Inductive add_events h : list hist_el -> hist -> Prop :=
| add_events_nil : add_events h [] h
| add_events_snoc : forall le h' t e (Hh' : add_events h le h') (Ht : newer h' t),
add_events h (le ++ [e]) (h' ++ [(t, e)]).
Hint Resolve add_events_nil.

Lemma add_events_NoDup : forall h le h', add_events h le h' -> NoDup (map fst h) -> NoDup (map fst h').
Notation AL_witness sh p g R h P Q :=
(sh%logic, p%logic, (ghost_hist sh h g * P)%logic, hist_R g%logic R,
EX h' : hist, fun v => !!(add_events h [Load v] h') && ghost_hist sh h' g * Q v).