Section Invariants.
Instance unit_PCM : Ghost := { valid a := True; Join_G a b c := True }.
Inductive list_join {P : Ghost} : Join (list (option G)) :=
| list_join_nil_l m: list_join nil m m
| list_join_nil_r m: list_join m nil m
| list_join_cons a1 a2 m1 m2 a3 m3: join a1 a2 a3 -> list_join m1 m2 m3 ->
list_join (a1 :: m1) (a2 :: m2) (a3 :: m3).
Existing Instance list_join.

Lemma list_join_inv: forall {P : Ghost} (l1 l2 l3 : list (option G)), list_join l1 l2 l3 ->
match l1, l2 with
| nil, _ => l3 = l2
| _, nil => l3 = l1
| a1 :: l1, a2 :: l2 => match l3 with nil => False
| a3 :: l3 => join a1 a2 a3 /\ list_join l1 l2 l3 end
end.