(** Some properties of [is_mill] and [dests_disjoint]. *)
Definition dests_disjoint (m1 m2: moves) : Prop :=
list_disjoint (dests m1) (dests m2).

(* Specifications: *)
Lemma dests_disjoint_sym:
forall m1 m2,
dests_disjoint m1 m2 <-> dests_disjoint m2 m1.
Lemma dests_disjoint_cons_left:
forall m1 s d m2,
dests_disjoint ((s, d) :: m1) m2 <->
dests_disjoint m1 m2 /\ ~In d (dests m2).
Lemma dests_disjoint_cons_right:
forall m1 s d m2,
dests_disjoint m1 ((s, d) :: m2) <->
dests_disjoint m1 m2 /\ ~In d (dests m1).
Lemma dests_disjoint_append_left:
forall m1 m2 m3,
dests_disjoint (m1 ++ m2) m3 <->
dests_disjoint m1 m3 /\ dests_disjoint m2 m3.
Lemma dests_disjoint_append_right:
forall m1 m2 m3,
dests_disjoint m1 (m2 ++ m3) <->
dests_disjoint m1 m2 /\ dests_disjoint m1 m3.
Lemma is_mill_cons:
forall s d m,
is_mill ((s, d) :: m) <->
is_mill m /\ ~In d (dests m).
Lemma is_mill_append:
forall m1 m2,
is_mill (m1 ++ m2) <->
is_mill m1 /\ is_mill m2 /\ dests_disjoint m1 m2.