(* Being a subtree of *)
Fixpoint InCBV p proof_tree : Prop :=
p = proof_tree \/
match proof_tree with
| cbv_constr lp _ _ _ _ => orl (map (InCBV p) lp)
| cbv_split lp p' _ _ _ _ => InCBV p p' \/ orl (map (InCBV p) lp)
| cbv_update _ _ p' _ _ _ _ => InCBV p p'
| cbv_read _ _ _ => False
end.

(* Specifications: *)
Lemma InCBV_refl p : InCBV p p.
Lemma InCBV_trans p p' p'': InCBV p p' -> InCBV p' p'' -> InCBV p p''.
(* Reverse induction on proof trees *)
Lemma cbv_reverse_induction :
forall (P : cbv -> Prop) proof_tree,
P proof_tree ->
(forall lp c1 t c2 v, InCBV (cbv_constr lp c1 t c2 v) proof_tree -> P (cbv_constr lp c1 t c2 v) -> forall p, In p lp -> P p) ->
(forall lp p c1 t c2 v, InCBV (cbv_split lp p c1 t c2 v) proof_tree -> P (cbv_split lp p c1 t c2 v) -> forall p', (p' = p \/ In p' lp) -> P p') ->
(forall i s p c1 t c2 v, InCBV (cbv_update i s p c1 t c2 v) proof_tree -> P (cbv_update i s p c1 t c2 v) -> P p) ->
forall p, InCBV p proof_tree -> P p.