#[global]
Instance remove_rb s x : Rbt s -> Rbt (remove x s).
(** ** Treeify *)
Definition treeify_rb_invariant size depth (f:treeify_t) :=
forall acc,
size <= length acc ->
rbt depth (fst (f acc)) /\
size + length (snd (f acc)) = length acc.

(* Specifications: *)
Lemma treeify_zero_rb : treeify_rb_invariant 0 0 treeify_zero.
Lemma treeify_one_rb : treeify_rb_invariant 1 0 treeify_one.
Lemma treeify_cont_rb f g size1 size2 size d :
treeify_rb_invariant size1 d f ->
treeify_rb_invariant size2 d g ->
size = S (size1 + size2) ->
treeify_rb_invariant size (S d) (treeify_cont f g).
Lemma treeify_aux_rb n :
exists d, forall (b:bool),
treeify_rb_invariant (ifpred b (Pos.to_nat n)) d (treeify_aux b n).