(* The proof is long and very boring, but it is a simple case analysis.  Could it be possible to simplify it? *)

(* Specifications: *)
Lemma no_copy_to_owner :
forall c0 : Config,
legal c0 -> forall s1 : Site, ~ In_queue Message copy (bm c0 s1 owner).
Lemma empty_q_to_me :
forall c : Config, legal c -> forall s : Site, bm c s s = empty Message.
Lemma not_reflexive :
forall c : Config,
legal c ->
forall s1 s5 : Site,
In_queue Message (inc_dec s1) (bm c s5 owner) -> s1 <> s5.
Lemma not_in_queue_post :
forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message),
m1 <> m2 ->
~ In_queue Message m1 (b s1 s2) ->
~ In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2).
Lemma not_in_queue_collect :
forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message),
~ In_queue Message m1 (b s1 s2) ->
~ In_queue Message m1 (Collect_message Message b s3 s4 s1 s2).
Lemma inc_dec_owner :
forall (c : Config) (s1 s2 : Site),
legal c ->
s1 = owner \/ s2 <> owner ->
forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner2 :
forall (c : Config) (s1 s2 : Site),
legal c ->
s1 <> owner ->
s2 <> owner ->
forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner3 :
forall (c : Config) (s1 s2 : Site),
legal c ->
s2 <> owner ->
forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner4 :
forall (c : Config) (s1 s2 : Site),
legal c ->
s1 = owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma empty_queue1 :
forall c : Config,
legal c -> forall s1 s2 : Site, s1 = s2 -> bm c s1 s2 = empty Message.
Lemma empty_queue2 :
forall c : Config,
legal c ->
forall s1 s2 s : Site, s1 = s -> s2 = s -> bm c s1 s2 = empty Message.
Lemma st_rt :
forall (c0 : Config) (s0 : Site),
legal c0 -> s0 <> owner -> (st c0 s0 > 0)%Z -> rt c0 s0 = true.