End ELEMENTS_BETWEEN.
Section FOR_ALL_BETWEEN.
(** [for_all_between pred above below s] is [true] iff all elements of [s] in a given variation interval satisfy predicate [pred]. The variation interval is given by two predicates [above] and [below] which must both hold if the element is part of the interval. Using the monotonicity of [above] and [below], the implementation of [for_all_between] avoids traversing the subtrees of [s] that lie entirely outside the interval of interest. *)
Variable pred: elt -> bool.
Variable above_low_bound: elt -> bool.
Variable below_high_bound: elt -> bool.
Fixpoint raw_for_all_between (m: Raw.tree) : bool :=
match m with
| Raw.Leaf => true
| Raw.Node _ l x r =>
if above_low_bound x
then if below_high_bound x
then raw_for_all_between l && pred x && raw_for_all_between r
else raw_for_all_between l
else raw_for_all_between r
end.
Definition for_all_between (m: t) : bool := raw_for_all_between m.(MSet.this).
Hypothesis pred_compat:
forall x1 x2, X.eq x1 x2 -> pred x1 = pred x2.
Hypothesis above_monotone:
forall x1 x2, X.eq x1 x2 \/ X.lt x1 x2 -> above_low_bound x1 = true -> above_low_bound x2 = true.
Hypothesis below_monotone:
forall x1 x2, X.eq x1 x2 \/ X.lt x2 x1 -> below_high_bound x1 = true -> below_high_bound x2 = true.

(* Specifications: *)
Lemma raw_for_all_between_1:
forall x m,
Raw.bst m ->
raw_for_all_between m = true ->
Raw.In x m ->
above_low_bound x = true ->
below_high_bound x = true ->
pred x = true.
Lemma raw_for_all_between_2:
forall m,
Raw.bst m ->
(forall x, Raw.In x m -> above_low_bound x = true -> below_high_bound x = true -> pred x = true) ->
raw_for_all_between m = true.
Theorem for_all_between_iff:
forall s,
for_all_between s = true <-> (forall x, In x s -> above_low_bound x = true -> below_high_bound x = true -> pred x = true).