Fixpoint split_tok1 (n:nat) (x:ShareTree) {struct x} : ShareTree :=
match x with
| Node (Leaf true)  t2 =>
match n with
| O    => Node (Leaf true) (Leaf false)
| S n' => Node (Leaf true) (split_tok1 n' t2)
end
| Node (Leaf false) t2 => Node (Leaf false) (split_tok1 n t2)
| _ => Leaf false
end.
Fixpoint split_tok2 (n:nat) (x:ShareTree) {struct x} : ShareTree :=
match x with
| Node (Leaf true)  t2 =>
match n with
| O    => Node (Leaf false) t2
| S n' => Node (Leaf false) (split_tok2 n' t2)
end
| Node (Leaf false) t2 => Node (Leaf false) (split_tok2 n t2)
| _ => x
end.

Lemma split_tok1_correct : forall tok n m,
isToken' tok m ->
gt m n ->
isToken' (split_tok1 n tok) (S n).