Admitted. (* QuickChick update_permute. *)
Definition total_map := (partial_map * nat)%type.
Definition t_empty v : total_map := (empty, v).
Definition t_update (m : total_map) (x : id) (v : nat) :=
let (pm,d) := m in
(update (x, v) pm, d).
Inductive t_bind : partial_map -> nat -> id -> nat -> Prop :=
| T_BindDef   : forall x v, t_bind nil v x v
| T_BindNow   : forall x a m d, t_bind (cons (x, a) m) d x a
| T_BindLater : forall x x' a a' m' d,
~ (x = x') ->
t_bind m' d x a ->
t_bind (cons (x',a') m') d x a.
Derive ArbitrarySizedSuchThat for (fun x => t_bind m d x a).
Derive SizeMonotonicSuchThatOpt for (fun x => t_bind m d x a).
Instance adm_st' d m a : SuchThatCorrect (fun x => t_bind m d x a) (genST (fun x => t_bind m d x a)).
Admitted.

(* Specifications: *)
Lemma t_apply_empty:  forall x v v', t_bind empty v x v' -> v = v'.
Admitted. (* Leo TODO: suchtat4_2  QuickChick t_apply_empty. *)
Fixpoint lookup m x : option nat :=
match m with
| nil => None
| (x',v)::t => if (x = x') ? then Some v else lookup t x
end.