Inductive op : Type :=
  | I : K -> op
  | O : K -> op.Inductive op : Type :=
  | I : K -> op
  | O : K -> op.Inductive op : Type :=
  | I : K -> op
  | O : K -> op.Definition op_eq_dec :
    forall x y : op, {x = y} + {x <> y}.Inductive IR : Type :=
  | IRI : K -> IR
  | IRO : K -> IR
  | IRU : K -> IR.Inductive IR : Type :=
  | IRI : K -> IR
  | IRO : K -> IR
  | IRU : K -> IR.Inductive IR : Type :=
  | IRI : K -> IR
  | IRO : K -> IR
  | IRU : K -> IR.Inductive IR : Type :=
  | IRI : K -> IR
  | IRO : K -> IR
  | IRU : K -> IR.Definition IR_eq_dec :
    forall x y : IR, {x = y} + {x <> y}.(* Hypothesis trace_NoDup : NoDup trace. *)
  (* also maybe: no Us *)
  (* alse maybe: every O has corresponding I before it *)

  Definition acknowledged_op (k : K) (trace : list op) :=
    In (O k) trace.Definition acknowledged_op_dec (k : K) (tr : list op) : {acknowledged_op k tr} + {~acknowledged_op k tr} :=
    in_dec op_eq_dec (O k) tr.

(* Specifications: *)
Lemma acknowledge_all_ops_was_in : forall l ir, acknowledge_all_ops l ir -> forall k, In (IRI k) ir -> In (I k) l.
Lemma acknowledge_all_ops_func_defn : forall x l target, acknowledge_all_ops_func (x :: l) target = match x with | I k => if acknowledged_op_dec k l then IRI k :: acknowledge_all_ops_func l target else if in_dec IR_eq_dec (IRU k) target then IRI k :: IRU k :: acknowledge_all_ops_func l target else acknowledge_all_ops_func l target | O k => IRO k :: acknowledge_all_ops_func l target end.
Lemma acknowledge_all_ops_func_correct : forall l target, acknowledge_all_ops l (acknowledge_all_ops_func l target).
Lemma acknowledge_all_ops_func_target_ext : forall l t t', (forall k, In (IRU k) t -> In (IRU k) t') -> (forall k, In (IRU k) t' -> In (IRU k) t) -> acknowledge_all_ops_func l t = acknowledge_all_ops_func l t'.