Axiom
  sigma_rooted_change_queue :
    forall (s0 s1 s2 : Site) (b : Bag_of_message) (q : queue Message),
    s0 <> owner ->
    b s1 owner = input Message dec (input Message (inc_dec s2) q) ->
    sigma_rooted s0 (change_queue (queue Message) b s1 owner q) =
    (sigma_rooted s0 b - rooted_fun s0 s1 owner dec -
     rooted_fun s0 s1 owner (inc_dec s2))%Z.

(* Specifications: *)
Lemma invariant2_init : forall s0 : Site, st config_init s0 = sigma_rooted s0 (bm config_init).
Lemma invariant2_ind : forall s0 : Site, s0 <> owner -> forall (c : Config) (t : class_trans c), legal c -> st c s0 = sigma_rooted s0 (bm c) -> st (transition c t) s0 = sigma_rooted s0 (bm (transition c t)).
Lemma invariant2 : forall (c0 : Config) (s0 : Site), legal c0 -> s0 <> owner -> st c0 s0 = sigma_rooted s0 (bm c0).
Lemma positive_st : forall (c : Config) (s0 s5 : Site), s0 <> owner -> legal c -> In_queue Message (inc_dec s0) (bm c s5 owner) -> (st c s0 > 0)%Z.
Lemma invariant2_init : forall s0 : Site, st config_init s0 = sigma_rooted s0 (bm config_init).
Lemma invariant2_ind : forall s0 : Site, s0 <> owner -> forall (c : Config) (t : class_trans c), legal c -> st c s0 = sigma_rooted s0 (bm c) -> st (transition c t) s0 = sigma_rooted s0 (bm (transition c t)).
Lemma invariant2 : forall (c0 : Config) (s0 : Site), legal c0 -> s0 <> owner -> st c0 s0 = sigma_rooted s0 (bm c0).
Lemma positive_st : forall (c : Config) (s0 s5 : Site), s0 <> owner -> legal c -> In_queue Message (inc_dec s0) (bm c s5 owner) -> (st c s0 > 0)%Z.