Section Invariants.
Instance unit_PCM : Ghost := { valid a := True; Join_G a b c := True }.
Inductive list_join {P : Ghost} : Join (list (option G)) :=
| list_join_nil_l m: list_join nil m m
| list_join_nil_r m: list_join m nil m
| list_join_cons a1 a2 m1 m2 a3 m3: join a1 a2 a3 -> list_join m1 m2 m3 ->
list_join (a1 :: m1) (a2 :: m2) (a3 :: m3).
Existing Instance list_join.
Instance list_PCM (P : Ghost) : Ghost := { valid a := True; Join_G := list_join }.

Lemma list_join_length : forall {P : Ghost} l1 l2 l3, list_join l1 l2 l3 ->
(length l1 <= length l3)%nat.