(** ** Emptyness test *)

(* Specifications: *)
Lemma is_empty_spec : forall s, is_empty s = true <-> Empty s.
(** ** Membership *)
Lemma mem_spec : forall s x `{Ok s}, mem x s = true <-> InT x s.
(** ** Minimal and maximal elements *)
Lemma min_elt_spec1 s x : min_elt s = Some x -> InT x s.
Lemma min_elt_spec2 s x y `{Ok s} :
min_elt s = Some x -> InT y s -> ~ X.lt y x.
Lemma min_elt_spec3 s : min_elt s = None -> Empty s.
Lemma max_elt_spec1 s x : max_elt s = Some x -> InT x s.
Lemma max_elt_spec2 s x y `{Ok s} :
max_elt s = Some x -> InT y s -> ~ X.lt x y.
Lemma max_elt_spec3 s : max_elt s = None -> Empty s.
Lemma choose_spec1 : forall s x, choose s = Some x -> InT x s.
Lemma choose_spec2 : forall s, choose s = None -> Empty s.
Lemma choose_spec3 : forall s s' x x' `{Ok s, Ok s'},
choose s = Some x -> choose s' = Some x' ->
Equal s s' -> X.eq x x'.