
+interpretation i_assigned_nodes_component?: l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf get_tag_name get_tag_name_locs known_ptr get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs
+  heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
+  get_disconnected_document_locs get_parent get_parent_locs get_mode get_mode_locs get_attribute
+  get_attribute_locs first_in_tree_order find_slot assigned_slot known_ptrs to_tree_order assigned_nodes
+  assigned_nodes_flatten flatten_dom get_root_node get_root_node_locs remove insert_before insert_before_locs
+  append_child remove_shadow_root remove_shadow_root_locs set_shadow_root set_shadow_root_locs remove_child
+  remove_child_locs get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_ancestors
+  get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name get_owner_document
+  set_disconnected_nodes set_disconnected_nodes_locs get_ancestors_di get_ancestors_di_locs
+  adopt_node adopt_node_locs adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M adopt_node_locs\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M set_child_nodes set_child_nodes_locs
+  by(auto simp add: l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_owner\_document\<close>
+
+locale l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_owner_document_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma get_owner_document_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
+  assumes "\<not>is_document_ptr_kind |h \<turnstile> get_root_node ptr|\<^sub>r"
+  shows "set |h \<turnstile> get_dom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast owner_document)|\<^sub>r = {}"
+proof -
+  have "owner_document |\<in>| document_ptr_kinds h"
+    using assms(1) assms(2) assms(3) assms(4) get_owner_document_owner_document_in_heap by blast
+  have "ptr |\<in>| object_ptr_kinds h"
+    by (meson assms(4) is_OK_returns_result_I local.get_owner_document_ptr_in_heap)
+  obtain root where root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
+    by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_result_I
+        local.get_owner_document_ptr_in_heap local.get_root_node_ok returns_result_select_result)
+  then obtain to where to: "h \<turnstile> to_tree_order root \<rightarrow>\<^sub>r to"
+    by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_root_node_root_in_heap
+        local.to_tree_order_ok)
+  then have "\<forall>p \<in> set to. \<not>is_document_ptr_kind p"
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) document_ptr_casts_commute3
+        local.to_tree_order_node_ptrs node_ptr_no_document_ptr_cast root select_result_I2)
+  then have "cast owner_document \<notin> set |h \<turnstile> get_dom_component ptr|\<^sub>r"
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) document_ptr_document_ptr_cast
+        is_OK_returns_result_I l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok local.get_dom_component_root_node_same
+        local.get_root_node_not_node_same local.get_root_node_ptr_in_heap local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
+        node_ptr_no_document_ptr_cast returns_result_select_result root select_result_I2)
+  then have "|h \<turnstile> get_dom_component ptr|\<^sub>r \<noteq> |h \<turnstile> get_dom_component (cast owner_document)|\<^sub>r"
+    by (metis (no_types, lifting) \<open>owner_document |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        document_ptr_kinds_commutes l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok local.get_dom_component_ptr
+        local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms returns_result_select_result)
+  then show ?thesis
+    by (meson \<open>owner_document |\<in>| document_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2)
+        assms(3) document_ptr_kinds_commutes l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_no_overlap
+        l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms returns_result_select_result)
+qed
+
+end
+
+interpretation i_get_owner_document_component?: l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf get_disconnected_nodes get_disconnected_nodes_locs known_ptr get_child_nodes get_child_nodes_locs
+  DocumentClass.known_ptr get_parent get_parent_locs DocumentClass.type_wf get_root_node get_root_node_locs
+  CD.a_get_owner_document get_host get_host_locs get_owner_document get_shadow_root get_shadow_root_locs
+  get_tag_name get_tag_name_locs heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_disconnected_document get_disconnected_document_locs known_ptrs get_ancestors get_ancestors_locs to_tree_order
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_element_by_id
+  get_elements_by_class_name get_elements_by_tag_name
+  by(auto simp add: l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+definition is_shadow_root_component :: "(_) object_ptr list \<Rightarrow> bool"
+  where
+    "is_shadow_root_component c = is_shadow_root_ptr_kind (hd c)"
+
+end
diff --git a/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy b/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy
new file mode 100644
index 0000000..f66abe7
--- /dev/null
+++ b/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy
@@ -0,0 +1,1005 @@
+(***********************************************************************************
+ * Copyright (c) 2016-2020 The University of Sheffield, UK
+ *               2019-2020 University of Exeter, UK
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * * Redistributions of source code must retain the above copyright notice, this
+ *   list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright notice,
+ *   this list of conditions and the following disclaimer in the documentation
+ *   and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ ***********************************************************************************)
+
+section \<open>Shadow SC DOM Components II\<close>
+theory Shadow_DOM_SC_DOM_Components
+  imports
+    Core_DOM_SC_DOM_Components
+    Shadow_DOM_DOM_Components
+begin
+
+section \<open>Shadow root scope components\<close>
+
+
+subsection \<open>get\_scope\_component\<close>
+
+global_interpretation l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_owner_document get_disconnected_nodes
+  get_disconnected_nodes_locs to_tree_order
+  defines get_scdom_component = a_get_scdom_component
+    and is_strongly_scdom_component_safe = a_is_strongly_scdom_component_safe
+    and is_weakly_scdom_component_safe = a_is_weakly_scdom_component_safe
+  .
+interpretation i_get_scdom_component?: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_owner_document get_disconnected_nodes get_disconnected_nodes_locs to_tree_order
+  by(auto simp add: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def get_scdom_component_def
+      is_strongly_scdom_component_safe_def is_weakly_scdom_component_safe_def instances)
+declare l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsubsection \<open>get\_component\<close>
+
+locale l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_heap_is_wellformed +
+  l_get_owner_document +
+  l_get_owner_document_wf +
+  l_get_disconnected_nodes +
+  l_to_tree_order +
+  l_known_ptr +
+  l_known_ptrs +
+  l_get_owner_document_wf_get_root_node_wf +
+  assumes known_ptr_impl: "known_ptr = ShadowRootClass.known_ptr"
+begin
+
+lemma known_ptr_node_or_document: "known_ptr ptr \<Longrightarrow> is_node_ptr_kind ptr \<or> is_document_ptr_kind ptr"
+  by(auto simp add: known_ptr_impl known_ptr_defs DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+      ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+
+lemma get_scdom_component_subset_get_dom_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
+  shows "set c \<subseteq> set sc"
+proof -
+  obtain document disc_nodes tree_order disconnected_tree_orders where document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
+    and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
+    and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
+    and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
+    and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
+    using assms(4)
+    by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
+        elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
+        )
+
+  obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
+    and c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
+    using assms(5)
+    by(auto simp add: get_dom_component_def elim!: bind_returns_result_E2[rotated, OF get_root_node_pure, rotated])
+
+  show ?thesis
+  proof (cases "is_document_ptr_kind root_ptr")
+    case True
+    then have "cast document = root_ptr"
+      using get_root_node_document assms(1) assms(2) assms(3) root_ptr document
+      by (metis document_ptr_casts_commute3 returns_result_eq)
+    then have "c = tree_order"
+      using tree_order c
+      by auto
+    then show ?thesis
+      by(simp add: sc)
+  next
+    case False
+    moreover have "root_ptr |\<in>| object_ptr_kinds h"
+      using assms(1) assms(2) assms(3) local.get_root_node_root_in_heap root_ptr by blast
+    ultimately have "is_node_ptr_kind root_ptr"
+      using assms(3) known_ptrs_known_ptr known_ptr_node_or_document
+      by auto
+    then obtain root_node_ptr where root_node_ptr: "root_ptr = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr"
+      by (metis node_ptr_casts_commute3)
+    then have "h \<turnstile> get_owner_document root_ptr \<rightarrow>\<^sub>r document"
+      using get_root_node_same_owner_document
+      using assms(1) assms(2) assms(3) document root_ptr by blast
+    then have "root_node_ptr \<in> set disc_nodes"
+      using assms(1) assms(2) assms(3) disc_nodes in_disconnected_nodes_no_parent root_node_ptr
+      using local.get_root_node_same_no_parent root_ptr by blast
+    then have "c \<in> set disconnected_tree_orders"
+      using c root_node_ptr
+      using map_M_pure_E[OF disconnected_tree_orders]
+      by (metis (mono_tags, lifting) comp_apply local.to_tree_order_pure select_result_I2)
+    then show ?thesis
+      by(auto simp add: sc)
+  qed
+qed
+
+lemma get_scdom_component_ptrs_same_owner_document:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
+  shows "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
+proof -
+  obtain document disc_nodes tree_order disconnected_tree_orders where document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
+    and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
+    and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
+    and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
+    and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
+    using assms(4)
+    by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
+        elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
+        )
+  show ?thesis
+  proof (cases "ptr' \<in> set tree_order")
+    case True
+    have "owner_document = document"
+      using assms(6) document by fastforce
+    then show ?thesis
+      by (metis (no_types) True assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document
+          document_ptr_casts_commute3 document_ptr_document_ptr_cast document_ptr_kinds_commutes
+          local.get_owner_document_owner_document_in_heap local.get_root_node_document
+          local.get_root_node_not_node_same local.to_tree_order_same_root node_ptr_no_document_ptr_cast
+          tree_order)
+  next
+    case False
+    then obtain disconnected_tree_order where disconnected_tree_order:
+      "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
+      using sc \<open>ptr' \<in> set sc\<close>
+      by auto
+    obtain root_ptr' where
+      root_ptr': "root_ptr' \<in> set disc_nodes" and
+      "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
+      using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
+      by (metis comp_apply local.to_tree_order_pure)
+    have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
+      using disc_nodes
+      by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
+          local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
+          returns_result_select_result root_ptr')
+    then
+    have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
+      using disc_nodes
+      by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq local.get_parent_child_dual
+          local.get_parent_ok local.get_parent_parent_in_heap local.heap_is_wellformed_disc_nodes_in_heap
+          returns_result_select_result root_ptr' select_result_I2 split_option_ex)
+    then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
+      using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
+        assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent local.to_tree_order_get_root_node
+        local.to_tree_order_ptr_in_result
+      by blast
+    then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
+      using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
+      by blast
+
+    then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
+      using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
+        local.get_root_node_same_owner_document
+      by blast
+    then show ?thesis
+      using assms(6) document returns_result_eq by force
+  qed
+qed
+
+lemma get_scdom_component_ptrs_same_scope_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  shows "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+proof -
+  obtain document disc_nodes tree_order disconnected_tree_orders where document:
+    "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
+    and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
+    and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
+    and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
+    and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
+    using assms(4)
+    by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
+        elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
+        )
+  show ?thesis
+  proof (cases "ptr' \<in> set tree_order")
+    case True
+    then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
+      by (metis assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document document_ptr_casts_commute3
+          document_ptr_kinds_commutes known_ptr_node_or_document local.get_owner_document_owner_document_in_heap
+          local.get_root_node_document local.get_root_node_not_node_same local.known_ptrs_known_ptr
+          local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result node_ptr_no_document_ptr_cast tree_order)
+    then show ?thesis
+      using disc_nodes tree_order disconnected_tree_orders sc
+      by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  next
+    case False
+    then obtain disconnected_tree_order where disconnected_tree_order:
+      "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
+      using sc \<open>ptr' \<in> set sc\<close>
+      by auto
+    obtain root_ptr' where
+      root_ptr': "root_ptr' \<in> set disc_nodes" and
+      "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
+      using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
+      by (metis comp_apply local.to_tree_order_pure)
+    have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
+      using disc_nodes
+      by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
+          local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
+          returns_result_select_result root_ptr')
+    then
+    have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
+      using disc_nodes
+      by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq local.get_parent_child_dual
+          local.get_parent_ok local.get_parent_parent_in_heap local.heap_is_wellformed_disc_nodes_in_heap
+          returns_result_select_result root_ptr' select_result_I2 split_option_ex)
+    then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
+      using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
+        assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent local.to_tree_order_get_root_node
+        local.to_tree_order_ptr_in_result
+      by blast
+    then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
+      using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
+      by blast
+
+    then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
+      using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
+        local.get_root_node_same_owner_document
+      by blast
+    then show ?thesis
+      using disc_nodes tree_order disconnected_tree_orders sc
+      by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
+  qed
+qed
+
+lemma get_scdom_component_ok:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "ptr |\<in>| object_ptr_kinds h"
+  shows "h \<turnstile> ok (get_scdom_component ptr)"
+  using assms
+  apply(auto simp add: get_scdom_component_def intro!: bind_is_OK_pure_I map_M_pure_I map_M_ok_I)[1]
+  using get_owner_document_ok
+     apply blast
+    apply (simp add: local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap)
+   apply (simp add: local.get_owner_document_owner_document_in_heap local.to_tree_order_ok)
+  using local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok node_ptr_kinds_commutes
+  by blast
+
+
+lemma get_scdom_component_ptr_in_heap:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  shows "ptr' |\<in>| object_ptr_kinds h"
+  using assms
+  apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
+  using local.to_tree_order_ptrs_in_heap apply blast
+  by (metis (no_types, lifting) assms(4) assms(5) bind_returns_result_E get_scdom_component_impl
+      get_scdom_component_ptrs_same_scope_component is_OK_returns_result_I
+      l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_scdom_component_def local.get_owner_document_ptr_in_heap)
+
+lemma get_scdom_component_contains_get_dom_component:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  obtains c where "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c" and "set c \<subseteq> set sc"
+proof -
+  have "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+    using assms(1) assms(2) assms(3) assms(4) assms(5) get_scdom_component_ptrs_same_scope_component
+    by blast
+  then show ?thesis
+    by (meson assms(1) assms(2) assms(3) assms(5) get_scdom_component_ptr_in_heap
+        get_scdom_component_subset_get_dom_component is_OK_returns_result_E local.get_dom_component_ok that)
+qed
+
+lemma get_scdom_component_owner_document_same:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "ptr' \<in> set sc"
+  obtains owner_document where "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document" and "cast owner_document \<in> set sc"
+  using assms
+  apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
+   apply (metis (no_types, lifting) assms(4) assms(5) document_ptr_casts_commute3
+      document_ptr_document_ptr_cast get_scdom_component_contains_get_dom_component local.get_dom_component_ptr
+      local.get_dom_component_root_node_same local.get_dom_component_to_tree_order local.get_root_node_document
+      local.get_root_node_not_node_same local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap
+      node_ptr_no_document_ptr_cast)
+  apply(rule map_M_pure_E2)
+     apply(simp)
+    apply(simp)
+   apply(simp)
+  by (smt assms(4) assms(5) comp_apply get_scdom_component_ptr_in_heap is_OK_returns_result_E
+      local.get_owner_document_disconnected_nodes local.get_root_node_ok local.get_root_node_same_owner_document
+      local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result)
+
+lemma get_scdom_component_different_owner_documents:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
+  assumes "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document'"
+  assumes "owner_document \<noteq> owner_document'"
+  shows "set |h \<turnstile> get_scdom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = {}"
+  using assms get_scdom_component_ptrs_same_owner_document
+  by (smt disjoint_iff_not_equal get_scdom_component_ok is_OK_returns_result_I
+      local.get_owner_document_ptr_in_heap returns_result_eq returns_result_select_result)
+end
+
+interpretation i_get_dom_component_get_scdom_component?: l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_owner_document
+  get_disconnected_nodes get_disconnected_nodes_locs to_tree_order heap_is_wellformed parent_child_rel
+  type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node
+  get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name
+  get_elements_by_tag_name
+  by(auto simp add: l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
+declare l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+lemma get_dom_component_get_scdom_component_is_l_get_dom_component_get_scdom_component [instances]:
+  "l_get_dom_component_get_scdom_component get_owner_document heap_is_wellformed type_wf known_ptr known_ptrs get_scdom_component get_dom_component"
+  apply(auto simp add: l_get_dom_component_get_scdom_component_def
+      l_get_dom_component_get_scdom_component_axioms_def instances)[1]
+  using get_scdom_component_subset_get_dom_component apply fast
+  using get_scdom_component_ptrs_same_scope_component apply fast
+  using get_scdom_component_ptrs_same_owner_document apply fast
+  using get_scdom_component_ok apply fast
+  using get_scdom_component_ptr_in_heap apply fast
+  using get_scdom_component_contains_get_dom_component apply blast
+  using get_scdom_component_owner_document_same apply blast
+  using get_scdom_component_different_owner_documents apply fast
+  done
+
+
+subsection \<open>attach\_shadow\_root\<close>
+
+lemma attach_shadow_root_not_strongly_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'ShadowRoot::{equal,linorder}) heap" and
+    h' and host and new_shadow_root_ptr where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> attach_shadow_root host m \<rightarrow>\<^sub>r new_shadow_root_ptr \<rightarrow>\<^sub>h h'" and
+    "\<not> is_strongly_scdom_component_safe {cast host} {cast new_shadow_root_ptr} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'ShadowRoot::{equal,linorder}) heap"
+  let ?P = "do {
+    doc \<leftarrow> create_document;
+    create_element doc ''div''
+}"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e1 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and host="?e1"])
+    by code_simp+
+qed
+
+locale l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma attach_shadow_root_is_weakly_component_safe_step:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>h h'"
+  assumes "ptr \<noteq> cast |h \<turnstile> attach_shadow_root element_ptr shadow_root_mode|\<^sub>r"
+  assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast element_ptr)|\<^sub>r"
+  shows "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
+proof -
+  have "element_ptr |\<in>| element_ptr_kinds h"
+    by (meson assms(4) is_OK_returns_heap_I local.attach_shadow_root_element_ptr_in_heap)
+  obtain sc where sc: "h \<turnstile> get_scdom_component (cast element_ptr) \<rightarrow>\<^sub>r sc"
+    using get_scdom_component_ok
+    by (meson assms(1) assms(2) assms(3) assms(4) element_ptr_kinds_commutes is_OK_returns_heap_I
+        local.attach_shadow_root_element_ptr_in_heap node_ptr_kinds_commutes select_result_I)
+  then have "ptr \<notin> set |h \<turnstile> get_dom_component (cast element_ptr)|\<^sub>r"
+    by (metis (no_types, lifting) \<open>element_ptr |\<in>| element_ptr_kinds h\<close> assms(1) assms(2) assms(3)
+        assms(6) element_ptr_kinds_commutes local.get_dom_component_ok
+        local.get_scdom_component_subset_get_dom_component node_ptr_kinds_commutes
+        returns_result_select_result select_result_I2 set_rev_mp)
+  then show ?thesis
+    using assms(1) assms(2) assms(3) assms(4) assms(5) local.attach_shadow_root_is_weakly_dom_component_safe
+    by blast
+qed
+
+lemma attach_shadow_root_is_weakly_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r result"
+  assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>h h'"
+  shows "is_weakly_scdom_component_safe {cast element_ptr} {cast result} h h'"
+proof -
+
+  obtain h2 h3 new_shadow_root_ptr where
+    h2: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h2" and
+    new_shadow_root_ptr: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr" and
+    h3: "h2 \<turnstile> set_mode new_shadow_root_ptr shadow_root_mode \<rightarrow>\<^sub>h h3" and
+    h': "h3 \<turnstile> set_shadow_root element_ptr (Some new_shadow_root_ptr) \<rightarrow>\<^sub>h h'"
+    using assms(5)
+    by(auto simp add: attach_shadow_root_def elim!:  bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
+  have "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr"
+    using new_shadow_root_ptr h2 h3 h'
+    using assms(5)
+    by(auto simp add: attach_shadow_root_def intro!: bind_returns_result_I
+        bind_pure_returns_result_I[OF get_tag_name_pure] bind_pure_returns_result_I[OF get_shadow_root_pure]
+        elim!:  bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
+  then
+  have "object_ptr_kinds h2 = {|cast result|} |\<union>| object_ptr_kinds h"
+    using h2 new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_new_ptr
+    using new_shadow_root_ptr
+    using assms(4) by auto
+  moreover
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_mode_writes h3])
+    using set_mode_pointers_preserved
+      apply blast
+    by (auto simp add: reflp_def transp_def)
+  moreover
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h3 = object_ptr_kinds h'"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_shadow_root_writes h'])
+    using set_shadow_root_pointers_preserved
+      apply blast
+    by (auto simp add: reflp_def transp_def)
+  ultimately have "object_ptr_kinds h' = {|cast result|} |\<union>| object_ptr_kinds h"
+    by simp
+  moreover
+  have "result |\<notin>| shadow_root_ptr_kinds h"
+    using h2 new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_ptr_not_in_heap new_shadow_root_ptr
+    using \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close> assms(4)
+      returns_result_eq by metis
+  ultimately
+  show ?thesis
+    using assms
+    apply(auto simp add: is_weakly_scdom_component_safe_def Let_def)[1]
+    using attach_shadow_root_is_weakly_component_safe_step
+    by (smt document_ptr_kinds_commutes local.get_scdom_component_impl select_result_I2
+        shadow_root_ptr_kinds_commutes)
+qed
+end
+
+interpretation i_get_scdom_component_attach_shadow_root?: l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe to_tree_order
+  get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  set_shadow_root set_shadow_root_locs set_mode set_mode_locs attach_shadow_root get_disconnected_nodes
+  get_disconnected_nodes_locs get_tag_name get_tag_name_locs get_shadow_root get_shadow_root_locs
+  by(auto simp add: l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsection \<open>get\_shadow\_root\<close>
+
+lemma get_shadow_root_not_weakly_scdom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
+'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    element_ptr and shadow_root_ptr_opt and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> get_shadow_root_safe element_ptr \<rightarrow>\<^sub>r shadow_root_ptr_opt \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_scdom_component_safe {cast element_ptr} (cast ` set_option shadow_root_ptr_opt) h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
+'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Open;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e1
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e1 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and element_ptr="?e1"])
+    by code_simp+
+qed
+
+locale l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_scdom_component +
+  l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_create_document +
+  l_get_owner_document_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_mode +
+  l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_shadow_root_safe\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  assumes known_ptrs_impl: "known_ptrs = a_known_ptrs"
+begin
+lemma get_shadow_root_components_disjunct:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
+  shows "set |h \<turnstile> get_scdom_component (cast host)|\<^sub>r \<inter> set |  h \<turnstile> get_scdom_component (cast shadow_root_ptr)|\<^sub>r = {}"
+proof -
+  obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast host) \<rightarrow>\<^sub>r owner_document"
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) element_ptr_kinds_commutes
+        is_OK_returns_result_E is_OK_returns_result_I local.get_dom_component_ok local.get_dom_component_ptr
+        local.get_scdom_component_ok local.get_scdom_component_owner_document_same
+        local.get_scdom_component_subset_get_dom_component local.get_shadow_root_ptr_in_heap node_ptr_kinds_commutes
+        subset_code(1))
+  have "owner_document \<noteq> cast shadow_root_ptr"
+  proof
+    assume "owner_document = cast shadow_root_ptr"
+    then have "(cast owner_document, cast host) \<in>
+(parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)\<^sup>*"
+      using get_owner_document_rel owner_document
+      by (metis (no_types, lifting) assms(1) assms(2) assms(3) cast_document_ptr_not_node_ptr(2)
+          in_rtrancl_UnI inf_sup_aci(6) inf_sup_aci(7))
+    then have "(cast shadow_root_ptr, cast host) \<in>
+(parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)\<^sup>*"
+      by (simp add: \<open>owner_document = cast shadow_root_ptr\<close>)
+    moreover have "(cast host, cast shadow_root_ptr) \<in> a_host_shadow_root_rel h"
+      by (metis (mono_tags, lifting) assms(5) is_OK_returns_result_I local.get_shadow_root_ptr_in_heap
+          local.a_host_shadow_root_rel_def mem_Collect_eq pair_imageI prod.simps(2) select_result_I2)
+    then have "(cast host, cast shadow_root_ptr) \<in>
+(parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)"
+      by (simp)
+    ultimately show False
+      using assms(1)
+      unfolding heap_is_wellformed_def \<open>owner_document = cast shadow_root_ptr\<close> acyclic_def
+      by (meson rtrancl_into_trancl1)
+  qed
+  moreover
+  have "shadow_root_ptr |\<in>| shadow_root_ptr_kinds h"
+    using assms(1) assms(5) local.get_shadow_root_shadow_root_ptr_in_heap by blast
+  then
+  have "cast shadow_root_ptr \<in> fset (object_ptr_kinds h)"
+    by auto
+  have "is_shadow_root_ptr shadow_root_ptr"
+    using assms(3)[unfolded known_ptrs_impl ShadowRootClass.known_ptrs_defs
+        ShadowRootClass.known_ptr_defs DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs, simplified, rule_format, OF
+        \<open>cast shadow_root_ptr \<in> fset (object_ptr_kinds h)\<close>]
+    by(auto simp add: is_document_ptr\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        split: option.splits document_ptr.splits)
+  then
+  have "h \<turnstile> get_owner_document (cast shadow_root_ptr) \<rightarrow>\<^sub>r cast shadow_root_ptr"
+    using \<open>shadow_root_ptr |\<in>| shadow_root_ptr_kinds h\<close>
+    apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def
+        CD.a_get_owner_document_tups_def)[1]
+    apply(split invoke_splits, (rule conjI | rule impI)+)+
+    by(auto simp add: is_node_ptr_kind_none a_get_owner_document\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        CD.a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)
+  ultimately show ?thesis
+    using assms(1) assms(2) assms(3) get_scdom_component_different_owner_documents owner_document
+    by blast
+qed
+
+lemma get_shadow_root_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_shadow_root_safe element_ptr \<rightarrow>\<^sub>r shadow_root_ptr_opt \<rightarrow>\<^sub>h h'"
+  assumes "\<forall>shadow_root_ptr \<in> fset (shadow_root_ptr_kinds h). h \<turnstile> get_mode shadow_root_ptr \<rightarrow>\<^sub>r Closed"
+  shows "is_strongly_scdom_component_safe {cast element_ptr} (cast ` set_option shadow_root_ptr_opt) h h'"
+proof -
+  have "h = h'"
+    using assms(4)
+    by(auto simp add: returns_result_heap_def pure_returns_heap_eq)
+  moreover have "shadow_root_ptr_opt = None"
+    using assms(4)
+    apply(auto simp add: returns_result_heap_def get_shadow_root_safe_def elim!: bind_returns_result_E2
+        split: option.splits if_splits)[1]
+    using get_shadow_root_shadow_root_ptr_in_heap
+    by (meson assms(5) is_OK_returns_result_I local.get_mode_ptr_in_heap notin_fset returns_result_eq
+        shadow_root_mode.distinct(1))
+  ultimately show ?thesis
+    by(simp add: is_strongly_scdom_component_safe_def preserved_def)
+qed
+end
+
+interpretation i_get_shadow_root_scope_component?: l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
+  is_strongly_dom_component_safe is_weakly_dom_component_safe get_shadow_root get_shadow_root_locs
+  get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_tag_name
+  get_tag_name_locs heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
+  get_disconnected_document_locs to_tree_order get_parent get_parent_locs get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  remove_shadow_root remove_shadow_root_locs create_document DocumentClass.known_ptr DocumentClass.type_wf
+  CD.a_get_owner_document  get_mode get_mode_locs get_shadow_root_safe get_shadow_root_safe_locs
+  by(auto simp add: l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
+declare l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsection \<open>get\_host\<close>
+
+lemma get_host_not_weakly_scdom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    shadow_root_ptr and element_ptr and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r element_ptr \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_scdom_component_safe {cast shadow_root_ptr} {cast element_ptr} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Open;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return s1
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?s1 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and shadow_root_ptr="?s1"])
+    by code_simp+
+qed
+
+locale l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+lemma get_host_components_disjunct:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
+  assumes "h \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host"
+  shows "set |h \<turnstile> get_scdom_component (cast host)|\<^sub>r \<inter> set |  h \<turnstile> get_scdom_component (cast shadow_root_ptr)|\<^sub>r = {}"
+  using assms get_shadow_root_components_disjunct local.shadow_root_host_dual
+  by blast
+end
+
+interpretation i_get_host_scope_component?: l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr
+  known_ptrs get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_shadow_root
+  get_shadow_root_locs get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
+  get_tag_name get_tag_name_locs heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
+  get_disconnected_document_locs to_tree_order get_parent get_parent_locs get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  remove_shadow_root remove_shadow_root_locs create_document DocumentClass.known_ptr DocumentClass.type_wf
+  CD.a_get_owner_document get_mode get_mode_locs get_shadow_root_safe get_shadow_root_safe_locs
+  by(auto simp add: l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsection \<open>get\_root\_node\_si\<close>
+
+lemma get_composed_root_node_not_weakly_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    ptr and root and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> get_root_node_si ptr \<rightarrow>\<^sub>r root \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_scdom_component_safe {ptr} {root} h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Closed;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e3
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e3"])
+    by code_simp+
+qed
+
+locale l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_dom_component_get_scdom_component
+begin
+
+lemma get_root_node_si_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root"
+  shows "set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or>
+set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}"
+proof -
+  have "ptr' |\<in>| object_ptr_kinds h"
+    using get_ancestors_si_ptr_in_heap assms(4)
+    by(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)
+  then
+  obtain sc where "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
+    by (meson assms(1) assms(2) assms(3) local.get_scdom_component_ok select_result_I)
+  moreover
+  have "root |\<in>| object_ptr_kinds h"
+    using get_ancestors_si_ptr assms(4)
+    apply(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)[1]
+    by (metis (no_types, lifting) assms(1) assms(2) assms(3) empty_iff empty_set
+        get_ancestors_si_ptrs_in_heap last_in_set)
+  then
+  obtain sc' where "h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc'"
+    by (meson assms(1) assms(2) assms(3) local.get_scdom_component_ok select_result_I)
+  ultimately show ?thesis
+    by (metis (no_types, hide_lams) IntE \<open>\<And>thesis. (\<And>sc'. h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc' \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
+        \<open>\<And>thesis. (\<And>sc. h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> assms(1) assms(2) assms(3) empty_subsetI
+        local.get_scdom_component_ptrs_same_scope_component returns_result_eq select_result_I2 subsetI subset_antisym)
+qed
+end
+
+interpretation i_get_scdom_component_get_root_node_si?: l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_host
+  get_host_locs get_ancestors_si get_ancestors_si_locs get_root_node_si get_root_node_si_locs get_disconnected_nodes
+  get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs get_tag_name get_tag_name_locs heap_is_wellformed
+  parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_document get_disconnected_document_locs to_tree_order
+  get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  get_owner_document get_scdom_component is_strongly_scdom_component_safe
+  by(auto simp add: l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+
+
+subsection \<open>get\_assigned\_nodes\<close>
+
+lemma assigned_nodes_not_weakly_scdom_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    node_ptr and nodes and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> assigned_nodes node_ptr \<rightarrow>\<^sub>r nodes \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_scdom_component_safe {cast node_ptr} (cast ` set nodes) h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Closed;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e3
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and node_ptr="?e3"])
+    by code_simp+
+qed
+
+lemma assigned_slot_not_weakly_component_safe:
+  obtains
+    h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
+'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
+'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
+'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
+    node_ptr and slot_opt and h' where
+    "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
+    "h \<turnstile> assigned_slot node_ptr \<rightarrow>\<^sub>r slot_opt \<rightarrow>\<^sub>h h'" and
+    "\<not> is_weakly_scdom_component_safe {cast node_ptr} (cast ` set_option slot_opt) h h'"
+proof -
+  let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
+'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
+'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
+'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
+'Shadowroot::{equal,linorder}) heap"
+  let ?P = "do {
+        document_ptr \<leftarrow> create_document;
+        html \<leftarrow> create_element document_ptr ''html'';
+        append_child (cast document_ptr) (cast html);
+        head \<leftarrow> create_element document_ptr ''head'';
+        append_child (cast html) (cast head);
+        body \<leftarrow> create_element document_ptr ''body'';
+        append_child (cast html) (cast body);
+        e1 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast body) (cast e1);
+        e2 \<leftarrow> create_element document_ptr ''div'';
+        append_child (cast e1) (cast e2);
+        s1 \<leftarrow> attach_shadow_root e1 Open;
+        e3 \<leftarrow> create_element document_ptr ''slot'';
+        append_child (cast s1) (cast e3);
+        return e2
+      }"
+  let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
+  let ?e2 = "|?h0 \<turnstile> ?P|\<^sub>r"
+
+  show thesis
+    apply(rule that[where h="?h1" and node_ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e2"])
+    by code_simp+
+qed
+
+locale l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_find_slot\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+begin
+
+lemma find_slot_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> find_slot open_flag node_ptr \<rightarrow>\<^sub>r Some slot"
+  shows "set |h \<turnstile> get_scdom_component (cast node_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component (cast slot)|\<^sub>r = {}"
+proof -
+  obtain host shadow_root_ptr to where
+    "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)" and
+    "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr" and
+    "h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to" and
+    "cast slot \<in> set to"
+    using assms(4)
+    apply(auto simp add: find_slot_def first_in_tree_order_def elim!: bind_returns_result_E2
+        map_filter_M_pure_E[where y=slot] split: option.splits if_splits list.splits
+        intro!: map_filter_M_pure bind_pure_I)[1]
+    by (metis element_ptr_casts_commute3)+
+
+  have "node_ptr |\<in>| node_ptr_kinds h"
+    using assms(4) find_slot_ptr_in_heap by blast
+  then obtain node_ptr_c where node_ptr_c: "h \<turnstile> get_scdom_component (cast node_ptr) \<rightarrow>\<^sub>r node_ptr_c"
+    using assms(1) assms(2) assms(3) get_scdom_component_ok is_OK_returns_result_E
+      node_ptr_kinds_commutes[symmetric]
+    by metis
+
+  then have "cast host \<in> set node_ptr_c"
+    using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> assms(1) assms(2) assms(3)
+    by (meson assms(4) is_OK_returns_result_E local.find_slot_ptr_in_heap local.get_dom_component_ok
+        local.get_dom_component_parent_inside local.get_dom_component_ptr
+        local.get_scdom_component_subset_get_dom_component node_ptr_kinds_commutes subsetCE)
+
+  then have "h \<turnstile> get_scdom_component (cast host) \<rightarrow>\<^sub>r node_ptr_c"
+    using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> a_heap_is_wellformed_def assms(1) assms(2)
+      assms(3) node_ptr_c
+    using local.get_scdom_component_ptrs_same_scope_component by blast
+
+  moreover have "slot |\<in>| element_ptr_kinds h"
+    using assms(4) find_slot_slot_in_heap by blast
+  then obtain slot_c where slot_c: "h \<turnstile> get_scdom_component (cast slot) \<rightarrow>\<^sub>r slot_c"
+    using a_heap_is_wellformed_def assms(1) assms(2) assms(3) get_scdom_component_ok
+      is_OK_returns_result_E node_ptr_kinds_commutes[symmetric] element_ptr_kinds_commutes[symmetric]
+    by smt
+  then have "cast shadow_root_ptr \<in> set slot_c"
+    using \<open>h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to\<close> \<open>cast slot \<in> set to\<close> assms(1) assms(2) assms(3)
+    by (meson is_OK_returns_result_E local.get_dom_component_ok local.get_dom_component_ptr
+        local.get_dom_component_to_tree_order local.get_scdom_component_subset_get_dom_component local.to_tree_order_ptrs_in_heap subsetCE)
+  then have "h \<turnstile> get_scdom_component (cast shadow_root_ptr) \<rightarrow>\<^sub>r slot_c"
+    using  \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close> assms(1) assms(2) assms(3) slot_c
+    using local.get_scdom_component_ptrs_same_scope_component by blast
+
+  ultimately show ?thesis
+    using get_shadow_root_components_disjunct assms \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close>
+      node_ptr_c slot_c
+    by (metis (no_types, lifting) select_result_I2)
+qed
+
+
+lemma assigned_nodes_is_component_unsafe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> assigned_nodes element_ptr \<rightarrow>\<^sub>r nodes"
+  assumes "node_ptr \<in> set nodes"
+  shows "set |h \<turnstile> get_scdom_component (cast element_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component (cast node_ptr)|\<^sub>r = {}"
+  using assms
+proof -
+  have "h \<turnstile> find_slot False node_ptr \<rightarrow>\<^sub>r Some element_ptr"
+    using assms(4) assms(5)
+    by(auto simp add: assigned_nodes_def elim!: bind_returns_result_E2
+        dest!: filter_M_holds_for_result[where x=node_ptr] intro!: bind_pure_I split: if_splits)
+  then show ?thesis
+    using assms find_slot_is_component_unsafe
+    by blast
+qed
+
+lemma assigned_slot_is_strongly_scdom_component_safe:
+  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
+  assumes "h \<turnstile> assigned_slot element_ptr \<rightarrow>\<^sub>r slot_opt \<rightarrow>\<^sub>h h'"
+  assumes "\<forall>shadow_root_ptr \<in> fset (shadow_root_ptr_kinds h). h \<turnstile> get_mode shadow_root_ptr \<rightarrow>\<^sub>r Closed"
+  shows "is_strongly_scdom_component_safe {cast element_ptr} (cast ` set_option slot_opt) h h'"
+proof -
+  have "h = h'"
+    using assms(4) find_slot_pure
+    by(auto simp add: assigned_slot_def returns_result_heap_def pure_returns_heap_eq find_slot_impl)
+  moreover have "slot_opt = None"
+    using assms(4) assms(5)
+    apply(auto simp add: returns_result_heap_def assigned_slot_def a_find_slot_def
+        elim!: bind_returns_result_E2 split: option.splits if_splits
+        dest!: get_shadow_root_shadow_root_ptr_in_heap[OF assms(1)])[1]
+     apply (meson finite_set_in returns_result_eq shadow_root_mode.distinct(1))
+    apply (meson finite_set_in returns_result_eq shadow_root_mode.distinct(1))
+    done
+  ultimately show ?thesis
+    by(auto simp add: is_strongly_scdom_component_safe_def preserved_def)
+qed
+end
+
+interpretation i_assigned_nodes_scope_component?: l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf get_tag_name get_tag_name_locs known_ptr get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs
+  heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs
+  get_disconnected_document get_disconnected_document_locs get_parent get_parent_locs
+  get_mode get_mode_locs get_attribute get_attribute_locs first_in_tree_order find_slot
+  assigned_slot known_ptrs to_tree_order assigned_nodes assigned_nodes_flatten flatten_dom
+  get_root_node get_root_node_locs remove insert_before insert_before_locs append_child
+  remove_shadow_root remove_shadow_root_locs set_shadow_root set_shadow_root_locs remove_child
+  remove_child_locs get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe
+  get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
+  get_owner_document set_disconnected_nodes set_disconnected_nodes_locs get_ancestors_di get_ancestors_di_locs
+  adopt_node adopt_node_locs adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M adopt_node_locs\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M set_child_nodes set_child_nodes_locs
+  get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe create_document
+  DocumentClass.known_ptr DocumentClass.type_wf CD.a_get_owner_document get_shadow_root_safe
+  get_shadow_root_safe_locs
+  by(auto simp add: l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
+declare l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
+end
diff --git a/SC_DOM_Components/document/fancytabs-normal.jpg b/SC_DOM_Components/document/fancytabs-normal.jpg
new file mode 100644
index 0000000..ffe62d6
Binary files /dev/null and b/SC_DOM_Components/document/fancytabs-normal.jpg differ
diff --git a/SC_DOM_Components/document/root.bib b/SC_DOM_Components/document/root.bib
new file mode 100644
index 0000000..710eec2
--- /dev/null
+++ b/SC_DOM_Components/document/root.bib
@@ -0,0 +1,747 @@
+@STRING{j-fac   = "Formal Aspects of Computing" }
+@STRING{pub-springer={Springer-Verlag} }
+@STRING{pub-springer:adr={Heidelberg} }
+@STRING{s-lncs	= "Lecture Notes in Computer Science" }
+
+@Book{		  nipkow.ea:isabelle:2002,
+  author	= {Tobias Nipkow and Lawrence C. Paulson and Markus Wenzel},
+  title		= {Isabelle/HOL---A Proof Assistant for Higher-Order Logic},
+  publisher	= pub-springer,
+  address	= pub-springer:adr,
+  series	= s-lncs,
+  volume	= 2283,
+  doi		= {10.1007/3-540-45949-9},
+  abstract	= {This book is a self-contained introduction to interactive
+		  proof in higher-order logic (HOL), using the proof
+		  assistant Isabelle2002. It is a tutorial for potential
+		  users rather than a monograph for researchers. The book has
+		  three parts.
+		  
+		  1. Elementary Techniques shows how to model functional
+		  programs in higher-order logic. Early examples involve
+		  lists and the natural numbers. Most proofs are two steps
+		  long, consisting of induction on a chosen variable followed
+		  by the auto tactic. But even this elementary part covers
+		  such advanced topics as nested and mutual recursion. 2.
+		  Logic and Sets presents a collection of lower-level tactics
+		  that you can use to apply rules selectively. It also
+		  describes Isabelle/HOL's treatment of sets, functions and
+		  relations and explains how to define sets inductively. One
+		  of the examples concerns the theory of model checking, and
+		  another is drawn from a classic textbook on formal
+		  languages. 3. Advanced Material describes a variety of
+		  other topics. Among these are the real numbers, records and
+		  overloading. Advanced techniques are described involving
+		  induction and recursion. A whole chapter is devoted to an
+		  extended example: the verification of a security protocol.
+		  },
+  year		= 2002,
+  acknowledgement={brucker, 2007-02-19},
+  bibkey	= {nipkow.ea:isabelle:2002}
+}
+
+@Misc{		  dom-specification,
+  year		= 2016,
+  month		= {DOM Living Standard -- Last Updated 20 October 2016},
+  day		= 20,
+  url		= {https://dom.spec.whatwg.org/},
+  organization	= {Web Hypertext Application Technology Working Group
+		  (WHATWG)},
+  note		= {An archived copy of the version from 20 October 2016 is
+		  available at
+		  \url{https://git.logicalhacking.com/BrowserSecurity/fDOM-idl/}.}
+}
+
+@InProceedings{	  brucker.ea:core-dom:2018,
+  author	= {Achim D. Brucker and Michael Herzberg},
+  title		= {A Formal Semantics of the Core {DOM} in {Isabelle/HOL}},
+  booktitle	= {Proceedings of the Web Programming, Design, Analysis, And
+		  Implementation (WPDAI) track at WWW 2018},
+  location	= {Lyon, France},
+  url		= {https://www.brucker.ch/bibliography/abstract/brucker.ea-fdom-2018},
+  year		= {2018},
+  abstract	= {At its core, the Document Object Model (DOM) defines a
+		  tree-like data structure for representing documents in
+		  general and HTML documents in particular. It forms the
+		  heart of any rendering engine of modern web browsers.
+		  Formalizing the key concepts of the DOM is a pre-requisite
+		  for the formal reasoning over client-side JavaScript
+		  programs as well as for the analysis of security concepts
+		  in modern web browsers. In this paper, we present a
+		  formalization of the core DOM, with focus on the node-tree
+		  and the operations defined on node-trees, in Isabelle/HOL.
+		  We use the formalization to verify the functional
+		  correctness of the most important functions defined in the
+		  DOM standard. Moreover, our formalization is (1)
+		  extensible, i.e., can be extended without the need of
+		  re-proving already proven properties and (2) executable,
+		  i.e., we can generate executable code from our
+		  specification. },
+  keywords	= {Document Object Model, DOM, Formal Semantics,
+		  Isabelle/HOL},
+  classification= {conference},
+  areas		= {formal methods, software},
+  public	= {yes}
+}
+@Article{         klein:operating:2009,
+  author        = {Gerwin Klein},
+  title         = {Operating System Verification --- An Overview},
+  journal       = {S\={a}dhan\={a}},
+  publisher     = pub-springer,
+  year          = 2009,
+  volume        = 34,
+  number        = 1,
+  month         = feb,
+  pages         = {27--69},
+  abstract      = {This paper gives a high-level introduction to the topic of
+                  formal, interactive, machine-checked software verification
+                  in general, and the verification of operating systems code
+                  in particular. We survey the state of the art, the
+                  advantages and limitations of machine-checked code proofs,
+                  and describe two specific ongoing larger-scale verification
+                  projects in more detail.}
+}
+
+
+@InProceedings{   gardner.ea:securing:2009,
+  author        = {Ryan W. Gardner and Sujata Garera and Matthew W. Pagano
+                  and Matthew Green and Aviel D. Rubin},
+  title         = {Securing medical records on smart phones},
+  booktitle     = {ACM workshop on Security and privacy in medical and
+                  home-care systems (SPIMACS)},
+  year          = 2009,
+  isbn          = {978-1-60558-790-5},
+  pages         = {31--40},
+  location      = {Chicago, Illinois, USA},
+  doi           = {10.1145/1655084.1655090},
+  address       = pub-acm:adr,
+  publisher     = pub-acm,
+  abstract      = {There is an inherent conflict between the desire to
+                  maintain privacy of one's medical records and the need to
+                  make those records available during an emergency. To
+                  satisfy both objectives, we introduce a flexible
+                  architecture for the secure storage of medical records on
+                  smart phones. In our system, a person can view her records
+                  at any time, and emergency medical personnel can view the
+                  records as long as the person is present (even if she is
+                  unconscious). Our solution allows for efficient revocation
+                  of access rights and is robust against adversaries who can
+                  access the phone's storage offline.}
+}
+
+@InProceedings{   raad.ea:dom:2016,
+  author        = {Azalea Raad and Jos{\'{e}} Fragoso Santos and Philippa
+                  Gardner},
+  title         = {{DOM:} Specification and Client Reasoning},
+  booktitle     = {Programming Languages and Systems - 14th Asian Symposium,
+                  {APLAS} 2016, Hanoi, Vietnam, November 21-23, 2016,
+                  Proceedings},
+  pages         = {401--422},
+  year          = 2016,
+  crossref      = {igarashi:programming:2016},
+  doi           = {10.1007/978-3-319-47958-3_21},
+  abstract      = {We present an axiomatic specification of a key fragment of
+                  DOM using structural separation logic. This specification
+                  allows us to develop modular reasoning about client
+                  programs that call the DOM.}
+}
+
+
+@InProceedings{   bohannon.ea:featherweight:2010,
+  author        = {Aaron Bohannon and Benjamin C. Pierce},
+  title         = {Featherweight {F}irefox: {F}ormalizing the Core of a Web
+                  Browser},
+  booktitle     = {Usenix Conference on Web Application Development
+                  (WebApps)},
+  year          = 2010,
+  month         = jun,
+  url           = {http://www.cis.upenn.edu/~bohannon/browser-model/},
+  abstract      = {We offer a formal specification of the core functionality
+                  of a web browser in the form of a small-step operational
+                  semantics. The specification accurately models the asyn-
+                  chronous nature of web browsers and covers the basic as-
+                  pects of windows, DOM trees, cookies, HTTP requests and
+                  responses, user input, and a minimal scripting lan- guage
+                  with first-class functions, dynamic evaluation, and AJAX
+                  requests. No security enforcement mechanisms are
+                  included{\^a}instead, the model is intended to serve as a
+                  basis for formalizing and experimenting with different
+                  security policies and mechanisms. We survey the most
+                  interesting design choices and discuss how our model re-
+                  lates to real web browsers.}
+}
+
+@Proceedings{     joyce.ea:higher:1994,
+  editor        = {Jeffrey J. Joyce and Carl-Johan H. Seger},
+  title         = {Higher Order Logic Theorem Proving and Its Applications
+                  (HUG)},
+  booktitle     = {Higher Order Logic Theorem Proving and Its Applications
+                  (HUG)},
+  publisher     = pub-springer,
+  address       = pub-springer:adr,
+  series        = s-lncs,
+  abstract      = {Theorem proving based techniques for formal hardware
+                  verification have been evolving constantly and researchers
+                  are getting able to reason about more complex issues than
+                  it was possible or practically feasible in the past. It is
+                  often the case that a model of a system is built in a
+                  formal logic and then reasoning about this model is carried
+                  out in the logic. Concern is growing on how to consistently
+                  interface a model built in a formal logic with an informal
+                  CAD environment. Researchers have been investigating how to
+                  define the formal semantics of hardware description
+                  languages so that one can formally reason about models
+                  informally dealt with in a CAD environment. At the
+                  University of Cambridge, the embedding of hardware
+                  description languages in a logic is classified in two
+                  categories: deep embedding and shallow embedding. In this
+                  paper we argue that there are degrees of formality in
+                  shallow embedding a language in a logic. The choice of the
+                  degree of formality is a trade-off between the security of
+                  the embedding and the amount and complexity of the proof
+                  effort in the logic. We also argue that the design of a
+                  language could consider this verifiability issue. There are
+                  choices in the design of a language that can make it easier
+                  to improve the degree of formality, without implying
+                  serious drawbacks for the CAD environment.},
+  volume        = 780,
+  year          = 1994,
+  doi           = {10.1007/3-540-57826-9},
+  isbn          = {3-540-57826-9},
+  acknowledgement={brucker, 2007-02-19}
+}
+
+
+@Misc{ whatwg:dom:2017,
+  key={whatwg},
+  author={{WHATWG}},
+  url={https://dom.spec.whatwg.org/commit-snapshots/6253e53af2fbfaa6d25ad09fd54280d8083b2a97/},
+  month=mar,
+  year=2017,
+  day=24,
+  title={{DOM} -- Living Standard},
+  note={Last Updated 24 {March} 2017},
+  institution =  {WHATWG},
+}
+
+@Misc{ whatwg:html:2017,
+  key={whatwg},
+  author={{WHATWG}},
+  url={https://html.spec.whatwg.org/},
+  month=apr,
+  year=2017,
+  day=13,
+  title={{HTML} -- Living Standard},
+  note={Last Updated 13 {April} 2017},
+  institution =  {WHATWG},
+}
+
+
+@Misc{ w3c:dom:2015,
+  key={w3c},
+  author={{W3C}},
+  url={https://www.w3.org/TR/dom/},
+  month=nov,
+  year=2015,
+  day=19,
+  title={{W3C} {DOM4}},
+  institution =  {W3C},
+}
+
+
+@Proceedings{     igarashi:programming:2016,
+  editor        = {Atsushi Igarashi},
+  title         = {Programming Languages and Systems - 14th Asian Symposium,
+                  {APLAS} 2016, Hanoi, Vietnam, November 21-23, 2016,
+                  Proceedings},
+  series        = {Lecture Notes in Computer Science},
+  volume        = 10017,
+  year          = 2016,
+  doi           = {10.1007/978-3-319-47958-3},
+  isbn          = {978-3-319-47957-6}
+}
+
+
+
+
+
+
+@InProceedings{   gardner.ea:dom:2008,
+  author        = {Philippa Gardner and Gareth Smith and Mark J. Wheelhouse
+                  and Uri Zarfaty},
+  title         = {{DOM:} Towards a Formal Specification},
+  booktitle     = {{PLAN-X} 2008, Programming Language Technologies for XML,
+                  An {ACM} {SIGPLAN} Workshop colocated with {POPL} 2008, San
+                  Francisco, California, USA, January 9, 2008},
+  year          = 2008,
+  crossref      = {plan-x:2008},
+  url           = {http://gemo.futurs.inria.fr/events/PLANX2008/papers/p18.pdf},
+  abstract      = {The W3C Document Object Model (DOM) specifies an XML up-
+                  date library. DOM is written in English, and is therefore
+                  not compo- sitional and not complete. We provide a first
+                  step towards a compo- sitional specification of DOM. Unlike
+                  DOM, we are able to work with a minimal set of commands and
+                  obtain a complete reason- ing for straight-line code. Our
+                  work transfers O{\^a}Hearn, Reynolds and Yang{\^a}s
+                  local Hoare reasoning for analysing heaps to XML, viewing
+                  XML as an in-place memory store as does DOM. In par-
+                  ticular, we apply recent work by Calcagno, Gardner and
+                  Zarfaty on local Hoare reasoning about a simple tree-update
+                  language to DOM, showing that our reasoning scales to DOM.
+                  Our reasoning not only formally specifies a significant
+                  subset of DOM Core Level 1, but can also be used to verify
+                  e.g. invariant properties of simple Javascript programs.}
+}
+
+
+
+@InProceedings{   jang.ea:establishing:2012,
+  author        = {Dongseok Jang and Zachary Tatlock and Sorin Lerner},
+  title         = {Establishing Browser Security Guarantees through Formal
+                  Shim Verification},
+  booktitle     = {Proceedings of the 21th {USENIX} Security Symposium,
+                  Bellevue, WA, USA, August 8-10, 2012},
+  pages         = {113--128},
+  year          = 2012,
+  crossref      = {kohno:proceedings:2012},
+  url           = {https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/jang},
+  abstract      = { Web browsers mediate access to valuable private data in
+                  domains ranging from health care to banking. Despite this
+                  critical role, attackers routinely exploit browser
+                  vulnerabilities to exfiltrate private data and take over
+                  the un- derlying system. We present Q UARK , a browser
+                  whose kernel has been implemented and verified in Coq. We
+                  give a specification of our kernel, show that the
+                  implementation satisfies the specification, and finally
+                  show that the specification implies several security
+                  properties, including tab non-interference, cookie
+                  integrity and confidentiality, and address bar integrity.
+                  }
+}
+
+@Proceedings{     kohno:proceedings:2012,
+  editor        = {Tadayoshi Kohno},
+  title         = {Proceedings of the 21th {USENIX} Security Symposium,
+                  Bellevue, WA, USA, August 8-10, 2012},
+  publisher     = {{USENIX} Association},
+  year          = 2012,
+  timestamp     = {Thu, 15 May 2014 09:12:27 +0200}
+}
+
+
+
+@Proceedings{     plan-x:2008,
+  title         = {{PLAN-X} 2008, Programming Language Technologies for XML,
+                  An {ACM} {SIGPLAN} Workshop colocated with {POPL} 2008, San
+                  Francisco, California, USA, January 9, 2008},
+  year          = 2008,
+  timestamp     = {Fri, 18 Jan 2008 13:01:04 +0100}
+}
+
+
+@Article{ brucker.ea:extensible:2008-b,
+	abstract	= 	{We present an extensible encoding of object-oriented data models into HOL. Our encoding is supported by a datatype package that leverages the use of the shallow embedding technique to object-oriented specification and programming languages. The package incrementally compiles an object-oriented data model, i.e., a class model, to a theory containing object-universes, constructors, accessor functions, coercions (casts) between dynamic and static types, characteristic sets, and co-inductive class invariants. The package is conservative, i.e., all properties are derived entirely from constant definitions, including the constraints over object structures. As an application, we use the package for an object-oriented core-language called IMP++, for which we formally prove the correctness of a Hoare-Logic with respect to a denotational semantics.},
+	address	= 	{Heidelberg},
+	author	= 	{Achim D. Brucker and Burkhart Wolff},
+	doi	= 	{10.1007/s10817-008-9108-3},
+	issn	= 	{0168-7433},
+	issue	= 	{3},
+	journal	= 	{Journal of Automated Reasoning},
+	keywords	= 	{object-oriented data models, HOL, theorem proving, verification},
+	language	= 	{USenglish},
+	pages	= 	{219--249},
+	pdf	= 	{https://www.brucker.ch/bibliography/download/2008/brucker.ea-extensible-2008-b.pdf},
+	publisher	= 	{Springer-Verlag},
+	title	= 	{An Extensible Encoding of Object-oriented Data Models in HOL},
+	url	= 	{https://www.brucker.ch/bibliography/abstract/brucker.ea-extensible-2008-b},
+	volume	= 	{41},
+	year	= 	{2008},
+} 
+
+@PhDThesis{ brucker:interactive:2007,
+	abstract	= 	{We present a semantic framework for object-oriented specification languages. We develop this framework as a conservative shallow embedding in Isabelle/HOL. Using only conservative extensions guarantees by construction the consistency of our formalization. Moreover, we show how our framework can be used to build an interactive proof environment, called HOL-OCL, for object-oriented specifications in general and for UML/OCL in particular.\\\\Our main contributions are an extensible encoding of object-oriented data structures in HOL, a datatype package for object-oriented specifications, and the development of several equational and tableaux calculi for object-oriented specifications. Further, we show that our formal framework can be the basis of a formal machine-checked semantics for OCL that is compliant to the OCL 2.0 standard.},
+	abstract_de	= 	{In dieser Arbeit wird ein semantisches Rahmenwerk f{\"u}r objektorientierte Spezifikationen vorgestellt. Das Rahmenwerk ist als konservative, flache Einbettung in Isabelle/HOL realisiert. Durch die Beschr{\"a}nkung auf konservative Erweiterungen kann die logische Konsistenz der Einbettung garantiert werden. Das semantische Rahmenwerk wird verwendet, um das interaktives Beweissystem HOL-OCL f{\"u}r objektorientierte Spezifikationen im Allgemeinen und insbesondere f{\"u}r UML/OCL zu entwickeln.\\\\Die Hauptbeitr{\"a}ge dieser Arbeit sind die Entwicklung einer erweiterbaren Kodierung objektorientierter Datenstrukturen in HOL, ein Datentyp-Paket f{\"u}r objektorientierte Spezifikationen und die Entwicklung verschiedener Kalk{\"u}le f{\"u}r objektorientierte Spezifikationen. Zudem zeigen wir, wie das formale Rahmenwerk verwendet werden kann, um eine formale, maschinell gepr{\"u}fte Semantik f{\"u}r OCL anzugeben, die konform zum Standard f{\"u}r OCL 2.0 ist.},
+	author	= 	{Achim D. Brucker},
+	keywords	= 	{OCL, UML, formal semantics, theorem proving, Isabelle, HOL-OCL},
+	month	= 	{mar},
+	note	= 	{ETH Dissertation No. 17097.},
+	pdf	= 	{https://www.brucker.ch/bibliography/download/2007/brucker-interactive-2007.pdf},
+	school	= 	{ETH Zurich},
+	title	= 	{An Interactive Proof Environment for Object-oriented Specifications},
+	url	= 	{https://www.brucker.ch/bibliography/abstract/brucker-interactive-2007},
+	year	= 	{2007},
+} 
+
+@InCollection{    brucker.ea:standard-compliance-testing:2018,
+  talk          = {talk:brucker.ea:standard-compliance-testing:2018},
+  abstract      = {Most popular technologies are based on informal or
+                  semiformal standards that lack a rigid formal semantics.
+                  Typical examples include web technologies such as the DOM
+                  or HTML, which are defined by the Web Hypertext Application
+                  Technology Working Group (WHATWG) and the World Wide Web
+                  Consortium (W3C). While there might be API specifications
+                  and test cases meant to assert the compliance of a certain
+                  implementation, the actual standard is rarely accompanied
+                  by a formal model that would lend itself for, e.g.,
+                  verifying the security or safety properties of real
+                  systems.
+
+                  Even when such a formalization of a standard exists, two
+                  important questions arise: first, to what extend does the
+                  formal model comply to the standard and, second, to what
+                  extend does the implementation comply to the formal model
+                  and the assumptions made during the verification? In this
+                  paper, we present an approach that brings all three
+                  involved artifacts - the (semi-)formal standard, the
+                  formalization of the standard, and the implementations -
+                  closer together by combining verification, symbolic
+                  execution, and specification based testing.},
+  keywords      = {standard compliance, compliance tests, DOM},
+  location      = {Toulouse, France},
+  author        = {Achim D. Brucker and Michael Herzberg},
+  booktitle     = {{TAP} 2018: Tests And Proofs},
+  language      = {USenglish},
+  publisher     = pub-springer,
+  address       = pub-springer:adr,
+  series        = s-lncs,
+  number        = 10889,
+  editor        = {Cathrine Dubois and Burkhart Wolff},
+  title         = {Formalizing (Web) Standards: An Application of Test and
+                  Proof},
+  categories    = {holtestgen, websecurity},
+  classification= {conference},
+  areas         = {formal methods, software engineering},
+  public        = {yes},
+  year          = 2018,
+  doi           = {10.1007/978-3-319-92994-1_9},
+  pages         = {159--166},
+  isbn          = {978-3-642-38915-3},
+  pdf           = {http://www.brucker.ch/bibliography/download/2018/brucker.ea-standard-compliance-testing-2018.pdf},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-standard-compliance-testing-2018}
+}
+
+
+@InCollection{    brucker.ea:interactive:2005,
+  keywords      = {symbolic test case generations, black box testing, white
+                  box testing, theorem proving, interactive testing},
+  abstract      = {HOL-TestGen is a test environment for specification-based
+                  unit testing build upon the proof assistant Isabelle/HOL\@.
+                  While there is considerable skepticism with regard to
+                  interactive theorem provers in testing communities, we
+                  argue that they are a natural choice for (automated)
+                  symbolic computations underlying systematic tests. This
+                  holds in particular for the development on non-trivial
+                  formal test plans of complex software, where some parts of
+                  the overall activity require inherently guidance by a test
+                  engineer. In this paper, we present the underlying methods
+                  for both black box and white box testing in interactive
+                  unit test scenarios. HOL-TestGen can also be understood as
+                  a unifying technical and conceptual framework for
+                  presenting and investigating the variety of unit test
+                  techniques in a logically consistent way. },
+  location      = {Edinburgh},
+  author        = {Achim D. Brucker and Burkhart Wolff},
+  booktitle     = {Formal Approaches to Testing of Software},
+  language      = {USenglish},
+  publisher     = pub-springer,
+  address       = pub-springer:adr,
+  series        = s-lncs,
+  number        = 3997,
+  doi           = {10.1007/11759744_7},
+  isbn          = {3-540-25109-X},
+  editor        = {Wolfgang Grieskamp and Carsten Weise},
+  pdf           = {http://www.brucker.ch/bibliography/download/2005/brucker.ea-interactive-2005.pdf},
+  project       = {CSFMDOS},
+  title         = {Interactive Testing using {HOL}-{TestGen}},
+  classification= {workshop},
+  areas         = {formal methods, software},
+  categories    = {holtestgen},
+  year          = 2005,
+  public        = {yes},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-interactive-2005}
+}
+
+
+@Article{         brucker.ea:theorem-prover:2012,
+  author        = {Achim D. Brucker and Burkhart Wolff},
+  journal       = j-fac,
+  publisher     = pub-springer,
+  address       = pub-springer:adr,
+  language      = {USenglish},
+  categories    = {holtestgen},
+  title         = {On Theorem Prover-based Testing},
+  year          = 2013,
+  issn          = {0934-5043},
+  pages         = {683--721},
+  volume        = 25,
+  number        = 5,
+  classification= {journal},
+  areas         = {formal methods, software},
+  public        = {yes},
+  doi           = {10.1007/s00165-012-0222-y},
+  keywords      = {test case generation, domain partitioning, test sequence,
+                  theorem proving, HOL-TestGen},
+  abstract      = {HOL-TestGen is a specification and test case generation
+                  environment extending the interactive theorem prover
+                  Isabelle/HOL. As such, HOL-TestGen allows for an integrated
+                  workflow supporting interactive theorem proving, test case
+                  generation, and test data generation.
+
+                  The HOL-TestGen method is two-staged: first, the original
+                  formula is partitioned into test cases by transformation
+                  into a normal form called test theorem. Second, the test
+                  cases are analyzed for ground instances (the test data)
+                  satisfying the constraints of the test cases. Particular
+                  emphasis is put on the control of explicit test-hypotheses
+                  which can be proven over concrete programs.
+
+                  Due to the generality of the underlying framework, our
+                  system can be used for black-box unit, sequence, reactive
+                  sequence and white-box test scenarios. Although based on
+                  particularly clean theoretical foundations, the system can
+                  be applied for substantial case-studies. },
+  pdf           = {http://www.brucker.ch/bibliography/download/2012/brucker.ea-theorem-prover-2012.pdf},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-theorem-prover-2012}
+}
+
+
+@Article{ brucker.ea:afp-core-dom:2018,
+	abstract	= 	{In this AFP entry, we formalize the core of the Document Object Model (DOM). At its core, the DOM defines a tree-like data structure for representing documents in general and HTML documents in particular. It is the heart of any modern web browser. Formalizing the key concepts of the DOM is a prerequisite for the formal reasoning over client-side JavaScript programs and for the analysis of security concepts in modern web browsers. We present a formalization of the core DOM, with focus on the node-tree and the operations defined on node-trees, in Isabelle/HOL. We use the formalization to verify the functional correctness of the most important functions defined in the DOM standard. Moreover, our formalization is 1) extensible, i.e., can be extended without the need of re-proving already proven properties and 2) executable, i.e., we can generate executable code from our specification.},
+	author	= 	{Achim D. Brucker and Michael Herzberg},
+	date	= 	{2018-12-26},
+	file	= 	{https://www.brucker.ch/bibliography/download/2018/brucker.ea-afp-core-dom-outline-2018.pdf},
+	filelabel	= 	{Outline},
+	issn	= 	{2150-914x},
+	journal	= 	{Archive of Formal Proofs},
+	month	= 	{dec},
+	note	= 	{\url{http://www.isa-afp.org/entries/Core_DOM.html}, Formal proof development},
+	pdf	= 	{https://www.brucker.ch/bibliography/download/2018/brucker.ea-afp-core-dom-2018.pdf},
+	title	= 	{The Core {DOM}},
+	url	= 	{https://www.brucker.ch/bibliography/abstract/brucker.ea-afp-core-dom-2018-a},
+	year	= 	{2018},
+} 
+
+@Misc{            whatwg:dom:2019,
+  key           = {whatwg},
+  author        = {{WHATWG}},
+  url           = {https://dom.spec.whatwg.org/commit-snapshots/7fa83673430f767d329406d0aed901f296332216/},
+  month         = feb,
+  year          = 2019,
+  day           = 11,
+  title         = {{DOM} -- Living Standard},
+  note          = {Last Updated 11 {February} 2019},
+  institution   = {WHATWG}
+}
+
+@Misc{            bidelman:self-contained:2017,
+  author        = {Eric Bidelman},
+  title         = {Shadow DOM v1: Self-Contained Web Components},
+  month         = may,
+  day           = 12,
+  year          = 2017,
+  url           = {https://developers.google.com/web/fundamentals/getting-started/primers/shadowdom}
+}
+
+
+
+@Article{         brucker.ea:afp-shadow-sc-dom:2020,
+  author        = {Achim D. Brucker and Michael Herzberg},
+  title         = {Shadow SC DOM: A Formal Model of the Safelty Composable Document Object Model with Shadow Roots},
+  journal       = {Archive of Formal Proofs},
+  month         = sep,
+  year          = 2020,
+  date          = {2020-09-28},
+  note          = {\url{http://www.isa-afp.org/entries/Shadow_SC_DOM.html}, Formal proof development},
+  issn          = {2150-914x},
+  abstract      = { In this AFP entry, we extend our formalization of the safely composable DOM with \emph{Shadow
+                  Roots}. Shadow roots are a recent proposal of the web community to support a component-based
+                  development approach for client-side web applications.
+
+                  Shadow roots are a significant extension to the DOM standard and, as web standards are condemned to be
+                  backward compatible, such extensions often result in complex specification that may contain unwanted
+                  subtleties that can be detected by a formalization.
+
+                  Our Isabelle/HOL formalization is, in the sense of object-orientation, an extension of our
+                  formalization of the core DOM and enjoys the same basic properties, i.e., it is extensible, i.e., can
+                  be extended without the need of re-proving already proven properties and executable, i.e., we can
+                  generate executable code from our specification. We exploit the executability to show that our
+                  formalization complies to the official standard of the W3C, respectively, the WHATWG. },
+  public        = {yes},
+  classification= {formal},
+  categories    = {websecurity},
+  pdf           = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-shadow-sc-dom-2020.pdf},
+  filelabel     = {Outline},
+  file          = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-shadow-sc-dom-outline-2020.pdf},
+  areas         = {formal methods, security, software engineering},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-afp-shadow-sc-dom-2020}
+}
+
+@Article{         brucker.ea:afp-dom-components:2020,
+  author        = {Achim D. Brucker and Michael Herzberg},
+  title         = {A Formalization of Web Components},
+  journal       = {Archive of Formal Proofs},
+  month         = sep,
+  year          = 2020,
+  date          = {2020-09-28},
+  note          = {\url{http://www.isa-afp.org/entries/DOM_Components.html}, Formal proof development},
+  issn          = {2150-914x},
+  public        = {yes},
+  classification= {formal},
+  categories    = {websecurity},
+  pdf           = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-dom-components-2020.pdf},
+  filelabel     = {Outline},
+  file          = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-dom-components-outline-2020.pdf},
+  areas         = {formal methods, security, software engineering},
+  abstract      = { While the DOM with shadow trees provide the technical basis for defining web components, the DOM
+                  standard neither defines the concept of web components nor specifies the safety properties that web
+                  components should guarantee. Consequently, the standard also does not discuss how or even if the
+                  methods for modifying the DOM respect component boundaries.
+
+                  In AFP entry, we present a formally verified model of web components and define safety properties
+                  which ensure that different web components can only interact with each other using well-defined
+                  interfaces. Moreover, our verification of the application programming interface (API) of the DOM
+                  revealed numerous invariants that implementations of the DOM API need to preserve to ensure the
+                  integrity of components. },
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-afp-dom-components-2020}
+}
+
+@Article{         brucker.ea:afp-sc-dom-components:2020,
+  author        = {Achim D. Brucker and Michael Herzberg},
+  title         = {A Formalization of Safely Composable Web Components},
+  journal       = {Archive of Formal Proofs},
+  month         = sep,
+  year          = 2020,
+  date          = {2020-09-28},
+  note          = {\url{http://www.isa-afp.org/entries/SC_DOM_Components.html}, Formal proof development},
+  issn          = {2150-914x},
+  public        = {yes},
+  classification= {formal},
+  categories    = {websecurity},
+  pdf           = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-sc-dom-components-2020.pdf},
+  filelabel     = {Outline},
+  file          = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-sc-dom-components-outline-2020.pdf},
+  areas         = {formal methods, security, software engineering},
+  abstract      = { While the (safely composable) DOM with shadow trees provide the technical basis for defining web
+                  components, it does neither defines the concept of web components nor specifies the safety properties
+                  that web components should guarantee. Consequently, the standard also does not discuss how or even if
+                  the methods for modifying the DOM respect component boundaries. In AFP entry, we present a formally
+                  verified model of safely composable web components and define safety properties which ensure that
+                  different web components can only interact with each other using well-defined interfaces. Moreover,
+                  our verification of the application programming interface (API) of the DOM revealed numerous
+                  invariants that implementations of the DOM API need to preserve to ensure the integrity of components.
+                  },
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-afp-sc-dom-components-2020}
+}
+                      
+
+
+@Article{         brucker.ea:afp-core-sc-dom:2020,
+  author        = {Achim D. Brucker and Michael Herzberg},
+  title         = {The Safely Composable {DOM}},
+  journal       = {Archive of Formal Proofs},
+  month         = sep,
+  year          = 2020,
+  date          = {2020-09-28},
+  note          = {\url{http://www.isa-afp.org/entries/Core_SC_DOM.html}, Formal proof development},
+  issn          = {2150-914x},
+  abstract      = { In this AFP entry, we formalize the core of the Safely Composable Document Object Model (SC DOM).
+                  The SC DOM improve the standard DOM by strengthening the tree boundaries set by shadow roots: in the
+                  SC DOM, the shadow root is a sub-class of the document class (instead of a base class).
+
+                  This modifications also results in changes to some API methods (e.g., getOwnerDocument) to return the
+                  nearest shadow root rather than the document root. As a result, many API methods that, when called on
+                  a node inside a shadow tree, would previously ``break out'' and return or modify nodes that are
+                  possibly outside the shadow tree, now stay within its boundaries. This change in behavior makes
+                  programs that operate on shadow trees more predictable for the developer and allows them to make more
+                  assumptions about other code accessing the DOM. },
+  public        = {yes},
+  classification= {formal},
+  categories    = {websecurity},
+  pdf           = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-core-sc-dom-2020.pdf},
+  filelabel     = {Outline},
+  file          = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-core-sc-dom-outline-2020.pdf},
+  areas         = {formal methods, security, software engineering},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-afp-core-sc-dom-2020}
+}
+
+@Article{         brucker.ea:afp-shadow-dom:2020,
+  author        = {Achim D. Brucker and Michael Herzberg},
+  title         = {Shadow DOM: A Formal Model of the Document Object Model with Shadow Roots},
+  journal       = {Archive of Formal Proofs},
+  month         = sep,
+  year          = 2020,
+  date          = {2020-09-28},
+  note          = {\url{http://www.isa-afp.org/entries/Shadow_DOM.html}, Formal proof development},
+  issn          = {2150-914x},
+  abstract      = { In this AFP entry, we extend our formalization of the core DOM with \emph{Shadow Roots}. Shadow
+                  roots are a recent proposal of the web community to support a component-based development approach for
+                  client-side web applications.
+
+                  Shadow roots are a significant extension to the DOM standard and, as web standards are condemned to be
+                  backward compatible, such extensions often result in complex specification that may contain unwanted
+                  subtleties that can be detected by a formalization.
+
+                  Our Isabelle/HOL formalization is, in the sense of object-orientation, an extension of our
+                  formalization of the core DOM and enjoys the same basic properties, i.e., it is extensible, i.e., can
+                  be extended without the need of re-proving already proven properties and executable, i.e., we can
+                  generate executable code from our specification. We exploit the executability to show that our
+                  formalization complies to the official standard of the W3C, respectively, the WHATWG. },
+  public        = {yes},
+  classification= {formal},
+  categories    = {websecurity},
+  pdf           = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-shadow-dom-2020.pdf},
+  filelabel     = {Outline},
+  file          = {http://www.brucker.ch/bibliography/download/2020/brucker.ea-afp-shadow-dom-outline-2020.pdf},
+  areas         = {formal methods, security, software engineering},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-afp-shadow-dom-2020}
+}
+
+
+
+
+@InCollection{    brucker.ea:web-components:2019,
+  abstract      = {The trend towards ever more complex client-side web applications is unstoppable. Compared to
+                  traditional software development, client-side web development lacks a well-established component
+                  model, i.e., a method for easily and safely reusing already developed functionality. To address this
+                  issue, the web community started to adopt shadow trees as part of the Document Object Model (DOM):
+                  shadow trees allow developers to "partition" a DOM instance into parts that should be safely
+                  separated, e.g., code modifying one part should not, unintentionally, affect other parts of the DOM.
+
+                  While shadow trees provide the technical basis for defining web components, the DOM standard neither
+                  defines the concept of web components nor specifies the safety properties that web components should
+                  guarantee. Consequently, the standard also does not discuss how or even if the methods for modifying
+                  the DOM respect component boundaries. In this paper, we present a formally verified model of web
+                  components and define safety properties which ensure that different web components can only interact
+                  with each other using well-defined interfaces. Moreover, our verification of the application
+                  programming interface (API) of the DOM revealed numerous invariants that implementations of the DOM
+                  API need to preserve to ensure the integrity of components.},
+  keywords      = {Web Component, Shadow Tree, DOM, Isabelle/HOL},
+  location      = {Amsterdam, The Netherlands},
+  author        = {Achim D. Brucker and Michael Herzberg},
+  booktitle     = {Formal Aspects of Component Software (FACS)},
+  language      = {USenglish},
+  publisher     = pub-springer,
+  address       = pub-springer:adr,
+  series        = s-lncs,
+  number        = 12018,
+  isbn          = {3-540-25109-X},
+  doi           = {10.1007/978-3-030-40914-2_3},
+  editor        = {Sung-Shik Jongmans and Farhad Arbab},
+  pdf           = {http://www.brucker.ch/bibliography/download/2019/brucker.ea-web-components-2019.pdf},
+  title         = {A Formally Verified Model of Web Components},
+  classification= {conference},
+  areas         = {formal methods, software},
+  year          = 2020,
+  public        = {yes},
+  url           = {http://www.brucker.ch/bibliography/abstract/brucker.ea-web-components-2019}
+}
+
+
+
+@PhdThesis{herzberg:web-components:2020,
+  author =       {Michael Herzberg},
+  title =        {Formal Foundations for Provably Safe Web Components},
+  school =       {The University of Sheffield},
+  year =         {2020}
+}
+
diff --git a/SC_DOM_Components/document/root.tex b/SC_DOM_Components/document/root.tex
new file mode 100644
index 0000000..ea93ab9
--- /dev/null
+++ b/SC_DOM_Components/document/root.tex
@@ -0,0 +1,255 @@
+\documentclass[10pt,DIV16,a4paper,abstract=true,twoside=semi,openright]
+{scrreprt}
+\usepackage[USenglish]{babel}
+\usepackage[numbers, sort&compress]{natbib}
+\usepackage{isabelle,isabellesym}
+\usepackage{booktabs}
+\usepackage{paralist}
+\usepackage{graphicx}
+\usepackage{amssymb}
+\usepackage{xspace}
+\usepackage{xcolor}
+\usepackage{listings}
+\lstloadlanguages{HTML}
+\usepackage[]{mathtools}
+\usepackage[pdfpagelabels, pageanchor=false, plainpages=false]{hyperref}
+\lstdefinestyle{html}{language=XML,
+  basicstyle=\ttfamily,
+  commentstyle=\itshape,
+  keywordstyle=\color{blue},
+  ndkeywordstyle=\color{blue},
+}
+\lstdefinestyle{displayhtml}{style=html,
+  floatplacement={tbp},
+  captionpos=b,
+  framexleftmargin=0pt,
+  basicstyle=\ttfamily\scriptsize,
+  backgroundcolor=\color{black!2},
+  frame=lines,
+}
+\lstnewenvironment{html}[1][]{\lstset{style=displayhtml, #1}}{}
+\def\inlinehtml{\lstinline[style=html, columns=fullflexible]}
+ \newsavebox{\fstlst}
+  \newsavebox{\sndlst}
+\usepackage[caption=false]{subfig}
+
+\pagestyle{headings}
+\isabellestyle{default}
+\setcounter{tocdepth}{1}
+\newcommand{\ie}{i.\,e.\xspace}
+\newcommand{\eg}{e.\,g.\xspace}
+\newcommand{\thy}{\isabellecontext}
+\renewcommand{\isamarkupsection}[1]{%
+  \begingroup% 
+  \def\isacharunderscore{\textunderscore}%
+  \section{#1 (\thy)}%
+  \endgroup% 
+}
+
+\title{A Formalization of Safely Composable Web Components} 
+\author{Achim~D.~Brucker \and Michael~Herzberg}%
+\publishers{
+  \footnotemark[1]~Department of Computer Science, University of Exeter, Exeter, UK\texorpdfstring{\\}{, }
+  \texttt{a.brucker@exeter.ac.uk}\\[2em]
+  %
+  \footnotemark[2]~  Department of Computer Science, The University of Sheffield, Sheffield, UK\texorpdfstring{\\}{, }
+   \texttt{msherzberg1@sheffield.ac.uk}
+}
+\begin{document}
+  \maketitle
+  \begin{abstract}
+    \begin{quote}
+      While the (safely composable) DOM with shadow trees provide the
+      technical basis for defining web components, it does neither
+      defines the concept of web components nor specifies the safety
+      properties that web components should guarantee. Consequently,
+      the standard also does not discuss how or even if the methods
+      for modifying the DOM respect component boundaries. In AFP
+      entry, we present a formally verified model of \emph{safely
+        composable} web components and define safety properties which
+      ensure that different web components can only interact with each
+      other using well-defined interfaces. Moreover, our verification
+      of the application programming interface (API) of the DOM
+      revealed numerous invariants that implementations of the DOM API
+      need to preserve to ensure the integrity of components.
+
+      In comparison to the strict standard compliance formalization of
+      Web Components in the AFP entry ``DOM Components'', the notion
+      of components in this entry (based on ``SC DOM'' and
+      ``Shadow SC DOM'') provides much stronger safety guarantees.
+
+      \bigskip
+      \noindent{\textbf{Keywords:} Web Components, DOM} 
+    \end{quote}
+  \end{abstract}
+
+
+\tableofcontents
+\cleardoublepage
+
+\chapter{Introduction}
+The trend towards ever more complex client-side web applications is
+unstoppable. Compared to traditional software development, client-side
+web development lacks a well-established component model which allows
+easily and safely reusing implementations. The Document Object Model
+(DOM) essentially defines a tree-like data structure (the \emph{node
+tree}) for representing documents in general and HTML documents in
+particular.
+
+\emph{Shadow trees} are a recent addition to the DOM
+standard~\cite{whatwg:dom:2019} to enable web developers to partition
+the node tree into ``sub-trees.'' The vision of shadow trees is to
+enable web developers to provide a library of re-usable and
+customizable widgets. For example, let us consider a multi-tab view
+called \emph{Fancy Tab}, which is a simplified version
+of~\cite{bidelman:self-contained:2017}.
+
+\begin{figure}[b]
+  \begin{lrbox}{\fstlst}%
+    \begin{minipage}{.34\linewidth}
+      \centering
+      \includegraphics[width=\linewidth]{fancytabs-normal}
+    \end{minipage}
+  \end{lrbox}
+  \begin{lrbox}{\sndlst}%
+    \begin{minipage}{.63\linewidth}
+      \begin{html}[basicstyle=\ttfamily\scriptsize]
+<fancy-tabs>
+  <button slot="title">Politics</button>
+  <button slot="title" selected>Sports</button>
+  <button slot="title">Culture</button>
+  <section>content panel 1</section>
+  <ul>
+    <li>News Item 1 <button>Share</button></li>
+    <li>News Item 2 <button>Share</button></li>
+    <li>News Item 3 <button>Share</button></li>
+  </ul>
+  <section>content panel 3</section>
+</fancy-tabs>
+      \end{html}
+    \end{minipage}
+  \end{lrbox}
+  \subfloat[\label{fig:running-example-user}
+    User view
+  ]{\usebox{\fstlst}}%
+  \hfill%
+  \subfloat[\label{fig:running-example-consumer}
+    Consumer view
+  ]{\usebox{\sndlst}}
+  \caption{A simple example: a fancy tab component.}\label{fig:running-example}
+\end{figure}
+
+The left-hand side of \autoref{fig:running-example} shows the rendered
+output of the widget in use while the right-hand side shows the HTML
+source code snippet.  It provides a custom HTML tag
+\inlinehtml{<fancy-tabs>} using an HTML template that developers can
+use to include the widget. Its children will be rendered inside the
+widget, more precisely, inside its \emph{slots} (elements of type
+\inlinehtml{slot}).  It has a slot called ``title'' and a default
+slot, which receives all children that do not specify a ``slot''
+attribute.
+
+It is important to understand that slotting does \emph{not change} the
+structure of the DOM (\ie, the underlying pointer graph): instead,
+slotting is implemented using special element attributes such as
+``slot,'' which control the final rendering. The DOM standard
+specifies methods that inspect the effect of these attributes such as
+\texttt{assigned\_slot}, but the majority of DOM methods do not
+consider the semantics of these attributes and therefore do not
+traverse into shadow trees.
+
+This provides an important boundary for client-side code. For example,
+a JavaScript program coming from the widget developer that changes the
+style attributes of the ``Previous Tab'' and ``Next Tab'' buttons in the lower
+corners of the widget will not affect buttons belonging to other parts
+coming from outside, \ie, the application of the widget consumer.
+Similarly, a JavaScript program that changes the styles of buttons
+outside of Fancy Tab, such as the navigation buttons, will not have
+any effect on them, even in the case of duplicate identifiers.
+
+Sadly, the DOM standard neither defines the concept of web components
+nor specifies the safety properties that they should guarantee, not
+even informally. Consequently, the standard also does not discuss how
+or even if the methods for modifying the node tree respect component
+boundaries.  Thus, shadow roots are only the very first step in
+defining a safe web component model.
+
+Earlier~\cite{brucker.ea:core-dom:2018,brucker.ea:afp-core-sc-dom:2020},
+we presented a formalization of the ``flat'' DOM (called Core DOM)
+without any support for shadow trees or components.  We then extended
+this formalisation with support for shadow trees and
+slots~\cite{brucker.ea:afp-shadow-sc-dom:2020}.
+
+In this AFP entries, we use the basis provided by our earlier work for
+defining a \emph{formally verified model of web components} in general
+and, in particular, the notion of \emph{weak} and \emph{strong
+  component safety}. For all methods that query, modify, or transform
+the DOM, we formally analyze their level of component safety. In more
+detail, the contribution of this AFP entry is four-fold:
+\begin{enumerate}
+\item We provide a formal model of web components and their safety
+  guarantees to web developers, enabling a compositional development
+  of web applications,
+\item for each method, we formally verify that it is either weakly or
+  strongly component safe, or we provide a proof showing
+  that it is not component safe,
+\item we fill the gaps in the standard by explicitly formalizing
+  invariants that are left out in the standard. These invariants are
+  required to ensure that methods in the standard preserve a valid
+  node tree. Finally,
+\item we present a formal model of the DOM with shadow roots including
+  the methods for querying, modifying, and transforming DOM instances
+  with shadow roots.
+\end{enumerate}
+Overall, our work gives web developers the guarantee that their code
+will respect the component boundaries as long as they abstain from or
+are careful when using certain DOM methods such as
+\texttt{appendChild} or \texttt{ownerDocument}.
+
+The rest of this document is automatically generated from the
+formalization in Isabelle/HOL, i.e., all content is checked by
+Isabelle (we refer readers interested in a more high-level
+presentation of the work to \cite{herzberg:web-components:2020,
+  brucker.ea:web-components:2019}. The structure follows the theory
+dependencies (see \autoref{fig:session-graph}).
+
+
+\paragraph{Important Note:} This document describes the formalization
+of the \emph{Safely Composable Web Components} (based on the SC DOM),
+which deviated in one important aspect from the official DOM standard: 
+in the SC DOM, the shadow root is a sub-class of the document class 
+(instead of a base class). This modification results in a stronger notion 
+of web components that provide improved safety properties for the composition of web
+components. While the SC DOM still passes the compliance test suite as
+provided by the authors of the DOM standard, its data model is
+different. We refer readers interested in a formalisation of the
+standard compliant DOM to the AFP entries
+``Core\_DOM''~\cite{brucker.ea:afp-core-dom:2018}, 
+``Shadow\_DOM''~\cite{brucker.ea:afp-shadow-dom:2020}, and 
+``COM\_Components''~\cite{brucker.ea:afp-dom-components:2020}.
+
+\begin{figure}
+  \centering
+  \includegraphics[width=.8\textwidth]{session_graph}
+  \caption{The Dependency Graph of the Isabelle Theories.\label{fig:session-graph}}
+\end{figure}
+
+\clearpage
+
+\chapter{Safely Composable Web Components}
+\label{cha:components}
+\input{Core_DOM_DOM_Components.tex}
+\input{Core_DOM_SC_DOM_Components.tex}
+\input{Shadow_DOM_DOM_Components.tex}
+\input{Shadow_DOM_SC_DOM_Components.tex}
+
+{\small
+  \bibliographystyle{abbrvnat}
+  \bibliography{root}
+}
+\end{document}
+
+%%% Local Variables:
+%%% mode: latex
+%%% TeX-master: t
+%%% End: