Fixpoint merge s1 :=
  if s1 is x1 :: s1' then
    let fix merge_s1 s2 :=
      if s2 is x2 :: s2' then
        if leT x2 x1 then x2 :: merge_s1 s2' else x1 :: merge s1' s2
      else s1 in
    merge_s1
  else id.

(* Specifications: *)
Lemma merge_path x s1 s2 : path leT x s1 -> path leT x s2 -> path leT x (merge s1 s2).
Lemma merge_sorted s1 s2 : sorted s1 -> sorted s2 -> sorted (merge s1 s2).
Lemma perm_merge s1 s2 : perm_eql (merge s1 s2) (s1 ++ s2).
Lemma mem_merge s1 s2 : merge s1 s2 =i s1 ++ s2.
Lemma size_merge s1 s2 : size (merge s1 s2) = size (s1 ++ s2).
Lemma merge_uniq s1 s2 : uniq (merge s1 s2) = uniq (s1 ++ s2).