just one dedicated execution per document version -- NB: non-monotonicity of cancel always requires fresh update;
explicit terminate_execution;
tuned source structure;
Intro Ref System Logics HOL ZF Inductive TutorialI IsarRef IsarImplementation Locales LaTeXsugar Classes Codegen Functions Nitpick Main Sledgehammer ProgProve