MSetPositive.v

Built with Alectryon, running Coq+SerAPI v8.10.0+0.7.0. Coq sources are in this panel; goals and messages will appear in the other. Bubbles () indicate interactive fragments: hover for details, tap to reveal contents. Use Ctrl+↑ Ctrl+↓ to navigate, Ctrl+🖱️ to focus.

(************************************************************************)
(*         *   The Coq Proof Assistant / The Coq Development Team       *)
(*  v      *   INRIA, CNRS and contributors - Copyright 1999-2018       *)
(* <O___,, *       (see CREDITS file for the list of authors)           *)
(*   \VV/  **************************************************************)
(*    //   *    This file is distributed under the terms of the         *)
(*         *     GNU Lesser General Public License Version 2.1          *)
(*         *     (see LICENSE file for the text of the license)         *)
(************************************************************************)

Efficient implementation of MSetInterface.S for positive keys, inspired from the FMapPositive module.

This module was adapted by Alexandre Ren, Damien Pous, and Thomas Braibant (2010, LIG, CNRS, UMR 5217), from the FMapPositive module of Pierre Letouzey and Jean-Christophe Filliâtre, which in turn comes from the FMap framework of a work by Xavier Leroy and Sandrine Blazy (used for building certified compilers).

Require Import Bool BinPos Orders OrdersEx MSetInterface.

Set Implicit Arguments.
Local Open Scope lazy_bool_scope.
Local Open Scope positive_scope.
Local Unset Elimination Schemes.

Module PositiveSet <: S with Module E:=PositiveOrderedTypeBits.

  Module E:=PositiveOrderedTypeBits.

  Definition elt := positive : Type.

  Inductive tree :=
    | Leaf : tree
    | Node : tree -> bool -> tree -> tree.

  Scheme tree_ind := Induction for tree Sort Prop.

  Definition t := tree : Type.

  Definition empty : t := Leaf.

  Fixpoint is_empty (m : t) : bool :=
   match m with
    | Leaf => true
    | Node l b r => negb b &&& is_empty l &&& is_empty r
   end.

  Fixpoint mem (i : positive) (m : t) {struct m} : bool :=
    match m with
    | Leaf => false
    | Node l o r =>
        match i with
        | 1 => o
        | i~0 => mem i l
        | i~1 => mem i r
        end
    end.

  Fixpoint add (i : positive) (m : t) : t :=
    match m with
    | Leaf =>
        match i with
        | 1 => Node Leaf true Leaf
        | i~0 => Node (add i Leaf) false Leaf
        | i~1 => Node Leaf false (add i Leaf)
        end
    | Node l o r =>
        match i with
        | 1 => Node l true r
        | i~0 => Node (add i l) o r
        | i~1 => Node l o (add i r)
        end
    end.

  Definition singleton i := add i empty.

helper function to avoid creating empty trees that are not leaves

  Definition node (l : t) (b: bool) (r : t) : t :=
    if b then Node l b r else
     match l,r with
       | Leaf,Leaf => Leaf
       | _,_ => Node l false r end.

  Fixpoint remove (i : positive) (m : t) {struct m} : t :=
    match m with
      | Leaf => Leaf
      | Node l o r =>
        match i with
          | 1 => node l false r
          | i~0 => node (remove i l) o r
          | i~1 => node l o (remove i r)
        end
    end.

  Fixpoint union (m m': t) : t :=
    match m with
      | Leaf => m'
      | Node l o r =>
        match m' with
          | Leaf => m
          | Node l' o' r' => Node (union l l') (o||o') (union r r')
        end
    end.

  Fixpoint inter (m m': t) : t :=
    match m with
      | Leaf => Leaf
      | Node l o r =>
        match m' with
          | Leaf => Leaf
          | Node l' o' r' => node (inter l l') (o&&o') (inter r r')
        end
    end.

  Fixpoint diff (m m': t) : t :=
    match m with
      | Leaf => Leaf
      | Node l o r =>
        match m' with
          | Leaf => m
          | Node l' o' r' => node (diff l l') (o&&negb o') (diff r r')
        end
    end.

  Fixpoint equal (m m': t): bool :=
    match m with
      | Leaf => is_empty m'
      | Node l o r =>
        match m' with
          | Leaf => is_empty m
          | Node l' o' r' => eqb o o' &&& equal l l' &&& equal r r'
        end
    end.

  Fixpoint subset (m m': t): bool :=
    match m with
      | Leaf => true
      | Node l o r =>
        match m' with
          | Leaf => is_empty m
          | Node l' o' r' => (negb o ||| o') &&& subset l l' &&& subset r r'
        end
    end.

reverses y and concatenate it with x

  Fixpoint rev_append (y x : elt) : elt :=
    match y with
      | 1 => x
      | y~1 => rev_append y x~1
      | y~0 => rev_append y x~0
    end.
  Infix "@" := rev_append (at level 60).
  Definition rev x := x@1.

  Section Fold.

    Variables B : Type.
    Variable f : positive -> B -> B.

the additional argument, i, records the current path, in reverse order (this should be more efficient: we reverse this argument only at present nodes only, rather than at each node of the tree). we also use this convention in all functions below

    Fixpoint xfold (m : t) (v : B) (i : positive) :=
      match m with
        | Leaf => v
        | Node l true r =>
          xfold r (f (rev i) (xfold l v i~0)) i~1
        | Node l false r =>
          xfold r (xfold l v i~0) i~1
      end.
    Definition fold m i := xfold m i 1.

  End Fold.

  Section Quantifiers.

    Variable f : positive -> bool.

    Fixpoint xforall (m : t) (i : positive) :=
      match m with
        | Leaf => true
        | Node l o r =>
          (negb o ||| f (rev i)) &&& xforall r i~1 &&& xforall l i~0
      end.
    Definition for_all m := xforall m 1.

    Fixpoint xexists (m : t) (i : positive) :=
      match m with
        | Leaf => false
        | Node l o r => (o &&& f (rev i)) ||| xexists r i~1 ||| xexists l i~0
      end.
    Definition exists_ m := xexists m 1.

    Fixpoint xfilter (m : t) (i : positive) : t :=
      match m with
        | Leaf => Leaf
        | Node l o r => node (xfilter l i~0) (o &&& f (rev i)) (xfilter r i~1)
      end.
    Definition filter m := xfilter m 1.

    Fixpoint xpartition (m : t) (i : positive) : t * t :=
      match m with
        | Leaf => (Leaf,Leaf)
        | Node l o r =>
          let (lt,lf) := xpartition l i~0 in
          let (rt,rf) := xpartition r i~1 in
             if o then
               let fi := f (rev i) in
                 (node lt fi rt, node lf (negb fi) rf)
             else
                 (node lt false rt, node lf false rf)
      end.
    Definition partition m := xpartition m 1.

  End Quantifiers.

uses a to accumulate values rather than doing a lot of concatenations

  Fixpoint xelements (m : t) (i : positive) (a: list positive) :=
    match m with
      | Leaf => a
      | Node l false r => xelements l i~0 (xelements r i~1 a)
      | Node l true r => xelements l i~0 (rev i :: xelements r i~1 a)
    end.

  Definition elements (m : t) := xelements m 1 nil.

  Fixpoint cardinal (m : t) : nat :=
    match m with
      | Leaf => O
      | Node l false r => (cardinal l + cardinal r)%nat
      | Node l true r => S (cardinal l + cardinal r)
    end.

would it be more efficient to use a path like in the above functions ?

  Fixpoint choose (m: t) : option elt :=
    match m with
      | Leaf => None
      | Node l o r => if o then Some 1 else
        match choose l with
          | None => option_map xI (choose r)
          | Some i => Some i~0
        end
    end.

  Fixpoint min_elt (m: t) : option elt :=
    match m with
      | Leaf => None
      | Node l o r =>
        match min_elt l with
          | None => if o then Some 1 else option_map xI (min_elt r)
          | Some i => Some i~0
        end
    end.

  Fixpoint max_elt (m: t) : option elt :=
    match m with
      | Leaf => None
      | Node l o r =>
        match max_elt r with
          | None => if o then Some 1 else option_map xO (max_elt l)
          | Some i => Some i~1
        end
    end.

lexicographic product, defined using a notation to keep things lazy

  Notation lex u v := match u with Eq => v | Lt => Lt | Gt => Gt end.

  Definition compare_bool a b :=
    match a,b with
      | false, true => Lt
      | true, false => Gt
      | _,_ => Eq
    end.

  Fixpoint compare (m m': t): comparison :=
    match m,m' with
      | Leaf,_ => if is_empty m' then Eq else Lt
      | _,Leaf => if is_empty m then Eq else Gt
      | Node l o r,Node l' o' r' =>
        lex (compare_bool o o') (lex (compare l l') (compare r r'))
    end.


  Definition In i t := mem i t = true.
  Definition Equal s s' := forall a : elt, In a  s <-> In a  s'.
  Definition Subset s s' := forall a : elt, In a s -> In a s'.
  Definition Empty s := forall a : elt, ~ In a s.
  Definition For_all (P : elt -> Prop) s := forall x, In x s -> P x.
  Definition Exists (P : elt -> Prop) s := exists x, In x s /\ P x.

  Notation "s  [=]  t" := (Equal s t) (at level 70, no associativity).
  Notation "s  [<=]  t" := (Subset s t) (at level 70, no associativity).

  Definition eq := Equal.
  Definition lt m m' := compare m m' = Lt.

Specification of In

  Instance In_compat : Proper (E.eq==>Logic.eq==>iff) In.Proper (E.eq ==> Logic.eq ==> iff) In
  Proof.Proper (E.eq ==> Logic.eq ==> iff) In
   intros s s' Hs x x' Hx.s, s':positive
Hs:E.eq s s'
x, x':t
Hx:x = x'
In s x <-> In s' x' rewrite Hs, Hx; intuition.
  Qed.

Specification of eq

  Instance eq_equiv : Equivalence eq.Equivalence eq
  Proof.Equivalence eq firstorder. Qed.

Specification of mem

  Lemma mem_spec: forall s x, mem x s = true <-> In x s.forall (s : t) (x : positive),
mem x s = true <-> In x s
  Proof.forall (s : t) (x : positive),
mem x s = true <-> In x s unfold In.forall (s : t) (x : positive),
mem x s = true <-> mem x s = true intuition. Qed.

Additional lemmas for mem

  Lemma mem_Leaf: forall x, mem x Leaf = false.forall x : positive, mem x Leaf = false
  Proof.forall x : positive, mem x Leaf = false destruct x; trivial. Qed.

Specification of empty

  Lemma empty_spec : Empty empty.Empty empty
  Proof.Empty empty unfold Empty, In.forall a : elt, mem a empty <> true intro.a:elt
mem a empty <> true rewrite mem_Leaf.a:elt
false <> true discriminate. Qed.

Specification of node

  Lemma mem_node: forall x l o r, mem x (node l o r) = mem x (Node l o r).forall (x : positive) (l : t) (o : bool) (r : t),
mem x (node l o r) = mem x (Node l o r)
  Proof.forall (x : positive) (l : t) (o : bool) (r : t),
mem x (node l o r) = mem x (Node l o r)
    intros x l o r.x:positive
l:t
o:bool
r:t
mem x (node l o r) = mem x (Node l o r)
    case o; trivial.x:positive
l:t
o:bool
r:t
mem x (node l false r) = mem x (Node l false r)
    destruct l; trivial.x:positive
o:bool
r:t
mem x (node Leaf false r) = mem x (Node Leaf false r)
    destruct r; trivial.x:positive
o:bool
mem x (node Leaf false Leaf) =
mem x (Node Leaf false Leaf)
    destruct x; reflexivity.
  Qed.
  Local Opaque node.

Specification of is_empty

  Lemma is_empty_spec: forall s, is_empty s = true <-> Empty s.forall s : t, is_empty s = true <-> Empty s
  Proof.forall s : t, is_empty s = true <-> Empty s
    unfold Empty, In.forall s : t,
is_empty s = true <->
(forall a : elt, mem a s <> true)
    induction s as [|l IHl o r IHr]; simpl.true = true <-> (elt -> false <> true)
l:tree
o:bool
r:tree
IHl:is_empty l = true <-> (forall a : elt, mem a l <> true)
IHr:is_empty r = true <-> (forall a : elt, mem a r <> true)
negb o &&& is_empty l &&& is_empty r = true <->
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true)
      firstorder.l:tree
o:bool
r:tree
IHl:is_empty l = true <-> (forall a : elt, mem a l <> true)
IHr:is_empty r = true <-> (forall a : elt, mem a r <> true)
negb o &&& is_empty l &&& is_empty r = true <->
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true)
      rewrite <- 2andb_lazy_alt, 2andb_true_iff, IHl, IHr.l:tree
o:bool
r:tree
IHl:is_empty l = true <-> (forall a : elt, mem a l <> true)
IHr:is_empty r = true <-> (forall a : elt, mem a r <> true)
(negb o = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) <->
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true) clear IHl IHr.l:tree
o:bool
r:tree
(negb o = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) <->
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true)
      destruct o; simpl; split.l, r:tree
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => true
 end <> true) ->
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
        intuition discriminate.l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => true
 end <> true) ->
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
        intro H.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) elim (H 1).l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
true = true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) reflexivity.l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
        intros H [a|a|]; apply H || intro; discriminate.l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
        intro H.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) split.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
true = true /\ (forall a : elt, mem a l <> true)
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true split.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
true = true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a l <> true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true reflexivity.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a l <> true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
          intro a.l, r:tree
H:forall a0 : elt,
match a0 with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
a:elt
mem a l <> true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true apply (H a~0).l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
          intro a.l, r:tree
H:forall a0 : elt,
match a0 with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
a:elt
mem a r <> true apply (H a~1).
  Qed.

Specification of subset

  Lemma subset_Leaf_s: forall s, Leaf [<=] s.forall s : t, Leaf [<=] s
  Proof.forall s : t, Leaf [<=] s intros s i Hi.s:t
i:elt
Hi:In i Leaf
In i s apply empty_spec in Hi.s:t
i:elt
Hi:False
In i s elim Hi. Qed.

  Lemma subset_spec: forall s s', subset s s' = true <-> s [<=] s'.forall s s' : t, subset s s' = true <-> s [<=] s'
  Proof.forall s s' : t, subset s s' = true <-> s [<=] s'
    induction s as [|l IHl o r IHr]; intros [|l' o' r']; simpl.true = true <-> Leaf [<=] Leaf
l':tree
o':bool
r':tree
true = true <-> Leaf [<=] Node l' o' r'
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
      split; intros.H:true = true
Leaf [<=] Leaf
H:Leaf [<=] Leaf
true = true
l':tree
o':bool
r':tree
true = true <-> Leaf [<=] Node l' o' r'
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' apply subset_Leaf_s.H:Leaf [<=] Leaf
true = true
l':tree
o':bool
r':tree
true = true <-> Leaf [<=] Node l' o' r'
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' reflexivity.l':tree
o':bool
r':tree
true = true <-> Leaf [<=] Node l' o' r'
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'

      split; intros.l':tree
o':bool
r':tree
H:true = true
Leaf [<=] Node l' o' r'
l':tree
o':bool
r':tree
H:Leaf [<=] Node l' o' r'
true = true
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' apply subset_Leaf_s.l':tree
o':bool
r':tree
H:Leaf [<=] Node l' o' r'
true = true
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
negb o &&& is_empty l &&& is_empty r = true <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'

      rewrite <- 2andb_lazy_alt, 2andb_true_iff, 2is_empty_spec.l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(negb o = true /\ Empty l) /\ Empty r <->
Node l o r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
      destruct o; simpl.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(false = true /\ Empty l) /\ Empty r <->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
        split.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(false = true /\ Empty l) /\ Empty r ->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Node l true r [<=] Leaf ->
(false = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          intuition discriminate.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Node l true r [<=] Leaf ->
(false = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          intro H.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l true r [<=] Leaf
(false = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' elim (@empty_spec 1).l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l true r [<=] Leaf
In 1 empty
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' apply H.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l true r [<=] Leaf
In 1 (Node l true r)
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' reflexivity.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
(true = true /\ Empty l) /\ Empty r <->
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
        split; intro H.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          destruct H as [[_ Hl] Hr].l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
Node l false r [<=] Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          intros [i|i|] Hi.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
i:positive
Hi:In i~1 (Node l false r)
In i~1 Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
i:positive
Hi:In i~0 (Node l false r)
In i~0 Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
Hi:In 1 (Node l false r)
In 1 Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
            elim (Hr i Hi).l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
i:positive
Hi:In i~0 (Node l false r)
In i~0 Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
Hi:In 1 (Node l false r)
In 1 Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
            elim (Hl i Hi).l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
Hl:Empty l
Hr:Empty r
Hi:In 1 (Node l false r)
In 1 Leaf
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
            discriminate.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          split.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
true = true /\ Empty l
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' split.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
true = true
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty l
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' reflexivity.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty l
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          unfold Empty.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
forall a : elt, ~ In a l
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' intros a H1.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
a:elt
H1:In a l
False
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' apply (@empty_spec (a~0)), H.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
a:elt
H1:In a l
In a~0 (Node l false r)
l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' assumption.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'
          unfold Empty.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
forall a : elt, ~ In a r
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' intros a H1.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
a:elt
H1:In a r
False
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' apply (@empty_spec (a~1)), H.l, r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
H:Node l false r [<=] Leaf
a:elt
H1:In a r
In a~1 (Node l false r)
l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r' assumption.l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o') &&& subset l l' &&& subset r r' = true <->
Node l o r [<=] Node l' o' r'

      rewrite <- 2andb_lazy_alt, 2andb_true_iff, IHl, IHr.l:tree
o:bool
r:tree
IHl:forall s' : t, subset l s' = true <-> l [<=] s'
IHr:forall s' : t, subset r s' = true <-> r [<=] s'
l':tree
o':bool
r':tree
(negb o ||| o' = true /\ l [<=] l') /\ r [<=] r' <->
Node l o r [<=] Node l' o' r' clear.l:tree
o:bool
r, l':tree
o':bool
r':tree
(negb o ||| o' = true /\ l [<=] l') /\ r [<=] r' <->
Node l o r [<=] Node l' o' r'
      destruct o; simpl.l, r, l':tree
o':bool
r':tree
(o' = true /\ l [<=] l') /\ r [<=] r' <->
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
       split; intro H.l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
         destruct H as [[Ho' Hl] Hr].l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' rewrite Ho'.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Node l true r [<=] Node l' true r'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
          intros i Hi.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:elt
Hi:In i (Node l true r)
In i (Node l' true r')
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' destruct i.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l true r)
In i~1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i~0 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
            apply (Hr i).l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l true r)
In i r
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i~0 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' assumption.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i~0 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
            apply (Hl i).l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i l
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' assumption.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
            assumption.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
         split.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
o' = true /\ l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' split.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
o' = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
          destruct o'; trivial.l, r, l', r':tree
H:Node l true r [<=] Node l' false r'
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
          specialize (H 1).l, r, l', r':tree
H:In 1 (Node l true r) -> In 1 (Node l' false r')
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' unfold In in H.l, r, l', r':tree
H:mem 1 (Node l true r) = true ->
mem 1 (Node l' false r') = true
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' simpl in H.l, r, l', r':tree
H:true = true -> false = true
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' apply H.l, r, l', r':tree
H:true = true -> false = true
true = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' reflexivity.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
          intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i l
In i l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' apply (H i~0).l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i l
In i~0 (Node l true r)
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' apply Hi.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
          intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i r
In i r'
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' apply (H i~1).l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i r
In i~1 (Node l true r)
l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r' apply Hi.l, r, l':tree
o':bool
r':tree
(true = true /\ l [<=] l') /\ r [<=] r' <->
Node l false r [<=] Node l' o' r'
       split; intros.l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r'
         intros i Hi.l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
i:elt
Hi:In i (Node l false r)
In i (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r' destruct i; destruct H as [[H Hl] Hr].l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l false r)
In i~1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i~0 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r'
           apply (Hr i).l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l false r)
In i r
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i~0 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r' assumption.l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i~0 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r'
           apply (Hl i).l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i l
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r' assumption.l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r'
            discriminate Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r'
         split.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
true = true /\ l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r' split.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
true = true
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r' reflexivity.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
           intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i l
In i l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r' apply (H i~0).l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i l
In i~0 (Node l false r)
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r' apply Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
           intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i r
In i r' apply (H i~1).l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i r
In i~1 (Node l false r) apply Hi.
  Qed.

Specification of equal (via subset)

  Lemma equal_subset: forall s s', equal s s' = subset s s' && subset s' s.forall s s' : t,
equal s s' = subset s s' && subset s' s
  Proof.forall s s' : t,
equal s s' = subset s s' && subset s' s
    induction s as [|l IHl o r IHr]; intros [|l' o' r']; simpl; trivial.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb o &&& is_empty l &&& is_empty r =
negb o &&& is_empty l &&& is_empty r && true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r)
      destruct o.l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb true &&& is_empty l &&& is_empty r =
negb true &&& is_empty l &&& is_empty r && true
l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb false &&& is_empty l &&& is_empty r =
negb false &&& is_empty l &&& is_empty r && true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r) reflexivity.l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb false &&& is_empty l &&& is_empty r =
negb false &&& is_empty l &&& is_empty r && true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r) rewrite andb_comm.l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb false &&& is_empty l &&& is_empty r =
true && (negb false &&& is_empty l &&& is_empty r)
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r) reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r)
      rewrite <- 6andb_lazy_alt.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' && equal l l' && equal r r' =
(negb o ||| o') && subset l l' && subset r r' &&
((negb o' ||| o) && subset l' l && subset r' r) rewrite eq_iff_eq_true.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' && equal l l' && equal r r' = true <->
(negb o ||| o') && subset l l' && subset r r' &&
((negb o' ||| o) && subset l' l && subset r' r) = true
       rewrite 7andb_true_iff, eqb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
(o = o' /\ equal l l' = true) /\ equal r r' = true <->
((negb o ||| o' = true /\ subset l l' = true) /\
 subset r r' = true) /\
(negb o' ||| o = true /\ subset l' l = true) /\
subset r' r = true
      rewrite IHl, IHr, 2andb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
(o = o' /\ subset l l' = true /\ subset l' l = true) /\
subset r r' = true /\ subset r' r = true <->
((negb o ||| o' = true /\ subset l l' = true) /\
 subset r r' = true) /\
(negb o' ||| o = true /\ subset l' l = true) /\
subset r' r = true clear IHl IHr.l:tree
o:bool
r, l':tree
o':bool
r':tree
(o = o' /\ subset l l' = true /\ subset l' l = true) /\
subset r r' = true /\ subset r' r = true <->
((negb o ||| o' = true /\ subset l l' = true) /\
 subset r r' = true) /\
(negb o' ||| o = true /\ subset l' l = true) /\
subset r' r = true intuition subst.l, r, l':tree
o':bool
r':tree
H0:subset r r' = true
H3:subset r' r = true
H1:subset l l' = true
H4:subset l' l = true
negb o' ||| o' = true
l, r, l':tree
o':bool
r':tree
H0:subset r r' = true
H3:subset r' r = true
H1:subset l l' = true
H4:subset l' l = true
negb o' ||| o' = true
l:tree
o:bool
r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb o ||| o' = true
H4:subset l l' = true
H:negb o' ||| o = true
H5:subset l' l = true
o = o'
       destruct o'; reflexivity.l, r, l':tree
o':bool
r':tree
H0:subset r r' = true
H3:subset r' r = true
H1:subset l l' = true
H4:subset l' l = true
negb o' ||| o' = true
l:tree
o:bool
r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb o ||| o' = true
H4:subset l l' = true
H:negb o' ||| o = true
H5:subset l' l = true
o = o'
       destruct o'; reflexivity.l:tree
o:bool
r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb o ||| o' = true
H4:subset l l' = true
H:negb o' ||| o = true
H5:subset l' l = true
o = o'
       destruct o; auto.l, r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb false ||| o' = true
H4:subset l l' = true
H:negb o' ||| false = true
H5:subset l' l = true
false = o' destruct o'; trivial.
  Qed.

  Lemma equal_spec: forall s s', equal s s' = true <-> Equal s s'.forall s s' : t, equal s s' = true <-> s [=] s'
  Proof.forall s s' : t, equal s s' = true <-> s [=] s'
    intros.s, s':t
equal s s' = true <-> s [=] s' rewrite equal_subset.s, s':t
subset s s' && subset s' s = true <-> s [=] s' rewrite andb_true_iff.s, s':t
subset s s' = true /\ subset s' s = true <-> s [=] s'
    rewrite 2subset_spec.s, s':t
s [<=] s' /\ s' [<=] s <-> s [=] s' unfold Equal, Subset.s, s':t
(forall a : elt, In a s -> In a s') /\
(forall a : elt, In a s' -> In a s) <->
(forall a : elt, In a s <-> In a s') firstorder.
  Qed.

  Lemma eq_dec : forall s s', { eq s s' } + { ~ eq s s' }.forall s s' : t, {eq s s'} + {~ eq s s'}
  Proof.forall s s' : t, {eq s s'} + {~ eq s s'}
    unfold eq.forall s s' : t, {s [=] s'} + {~ s [=] s'}
    intros.s, s':t
{s [=] s'} + {~ s [=] s'} case_eq (equal s s'); intro H.s, s':t
H:equal s s' = true
{s [=] s'} + {~ s [=] s'}
s, s':t
H:equal s s' = false
{s [=] s'} + {~ s [=] s'}
     left.s, s':t
H:equal s s' = true
s [=] s'
s, s':t
H:equal s s' = false
{s [=] s'} + {~ s [=] s'} apply equal_spec, H.s, s':t
H:equal s s' = false
{s [=] s'} + {~ s [=] s'}
     right.s, s':t
H:equal s s' = false
~ s [=] s' rewrite <- equal_spec.s, s':t
H:equal s s' = false
equal s s' <> true congruence.
  Defined.

(Specified) definition of compare

  Lemma lex_Opp: forall u v u' v', u = CompOpp u' -> v = CompOpp v' ->
    lex u v = CompOpp (lex u' v').forall u v u' v' : comparison,
u = CompOpp u' ->
v = CompOpp v' -> lex u v = CompOpp (lex u' v')
  Proof.forall u v u' v' : comparison,
u = CompOpp u' ->
v = CompOpp v' -> lex u v = CompOpp (lex u' v') intros ? ? u' ? -> ->.u', v':comparison
lex (CompOpp u') (CompOpp v') = CompOpp (lex u' v') case u'; reflexivity. Qed.

  Lemma compare_bool_inv: forall b b',
    compare_bool b b' = CompOpp (compare_bool b' b).forall b b' : bool,
compare_bool b b' = CompOpp (compare_bool b' b)
  Proof.forall b b' : bool,
compare_bool b b' = CompOpp (compare_bool b' b) intros [|] [|]; reflexivity. Qed.

  Lemma compare_inv: forall s s', compare s s' = CompOpp (compare s' s).forall s s' : t, compare s s' = CompOpp (compare s' s)
  Proof.forall s s' : t, compare s s' = CompOpp (compare s' s)
    induction s as [|l IHl o r IHr]; destruct s' as [|l' o' r']; trivial.l':tree
o':bool
r':tree
compare Leaf (Node l' o' r') =
CompOpp (compare (Node l' o' r') Leaf)
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
compare (Node l o r) Leaf =
CompOpp (compare Leaf (Node l o r))
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') =
CompOpp (compare (Node l' o' r') (Node l o r))
    unfold compare.l':tree
o':bool
r':tree
(if is_empty (Node l' o' r') then Eq else Lt) =
CompOpp (if is_empty (Node l' o' r') then Eq else Gt)
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
compare (Node l o r) Leaf =
CompOpp (compare Leaf (Node l o r))
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') =
CompOpp (compare (Node l' o' r') (Node l o r)) case is_empty; reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
compare (Node l o r) Leaf =
CompOpp (compare Leaf (Node l o r))
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') =
CompOpp (compare (Node l' o' r') (Node l o r))
    unfold compare.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
(if is_empty (Node l o r) then Eq else Gt) =
CompOpp (if is_empty (Node l o r) then Eq else Lt)
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') =
CompOpp (compare (Node l' o' r') (Node l o r)) case is_empty; reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') =
CompOpp (compare (Node l' o' r') (Node l o r))
    simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) =
CompOpp
  (lex (compare_bool o' o)
     (lex (compare l' l) (compare r' r))) rewrite compare_bool_inv.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = CompOpp (compare s' l)
IHr:forall s' : t, compare r s' = CompOpp (compare s' r)
l':tree
o':bool
r':tree
lex (CompOpp (compare_bool o' o))
  (lex (compare l l') (compare r r')) =
CompOpp
  (lex (compare_bool o' o)
     (lex (compare l' l) (compare r' r)))
     case compare_bool; simpl; trivial; apply lex_Opp; auto.
  Qed.

  Lemma lex_Eq: forall u v, lex u v = Eq <-> u=Eq /\ v=Eq.forall u v : comparison,
lex u v = Eq <-> u = Eq /\ v = Eq
  Proof.forall u v : comparison,
lex u v = Eq <-> u = Eq /\ v = Eq intros u v; destruct u; intuition discriminate. Qed.

  Lemma compare_bool_Eq: forall b1 b2,
    compare_bool b1 b2 = Eq <-> eqb b1 b2 = true.forall b1 b2 : bool,
compare_bool b1 b2 = Eq <-> eqb b1 b2 = true
  Proof.forall b1 b2 : bool,
compare_bool b1 b2 = Eq <-> eqb b1 b2 = true intros [|] [|]; intuition discriminate. Qed.

  Lemma compare_equal: forall s s', compare s s' = Eq <-> equal s s' = true.forall s s' : t,
compare s s' = Eq <-> equal s s' = true
  Proof.forall s s' : t,
compare s s' = Eq <-> equal s s' = true
    induction s as [|l IHl o r IHr]; destruct s' as [|l' o' r'].compare Leaf Leaf = Eq <-> equal Leaf Leaf = true
l':tree
o':bool
r':tree
compare Leaf (Node l' o' r') = Eq <->
equal Leaf (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
compare (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     simpl.Eq = Eq <-> true = true
l':tree
o':bool
r':tree
compare Leaf (Node l' o' r') = Eq <->
equal Leaf (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
compare (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true tauto.l':tree
o':bool
r':tree
compare Leaf (Node l' o' r') = Eq <->
equal Leaf (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
compare (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     unfold compare, equal.l':tree
o':bool
r':tree
(if is_empty (Node l' o' r') then Eq else Lt) = Eq <->
is_empty (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
compare (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true case is_empty; intuition discriminate.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
compare (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     unfold compare, equal.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
(if is_empty (Node l o r) then Eq else Gt) = Eq <->
is_empty (Node l o r) = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true case is_empty; intuition discriminate.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq <->
eqb o o' &&& equal l l' &&& equal r r' = true rewrite <- 2andb_lazy_alt, 2andb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq <->
(eqb o o' = true /\ equal l l' = true) /\
equal r r' = true
     rewrite <- IHl, <- IHr, <- compare_bool_Eq.l:tree
o:bool
r:tree
IHl:forall s' : t, compare l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq <->
(compare_bool o o' = Eq /\ compare l l' = Eq) /\
compare r r' = Eq clear IHl IHr.l:tree
o:bool
r, l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq <->
(compare_bool o o' = Eq /\ compare l l' = Eq) /\
compare r r' = Eq
     rewrite and_assoc.l:tree
o:bool
r, l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq <->
compare_bool o o' = Eq /\
compare l l' = Eq /\ compare r r' = Eq rewrite <- 2lex_Eq.l:tree
o:bool
r, l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq <->
lex (compare_bool o o')
  (lex (compare l l') (compare r r')) = Eq reflexivity.
  Qed.


  Lemma compare_gt: forall s s', compare s s' = Gt -> lt s' s.forall s s' : t, compare s s' = Gt -> lt s' s
  Proof.forall s s' : t, compare s s' = Gt -> lt s' s
    unfold lt.forall s s' : t,
compare s s' = Gt -> compare s' s = Lt intros s s'.s, s':t
compare s s' = Gt -> compare s' s = Lt rewrite compare_inv.s, s':t
CompOpp (compare s' s) = Gt -> compare s' s = Lt
     case compare; trivial; intros; discriminate.
  Qed.

  Lemma compare_eq: forall s s', compare s s' = Eq -> eq s s'.forall s s' : t, compare s s' = Eq -> eq s s'
  Proof.forall s s' : t, compare s s' = Eq -> eq s s'
    unfold eq.forall s s' : t, compare s s' = Eq -> s [=] s' intros s s'.s, s':t
compare s s' = Eq -> s [=] s' rewrite compare_equal, equal_spec.s, s':t
s [=] s' -> s [=] s' trivial.
  Qed.

  Lemma compare_spec : forall s s' : t, CompSpec eq lt s s' (compare s s').forall s s' : t, CompSpec eq lt s s' (compare s s')
  Proof.forall s s' : t, CompSpec eq lt s s' (compare s s')
    intros.s, s':t
CompSpec eq lt s s' (compare s s') case_eq (compare s s'); intro H; constructor.s, s':t
H:compare s s' = Eq
eq s s'
s, s':t
H:compare s s' = Lt
lt s s'
s, s':t
H:compare s s' = Gt
lt s' s
    apply compare_eq, H.s, s':t
H:compare s s' = Lt
lt s s'
s, s':t
H:compare s s' = Gt
lt s' s
    assumption.s, s':t
H:compare s s' = Gt
lt s' s
    apply compare_gt, H.
  Qed.

  Section lt_spec.

  Inductive ct: comparison -> comparison -> comparison -> Prop :=
  | ct_xxx: forall x, ct x  x  x
  | ct_xex: forall x, ct x  Eq x
  | ct_exx: forall x, ct Eq x  x
  | ct_glx: forall x, ct Gt Lt x
  | ct_lgx: forall x, ct Lt Gt x.

  Lemma ct_cxe: forall x, ct (CompOpp x) x Eq.forall x : comparison, ct (CompOpp x) x Eq
  Proof.forall x : comparison, ct (CompOpp x) x Eq destruct x; constructor. Qed.

  Lemma ct_xce: forall x, ct x (CompOpp x) Eq.forall x : comparison, ct x (CompOpp x) Eq
  Proof.forall x : comparison, ct x (CompOpp x) Eq destruct x; constructor. Qed.

  Lemma ct_lxl: forall x, ct Lt x Lt.forall x : comparison, ct Lt x Lt
  Proof.forall x : comparison, ct Lt x Lt destruct x; constructor. Qed.

  Lemma ct_gxg: forall x, ct Gt x Gt.forall x : comparison, ct Gt x Gt
  Proof.forall x : comparison, ct Gt x Gt destruct x; constructor. Qed.

  Lemma ct_xll: forall x, ct x Lt Lt.forall x : comparison, ct x Lt Lt
  Proof.forall x : comparison, ct x Lt Lt destruct x; constructor. Qed.

  Lemma ct_xgg: forall x, ct x Gt Gt.forall x : comparison, ct x Gt Gt
  Proof.forall x : comparison, ct x Gt Gt destruct x; constructor. Qed.

  Local Hint Constructors ct: ct.
  Local Hint Resolve ct_cxe ct_xce ct_lxl ct_xll ct_gxg ct_xgg: ct.
  Ltac ct := trivial with ct.

  Lemma ct_lex: forall u v w u' v' w',
    ct u v w -> ct u' v' w' -> ct (lex u u') (lex v v') (lex w w').forall u v w u' v' w' : comparison,
ct u v w ->
ct u' v' w' -> ct (lex u u') (lex v v') (lex w w')
  Proof.forall u v w u' v' w' : comparison,
ct u v w ->
ct u' v' w' -> ct (lex u u') (lex v v') (lex w w')
    intros u v w u' v' w' H H'.u, v, w, u', v', w':comparison
H:ct u v w
H':ct u' v' w'
ct (lex u u') (lex v v') (lex w w')
    inversion_clear H; inversion_clear H'; ct; destruct w; ct; destruct w'; ct.
  Qed.

  Lemma ct_compare_bool:
    forall a b c, ct (compare_bool a b) (compare_bool b c) (compare_bool a c).forall a b c : bool,
ct (compare_bool a b) (compare_bool b c)
  (compare_bool a c)
  Proof.forall a b c : bool,
ct (compare_bool a b) (compare_bool b c)
  (compare_bool a c)
    intros [|] [|] [|]; constructor.
  Qed.

  Lemma compare_x_Leaf: forall s,
    compare s Leaf = if is_empty s then Eq else Gt.forall s : t,
compare s Leaf = (if is_empty s then Eq else Gt)
  Proof.forall s : t,
compare s Leaf = (if is_empty s then Eq else Gt)
    intros.s:t
compare s Leaf = (if is_empty s then Eq else Gt) rewrite compare_inv.s:t
CompOpp (compare Leaf s) =
(if is_empty s then Eq else Gt) simpl.s:t
CompOpp (if is_empty s then Eq else Lt) =
(if is_empty s then Eq else Gt) case (is_empty s); reflexivity.
  Qed.

  Lemma compare_empty_x: forall a, is_empty a = true ->
    forall b, compare a b = if is_empty b then Eq else Lt.forall a : t,
is_empty a = true ->
forall b : t,
compare a b = (if is_empty b then Eq else Lt)
  Proof.forall a : t,
is_empty a = true ->
forall b : t,
compare a b = (if is_empty b then Eq else Lt)
    induction a as [|l IHl o r IHr]; trivial.l:tree
o:bool
r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
is_empty (Node l o r) = true ->
forall b : t,
compare (Node l o r) b =
(if is_empty b then Eq else Lt)
    destruct o.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
is_empty (Node l true r) = true ->
forall b : t,
compare (Node l true r) b =
(if is_empty b then Eq else Lt)
l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
is_empty (Node l false r) = true ->
forall b : t,
compare (Node l false r) b =
(if is_empty b then Eq else Lt) intro; discriminate.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
is_empty (Node l false r) = true ->
forall b : t,
compare (Node l false r) b =
(if is_empty b then Eq else Lt)
    simpl is_empty.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
is_empty l &&& is_empty r = true ->
forall b : t,
compare (Node l false r) b =
(if is_empty b then Eq else Lt) rewrite <- andb_lazy_alt, andb_true_iff.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
is_empty l = true /\ is_empty r = true ->
forall b : t,
compare (Node l false r) b =
(if is_empty b then Eq else Lt)
    intros [Hl Hr].l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
forall b : t,
compare (Node l false r) b =
(if is_empty b then Eq else Lt)
    destruct b as [|l' [|] r']; simpl compare; trivial.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
(if is_empty l &&& is_empty r then Eq else Gt) =
(if is_empty Leaf then Eq else Lt)
l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (compare l l') (compare r r') =
(if is_empty (Node l' false r') then Eq else Lt)
     rewrite Hl, Hr.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
Eq = (if is_empty Leaf then Eq else Lt)
l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (compare l l') (compare r r') =
(if is_empty (Node l' false r') then Eq else Lt) trivial.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (compare l l') (compare r r') =
(if is_empty (Node l' false r') then Eq else Lt)
     rewrite (IHl Hl), (IHr Hr).l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (if is_empty l' then Eq else Lt)
  (if is_empty r' then Eq else Lt) =
(if is_empty (Node l' false r') then Eq else Lt) simpl.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (if is_empty l' then Eq else Lt)
  (if is_empty r' then Eq else Lt) =
(if is_empty l' &&& is_empty r' then Eq else Lt)
     case (is_empty l'); case (is_empty r'); trivial.
  Qed.

  Lemma compare_x_empty: forall a, is_empty a = true ->
    forall b, compare b a = if is_empty b then Eq else Gt.forall a : t,
is_empty a = true ->
forall b : t,
compare b a = (if is_empty b then Eq else Gt)
  Proof.forall a : t,
is_empty a = true ->
forall b : t,
compare b a = (if is_empty b then Eq else Gt)
    setoid_rewrite <- compare_x_Leaf.forall a : t,
is_empty a = true ->
forall b : t, compare b a = compare b Leaf
    intros.a:t
H:is_empty a = true
b:t
compare b a = compare b Leaf rewrite 2(compare_inv b), (compare_empty_x _ H).a:t
H:is_empty a = true
b:t
CompOpp (if is_empty b then Eq else Lt) =
CompOpp (compare Leaf b) reflexivity.
  Qed.

  Lemma ct_compare:
    forall a b c, ct (compare a b) (compare b c) (compare a c).forall a b c : t,
ct (compare a b) (compare b c) (compare a c)
  Proof.forall a b c : t,
ct (compare a b) (compare b c) (compare a c)
    induction a as [|l IHl o r IHr]; intros s' s''.s', s'':t
ct (compare Leaf s') (compare s' s'')
  (compare Leaf s'')
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
     destruct s' as [|l' o' r']; destruct s'' as [|l'' o'' r'']; ct.l':tree
o':bool
r':tree
ct (compare Leaf (Node l' o' r'))
  (compare (Node l' o' r') Leaf) (compare Leaf Leaf)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare Leaf (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
      rewrite compare_inv.l':tree
o':bool
r':tree
ct (CompOpp (compare (Node l' o' r') Leaf))
  (compare (Node l' o' r') Leaf) (compare Leaf Leaf)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare Leaf (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'') ct.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare Leaf (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
      unfold compare at 1.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (if is_empty (Node l' o' r') then Eq else Lt)
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'') case_eq (is_empty (Node l' o' r')); intro H'.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = true
ct Eq (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
       rewrite (compare_empty_x _ H').l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = true
ct Eq (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare Leaf (Node l'' o'' r''))
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'') ct.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r''))
  (compare Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
       unfold compare at 2.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r''))
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'') case_eq (is_empty (Node l'' o'' r'')); intro H''.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = true
ct Lt (compare (Node l' o' r') (Node l'' o'' r'')) Eq
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r'')) Lt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
        rewrite (compare_x_empty _ H''), H'.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = true
ct Lt Gt Eq
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r'')) Lt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'') ct.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = false
ct Lt (compare (Node l' o' r') (Node l'' o'' r'')) Lt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')
        ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
s', s'':t
ct (compare (Node l o r) s') (compare s' s'')
  (compare (Node l o r) s'')

     destruct s' as [|l' o' r']; destruct s'' as [|l'' o'' r''].l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
ct (compare (Node l o r) Leaf) (compare Leaf Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) Leaf)
  (compare Leaf (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
      ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) Leaf)
  (compare Leaf (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
      unfold compare at 2.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) Leaf)
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r'')) rewrite compare_x_Leaf.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
ct (if is_empty (Node l o r) then Eq else Gt)
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
      case_eq (is_empty (Node l o r)); intro H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = true
ct Eq (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
ct Gt (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
       rewrite (compare_empty_x _ H).l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = true
ct Eq (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
ct Gt (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
ct Gt (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
       case_eq (is_empty (Node l'' o'' r'')); intro H''.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = true
ct Gt Eq (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = false
ct Gt Lt (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
        rewrite (compare_x_empty _ H''), H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = true
ct Gt Eq Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = false
ct Gt Lt (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = false
ct Gt Lt (compare (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
        ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') Leaf)
  (compare (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))

      rewrite 2 compare_x_Leaf.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
ct (compare (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt)
  (if is_empty (Node l o r) then Eq else Gt)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
      case_eq (is_empty (Node l o r)); intro H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = true
ct (compare (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Eq
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
ct (compare (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
       rewrite compare_inv, (compare_x_empty _ H).l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = true
ct
  (CompOpp
     (if is_empty (Node l' o' r') then Eq else Gt))
  (if is_empty (Node l' o' r') then Eq else Gt) Eq
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
ct (compare (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
ct (compare (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
       case_eq (is_empty (Node l' o' r')); intro H'.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = true
ct (compare (Node l o r) (Node l' o' r')) Eq Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = false
ct (compare (Node l o r) (Node l' o' r')) Gt Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
        rewrite (compare_x_empty _ H'), H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = true
ct Gt Eq Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = false
ct (compare (Node l o r) (Node l' o' r')) Gt Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = false
ct (compare (Node l o r) (Node l' o' r')) Gt Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))
        ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare (Node l o r) (Node l' o' r'))
  (compare (Node l' o' r') (Node l'' o'' r''))
  (compare (Node l o r) (Node l'' o'' r''))

      simpl compare.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct
  (lex (compare_bool o o')
     (lex (compare l l') (compare r r')))
  (lex (compare_bool o' o'')
     (lex (compare l' l'') (compare r' r'')))
  (lex (compare_bool o o'')
     (lex (compare l l'') (compare r r''))) apply ct_lex.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_bool o o') (compare_bool o' o'')
  (compare_bool o o'')
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (lex (compare l l') (compare r r'))
  (lex (compare l' l'') (compare r' r''))
  (lex (compare l l'') (compare r r'')) apply ct_compare_bool.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare l b) (compare b c) (compare l c)
IHr:forall b c : t, ct (compare r b) (compare b c) (compare r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (lex (compare l l') (compare r r'))
  (lex (compare l' l'') (compare r' r''))
  (lex (compare l l'') (compare r r''))
       apply ct_lex; trivial.
  Qed.

  End lt_spec.

  Instance lt_strorder : StrictOrder lt.StrictOrder lt
  Proof.StrictOrder lt
   unfold lt.StrictOrder (fun m m' : t => compare m m' = Lt) split.Irreflexive (fun m m' : t => compare m m' = Lt)
Transitive (fun m m' : t => compare m m' = Lt)
   intros x H.x:t
H:compare x x = Lt
False
Transitive (fun m m' : t => compare m m' = Lt)
   assert (compare x x = Eq).x:t
H:compare x x = Lt
compare x x = Eq
x:t
H:compare x x = Lt
H0:compare x x = Eq
False
Transitive (fun m m' : t => compare m m' = Lt)
    apply compare_equal, equal_spec.x:t
H:compare x x = Lt
x [=] x
x:t
H:compare x x = Lt
H0:compare x x = Eq
False
Transitive (fun m m' : t => compare m m' = Lt) reflexivity.x:t
H:compare x x = Lt
H0:compare x x = Eq
False
Transitive (fun m m' : t => compare m m' = Lt)
   congruence.Transitive (fun m m' : t => compare m m' = Lt)
   intros a b c.a, b, c:t
compare a b = Lt ->
compare b c = Lt -> compare a c = Lt assert (H := ct_compare a b c).a, b, c:t
H:ct (compare a b) (compare b c) (compare a c)
compare a b = Lt ->
compare b c = Lt -> compare a c = Lt
    inversion_clear H; trivial; intros; discriminate.
  Qed.

  Instance compare_compat_1 : Proper (eq==>Logic.eq==>Logic.eq) compare.Proper (eq ==> Logic.eq ==> Logic.eq) compare
  Proof.Proper (eq ==> Logic.eq ==> Logic.eq) compare
   intros x x' Hx y y' Hy.x, x':t
Hx:eq x x'
y, y':t
Hy:y = y'
compare x y = compare x' y' subst y'.x, x':t
Hx:eq x x'
y:t
compare x y = compare x' y
   unfold eq in *.x, x':t
Hx:x [=] x'
y:t
compare x y = compare x' y rewrite <- equal_spec, <- compare_equal in *.x, x':t
Hx:compare x x' = Eq
y:t
compare x y = compare x' y
   assert (C:=ct_compare x x' y).x, x':t
Hx:compare x x' = Eq
y:t
C:ct (compare x x') (compare x' y) (compare x y)
compare x y = compare x' y rewrite Hx in C.x, x':t
Hx:compare x x' = Eq
y:t
C:ct Eq (compare x' y) (compare x y)
compare x y = compare x' y inversion C; auto.
  Qed.

  Instance compare_compat : Proper (eq==>eq==>Logic.eq) compare.Proper (eq ==> eq ==> Logic.eq) compare
  Proof.Proper (eq ==> eq ==> Logic.eq) compare
   intros x x' Hx y y' Hy.x, x':t
Hx:eq x x'
y, y':t
Hy:eq y y'
compare x y = compare x' y' rewrite Hx.x, x':t
Hx:eq x x'
y, y':t
Hy:eq y y'
compare x' y = compare x' y'
   rewrite compare_inv, Hy, <- compare_inv.x, x':t
Hx:eq x x'
y, y':t
Hy:eq y y'
compare x' y' = compare x' y' reflexivity.
  Qed.

  Instance lt_compat : Proper (eq==>eq==>iff) lt.Proper (eq ==> eq ==> iff) lt
  Proof.Proper (eq ==> eq ==> iff) lt
   intros x x' Hx y y' Hy.x, x':t
Hx:eq x x'
y, y':t
Hy:eq y y'
lt x y <-> lt x' y' unfold lt.x, x':t
Hx:eq x x'
y, y':t
Hy:eq y y'
compare x y = Lt <-> compare x' y' = Lt rewrite Hx, Hy.x, x':t
Hx:eq x x'
y, y':t
Hy:eq y y'
compare x' y' = Lt <-> compare x' y' = Lt intuition.
  Qed.

Specification of add

  Lemma add_spec: forall s x y, In y (add x s) <-> y=x \/ In y s.forall (s : t) (x y : positive),
In y (add x s) <-> y = x \/ In y s
  Proof.forall (s : t) (x y : positive),
In y (add x s) <-> y = x \/ In y s
    unfold In.forall (s : t) (x y : positive),
mem y (add x s) = true <-> y = x \/ mem y s = true intros s x y; revert x y s.forall (x y : positive) (s : t),
mem y (add x s) = true <-> y = x \/ mem y s = true
    induction x; intros [y|y|] [|l o r]; simpl mem;
    try (rewrite IHx; clear IHx); rewrite ?mem_Leaf; intuition congruence.
  Qed.

Specification of remove

  Lemma remove_spec: forall s x y, In y (remove x s) <-> In y s /\ y<>x.forall (s : t) (x y : positive),
In y (remove x s) <-> In y s /\ y <> x
  Proof.forall (s : t) (x y : positive),
In y (remove x s) <-> In y s /\ y <> x
    unfold In.forall (s : t) (x y : positive),
mem y (remove x s) = true <-> mem y s = true /\ y <> x intros s x y; revert x y s.forall (x y : positive) (s : t),
mem y (remove x s) = true <-> mem y s = true /\ y <> x
    induction x; intros [y|y|] [|l o r]; simpl remove; rewrite ?mem_node;
     simpl mem; try (rewrite IHx; clear IHx); rewrite ?mem_Leaf;
     intuition congruence.
  Qed.

Specification of singleton

  Lemma singleton_spec : forall x y, In y (singleton x) <-> y=x.forall x y : positive, In y (singleton x) <-> y = x
  Proof.forall x y : positive, In y (singleton x) <-> y = x
    unfold singleton.forall x y : positive, In y (add x empty) <-> y = x intros x y.x, y:positive
In y (add x empty) <-> y = x rewrite add_spec.x, y:positive
y = x \/ In y empty <-> y = x intuition.x, y:positive
H0:In y empty
y = x
    unfold In in *.x, y:positive
H0:mem y empty = true
y = x rewrite mem_Leaf in *.x, y:positive
H0:false = true
y = x discriminate.
  Qed.

Specification of union

  Lemma union_spec: forall s s' x, In x (union s s') <-> In x s \/ In x s'.forall (s s' : t) (x : positive),
In x (union s s') <-> In x s \/ In x s'
  Proof.forall (s s' : t) (x : positive),
In x (union s s') <-> In x s \/ In x s'
    unfold In.forall (s s' : t) (x : positive),
mem x (union s s') = true <->
mem x s = true \/ mem x s' = true intros s s' x; revert x s s'.forall (x : positive) (s s' : t),
mem x (union s s') = true <->
mem x s = true \/ mem x s' = true
    induction x; destruct s; destruct s'; simpl union; simpl mem;
      try (rewrite IHx; clear IHx); try intuition congruence.s1:tree
b:bool
s2, s'1:tree
b0:bool
s'2:tree
b || b0 = true <-> b = true \/ b0 = true
      apply orb_true_iff.
  Qed.

Specification of inter

  Lemma inter_spec: forall s s' x, In x (inter s s') <-> In x s /\ In x s'.forall (s s' : t) (x : positive),
In x (inter s s') <-> In x s /\ In x s'
  Proof.forall (s s' : t) (x : positive),
In x (inter s s') <-> In x s /\ In x s'
    unfold In.forall (s s' : t) (x : positive),
mem x (inter s s') = true <->
mem x s = true /\ mem x s' = true intros s s' x; revert x s s'.forall (x : positive) (s s' : t),
mem x (inter s s') = true <->
mem x s = true /\ mem x s' = true
    induction x; destruct s; destruct s'; simpl inter; rewrite ?mem_node;
     simpl mem; try (rewrite IHx; clear IHx); try intuition congruence.s1:tree
b:bool
s2, s'1:tree
b0:bool
s'2:tree
b && b0 = true <-> b = true /\ b0 = true
     apply andb_true_iff.
  Qed.

Specification of diff

  Lemma diff_spec: forall s s' x, In x (diff s s') <-> In x s /\ ~ In x s'.forall (s s' : t) (x : positive),
In x (diff s s') <-> In x s /\ ~ In x s'
  Proof.forall (s s' : t) (x : positive),
In x (diff s s') <-> In x s /\ ~ In x s'
    unfold In.forall (s s' : t) (x : positive),
mem x (diff s s') = true <->
mem x s = true /\ mem x s' <> true intros s s' x; revert x s s'.forall (x : positive) (s s' : t),
mem x (diff s s') = true <->
mem x s = true /\ mem x s' <> true
    induction x; destruct s; destruct s' as [|l' o' r']; simpl diff;
     rewrite ?mem_node; simpl mem;
      try (rewrite IHx; clear IHx); try intuition congruence.s1:tree
b:bool
s2, l':tree
o':bool
r':tree
b && negb o' = true <-> b = true /\ o' <> true
      rewrite andb_true_iff.s1:tree
b:bool
s2, l':tree
o':bool
r':tree
b = true /\ negb o' = true <-> b = true /\ o' <> true destruct o'; intuition discriminate.
  Qed.

Specification of fold

  Lemma fold_spec: forall s (A : Type) (i : A) (f : elt -> A -> A),
      fold f s i = fold_left (fun a e => f e a) (elements s) i.forall (s : t) (A : Type) (i : A) (f : elt -> A -> A),
fold f s i =
fold_left (fun (a : A) (e : elt) => f e a)
  (elements s) i
  Proof.forall (s : t) (A : Type) (i : A) (f : elt -> A -> A),
fold f s i =
fold_left (fun (a : A) (e : elt) => f e a)
  (elements s) i
    unfold fold, elements.forall (s : t) (A : Type) (i : A) (f : elt -> A -> A),
xfold f s i 1 =
fold_left (fun (a : A) (e : elt) => f e a)
  (xelements s 1 nil) i intros s A i f.s:t
A:Type
i:A
f:elt -> A -> A
xfold f s i 1 =
fold_left (fun (a : A) (e : elt) => f e a)
  (xelements s 1 nil) i revert s i.A:Type
f:elt -> A -> A
forall (s : t) (i : A),
xfold f s i 1 =
fold_left (fun (a : A) (e : elt) => f e a)
  (xelements s 1 nil) i
    set (f' := fun a e => f e a).A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
    assert (H: forall s i j acc,
      fold_left f' acc (xfold f s i j) =
      fold_left f' (xelements s j acc) i).A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
forall (s : t) (i : A) (j : positive) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i

    induction s as [|l IHl o r IHr]; intros; trivial.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l:tree
o:bool
r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' acc (xfold f (Node l o r) i j) =
fold_left f' (xelements (Node l o r) j acc) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
      destruct o; simpl xelements; simpl xfold.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' acc
  (xfold f r (f (rev j) (xfold f l i j~0)) j~1) =
fold_left f'
  (xelements l j~0 (rev j :: xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' acc (xfold f r (xfold f l i j~0) j~1) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
        rewrite IHr, <- IHl.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' (xelements r j~1 acc)
  (f (rev j) (xfold f l i j~0)) =
fold_left f' (rev j :: xelements r j~1 acc)
  (xfold f l i j~0)
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' acc (xfold f r (xfold f l i j~0) j~1) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i reflexivity.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' acc (xfold f r (xfold f l i j~0) j~1) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
        rewrite IHr.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : positive) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:positive
acc:list elt
fold_left f' (xelements r j~1 acc) (xfold f l i j~0) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i apply IHl.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i

    intros.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s0 : t) (i0 : A) (j : positive)
  (acc : list elt),
fold_left f' acc (xfold f s0 i0 j) =
fold_left f' (xelements s0 j acc) i0
s:t
i:A
xfold f s i 1 = fold_left f' (xelements s 1 nil) i exact (H s i 1 nil).
  Qed.

Specification of cardinal

  Lemma cardinal_spec: forall s, cardinal s = length (elements s).forall s : t, cardinal s = length (elements s)
  Proof.forall s : t, cardinal s = length (elements s)
    unfold elements.forall s : t, cardinal s = length (xelements s 1 nil)
    assert (H: forall s j acc,
                (cardinal s + length acc)%nat = length (xelements s j acc)).forall (s : t) (j : positive) (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)

    induction s as [|l IHl b r IHr]; intros j acc; simpl; trivial.l:tree
b:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
((if b
  then S (cardinal l + cardinal r)
  else cardinal l + cardinal r) + length acc)%nat =
length
  (if b
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) destruct b.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(S (cardinal l + cardinal r) + length acc)%nat =
length
  (xelements l j~0 (rev j :: xelements r j~1 acc))
l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)
      rewrite <- IHl.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(S (cardinal l + cardinal r) + length acc)%nat =
(cardinal l + length (rev j :: xelements r j~1 acc))%nat
l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) simpl.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
S (cardinal l + cardinal r + length acc) =
(cardinal l + S (length (xelements r j~1 acc)))%nat
l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) rewrite <- IHr.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
S (cardinal l + cardinal r + length acc) =
(cardinal l + S (cardinal r + length acc))%nat
l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)
       rewrite <- plus_n_Sm, Plus.plus_assoc.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
S (cardinal l + cardinal r + length acc) =
S (cardinal l + cardinal r + length acc)
l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) reflexivity.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)
      rewrite <- IHl, <- IHr.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
(cardinal l + (cardinal r + length acc))%nat
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) rewrite Plus.plus_assoc.l, r:tree
IHl:forall (j0 : positive) (acc0 : list positive),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : positive) (acc0 : list positive),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:positive
acc:list positive
(cardinal l + cardinal r + length acc)%nat =
(cardinal l + cardinal r + length acc)%nat
H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) reflexivity.H:forall (s : t) (j : positive)
  (acc : list positive),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)

    intros.H:forall (s0 : t) (j : positive)
  (acc : list positive),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = length (xelements s 1 nil) rewrite <- H.H:forall (s0 : t) (j : positive)
  (acc : list positive),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = (cardinal s + length nil)%nat simpl.H:forall (s0 : t) (j : positive)
  (acc : list positive),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = (cardinal s + 0)%nat rewrite Plus.plus_comm.H:forall (s0 : t) (j : positive)
  (acc : list positive),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = (0 + cardinal s)%nat reflexivity.
  Qed.

Specification of filter

  Lemma xfilter_spec: forall f s x i,
    In x (xfilter f s i) <-> In x s /\ f (i@x) = true.forall (f : positive -> bool) (s : t) (x i : positive),
In x (xfilter f s i) <-> In x s /\ f (i @ x) = true
  Proof.forall (f : positive -> bool) (s : t) (x i : positive),
In x (xfilter f s i) <-> In x s /\ f (i @ x) = true
    intro f.f:positive -> bool
forall (s : t) (x i : positive),
In x (xfilter f s i) <-> In x s /\ f (i @ x) = true unfold In.f:positive -> bool
forall (s : t) (x i : positive),
mem x (xfilter f s i) = true <->
mem x s = true /\ f (i @ x) = true
    induction s as [|l IHl o r IHr]; intros x i; simpl xfilter.f:positive -> bool
x, i:positive
mem x Leaf = true <->
mem x Leaf = true /\ f (i @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x
  (node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true
     rewrite mem_Leaf.f:positive -> bool
x, i:positive
false = true <-> false = true /\ f (i @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x
  (node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true intuition discriminate.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x
  (node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true
     rewrite mem_node.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x
  (Node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true destruct x; simpl.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x (xfilter f r i~1) = true <->
mem x r = true /\ f (i @ x~1) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x (xfilter f l i~0) = true <->
mem x l = true /\ f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : positive,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : positive,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:positive
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true
       rewrite IHr.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x r = true /\ f (i~1 @ x) = true <->
mem x r = true /\ f (i @ x~1) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x (xfilter f l i~0) = true <->
mem x l = true /\ f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : positive,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : positive,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:positive
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true reflexivity.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x (xfilter f l i~0) = true <->
mem x l = true /\ f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : positive,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : positive,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:positive
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true
       rewrite IHl.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : positive,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : positive,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:positive
mem x l = true /\ f (i~0 @ x) = true <->
mem x l = true /\ f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : positive,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : positive,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:positive
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true reflexivity.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : positive,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : positive,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:positive
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true
       rewrite <- andb_lazy_alt.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : positive,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : positive,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:positive
o && f (rev i) = true <-> o = true /\ f (i @ 1) = true apply andb_true_iff.
  Qed.

  Lemma filter_spec: forall s x f, @compat_bool elt E.eq f ->
    (In x (filter f s) <-> In x s /\ f x = true).forall (s : t) (x : positive) (f : elt -> bool),
compat_bool E.eq f ->
In x (filter f s) <-> In x s /\ f x = true
  Proof.forall (s : t) (x : positive) (f : elt -> bool),
compat_bool E.eq f ->
In x (filter f s) <-> In x s /\ f x = true intros.s:t
x:positive
f:elt -> bool
H:compat_bool E.eq f
In x (filter f s) <-> In x s /\ f x = true apply xfilter_spec. Qed.

Specification of for_all

  Lemma xforall_spec: forall f s i,
    xforall f s i = true <-> For_all (fun x => f (i@x) = true) s.forall (f : positive -> bool) (s : t) (i : positive),
xforall f s i = true <->
For_all (fun x : elt => f (i @ x) = true) s
  Proof.forall (f : positive -> bool) (s : t) (i : positive),
xforall f s i = true <->
For_all (fun x : elt => f (i @ x) = true) s
    unfold For_all, In.forall (f : positive -> bool) (s : t) (i : positive),
xforall f s i = true <->
(forall x : positive,
 mem x s = true -> f (i @ x) = true) intro f.f:positive -> bool
forall (s : t) (i : positive),
xforall f s i = true <->
(forall x : positive,
 mem x s = true -> f (i @ x) = true)
    induction s as [|l IHl o r IHr]; intros i; simpl.f:positive -> bool
i:positive
true = true <->
(forall x : positive, false = true -> f (i @ x) = true)
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xforall f l i0 = true <->
(forall x : positive, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : positive,
xforall f r i0 = true <->
(forall x : positive, mem x r = true -> f (i0 @ x) = true)
i:positive
(negb o ||| f (rev i)) &&& xforall f r i~1 &&&
xforall f l i~0 = true <->
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
    intuition discriminate.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xforall f l i0 = true <->
(forall x : positive, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : positive,
xforall f r i0 = true <->
(forall x : positive, mem x r = true -> f (i0 @ x) = true)
i:positive
(negb o ||| f (rev i)) &&& xforall f r i~1 &&&
xforall f l i~0 = true <->
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
     rewrite <- 2andb_lazy_alt, <- orb_lazy_alt, 2 andb_true_iff.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xforall f l i0 = true <->
(forall x : positive, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : positive,
xforall f r i0 = true <->
(forall x : positive, mem x r = true -> f (i0 @ x) = true)
i:positive
(negb o || f (rev i) = true /\ xforall f r i~1 = true) /\
xforall f l i~0 = true <->
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
     rewrite IHl, IHr.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xforall f l i0 = true <->
(forall x : positive, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : positive,
xforall f r i0 = true <->
(forall x : positive, mem x r = true -> f (i0 @ x) = true)
i:positive
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true) <->
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) clear IHl IHr.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true) <->
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
      split.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true) ->
forall x : positive,
match x with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true)
       intros [[Hi Hr] Hl] x.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x0 : positive,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : positive,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
match x with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true) destruct x; simpl; intro H.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x0 : positive,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : positive,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
H:mem x r = true
f (i @ x~1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x0 : positive,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : positive,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
H:mem x l = true
f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x : positive,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : positive,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true)
        apply Hr, H.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x0 : positive,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : positive,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
H:mem x l = true
f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x : positive,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : positive,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true)
        apply Hl, H.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb o || f (rev i) = true
Hr:forall x : positive,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : positive,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true)
        rewrite H in Hi.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:negb true || f (rev i) = true
Hr:forall x : positive,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : positive,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true) assumption.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(forall x : positive,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : positive,
  mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : positive,
 mem x l = true -> f (i~0 @ x) = true)
       intro H; intuition.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x : positive,
match x with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x) = true
negb o || f (rev i) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
f (i~1 @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true
        specialize (H 1).f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:match 1 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ 1) = true
negb o || f (rev i) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
f (i~1 @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true destruct o.f:positive -> bool
l, r:tree
i:positive
H:true = true -> f (i @ 1) = true
negb true || f (rev i) = true
f:positive -> bool
l, r:tree
i:positive
H:false = true -> f (i @ 1) = true
negb false || f (rev i) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
f (i~1 @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true apply H.f:positive -> bool
l, r:tree
i:positive
H:true = true -> f (i @ 1) = true
true = true
f:positive -> bool
l, r:tree
i:positive
H:false = true -> f (i @ 1) = true
negb false || f (rev i) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
f (i~1 @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true reflexivity.f:positive -> bool
l, r:tree
i:positive
H:false = true -> f (i @ 1) = true
negb false || f (rev i) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
f (i~1 @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true reflexivity.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
f (i~1 @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true
        apply H.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x r = true
mem x r = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true assumption.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
f (i~0 @ x) = true
        apply H.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
H:forall x0 : positive,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:positive
H0:mem x l = true
mem x l = true assumption.
  Qed.

  Lemma for_all_spec: forall s f, @compat_bool elt E.eq f ->
    (for_all f s = true <-> For_all (fun x => f x = true) s).forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
for_all f s = true <->
For_all (fun x : elt => f x = true) s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
for_all f s = true <->
For_all (fun x : elt => f x = true) s intros.s:t
f:elt -> bool
H:compat_bool E.eq f
for_all f s = true <->
For_all (fun x : elt => f x = true) s apply xforall_spec. Qed.

Specification of ∃

  Lemma xexists_spec: forall f s i,
    xexists f s i = true <-> Exists (fun x => f (i@x) = true) s.forall (f : positive -> bool) (s : t) (i : positive),
xexists f s i = true <->
Exists (fun x : elt => f (i @ x) = true) s
  Proof.forall (f : positive -> bool) (s : t) (i : positive),
xexists f s i = true <->
Exists (fun x : elt => f (i @ x) = true) s
    unfold Exists, In.forall (f : positive -> bool) (s : t) (i : positive),
xexists f s i = true <->
(exists x : positive,
   mem x s = true /\ f (i @ x) = true) intro f.f:positive -> bool
forall (s : t) (i : positive),
xexists f s i = true <->
(exists x : positive,
   mem x s = true /\ f (i @ x) = true)
    induction s as [|l IHl o r IHr]; intros i; simpl.f:positive -> bool
i:positive
false = true <->
(exists x : positive, false = true /\ f (i @ x) = true)
f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xexists f l i0 = true <->
(exists x : positive, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : positive,
xexists f r i0 = true <->
(exists x : positive, mem x r = true /\ f (i0 @ x) = true)
i:positive
o &&& f (rev i) ||| xexists f r i~1
||| xexists f l i~0 = true <->
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
     firstorder.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xexists f l i0 = true <->
(exists x : positive, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : positive,
xexists f r i0 = true <->
(exists x : positive, mem x r = true /\ f (i0 @ x) = true)
i:positive
o &&& f (rev i) ||| xexists f r i~1
||| xexists f l i~0 = true <->
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
     rewrite <- 2orb_lazy_alt, 2orb_true_iff, <- andb_lazy_alt, andb_true_iff.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xexists f l i0 = true <->
(exists x : positive, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : positive,
xexists f r i0 = true <->
(exists x : positive, mem x r = true /\ f (i0 @ x) = true)
i:positive
(o = true /\ f (rev i) = true \/
 xexists f r i~1 = true) \/ xexists f l i~0 = true <->
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
     rewrite IHl, IHr.f:positive -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : positive,
xexists f l i0 = true <->
(exists x : positive, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : positive,
xexists f r i0 = true <->
(exists x : positive, mem x r = true /\ f (i0 @ x) = true)
i:positive
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true) <->
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) clear IHl IHr.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true) <->
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
      split.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true) ->
exists x : positive,
  match x with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true)
       intros [[Hi|[x Hr]]|[x Hl]].f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:o = true /\ f (rev i) = true
exists x : positive,
  match x with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x) = true
f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hr:mem x r = true /\ f (i~1 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true)
        exists 1.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
Hi:o = true /\ f (rev i) = true
o = true /\ f (i @ 1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hr:mem x r = true /\ f (i~1 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true) exact Hi.f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hr:mem x r = true /\ f (i~1 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true)
        exists x~1.f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hr:mem x r = true /\ f (i~1 @ x) = true
mem x r = true /\ f (i @ x~1) = true
f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true) exact Hr.f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : positive,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true)
        exists x~0.f:positive -> bool
l:tree
o:bool
r:tree
i, x:positive
Hl:mem x l = true /\ f (i~0 @ x) = true
mem x l = true /\ f (i @ x~0) = true
f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true) exact Hl.f:positive -> bool
l:tree
o:bool
r:tree
i:positive
(exists x : positive,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : positive,
    mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : positive,
   mem x l = true /\ f (i~0 @ x) = true)
       intros [[x|x|] H]; eauto.
  Qed.

  Lemma exists_spec : forall s f, @compat_bool elt E.eq f ->
    (exists_ f s = true <-> Exists (fun x => f x = true) s).forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
exists_ f s = true <->
Exists (fun x : elt => f x = true) s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
exists_ f s = true <->
Exists (fun x : elt => f x = true) s intros.s:t
f:elt -> bool
H:compat_bool E.eq f
exists_ f s = true <->
Exists (fun x : elt => f x = true) s apply xexists_spec. Qed.

Specification of partition

  Lemma partition_filter : forall s f,
    partition f s = (filter f s, filter (fun x => negb (f x)) s).forall (s : t) (f : positive -> bool),
partition f s =
(filter f s,
filter (fun x : positive => negb (f x)) s)
  Proof.forall (s : t) (f : positive -> bool),
partition f s =
(filter f s,
filter (fun x : positive => negb (f x)) s)
    unfold partition, filter.forall (s : t) (f : positive -> bool),
xpartition f s 1 =
(xfilter f s 1,
xfilter (fun x : positive => negb (f x)) s 1) intros s f.s:t
f:positive -> bool
xpartition f s 1 =
(xfilter f s 1,
xfilter (fun x : positive => negb (f x)) s 1) generalize 1 as j.s:t
f:positive -> bool
forall j : positive,
xpartition f s j =
(xfilter f s j,
xfilter (fun x : positive => negb (f x)) s j)
    induction s as [|l IHl o r IHr]; intro j.f:positive -> bool
j:positive
xpartition f Leaf j =
(xfilter f Leaf j,
xfilter (fun x : positive => negb (f x)) Leaf j)
l:tree
o:bool
r:tree
f:positive -> bool
IHl:forall j0 : positive,
xpartition f l j0 =
(xfilter f l j0, xfilter (fun x : positive => negb (f x)) l j0)
IHr:forall j0 : positive,
xpartition f r j0 =
(xfilter f r j0, xfilter (fun x : positive => negb (f x)) r j0)
j:positive
xpartition f (Node l o r) j =
(xfilter f (Node l o r) j,
xfilter (fun x : positive => negb (f x)) (Node l o r)
  j)
      reflexivity.l:tree
o:bool
r:tree
f:positive -> bool
IHl:forall j0 : positive,
xpartition f l j0 =
(xfilter f l j0, xfilter (fun x : positive => negb (f x)) l j0)
IHr:forall j0 : positive,
xpartition f r j0 =
(xfilter f r j0, xfilter (fun x : positive => negb (f x)) r j0)
j:positive
xpartition f (Node l o r) j =
(xfilter f (Node l o r) j,
xfilter (fun x : positive => negb (f x)) (Node l o r)
  j)
      destruct o; simpl; rewrite IHl, IHr; reflexivity.
  Qed.

  Lemma partition_spec1 : forall s f, @compat_bool elt E.eq f ->
      Equal (fst (partition f s)) (filter f s).forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
fst (partition f s) [=] filter f s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
fst (partition f s) [=] filter f s intros.s:t
f:elt -> bool
H:compat_bool E.eq f
fst (partition f s) [=] filter f s rewrite partition_filter.s:t
f:elt -> bool
H:compat_bool E.eq f
fst
  (filter f s,
  filter (fun x : positive => negb (f x)) s) [=]
filter f s reflexivity. Qed.

  Lemma partition_spec2 : forall s f, @compat_bool elt E.eq f ->
      Equal (snd (partition f s)) (filter (fun x => negb (f x)) s).forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
snd (partition f s) [=]
filter (fun x : positive => negb (f x)) s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
snd (partition f s) [=]
filter (fun x : positive => negb (f x)) s intros.s:t
f:elt -> bool
H:compat_bool E.eq f
snd (partition f s) [=]
filter (fun x : positive => negb (f x)) s rewrite partition_filter.s:t
f:elt -> bool
H:compat_bool E.eq f
snd
  (filter f s,
  filter (fun x : positive => negb (f x)) s) [=]
filter (fun x : positive => negb (f x)) s reflexivity. Qed.

Specification of elements

  Notation InL := (InA E.eq).

  Lemma xelements_spec: forall s j acc y,
    InL y (xelements s j acc)
    <->
    InL y acc \/ exists x, y=(j@x) /\ mem x s = true.forall (s : t) (j : positive) (acc : list positive)
  (y : positive),
InL y (xelements s j acc) <->
InL y acc \/
(exists x : elt, y = j @ x /\ mem x s = true)
  Proof.forall (s : t) (j : positive) (acc : list positive)
  (y : positive),
InL y (xelements s j acc) <->
InL y acc \/
(exists x : elt, y = j @ x /\ mem x s = true)
    induction s as [|l IHl o r IHr]; simpl.forall (j : positive) (acc : list positive)
  (y : positive),
InL y acc <->
InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)
      intros.j:positive
acc:list positive
y:positive
InL y acc <->
InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) split; intro H.j:positive
acc:list positive
y:positive
H:InL y acc
InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
j:positive
acc:list positive
y:positive
H:InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)
        left.j:positive
acc:list positive
y:positive
H:InL y acc
InL y acc
j:positive
acc:list positive
y:positive
H:InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) assumption.j:positive
acc:list positive
y:positive
H:InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)
        destruct H as [H|[x [Hx Hx']]].j:positive
acc:list positive
y:positive
H:InL y acc
InL y acc
j:positive
acc:list positive
y:positive
x:elt
Hx:y = j @ x
Hx':false = true
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) assumption.j:positive
acc:list positive
y:positive
x:elt
Hx:y = j @ x
Hx':false = true
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) discriminate.l:tree
o:bool
r:tree
IHl:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : positive) (acc : list positive) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : positive) (acc : list positive)
  (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)

      intros j acc y.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) case o.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (rev j :: xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
        rewrite IHl.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (rev j :: xelements r j~1 acc) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) rewrite InA_cons.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
(E.eq y (rev j) \/ InL y (xelements r j~1 acc)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) rewrite IHr.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) clear IHl IHr.l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) split.l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) ->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
          intros [[H|[H|[x [-> H]]]]|[x [-> H]]]; eauto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
InL (j~1 @ x) acc \/
(exists x0 : elt,
   j~1 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
exists x0 : elt,
  j~1 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => true
  end = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x~1.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
j~1 @ x = j @ x~1 /\ mem x r = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
exists x0 : elt,
  j~0 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => true
  end = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x~0.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
j~0 @ x = j @ x~0 /\ mem x l = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
          intros [H|[x [-> H]]].l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
H:InL y acc
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
(E.eq (j @ x) (rev j) \/
 InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            eauto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
(E.eq (j @ x) (rev j) \/
 InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            destruct x.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
(E.eq (j @ x~1) (rev j) \/
 InL (j @ x~1) acc \/
 (exists x0 : elt,
    j @ x~1 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~1 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
              left.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
E.eq (j @ x~1) (rev j) \/
InL (j @ x~1) acc \/
(exists x0 : elt,
   j @ x~1 = j~1 @ x0 /\ mem x0 r = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
InL (j @ x~1) acc \/
(exists x0 : elt,
   j @ x~1 = j~1 @ x0 /\ mem x0 r = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
exists x0 : elt, j @ x~1 = j~1 @ x0 /\ mem x0 r = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x; auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
              right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
exists x0 : elt, j @ x~0 = j~0 @ x0 /\ mem x0 l = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x; auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
              left.l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
E.eq (j @ 1) (rev j) \/
InL (j @ 1) acc \/
(exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) left.l:tree
o:bool
r:tree
j:positive
acc:list positive
H:true = true
E.eq (j @ 1) (rev j)
l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) reflexivity.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)

        rewrite IHl, IHr.l:tree
o:bool
r:tree
IHl:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : positive) (acc0 : list positive) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:positive
acc:list positive
y:positive
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) clear IHl IHr.l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) split.l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) ->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
          intros [[H|[x [-> H]]]|[x [-> H]]].l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
H:InL y acc
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
InL (j~1 @ x) acc \/
(exists x0 : elt,
   j~1 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
            eauto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
InL (j~1 @ x) acc \/
(exists x0 : elt,
   j~1 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
            right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
exists x0 : elt,
  j~1 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => false
  end = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) exists x~1.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x r = true
j~1 @ x = j @ x~1 /\ mem x r = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
            right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
exists x0 : elt,
  j~0 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => false
  end = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) exists x~0.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:mem x l = true
j~0 @ x = j @ x~0 /\ mem x l = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
          intros [H|[x [-> H]]].l:tree
o:bool
r:tree
j:positive
acc:list positive
y:positive
H:InL y acc
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
(InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
            eauto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
(InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
            destruct x.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
(InL (j @ x~1) acc \/
 (exists x0 : elt,
    j @ x~1 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~1 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
              left.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
InL (j @ x~1) acc \/
(exists x0 : elt,
   j @ x~1 = j~1 @ x0 /\ mem x0 r = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true) right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x r = true
exists x0 : elt, j @ x~1 = j~1 @ x0 /\ mem x0 r = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)  exists x; auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
              right.l:tree
o:bool
r:tree
j:positive
acc:list positive
x:positive
H:mem x l = true
exists x0 : elt, j @ x~0 = j~0 @ x0 /\ mem x0 l = true
l:tree
o:bool
r:tree
j:positive
acc:list positive
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true) exists x; auto.l:tree
o:bool
r:tree
j:positive
acc:list positive
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
              discriminate.
  Qed.

  Lemma elements_spec1: forall s x, InL x (elements s) <-> In x s.forall (s : t) (x : positive),
InL x (elements s) <-> In x s
  Proof.forall (s : t) (x : positive),
InL x (elements s) <-> In x s
   unfold elements.forall (s : t) (x : positive),
InL x (xelements s 1 nil) <-> In x s intros.s:t
x:positive
InL x (xelements s 1 nil) <-> In x s rewrite xelements_spec.s:t
x:positive
InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true) <->
In x s
   split; [ intros [A|(y & B & C)] | intros IN ].s:t
x:positive
A:InL x nil
In x s
s:t
x:positive
y:elt
B:x = 1 @ y
C:mem y s = true
In x s
s:t
x:positive
IN:In x s
InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true)
   inversion A.s:t
x:positive
y:elt
B:x = 1 @ y
C:mem y s = true
In x s
s:t
x:positive
IN:In x s
InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true) simpl in *.s:t
x:positive
y:elt
B:x = y
C:mem y s = true
In x s
s:t
x:positive
IN:In x s
InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true) congruence.s:t
x:positive
IN:In x s
InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true)
   right.s:t
x:positive
IN:In x s
exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true exists x.s:t
x:positive
IN:In x s
x = 1 @ x /\ mem x s = true auto.
  Qed.

  Lemma lt_rev_append: forall j x y, E.lt x y -> E.lt (j@x) (j@y).forall (j : elt) (x y : positive),
E.lt x y -> E.lt (j @ x) (j @ y)
  Proof.forall (j : elt) (x y : positive),
E.lt x y -> E.lt (j @ x) (j @ y) induction j; intros; simpl; auto. Qed.

  Lemma elements_spec2: forall s, sort E.lt (elements s).forall s : t, Sorted E.lt (elements s)
  Proof.forall s : t, Sorted E.lt (elements s)
    unfold elements.forall s : t, Sorted E.lt (xelements s 1 nil)
    assert (H: forall s j acc,
      sort E.lt acc ->
      (forall x y, In x s ->  InL y acc -> E.lt (j@x) y) ->
      sort E.lt (xelements s j acc)).forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)

    induction s as [|l IHl o r IHr]; simpl; trivial.l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive, In x l -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements l j acc)
IHr:forall (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive, In x r -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements r j acc)
forall (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x (Node l o r) -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
    intros j acc Hacc Hsacc.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l o r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) destruct o.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt
  (xelements l j~0 (rev j :: xelements r j~1 acc))
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
      apply IHl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (rev j :: xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       apply IHr.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt acc
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hacc.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x r
Hy:InL y acc
E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       case_eq (xelements r j~1 acc).l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
xelements r j~1 acc = nil -> HdRel E.lt (rev j) nil
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (p : positive) (l0 : list positive),
xelements r j~1 acc = p :: l0 ->
HdRel E.lt (rev j) (p :: l0)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (p : positive) (l0 : list positive),
xelements r j~1 acc = p :: l0 ->
HdRel E.lt (rev j) (p :: l0)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros z q H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
HdRel E.lt (rev j) (z :: q)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       assert (H': InL z (xelements r j~1 acc)).l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
InL z (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
        rewrite H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
InL z (z :: q)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
E.eq z z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) reflexivity.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
q:list positive
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       clear H q.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) rewrite xelements_spec in H'.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
H':InL z acc \/
(exists x : elt, z = j~1 @ x /\ mem x r = true)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) destruct H' as [Hy|[x [-> Hx]]].l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
Hy:InL z acc
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j~1 @ x)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         apply (Hsacc 1 z); trivial.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:positive
Hy:InL z acc
In 1 (Node l true r)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j~1 @ x)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) reflexivity.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j~1 @ x)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j @ x~1)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt 1 x~1
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
Hy:InL y (rev j :: xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) inversion_clear Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         rewrite H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt (j~0 @ x) (rev j)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt (j @ x~0) (rev j)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt x~0 1
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive,
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         rewrite xelements_spec in H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
H:InL y acc \/
(exists x0 : elt, y = j~1 @ x0 /\ mem x0 r = true)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) destruct H as [Hy|[z [-> Hy]]].l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
Hy:InL y acc
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
           apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
           simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j @ x~0) (j @ z~1)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt x~0 z~1
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)

      apply IHl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply IHr.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt acc
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hacc.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x r
Hy:InL y acc
E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive,
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x y : positive, In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x y : positive,
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall x y : positive,
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
Hy:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) rewrite xelements_spec in Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
Hy:InL y acc \/
(exists x0 : elt, y = j~1 @ x0 /\ mem x0 r = true)
E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
        destruct Hy as [Hy|[z [-> Hy]]].l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y0 : positive, In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y0 : positive,
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x, y:positive
Hx:In x l
Hy:InL y acc
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive,
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j @ x~0) (j @ z~1)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall x0 y : positive, In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall x0 y : positive,
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:positive
Hx:In x l
z:elt
Hy:mem z r = true
E.lt x~0 z~1
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)

    intros.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
Sorted E.lt (xelements s 1 nil) apply H.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
Sorted E.lt nil
H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
forall x y : positive,
In x s -> InL y nil -> E.lt (1 @ x) y constructor.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x y : positive,
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
forall x y : positive,
In x s -> InL y nil -> E.lt (1 @ x) y
      intros x y _ H'.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall x0 y0 : positive,
 In x0 s0 -> InL y0 acc -> E.lt (j @ x0) y0) ->
Sorted E.lt (xelements s0 j acc)
s:t
x, y:positive
H':InL y nil
E.lt (1 @ x) y inversion H'.
  Qed.

  Lemma elements_spec2w: forall s, NoDupA E.eq (elements s).forall s : t, NoDupA E.eq (elements s)
  Proof.forall s : t, NoDupA E.eq (elements s)
    intro.s:t
NoDupA E.eq (elements s) apply SortA_NoDupA with E.lt; auto with *.s:t
Sorted E.lt (elements s)
    apply elements_spec2.
  Qed.

Specification of choose

  Lemma choose_spec1: forall s x, choose s = Some x -> In x s.forall (s : t) (x : elt), choose s = Some x -> In x s
  Proof.forall (s : t) (x : elt), choose s = Some x -> In x s
    induction s as [| l IHl o r IHr]; simpl.forall x : elt, None = Some x -> In x Leaf
l:tree
o:bool
r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => option_map xI (choose r)
  end) = Some x -> In x (Node l o r)
      intros.x:elt
H:None = Some x
In x Leaf
l:tree
o:bool
r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => option_map xI (choose r)
  end) = Some x -> In x (Node l o r) discriminate.l:tree
o:bool
r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => option_map xI (choose r)
  end) = Some x -> In x (Node l o r)
      destruct o.l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
Some 1 = Some x -> In x (Node l true r)
l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => option_map xI (choose r)
end = Some x -> In x (Node l false r)
        intros x H.l, r:tree
IHl:forall x0 : elt, choose l = Some x0 -> In x0 l
IHr:forall x0 : elt, choose r = Some x0 -> In x0 r
x:elt
H:Some 1 = Some x
In x (Node l true r)
l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => option_map xI (choose r)
end = Some x -> In x (Node l false r) injection H; intros; subst.l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
H:Some 1 = Some 1
In 1 (Node l true r)
l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => option_map xI (choose r)
end = Some x -> In x (Node l false r) reflexivity.l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => option_map xI (choose r)
end = Some x -> In x (Node l false r)
        revert IHl.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, choose l = Some x -> In x l) ->
forall x : elt,
match choose l with
| Some i => Some i~0
| None => option_map xI (choose r)
end = Some x -> In x (Node l false r) case choose.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
forall e : elt,
(forall x : elt, Some e = Some x -> In x l) ->
forall x : elt,
Some e~0 = Some x -> In x (Node l false r)
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
option_map xI (choose r) = Some x ->
In x (Node l false r)
          intros p Hp x H.l, r:tree
IHr:forall x0 : elt, choose r = Some x0 -> In x0 r
p:elt
Hp:forall x0 : elt, Some p = Some x0 -> In x0 l
x:elt
H:Some p~0 = Some x
In x (Node l false r)
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
option_map xI (choose r) = Some x ->
In x (Node l false r) injection H as <-.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
p:elt
Hp:forall x : elt, Some p = Some x -> In x l
In p~0 (Node l false r)
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
option_map xI (choose r) = Some x ->
In x (Node l false r) apply Hp.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
p:elt
Hp:forall x : elt, Some p = Some x -> In x l
Some p = Some p
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
option_map xI (choose r) = Some x ->
In x (Node l false r)
           reflexivity.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
option_map xI (choose r) = Some x ->
In x (Node l false r)
          intros _ x.l, r:tree
IHr:forall x0 : elt, choose r = Some x0 -> In x0 r
x:elt
option_map xI (choose r) = Some x ->
In x (Node l false r) revert IHr.l, r:tree
x:elt
(forall x0 : elt, choose r = Some x0 -> In x0 r) ->
option_map xI (choose r) = Some x ->
In x (Node l false r) case choose.l, r:tree
x:elt
forall e : elt,
(forall x0 : elt, Some e = Some x0 -> In x0 r) ->
option_map xI (Some e) = Some x ->
In x (Node l false r)
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
option_map xI None = Some x -> In x (Node l false r)
            intros p Hp H.l, r:tree
x, p:elt
Hp:forall x0 : elt, Some p = Some x0 -> In x0 r
H:option_map xI (Some p) = Some x
In x (Node l false r)
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
option_map xI None = Some x -> In x (Node l false r) injection H as <-.l, r:tree
p:elt
Hp:forall x : elt, Some p = Some x -> In x r
In p~1 (Node l false r)
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
option_map xI None = Some x -> In x (Node l false r) apply Hp.l, r:tree
p:elt
Hp:forall x : elt, Some p = Some x -> In x r
Some p = Some p
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
option_map xI None = Some x -> In x (Node l false r)
            reflexivity.l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
option_map xI None = Some x -> In x (Node l false r)
            intros.l, r:tree
x:elt
IHr:forall x0 : elt, None = Some x0 -> In x0 r
H:option_map xI None = Some x
In x (Node l false r) discriminate.
  Qed.

  Lemma choose_spec2: forall s, choose s = None -> Empty s.forall s : t, choose s = None -> Empty s
  Proof.forall s : t, choose s = None -> Empty s
    unfold Empty, In.forall s : t,
choose s = None -> forall a : elt, mem a s <> true intros s H.s:t
H:choose s = None
forall a : elt, mem a s <> true
    induction s as [|l IHl o r IHr].H:choose Leaf = None
forall a : elt, mem a Leaf <> true
l:tree
o:bool
r:tree
H:choose (Node l o r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intro.H:choose Leaf = None
a:elt
mem a Leaf <> true
l:tree
o:bool
r:tree
H:choose (Node l o r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true apply empty_spec.l:tree
o:bool
r:tree
H:choose (Node l o r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      destruct o.l, r:tree
H:choose (Node l true r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l true r) <> true
l, r:tree
H:choose (Node l false r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
        discriminate.l, r:tree
H:choose (Node l false r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
        simpl in H.l, r:tree
H:match choose l with
| Some i => Some i~0
| None => option_map xI (choose r)
end = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true destruct (choose l).l, r:tree
e:elt
H:Some e~0 = None
IHl:Some e = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
l, r:tree
H:option_map xI (choose r) = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
          discriminate.l, r:tree
H:option_map xI (choose r) = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
          destruct (choose r).l, r:tree
e:elt
H:option_map xI (Some e) = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:Some e = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
            discriminate.l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
            intros [a|a|].l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~1 (Node l false r) <> true
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l false r) <> true
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true
              apply IHr.l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
None = None
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l false r) <> true
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true reflexivity.l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l false r) <> true
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true
              apply IHl.l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
None = None
l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true reflexivity.l, r:tree
H:option_map xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true
              discriminate.
  Qed.

  Lemma choose_empty: forall s, is_empty s = true -> choose s = None.forall s : t, is_empty s = true -> choose s = None
  Proof.forall s : t, is_empty s = true -> choose s = None
    intros s Hs.s:t
Hs:is_empty s = true
choose s = None case_eq (choose s); trivial.s:t
Hs:is_empty s = true
forall e : elt, choose s = Some e -> Some e = None
    intros p Hp.s:t
Hs:is_empty s = true
p:elt
Hp:choose s = Some p
Some p = None apply choose_spec1 in Hp.s:t
Hs:is_empty s = true
p:elt
Hp:In p s
Some p = None apply is_empty_spec in Hs.s:t
Hs:Empty s
p:elt
Hp:In p s
Some p = None
     elim (Hs _ Hp).
  Qed.

  Lemma choose_spec3': forall s s', Equal s s' -> choose s = choose s'.forall s s' : t, s [=] s' -> choose s = choose s'
  Proof.forall s s' : t, s [=] s' -> choose s = choose s'
    setoid_rewrite <- equal_spec.forall s s' : t,
equal s s' = true -> choose s = choose s'
    induction s as [|l IHl o r IHr].forall s' : t,
equal Leaf s' = true -> choose Leaf = choose s'
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s'
      intros.s':t
H:equal Leaf s' = true
choose Leaf = choose s'
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s' symmetry.s':t
H:equal Leaf s' = true
choose s' = choose Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s' apply choose_empty.s':t
H:equal Leaf s' = true
is_empty s' = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s' assumption.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s'

      destruct s' as [|l' o' r'].l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
equal (Node l o r) Leaf = true ->
choose (Node l o r) = choose Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')
        generalize (Node l o r) as s.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s : tree,
equal s Leaf = true -> choose s = choose Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s : tree,
equal s Leaf = true -> choose s = None
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') intros.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:equal s Leaf = true
choose s = None
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') apply choose_empty.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:equal s Leaf = true
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')
        rewrite equal_spec in H.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:s [=] Leaf
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') symmetry in H.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:Leaf [=] s
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') rewrite <- equal_spec in H.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:equal Leaf s = true
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')
        assumption.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')

        simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' = true ->
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => option_map xI (choose r)
  end) =
(if o'
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => option_map xI (choose r')
  end) rewrite <- 2andb_lazy_alt, 2andb_true_iff, eqb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
(o = o' /\ equal l l' = true) /\ equal r r' = true ->
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => option_map xI (choose r)
  end) =
(if o'
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => option_map xI (choose r')
  end)
        intros [[<- Hl] Hr].l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l', r':tree
Hl:equal l l' = true
Hr:equal r r' = true
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => option_map xI (choose r)
  end) =
(if o
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => option_map xI (choose r')
  end) rewrite (IHl _ Hl), (IHr _ Hr).l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l', r':tree
Hl:equal l l' = true
Hr:equal r r' = true
(if o
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => option_map xI (choose r')
  end) =
(if o
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => option_map xI (choose r')
  end) reflexivity.
  Qed.

  Lemma choose_spec3: forall s s' x y,
    choose s = Some x -> choose s' = Some y -> Equal s s' -> E.eq x y.forall (s s' : t) (x y : elt),
choose s = Some x ->
choose s' = Some y -> s [=] s' -> E.eq x y
  Proof.forall (s s' : t) (x y : elt),
choose s = Some x ->
choose s' = Some y -> s [=] s' -> E.eq x y intros s s' x y Hx Hy H.s, s':t
x, y:elt
Hx:choose s = Some x
Hy:choose s' = Some y
H:s [=] s'
E.eq x y apply choose_spec3' in H.s, s':t
x, y:elt
Hx:choose s = Some x
Hy:choose s' = Some y
H:choose s = choose s'
E.eq x y congruence. Qed.

Specification of min_elt

  Lemma min_elt_spec1: forall s x, min_elt s = Some x -> In x s.forall (s : t) (x : elt), min_elt s = Some x -> In x s
  Proof.forall (s : t) (x : elt), min_elt s = Some x -> In x s
   unfold In.forall (s : t) (x : elt),
min_elt s = Some x -> mem x s = true
   induction s as [| l IHl o r IHr]; simpl.forall x : elt, None = Some x -> false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, min_elt l = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
forall x : elt,
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros.x:elt
H:None = Some x
false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, min_elt l = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
forall x : elt,
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true discriminate.l:tree
o:bool
r:tree
IHl:forall x : elt, min_elt l = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
forall x : elt,
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros x.l:tree
o:bool
r:tree
IHl:forall x0 : elt, min_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true destruct (min_elt l); intros.l:tree
o:bool
r:tree
e:elt
IHl:forall x0 : elt, Some e = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:Some e~0 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       injection H as <-.l:tree
o:bool
r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
mem e l = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true apply IHl.l:tree
o:bool
r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
Some e = Some e
l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true reflexivity.l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       destruct o; simpl.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:Some 1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:option_map xI (min_elt r) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         injection H as <-.l, r:tree
IHl:forall x : elt, None = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
true = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:option_map xI (min_elt r) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:option_map xI (min_elt r) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         destruct (min_elt r); simpl in *.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
e:elt
IHr:forall x0 : elt, Some e = Some x0 -> mem x0 r = true
x:elt
H:Some e~1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           injection H as <-.l, r:tree
IHl:forall x : elt, None = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
mem e r = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true apply IHr.l, r:tree
IHl:forall x : elt, None = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
Some e = Some e
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           discriminate.
  Qed.

  Lemma min_elt_spec3: forall s, min_elt s = None -> Empty s.forall s : t, min_elt s = None -> Empty s
  Proof.forall s : t, min_elt s = None -> Empty s
    unfold Empty, In.forall s : t,
min_elt s = None -> forall a : elt, mem a s <> true intros s H.s:t
H:min_elt s = None
forall a : elt, mem a s <> true
    induction s as [|l IHl o r IHr].H:min_elt Leaf = None
forall a : elt, mem a Leaf <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intro.H:min_elt Leaf = None
a:elt
mem a Leaf <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true apply empty_spec.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intros [a|a|].l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~1 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHr.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt (Node l o r) = None -> min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
min_elt (Node l o r) = None -> min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = None -> min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (min_elt r); trivial.l:tree
o:bool
r:tree
e:elt
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else option_map xI (Some e)
end = None -> Some e = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
          case min_elt; intros; try discriminate.l:tree
o:bool
r:tree
e:elt
H:(if o then Some 1 else option_map xI (Some e)) =
None
Some e = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct o; discriminate.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHl.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt (Node l o r) = None -> min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
min_elt (Node l o r) = None -> min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = None -> min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (min_elt l); trivial.l:tree
o:bool
r:tree
e:elt
Some e~0 = None -> Some e = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
         intro; discriminate.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        revert H.l:tree
o:bool
r:tree
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
min_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
min_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else option_map xI (min_elt r)
end = None -> o <> true case min_elt; intros; try discriminate.l:tree
o:bool
r:tree
H:(if o then Some 1 else option_map xI (min_elt r)) =
None
o <> true
         destruct o; discriminate.
  Qed.

  Lemma min_elt_spec2: forall s x y, min_elt s = Some x -> In y s -> ~ E.lt y x.forall (s : t) (x : elt) (y : positive),
min_elt s = Some x -> In y s -> ~ E.lt y x
  Proof.forall (s : t) (x : elt) (y : positive),
min_elt s = Some x -> In y s -> ~ E.lt y x
    unfold In.forall (s : t) (x : elt) (y : positive),
min_elt s = Some x -> mem y s = true -> ~ E.lt y x
    induction s as [|l IHl o r IHr]; intros x y H H'.x:elt
y:positive
H:min_elt Leaf = Some x
H':mem y Leaf = true
~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:min_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt y x
      discriminate.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:min_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt y x
      simpl in H.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
~ E.lt y x case_eq (min_elt l).l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
forall e : elt, min_elt l = Some e -> ~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x
        intros p Hp.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
p:elt
Hp:min_elt l = Some p
~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
p:elt
H:Some p~0 = Some x
H':mem y (Node l o r) = true
Hp:min_elt l = Some p
~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x injection H as <-.l:tree
o:bool
r:tree
IHl:forall (x : elt) (y0 : positive),
min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
IHr:forall (x : elt) (y0 : positive),
min_elt r = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:positive
p:elt
H':mem y (Node l o r) = true
Hp:min_elt l = Some p
~ E.lt y p~0
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x
        destruct y as [z|z|]; simpl; intro; trivial.l:tree
o:bool
r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
IHr:forall (x : elt) (y : positive),
min_elt r = Some x -> mem y r = true -> ~ E.lt y x
z:positive
p:elt
H':mem z~0 (Node l o r) = true
Hp:min_elt l = Some p
H:E.lt z p
False
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x apply (IHl p z); trivial.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o
    then Some 1
    else option_map xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x
        intro Hp; rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:(if o then Some 1 else option_map xI (min_elt r)) =
Some x
H':mem y (Node l o r) = true
Hp:min_elt l = None
~ E.lt y x apply min_elt_spec3 in Hp.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:(if o then Some 1 else option_map xI (min_elt r)) =
Some x
H':mem y (Node l o r) = true
Hp:Empty l
~ E.lt y x
        destruct o.l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:Some 1 = Some x
H':mem y (Node l true r) = true
Hp:Empty l
~ E.lt y x
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
          injection H as <-.l, r:tree
IHl:forall (x : elt) (y0 : positive),
min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
IHr:forall (x : elt) (y0 : positive),
min_elt r = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:positive
H':mem y (Node l true r) = true
Hp:Empty l
~ E.lt y 1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x intros Hl.l, r:tree
IHl:forall (x : elt) (y0 : positive),
min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
IHr:forall (x : elt) (y0 : positive),
min_elt r = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:positive
H':mem y (Node l true r) = true
Hp:Empty l
Hl:E.lt y 1
False
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
          destruct y as [z|z|]; simpl; trivial.l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
IHr:forall (x : elt) (y : positive),
min_elt r = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~0 (Node l true r) = true
Hp:Empty l
Hl:E.lt z~0 1
False
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x elim (Hp _ H').l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x

          destruct (min_elt r).l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
e:elt
IHr:forall (x0 : elt) (y0 : positive),
Some e = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI (Some e) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
            injection H as <-.l, r:tree
IHl:forall (x : elt) (y0 : positive),
min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
e:elt
IHr:forall (x : elt) (y0 : positive),
Some e = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:positive
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y e~1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
            destruct y as [z|z|].l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall (x : elt) (y : positive),
Some e = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~1 (Node l false r) = true
Hp:Empty l
~ E.lt z~1 e~1
l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall (x : elt) (y : positive),
Some e = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty l
~ E.lt z~0 e~1
l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall (x : elt) (y : positive),
Some e = Some x -> mem y r = true -> ~ E.lt y x
H':mem 1 (Node l false r) = true
Hp:Empty l
~ E.lt 1 e~1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
              apply (IHr e z); trivial.l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall (x : elt) (y : positive),
Some e = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty l
~ E.lt z~0 e~1
l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall (x : elt) (y : positive),
Some e = Some x -> mem y r = true -> ~ E.lt y x
H':mem 1 (Node l false r) = true
Hp:Empty l
~ E.lt 1 e~1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
              elim (Hp _ H').l, r:tree
IHl:forall (x : elt) (y : positive),
min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall (x : elt) (y : positive),
Some e = Some x -> mem y r = true -> ~ E.lt y x
H':mem 1 (Node l false r) = true
Hp:Empty l
~ E.lt 1 e~1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
              discriminate.l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x:elt
y:positive
H:option_map xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
            discriminate.
  Qed.

Specification of max_elt

  Lemma max_elt_spec1: forall s x, max_elt s = Some x -> In x s.forall (s : t) (x : elt), max_elt s = Some x -> In x s
  Proof.forall (s : t) (x : elt), max_elt s = Some x -> In x s
   unfold In.forall (s : t) (x : elt),
max_elt s = Some x -> mem x s = true
   induction s as [| l IHl o r IHr]; simpl.forall x : elt, None = Some x -> false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, max_elt r = Some x -> mem x r = true
forall x : elt,
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros.x:elt
H:None = Some x
false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, max_elt r = Some x -> mem x r = true
forall x : elt,
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true discriminate.l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, max_elt r = Some x -> mem x r = true
forall x : elt,
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros x.l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, max_elt r = Some x0 -> mem x0 r = true
x:elt
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true destruct (max_elt r); intros.l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
e:elt
IHr:forall x0 : elt, Some e = Some x0 -> mem x0 r = true
x:elt
H:Some e~1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       injection H as <-.l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
mem e r = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true apply IHr.l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
Some e = Some e
l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true reflexivity.l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else option_map xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       destruct o; simpl.l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:Some 1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:option_map xO (max_elt l) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         injection H as <-.l, r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, None = Some x -> mem x r = true
true = true
l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:option_map xO (max_elt l) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:option_map xO (max_elt l) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         destruct (max_elt l); simpl in *.l, r:tree
e:elt
IHl:forall x0 : elt, Some e = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:Some e~0 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           injection H as <-.l, r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, None = Some x -> mem x r = true
mem e l = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true apply IHl.l, r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, None = Some x -> mem x r = true
Some e = Some e
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           discriminate.
  Qed.

  Lemma max_elt_spec3: forall s, max_elt s = None -> Empty s.forall s : t, max_elt s = None -> Empty s
  Proof.forall s : t, max_elt s = None -> Empty s
    unfold Empty, In.forall s : t,
max_elt s = None -> forall a : elt, mem a s <> true intros s H.s:t
H:max_elt s = None
forall a : elt, mem a s <> true
    induction s as [|l IHl o r IHr].H:max_elt Leaf = None
forall a : elt, mem a Leaf <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intro.H:max_elt Leaf = None
a:elt
mem a Leaf <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true apply empty_spec.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intros [a|a|].l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~1 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHr.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt (Node l o r) = None -> max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
max_elt (Node l o r) = None -> max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = None -> max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (max_elt r); trivial.l:tree
o:bool
r:tree
e:elt
Some e~1 = None -> Some e = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
         intro; discriminate.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHl.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt (Node l o r) = None -> max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
max_elt (Node l o r) = None -> max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = None -> max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (max_elt l); trivial.l:tree
o:bool
r:tree
e:elt
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else option_map xO (Some e)
end = None -> Some e = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
          case max_elt; intros; try discriminate.l:tree
o:bool
r:tree
e:elt
H:(if o then Some 1 else option_map xO (Some e)) =
None
Some e = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct o; discriminate.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        revert H.l:tree
o:bool
r:tree
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
max_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
max_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else option_map xO (max_elt l)
end = None -> o <> true case max_elt; intros; try discriminate.l:tree
o:bool
r:tree
H:(if o then Some 1 else option_map xO (max_elt l)) =
None
o <> true
         destruct o; discriminate.
  Qed.

  Lemma max_elt_spec2: forall s x y, max_elt s = Some x -> In y s -> ~ E.lt x y.forall (s : t) (x : elt) (y : positive),
max_elt s = Some x -> In y s -> ~ E.lt x y
  Proof.forall (s : t) (x : elt) (y : positive),
max_elt s = Some x -> In y s -> ~ E.lt x y
    unfold In.forall (s : t) (x : elt) (y : positive),
max_elt s = Some x -> mem y s = true -> ~ E.lt x y
    induction s as [|l IHl o r IHr]; intros x y H H'.x:elt
y:positive
H:max_elt Leaf = Some x
H':mem y Leaf = true
~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:max_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt x y
      discriminate.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:max_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt x y
      simpl in H.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
~ E.lt x y case_eq (max_elt r).l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
forall e : elt, max_elt r = Some e -> ~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y
        intros p Hp.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
p:elt
Hp:max_elt r = Some p
~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
p:elt
H:Some p~1 = Some x
H':mem y (Node l o r) = true
Hp:max_elt r = Some p
~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y injection H as <-.l:tree
o:bool
r:tree
IHl:forall (x : elt) (y0 : positive),
max_elt l = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall (x : elt) (y0 : positive),
max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:positive
p:elt
H':mem y (Node l o r) = true
Hp:max_elt r = Some p
~ E.lt p~1 y
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y
        destruct y as [z|z|]; simpl; intro; trivial.l:tree
o:bool
r:tree
IHl:forall (x : elt) (y : positive),
max_elt l = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
p:elt
H':mem z~1 (Node l o r) = true
Hp:max_elt r = Some p
H:E.lt p z
False
l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y apply (IHr p z); trivial.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o
    then Some 1
    else option_map xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y
        intro Hp; rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:(if o then Some 1 else option_map xO (max_elt l)) =
Some x
H':mem y (Node l o r) = true
Hp:max_elt r = None
~ E.lt x y apply max_elt_spec3 in Hp.l:tree
o:bool
r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:(if o then Some 1 else option_map xO (max_elt l)) =
Some x
H':mem y (Node l o r) = true
Hp:Empty r
~ E.lt x y
        destruct o.l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:Some 1 = Some x
H':mem y (Node l true r) = true
Hp:Empty r
~ E.lt x y
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
          injection H as <-.l, r:tree
IHl:forall (x : elt) (y0 : positive),
max_elt l = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall (x : elt) (y0 : positive),
max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:positive
H':mem y (Node l true r) = true
Hp:Empty r
~ E.lt 1 y
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y intros Hl.l, r:tree
IHl:forall (x : elt) (y0 : positive),
max_elt l = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall (x : elt) (y0 : positive),
max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:positive
H':mem y (Node l true r) = true
Hp:Empty r
Hl:E.lt 1 y
False
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
          destruct y as [z|z|]; simpl; trivial.l, r:tree
IHl:forall (x : elt) (y : positive),
max_elt l = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~1 (Node l true r) = true
Hp:Empty r
Hl:E.lt 1 z~1
False
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y elim (Hp _ H').l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y

          destruct (max_elt l).l, r:tree
e:elt
IHl:forall (x0 : elt) (y0 : positive),
Some e = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO (Some e) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
            injection H as <-.l, r:tree
e:elt
IHl:forall (x : elt) (y0 : positive),
Some e = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall (x : elt) (y0 : positive),
max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:positive
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt e~0 y
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
            destruct y as [z|z|].l, r:tree
e:elt
IHl:forall (x : elt) (y : positive),
Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 z~1
l, r:tree
e:elt
IHl:forall (x : elt) (y : positive),
Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 z~0
l, r:tree
e:elt
IHl:forall (x : elt) (y : positive),
Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
H':mem 1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
              elim (Hp _ H').l, r:tree
e:elt
IHl:forall (x : elt) (y : positive),
Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 z~0
l, r:tree
e:elt
IHl:forall (x : elt) (y : positive),
Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
H':mem 1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
              apply (IHl e z); trivial.l, r:tree
e:elt
IHl:forall (x : elt) (y : positive),
Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall (x : elt) (y : positive),
max_elt r = Some x -> mem y r = true -> ~ E.lt x y
H':mem 1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 1
l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
              discriminate.l, r:tree
IHl:forall (x0 : elt) (y0 : positive),
None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall (x0 : elt) (y0 : positive),
max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x:elt
y:positive
H:option_map xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
            discriminate.
  Qed.

End PositiveSet.