Definition valid (x: tree) := searchtree None None x /\
(exists n, is_redblack x Red n).
(*  NOW FOR THE HARD PART, DELETION! Here we follow the deletion algorithm of Stefan Kahrs (2001), and in particular, http://www.cs.kent.ac.uk/people/staff/smk/redblack/Untyped.hs *)
Ltac hax :=
repeat (auto; try solve [repeat constructor; auto];
match goal with
| H: is_redblack _ Red _ |- _ => inv H
| H: is_redblack _ _ 0 |- _ => inv H
| H: is_redblack _ _ (S _) |- _ => inv H
| H: infrared _ 0 |- _ => inv H
| H: infrared _ (S _) |- _ => inv H
end).

(* Specifications: *)
Lemma balance'_shape:
forall n tl k tr,
(is_redblack tl Black n /\ infrared tr n \/ infrared tl n /\ is_redblack tr Black n) ->
is_redblack (balance' tl k tr) Black (S n).
Lemma searchtree_balance':
forall s1 t s2 lo hi,
searchtree lo (Some t) s1 -> searchtree (Some t) hi s2 ->
searchtree lo hi (balance' s1 t s2).
Lemma searchtree_append_aux:
forall n tl tr, size tl + size tr < n ->
forall lo k hi,
searchtree lo (Some k) tl -> searchtree (Some k) hi tr ->
searchtree lo hi (append(tl,tr)).
Lemma searchtree_append:
forall tl tr lo k hi,
searchtree lo (Some k) tl -> searchtree (Some k) hi tr->
searchtree lo hi (append(tl,tr)).
Lemma searchtree_sub1: forall t lo hi, searchtree lo hi t -> searchtree lo hi (sub1 t).
Lemma del_is_searchtree:
forall x t lo hi,
searchtree lo hi t -> searchtree lo hi (del x t).