End POSTORDER.
Definition postorder (g: graph) (root: node) :=
WfIter.iterate _ _ transition lt_state lt_state_wf transition_decreases (init_state g root).
Inductive reachable (g: graph) (root: positive) : positive -> Prop :=
| reachable_root:
reachable g root root
| reachable_succ: forall x succs y,
reachable g root x -> g!x = Some succs -> In y succs ->
reachable g root y.

(* Specifications: *)
Theorem postorder_correct:
forall g root,
let m := postorder g root in
(forall x1 x2 y, m!x1 = Some y -> m!x2 = Some y -> x1 = x2)
/\ (forall x, reachable g root x -> g!x <> None -> m!x <> None).
Theorem postorder_correct:
forall g root,
let m := postorder g root in
(forall x1 x2 y, m!x1 = Some y -> m!x2 = Some y -> x1 = x2)
/\ (forall x, reachable g root x -> g!x <> None -> m!x <> None).