Complete proofs in ScanState.v