(** [] *)

(* ################################################################# *)
(** * It Wasn't Really Luck, Actually *)

(** In the previous section, I said, "we got lucky that the abstraction
    relation that I happened to choose had this super-strong property."

    But actually, the first time I tried to prove correctness of search trees,
    I did _not_ get lucky.  I chose a different abstraction relation: *)

Definition AbsX (t: tree) (m: total_map V) : Prop :=
    list2map (elements t) = m.

(* Specifications: *)
Theorem elements_relateX: forall t cts, SearchTree t -> AbsX t cts -> list2map (elements t) = cts.
Theorem naive_lookup_relateX: forall k t cts , AbsX t cts -> lookup k t = cts k.
Theorem not_naive_lookup_relateX: forall v, default <> v -> ~ (forall k t cts , AbsX t cts -> lookup k t = cts k).
Theorem lookup_relateX: forall k t cts , SearchTree t -> AbsX t cts -> lookup k t = cts k.