(* An induction principle. In order to prove that a property [P] holds of [fold f e accu], it suffices to hold that it holds of the initial accumulator and that it is preserved by one iteration. The statement is expressed in terms of [empty] and [raw_insert], so the fact that environments are implemented as lists is not exposed. *)

(* Specifications: *)
Lemma fold_invariant:
forall A B (P : env A -> B -> Prop) f accu,
P (@empty _) accu ->
(forall o e accu, P e accu -> P (raw_insert 0 o e) (f o accu)) ->
forall e,
P e (fold f e accu).