(** Moreover, this is optimal: all addresses below [(ad_alloc_opt m)] are in [dom m]: *)

(* Specifications: *)
Lemma ad_alloc_opt_optimal_1 :
forall (m:Map A) (a:ad),
Nleb (ad_alloc_opt m) a = false -> {y : A | MapGet A m a = Some y}.
Lemma ad_alloc_opt_optimal :
forall (m:Map A) (a:ad),
Nleb (ad_alloc_opt m) a = false -> in_dom A a m = true.