CoInductive supp_spec x (s : fmap) : bool -> Type :=
| supp_spec_some v of fnd x s = Some v : supp_spec x s true
| supp_spec_none of fnd x s = None : supp_spec x s false.

(* Specifications: *)
Lemma suppP x (s : fmap) : supp_spec x s (x \in supp s).
Lemma supp_nil : supp nil = [::]. Proof. by []. Qed.
Lemma supp_nilE (s : fmap) : (supp s = [::]) <-> (s = nil).
Lemma supp_ins k v (s : fmap) :
supp (ins k v s) =i predU (pred1 k) (mem (supp s)).
Lemma fnd_empty k : fnd k nil = None. Proof. by []. Qed.
Lemma fnd_rem k1 k2 (s : fmap) :
fnd k1 (rem k2 s) = if k1 == k2 then None else fnd k1 s.
Lemma fnd_ins k1 k2 v (s : fmap) :
fnd k1 (ins k2 v s) = if k1 == k2 then Some v else fnd k1 s.
Lemma ins_rem k1 k2 v (s : fmap) :
ins k1 v (rem k2 s) =
if k1 == k2 then ins k1 v s else rem k2 (ins k1 v s).
Lemma ins_ins k1 k2 v1 v2 (s : fmap) :
ins k1 v1 (ins k2 v2 s) = if k1 == k2 then ins k1 v1 s
else ins k2 v2 (ins k1 v1 s).
Lemma rem_empty k : rem k nil = nil.
Lemma rem_ins k1 k2 v (s : fmap) :
rem k1 (ins k2 v s) =
if k1 == k2 then rem k1 s else ins k2 v (rem k1 s).
Lemma rem_supp k (s : fmap) :
k \notin supp s -> rem k s = s.
Lemma fnd_supp k (s : fmap) :
k \notin supp s -> fnd k s = None.