(* s1 is parent of s0 *)
Inductive mul_parent : Site -> Site -> Prop :=
    mul_parent_intro :
      forall s1 s0 : Site,
      rt c0 s0 = true ->
      In_queue Message (inc_dec s1) (bm c0 s0 owner) -> mul_parent s1 s0.(* s1 is parent of s0 *)
Inductive mul_parent : Site -> Site -> Prop :=
    mul_parent_intro :
      forall s1 s0 : Site,
      rt c0 s0 = true ->
      In_queue Message (inc_dec s1) (bm c0 s0 owner) -> mul_parent s1 s0.(* s1 is ancestor of s0 *)
Inductive mul_ancestor : Site -> Site -> Prop :=
  | mul_short : forall s1 s0 : Site, mul_parent s1 s0 -> mul_ancestor s1 s0
  | mul_long :
      forall s2 s1 s0 : Site,
      mul_ancestor s2 s1 -> mul_parent s1 s0 -> mul_ancestor s2 s0.(* s1 is ancestor of s0 *)
Inductive mul_ancestor : Site -> Site -> Prop :=
  | mul_short : forall s1 s0 : Site, mul_parent s1 s0 -> mul_ancestor s1 s0
  | mul_long :
      forall s2 s1 s0 : Site,
      mul_ancestor s2 s1 -> mul_parent s1 s0 -> mul_ancestor s2 s0.(* s1 is ancestor of s0 *)
Inductive mul_ancestor : Site -> Site -> Prop :=
  | mul_short : forall s1 s0 : Site, mul_parent s1 s0 -> mul_ancestor s1 s0
  | mul_long :
      forall s2 s1 s0 : Site,
      mul_ancestor s2 s1 -> mul_parent s1 s0 -> mul_ancestor s2 s0.

(* Specifications: *)
Lemma in_queue_post : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message), m1 <> m2 -> In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2) -> In_queue Message m1 (b s1 s2).
Lemma in_queue_collect : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message), In_queue Message m1 (Collect_message Message b s3 s4 s1 s2) -> In_queue Message m1 (b s1 s2).
Lemma mul_parent_does_not_join : forall (c0 : Config) (s2 s3 s4 : Site), legal c0 -> legal (rec_copy2_trans c0 s2) -> mul_parent (rec_copy2_trans c0 s2) s3 s4 -> rt c0 s2 = false -> first Message (bm c0 owner s2) = value Message copy -> s3 <> s2.
Lemma mul_ancestor_does_not_join : forall (c0 : Config) (s2 s3 s4 : Site), legal c0 -> legal (rec_copy2_trans c0 s2) -> mul_ancestor (rec_copy2_trans c0 s2) s3 s4 -> rt c0 s2 = false -> first Message (bm c0 owner s2) = value Message copy -> s3 <> s2.
Lemma mul_parent_does_not_join2 : forall (c0 : Config) (s1 s2 s3 s4 : Site), legal c0 -> legal (rec_copy3_trans c0 s1 s2) -> mul_parent (rec_copy3_trans c0 s1 s2) s3 s4 -> rt c0 s2 = false -> first Message (bm c0 s1 s2) = value Message copy -> s3 <> s2.
Lemma mul_ancestor_does_not_join2 : forall (c0 : Config) (s1 s2 s3 s4 : Site), legal c0 -> legal (rec_copy3_trans c0 s1 s2) -> mul_ancestor (rec_copy3_trans c0 s1 s2) s3 s4 -> rt c0 s2 = false -> first Message (bm c0 s1 s2) = value Message copy -> s3 <> s2.
Lemma mul_ancestor_not_reflexive : forall c : Config, legal c -> forall s1 s2 : Site, mul_ancestor c s1 s2 -> s1 <> s2.
Lemma not_in_queue_input : forall (q : queue Message) (m1 m : Message), ~ In_queue Message m1 (input Message m q) -> ~ In_queue Message m1 q.
Lemma same_parent : forall (c : Config) (s2 s5 s6 : Site), parent c s5 s6 -> parent c s2 s6 -> s2 = s5.
Lemma ancestor_is_mul_ancestor : forall (c : Config) (s1 s2 : Site), ancestor c s1 s2 -> mul_ancestor c s1 s2.
Lemma ancestor_not_reflexive : forall c : Config, legal c -> forall s1 s2 : Site, ancestor c s1 s2 -> s1 <> s2.
Lemma ancestor_has_positive_st : forall c : Config, legal c -> forall s1 s2 : Site, ancestor c s1 s2 -> (st c s1 > 0)%Z.