Regenerate the test files and add the fstar-split tests

9 files changed, 378 insertions, 653 deletions

diff --git a/tests/coq/misc/Bitwise.v b/tests/coq/misc/Bitwise.v
index 94771b37..b04c95f2 100644
--- a/tests/coq/misc/Bitwise.v
+++ b/tests/coq/misc/Bitwise.v
@@ -8,29 +8,29 @@ Import ListNotations.
 Local Open Scope Primitives_scope.
 Module Bitwise.
 
-(** [bitwise::shift_u32]: forward function
+(** [bitwise::shift_u32]:
     Source: 'src/bitwise.rs', lines 3:0-3:31 *)
 Definition shift_u32 (a : u32) : result u32 :=
   t <- u32_shr a 16%usize; u32_shl t 16%usize
 .
 
-(** [bitwise::shift_i32]: forward function
+(** [bitwise::shift_i32]:
     Source: 'src/bitwise.rs', lines 10:0-10:31 *)
 Definition shift_i32 (a : i32) : result i32 :=
   t <- i32_shr a 16%isize; i32_shl t 16%isize
 .
 
-(** [bitwise::xor_u32]: forward function
+(** [bitwise::xor_u32]:
     Source: 'src/bitwise.rs', lines 17:0-17:37 *)
 Definition xor_u32 (a : u32) (b : u32) : result u32 :=
   Return (u32_xor a b).
 
-(** [bitwise::or_u32]: forward function
+(** [bitwise::or_u32]:
     Source: 'src/bitwise.rs', lines 21:0-21:36 *)
 Definition or_u32 (a : u32) (b : u32) : result u32 :=
   Return (u32_or a b).
 
-(** [bitwise::and_u32]: forward function
+(** [bitwise::and_u32]:
     Source: 'src/bitwise.rs', lines 25:0-25:37 *)
 Definition and_u32 (a : u32) (b : u32) : result u32 :=
   Return (u32_and a b).
diff --git a/tests/coq/misc/Constants.v b/tests/coq/misc/Constants.v
index ad899f25..0f33cbd6 100644
--- a/tests/coq/misc/Constants.v
+++ b/tests/coq/misc/Constants.v
@@ -23,7 +23,7 @@ Definition x1_c : u32 := x1_body%global.
 Definition x2_body : result u32 := Return 3%u32.
 Definition x2_c : u32 := x2_body%global.
 
-(** [constants::incr]: forward function
+(** [constants::incr]:
     Source: 'src/constants.rs', lines 17:0-17:32 *)
 Definition incr (n : u32) : result u32 :=
   u32_add n 1%u32.
@@ -33,7 +33,7 @@ Definition incr (n : u32) : result u32 :=
 Definition x3_body : result u32 := incr 32%u32.
 Definition x3_c : u32 := x3_body%global.
 
-(** [constants::mk_pair0]: forward function
+(** [constants::mk_pair0]:
     Source: 'src/constants.rs', lines 23:0-23:51 *)
 Definition mk_pair0 (x : u32) (y : u32) : result (u32 * u32) :=
   Return (x, y).
@@ -46,7 +46,7 @@ Arguments mkPair_t { _ _ }.
 Arguments pair_x { _ _ }.
 Arguments pair_y { _ _ }.
 
-(** [constants::mk_pair1]: forward function
+(** [constants::mk_pair1]:
     Source: 'src/constants.rs', lines 27:0-27:55 *)
 Definition mk_pair1 (x : u32) (y : u32) : result (Pair_t u32 u32) :=
   Return {| pair_x := x; pair_y := y |}
@@ -81,7 +81,7 @@ Record Wrap_t (T : Type) := mkWrap_t { wrap_value : T; }.
 Arguments mkWrap_t { _ }.
 Arguments wrap_value { _ }.
 
-(** [constants::{constants::Wrap<T>}::new]: forward function
+(** [constants::{constants::Wrap<T>}::new]:
     Source: 'src/constants.rs', lines 54:4-54:41 *)
 Definition wrap_new (T : Type) (value : T) : result (Wrap_t T) :=
   Return {| wrap_value := value |}
@@ -92,7 +92,7 @@ Definition wrap_new (T : Type) (value : T) : result (Wrap_t T) :=
 Definition y_body : result (Wrap_t i32) := wrap_new i32 2%i32.
 Definition y_c : Wrap_t i32 := y_body%global.
 
-(** [constants::unwrap_y]: forward function
+(** [constants::unwrap_y]:
     Source: 'src/constants.rs', lines 43:0-43:30 *)
 Definition unwrap_y : result i32 :=
   Return y_c.(wrap_value).
@@ -107,12 +107,12 @@ Definition yval_c : i32 := yval_body%global.
 Definition get_z1_z1_body : result i32 := Return 3%i32.
 Definition get_z1_z1_c : i32 := get_z1_z1_body%global.
 
-(** [constants::get_z1]: forward function
+(** [constants::get_z1]:
     Source: 'src/constants.rs', lines 61:0-61:28 *)
 Definition get_z1 : result i32 :=
   Return get_z1_z1_c.
 
-(** [constants::add]: forward function
+(** [constants::add]:
     Source: 'src/constants.rs', lines 66:0-66:39 *)
 Definition add (a : i32) (b : i32) : result i32 :=
   i32_add a b.
@@ -132,10 +132,10 @@ Definition q2_c : i32 := q2_body%global.
 Definition q3_body : result i32 := add q2_c 3%i32.
 Definition q3_c : i32 := q3_body%global.
 
-(** [constants::get_z2]: forward function
+(** [constants::get_z2]:
     Source: 'src/constants.rs', lines 70:0-70:28 *)
 Definition get_z2 : result i32 :=
-  i <- get_z1; i0 <- add i q3_c; add q1_c i0.
+  i <- get_z1; i1 <- add i q3_c; add q1_c i1.
 
 (** [constants::S1]
     Source: 'src/constants.rs', lines 80:0-80:18 *)
diff --git a/tests/coq/misc/External_Funs.v b/tests/coq/misc/External_Funs.v
index e9d39f66..049f5d39 100644
--- a/tests/coq/misc/External_Funs.v
+++ b/tests/coq/misc/External_Funs.v
@@ -12,44 +12,23 @@ Require Import External_FunsExternal.
 Include External_FunsExternal.
 Module External_Funs.
 
-(** [external::swap]: forward function
+(** [external::swap]:
     Source: 'src/external.rs', lines 6:0-6:46 *)
 Definition swap
-  (T : Type) (x : T) (y : T) (st : state) : result (state * unit) :=
-  p <- core_mem_swap T x y st;
-  let (st0, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st0;
-  let (st1, _) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st1;
-  let (st2, _) := p1 in
-  Return (st2, tt)
+  (T : Type) (x : T) (y : T) (st : state) : result (state * (T * T)) :=
+  core_mem_swap T x y st
 .
 
-(** [external::swap]: backward function 0
-    Source: 'src/external.rs', lines 6:0-6:46 *)
-Definition swap_back
-  (T : Type) (x : T) (y : T) (st : state) (st0 : state) :
-  result (state * (T * T))
-  :=
-  p <- core_mem_swap T x y st;
-  let (st1, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st1;
-  let (st2, x0) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st2;
-  let (_, y0) := p1 in
-  Return (st0, (x0, y0))
-.
-
-(** [external::test_new_non_zero_u32]: forward function
+(** [external::test_new_non_zero_u32]:
     Source: 'src/external.rs', lines 11:0-11:60 *)
 Definition test_new_non_zero_u32
   (x : u32) (st : state) : result (state * core_num_nonzero_NonZeroU32_t) :=
   p <- core_num_nonzero_NonZeroU32_new x st;
-  let (st0, o) := p in
-  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st0
+  let (st1, o) := p in
+  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st1
 .
 
-(** [external::test_vec]: forward function
+(** [external::test_vec]:
     Source: 'src/external.rs', lines 17:0-17:17 *)
 Definition test_vec : result unit :=
   let v := alloc_vec_Vec_new u32 in
@@ -60,59 +39,39 @@ Definition test_vec : result unit :=
 (** Unit test for [external::test_vec] *)
 Check (test_vec )%return.
 
-(** [external::custom_swap]: forward function
+(** [external::custom_swap]:
     Source: 'src/external.rs', lines 24:0-24:66 *)
 Definition custom_swap
-  (T : Type) (x : T) (y : T) (st : state) : result (state * T) :=
-  p <- core_mem_swap T x y st;
-  let (st0, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st0;
-  let (st1, x0) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st1;
-  let (st2, _) := p1 in
-  Return (st2, x0)
-.
-
-(** [external::custom_swap]: backward function 0
-    Source: 'src/external.rs', lines 24:0-24:66 *)
-Definition custom_swap_back
-  (T : Type) (x : T) (y : T) (st : state) (ret : T) (st0 : state) :
-  result (state * (T * T))
+  (T : Type) (x : T) (y : T) (st : state) :
+  result (state * (T * (T -> state -> result (state * (T * T)))))
   :=
   p <- core_mem_swap T x y st;
-  let (st1, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st1;
-  let (st2, _) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st2;
-  let (_, y0) := p1 in
-  Return (st0, (ret, y0))
+  let (st1, p1) := p in
+  let (t, t1) := p1 in
+  let back_'a := fun (ret : T) (st2 : state) => Return (st2, (ret, t1)) in
+  Return (st1, (t, back_'a))
 .
 
-(** [external::test_custom_swap]: forward function
+(** [external::test_custom_swap]:
     Source: 'src/external.rs', lines 29:0-29:59 *)
 Definition test_custom_swap
-  (x : u32) (y : u32) (st : state) : result (state * unit) :=
-  p <- custom_swap u32 x y st; let (st0, _) := p in Return (st0, tt)
-.
-
-(** [external::test_custom_swap]: backward function 0
-    Source: 'src/external.rs', lines 29:0-29:59 *)
-Definition test_custom_swap_back
-  (x : u32) (y : u32) (st : state) (st0 : state) :
-  result (state * (u32 * u32))
-  :=
-  custom_swap_back u32 x y st 1%u32 st0
+  (x : u32) (y : u32) (st : state) : result (state * (u32 * u32)) :=
+  p <- custom_swap u32 x y st;
+  let (st1, p1) := p in
+  let (_, custom_swap_back) := p1 in
+  p2 <- custom_swap_back 1%u32 st1;
+  let (_, p3) := p2 in
+  let (x1, y1) := p3 in
+  Return (st1, (x1, y1))
 .
 
-(** [external::test_swap_non_zero]: forward function
+(** [external::test_swap_non_zero]:
     Source: 'src/external.rs', lines 35:0-35:44 *)
 Definition test_swap_non_zero (x : u32) (st : state) : result (state * u32) :=
   p <- swap u32 x 0%u32 st;
-  let (st0, _) := p in
-  p0 <- swap_back u32 x 0%u32 st st0;
-  let (st1, p1) := p0 in
-  let (x0, _) := p1 in
-  if x0 s= 0%u32 then Fail_ Failure else Return (st1, x0)
+  let (st1, p1) := p in
+  let (x1, _) := p1 in
+  if x1 s= 0%u32 then Fail_ Failure else Return (st1, x1)
 .
 
 End External_Funs.
diff --git a/tests/coq/misc/External_FunsExternal_Template.v b/tests/coq/misc/External_FunsExternal_Template.v
index 31e69c39..6773ac18 100644
--- a/tests/coq/misc/External_FunsExternal_Template.v
+++ b/tests/coq/misc/External_FunsExternal_Template.v
@@ -11,31 +11,19 @@ Require Import External_Types.
 Include External_Types.
 Module External_FunsExternal_Template.
 
-(** [core::mem::swap]: forward function
+(** [core::mem::swap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
 Axiom core_mem_swap :
-  forall(T : Type), T -> T -> state -> result (state * unit)
+  forall(T : Type), T -> T -> state -> result (state * (T * T))
 .
 
-(** [core::mem::swap]: backward function 0
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap_back0 :
-  forall(T : Type), T -> T -> state -> state -> result (state * T)
-.
-
-(** [core::mem::swap]: backward function 1
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap_back1 :
-  forall(T : Type), T -> T -> state -> state -> result (state * T)
-.
-
-(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]: forward function
+(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/num/nonzero.rs', lines 79:16-79:57 *)
 Axiom core_num_nonzero_NonZeroU32_new
   : u32 -> state -> result (state * (option core_num_nonzero_NonZeroU32_t))
 .
 
-(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+(** [core::option::{core::option::Option<T>}::unwrap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
 Axiom core_option_Option_unwrap :
   forall(T : Type), option T -> state -> result (state * T)
diff --git a/tests/coq/misc/Loops.v b/tests/coq/misc/Loops.v
index 83c249c1..313c2cfd 100644
--- a/tests/coq/misc/Loops.v
+++ b/tests/coq/misc/Loops.v
@@ -8,90 +8,90 @@ Import ListNotations.
 Local Open Scope Primitives_scope.
 Module Loops.
 
-(** [loops::sum]: loop 0: forward function
+(** [loops::sum]: loop 0:
     Source: 'src/loops.rs', lines 4:0-14:1 *)
 Fixpoint sum_loop (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if i s< max
-    then (s0 <- u32_add s i; i0 <- u32_add i 1%u32; sum_loop n0 max i0 s0)
+    then (s1 <- u32_add s i; i1 <- u32_add i 1%u32; sum_loop n1 max i1 s1)
     else u32_mul s 2%u32
   end
 .
 
-(** [loops::sum]: forward function
+(** [loops::sum]:
     Source: 'src/loops.rs', lines 4:0-4:27 *)
 Definition sum (n : nat) (max : u32) : result u32 :=
   sum_loop n max 0%u32 0%u32
 .
 
-(** [loops::sum_with_mut_borrows]: loop 0: forward function
+(** [loops::sum_with_mut_borrows]: loop 0:
     Source: 'src/loops.rs', lines 19:0-31:1 *)
 Fixpoint sum_with_mut_borrows_loop
   (n : nat) (max : u32) (mi : u32) (ms : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if mi s< max
     then (
-      ms0 <- u32_add ms mi;
-      mi0 <- u32_add mi 1%u32;
-      sum_with_mut_borrows_loop n0 max mi0 ms0)
+      ms1 <- u32_add ms mi;
+      mi1 <- u32_add mi 1%u32;
+      sum_with_mut_borrows_loop n1 max mi1 ms1)
     else u32_mul ms 2%u32
   end
 .
 
-(** [loops::sum_with_mut_borrows]: forward function
+(** [loops::sum_with_mut_borrows]:
     Source: 'src/loops.rs', lines 19:0-19:44 *)
 Definition sum_with_mut_borrows (n : nat) (max : u32) : result u32 :=
   sum_with_mut_borrows_loop n max 0%u32 0%u32
 .
 
-(** [loops::sum_with_shared_borrows]: loop 0: forward function
+(** [loops::sum_with_shared_borrows]: loop 0:
     Source: 'src/loops.rs', lines 34:0-48:1 *)
 Fixpoint sum_with_shared_borrows_loop
   (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if i s< max
     then (
-      i0 <- u32_add i 1%u32;
-      s0 <- u32_add s i0;
-      sum_with_shared_borrows_loop n0 max i0 s0)
+      i1 <- u32_add i 1%u32;
+      s1 <- u32_add s i1;
+      sum_with_shared_borrows_loop n1 max i1 s1)
     else u32_mul s 2%u32
   end
 .
 
-(** [loops::sum_with_shared_borrows]: forward function
+(** [loops::sum_with_shared_borrows]:
     Source: 'src/loops.rs', lines 34:0-34:47 *)
 Definition sum_with_shared_borrows (n : nat) (max : u32) : result u32 :=
   sum_with_shared_borrows_loop n max 0%u32 0%u32
 .
 
-(** [loops::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [loops::clear]: loop 0:
     Source: 'src/loops.rs', lines 52:0-58:1 *)
 Fixpoint clear_loop
   (n : nat) (v : alloc_vec_Vec u32) (i : usize) : result (alloc_vec_Vec u32) :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := alloc_vec_Vec_len u32 v in
-    if i s< i0
+  | S n1 =>
+    let i1 := alloc_vec_Vec_len u32 v in
+    if i s< i1
     then (
-      i1 <- usize_add i 1%usize;
-      v0 <-
-        alloc_vec_Vec_index_mut_back u32 usize
-          (core_slice_index_SliceIndexUsizeSliceTInst u32) v i 0%u32;
-      clear_loop n0 v0 i1)
+      p <-
+        alloc_vec_Vec_index_mut u32 usize
+          (core_slice_index_SliceIndexUsizeSliceTInst u32) v i;
+      let (_, index_mut_back) := p in
+      i2 <- usize_add i 1%usize;
+      v1 <- index_mut_back 0%u32;
+      clear_loop n1 v1 i2)
     else Return v
   end
 .
 
-(** [loops::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [loops::clear]:
     Source: 'src/loops.rs', lines 52:0-52:30 *)
 Definition clear
   (n : nat) (v : alloc_vec_Vec u32) : result (alloc_vec_Vec u32) :=
@@ -108,181 +108,146 @@ Inductive List_t (T : Type) :=
 Arguments List_Cons { _ }.
 Arguments List_Nil { _ }.
 
-(** [loops::list_mem]: loop 0: forward function
+(** [loops::list_mem]: loop 0:
     Source: 'src/loops.rs', lines 66:0-75:1 *)
 Fixpoint list_mem_loop (n : nat) (x : u32) (ls : List_t u32) : result bool :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
-    | List_Cons y tl => if y s= x then Return true else list_mem_loop n0 x tl
+    | List_Cons y tl => if y s= x then Return true else list_mem_loop n1 x tl
     | List_Nil => Return false
     end
   end
 .
 
-(** [loops::list_mem]: forward function
+(** [loops::list_mem]:
     Source: 'src/loops.rs', lines 66:0-66:52 *)
 Definition list_mem (n : nat) (x : u32) (ls : List_t u32) : result bool :=
   list_mem_loop n x ls
 .
 
-(** [loops::list_nth_mut_loop]: loop 0: forward function
+(** [loops::list_nth_mut_loop]: loop 0:
     Source: 'src/loops.rs', lines 78:0-88:1 *)
 Fixpoint list_nth_mut_loop_loop
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons x tl =>
-      if i s= 0%u32
-      then Return x
-      else (i0 <- u32_sub i 1%u32; list_nth_mut_loop_loop T n0 tl i0)
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop]: forward function
-    Source: 'src/loops.rs', lines 78:0-78:71 *)
-Definition list_nth_mut_loop
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  list_nth_mut_loop_loop T n ls i
-.
-
-(** [loops::list_nth_mut_loop]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 78:0-88:1 *)
-Fixpoint list_nth_mut_loop_loop_back
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+  (T : Type) (n : nat) (ls : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
-      then Return (List_Cons ret tl)
+      then
+        let back := fun (ret : T) => Return (List_Cons ret tl) in
+        Return (x, back)
       else (
-        i0 <- u32_sub i 1%u32;
-        tl0 <- list_nth_mut_loop_loop_back T n0 tl i0 ret;
-        Return (List_Cons x tl0))
+        i1 <- u32_sub i 1%u32;
+        p <- list_nth_mut_loop_loop T n1 tl i1;
+        let (t, back) := p in
+        let back1 := fun (ret : T) => tl1 <- back ret; Return (List_Cons x tl1)
+          in
+        Return (t, back1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_mut_loop]: backward function 0
+(** [loops::list_nth_mut_loop]:
     Source: 'src/loops.rs', lines 78:0-78:71 *)
-Definition list_nth_mut_loop_back
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+Definition list_nth_mut_loop
+  (T : Type) (n : nat) (ls : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
   :=
-  list_nth_mut_loop_loop_back T n ls i ret
+  p <- list_nth_mut_loop_loop T n ls i;
+  let (t, back) := p in
+  let back1 := fun (ret : T) => back ret in
+  Return (t, back1)
 .
 
-(** [loops::list_nth_shared_loop]: loop 0: forward function
+(** [loops::list_nth_shared_loop]: loop 0:
     Source: 'src/loops.rs', lines 91:0-101:1 *)
 Fixpoint list_nth_shared_loop_loop
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
       then Return x
-      else (i0 <- u32_sub i 1%u32; list_nth_shared_loop_loop T n0 tl i0)
+      else (i1 <- u32_sub i 1%u32; list_nth_shared_loop_loop T n1 tl i1)
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_shared_loop]: forward function
+(** [loops::list_nth_shared_loop]:
     Source: 'src/loops.rs', lines 91:0-91:66 *)
 Definition list_nth_shared_loop
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   list_nth_shared_loop_loop T n ls i
 .
 
-(** [loops::get_elem_mut]: loop 0: forward function
+(** [loops::get_elem_mut]: loop 0:
     Source: 'src/loops.rs', lines 103:0-117:1 *)
 Fixpoint get_elem_mut_loop
-  (n : nat) (x : usize) (ls : List_t usize) : result usize :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons y tl => if y s= x then Return y else get_elem_mut_loop n0 x tl
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::get_elem_mut]: forward function
-    Source: 'src/loops.rs', lines 103:0-103:73 *)
-Definition get_elem_mut
-  (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) :
-  result usize
-  :=
-  l <-
-    alloc_vec_Vec_index_mut (List_t usize) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (List_t usize)) slots 0%usize;
-  get_elem_mut_loop n x l
-.
-
-(** [loops::get_elem_mut]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 103:0-117:1 *)
-Fixpoint get_elem_mut_loop_back
-  (n : nat) (x : usize) (ls : List_t usize) (ret : usize) :
-  result (List_t usize)
+  (n : nat) (x : usize) (ls : List_t usize) :
+  result (usize * (usize -> result (List_t usize)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons y tl =>
       if y s= x
-      then Return (List_Cons ret tl)
+      then
+        let back := fun (ret : usize) => Return (List_Cons ret tl) in
+        Return (y, back)
       else (
-        tl0 <- get_elem_mut_loop_back n0 x tl ret; Return (List_Cons y tl0))
+        p <- get_elem_mut_loop n1 x tl;
+        let (i, back) := p in
+        let back1 :=
+          fun (ret : usize) => tl1 <- back ret; Return (List_Cons y tl1) in
+        Return (i, back1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::get_elem_mut]: backward function 0
+(** [loops::get_elem_mut]:
     Source: 'src/loops.rs', lines 103:0-103:73 *)
-Definition get_elem_mut_back
-  (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) (ret : usize) :
-  result (alloc_vec_Vec (List_t usize))
+Definition get_elem_mut
+  (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) :
+  result (usize * (usize -> result (alloc_vec_Vec (List_t usize))))
   :=
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (List_t usize) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (List_t usize)) slots 0%usize;
-  l0 <- get_elem_mut_loop_back n x l ret;
-  alloc_vec_Vec_index_mut_back (List_t usize) usize
-    (core_slice_index_SliceIndexUsizeSliceTInst (List_t usize)) slots 0%usize
-    l0
+  let (l, index_mut_back) := p in
+  p1 <- get_elem_mut_loop n x l;
+  let (i, back) := p1 in
+  let back1 := fun (ret : usize) => l1 <- back ret; index_mut_back l1 in
+  Return (i, back1)
 .
 
-(** [loops::get_elem_shared]: loop 0: forward function
+(** [loops::get_elem_shared]: loop 0:
     Source: 'src/loops.rs', lines 119:0-133:1 *)
 Fixpoint get_elem_shared_loop
   (n : nat) (x : usize) (ls : List_t usize) : result usize :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons y tl =>
-      if y s= x then Return y else get_elem_shared_loop n0 x tl
+      if y s= x then Return y else get_elem_shared_loop n1 x tl
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::get_elem_shared]: forward function
+(** [loops::get_elem_shared]:
     Source: 'src/loops.rs', lines 119:0-119:68 *)
 Definition get_elem_shared
   (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) :
@@ -294,123 +259,114 @@ Definition get_elem_shared
   get_elem_shared_loop n x l
 .
 
-(** [loops::id_mut]: forward function
-    Source: 'src/loops.rs', lines 135:0-135:50 *)
-Definition id_mut (T : Type) (ls : List_t T) : result (List_t T) :=
-  Return ls.
-
-(** [loops::id_mut]: backward function 0
+(** [loops::id_mut]:
     Source: 'src/loops.rs', lines 135:0-135:50 *)
-Definition id_mut_back
-  (T : Type) (ls : List_t T) (ret : List_t T) : result (List_t T) :=
-  Return ret
+Definition id_mut
+  (T : Type) (ls : List_t T) :
+  result ((List_t T) * (List_t T -> result (List_t T)))
+  :=
+  let back := fun (ret : List_t T) => Return ret in Return (ls, back)
 .
 
-(** [loops::id_shared]: forward function
+(** [loops::id_shared]:
     Source: 'src/loops.rs', lines 139:0-139:45 *)
 Definition id_shared (T : Type) (ls : List_t T) : result (List_t T) :=
   Return ls
 .
 
-(** [loops::list_nth_mut_loop_with_id]: loop 0: forward function
+(** [loops::list_nth_mut_loop_with_id]: loop 0:
     Source: 'src/loops.rs', lines 144:0-155:1 *)
 Fixpoint list_nth_mut_loop_with_id_loop
-  (T : Type) (n : nat) (i : u32) (ls : List_t T) : result T :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons x tl =>
-      if i s= 0%u32
-      then Return x
-      else (i0 <- u32_sub i 1%u32; list_nth_mut_loop_with_id_loop T n0 i0 tl)
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_with_id]: forward function
-    Source: 'src/loops.rs', lines 144:0-144:75 *)
-Definition list_nth_mut_loop_with_id
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  ls0 <- id_mut T ls; list_nth_mut_loop_with_id_loop T n i ls0
-.
-
-(** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 144:0-155:1 *)
-Fixpoint list_nth_mut_loop_with_id_loop_back
-  (T : Type) (n : nat) (i : u32) (ls : List_t T) (ret : T) :
-  result (List_t T)
+  (T : Type) (n : nat) (i : u32) (ls : List_t T) :
+  result (T * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
-      then Return (List_Cons ret tl)
+      then
+        let back := fun (ret : T) => Return (List_Cons ret tl) in
+        Return (x, back)
       else (
-        i0 <- u32_sub i 1%u32;
-        tl0 <- list_nth_mut_loop_with_id_loop_back T n0 i0 tl ret;
-        Return (List_Cons x tl0))
+        i1 <- u32_sub i 1%u32;
+        p <- list_nth_mut_loop_with_id_loop T n1 i1 tl;
+        let (t, back) := p in
+        let back1 := fun (ret : T) => tl1 <- back ret; Return (List_Cons x tl1)
+          in
+        Return (t, back1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_mut_loop_with_id]: backward function 0
+(** [loops::list_nth_mut_loop_with_id]:
     Source: 'src/loops.rs', lines 144:0-144:75 *)
-Definition list_nth_mut_loop_with_id_back
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+Definition list_nth_mut_loop_with_id
+  (T : Type) (n : nat) (ls : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
   :=
-  ls0 <- id_mut T ls;
-  l <- list_nth_mut_loop_with_id_loop_back T n i ls0 ret;
-  id_mut_back T ls l
+  p <- id_mut T ls;
+  let (ls1, id_mut_back) := p in
+  p1 <- list_nth_mut_loop_with_id_loop T n i ls1;
+  let (t, back) := p1 in
+  let back1 := fun (ret : T) => l <- back ret; id_mut_back l in
+  Return (t, back1)
 .
 
-(** [loops::list_nth_shared_loop_with_id]: loop 0: forward function
+(** [loops::list_nth_shared_loop_with_id]: loop 0:
     Source: 'src/loops.rs', lines 158:0-169:1 *)
 Fixpoint list_nth_shared_loop_with_id_loop
   (T : Type) (n : nat) (i : u32) (ls : List_t T) : result T :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
       then Return x
       else (
-        i0 <- u32_sub i 1%u32; list_nth_shared_loop_with_id_loop T n0 i0 tl)
+        i1 <- u32_sub i 1%u32; list_nth_shared_loop_with_id_loop T n1 i1 tl)
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_shared_loop_with_id]: forward function
+(** [loops::list_nth_shared_loop_with_id]:
     Source: 'src/loops.rs', lines 158:0-158:70 *)
 Definition list_nth_shared_loop_with_id
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  ls0 <- id_shared T ls; list_nth_shared_loop_with_id_loop T n i ls0
+  ls1 <- id_shared T ls; list_nth_shared_loop_with_id_loop T n i ls1
 .
 
-(** [loops::list_nth_mut_loop_pair]: loop 0: forward function
+(** [loops::list_nth_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 174:0-195:1 *)
 Fixpoint list_nth_mut_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl0) in
+          let back_'b := fun (ret : T) => Return (List_Cons ret tl1) in
+          Return ((x0, x1), back_'a, back_'b)
         else (
-          i0 <- u32_sub i 1%u32; list_nth_mut_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          t <- list_nth_mut_loop_pair_loop T n1 tl0 tl1 i1;
+          let (p, back_'a, back_'b) := t in
+          let back_'a1 :=
+            fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
+          let back_'b1 :=
+            fun (ret : T) => tl11 <- back_'b ret; Return (List_Cons x1 tl11) in
+          Return (p, back_'a1, back_'b1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -418,86 +374,20 @@ Fixpoint list_nth_mut_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_mut_loop_pair]: forward function
+(** [loops::list_nth_mut_loop_pair]:
     Source: 'src/loops.rs', lines 174:0-178:27 *)
 Definition list_nth_mut_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)) * (T -> result (List_t T)))
   :=
-  list_nth_mut_loop_pair_loop T n ls0 ls1 i
+  t <- list_nth_mut_loop_pair_loop T n ls0 ls1 i;
+  let (p, back_'a, back_'b) := t in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  let back_'b1 := fun (ret : T) => back_'b ret in
+  Return (p, back_'a1, back_'b1)
 .
 
-(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 174:0-195:1 *)
-Fixpoint list_nth_mut_loop_pair_loop_back'a
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl0)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl00 <- list_nth_mut_loop_pair_loop_back'a T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x0 tl00))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_pair]: backward function 0
-    Source: 'src/loops.rs', lines 174:0-178:27 *)
-Definition list_nth_mut_loop_pair_back'a
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_mut_loop_pair_loop_back'a T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1
-    Source: 'src/loops.rs', lines 174:0-195:1 *)
-Fixpoint list_nth_mut_loop_pair_loop_back'b
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl10 <- list_nth_mut_loop_pair_loop_back'b T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_pair]: backward function 1
-    Source: 'src/loops.rs', lines 174:0-178:27 *)
-Definition list_nth_mut_loop_pair_back'b
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_mut_loop_pair_loop_back'b T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_shared_loop_pair]: loop 0: forward function
+(** [loops::list_nth_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 198:0-219:1 *)
 Fixpoint list_nth_shared_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -505,7 +395,7 @@ Fixpoint list_nth_shared_loop_pair_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
@@ -513,7 +403,7 @@ Fixpoint list_nth_shared_loop_pair_loop
         if i s= 0%u32
         then Return (x0, x1)
         else (
-          i0 <- u32_sub i 1%u32; list_nth_shared_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32; list_nth_shared_loop_pair_loop T n1 tl0 tl1 i1)
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -521,7 +411,7 @@ Fixpoint list_nth_shared_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_shared_loop_pair]: forward function
+(** [loops::list_nth_shared_loop_pair]:
     Source: 'src/loops.rs', lines 198:0-202:19 *)
 Definition list_nth_shared_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -530,24 +420,36 @@ Definition list_nth_shared_loop_pair
   list_nth_shared_loop_pair_loop T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 223:0-238:1 *)
 Fixpoint list_nth_mut_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * ((T * T) -> result ((List_t T) * (List_t T))))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a :=
+            fun (ret : (T * T)) =>
+              let (t, t1) := ret in Return (List_Cons t tl0, List_Cons t1 tl1)
+            in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_mut_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_mut_loop_pair_merge_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : (T * T)) =>
+              p2 <- back_'a ret;
+              let (tl01, tl11) := p2 in
+              Return (List_Cons x0 tl01, List_Cons x1 tl11) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -555,54 +457,19 @@ Fixpoint list_nth_mut_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_mut_loop_pair_merge]: forward function
+(** [loops::list_nth_mut_loop_pair_merge]:
     Source: 'src/loops.rs', lines 223:0-227:27 *)
 Definition list_nth_mut_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * ((T * T) -> result ((List_t T) * (List_t T))))
   :=
-  list_nth_mut_loop_pair_merge_loop T n ls0 ls1 i
+  p <- list_nth_mut_loop_pair_merge_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : (T * T)) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
-(** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 223:0-238:1 *)
-Fixpoint list_nth_mut_loop_pair_merge_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32)
-  (ret : (T * T)) :
-  result ((List_t T) * (List_t T))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then let (t, t0) := ret in Return (List_Cons t tl0, List_Cons t0 tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          p <- list_nth_mut_loop_pair_merge_loop_back T n0 tl0 tl1 i0 ret;
-          let (tl00, tl10) := p in
-          Return (List_Cons x0 tl00, List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 223:0-227:27 *)
-Definition list_nth_mut_loop_pair_merge_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32)
-  (ret : (T * T)) :
-  result ((List_t T) * (List_t T))
-  :=
-  list_nth_mut_loop_pair_merge_loop_back T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 241:0-256:1 *)
 Fixpoint list_nth_shared_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -610,7 +477,7 @@ Fixpoint list_nth_shared_loop_pair_merge_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
@@ -618,8 +485,8 @@ Fixpoint list_nth_shared_loop_pair_merge_loop
         if i s= 0%u32
         then Return (x0, x1)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_shared_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          list_nth_shared_loop_pair_merge_loop T n1 tl0 tl1 i1)
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -627,7 +494,7 @@ Fixpoint list_nth_shared_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_shared_loop_pair_merge]: forward function
+(** [loops::list_nth_shared_loop_pair_merge]:
     Source: 'src/loops.rs', lines 241:0-245:19 *)
 Definition list_nth_shared_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -636,24 +503,30 @@ Definition list_nth_shared_loop_pair_merge
   list_nth_shared_loop_pair_merge_loop T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 259:0-274:1 *)
 Fixpoint list_nth_mut_shared_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl0) in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_mut_shared_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_mut_shared_loop_pair_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -661,68 +534,42 @@ Fixpoint list_nth_mut_shared_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair]: forward function
+(** [loops::list_nth_mut_shared_loop_pair]:
     Source: 'src/loops.rs', lines 259:0-263:23 *)
 Definition list_nth_mut_shared_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_mut_shared_loop_pair_loop T n ls0 ls1 i
+  p <- list_nth_mut_shared_loop_pair_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
-(** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 259:0-274:1 *)
-Fixpoint list_nth_mut_shared_loop_pair_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl0)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl00 <- list_nth_mut_shared_loop_pair_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x0 tl00))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_shared_loop_pair]: backward function 0
-    Source: 'src/loops.rs', lines 259:0-263:23 *)
-Definition list_nth_mut_shared_loop_pair_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_mut_shared_loop_pair_loop_back T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 278:0-293:1 *)
 Fixpoint list_nth_mut_shared_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl0) in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_mut_shared_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_mut_shared_loop_pair_merge_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -730,69 +577,42 @@ Fixpoint list_nth_mut_shared_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair_merge]: forward function
+(** [loops::list_nth_mut_shared_loop_pair_merge]:
     Source: 'src/loops.rs', lines 278:0-282:23 *)
 Definition list_nth_mut_shared_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
-  :=
-  list_nth_mut_shared_loop_pair_merge_loop T n ls0 ls1 i
-.
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 278:0-293:1 *)
-Fixpoint list_nth_mut_shared_loop_pair_merge_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl0)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl00 <-
-            list_nth_mut_shared_loop_pair_merge_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x0 tl00))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 278:0-282:23 *)
-Definition list_nth_mut_shared_loop_pair_merge_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_mut_shared_loop_pair_merge_loop_back T n ls0 ls1 i ret
+  p <- list_nth_mut_shared_loop_pair_merge_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
-(** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 297:0-312:1 *)
 Fixpoint list_nth_shared_mut_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'b := fun (ret : T) => Return (List_Cons ret tl1) in
+          Return ((x0, x1), back_'b)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_shared_mut_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_shared_mut_loop_pair_loop T n1 tl0 tl1 i1;
+          let (p1, back_'b) := p in
+          let back_'b1 :=
+            fun (ret : T) => tl11 <- back_'b ret; Return (List_Cons x1 tl11) in
+          Return (p1, back_'b1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -800,68 +620,42 @@ Fixpoint list_nth_shared_mut_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair]: forward function
+(** [loops::list_nth_shared_mut_loop_pair]:
     Source: 'src/loops.rs', lines 297:0-301:23 *)
 Definition list_nth_shared_mut_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_shared_mut_loop_pair_loop T n ls0 ls1 i
-.
-
-(** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1
-    Source: 'src/loops.rs', lines 297:0-312:1 *)
-Fixpoint list_nth_shared_mut_loop_pair_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl10 <- list_nth_shared_mut_loop_pair_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
+  p <- list_nth_shared_mut_loop_pair_loop T n ls0 ls1 i;
+  let (p1, back_'b) := p in
+  let back_'b1 := fun (ret : T) => back_'b ret in
+  Return (p1, back_'b1)
 .
 
-(** [loops::list_nth_shared_mut_loop_pair]: backward function 1
-    Source: 'src/loops.rs', lines 297:0-301:23 *)
-Definition list_nth_shared_mut_loop_pair_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_shared_mut_loop_pair_loop_back T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 316:0-331:1 *)
 Fixpoint list_nth_shared_mut_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl1) in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_shared_mut_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_shared_mut_loop_pair_merge_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : T) => tl11 <- back_'a ret; Return (List_Cons x1 tl11) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -869,49 +663,16 @@ Fixpoint list_nth_shared_mut_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair_merge]: forward function
+(** [loops::list_nth_shared_mut_loop_pair_merge]:
     Source: 'src/loops.rs', lines 316:0-320:23 *)
 Definition list_nth_shared_mut_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
-  :=
-  list_nth_shared_mut_loop_pair_merge_loop T n ls0 ls1 i
-.
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 316:0-331:1 *)
-Fixpoint list_nth_shared_mut_loop_pair_merge_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl10 <-
-            list_nth_shared_mut_loop_pair_merge_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 316:0-320:23 *)
-Definition list_nth_shared_mut_loop_pair_merge_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_shared_mut_loop_pair_merge_loop_back T n ls0 ls1 i ret
+  p <- list_nth_shared_mut_loop_pair_merge_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
 End Loops.
diff --git a/tests/coq/misc/Paper.v b/tests/coq/misc/Paper.v
index 6b110193..e46df0ce 100644
--- a/tests/coq/misc/Paper.v
+++ b/tests/coq/misc/Paper.v
@@ -8,44 +8,40 @@ Import ListNotations.
 Local Open Scope Primitives_scope.
 Module Paper.
 
-(** [paper::ref_incr]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [paper::ref_incr]:
     Source: 'src/paper.rs', lines 4:0-4:28 *)
 Definition ref_incr (x : i32) : result i32 :=
   i32_add x 1%i32.
 
-(** [paper::test_incr]: forward function
+(** [paper::test_incr]:
     Source: 'src/paper.rs', lines 8:0-8:18 *)
 Definition test_incr : result unit :=
-  x <- ref_incr 0%i32; if negb (x s= 1%i32) then Fail_ Failure else Return tt
+  i <- ref_incr 0%i32; if negb (i s= 1%i32) then Fail_ Failure else Return tt
 .
 
 (** Unit test for [paper::test_incr] *)
 Check (test_incr )%return.
 
-(** [paper::choose]: forward function
+(** [paper::choose]:
     Source: 'src/paper.rs', lines 15:0-15:70 *)
-Definition choose (T : Type) (b : bool) (x : T) (y : T) : result T :=
-  if b then Return x else Return y
+Definition choose
+  (T : Type) (b : bool) (x : T) (y : T) : result (T * (T -> result (T * T))) :=
+  if b
+  then let back_'a := fun (ret : T) => Return (ret, y) in Return (x, back_'a)
+  else let back_'a := fun (ret : T) => Return (x, ret) in Return (y, back_'a)
 .
 
-(** [paper::choose]: backward function 0
-    Source: 'src/paper.rs', lines 15:0-15:70 *)
-Definition choose_back
-  (T : Type) (b : bool) (x : T) (y : T) (ret : T) : result (T * T) :=
-  if b then Return (ret, y) else Return (x, ret)
-.
-
-(** [paper::test_choose]: forward function
+(** [paper::test_choose]:
     Source: 'src/paper.rs', lines 23:0-23:20 *)
 Definition test_choose : result unit :=
-  z <- choose i32 true 0%i32 0%i32;
-  z0 <- i32_add z 1%i32;
-  if negb (z0 s= 1%i32)
+  p <- choose i32 true 0%i32 0%i32;
+  let (z, choose_back) := p in
+  z1 <- i32_add z 1%i32;
+  if negb (z1 s= 1%i32)
   then Fail_ Failure
   else (
-    p <- choose_back i32 true 0%i32 0%i32 z0;
-    let (x, y) := p in
+    p1 <- choose_back z1;
+    let (x, y) := p1 in
     if negb (x s= 1%i32)
     then Fail_ Failure
     else if negb (y s= 0%i32) then Fail_ Failure else Return tt)
@@ -64,35 +60,31 @@ Inductive List_t (T : Type) :=
 Arguments List_Cons { _ }.
 Arguments List_Nil { _ }.
 
-(** [paper::list_nth_mut]: forward function
-    Source: 'src/paper.rs', lines 42:0-42:67 *)
-Fixpoint list_nth_mut (T : Type) (l : List_t T) (i : u32) : result T :=
-  match l with
-  | List_Cons x tl =>
-    if i s= 0%u32
-    then Return x
-    else (i0 <- u32_sub i 1%u32; list_nth_mut T tl i0)
-  | List_Nil => Fail_ Failure
-  end
-.
-
-(** [paper::list_nth_mut]: backward function 0
+(** [paper::list_nth_mut]:
     Source: 'src/paper.rs', lines 42:0-42:67 *)
-Fixpoint list_nth_mut_back
-  (T : Type) (l : List_t T) (i : u32) (ret : T) : result (List_t T) :=
+Fixpoint list_nth_mut
+  (T : Type) (l : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
+  :=
   match l with
   | List_Cons x tl =>
     if i s= 0%u32
-    then Return (List_Cons ret tl)
+    then
+      let back_'a := fun (ret : T) => Return (List_Cons ret tl) in
+      Return (x, back_'a)
     else (
-      i0 <- u32_sub i 1%u32;
-      tl0 <- list_nth_mut_back T tl i0 ret;
-      Return (List_Cons x tl0))
+      i1 <- u32_sub i 1%u32;
+      p <- list_nth_mut T tl i1;
+      let (t, list_nth_mut_back) := p in
+      let back_'a :=
+        fun (ret : T) => tl1 <- list_nth_mut_back ret; Return (List_Cons x tl1)
+        in
+      Return (t, back_'a))
   | List_Nil => Fail_ Failure
   end
 .
 
-(** [paper::sum]: forward function
+(** [paper::sum]:
     Source: 'src/paper.rs', lines 57:0-57:32 *)
 Fixpoint sum (l : List_t i32) : result i32 :=
   match l with
@@ -101,31 +93,33 @@ Fixpoint sum (l : List_t i32) : result i32 :=
   end
 .
 
-(** [paper::test_nth]: forward function
+(** [paper::test_nth]:
     Source: 'src/paper.rs', lines 68:0-68:17 *)
 Definition test_nth : result unit :=
   let l := List_Nil in
-  let l0 := List_Cons 3%i32 l in
-  let l1 := List_Cons 2%i32 l0 in
-  x <- list_nth_mut i32 (List_Cons 1%i32 l1) 2%u32;
-  x0 <- i32_add x 1%i32;
-  l2 <- list_nth_mut_back i32 (List_Cons 1%i32 l1) 2%u32 x0;
-  i <- sum l2;
+  let l1 := List_Cons 3%i32 l in
+  let l2 := List_Cons 2%i32 l1 in
+  p <- list_nth_mut i32 (List_Cons 1%i32 l2) 2%u32;
+  let (x, list_nth_mut_back) := p in
+  x1 <- i32_add x 1%i32;
+  l3 <- list_nth_mut_back x1;
+  i <- sum l3;
   if negb (i s= 7%i32) then Fail_ Failure else Return tt
 .
 
 (** Unit test for [paper::test_nth] *)
 Check (test_nth )%return.
 
-(** [paper::call_choose]: forward function
+(** [paper::call_choose]:
     Source: 'src/paper.rs', lines 76:0-76:44 *)
 Definition call_choose (p : (u32 * u32)) : result u32 :=
   let (px, py) := p in
-  pz <- choose u32 true px py;
-  pz0 <- u32_add pz 1%u32;
-  p0 <- choose_back u32 true px py pz0;
-  let (px0, _) := p0 in
-  Return px0
+  p1 <- choose u32 true px py;
+  let (pz, choose_back) := p1 in
+  pz1 <- u32_add pz 1%u32;
+  p2 <- choose_back pz1;
+  let (px1, _) := p2 in
+  Return px1
 .
 
 End Paper.
diff --git a/tests/coq/misc/PoloniusList.v b/tests/coq/misc/PoloniusList.v
index 2371b1cc..7e967855 100644
--- a/tests/coq/misc/PoloniusList.v
+++ b/tests/coq/misc/PoloniusList.v
@@ -18,26 +18,28 @@ Inductive List_t (T : Type) :=
 Arguments List_Cons { _ }.
 Arguments List_Nil { _ }.
 
-(** [polonius_list::get_list_at_x]: forward function
+(** [polonius_list::get_list_at_x]:
     Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
-Fixpoint get_list_at_x (ls : List_t u32) (x : u32) : result (List_t u32) :=
-  match ls with
-  | List_Cons hd tl =>
-    if hd s= x then Return (List_Cons hd tl) else get_list_at_x tl x
-  | List_Nil => Return List_Nil
-  end
-.
-
-(** [polonius_list::get_list_at_x]: backward function 0
-    Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
-Fixpoint get_list_at_x_back
-  (ls : List_t u32) (x : u32) (ret : List_t u32) : result (List_t u32) :=
+Fixpoint get_list_at_x
+  (ls : List_t u32) (x : u32) :
+  result ((List_t u32) * (List_t u32 -> result (List_t u32)))
+  :=
   match ls with
   | List_Cons hd tl =>
     if hd s= x
-    then Return ret
-    else (tl0 <- get_list_at_x_back tl x ret; Return (List_Cons hd tl0))
-  | List_Nil => Return ret
+    then
+      let back_'a := fun (ret : List_t u32) => Return ret in
+      Return (List_Cons hd tl, back_'a)
+    else (
+      p <- get_list_at_x tl x;
+      let (l, get_list_at_x_back) := p in
+      let back_'a :=
+        fun (ret : List_t u32) =>
+          tl1 <- get_list_at_x_back ret; Return (List_Cons hd tl1) in
+      Return (l, back_'a))
+  | List_Nil =>
+    let back_'a := fun (ret : List_t u32) => Return ret in
+    Return (List_Nil, back_'a)
   end
 .
 
diff --git a/tests/coq/misc/Primitives.v b/tests/coq/misc/Primitives.v
index c0056073..990e27e4 100644
--- a/tests/coq/misc/Primitives.v
+++ b/tests/coq/misc/Primitives.v
@@ -67,7 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a * (a -> a) := (x, fun x => x) .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -585,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -592,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
diff --git a/tests/coq/misc/_CoqProject b/tests/coq/misc/_CoqProject
index 869cdb4d..64cddedd 100644
--- a/tests/coq/misc/_CoqProject
+++ b/tests/coq/misc/_CoqProject
@@ -8,9 +8,9 @@ External_Types.v
 Primitives.v
 External_Funs.v
 External_TypesExternal.v
+Paper.v
 Constants.v
 PoloniusList.v
-Paper.v
 NoNestedBorrows.v
 External_FunsExternal.v
 Bitwise.v