From 3688596f27a1ba461f48e88446b8812ec73f1a2f Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 22 Dec 2023 19:09:16 +0100
Subject: Add an option to split the fwd/back functions and fix a minor issue

---
 tests/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tests')

diff --git a/tests/Makefile b/tests/Makefile
index 8d40e8da..ccdbf652 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -1,4 +1,4 @@
-all: test-fstar test-coq test-lean test-hol4
+all: test-fstar test-fstar-split test-coq test-lean test-hol4
 
 test-%:
 	cd $* && $(MAKE) all
-- 
cgit v1.2.3


From 20f743016400fadc5726203e3631d32b6244bd1b Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 22 Dec 2023 19:16:55 +0100
Subject: Regenerate some of the NoNestedBorrows tests

---
 tests/fstar/misc/NoNestedBorrows.fst | 377 ++++++++++++-------------
 tests/fstar/misc/Primitives.fst      | 111 ++------
 tests/lean/NoNestedBorrows.lean      | 532 +++++++++++++++++------------------
 3 files changed, 474 insertions(+), 546 deletions(-)

(limited to 'tests')

diff --git a/tests/fstar/misc/NoNestedBorrows.fst b/tests/fstar/misc/NoNestedBorrows.fst
index 1386b02c..0fd0c1dc 100644
--- a/tests/fstar/misc/NoNestedBorrows.fst
+++ b/tests/fstar/misc/NoNestedBorrows.fst
@@ -37,96 +37,96 @@ type sum_t (t1 t2 : Type0) =
 | Sum_Left : t1 -> sum_t t1 t2
 | Sum_Right : t2 -> sum_t t1 t2
 
-(** [no_nested_borrows::neg_test]: forward function
+(** [no_nested_borrows::neg_test]:
     Source: 'src/no_nested_borrows.rs', lines 48:0-48:30 *)
 let neg_test (x : i32) : result i32 =
   i32_neg x
 
-(** [no_nested_borrows::add_u32]: forward function
+(** [no_nested_borrows::add_u32]:
     Source: 'src/no_nested_borrows.rs', lines 54:0-54:37 *)
 let add_u32 (x : u32) (y : u32) : result u32 =
   u32_add x y
 
-(** [no_nested_borrows::subs_u32]: forward function
+(** [no_nested_borrows::subs_u32]:
     Source: 'src/no_nested_borrows.rs', lines 60:0-60:38 *)
 let subs_u32 (x : u32) (y : u32) : result u32 =
   u32_sub x y
 
-(** [no_nested_borrows::div_u32]: forward function
+(** [no_nested_borrows::div_u32]:
     Source: 'src/no_nested_borrows.rs', lines 66:0-66:37 *)
 let div_u32 (x : u32) (y : u32) : result u32 =
   u32_div x y
 
-(** [no_nested_borrows::div_u32_const]: forward function
+(** [no_nested_borrows::div_u32_const]:
     Source: 'src/no_nested_borrows.rs', lines 73:0-73:35 *)
 let div_u32_const (x : u32) : result u32 =
   u32_div x 2
 
-(** [no_nested_borrows::rem_u32]: forward function
+(** [no_nested_borrows::rem_u32]:
     Source: 'src/no_nested_borrows.rs', lines 78:0-78:37 *)
 let rem_u32 (x : u32) (y : u32) : result u32 =
   u32_rem x y
 
-(** [no_nested_borrows::mul_u32]: forward function
+(** [no_nested_borrows::mul_u32]:
     Source: 'src/no_nested_borrows.rs', lines 82:0-82:37 *)
 let mul_u32 (x : u32) (y : u32) : result u32 =
   u32_mul x y
 
-(** [no_nested_borrows::add_i32]: forward function
+(** [no_nested_borrows::add_i32]:
     Source: 'src/no_nested_borrows.rs', lines 88:0-88:37 *)
 let add_i32 (x : i32) (y : i32) : result i32 =
   i32_add x y
 
-(** [no_nested_borrows::subs_i32]: forward function
+(** [no_nested_borrows::subs_i32]:
     Source: 'src/no_nested_borrows.rs', lines 92:0-92:38 *)
 let subs_i32 (x : i32) (y : i32) : result i32 =
   i32_sub x y
 
-(** [no_nested_borrows::div_i32]: forward function
+(** [no_nested_borrows::div_i32]:
     Source: 'src/no_nested_borrows.rs', lines 96:0-96:37 *)
 let div_i32 (x : i32) (y : i32) : result i32 =
   i32_div x y
 
-(** [no_nested_borrows::div_i32_const]: forward function
+(** [no_nested_borrows::div_i32_const]:
     Source: 'src/no_nested_borrows.rs', lines 100:0-100:35 *)
 let div_i32_const (x : i32) : result i32 =
   i32_div x 2
 
-(** [no_nested_borrows::rem_i32]: forward function
+(** [no_nested_borrows::rem_i32]:
     Source: 'src/no_nested_borrows.rs', lines 104:0-104:37 *)
 let rem_i32 (x : i32) (y : i32) : result i32 =
   i32_rem x y
 
-(** [no_nested_borrows::mul_i32]: forward function
+(** [no_nested_borrows::mul_i32]:
     Source: 'src/no_nested_borrows.rs', lines 108:0-108:37 *)
 let mul_i32 (x : i32) (y : i32) : result i32 =
   i32_mul x y
 
-(** [no_nested_borrows::mix_arith_u32]: forward function
+(** [no_nested_borrows::mix_arith_u32]:
     Source: 'src/no_nested_borrows.rs', lines 112:0-112:51 *)
 let mix_arith_u32 (x : u32) (y : u32) (z : u32) : result u32 =
   let* i = u32_add x y in
-  let* i0 = u32_div x y in
-  let* i1 = u32_mul i i0 in
-  let* i2 = u32_rem z y in
-  let* i3 = u32_sub x i2 in
-  let* i4 = u32_add i1 i3 in
-  let* i5 = u32_add x y in
-  let* i6 = u32_add i5 z in
-  u32_rem i4 i6
-
-(** [no_nested_borrows::mix_arith_i32]: forward function
+  let* i1 = u32_div x y in
+  let* i2 = u32_mul i i1 in
+  let* i3 = u32_rem z y in
+  let* i4 = u32_sub x i3 in
+  let* i5 = u32_add i2 i4 in
+  let* i6 = u32_add x y in
+  let* i7 = u32_add i6 z in
+  u32_rem i5 i7
+
+(** [no_nested_borrows::mix_arith_i32]:
     Source: 'src/no_nested_borrows.rs', lines 116:0-116:51 *)
 let mix_arith_i32 (x : i32) (y : i32) (z : i32) : result i32 =
   let* i = i32_add x y in
-  let* i0 = i32_div x y in
-  let* i1 = i32_mul i i0 in
-  let* i2 = i32_rem z y in
-  let* i3 = i32_sub x i2 in
-  let* i4 = i32_add i1 i3 in
-  let* i5 = i32_add x y in
-  let* i6 = i32_add i5 z in
-  i32_rem i4 i6
+  let* i1 = i32_div x y in
+  let* i2 = i32_mul i i1 in
+  let* i3 = i32_rem z y in
+  let* i4 = i32_sub x i3 in
+  let* i5 = i32_add i2 i4 in
+  let* i6 = i32_add x y in
+  let* i7 = i32_add i6 z in
+  i32_rem i5 i7
 
 (** [no_nested_borrows::CONST0]
     Source: 'src/no_nested_borrows.rs', lines 125:0-125:23 *)
@@ -138,22 +138,22 @@ let const0_c : usize = eval_global const0_body
 let const1_body : result usize = usize_mul 2 2
 let const1_c : usize = eval_global const1_body
 
-(** [no_nested_borrows::cast_u32_to_i32]: forward function
+(** [no_nested_borrows::cast_u32_to_i32]:
     Source: 'src/no_nested_borrows.rs', lines 128:0-128:37 *)
 let cast_u32_to_i32 (x : u32) : result i32 =
   scalar_cast U32 I32 x
 
-(** [no_nested_borrows::cast_bool_to_i32]: forward function
+(** [no_nested_borrows::cast_bool_to_i32]:
     Source: 'src/no_nested_borrows.rs', lines 132:0-132:39 *)
 let cast_bool_to_i32 (x : bool) : result i32 =
   scalar_cast_bool I32 x
 
-(** [no_nested_borrows::cast_bool_to_bool]: forward function
+(** [no_nested_borrows::cast_bool_to_bool]:
     Source: 'src/no_nested_borrows.rs', lines 137:0-137:41 *)
 let cast_bool_to_bool (x : bool) : result bool =
   Return x
 
-(** [no_nested_borrows::test2]: forward function
+(** [no_nested_borrows::test2]:
     Source: 'src/no_nested_borrows.rs', lines 142:0-142:14 *)
 let test2 : result unit =
   let* _ = u32_add 23 44 in Return ()
@@ -161,12 +161,12 @@ let test2 : result unit =
 (** Unit test for [no_nested_borrows::test2] *)
 let _ = assert_norm (test2 = Return ())
 
-(** [no_nested_borrows::get_max]: forward function
+(** [no_nested_borrows::get_max]:
     Source: 'src/no_nested_borrows.rs', lines 154:0-154:37 *)
 let get_max (x : u32) (y : u32) : result u32 =
   if x >= y then Return x else Return y
 
-(** [no_nested_borrows::test3]: forward function
+(** [no_nested_borrows::test3]:
     Source: 'src/no_nested_borrows.rs', lines 162:0-162:14 *)
 let test3 : result unit =
   let* x = get_max 4 3 in
@@ -177,7 +177,7 @@ let test3 : result unit =
 (** Unit test for [no_nested_borrows::test3] *)
 let _ = assert_norm (test3 = Return ())
 
-(** [no_nested_borrows::test_neg1]: forward function
+(** [no_nested_borrows::test_neg1]:
     Source: 'src/no_nested_borrows.rs', lines 169:0-169:18 *)
 let test_neg1 : result unit =
   let* y = i32_neg 3 in if not (y = -3) then Fail Failure else Return ()
@@ -185,7 +185,7 @@ let test_neg1 : result unit =
 (** Unit test for [no_nested_borrows::test_neg1] *)
 let _ = assert_norm (test_neg1 = Return ())
 
-(** [no_nested_borrows::refs_test1]: forward function
+(** [no_nested_borrows::refs_test1]:
     Source: 'src/no_nested_borrows.rs', lines 176:0-176:19 *)
 let refs_test1 : result unit =
   if not (1 = 1) then Fail Failure else Return ()
@@ -193,7 +193,7 @@ let refs_test1 : result unit =
 (** Unit test for [no_nested_borrows::refs_test1] *)
 let _ = assert_norm (refs_test1 = Return ())
 
-(** [no_nested_borrows::refs_test2]: forward function
+(** [no_nested_borrows::refs_test2]:
     Source: 'src/no_nested_borrows.rs', lines 187:0-187:19 *)
 let refs_test2 : result unit =
   if not (2 = 2)
@@ -209,7 +209,7 @@ let refs_test2 : result unit =
 (** Unit test for [no_nested_borrows::refs_test2] *)
 let _ = assert_norm (refs_test2 = Return ())
 
-(** [no_nested_borrows::test_list1]: forward function
+(** [no_nested_borrows::test_list1]:
     Source: 'src/no_nested_borrows.rs', lines 203:0-203:19 *)
 let test_list1 : result unit =
   Return ()
@@ -217,33 +217,34 @@ let test_list1 : result unit =
 (** Unit test for [no_nested_borrows::test_list1] *)
 let _ = assert_norm (test_list1 = Return ())
 
-(** [no_nested_borrows::test_box1]: forward function
+(** [no_nested_borrows::test_box1]:
     Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 *)
 let test_box1 : result unit =
   let b = 0 in
-  let* b0 = alloc_boxed_Box_deref_mut_back i32 b 1 in
-  let* x = alloc_boxed_Box_deref i32 b0 in
+  let* (_, deref_mut_back) = alloc_boxed_Box_deref_mut i32 b in
+  let* b1 = deref_mut_back 1 in
+  let* x = alloc_boxed_Box_deref i32 b1 in
   if not (x = 1) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_box1] *)
 let _ = assert_norm (test_box1 = Return ())
 
-(** [no_nested_borrows::copy_int]: forward function
+(** [no_nested_borrows::copy_int]:
     Source: 'src/no_nested_borrows.rs', lines 218:0-218:30 *)
 let copy_int (x : i32) : result i32 =
   Return x
 
-(** [no_nested_borrows::test_unreachable]: forward function
+(** [no_nested_borrows::test_unreachable]:
     Source: 'src/no_nested_borrows.rs', lines 224:0-224:32 *)
 let test_unreachable (b : bool) : result unit =
   if b then Fail Failure else Return ()
 
-(** [no_nested_borrows::test_panic]: forward function
+(** [no_nested_borrows::test_panic]:
     Source: 'src/no_nested_borrows.rs', lines 232:0-232:26 *)
 let test_panic (b : bool) : result unit =
   if b then Fail Failure else Return ()
 
-(** [no_nested_borrows::test_copy_int]: forward function
+(** [no_nested_borrows::test_copy_int]:
     Source: 'src/no_nested_borrows.rs', lines 239:0-239:22 *)
 let test_copy_int : result unit =
   let* y = copy_int 0 in if not (0 = y) then Fail Failure else Return ()
@@ -251,15 +252,15 @@ let test_copy_int : result unit =
 (** Unit test for [no_nested_borrows::test_copy_int] *)
 let _ = assert_norm (test_copy_int = Return ())
 
-(** [no_nested_borrows::is_cons]: forward function
+(** [no_nested_borrows::is_cons]:
     Source: 'src/no_nested_borrows.rs', lines 246:0-246:38 *)
 let is_cons (t : Type0) (l : list_t t) : result bool =
   begin match l with
-  | List_Cons x l0 -> Return true
+  | List_Cons _ _ -> Return true
   | List_Nil -> Return false
   end
 
-(** [no_nested_borrows::test_is_cons]: forward function
+(** [no_nested_borrows::test_is_cons]:
     Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 *)
 let test_is_cons : result unit =
   let l = List_Nil in
@@ -269,7 +270,7 @@ let test_is_cons : result unit =
 (** Unit test for [no_nested_borrows::test_is_cons] *)
 let _ = assert_norm (test_is_cons = Return ())
 
-(** [no_nested_borrows::split_list]: forward function
+(** [no_nested_borrows::split_list]:
     Source: 'src/no_nested_borrows.rs', lines 259:0-259:48 *)
 let split_list (t : Type0) (l : list_t t) : result (t & (list_t t)) =
   begin match l with
@@ -277,7 +278,7 @@ let split_list (t : Type0) (l : list_t t) : result (t & (list_t t)) =
   | List_Nil -> Fail Failure
   end
 
-(** [no_nested_borrows::test_split_list]: forward function
+(** [no_nested_borrows::test_split_list]:
     Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 *)
 let test_split_list : result unit =
   let l = List_Nil in
@@ -288,26 +289,23 @@ let test_split_list : result unit =
 (** Unit test for [no_nested_borrows::test_split_list] *)
 let _ = assert_norm (test_split_list = Return ())
 
-(** [no_nested_borrows::choose]: forward function
+(** [no_nested_borrows::choose]:
     Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 *)
-let choose (t : Type0) (b : bool) (x : t) (y : t) : result t =
-  if b then Return x else Return y
+let choose
+  (t : Type0) (b : bool) (x : t) (y : t) : result (t & (t -> result (t & t))) =
+  if b
+  then let back_'a = fun ret -> Return (ret, y) in Return (x, back_'a)
+  else let back_'a = fun ret -> Return (x, ret) in Return (y, back_'a)
 
-(** [no_nested_borrows::choose]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 *)
-let choose_back
-  (t : Type0) (b : bool) (x : t) (y : t) (ret : t) : result (t & t) =
-  if b then Return (ret, y) else Return (x, ret)
-
-(** [no_nested_borrows::choose_test]: forward function
+(** [no_nested_borrows::choose_test]:
     Source: 'src/no_nested_borrows.rs', lines 282:0-282:20 *)
 let choose_test : result unit =
-  let* z = choose i32 true 0 0 in
-  let* z0 = i32_add z 1 in
-  if not (z0 = 1)
+  let* (z, choose_back) = choose i32 true 0 0 in
+  let* z1 = i32_add z 1 in
+  if not (z1 = 1)
   then Fail Failure
   else
-    let* (x, y) = choose_back i32 true 0 0 z0 in
+    let* (x, y) = choose_back z1 in
     if not (x = 1)
     then Fail Failure
     else if not (y = 0) then Fail Failure else Return ()
@@ -315,7 +313,7 @@ let choose_test : result unit =
 (** Unit test for [no_nested_borrows::choose_test] *)
 let _ = assert_norm (choose_test = Return ())
 
-(** [no_nested_borrows::test_char]: forward function
+(** [no_nested_borrows::test_char]:
     Source: 'src/no_nested_borrows.rs', lines 294:0-294:26 *)
 let test_char : result char =
   Return 'a'
@@ -332,50 +330,47 @@ and nodeElem_t (t : Type0) =
 | NodeElem_Cons : tree_t t -> nodeElem_t t -> nodeElem_t t
 | NodeElem_Nil : nodeElem_t t
 
-(** [no_nested_borrows::list_length]: forward function
+(** [no_nested_borrows::list_length]:
     Source: 'src/no_nested_borrows.rs', lines 339:0-339:48 *)
 let rec list_length (t : Type0) (l : list_t t) : result u32 =
   begin match l with
-  | List_Cons x l1 -> let* i = list_length t l1 in u32_add 1 i
+  | List_Cons _ l1 -> let* i = list_length t l1 in u32_add 1 i
   | List_Nil -> Return 0
   end
 
-(** [no_nested_borrows::list_nth_shared]: forward function
+(** [no_nested_borrows::list_nth_shared]:
     Source: 'src/no_nested_borrows.rs', lines 347:0-347:62 *)
 let rec list_nth_shared (t : Type0) (l : list_t t) (i : u32) : result t =
   begin match l with
   | List_Cons x tl ->
     if i = 0
     then Return x
-    else let* i0 = u32_sub i 1 in list_nth_shared t tl i0
-  | List_Nil -> Fail Failure
-  end
-
-(** [no_nested_borrows::list_nth_mut]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 *)
-let rec list_nth_mut (t : Type0) (l : list_t t) (i : u32) : result t =
-  begin match l with
-  | List_Cons x tl ->
-    if i = 0 then Return x else let* i0 = u32_sub i 1 in list_nth_mut t tl i0
+    else let* i1 = u32_sub i 1 in list_nth_shared t tl i1
   | List_Nil -> Fail Failure
   end
 
-(** [no_nested_borrows::list_nth_mut]: backward function 0
+(** [no_nested_borrows::list_nth_mut]:
     Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 *)
-let rec list_nth_mut_back
-  (t : Type0) (l : list_t t) (i : u32) (ret : t) : result (list_t t) =
+let rec list_nth_mut
+  (t : Type0) (l : list_t t) (i : u32) :
+  result (t & (t -> result (list_t t)))
+  =
   begin match l with
   | List_Cons x tl ->
     if i = 0
-    then Return (List_Cons ret tl)
+    then
+      let back_'a = fun ret -> Return (List_Cons ret tl) in Return (x, back_'a)
     else
-      let* i0 = u32_sub i 1 in
-      let* tl0 = list_nth_mut_back t tl i0 ret in
-      Return (List_Cons x tl0)
+      let* i1 = u32_sub i 1 in
+      let* (x1, list_nth_mut_back) = list_nth_mut t tl i1 in
+      let back_'a =
+        fun ret -> let* tl1 = list_nth_mut_back ret in Return (List_Cons x tl1)
+        in
+      Return (x1, back_'a)
   | List_Nil -> Fail Failure
   end
 
-(** [no_nested_borrows::list_rev_aux]: forward function
+(** [no_nested_borrows::list_rev_aux]:
     Source: 'src/no_nested_borrows.rs', lines 379:0-379:63 *)
 let rec list_rev_aux
   (t : Type0) (li : list_t t) (lo : list_t t) : result (list_t t) =
@@ -384,120 +379,105 @@ let rec list_rev_aux
   | List_Nil -> Return lo
   end
 
-(** [no_nested_borrows::list_rev]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [no_nested_borrows::list_rev]:
     Source: 'src/no_nested_borrows.rs', lines 393:0-393:42 *)
 let list_rev (t : Type0) (l : list_t t) : result (list_t t) =
-  let li = core_mem_replace (list_t t) l List_Nil in list_rev_aux t li List_Nil
+  let (li, _) = core_mem_replace (list_t t) l List_Nil in
+  list_rev_aux t li List_Nil
 
-(** [no_nested_borrows::test_list_functions]: forward function
+(** [no_nested_borrows::test_list_functions]:
     Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 *)
 let test_list_functions : result unit =
   let l = List_Nil in
-  let l0 = List_Cons 2 l in
-  let l1 = List_Cons 1 l0 in
-  let* i = list_length i32 (List_Cons 0 l1) in
+  let l1 = List_Cons 2 l in
+  let l2 = List_Cons 1 l1 in
+  let* i = list_length i32 (List_Cons 0 l2) in
   if not (i = 3)
   then Fail Failure
   else
-    let* i0 = list_nth_shared i32 (List_Cons 0 l1) 0 in
-    if not (i0 = 0)
+    let* i1 = list_nth_shared i32 (List_Cons 0 l2) 0 in
+    if not (i1 = 0)
     then Fail Failure
     else
-      let* i1 = list_nth_shared i32 (List_Cons 0 l1) 1 in
-      if not (i1 = 1)
+      let* i2 = list_nth_shared i32 (List_Cons 0 l2) 1 in
+      if not (i2 = 1)
       then Fail Failure
       else
-        let* i2 = list_nth_shared i32 (List_Cons 0 l1) 2 in
-        if not (i2 = 2)
+        let* i3 = list_nth_shared i32 (List_Cons 0 l2) 2 in
+        if not (i3 = 2)
         then Fail Failure
         else
-          let* ls = list_nth_mut_back i32 (List_Cons 0 l1) 1 3 in
-          let* i3 = list_nth_shared i32 ls 0 in
-          if not (i3 = 0)
+          let* (_, list_nth_mut_back) = list_nth_mut i32 (List_Cons 0 l2) 1 in
+          let* ls = list_nth_mut_back 3 in
+          let* i4 = list_nth_shared i32 ls 0 in
+          if not (i4 = 0)
           then Fail Failure
           else
-            let* i4 = list_nth_shared i32 ls 1 in
-            if not (i4 = 3)
+            let* i5 = list_nth_shared i32 ls 1 in
+            if not (i5 = 3)
             then Fail Failure
             else
-              let* i5 = list_nth_shared i32 ls 2 in
-              if not (i5 = 2) then Fail Failure else Return ()
+              let* i6 = list_nth_shared i32 ls 2 in
+              if not (i6 = 2) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_list_functions] *)
 let _ = assert_norm (test_list_functions = Return ())
 
-(** [no_nested_borrows::id_mut_pair1]: forward function
+(** [no_nested_borrows::id_mut_pair1]:
     Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 *)
-let id_mut_pair1 (t1 t2 : Type0) (x : t1) (y : t2) : result (t1 & t2) =
-  Return (x, y)
-
-(** [no_nested_borrows::id_mut_pair1]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 *)
-let id_mut_pair1_back
-  (t1 t2 : Type0) (x : t1) (y : t2) (ret : (t1 & t2)) : result (t1 & t2) =
-  let (x0, x1) = ret in Return (x0, x1)
-
-(** [no_nested_borrows::id_mut_pair2]: forward function
+let id_mut_pair1
+  (t1 t2 : Type0) (x : t1) (y : t2) :
+  result ((t1 & t2) & ((t1 & t2) -> result (t1 & t2)))
+  =
+  let back_'a = fun ret -> let (x1, x2) = ret in Return (x1, x2) in
+  Return ((x, y), back_'a)
+
+(** [no_nested_borrows::id_mut_pair2]:
     Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 *)
-let id_mut_pair2 (t1 t2 : Type0) (p : (t1 & t2)) : result (t1 & t2) =
-  let (x, x0) = p in Return (x, x0)
-
-(** [no_nested_borrows::id_mut_pair2]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 *)
-let id_mut_pair2_back
-  (t1 t2 : Type0) (p : (t1 & t2)) (ret : (t1 & t2)) : result (t1 & t2) =
-  let (x, x0) = ret in Return (x, x0)
-
-(** [no_nested_borrows::id_mut_pair3]: forward function
+let id_mut_pair2
+  (t1 t2 : Type0) (p : (t1 & t2)) :
+  result ((t1 & t2) & ((t1 & t2) -> result (t1 & t2)))
+  =
+  let (x, x1) = p in
+  let back_'a = fun ret -> let (x2, x3) = ret in Return (x2, x3) in
+  Return ((x, x1), back_'a)
+
+(** [no_nested_borrows::id_mut_pair3]:
     Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
-let id_mut_pair3 (t1 t2 : Type0) (x : t1) (y : t2) : result (t1 & t2) =
-  Return (x, y)
-
-(** [no_nested_borrows::id_mut_pair3]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
-let id_mut_pair3_back'a
-  (t1 t2 : Type0) (x : t1) (y : t2) (ret : t1) : result t1 =
-  Return ret
-
-(** [no_nested_borrows::id_mut_pair3]: backward function 1
-    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
-let id_mut_pair3_back'b
-  (t1 t2 : Type0) (x : t1) (y : t2) (ret : t2) : result t2 =
-  Return ret
-
-(** [no_nested_borrows::id_mut_pair4]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
-let id_mut_pair4 (t1 t2 : Type0) (p : (t1 & t2)) : result (t1 & t2) =
-  let (x, x0) = p in Return (x, x0)
-
-(** [no_nested_borrows::id_mut_pair4]: backward function 0
+let id_mut_pair3
+  (t1 t2 : Type0) (x : t1) (y : t2) :
+  result ((t1 & t2) & (t1 -> result t1) & (t2 -> result t2))
+  =
+  let back_'a = fun ret -> Return ret in
+  let back_'b = fun ret -> Return ret in
+  Return ((x, y), back_'a, back_'b)
+
+(** [no_nested_borrows::id_mut_pair4]:
     Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
-let id_mut_pair4_back'a
-  (t1 t2 : Type0) (p : (t1 & t2)) (ret : t1) : result t1 =
-  Return ret
-
-(** [no_nested_borrows::id_mut_pair4]: backward function 1
-    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
-let id_mut_pair4_back'b
-  (t1 t2 : Type0) (p : (t1 & t2)) (ret : t2) : result t2 =
-  Return ret
+let id_mut_pair4
+  (t1 t2 : Type0) (p : (t1 & t2)) :
+  result ((t1 & t2) & (t1 -> result t1) & (t2 -> result t2))
+  =
+  let (x, x1) = p in
+  let back_'a = fun ret -> Return ret in
+  let back_'b = fun ret -> Return ret in
+  Return ((x, x1), back_'a, back_'b)
 
 (** [no_nested_borrows::StructWithTuple]
     Source: 'src/no_nested_borrows.rs', lines 433:0-433:34 *)
 type structWithTuple_t (t1 t2 : Type0) = { p : (t1 & t2); }
 
-(** [no_nested_borrows::new_tuple1]: forward function
+(** [no_nested_borrows::new_tuple1]:
     Source: 'src/no_nested_borrows.rs', lines 437:0-437:48 *)
 let new_tuple1 : result (structWithTuple_t u32 u32) =
   Return { p = (1, 2) }
 
-(** [no_nested_borrows::new_tuple2]: forward function
+(** [no_nested_borrows::new_tuple2]:
     Source: 'src/no_nested_borrows.rs', lines 441:0-441:48 *)
 let new_tuple2 : result (structWithTuple_t i16 i16) =
   Return { p = (1, 2) }
 
-(** [no_nested_borrows::new_tuple3]: forward function
+(** [no_nested_borrows::new_tuple3]:
     Source: 'src/no_nested_borrows.rs', lines 445:0-445:48 *)
 let new_tuple3 : result (structWithTuple_t u64 i64) =
   Return { p = (1, 2) }
@@ -506,12 +486,12 @@ let new_tuple3 : result (structWithTuple_t u64 i64) =
     Source: 'src/no_nested_borrows.rs', lines 450:0-450:33 *)
 type structWithPair_t (t1 t2 : Type0) = { p : pair_t t1 t2; }
 
-(** [no_nested_borrows::new_pair1]: forward function
+(** [no_nested_borrows::new_pair1]:
     Source: 'src/no_nested_borrows.rs', lines 454:0-454:46 *)
 let new_pair1 : result (structWithPair_t u32 u32) =
   Return { p = { x = 1; y = 2 } }
 
-(** [no_nested_borrows::test_constants]: forward function
+(** [no_nested_borrows::test_constants]:
     Source: 'src/no_nested_borrows.rs', lines 462:0-462:23 *)
 let test_constants : result unit =
   let* swt = new_tuple1 in
@@ -519,14 +499,14 @@ let test_constants : result unit =
   if not (i = 1)
   then Fail Failure
   else
-    let* swt0 = new_tuple2 in
-    let (i0, _) = swt0.p in
-    if not (i0 = 1)
+    let* swt1 = new_tuple2 in
+    let (i1, _) = swt1.p in
+    if not (i1 = 1)
     then Fail Failure
     else
-      let* swt1 = new_tuple3 in
-      let (i1, _) = swt1.p in
-      if not (i1 = 1)
+      let* swt2 = new_tuple3 in
+      let (i2, _) = swt2.p in
+      if not (i2 = 1)
       then Fail Failure
       else
         let* swp = new_pair1 in
@@ -535,7 +515,7 @@ let test_constants : result unit =
 (** Unit test for [no_nested_borrows::test_constants] *)
 let _ = assert_norm (test_constants = Return ())
 
-(** [no_nested_borrows::test_weird_borrows1]: forward function
+(** [no_nested_borrows::test_weird_borrows1]:
     Source: 'src/no_nested_borrows.rs', lines 471:0-471:28 *)
 let test_weird_borrows1 : result unit =
   Return ()
@@ -543,59 +523,72 @@ let test_weird_borrows1 : result unit =
 (** Unit test for [no_nested_borrows::test_weird_borrows1] *)
 let _ = assert_norm (test_weird_borrows1 = Return ())
 
-(** [no_nested_borrows::test_mem_replace]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [no_nested_borrows::test_mem_replace]:
     Source: 'src/no_nested_borrows.rs', lines 481:0-481:37 *)
 let test_mem_replace (px : u32) : result u32 =
-  let y = core_mem_replace u32 px 1 in
+  let (y, _) = core_mem_replace u32 px 1 in
   if not (y = 0) then Fail Failure else Return 2
 
-(** [no_nested_borrows::test_shared_borrow_bool1]: forward function
+(** [no_nested_borrows::test_shared_borrow_bool1]:
     Source: 'src/no_nested_borrows.rs', lines 488:0-488:47 *)
 let test_shared_borrow_bool1 (b : bool) : result u32 =
   if b then Return 0 else Return 1
 
-(** [no_nested_borrows::test_shared_borrow_bool2]: forward function
+(** [no_nested_borrows::test_shared_borrow_bool2]:
     Source: 'src/no_nested_borrows.rs', lines 501:0-501:40 *)
 let test_shared_borrow_bool2 : result u32 =
   Return 0
 
-(** [no_nested_borrows::test_shared_borrow_enum1]: forward function
+(** [no_nested_borrows::test_shared_borrow_enum1]:
     Source: 'src/no_nested_borrows.rs', lines 516:0-516:52 *)
 let test_shared_borrow_enum1 (l : list_t u32) : result u32 =
-  begin match l with | List_Cons i l0 -> Return 1 | List_Nil -> Return 0 end
+  begin match l with | List_Cons _ _ -> Return 1 | List_Nil -> Return 0 end
 
-(** [no_nested_borrows::test_shared_borrow_enum2]: forward function
+(** [no_nested_borrows::test_shared_borrow_enum2]:
     Source: 'src/no_nested_borrows.rs', lines 528:0-528:40 *)
 let test_shared_borrow_enum2 : result u32 =
   Return 0
 
-(** [no_nested_borrows::Tuple]
+(** [no_nested_borrows::incr]:
     Source: 'src/no_nested_borrows.rs', lines 539:0-539:24 *)
+let incr (x : u32) : result u32 =
+  u32_add x 1
+
+(** [no_nested_borrows::call_incr]:
+    Source: 'src/no_nested_borrows.rs', lines 543:0-543:35 *)
+let call_incr (x : u32) : result u32 =
+  incr x
+
+(** [no_nested_borrows::read_then_incr]:
+    Source: 'src/no_nested_borrows.rs', lines 548:0-548:41 *)
+let read_then_incr (x : u32) : result (u32 & u32) =
+  let* x1 = u32_add x 1 in Return (x, x1)
+
+(** [no_nested_borrows::Tuple]
+    Source: 'src/no_nested_borrows.rs', lines 554:0-554:24 *)
 type tuple_t (t1 t2 : Type0) = t1 * t2
 
-(** [no_nested_borrows::use_tuple_struct]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
-    Source: 'src/no_nested_borrows.rs', lines 541:0-541:48 *)
+(** [no_nested_borrows::use_tuple_struct]:
+    Source: 'src/no_nested_borrows.rs', lines 556:0-556:48 *)
 let use_tuple_struct (x : tuple_t u32 u32) : result (tuple_t u32 u32) =
   let (_, i) = x in Return (1, i)
 
-(** [no_nested_borrows::create_tuple_struct]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 545:0-545:61 *)
+(** [no_nested_borrows::create_tuple_struct]:
+    Source: 'src/no_nested_borrows.rs', lines 560:0-560:61 *)
 let create_tuple_struct (x : u32) (y : u64) : result (tuple_t u32 u64) =
   Return (x, y)
 
 (** [no_nested_borrows::IdType]
-    Source: 'src/no_nested_borrows.rs', lines 550:0-550:20 *)
+    Source: 'src/no_nested_borrows.rs', lines 565:0-565:20 *)
 type idType_t (t : Type0) = t
 
-(** [no_nested_borrows::use_id_type]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 552:0-552:40 *)
+(** [no_nested_borrows::use_id_type]:
+    Source: 'src/no_nested_borrows.rs', lines 567:0-567:40 *)
 let use_id_type (t : Type0) (x : idType_t t) : result t =
   Return x
 
-(** [no_nested_borrows::create_id_type]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 556:0-556:43 *)
+(** [no_nested_borrows::create_id_type]:
+    Source: 'src/no_nested_borrows.rs', lines 571:0-571:43 *)
 let create_id_type (t : Type0) (x : t) : result (idType_t t) =
   Return x
 
diff --git a/tests/fstar/misc/Primitives.fst b/tests/fstar/misc/Primitives.fst
index a3ffbde4..6b8dbeb7 100644
--- a/tests/fstar/misc/Primitives.fst
+++ b/tests/fstar/misc/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & (a -> a) = (x, (fun x -> x))
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -588,8 +584,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +606,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +617,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +639,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +665,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +684,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +699,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +719,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +735,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +743,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +762,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +777,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +790,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +808,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +823,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/lean/NoNestedBorrows.lean b/tests/lean/NoNestedBorrows.lean
index 0bce3a64..cb0aac10 100644
--- a/tests/lean/NoNestedBorrows.lean
+++ b/tests/lean/NoNestedBorrows.lean
@@ -43,98 +43,98 @@ inductive Sum (T1 T2 : Type) :=
 | Left : T1 → Sum T1 T2
 | Right : T2 → Sum T1 T2
 
-/- [no_nested_borrows::neg_test]: forward function
+/- [no_nested_borrows::neg_test]:
    Source: 'src/no_nested_borrows.rs', lines 48:0-48:30 -/
 def neg_test (x : I32) : Result I32 :=
   - x
 
-/- [no_nested_borrows::add_u32]: forward function
+/- [no_nested_borrows::add_u32]:
    Source: 'src/no_nested_borrows.rs', lines 54:0-54:37 -/
 def add_u32 (x : U32) (y : U32) : Result U32 :=
   x + y
 
-/- [no_nested_borrows::subs_u32]: forward function
+/- [no_nested_borrows::subs_u32]:
    Source: 'src/no_nested_borrows.rs', lines 60:0-60:38 -/
 def subs_u32 (x : U32) (y : U32) : Result U32 :=
   x - y
 
-/- [no_nested_borrows::div_u32]: forward function
+/- [no_nested_borrows::div_u32]:
    Source: 'src/no_nested_borrows.rs', lines 66:0-66:37 -/
 def div_u32 (x : U32) (y : U32) : Result U32 :=
   x / y
 
-/- [no_nested_borrows::div_u32_const]: forward function
+/- [no_nested_borrows::div_u32_const]:
    Source: 'src/no_nested_borrows.rs', lines 73:0-73:35 -/
 def div_u32_const (x : U32) : Result U32 :=
   x / 2#u32
 
-/- [no_nested_borrows::rem_u32]: forward function
+/- [no_nested_borrows::rem_u32]:
    Source: 'src/no_nested_borrows.rs', lines 78:0-78:37 -/
 def rem_u32 (x : U32) (y : U32) : Result U32 :=
   x % y
 
-/- [no_nested_borrows::mul_u32]: forward function
+/- [no_nested_borrows::mul_u32]:
    Source: 'src/no_nested_borrows.rs', lines 82:0-82:37 -/
 def mul_u32 (x : U32) (y : U32) : Result U32 :=
   x * y
 
-/- [no_nested_borrows::add_i32]: forward function
+/- [no_nested_borrows::add_i32]:
    Source: 'src/no_nested_borrows.rs', lines 88:0-88:37 -/
 def add_i32 (x : I32) (y : I32) : Result I32 :=
   x + y
 
-/- [no_nested_borrows::subs_i32]: forward function
+/- [no_nested_borrows::subs_i32]:
    Source: 'src/no_nested_borrows.rs', lines 92:0-92:38 -/
 def subs_i32 (x : I32) (y : I32) : Result I32 :=
   x - y
 
-/- [no_nested_borrows::div_i32]: forward function
+/- [no_nested_borrows::div_i32]:
    Source: 'src/no_nested_borrows.rs', lines 96:0-96:37 -/
 def div_i32 (x : I32) (y : I32) : Result I32 :=
   x / y
 
-/- [no_nested_borrows::div_i32_const]: forward function
+/- [no_nested_borrows::div_i32_const]:
    Source: 'src/no_nested_borrows.rs', lines 100:0-100:35 -/
 def div_i32_const (x : I32) : Result I32 :=
   x / 2#i32
 
-/- [no_nested_borrows::rem_i32]: forward function
+/- [no_nested_borrows::rem_i32]:
    Source: 'src/no_nested_borrows.rs', lines 104:0-104:37 -/
 def rem_i32 (x : I32) (y : I32) : Result I32 :=
   x % y
 
-/- [no_nested_borrows::mul_i32]: forward function
+/- [no_nested_borrows::mul_i32]:
    Source: 'src/no_nested_borrows.rs', lines 108:0-108:37 -/
 def mul_i32 (x : I32) (y : I32) : Result I32 :=
   x * y
 
-/- [no_nested_borrows::mix_arith_u32]: forward function
+/- [no_nested_borrows::mix_arith_u32]:
    Source: 'src/no_nested_borrows.rs', lines 112:0-112:51 -/
 def mix_arith_u32 (x : U32) (y : U32) (z : U32) : Result U32 :=
   do
-    let i ← x + y
-    let i0 ← x / y
-    let i1 ← i * i0
-    let i2 ← z % y
-    let i3 ← x - i2
-    let i4 ← i1 + i3
-    let i5 ← x + y
-    let i6 ← i5 + z
-    i4 % i6
-
-/- [no_nested_borrows::mix_arith_i32]: forward function
+  let i ← x + y
+  let i1 ← x / y
+  let i2 ← i * i1
+  let i3 ← z % y
+  let i4 ← x - i3
+  let i5 ← i2 + i4
+  let i6 ← x + y
+  let i7 ← i6 + z
+  i5 % i7
+
+/- [no_nested_borrows::mix_arith_i32]:
    Source: 'src/no_nested_borrows.rs', lines 116:0-116:51 -/
 def mix_arith_i32 (x : I32) (y : I32) (z : I32) : Result I32 :=
   do
-    let i ← x + y
-    let i0 ← x / y
-    let i1 ← i * i0
-    let i2 ← z % y
-    let i3 ← x - i2
-    let i4 ← i1 + i3
-    let i5 ← x + y
-    let i6 ← i5 + z
-    i4 % i6
+  let i ← x + y
+  let i1 ← x / y
+  let i2 ← i * i1
+  let i3 ← z % y
+  let i4 ← x - i3
+  let i5 ← i2 + i4
+  let i6 ← x + y
+  let i7 ← i6 + z
+  i5 % i7
 
 /- [no_nested_borrows::CONST0]
    Source: 'src/no_nested_borrows.rs', lines 125:0-125:23 -/
@@ -146,65 +146,65 @@ def const0_c : Usize := eval_global const0_body (by simp)
 def const1_body : Result Usize := 2#usize * 2#usize
 def const1_c : Usize := eval_global const1_body (by simp)
 
-/- [no_nested_borrows::cast_u32_to_i32]: forward function
+/- [no_nested_borrows::cast_u32_to_i32]:
    Source: 'src/no_nested_borrows.rs', lines 128:0-128:37 -/
 def cast_u32_to_i32 (x : U32) : Result I32 :=
   Scalar.cast .I32 x
 
-/- [no_nested_borrows::cast_bool_to_i32]: forward function
+/- [no_nested_borrows::cast_bool_to_i32]:
    Source: 'src/no_nested_borrows.rs', lines 132:0-132:39 -/
 def cast_bool_to_i32 (x : Bool) : Result I32 :=
   Scalar.cast_bool .I32 x
 
-/- [no_nested_borrows::cast_bool_to_bool]: forward function
+/- [no_nested_borrows::cast_bool_to_bool]:
    Source: 'src/no_nested_borrows.rs', lines 137:0-137:41 -/
 def cast_bool_to_bool (x : Bool) : Result Bool :=
   Result.ret x
 
-/- [no_nested_borrows::test2]: forward function
+/- [no_nested_borrows::test2]:
    Source: 'src/no_nested_borrows.rs', lines 142:0-142:14 -/
 def test2 : Result Unit :=
   do
-    let _ ← 23#u32 + 44#u32
-    Result.ret ()
+  let _ ← 23#u32 + 44#u32
+  Result.ret ()
 
 /- Unit test for [no_nested_borrows::test2] -/
 #assert (test2 == Result.ret ())
 
-/- [no_nested_borrows::get_max]: forward function
+/- [no_nested_borrows::get_max]:
    Source: 'src/no_nested_borrows.rs', lines 154:0-154:37 -/
 def get_max (x : U32) (y : U32) : Result U32 :=
   if x >= y
   then Result.ret x
   else Result.ret y
 
-/- [no_nested_borrows::test3]: forward function
+/- [no_nested_borrows::test3]:
    Source: 'src/no_nested_borrows.rs', lines 162:0-162:14 -/
 def test3 : Result Unit :=
   do
-    let x ← get_max 4#u32 3#u32
-    let y ← get_max 10#u32 11#u32
-    let z ← x + y
-    if not (z = 15#u32)
-    then Result.fail .panic
-    else Result.ret ()
+  let x ← get_max 4#u32 3#u32
+  let y ← get_max 10#u32 11#u32
+  let z ← x + y
+  if not (z = 15#u32)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test3] -/
 #assert (test3 == Result.ret ())
 
-/- [no_nested_borrows::test_neg1]: forward function
+/- [no_nested_borrows::test_neg1]:
    Source: 'src/no_nested_borrows.rs', lines 169:0-169:18 -/
 def test_neg1 : Result Unit :=
   do
-    let y ← - 3#i32
-    if not (y = (-(3:Int))#i32)
-    then Result.fail .panic
-    else Result.ret ()
+  let y ← - 3#i32
+  if not (y = (-(3:Int))#i32)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_neg1] -/
 #assert (test_neg1 == Result.ret ())
 
-/- [no_nested_borrows::refs_test1]: forward function
+/- [no_nested_borrows::refs_test1]:
    Source: 'src/no_nested_borrows.rs', lines 176:0-176:19 -/
 def refs_test1 : Result Unit :=
   if not (1#i32 = 1#i32)
@@ -214,7 +214,7 @@ def refs_test1 : Result Unit :=
 /- Unit test for [no_nested_borrows::refs_test1] -/
 #assert (refs_test1 == Result.ret ())
 
-/- [no_nested_borrows::refs_test2]: forward function
+/- [no_nested_borrows::refs_test2]:
    Source: 'src/no_nested_borrows.rs', lines 187:0-187:19 -/
 def refs_test2 : Result Unit :=
   if not (2#i32 = 2#i32)
@@ -232,7 +232,7 @@ def refs_test2 : Result Unit :=
 /- Unit test for [no_nested_borrows::refs_test2] -/
 #assert (refs_test2 == Result.ret ())
 
-/- [no_nested_borrows::test_list1]: forward function
+/- [no_nested_borrows::test_list1]:
    Source: 'src/no_nested_borrows.rs', lines 203:0-203:19 -/
 def test_list1 : Result Unit :=
   Result.ret ()
@@ -240,128 +240,126 @@ def test_list1 : Result Unit :=
 /- Unit test for [no_nested_borrows::test_list1] -/
 #assert (test_list1 == Result.ret ())
 
-/- [no_nested_borrows::test_box1]: forward function
+/- [no_nested_borrows::test_box1]:
    Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 -/
 def test_box1 : Result Unit :=
   do
-    let b := 0#i32
-    let b0 ← alloc.boxed.Box.deref_mut_back I32 b 1#i32
-    let x ← alloc.boxed.Box.deref I32 b0
-    if not (x = 1#i32)
-    then Result.fail .panic
-    else Result.ret ()
+  let b := 0#i32
+  let (_, deref_mut_back) ← alloc.boxed.Box.deref_mut I32 b
+  let b1 ← deref_mut_back 1#i32
+  let x ← alloc.boxed.Box.deref I32 b1
+  if not (x = 1#i32)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_box1] -/
 #assert (test_box1 == Result.ret ())
 
-/- [no_nested_borrows::copy_int]: forward function
+/- [no_nested_borrows::copy_int]:
    Source: 'src/no_nested_borrows.rs', lines 218:0-218:30 -/
 def copy_int (x : I32) : Result I32 :=
   Result.ret x
 
-/- [no_nested_borrows::test_unreachable]: forward function
+/- [no_nested_borrows::test_unreachable]:
    Source: 'src/no_nested_borrows.rs', lines 224:0-224:32 -/
 def test_unreachable (b : Bool) : Result Unit :=
   if b
   then Result.fail .panic
   else Result.ret ()
 
-/- [no_nested_borrows::test_panic]: forward function
+/- [no_nested_borrows::test_panic]:
    Source: 'src/no_nested_borrows.rs', lines 232:0-232:26 -/
 def test_panic (b : Bool) : Result Unit :=
   if b
   then Result.fail .panic
   else Result.ret ()
 
-/- [no_nested_borrows::test_copy_int]: forward function
+/- [no_nested_borrows::test_copy_int]:
    Source: 'src/no_nested_borrows.rs', lines 239:0-239:22 -/
 def test_copy_int : Result Unit :=
   do
-    let y ← copy_int 0#i32
-    if not (0#i32 = y)
-    then Result.fail .panic
-    else Result.ret ()
+  let y ← copy_int 0#i32
+  if not (0#i32 = y)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_copy_int] -/
 #assert (test_copy_int == Result.ret ())
 
-/- [no_nested_borrows::is_cons]: forward function
+/- [no_nested_borrows::is_cons]:
    Source: 'src/no_nested_borrows.rs', lines 246:0-246:38 -/
 def is_cons (T : Type) (l : List T) : Result Bool :=
   match l with
-  | List.Cons t l0 => Result.ret true
+  | List.Cons _ _ => Result.ret true
   | List.Nil => Result.ret false
 
-/- [no_nested_borrows::test_is_cons]: forward function
+/- [no_nested_borrows::test_is_cons]:
    Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 -/
 def test_is_cons : Result Unit :=
   do
-    let l := List.Nil
-    let b ← is_cons I32 (List.Cons 0#i32 l)
-    if not b
-    then Result.fail .panic
-    else Result.ret ()
+  let l := List.Nil
+  let b ← is_cons I32 (List.Cons 0#i32 l)
+  if not b
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_is_cons] -/
 #assert (test_is_cons == Result.ret ())
 
-/- [no_nested_borrows::split_list]: forward function
+/- [no_nested_borrows::split_list]:
    Source: 'src/no_nested_borrows.rs', lines 259:0-259:48 -/
 def split_list (T : Type) (l : List T) : Result (T × (List T)) :=
   match l with
   | List.Cons hd tl => Result.ret (hd, tl)
   | List.Nil => Result.fail .panic
 
-/- [no_nested_borrows::test_split_list]: forward function
+/- [no_nested_borrows::test_split_list]:
    Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 -/
 def test_split_list : Result Unit :=
   do
-    let l := List.Nil
-    let p ← split_list I32 (List.Cons 0#i32 l)
-    let (hd, _) := p
-    if not (hd = 0#i32)
-    then Result.fail .panic
-    else Result.ret ()
+  let l := List.Nil
+  let p ← split_list I32 (List.Cons 0#i32 l)
+  let (hd, _) := p
+  if not (hd = 0#i32)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_split_list] -/
 #assert (test_split_list == Result.ret ())
 
-/- [no_nested_borrows::choose]: forward function
+/- [no_nested_borrows::choose]:
    Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 -/
-def choose (T : Type) (b : Bool) (x : T) (y : T) : Result T :=
+def choose
+  (T : Type) (b : Bool) (x : T) (y : T) :
+  Result (T × (T → Result (T × T)))
+  :=
   if b
-  then Result.ret x
-  else Result.ret y
+  then let back_'a := fun ret => Result.ret (ret, y)
+       Result.ret (x, back_'a)
+  else let back_'a := fun ret => Result.ret (x, ret)
+       Result.ret (y, back_'a)
 
-/- [no_nested_borrows::choose]: backward function 0
-   Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 -/
-def choose_back
-  (T : Type) (b : Bool) (x : T) (y : T) (ret : T) : Result (T × T) :=
-  if b
-  then Result.ret (ret, y)
-  else Result.ret (x, ret)
-
-/- [no_nested_borrows::choose_test]: forward function
+/- [no_nested_borrows::choose_test]:
    Source: 'src/no_nested_borrows.rs', lines 282:0-282:20 -/
 def choose_test : Result Unit :=
   do
-    let z ← choose I32 true 0#i32 0#i32
-    let z0 ← z + 1#i32
-    if not (z0 = 1#i32)
+  let (z, choose_back) ← choose I32 true 0#i32 0#i32
+  let z1 ← z + 1#i32
+  if not (z1 = 1#i32)
+  then Result.fail .panic
+  else
+    do
+    let (x, y) ← choose_back z1
+    if not (x = 1#i32)
     then Result.fail .panic
-    else
-      do
-        let (x, y) ← choose_back I32 true 0#i32 0#i32 z0
-        if not (x = 1#i32)
-        then Result.fail .panic
-        else if not (y = 0#i32)
-             then Result.fail .panic
-             else Result.ret ()
+    else if not (y = 0#i32)
+         then Result.fail .panic
+         else Result.ret ()
 
 /- Unit test for [no_nested_borrows::choose_test] -/
 #assert (choose_test == Result.ret ())
 
-/- [no_nested_borrows::test_char]: forward function
+/- [no_nested_borrows::test_char]:
    Source: 'src/no_nested_borrows.rs', lines 294:0-294:26 -/
 def test_char : Result Char :=
   Result.ret 'a'
@@ -382,16 +380,16 @@ inductive NodeElem (T : Type) :=
 
 end
 
-/- [no_nested_borrows::list_length]: forward function
+/- [no_nested_borrows::list_length]:
    Source: 'src/no_nested_borrows.rs', lines 339:0-339:48 -/
 divergent def list_length (T : Type) (l : List T) : Result U32 :=
   match l with
-  | List.Cons t l1 => do
-                        let i ← list_length T l1
-                        1#u32 + i
+  | List.Cons _ l1 => do
+                      let i ← list_length T l1
+                      1#u32 + i
   | List.Nil => Result.ret 0#u32
 
-/- [no_nested_borrows::list_nth_shared]: forward function
+/- [no_nested_borrows::list_nth_shared]:
    Source: 'src/no_nested_borrows.rs', lines 347:0-347:62 -/
 divergent def list_nth_shared (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
@@ -399,38 +397,33 @@ divergent def list_nth_shared (T : Type) (l : List T) (i : U32) : Result T :=
     if i = 0#u32
     then Result.ret x
     else do
-           let i0 ← i - 1#u32
-           list_nth_shared T tl i0
-  | List.Nil => Result.fail .panic
-
-/- [no_nested_borrows::list_nth_mut]: forward function
-   Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 -/
-divergent def list_nth_mut (T : Type) (l : List T) (i : U32) : Result T :=
-  match l with
-  | List.Cons x tl =>
-    if i = 0#u32
-    then Result.ret x
-    else do
-           let i0 ← i - 1#u32
-           list_nth_mut T tl i0
+         let i1 ← i - 1#u32
+         list_nth_shared T tl i1
   | List.Nil => Result.fail .panic
 
-/- [no_nested_borrows::list_nth_mut]: backward function 0
+/- [no_nested_borrows::list_nth_mut]:
    Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 -/
-divergent def list_nth_mut_back
-  (T : Type) (l : List T) (i : U32) (ret : T) : Result (List T) :=
+divergent def list_nth_mut
+  (T : Type) (l : List T) (i : U32) : Result (T × (T → Result (List T))) :=
   match l with
   | List.Cons x tl =>
     if i = 0#u32
-    then Result.ret (List.Cons ret tl)
+    then
+      let back_'a := fun ret => Result.ret (List.Cons ret tl)
+      Result.ret (x, back_'a)
     else
       do
-        let i0 ← i - 1#u32
-        let tl0 ← list_nth_mut_back T tl i0 ret
-        Result.ret (List.Cons x tl0)
+      let i1 ← i - 1#u32
+      let (t, list_nth_mut_back) ← list_nth_mut T tl i1
+      let back_'a :=
+        fun ret =>
+          do
+          let tl1 ← list_nth_mut_back ret
+          Result.ret (List.Cons x tl1)
+      Result.ret (t, back_'a)
   | List.Nil => Result.fail .panic
 
-/- [no_nested_borrows::list_rev_aux]: forward function
+/- [no_nested_borrows::list_rev_aux]:
    Source: 'src/no_nested_borrows.rs', lines 379:0-379:63 -/
 divergent def list_rev_aux
   (T : Type) (li : List T) (lo : List T) : Result (List T) :=
@@ -438,136 +431,118 @@ divergent def list_rev_aux
   | List.Cons hd tl => list_rev_aux T tl (List.Cons hd lo)
   | List.Nil => Result.ret lo
 
-/- [no_nested_borrows::list_rev]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [no_nested_borrows::list_rev]:
    Source: 'src/no_nested_borrows.rs', lines 393:0-393:42 -/
 def list_rev (T : Type) (l : List T) : Result (List T) :=
-  let li := core.mem.replace (List T) l List.Nil
+  let (li, _) := core.mem.replace (List T) l List.Nil
   list_rev_aux T li List.Nil
 
-/- [no_nested_borrows::test_list_functions]: forward function
+/- [no_nested_borrows::test_list_functions]:
    Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 -/
 def test_list_functions : Result Unit :=
   do
-    let l := List.Nil
-    let l0 := List.Cons 2#i32 l
-    let l1 := List.Cons 1#i32 l0
-    let i ← list_length I32 (List.Cons 0#i32 l1)
-    if not (i = 3#u32)
+  let l := List.Nil
+  let l1 := List.Cons 2#i32 l
+  let l2 := List.Cons 1#i32 l1
+  let i ← list_length I32 (List.Cons 0#i32 l2)
+  if not (i = 3#u32)
+  then Result.fail .panic
+  else
+    do
+    let i1 ← list_nth_shared I32 (List.Cons 0#i32 l2) 0#u32
+    if not (i1 = 0#i32)
     then Result.fail .panic
     else
       do
-        let i0 ← list_nth_shared I32 (List.Cons 0#i32 l1) 0#u32
-        if not (i0 = 0#i32)
+      let i2 ← list_nth_shared I32 (List.Cons 0#i32 l2) 1#u32
+      if not (i2 = 1#i32)
+      then Result.fail .panic
+      else
+        do
+        let i3 ← list_nth_shared I32 (List.Cons 0#i32 l2) 2#u32
+        if not (i3 = 2#i32)
         then Result.fail .panic
         else
           do
-            let i1 ← list_nth_shared I32 (List.Cons 0#i32 l1) 1#u32
-            if not (i1 = 1#i32)
+          let (_, list_nth_mut_back) ←
+            list_nth_mut I32 (List.Cons 0#i32 l2) 1#u32
+          let ls ← list_nth_mut_back 3#i32
+          let i4 ← list_nth_shared I32 ls 0#u32
+          if not (i4 = 0#i32)
+          then Result.fail .panic
+          else
+            do
+            let i5 ← list_nth_shared I32 ls 1#u32
+            if not (i5 = 3#i32)
             then Result.fail .panic
             else
               do
-                let i2 ← list_nth_shared I32 (List.Cons 0#i32 l1) 2#u32
-                if not (i2 = 2#i32)
-                then Result.fail .panic
-                else
-                  do
-                    let ls ←
-                      list_nth_mut_back I32 (List.Cons 0#i32 l1) 1#u32 3#i32
-                    let i3 ← list_nth_shared I32 ls 0#u32
-                    if not (i3 = 0#i32)
-                    then Result.fail .panic
-                    else
-                      do
-                        let i4 ← list_nth_shared I32 ls 1#u32
-                        if not (i4 = 3#i32)
-                        then Result.fail .panic
-                        else
-                          do
-                            let i5 ← list_nth_shared I32 ls 2#u32
-                            if not (i5 = 2#i32)
-                            then Result.fail .panic
-                            else Result.ret ()
+              let i6 ← list_nth_shared I32 ls 2#u32
+              if not (i6 = 2#i32)
+              then Result.fail .panic
+              else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_list_functions] -/
 #assert (test_list_functions == Result.ret ())
 
-/- [no_nested_borrows::id_mut_pair1]: forward function
+/- [no_nested_borrows::id_mut_pair1]:
    Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 -/
-def id_mut_pair1 (T1 T2 : Type) (x : T1) (y : T2) : Result (T1 × T2) :=
-  Result.ret (x, y)
-
-/- [no_nested_borrows::id_mut_pair1]: backward function 0
-   Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 -/
-def id_mut_pair1_back
-  (T1 T2 : Type) (x : T1) (y : T2) (ret : (T1 × T2)) : Result (T1 × T2) :=
-  let (t, t0) := ret
-  Result.ret (t, t0)
-
-/- [no_nested_borrows::id_mut_pair2]: forward function
+def id_mut_pair1
+  (T1 T2 : Type) (x : T1) (y : T2) :
+  Result ((T1 × T2) × ((T1 × T2) → Result (T1 × T2)))
+  :=
+  let back_'a := fun ret => let (t, t1) := ret
+                            Result.ret (t, t1)
+  Result.ret ((x, y), back_'a)
+
+/- [no_nested_borrows::id_mut_pair2]:
    Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 -/
-def id_mut_pair2 (T1 T2 : Type) (p : (T1 × T2)) : Result (T1 × T2) :=
-  let (t, t0) := p
-  Result.ret (t, t0)
-
-/- [no_nested_borrows::id_mut_pair2]: backward function 0
-   Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 -/
-def id_mut_pair2_back
-  (T1 T2 : Type) (p : (T1 × T2)) (ret : (T1 × T2)) : Result (T1 × T2) :=
-  let (t, t0) := ret
-  Result.ret (t, t0)
-
-/- [no_nested_borrows::id_mut_pair3]: forward function
+def id_mut_pair2
+  (T1 T2 : Type) (p : (T1 × T2)) :
+  Result ((T1 × T2) × ((T1 × T2) → Result (T1 × T2)))
+  :=
+  let (t, t1) := p
+  let back_'a := fun ret => let (t2, t3) := ret
+                            Result.ret (t2, t3)
+  Result.ret ((t, t1), back_'a)
+
+/- [no_nested_borrows::id_mut_pair3]:
    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 -/
-def id_mut_pair3 (T1 T2 : Type) (x : T1) (y : T2) : Result (T1 × T2) :=
-  Result.ret (x, y)
-
-/- [no_nested_borrows::id_mut_pair3]: backward function 0
-   Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 -/
-def id_mut_pair3_back'a
-  (T1 T2 : Type) (x : T1) (y : T2) (ret : T1) : Result T1 :=
-  Result.ret ret
-
-/- [no_nested_borrows::id_mut_pair3]: backward function 1
-   Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 -/
-def id_mut_pair3_back'b
-  (T1 T2 : Type) (x : T1) (y : T2) (ret : T2) : Result T2 :=
-  Result.ret ret
-
-/- [no_nested_borrows::id_mut_pair4]: forward function
+def id_mut_pair3
+  (T1 T2 : Type) (x : T1) (y : T2) :
+  Result ((T1 × T2) × (T1 → Result T1) × (T2 → Result T2))
+  :=
+  let back_'a := fun ret => Result.ret ret
+  let back_'b := fun ret => Result.ret ret
+  Result.ret ((x, y), back_'a, back_'b)
+
+/- [no_nested_borrows::id_mut_pair4]:
    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 -/
-def id_mut_pair4 (T1 T2 : Type) (p : (T1 × T2)) : Result (T1 × T2) :=
-  let (t, t0) := p
-  Result.ret (t, t0)
-
-/- [no_nested_borrows::id_mut_pair4]: backward function 0
-   Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 -/
-def id_mut_pair4_back'a
-  (T1 T2 : Type) (p : (T1 × T2)) (ret : T1) : Result T1 :=
-  Result.ret ret
-
-/- [no_nested_borrows::id_mut_pair4]: backward function 1
-   Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 -/
-def id_mut_pair4_back'b
-  (T1 T2 : Type) (p : (T1 × T2)) (ret : T2) : Result T2 :=
-  Result.ret ret
+def id_mut_pair4
+  (T1 T2 : Type) (p : (T1 × T2)) :
+  Result ((T1 × T2) × (T1 → Result T1) × (T2 → Result T2))
+  :=
+  let (t, t1) := p
+  let back_'a := fun ret => Result.ret ret
+  let back_'b := fun ret => Result.ret ret
+  Result.ret ((t, t1), back_'a, back_'b)
 
 /- [no_nested_borrows::StructWithTuple]
    Source: 'src/no_nested_borrows.rs', lines 433:0-433:34 -/
 structure StructWithTuple (T1 T2 : Type) where
   p : (T1 × T2)
 
-/- [no_nested_borrows::new_tuple1]: forward function
+/- [no_nested_borrows::new_tuple1]:
    Source: 'src/no_nested_borrows.rs', lines 437:0-437:48 -/
 def new_tuple1 : Result (StructWithTuple U32 U32) :=
   Result.ret { p := (1#u32, 2#u32) }
 
-/- [no_nested_borrows::new_tuple2]: forward function
+/- [no_nested_borrows::new_tuple2]:
    Source: 'src/no_nested_borrows.rs', lines 441:0-441:48 -/
 def new_tuple2 : Result (StructWithTuple I16 I16) :=
   Result.ret { p := (1#i16, 2#i16) }
 
-/- [no_nested_borrows::new_tuple3]: forward function
+/- [no_nested_borrows::new_tuple3]:
    Source: 'src/no_nested_borrows.rs', lines 445:0-445:48 -/
 def new_tuple3 : Result (StructWithTuple U64 I64) :=
   Result.ret { p := (1#u64, 2#i64) }
@@ -577,42 +552,42 @@ def new_tuple3 : Result (StructWithTuple U64 I64) :=
 structure StructWithPair (T1 T2 : Type) where
   p : Pair T1 T2
 
-/- [no_nested_borrows::new_pair1]: forward function
+/- [no_nested_borrows::new_pair1]:
    Source: 'src/no_nested_borrows.rs', lines 454:0-454:46 -/
 def new_pair1 : Result (StructWithPair U32 U32) :=
   Result.ret { p := { x := 1#u32, y := 2#u32 } }
 
-/- [no_nested_borrows::test_constants]: forward function
+/- [no_nested_borrows::test_constants]:
    Source: 'src/no_nested_borrows.rs', lines 462:0-462:23 -/
 def test_constants : Result Unit :=
   do
-    let swt ← new_tuple1
-    let (i, _) := swt.p
-    if not (i = 1#u32)
+  let swt ← new_tuple1
+  let (i, _) := swt.p
+  if not (i = 1#u32)
+  then Result.fail .panic
+  else
+    do
+    let swt1 ← new_tuple2
+    let (i1, _) := swt1.p
+    if not (i1 = 1#i16)
     then Result.fail .panic
     else
       do
-        let swt0 ← new_tuple2
-        let (i0, _) := swt0.p
-        if not (i0 = 1#i16)
+      let swt2 ← new_tuple3
+      let (i2, _) := swt2.p
+      if not (i2 = 1#u64)
+      then Result.fail .panic
+      else
+        do
+        let swp ← new_pair1
+        if not (swp.p.x = 1#u32)
         then Result.fail .panic
-        else
-          do
-            let swt1 ← new_tuple3
-            let (i1, _) := swt1.p
-            if not (i1 = 1#u64)
-            then Result.fail .panic
-            else
-              do
-                let swp ← new_pair1
-                if not (swp.p.x = 1#u32)
-                then Result.fail .panic
-                else Result.ret ()
+        else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_constants] -/
 #assert (test_constants == Result.ret ())
 
-/- [no_nested_borrows::test_weird_borrows1]: forward function
+/- [no_nested_borrows::test_weird_borrows1]:
    Source: 'src/no_nested_borrows.rs', lines 471:0-471:28 -/
 def test_weird_borrows1 : Result Unit :=
   Result.ret ()
@@ -620,65 +595,80 @@ def test_weird_borrows1 : Result Unit :=
 /- Unit test for [no_nested_borrows::test_weird_borrows1] -/
 #assert (test_weird_borrows1 == Result.ret ())
 
-/- [no_nested_borrows::test_mem_replace]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [no_nested_borrows::test_mem_replace]:
    Source: 'src/no_nested_borrows.rs', lines 481:0-481:37 -/
 def test_mem_replace (px : U32) : Result U32 :=
-  let y := core.mem.replace U32 px 1#u32
+  let (y, _) := core.mem.replace U32 px 1#u32
   if not (y = 0#u32)
   then Result.fail .panic
   else Result.ret 2#u32
 
-/- [no_nested_borrows::test_shared_borrow_bool1]: forward function
+/- [no_nested_borrows::test_shared_borrow_bool1]:
    Source: 'src/no_nested_borrows.rs', lines 488:0-488:47 -/
 def test_shared_borrow_bool1 (b : Bool) : Result U32 :=
   if b
   then Result.ret 0#u32
   else Result.ret 1#u32
 
-/- [no_nested_borrows::test_shared_borrow_bool2]: forward function
+/- [no_nested_borrows::test_shared_borrow_bool2]:
    Source: 'src/no_nested_borrows.rs', lines 501:0-501:40 -/
 def test_shared_borrow_bool2 : Result U32 :=
   Result.ret 0#u32
 
-/- [no_nested_borrows::test_shared_borrow_enum1]: forward function
+/- [no_nested_borrows::test_shared_borrow_enum1]:
    Source: 'src/no_nested_borrows.rs', lines 516:0-516:52 -/
 def test_shared_borrow_enum1 (l : List U32) : Result U32 :=
   match l with
-  | List.Cons i l0 => Result.ret 1#u32
+  | List.Cons _ _ => Result.ret 1#u32
   | List.Nil => Result.ret 0#u32
 
-/- [no_nested_borrows::test_shared_borrow_enum2]: forward function
+/- [no_nested_borrows::test_shared_borrow_enum2]:
    Source: 'src/no_nested_borrows.rs', lines 528:0-528:40 -/
 def test_shared_borrow_enum2 : Result U32 :=
   Result.ret 0#u32
 
-/- [no_nested_borrows::Tuple]
+/- [no_nested_borrows::incr]:
    Source: 'src/no_nested_borrows.rs', lines 539:0-539:24 -/
+def incr (x : U32) : Result U32 :=
+  x + 1#u32
+
+/- [no_nested_borrows::call_incr]:
+   Source: 'src/no_nested_borrows.rs', lines 543:0-543:35 -/
+def call_incr (x : U32) : Result U32 :=
+  incr x
+
+/- [no_nested_borrows::read_then_incr]:
+   Source: 'src/no_nested_borrows.rs', lines 548:0-548:41 -/
+def read_then_incr (x : U32) : Result (U32 × U32) :=
+  do
+  let x1 ← x + 1#u32
+  Result.ret (x, x1)
+
+/- [no_nested_borrows::Tuple]
+   Source: 'src/no_nested_borrows.rs', lines 554:0-554:24 -/
 def Tuple (T1 T2 : Type) := T1 × T2
 
-/- [no_nested_borrows::use_tuple_struct]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
-   Source: 'src/no_nested_borrows.rs', lines 541:0-541:48 -/
+/- [no_nested_borrows::use_tuple_struct]:
+   Source: 'src/no_nested_borrows.rs', lines 556:0-556:48 -/
 def use_tuple_struct (x : Tuple U32 U32) : Result (Tuple U32 U32) :=
   Result.ret (1#u32, x.1)
 
-/- [no_nested_borrows::create_tuple_struct]: forward function
-   Source: 'src/no_nested_borrows.rs', lines 545:0-545:61 -/
+/- [no_nested_borrows::create_tuple_struct]:
+   Source: 'src/no_nested_borrows.rs', lines 560:0-560:61 -/
 def create_tuple_struct (x : U32) (y : U64) : Result (Tuple U32 U64) :=
   Result.ret (x, y)
 
 /- [no_nested_borrows::IdType]
-   Source: 'src/no_nested_borrows.rs', lines 550:0-550:20 -/
+   Source: 'src/no_nested_borrows.rs', lines 565:0-565:20 -/
 @[reducible] def IdType (T : Type) := T
 
-/- [no_nested_borrows::use_id_type]: forward function
-   Source: 'src/no_nested_borrows.rs', lines 552:0-552:40 -/
+/- [no_nested_borrows::use_id_type]:
+   Source: 'src/no_nested_borrows.rs', lines 567:0-567:40 -/
 def use_id_type (T : Type) (x : IdType T) : Result T :=
   Result.ret x
 
-/- [no_nested_borrows::create_id_type]: forward function
-   Source: 'src/no_nested_borrows.rs', lines 556:0-556:43 -/
+/- [no_nested_borrows::create_id_type]:
+   Source: 'src/no_nested_borrows.rs', lines 571:0-571:43 -/
 def create_id_type (T : Type) (x : T) : Result (IdType T) :=
   Result.ret x
 
-- 
cgit v1.2.3


From 2171c01c6101958d3d12734ad970132b78d500d7 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 22 Dec 2023 19:17:44 +0100
Subject: Start pushing files from the fstar-split test folder

---
 tests/fstar-split/.gitignore               |   1 +
 tests/fstar-split/Makefile                 |  33 ++
 tests/fstar-split/Makefile.template        |  48 ++
 tests/fstar-split/misc/Makefile            |  49 ++
 tests/fstar-split/misc/NoNestedBorrows.fst | 622 ++++++++++++++++++++
 tests/fstar-split/misc/Primitives.fst      | 884 +++++++++++++++++++++++++++++
 6 files changed, 1637 insertions(+)
 create mode 100644 tests/fstar-split/.gitignore
 create mode 100644 tests/fstar-split/Makefile
 create mode 100644 tests/fstar-split/Makefile.template
 create mode 100644 tests/fstar-split/misc/Makefile
 create mode 100644 tests/fstar-split/misc/NoNestedBorrows.fst
 create mode 100644 tests/fstar-split/misc/Primitives.fst

(limited to 'tests')

diff --git a/tests/fstar-split/.gitignore b/tests/fstar-split/.gitignore
new file mode 100644
index 00000000..28a11147
--- /dev/null
+++ b/tests/fstar-split/.gitignore
@@ -0,0 +1 @@
+*/obj
\ No newline at end of file
diff --git a/tests/fstar-split/Makefile b/tests/fstar-split/Makefile
new file mode 100644
index 00000000..6cf03386
--- /dev/null
+++ b/tests/fstar-split/Makefile
@@ -0,0 +1,33 @@
+ALL_DIRS ?= $(filter-out Makefile%, $(wildcard *))
+
+VERIFY_DIRS = $(addprefix verif-,$(ALL_DIRS))
+
+CLEAN_DIRS = $(addprefix clean-,$(ALL_DIRS))
+
+COPY_MAKEFILES = $(addprefix copy-makefile-,$(ALL_DIRS))
+
+.PHONY: all
+all: prepare-projects verify
+
+.PHONY: prepare-projects
+prepare-projects: $(COPY_MAKEFILES)
+
+.PHONY: verify
+verify: $(VERIFY_DIRS)
+
+.PHONY: verif-%
+verif-%:
+	cd $* && make all
+
+.PHONY: copy-makefile-%
+copy-makefile-%:
+	rm -f $*/Makefile
+	echo "# This file was automatically generated - modify ../Makefile.template instead" >> $*/Makefile
+	cat Makefile.template >> $*/Makefile
+
+.PHONY: clean
+clean: $(CLEAN_DIRS)
+
+.PHONY: clean-%
+clean-%:
+	cd $* && make clean
diff --git a/tests/fstar-split/Makefile.template b/tests/fstar-split/Makefile.template
new file mode 100644
index 00000000..14790d6d
--- /dev/null
+++ b/tests/fstar-split/Makefile.template
@@ -0,0 +1,48 @@
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/misc/Makefile b/tests/fstar-split/misc/Makefile
new file mode 100644
index 00000000..fa7d1f36
--- /dev/null
+++ b/tests/fstar-split/misc/Makefile
@@ -0,0 +1,49 @@
+# This file was automatically generated - modify ../Makefile.template instead
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/misc/NoNestedBorrows.fst b/tests/fstar-split/misc/NoNestedBorrows.fst
new file mode 100644
index 00000000..41bb7a06
--- /dev/null
+++ b/tests/fstar-split/misc/NoNestedBorrows.fst
@@ -0,0 +1,622 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [no_nested_borrows] *)
+module NoNestedBorrows
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [no_nested_borrows::Pair]
+    Source: 'src/no_nested_borrows.rs', lines 4:0-4:23 *)
+type pair_t (t1 t2 : Type0) = { x : t1; y : t2; }
+
+(** [no_nested_borrows::List]
+    Source: 'src/no_nested_borrows.rs', lines 9:0-9:16 *)
+type list_t (t : Type0) =
+| List_Cons : t -> list_t t -> list_t t
+| List_Nil : list_t t
+
+(** [no_nested_borrows::One]
+    Source: 'src/no_nested_borrows.rs', lines 20:0-20:16 *)
+type one_t (t1 : Type0) = | One_One : t1 -> one_t t1
+
+(** [no_nested_borrows::EmptyEnum]
+    Source: 'src/no_nested_borrows.rs', lines 26:0-26:18 *)
+type emptyEnum_t = | EmptyEnum_Empty : emptyEnum_t
+
+(** [no_nested_borrows::Enum]
+    Source: 'src/no_nested_borrows.rs', lines 32:0-32:13 *)
+type enum_t = | Enum_Variant1 : enum_t | Enum_Variant2 : enum_t
+
+(** [no_nested_borrows::EmptyStruct]
+    Source: 'src/no_nested_borrows.rs', lines 39:0-39:22 *)
+type emptyStruct_t = unit
+
+(** [no_nested_borrows::Sum]
+    Source: 'src/no_nested_borrows.rs', lines 41:0-41:20 *)
+type sum_t (t1 t2 : Type0) =
+| Sum_Left : t1 -> sum_t t1 t2
+| Sum_Right : t2 -> sum_t t1 t2
+
+(** [no_nested_borrows::neg_test]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 48:0-48:30 *)
+let neg_test (x : i32) : result i32 =
+  i32_neg x
+
+(** [no_nested_borrows::add_u32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 54:0-54:37 *)
+let add_u32 (x : u32) (y : u32) : result u32 =
+  u32_add x y
+
+(** [no_nested_borrows::subs_u32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 60:0-60:38 *)
+let subs_u32 (x : u32) (y : u32) : result u32 =
+  u32_sub x y
+
+(** [no_nested_borrows::div_u32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 66:0-66:37 *)
+let div_u32 (x : u32) (y : u32) : result u32 =
+  u32_div x y
+
+(** [no_nested_borrows::div_u32_const]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 73:0-73:35 *)
+let div_u32_const (x : u32) : result u32 =
+  u32_div x 2
+
+(** [no_nested_borrows::rem_u32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 78:0-78:37 *)
+let rem_u32 (x : u32) (y : u32) : result u32 =
+  u32_rem x y
+
+(** [no_nested_borrows::mul_u32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 82:0-82:37 *)
+let mul_u32 (x : u32) (y : u32) : result u32 =
+  u32_mul x y
+
+(** [no_nested_borrows::add_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 88:0-88:37 *)
+let add_i32 (x : i32) (y : i32) : result i32 =
+  i32_add x y
+
+(** [no_nested_borrows::subs_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 92:0-92:38 *)
+let subs_i32 (x : i32) (y : i32) : result i32 =
+  i32_sub x y
+
+(** [no_nested_borrows::div_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 96:0-96:37 *)
+let div_i32 (x : i32) (y : i32) : result i32 =
+  i32_div x y
+
+(** [no_nested_borrows::div_i32_const]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 100:0-100:35 *)
+let div_i32_const (x : i32) : result i32 =
+  i32_div x 2
+
+(** [no_nested_borrows::rem_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 104:0-104:37 *)
+let rem_i32 (x : i32) (y : i32) : result i32 =
+  i32_rem x y
+
+(** [no_nested_borrows::mul_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 108:0-108:37 *)
+let mul_i32 (x : i32) (y : i32) : result i32 =
+  i32_mul x y
+
+(** [no_nested_borrows::mix_arith_u32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 112:0-112:51 *)
+let mix_arith_u32 (x : u32) (y : u32) (z : u32) : result u32 =
+  let* i = u32_add x y in
+  let* i1 = u32_div x y in
+  let* i2 = u32_mul i i1 in
+  let* i3 = u32_rem z y in
+  let* i4 = u32_sub x i3 in
+  let* i5 = u32_add i2 i4 in
+  let* i6 = u32_add x y in
+  let* i7 = u32_add i6 z in
+  u32_rem i5 i7
+
+(** [no_nested_borrows::mix_arith_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 116:0-116:51 *)
+let mix_arith_i32 (x : i32) (y : i32) (z : i32) : result i32 =
+  let* i = i32_add x y in
+  let* i1 = i32_div x y in
+  let* i2 = i32_mul i i1 in
+  let* i3 = i32_rem z y in
+  let* i4 = i32_sub x i3 in
+  let* i5 = i32_add i2 i4 in
+  let* i6 = i32_add x y in
+  let* i7 = i32_add i6 z in
+  i32_rem i5 i7
+
+(** [no_nested_borrows::CONST0]
+    Source: 'src/no_nested_borrows.rs', lines 125:0-125:23 *)
+let const0_body : result usize = usize_add 1 1
+let const0_c : usize = eval_global const0_body
+
+(** [no_nested_borrows::CONST1]
+    Source: 'src/no_nested_borrows.rs', lines 126:0-126:23 *)
+let const1_body : result usize = usize_mul 2 2
+let const1_c : usize = eval_global const1_body
+
+(** [no_nested_borrows::cast_u32_to_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 128:0-128:37 *)
+let cast_u32_to_i32 (x : u32) : result i32 =
+  scalar_cast U32 I32 x
+
+(** [no_nested_borrows::cast_bool_to_i32]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 132:0-132:39 *)
+let cast_bool_to_i32 (x : bool) : result i32 =
+  scalar_cast_bool I32 x
+
+(** [no_nested_borrows::cast_bool_to_bool]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 137:0-137:41 *)
+let cast_bool_to_bool (x : bool) : result bool =
+  Return x
+
+(** [no_nested_borrows::test2]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 142:0-142:14 *)
+let test2 : result unit =
+  let* _ = u32_add 23 44 in Return ()
+
+(** Unit test for [no_nested_borrows::test2] *)
+let _ = assert_norm (test2 = Return ())
+
+(** [no_nested_borrows::get_max]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 154:0-154:37 *)
+let get_max (x : u32) (y : u32) : result u32 =
+  if x >= y then Return x else Return y
+
+(** [no_nested_borrows::test3]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 162:0-162:14 *)
+let test3 : result unit =
+  let* x = get_max 4 3 in
+  let* y = get_max 10 11 in
+  let* z = u32_add x y in
+  if not (z = 15) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test3] *)
+let _ = assert_norm (test3 = Return ())
+
+(** [no_nested_borrows::test_neg1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 169:0-169:18 *)
+let test_neg1 : result unit =
+  let* y = i32_neg 3 in if not (y = -3) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_neg1] *)
+let _ = assert_norm (test_neg1 = Return ())
+
+(** [no_nested_borrows::refs_test1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 176:0-176:19 *)
+let refs_test1 : result unit =
+  if not (1 = 1) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::refs_test1] *)
+let _ = assert_norm (refs_test1 = Return ())
+
+(** [no_nested_borrows::refs_test2]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 187:0-187:19 *)
+let refs_test2 : result unit =
+  if not (2 = 2)
+  then Fail Failure
+  else
+    if not (0 = 0)
+    then Fail Failure
+    else
+      if not (2 = 2)
+      then Fail Failure
+      else if not (2 = 2) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::refs_test2] *)
+let _ = assert_norm (refs_test2 = Return ())
+
+(** [no_nested_borrows::test_list1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 203:0-203:19 *)
+let test_list1 : result unit =
+  Return ()
+
+(** Unit test for [no_nested_borrows::test_list1] *)
+let _ = assert_norm (test_list1 = Return ())
+
+(** [no_nested_borrows::test_box1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 *)
+let test_box1 : result unit =
+  let b = 0 in
+  let* b1 = alloc_boxed_Box_deref_mut_back i32 b 1 in
+  let* x = alloc_boxed_Box_deref i32 b1 in
+  if not (x = 1) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_box1] *)
+let _ = assert_norm (test_box1 = Return ())
+
+(** [no_nested_borrows::copy_int]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 218:0-218:30 *)
+let copy_int (x : i32) : result i32 =
+  Return x
+
+(** [no_nested_borrows::test_unreachable]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 224:0-224:32 *)
+let test_unreachable (b : bool) : result unit =
+  if b then Fail Failure else Return ()
+
+(** [no_nested_borrows::test_panic]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 232:0-232:26 *)
+let test_panic (b : bool) : result unit =
+  if b then Fail Failure else Return ()
+
+(** [no_nested_borrows::test_copy_int]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 239:0-239:22 *)
+let test_copy_int : result unit =
+  let* y = copy_int 0 in if not (0 = y) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_copy_int] *)
+let _ = assert_norm (test_copy_int = Return ())
+
+(** [no_nested_borrows::is_cons]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 246:0-246:38 *)
+let is_cons (t : Type0) (l : list_t t) : result bool =
+  begin match l with
+  | List_Cons _ _ -> Return true
+  | List_Nil -> Return false
+  end
+
+(** [no_nested_borrows::test_is_cons]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 *)
+let test_is_cons : result unit =
+  let l = List_Nil in
+  let* b = is_cons i32 (List_Cons 0 l) in
+  if not b then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_is_cons] *)
+let _ = assert_norm (test_is_cons = Return ())
+
+(** [no_nested_borrows::split_list]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 259:0-259:48 *)
+let split_list (t : Type0) (l : list_t t) : result (t & (list_t t)) =
+  begin match l with
+  | List_Cons hd tl -> Return (hd, tl)
+  | List_Nil -> Fail Failure
+  end
+
+(** [no_nested_borrows::test_split_list]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 *)
+let test_split_list : result unit =
+  let l = List_Nil in
+  let* p = split_list i32 (List_Cons 0 l) in
+  let (hd, _) = p in
+  if not (hd = 0) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_split_list] *)
+let _ = assert_norm (test_split_list = Return ())
+
+(** [no_nested_borrows::choose]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 *)
+let choose (t : Type0) (b : bool) (x : t) (y : t) : result t =
+  if b then Return x else Return y
+
+(** [no_nested_borrows::choose]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 *)
+let choose_back
+  (t : Type0) (b : bool) (x : t) (y : t) (ret : t) : result (t & t) =
+  if b then Return (ret, y) else Return (x, ret)
+
+(** [no_nested_borrows::choose_test]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 282:0-282:20 *)
+let choose_test : result unit =
+  let* z = choose i32 true 0 0 in
+  let* z1 = i32_add z 1 in
+  if not (z1 = 1)
+  then Fail Failure
+  else
+    let* (x, y) = choose_back i32 true 0 0 z1 in
+    if not (x = 1)
+    then Fail Failure
+    else if not (y = 0) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::choose_test] *)
+let _ = assert_norm (choose_test = Return ())
+
+(** [no_nested_borrows::test_char]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 294:0-294:26 *)
+let test_char : result char =
+  Return 'a'
+
+(** [no_nested_borrows::Tree]
+    Source: 'src/no_nested_borrows.rs', lines 299:0-299:16 *)
+type tree_t (t : Type0) =
+| Tree_Leaf : t -> tree_t t
+| Tree_Node : t -> nodeElem_t t -> tree_t t -> tree_t t
+
+(** [no_nested_borrows::NodeElem]
+    Source: 'src/no_nested_borrows.rs', lines 304:0-304:20 *)
+and nodeElem_t (t : Type0) =
+| NodeElem_Cons : tree_t t -> nodeElem_t t -> nodeElem_t t
+| NodeElem_Nil : nodeElem_t t
+
+(** [no_nested_borrows::list_length]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 339:0-339:48 *)
+let rec list_length (t : Type0) (l : list_t t) : result u32 =
+  begin match l with
+  | List_Cons _ l1 -> let* i = list_length t l1 in u32_add 1 i
+  | List_Nil -> Return 0
+  end
+
+(** [no_nested_borrows::list_nth_shared]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 347:0-347:62 *)
+let rec list_nth_shared (t : Type0) (l : list_t t) (i : u32) : result t =
+  begin match l with
+  | List_Cons x tl ->
+    if i = 0
+    then Return x
+    else let* i1 = u32_sub i 1 in list_nth_shared t tl i1
+  | List_Nil -> Fail Failure
+  end
+
+(** [no_nested_borrows::list_nth_mut]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 *)
+let rec list_nth_mut (t : Type0) (l : list_t t) (i : u32) : result t =
+  begin match l with
+  | List_Cons x tl ->
+    if i = 0 then Return x else let* i1 = u32_sub i 1 in list_nth_mut t tl i1
+  | List_Nil -> Fail Failure
+  end
+
+(** [no_nested_borrows::list_nth_mut]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 *)
+let rec list_nth_mut_back
+  (t : Type0) (l : list_t t) (i : u32) (ret : t) : result (list_t t) =
+  begin match l with
+  | List_Cons x tl ->
+    if i = 0
+    then Return (List_Cons ret tl)
+    else
+      let* i1 = u32_sub i 1 in
+      let* tl1 = list_nth_mut_back t tl i1 ret in
+      Return (List_Cons x tl1)
+  | List_Nil -> Fail Failure
+  end
+
+(** [no_nested_borrows::list_rev_aux]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 379:0-379:63 *)
+let rec list_rev_aux
+  (t : Type0) (li : list_t t) (lo : list_t t) : result (list_t t) =
+  begin match li with
+  | List_Cons hd tl -> list_rev_aux t tl (List_Cons hd lo)
+  | List_Nil -> Return lo
+  end
+
+(** [no_nested_borrows::list_rev]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/no_nested_borrows.rs', lines 393:0-393:42 *)
+let list_rev (t : Type0) (l : list_t t) : result (list_t t) =
+  let li = core_mem_replace (list_t t) l List_Nil in list_rev_aux t li List_Nil
+
+(** [no_nested_borrows::test_list_functions]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 *)
+let test_list_functions : result unit =
+  let l = List_Nil in
+  let l1 = List_Cons 2 l in
+  let l2 = List_Cons 1 l1 in
+  let* i = list_length i32 (List_Cons 0 l2) in
+  if not (i = 3)
+  then Fail Failure
+  else
+    let* i1 = list_nth_shared i32 (List_Cons 0 l2) 0 in
+    if not (i1 = 0)
+    then Fail Failure
+    else
+      let* i2 = list_nth_shared i32 (List_Cons 0 l2) 1 in
+      if not (i2 = 1)
+      then Fail Failure
+      else
+        let* i3 = list_nth_shared i32 (List_Cons 0 l2) 2 in
+        if not (i3 = 2)
+        then Fail Failure
+        else
+          let* ls = list_nth_mut_back i32 (List_Cons 0 l2) 1 3 in
+          let* i4 = list_nth_shared i32 ls 0 in
+          if not (i4 = 0)
+          then Fail Failure
+          else
+            let* i5 = list_nth_shared i32 ls 1 in
+            if not (i5 = 3)
+            then Fail Failure
+            else
+              let* i6 = list_nth_shared i32 ls 2 in
+              if not (i6 = 2) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_list_functions] *)
+let _ = assert_norm (test_list_functions = Return ())
+
+(** [no_nested_borrows::id_mut_pair1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 *)
+let id_mut_pair1 (t1 t2 : Type0) (x : t1) (y : t2) : result (t1 & t2) =
+  Return (x, y)
+
+(** [no_nested_borrows::id_mut_pair1]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 *)
+let id_mut_pair1_back
+  (t1 t2 : Type0) (x : t1) (y : t2) (ret : (t1 & t2)) : result (t1 & t2) =
+  let (x1, x2) = ret in Return (x1, x2)
+
+(** [no_nested_borrows::id_mut_pair2]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 *)
+let id_mut_pair2 (t1 t2 : Type0) (p : (t1 & t2)) : result (t1 & t2) =
+  let (x, x1) = p in Return (x, x1)
+
+(** [no_nested_borrows::id_mut_pair2]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 *)
+let id_mut_pair2_back
+  (t1 t2 : Type0) (p : (t1 & t2)) (ret : (t1 & t2)) : result (t1 & t2) =
+  let (x, x1) = ret in Return (x, x1)
+
+(** [no_nested_borrows::id_mut_pair3]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
+let id_mut_pair3 (t1 t2 : Type0) (x : t1) (y : t2) : result (t1 & t2) =
+  Return (x, y)
+
+(** [no_nested_borrows::id_mut_pair3]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
+let id_mut_pair3_back'a
+  (t1 t2 : Type0) (x : t1) (y : t2) (ret : t1) : result t1 =
+  Return ret
+
+(** [no_nested_borrows::id_mut_pair3]: backward function 1
+    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
+let id_mut_pair3_back'b
+  (t1 t2 : Type0) (x : t1) (y : t2) (ret : t2) : result t2 =
+  Return ret
+
+(** [no_nested_borrows::id_mut_pair4]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
+let id_mut_pair4 (t1 t2 : Type0) (p : (t1 & t2)) : result (t1 & t2) =
+  let (x, x1) = p in Return (x, x1)
+
+(** [no_nested_borrows::id_mut_pair4]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
+let id_mut_pair4_back'a
+  (t1 t2 : Type0) (p : (t1 & t2)) (ret : t1) : result t1 =
+  Return ret
+
+(** [no_nested_borrows::id_mut_pair4]: backward function 1
+    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
+let id_mut_pair4_back'b
+  (t1 t2 : Type0) (p : (t1 & t2)) (ret : t2) : result t2 =
+  Return ret
+
+(** [no_nested_borrows::StructWithTuple]
+    Source: 'src/no_nested_borrows.rs', lines 433:0-433:34 *)
+type structWithTuple_t (t1 t2 : Type0) = { p : (t1 & t2); }
+
+(** [no_nested_borrows::new_tuple1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 437:0-437:48 *)
+let new_tuple1 : result (structWithTuple_t u32 u32) =
+  Return { p = (1, 2) }
+
+(** [no_nested_borrows::new_tuple2]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 441:0-441:48 *)
+let new_tuple2 : result (structWithTuple_t i16 i16) =
+  Return { p = (1, 2) }
+
+(** [no_nested_borrows::new_tuple3]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 445:0-445:48 *)
+let new_tuple3 : result (structWithTuple_t u64 i64) =
+  Return { p = (1, 2) }
+
+(** [no_nested_borrows::StructWithPair]
+    Source: 'src/no_nested_borrows.rs', lines 450:0-450:33 *)
+type structWithPair_t (t1 t2 : Type0) = { p : pair_t t1 t2; }
+
+(** [no_nested_borrows::new_pair1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 454:0-454:46 *)
+let new_pair1 : result (structWithPair_t u32 u32) =
+  Return { p = { x = 1; y = 2 } }
+
+(** [no_nested_borrows::test_constants]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 462:0-462:23 *)
+let test_constants : result unit =
+  let* swt = new_tuple1 in
+  let (i, _) = swt.p in
+  if not (i = 1)
+  then Fail Failure
+  else
+    let* swt1 = new_tuple2 in
+    let (i1, _) = swt1.p in
+    if not (i1 = 1)
+    then Fail Failure
+    else
+      let* swt2 = new_tuple3 in
+      let (i2, _) = swt2.p in
+      if not (i2 = 1)
+      then Fail Failure
+      else
+        let* swp = new_pair1 in
+        if not (swp.p.x = 1) then Fail Failure else Return ()
+
+(** Unit test for [no_nested_borrows::test_constants] *)
+let _ = assert_norm (test_constants = Return ())
+
+(** [no_nested_borrows::test_weird_borrows1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 471:0-471:28 *)
+let test_weird_borrows1 : result unit =
+  Return ()
+
+(** Unit test for [no_nested_borrows::test_weird_borrows1] *)
+let _ = assert_norm (test_weird_borrows1 = Return ())
+
+(** [no_nested_borrows::test_mem_replace]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/no_nested_borrows.rs', lines 481:0-481:37 *)
+let test_mem_replace (px : u32) : result u32 =
+  let y = core_mem_replace u32 px 1 in
+  if not (y = 0) then Fail Failure else Return 2
+
+(** [no_nested_borrows::test_shared_borrow_bool1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 488:0-488:47 *)
+let test_shared_borrow_bool1 (b : bool) : result u32 =
+  if b then Return 0 else Return 1
+
+(** [no_nested_borrows::test_shared_borrow_bool2]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 501:0-501:40 *)
+let test_shared_borrow_bool2 : result u32 =
+  Return 0
+
+(** [no_nested_borrows::test_shared_borrow_enum1]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 516:0-516:52 *)
+let test_shared_borrow_enum1 (l : list_t u32) : result u32 =
+  begin match l with | List_Cons _ _ -> Return 1 | List_Nil -> Return 0 end
+
+(** [no_nested_borrows::test_shared_borrow_enum2]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 528:0-528:40 *)
+let test_shared_borrow_enum2 : result u32 =
+  Return 0
+
+(** [no_nested_borrows::incr]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/no_nested_borrows.rs', lines 539:0-539:24 *)
+let incr (x : u32) : result u32 =
+  u32_add x 1
+
+(** [no_nested_borrows::call_incr]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 543:0-543:35 *)
+let call_incr (x : u32) : result u32 =
+  incr x
+
+(** [no_nested_borrows::read_then_incr]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 548:0-548:41 *)
+let read_then_incr (x : u32) : result u32 =
+  let* _ = u32_add x 1 in Return x
+
+(** [no_nested_borrows::read_then_incr]: backward function 0
+    Source: 'src/no_nested_borrows.rs', lines 548:0-548:41 *)
+let read_then_incr_back (x : u32) : result u32 =
+  u32_add x 1
+
+(** [no_nested_borrows::Tuple]
+    Source: 'src/no_nested_borrows.rs', lines 554:0-554:24 *)
+type tuple_t (t1 t2 : Type0) = t1 * t2
+
+(** [no_nested_borrows::use_tuple_struct]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/no_nested_borrows.rs', lines 556:0-556:48 *)
+let use_tuple_struct (x : tuple_t u32 u32) : result (tuple_t u32 u32) =
+  let (_, i) = x in Return (1, i)
+
+(** [no_nested_borrows::create_tuple_struct]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 560:0-560:61 *)
+let create_tuple_struct (x : u32) (y : u64) : result (tuple_t u32 u64) =
+  Return (x, y)
+
+(** [no_nested_borrows::IdType]
+    Source: 'src/no_nested_borrows.rs', lines 565:0-565:20 *)
+type idType_t (t : Type0) = t
+
+(** [no_nested_borrows::use_id_type]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 567:0-567:40 *)
+let use_id_type (t : Type0) (x : idType_t t) : result t =
+  Return x
+
+(** [no_nested_borrows::create_id_type]: forward function
+    Source: 'src/no_nested_borrows.rs', lines 571:0-571:43 *)
+let create_id_type (t : Type0) (x : t) : result (idType_t t) =
+  Return x
+
diff --git a/tests/fstar-split/misc/Primitives.fst b/tests/fstar-split/misc/Primitives.fst
new file mode 100644
index 00000000..a3ffbde4
--- /dev/null
+++ b/tests/fstar-split/misc/Primitives.fst
@@ -0,0 +1,884 @@
+/// This file lists primitive and assumed functions and types
+module Primitives
+open FStar.Mul
+open FStar.List.Tot
+
+#set-options "--z3rlimit 15 --fuel 0 --ifuel 1"
+
+(*** Utilities *)
+val list_update (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a) :
+  ls':list a{
+    length ls' = length ls /\
+    index ls' i == x
+  }
+#push-options "--fuel 1"
+let rec list_update #a ls i x =
+  match ls with
+  | x' :: ls -> if i = 0 then x :: ls else x' :: list_update ls (i-1) x
+#pop-options
+
+(*** Result *)
+type error : Type0 =
+| Failure
+| OutOfFuel
+
+type result (a : Type0) : Type0 =
+| Return : v:a -> result a
+| Fail : e:error -> result a
+
+// Monadic return operator
+unfold let return (#a : Type0) (x : a) : result a = Return x
+
+// Monadic bind operator.
+// Allows to use the notation:
+// ```
+// let* x = y in
+// ...
+// ```
+unfold let (let*) (#a #b : Type0) (m: result a)
+  (f: (x:a) -> Pure (result b) (requires (m == Return x)) (ensures fun _ -> True)) :
+  result b =
+  match m with
+  | Return x -> f x
+  | Fail e   -> Fail e
+
+// Monadic assert(...)
+let massert (b:bool) : result unit = if b then Return () else Fail Failure
+
+// Normalize and unwrap a successful result (used for globals).
+let eval_global (#a : Type0) (x : result a{Return? (normalize_term x)}) : a = Return?.v x
+
+(*** Misc *)
+type char = FStar.Char.char
+type string = string
+
+let is_zero (n: nat) : bool = n = 0
+let decrease (n: nat{n > 0}) : nat = n - 1
+
+let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
+let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+
+// We don't really use raw pointers for now
+type mut_raw_ptr (t : Type0) = { v : t }
+type const_raw_ptr (t : Type0) = { v : t }
+
+(*** Scalars *)
+/// Rem.: most of the following code was partially generated
+
+assume val size_numbits : pos
+
+// TODO: we could use FStar.Int.int_t and FStar.UInt.int_t
+
+let isize_min : int = -9223372036854775808 // TODO: should be opaque
+let isize_max : int = 9223372036854775807 // TODO: should be opaque
+let i8_min : int = -128
+let i8_max : int = 127
+let i16_min : int = -32768
+let i16_max : int = 32767
+let i32_min : int = -2147483648
+let i32_max : int = 2147483647
+let i64_min : int = -9223372036854775808
+let i64_max : int = 9223372036854775807
+let i128_min : int = -170141183460469231731687303715884105728
+let i128_max : int = 170141183460469231731687303715884105727
+let usize_min : int = 0
+let usize_max : int = 4294967295 // TODO: should be opaque
+let u8_min : int = 0
+let u8_max : int = 255
+let u16_min : int = 0
+let u16_max : int = 65535
+let u32_min : int = 0
+let u32_max : int = 4294967295
+let u64_min : int = 0
+let u64_max : int = 18446744073709551615
+let u128_min : int = 0
+let u128_max : int = 340282366920938463463374607431768211455
+
+type scalar_ty =
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+let is_unsigned = function
+  | Isize | I8 | I16 | I32 | I64 | I128 -> false
+  | Usize | U8 | U16 | U32 | U64 | U128 -> true
+
+let scalar_min (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_min
+  | I8 -> i8_min
+  | I16 -> i16_min
+  | I32 -> i32_min
+  | I64 -> i64_min
+  | I128 -> i128_min
+  | Usize -> usize_min
+  | U8 -> u8_min
+  | U16 -> u16_min
+  | U32 -> u32_min
+  | U64 -> u64_min
+  | U128 -> u128_min
+
+let scalar_max (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_max
+  | I8 -> i8_max
+  | I16 -> i16_max
+  | I32 -> i32_max
+  | I64 -> i64_max
+  | I128 -> i128_max
+  | Usize -> usize_max
+  | U8 -> u8_max
+  | U16 -> u16_max
+  | U32 -> u32_max
+  | U64 -> u64_max
+  | U128 -> u128_max
+
+type scalar (ty : scalar_ty) : eqtype = x:int{scalar_min ty <= x && x <= scalar_max ty}
+
+let mk_scalar (ty : scalar_ty) (x : int) : result (scalar ty) =
+  if scalar_min ty <= x && scalar_max ty >= x then Return x else Fail Failure
+
+let scalar_neg (#ty : scalar_ty) (x : scalar ty) : result (scalar ty) = mk_scalar ty (-x)
+
+let scalar_div (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (x / y) else Fail Failure
+
+/// The remainder operation
+let int_rem (x : int) (y : int{y <> 0}) : int =
+  if x >= 0 then (x % y) else -(x % y)
+
+(* Checking consistency with Rust *)
+let _ = assert_norm(int_rem 1 2 = 1)
+let _ = assert_norm(int_rem (-1) 2 = -1)
+let _ = assert_norm(int_rem 1 (-2) = 1)
+let _ = assert_norm(int_rem (-1) (-2) = -1)
+
+let scalar_rem (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (int_rem x y) else Fail Failure
+
+let scalar_add (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x + y)
+
+let scalar_sub (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x - y)
+
+let scalar_mul (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x * y)
+
+let scalar_xor (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logxor #8 x y
+  | U16 -> FStar.UInt.logxor #16 x y
+  | U32 -> FStar.UInt.logxor #32 x y
+  | U64 -> FStar.UInt.logxor #64 x y
+  | U128 -> FStar.UInt.logxor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logxor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logxor #16 x y
+  | I32 -> FStar.Int.logxor #32 x y
+  | I64 -> FStar.Int.logxor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logxor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_or (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logor #8 x y
+  | U16 -> FStar.UInt.logor #16 x y
+  | U32 -> FStar.UInt.logor #32 x y
+  | U64 -> FStar.UInt.logor #64 x y
+  | U128 -> FStar.UInt.logor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logor #16 x y
+  | I32 -> FStar.Int.logor #32 x y
+  | I64 -> FStar.Int.logor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_and (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logand #8 x y
+  | U16 -> FStar.UInt.logand #16 x y
+  | U32 -> FStar.UInt.logand #32 x y
+  | U64 -> FStar.UInt.logand #64 x y
+  | U128 -> FStar.UInt.logand #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logand #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logand #16 x y
+  | I32 -> FStar.Int.logand #32 x y
+  | I64 -> FStar.Int.logand #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logand #128 x y
+  | Isize -> admit() // TODO
+
+// Shift left
+let scalar_shl (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+// Shift right
+let scalar_shr (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+(** Cast an integer from a [src_ty] to a [tgt_ty] *)
+// TODO: check the semantics of casts in Rust
+let scalar_cast (src_ty : scalar_ty) (tgt_ty : scalar_ty) (x : scalar src_ty) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty x
+
+// This can't fail, but for now we make all casts faillible (easier for the translation)
+let scalar_cast_bool (tgt_ty : scalar_ty) (x : bool) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty (if x then 1 else 0)
+
+/// The scalar types
+type isize : eqtype = scalar Isize
+type i8    : eqtype = scalar I8
+type i16   : eqtype = scalar I16
+type i32   : eqtype = scalar I32
+type i64   : eqtype = scalar I64
+type i128  : eqtype = scalar I128
+type usize : eqtype = scalar Usize
+type u8    : eqtype = scalar U8
+type u16   : eqtype = scalar U16
+type u32   : eqtype = scalar U32
+type u64   : eqtype = scalar U64
+type u128  : eqtype = scalar U128
+
+
+let core_isize_min : isize = isize_min
+let core_isize_max : isize = isize_max
+let core_i8_min    : i8 = i8_min
+let core_i8_max    : i8 = i8_max
+let core_i16_min   : i16 = i16_min
+let core_i16_max   : i16 = i16_max
+let core_i32_min   : i32 = i32_min
+let core_i32_max   : i32 = i32_max
+let core_i64_min   : i64 = i64_min
+let core_i64_max   : i64 = i64_max
+let core_i128_min  : i128 = i128_min
+let core_i128_max  : i128 = i128_max
+
+let core_usize_min : usize = usize_min
+let core_usize_max : usize = usize_max
+let core_u8_min    : u8 = u8_min
+let core_u8_max    : u8 = u8_max
+let core_u16_min   : u16 = u16_min
+let core_u16_max   : u16 = u16_max
+let core_u32_min   : u32 = u32_min
+let core_u32_max   : u32 = u32_max
+let core_u64_min   : u64 = u64_min
+let core_u64_max   : u64 = u64_max
+let core_u128_min  : u128 = u128_min
+let core_u128_max  : u128 = u128_max
+
+/// Negation
+let isize_neg = scalar_neg #Isize
+let i8_neg = scalar_neg #I8
+let i16_neg = scalar_neg #I16
+let i32_neg = scalar_neg #I32
+let i64_neg = scalar_neg #I64
+let i128_neg = scalar_neg #I128
+
+/// Division
+let isize_div = scalar_div #Isize
+let i8_div = scalar_div #I8
+let i16_div = scalar_div #I16
+let i32_div = scalar_div #I32
+let i64_div = scalar_div #I64
+let i128_div = scalar_div #I128
+let usize_div = scalar_div #Usize
+let u8_div = scalar_div #U8
+let u16_div = scalar_div #U16
+let u32_div = scalar_div #U32
+let u64_div = scalar_div #U64
+let u128_div = scalar_div #U128
+
+/// Remainder
+let isize_rem = scalar_rem #Isize
+let i8_rem = scalar_rem #I8
+let i16_rem = scalar_rem #I16
+let i32_rem = scalar_rem #I32
+let i64_rem = scalar_rem #I64
+let i128_rem = scalar_rem #I128
+let usize_rem = scalar_rem #Usize
+let u8_rem = scalar_rem #U8
+let u16_rem = scalar_rem #U16
+let u32_rem = scalar_rem #U32
+let u64_rem = scalar_rem #U64
+let u128_rem = scalar_rem #U128
+
+/// Addition
+let isize_add = scalar_add #Isize
+let i8_add = scalar_add #I8
+let i16_add = scalar_add #I16
+let i32_add = scalar_add #I32
+let i64_add = scalar_add #I64
+let i128_add = scalar_add #I128
+let usize_add = scalar_add #Usize
+let u8_add = scalar_add #U8
+let u16_add = scalar_add #U16
+let u32_add = scalar_add #U32
+let u64_add = scalar_add #U64
+let u128_add = scalar_add #U128
+
+/// Subtraction
+let isize_sub = scalar_sub #Isize
+let i8_sub = scalar_sub #I8
+let i16_sub = scalar_sub #I16
+let i32_sub = scalar_sub #I32
+let i64_sub = scalar_sub #I64
+let i128_sub = scalar_sub #I128
+let usize_sub = scalar_sub #Usize
+let u8_sub = scalar_sub #U8
+let u16_sub = scalar_sub #U16
+let u32_sub = scalar_sub #U32
+let u64_sub = scalar_sub #U64
+let u128_sub = scalar_sub #U128
+
+/// Multiplication
+let isize_mul = scalar_mul #Isize
+let i8_mul = scalar_mul #I8
+let i16_mul = scalar_mul #I16
+let i32_mul = scalar_mul #I32
+let i64_mul = scalar_mul #I64
+let i128_mul = scalar_mul #I128
+let usize_mul = scalar_mul #Usize
+let u8_mul = scalar_mul #U8
+let u16_mul = scalar_mul #U16
+let u32_mul = scalar_mul #U32
+let u64_mul = scalar_mul #U64
+let u128_mul = scalar_mul #U128
+
+/// Xor
+let u8_xor = scalar_xor #U8
+let u16_xor = scalar_xor #U16
+let u32_xor = scalar_xor #U32
+let u64_xor = scalar_xor #U64
+let u128_xor = scalar_xor #U128
+let usize_xor = scalar_xor #Usize
+let i8_xor = scalar_xor #I8
+let i16_xor = scalar_xor #I16
+let i32_xor = scalar_xor #I32
+let i64_xor = scalar_xor #I64
+let i128_xor = scalar_xor #I128
+let isize_xor = scalar_xor #Isize
+
+/// Or
+let u8_or = scalar_or #U8
+let u16_or = scalar_or #U16
+let u32_or = scalar_or #U32
+let u64_or = scalar_or #U64
+let u128_or = scalar_or #U128
+let usize_or = scalar_or #Usize
+let i8_or = scalar_or #I8
+let i16_or = scalar_or #I16
+let i32_or = scalar_or #I32
+let i64_or = scalar_or #I64
+let i128_or = scalar_or #I128
+let isize_or = scalar_or #Isize
+
+/// And
+let u8_and = scalar_and #U8
+let u16_and = scalar_and #U16
+let u32_and = scalar_and #U32
+let u64_and = scalar_and #U64
+let u128_and = scalar_and #U128
+let usize_and = scalar_and #Usize
+let i8_and = scalar_and #I8
+let i16_and = scalar_and #I16
+let i32_and = scalar_and #I32
+let i64_and = scalar_and #I64
+let i128_and = scalar_and #I128
+let isize_and = scalar_and #Isize
+
+/// Shift left
+let u8_shl #ty = scalar_shl #U8 #ty
+let u16_shl #ty = scalar_shl #U16 #ty
+let u32_shl #ty = scalar_shl #U32 #ty
+let u64_shl #ty = scalar_shl #U64 #ty
+let u128_shl #ty = scalar_shl #U128 #ty
+let usize_shl #ty = scalar_shl #Usize #ty
+let i8_shl #ty = scalar_shl #I8 #ty
+let i16_shl #ty = scalar_shl #I16 #ty
+let i32_shl #ty = scalar_shl #I32 #ty
+let i64_shl #ty = scalar_shl #I64 #ty
+let i128_shl #ty = scalar_shl #I128 #ty
+let isize_shl #ty = scalar_shl #Isize #ty
+
+/// Shift right
+let u8_shr #ty = scalar_shr #U8 #ty
+let u16_shr #ty = scalar_shr #U16 #ty
+let u32_shr #ty = scalar_shr #U32 #ty
+let u64_shr #ty = scalar_shr #U64 #ty
+let u128_shr #ty = scalar_shr #U128 #ty
+let usize_shr #ty = scalar_shr #Usize #ty
+let i8_shr #ty = scalar_shr #I8 #ty
+let i16_shr #ty = scalar_shr #I16 #ty
+let i32_shr #ty = scalar_shr #I32 #ty
+let i64_shr #ty = scalar_shr #I64 #ty
+let i128_shr #ty = scalar_shr #I128 #ty
+let isize_shr #ty = scalar_shr #Isize #ty
+
+(*** core::ops *)
+
+// Trait declaration: [core::ops::index::Index]
+noeq type core_ops_index_Index (self idx : Type0) = {
+  output : Type0;
+  index : self → idx → result output
+}
+
+// Trait declaration: [core::ops::index::IndexMut]
+noeq type core_ops_index_IndexMut (self idx : Type0) = {
+  indexInst : core_ops_index_Index self idx;
+  index_mut : self → idx → result indexInst.output;
+  index_mut_back : self → idx → indexInst.output → result self;
+}
+
+// Trait declaration [core::ops::deref::Deref]
+noeq type core_ops_deref_Deref (self : Type0) = {
+  target : Type0;
+  deref : self → result target;
+}
+
+// Trait declaration [core::ops::deref::DerefMut]
+noeq type core_ops_deref_DerefMut (self : Type0) = {
+  derefInst : core_ops_deref_Deref self;
+  deref_mut : self → result derefInst.target;
+  deref_mut_back : self → derefInst.target → result self;
+}
+
+type core_ops_range_Range (a : Type0) = {
+  start : a;
+  end_ : a;
+}
+
+(*** [alloc] *)
+
+let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
+  target = self;
+  deref = alloc_boxed_Box_deref self;
+}
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
+  derefInst = alloc_boxed_Box_coreopsDerefInst self;
+  deref_mut = alloc_boxed_Box_deref_mut self;
+  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
+}
+
+(*** Array *)
+type array (a : Type0) (n : usize) = s:list a{length s = n}
+
+// We tried putting the normalize_term condition as a refinement on the list
+// but it didn't work. It works with the requires clause.
+let mk_array (a : Type0) (n : usize)
+  (l : list a) :
+  Pure (array a n)
+  (requires (normalize_term(FStar.List.Tot.length l) = n))
+  (ensures (fun _ -> True)) =
+  normalize_term_spec (FStar.List.Tot.length l);
+  l
+
+let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Slice *)
+type slice (a : Type0) = s:list a{length s <= usize_max}
+
+let slice_len (a : Type0) (s : slice a) : usize = length s
+
+let slice_index_usize (a : Type0) (x : slice a) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (slice a) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Subslices *)
+
+let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
+let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : result (array a n) =
+  if length s = n then Return s
+  else Fail Failure
+
+// TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
+let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let array_update_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) (ns : slice a) : result (array a n) =
+  admit()
+
+let array_repeat (a : Type0) (n : usize) (x : a) : array a n =
+  admit()
+
+let slice_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let slice_update_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) (ns : slice a) : result (slice a) =
+  admit()
+
+(*** Vector *)
+type alloc_vec_Vec (a : Type0) = v:list a{length v <= usize_max}
+
+let alloc_vec_Vec_new (a  : Type0) : alloc_vec_Vec a = assert_norm(length #a [] == 0); []
+let alloc_vec_Vec_len (a : Type0) (v : alloc_vec_Vec a) : usize = length v
+
+// Helper
+let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : result a =
+  if i < length v then Return (index v i) else Fail Failure
+// Helper
+let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
+  Pure (result (alloc_vec_Vec a))
+  (requires True)
+  (ensures (fun res ->
+    match res with
+    | Fail e -> e == Failure
+    | Return v' -> length v' = length v + 1)) =
+  if length v < usize_max then begin
+    (**) assert_norm(length [x] == 1);
+    (**) append_length v [x];
+    (**) assert(length (append v [x]) = length v + 1);
+    Return (append v [x])
+    end
+  else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
+  if i < length v then Return () else Fail Failure
+let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// Trait declaration: [core::slice::index::private_slice_index::Sealed]
+type core_slice_index_private_slice_index_Sealed (self : Type0) = unit
+
+// Trait declaration: [core::slice::index::SliceIndex]
+noeq type core_slice_index_SliceIndex (self t : Type0) = {
+  sealedInst : core_slice_index_private_slice_index_Sealed self;
+  output : Type0;
+  get : self → t → result (option output);
+  get_mut : self → t → result (option output);
+  get_mut_back : self → t → option output → result t;
+  get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
+  get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
+  index : self → t → result output;
+  index_mut : self → t → result output;
+  index_mut_back : self → t → output → result t;
+}
+
+// [core::slice::index::[T]::index]: forward function
+let core_slice_index_Slice_index
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (s : slice t) (i : idx) : result inst.output =
+  let* x = inst.get i s in
+  match x with
+  | None -> Fail Failure
+  | Some x -> Return x
+
+// [core::slice::index::Range:::get]: forward function
+let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize) (s : slice t) :
+  result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: forward function
+let core_slice_index_RangeUsize_get_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: backward function 0
+let core_slice_index_RangeUsize_get_mut_back
+  (t : Type0) :
+  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_unchecked]: forward function
+let core_slice_index_RangeUsize_get_unchecked
+  (t : Type0) :
+  core_ops_range_Range usize → const_raw_ptr (slice t) → result (const_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::get_unchecked_mut]: forward function
+let core_slice_index_RangeUsize_get_unchecked_mut
+  (t : Type0) :
+  core_ops_range_Range usize → mut_raw_ptr (slice t) → result (mut_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::index]: forward function
+let core_slice_index_RangeUsize_index
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: forward function
+let core_slice_index_RangeUsize_index_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: backward function 0
+let core_slice_index_RangeUsize_index_mut_back
+  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::[T]::index_mut]: forward function
+let core_slice_index_Slice_index_mut
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → result inst.output =
+  admit () // 
+
+// [core::slice::index::[T]::index_mut]: backward function 0
+let core_slice_index_Slice_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → inst.output → result (slice t) =
+  admit () // TODO
+
+// [core::array::[T; N]::index]: forward function
+let core_array_Array_index
+  (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
+  (a : array t n) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: forward function
+let core_array_Array_index_mut
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) : result inst.indexInst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: backward function 0
+let core_array_Array_index_mut_back
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::Range]
+let core_slice_index_private_slice_index_SealedRangeUsizeInst
+  : core_slice_index_private_slice_index_Sealed (core_ops_range_Range usize) = ()
+
+// Trait implementation: [core::slice::index::Range]
+let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex (core_ops_range_Range usize) (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedRangeUsizeInst;
+  output = slice t;
+  get = core_slice_index_RangeUsize_get t;
+  get_mut = core_slice_index_RangeUsize_get_mut t;
+  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
+  get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
+  index = core_slice_index_RangeUsize_index t;
+  index_mut = core_slice_index_RangeUsize_index_mut t;
+  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (slice t) idx = {
+  output = inst.output;
+  index = core_slice_index_Slice_index t idx inst;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (slice t) idx = {
+  indexInst = core_ops_index_IndexSliceTIInst t idx inst;
+  index_mut = core_slice_index_Slice_index_mut t idx inst;
+  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexArrayInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_Index (slice t) idx) :
+  core_ops_index_Index (array t n) idx = {
+  output = inst.output;
+  index = core_array_Array_index t idx n inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_IndexMut (slice t) idx) :
+  core_ops_index_IndexMut (array t n) idx = {
+  indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
+  index_mut = core_array_Array_index_mut t idx n inst;
+  index_mut_back = core_array_Array_index_mut_back t idx n inst;
+}
+
+// [core::slice::index::usize::get]: forward function
+let core_slice_index_usize_get
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: forward function
+let core_slice_index_usize_get_mut
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: backward function 0
+let core_slice_index_usize_get_mut_back
+  (t : Type0) : usize → slice t → option t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked]: forward function
+let core_slice_index_usize_get_unchecked
+  (t : Type0) : usize → const_raw_ptr (slice t) → result (const_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked_mut]: forward function
+let core_slice_index_usize_get_unchecked_mut
+  (t : Type0) : usize → mut_raw_ptr (slice t) → result (mut_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::index]: forward function
+let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: forward function
+let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: backward function 0
+let core_slice_index_usize_index_mut_back
+  (t : Type0) : usize → slice t → t → result (slice t) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::usize]
+let core_slice_index_private_slice_index_SealedUsizeInst
+  : core_slice_index_private_slice_index_Sealed usize = ()
+
+// Trait implementation: [core::slice::index::usize]
+let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex usize (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedUsizeInst;
+  output = t;
+  get = core_slice_index_usize_get t;
+  get_mut = core_slice_index_usize_get_mut t;
+  get_mut_back = core_slice_index_usize_get_mut_back t;
+  get_unchecked = core_slice_index_usize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
+  index = core_slice_index_usize_index t;
+  index_mut = core_slice_index_usize_index_mut t;
+  index_mut_back = core_slice_index_usize_index_mut_back t;
+}
+
+// [alloc::vec::Vec::index]: forward function
+let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: forward function
+let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: backward function 0
+let alloc_vec_Vec_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  admit () // TODO
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (alloc_vec_Vec t) idx = {
+  output = inst.output;
+  index = alloc_vec_Vec_index t idx inst;
+}
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
+  indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
+  index_mut = alloc_vec_Vec_index_mut t idx inst;
+  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
+}
+
+(*** Theorems *)
+
+let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
+  Lemma (
+    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
+      alloc_vec_Vec_update_usize v i x)
+  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
+  =
+  admit()
-- 
cgit v1.2.3


From 719263b7bb727bdb432f66709b8c1eadc47ba922 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 22 Dec 2023 19:23:39 +0100
Subject: Annotate the bound vars in the lambdas for Coq

---
 tests/coq/misc/NoNestedBorrows.v | 388 +++++++++++++++++++--------------------
 tests/coq/misc/Primitives.v      | 116 +++++-------
 2 files changed, 231 insertions(+), 273 deletions(-)

(limited to 'tests')

diff --git a/tests/coq/misc/NoNestedBorrows.v b/tests/coq/misc/NoNestedBorrows.v
index 65164ac5..081c65c3 100644
--- a/tests/coq/misc/NoNestedBorrows.v
+++ b/tests/coq/misc/NoNestedBorrows.v
@@ -54,97 +54,97 @@ Inductive Sum_t (T1 T2 : Type) :=
 Arguments Sum_Left { _ _ }.
 Arguments Sum_Right { _ _ }.
 
-(** [no_nested_borrows::neg_test]: forward function
+(** [no_nested_borrows::neg_test]:
     Source: 'src/no_nested_borrows.rs', lines 48:0-48:30 *)
 Definition neg_test (x : i32) : result i32 :=
   i32_neg x.
 
-(** [no_nested_borrows::add_u32]: forward function
+(** [no_nested_borrows::add_u32]:
     Source: 'src/no_nested_borrows.rs', lines 54:0-54:37 *)
 Definition add_u32 (x : u32) (y : u32) : result u32 :=
   u32_add x y.
 
-(** [no_nested_borrows::subs_u32]: forward function
+(** [no_nested_borrows::subs_u32]:
     Source: 'src/no_nested_borrows.rs', lines 60:0-60:38 *)
 Definition subs_u32 (x : u32) (y : u32) : result u32 :=
   u32_sub x y.
 
-(** [no_nested_borrows::div_u32]: forward function
+(** [no_nested_borrows::div_u32]:
     Source: 'src/no_nested_borrows.rs', lines 66:0-66:37 *)
 Definition div_u32 (x : u32) (y : u32) : result u32 :=
   u32_div x y.
 
-(** [no_nested_borrows::div_u32_const]: forward function
+(** [no_nested_borrows::div_u32_const]:
     Source: 'src/no_nested_borrows.rs', lines 73:0-73:35 *)
 Definition div_u32_const (x : u32) : result u32 :=
   u32_div x 2%u32.
 
-(** [no_nested_borrows::rem_u32]: forward function
+(** [no_nested_borrows::rem_u32]:
     Source: 'src/no_nested_borrows.rs', lines 78:0-78:37 *)
 Definition rem_u32 (x : u32) (y : u32) : result u32 :=
   u32_rem x y.
 
-(** [no_nested_borrows::mul_u32]: forward function
+(** [no_nested_borrows::mul_u32]:
     Source: 'src/no_nested_borrows.rs', lines 82:0-82:37 *)
 Definition mul_u32 (x : u32) (y : u32) : result u32 :=
   u32_mul x y.
 
-(** [no_nested_borrows::add_i32]: forward function
+(** [no_nested_borrows::add_i32]:
     Source: 'src/no_nested_borrows.rs', lines 88:0-88:37 *)
 Definition add_i32 (x : i32) (y : i32) : result i32 :=
   i32_add x y.
 
-(** [no_nested_borrows::subs_i32]: forward function
+(** [no_nested_borrows::subs_i32]:
     Source: 'src/no_nested_borrows.rs', lines 92:0-92:38 *)
 Definition subs_i32 (x : i32) (y : i32) : result i32 :=
   i32_sub x y.
 
-(** [no_nested_borrows::div_i32]: forward function
+(** [no_nested_borrows::div_i32]:
     Source: 'src/no_nested_borrows.rs', lines 96:0-96:37 *)
 Definition div_i32 (x : i32) (y : i32) : result i32 :=
   i32_div x y.
 
-(** [no_nested_borrows::div_i32_const]: forward function
+(** [no_nested_borrows::div_i32_const]:
     Source: 'src/no_nested_borrows.rs', lines 100:0-100:35 *)
 Definition div_i32_const (x : i32) : result i32 :=
   i32_div x 2%i32.
 
-(** [no_nested_borrows::rem_i32]: forward function
+(** [no_nested_borrows::rem_i32]:
     Source: 'src/no_nested_borrows.rs', lines 104:0-104:37 *)
 Definition rem_i32 (x : i32) (y : i32) : result i32 :=
   i32_rem x y.
 
-(** [no_nested_borrows::mul_i32]: forward function
+(** [no_nested_borrows::mul_i32]:
     Source: 'src/no_nested_borrows.rs', lines 108:0-108:37 *)
 Definition mul_i32 (x : i32) (y : i32) : result i32 :=
   i32_mul x y.
 
-(** [no_nested_borrows::mix_arith_u32]: forward function
+(** [no_nested_borrows::mix_arith_u32]:
     Source: 'src/no_nested_borrows.rs', lines 112:0-112:51 *)
 Definition mix_arith_u32 (x : u32) (y : u32) (z : u32) : result u32 :=
   i <- u32_add x y;
-  i0 <- u32_div x y;
-  i1 <- u32_mul i i0;
-  i2 <- u32_rem z y;
-  i3 <- u32_sub x i2;
-  i4 <- u32_add i1 i3;
-  i5 <- u32_add x y;
-  i6 <- u32_add i5 z;
-  u32_rem i4 i6
+  i1 <- u32_div x y;
+  i2 <- u32_mul i i1;
+  i3 <- u32_rem z y;
+  i4 <- u32_sub x i3;
+  i5 <- u32_add i2 i4;
+  i6 <- u32_add x y;
+  i7 <- u32_add i6 z;
+  u32_rem i5 i7
 .
 
-(** [no_nested_borrows::mix_arith_i32]: forward function
+(** [no_nested_borrows::mix_arith_i32]:
     Source: 'src/no_nested_borrows.rs', lines 116:0-116:51 *)
 Definition mix_arith_i32 (x : i32) (y : i32) (z : i32) : result i32 :=
   i <- i32_add x y;
-  i0 <- i32_div x y;
-  i1 <- i32_mul i i0;
-  i2 <- i32_rem z y;
-  i3 <- i32_sub x i2;
-  i4 <- i32_add i1 i3;
-  i5 <- i32_add x y;
-  i6 <- i32_add i5 z;
-  i32_rem i4 i6
+  i1 <- i32_div x y;
+  i2 <- i32_mul i i1;
+  i3 <- i32_rem z y;
+  i4 <- i32_sub x i3;
+  i5 <- i32_add i2 i4;
+  i6 <- i32_add x y;
+  i7 <- i32_add i6 z;
+  i32_rem i5 i7
 .
 
 (** [no_nested_borrows::CONST0]
@@ -157,22 +157,22 @@ Definition const0_c : usize := const0_body%global.
 Definition const1_body : result usize := usize_mul 2%usize 2%usize.
 Definition const1_c : usize := const1_body%global.
 
-(** [no_nested_borrows::cast_u32_to_i32]: forward function
+(** [no_nested_borrows::cast_u32_to_i32]:
     Source: 'src/no_nested_borrows.rs', lines 128:0-128:37 *)
 Definition cast_u32_to_i32 (x : u32) : result i32 :=
   scalar_cast U32 I32 x.
 
-(** [no_nested_borrows::cast_bool_to_i32]: forward function
+(** [no_nested_borrows::cast_bool_to_i32]:
     Source: 'src/no_nested_borrows.rs', lines 132:0-132:39 *)
 Definition cast_bool_to_i32 (x : bool) : result i32 :=
   scalar_cast_bool I32 x.
 
-(** [no_nested_borrows::cast_bool_to_bool]: forward function
+(** [no_nested_borrows::cast_bool_to_bool]:
     Source: 'src/no_nested_borrows.rs', lines 137:0-137:41 *)
 Definition cast_bool_to_bool (x : bool) : result bool :=
   Return x.
 
-(** [no_nested_borrows::test2]: forward function
+(** [no_nested_borrows::test2]:
     Source: 'src/no_nested_borrows.rs', lines 142:0-142:14 *)
 Definition test2 : result unit :=
   _ <- u32_add 23%u32 44%u32; Return tt.
@@ -180,13 +180,13 @@ Definition test2 : result unit :=
 (** Unit test for [no_nested_borrows::test2] *)
 Check (test2 )%return.
 
-(** [no_nested_borrows::get_max]: forward function
+(** [no_nested_borrows::get_max]:
     Source: 'src/no_nested_borrows.rs', lines 154:0-154:37 *)
 Definition get_max (x : u32) (y : u32) : result u32 :=
   if x s>= y then Return x else Return y
 .
 
-(** [no_nested_borrows::test3]: forward function
+(** [no_nested_borrows::test3]:
     Source: 'src/no_nested_borrows.rs', lines 162:0-162:14 *)
 Definition test3 : result unit :=
   x <- get_max 4%u32 3%u32;
@@ -198,7 +198,7 @@ Definition test3 : result unit :=
 (** Unit test for [no_nested_borrows::test3] *)
 Check (test3 )%return.
 
-(** [no_nested_borrows::test_neg1]: forward function
+(** [no_nested_borrows::test_neg1]:
     Source: 'src/no_nested_borrows.rs', lines 169:0-169:18 *)
 Definition test_neg1 : result unit :=
   y <- i32_neg 3%i32; if negb (y s= (-3)%i32) then Fail_ Failure else Return tt
@@ -207,7 +207,7 @@ Definition test_neg1 : result unit :=
 (** Unit test for [no_nested_borrows::test_neg1] *)
 Check (test_neg1 )%return.
 
-(** [no_nested_borrows::refs_test1]: forward function
+(** [no_nested_borrows::refs_test1]:
     Source: 'src/no_nested_borrows.rs', lines 176:0-176:19 *)
 Definition refs_test1 : result unit :=
   if negb (1%i32 s= 1%i32) then Fail_ Failure else Return tt
@@ -216,7 +216,7 @@ Definition refs_test1 : result unit :=
 (** Unit test for [no_nested_borrows::refs_test1] *)
 Check (refs_test1 )%return.
 
-(** [no_nested_borrows::refs_test2]: forward function
+(** [no_nested_borrows::refs_test2]:
     Source: 'src/no_nested_borrows.rs', lines 187:0-187:19 *)
 Definition refs_test2 : result unit :=
   if negb (2%i32 s= 2%i32)
@@ -233,7 +233,7 @@ Definition refs_test2 : result unit :=
 (** Unit test for [no_nested_borrows::refs_test2] *)
 Check (refs_test2 )%return.
 
-(** [no_nested_borrows::test_list1]: forward function
+(** [no_nested_borrows::test_list1]:
     Source: 'src/no_nested_borrows.rs', lines 203:0-203:19 *)
 Definition test_list1 : result unit :=
   Return tt.
@@ -241,36 +241,38 @@ Definition test_list1 : result unit :=
 (** Unit test for [no_nested_borrows::test_list1] *)
 Check (test_list1 )%return.
 
-(** [no_nested_borrows::test_box1]: forward function
+(** [no_nested_borrows::test_box1]:
     Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 *)
 Definition test_box1 : result unit :=
   let b := 0%i32 in
-  b0 <- alloc_boxed_Box_deref_mut_back i32 b 1%i32;
-  x <- alloc_boxed_Box_deref i32 b0;
+  p <- alloc_boxed_Box_deref_mut i32 b;
+  let (_, deref_mut_back) := p in
+  b1 <- deref_mut_back 1%i32;
+  x <- alloc_boxed_Box_deref i32 b1;
   if negb (x s= 1%i32) then Fail_ Failure else Return tt
 .
 
 (** Unit test for [no_nested_borrows::test_box1] *)
 Check (test_box1 )%return.
 
-(** [no_nested_borrows::copy_int]: forward function
+(** [no_nested_borrows::copy_int]:
     Source: 'src/no_nested_borrows.rs', lines 218:0-218:30 *)
 Definition copy_int (x : i32) : result i32 :=
   Return x.
 
-(** [no_nested_borrows::test_unreachable]: forward function
+(** [no_nested_borrows::test_unreachable]:
     Source: 'src/no_nested_borrows.rs', lines 224:0-224:32 *)
 Definition test_unreachable (b : bool) : result unit :=
   if b then Fail_ Failure else Return tt
 .
 
-(** [no_nested_borrows::test_panic]: forward function
+(** [no_nested_borrows::test_panic]:
     Source: 'src/no_nested_borrows.rs', lines 232:0-232:26 *)
 Definition test_panic (b : bool) : result unit :=
   if b then Fail_ Failure else Return tt
 .
 
-(** [no_nested_borrows::test_copy_int]: forward function
+(** [no_nested_borrows::test_copy_int]:
     Source: 'src/no_nested_borrows.rs', lines 239:0-239:22 *)
 Definition test_copy_int : result unit :=
   y <- copy_int 0%i32; if negb (0%i32 s= y) then Fail_ Failure else Return tt
@@ -279,13 +281,13 @@ Definition test_copy_int : result unit :=
 (** Unit test for [no_nested_borrows::test_copy_int] *)
 Check (test_copy_int )%return.
 
-(** [no_nested_borrows::is_cons]: forward function
+(** [no_nested_borrows::is_cons]:
     Source: 'src/no_nested_borrows.rs', lines 246:0-246:38 *)
 Definition is_cons (T : Type) (l : List_t T) : result bool :=
-  match l with | List_Cons t l0 => Return true | List_Nil => Return false end
+  match l with | List_Cons _ _ => Return true | List_Nil => Return false end
 .
 
-(** [no_nested_borrows::test_is_cons]: forward function
+(** [no_nested_borrows::test_is_cons]:
     Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 *)
 Definition test_is_cons : result unit :=
   let l := List_Nil in
@@ -296,7 +298,7 @@ Definition test_is_cons : result unit :=
 (** Unit test for [no_nested_borrows::test_is_cons] *)
 Check (test_is_cons )%return.
 
-(** [no_nested_borrows::split_list]: forward function
+(** [no_nested_borrows::split_list]:
     Source: 'src/no_nested_borrows.rs', lines 259:0-259:48 *)
 Definition split_list (T : Type) (l : List_t T) : result (T * (List_t T)) :=
   match l with
@@ -305,7 +307,7 @@ Definition split_list (T : Type) (l : List_t T) : result (T * (List_t T)) :=
   end
 .
 
-(** [no_nested_borrows::test_split_list]: forward function
+(** [no_nested_borrows::test_split_list]:
     Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 *)
 Definition test_split_list : result unit :=
   let l := List_Nil in
@@ -317,29 +319,26 @@ Definition test_split_list : result unit :=
 (** Unit test for [no_nested_borrows::test_split_list] *)
 Check (test_split_list )%return.
 
-(** [no_nested_borrows::choose]: forward function
+(** [no_nested_borrows::choose]:
     Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 *)
-Definition choose (T : Type) (b : bool) (x : T) (y : T) : result T :=
-  if b then Return x else Return y
+Definition choose
+  (T : Type) (b : bool) (x : T) (y : T) : result (T * (T -> result (T * T))) :=
+  if b
+  then let back_'a := fun (ret : T) => Return (ret, y) in Return (x, back_'a)
+  else let back_'a := fun (ret : T) => Return (x, ret) in Return (y, back_'a)
 .
 
-(** [no_nested_borrows::choose]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 274:0-274:70 *)
-Definition choose_back
-  (T : Type) (b : bool) (x : T) (y : T) (ret : T) : result (T * T) :=
-  if b then Return (ret, y) else Return (x, ret)
-.
-
-(** [no_nested_borrows::choose_test]: forward function
+(** [no_nested_borrows::choose_test]:
     Source: 'src/no_nested_borrows.rs', lines 282:0-282:20 *)
 Definition choose_test : result unit :=
-  z <- choose i32 true 0%i32 0%i32;
-  z0 <- i32_add z 1%i32;
-  if negb (z0 s= 1%i32)
+  p <- choose i32 true 0%i32 0%i32;
+  let (z, choose_back) := p in
+  z1 <- i32_add z 1%i32;
+  if negb (z1 s= 1%i32)
   then Fail_ Failure
   else (
-    p <- choose_back i32 true 0%i32 0%i32 z0;
-    let (x, y) := p in
+    p1 <- choose_back z1;
+    let (x, y) := p1 in
     if negb (x s= 1%i32)
     then Fail_ Failure
     else if negb (y s= 0%i32) then Fail_ Failure else Return tt)
@@ -348,7 +347,7 @@ Definition choose_test : result unit :=
 (** Unit test for [no_nested_borrows::choose_test] *)
 Check (choose_test )%return.
 
-(** [no_nested_borrows::test_char]: forward function
+(** [no_nested_borrows::test_char]:
     Source: 'src/no_nested_borrows.rs', lines 294:0-294:26 *)
 Definition test_char : result char :=
   Return (char_of_byte Coq.Init.Byte.x61).
@@ -372,56 +371,52 @@ Arguments Tree_Node { _ }.
 Arguments NodeElem_Cons { _ }.
 Arguments NodeElem_Nil { _ }.
 
-(** [no_nested_borrows::list_length]: forward function
+(** [no_nested_borrows::list_length]:
     Source: 'src/no_nested_borrows.rs', lines 339:0-339:48 *)
 Fixpoint list_length (T : Type) (l : List_t T) : result u32 :=
   match l with
-  | List_Cons t l1 => i <- list_length T l1; u32_add 1%u32 i
+  | List_Cons _ l1 => i <- list_length T l1; u32_add 1%u32 i
   | List_Nil => Return 0%u32
   end
 .
 
-(** [no_nested_borrows::list_nth_shared]: forward function
+(** [no_nested_borrows::list_nth_shared]:
     Source: 'src/no_nested_borrows.rs', lines 347:0-347:62 *)
 Fixpoint list_nth_shared (T : Type) (l : List_t T) (i : u32) : result T :=
   match l with
   | List_Cons x tl =>
     if i s= 0%u32
     then Return x
-    else (i0 <- u32_sub i 1%u32; list_nth_shared T tl i0)
+    else (i1 <- u32_sub i 1%u32; list_nth_shared T tl i1)
   | List_Nil => Fail_ Failure
   end
 .
 
-(** [no_nested_borrows::list_nth_mut]: forward function
+(** [no_nested_borrows::list_nth_mut]:
     Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 *)
-Fixpoint list_nth_mut (T : Type) (l : List_t T) (i : u32) : result T :=
+Fixpoint list_nth_mut
+  (T : Type) (l : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
+  :=
   match l with
   | List_Cons x tl =>
     if i s= 0%u32
-    then Return x
-    else (i0 <- u32_sub i 1%u32; list_nth_mut T tl i0)
-  | List_Nil => Fail_ Failure
-  end
-.
-
-(** [no_nested_borrows::list_nth_mut]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 363:0-363:67 *)
-Fixpoint list_nth_mut_back
-  (T : Type) (l : List_t T) (i : u32) (ret : T) : result (List_t T) :=
-  match l with
-  | List_Cons x tl =>
-    if i s= 0%u32
-    then Return (List_Cons ret tl)
+    then
+      let back_'a := fun (ret : T) => Return (List_Cons ret tl) in
+      Return (x, back_'a)
     else (
-      i0 <- u32_sub i 1%u32;
-      tl0 <- list_nth_mut_back T tl i0 ret;
-      Return (List_Cons x tl0))
+      i1 <- u32_sub i 1%u32;
+      p <- list_nth_mut T tl i1;
+      let (t, list_nth_mut_back) := p in
+      let back_'a :=
+        fun (ret : T) => tl1 <- list_nth_mut_back ret; Return (List_Cons x tl1)
+        in
+      Return (t, back_'a))
   | List_Nil => Fail_ Failure
   end
 .
 
-(** [no_nested_borrows::list_rev_aux]: forward function
+(** [no_nested_borrows::list_rev_aux]:
     Source: 'src/no_nested_borrows.rs', lines 379:0-379:63 *)
 Fixpoint list_rev_aux
   (T : Type) (li : List_t T) (lo : List_t T) : result (List_t T) :=
@@ -431,116 +426,97 @@ Fixpoint list_rev_aux
   end
 .
 
-(** [no_nested_borrows::list_rev]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [no_nested_borrows::list_rev]:
     Source: 'src/no_nested_borrows.rs', lines 393:0-393:42 *)
 Definition list_rev (T : Type) (l : List_t T) : result (List_t T) :=
-  let li := core_mem_replace (List_t T) l List_Nil in
+  let (li, _) := core_mem_replace (List_t T) l List_Nil in
   list_rev_aux T li List_Nil
 .
 
-(** [no_nested_borrows::test_list_functions]: forward function
+(** [no_nested_borrows::test_list_functions]:
     Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 *)
 Definition test_list_functions : result unit :=
   let l := List_Nil in
-  let l0 := List_Cons 2%i32 l in
-  let l1 := List_Cons 1%i32 l0 in
-  i <- list_length i32 (List_Cons 0%i32 l1);
+  let l1 := List_Cons 2%i32 l in
+  let l2 := List_Cons 1%i32 l1 in
+  i <- list_length i32 (List_Cons 0%i32 l2);
   if negb (i s= 3%u32)
   then Fail_ Failure
   else (
-    i0 <- list_nth_shared i32 (List_Cons 0%i32 l1) 0%u32;
-    if negb (i0 s= 0%i32)
+    i1 <- list_nth_shared i32 (List_Cons 0%i32 l2) 0%u32;
+    if negb (i1 s= 0%i32)
     then Fail_ Failure
     else (
-      i1 <- list_nth_shared i32 (List_Cons 0%i32 l1) 1%u32;
-      if negb (i1 s= 1%i32)
+      i2 <- list_nth_shared i32 (List_Cons 0%i32 l2) 1%u32;
+      if negb (i2 s= 1%i32)
       then Fail_ Failure
       else (
-        i2 <- list_nth_shared i32 (List_Cons 0%i32 l1) 2%u32;
-        if negb (i2 s= 2%i32)
+        i3 <- list_nth_shared i32 (List_Cons 0%i32 l2) 2%u32;
+        if negb (i3 s= 2%i32)
         then Fail_ Failure
         else (
-          ls <- list_nth_mut_back i32 (List_Cons 0%i32 l1) 1%u32 3%i32;
-          i3 <- list_nth_shared i32 ls 0%u32;
-          if negb (i3 s= 0%i32)
+          p <- list_nth_mut i32 (List_Cons 0%i32 l2) 1%u32;
+          let (_, list_nth_mut_back) := p in
+          ls <- list_nth_mut_back 3%i32;
+          i4 <- list_nth_shared i32 ls 0%u32;
+          if negb (i4 s= 0%i32)
           then Fail_ Failure
           else (
-            i4 <- list_nth_shared i32 ls 1%u32;
-            if negb (i4 s= 3%i32)
+            i5 <- list_nth_shared i32 ls 1%u32;
+            if negb (i5 s= 3%i32)
             then Fail_ Failure
             else (
-              i5 <- list_nth_shared i32 ls 2%u32;
-              if negb (i5 s= 2%i32) then Fail_ Failure else Return tt))))))
+              i6 <- list_nth_shared i32 ls 2%u32;
+              if negb (i6 s= 2%i32) then Fail_ Failure else Return tt))))))
 .
 
 (** Unit test for [no_nested_borrows::test_list_functions] *)
 Check (test_list_functions )%return.
 
-(** [no_nested_borrows::id_mut_pair1]: forward function
+(** [no_nested_borrows::id_mut_pair1]:
     Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 *)
-Definition id_mut_pair1 (T1 T2 : Type) (x : T1) (y : T2) : result (T1 * T2) :=
-  Return (x, y)
-.
-
-(** [no_nested_borrows::id_mut_pair1]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 414:0-414:89 *)
-Definition id_mut_pair1_back
-  (T1 T2 : Type) (x : T1) (y : T2) (ret : (T1 * T2)) : result (T1 * T2) :=
-  let (t, t0) := ret in Return (t, t0)
-.
-
-(** [no_nested_borrows::id_mut_pair2]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 *)
-Definition id_mut_pair2 (T1 T2 : Type) (p : (T1 * T2)) : result (T1 * T2) :=
-  let (t, t0) := p in Return (t, t0)
+Definition id_mut_pair1
+  (T1 T2 : Type) (x : T1) (y : T2) :
+  result ((T1 * T2) * ((T1 * T2) -> result (T1 * T2)))
+  :=
+  let back_'a := fun (ret : (T1 * T2)) => let (t, t1) := ret in Return (t, t1)
+    in
+  Return ((x, y), back_'a)
 .
 
-(** [no_nested_borrows::id_mut_pair2]: backward function 0
+(** [no_nested_borrows::id_mut_pair2]:
     Source: 'src/no_nested_borrows.rs', lines 418:0-418:88 *)
-Definition id_mut_pair2_back
-  (T1 T2 : Type) (p : (T1 * T2)) (ret : (T1 * T2)) : result (T1 * T2) :=
-  let (t, t0) := ret in Return (t, t0)
+Definition id_mut_pair2
+  (T1 T2 : Type) (p : (T1 * T2)) :
+  result ((T1 * T2) * ((T1 * T2) -> result (T1 * T2)))
+  :=
+  let (t, t1) := p in
+  let back_'a :=
+    fun (ret : (T1 * T2)) => let (t2, t3) := ret in Return (t2, t3) in
+  Return ((t, t1), back_'a)
 .
 
-(** [no_nested_borrows::id_mut_pair3]: forward function
+(** [no_nested_borrows::id_mut_pair3]:
     Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
-Definition id_mut_pair3 (T1 T2 : Type) (x : T1) (y : T2) : result (T1 * T2) :=
-  Return (x, y)
-.
-
-(** [no_nested_borrows::id_mut_pair3]: backward function 0
-    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
-Definition id_mut_pair3_back'a
-  (T1 T2 : Type) (x : T1) (y : T2) (ret : T1) : result T1 :=
-  Return ret
-.
-
-(** [no_nested_borrows::id_mut_pair3]: backward function 1
-    Source: 'src/no_nested_borrows.rs', lines 422:0-422:93 *)
-Definition id_mut_pair3_back'b
-  (T1 T2 : Type) (x : T1) (y : T2) (ret : T2) : result T2 :=
-  Return ret
-.
-
-(** [no_nested_borrows::id_mut_pair4]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
-Definition id_mut_pair4 (T1 T2 : Type) (p : (T1 * T2)) : result (T1 * T2) :=
-  let (t, t0) := p in Return (t, t0)
+Definition id_mut_pair3
+  (T1 T2 : Type) (x : T1) (y : T2) :
+  result ((T1 * T2) * (T1 -> result T1) * (T2 -> result T2))
+  :=
+  let back_'a := fun (ret : T1) => Return ret in
+  let back_'b := fun (ret : T2) => Return ret in
+  Return ((x, y), back_'a, back_'b)
 .
 
-(** [no_nested_borrows::id_mut_pair4]: backward function 0
+(** [no_nested_borrows::id_mut_pair4]:
     Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
-Definition id_mut_pair4_back'a
-  (T1 T2 : Type) (p : (T1 * T2)) (ret : T1) : result T1 :=
-  Return ret
-.
-
-(** [no_nested_borrows::id_mut_pair4]: backward function 1
-    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
-Definition id_mut_pair4_back'b
-  (T1 T2 : Type) (p : (T1 * T2)) (ret : T2) : result T2 :=
-  Return ret
+Definition id_mut_pair4
+  (T1 T2 : Type) (p : (T1 * T2)) :
+  result ((T1 * T2) * (T1 -> result T1) * (T2 -> result T2))
+  :=
+  let (t, t1) := p in
+  let back_'a := fun (ret : T1) => Return ret in
+  let back_'b := fun (ret : T2) => Return ret in
+  Return ((t, t1), back_'a, back_'b)
 .
 
 (** [no_nested_borrows::StructWithTuple]
@@ -554,19 +530,19 @@ mkStructWithTuple_t {
 Arguments mkStructWithTuple_t { _ _ }.
 Arguments structWithTuple_p { _ _ }.
 
-(** [no_nested_borrows::new_tuple1]: forward function
+(** [no_nested_borrows::new_tuple1]:
     Source: 'src/no_nested_borrows.rs', lines 437:0-437:48 *)
 Definition new_tuple1 : result (StructWithTuple_t u32 u32) :=
   Return {| structWithTuple_p := (1%u32, 2%u32) |}
 .
 
-(** [no_nested_borrows::new_tuple2]: forward function
+(** [no_nested_borrows::new_tuple2]:
     Source: 'src/no_nested_borrows.rs', lines 441:0-441:48 *)
 Definition new_tuple2 : result (StructWithTuple_t i16 i16) :=
   Return {| structWithTuple_p := (1%i16, 2%i16) |}
 .
 
-(** [no_nested_borrows::new_tuple3]: forward function
+(** [no_nested_borrows::new_tuple3]:
     Source: 'src/no_nested_borrows.rs', lines 445:0-445:48 *)
 Definition new_tuple3 : result (StructWithTuple_t u64 i64) :=
   Return {| structWithTuple_p := (1%u64, 2%i64) |}
@@ -583,13 +559,13 @@ mkStructWithPair_t {
 Arguments mkStructWithPair_t { _ _ }.
 Arguments structWithPair_p { _ _ }.
 
-(** [no_nested_borrows::new_pair1]: forward function
+(** [no_nested_borrows::new_pair1]:
     Source: 'src/no_nested_borrows.rs', lines 454:0-454:46 *)
 Definition new_pair1 : result (StructWithPair_t u32 u32) :=
   Return {| structWithPair_p := {| pair_x := 1%u32; pair_y := 2%u32 |} |}
 .
 
-(** [no_nested_borrows::test_constants]: forward function
+(** [no_nested_borrows::test_constants]:
     Source: 'src/no_nested_borrows.rs', lines 462:0-462:23 *)
 Definition test_constants : result unit :=
   swt <- new_tuple1;
@@ -597,14 +573,14 @@ Definition test_constants : result unit :=
   if negb (i s= 1%u32)
   then Fail_ Failure
   else (
-    swt0 <- new_tuple2;
-    let (i0, _) := swt0.(structWithTuple_p) in
-    if negb (i0 s= 1%i16)
+    swt1 <- new_tuple2;
+    let (i1, _) := swt1.(structWithTuple_p) in
+    if negb (i1 s= 1%i16)
     then Fail_ Failure
     else (
-      swt1 <- new_tuple3;
-      let (i1, _) := swt1.(structWithTuple_p) in
-      if negb (i1 s= 1%u64)
+      swt2 <- new_tuple3;
+      let (i2, _) := swt2.(structWithTuple_p) in
+      if negb (i2 s= 1%u64)
       then Fail_ Failure
       else (
         swp <- new_pair1;
@@ -616,7 +592,7 @@ Definition test_constants : result unit :=
 (** Unit test for [no_nested_borrows::test_constants] *)
 Check (test_constants )%return.
 
-(** [no_nested_borrows::test_weird_borrows1]: forward function
+(** [no_nested_borrows::test_weird_borrows1]:
     Source: 'src/no_nested_borrows.rs', lines 471:0-471:28 *)
 Definition test_weird_borrows1 : result unit :=
   Return tt.
@@ -624,65 +600,79 @@ Definition test_weird_borrows1 : result unit :=
 (** Unit test for [no_nested_borrows::test_weird_borrows1] *)
 Check (test_weird_borrows1 )%return.
 
-(** [no_nested_borrows::test_mem_replace]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [no_nested_borrows::test_mem_replace]:
     Source: 'src/no_nested_borrows.rs', lines 481:0-481:37 *)
 Definition test_mem_replace (px : u32) : result u32 :=
-  let y := core_mem_replace u32 px 1%u32 in
+  let (y, _) := core_mem_replace u32 px 1%u32 in
   if negb (y s= 0%u32) then Fail_ Failure else Return 2%u32
 .
 
-(** [no_nested_borrows::test_shared_borrow_bool1]: forward function
+(** [no_nested_borrows::test_shared_borrow_bool1]:
     Source: 'src/no_nested_borrows.rs', lines 488:0-488:47 *)
 Definition test_shared_borrow_bool1 (b : bool) : result u32 :=
   if b then Return 0%u32 else Return 1%u32
 .
 
-(** [no_nested_borrows::test_shared_borrow_bool2]: forward function
+(** [no_nested_borrows::test_shared_borrow_bool2]:
     Source: 'src/no_nested_borrows.rs', lines 501:0-501:40 *)
 Definition test_shared_borrow_bool2 : result u32 :=
   Return 0%u32.
 
-(** [no_nested_borrows::test_shared_borrow_enum1]: forward function
+(** [no_nested_borrows::test_shared_borrow_enum1]:
     Source: 'src/no_nested_borrows.rs', lines 516:0-516:52 *)
 Definition test_shared_borrow_enum1 (l : List_t u32) : result u32 :=
-  match l with | List_Cons i l0 => Return 1%u32 | List_Nil => Return 0%u32 end
+  match l with | List_Cons _ _ => Return 1%u32 | List_Nil => Return 0%u32 end
 .
 
-(** [no_nested_borrows::test_shared_borrow_enum2]: forward function
+(** [no_nested_borrows::test_shared_borrow_enum2]:
     Source: 'src/no_nested_borrows.rs', lines 528:0-528:40 *)
 Definition test_shared_borrow_enum2 : result u32 :=
   Return 0%u32.
 
-(** [no_nested_borrows::Tuple]
+(** [no_nested_borrows::incr]:
     Source: 'src/no_nested_borrows.rs', lines 539:0-539:24 *)
+Definition incr (x : u32) : result u32 :=
+  u32_add x 1%u32.
+
+(** [no_nested_borrows::call_incr]:
+    Source: 'src/no_nested_borrows.rs', lines 543:0-543:35 *)
+Definition call_incr (x : u32) : result u32 :=
+  incr x.
+
+(** [no_nested_borrows::read_then_incr]:
+    Source: 'src/no_nested_borrows.rs', lines 548:0-548:41 *)
+Definition read_then_incr (x : u32) : result (u32 * u32) :=
+  x1 <- u32_add x 1%u32; Return (x, x1)
+.
+
+(** [no_nested_borrows::Tuple]
+    Source: 'src/no_nested_borrows.rs', lines 554:0-554:24 *)
 Definition Tuple_t (T1 T2 : Type) : Type := T1 * T2.
 
-(** [no_nested_borrows::use_tuple_struct]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
-    Source: 'src/no_nested_borrows.rs', lines 541:0-541:48 *)
+(** [no_nested_borrows::use_tuple_struct]:
+    Source: 'src/no_nested_borrows.rs', lines 556:0-556:48 *)
 Definition use_tuple_struct (x : Tuple_t u32 u32) : result (Tuple_t u32 u32) :=
   let (_, i) := x in Return (1%u32, i)
 .
 
-(** [no_nested_borrows::create_tuple_struct]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 545:0-545:61 *)
+(** [no_nested_borrows::create_tuple_struct]:
+    Source: 'src/no_nested_borrows.rs', lines 560:0-560:61 *)
 Definition create_tuple_struct
   (x : u32) (y : u64) : result (Tuple_t u32 u64) :=
   Return (x, y)
 .
 
 (** [no_nested_borrows::IdType]
-    Source: 'src/no_nested_borrows.rs', lines 550:0-550:20 *)
+    Source: 'src/no_nested_borrows.rs', lines 565:0-565:20 *)
 Definition IdType_t (T : Type) : Type := T.
 
-(** [no_nested_borrows::use_id_type]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 552:0-552:40 *)
+(** [no_nested_borrows::use_id_type]:
+    Source: 'src/no_nested_borrows.rs', lines 567:0-567:40 *)
 Definition use_id_type (T : Type) (x : IdType_t T) : result T :=
   Return x.
 
-(** [no_nested_borrows::create_id_type]: forward function
-    Source: 'src/no_nested_borrows.rs', lines 556:0-556:43 *)
+(** [no_nested_borrows::create_id_type]:
+    Source: 'src/no_nested_borrows.rs', lines 571:0-571:43 *)
 Definition create_id_type (T : Type) (x : T) : result (IdType_t T) :=
   Return x.
 
diff --git a/tests/coq/misc/Primitives.v b/tests/coq/misc/Primitives.v
index 84280b96..c0056073 100644
--- a/tests/coq/misc/Primitives.v
+++ b/tests/coq/misc/Primitives.v
@@ -67,8 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a := x .
-Definition core_mem_replace_back (a : Type) (x : a) (y : a) : a := y .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * (a -> a) := (x, fun x => x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -504,13 +503,15 @@ Arguments core_ops_index_Index_index {_ _}.
 (* Trait declaration: [core::ops::index::IndexMut] *)
 Record core_ops_index_IndexMut (Self Idx : Type) := mk_core_ops_index_IndexMut {
   core_ops_index_IndexMut_indexInst : core_ops_index_Index Self Idx;
-  core_ops_index_IndexMut_index_mut : Self -> Idx -> result core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output);
-  core_ops_index_IndexMut_index_mut_back : Self -> Idx -> core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self;
+  core_ops_index_IndexMut_index_mut :
+    Self ->
+    Idx ->
+    result (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) *
+            (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self));
 }.
 Arguments mk_core_ops_index_IndexMut {_ _}.
 Arguments core_ops_index_IndexMut_indexInst {_ _}.
 Arguments core_ops_index_IndexMut_index_mut {_ _}.
-Arguments core_ops_index_IndexMut_index_mut_back {_ _}.
 
 (* Trait declaration [core::ops::deref::Deref] *)
 Record core_ops_deref_Deref (Self : Type) := mk_core_ops_deref_Deref {
@@ -524,13 +525,14 @@ Arguments core_ops_deref_Deref_deref {_}.
 (* Trait declaration [core::ops::deref::DerefMut] *)
 Record core_ops_deref_DerefMut (Self : Type) := mk_core_ops_deref_DerefMut {
   core_ops_deref_DerefMut_derefInst : core_ops_deref_Deref Self;
-  core_ops_deref_DerefMut_deref_mut : Self -> result core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target);
-  core_ops_deref_DerefMut_deref_mut_back : Self -> core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self;
+  core_ops_deref_DerefMut_deref_mut :
+    Self ->
+    result (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) *
+            (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self));
 }.
 Arguments mk_core_ops_deref_DerefMut {_}.
 Arguments core_ops_deref_DerefMut_derefInst {_}.
 Arguments core_ops_deref_DerefMut_deref_mut {_}.
-Arguments core_ops_deref_DerefMut_deref_mut_back {_}.
 
 Record core_ops_range_Range (T : Type) := mk_core_ops_range_Range {
   core_ops_range_Range_start : T;
@@ -543,8 +545,8 @@ Arguments core_ops_range_Range_end_ {_}.
 (*** [alloc] *)
 
 Definition alloc_boxed_Box_deref (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut_back (T : Type) (_ : T) (x : T) : result T := Return x.
+Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result (T * (T -> result T)) :=
+  Return (x, fun x => Return x).
 
 (* Trait instance *)
 Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref Self := {|
@@ -556,7 +558,6 @@ Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref
 Definition alloc_boxed_Box_coreopsDerefMutInst (Self : Type) : core_ops_deref_DerefMut Self := {|
   core_ops_deref_DerefMut_derefInst := alloc_boxed_Box_coreopsDerefInst Self;
   core_ops_deref_DerefMut_deref_mut := alloc_boxed_Box_deref_mut Self;
-  core_ops_deref_DerefMut_deref_mut_back := alloc_boxed_Box_deref_mut_back Self;
 |}.
 
 
@@ -639,16 +640,9 @@ Definition alloc_vec_Vec_bind {A B} (v: alloc_vec_Vec A) (f: list A -> result (l
   | right _ => Fail_ Failure
   end.
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_push_fwd (T: Type) (v: alloc_vec_Vec T) (x: T) : unit := tt.
-
 Definition alloc_vec_Vec_push (T: Type) (v: alloc_vec_Vec T) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l => Return (l ++ [x])).
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_insert_fwd (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result unit :=
-  if to_Z i <? alloc_vec_Vec_length v then Return tt else Fail_ Failure.
-
 Definition alloc_vec_Vec_insert (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l =>
     if to_Z i <? Z.of_nat (length l)
@@ -661,6 +655,14 @@ Axiom alloc_vec_Vec_index_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : u
 (* Helper *)
 Axiom alloc_vec_Vec_update_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : usize) (x : T), result (alloc_vec_Vec T).
 
+Definition alloc_vec_Vec_index_mut_usize {T : Type} (v: alloc_vec_Vec T) (i: usize) :
+  result (T * (T -> result (alloc_vec_Vec T))) :=
+  match alloc_vec_Vec_index_usize v i with
+  | Return x =>
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail_ e => Fail_ e
+  end.
+
 (* Trait declaration: [core::slice::index::private_slice_index::Sealed] *)
 Definition core_slice_index_private_slice_index_Sealed (self : Type) := unit.
 
@@ -669,25 +671,23 @@ Record core_slice_index_SliceIndex (Self T : Type) := mk_core_slice_index_SliceI
   core_slice_index_SliceIndex_sealedInst : core_slice_index_private_slice_index_Sealed Self;
   core_slice_index_SliceIndex_Output : Type;
   core_slice_index_SliceIndex_get : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut_back : Self -> T -> option core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_get_mut :
+    Self -> T -> result (option core_slice_index_SliceIndex_Output * (option core_slice_index_SliceIndex_Output -> result T));
   core_slice_index_SliceIndex_get_unchecked : Self -> const_raw_ptr T -> result (const_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_get_unchecked_mut : Self -> mut_raw_ptr T -> result (mut_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_index : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut_back : Self -> T -> core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_index_mut :
+    Self -> T -> result (core_slice_index_SliceIndex_Output * (core_slice_index_SliceIndex_Output -> result T));
 }.
 Arguments mk_core_slice_index_SliceIndex {_ _}.
 Arguments core_slice_index_SliceIndex_sealedInst {_ _}.
 Arguments core_slice_index_SliceIndex_Output {_ _}.
 Arguments core_slice_index_SliceIndex_get {_ _}.
 Arguments core_slice_index_SliceIndex_get_mut {_ _}.
-Arguments core_slice_index_SliceIndex_get_mut_back {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked_mut {_ _}.
 Arguments core_slice_index_SliceIndex_index {_ _}.
 Arguments core_slice_index_SliceIndex_index_mut {_ _}.
-Arguments core_slice_index_SliceIndex_index_mut_back {_ _}.
 
 (* [core::slice::index::[T]::index]: forward function *)
 Definition core_slice_index_Slice_index
@@ -704,11 +704,9 @@ Axiom core_slice_index_RangeUsize_get : forall (T : Type) (i : core_ops_range_Ra
 
 (* [core::slice::index::Range::get_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_get_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (option (slice T)).
-
-(* [core::slice::index::Range::get_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_get_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> option (slice T) -> result (slice T).
+  forall (T : Type),
+    core_ops_range_Range usize -> slice T ->
+    result (option (slice T) * (option (slice T) -> result (slice T))).
 
 (* [core::slice::index::Range::get_unchecked]: forward function *)
 Definition core_slice_index_RangeUsize_get_unchecked
@@ -732,21 +730,14 @@ Axiom core_slice_index_RangeUsize_index :
 
 (* [core::slice::index::Range::index_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_index_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T).
-
-(* [core::slice::index::Range::index_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_index_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> slice T -> result (slice T).
+  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T * (slice T -> result (slice T))).
 
 (* [core::slice::index::[T]::index_mut]: forward function *)
 Axiom core_slice_index_Slice_index_mut :
   forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> result inst.(core_slice_index_SliceIndex_Output).
-
-(* [core::slice::index::[T]::index_mut]: backward function 0 *)
-Axiom core_slice_index_Slice_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> inst.(core_slice_index_SliceIndex_Output) -> result (slice T).
+  slice T -> Idx ->
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (slice T))).
 
 (* [core::array::[T; N]::index]: forward function *)
 Axiom core_array_Array_index :
@@ -756,12 +747,9 @@ Axiom core_array_Array_index :
 (* [core::array::[T; N]::index_mut]: forward function *)
 Axiom core_array_Array_index_mut :
   forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx), result inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output).
-
-(* [core::array::[T; N]::index_mut]: backward function 0 *)
-Axiom core_array_Array_index_mut_back :
-  forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx) (x : inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output)), result (array T N).
+  (a : array T N) (i : Idx),
+  result (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) *
+          (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) -> result (array T N))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::Range] *)
 Definition core_slice_index_private_slice_index_SealedRangeUsizeInst
@@ -774,12 +762,10 @@ Definition core_slice_index_SliceIndexRangeUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := slice T;
   core_slice_index_SliceIndex_get := core_slice_index_RangeUsize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_RangeUsize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_RangeUsize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_RangeUsize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_RangeUsize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_RangeUsize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_RangeUsize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_RangeUsize_index_mut_back T;
 |}.
 
 (* Trait implementation: [core::slice::index::[T]] *)
@@ -796,7 +782,6 @@ Definition core_ops_index_IndexMutSliceTIInst (T Idx : Type)
   core_ops_index_IndexMut (slice T) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexSliceTIInst T Idx inst;
   core_ops_index_IndexMut_index_mut := core_slice_index_Slice_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := core_slice_index_Slice_index_mut_back T Idx inst;
 |}.
 
 (* Trait implementation: [core::array::[T; N]] *)
@@ -813,18 +798,14 @@ Definition core_ops_index_IndexMutArrayInst (T Idx : Type) (N : usize)
   core_ops_index_IndexMut (array T N) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexArrayInst T Idx N inst.(core_ops_index_IndexMut_indexInst);
   core_ops_index_IndexMut_index_mut := core_array_Array_index_mut T Idx N inst;
-  core_ops_index_IndexMut_index_mut_back := core_array_Array_index_mut_back T Idx N inst;
 |}.
 
 (* [core::slice::index::usize::get]: forward function *)
 Axiom core_slice_index_usize_get : forall (T : Type), usize -> slice T -> result (option T).
 
 (* [core::slice::index::usize::get_mut]: forward function *)
-Axiom core_slice_index_usize_get_mut : forall (T : Type), usize -> slice T -> result (option T).
-
-(* [core::slice::index::usize::get_mut]: backward function 0 *)
-Axiom core_slice_index_usize_get_mut_back :
-  forall (T : Type), usize -> slice T -> option T -> result (slice T).
+Axiom core_slice_index_usize_get_mut :
+  forall (T : Type), usize -> slice T -> result (option T * (option T -> result (slice T))).
 
 (* [core::slice::index::usize::get_unchecked]: forward function *)
 Axiom core_slice_index_usize_get_unchecked :
@@ -838,11 +819,8 @@ Axiom core_slice_index_usize_get_unchecked_mut :
 Axiom core_slice_index_usize_index : forall (T : Type), usize -> slice T -> result T.
 
 (* [core::slice::index::usize::index_mut]: forward function *)
-Axiom core_slice_index_usize_index_mut : forall (T : Type), usize -> slice T -> result T.
-
-(* [core::slice::index::usize::index_mut]: backward function 0 *)
-Axiom core_slice_index_usize_index_mut_back :
-  forall (T : Type), usize -> slice T -> T -> result (slice T).
+Axiom core_slice_index_usize_index_mut :
+  forall (T : Type), usize -> slice T -> result (T * (T -> result (slice T))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::usize] *)
 Definition core_slice_index_private_slice_index_SealedUsizeInst
@@ -855,12 +833,10 @@ Definition core_slice_index_SliceIndexUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := T;
   core_slice_index_SliceIndex_get := core_slice_index_usize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_usize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_usize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_usize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_usize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_usize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_usize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_usize_index_mut_back T;
 |}.
 
 (* [alloc::vec::Vec::index]: forward function *)
@@ -869,12 +845,9 @@ Axiom alloc_vec_Vec_index : forall (T Idx : Type) (inst : core_slice_index_Slice
 
 (* [alloc::vec::Vec::index_mut]: forward function *)
 Axiom alloc_vec_Vec_index_mut : forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx), result inst.(core_slice_index_SliceIndex_Output).
-
-(* [alloc::vec::Vec::index_mut]: backward function 0 *)
-Axiom alloc_vec_Vec_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx) (x : inst.(core_slice_index_SliceIndex_Output)), result (alloc_vec_Vec T).
+  (Self : alloc_vec_Vec T) (i : Idx),
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (alloc_vec_Vec T))).
 
 (* Trait implementation: [alloc::vec::Vec] *)
 Definition alloc_vec_Vec_coreopsindexIndexInst (T Idx : Type)
@@ -890,7 +863,6 @@ Definition alloc_vec_Vec_coreopsindexIndexMutInst (T Idx : Type)
   core_ops_index_IndexMut (alloc_vec_Vec T) Idx := {|
   core_ops_index_IndexMut_indexInst := alloc_vec_Vec_coreopsindexIndexInst T Idx inst;
   core_ops_index_IndexMut_index_mut := alloc_vec_Vec_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := alloc_vec_Vec_index_mut_back T Idx inst;
 |}.
 
 (*** Theorems *)
@@ -901,10 +873,6 @@ Axiom alloc_vec_Vec_index_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usiz
 
 Axiom alloc_vec_Vec_index_mut_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
   alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i =
-    alloc_vec_Vec_index_usize v i.
-
-Axiom alloc_vec_Vec_index_mut_back_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
-  alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x =
-    alloc_vec_Vec_update_usize v i x.
+    alloc_vec_Vec_index_mut_usize v i.
 
 End Primitives.
-- 
cgit v1.2.3


From a0c58326c43a7a8026b3d4c158017bf126180e90 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 22 Dec 2023 23:23:30 +0100
Subject: Regenerate the test files and add the fstar-split tests

---
 tests/coq/array/Array.v                            |  421 ++-
 tests/coq/array/Primitives.v                       |  137 +-
 tests/coq/betree/BetreeMain_Funs.v                 | 1052 +++----
 .../coq/betree/BetreeMain_FunsExternal_Template.v  |   10 +-
 tests/coq/betree/BetreeMain_Types.v                |   16 +-
 tests/coq/betree/Primitives.v                      |  137 +-
 tests/coq/hashmap/Hashmap_Funs.v                   |  503 ++-
 tests/coq/hashmap/Primitives.v                     |  137 +-
 tests/coq/hashmap_on_disk/HashmapMain_Funs.v       |  522 ++--
 .../HashmapMain_FunsExternal_Template.v            |    4 +-
 tests/coq/hashmap_on_disk/Primitives.v             |  137 +-
 tests/coq/misc/Bitwise.v                           |   10 +-
 tests/coq/misc/Constants.v                         |   18 +-
 tests/coq/misc/External_Funs.v                     |   95 +-
 tests/coq/misc/External_FunsExternal_Template.v    |   20 +-
 tests/coq/misc/Loops.v                             |  729 ++---
 tests/coq/misc/Paper.v                             |  100 +-
 tests/coq/misc/PoloniusList.v                      |   34 +-
 tests/coq/misc/Primitives.v                        |   23 +-
 tests/coq/misc/_CoqProject                         |    2 +-
 tests/coq/traits/Primitives.v                      |  137 +-
 tests/coq/traits/Traits.v                          |  153 +-
 tests/fstar-split/array/Array.Clauses.Template.fst |   21 +
 tests/fstar-split/array/Array.Clauses.fst          |   19 +
 tests/fstar-split/array/Array.Funs.fst             |  445 +++
 tests/fstar-split/array/Array.Types.fst            |   11 +
 tests/fstar-split/array/Makefile                   |   49 +
 tests/fstar-split/array/Primitives.fst             |  884 ++++++
 .../betree/BetreeMain.Clauses.Template.fst         |  117 +
 tests/fstar-split/betree/BetreeMain.Clauses.fst    |  210 ++
 tests/fstar-split/betree/BetreeMain.Funs.fst       | 1011 +++++++
 .../betree/BetreeMain.FunsExternal.fsti            |   35 +
 tests/fstar-split/betree/BetreeMain.Types.fst      |   61 +
 .../betree/BetreeMain.TypesExternal.fsti           |   10 +
 tests/fstar-split/betree/Makefile                  |   49 +
 tests/fstar-split/betree/Primitives.fst            |  884 ++++++
 .../hashmap/Hashmap.Clauses.Template.fst           |   71 +
 tests/fstar-split/hashmap/Hashmap.Clauses.fst      |   61 +
 tests/fstar-split/hashmap/Hashmap.Funs.fst         |  529 ++++
 tests/fstar-split/hashmap/Hashmap.Properties.fst   | 3186 ++++++++++++++++++++
 tests/fstar-split/hashmap/Hashmap.Properties.fsti  |  267 ++
 tests/fstar-split/hashmap/Hashmap.Types.fst        |   23 +
 tests/fstar-split/hashmap/Makefile                 |   49 +
 tests/fstar-split/hashmap/Primitives.fst           |  884 ++++++
 .../HashmapMain.Clauses.Template.fst               |   72 +
 .../hashmap_on_disk/HashmapMain.Clauses.fst        |   61 +
 .../hashmap_on_disk/HashmapMain.Funs.fst           |  576 ++++
 .../hashmap_on_disk/HashmapMain.FunsExternal.fsti  |   18 +
 .../hashmap_on_disk/HashmapMain.Properties.fst     |   48 +
 .../hashmap_on_disk/HashmapMain.Types.fst          |   24 +
 .../hashmap_on_disk/HashmapMain.TypesExternal.fsti |   10 +
 tests/fstar-split/hashmap_on_disk/Makefile         |   49 +
 tests/fstar-split/hashmap_on_disk/Primitives.fst   |  884 ++++++
 tests/fstar-split/misc/Bitwise.fst                 |   32 +
 tests/fstar-split/misc/Constants.fst               |  145 +
 tests/fstar-split/misc/External.Funs.fst           |   84 +
 tests/fstar-split/misc/External.FunsExternal.fsti  |   32 +
 tests/fstar-split/misc/External.Types.fst          |    8 +
 tests/fstar-split/misc/External.TypesExternal.fsti |   14 +
 tests/fstar-split/misc/Loops.Clauses.Template.fst  |  131 +
 tests/fstar-split/misc/Loops.Clauses.fst           |  107 +
 tests/fstar-split/misc/Loops.Funs.fst              |  734 +++++
 tests/fstar-split/misc/Loops.Types.fst             |   13 +
 tests/fstar-split/misc/Paper.fst                   |  110 +
 tests/fstar-split/misc/PoloniusList.fst            |   34 +
 tests/fstar-split/traits/Makefile                  |   49 +
 tests/fstar-split/traits/Primitives.fst            |  884 ++++++
 tests/fstar-split/traits/Traits.fst                |  476 +++
 tests/fstar/array/Array.Clauses.Template.fst       |    4 +-
 tests/fstar/array/Array.Funs.fst                   |  389 ++-
 tests/fstar/array/Primitives.fst                   |  132 +-
 tests/fstar/betree/BetreeMain.Funs.fst             |  845 ++----
 tests/fstar/betree/BetreeMain.FunsExternal.fsti    |   10 +-
 tests/fstar/betree/Primitives.fst                  |  132 +-
 .../fstar/betree_back_stateful/BetreeMain.Funs.fst | 1043 ++-----
 .../BetreeMain.FunsExternal.fsti                   |   10 +-
 tests/fstar/betree_back_stateful/Primitives.fst    |  132 +-
 tests/fstar/hashmap/Hashmap.Funs.fst               |  411 +--
 tests/fstar/hashmap/Hashmap.Properties.fst         | 3186 --------------------
 tests/fstar/hashmap/Hashmap.Properties.fsti        |  267 --
 tests/fstar/hashmap/Primitives.fst                 |  132 +-
 tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst   |  432 +--
 .../hashmap_on_disk/HashmapMain.FunsExternal.fsti  |    4 +-
 tests/fstar/hashmap_on_disk/Primitives.fst         |  132 +-
 tests/fstar/misc/Bitwise.fst                       |   10 +-
 tests/fstar/misc/Constants.fst                     |   18 +-
 tests/fstar/misc/External.Funs.fst                 |   76 +-
 tests/fstar/misc/External.FunsExternal.fsti        |   18 +-
 tests/fstar/misc/Loops.Funs.fst                    |  602 ++--
 tests/fstar/misc/Paper.fst                         |   87 +-
 tests/fstar/misc/PoloniusList.fst                  |   30 +-
 tests/fstar/misc/Primitives.fst                    |   23 +-
 tests/fstar/traits/Primitives.fst                  |  132 +-
 tests/fstar/traits/Traits.fst                      |  142 +-
 tests/lean/Array.lean                              |  503 ++-
 tests/lean/BetreeMain/Funs.lean                    | 1158 +++----
 tests/lean/BetreeMain/FunsExternal_Template.lean   |   10 +-
 tests/lean/Bitwise.lean                            |   18 +-
 tests/lean/Constants.lean                          |   22 +-
 tests/lean/External/Funs.lean                      |   89 +-
 tests/lean/External/FunsExternal_Template.lean     |   19 +-
 tests/lean/Hashmap/Funs.lean                       |  582 ++--
 tests/lean/HashmapMain/Funs.lean                   |  603 ++--
 tests/lean/HashmapMain/FunsExternal_Template.lean  |    4 +-
 tests/lean/Loops.lean                              |  661 ++--
 tests/lean/Paper.lean                              |  131 +-
 tests/lean/PoloniusList.lean                       |   35 +-
 tests/lean/Traits.lean                             |  161 +-
 108 files changed, 18545 insertions(+), 11718 deletions(-)
 create mode 100644 tests/fstar-split/array/Array.Clauses.Template.fst
 create mode 100644 tests/fstar-split/array/Array.Clauses.fst
 create mode 100644 tests/fstar-split/array/Array.Funs.fst
 create mode 100644 tests/fstar-split/array/Array.Types.fst
 create mode 100644 tests/fstar-split/array/Makefile
 create mode 100644 tests/fstar-split/array/Primitives.fst
 create mode 100644 tests/fstar-split/betree/BetreeMain.Clauses.Template.fst
 create mode 100644 tests/fstar-split/betree/BetreeMain.Clauses.fst
 create mode 100644 tests/fstar-split/betree/BetreeMain.Funs.fst
 create mode 100644 tests/fstar-split/betree/BetreeMain.FunsExternal.fsti
 create mode 100644 tests/fstar-split/betree/BetreeMain.Types.fst
 create mode 100644 tests/fstar-split/betree/BetreeMain.TypesExternal.fsti
 create mode 100644 tests/fstar-split/betree/Makefile
 create mode 100644 tests/fstar-split/betree/Primitives.fst
 create mode 100644 tests/fstar-split/hashmap/Hashmap.Clauses.Template.fst
 create mode 100644 tests/fstar-split/hashmap/Hashmap.Clauses.fst
 create mode 100644 tests/fstar-split/hashmap/Hashmap.Funs.fst
 create mode 100644 tests/fstar-split/hashmap/Hashmap.Properties.fst
 create mode 100644 tests/fstar-split/hashmap/Hashmap.Properties.fsti
 create mode 100644 tests/fstar-split/hashmap/Hashmap.Types.fst
 create mode 100644 tests/fstar-split/hashmap/Makefile
 create mode 100644 tests/fstar-split/hashmap/Primitives.fst
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.Template.fst
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.fst
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.FunsExternal.fsti
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.Properties.fst
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.Types.fst
 create mode 100644 tests/fstar-split/hashmap_on_disk/HashmapMain.TypesExternal.fsti
 create mode 100644 tests/fstar-split/hashmap_on_disk/Makefile
 create mode 100644 tests/fstar-split/hashmap_on_disk/Primitives.fst
 create mode 100644 tests/fstar-split/misc/Bitwise.fst
 create mode 100644 tests/fstar-split/misc/Constants.fst
 create mode 100644 tests/fstar-split/misc/External.Funs.fst
 create mode 100644 tests/fstar-split/misc/External.FunsExternal.fsti
 create mode 100644 tests/fstar-split/misc/External.Types.fst
 create mode 100644 tests/fstar-split/misc/External.TypesExternal.fsti
 create mode 100644 tests/fstar-split/misc/Loops.Clauses.Template.fst
 create mode 100644 tests/fstar-split/misc/Loops.Clauses.fst
 create mode 100644 tests/fstar-split/misc/Loops.Funs.fst
 create mode 100644 tests/fstar-split/misc/Loops.Types.fst
 create mode 100644 tests/fstar-split/misc/Paper.fst
 create mode 100644 tests/fstar-split/misc/PoloniusList.fst
 create mode 100644 tests/fstar-split/traits/Makefile
 create mode 100644 tests/fstar-split/traits/Primitives.fst
 create mode 100644 tests/fstar-split/traits/Traits.fst
 delete mode 100644 tests/fstar/hashmap/Hashmap.Properties.fst
 delete mode 100644 tests/fstar/hashmap/Hashmap.Properties.fsti

(limited to 'tests')

diff --git a/tests/coq/array/Array.v b/tests/coq/array/Array.v
index 1f2cc0e0..faa0e92c 100644
--- a/tests/coq/array/Array.v
+++ b/tests/coq/array/Array.v
@@ -12,108 +12,98 @@ Module Array.
     Source: 'src/array.rs', lines 3:0-3:11 *)
 Inductive AB_t := | AB_A : AB_t | AB_B : AB_t.
 
-(** [array::incr]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::incr]:
     Source: 'src/array.rs', lines 8:0-8:24 *)
 Definition incr (x : u32) : result u32 :=
   u32_add x 1%u32.
 
-(** [array::array_to_shared_slice_]: forward function
+(** [array::array_to_shared_slice_]:
     Source: 'src/array.rs', lines 16:0-16:53 *)
 Definition array_to_shared_slice_
   (T : Type) (s : array T 32%usize) : result (slice T) :=
   array_to_slice T 32%usize s
 .
 
-(** [array::array_to_mut_slice_]: forward function
+(** [array::array_to_mut_slice_]:
     Source: 'src/array.rs', lines 21:0-21:58 *)
 Definition array_to_mut_slice_
-  (T : Type) (s : array T 32%usize) : result (slice T) :=
-  array_to_slice T 32%usize s
-.
-
-(** [array::array_to_mut_slice_]: backward function 0
-    Source: 'src/array.rs', lines 21:0-21:58 *)
-Definition array_to_mut_slice__back
-  (T : Type) (s : array T 32%usize) (ret : slice T) :
-  result (array T 32%usize)
+  (T : Type) (s : array T 32%usize) :
+  result ((slice T) * (slice T -> result (array T 32%usize)))
   :=
-  array_from_slice T 32%usize s ret
+  p <- array_to_slice_mut T 32%usize s;
+  let (s1, to_slice_mut_back) := p in
+  let back := fun (ret : slice T) => to_slice_mut_back ret in
+  Return (s1, back)
 .
 
-(** [array::array_len]: forward function
+(** [array::array_len]:
     Source: 'src/array.rs', lines 25:0-25:40 *)
 Definition array_len (T : Type) (s : array T 32%usize) : result usize :=
-  s0 <- array_to_slice T 32%usize s; let i := slice_len T s0 in Return i
+  s1 <- array_to_slice T 32%usize s; let i := slice_len T s1 in Return i
 .
 
-(** [array::shared_array_len]: forward function
+(** [array::shared_array_len]:
     Source: 'src/array.rs', lines 29:0-29:48 *)
 Definition shared_array_len (T : Type) (s : array T 32%usize) : result usize :=
-  s0 <- array_to_slice T 32%usize s; let i := slice_len T s0 in Return i
+  s1 <- array_to_slice T 32%usize s; let i := slice_len T s1 in Return i
 .
 
-(** [array::shared_slice_len]: forward function
+(** [array::shared_slice_len]:
     Source: 'src/array.rs', lines 33:0-33:44 *)
 Definition shared_slice_len (T : Type) (s : slice T) : result usize :=
   let i := slice_len T s in Return i
 .
 
-(** [array::index_array_shared]: forward function
+(** [array::index_array_shared]:
     Source: 'src/array.rs', lines 37:0-37:57 *)
 Definition index_array_shared
   (T : Type) (s : array T 32%usize) (i : usize) : result T :=
   array_index_usize T 32%usize s i
 .
 
-(** [array::index_array_u32]: forward function
+(** [array::index_array_u32]:
     Source: 'src/array.rs', lines 44:0-44:53 *)
 Definition index_array_u32 (s : array u32 32%usize) (i : usize) : result u32 :=
   array_index_usize u32 32%usize s i
 .
 
-(** [array::index_array_copy]: forward function
+(** [array::index_array_copy]:
     Source: 'src/array.rs', lines 48:0-48:45 *)
 Definition index_array_copy (x : array u32 32%usize) : result u32 :=
   array_index_usize u32 32%usize x 0%usize
 .
 
-(** [array::index_mut_array]: forward function
+(** [array::index_mut_array]:
     Source: 'src/array.rs', lines 52:0-52:62 *)
 Definition index_mut_array
-  (T : Type) (s : array T 32%usize) (i : usize) : result T :=
-  array_index_usize T 32%usize s i
-.
-
-(** [array::index_mut_array]: backward function 0
-    Source: 'src/array.rs', lines 52:0-52:62 *)
-Definition index_mut_array_back
-  (T : Type) (s : array T 32%usize) (i : usize) (ret : T) :
-  result (array T 32%usize)
+  (T : Type) (s : array T 32%usize) (i : usize) :
+  result (T * (T -> result (array T 32%usize)))
   :=
-  array_update_usize T 32%usize s i ret
+  p <- array_index_mut_usize T 32%usize s i;
+  let (t, index_mut_back) := p in
+  let back := fun (ret : T) => index_mut_back ret in
+  Return (t, back)
 .
 
-(** [array::index_slice]: forward function
+(** [array::index_slice]:
     Source: 'src/array.rs', lines 56:0-56:46 *)
 Definition index_slice (T : Type) (s : slice T) (i : usize) : result T :=
   slice_index_usize T s i
 .
 
-(** [array::index_mut_slice]: forward function
+(** [array::index_mut_slice]:
     Source: 'src/array.rs', lines 60:0-60:58 *)
-Definition index_mut_slice (T : Type) (s : slice T) (i : usize) : result T :=
-  slice_index_usize T s i
-.
-
-(** [array::index_mut_slice]: backward function 0
-    Source: 'src/array.rs', lines 60:0-60:58 *)
-Definition index_mut_slice_back
-  (T : Type) (s : slice T) (i : usize) (ret : T) : result (slice T) :=
-  slice_update_usize T s i ret
+Definition index_mut_slice
+  (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T)))
+  :=
+  p <- slice_index_mut_usize T s i;
+  let (t, index_mut_back) := p in
+  let back := fun (ret : T) => index_mut_back ret in
+  Return (t, back)
 .
 
-(** [array::slice_subslice_shared_]: forward function
+(** [array::slice_subslice_shared_]:
     Source: 'src/array.rs', lines 64:0-64:70 *)
 Definition slice_subslice_shared_
   (x : slice u32) (y : usize) (z : usize) : result (slice u32) :=
@@ -122,47 +112,41 @@ Definition slice_subslice_shared_
     {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |}
 .
 
-(** [array::slice_subslice_mut_]: forward function
+(** [array::slice_subslice_mut_]:
     Source: 'src/array.rs', lines 68:0-68:75 *)
 Definition slice_subslice_mut_
-  (x : slice u32) (y : usize) (z : usize) : result (slice u32) :=
-  core_slice_index_Slice_index_mut u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
-    {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |}
-.
-
-(** [array::slice_subslice_mut_]: backward function 0
-    Source: 'src/array.rs', lines 68:0-68:75 *)
-Definition slice_subslice_mut__back
-  (x : slice u32) (y : usize) (z : usize) (ret : slice u32) :
-  result (slice u32)
+  (x : slice u32) (y : usize) (z : usize) :
+  result ((slice u32) * (slice u32 -> result (slice u32)))
   :=
-  core_slice_index_Slice_index_mut_back u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
-    {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |} ret
+  p <-
+    core_slice_index_Slice_index_mut u32 (core_ops_range_Range usize)
+      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
+      {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |};
+  let (s, index_mut_back) := p in
+  let back := fun (ret : slice u32) => index_mut_back ret in
+  Return (s, back)
 .
 
-(** [array::array_to_slice_shared_]: forward function
+(** [array::array_to_slice_shared_]:
     Source: 'src/array.rs', lines 72:0-72:54 *)
 Definition array_to_slice_shared_
   (x : array u32 32%usize) : result (slice u32) :=
   array_to_slice u32 32%usize x
 .
 
-(** [array::array_to_slice_mut_]: forward function
+(** [array::array_to_slice_mut_]:
     Source: 'src/array.rs', lines 76:0-76:59 *)
-Definition array_to_slice_mut_ (x : array u32 32%usize) : result (slice u32) :=
-  array_to_slice u32 32%usize x
-.
-
-(** [array::array_to_slice_mut_]: backward function 0
-    Source: 'src/array.rs', lines 76:0-76:59 *)
-Definition array_to_slice_mut__back
-  (x : array u32 32%usize) (ret : slice u32) : result (array u32 32%usize) :=
-  array_from_slice u32 32%usize x ret
+Definition array_to_slice_mut_
+  (x : array u32 32%usize) :
+  result ((slice u32) * (slice u32 -> result (array u32 32%usize)))
+  :=
+  p <- array_to_slice_mut u32 32%usize x;
+  let (s, to_slice_mut_back) := p in
+  let back := fun (ret : slice u32) => to_slice_mut_back ret in
+  Return (s, back)
 .
 
-(** [array::array_subslice_shared_]: forward function
+(** [array::array_subslice_shared_]:
     Source: 'src/array.rs', lines 80:0-80:74 *)
 Definition array_subslice_shared_
   (x : array u32 32%usize) (y : usize) (z : usize) : result (slice u32) :=
@@ -172,41 +156,35 @@ Definition array_subslice_shared_
     {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |}
 .
 
-(** [array::array_subslice_mut_]: forward function
+(** [array::array_subslice_mut_]:
     Source: 'src/array.rs', lines 84:0-84:79 *)
 Definition array_subslice_mut_
-  (x : array u32 32%usize) (y : usize) (z : usize) : result (slice u32) :=
-  core_array_Array_index_mut u32 (core_ops_range_Range usize) 32%usize
-    (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
-    {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |}
-.
-
-(** [array::array_subslice_mut_]: backward function 0
-    Source: 'src/array.rs', lines 84:0-84:79 *)
-Definition array_subslice_mut__back
-  (x : array u32 32%usize) (y : usize) (z : usize) (ret : slice u32) :
-  result (array u32 32%usize)
+  (x : array u32 32%usize) (y : usize) (z : usize) :
+  result ((slice u32) * (slice u32 -> result (array u32 32%usize)))
   :=
-  core_array_Array_index_mut_back u32 (core_ops_range_Range usize) 32%usize
-    (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
-    {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |} ret
+  p <-
+    core_array_Array_index_mut u32 (core_ops_range_Range usize) 32%usize
+      (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
+      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
+      {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |};
+  let (s, index_mut_back) := p in
+  let back := fun (ret : slice u32) => index_mut_back ret in
+  Return (s, back)
 .
 
-(** [array::index_slice_0]: forward function
+(** [array::index_slice_0]:
     Source: 'src/array.rs', lines 88:0-88:38 *)
 Definition index_slice_0 (T : Type) (s : slice T) : result T :=
   slice_index_usize T s 0%usize
 .
 
-(** [array::index_array_0]: forward function
+(** [array::index_array_0]:
     Source: 'src/array.rs', lines 92:0-92:42 *)
 Definition index_array_0 (T : Type) (s : array T 32%usize) : result T :=
   array_index_usize T 32%usize s 0%usize
 .
 
-(** [array::index_index_array]: forward function
+(** [array::index_index_array]:
     Source: 'src/array.rs', lines 103:0-103:71 *)
 Definition index_index_array
   (s : array (array u32 32%usize) 32%usize) (i : usize) (j : usize) :
@@ -216,157 +194,164 @@ Definition index_index_array
   array_index_usize u32 32%usize a j
 .
 
-(** [array::update_update_array]: forward function
+(** [array::update_update_array]:
     Source: 'src/array.rs', lines 114:0-114:70 *)
 Definition update_update_array
   (s : array (array u32 32%usize) 32%usize) (i : usize) (j : usize) :
   result unit
   :=
-  a <- array_index_usize (array u32 32%usize) 32%usize s i;
-  a0 <- array_update_usize u32 32%usize a j 0%u32;
-  _ <- array_update_usize (array u32 32%usize) 32%usize s i a0;
+  p <- array_index_mut_usize (array u32 32%usize) 32%usize s i;
+  let (a, index_mut_back) := p in
+  p1 <- array_index_mut_usize u32 32%usize a j;
+  let (_, index_mut_back1) := p1 in
+  a1 <- index_mut_back1 0%u32;
+  _ <- index_mut_back a1;
   Return tt
 .
 
-(** [array::array_local_deep_copy]: forward function
+(** [array::array_local_deep_copy]:
     Source: 'src/array.rs', lines 118:0-118:43 *)
 Definition array_local_deep_copy (x : array u32 32%usize) : result unit :=
   Return tt
 .
 
-(** [array::take_array]: forward function
+(** [array::take_array]:
     Source: 'src/array.rs', lines 122:0-122:30 *)
 Definition take_array (a : array u32 2%usize) : result unit :=
   Return tt.
 
-(** [array::take_array_borrow]: forward function
+(** [array::take_array_borrow]:
     Source: 'src/array.rs', lines 123:0-123:38 *)
 Definition take_array_borrow (a : array u32 2%usize) : result unit :=
   Return tt
 .
 
-(** [array::take_slice]: forward function
+(** [array::take_slice]:
     Source: 'src/array.rs', lines 124:0-124:28 *)
 Definition take_slice (s : slice u32) : result unit :=
   Return tt.
 
-(** [array::take_mut_slice]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::take_mut_slice]:
     Source: 'src/array.rs', lines 125:0-125:36 *)
 Definition take_mut_slice (s : slice u32) : result (slice u32) :=
   Return s.
 
-(** [array::const_array]: forward function
+(** [array::const_array]:
     Source: 'src/array.rs', lines 127:0-127:32 *)
 Definition const_array : result (array u32 2%usize) :=
   Return (mk_array u32 2%usize [ 0%u32; 0%u32 ])
 .
 
-(** [array::const_slice]: forward function
+(** [array::const_slice]:
     Source: 'src/array.rs', lines 131:0-131:20 *)
 Definition const_slice : result unit :=
   _ <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
   Return tt
 .
 
-(** [array::take_all]: forward function
+(** [array::take_all]:
     Source: 'src/array.rs', lines 141:0-141:17 *)
 Definition take_all : result unit :=
+  _ <- take_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
   _ <- take_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
   _ <- take_array_borrow (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
   s <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
   _ <- take_slice s;
-  s0 <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  s1 <- take_mut_slice s0;
-  _ <- array_from_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]) s1;
+  p <- array_to_slice_mut u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  let (s1, to_slice_mut_back) := p in
+  s2 <- take_mut_slice s1;
+  _ <- to_slice_mut_back s2;
   Return tt
 .
 
-(** [array::index_array]: forward function
+(** [array::index_array]:
     Source: 'src/array.rs', lines 155:0-155:38 *)
 Definition index_array (x : array u32 2%usize) : result u32 :=
   array_index_usize u32 2%usize x 0%usize
 .
 
-(** [array::index_array_borrow]: forward function
+(** [array::index_array_borrow]:
     Source: 'src/array.rs', lines 158:0-158:46 *)
 Definition index_array_borrow (x : array u32 2%usize) : result u32 :=
   array_index_usize u32 2%usize x 0%usize
 .
 
-(** [array::index_slice_u32_0]: forward function
+(** [array::index_slice_u32_0]:
     Source: 'src/array.rs', lines 162:0-162:42 *)
 Definition index_slice_u32_0 (x : slice u32) : result u32 :=
   slice_index_usize u32 x 0%usize
 .
 
-(** [array::index_mut_slice_u32_0]: forward function
+(** [array::index_mut_slice_u32_0]:
     Source: 'src/array.rs', lines 166:0-166:50 *)
-Definition index_mut_slice_u32_0 (x : slice u32) : result u32 :=
-  slice_index_usize u32 x 0%usize
+Definition index_mut_slice_u32_0
+  (x : slice u32) : result (u32 * (slice u32)) :=
+  i <- slice_index_usize u32 x 0%usize; Return (i, x)
 .
 
-(** [array::index_mut_slice_u32_0]: backward function 0
-    Source: 'src/array.rs', lines 166:0-166:50 *)
-Definition index_mut_slice_u32_0_back (x : slice u32) : result (slice u32) :=
-  _ <- slice_index_usize u32 x 0%usize; Return x
-.
-
-(** [array::index_all]: forward function
+(** [array::index_all]:
     Source: 'src/array.rs', lines 170:0-170:25 *)
 Definition index_all : result u32 :=
   i <- index_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  i0 <- index_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  i1 <- u32_add i i0;
-  i2 <- index_array_borrow (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  i3 <- u32_add i1 i2;
+  i1 <- index_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  i2 <- u32_add i i1;
+  i3 <- index_array_borrow (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  i4 <- u32_add i2 i3;
   s <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  i4 <- index_slice_u32_0 s;
-  i5 <- u32_add i3 i4;
-  s0 <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  i6 <- index_mut_slice_u32_0 s0;
-  i7 <- u32_add i5 i6;
-  s1 <- index_mut_slice_u32_0_back s0;
-  _ <- array_from_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]) s1;
-  Return i7
-.
-
-(** [array::update_array]: forward function
+  i5 <- index_slice_u32_0 s;
+  i6 <- u32_add i4 i5;
+  p <- array_to_slice_mut u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  let (s1, to_slice_mut_back) := p in
+  p1 <- index_mut_slice_u32_0 s1;
+  let (i7, s2) := p1 in
+  i8 <- u32_add i6 i7;
+  _ <- to_slice_mut_back s2;
+  Return i8
+.
+
+(** [array::update_array]:
     Source: 'src/array.rs', lines 184:0-184:36 *)
 Definition update_array (x : array u32 2%usize) : result unit :=
-  _ <- array_update_usize u32 2%usize x 0%usize 1%u32; Return tt
+  p <- array_index_mut_usize u32 2%usize x 0%usize;
+  let (_, index_mut_back) := p in
+  _ <- index_mut_back 1%u32;
+  Return tt
 .
 
-(** [array::update_array_mut_borrow]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::update_array_mut_borrow]:
     Source: 'src/array.rs', lines 187:0-187:48 *)
 Definition update_array_mut_borrow
   (x : array u32 2%usize) : result (array u32 2%usize) :=
-  array_update_usize u32 2%usize x 0%usize 1%u32
+  p <- array_index_mut_usize u32 2%usize x 0%usize;
+  let (_, index_mut_back) := p in
+  index_mut_back 1%u32
 .
 
-(** [array::update_mut_slice]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::update_mut_slice]:
     Source: 'src/array.rs', lines 190:0-190:38 *)
 Definition update_mut_slice (x : slice u32) : result (slice u32) :=
-  slice_update_usize u32 x 0%usize 1%u32
+  p <- slice_index_mut_usize u32 x 0%usize;
+  let (_, index_mut_back) := p in
+  index_mut_back 1%u32
 .
 
-(** [array::update_all]: forward function
+(** [array::update_all]:
     Source: 'src/array.rs', lines 194:0-194:19 *)
 Definition update_all : result unit :=
   _ <- update_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  x <- update_array_mut_borrow (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  s <- array_to_slice u32 2%usize x;
-  s0 <- update_mut_slice s;
-  _ <- array_from_slice u32 2%usize x s0;
+  _ <- update_array (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  a <- update_array_mut_borrow (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  p <- array_to_slice_mut u32 2%usize a;
+  let (s, to_slice_mut_back) := p in
+  s1 <- update_mut_slice s;
+  _ <- to_slice_mut_back s1;
   Return tt
 .
 
-(** [array::range_all]: forward function
+(** [array::range_all]:
     Source: 'src/array.rs', lines 205:0-205:18 *)
 Definition range_all : result unit :=
-  s <-
+  p <-
     core_array_Array_index_mut u32 (core_ops_range_Range usize) 4%usize
       (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
       (core_slice_index_SliceIndexRangeUsizeSliceTInst u32))
@@ -375,127 +360,119 @@ Definition range_all : result unit :=
         core_ops_range_Range_start := 1%usize;
         core_ops_range_Range_end_ := 3%usize
       |};
-  s0 <- update_mut_slice s;
-  _ <-
-    core_array_Array_index_mut_back u32 (core_ops_range_Range usize) 4%usize
-      (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
-      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32))
-      (mk_array u32 4%usize [ 0%u32; 0%u32; 0%u32; 0%u32 ])
-      {|
-        core_ops_range_Range_start := 1%usize;
-        core_ops_range_Range_end_ := 3%usize
-      |} s0;
+  let (s, index_mut_back) := p in
+  s1 <- update_mut_slice s;
+  _ <- index_mut_back s1;
   Return tt
 .
 
-(** [array::deref_array_borrow]: forward function
+(** [array::deref_array_borrow]:
     Source: 'src/array.rs', lines 214:0-214:46 *)
 Definition deref_array_borrow (x : array u32 2%usize) : result u32 :=
   array_index_usize u32 2%usize x 0%usize
 .
 
-(** [array::deref_array_mut_borrow]: forward function
-    Source: 'src/array.rs', lines 219:0-219:54 *)
-Definition deref_array_mut_borrow (x : array u32 2%usize) : result u32 :=
-  array_index_usize u32 2%usize x 0%usize
-.
-
-(** [array::deref_array_mut_borrow]: backward function 0
+(** [array::deref_array_mut_borrow]:
     Source: 'src/array.rs', lines 219:0-219:54 *)
-Definition deref_array_mut_borrow_back
-  (x : array u32 2%usize) : result (array u32 2%usize) :=
-  _ <- array_index_usize u32 2%usize x 0%usize; Return x
+Definition deref_array_mut_borrow
+  (x : array u32 2%usize) : result (u32 * (array u32 2%usize)) :=
+  i <- array_index_usize u32 2%usize x 0%usize; Return (i, x)
 .
 
-(** [array::take_array_t]: forward function
+(** [array::take_array_t]:
     Source: 'src/array.rs', lines 227:0-227:31 *)
 Definition take_array_t (a : array AB_t 2%usize) : result unit :=
   Return tt.
 
-(** [array::non_copyable_array]: forward function
+(** [array::non_copyable_array]:
     Source: 'src/array.rs', lines 229:0-229:27 *)
 Definition non_copyable_array : result unit :=
   _ <- take_array_t (mk_array AB_t 2%usize [ AB_A; AB_B ]); Return tt
 .
 
-(** [array::sum]: loop 0: forward function
+(** [array::sum]: loop 0:
     Source: 'src/array.rs', lines 242:0-250:1 *)
 Fixpoint sum_loop
-  (n : nat) (s : slice u32) (sum0 : u32) (i : usize) : result u32 :=
+  (n : nat) (s : slice u32) (sum1 : u32) (i : usize) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := slice_len u32 s in
-    if i s< i0
+  | S n1 =>
+    let i1 := slice_len u32 s in
+    if i s< i1
     then (
-      i1 <- slice_index_usize u32 s i;
-      sum1 <- u32_add sum0 i1;
-      i2 <- usize_add i 1%usize;
-      sum_loop n0 s sum1 i2)
-    else Return sum0
+      i2 <- slice_index_usize u32 s i;
+      sum3 <- u32_add sum1 i2;
+      i3 <- usize_add i 1%usize;
+      sum_loop n1 s sum3 i3)
+    else Return sum1
   end
 .
 
-(** [array::sum]: forward function
+(** [array::sum]:
     Source: 'src/array.rs', lines 242:0-242:28 *)
 Definition sum (n : nat) (s : slice u32) : result u32 :=
   sum_loop n s 0%u32 0%usize
 .
 
-(** [array::sum2]: loop 0: forward function
+(** [array::sum2]: loop 0:
     Source: 'src/array.rs', lines 252:0-261:1 *)
 Fixpoint sum2_loop
-  (n : nat) (s : slice u32) (s2 : slice u32) (sum0 : u32) (i : usize) :
+  (n : nat) (s : slice u32) (s2 : slice u32) (sum1 : u32) (i : usize) :
   result u32
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := slice_len u32 s in
-    if i s< i0
+  | S n1 =>
+    let i1 := slice_len u32 s in
+    if i s< i1
     then (
-      i1 <- slice_index_usize u32 s i;
-      i2 <- slice_index_usize u32 s2 i;
-      i3 <- u32_add i1 i2;
-      sum1 <- u32_add sum0 i3;
-      i4 <- usize_add i 1%usize;
-      sum2_loop n0 s s2 sum1 i4)
-    else Return sum0
+      i2 <- slice_index_usize u32 s i;
+      i3 <- slice_index_usize u32 s2 i;
+      i4 <- u32_add i2 i3;
+      sum3 <- u32_add sum1 i4;
+      i5 <- usize_add i 1%usize;
+      sum2_loop n1 s s2 sum3 i5)
+    else Return sum1
   end
 .
 
-(** [array::sum2]: forward function
+(** [array::sum2]:
     Source: 'src/array.rs', lines 252:0-252:41 *)
 Definition sum2 (n : nat) (s : slice u32) (s2 : slice u32) : result u32 :=
   let i := slice_len u32 s in
-  let i0 := slice_len u32 s2 in
-  if negb (i s= i0) then Fail_ Failure else sum2_loop n s s2 0%u32 0%usize
+  let i1 := slice_len u32 s2 in
+  if negb (i s= i1) then Fail_ Failure else sum2_loop n s s2 0%u32 0%usize
 .
 
-(** [array::f0]: forward function
+(** [array::f0]:
     Source: 'src/array.rs', lines 263:0-263:11 *)
 Definition f0 : result unit :=
-  s <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 1%u32; 2%u32 ]);
-  s0 <- slice_update_usize u32 s 0%usize 1%u32;
-  _ <- array_from_slice u32 2%usize (mk_array u32 2%usize [ 1%u32; 2%u32 ]) s0;
+  p <- array_to_slice_mut u32 2%usize (mk_array u32 2%usize [ 1%u32; 2%u32 ]);
+  let (s, to_slice_mut_back) := p in
+  p1 <- slice_index_mut_usize u32 s 0%usize;
+  let (_, index_mut_back) := p1 in
+  s1 <- index_mut_back 1%u32;
+  _ <- to_slice_mut_back s1;
   Return tt
 .
 
-(** [array::f1]: forward function
+(** [array::f1]:
     Source: 'src/array.rs', lines 268:0-268:11 *)
 Definition f1 : result unit :=
-  _ <-
-    array_update_usize u32 2%usize (mk_array u32 2%usize [ 1%u32; 2%u32 ])
-      0%usize 1%u32;
+  p <-
+    array_index_mut_usize u32 2%usize (mk_array u32 2%usize [ 1%u32; 2%u32 ])
+      0%usize;
+  let (_, index_mut_back) := p in
+  _ <- index_mut_back 1%u32;
   Return tt
 .
 
-(** [array::f2]: forward function
+(** [array::f2]:
     Source: 'src/array.rs', lines 273:0-273:17 *)
 Definition f2 (i : u32) : result unit :=
   Return tt.
 
-(** [array::f4]: forward function
+(** [array::f4]:
     Source: 'src/array.rs', lines 282:0-282:54 *)
 Definition f4
   (x : array u32 32%usize) (y : usize) (z : usize) : result (slice u32) :=
@@ -505,7 +482,7 @@ Definition f4
     {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |}
 .
 
-(** [array::f3]: forward function
+(** [array::f3]:
     Source: 'src/array.rs', lines 275:0-275:18 *)
 Definition f3 (n : nat) : result u32 :=
   i <-
@@ -514,8 +491,8 @@ Definition f3 (n : nat) : result u32 :=
   _ <- f2 i;
   let b := array_repeat u32 32%usize 0%u32 in
   s <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 1%u32; 2%u32 ]);
-  s0 <- f4 b 16%usize 18%usize;
-  sum2 n s s0
+  s1 <- f4 b 16%usize 18%usize;
+  sum2 n s s1
 .
 
 (** [array::SZ]
@@ -523,21 +500,25 @@ Definition f3 (n : nat) : result u32 :=
 Definition sz_body : result usize := Return 32%usize.
 Definition sz_c : usize := sz_body%global.
 
-(** [array::f5]: forward function
+(** [array::f5]:
     Source: 'src/array.rs', lines 289:0-289:31 *)
 Definition f5 (x : array u32 32%usize) : result u32 :=
   array_index_usize u32 32%usize x 0%usize
 .
 
-(** [array::ite]: forward function
+(** [array::ite]:
     Source: 'src/array.rs', lines 294:0-294:12 *)
 Definition ite : result unit :=
-  s <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  s0 <- array_to_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
-  s1 <- index_mut_slice_u32_0_back s0;
-  _ <- array_from_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]) s1;
-  s2 <- index_mut_slice_u32_0_back s;
-  _ <- array_from_slice u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]) s2;
+  p <- array_to_slice_mut u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  let (s, to_slice_mut_back) := p in
+  p1 <- index_mut_slice_u32_0 s;
+  let (_, s1) := p1 in
+  p2 <- array_to_slice_mut u32 2%usize (mk_array u32 2%usize [ 0%u32; 0%u32 ]);
+  let (s2, to_slice_mut_back1) := p2 in
+  p3 <- index_mut_slice_u32_0 s2;
+  let (_, s3) := p3 in
+  _ <- to_slice_mut_back1 s3;
+  _ <- to_slice_mut_back s1;
   Return tt
 .
 
diff --git a/tests/coq/array/Primitives.v b/tests/coq/array/Primitives.v
index 84280b96..990e27e4 100644
--- a/tests/coq/array/Primitives.v
+++ b/tests/coq/array/Primitives.v
@@ -67,8 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a := x .
-Definition core_mem_replace_back (a : Type) (x : a) (y : a) : a := y .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -504,13 +503,15 @@ Arguments core_ops_index_Index_index {_ _}.
 (* Trait declaration: [core::ops::index::IndexMut] *)
 Record core_ops_index_IndexMut (Self Idx : Type) := mk_core_ops_index_IndexMut {
   core_ops_index_IndexMut_indexInst : core_ops_index_Index Self Idx;
-  core_ops_index_IndexMut_index_mut : Self -> Idx -> result core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output);
-  core_ops_index_IndexMut_index_mut_back : Self -> Idx -> core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self;
+  core_ops_index_IndexMut_index_mut :
+    Self ->
+    Idx ->
+    result (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) *
+            (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self));
 }.
 Arguments mk_core_ops_index_IndexMut {_ _}.
 Arguments core_ops_index_IndexMut_indexInst {_ _}.
 Arguments core_ops_index_IndexMut_index_mut {_ _}.
-Arguments core_ops_index_IndexMut_index_mut_back {_ _}.
 
 (* Trait declaration [core::ops::deref::Deref] *)
 Record core_ops_deref_Deref (Self : Type) := mk_core_ops_deref_Deref {
@@ -524,13 +525,14 @@ Arguments core_ops_deref_Deref_deref {_}.
 (* Trait declaration [core::ops::deref::DerefMut] *)
 Record core_ops_deref_DerefMut (Self : Type) := mk_core_ops_deref_DerefMut {
   core_ops_deref_DerefMut_derefInst : core_ops_deref_Deref Self;
-  core_ops_deref_DerefMut_deref_mut : Self -> result core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target);
-  core_ops_deref_DerefMut_deref_mut_back : Self -> core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self;
+  core_ops_deref_DerefMut_deref_mut :
+    Self ->
+    result (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) *
+            (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self));
 }.
 Arguments mk_core_ops_deref_DerefMut {_}.
 Arguments core_ops_deref_DerefMut_derefInst {_}.
 Arguments core_ops_deref_DerefMut_deref_mut {_}.
-Arguments core_ops_deref_DerefMut_deref_mut_back {_}.
 
 Record core_ops_range_Range (T : Type) := mk_core_ops_range_Range {
   core_ops_range_Range_start : T;
@@ -543,8 +545,8 @@ Arguments core_ops_range_Range_end_ {_}.
 (*** [alloc] *)
 
 Definition alloc_boxed_Box_deref (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut_back (T : Type) (_ : T) (x : T) : result T := Return x.
+Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result (T * (T -> result T)) :=
+  Return (x, fun x => Return x).
 
 (* Trait instance *)
 Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref Self := {|
@@ -556,7 +558,6 @@ Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref
 Definition alloc_boxed_Box_coreopsDerefMutInst (Self : Type) : core_ops_deref_DerefMut Self := {|
   core_ops_deref_DerefMut_derefInst := alloc_boxed_Box_coreopsDerefInst Self;
   core_ops_deref_DerefMut_deref_mut := alloc_boxed_Box_deref_mut Self;
-  core_ops_deref_DerefMut_deref_mut_back := alloc_boxed_Box_deref_mut_back Self;
 |}.
 
 
@@ -584,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -591,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
@@ -639,16 +661,9 @@ Definition alloc_vec_Vec_bind {A B} (v: alloc_vec_Vec A) (f: list A -> result (l
   | right _ => Fail_ Failure
   end.
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_push_fwd (T: Type) (v: alloc_vec_Vec T) (x: T) : unit := tt.
-
 Definition alloc_vec_Vec_push (T: Type) (v: alloc_vec_Vec T) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l => Return (l ++ [x])).
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_insert_fwd (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result unit :=
-  if to_Z i <? alloc_vec_Vec_length v then Return tt else Fail_ Failure.
-
 Definition alloc_vec_Vec_insert (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l =>
     if to_Z i <? Z.of_nat (length l)
@@ -661,6 +676,14 @@ Axiom alloc_vec_Vec_index_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : u
 (* Helper *)
 Axiom alloc_vec_Vec_update_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : usize) (x : T), result (alloc_vec_Vec T).
 
+Definition alloc_vec_Vec_index_mut_usize {T : Type} (v: alloc_vec_Vec T) (i: usize) :
+  result (T * (T -> result (alloc_vec_Vec T))) :=
+  match alloc_vec_Vec_index_usize v i with
+  | Return x =>
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail_ e => Fail_ e
+  end.
+
 (* Trait declaration: [core::slice::index::private_slice_index::Sealed] *)
 Definition core_slice_index_private_slice_index_Sealed (self : Type) := unit.
 
@@ -669,25 +692,23 @@ Record core_slice_index_SliceIndex (Self T : Type) := mk_core_slice_index_SliceI
   core_slice_index_SliceIndex_sealedInst : core_slice_index_private_slice_index_Sealed Self;
   core_slice_index_SliceIndex_Output : Type;
   core_slice_index_SliceIndex_get : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut_back : Self -> T -> option core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_get_mut :
+    Self -> T -> result (option core_slice_index_SliceIndex_Output * (option core_slice_index_SliceIndex_Output -> result T));
   core_slice_index_SliceIndex_get_unchecked : Self -> const_raw_ptr T -> result (const_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_get_unchecked_mut : Self -> mut_raw_ptr T -> result (mut_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_index : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut_back : Self -> T -> core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_index_mut :
+    Self -> T -> result (core_slice_index_SliceIndex_Output * (core_slice_index_SliceIndex_Output -> result T));
 }.
 Arguments mk_core_slice_index_SliceIndex {_ _}.
 Arguments core_slice_index_SliceIndex_sealedInst {_ _}.
 Arguments core_slice_index_SliceIndex_Output {_ _}.
 Arguments core_slice_index_SliceIndex_get {_ _}.
 Arguments core_slice_index_SliceIndex_get_mut {_ _}.
-Arguments core_slice_index_SliceIndex_get_mut_back {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked_mut {_ _}.
 Arguments core_slice_index_SliceIndex_index {_ _}.
 Arguments core_slice_index_SliceIndex_index_mut {_ _}.
-Arguments core_slice_index_SliceIndex_index_mut_back {_ _}.
 
 (* [core::slice::index::[T]::index]: forward function *)
 Definition core_slice_index_Slice_index
@@ -704,11 +725,9 @@ Axiom core_slice_index_RangeUsize_get : forall (T : Type) (i : core_ops_range_Ra
 
 (* [core::slice::index::Range::get_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_get_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (option (slice T)).
-
-(* [core::slice::index::Range::get_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_get_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> option (slice T) -> result (slice T).
+  forall (T : Type),
+    core_ops_range_Range usize -> slice T ->
+    result (option (slice T) * (option (slice T) -> result (slice T))).
 
 (* [core::slice::index::Range::get_unchecked]: forward function *)
 Definition core_slice_index_RangeUsize_get_unchecked
@@ -732,21 +751,14 @@ Axiom core_slice_index_RangeUsize_index :
 
 (* [core::slice::index::Range::index_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_index_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T).
-
-(* [core::slice::index::Range::index_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_index_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> slice T -> result (slice T).
+  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T * (slice T -> result (slice T))).
 
 (* [core::slice::index::[T]::index_mut]: forward function *)
 Axiom core_slice_index_Slice_index_mut :
   forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> result inst.(core_slice_index_SliceIndex_Output).
-
-(* [core::slice::index::[T]::index_mut]: backward function 0 *)
-Axiom core_slice_index_Slice_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> inst.(core_slice_index_SliceIndex_Output) -> result (slice T).
+  slice T -> Idx ->
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (slice T))).
 
 (* [core::array::[T; N]::index]: forward function *)
 Axiom core_array_Array_index :
@@ -756,12 +768,9 @@ Axiom core_array_Array_index :
 (* [core::array::[T; N]::index_mut]: forward function *)
 Axiom core_array_Array_index_mut :
   forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx), result inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output).
-
-(* [core::array::[T; N]::index_mut]: backward function 0 *)
-Axiom core_array_Array_index_mut_back :
-  forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx) (x : inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output)), result (array T N).
+  (a : array T N) (i : Idx),
+  result (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) *
+          (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) -> result (array T N))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::Range] *)
 Definition core_slice_index_private_slice_index_SealedRangeUsizeInst
@@ -774,12 +783,10 @@ Definition core_slice_index_SliceIndexRangeUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := slice T;
   core_slice_index_SliceIndex_get := core_slice_index_RangeUsize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_RangeUsize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_RangeUsize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_RangeUsize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_RangeUsize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_RangeUsize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_RangeUsize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_RangeUsize_index_mut_back T;
 |}.
 
 (* Trait implementation: [core::slice::index::[T]] *)
@@ -796,7 +803,6 @@ Definition core_ops_index_IndexMutSliceTIInst (T Idx : Type)
   core_ops_index_IndexMut (slice T) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexSliceTIInst T Idx inst;
   core_ops_index_IndexMut_index_mut := core_slice_index_Slice_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := core_slice_index_Slice_index_mut_back T Idx inst;
 |}.
 
 (* Trait implementation: [core::array::[T; N]] *)
@@ -813,18 +819,14 @@ Definition core_ops_index_IndexMutArrayInst (T Idx : Type) (N : usize)
   core_ops_index_IndexMut (array T N) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexArrayInst T Idx N inst.(core_ops_index_IndexMut_indexInst);
   core_ops_index_IndexMut_index_mut := core_array_Array_index_mut T Idx N inst;
-  core_ops_index_IndexMut_index_mut_back := core_array_Array_index_mut_back T Idx N inst;
 |}.
 
 (* [core::slice::index::usize::get]: forward function *)
 Axiom core_slice_index_usize_get : forall (T : Type), usize -> slice T -> result (option T).
 
 (* [core::slice::index::usize::get_mut]: forward function *)
-Axiom core_slice_index_usize_get_mut : forall (T : Type), usize -> slice T -> result (option T).
-
-(* [core::slice::index::usize::get_mut]: backward function 0 *)
-Axiom core_slice_index_usize_get_mut_back :
-  forall (T : Type), usize -> slice T -> option T -> result (slice T).
+Axiom core_slice_index_usize_get_mut :
+  forall (T : Type), usize -> slice T -> result (option T * (option T -> result (slice T))).
 
 (* [core::slice::index::usize::get_unchecked]: forward function *)
 Axiom core_slice_index_usize_get_unchecked :
@@ -838,11 +840,8 @@ Axiom core_slice_index_usize_get_unchecked_mut :
 Axiom core_slice_index_usize_index : forall (T : Type), usize -> slice T -> result T.
 
 (* [core::slice::index::usize::index_mut]: forward function *)
-Axiom core_slice_index_usize_index_mut : forall (T : Type), usize -> slice T -> result T.
-
-(* [core::slice::index::usize::index_mut]: backward function 0 *)
-Axiom core_slice_index_usize_index_mut_back :
-  forall (T : Type), usize -> slice T -> T -> result (slice T).
+Axiom core_slice_index_usize_index_mut :
+  forall (T : Type), usize -> slice T -> result (T * (T -> result (slice T))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::usize] *)
 Definition core_slice_index_private_slice_index_SealedUsizeInst
@@ -855,12 +854,10 @@ Definition core_slice_index_SliceIndexUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := T;
   core_slice_index_SliceIndex_get := core_slice_index_usize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_usize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_usize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_usize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_usize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_usize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_usize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_usize_index_mut_back T;
 |}.
 
 (* [alloc::vec::Vec::index]: forward function *)
@@ -869,12 +866,9 @@ Axiom alloc_vec_Vec_index : forall (T Idx : Type) (inst : core_slice_index_Slice
 
 (* [alloc::vec::Vec::index_mut]: forward function *)
 Axiom alloc_vec_Vec_index_mut : forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx), result inst.(core_slice_index_SliceIndex_Output).
-
-(* [alloc::vec::Vec::index_mut]: backward function 0 *)
-Axiom alloc_vec_Vec_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx) (x : inst.(core_slice_index_SliceIndex_Output)), result (alloc_vec_Vec T).
+  (Self : alloc_vec_Vec T) (i : Idx),
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (alloc_vec_Vec T))).
 
 (* Trait implementation: [alloc::vec::Vec] *)
 Definition alloc_vec_Vec_coreopsindexIndexInst (T Idx : Type)
@@ -890,7 +884,6 @@ Definition alloc_vec_Vec_coreopsindexIndexMutInst (T Idx : Type)
   core_ops_index_IndexMut (alloc_vec_Vec T) Idx := {|
   core_ops_index_IndexMut_indexInst := alloc_vec_Vec_coreopsindexIndexInst T Idx inst;
   core_ops_index_IndexMut_index_mut := alloc_vec_Vec_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := alloc_vec_Vec_index_mut_back T Idx inst;
 |}.
 
 (*** Theorems *)
@@ -901,10 +894,6 @@ Axiom alloc_vec_Vec_index_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usiz
 
 Axiom alloc_vec_Vec_index_mut_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
   alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i =
-    alloc_vec_Vec_index_usize v i.
-
-Axiom alloc_vec_Vec_index_mut_back_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
-  alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x =
-    alloc_vec_Vec_update_usize v i x.
+    alloc_vec_Vec_index_mut_usize v i.
 
 End Primitives.
diff --git a/tests/coq/betree/BetreeMain_Funs.v b/tests/coq/betree/BetreeMain_Funs.v
index a5dd4230..516bc7b7 100644
--- a/tests/coq/betree/BetreeMain_Funs.v
+++ b/tests/coq/betree/BetreeMain_Funs.v
@@ -12,7 +12,7 @@ Require Import BetreeMain_FunsExternal.
 Include BetreeMain_FunsExternal.
 Module BetreeMain_Funs.
 
-(** [betree_main::betree::load_internal_node]: forward function
+(** [betree_main::betree::load_internal_node]:
     Source: 'src/betree.rs', lines 36:0-36:52 *)
 Definition betree_load_internal_node
   (id : u64) (st : state) :
@@ -21,70 +21,57 @@ Definition betree_load_internal_node
   betree_utils_load_internal_node id st
 .
 
-(** [betree_main::betree::store_internal_node]: forward function
+(** [betree_main::betree::store_internal_node]:
     Source: 'src/betree.rs', lines 41:0-41:60 *)
 Definition betree_store_internal_node
   (id : u64) (content : betree_List_t (u64 * betree_Message_t)) (st : state) :
   result (state * unit)
   :=
   p <- betree_utils_store_internal_node id content st;
-  let (st0, _) := p in
-  Return (st0, tt)
+  let (st1, _) := p in
+  Return (st1, tt)
 .
 
-(** [betree_main::betree::load_leaf_node]: forward function
+(** [betree_main::betree::load_leaf_node]:
     Source: 'src/betree.rs', lines 46:0-46:44 *)
 Definition betree_load_leaf_node
   (id : u64) (st : state) : result (state * (betree_List_t (u64 * u64))) :=
   betree_utils_load_leaf_node id st
 .
 
-(** [betree_main::betree::store_leaf_node]: forward function
+(** [betree_main::betree::store_leaf_node]:
     Source: 'src/betree.rs', lines 51:0-51:52 *)
 Definition betree_store_leaf_node
   (id : u64) (content : betree_List_t (u64 * u64)) (st : state) :
   result (state * unit)
   :=
   p <- betree_utils_store_leaf_node id content st;
-  let (st0, _) := p in
-  Return (st0, tt)
+  let (st1, _) := p in
+  Return (st1, tt)
 .
 
-(** [betree_main::betree::fresh_node_id]: forward function
+(** [betree_main::betree::fresh_node_id]:
     Source: 'src/betree.rs', lines 55:0-55:48 *)
-Definition betree_fresh_node_id (counter : u64) : result u64 :=
-  _ <- u64_add counter 1%u64; Return counter
+Definition betree_fresh_node_id (counter : u64) : result (u64 * u64) :=
+  counter1 <- u64_add counter 1%u64; Return (counter, counter1)
 .
 
-(** [betree_main::betree::fresh_node_id]: backward function 0
-    Source: 'src/betree.rs', lines 55:0-55:48 *)
-Definition betree_fresh_node_id_back (counter : u64) : result u64 :=
-  u64_add counter 1%u64
-.
-
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]: forward function
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]:
     Source: 'src/betree.rs', lines 206:4-206:20 *)
 Definition betree_NodeIdCounter_new : result betree_NodeIdCounter_t :=
   Return {| betree_NodeIdCounter_next_node_id := 0%u64 |}
 .
 
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: forward function
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]:
     Source: 'src/betree.rs', lines 210:4-210:36 *)
 Definition betree_NodeIdCounter_fresh_id
-  (self : betree_NodeIdCounter_t) : result u64 :=
-  _ <- u64_add self.(betree_NodeIdCounter_next_node_id) 1%u64;
-  Return self.(betree_NodeIdCounter_next_node_id)
-.
-
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: backward function 0
-    Source: 'src/betree.rs', lines 210:4-210:36 *)
-Definition betree_NodeIdCounter_fresh_id_back
-  (self : betree_NodeIdCounter_t) : result betree_NodeIdCounter_t :=
+  (self : betree_NodeIdCounter_t) : result (u64 * betree_NodeIdCounter_t) :=
   i <- u64_add self.(betree_NodeIdCounter_next_node_id) 1%u64;
-  Return {| betree_NodeIdCounter_next_node_id := i |}
+  Return (self.(betree_NodeIdCounter_next_node_id),
+    {| betree_NodeIdCounter_next_node_id := i |})
 .
 
-(** [betree_main::betree::upsert_update]: forward function
+(** [betree_main::betree::upsert_update]:
     Source: 'src/betree.rs', lines 234:0-234:70 *)
 Definition betree_upsert_update
   (prev : option u64) (st : betree_UpsertFunState_t) : result u64 :=
@@ -92,49 +79,49 @@ Definition betree_upsert_update
   | None =>
     match st with
     | Betree_UpsertFunState_Add v => Return v
-    | Betree_UpsertFunState_Sub i => Return 0%u64
+    | Betree_UpsertFunState_Sub _ => Return 0%u64
     end
-  | Some prev0 =>
+  | Some prev1 =>
     match st with
     | Betree_UpsertFunState_Add v =>
-      margin <- u64_sub core_u64_max prev0;
-      if margin s>= v then u64_add prev0 v else Return core_u64_max
+      margin <- u64_sub core_u64_max prev1;
+      if margin s>= v then u64_add prev1 v else Return core_u64_max
     | Betree_UpsertFunState_Sub v =>
-      if prev0 s>= v then u64_sub prev0 v else Return 0%u64
+      if prev1 s>= v then u64_sub prev1 v else Return 0%u64
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]:
     Source: 'src/betree.rs', lines 276:4-276:24 *)
 Fixpoint betree_List_len
   (T : Type) (n : nat) (self : betree_List_t T) : result u64 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match self with
-    | Betree_List_Cons t tl => i <- betree_List_len T n0 tl; u64_add 1%u64 i
+    | Betree_List_Cons _ tl => i <- betree_List_len T n1 tl; u64_add 1%u64 i
     | Betree_List_Nil => Return 0%u64
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]:
     Source: 'src/betree.rs', lines 284:4-284:51 *)
 Fixpoint betree_List_split_at
-  (T : Type) (n : nat) (self : betree_List_t T) (n0 : u64) :
+  (T : Type) (n : nat) (self : betree_List_t T) (n1 : u64) :
   result ((betree_List_t T) * (betree_List_t T))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n1 =>
-    if n0 s= 0%u64
+  | S n2 =>
+    if n1 s= 0%u64
     then Return (Betree_List_Nil, self)
     else
       match self with
       | Betree_List_Cons hd tl =>
-        i <- u64_sub n0 1%u64;
-        p <- betree_List_split_at T n1 tl i;
+        i <- u64_sub n1 1%u64;
+        p <- betree_List_split_at T n2 tl i;
         let (ls0, ls1) := p in
         let l := ls0 in
         Return (Betree_List_Cons hd l, ls1)
@@ -143,58 +130,46 @@ Fixpoint betree_List_split_at
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]:
     Source: 'src/betree.rs', lines 299:4-299:34 *)
 Definition betree_List_push_front
   (T : Type) (self : betree_List_t T) (x : T) : result (betree_List_t T) :=
-  let tl := core_mem_replace (betree_List_t T) self Betree_List_Nil in
+  let (tl, _) := core_mem_replace (betree_List_t T) self Betree_List_Nil in
   let l := tl in
   Return (Betree_List_Cons x l)
 .
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
     Source: 'src/betree.rs', lines 306:4-306:32 *)
 Definition betree_List_pop_front
-  (T : Type) (self : betree_List_t T) : result T :=
-  let ls := core_mem_replace (betree_List_t T) self Betree_List_Nil in
+  (T : Type) (self : betree_List_t T) : result (T * (betree_List_t T)) :=
+  let (ls, _) := core_mem_replace (betree_List_t T) self Betree_List_Nil in
   match ls with
-  | Betree_List_Cons x tl => Return x
+  | Betree_List_Cons x tl => Return (x, tl)
   | Betree_List_Nil => Fail_ Failure
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: backward function 0
-    Source: 'src/betree.rs', lines 306:4-306:32 *)
-Definition betree_List_pop_front_back
-  (T : Type) (self : betree_List_t T) : result (betree_List_t T) :=
-  let ls := core_mem_replace (betree_List_t T) self Betree_List_Nil in
-  match ls with
-  | Betree_List_Cons x tl => Return tl
-  | Betree_List_Nil => Fail_ Failure
-  end
-.
-
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]:
     Source: 'src/betree.rs', lines 318:4-318:22 *)
 Definition betree_List_hd (T : Type) (self : betree_List_t T) : result T :=
   match self with
-  | Betree_List_Cons hd l => Return hd
+  | Betree_List_Cons hd _ => Return hd
   | Betree_List_Nil => Fail_ Failure
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]: forward function
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]:
     Source: 'src/betree.rs', lines 327:4-327:44 *)
 Definition betree_ListTupleU64T_head_has_key
   (T : Type) (self : betree_List_t (u64 * T)) (key : u64) : result bool :=
   match self with
-  | Betree_List_Cons hd l => let (i, _) := hd in Return (i s= key)
+  | Betree_List_Cons hd _ => let (i, _) := hd in Return (i s= key)
   | Betree_List_Nil => Return false
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]: forward function
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]:
     Source: 'src/betree.rs', lines 339:4-339:73 *)
 Fixpoint betree_ListTupleU64T_partition_at_pivot
   (T : Type) (n : nat) (self : betree_List_t (u64 * T)) (pivot : u64) :
@@ -202,14 +177,14 @@ Fixpoint betree_ListTupleU64T_partition_at_pivot
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match self with
     | Betree_List_Cons hd tl =>
       let (i, t) := hd in
       if i s>= pivot
       then Return (Betree_List_Nil, Betree_List_Cons (i, t) tl)
       else (
-        p <- betree_ListTupleU64T_partition_at_pivot T n0 tl pivot;
+        p <- betree_ListTupleU64T_partition_at_pivot T n1 tl pivot;
         let (ls0, ls1) := p in
         let l := ls0 in
         Return (Betree_List_Cons (i, t) l, ls1))
@@ -218,107 +193,76 @@ Fixpoint betree_ListTupleU64T_partition_at_pivot
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: forward function
+(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]:
     Source: 'src/betree.rs', lines 359:4-364:17 *)
 Definition betree_Leaf_split
   (n : nat) (self : betree_Leaf_t) (content : betree_List_t (u64 * u64))
   (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
   (st : state) :
-  result (state * betree_Internal_t)
+  result (state * (betree_Internal_t * betree_NodeIdCounter_t))
   :=
   p <-
     betree_List_split_at (u64 * u64) n content
       params.(betree_Params_split_size);
   let (content0, content1) := p in
-  p0 <- betree_List_hd (u64 * u64) content1;
-  let (pivot, _) := p0 in
-  id0 <- betree_NodeIdCounter_fresh_id node_id_cnt;
-  node_id_cnt0 <- betree_NodeIdCounter_fresh_id_back node_id_cnt;
-  id1 <- betree_NodeIdCounter_fresh_id node_id_cnt0;
-  p1 <- betree_store_leaf_node id0 content0 st;
-  let (st0, _) := p1 in
-  p2 <- betree_store_leaf_node id1 content1 st0;
-  let (st1, _) := p2 in
-  let n0 := Betree_Node_Leaf
+  p1 <- betree_List_hd (u64 * u64) content1;
+  let (pivot, _) := p1 in
+  p2 <- betree_NodeIdCounter_fresh_id node_id_cnt;
+  let (id0, nic) := p2 in
+  p3 <- betree_NodeIdCounter_fresh_id nic;
+  let (id1, nic1) := p3 in
+  p4 <- betree_store_leaf_node id0 content0 st;
+  let (st1, _) := p4 in
+  p5 <- betree_store_leaf_node id1 content1 st1;
+  let (st2, _) := p5 in
+  let n1 := Betree_Node_Leaf
     {|
       betree_Leaf_id := id0;
       betree_Leaf_size := params.(betree_Params_split_size)
     |} in
-  let n1 := Betree_Node_Leaf
+  let n2 := Betree_Node_Leaf
     {|
       betree_Leaf_id := id1;
       betree_Leaf_size := params.(betree_Params_split_size)
     |} in
-  Return (st1, mkbetree_Internal_t self.(betree_Leaf_id) pivot n0 n1)
+  Return (st2, (mkbetree_Internal_t self.(betree_Leaf_id) pivot n1 n2, nic1))
 .
 
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 2
-    Source: 'src/betree.rs', lines 359:4-364:17 *)
-Definition betree_Leaf_split_back
-  (n : nat) (self : betree_Leaf_t) (content : betree_List_t (u64 * u64))
-  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
-  (st : state) :
-  result betree_NodeIdCounter_t
-  :=
-  p <-
-    betree_List_split_at (u64 * u64) n content
-      params.(betree_Params_split_size);
-  let (content0, content1) := p in
-  _ <- betree_List_hd (u64 * u64) content1;
-  id0 <- betree_NodeIdCounter_fresh_id node_id_cnt;
-  node_id_cnt0 <- betree_NodeIdCounter_fresh_id_back node_id_cnt;
-  id1 <- betree_NodeIdCounter_fresh_id node_id_cnt0;
-  p0 <- betree_store_leaf_node id0 content0 st;
-  let (st0, _) := p0 in
-  _ <- betree_store_leaf_node id1 content1 st0;
-  betree_NodeIdCounter_fresh_id_back node_id_cnt0
-.
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]:
     Source: 'src/betree.rs', lines 789:4-792:34 *)
 Fixpoint betree_Node_lookup_first_message_for_key
   (n : nat) (key : u64) (msgs : betree_List_t (u64 * betree_Message_t)) :
-  result (betree_List_t (u64 * betree_Message_t))
+  result ((betree_List_t (u64 * betree_Message_t)) * (betree_List_t (u64 *
+    betree_Message_t) -> result (betree_List_t (u64 * betree_Message_t))))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    match msgs with
-    | Betree_List_Cons x next_msgs =>
-      let (i, m) := x in
-      if i s>= key
-      then Return (Betree_List_Cons (i, m) next_msgs)
-      else betree_Node_lookup_first_message_for_key n0 key next_msgs
-    | Betree_List_Nil => Return Betree_List_Nil
-    end
-  end
-.
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: backward function 0
-    Source: 'src/betree.rs', lines 789:4-792:34 *)
-Fixpoint betree_Node_lookup_first_message_for_key_back
-  (n : nat) (key : u64) (msgs : betree_List_t (u64 * betree_Message_t))
-  (ret : betree_List_t (u64 * betree_Message_t)) :
-  result (betree_List_t (u64 * betree_Message_t))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match msgs with
     | Betree_List_Cons x next_msgs =>
       let (i, m) := x in
       if i s>= key
-      then Return ret
+      then
+        let back_'a :=
+          fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
+        Return (Betree_List_Cons (i, m) next_msgs, back_'a)
       else (
-        next_msgs0 <-
-          betree_Node_lookup_first_message_for_key_back n0 key next_msgs ret;
-        Return (Betree_List_Cons (i, m) next_msgs0))
-    | Betree_List_Nil => Return ret
+        p <- betree_Node_lookup_first_message_for_key n1 key next_msgs;
+        let (l, lookup_first_message_for_key_back) := p in
+        let back_'a :=
+          fun (ret : betree_List_t (u64 * betree_Message_t)) =>
+            next_msgs1 <- lookup_first_message_for_key_back ret;
+            Return (Betree_List_Cons (i, m) next_msgs1) in
+        Return (l, back_'a))
+    | Betree_List_Nil =>
+      let back_'a :=
+        fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
+      Return (Betree_List_Nil, back_'a)
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
     Source: 'src/betree.rs', lines 636:4-636:80 *)
 Fixpoint betree_Node_lookup_in_bindings
   (n : nat) (key : u64) (bindings : betree_List_t (u64 * u64)) :
@@ -326,263 +270,146 @@ Fixpoint betree_Node_lookup_in_bindings
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match bindings with
     | Betree_List_Cons hd tl =>
-      let (i, i0) := hd in
+      let (i, i1) := hd in
       if i s= key
-      then Return (Some i0)
+      then Return (Some i1)
       else
         if i s> key
         then Return None
-        else betree_Node_lookup_in_bindings n0 key tl
+        else betree_Node_lookup_in_bindings n1 key tl
     | Betree_List_Nil => Return None
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]:
     Source: 'src/betree.rs', lines 819:4-819:90 *)
 Fixpoint betree_Node_apply_upserts
   (n : nat) (msgs : betree_List_t (u64 * betree_Message_t)) (prev : option u64)
   (key : u64) (st : state) :
-  result (state * u64)
+  result (state * (u64 * (betree_List_t (u64 * betree_Message_t))))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     b <- betree_ListTupleU64T_head_has_key betree_Message_t msgs key;
     if b
     then (
-      msg <- betree_List_pop_front (u64 * betree_Message_t) msgs;
+      p <- betree_List_pop_front (u64 * betree_Message_t) msgs;
+      let (msg, l) := p in
       let (_, m) := msg in
       match m with
-      | Betree_Message_Insert i => Fail_ Failure
+      | Betree_Message_Insert _ => Fail_ Failure
       | Betree_Message_Delete => Fail_ Failure
       | Betree_Message_Upsert s =>
         v <- betree_upsert_update prev s;
-        msgs0 <- betree_List_pop_front_back (u64 * betree_Message_t) msgs;
-        betree_Node_apply_upserts n0 msgs0 (Some v) key st
+        betree_Node_apply_upserts n1 l (Some v) key st
       end)
     else (
       p <- core_option_Option_unwrap u64 prev st;
-      let (st0, v) := p in
-      _ <-
+      let (st1, v) := p in
+      l <-
         betree_List_push_front (u64 * betree_Message_t) msgs (key,
           Betree_Message_Insert v);
-      Return (st0, v))
-  end
-.
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: backward function 0
-    Source: 'src/betree.rs', lines 819:4-819:90 *)
-Fixpoint betree_Node_apply_upserts_back
-  (n : nat) (msgs : betree_List_t (u64 * betree_Message_t)) (prev : option u64)
-  (key : u64) (st : state) :
-  result (betree_List_t (u64 * betree_Message_t))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    b <- betree_ListTupleU64T_head_has_key betree_Message_t msgs key;
-    if b
-    then (
-      msg <- betree_List_pop_front (u64 * betree_Message_t) msgs;
-      let (_, m) := msg in
-      match m with
-      | Betree_Message_Insert i => Fail_ Failure
-      | Betree_Message_Delete => Fail_ Failure
-      | Betree_Message_Upsert s =>
-        v <- betree_upsert_update prev s;
-        msgs0 <- betree_List_pop_front_back (u64 * betree_Message_t) msgs;
-        betree_Node_apply_upserts_back n0 msgs0 (Some v) key st
-      end)
-    else (
-      p <- core_option_Option_unwrap u64 prev st;
-      let (_, v) := p in
-      betree_List_push_front (u64 * betree_Message_t) msgs (key,
-        Betree_Message_Insert v))
+      Return (st1, (v, l)))
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: forward function
+(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]:
     Source: 'src/betree.rs', lines 395:4-395:63 *)
 Fixpoint betree_Internal_lookup_in_children
   (n : nat) (self : betree_Internal_t) (key : u64) (st : state) :
-  result (state * (option u64))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    if key s< self.(betree_Internal_pivot)
-    then betree_Node_lookup n0 self.(betree_Internal_left) key st
-    else betree_Node_lookup n0 self.(betree_Internal_right) key st
-  end
-
-(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: backward function 0
-    Source: 'src/betree.rs', lines 395:4-395:63 *)
-with betree_Internal_lookup_in_children_back
-  (n : nat) (self : betree_Internal_t) (key : u64) (st : state) :
-  result betree_Internal_t
+  result (state * ((option u64) * betree_Internal_t))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if key s< self.(betree_Internal_pivot)
     then (
-      n1 <- betree_Node_lookup_back n0 self.(betree_Internal_left) key st;
-      Return (mkbetree_Internal_t self.(betree_Internal_id)
-        self.(betree_Internal_pivot) n1 self.(betree_Internal_right)))
+      p <- betree_Node_lookup n1 self.(betree_Internal_left) key st;
+      let (st1, p1) := p in
+      let (o, n2) := p1 in
+      Return (st1, (o, mkbetree_Internal_t self.(betree_Internal_id)
+        self.(betree_Internal_pivot) n2 self.(betree_Internal_right))))
     else (
-      n1 <- betree_Node_lookup_back n0 self.(betree_Internal_right) key st;
-      Return (mkbetree_Internal_t self.(betree_Internal_id)
-        self.(betree_Internal_pivot) self.(betree_Internal_left) n1))
+      p <- betree_Node_lookup n1 self.(betree_Internal_right) key st;
+      let (st1, p1) := p in
+      let (o, n2) := p1 in
+      Return (st1, (o, mkbetree_Internal_t self.(betree_Internal_id)
+        self.(betree_Internal_pivot) self.(betree_Internal_left) n2)))
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]:
     Source: 'src/betree.rs', lines 709:4-709:58 *)
 with betree_Node_lookup
   (n : nat) (self : betree_Node_t) (key : u64) (st : state) :
-  result (state * (option u64))
+  result (state * ((option u64) * betree_Node_t))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    match self with
-    | Betree_Node_Internal node =>
-      p <- betree_load_internal_node node.(betree_Internal_id) st;
-      let (st0, msgs) := p in
-      pending <- betree_Node_lookup_first_message_for_key n0 key msgs;
-      match pending with
-      | Betree_List_Cons p0 l =>
-        let (k, msg) := p0 in
-        if k s<> key
-        then (
-          p1 <- betree_Internal_lookup_in_children n0 node key st0;
-          let (st1, o) := p1 in
-          _ <-
-            betree_Node_lookup_first_message_for_key_back n0 key msgs
-              (Betree_List_Cons (k, msg) l);
-          Return (st1, o))
-        else
-          match msg with
-          | Betree_Message_Insert v =>
-            _ <-
-              betree_Node_lookup_first_message_for_key_back n0 key msgs
-                (Betree_List_Cons (k, Betree_Message_Insert v) l);
-            Return (st0, Some v)
-          | Betree_Message_Delete =>
-            _ <-
-              betree_Node_lookup_first_message_for_key_back n0 key msgs
-                (Betree_List_Cons (k, Betree_Message_Delete) l);
-            Return (st0, None)
-          | Betree_Message_Upsert ufs =>
-            p1 <- betree_Internal_lookup_in_children n0 node key st0;
-            let (st1, v) := p1 in
-            p2 <-
-              betree_Node_apply_upserts n0 (Betree_List_Cons (k,
-                Betree_Message_Upsert ufs) l) v key st1;
-            let (st2, v0) := p2 in
-            node0 <- betree_Internal_lookup_in_children_back n0 node key st0;
-            pending0 <-
-              betree_Node_apply_upserts_back n0 (Betree_List_Cons (k,
-                Betree_Message_Upsert ufs) l) v key st1;
-            msgs0 <-
-              betree_Node_lookup_first_message_for_key_back n0 key msgs
-                pending0;
-            p3 <-
-              betree_store_internal_node node0.(betree_Internal_id) msgs0 st2;
-            let (st3, _) := p3 in
-            Return (st3, Some v0)
-          end
-      | Betree_List_Nil =>
-        p0 <- betree_Internal_lookup_in_children n0 node key st0;
-        let (st1, o) := p0 in
-        _ <-
-          betree_Node_lookup_first_message_for_key_back n0 key msgs
-            Betree_List_Nil;
-        Return (st1, o)
-      end
-    | Betree_Node_Leaf node =>
-      p <- betree_load_leaf_node node.(betree_Leaf_id) st;
-      let (st0, bindings) := p in
-      o <- betree_Node_lookup_in_bindings n0 key bindings;
-      Return (st0, o)
-    end
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: backward function 0
-    Source: 'src/betree.rs', lines 709:4-709:58 *)
-with betree_Node_lookup_back
-  (n : nat) (self : betree_Node_t) (key : u64) (st : state) :
-  result betree_Node_t
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match self with
     | Betree_Node_Internal node =>
       p <- betree_load_internal_node node.(betree_Internal_id) st;
-      let (st0, msgs) := p in
-      pending <- betree_Node_lookup_first_message_for_key n0 key msgs;
+      let (st1, msgs) := p in
+      p1 <- betree_Node_lookup_first_message_for_key n1 key msgs;
+      let (pending, lookup_first_message_for_key_back) := p1 in
       match pending with
-      | Betree_List_Cons p0 l =>
-        let (k, msg) := p0 in
+      | Betree_List_Cons p2 l =>
+        let (k, msg) := p2 in
         if k s<> key
         then (
-          _ <-
-            betree_Node_lookup_first_message_for_key_back n0 key msgs
-              (Betree_List_Cons (k, msg) l);
-          node0 <- betree_Internal_lookup_in_children_back n0 node key st0;
-          Return (Betree_Node_Internal node0))
+          p3 <- betree_Internal_lookup_in_children n1 node key st1;
+          let (st2, p4) := p3 in
+          let (o, i) := p4 in
+          _ <- lookup_first_message_for_key_back (Betree_List_Cons (k, msg) l);
+          Return (st2, (o, Betree_Node_Internal i)))
         else
           match msg with
           | Betree_Message_Insert v =>
             _ <-
-              betree_Node_lookup_first_message_for_key_back n0 key msgs
-                (Betree_List_Cons (k, Betree_Message_Insert v) l);
-            Return (Betree_Node_Internal node)
+              lookup_first_message_for_key_back (Betree_List_Cons (k,
+                Betree_Message_Insert v) l);
+            Return (st1, (Some v, Betree_Node_Internal node))
           | Betree_Message_Delete =>
             _ <-
-              betree_Node_lookup_first_message_for_key_back n0 key msgs
-                (Betree_List_Cons (k, Betree_Message_Delete) l);
-            Return (Betree_Node_Internal node)
+              lookup_first_message_for_key_back (Betree_List_Cons (k,
+                Betree_Message_Delete) l);
+            Return (st1, (None, Betree_Node_Internal node))
           | Betree_Message_Upsert ufs =>
-            p1 <- betree_Internal_lookup_in_children n0 node key st0;
-            let (st1, v) := p1 in
-            p2 <-
-              betree_Node_apply_upserts n0 (Betree_List_Cons (k,
-                Betree_Message_Upsert ufs) l) v key st1;
-            let (st2, _) := p2 in
-            node0 <- betree_Internal_lookup_in_children_back n0 node key st0;
-            pending0 <-
-              betree_Node_apply_upserts_back n0 (Betree_List_Cons (k,
-                Betree_Message_Upsert ufs) l) v key st1;
-            msgs0 <-
-              betree_Node_lookup_first_message_for_key_back n0 key msgs
-                pending0;
-            _ <-
-              betree_store_internal_node node0.(betree_Internal_id) msgs0 st2;
-            Return (Betree_Node_Internal node0)
+            p3 <- betree_Internal_lookup_in_children n1 node key st1;
+            let (st2, p4) := p3 in
+            let (v, i) := p4 in
+            p5 <-
+              betree_Node_apply_upserts n1 (Betree_List_Cons (k,
+                Betree_Message_Upsert ufs) l) v key st2;
+            let (st3, p6) := p5 in
+            let (v1, l1) := p6 in
+            msgs1 <- lookup_first_message_for_key_back l1;
+            p7 <- betree_store_internal_node i.(betree_Internal_id) msgs1 st3;
+            let (st4, _) := p7 in
+            Return (st4, (Some v1, Betree_Node_Internal i))
           end
       | Betree_List_Nil =>
-        _ <-
-          betree_Node_lookup_first_message_for_key_back n0 key msgs
-            Betree_List_Nil;
-        node0 <- betree_Internal_lookup_in_children_back n0 node key st0;
-        Return (Betree_Node_Internal node0)
+        p2 <- betree_Internal_lookup_in_children n1 node key st1;
+        let (st2, p3) := p2 in
+        let (o, i) := p3 in
+        _ <- lookup_first_message_for_key_back Betree_List_Nil;
+        Return (st2, (o, Betree_Node_Internal i))
       end
     | Betree_Node_Leaf node =>
       p <- betree_load_leaf_node node.(betree_Leaf_id) st;
-      let (_, bindings) := p in
-      _ <- betree_Node_lookup_in_bindings n0 key bindings;
-      Return (Betree_Node_Leaf node)
+      let (st1, bindings) := p in
+      o <- betree_Node_lookup_in_bindings n1 key bindings;
+      Return (st1, (o, Betree_Node_Leaf node))
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]:
     Source: 'src/betree.rs', lines 674:4-674:77 *)
 Fixpoint betree_Node_filter_messages_for_key
   (n : nat) (key : u64) (msgs : betree_List_t (u64 * betree_Message_t)) :
@@ -590,127 +417,118 @@ Fixpoint betree_Node_filter_messages_for_key
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match msgs with
     | Betree_List_Cons p l =>
       let (k, m) := p in
       if k s= key
       then (
-        msgs0 <-
-          betree_List_pop_front_back (u64 * betree_Message_t) (Betree_List_Cons
-            (k, m) l);
-        betree_Node_filter_messages_for_key n0 key msgs0)
+        p1 <-
+          betree_List_pop_front (u64 * betree_Message_t) (Betree_List_Cons (k,
+            m) l);
+        let (_, l1) := p1 in
+        betree_Node_filter_messages_for_key n1 key l1)
       else Return (Betree_List_Cons (k, m) l)
     | Betree_List_Nil => Return Betree_List_Nil
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]:
     Source: 'src/betree.rs', lines 689:4-692:34 *)
 Fixpoint betree_Node_lookup_first_message_after_key
   (n : nat) (key : u64) (msgs : betree_List_t (u64 * betree_Message_t)) :
-  result (betree_List_t (u64 * betree_Message_t))
+  result ((betree_List_t (u64 * betree_Message_t)) * (betree_List_t (u64 *
+    betree_Message_t) -> result (betree_List_t (u64 * betree_Message_t))))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    match msgs with
-    | Betree_List_Cons p next_msgs =>
-      let (k, m) := p in
-      if k s= key
-      then betree_Node_lookup_first_message_after_key n0 key next_msgs
-      else Return (Betree_List_Cons (k, m) next_msgs)
-    | Betree_List_Nil => Return Betree_List_Nil
-    end
-  end
-.
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: backward function 0
-    Source: 'src/betree.rs', lines 689:4-692:34 *)
-Fixpoint betree_Node_lookup_first_message_after_key_back
-  (n : nat) (key : u64) (msgs : betree_List_t (u64 * betree_Message_t))
-  (ret : betree_List_t (u64 * betree_Message_t)) :
-  result (betree_List_t (u64 * betree_Message_t))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match msgs with
     | Betree_List_Cons p next_msgs =>
       let (k, m) := p in
       if k s= key
       then (
-        next_msgs0 <-
-          betree_Node_lookup_first_message_after_key_back n0 key next_msgs ret;
-        Return (Betree_List_Cons (k, m) next_msgs0))
-      else Return ret
-    | Betree_List_Nil => Return ret
+        p1 <- betree_Node_lookup_first_message_after_key n1 key next_msgs;
+        let (l, lookup_first_message_after_key_back) := p1 in
+        let back_'a :=
+          fun (ret : betree_List_t (u64 * betree_Message_t)) =>
+            next_msgs1 <- lookup_first_message_after_key_back ret;
+            Return (Betree_List_Cons (k, m) next_msgs1) in
+        Return (l, back_'a))
+      else
+        let back_'a :=
+          fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
+        Return (Betree_List_Cons (k, m) next_msgs, back_'a)
+    | Betree_List_Nil =>
+      let back_'a :=
+        fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
+      Return (Betree_List_Nil, back_'a)
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
     Source: 'src/betree.rs', lines 521:4-521:89 *)
 Definition betree_Node_apply_to_internal
   (n : nat) (msgs : betree_List_t (u64 * betree_Message_t)) (key : u64)
   (new_msg : betree_Message_t) :
   result (betree_List_t (u64 * betree_Message_t))
   :=
-  msgs0 <- betree_Node_lookup_first_message_for_key n key msgs;
-  b <- betree_ListTupleU64T_head_has_key betree_Message_t msgs0 key;
+  p <- betree_Node_lookup_first_message_for_key n key msgs;
+  let (msgs1, lookup_first_message_for_key_back) := p in
+  b <- betree_ListTupleU64T_head_has_key betree_Message_t msgs1 key;
   if b
   then
     match new_msg with
     | Betree_Message_Insert i =>
-      msgs1 <- betree_Node_filter_messages_for_key n key msgs0;
-      msgs2 <-
-        betree_List_push_front (u64 * betree_Message_t) msgs1 (key,
+      l <- betree_Node_filter_messages_for_key n key msgs1;
+      l1 <-
+        betree_List_push_front (u64 * betree_Message_t) l (key,
           Betree_Message_Insert i);
-      betree_Node_lookup_first_message_for_key_back n key msgs msgs2
+      lookup_first_message_for_key_back l1
     | Betree_Message_Delete =>
-      msgs1 <- betree_Node_filter_messages_for_key n key msgs0;
-      msgs2 <-
-        betree_List_push_front (u64 * betree_Message_t) msgs1 (key,
+      l <- betree_Node_filter_messages_for_key n key msgs1;
+      l1 <-
+        betree_List_push_front (u64 * betree_Message_t) l (key,
           Betree_Message_Delete);
-      betree_Node_lookup_first_message_for_key_back n key msgs msgs2
+      lookup_first_message_for_key_back l1
     | Betree_Message_Upsert s =>
-      p <- betree_List_hd (u64 * betree_Message_t) msgs0;
-      let (_, m) := p in
+      p1 <- betree_List_hd (u64 * betree_Message_t) msgs1;
+      let (_, m) := p1 in
       match m with
       | Betree_Message_Insert prev =>
         v <- betree_upsert_update (Some prev) s;
-        msgs1 <- betree_List_pop_front_back (u64 * betree_Message_t) msgs0;
-        msgs2 <-
-          betree_List_push_front (u64 * betree_Message_t) msgs1 (key,
+        p2 <- betree_List_pop_front (u64 * betree_Message_t) msgs1;
+        let (_, l) := p2 in
+        l1 <-
+          betree_List_push_front (u64 * betree_Message_t) l (key,
             Betree_Message_Insert v);
-        betree_Node_lookup_first_message_for_key_back n key msgs msgs2
+        lookup_first_message_for_key_back l1
       | Betree_Message_Delete =>
+        p2 <- betree_List_pop_front (u64 * betree_Message_t) msgs1;
+        let (_, l) := p2 in
         v <- betree_upsert_update None s;
-        msgs1 <- betree_List_pop_front_back (u64 * betree_Message_t) msgs0;
-        msgs2 <-
-          betree_List_push_front (u64 * betree_Message_t) msgs1 (key,
+        l1 <-
+          betree_List_push_front (u64 * betree_Message_t) l (key,
             Betree_Message_Insert v);
-        betree_Node_lookup_first_message_for_key_back n key msgs msgs2
-      | Betree_Message_Upsert ufs =>
-        msgs1 <- betree_Node_lookup_first_message_after_key n key msgs0;
-        msgs2 <-
-          betree_List_push_front (u64 * betree_Message_t) msgs1 (key,
+        lookup_first_message_for_key_back l1
+      | Betree_Message_Upsert _ =>
+        p2 <- betree_Node_lookup_first_message_after_key n key msgs1;
+        let (msgs2, lookup_first_message_after_key_back) := p2 in
+        l <-
+          betree_List_push_front (u64 * betree_Message_t) msgs2 (key,
             Betree_Message_Upsert s);
-        msgs3 <-
-          betree_Node_lookup_first_message_after_key_back n key msgs0 msgs2;
-        betree_Node_lookup_first_message_for_key_back n key msgs msgs3
+        msgs3 <- lookup_first_message_after_key_back l;
+        lookup_first_message_for_key_back msgs3
       end
     end
   else (
-    msgs1 <-
-      betree_List_push_front (u64 * betree_Message_t) msgs0 (key, new_msg);
-    betree_Node_lookup_first_message_for_key_back n key msgs msgs1)
+    l <- betree_List_push_front (u64 * betree_Message_t) msgs1 (key, new_msg);
+    lookup_first_message_for_key_back l)
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]:
     Source: 'src/betree.rs', lines 502:4-505:5 *)
 Fixpoint betree_Node_apply_messages_to_internal
   (n : nat) (msgs : betree_List_t (u64 * betree_Message_t))
@@ -719,104 +537,88 @@ Fixpoint betree_Node_apply_messages_to_internal
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match new_msgs with
     | Betree_List_Cons new_msg new_msgs_tl =>
       let (i, m) := new_msg in
-      msgs0 <- betree_Node_apply_to_internal n0 msgs i m;
-      betree_Node_apply_messages_to_internal n0 msgs0 new_msgs_tl
+      l <- betree_Node_apply_to_internal n1 msgs i m;
+      betree_Node_apply_messages_to_internal n1 l new_msgs_tl
     | Betree_List_Nil => Return msgs
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]:
     Source: 'src/betree.rs', lines 653:4-656:32 *)
 Fixpoint betree_Node_lookup_mut_in_bindings
   (n : nat) (key : u64) (bindings : betree_List_t (u64 * u64)) :
-  result (betree_List_t (u64 * u64))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match bindings with
-    | Betree_List_Cons hd tl =>
-      let (i, i0) := hd in
-      if i s>= key
-      then Return (Betree_List_Cons (i, i0) tl)
-      else betree_Node_lookup_mut_in_bindings n0 key tl
-    | Betree_List_Nil => Return Betree_List_Nil
-    end
-  end
-.
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: backward function 0
-    Source: 'src/betree.rs', lines 653:4-656:32 *)
-Fixpoint betree_Node_lookup_mut_in_bindings_back
-  (n : nat) (key : u64) (bindings : betree_List_t (u64 * u64))
-  (ret : betree_List_t (u64 * u64)) :
-  result (betree_List_t (u64 * u64))
+  result ((betree_List_t (u64 * u64)) * (betree_List_t (u64 * u64) -> result
+    (betree_List_t (u64 * u64))))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match bindings with
     | Betree_List_Cons hd tl =>
-      let (i, i0) := hd in
+      let (i, i1) := hd in
       if i s>= key
-      then Return ret
+      then
+        let back_'a := fun (ret : betree_List_t (u64 * u64)) => Return ret in
+        Return (Betree_List_Cons (i, i1) tl, back_'a)
       else (
-        tl0 <- betree_Node_lookup_mut_in_bindings_back n0 key tl ret;
-        Return (Betree_List_Cons (i, i0) tl0))
-    | Betree_List_Nil => Return ret
+        p <- betree_Node_lookup_mut_in_bindings n1 key tl;
+        let (l, lookup_mut_in_bindings_back) := p in
+        let back_'a :=
+          fun (ret : betree_List_t (u64 * u64)) =>
+            tl1 <- lookup_mut_in_bindings_back ret;
+            Return (Betree_List_Cons (i, i1) tl1) in
+        Return (l, back_'a))
+    | Betree_List_Nil =>
+      let back_'a := fun (ret : betree_List_t (u64 * u64)) => Return ret in
+      Return (Betree_List_Nil, back_'a)
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
     Source: 'src/betree.rs', lines 460:4-460:87 *)
 Definition betree_Node_apply_to_leaf
   (n : nat) (bindings : betree_List_t (u64 * u64)) (key : u64)
   (new_msg : betree_Message_t) :
   result (betree_List_t (u64 * u64))
   :=
-  bindings0 <- betree_Node_lookup_mut_in_bindings n key bindings;
-  b <- betree_ListTupleU64T_head_has_key u64 bindings0 key;
+  p <- betree_Node_lookup_mut_in_bindings n key bindings;
+  let (bindings1, lookup_mut_in_bindings_back) := p in
+  b <- betree_ListTupleU64T_head_has_key u64 bindings1 key;
   if b
   then (
-    hd <- betree_List_pop_front (u64 * u64) bindings0;
+    p1 <- betree_List_pop_front (u64 * u64) bindings1;
+    let (hd, l) := p1 in
     match new_msg with
     | Betree_Message_Insert v =>
-      bindings1 <- betree_List_pop_front_back (u64 * u64) bindings0;
-      bindings2 <- betree_List_push_front (u64 * u64) bindings1 (key, v);
-      betree_Node_lookup_mut_in_bindings_back n key bindings bindings2
-    | Betree_Message_Delete =>
-      bindings1 <- betree_List_pop_front_back (u64 * u64) bindings0;
-      betree_Node_lookup_mut_in_bindings_back n key bindings bindings1
+      l1 <- betree_List_push_front (u64 * u64) l (key, v);
+      lookup_mut_in_bindings_back l1
+    | Betree_Message_Delete => lookup_mut_in_bindings_back l
     | Betree_Message_Upsert s =>
       let (_, i) := hd in
       v <- betree_upsert_update (Some i) s;
-      bindings1 <- betree_List_pop_front_back (u64 * u64) bindings0;
-      bindings2 <- betree_List_push_front (u64 * u64) bindings1 (key, v);
-      betree_Node_lookup_mut_in_bindings_back n key bindings bindings2
+      l1 <- betree_List_push_front (u64 * u64) l (key, v);
+      lookup_mut_in_bindings_back l1
     end)
   else
     match new_msg with
     | Betree_Message_Insert v =>
-      bindings1 <- betree_List_push_front (u64 * u64) bindings0 (key, v);
-      betree_Node_lookup_mut_in_bindings_back n key bindings bindings1
-    | Betree_Message_Delete =>
-      betree_Node_lookup_mut_in_bindings_back n key bindings bindings0
+      l <- betree_List_push_front (u64 * u64) bindings1 (key, v);
+      lookup_mut_in_bindings_back l
+    | Betree_Message_Delete => lookup_mut_in_bindings_back bindings1
     | Betree_Message_Upsert s =>
       v <- betree_upsert_update None s;
-      bindings1 <- betree_List_push_front (u64 * u64) bindings0 (key, v);
-      betree_Node_lookup_mut_in_bindings_back n key bindings bindings1
+      l <- betree_List_push_front (u64 * u64) bindings1 (key, v);
+      lookup_mut_in_bindings_back l
     end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]:
     Source: 'src/betree.rs', lines 444:4-447:5 *)
 Fixpoint betree_Node_apply_messages_to_leaf
   (n : nat) (bindings : betree_List_t (u64 * u64))
@@ -825,404 +627,230 @@ Fixpoint betree_Node_apply_messages_to_leaf
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match new_msgs with
     | Betree_List_Cons new_msg new_msgs_tl =>
       let (i, m) := new_msg in
-      bindings0 <- betree_Node_apply_to_leaf n0 bindings i m;
-      betree_Node_apply_messages_to_leaf n0 bindings0 new_msgs_tl
+      l <- betree_Node_apply_to_leaf n1 bindings i m;
+      betree_Node_apply_messages_to_leaf n1 l new_msgs_tl
     | Betree_List_Nil => Return bindings
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: forward function
+(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]:
     Source: 'src/betree.rs', lines 410:4-415:26 *)
 Fixpoint betree_Internal_flush
   (n : nat) (self : betree_Internal_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t)
   (content : betree_List_t (u64 * betree_Message_t)) (st : state) :
-  result (state * (betree_List_t (u64 * betree_Message_t)))
+  result (state * ((betree_List_t (u64 * betree_Message_t)) *
+    (betree_Internal_t * betree_NodeIdCounter_t)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    p <-
-      betree_ListTupleU64T_partition_at_pivot betree_Message_t n0 content
-        self.(betree_Internal_pivot);
-    let (msgs_left, msgs_right) := p in
-    len_left <- betree_List_len (u64 * betree_Message_t) n0 msgs_left;
-    if len_left s>= params.(betree_Params_min_flush_size)
-    then (
-      p0 <-
-        betree_Node_apply_messages n0 self.(betree_Internal_left) params
-          node_id_cnt msgs_left st;
-      let (st0, _) := p0 in
-      p1 <-
-        betree_Node_apply_messages_back n0 self.(betree_Internal_left) params
-          node_id_cnt msgs_left st;
-      let (_, node_id_cnt0) := p1 in
-      len_right <- betree_List_len (u64 * betree_Message_t) n0 msgs_right;
-      if len_right s>= params.(betree_Params_min_flush_size)
-      then (
-        p2 <-
-          betree_Node_apply_messages n0 self.(betree_Internal_right) params
-            node_id_cnt0 msgs_right st0;
-        let (st1, _) := p2 in
-        _ <-
-          betree_Node_apply_messages_back n0 self.(betree_Internal_right)
-            params node_id_cnt0 msgs_right st0;
-        Return (st1, Betree_List_Nil))
-      else Return (st0, msgs_right))
-    else (
-      p0 <-
-        betree_Node_apply_messages n0 self.(betree_Internal_right) params
-          node_id_cnt msgs_right st;
-      let (st0, _) := p0 in
-      _ <-
-        betree_Node_apply_messages_back n0 self.(betree_Internal_right) params
-          node_id_cnt msgs_right st;
-      Return (st0, msgs_left))
-  end
-
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: backward function 0
-    Source: 'src/betree.rs', lines 410:4-415:26 *)
-with betree_Internal_flush_back
-  (n : nat) (self : betree_Internal_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (content : betree_List_t (u64 * betree_Message_t)) (st : state) :
-  result (betree_Internal_t * betree_NodeIdCounter_t)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     p <-
-      betree_ListTupleU64T_partition_at_pivot betree_Message_t n0 content
+      betree_ListTupleU64T_partition_at_pivot betree_Message_t n1 content
         self.(betree_Internal_pivot);
     let (msgs_left, msgs_right) := p in
-    len_left <- betree_List_len (u64 * betree_Message_t) n0 msgs_left;
+    len_left <- betree_List_len (u64 * betree_Message_t) n1 msgs_left;
     if len_left s>= params.(betree_Params_min_flush_size)
     then (
-      p0 <-
-        betree_Node_apply_messages n0 self.(betree_Internal_left) params
-          node_id_cnt msgs_left st;
-      let (st0, _) := p0 in
       p1 <-
-        betree_Node_apply_messages_back n0 self.(betree_Internal_left) params
+        betree_Node_apply_messages n1 self.(betree_Internal_left) params
           node_id_cnt msgs_left st;
-      let (n1, node_id_cnt0) := p1 in
-      len_right <- betree_List_len (u64 * betree_Message_t) n0 msgs_right;
+      let (st1, p2) := p1 in
+      let (n2, node_id_cnt1) := p2 in
+      len_right <- betree_List_len (u64 * betree_Message_t) n1 msgs_right;
       if len_right s>= params.(betree_Params_min_flush_size)
       then (
-        p2 <-
-          betree_Node_apply_messages_back n0 self.(betree_Internal_right)
-            params node_id_cnt0 msgs_right st0;
-        let (n2, node_id_cnt1) := p2 in
-        Return (mkbetree_Internal_t self.(betree_Internal_id)
-          self.(betree_Internal_pivot) n1 n2, node_id_cnt1))
+        p3 <-
+          betree_Node_apply_messages n1 self.(betree_Internal_right) params
+            node_id_cnt1 msgs_right st1;
+        let (st2, p4) := p3 in
+        let (n3, node_id_cnt2) := p4 in
+        Return (st2, (Betree_List_Nil, (mkbetree_Internal_t
+          self.(betree_Internal_id) self.(betree_Internal_pivot) n2 n3,
+          node_id_cnt2))))
       else
-        Return (mkbetree_Internal_t self.(betree_Internal_id)
-          self.(betree_Internal_pivot) n1 self.(betree_Internal_right),
-          node_id_cnt0))
+        Return (st1, (msgs_right, (mkbetree_Internal_t
+          self.(betree_Internal_id) self.(betree_Internal_pivot) n2
+          self.(betree_Internal_right), node_id_cnt1))))
     else (
-      p0 <-
-        betree_Node_apply_messages_back n0 self.(betree_Internal_right) params
+      p1 <-
+        betree_Node_apply_messages n1 self.(betree_Internal_right) params
           node_id_cnt msgs_right st;
-      let (n1, node_id_cnt0) := p0 in
-      Return (mkbetree_Internal_t self.(betree_Internal_id)
-        self.(betree_Internal_pivot) self.(betree_Internal_left) n1,
-        node_id_cnt0))
+      let (st1, p2) := p1 in
+      let (n2, node_id_cnt1) := p2 in
+      Return (st1, (msgs_left, (mkbetree_Internal_t self.(betree_Internal_id)
+        self.(betree_Internal_pivot) self.(betree_Internal_left) n2,
+        node_id_cnt1))))
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]:
     Source: 'src/betree.rs', lines 588:4-593:5 *)
 with betree_Node_apply_messages
   (n : nat) (self : betree_Node_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t)
   (msgs : betree_List_t (u64 * betree_Message_t)) (st : state) :
-  result (state * unit)
+  result (state * (betree_Node_t * betree_NodeIdCounter_t))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match self with
     | Betree_Node_Internal node =>
       p <- betree_load_internal_node node.(betree_Internal_id) st;
-      let (st0, content) := p in
-      content0 <- betree_Node_apply_messages_to_internal n0 content msgs;
-      num_msgs <- betree_List_len (u64 * betree_Message_t) n0 content0;
+      let (st1, content) := p in
+      l <- betree_Node_apply_messages_to_internal n1 content msgs;
+      num_msgs <- betree_List_len (u64 * betree_Message_t) n1 l;
       if num_msgs s>= params.(betree_Params_min_flush_size)
       then (
-        p0 <- betree_Internal_flush n0 node params node_id_cnt content0 st0;
-        let (st1, content1) := p0 in
-        p1 <-
-          betree_Internal_flush_back n0 node params node_id_cnt content0 st0;
-        let (node0, _) := p1 in
-        p2 <-
-          betree_store_internal_node node0.(betree_Internal_id) content1 st1;
-        let (st2, _) := p2 in
-        Return (st2, tt))
+        p1 <- betree_Internal_flush n1 node params node_id_cnt l st1;
+        let (st2, p2) := p1 in
+        let (content1, p3) := p2 in
+        let (node1, node_id_cnt1) := p3 in
+        p4 <-
+          betree_store_internal_node node1.(betree_Internal_id) content1 st2;
+        let (st3, _) := p4 in
+        Return (st3, (Betree_Node_Internal node1, node_id_cnt1)))
       else (
-        p0 <-
-          betree_store_internal_node node.(betree_Internal_id) content0 st0;
-        let (st1, _) := p0 in
-        Return (st1, tt))
-    | Betree_Node_Leaf node =>
-      p <- betree_load_leaf_node node.(betree_Leaf_id) st;
-      let (st0, content) := p in
-      content0 <- betree_Node_apply_messages_to_leaf n0 content msgs;
-      len <- betree_List_len (u64 * u64) n0 content0;
-      i <- u64_mul 2%u64 params.(betree_Params_split_size);
-      if len s>= i
-      then (
-        p0 <- betree_Leaf_split n0 node content0 params node_id_cnt st0;
-        let (st1, _) := p0 in
-        p1 <- betree_store_leaf_node node.(betree_Leaf_id) Betree_List_Nil st1;
+        p1 <- betree_store_internal_node node.(betree_Internal_id) l st1;
         let (st2, _) := p1 in
-        Return (st2, tt))
-      else (
-        p0 <- betree_store_leaf_node node.(betree_Leaf_id) content0 st0;
-        let (st1, _) := p0 in
-        Return (st1, tt))
-    end
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: backward function 0
-    Source: 'src/betree.rs', lines 588:4-593:5 *)
-with betree_Node_apply_messages_back
-  (n : nat) (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (msgs : betree_List_t (u64 * betree_Message_t)) (st : state) :
-  result (betree_Node_t * betree_NodeIdCounter_t)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match self with
-    | Betree_Node_Internal node =>
-      p <- betree_load_internal_node node.(betree_Internal_id) st;
-      let (st0, content) := p in
-      content0 <- betree_Node_apply_messages_to_internal n0 content msgs;
-      num_msgs <- betree_List_len (u64 * betree_Message_t) n0 content0;
-      if num_msgs s>= params.(betree_Params_min_flush_size)
-      then (
-        p0 <- betree_Internal_flush n0 node params node_id_cnt content0 st0;
-        let (st1, content1) := p0 in
-        p1 <-
-          betree_Internal_flush_back n0 node params node_id_cnt content0 st0;
-        let (node0, node_id_cnt0) := p1 in
-        _ <-
-          betree_store_internal_node node0.(betree_Internal_id) content1 st1;
-        Return (Betree_Node_Internal node0, node_id_cnt0))
-      else (
-        _ <- betree_store_internal_node node.(betree_Internal_id) content0 st0;
-        Return (Betree_Node_Internal node, node_id_cnt))
+        Return (st2, (Betree_Node_Internal node, node_id_cnt)))
     | Betree_Node_Leaf node =>
       p <- betree_load_leaf_node node.(betree_Leaf_id) st;
-      let (st0, content) := p in
-      content0 <- betree_Node_apply_messages_to_leaf n0 content msgs;
-      len <- betree_List_len (u64 * u64) n0 content0;
+      let (st1, content) := p in
+      l <- betree_Node_apply_messages_to_leaf n1 content msgs;
+      len <- betree_List_len (u64 * u64) n1 l;
       i <- u64_mul 2%u64 params.(betree_Params_split_size);
       if len s>= i
       then (
-        p0 <- betree_Leaf_split n0 node content0 params node_id_cnt st0;
-        let (st1, new_node) := p0 in
-        _ <- betree_store_leaf_node node.(betree_Leaf_id) Betree_List_Nil st1;
-        node_id_cnt0 <-
-          betree_Leaf_split_back n0 node content0 params node_id_cnt st0;
-        Return (Betree_Node_Internal new_node, node_id_cnt0))
+        p1 <- betree_Leaf_split n1 node l params node_id_cnt st1;
+        let (st2, p2) := p1 in
+        let (new_node, nic) := p2 in
+        p3 <- betree_store_leaf_node node.(betree_Leaf_id) Betree_List_Nil st2;
+        let (st3, _) := p3 in
+        Return (st3, (Betree_Node_Internal new_node, nic)))
       else (
-        _ <- betree_store_leaf_node node.(betree_Leaf_id) content0 st0;
-        Return (Betree_Node_Leaf
+        p1 <- betree_store_leaf_node node.(betree_Leaf_id) l st1;
+        let (st2, _) := p1 in
+        Return (st2, (Betree_Node_Leaf
           {| betree_Leaf_id := node.(betree_Leaf_id); betree_Leaf_size := len
-          |}, node_id_cnt))
+          |}, node_id_cnt)))
     end
   end
 .
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply]:
     Source: 'src/betree.rs', lines 576:4-582:5 *)
 Definition betree_Node_apply
   (n : nat) (self : betree_Node_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
   (new_msg : betree_Message_t) (st : state) :
-  result (state * unit)
+  result (state * (betree_Node_t * betree_NodeIdCounter_t))
   :=
   let l := Betree_List_Nil in
   p <-
     betree_Node_apply_messages n self params node_id_cnt (Betree_List_Cons
       (key, new_msg) l) st;
-  let (st0, _) := p in
-  _ <-
-    betree_Node_apply_messages_back n self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st;
-  Return (st0, tt)
-.
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 0
-    Source: 'src/betree.rs', lines 576:4-582:5 *)
-Definition betree_Node_apply_back
-  (n : nat) (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
-  (new_msg : betree_Message_t) (st : state) :
-  result (betree_Node_t * betree_NodeIdCounter_t)
-  :=
-  let l := Betree_List_Nil in
-  betree_Node_apply_messages_back n self params node_id_cnt (Betree_List_Cons
-    (key, new_msg) l) st
+  let (st1, p1) := p in
+  let (self1, node_id_cnt1) := p1 in
+  Return (st1, (self1, node_id_cnt1))
 .
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]:
     Source: 'src/betree.rs', lines 849:4-849:60 *)
 Definition betree_BeTree_new
   (min_flush_size : u64) (split_size : u64) (st : state) :
   result (state * betree_BeTree_t)
   :=
   node_id_cnt <- betree_NodeIdCounter_new;
-  id <- betree_NodeIdCounter_fresh_id node_id_cnt;
-  p <- betree_store_leaf_node id Betree_List_Nil st;
-  let (st0, _) := p in
-  node_id_cnt0 <- betree_NodeIdCounter_fresh_id_back node_id_cnt;
-  Return (st0,
+  p <- betree_NodeIdCounter_fresh_id node_id_cnt;
+  let (id, nic) := p in
+  p1 <- betree_store_leaf_node id Betree_List_Nil st;
+  let (st1, _) := p1 in
+  Return (st1,
     {|
       betree_BeTree_params :=
         {|
           betree_Params_min_flush_size := min_flush_size;
           betree_Params_split_size := split_size
         |};
-      betree_BeTree_node_id_cnt := node_id_cnt0;
+      betree_BeTree_node_id_cnt := nic;
       betree_BeTree_root :=
         (Betree_Node_Leaf
           {| betree_Leaf_id := id; betree_Leaf_size := 0%u64 |})
     |})
 .
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]:
     Source: 'src/betree.rs', lines 868:4-868:47 *)
 Definition betree_BeTree_apply
   (n : nat) (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t)
   (st : state) :
-  result (state * unit)
+  result (state * betree_BeTree_t)
   :=
   p <-
     betree_Node_apply n self.(betree_BeTree_root) self.(betree_BeTree_params)
       self.(betree_BeTree_node_id_cnt) key msg st;
-  let (st0, _) := p in
-  _ <-
-    betree_Node_apply_back n self.(betree_BeTree_root)
-      self.(betree_BeTree_params) self.(betree_BeTree_node_id_cnt) key msg st;
-  Return (st0, tt)
-.
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: backward function 0
-    Source: 'src/betree.rs', lines 868:4-868:47 *)
-Definition betree_BeTree_apply_back
-  (n : nat) (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t)
-  (st : state) :
-  result betree_BeTree_t
-  :=
-  p <-
-    betree_Node_apply_back n self.(betree_BeTree_root)
-      self.(betree_BeTree_params) self.(betree_BeTree_node_id_cnt) key msg st;
-  let (n0, nic) := p in
-  Return
+  let (st1, p1) := p in
+  let (n1, nic) := p1 in
+  Return (st1,
     {|
       betree_BeTree_params := self.(betree_BeTree_params);
       betree_BeTree_node_id_cnt := nic;
-      betree_BeTree_root := n0
-    |}
+      betree_BeTree_root := n1
+    |})
 .
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]:
     Source: 'src/betree.rs', lines 874:4-874:52 *)
 Definition betree_BeTree_insert
   (n : nat) (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
-  result (state * unit)
-  :=
-  p <- betree_BeTree_apply n self key (Betree_Message_Insert value) st;
-  let (st0, _) := p in
-  _ <- betree_BeTree_apply_back n self key (Betree_Message_Insert value) st;
-  Return (st0, tt)
-.
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: backward function 0
-    Source: 'src/betree.rs', lines 874:4-874:52 *)
-Definition betree_BeTree_insert_back
-  (n : nat) (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
-  result betree_BeTree_t
+  result (state * betree_BeTree_t)
   :=
-  betree_BeTree_apply_back n self key (Betree_Message_Insert value) st
+  betree_BeTree_apply n self key (Betree_Message_Insert value) st
 .
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]:
     Source: 'src/betree.rs', lines 880:4-880:38 *)
 Definition betree_BeTree_delete
   (n : nat) (self : betree_BeTree_t) (key : u64) (st : state) :
-  result (state * unit)
-  :=
-  p <- betree_BeTree_apply n self key Betree_Message_Delete st;
-  let (st0, _) := p in
-  _ <- betree_BeTree_apply_back n self key Betree_Message_Delete st;
-  Return (st0, tt)
-.
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: backward function 0
-    Source: 'src/betree.rs', lines 880:4-880:38 *)
-Definition betree_BeTree_delete_back
-  (n : nat) (self : betree_BeTree_t) (key : u64) (st : state) :
-  result betree_BeTree_t
+  result (state * betree_BeTree_t)
   :=
-  betree_BeTree_apply_back n self key Betree_Message_Delete st
+  betree_BeTree_apply n self key Betree_Message_Delete st
 .
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]:
     Source: 'src/betree.rs', lines 886:4-886:59 *)
 Definition betree_BeTree_upsert
   (n : nat) (self : betree_BeTree_t) (key : u64)
   (upd : betree_UpsertFunState_t) (st : state) :
-  result (state * unit)
-  :=
-  p <- betree_BeTree_apply n self key (Betree_Message_Upsert upd) st;
-  let (st0, _) := p in
-  _ <- betree_BeTree_apply_back n self key (Betree_Message_Upsert upd) st;
-  Return (st0, tt)
-.
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: backward function 0
-    Source: 'src/betree.rs', lines 886:4-886:59 *)
-Definition betree_BeTree_upsert_back
-  (n : nat) (self : betree_BeTree_t) (key : u64)
-  (upd : betree_UpsertFunState_t) (st : state) :
-  result betree_BeTree_t
+  result (state * betree_BeTree_t)
   :=
-  betree_BeTree_apply_back n self key (Betree_Message_Upsert upd) st
+  betree_BeTree_apply n self key (Betree_Message_Upsert upd) st
 .
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]:
     Source: 'src/betree.rs', lines 895:4-895:62 *)
 Definition betree_BeTree_lookup
   (n : nat) (self : betree_BeTree_t) (key : u64) (st : state) :
-  result (state * (option u64))
-  :=
-  betree_Node_lookup n self.(betree_BeTree_root) key st
-.
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: backward function 0
-    Source: 'src/betree.rs', lines 895:4-895:62 *)
-Definition betree_BeTree_lookup_back
-  (n : nat) (self : betree_BeTree_t) (key : u64) (st : state) :
-  result betree_BeTree_t
+  result (state * ((option u64) * betree_BeTree_t))
   :=
-  n0 <- betree_Node_lookup_back n self.(betree_BeTree_root) key st;
-  Return
+  p <- betree_Node_lookup n self.(betree_BeTree_root) key st;
+  let (st1, p1) := p in
+  let (o, n1) := p1 in
+  Return (st1, (o,
     {|
       betree_BeTree_params := self.(betree_BeTree_params);
       betree_BeTree_node_id_cnt := self.(betree_BeTree_node_id_cnt);
-      betree_BeTree_root := n0
-    |}
+      betree_BeTree_root := n1
+    |}))
 .
 
-(** [betree_main::main]: forward function
+(** [betree_main::main]:
     Source: 'src/betree_main.rs', lines 5:0-5:9 *)
 Definition main : result unit :=
   Return tt.
diff --git a/tests/coq/betree/BetreeMain_FunsExternal_Template.v b/tests/coq/betree/BetreeMain_FunsExternal_Template.v
index 36022a20..a9969448 100644
--- a/tests/coq/betree/BetreeMain_FunsExternal_Template.v
+++ b/tests/coq/betree/BetreeMain_FunsExternal_Template.v
@@ -11,13 +11,13 @@ Require Import BetreeMain_Types.
 Include BetreeMain_Types.
 Module BetreeMain_FunsExternal_Template.
 
-(** [betree_main::betree_utils::load_internal_node]: forward function
+(** [betree_main::betree_utils::load_internal_node]:
     Source: 'src/betree_utils.rs', lines 98:0-98:63 *)
 Axiom betree_utils_load_internal_node
   : u64 -> state -> result (state * (betree_List_t (u64 * betree_Message_t)))
 .
 
-(** [betree_main::betree_utils::store_internal_node]: forward function
+(** [betree_main::betree_utils::store_internal_node]:
     Source: 'src/betree_utils.rs', lines 115:0-115:71 *)
 Axiom betree_utils_store_internal_node
   :
@@ -25,19 +25,19 @@ Axiom betree_utils_store_internal_node
     unit)
 .
 
-(** [betree_main::betree_utils::load_leaf_node]: forward function
+(** [betree_main::betree_utils::load_leaf_node]:
     Source: 'src/betree_utils.rs', lines 132:0-132:55 *)
 Axiom betree_utils_load_leaf_node
   : u64 -> state -> result (state * (betree_List_t (u64 * u64)))
 .
 
-(** [betree_main::betree_utils::store_leaf_node]: forward function
+(** [betree_main::betree_utils::store_leaf_node]:
     Source: 'src/betree_utils.rs', lines 145:0-145:63 *)
 Axiom betree_utils_store_leaf_node
   : u64 -> betree_List_t (u64 * u64) -> state -> result (state * unit)
 .
 
-(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+(** [core::option::{core::option::Option<T>}::unwrap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
 Axiom core_option_Option_unwrap :
   forall(T : Type), option T -> state -> result (state * T)
diff --git a/tests/coq/betree/BetreeMain_Types.v b/tests/coq/betree/BetreeMain_Types.v
index 22989256..acbc2085 100644
--- a/tests/coq/betree/BetreeMain_Types.v
+++ b/tests/coq/betree/BetreeMain_Types.v
@@ -61,31 +61,31 @@ with betree_Node_t :=
 .
 
 Definition betree_Internal_id (x : betree_Internal_t) :=
-  match x with | mkbetree_Internal_t x0 _ _ _ => x0 end
+  match x with | mkbetree_Internal_t x1 _ _ _ => x1 end
 .
 
-Notation "x1 .(betree_Internal_id)" := (betree_Internal_id x1) (at level 9).
+Notation "x2 .(betree_Internal_id)" := (betree_Internal_id x2) (at level 9).
 
 Definition betree_Internal_pivot (x : betree_Internal_t) :=
-  match x with | mkbetree_Internal_t _ x0 _ _ => x0 end
+  match x with | mkbetree_Internal_t _ x1 _ _ => x1 end
 .
 
-Notation "x1 .(betree_Internal_pivot)" := (betree_Internal_pivot x1)
+Notation "x2 .(betree_Internal_pivot)" := (betree_Internal_pivot x2)
   (at level 9)
 .
 
 Definition betree_Internal_left (x : betree_Internal_t) :=
-  match x with | mkbetree_Internal_t _ _ x0 _ => x0 end
+  match x with | mkbetree_Internal_t _ _ x1 _ => x1 end
 .
 
-Notation "x1 .(betree_Internal_left)" := (betree_Internal_left x1) (at level 9)
+Notation "x2 .(betree_Internal_left)" := (betree_Internal_left x2) (at level 9)
 .
 
 Definition betree_Internal_right (x : betree_Internal_t) :=
-  match x with | mkbetree_Internal_t _ _ _ x0 => x0 end
+  match x with | mkbetree_Internal_t _ _ _ x1 => x1 end
 .
 
-Notation "x1 .(betree_Internal_right)" := (betree_Internal_right x1)
+Notation "x2 .(betree_Internal_right)" := (betree_Internal_right x2)
   (at level 9)
 .
 
diff --git a/tests/coq/betree/Primitives.v b/tests/coq/betree/Primitives.v
index 84280b96..990e27e4 100644
--- a/tests/coq/betree/Primitives.v
+++ b/tests/coq/betree/Primitives.v
@@ -67,8 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a := x .
-Definition core_mem_replace_back (a : Type) (x : a) (y : a) : a := y .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -504,13 +503,15 @@ Arguments core_ops_index_Index_index {_ _}.
 (* Trait declaration: [core::ops::index::IndexMut] *)
 Record core_ops_index_IndexMut (Self Idx : Type) := mk_core_ops_index_IndexMut {
   core_ops_index_IndexMut_indexInst : core_ops_index_Index Self Idx;
-  core_ops_index_IndexMut_index_mut : Self -> Idx -> result core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output);
-  core_ops_index_IndexMut_index_mut_back : Self -> Idx -> core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self;
+  core_ops_index_IndexMut_index_mut :
+    Self ->
+    Idx ->
+    result (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) *
+            (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self));
 }.
 Arguments mk_core_ops_index_IndexMut {_ _}.
 Arguments core_ops_index_IndexMut_indexInst {_ _}.
 Arguments core_ops_index_IndexMut_index_mut {_ _}.
-Arguments core_ops_index_IndexMut_index_mut_back {_ _}.
 
 (* Trait declaration [core::ops::deref::Deref] *)
 Record core_ops_deref_Deref (Self : Type) := mk_core_ops_deref_Deref {
@@ -524,13 +525,14 @@ Arguments core_ops_deref_Deref_deref {_}.
 (* Trait declaration [core::ops::deref::DerefMut] *)
 Record core_ops_deref_DerefMut (Self : Type) := mk_core_ops_deref_DerefMut {
   core_ops_deref_DerefMut_derefInst : core_ops_deref_Deref Self;
-  core_ops_deref_DerefMut_deref_mut : Self -> result core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target);
-  core_ops_deref_DerefMut_deref_mut_back : Self -> core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self;
+  core_ops_deref_DerefMut_deref_mut :
+    Self ->
+    result (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) *
+            (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self));
 }.
 Arguments mk_core_ops_deref_DerefMut {_}.
 Arguments core_ops_deref_DerefMut_derefInst {_}.
 Arguments core_ops_deref_DerefMut_deref_mut {_}.
-Arguments core_ops_deref_DerefMut_deref_mut_back {_}.
 
 Record core_ops_range_Range (T : Type) := mk_core_ops_range_Range {
   core_ops_range_Range_start : T;
@@ -543,8 +545,8 @@ Arguments core_ops_range_Range_end_ {_}.
 (*** [alloc] *)
 
 Definition alloc_boxed_Box_deref (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut_back (T : Type) (_ : T) (x : T) : result T := Return x.
+Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result (T * (T -> result T)) :=
+  Return (x, fun x => Return x).
 
 (* Trait instance *)
 Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref Self := {|
@@ -556,7 +558,6 @@ Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref
 Definition alloc_boxed_Box_coreopsDerefMutInst (Self : Type) : core_ops_deref_DerefMut Self := {|
   core_ops_deref_DerefMut_derefInst := alloc_boxed_Box_coreopsDerefInst Self;
   core_ops_deref_DerefMut_deref_mut := alloc_boxed_Box_deref_mut Self;
-  core_ops_deref_DerefMut_deref_mut_back := alloc_boxed_Box_deref_mut_back Self;
 |}.
 
 
@@ -584,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -591,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
@@ -639,16 +661,9 @@ Definition alloc_vec_Vec_bind {A B} (v: alloc_vec_Vec A) (f: list A -> result (l
   | right _ => Fail_ Failure
   end.
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_push_fwd (T: Type) (v: alloc_vec_Vec T) (x: T) : unit := tt.
-
 Definition alloc_vec_Vec_push (T: Type) (v: alloc_vec_Vec T) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l => Return (l ++ [x])).
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_insert_fwd (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result unit :=
-  if to_Z i <? alloc_vec_Vec_length v then Return tt else Fail_ Failure.
-
 Definition alloc_vec_Vec_insert (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l =>
     if to_Z i <? Z.of_nat (length l)
@@ -661,6 +676,14 @@ Axiom alloc_vec_Vec_index_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : u
 (* Helper *)
 Axiom alloc_vec_Vec_update_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : usize) (x : T), result (alloc_vec_Vec T).
 
+Definition alloc_vec_Vec_index_mut_usize {T : Type} (v: alloc_vec_Vec T) (i: usize) :
+  result (T * (T -> result (alloc_vec_Vec T))) :=
+  match alloc_vec_Vec_index_usize v i with
+  | Return x =>
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail_ e => Fail_ e
+  end.
+
 (* Trait declaration: [core::slice::index::private_slice_index::Sealed] *)
 Definition core_slice_index_private_slice_index_Sealed (self : Type) := unit.
 
@@ -669,25 +692,23 @@ Record core_slice_index_SliceIndex (Self T : Type) := mk_core_slice_index_SliceI
   core_slice_index_SliceIndex_sealedInst : core_slice_index_private_slice_index_Sealed Self;
   core_slice_index_SliceIndex_Output : Type;
   core_slice_index_SliceIndex_get : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut_back : Self -> T -> option core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_get_mut :
+    Self -> T -> result (option core_slice_index_SliceIndex_Output * (option core_slice_index_SliceIndex_Output -> result T));
   core_slice_index_SliceIndex_get_unchecked : Self -> const_raw_ptr T -> result (const_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_get_unchecked_mut : Self -> mut_raw_ptr T -> result (mut_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_index : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut_back : Self -> T -> core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_index_mut :
+    Self -> T -> result (core_slice_index_SliceIndex_Output * (core_slice_index_SliceIndex_Output -> result T));
 }.
 Arguments mk_core_slice_index_SliceIndex {_ _}.
 Arguments core_slice_index_SliceIndex_sealedInst {_ _}.
 Arguments core_slice_index_SliceIndex_Output {_ _}.
 Arguments core_slice_index_SliceIndex_get {_ _}.
 Arguments core_slice_index_SliceIndex_get_mut {_ _}.
-Arguments core_slice_index_SliceIndex_get_mut_back {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked_mut {_ _}.
 Arguments core_slice_index_SliceIndex_index {_ _}.
 Arguments core_slice_index_SliceIndex_index_mut {_ _}.
-Arguments core_slice_index_SliceIndex_index_mut_back {_ _}.
 
 (* [core::slice::index::[T]::index]: forward function *)
 Definition core_slice_index_Slice_index
@@ -704,11 +725,9 @@ Axiom core_slice_index_RangeUsize_get : forall (T : Type) (i : core_ops_range_Ra
 
 (* [core::slice::index::Range::get_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_get_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (option (slice T)).
-
-(* [core::slice::index::Range::get_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_get_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> option (slice T) -> result (slice T).
+  forall (T : Type),
+    core_ops_range_Range usize -> slice T ->
+    result (option (slice T) * (option (slice T) -> result (slice T))).
 
 (* [core::slice::index::Range::get_unchecked]: forward function *)
 Definition core_slice_index_RangeUsize_get_unchecked
@@ -732,21 +751,14 @@ Axiom core_slice_index_RangeUsize_index :
 
 (* [core::slice::index::Range::index_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_index_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T).
-
-(* [core::slice::index::Range::index_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_index_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> slice T -> result (slice T).
+  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T * (slice T -> result (slice T))).
 
 (* [core::slice::index::[T]::index_mut]: forward function *)
 Axiom core_slice_index_Slice_index_mut :
   forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> result inst.(core_slice_index_SliceIndex_Output).
-
-(* [core::slice::index::[T]::index_mut]: backward function 0 *)
-Axiom core_slice_index_Slice_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> inst.(core_slice_index_SliceIndex_Output) -> result (slice T).
+  slice T -> Idx ->
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (slice T))).
 
 (* [core::array::[T; N]::index]: forward function *)
 Axiom core_array_Array_index :
@@ -756,12 +768,9 @@ Axiom core_array_Array_index :
 (* [core::array::[T; N]::index_mut]: forward function *)
 Axiom core_array_Array_index_mut :
   forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx), result inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output).
-
-(* [core::array::[T; N]::index_mut]: backward function 0 *)
-Axiom core_array_Array_index_mut_back :
-  forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx) (x : inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output)), result (array T N).
+  (a : array T N) (i : Idx),
+  result (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) *
+          (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) -> result (array T N))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::Range] *)
 Definition core_slice_index_private_slice_index_SealedRangeUsizeInst
@@ -774,12 +783,10 @@ Definition core_slice_index_SliceIndexRangeUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := slice T;
   core_slice_index_SliceIndex_get := core_slice_index_RangeUsize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_RangeUsize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_RangeUsize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_RangeUsize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_RangeUsize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_RangeUsize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_RangeUsize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_RangeUsize_index_mut_back T;
 |}.
 
 (* Trait implementation: [core::slice::index::[T]] *)
@@ -796,7 +803,6 @@ Definition core_ops_index_IndexMutSliceTIInst (T Idx : Type)
   core_ops_index_IndexMut (slice T) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexSliceTIInst T Idx inst;
   core_ops_index_IndexMut_index_mut := core_slice_index_Slice_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := core_slice_index_Slice_index_mut_back T Idx inst;
 |}.
 
 (* Trait implementation: [core::array::[T; N]] *)
@@ -813,18 +819,14 @@ Definition core_ops_index_IndexMutArrayInst (T Idx : Type) (N : usize)
   core_ops_index_IndexMut (array T N) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexArrayInst T Idx N inst.(core_ops_index_IndexMut_indexInst);
   core_ops_index_IndexMut_index_mut := core_array_Array_index_mut T Idx N inst;
-  core_ops_index_IndexMut_index_mut_back := core_array_Array_index_mut_back T Idx N inst;
 |}.
 
 (* [core::slice::index::usize::get]: forward function *)
 Axiom core_slice_index_usize_get : forall (T : Type), usize -> slice T -> result (option T).
 
 (* [core::slice::index::usize::get_mut]: forward function *)
-Axiom core_slice_index_usize_get_mut : forall (T : Type), usize -> slice T -> result (option T).
-
-(* [core::slice::index::usize::get_mut]: backward function 0 *)
-Axiom core_slice_index_usize_get_mut_back :
-  forall (T : Type), usize -> slice T -> option T -> result (slice T).
+Axiom core_slice_index_usize_get_mut :
+  forall (T : Type), usize -> slice T -> result (option T * (option T -> result (slice T))).
 
 (* [core::slice::index::usize::get_unchecked]: forward function *)
 Axiom core_slice_index_usize_get_unchecked :
@@ -838,11 +840,8 @@ Axiom core_slice_index_usize_get_unchecked_mut :
 Axiom core_slice_index_usize_index : forall (T : Type), usize -> slice T -> result T.
 
 (* [core::slice::index::usize::index_mut]: forward function *)
-Axiom core_slice_index_usize_index_mut : forall (T : Type), usize -> slice T -> result T.
-
-(* [core::slice::index::usize::index_mut]: backward function 0 *)
-Axiom core_slice_index_usize_index_mut_back :
-  forall (T : Type), usize -> slice T -> T -> result (slice T).
+Axiom core_slice_index_usize_index_mut :
+  forall (T : Type), usize -> slice T -> result (T * (T -> result (slice T))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::usize] *)
 Definition core_slice_index_private_slice_index_SealedUsizeInst
@@ -855,12 +854,10 @@ Definition core_slice_index_SliceIndexUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := T;
   core_slice_index_SliceIndex_get := core_slice_index_usize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_usize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_usize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_usize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_usize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_usize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_usize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_usize_index_mut_back T;
 |}.
 
 (* [alloc::vec::Vec::index]: forward function *)
@@ -869,12 +866,9 @@ Axiom alloc_vec_Vec_index : forall (T Idx : Type) (inst : core_slice_index_Slice
 
 (* [alloc::vec::Vec::index_mut]: forward function *)
 Axiom alloc_vec_Vec_index_mut : forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx), result inst.(core_slice_index_SliceIndex_Output).
-
-(* [alloc::vec::Vec::index_mut]: backward function 0 *)
-Axiom alloc_vec_Vec_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx) (x : inst.(core_slice_index_SliceIndex_Output)), result (alloc_vec_Vec T).
+  (Self : alloc_vec_Vec T) (i : Idx),
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (alloc_vec_Vec T))).
 
 (* Trait implementation: [alloc::vec::Vec] *)
 Definition alloc_vec_Vec_coreopsindexIndexInst (T Idx : Type)
@@ -890,7 +884,6 @@ Definition alloc_vec_Vec_coreopsindexIndexMutInst (T Idx : Type)
   core_ops_index_IndexMut (alloc_vec_Vec T) Idx := {|
   core_ops_index_IndexMut_indexInst := alloc_vec_Vec_coreopsindexIndexInst T Idx inst;
   core_ops_index_IndexMut_index_mut := alloc_vec_Vec_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := alloc_vec_Vec_index_mut_back T Idx inst;
 |}.
 
 (*** Theorems *)
@@ -901,10 +894,6 @@ Axiom alloc_vec_Vec_index_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usiz
 
 Axiom alloc_vec_Vec_index_mut_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
   alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i =
-    alloc_vec_Vec_index_usize v i.
-
-Axiom alloc_vec_Vec_index_mut_back_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
-  alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x =
-    alloc_vec_Vec_update_usize v i x.
+    alloc_vec_Vec_index_mut_usize v i.
 
 End Primitives.
diff --git a/tests/coq/hashmap/Hashmap_Funs.v b/tests/coq/hashmap/Hashmap_Funs.v
index 64de44a6..5cd9fe70 100644
--- a/tests/coq/hashmap/Hashmap_Funs.v
+++ b/tests/coq/hashmap/Hashmap_Funs.v
@@ -10,39 +10,39 @@ Require Import Hashmap_Types.
 Include Hashmap_Types.
 Module Hashmap_Funs.
 
-(** [hashmap::hash_key]: forward function
+(** [hashmap::hash_key]:
     Source: 'src/hashmap.rs', lines 27:0-27:32 *)
 Definition hash_key (k : usize) : result usize :=
   Return k.
 
-(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0:
     Source: 'src/hashmap.rs', lines 50:4-56:5 *)
 Fixpoint hashMap_allocate_slots_loop
-  (T : Type) (n : nat) (slots : alloc_vec_Vec (List_t T)) (n0 : usize) :
+  (T : Type) (n : nat) (slots : alloc_vec_Vec (List_t T)) (n1 : usize) :
   result (alloc_vec_Vec (List_t T))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n1 =>
-    if n0 s> 0%usize
+  | S n2 =>
+    if n1 s> 0%usize
     then (
-      slots0 <- alloc_vec_Vec_push (List_t T) slots List_Nil;
-      n2 <- usize_sub n0 1%usize;
-      hashMap_allocate_slots_loop T n1 slots0 n2)
+      v <- alloc_vec_Vec_push (List_t T) slots List_Nil;
+      n3 <- usize_sub n1 1%usize;
+      hashMap_allocate_slots_loop T n2 v n3)
     else Return slots
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]:
     Source: 'src/hashmap.rs', lines 50:4-50:76 *)
 Definition hashMap_allocate_slots
-  (T : Type) (n : nat) (slots : alloc_vec_Vec (List_t T)) (n0 : usize) :
+  (T : Type) (n : nat) (slots : alloc_vec_Vec (List_t T)) (n1 : usize) :
   result (alloc_vec_Vec (List_t T))
   :=
-  hashMap_allocate_slots_loop T n slots n0
+  hashMap_allocate_slots_loop T n slots n1
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::new_with_capacity]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::new_with_capacity]:
     Source: 'src/hashmap.rs', lines 59:4-63:13 *)
 Definition hashMap_new_with_capacity
   (T : Type) (n : nat) (capacity : usize) (max_load_dividend : usize)
@@ -52,24 +52,23 @@ Definition hashMap_new_with_capacity
   let v := alloc_vec_Vec_new (List_t T) in
   slots <- hashMap_allocate_slots T n v capacity;
   i <- usize_mul capacity max_load_dividend;
-  i0 <- usize_div i max_load_divisor;
+  i1 <- usize_div i max_load_divisor;
   Return
     {|
       hashMap_num_entries := 0%usize;
       hashMap_max_load_factor := (max_load_dividend, max_load_divisor);
-      hashMap_max_load := i0;
+      hashMap_max_load := i1;
       hashMap_slots := slots
     |}
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::new]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::new]:
     Source: 'src/hashmap.rs', lines 75:4-75:24 *)
 Definition hashMap_new (T : Type) (n : nat) : result (HashMap_t T) :=
   hashMap_new_with_capacity T n 32%usize 4%usize 5%usize
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::clear]: loop 0:
     Source: 'src/hashmap.rs', lines 80:4-88:5 *)
 Fixpoint hashMap_clear_loop
   (T : Type) (n : nat) (slots : alloc_vec_Vec (List_t T)) (i : usize) :
@@ -77,101 +76,73 @@ Fixpoint hashMap_clear_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := alloc_vec_Vec_len (List_t T) slots in
-    if i s< i0
+  | S n1 =>
+    let i1 := alloc_vec_Vec_len (List_t T) slots in
+    if i s< i1
     then (
-      i1 <- usize_add i 1%usize;
-      slots0 <-
-        alloc_vec_Vec_index_mut_back (List_t T) usize
-          (core_slice_index_SliceIndexUsizeSliceTInst (List_t T)) slots i
-          List_Nil;
-      hashMap_clear_loop T n0 slots0 i1)
+      p <-
+        alloc_vec_Vec_index_mut (List_t T) usize
+          (core_slice_index_SliceIndexUsizeSliceTInst (List_t T)) slots i;
+      let (_, index_mut_back) := p in
+      i2 <- usize_add i 1%usize;
+      slots1 <- index_mut_back List_Nil;
+      hashMap_clear_loop T n1 slots1 i2)
     else Return slots
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::clear]:
     Source: 'src/hashmap.rs', lines 80:4-80:27 *)
 Definition hashMap_clear
   (T : Type) (n : nat) (self : HashMap_t T) : result (HashMap_t T) :=
-  v <- hashMap_clear_loop T n self.(hashMap_slots) 0%usize;
+  back <- hashMap_clear_loop T n self.(hashMap_slots) 0%usize;
   Return
     {|
       hashMap_num_entries := 0%usize;
       hashMap_max_load_factor := self.(hashMap_max_load_factor);
       hashMap_max_load := self.(hashMap_max_load);
-      hashMap_slots := v
+      hashMap_slots := back
     |}
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::len]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::len]:
     Source: 'src/hashmap.rs', lines 90:4-90:30 *)
 Definition hashMap_len (T : Type) (self : HashMap_t T) : result usize :=
   Return self.(hashMap_num_entries)
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 97:4-114:5 *)
 Fixpoint hashMap_insert_in_list_loop
   (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
-  result bool
+  result (bool * (List_t T))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons ckey cvalue tl =>
       if ckey s= key
-      then Return false
-      else hashMap_insert_in_list_loop T n0 key value tl
-    | List_Nil => Return true
+      then Return (false, List_Cons ckey value tl)
+      else (
+        p <- hashMap_insert_in_list_loop T n1 key value tl;
+        let (b, back) := p in
+        Return (b, List_Cons ckey cvalue back))
+    | List_Nil => let l := List_Nil in Return (true, List_Cons key value l)
     end
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]:
     Source: 'src/hashmap.rs', lines 97:4-97:71 *)
 Definition hashMap_insert_in_list
   (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
-  result bool
+  result (bool * (List_t T))
   :=
   hashMap_insert_in_list_loop T n key value ls
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
-Fixpoint hashMap_insert_in_list_loop_back
-  (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons ckey cvalue tl =>
-      if ckey s= key
-      then Return (List_Cons ckey value tl)
-      else (
-        tl0 <- hashMap_insert_in_list_loop_back T n0 key value tl;
-        Return (List_Cons ckey cvalue tl0))
-    | List_Nil => let l := List_Nil in Return (List_Cons key value l)
-    end
-  end
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: backward function 0
-    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
-Definition hashMap_insert_in_list_back
-  (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
-  result (List_t T)
-  :=
-  hashMap_insert_in_list_loop_back T n key value ls
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::insert_no_resize]:
     Source: 'src/hashmap.rs', lines 117:4-117:54 *)
 Definition hashMap_insert_no_resize
   (T : Type) (n : nat) (self : HashMap_t T) (key : usize) (value : T) :
@@ -180,32 +151,26 @@ Definition hashMap_insert_no_resize
   hash <- hash_key key;
   let i := alloc_vec_Vec_len (List_t T) self.(hashMap_slots) in
   hash_mod <- usize_rem hash i;
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (List_t T) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
       self.(hashMap_slots) hash_mod;
-  inserted <- hashMap_insert_in_list T n key value l;
+  let (l, index_mut_back) := p in
+  p1 <- hashMap_insert_in_list T n key value l;
+  let (inserted, l1) := p1 in
   if inserted
   then (
-    i0 <- usize_add self.(hashMap_num_entries) 1%usize;
-    l0 <- hashMap_insert_in_list_back T n key value l;
-    v <-
-      alloc_vec_Vec_index_mut_back (List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-        self.(hashMap_slots) hash_mod l0;
+    i1 <- usize_add self.(hashMap_num_entries) 1%usize;
+    v <- index_mut_back l1;
     Return
       {|
-        hashMap_num_entries := i0;
+        hashMap_num_entries := i1;
         hashMap_max_load_factor := self.(hashMap_max_load_factor);
         hashMap_max_load := self.(hashMap_max_load);
         hashMap_slots := v
       |})
   else (
-    l0 <- hashMap_insert_in_list_back T n key value l;
-    v <-
-      alloc_vec_Vec_index_mut_back (List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-        self.(hashMap_slots) hash_mod l0;
+    v <- index_mut_back l1;
     Return
       {|
         hashMap_num_entries := self.(hashMap_num_entries);
@@ -215,8 +180,7 @@ Definition hashMap_insert_no_resize
       |})
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 183:4-196:5 *)
 Fixpoint hashMap_move_elements_from_list_loop
   (T : Type) (n : nat) (ntable : HashMap_t T) (ls : List_t T) :
@@ -224,18 +188,17 @@ Fixpoint hashMap_move_elements_from_list_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons k v tl =>
-      ntable0 <- hashMap_insert_no_resize T n0 ntable k v;
-      hashMap_move_elements_from_list_loop T n0 ntable0 tl
+      hm <- hashMap_insert_no_resize T n1 ntable k v;
+      hashMap_move_elements_from_list_loop T n1 hm tl
     | List_Nil => Return ntable
     end
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]:
     Source: 'src/hashmap.rs', lines 183:4-183:72 *)
 Definition hashMap_move_elements_from_list
   (T : Type) (n : nat) (ntable : HashMap_t T) (ls : List_t T) :
@@ -244,8 +207,7 @@ Definition hashMap_move_elements_from_list
   hashMap_move_elements_from_list_loop T n ntable ls
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0:
     Source: 'src/hashmap.rs', lines 171:4-180:5 *)
 Fixpoint hashMap_move_elements_loop
   (T : Type) (n : nat) (ntable : HashMap_t T)
@@ -254,108 +216,105 @@ Fixpoint hashMap_move_elements_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := alloc_vec_Vec_len (List_t T) slots in
-    if i s< i0
+  | S n1 =>
+    let i1 := alloc_vec_Vec_len (List_t T) slots in
+    if i s< i1
     then (
-      l <-
+      p <-
         alloc_vec_Vec_index_mut (List_t T) usize
           (core_slice_index_SliceIndexUsizeSliceTInst (List_t T)) slots i;
-      let ls := core_mem_replace (List_t T) l List_Nil in
-      ntable0 <- hashMap_move_elements_from_list T n0 ntable ls;
-      i1 <- usize_add i 1%usize;
-      let l0 := core_mem_replace_back (List_t T) l List_Nil in
-      slots0 <-
-        alloc_vec_Vec_index_mut_back (List_t T) usize
-          (core_slice_index_SliceIndexUsizeSliceTInst (List_t T)) slots i l0;
-      hashMap_move_elements_loop T n0 ntable0 slots0 i1)
+      let (l, index_mut_back) := p in
+      let (ls, l1) := core_mem_replace (List_t T) l List_Nil in
+      hm <- hashMap_move_elements_from_list T n1 ntable ls;
+      i2 <- usize_add i 1%usize;
+      slots1 <- index_mut_back l1;
+      back_'a <- hashMap_move_elements_loop T n1 hm slots1 i2;
+      let (hm1, v) := back_'a in
+      Return (hm1, v))
     else Return (ntable, slots)
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]:
     Source: 'src/hashmap.rs', lines 171:4-171:95 *)
 Definition hashMap_move_elements
   (T : Type) (n : nat) (ntable : HashMap_t T)
   (slots : alloc_vec_Vec (List_t T)) (i : usize) :
   result ((HashMap_t T) * (alloc_vec_Vec (List_t T)))
   :=
-  hashMap_move_elements_loop T n ntable slots i
+  back_'a <- hashMap_move_elements_loop T n ntable slots i;
+  let (hm, v) := back_'a in
+  Return (hm, v)
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::try_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::try_resize]:
     Source: 'src/hashmap.rs', lines 140:4-140:28 *)
 Definition hashMap_try_resize
   (T : Type) (n : nat) (self : HashMap_t T) : result (HashMap_t T) :=
   max_usize <- scalar_cast U32 Usize core_u32_max;
   let capacity := alloc_vec_Vec_len (List_t T) self.(hashMap_slots) in
   n1 <- usize_div max_usize 2%usize;
-  let (i, i0) := self.(hashMap_max_load_factor) in
-  i1 <- usize_div n1 i;
-  if capacity s<= i1
+  let (i, i1) := self.(hashMap_max_load_factor) in
+  i2 <- usize_div n1 i;
+  if capacity s<= i2
   then (
-    i2 <- usize_mul capacity 2%usize;
-    ntable <- hashMap_new_with_capacity T n i2 i i0;
+    i3 <- usize_mul capacity 2%usize;
+    ntable <- hashMap_new_with_capacity T n i3 i i1;
     p <- hashMap_move_elements T n ntable self.(hashMap_slots) 0%usize;
-    let (ntable0, _) := p in
+    let (ntable1, _) := p in
     Return
       {|
         hashMap_num_entries := self.(hashMap_num_entries);
-        hashMap_max_load_factor := (i, i0);
-        hashMap_max_load := ntable0.(hashMap_max_load);
-        hashMap_slots := ntable0.(hashMap_slots)
+        hashMap_max_load_factor := (i, i1);
+        hashMap_max_load := ntable1.(hashMap_max_load);
+        hashMap_slots := ntable1.(hashMap_slots)
       |})
   else
     Return
       {|
         hashMap_num_entries := self.(hashMap_num_entries);
-        hashMap_max_load_factor := (i, i0);
+        hashMap_max_load_factor := (i, i1);
         hashMap_max_load := self.(hashMap_max_load);
         hashMap_slots := self.(hashMap_slots)
       |}
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::insert]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::insert]:
     Source: 'src/hashmap.rs', lines 129:4-129:48 *)
 Definition hashMap_insert
   (T : Type) (n : nat) (self : HashMap_t T) (key : usize) (value : T) :
   result (HashMap_t T)
   :=
-  self0 <- hashMap_insert_no_resize T n self key value;
-  i <- hashMap_len T self0;
-  if i s> self0.(hashMap_max_load)
-  then hashMap_try_resize T n self0
-  else Return self0
+  hm <- hashMap_insert_no_resize T n self key value;
+  i <- hashMap_len T hm;
+  if i s> hm.(hashMap_max_load) then hashMap_try_resize T n hm else Return hm
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 206:4-219:5 *)
 Fixpoint hashMap_contains_key_in_list_loop
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result bool :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
-    | List_Cons ckey t tl =>
+    | List_Cons ckey _ tl =>
       if ckey s= key
       then Return true
-      else hashMap_contains_key_in_list_loop T n0 key tl
+      else hashMap_contains_key_in_list_loop T n1 key tl
     | List_Nil => Return false
     end
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]:
     Source: 'src/hashmap.rs', lines 206:4-206:68 *)
 Definition hashMap_contains_key_in_list
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result bool :=
   hashMap_contains_key_in_list_loop T n key ls
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::contains_key]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::contains_key]:
     Source: 'src/hashmap.rs', lines 199:4-199:49 *)
 Definition hashMap_contains_key
   (T : Type) (n : nat) (self : HashMap_t T) (key : usize) : result bool :=
@@ -369,31 +328,31 @@ Definition hashMap_contains_key
   hashMap_contains_key_in_list T n key l
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 224:4-237:5 *)
 Fixpoint hashMap_get_in_list_loop
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result T :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons ckey cvalue tl =>
       if ckey s= key
       then Return cvalue
-      else hashMap_get_in_list_loop T n0 key tl
+      else hashMap_get_in_list_loop T n1 key tl
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]:
     Source: 'src/hashmap.rs', lines 224:4-224:70 *)
 Definition hashMap_get_in_list
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result T :=
   hashMap_get_in_list_loop T n key ls
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::get]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get]:
     Source: 'src/hashmap.rs', lines 239:4-239:55 *)
 Definition hashMap_get
   (T : Type) (n : nat) (self : HashMap_t T) (key : usize) : result T :=
@@ -407,264 +366,188 @@ Definition hashMap_get
   hashMap_get_in_list T n key l
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 245:4-254:5 *)
 Fixpoint hashMap_get_mut_in_list_loop
-  (T : Type) (n : nat) (ls : List_t T) (key : usize) : result T :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons ckey cvalue tl =>
-      if ckey s= key
-      then Return cvalue
-      else hashMap_get_mut_in_list_loop T n0 tl key
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: forward function
-    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-Definition hashMap_get_mut_in_list
-  (T : Type) (n : nat) (ls : List_t T) (key : usize) : result T :=
-  hashMap_get_mut_in_list_loop T n ls key
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
-Fixpoint hashMap_get_mut_in_list_loop_back
-  (T : Type) (n : nat) (ls : List_t T) (key : usize) (ret : T) :
-  result (List_t T)
+  (T : Type) (n : nat) (ls : List_t T) (key : usize) :
+  result (T * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons ckey cvalue tl =>
       if ckey s= key
-      then Return (List_Cons ckey ret tl)
+      then
+        let back_'a := fun (ret : T) => Return (List_Cons ckey ret tl) in
+        Return (cvalue, back_'a)
       else (
-        tl0 <- hashMap_get_mut_in_list_loop_back T n0 tl key ret;
-        Return (List_Cons ckey cvalue tl0))
+        p <- hashMap_get_mut_in_list_loop T n1 tl key;
+        let (t, back_'a) := p in
+        let back_'a1 :=
+          fun (ret : T) =>
+            tl1 <- back_'a ret; Return (List_Cons ckey cvalue tl1) in
+        Return (t, back_'a1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]:
     Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-Definition hashMap_get_mut_in_list_back
-  (T : Type) (n : nat) (ls : List_t T) (key : usize) (ret : T) :
-  result (List_t T)
+Definition hashMap_get_mut_in_list
+  (T : Type) (n : nat) (ls : List_t T) (key : usize) :
+  result (T * (T -> result (List_t T)))
   :=
-  hashMap_get_mut_in_list_loop_back T n ls key ret
+  p <- hashMap_get_mut_in_list_loop T n ls key;
+  let (t, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (t, back_'a1)
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::get_mut]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_mut]:
     Source: 'src/hashmap.rs', lines 257:4-257:67 *)
 Definition hashMap_get_mut
-  (T : Type) (n : nat) (self : HashMap_t T) (key : usize) : result T :=
-  hash <- hash_key key;
-  let i := alloc_vec_Vec_len (List_t T) self.(hashMap_slots) in
-  hash_mod <- usize_rem hash i;
-  l <-
-    alloc_vec_Vec_index_mut (List_t T) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-      self.(hashMap_slots) hash_mod;
-  hashMap_get_mut_in_list T n l key
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::get_mut]: backward function 0
-    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
-Definition hashMap_get_mut_back
-  (T : Type) (n : nat) (self : HashMap_t T) (key : usize) (ret : T) :
-  result (HashMap_t T)
+  (T : Type) (n : nat) (self : HashMap_t T) (key : usize) :
+  result (T * (T -> result (HashMap_t T)))
   :=
   hash <- hash_key key;
   let i := alloc_vec_Vec_len (List_t T) self.(hashMap_slots) in
   hash_mod <- usize_rem hash i;
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (List_t T) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
       self.(hashMap_slots) hash_mod;
-  l0 <- hashMap_get_mut_in_list_back T n l key ret;
-  v <-
-    alloc_vec_Vec_index_mut_back (List_t T) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-      self.(hashMap_slots) hash_mod l0;
-  Return
-    {|
-      hashMap_num_entries := self.(hashMap_num_entries);
-      hashMap_max_load_factor := self.(hashMap_max_load_factor);
-      hashMap_max_load := self.(hashMap_max_load);
-      hashMap_slots := v
-    |}
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
+  let (l, index_mut_back) := p in
+  p1 <- hashMap_get_mut_in_list T n l key;
+  let (t, get_mut_in_list_back) := p1 in
+  let back_'a :=
+    fun (ret : T) =>
+      l1 <- get_mut_in_list_back ret;
+      v <- index_mut_back l1;
+      Return
+        {|
+          hashMap_num_entries := self.(hashMap_num_entries);
+          hashMap_max_load_factor := self.(hashMap_max_load_factor);
+          hashMap_max_load := self.(hashMap_max_load);
+          hashMap_slots := v
+        |} in
+  Return (t, back_'a)
+.
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 265:4-291:5 *)
 Fixpoint hashMap_remove_from_list_loop
-  (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (option T) :=
+  (T : Type) (n : nat) (key : usize) (ls : List_t T) :
+  result ((option T) * (List_t T))
+  :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons ckey t tl =>
       if ckey s= key
       then
-        let mv_ls := core_mem_replace (List_t T) (List_Cons ckey t tl) List_Nil
-          in
+        let (mv_ls, _) :=
+          core_mem_replace (List_t T) (List_Cons ckey t tl) List_Nil in
         match mv_ls with
-        | List_Cons i cvalue tl0 => Return (Some cvalue)
+        | List_Cons _ cvalue tl1 => Return (Some cvalue, tl1)
         | List_Nil => Fail_ Failure
         end
-      else hashMap_remove_from_list_loop T n0 key tl
-    | List_Nil => Return None
+      else (
+        p <- hashMap_remove_from_list_loop T n1 key tl;
+        let (o, back) := p in
+        Return (o, List_Cons ckey t back))
+    | List_Nil => Return (None, List_Nil)
     end
   end
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]:
     Source: 'src/hashmap.rs', lines 265:4-265:69 *)
 Definition hashMap_remove_from_list
-  (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (option T) :=
+  (T : Type) (n : nat) (key : usize) (ls : List_t T) :
+  result ((option T) * (List_t T))
+  :=
   hashMap_remove_from_list_loop T n key ls
 .
 
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
-Fixpoint hashMap_remove_from_list_loop_back
-  (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (List_t T) :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons ckey t tl =>
-      if ckey s= key
-      then
-        let mv_ls := core_mem_replace (List_t T) (List_Cons ckey t tl) List_Nil
-          in
-        match mv_ls with
-        | List_Cons i cvalue tl0 => Return tl0
-        | List_Nil => Fail_ Failure
-        end
-      else (
-        tl0 <- hashMap_remove_from_list_loop_back T n0 key tl;
-        Return (List_Cons ckey t tl0))
-    | List_Nil => Return List_Nil
-    end
-  end
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
-Definition hashMap_remove_from_list_back
-  (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (List_t T) :=
-  hashMap_remove_from_list_loop_back T n key ls
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::remove]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::remove]:
     Source: 'src/hashmap.rs', lines 294:4-294:52 *)
 Definition hashMap_remove
   (T : Type) (n : nat) (self : HashMap_t T) (key : usize) :
-  result (option T)
-  :=
-  hash <- hash_key key;
-  let i := alloc_vec_Vec_len (List_t T) self.(hashMap_slots) in
-  hash_mod <- usize_rem hash i;
-  l <-
-    alloc_vec_Vec_index_mut (List_t T) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-      self.(hashMap_slots) hash_mod;
-  x <- hashMap_remove_from_list T n key l;
-  match x with
-  | None => Return None
-  | Some x0 =>
-    _ <- usize_sub self.(hashMap_num_entries) 1%usize; Return (Some x0)
-  end
-.
-
-(** [hashmap::{hashmap::HashMap<T>}::remove]: backward function 0
-    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
-Definition hashMap_remove_back
-  (T : Type) (n : nat) (self : HashMap_t T) (key : usize) :
-  result (HashMap_t T)
+  result ((option T) * (HashMap_t T))
   :=
   hash <- hash_key key;
   let i := alloc_vec_Vec_len (List_t T) self.(hashMap_slots) in
   hash_mod <- usize_rem hash i;
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (List_t T) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
       self.(hashMap_slots) hash_mod;
-  x <- hashMap_remove_from_list T n key l;
+  let (l, index_mut_back) := p in
+  p1 <- hashMap_remove_from_list T n key l;
+  let (x, l1) := p1 in
   match x with
   | None =>
-    l0 <- hashMap_remove_from_list_back T n key l;
-    v <-
-      alloc_vec_Vec_index_mut_back (List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-        self.(hashMap_slots) hash_mod l0;
-    Return
+    v <- index_mut_back l1;
+    Return (None,
       {|
         hashMap_num_entries := self.(hashMap_num_entries);
         hashMap_max_load_factor := self.(hashMap_max_load_factor);
         hashMap_max_load := self.(hashMap_max_load);
         hashMap_slots := v
-      |}
-  | Some x0 =>
-    i0 <- usize_sub self.(hashMap_num_entries) 1%usize;
-    l0 <- hashMap_remove_from_list_back T n key l;
-    v <-
-      alloc_vec_Vec_index_mut_back (List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (List_t T))
-        self.(hashMap_slots) hash_mod l0;
-    Return
+      |})
+  | Some x1 =>
+    i1 <- usize_sub self.(hashMap_num_entries) 1%usize;
+    v <- index_mut_back l1;
+    Return (Some x1,
       {|
-        hashMap_num_entries := i0;
+        hashMap_num_entries := i1;
         hashMap_max_load_factor := self.(hashMap_max_load_factor);
         hashMap_max_load := self.(hashMap_max_load);
         hashMap_slots := v
-      |}
+      |})
   end
 .
 
-(** [hashmap::test1]: forward function
+(** [hashmap::test1]:
     Source: 'src/hashmap.rs', lines 315:0-315:10 *)
 Definition test1 (n : nat) : result unit :=
   hm <- hashMap_new u64 n;
-  hm0 <- hashMap_insert u64 n hm 0%usize 42%u64;
-  hm1 <- hashMap_insert u64 n hm0 128%usize 18%u64;
-  hm2 <- hashMap_insert u64 n hm1 1024%usize 138%u64;
-  hm3 <- hashMap_insert u64 n hm2 1056%usize 256%u64;
-  i <- hashMap_get u64 n hm3 128%usize;
+  hm1 <- hashMap_insert u64 n hm 0%usize 42%u64;
+  hm2 <- hashMap_insert u64 n hm1 128%usize 18%u64;
+  hm3 <- hashMap_insert u64 n hm2 1024%usize 138%u64;
+  hm4 <- hashMap_insert u64 n hm3 1056%usize 256%u64;
+  i <- hashMap_get u64 n hm4 128%usize;
   if negb (i s= 18%u64)
   then Fail_ Failure
   else (
-    hm4 <- hashMap_get_mut_back u64 n hm3 1024%usize 56%u64;
-    i0 <- hashMap_get u64 n hm4 1024%usize;
-    if negb (i0 s= 56%u64)
+    p <- hashMap_get_mut u64 n hm4 1024%usize;
+    let (_, get_mut_back) := p in
+    hm5 <- get_mut_back 56%u64;
+    i1 <- hashMap_get u64 n hm5 1024%usize;
+    if negb (i1 s= 56%u64)
     then Fail_ Failure
     else (
-      x <- hashMap_remove u64 n hm4 1024%usize;
+      p1 <- hashMap_remove u64 n hm5 1024%usize;
+      let (x, hm6) := p1 in
       match x with
       | None => Fail_ Failure
-      | Some x0 =>
-        if negb (x0 s= 56%u64)
+      | Some x1 =>
+        if negb (x1 s= 56%u64)
         then Fail_ Failure
         else (
-          hm5 <- hashMap_remove_back u64 n hm4 1024%usize;
-          i1 <- hashMap_get u64 n hm5 0%usize;
-          if negb (i1 s= 42%u64)
+          i2 <- hashMap_get u64 n hm6 0%usize;
+          if negb (i2 s= 42%u64)
           then Fail_ Failure
           else (
-            i2 <- hashMap_get u64 n hm5 128%usize;
-            if negb (i2 s= 18%u64)
+            i3 <- hashMap_get u64 n hm6 128%usize;
+            if negb (i3 s= 18%u64)
             then Fail_ Failure
             else (
-              i3 <- hashMap_get u64 n hm5 1056%usize;
-              if negb (i3 s= 256%u64) then Fail_ Failure else Return tt)))
+              i4 <- hashMap_get u64 n hm6 1056%usize;
+              if negb (i4 s= 256%u64) then Fail_ Failure else Return tt)))
       end))
 .
 
diff --git a/tests/coq/hashmap/Primitives.v b/tests/coq/hashmap/Primitives.v
index 84280b96..990e27e4 100644
--- a/tests/coq/hashmap/Primitives.v
+++ b/tests/coq/hashmap/Primitives.v
@@ -67,8 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a := x .
-Definition core_mem_replace_back (a : Type) (x : a) (y : a) : a := y .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -504,13 +503,15 @@ Arguments core_ops_index_Index_index {_ _}.
 (* Trait declaration: [core::ops::index::IndexMut] *)
 Record core_ops_index_IndexMut (Self Idx : Type) := mk_core_ops_index_IndexMut {
   core_ops_index_IndexMut_indexInst : core_ops_index_Index Self Idx;
-  core_ops_index_IndexMut_index_mut : Self -> Idx -> result core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output);
-  core_ops_index_IndexMut_index_mut_back : Self -> Idx -> core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self;
+  core_ops_index_IndexMut_index_mut :
+    Self ->
+    Idx ->
+    result (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) *
+            (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self));
 }.
 Arguments mk_core_ops_index_IndexMut {_ _}.
 Arguments core_ops_index_IndexMut_indexInst {_ _}.
 Arguments core_ops_index_IndexMut_index_mut {_ _}.
-Arguments core_ops_index_IndexMut_index_mut_back {_ _}.
 
 (* Trait declaration [core::ops::deref::Deref] *)
 Record core_ops_deref_Deref (Self : Type) := mk_core_ops_deref_Deref {
@@ -524,13 +525,14 @@ Arguments core_ops_deref_Deref_deref {_}.
 (* Trait declaration [core::ops::deref::DerefMut] *)
 Record core_ops_deref_DerefMut (Self : Type) := mk_core_ops_deref_DerefMut {
   core_ops_deref_DerefMut_derefInst : core_ops_deref_Deref Self;
-  core_ops_deref_DerefMut_deref_mut : Self -> result core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target);
-  core_ops_deref_DerefMut_deref_mut_back : Self -> core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self;
+  core_ops_deref_DerefMut_deref_mut :
+    Self ->
+    result (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) *
+            (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self));
 }.
 Arguments mk_core_ops_deref_DerefMut {_}.
 Arguments core_ops_deref_DerefMut_derefInst {_}.
 Arguments core_ops_deref_DerefMut_deref_mut {_}.
-Arguments core_ops_deref_DerefMut_deref_mut_back {_}.
 
 Record core_ops_range_Range (T : Type) := mk_core_ops_range_Range {
   core_ops_range_Range_start : T;
@@ -543,8 +545,8 @@ Arguments core_ops_range_Range_end_ {_}.
 (*** [alloc] *)
 
 Definition alloc_boxed_Box_deref (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut_back (T : Type) (_ : T) (x : T) : result T := Return x.
+Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result (T * (T -> result T)) :=
+  Return (x, fun x => Return x).
 
 (* Trait instance *)
 Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref Self := {|
@@ -556,7 +558,6 @@ Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref
 Definition alloc_boxed_Box_coreopsDerefMutInst (Self : Type) : core_ops_deref_DerefMut Self := {|
   core_ops_deref_DerefMut_derefInst := alloc_boxed_Box_coreopsDerefInst Self;
   core_ops_deref_DerefMut_deref_mut := alloc_boxed_Box_deref_mut Self;
-  core_ops_deref_DerefMut_deref_mut_back := alloc_boxed_Box_deref_mut_back Self;
 |}.
 
 
@@ -584,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -591,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
@@ -639,16 +661,9 @@ Definition alloc_vec_Vec_bind {A B} (v: alloc_vec_Vec A) (f: list A -> result (l
   | right _ => Fail_ Failure
   end.
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_push_fwd (T: Type) (v: alloc_vec_Vec T) (x: T) : unit := tt.
-
 Definition alloc_vec_Vec_push (T: Type) (v: alloc_vec_Vec T) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l => Return (l ++ [x])).
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_insert_fwd (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result unit :=
-  if to_Z i <? alloc_vec_Vec_length v then Return tt else Fail_ Failure.
-
 Definition alloc_vec_Vec_insert (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l =>
     if to_Z i <? Z.of_nat (length l)
@@ -661,6 +676,14 @@ Axiom alloc_vec_Vec_index_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : u
 (* Helper *)
 Axiom alloc_vec_Vec_update_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : usize) (x : T), result (alloc_vec_Vec T).
 
+Definition alloc_vec_Vec_index_mut_usize {T : Type} (v: alloc_vec_Vec T) (i: usize) :
+  result (T * (T -> result (alloc_vec_Vec T))) :=
+  match alloc_vec_Vec_index_usize v i with
+  | Return x =>
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail_ e => Fail_ e
+  end.
+
 (* Trait declaration: [core::slice::index::private_slice_index::Sealed] *)
 Definition core_slice_index_private_slice_index_Sealed (self : Type) := unit.
 
@@ -669,25 +692,23 @@ Record core_slice_index_SliceIndex (Self T : Type) := mk_core_slice_index_SliceI
   core_slice_index_SliceIndex_sealedInst : core_slice_index_private_slice_index_Sealed Self;
   core_slice_index_SliceIndex_Output : Type;
   core_slice_index_SliceIndex_get : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut_back : Self -> T -> option core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_get_mut :
+    Self -> T -> result (option core_slice_index_SliceIndex_Output * (option core_slice_index_SliceIndex_Output -> result T));
   core_slice_index_SliceIndex_get_unchecked : Self -> const_raw_ptr T -> result (const_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_get_unchecked_mut : Self -> mut_raw_ptr T -> result (mut_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_index : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut_back : Self -> T -> core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_index_mut :
+    Self -> T -> result (core_slice_index_SliceIndex_Output * (core_slice_index_SliceIndex_Output -> result T));
 }.
 Arguments mk_core_slice_index_SliceIndex {_ _}.
 Arguments core_slice_index_SliceIndex_sealedInst {_ _}.
 Arguments core_slice_index_SliceIndex_Output {_ _}.
 Arguments core_slice_index_SliceIndex_get {_ _}.
 Arguments core_slice_index_SliceIndex_get_mut {_ _}.
-Arguments core_slice_index_SliceIndex_get_mut_back {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked_mut {_ _}.
 Arguments core_slice_index_SliceIndex_index {_ _}.
 Arguments core_slice_index_SliceIndex_index_mut {_ _}.
-Arguments core_slice_index_SliceIndex_index_mut_back {_ _}.
 
 (* [core::slice::index::[T]::index]: forward function *)
 Definition core_slice_index_Slice_index
@@ -704,11 +725,9 @@ Axiom core_slice_index_RangeUsize_get : forall (T : Type) (i : core_ops_range_Ra
 
 (* [core::slice::index::Range::get_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_get_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (option (slice T)).
-
-(* [core::slice::index::Range::get_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_get_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> option (slice T) -> result (slice T).
+  forall (T : Type),
+    core_ops_range_Range usize -> slice T ->
+    result (option (slice T) * (option (slice T) -> result (slice T))).
 
 (* [core::slice::index::Range::get_unchecked]: forward function *)
 Definition core_slice_index_RangeUsize_get_unchecked
@@ -732,21 +751,14 @@ Axiom core_slice_index_RangeUsize_index :
 
 (* [core::slice::index::Range::index_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_index_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T).
-
-(* [core::slice::index::Range::index_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_index_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> slice T -> result (slice T).
+  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T * (slice T -> result (slice T))).
 
 (* [core::slice::index::[T]::index_mut]: forward function *)
 Axiom core_slice_index_Slice_index_mut :
   forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> result inst.(core_slice_index_SliceIndex_Output).
-
-(* [core::slice::index::[T]::index_mut]: backward function 0 *)
-Axiom core_slice_index_Slice_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> inst.(core_slice_index_SliceIndex_Output) -> result (slice T).
+  slice T -> Idx ->
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (slice T))).
 
 (* [core::array::[T; N]::index]: forward function *)
 Axiom core_array_Array_index :
@@ -756,12 +768,9 @@ Axiom core_array_Array_index :
 (* [core::array::[T; N]::index_mut]: forward function *)
 Axiom core_array_Array_index_mut :
   forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx), result inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output).
-
-(* [core::array::[T; N]::index_mut]: backward function 0 *)
-Axiom core_array_Array_index_mut_back :
-  forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx) (x : inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output)), result (array T N).
+  (a : array T N) (i : Idx),
+  result (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) *
+          (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) -> result (array T N))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::Range] *)
 Definition core_slice_index_private_slice_index_SealedRangeUsizeInst
@@ -774,12 +783,10 @@ Definition core_slice_index_SliceIndexRangeUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := slice T;
   core_slice_index_SliceIndex_get := core_slice_index_RangeUsize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_RangeUsize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_RangeUsize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_RangeUsize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_RangeUsize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_RangeUsize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_RangeUsize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_RangeUsize_index_mut_back T;
 |}.
 
 (* Trait implementation: [core::slice::index::[T]] *)
@@ -796,7 +803,6 @@ Definition core_ops_index_IndexMutSliceTIInst (T Idx : Type)
   core_ops_index_IndexMut (slice T) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexSliceTIInst T Idx inst;
   core_ops_index_IndexMut_index_mut := core_slice_index_Slice_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := core_slice_index_Slice_index_mut_back T Idx inst;
 |}.
 
 (* Trait implementation: [core::array::[T; N]] *)
@@ -813,18 +819,14 @@ Definition core_ops_index_IndexMutArrayInst (T Idx : Type) (N : usize)
   core_ops_index_IndexMut (array T N) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexArrayInst T Idx N inst.(core_ops_index_IndexMut_indexInst);
   core_ops_index_IndexMut_index_mut := core_array_Array_index_mut T Idx N inst;
-  core_ops_index_IndexMut_index_mut_back := core_array_Array_index_mut_back T Idx N inst;
 |}.
 
 (* [core::slice::index::usize::get]: forward function *)
 Axiom core_slice_index_usize_get : forall (T : Type), usize -> slice T -> result (option T).
 
 (* [core::slice::index::usize::get_mut]: forward function *)
-Axiom core_slice_index_usize_get_mut : forall (T : Type), usize -> slice T -> result (option T).
-
-(* [core::slice::index::usize::get_mut]: backward function 0 *)
-Axiom core_slice_index_usize_get_mut_back :
-  forall (T : Type), usize -> slice T -> option T -> result (slice T).
+Axiom core_slice_index_usize_get_mut :
+  forall (T : Type), usize -> slice T -> result (option T * (option T -> result (slice T))).
 
 (* [core::slice::index::usize::get_unchecked]: forward function *)
 Axiom core_slice_index_usize_get_unchecked :
@@ -838,11 +840,8 @@ Axiom core_slice_index_usize_get_unchecked_mut :
 Axiom core_slice_index_usize_index : forall (T : Type), usize -> slice T -> result T.
 
 (* [core::slice::index::usize::index_mut]: forward function *)
-Axiom core_slice_index_usize_index_mut : forall (T : Type), usize -> slice T -> result T.
-
-(* [core::slice::index::usize::index_mut]: backward function 0 *)
-Axiom core_slice_index_usize_index_mut_back :
-  forall (T : Type), usize -> slice T -> T -> result (slice T).
+Axiom core_slice_index_usize_index_mut :
+  forall (T : Type), usize -> slice T -> result (T * (T -> result (slice T))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::usize] *)
 Definition core_slice_index_private_slice_index_SealedUsizeInst
@@ -855,12 +854,10 @@ Definition core_slice_index_SliceIndexUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := T;
   core_slice_index_SliceIndex_get := core_slice_index_usize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_usize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_usize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_usize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_usize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_usize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_usize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_usize_index_mut_back T;
 |}.
 
 (* [alloc::vec::Vec::index]: forward function *)
@@ -869,12 +866,9 @@ Axiom alloc_vec_Vec_index : forall (T Idx : Type) (inst : core_slice_index_Slice
 
 (* [alloc::vec::Vec::index_mut]: forward function *)
 Axiom alloc_vec_Vec_index_mut : forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx), result inst.(core_slice_index_SliceIndex_Output).
-
-(* [alloc::vec::Vec::index_mut]: backward function 0 *)
-Axiom alloc_vec_Vec_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx) (x : inst.(core_slice_index_SliceIndex_Output)), result (alloc_vec_Vec T).
+  (Self : alloc_vec_Vec T) (i : Idx),
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (alloc_vec_Vec T))).
 
 (* Trait implementation: [alloc::vec::Vec] *)
 Definition alloc_vec_Vec_coreopsindexIndexInst (T Idx : Type)
@@ -890,7 +884,6 @@ Definition alloc_vec_Vec_coreopsindexIndexMutInst (T Idx : Type)
   core_ops_index_IndexMut (alloc_vec_Vec T) Idx := {|
   core_ops_index_IndexMut_indexInst := alloc_vec_Vec_coreopsindexIndexInst T Idx inst;
   core_ops_index_IndexMut_index_mut := alloc_vec_Vec_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := alloc_vec_Vec_index_mut_back T Idx inst;
 |}.
 
 (*** Theorems *)
@@ -901,10 +894,6 @@ Axiom alloc_vec_Vec_index_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usiz
 
 Axiom alloc_vec_Vec_index_mut_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
   alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i =
-    alloc_vec_Vec_index_usize v i.
-
-Axiom alloc_vec_Vec_index_mut_back_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
-  alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x =
-    alloc_vec_Vec_update_usize v i x.
+    alloc_vec_Vec_index_mut_usize v i.
 
 End Primitives.
diff --git a/tests/coq/hashmap_on_disk/HashmapMain_Funs.v b/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
index faba0afe..b74fa61a 100644
--- a/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
+++ b/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
@@ -12,41 +12,41 @@ Require Import HashmapMain_FunsExternal.
 Include HashmapMain_FunsExternal.
 Module HashmapMain_Funs.
 
-(** [hashmap_main::hashmap::hash_key]: forward function
+(** [hashmap_main::hashmap::hash_key]:
     Source: 'src/hashmap.rs', lines 27:0-27:32 *)
 Definition hashmap_hash_key (k : usize) : result usize :=
   Return k.
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0:
     Source: 'src/hashmap.rs', lines 50:4-56:5 *)
 Fixpoint hashmap_HashMap_allocate_slots_loop
-  (T : Type) (n : nat) (slots : alloc_vec_Vec (hashmap_List_t T)) (n0 : usize)
+  (T : Type) (n : nat) (slots : alloc_vec_Vec (hashmap_List_t T)) (n1 : usize)
   :
   result (alloc_vec_Vec (hashmap_List_t T))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n1 =>
-    if n0 s> 0%usize
+  | S n2 =>
+    if n1 s> 0%usize
     then (
-      slots0 <- alloc_vec_Vec_push (hashmap_List_t T) slots Hashmap_List_Nil;
-      n2 <- usize_sub n0 1%usize;
-      hashmap_HashMap_allocate_slots_loop T n1 slots0 n2)
+      v <- alloc_vec_Vec_push (hashmap_List_t T) slots Hashmap_List_Nil;
+      n3 <- usize_sub n1 1%usize;
+      hashmap_HashMap_allocate_slots_loop T n2 v n3)
     else Return slots
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]:
     Source: 'src/hashmap.rs', lines 50:4-50:76 *)
 Definition hashmap_HashMap_allocate_slots
-  (T : Type) (n : nat) (slots : alloc_vec_Vec (hashmap_List_t T)) (n0 : usize)
+  (T : Type) (n : nat) (slots : alloc_vec_Vec (hashmap_List_t T)) (n1 : usize)
   :
   result (alloc_vec_Vec (hashmap_List_t T))
   :=
-  hashmap_HashMap_allocate_slots_loop T n slots n0
+  hashmap_HashMap_allocate_slots_loop T n slots n1
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]:
     Source: 'src/hashmap.rs', lines 59:4-63:13 *)
 Definition hashmap_HashMap_new_with_capacity
   (T : Type) (n : nat) (capacity : usize) (max_load_dividend : usize)
@@ -56,25 +56,24 @@ Definition hashmap_HashMap_new_with_capacity
   let v := alloc_vec_Vec_new (hashmap_List_t T) in
   slots <- hashmap_HashMap_allocate_slots T n v capacity;
   i <- usize_mul capacity max_load_dividend;
-  i0 <- usize_div i max_load_divisor;
+  i1 <- usize_div i max_load_divisor;
   Return
     {|
       hashmap_HashMap_num_entries := 0%usize;
       hashmap_HashMap_max_load_factor := (max_load_dividend, max_load_divisor);
-      hashmap_HashMap_max_load := i0;
+      hashmap_HashMap_max_load := i1;
       hashmap_HashMap_slots := slots
     |}
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]:
     Source: 'src/hashmap.rs', lines 75:4-75:24 *)
 Definition hashmap_HashMap_new
   (T : Type) (n : nat) : result (hashmap_HashMap_t T) :=
   hashmap_HashMap_new_with_capacity T n 32%usize 4%usize 5%usize
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0:
     Source: 'src/hashmap.rs', lines 80:4-88:5 *)
 Fixpoint hashmap_HashMap_clear_loop
   (T : Type) (n : nat) (slots : alloc_vec_Vec (hashmap_List_t T)) (i : usize) :
@@ -82,105 +81,78 @@ Fixpoint hashmap_HashMap_clear_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := alloc_vec_Vec_len (hashmap_List_t T) slots in
-    if i s< i0
+  | S n1 =>
+    let i1 := alloc_vec_Vec_len (hashmap_List_t T) slots in
+    if i s< i1
     then (
-      i1 <- usize_add i 1%usize;
-      slots0 <-
-        alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
+      p <-
+        alloc_vec_Vec_index_mut (hashmap_List_t T) usize
           (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T)) slots
-          i Hashmap_List_Nil;
-      hashmap_HashMap_clear_loop T n0 slots0 i1)
+          i;
+      let (_, index_mut_back) := p in
+      i2 <- usize_add i 1%usize;
+      slots1 <- index_mut_back Hashmap_List_Nil;
+      hashmap_HashMap_clear_loop T n1 slots1 i2)
     else Return slots
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]:
     Source: 'src/hashmap.rs', lines 80:4-80:27 *)
 Definition hashmap_HashMap_clear
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) :
   result (hashmap_HashMap_t T)
   :=
-  v <- hashmap_HashMap_clear_loop T n self.(hashmap_HashMap_slots) 0%usize;
+  back <- hashmap_HashMap_clear_loop T n self.(hashmap_HashMap_slots) 0%usize;
   Return
     {|
       hashmap_HashMap_num_entries := 0%usize;
       hashmap_HashMap_max_load_factor := self.(hashmap_HashMap_max_load_factor);
       hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
-      hashmap_HashMap_slots := v
+      hashmap_HashMap_slots := back
     |}
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]:
     Source: 'src/hashmap.rs', lines 90:4-90:30 *)
 Definition hashmap_HashMap_len
   (T : Type) (self : hashmap_HashMap_t T) : result usize :=
   Return self.(hashmap_HashMap_num_entries)
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 97:4-114:5 *)
 Fixpoint hashmap_HashMap_insert_in_list_loop
   (T : Type) (n : nat) (key : usize) (value : T) (ls : hashmap_List_t T) :
-  result bool
+  result (bool * (hashmap_List_t T))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | Hashmap_List_Cons ckey cvalue tl =>
-      if ckey s= key
-      then Return false
-      else hashmap_HashMap_insert_in_list_loop T n0 key value tl
-    | Hashmap_List_Nil => Return true
-    end
-  end
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: forward function
-    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
-Definition hashmap_HashMap_insert_in_list
-  (T : Type) (n : nat) (key : usize) (value : T) (ls : hashmap_List_t T) :
-  result bool
-  :=
-  hashmap_HashMap_insert_in_list_loop T n key value ls
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
-Fixpoint hashmap_HashMap_insert_in_list_loop_back
-  (T : Type) (n : nat) (key : usize) (value : T) (ls : hashmap_List_t T) :
-  result (hashmap_List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | Hashmap_List_Cons ckey cvalue tl =>
       if ckey s= key
-      then Return (Hashmap_List_Cons ckey value tl)
+      then Return (false, Hashmap_List_Cons ckey value tl)
       else (
-        tl0 <- hashmap_HashMap_insert_in_list_loop_back T n0 key value tl;
-        Return (Hashmap_List_Cons ckey cvalue tl0))
+        p <- hashmap_HashMap_insert_in_list_loop T n1 key value tl;
+        let (b, back) := p in
+        Return (b, Hashmap_List_Cons ckey cvalue back))
     | Hashmap_List_Nil =>
-      let l := Hashmap_List_Nil in Return (Hashmap_List_Cons key value l)
+      let l := Hashmap_List_Nil in Return (true, Hashmap_List_Cons key value l)
     end
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: backward function 0
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]:
     Source: 'src/hashmap.rs', lines 97:4-97:71 *)
-Definition hashmap_HashMap_insert_in_list_back
+Definition hashmap_HashMap_insert_in_list
   (T : Type) (n : nat) (key : usize) (value : T) (ls : hashmap_List_t T) :
-  result (hashmap_List_t T)
+  result (bool * (hashmap_List_t T))
   :=
-  hashmap_HashMap_insert_in_list_loop_back T n key value ls
+  hashmap_HashMap_insert_in_list_loop T n key value ls
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]:
     Source: 'src/hashmap.rs', lines 117:4-117:54 *)
 Definition hashmap_HashMap_insert_no_resize
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) (value : T) :
@@ -189,33 +161,27 @@ Definition hashmap_HashMap_insert_no_resize
   hash <- hashmap_hash_key key;
   let i := alloc_vec_Vec_len (hashmap_List_t T) self.(hashmap_HashMap_slots) in
   hash_mod <- usize_rem hash i;
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (hashmap_List_t T) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
       self.(hashmap_HashMap_slots) hash_mod;
-  inserted <- hashmap_HashMap_insert_in_list T n key value l;
+  let (l, index_mut_back) := p in
+  p1 <- hashmap_HashMap_insert_in_list T n key value l;
+  let (inserted, l1) := p1 in
   if inserted
   then (
-    i0 <- usize_add self.(hashmap_HashMap_num_entries) 1%usize;
-    l0 <- hashmap_HashMap_insert_in_list_back T n key value l;
-    v <-
-      alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-        self.(hashmap_HashMap_slots) hash_mod l0;
+    i1 <- usize_add self.(hashmap_HashMap_num_entries) 1%usize;
+    v <- index_mut_back l1;
     Return
       {|
-        hashmap_HashMap_num_entries := i0;
+        hashmap_HashMap_num_entries := i1;
         hashmap_HashMap_max_load_factor :=
           self.(hashmap_HashMap_max_load_factor);
         hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
         hashmap_HashMap_slots := v
       |})
   else (
-    l0 <- hashmap_HashMap_insert_in_list_back T n key value l;
-    v <-
-      alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-        self.(hashmap_HashMap_slots) hash_mod l0;
+    v <- index_mut_back l1;
     Return
       {|
         hashmap_HashMap_num_entries := self.(hashmap_HashMap_num_entries);
@@ -226,8 +192,7 @@ Definition hashmap_HashMap_insert_no_resize
       |})
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 183:4-196:5 *)
 Fixpoint hashmap_HashMap_move_elements_from_list_loop
   (T : Type) (n : nat) (ntable : hashmap_HashMap_t T) (ls : hashmap_List_t T) :
@@ -235,18 +200,17 @@ Fixpoint hashmap_HashMap_move_elements_from_list_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | Hashmap_List_Cons k v tl =>
-      ntable0 <- hashmap_HashMap_insert_no_resize T n0 ntable k v;
-      hashmap_HashMap_move_elements_from_list_loop T n0 ntable0 tl
+      hm <- hashmap_HashMap_insert_no_resize T n1 ntable k v;
+      hashmap_HashMap_move_elements_from_list_loop T n1 hm tl
     | Hashmap_List_Nil => Return ntable
     end
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]:
     Source: 'src/hashmap.rs', lines 183:4-183:72 *)
 Definition hashmap_HashMap_move_elements_from_list
   (T : Type) (n : nat) (ntable : hashmap_HashMap_t T) (ls : hashmap_List_t T) :
@@ -255,8 +219,7 @@ Definition hashmap_HashMap_move_elements_from_list
   hashmap_HashMap_move_elements_from_list_loop T n ntable ls
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0:
     Source: 'src/hashmap.rs', lines 171:4-180:5 *)
 Fixpoint hashmap_HashMap_move_elements_loop
   (T : Type) (n : nat) (ntable : hashmap_HashMap_t T)
@@ -265,40 +228,39 @@ Fixpoint hashmap_HashMap_move_elements_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := alloc_vec_Vec_len (hashmap_List_t T) slots in
-    if i s< i0
+  | S n1 =>
+    let i1 := alloc_vec_Vec_len (hashmap_List_t T) slots in
+    if i s< i1
     then (
-      l <-
+      p <-
         alloc_vec_Vec_index_mut (hashmap_List_t T) usize
           (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T)) slots
           i;
-      let ls := core_mem_replace (hashmap_List_t T) l Hashmap_List_Nil in
-      ntable0 <- hashmap_HashMap_move_elements_from_list T n0 ntable ls;
-      i1 <- usize_add i 1%usize;
-      let l0 := core_mem_replace_back (hashmap_List_t T) l Hashmap_List_Nil in
-      slots0 <-
-        alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
-          (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T)) slots
-          i l0;
-      hashmap_HashMap_move_elements_loop T n0 ntable0 slots0 i1)
+      let (l, index_mut_back) := p in
+      let (ls, l1) := core_mem_replace (hashmap_List_t T) l Hashmap_List_Nil in
+      hm <- hashmap_HashMap_move_elements_from_list T n1 ntable ls;
+      i2 <- usize_add i 1%usize;
+      slots1 <- index_mut_back l1;
+      back_'a <- hashmap_HashMap_move_elements_loop T n1 hm slots1 i2;
+      let (hm1, v) := back_'a in
+      Return (hm1, v))
     else Return (ntable, slots)
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]:
     Source: 'src/hashmap.rs', lines 171:4-171:95 *)
 Definition hashmap_HashMap_move_elements
   (T : Type) (n : nat) (ntable : hashmap_HashMap_t T)
   (slots : alloc_vec_Vec (hashmap_List_t T)) (i : usize) :
   result ((hashmap_HashMap_t T) * (alloc_vec_Vec (hashmap_List_t T)))
   :=
-  hashmap_HashMap_move_elements_loop T n ntable slots i
+  back_'a <- hashmap_HashMap_move_elements_loop T n ntable slots i;
+  let (hm, v) := back_'a in
+  Return (hm, v)
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]:
     Source: 'src/hashmap.rs', lines 140:4-140:28 *)
 Definition hashmap_HashMap_try_resize
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) :
@@ -308,72 +270,71 @@ Definition hashmap_HashMap_try_resize
   let capacity :=
     alloc_vec_Vec_len (hashmap_List_t T) self.(hashmap_HashMap_slots) in
   n1 <- usize_div max_usize 2%usize;
-  let (i, i0) := self.(hashmap_HashMap_max_load_factor) in
-  i1 <- usize_div n1 i;
-  if capacity s<= i1
+  let (i, i1) := self.(hashmap_HashMap_max_load_factor) in
+  i2 <- usize_div n1 i;
+  if capacity s<= i2
   then (
-    i2 <- usize_mul capacity 2%usize;
-    ntable <- hashmap_HashMap_new_with_capacity T n i2 i i0;
+    i3 <- usize_mul capacity 2%usize;
+    ntable <- hashmap_HashMap_new_with_capacity T n i3 i i1;
     p <-
       hashmap_HashMap_move_elements T n ntable self.(hashmap_HashMap_slots)
         0%usize;
-    let (ntable0, _) := p in
+    let (ntable1, _) := p in
     Return
       {|
         hashmap_HashMap_num_entries := self.(hashmap_HashMap_num_entries);
-        hashmap_HashMap_max_load_factor := (i, i0);
-        hashmap_HashMap_max_load := ntable0.(hashmap_HashMap_max_load);
-        hashmap_HashMap_slots := ntable0.(hashmap_HashMap_slots)
+        hashmap_HashMap_max_load_factor := (i, i1);
+        hashmap_HashMap_max_load := ntable1.(hashmap_HashMap_max_load);
+        hashmap_HashMap_slots := ntable1.(hashmap_HashMap_slots)
       |})
   else
     Return
       {|
         hashmap_HashMap_num_entries := self.(hashmap_HashMap_num_entries);
-        hashmap_HashMap_max_load_factor := (i, i0);
+        hashmap_HashMap_max_load_factor := (i, i1);
         hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
         hashmap_HashMap_slots := self.(hashmap_HashMap_slots)
       |}
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]:
     Source: 'src/hashmap.rs', lines 129:4-129:48 *)
 Definition hashmap_HashMap_insert
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) (value : T) :
   result (hashmap_HashMap_t T)
   :=
-  self0 <- hashmap_HashMap_insert_no_resize T n self key value;
-  i <- hashmap_HashMap_len T self0;
-  if i s> self0.(hashmap_HashMap_max_load)
-  then hashmap_HashMap_try_resize T n self0
-  else Return self0
+  hm <- hashmap_HashMap_insert_no_resize T n self key value;
+  i <- hashmap_HashMap_len T hm;
+  if i s> hm.(hashmap_HashMap_max_load)
+  then hashmap_HashMap_try_resize T n hm
+  else Return hm
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 206:4-219:5 *)
 Fixpoint hashmap_HashMap_contains_key_in_list_loop
   (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) : result bool :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
-    | Hashmap_List_Cons ckey t tl =>
+    | Hashmap_List_Cons ckey _ tl =>
       if ckey s= key
       then Return true
-      else hashmap_HashMap_contains_key_in_list_loop T n0 key tl
+      else hashmap_HashMap_contains_key_in_list_loop T n1 key tl
     | Hashmap_List_Nil => Return false
     end
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]:
     Source: 'src/hashmap.rs', lines 206:4-206:68 *)
 Definition hashmap_HashMap_contains_key_in_list
   (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) : result bool :=
   hashmap_HashMap_contains_key_in_list_loop T n key ls
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]:
     Source: 'src/hashmap.rs', lines 199:4-199:49 *)
 Definition hashmap_HashMap_contains_key
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) :
@@ -389,31 +350,31 @@ Definition hashmap_HashMap_contains_key
   hashmap_HashMap_contains_key_in_list T n key l
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 224:4-237:5 *)
 Fixpoint hashmap_HashMap_get_in_list_loop
   (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) : result T :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | Hashmap_List_Cons ckey cvalue tl =>
       if ckey s= key
       then Return cvalue
-      else hashmap_HashMap_get_in_list_loop T n0 key tl
+      else hashmap_HashMap_get_in_list_loop T n1 key tl
     | Hashmap_List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]:
     Source: 'src/hashmap.rs', lines 224:4-224:70 *)
 Definition hashmap_HashMap_get_in_list
   (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) : result T :=
   hashmap_HashMap_get_in_list_loop T n key ls
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]:
     Source: 'src/hashmap.rs', lines 239:4-239:55 *)
 Definition hashmap_HashMap_get
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) : result T :=
@@ -427,292 +388,209 @@ Definition hashmap_HashMap_get
   hashmap_HashMap_get_in_list T n key l
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 245:4-254:5 *)
 Fixpoint hashmap_HashMap_get_mut_in_list_loop
-  (T : Type) (n : nat) (ls : hashmap_List_t T) (key : usize) : result T :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | Hashmap_List_Cons ckey cvalue tl =>
-      if ckey s= key
-      then Return cvalue
-      else hashmap_HashMap_get_mut_in_list_loop T n0 tl key
-    | Hashmap_List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: forward function
-    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-Definition hashmap_HashMap_get_mut_in_list
-  (T : Type) (n : nat) (ls : hashmap_List_t T) (key : usize) : result T :=
-  hashmap_HashMap_get_mut_in_list_loop T n ls key
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
-Fixpoint hashmap_HashMap_get_mut_in_list_loop_back
-  (T : Type) (n : nat) (ls : hashmap_List_t T) (key : usize) (ret : T) :
-  result (hashmap_List_t T)
+  (T : Type) (n : nat) (ls : hashmap_List_t T) (key : usize) :
+  result (T * (T -> result (hashmap_List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | Hashmap_List_Cons ckey cvalue tl =>
       if ckey s= key
-      then Return (Hashmap_List_Cons ckey ret tl)
+      then
+        let back_'a := fun (ret : T) => Return (Hashmap_List_Cons ckey ret tl)
+          in
+        Return (cvalue, back_'a)
       else (
-        tl0 <- hashmap_HashMap_get_mut_in_list_loop_back T n0 tl key ret;
-        Return (Hashmap_List_Cons ckey cvalue tl0))
+        p <- hashmap_HashMap_get_mut_in_list_loop T n1 tl key;
+        let (t, back_'a) := p in
+        let back_'a1 :=
+          fun (ret : T) =>
+            tl1 <- back_'a ret; Return (Hashmap_List_Cons ckey cvalue tl1) in
+        Return (t, back_'a1))
     | Hashmap_List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]:
     Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-Definition hashmap_HashMap_get_mut_in_list_back
-  (T : Type) (n : nat) (ls : hashmap_List_t T) (key : usize) (ret : T) :
-  result (hashmap_List_t T)
+Definition hashmap_HashMap_get_mut_in_list
+  (T : Type) (n : nat) (ls : hashmap_List_t T) (key : usize) :
+  result (T * (T -> result (hashmap_List_t T)))
   :=
-  hashmap_HashMap_get_mut_in_list_loop_back T n ls key ret
+  p <- hashmap_HashMap_get_mut_in_list_loop T n ls key;
+  let (t, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (t, back_'a1)
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]:
     Source: 'src/hashmap.rs', lines 257:4-257:67 *)
 Definition hashmap_HashMap_get_mut
-  (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) : result T :=
-  hash <- hashmap_hash_key key;
-  let i := alloc_vec_Vec_len (hashmap_List_t T) self.(hashmap_HashMap_slots) in
-  hash_mod <- usize_rem hash i;
-  l <-
-    alloc_vec_Vec_index_mut (hashmap_List_t T) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-      self.(hashmap_HashMap_slots) hash_mod;
-  hashmap_HashMap_get_mut_in_list T n l key
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: backward function 0
-    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
-Definition hashmap_HashMap_get_mut_back
-  (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) (ret : T) :
-  result (hashmap_HashMap_t T)
+  (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) :
+  result (T * (T -> result (hashmap_HashMap_t T)))
   :=
   hash <- hashmap_hash_key key;
   let i := alloc_vec_Vec_len (hashmap_List_t T) self.(hashmap_HashMap_slots) in
   hash_mod <- usize_rem hash i;
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (hashmap_List_t T) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
       self.(hashmap_HashMap_slots) hash_mod;
-  l0 <- hashmap_HashMap_get_mut_in_list_back T n l key ret;
-  v <-
-    alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-      self.(hashmap_HashMap_slots) hash_mod l0;
-  Return
-    {|
-      hashmap_HashMap_num_entries := self.(hashmap_HashMap_num_entries);
-      hashmap_HashMap_max_load_factor := self.(hashmap_HashMap_max_load_factor);
-      hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
-      hashmap_HashMap_slots := v
-    |}
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
+  let (l, index_mut_back) := p in
+  p1 <- hashmap_HashMap_get_mut_in_list T n l key;
+  let (t, get_mut_in_list_back) := p1 in
+  let back_'a :=
+    fun (ret : T) =>
+      l1 <- get_mut_in_list_back ret;
+      v <- index_mut_back l1;
+      Return
+        {|
+          hashmap_HashMap_num_entries := self.(hashmap_HashMap_num_entries);
+          hashmap_HashMap_max_load_factor :=
+            self.(hashmap_HashMap_max_load_factor);
+          hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
+          hashmap_HashMap_slots := v
+        |} in
+  Return (t, back_'a)
+.
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 265:4-291:5 *)
 Fixpoint hashmap_HashMap_remove_from_list_loop
   (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) :
-  result (option T)
+  result ((option T) * (hashmap_List_t T))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | Hashmap_List_Cons ckey t tl =>
       if ckey s= key
       then
-        let mv_ls :=
+        let (mv_ls, _) :=
           core_mem_replace (hashmap_List_t T) (Hashmap_List_Cons ckey t tl)
             Hashmap_List_Nil in
         match mv_ls with
-        | Hashmap_List_Cons i cvalue tl0 => Return (Some cvalue)
+        | Hashmap_List_Cons _ cvalue tl1 => Return (Some cvalue, tl1)
         | Hashmap_List_Nil => Fail_ Failure
         end
-      else hashmap_HashMap_remove_from_list_loop T n0 key tl
-    | Hashmap_List_Nil => Return None
+      else (
+        p <- hashmap_HashMap_remove_from_list_loop T n1 key tl;
+        let (o, back) := p in
+        Return (o, Hashmap_List_Cons ckey t back))
+    | Hashmap_List_Nil => Return (None, Hashmap_List_Nil)
     end
   end
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]:
     Source: 'src/hashmap.rs', lines 265:4-265:69 *)
 Definition hashmap_HashMap_remove_from_list
   (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) :
-  result (option T)
+  result ((option T) * (hashmap_List_t T))
   :=
   hashmap_HashMap_remove_from_list_loop T n key ls
 .
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
-Fixpoint hashmap_HashMap_remove_from_list_loop_back
-  (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) :
-  result (hashmap_List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | Hashmap_List_Cons ckey t tl =>
-      if ckey s= key
-      then
-        let mv_ls :=
-          core_mem_replace (hashmap_List_t T) (Hashmap_List_Cons ckey t tl)
-            Hashmap_List_Nil in
-        match mv_ls with
-        | Hashmap_List_Cons i cvalue tl0 => Return tl0
-        | Hashmap_List_Nil => Fail_ Failure
-        end
-      else (
-        tl0 <- hashmap_HashMap_remove_from_list_loop_back T n0 key tl;
-        Return (Hashmap_List_Cons ckey t tl0))
-    | Hashmap_List_Nil => Return Hashmap_List_Nil
-    end
-  end
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
-Definition hashmap_HashMap_remove_from_list_back
-  (T : Type) (n : nat) (key : usize) (ls : hashmap_List_t T) :
-  result (hashmap_List_t T)
-  :=
-  hashmap_HashMap_remove_from_list_loop_back T n key ls
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]:
     Source: 'src/hashmap.rs', lines 294:4-294:52 *)
 Definition hashmap_HashMap_remove
   (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) :
-  result (option T)
+  result ((option T) * (hashmap_HashMap_t T))
   :=
   hash <- hashmap_hash_key key;
   let i := alloc_vec_Vec_len (hashmap_List_t T) self.(hashmap_HashMap_slots) in
   hash_mod <- usize_rem hash i;
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (hashmap_List_t T) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
       self.(hashmap_HashMap_slots) hash_mod;
-  x <- hashmap_HashMap_remove_from_list T n key l;
-  match x with
-  | None => Return None
-  | Some x0 =>
-    _ <- usize_sub self.(hashmap_HashMap_num_entries) 1%usize; Return (Some x0)
-  end
-.
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: backward function 0
-    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
-Definition hashmap_HashMap_remove_back
-  (T : Type) (n : nat) (self : hashmap_HashMap_t T) (key : usize) :
-  result (hashmap_HashMap_t T)
-  :=
-  hash <- hashmap_hash_key key;
-  let i := alloc_vec_Vec_len (hashmap_List_t T) self.(hashmap_HashMap_slots) in
-  hash_mod <- usize_rem hash i;
-  l <-
-    alloc_vec_Vec_index_mut (hashmap_List_t T) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-      self.(hashmap_HashMap_slots) hash_mod;
-  x <- hashmap_HashMap_remove_from_list T n key l;
+  let (l, index_mut_back) := p in
+  p1 <- hashmap_HashMap_remove_from_list T n key l;
+  let (x, l1) := p1 in
   match x with
   | None =>
-    l0 <- hashmap_HashMap_remove_from_list_back T n key l;
-    v <-
-      alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-        self.(hashmap_HashMap_slots) hash_mod l0;
-    Return
+    v <- index_mut_back l1;
+    Return (None,
       {|
         hashmap_HashMap_num_entries := self.(hashmap_HashMap_num_entries);
         hashmap_HashMap_max_load_factor :=
           self.(hashmap_HashMap_max_load_factor);
         hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
         hashmap_HashMap_slots := v
-      |}
-  | Some x0 =>
-    i0 <- usize_sub self.(hashmap_HashMap_num_entries) 1%usize;
-    l0 <- hashmap_HashMap_remove_from_list_back T n key l;
-    v <-
-      alloc_vec_Vec_index_mut_back (hashmap_List_t T) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t T))
-        self.(hashmap_HashMap_slots) hash_mod l0;
-    Return
+      |})
+  | Some x1 =>
+    i1 <- usize_sub self.(hashmap_HashMap_num_entries) 1%usize;
+    v <- index_mut_back l1;
+    Return (Some x1,
       {|
-        hashmap_HashMap_num_entries := i0;
+        hashmap_HashMap_num_entries := i1;
         hashmap_HashMap_max_load_factor :=
           self.(hashmap_HashMap_max_load_factor);
         hashmap_HashMap_max_load := self.(hashmap_HashMap_max_load);
         hashmap_HashMap_slots := v
-      |}
+      |})
   end
 .
 
-(** [hashmap_main::hashmap::test1]: forward function
+(** [hashmap_main::hashmap::test1]:
     Source: 'src/hashmap.rs', lines 315:0-315:10 *)
 Definition hashmap_test1 (n : nat) : result unit :=
   hm <- hashmap_HashMap_new u64 n;
-  hm0 <- hashmap_HashMap_insert u64 n hm 0%usize 42%u64;
-  hm1 <- hashmap_HashMap_insert u64 n hm0 128%usize 18%u64;
-  hm2 <- hashmap_HashMap_insert u64 n hm1 1024%usize 138%u64;
-  hm3 <- hashmap_HashMap_insert u64 n hm2 1056%usize 256%u64;
-  i <- hashmap_HashMap_get u64 n hm3 128%usize;
+  hm1 <- hashmap_HashMap_insert u64 n hm 0%usize 42%u64;
+  hm2 <- hashmap_HashMap_insert u64 n hm1 128%usize 18%u64;
+  hm3 <- hashmap_HashMap_insert u64 n hm2 1024%usize 138%u64;
+  hm4 <- hashmap_HashMap_insert u64 n hm3 1056%usize 256%u64;
+  i <- hashmap_HashMap_get u64 n hm4 128%usize;
   if negb (i s= 18%u64)
   then Fail_ Failure
   else (
-    hm4 <- hashmap_HashMap_get_mut_back u64 n hm3 1024%usize 56%u64;
-    i0 <- hashmap_HashMap_get u64 n hm4 1024%usize;
-    if negb (i0 s= 56%u64)
+    p <- hashmap_HashMap_get_mut u64 n hm4 1024%usize;
+    let (_, get_mut_back) := p in
+    hm5 <- get_mut_back 56%u64;
+    i1 <- hashmap_HashMap_get u64 n hm5 1024%usize;
+    if negb (i1 s= 56%u64)
     then Fail_ Failure
     else (
-      x <- hashmap_HashMap_remove u64 n hm4 1024%usize;
+      p1 <- hashmap_HashMap_remove u64 n hm5 1024%usize;
+      let (x, hm6) := p1 in
       match x with
       | None => Fail_ Failure
-      | Some x0 =>
-        if negb (x0 s= 56%u64)
+      | Some x1 =>
+        if negb (x1 s= 56%u64)
         then Fail_ Failure
         else (
-          hm5 <- hashmap_HashMap_remove_back u64 n hm4 1024%usize;
-          i1 <- hashmap_HashMap_get u64 n hm5 0%usize;
-          if negb (i1 s= 42%u64)
+          i2 <- hashmap_HashMap_get u64 n hm6 0%usize;
+          if negb (i2 s= 42%u64)
           then Fail_ Failure
           else (
-            i2 <- hashmap_HashMap_get u64 n hm5 128%usize;
-            if negb (i2 s= 18%u64)
+            i3 <- hashmap_HashMap_get u64 n hm6 128%usize;
+            if negb (i3 s= 18%u64)
             then Fail_ Failure
             else (
-              i3 <- hashmap_HashMap_get u64 n hm5 1056%usize;
-              if negb (i3 s= 256%u64) then Fail_ Failure else Return tt)))
+              i4 <- hashmap_HashMap_get u64 n hm6 1056%usize;
+              if negb (i4 s= 256%u64) then Fail_ Failure else Return tt)))
       end))
 .
 
-(** [hashmap_main::insert_on_disk]: forward function
+(** [hashmap_main::insert_on_disk]:
     Source: 'src/hashmap_main.rs', lines 7:0-7:43 *)
 Definition insert_on_disk
   (n : nat) (key : usize) (value : u64) (st : state) : result (state * unit) :=
   p <- hashmap_utils_deserialize st;
-  let (st0, hm) := p in
-  hm0 <- hashmap_HashMap_insert u64 n hm key value;
-  p0 <- hashmap_utils_serialize hm0 st0;
-  let (st1, _) := p0 in
-  Return (st1, tt)
+  let (st1, hm) := p in
+  hm1 <- hashmap_HashMap_insert u64 n hm key value;
+  p1 <- hashmap_utils_serialize hm1 st1;
+  let (st2, _) := p1 in
+  Return (st2, tt)
 .
 
-(** [hashmap_main::main]: forward function
+(** [hashmap_main::main]:
     Source: 'src/hashmap_main.rs', lines 16:0-16:13 *)
 Definition main : result unit :=
   Return tt.
diff --git a/tests/coq/hashmap_on_disk/HashmapMain_FunsExternal_Template.v b/tests/coq/hashmap_on_disk/HashmapMain_FunsExternal_Template.v
index e10d02f6..fb2e052a 100644
--- a/tests/coq/hashmap_on_disk/HashmapMain_FunsExternal_Template.v
+++ b/tests/coq/hashmap_on_disk/HashmapMain_FunsExternal_Template.v
@@ -11,13 +11,13 @@ Require Import HashmapMain_Types.
 Include HashmapMain_Types.
 Module HashmapMain_FunsExternal_Template.
 
-(** [hashmap_main::hashmap_utils::deserialize]: forward function
+(** [hashmap_main::hashmap_utils::deserialize]:
     Source: 'src/hashmap_utils.rs', lines 10:0-10:43 *)
 Axiom hashmap_utils_deserialize
   : state -> result (state * (hashmap_HashMap_t u64))
 .
 
-(** [hashmap_main::hashmap_utils::serialize]: forward function
+(** [hashmap_main::hashmap_utils::serialize]:
     Source: 'src/hashmap_utils.rs', lines 5:0-5:42 *)
 Axiom hashmap_utils_serialize
   : hashmap_HashMap_t u64 -> state -> result (state * unit)
diff --git a/tests/coq/hashmap_on_disk/Primitives.v b/tests/coq/hashmap_on_disk/Primitives.v
index 84280b96..990e27e4 100644
--- a/tests/coq/hashmap_on_disk/Primitives.v
+++ b/tests/coq/hashmap_on_disk/Primitives.v
@@ -67,8 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a := x .
-Definition core_mem_replace_back (a : Type) (x : a) (y : a) : a := y .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -504,13 +503,15 @@ Arguments core_ops_index_Index_index {_ _}.
 (* Trait declaration: [core::ops::index::IndexMut] *)
 Record core_ops_index_IndexMut (Self Idx : Type) := mk_core_ops_index_IndexMut {
   core_ops_index_IndexMut_indexInst : core_ops_index_Index Self Idx;
-  core_ops_index_IndexMut_index_mut : Self -> Idx -> result core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output);
-  core_ops_index_IndexMut_index_mut_back : Self -> Idx -> core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self;
+  core_ops_index_IndexMut_index_mut :
+    Self ->
+    Idx ->
+    result (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) *
+            (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self));
 }.
 Arguments mk_core_ops_index_IndexMut {_ _}.
 Arguments core_ops_index_IndexMut_indexInst {_ _}.
 Arguments core_ops_index_IndexMut_index_mut {_ _}.
-Arguments core_ops_index_IndexMut_index_mut_back {_ _}.
 
 (* Trait declaration [core::ops::deref::Deref] *)
 Record core_ops_deref_Deref (Self : Type) := mk_core_ops_deref_Deref {
@@ -524,13 +525,14 @@ Arguments core_ops_deref_Deref_deref {_}.
 (* Trait declaration [core::ops::deref::DerefMut] *)
 Record core_ops_deref_DerefMut (Self : Type) := mk_core_ops_deref_DerefMut {
   core_ops_deref_DerefMut_derefInst : core_ops_deref_Deref Self;
-  core_ops_deref_DerefMut_deref_mut : Self -> result core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target);
-  core_ops_deref_DerefMut_deref_mut_back : Self -> core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self;
+  core_ops_deref_DerefMut_deref_mut :
+    Self ->
+    result (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) *
+            (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self));
 }.
 Arguments mk_core_ops_deref_DerefMut {_}.
 Arguments core_ops_deref_DerefMut_derefInst {_}.
 Arguments core_ops_deref_DerefMut_deref_mut {_}.
-Arguments core_ops_deref_DerefMut_deref_mut_back {_}.
 
 Record core_ops_range_Range (T : Type) := mk_core_ops_range_Range {
   core_ops_range_Range_start : T;
@@ -543,8 +545,8 @@ Arguments core_ops_range_Range_end_ {_}.
 (*** [alloc] *)
 
 Definition alloc_boxed_Box_deref (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut_back (T : Type) (_ : T) (x : T) : result T := Return x.
+Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result (T * (T -> result T)) :=
+  Return (x, fun x => Return x).
 
 (* Trait instance *)
 Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref Self := {|
@@ -556,7 +558,6 @@ Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref
 Definition alloc_boxed_Box_coreopsDerefMutInst (Self : Type) : core_ops_deref_DerefMut Self := {|
   core_ops_deref_DerefMut_derefInst := alloc_boxed_Box_coreopsDerefInst Self;
   core_ops_deref_DerefMut_deref_mut := alloc_boxed_Box_deref_mut Self;
-  core_ops_deref_DerefMut_deref_mut_back := alloc_boxed_Box_deref_mut_back Self;
 |}.
 
 
@@ -584,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -591,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
@@ -639,16 +661,9 @@ Definition alloc_vec_Vec_bind {A B} (v: alloc_vec_Vec A) (f: list A -> result (l
   | right _ => Fail_ Failure
   end.
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_push_fwd (T: Type) (v: alloc_vec_Vec T) (x: T) : unit := tt.
-
 Definition alloc_vec_Vec_push (T: Type) (v: alloc_vec_Vec T) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l => Return (l ++ [x])).
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_insert_fwd (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result unit :=
-  if to_Z i <? alloc_vec_Vec_length v then Return tt else Fail_ Failure.
-
 Definition alloc_vec_Vec_insert (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l =>
     if to_Z i <? Z.of_nat (length l)
@@ -661,6 +676,14 @@ Axiom alloc_vec_Vec_index_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : u
 (* Helper *)
 Axiom alloc_vec_Vec_update_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : usize) (x : T), result (alloc_vec_Vec T).
 
+Definition alloc_vec_Vec_index_mut_usize {T : Type} (v: alloc_vec_Vec T) (i: usize) :
+  result (T * (T -> result (alloc_vec_Vec T))) :=
+  match alloc_vec_Vec_index_usize v i with
+  | Return x =>
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail_ e => Fail_ e
+  end.
+
 (* Trait declaration: [core::slice::index::private_slice_index::Sealed] *)
 Definition core_slice_index_private_slice_index_Sealed (self : Type) := unit.
 
@@ -669,25 +692,23 @@ Record core_slice_index_SliceIndex (Self T : Type) := mk_core_slice_index_SliceI
   core_slice_index_SliceIndex_sealedInst : core_slice_index_private_slice_index_Sealed Self;
   core_slice_index_SliceIndex_Output : Type;
   core_slice_index_SliceIndex_get : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut_back : Self -> T -> option core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_get_mut :
+    Self -> T -> result (option core_slice_index_SliceIndex_Output * (option core_slice_index_SliceIndex_Output -> result T));
   core_slice_index_SliceIndex_get_unchecked : Self -> const_raw_ptr T -> result (const_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_get_unchecked_mut : Self -> mut_raw_ptr T -> result (mut_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_index : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut_back : Self -> T -> core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_index_mut :
+    Self -> T -> result (core_slice_index_SliceIndex_Output * (core_slice_index_SliceIndex_Output -> result T));
 }.
 Arguments mk_core_slice_index_SliceIndex {_ _}.
 Arguments core_slice_index_SliceIndex_sealedInst {_ _}.
 Arguments core_slice_index_SliceIndex_Output {_ _}.
 Arguments core_slice_index_SliceIndex_get {_ _}.
 Arguments core_slice_index_SliceIndex_get_mut {_ _}.
-Arguments core_slice_index_SliceIndex_get_mut_back {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked_mut {_ _}.
 Arguments core_slice_index_SliceIndex_index {_ _}.
 Arguments core_slice_index_SliceIndex_index_mut {_ _}.
-Arguments core_slice_index_SliceIndex_index_mut_back {_ _}.
 
 (* [core::slice::index::[T]::index]: forward function *)
 Definition core_slice_index_Slice_index
@@ -704,11 +725,9 @@ Axiom core_slice_index_RangeUsize_get : forall (T : Type) (i : core_ops_range_Ra
 
 (* [core::slice::index::Range::get_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_get_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (option (slice T)).
-
-(* [core::slice::index::Range::get_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_get_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> option (slice T) -> result (slice T).
+  forall (T : Type),
+    core_ops_range_Range usize -> slice T ->
+    result (option (slice T) * (option (slice T) -> result (slice T))).
 
 (* [core::slice::index::Range::get_unchecked]: forward function *)
 Definition core_slice_index_RangeUsize_get_unchecked
@@ -732,21 +751,14 @@ Axiom core_slice_index_RangeUsize_index :
 
 (* [core::slice::index::Range::index_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_index_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T).
-
-(* [core::slice::index::Range::index_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_index_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> slice T -> result (slice T).
+  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T * (slice T -> result (slice T))).
 
 (* [core::slice::index::[T]::index_mut]: forward function *)
 Axiom core_slice_index_Slice_index_mut :
   forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> result inst.(core_slice_index_SliceIndex_Output).
-
-(* [core::slice::index::[T]::index_mut]: backward function 0 *)
-Axiom core_slice_index_Slice_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> inst.(core_slice_index_SliceIndex_Output) -> result (slice T).
+  slice T -> Idx ->
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (slice T))).
 
 (* [core::array::[T; N]::index]: forward function *)
 Axiom core_array_Array_index :
@@ -756,12 +768,9 @@ Axiom core_array_Array_index :
 (* [core::array::[T; N]::index_mut]: forward function *)
 Axiom core_array_Array_index_mut :
   forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx), result inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output).
-
-(* [core::array::[T; N]::index_mut]: backward function 0 *)
-Axiom core_array_Array_index_mut_back :
-  forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx) (x : inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output)), result (array T N).
+  (a : array T N) (i : Idx),
+  result (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) *
+          (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) -> result (array T N))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::Range] *)
 Definition core_slice_index_private_slice_index_SealedRangeUsizeInst
@@ -774,12 +783,10 @@ Definition core_slice_index_SliceIndexRangeUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := slice T;
   core_slice_index_SliceIndex_get := core_slice_index_RangeUsize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_RangeUsize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_RangeUsize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_RangeUsize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_RangeUsize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_RangeUsize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_RangeUsize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_RangeUsize_index_mut_back T;
 |}.
 
 (* Trait implementation: [core::slice::index::[T]] *)
@@ -796,7 +803,6 @@ Definition core_ops_index_IndexMutSliceTIInst (T Idx : Type)
   core_ops_index_IndexMut (slice T) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexSliceTIInst T Idx inst;
   core_ops_index_IndexMut_index_mut := core_slice_index_Slice_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := core_slice_index_Slice_index_mut_back T Idx inst;
 |}.
 
 (* Trait implementation: [core::array::[T; N]] *)
@@ -813,18 +819,14 @@ Definition core_ops_index_IndexMutArrayInst (T Idx : Type) (N : usize)
   core_ops_index_IndexMut (array T N) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexArrayInst T Idx N inst.(core_ops_index_IndexMut_indexInst);
   core_ops_index_IndexMut_index_mut := core_array_Array_index_mut T Idx N inst;
-  core_ops_index_IndexMut_index_mut_back := core_array_Array_index_mut_back T Idx N inst;
 |}.
 
 (* [core::slice::index::usize::get]: forward function *)
 Axiom core_slice_index_usize_get : forall (T : Type), usize -> slice T -> result (option T).
 
 (* [core::slice::index::usize::get_mut]: forward function *)
-Axiom core_slice_index_usize_get_mut : forall (T : Type), usize -> slice T -> result (option T).
-
-(* [core::slice::index::usize::get_mut]: backward function 0 *)
-Axiom core_slice_index_usize_get_mut_back :
-  forall (T : Type), usize -> slice T -> option T -> result (slice T).
+Axiom core_slice_index_usize_get_mut :
+  forall (T : Type), usize -> slice T -> result (option T * (option T -> result (slice T))).
 
 (* [core::slice::index::usize::get_unchecked]: forward function *)
 Axiom core_slice_index_usize_get_unchecked :
@@ -838,11 +840,8 @@ Axiom core_slice_index_usize_get_unchecked_mut :
 Axiom core_slice_index_usize_index : forall (T : Type), usize -> slice T -> result T.
 
 (* [core::slice::index::usize::index_mut]: forward function *)
-Axiom core_slice_index_usize_index_mut : forall (T : Type), usize -> slice T -> result T.
-
-(* [core::slice::index::usize::index_mut]: backward function 0 *)
-Axiom core_slice_index_usize_index_mut_back :
-  forall (T : Type), usize -> slice T -> T -> result (slice T).
+Axiom core_slice_index_usize_index_mut :
+  forall (T : Type), usize -> slice T -> result (T * (T -> result (slice T))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::usize] *)
 Definition core_slice_index_private_slice_index_SealedUsizeInst
@@ -855,12 +854,10 @@ Definition core_slice_index_SliceIndexUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := T;
   core_slice_index_SliceIndex_get := core_slice_index_usize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_usize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_usize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_usize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_usize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_usize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_usize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_usize_index_mut_back T;
 |}.
 
 (* [alloc::vec::Vec::index]: forward function *)
@@ -869,12 +866,9 @@ Axiom alloc_vec_Vec_index : forall (T Idx : Type) (inst : core_slice_index_Slice
 
 (* [alloc::vec::Vec::index_mut]: forward function *)
 Axiom alloc_vec_Vec_index_mut : forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx), result inst.(core_slice_index_SliceIndex_Output).
-
-(* [alloc::vec::Vec::index_mut]: backward function 0 *)
-Axiom alloc_vec_Vec_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx) (x : inst.(core_slice_index_SliceIndex_Output)), result (alloc_vec_Vec T).
+  (Self : alloc_vec_Vec T) (i : Idx),
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (alloc_vec_Vec T))).
 
 (* Trait implementation: [alloc::vec::Vec] *)
 Definition alloc_vec_Vec_coreopsindexIndexInst (T Idx : Type)
@@ -890,7 +884,6 @@ Definition alloc_vec_Vec_coreopsindexIndexMutInst (T Idx : Type)
   core_ops_index_IndexMut (alloc_vec_Vec T) Idx := {|
   core_ops_index_IndexMut_indexInst := alloc_vec_Vec_coreopsindexIndexInst T Idx inst;
   core_ops_index_IndexMut_index_mut := alloc_vec_Vec_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := alloc_vec_Vec_index_mut_back T Idx inst;
 |}.
 
 (*** Theorems *)
@@ -901,10 +894,6 @@ Axiom alloc_vec_Vec_index_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usiz
 
 Axiom alloc_vec_Vec_index_mut_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
   alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i =
-    alloc_vec_Vec_index_usize v i.
-
-Axiom alloc_vec_Vec_index_mut_back_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
-  alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x =
-    alloc_vec_Vec_update_usize v i x.
+    alloc_vec_Vec_index_mut_usize v i.
 
 End Primitives.
diff --git a/tests/coq/misc/Bitwise.v b/tests/coq/misc/Bitwise.v
index 94771b37..b04c95f2 100644
--- a/tests/coq/misc/Bitwise.v
+++ b/tests/coq/misc/Bitwise.v
@@ -8,29 +8,29 @@ Import ListNotations.
 Local Open Scope Primitives_scope.
 Module Bitwise.
 
-(** [bitwise::shift_u32]: forward function
+(** [bitwise::shift_u32]:
     Source: 'src/bitwise.rs', lines 3:0-3:31 *)
 Definition shift_u32 (a : u32) : result u32 :=
   t <- u32_shr a 16%usize; u32_shl t 16%usize
 .
 
-(** [bitwise::shift_i32]: forward function
+(** [bitwise::shift_i32]:
     Source: 'src/bitwise.rs', lines 10:0-10:31 *)
 Definition shift_i32 (a : i32) : result i32 :=
   t <- i32_shr a 16%isize; i32_shl t 16%isize
 .
 
-(** [bitwise::xor_u32]: forward function
+(** [bitwise::xor_u32]:
     Source: 'src/bitwise.rs', lines 17:0-17:37 *)
 Definition xor_u32 (a : u32) (b : u32) : result u32 :=
   Return (u32_xor a b).
 
-(** [bitwise::or_u32]: forward function
+(** [bitwise::or_u32]:
     Source: 'src/bitwise.rs', lines 21:0-21:36 *)
 Definition or_u32 (a : u32) (b : u32) : result u32 :=
   Return (u32_or a b).
 
-(** [bitwise::and_u32]: forward function
+(** [bitwise::and_u32]:
     Source: 'src/bitwise.rs', lines 25:0-25:37 *)
 Definition and_u32 (a : u32) (b : u32) : result u32 :=
   Return (u32_and a b).
diff --git a/tests/coq/misc/Constants.v b/tests/coq/misc/Constants.v
index ad899f25..0f33cbd6 100644
--- a/tests/coq/misc/Constants.v
+++ b/tests/coq/misc/Constants.v
@@ -23,7 +23,7 @@ Definition x1_c : u32 := x1_body%global.
 Definition x2_body : result u32 := Return 3%u32.
 Definition x2_c : u32 := x2_body%global.
 
-(** [constants::incr]: forward function
+(** [constants::incr]:
     Source: 'src/constants.rs', lines 17:0-17:32 *)
 Definition incr (n : u32) : result u32 :=
   u32_add n 1%u32.
@@ -33,7 +33,7 @@ Definition incr (n : u32) : result u32 :=
 Definition x3_body : result u32 := incr 32%u32.
 Definition x3_c : u32 := x3_body%global.
 
-(** [constants::mk_pair0]: forward function
+(** [constants::mk_pair0]:
     Source: 'src/constants.rs', lines 23:0-23:51 *)
 Definition mk_pair0 (x : u32) (y : u32) : result (u32 * u32) :=
   Return (x, y).
@@ -46,7 +46,7 @@ Arguments mkPair_t { _ _ }.
 Arguments pair_x { _ _ }.
 Arguments pair_y { _ _ }.
 
-(** [constants::mk_pair1]: forward function
+(** [constants::mk_pair1]:
     Source: 'src/constants.rs', lines 27:0-27:55 *)
 Definition mk_pair1 (x : u32) (y : u32) : result (Pair_t u32 u32) :=
   Return {| pair_x := x; pair_y := y |}
@@ -81,7 +81,7 @@ Record Wrap_t (T : Type) := mkWrap_t { wrap_value : T; }.
 Arguments mkWrap_t { _ }.
 Arguments wrap_value { _ }.
 
-(** [constants::{constants::Wrap<T>}::new]: forward function
+(** [constants::{constants::Wrap<T>}::new]:
     Source: 'src/constants.rs', lines 54:4-54:41 *)
 Definition wrap_new (T : Type) (value : T) : result (Wrap_t T) :=
   Return {| wrap_value := value |}
@@ -92,7 +92,7 @@ Definition wrap_new (T : Type) (value : T) : result (Wrap_t T) :=
 Definition y_body : result (Wrap_t i32) := wrap_new i32 2%i32.
 Definition y_c : Wrap_t i32 := y_body%global.
 
-(** [constants::unwrap_y]: forward function
+(** [constants::unwrap_y]:
     Source: 'src/constants.rs', lines 43:0-43:30 *)
 Definition unwrap_y : result i32 :=
   Return y_c.(wrap_value).
@@ -107,12 +107,12 @@ Definition yval_c : i32 := yval_body%global.
 Definition get_z1_z1_body : result i32 := Return 3%i32.
 Definition get_z1_z1_c : i32 := get_z1_z1_body%global.
 
-(** [constants::get_z1]: forward function
+(** [constants::get_z1]:
     Source: 'src/constants.rs', lines 61:0-61:28 *)
 Definition get_z1 : result i32 :=
   Return get_z1_z1_c.
 
-(** [constants::add]: forward function
+(** [constants::add]:
     Source: 'src/constants.rs', lines 66:0-66:39 *)
 Definition add (a : i32) (b : i32) : result i32 :=
   i32_add a b.
@@ -132,10 +132,10 @@ Definition q2_c : i32 := q2_body%global.
 Definition q3_body : result i32 := add q2_c 3%i32.
 Definition q3_c : i32 := q3_body%global.
 
-(** [constants::get_z2]: forward function
+(** [constants::get_z2]:
     Source: 'src/constants.rs', lines 70:0-70:28 *)
 Definition get_z2 : result i32 :=
-  i <- get_z1; i0 <- add i q3_c; add q1_c i0.
+  i <- get_z1; i1 <- add i q3_c; add q1_c i1.
 
 (** [constants::S1]
     Source: 'src/constants.rs', lines 80:0-80:18 *)
diff --git a/tests/coq/misc/External_Funs.v b/tests/coq/misc/External_Funs.v
index e9d39f66..049f5d39 100644
--- a/tests/coq/misc/External_Funs.v
+++ b/tests/coq/misc/External_Funs.v
@@ -12,44 +12,23 @@ Require Import External_FunsExternal.
 Include External_FunsExternal.
 Module External_Funs.
 
-(** [external::swap]: forward function
+(** [external::swap]:
     Source: 'src/external.rs', lines 6:0-6:46 *)
 Definition swap
-  (T : Type) (x : T) (y : T) (st : state) : result (state * unit) :=
-  p <- core_mem_swap T x y st;
-  let (st0, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st0;
-  let (st1, _) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st1;
-  let (st2, _) := p1 in
-  Return (st2, tt)
+  (T : Type) (x : T) (y : T) (st : state) : result (state * (T * T)) :=
+  core_mem_swap T x y st
 .
 
-(** [external::swap]: backward function 0
-    Source: 'src/external.rs', lines 6:0-6:46 *)
-Definition swap_back
-  (T : Type) (x : T) (y : T) (st : state) (st0 : state) :
-  result (state * (T * T))
-  :=
-  p <- core_mem_swap T x y st;
-  let (st1, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st1;
-  let (st2, x0) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st2;
-  let (_, y0) := p1 in
-  Return (st0, (x0, y0))
-.
-
-(** [external::test_new_non_zero_u32]: forward function
+(** [external::test_new_non_zero_u32]:
     Source: 'src/external.rs', lines 11:0-11:60 *)
 Definition test_new_non_zero_u32
   (x : u32) (st : state) : result (state * core_num_nonzero_NonZeroU32_t) :=
   p <- core_num_nonzero_NonZeroU32_new x st;
-  let (st0, o) := p in
-  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st0
+  let (st1, o) := p in
+  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st1
 .
 
-(** [external::test_vec]: forward function
+(** [external::test_vec]:
     Source: 'src/external.rs', lines 17:0-17:17 *)
 Definition test_vec : result unit :=
   let v := alloc_vec_Vec_new u32 in
@@ -60,59 +39,39 @@ Definition test_vec : result unit :=
 (** Unit test for [external::test_vec] *)
 Check (test_vec )%return.
 
-(** [external::custom_swap]: forward function
+(** [external::custom_swap]:
     Source: 'src/external.rs', lines 24:0-24:66 *)
 Definition custom_swap
-  (T : Type) (x : T) (y : T) (st : state) : result (state * T) :=
-  p <- core_mem_swap T x y st;
-  let (st0, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st0;
-  let (st1, x0) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st1;
-  let (st2, _) := p1 in
-  Return (st2, x0)
-.
-
-(** [external::custom_swap]: backward function 0
-    Source: 'src/external.rs', lines 24:0-24:66 *)
-Definition custom_swap_back
-  (T : Type) (x : T) (y : T) (st : state) (ret : T) (st0 : state) :
-  result (state * (T * T))
+  (T : Type) (x : T) (y : T) (st : state) :
+  result (state * (T * (T -> state -> result (state * (T * T)))))
   :=
   p <- core_mem_swap T x y st;
-  let (st1, _) := p in
-  p0 <- core_mem_swap_back0 T x y st st1;
-  let (st2, _) := p0 in
-  p1 <- core_mem_swap_back1 T x y st st2;
-  let (_, y0) := p1 in
-  Return (st0, (ret, y0))
+  let (st1, p1) := p in
+  let (t, t1) := p1 in
+  let back_'a := fun (ret : T) (st2 : state) => Return (st2, (ret, t1)) in
+  Return (st1, (t, back_'a))
 .
 
-(** [external::test_custom_swap]: forward function
+(** [external::test_custom_swap]:
     Source: 'src/external.rs', lines 29:0-29:59 *)
 Definition test_custom_swap
-  (x : u32) (y : u32) (st : state) : result (state * unit) :=
-  p <- custom_swap u32 x y st; let (st0, _) := p in Return (st0, tt)
-.
-
-(** [external::test_custom_swap]: backward function 0
-    Source: 'src/external.rs', lines 29:0-29:59 *)
-Definition test_custom_swap_back
-  (x : u32) (y : u32) (st : state) (st0 : state) :
-  result (state * (u32 * u32))
-  :=
-  custom_swap_back u32 x y st 1%u32 st0
+  (x : u32) (y : u32) (st : state) : result (state * (u32 * u32)) :=
+  p <- custom_swap u32 x y st;
+  let (st1, p1) := p in
+  let (_, custom_swap_back) := p1 in
+  p2 <- custom_swap_back 1%u32 st1;
+  let (_, p3) := p2 in
+  let (x1, y1) := p3 in
+  Return (st1, (x1, y1))
 .
 
-(** [external::test_swap_non_zero]: forward function
+(** [external::test_swap_non_zero]:
     Source: 'src/external.rs', lines 35:0-35:44 *)
 Definition test_swap_non_zero (x : u32) (st : state) : result (state * u32) :=
   p <- swap u32 x 0%u32 st;
-  let (st0, _) := p in
-  p0 <- swap_back u32 x 0%u32 st st0;
-  let (st1, p1) := p0 in
-  let (x0, _) := p1 in
-  if x0 s= 0%u32 then Fail_ Failure else Return (st1, x0)
+  let (st1, p1) := p in
+  let (x1, _) := p1 in
+  if x1 s= 0%u32 then Fail_ Failure else Return (st1, x1)
 .
 
 End External_Funs.
diff --git a/tests/coq/misc/External_FunsExternal_Template.v b/tests/coq/misc/External_FunsExternal_Template.v
index 31e69c39..6773ac18 100644
--- a/tests/coq/misc/External_FunsExternal_Template.v
+++ b/tests/coq/misc/External_FunsExternal_Template.v
@@ -11,31 +11,19 @@ Require Import External_Types.
 Include External_Types.
 Module External_FunsExternal_Template.
 
-(** [core::mem::swap]: forward function
+(** [core::mem::swap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
 Axiom core_mem_swap :
-  forall(T : Type), T -> T -> state -> result (state * unit)
+  forall(T : Type), T -> T -> state -> result (state * (T * T))
 .
 
-(** [core::mem::swap]: backward function 0
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap_back0 :
-  forall(T : Type), T -> T -> state -> state -> result (state * T)
-.
-
-(** [core::mem::swap]: backward function 1
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap_back1 :
-  forall(T : Type), T -> T -> state -> state -> result (state * T)
-.
-
-(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]: forward function
+(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/num/nonzero.rs', lines 79:16-79:57 *)
 Axiom core_num_nonzero_NonZeroU32_new
   : u32 -> state -> result (state * (option core_num_nonzero_NonZeroU32_t))
 .
 
-(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+(** [core::option::{core::option::Option<T>}::unwrap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
 Axiom core_option_Option_unwrap :
   forall(T : Type), option T -> state -> result (state * T)
diff --git a/tests/coq/misc/Loops.v b/tests/coq/misc/Loops.v
index 83c249c1..313c2cfd 100644
--- a/tests/coq/misc/Loops.v
+++ b/tests/coq/misc/Loops.v
@@ -8,90 +8,90 @@ Import ListNotations.
 Local Open Scope Primitives_scope.
 Module Loops.
 
-(** [loops::sum]: loop 0: forward function
+(** [loops::sum]: loop 0:
     Source: 'src/loops.rs', lines 4:0-14:1 *)
 Fixpoint sum_loop (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if i s< max
-    then (s0 <- u32_add s i; i0 <- u32_add i 1%u32; sum_loop n0 max i0 s0)
+    then (s1 <- u32_add s i; i1 <- u32_add i 1%u32; sum_loop n1 max i1 s1)
     else u32_mul s 2%u32
   end
 .
 
-(** [loops::sum]: forward function
+(** [loops::sum]:
     Source: 'src/loops.rs', lines 4:0-4:27 *)
 Definition sum (n : nat) (max : u32) : result u32 :=
   sum_loop n max 0%u32 0%u32
 .
 
-(** [loops::sum_with_mut_borrows]: loop 0: forward function
+(** [loops::sum_with_mut_borrows]: loop 0:
     Source: 'src/loops.rs', lines 19:0-31:1 *)
 Fixpoint sum_with_mut_borrows_loop
   (n : nat) (max : u32) (mi : u32) (ms : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if mi s< max
     then (
-      ms0 <- u32_add ms mi;
-      mi0 <- u32_add mi 1%u32;
-      sum_with_mut_borrows_loop n0 max mi0 ms0)
+      ms1 <- u32_add ms mi;
+      mi1 <- u32_add mi 1%u32;
+      sum_with_mut_borrows_loop n1 max mi1 ms1)
     else u32_mul ms 2%u32
   end
 .
 
-(** [loops::sum_with_mut_borrows]: forward function
+(** [loops::sum_with_mut_borrows]:
     Source: 'src/loops.rs', lines 19:0-19:44 *)
 Definition sum_with_mut_borrows (n : nat) (max : u32) : result u32 :=
   sum_with_mut_borrows_loop n max 0%u32 0%u32
 .
 
-(** [loops::sum_with_shared_borrows]: loop 0: forward function
+(** [loops::sum_with_shared_borrows]: loop 0:
     Source: 'src/loops.rs', lines 34:0-48:1 *)
 Fixpoint sum_with_shared_borrows_loop
   (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     if i s< max
     then (
-      i0 <- u32_add i 1%u32;
-      s0 <- u32_add s i0;
-      sum_with_shared_borrows_loop n0 max i0 s0)
+      i1 <- u32_add i 1%u32;
+      s1 <- u32_add s i1;
+      sum_with_shared_borrows_loop n1 max i1 s1)
     else u32_mul s 2%u32
   end
 .
 
-(** [loops::sum_with_shared_borrows]: forward function
+(** [loops::sum_with_shared_borrows]:
     Source: 'src/loops.rs', lines 34:0-34:47 *)
 Definition sum_with_shared_borrows (n : nat) (max : u32) : result u32 :=
   sum_with_shared_borrows_loop n max 0%u32 0%u32
 .
 
-(** [loops::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [loops::clear]: loop 0:
     Source: 'src/loops.rs', lines 52:0-58:1 *)
 Fixpoint clear_loop
   (n : nat) (v : alloc_vec_Vec u32) (i : usize) : result (alloc_vec_Vec u32) :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
-    let i0 := alloc_vec_Vec_len u32 v in
-    if i s< i0
+  | S n1 =>
+    let i1 := alloc_vec_Vec_len u32 v in
+    if i s< i1
     then (
-      i1 <- usize_add i 1%usize;
-      v0 <-
-        alloc_vec_Vec_index_mut_back u32 usize
-          (core_slice_index_SliceIndexUsizeSliceTInst u32) v i 0%u32;
-      clear_loop n0 v0 i1)
+      p <-
+        alloc_vec_Vec_index_mut u32 usize
+          (core_slice_index_SliceIndexUsizeSliceTInst u32) v i;
+      let (_, index_mut_back) := p in
+      i2 <- usize_add i 1%usize;
+      v1 <- index_mut_back 0%u32;
+      clear_loop n1 v1 i2)
     else Return v
   end
 .
 
-(** [loops::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [loops::clear]:
     Source: 'src/loops.rs', lines 52:0-52:30 *)
 Definition clear
   (n : nat) (v : alloc_vec_Vec u32) : result (alloc_vec_Vec u32) :=
@@ -108,181 +108,146 @@ Inductive List_t (T : Type) :=
 Arguments List_Cons { _ }.
 Arguments List_Nil { _ }.
 
-(** [loops::list_mem]: loop 0: forward function
+(** [loops::list_mem]: loop 0:
     Source: 'src/loops.rs', lines 66:0-75:1 *)
 Fixpoint list_mem_loop (n : nat) (x : u32) (ls : List_t u32) : result bool :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
-    | List_Cons y tl => if y s= x then Return true else list_mem_loop n0 x tl
+    | List_Cons y tl => if y s= x then Return true else list_mem_loop n1 x tl
     | List_Nil => Return false
     end
   end
 .
 
-(** [loops::list_mem]: forward function
+(** [loops::list_mem]:
     Source: 'src/loops.rs', lines 66:0-66:52 *)
 Definition list_mem (n : nat) (x : u32) (ls : List_t u32) : result bool :=
   list_mem_loop n x ls
 .
 
-(** [loops::list_nth_mut_loop]: loop 0: forward function
+(** [loops::list_nth_mut_loop]: loop 0:
     Source: 'src/loops.rs', lines 78:0-88:1 *)
 Fixpoint list_nth_mut_loop_loop
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons x tl =>
-      if i s= 0%u32
-      then Return x
-      else (i0 <- u32_sub i 1%u32; list_nth_mut_loop_loop T n0 tl i0)
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop]: forward function
-    Source: 'src/loops.rs', lines 78:0-78:71 *)
-Definition list_nth_mut_loop
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  list_nth_mut_loop_loop T n ls i
-.
-
-(** [loops::list_nth_mut_loop]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 78:0-88:1 *)
-Fixpoint list_nth_mut_loop_loop_back
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+  (T : Type) (n : nat) (ls : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
-      then Return (List_Cons ret tl)
+      then
+        let back := fun (ret : T) => Return (List_Cons ret tl) in
+        Return (x, back)
       else (
-        i0 <- u32_sub i 1%u32;
-        tl0 <- list_nth_mut_loop_loop_back T n0 tl i0 ret;
-        Return (List_Cons x tl0))
+        i1 <- u32_sub i 1%u32;
+        p <- list_nth_mut_loop_loop T n1 tl i1;
+        let (t, back) := p in
+        let back1 := fun (ret : T) => tl1 <- back ret; Return (List_Cons x tl1)
+          in
+        Return (t, back1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_mut_loop]: backward function 0
+(** [loops::list_nth_mut_loop]:
     Source: 'src/loops.rs', lines 78:0-78:71 *)
-Definition list_nth_mut_loop_back
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+Definition list_nth_mut_loop
+  (T : Type) (n : nat) (ls : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
   :=
-  list_nth_mut_loop_loop_back T n ls i ret
+  p <- list_nth_mut_loop_loop T n ls i;
+  let (t, back) := p in
+  let back1 := fun (ret : T) => back ret in
+  Return (t, back1)
 .
 
-(** [loops::list_nth_shared_loop]: loop 0: forward function
+(** [loops::list_nth_shared_loop]: loop 0:
     Source: 'src/loops.rs', lines 91:0-101:1 *)
 Fixpoint list_nth_shared_loop_loop
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
       then Return x
-      else (i0 <- u32_sub i 1%u32; list_nth_shared_loop_loop T n0 tl i0)
+      else (i1 <- u32_sub i 1%u32; list_nth_shared_loop_loop T n1 tl i1)
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_shared_loop]: forward function
+(** [loops::list_nth_shared_loop]:
     Source: 'src/loops.rs', lines 91:0-91:66 *)
 Definition list_nth_shared_loop
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   list_nth_shared_loop_loop T n ls i
 .
 
-(** [loops::get_elem_mut]: loop 0: forward function
+(** [loops::get_elem_mut]: loop 0:
     Source: 'src/loops.rs', lines 103:0-117:1 *)
 Fixpoint get_elem_mut_loop
-  (n : nat) (x : usize) (ls : List_t usize) : result usize :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons y tl => if y s= x then Return y else get_elem_mut_loop n0 x tl
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::get_elem_mut]: forward function
-    Source: 'src/loops.rs', lines 103:0-103:73 *)
-Definition get_elem_mut
-  (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) :
-  result usize
-  :=
-  l <-
-    alloc_vec_Vec_index_mut (List_t usize) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (List_t usize)) slots 0%usize;
-  get_elem_mut_loop n x l
-.
-
-(** [loops::get_elem_mut]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 103:0-117:1 *)
-Fixpoint get_elem_mut_loop_back
-  (n : nat) (x : usize) (ls : List_t usize) (ret : usize) :
-  result (List_t usize)
+  (n : nat) (x : usize) (ls : List_t usize) :
+  result (usize * (usize -> result (List_t usize)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons y tl =>
       if y s= x
-      then Return (List_Cons ret tl)
+      then
+        let back := fun (ret : usize) => Return (List_Cons ret tl) in
+        Return (y, back)
       else (
-        tl0 <- get_elem_mut_loop_back n0 x tl ret; Return (List_Cons y tl0))
+        p <- get_elem_mut_loop n1 x tl;
+        let (i, back) := p in
+        let back1 :=
+          fun (ret : usize) => tl1 <- back ret; Return (List_Cons y tl1) in
+        Return (i, back1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::get_elem_mut]: backward function 0
+(** [loops::get_elem_mut]:
     Source: 'src/loops.rs', lines 103:0-103:73 *)
-Definition get_elem_mut_back
-  (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) (ret : usize) :
-  result (alloc_vec_Vec (List_t usize))
+Definition get_elem_mut
+  (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) :
+  result (usize * (usize -> result (alloc_vec_Vec (List_t usize))))
   :=
-  l <-
+  p <-
     alloc_vec_Vec_index_mut (List_t usize) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (List_t usize)) slots 0%usize;
-  l0 <- get_elem_mut_loop_back n x l ret;
-  alloc_vec_Vec_index_mut_back (List_t usize) usize
-    (core_slice_index_SliceIndexUsizeSliceTInst (List_t usize)) slots 0%usize
-    l0
+  let (l, index_mut_back) := p in
+  p1 <- get_elem_mut_loop n x l;
+  let (i, back) := p1 in
+  let back1 := fun (ret : usize) => l1 <- back ret; index_mut_back l1 in
+  Return (i, back1)
 .
 
-(** [loops::get_elem_shared]: loop 0: forward function
+(** [loops::get_elem_shared]: loop 0:
     Source: 'src/loops.rs', lines 119:0-133:1 *)
 Fixpoint get_elem_shared_loop
   (n : nat) (x : usize) (ls : List_t usize) : result usize :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons y tl =>
-      if y s= x then Return y else get_elem_shared_loop n0 x tl
+      if y s= x then Return y else get_elem_shared_loop n1 x tl
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::get_elem_shared]: forward function
+(** [loops::get_elem_shared]:
     Source: 'src/loops.rs', lines 119:0-119:68 *)
 Definition get_elem_shared
   (n : nat) (slots : alloc_vec_Vec (List_t usize)) (x : usize) :
@@ -294,123 +259,114 @@ Definition get_elem_shared
   get_elem_shared_loop n x l
 .
 
-(** [loops::id_mut]: forward function
-    Source: 'src/loops.rs', lines 135:0-135:50 *)
-Definition id_mut (T : Type) (ls : List_t T) : result (List_t T) :=
-  Return ls.
-
-(** [loops::id_mut]: backward function 0
+(** [loops::id_mut]:
     Source: 'src/loops.rs', lines 135:0-135:50 *)
-Definition id_mut_back
-  (T : Type) (ls : List_t T) (ret : List_t T) : result (List_t T) :=
-  Return ret
+Definition id_mut
+  (T : Type) (ls : List_t T) :
+  result ((List_t T) * (List_t T -> result (List_t T)))
+  :=
+  let back := fun (ret : List_t T) => Return ret in Return (ls, back)
 .
 
-(** [loops::id_shared]: forward function
+(** [loops::id_shared]:
     Source: 'src/loops.rs', lines 139:0-139:45 *)
 Definition id_shared (T : Type) (ls : List_t T) : result (List_t T) :=
   Return ls
 .
 
-(** [loops::list_nth_mut_loop_with_id]: loop 0: forward function
+(** [loops::list_nth_mut_loop_with_id]: loop 0:
     Source: 'src/loops.rs', lines 144:0-155:1 *)
 Fixpoint list_nth_mut_loop_with_id_loop
-  (T : Type) (n : nat) (i : u32) (ls : List_t T) : result T :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls with
-    | List_Cons x tl =>
-      if i s= 0%u32
-      then Return x
-      else (i0 <- u32_sub i 1%u32; list_nth_mut_loop_with_id_loop T n0 i0 tl)
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_with_id]: forward function
-    Source: 'src/loops.rs', lines 144:0-144:75 *)
-Definition list_nth_mut_loop_with_id
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  ls0 <- id_mut T ls; list_nth_mut_loop_with_id_loop T n i ls0
-.
-
-(** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 144:0-155:1 *)
-Fixpoint list_nth_mut_loop_with_id_loop_back
-  (T : Type) (n : nat) (i : u32) (ls : List_t T) (ret : T) :
-  result (List_t T)
+  (T : Type) (n : nat) (i : u32) (ls : List_t T) :
+  result (T * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
-      then Return (List_Cons ret tl)
+      then
+        let back := fun (ret : T) => Return (List_Cons ret tl) in
+        Return (x, back)
       else (
-        i0 <- u32_sub i 1%u32;
-        tl0 <- list_nth_mut_loop_with_id_loop_back T n0 i0 tl ret;
-        Return (List_Cons x tl0))
+        i1 <- u32_sub i 1%u32;
+        p <- list_nth_mut_loop_with_id_loop T n1 i1 tl;
+        let (t, back) := p in
+        let back1 := fun (ret : T) => tl1 <- back ret; Return (List_Cons x tl1)
+          in
+        Return (t, back1))
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_mut_loop_with_id]: backward function 0
+(** [loops::list_nth_mut_loop_with_id]:
     Source: 'src/loops.rs', lines 144:0-144:75 *)
-Definition list_nth_mut_loop_with_id_back
-  (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+Definition list_nth_mut_loop_with_id
+  (T : Type) (n : nat) (ls : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
   :=
-  ls0 <- id_mut T ls;
-  l <- list_nth_mut_loop_with_id_loop_back T n i ls0 ret;
-  id_mut_back T ls l
+  p <- id_mut T ls;
+  let (ls1, id_mut_back) := p in
+  p1 <- list_nth_mut_loop_with_id_loop T n i ls1;
+  let (t, back) := p1 in
+  let back1 := fun (ret : T) => l <- back ret; id_mut_back l in
+  Return (t, back1)
 .
 
-(** [loops::list_nth_shared_loop_with_id]: loop 0: forward function
+(** [loops::list_nth_shared_loop_with_id]: loop 0:
     Source: 'src/loops.rs', lines 158:0-169:1 *)
 Fixpoint list_nth_shared_loop_with_id_loop
   (T : Type) (n : nat) (i : u32) (ls : List_t T) : result T :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls with
     | List_Cons x tl =>
       if i s= 0%u32
       then Return x
       else (
-        i0 <- u32_sub i 1%u32; list_nth_shared_loop_with_id_loop T n0 i0 tl)
+        i1 <- u32_sub i 1%u32; list_nth_shared_loop_with_id_loop T n1 i1 tl)
     | List_Nil => Fail_ Failure
     end
   end
 .
 
-(** [loops::list_nth_shared_loop_with_id]: forward function
+(** [loops::list_nth_shared_loop_with_id]:
     Source: 'src/loops.rs', lines 158:0-158:70 *)
 Definition list_nth_shared_loop_with_id
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
-  ls0 <- id_shared T ls; list_nth_shared_loop_with_id_loop T n i ls0
+  ls1 <- id_shared T ls; list_nth_shared_loop_with_id_loop T n i ls1
 .
 
-(** [loops::list_nth_mut_loop_pair]: loop 0: forward function
+(** [loops::list_nth_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 174:0-195:1 *)
 Fixpoint list_nth_mut_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl0) in
+          let back_'b := fun (ret : T) => Return (List_Cons ret tl1) in
+          Return ((x0, x1), back_'a, back_'b)
         else (
-          i0 <- u32_sub i 1%u32; list_nth_mut_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          t <- list_nth_mut_loop_pair_loop T n1 tl0 tl1 i1;
+          let (p, back_'a, back_'b) := t in
+          let back_'a1 :=
+            fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
+          let back_'b1 :=
+            fun (ret : T) => tl11 <- back_'b ret; Return (List_Cons x1 tl11) in
+          Return (p, back_'a1, back_'b1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -418,86 +374,20 @@ Fixpoint list_nth_mut_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_mut_loop_pair]: forward function
+(** [loops::list_nth_mut_loop_pair]:
     Source: 'src/loops.rs', lines 174:0-178:27 *)
 Definition list_nth_mut_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)) * (T -> result (List_t T)))
   :=
-  list_nth_mut_loop_pair_loop T n ls0 ls1 i
+  t <- list_nth_mut_loop_pair_loop T n ls0 ls1 i;
+  let (p, back_'a, back_'b) := t in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  let back_'b1 := fun (ret : T) => back_'b ret in
+  Return (p, back_'a1, back_'b1)
 .
 
-(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 174:0-195:1 *)
-Fixpoint list_nth_mut_loop_pair_loop_back'a
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl0)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl00 <- list_nth_mut_loop_pair_loop_back'a T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x0 tl00))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_pair]: backward function 0
-    Source: 'src/loops.rs', lines 174:0-178:27 *)
-Definition list_nth_mut_loop_pair_back'a
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_mut_loop_pair_loop_back'a T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1
-    Source: 'src/loops.rs', lines 174:0-195:1 *)
-Fixpoint list_nth_mut_loop_pair_loop_back'b
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl10 <- list_nth_mut_loop_pair_loop_back'b T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_pair]: backward function 1
-    Source: 'src/loops.rs', lines 174:0-178:27 *)
-Definition list_nth_mut_loop_pair_back'b
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_mut_loop_pair_loop_back'b T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_shared_loop_pair]: loop 0: forward function
+(** [loops::list_nth_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 198:0-219:1 *)
 Fixpoint list_nth_shared_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -505,7 +395,7 @@ Fixpoint list_nth_shared_loop_pair_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
@@ -513,7 +403,7 @@ Fixpoint list_nth_shared_loop_pair_loop
         if i s= 0%u32
         then Return (x0, x1)
         else (
-          i0 <- u32_sub i 1%u32; list_nth_shared_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32; list_nth_shared_loop_pair_loop T n1 tl0 tl1 i1)
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -521,7 +411,7 @@ Fixpoint list_nth_shared_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_shared_loop_pair]: forward function
+(** [loops::list_nth_shared_loop_pair]:
     Source: 'src/loops.rs', lines 198:0-202:19 *)
 Definition list_nth_shared_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -530,24 +420,36 @@ Definition list_nth_shared_loop_pair
   list_nth_shared_loop_pair_loop T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 223:0-238:1 *)
 Fixpoint list_nth_mut_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * ((T * T) -> result ((List_t T) * (List_t T))))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a :=
+            fun (ret : (T * T)) =>
+              let (t, t1) := ret in Return (List_Cons t tl0, List_Cons t1 tl1)
+            in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_mut_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_mut_loop_pair_merge_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : (T * T)) =>
+              p2 <- back_'a ret;
+              let (tl01, tl11) := p2 in
+              Return (List_Cons x0 tl01, List_Cons x1 tl11) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -555,54 +457,19 @@ Fixpoint list_nth_mut_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_mut_loop_pair_merge]: forward function
+(** [loops::list_nth_mut_loop_pair_merge]:
     Source: 'src/loops.rs', lines 223:0-227:27 *)
 Definition list_nth_mut_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * ((T * T) -> result ((List_t T) * (List_t T))))
   :=
-  list_nth_mut_loop_pair_merge_loop T n ls0 ls1 i
+  p <- list_nth_mut_loop_pair_merge_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : (T * T)) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
-(** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 223:0-238:1 *)
-Fixpoint list_nth_mut_loop_pair_merge_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32)
-  (ret : (T * T)) :
-  result ((List_t T) * (List_t T))
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then let (t, t0) := ret in Return (List_Cons t tl0, List_Cons t0 tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          p <- list_nth_mut_loop_pair_merge_loop_back T n0 tl0 tl1 i0 ret;
-          let (tl00, tl10) := p in
-          Return (List_Cons x0 tl00, List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 223:0-227:27 *)
-Definition list_nth_mut_loop_pair_merge_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32)
-  (ret : (T * T)) :
-  result ((List_t T) * (List_t T))
-  :=
-  list_nth_mut_loop_pair_merge_loop_back T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 241:0-256:1 *)
 Fixpoint list_nth_shared_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -610,7 +477,7 @@ Fixpoint list_nth_shared_loop_pair_merge_loop
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
@@ -618,8 +485,8 @@ Fixpoint list_nth_shared_loop_pair_merge_loop
         if i s= 0%u32
         then Return (x0, x1)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_shared_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          list_nth_shared_loop_pair_merge_loop T n1 tl0 tl1 i1)
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -627,7 +494,7 @@ Fixpoint list_nth_shared_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_shared_loop_pair_merge]: forward function
+(** [loops::list_nth_shared_loop_pair_merge]:
     Source: 'src/loops.rs', lines 241:0-245:19 *)
 Definition list_nth_shared_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
@@ -636,24 +503,30 @@ Definition list_nth_shared_loop_pair_merge
   list_nth_shared_loop_pair_merge_loop T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 259:0-274:1 *)
 Fixpoint list_nth_mut_shared_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl0) in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_mut_shared_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_mut_shared_loop_pair_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -661,68 +534,42 @@ Fixpoint list_nth_mut_shared_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair]: forward function
+(** [loops::list_nth_mut_shared_loop_pair]:
     Source: 'src/loops.rs', lines 259:0-263:23 *)
 Definition list_nth_mut_shared_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_mut_shared_loop_pair_loop T n ls0 ls1 i
+  p <- list_nth_mut_shared_loop_pair_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
-(** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 259:0-274:1 *)
-Fixpoint list_nth_mut_shared_loop_pair_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl0)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl00 <- list_nth_mut_shared_loop_pair_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x0 tl00))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_shared_loop_pair]: backward function 0
-    Source: 'src/loops.rs', lines 259:0-263:23 *)
-Definition list_nth_mut_shared_loop_pair_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_mut_shared_loop_pair_loop_back T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 278:0-293:1 *)
 Fixpoint list_nth_mut_shared_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl0) in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_mut_shared_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_mut_shared_loop_pair_merge_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -730,69 +577,42 @@ Fixpoint list_nth_mut_shared_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair_merge]: forward function
+(** [loops::list_nth_mut_shared_loop_pair_merge]:
     Source: 'src/loops.rs', lines 278:0-282:23 *)
 Definition list_nth_mut_shared_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
-  :=
-  list_nth_mut_shared_loop_pair_merge_loop T n ls0 ls1 i
-.
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 278:0-293:1 *)
-Fixpoint list_nth_mut_shared_loop_pair_merge_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl0)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl00 <-
-            list_nth_mut_shared_loop_pair_merge_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x0 tl00))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 278:0-282:23 *)
-Definition list_nth_mut_shared_loop_pair_merge_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_mut_shared_loop_pair_merge_loop_back T n ls0 ls1 i ret
+  p <- list_nth_mut_shared_loop_pair_merge_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
-(** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 297:0-312:1 *)
 Fixpoint list_nth_shared_mut_loop_pair_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'b := fun (ret : T) => Return (List_Cons ret tl1) in
+          Return ((x0, x1), back_'b)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_shared_mut_loop_pair_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_shared_mut_loop_pair_loop T n1 tl0 tl1 i1;
+          let (p1, back_'b) := p in
+          let back_'b1 :=
+            fun (ret : T) => tl11 <- back_'b ret; Return (List_Cons x1 tl11) in
+          Return (p1, back_'b1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -800,68 +620,42 @@ Fixpoint list_nth_shared_mut_loop_pair_loop
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair]: forward function
+(** [loops::list_nth_shared_mut_loop_pair]:
     Source: 'src/loops.rs', lines 297:0-301:23 *)
 Definition list_nth_shared_mut_loop_pair
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_shared_mut_loop_pair_loop T n ls0 ls1 i
-.
-
-(** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1
-    Source: 'src/loops.rs', lines 297:0-312:1 *)
-Fixpoint list_nth_shared_mut_loop_pair_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl10 <- list_nth_shared_mut_loop_pair_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
+  p <- list_nth_shared_mut_loop_pair_loop T n ls0 ls1 i;
+  let (p1, back_'b) := p in
+  let back_'b1 := fun (ret : T) => back_'b ret in
+  Return (p1, back_'b1)
 .
 
-(** [loops::list_nth_shared_mut_loop_pair]: backward function 1
-    Source: 'src/loops.rs', lines 297:0-301:23 *)
-Definition list_nth_shared_mut_loop_pair_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  list_nth_shared_mut_loop_pair_loop_back T n ls0 ls1 i ret
-.
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 316:0-331:1 *)
 Fixpoint list_nth_shared_mut_loop_pair_merge_loop
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
   match n with
   | O => Fail_ OutOfFuel
-  | S n0 =>
+  | S n1 =>
     match ls0 with
     | List_Cons x0 tl0 =>
       match ls1 with
       | List_Cons x1 tl1 =>
         if i s= 0%u32
-        then Return (x0, x1)
+        then
+          let back_'a := fun (ret : T) => Return (List_Cons ret tl1) in
+          Return ((x0, x1), back_'a)
         else (
-          i0 <- u32_sub i 1%u32;
-          list_nth_shared_mut_loop_pair_merge_loop T n0 tl0 tl1 i0)
+          i1 <- u32_sub i 1%u32;
+          p <- list_nth_shared_mut_loop_pair_merge_loop T n1 tl0 tl1 i1;
+          let (p1, back_'a) := p in
+          let back_'a1 :=
+            fun (ret : T) => tl11 <- back_'a ret; Return (List_Cons x1 tl11) in
+          Return (p1, back_'a1))
       | List_Nil => Fail_ Failure
       end
     | List_Nil => Fail_ Failure
@@ -869,49 +663,16 @@ Fixpoint list_nth_shared_mut_loop_pair_merge_loop
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair_merge]: forward function
+(** [loops::list_nth_shared_mut_loop_pair_merge]:
     Source: 'src/loops.rs', lines 316:0-320:23 *)
 Definition list_nth_shared_mut_loop_pair_merge
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
-  result (T * T)
-  :=
-  list_nth_shared_mut_loop_pair_merge_loop T n ls0 ls1 i
-.
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 316:0-331:1 *)
-Fixpoint list_nth_shared_mut_loop_pair_merge_loop_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
-  :=
-  match n with
-  | O => Fail_ OutOfFuel
-  | S n0 =>
-    match ls0 with
-    | List_Cons x0 tl0 =>
-      match ls1 with
-      | List_Cons x1 tl1 =>
-        if i s= 0%u32
-        then Return (List_Cons ret tl1)
-        else (
-          i0 <- u32_sub i 1%u32;
-          tl10 <-
-            list_nth_shared_mut_loop_pair_merge_loop_back T n0 tl0 tl1 i0 ret;
-          Return (List_Cons x1 tl10))
-      | List_Nil => Fail_ Failure
-      end
-    | List_Nil => Fail_ Failure
-    end
-  end
-.
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 316:0-320:23 *)
-Definition list_nth_shared_mut_loop_pair_merge_back
-  (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
-  result (List_t T)
+  result ((T * T) * (T -> result (List_t T)))
   :=
-  list_nth_shared_mut_loop_pair_merge_loop_back T n ls0 ls1 i ret
+  p <- list_nth_shared_mut_loop_pair_merge_loop T n ls0 ls1 i;
+  let (p1, back_'a) := p in
+  let back_'a1 := fun (ret : T) => back_'a ret in
+  Return (p1, back_'a1)
 .
 
 End Loops.
diff --git a/tests/coq/misc/Paper.v b/tests/coq/misc/Paper.v
index 6b110193..e46df0ce 100644
--- a/tests/coq/misc/Paper.v
+++ b/tests/coq/misc/Paper.v
@@ -8,44 +8,40 @@ Import ListNotations.
 Local Open Scope Primitives_scope.
 Module Paper.
 
-(** [paper::ref_incr]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [paper::ref_incr]:
     Source: 'src/paper.rs', lines 4:0-4:28 *)
 Definition ref_incr (x : i32) : result i32 :=
   i32_add x 1%i32.
 
-(** [paper::test_incr]: forward function
+(** [paper::test_incr]:
     Source: 'src/paper.rs', lines 8:0-8:18 *)
 Definition test_incr : result unit :=
-  x <- ref_incr 0%i32; if negb (x s= 1%i32) then Fail_ Failure else Return tt
+  i <- ref_incr 0%i32; if negb (i s= 1%i32) then Fail_ Failure else Return tt
 .
 
 (** Unit test for [paper::test_incr] *)
 Check (test_incr )%return.
 
-(** [paper::choose]: forward function
+(** [paper::choose]:
     Source: 'src/paper.rs', lines 15:0-15:70 *)
-Definition choose (T : Type) (b : bool) (x : T) (y : T) : result T :=
-  if b then Return x else Return y
+Definition choose
+  (T : Type) (b : bool) (x : T) (y : T) : result (T * (T -> result (T * T))) :=
+  if b
+  then let back_'a := fun (ret : T) => Return (ret, y) in Return (x, back_'a)
+  else let back_'a := fun (ret : T) => Return (x, ret) in Return (y, back_'a)
 .
 
-(** [paper::choose]: backward function 0
-    Source: 'src/paper.rs', lines 15:0-15:70 *)
-Definition choose_back
-  (T : Type) (b : bool) (x : T) (y : T) (ret : T) : result (T * T) :=
-  if b then Return (ret, y) else Return (x, ret)
-.
-
-(** [paper::test_choose]: forward function
+(** [paper::test_choose]:
     Source: 'src/paper.rs', lines 23:0-23:20 *)
 Definition test_choose : result unit :=
-  z <- choose i32 true 0%i32 0%i32;
-  z0 <- i32_add z 1%i32;
-  if negb (z0 s= 1%i32)
+  p <- choose i32 true 0%i32 0%i32;
+  let (z, choose_back) := p in
+  z1 <- i32_add z 1%i32;
+  if negb (z1 s= 1%i32)
   then Fail_ Failure
   else (
-    p <- choose_back i32 true 0%i32 0%i32 z0;
-    let (x, y) := p in
+    p1 <- choose_back z1;
+    let (x, y) := p1 in
     if negb (x s= 1%i32)
     then Fail_ Failure
     else if negb (y s= 0%i32) then Fail_ Failure else Return tt)
@@ -64,35 +60,31 @@ Inductive List_t (T : Type) :=
 Arguments List_Cons { _ }.
 Arguments List_Nil { _ }.
 
-(** [paper::list_nth_mut]: forward function
-    Source: 'src/paper.rs', lines 42:0-42:67 *)
-Fixpoint list_nth_mut (T : Type) (l : List_t T) (i : u32) : result T :=
-  match l with
-  | List_Cons x tl =>
-    if i s= 0%u32
-    then Return x
-    else (i0 <- u32_sub i 1%u32; list_nth_mut T tl i0)
-  | List_Nil => Fail_ Failure
-  end
-.
-
-(** [paper::list_nth_mut]: backward function 0
+(** [paper::list_nth_mut]:
     Source: 'src/paper.rs', lines 42:0-42:67 *)
-Fixpoint list_nth_mut_back
-  (T : Type) (l : List_t T) (i : u32) (ret : T) : result (List_t T) :=
+Fixpoint list_nth_mut
+  (T : Type) (l : List_t T) (i : u32) :
+  result (T * (T -> result (List_t T)))
+  :=
   match l with
   | List_Cons x tl =>
     if i s= 0%u32
-    then Return (List_Cons ret tl)
+    then
+      let back_'a := fun (ret : T) => Return (List_Cons ret tl) in
+      Return (x, back_'a)
     else (
-      i0 <- u32_sub i 1%u32;
-      tl0 <- list_nth_mut_back T tl i0 ret;
-      Return (List_Cons x tl0))
+      i1 <- u32_sub i 1%u32;
+      p <- list_nth_mut T tl i1;
+      let (t, list_nth_mut_back) := p in
+      let back_'a :=
+        fun (ret : T) => tl1 <- list_nth_mut_back ret; Return (List_Cons x tl1)
+        in
+      Return (t, back_'a))
   | List_Nil => Fail_ Failure
   end
 .
 
-(** [paper::sum]: forward function
+(** [paper::sum]:
     Source: 'src/paper.rs', lines 57:0-57:32 *)
 Fixpoint sum (l : List_t i32) : result i32 :=
   match l with
@@ -101,31 +93,33 @@ Fixpoint sum (l : List_t i32) : result i32 :=
   end
 .
 
-(** [paper::test_nth]: forward function
+(** [paper::test_nth]:
     Source: 'src/paper.rs', lines 68:0-68:17 *)
 Definition test_nth : result unit :=
   let l := List_Nil in
-  let l0 := List_Cons 3%i32 l in
-  let l1 := List_Cons 2%i32 l0 in
-  x <- list_nth_mut i32 (List_Cons 1%i32 l1) 2%u32;
-  x0 <- i32_add x 1%i32;
-  l2 <- list_nth_mut_back i32 (List_Cons 1%i32 l1) 2%u32 x0;
-  i <- sum l2;
+  let l1 := List_Cons 3%i32 l in
+  let l2 := List_Cons 2%i32 l1 in
+  p <- list_nth_mut i32 (List_Cons 1%i32 l2) 2%u32;
+  let (x, list_nth_mut_back) := p in
+  x1 <- i32_add x 1%i32;
+  l3 <- list_nth_mut_back x1;
+  i <- sum l3;
   if negb (i s= 7%i32) then Fail_ Failure else Return tt
 .
 
 (** Unit test for [paper::test_nth] *)
 Check (test_nth )%return.
 
-(** [paper::call_choose]: forward function
+(** [paper::call_choose]:
     Source: 'src/paper.rs', lines 76:0-76:44 *)
 Definition call_choose (p : (u32 * u32)) : result u32 :=
   let (px, py) := p in
-  pz <- choose u32 true px py;
-  pz0 <- u32_add pz 1%u32;
-  p0 <- choose_back u32 true px py pz0;
-  let (px0, _) := p0 in
-  Return px0
+  p1 <- choose u32 true px py;
+  let (pz, choose_back) := p1 in
+  pz1 <- u32_add pz 1%u32;
+  p2 <- choose_back pz1;
+  let (px1, _) := p2 in
+  Return px1
 .
 
 End Paper.
diff --git a/tests/coq/misc/PoloniusList.v b/tests/coq/misc/PoloniusList.v
index 2371b1cc..7e967855 100644
--- a/tests/coq/misc/PoloniusList.v
+++ b/tests/coq/misc/PoloniusList.v
@@ -18,26 +18,28 @@ Inductive List_t (T : Type) :=
 Arguments List_Cons { _ }.
 Arguments List_Nil { _ }.
 
-(** [polonius_list::get_list_at_x]: forward function
+(** [polonius_list::get_list_at_x]:
     Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
-Fixpoint get_list_at_x (ls : List_t u32) (x : u32) : result (List_t u32) :=
-  match ls with
-  | List_Cons hd tl =>
-    if hd s= x then Return (List_Cons hd tl) else get_list_at_x tl x
-  | List_Nil => Return List_Nil
-  end
-.
-
-(** [polonius_list::get_list_at_x]: backward function 0
-    Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
-Fixpoint get_list_at_x_back
-  (ls : List_t u32) (x : u32) (ret : List_t u32) : result (List_t u32) :=
+Fixpoint get_list_at_x
+  (ls : List_t u32) (x : u32) :
+  result ((List_t u32) * (List_t u32 -> result (List_t u32)))
+  :=
   match ls with
   | List_Cons hd tl =>
     if hd s= x
-    then Return ret
-    else (tl0 <- get_list_at_x_back tl x ret; Return (List_Cons hd tl0))
-  | List_Nil => Return ret
+    then
+      let back_'a := fun (ret : List_t u32) => Return ret in
+      Return (List_Cons hd tl, back_'a)
+    else (
+      p <- get_list_at_x tl x;
+      let (l, get_list_at_x_back) := p in
+      let back_'a :=
+        fun (ret : List_t u32) =>
+          tl1 <- get_list_at_x_back ret; Return (List_Cons hd tl1) in
+      Return (l, back_'a))
+  | List_Nil =>
+    let back_'a := fun (ret : List_t u32) => Return ret in
+    Return (List_Nil, back_'a)
   end
 .
 
diff --git a/tests/coq/misc/Primitives.v b/tests/coq/misc/Primitives.v
index c0056073..990e27e4 100644
--- a/tests/coq/misc/Primitives.v
+++ b/tests/coq/misc/Primitives.v
@@ -67,7 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a * (a -> a) := (x, fun x => x) .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -585,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -592,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
diff --git a/tests/coq/misc/_CoqProject b/tests/coq/misc/_CoqProject
index 869cdb4d..64cddedd 100644
--- a/tests/coq/misc/_CoqProject
+++ b/tests/coq/misc/_CoqProject
@@ -8,9 +8,9 @@ External_Types.v
 Primitives.v
 External_Funs.v
 External_TypesExternal.v
+Paper.v
 Constants.v
 PoloniusList.v
-Paper.v
 NoNestedBorrows.v
 External_FunsExternal.v
 Bitwise.v
diff --git a/tests/coq/traits/Primitives.v b/tests/coq/traits/Primitives.v
index 84280b96..990e27e4 100644
--- a/tests/coq/traits/Primitives.v
+++ b/tests/coq/traits/Primitives.v
@@ -67,8 +67,7 @@ Definition string := Coq.Strings.String.string.
 Definition char := Coq.Strings.Ascii.ascii.
 Definition char_of_byte := Coq.Strings.Ascii.ascii_of_byte.
 
-Definition core_mem_replace (a : Type) (x : a) (y : a) : a := x .
-Definition core_mem_replace_back (a : Type) (x : a) (y : a) : a := y .
+Definition core_mem_replace (a : Type) (x : a) (y : a) : a * a := (x, x) .
 
 Record mut_raw_ptr (T : Type) := { mut_raw_ptr_v : T }.
 Record const_raw_ptr (T : Type) := { const_raw_ptr_v : T }.
@@ -504,13 +503,15 @@ Arguments core_ops_index_Index_index {_ _}.
 (* Trait declaration: [core::ops::index::IndexMut] *)
 Record core_ops_index_IndexMut (Self Idx : Type) := mk_core_ops_index_IndexMut {
   core_ops_index_IndexMut_indexInst : core_ops_index_Index Self Idx;
-  core_ops_index_IndexMut_index_mut : Self -> Idx -> result core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output);
-  core_ops_index_IndexMut_index_mut_back : Self -> Idx -> core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self;
+  core_ops_index_IndexMut_index_mut :
+    Self ->
+    Idx ->
+    result (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) *
+            (core_ops_index_IndexMut_indexInst.(core_ops_index_Index_Output) -> result Self));
 }.
 Arguments mk_core_ops_index_IndexMut {_ _}.
 Arguments core_ops_index_IndexMut_indexInst {_ _}.
 Arguments core_ops_index_IndexMut_index_mut {_ _}.
-Arguments core_ops_index_IndexMut_index_mut_back {_ _}.
 
 (* Trait declaration [core::ops::deref::Deref] *)
 Record core_ops_deref_Deref (Self : Type) := mk_core_ops_deref_Deref {
@@ -524,13 +525,14 @@ Arguments core_ops_deref_Deref_deref {_}.
 (* Trait declaration [core::ops::deref::DerefMut] *)
 Record core_ops_deref_DerefMut (Self : Type) := mk_core_ops_deref_DerefMut {
   core_ops_deref_DerefMut_derefInst : core_ops_deref_Deref Self;
-  core_ops_deref_DerefMut_deref_mut : Self -> result core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target);
-  core_ops_deref_DerefMut_deref_mut_back : Self -> core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self;
+  core_ops_deref_DerefMut_deref_mut :
+    Self ->
+    result (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) *
+            (core_ops_deref_DerefMut_derefInst.(core_ops_deref_Deref_target) -> result Self));
 }.
 Arguments mk_core_ops_deref_DerefMut {_}.
 Arguments core_ops_deref_DerefMut_derefInst {_}.
 Arguments core_ops_deref_DerefMut_deref_mut {_}.
-Arguments core_ops_deref_DerefMut_deref_mut_back {_}.
 
 Record core_ops_range_Range (T : Type) := mk_core_ops_range_Range {
   core_ops_range_Range_start : T;
@@ -543,8 +545,8 @@ Arguments core_ops_range_Range_end_ {_}.
 (*** [alloc] *)
 
 Definition alloc_boxed_Box_deref (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result T := Return x.
-Definition alloc_boxed_Box_deref_mut_back (T : Type) (_ : T) (x : T) : result T := Return x.
+Definition alloc_boxed_Box_deref_mut (T : Type) (x : T) : result (T * (T -> result T)) :=
+  Return (x, fun x => Return x).
 
 (* Trait instance *)
 Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref Self := {|
@@ -556,7 +558,6 @@ Definition alloc_boxed_Box_coreopsDerefInst (Self : Type) : core_ops_deref_Deref
 Definition alloc_boxed_Box_coreopsDerefMutInst (Self : Type) : core_ops_deref_DerefMut Self := {|
   core_ops_deref_DerefMut_derefInst := alloc_boxed_Box_coreopsDerefInst Self;
   core_ops_deref_DerefMut_deref_mut := alloc_boxed_Box_deref_mut Self;
-  core_ops_deref_DerefMut_deref_mut_back := alloc_boxed_Box_deref_mut_back Self;
 |}.
 
 
@@ -584,6 +585,13 @@ Axiom array_repeat : forall (T : Type) (n : usize) (x : T), array T n.
 Axiom array_index_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize), result T.
 Axiom array_update_usize : forall (T : Type) (n : usize) (x : array T n) (i : usize) (nx : T), result (array T n).
 
+Definition array_index_mut_usize (T : Type) (n : usize) (a : array T n) (i : usize) :
+  result (T * (T -> result (array T n))) :=
+  match array_index_usize T n a i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_update_usize T n a i)
+  end.
+
 (*** Slice *)
 Definition slice T := { l: list T | Z.of_nat (length l) <= usize_max}.
 
@@ -591,11 +599,25 @@ Axiom slice_len : forall (T : Type) (s : slice T), usize.
 Axiom slice_index_usize : forall (T : Type) (x : slice T) (i : usize), result T.
 Axiom slice_update_usize : forall (T : Type) (x : slice T) (i : usize) (nx : T), result (slice T).
 
+Definition slice_index_mut_usize (T : Type) (s : slice T) (i : usize) :
+  result (T * (T -> result (slice T))) :=
+  match slice_index_usize T s i with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, slice_update_usize T s i)
+  end.
+
 (*** Subslices *)
 
 Axiom array_to_slice : forall (T : Type) (n : usize) (x : array T n), result (slice T).
 Axiom array_from_slice : forall (T : Type) (n : usize) (x : array T n) (s : slice T), result (array T n).
 
+Definition array_to_slice_mut (T : Type) (n : usize) (a : array T n) :
+  result (slice T * (slice T -> result (array T n))) :=
+  match array_to_slice T n a with
+  | Fail_ e => Fail_ e
+  | Return x => Return (x, array_from_slice T n a)
+  end.
+
 Axiom array_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize), result (slice T).
 Axiom array_update_subslice: forall (T : Type) (n : usize) (x : array T n) (r : core_ops_range_Range usize) (ns : slice T), result (array T n).
 
@@ -639,16 +661,9 @@ Definition alloc_vec_Vec_bind {A B} (v: alloc_vec_Vec A) (f: list A -> result (l
   | right _ => Fail_ Failure
   end.
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_push_fwd (T: Type) (v: alloc_vec_Vec T) (x: T) : unit := tt.
-
 Definition alloc_vec_Vec_push (T: Type) (v: alloc_vec_Vec T) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l => Return (l ++ [x])).
 
-(* The **forward** function shouldn't be used *)
-Definition alloc_vec_Vec_insert_fwd (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result unit :=
-  if to_Z i <? alloc_vec_Vec_length v then Return tt else Fail_ Failure.
-
 Definition alloc_vec_Vec_insert (T: Type) (v: alloc_vec_Vec T) (i: usize) (x: T) : result (alloc_vec_Vec T) :=
   alloc_vec_Vec_bind v (fun l =>
     if to_Z i <? Z.of_nat (length l)
@@ -661,6 +676,14 @@ Axiom alloc_vec_Vec_index_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : u
 (* Helper *)
 Axiom alloc_vec_Vec_update_usize : forall {T : Type} (v : alloc_vec_Vec T) (i : usize) (x : T), result (alloc_vec_Vec T).
 
+Definition alloc_vec_Vec_index_mut_usize {T : Type} (v: alloc_vec_Vec T) (i: usize) :
+  result (T * (T -> result (alloc_vec_Vec T))) :=
+  match alloc_vec_Vec_index_usize v i with
+  | Return x =>
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail_ e => Fail_ e
+  end.
+
 (* Trait declaration: [core::slice::index::private_slice_index::Sealed] *)
 Definition core_slice_index_private_slice_index_Sealed (self : Type) := unit.
 
@@ -669,25 +692,23 @@ Record core_slice_index_SliceIndex (Self T : Type) := mk_core_slice_index_SliceI
   core_slice_index_SliceIndex_sealedInst : core_slice_index_private_slice_index_Sealed Self;
   core_slice_index_SliceIndex_Output : Type;
   core_slice_index_SliceIndex_get : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut : Self -> T -> result (option core_slice_index_SliceIndex_Output);
-  core_slice_index_SliceIndex_get_mut_back : Self -> T -> option core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_get_mut :
+    Self -> T -> result (option core_slice_index_SliceIndex_Output * (option core_slice_index_SliceIndex_Output -> result T));
   core_slice_index_SliceIndex_get_unchecked : Self -> const_raw_ptr T -> result (const_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_get_unchecked_mut : Self -> mut_raw_ptr T -> result (mut_raw_ptr core_slice_index_SliceIndex_Output);
   core_slice_index_SliceIndex_index : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut : Self -> T -> result core_slice_index_SliceIndex_Output;
-  core_slice_index_SliceIndex_index_mut_back : Self -> T -> core_slice_index_SliceIndex_Output -> result T;
+  core_slice_index_SliceIndex_index_mut :
+    Self -> T -> result (core_slice_index_SliceIndex_Output * (core_slice_index_SliceIndex_Output -> result T));
 }.
 Arguments mk_core_slice_index_SliceIndex {_ _}.
 Arguments core_slice_index_SliceIndex_sealedInst {_ _}.
 Arguments core_slice_index_SliceIndex_Output {_ _}.
 Arguments core_slice_index_SliceIndex_get {_ _}.
 Arguments core_slice_index_SliceIndex_get_mut {_ _}.
-Arguments core_slice_index_SliceIndex_get_mut_back {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked {_ _}.
 Arguments core_slice_index_SliceIndex_get_unchecked_mut {_ _}.
 Arguments core_slice_index_SliceIndex_index {_ _}.
 Arguments core_slice_index_SliceIndex_index_mut {_ _}.
-Arguments core_slice_index_SliceIndex_index_mut_back {_ _}.
 
 (* [core::slice::index::[T]::index]: forward function *)
 Definition core_slice_index_Slice_index
@@ -704,11 +725,9 @@ Axiom core_slice_index_RangeUsize_get : forall (T : Type) (i : core_ops_range_Ra
 
 (* [core::slice::index::Range::get_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_get_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (option (slice T)).
-
-(* [core::slice::index::Range::get_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_get_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> option (slice T) -> result (slice T).
+  forall (T : Type),
+    core_ops_range_Range usize -> slice T ->
+    result (option (slice T) * (option (slice T) -> result (slice T))).
 
 (* [core::slice::index::Range::get_unchecked]: forward function *)
 Definition core_slice_index_RangeUsize_get_unchecked
@@ -732,21 +751,14 @@ Axiom core_slice_index_RangeUsize_index :
 
 (* [core::slice::index::Range::index_mut]: forward function *)
 Axiom core_slice_index_RangeUsize_index_mut :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T).
-
-(* [core::slice::index::Range::index_mut]: backward function 0 *)
-Axiom core_slice_index_RangeUsize_index_mut_back :
-  forall (T : Type), core_ops_range_Range usize -> slice T -> slice T -> result (slice T).
+  forall (T : Type), core_ops_range_Range usize -> slice T -> result (slice T * (slice T -> result (slice T))).
 
 (* [core::slice::index::[T]::index_mut]: forward function *)
 Axiom core_slice_index_Slice_index_mut :
   forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> result inst.(core_slice_index_SliceIndex_Output).
-
-(* [core::slice::index::[T]::index_mut]: backward function 0 *)
-Axiom core_slice_index_Slice_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T)),
-  slice T -> Idx -> inst.(core_slice_index_SliceIndex_Output) -> result (slice T).
+  slice T -> Idx ->
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (slice T))).
 
 (* [core::array::[T; N]::index]: forward function *)
 Axiom core_array_Array_index :
@@ -756,12 +768,9 @@ Axiom core_array_Array_index :
 (* [core::array::[T; N]::index_mut]: forward function *)
 Axiom core_array_Array_index_mut :
   forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx), result inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output).
-
-(* [core::array::[T; N]::index_mut]: backward function 0 *)
-Axiom core_array_Array_index_mut_back :
-  forall (T Idx : Type) (N : usize) (inst : core_ops_index_IndexMut (slice T) Idx)
-  (a : array T N) (i : Idx) (x : inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output)), result (array T N).
+  (a : array T N) (i : Idx),
+  result (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) *
+          (inst.(core_ops_index_IndexMut_indexInst).(core_ops_index_Index_Output) -> result (array T N))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::Range] *)
 Definition core_slice_index_private_slice_index_SealedRangeUsizeInst
@@ -774,12 +783,10 @@ Definition core_slice_index_SliceIndexRangeUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := slice T;
   core_slice_index_SliceIndex_get := core_slice_index_RangeUsize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_RangeUsize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_RangeUsize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_RangeUsize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_RangeUsize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_RangeUsize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_RangeUsize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_RangeUsize_index_mut_back T;
 |}.
 
 (* Trait implementation: [core::slice::index::[T]] *)
@@ -796,7 +803,6 @@ Definition core_ops_index_IndexMutSliceTIInst (T Idx : Type)
   core_ops_index_IndexMut (slice T) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexSliceTIInst T Idx inst;
   core_ops_index_IndexMut_index_mut := core_slice_index_Slice_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := core_slice_index_Slice_index_mut_back T Idx inst;
 |}.
 
 (* Trait implementation: [core::array::[T; N]] *)
@@ -813,18 +819,14 @@ Definition core_ops_index_IndexMutArrayInst (T Idx : Type) (N : usize)
   core_ops_index_IndexMut (array T N) Idx := {|
   core_ops_index_IndexMut_indexInst := core_ops_index_IndexArrayInst T Idx N inst.(core_ops_index_IndexMut_indexInst);
   core_ops_index_IndexMut_index_mut := core_array_Array_index_mut T Idx N inst;
-  core_ops_index_IndexMut_index_mut_back := core_array_Array_index_mut_back T Idx N inst;
 |}.
 
 (* [core::slice::index::usize::get]: forward function *)
 Axiom core_slice_index_usize_get : forall (T : Type), usize -> slice T -> result (option T).
 
 (* [core::slice::index::usize::get_mut]: forward function *)
-Axiom core_slice_index_usize_get_mut : forall (T : Type), usize -> slice T -> result (option T).
-
-(* [core::slice::index::usize::get_mut]: backward function 0 *)
-Axiom core_slice_index_usize_get_mut_back :
-  forall (T : Type), usize -> slice T -> option T -> result (slice T).
+Axiom core_slice_index_usize_get_mut :
+  forall (T : Type), usize -> slice T -> result (option T * (option T -> result (slice T))).
 
 (* [core::slice::index::usize::get_unchecked]: forward function *)
 Axiom core_slice_index_usize_get_unchecked :
@@ -838,11 +840,8 @@ Axiom core_slice_index_usize_get_unchecked_mut :
 Axiom core_slice_index_usize_index : forall (T : Type), usize -> slice T -> result T.
 
 (* [core::slice::index::usize::index_mut]: forward function *)
-Axiom core_slice_index_usize_index_mut : forall (T : Type), usize -> slice T -> result T.
-
-(* [core::slice::index::usize::index_mut]: backward function 0 *)
-Axiom core_slice_index_usize_index_mut_back :
-  forall (T : Type), usize -> slice T -> T -> result (slice T).
+Axiom core_slice_index_usize_index_mut :
+  forall (T : Type), usize -> slice T -> result (T * (T -> result (slice T))).
 
 (* Trait implementation: [core::slice::index::private_slice_index::usize] *)
 Definition core_slice_index_private_slice_index_SealedUsizeInst
@@ -855,12 +854,10 @@ Definition core_slice_index_SliceIndexUsizeSliceTInst (T : Type) :
   core_slice_index_SliceIndex_Output := T;
   core_slice_index_SliceIndex_get := core_slice_index_usize_get T;
   core_slice_index_SliceIndex_get_mut := core_slice_index_usize_get_mut T;
-  core_slice_index_SliceIndex_get_mut_back := core_slice_index_usize_get_mut_back T;
   core_slice_index_SliceIndex_get_unchecked := core_slice_index_usize_get_unchecked T;
   core_slice_index_SliceIndex_get_unchecked_mut := core_slice_index_usize_get_unchecked_mut T;
   core_slice_index_SliceIndex_index := core_slice_index_usize_index T;
   core_slice_index_SliceIndex_index_mut := core_slice_index_usize_index_mut T;
-  core_slice_index_SliceIndex_index_mut_back := core_slice_index_usize_index_mut_back T;
 |}.
 
 (* [alloc::vec::Vec::index]: forward function *)
@@ -869,12 +866,9 @@ Axiom alloc_vec_Vec_index : forall (T Idx : Type) (inst : core_slice_index_Slice
 
 (* [alloc::vec::Vec::index_mut]: forward function *)
 Axiom alloc_vec_Vec_index_mut : forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx), result inst.(core_slice_index_SliceIndex_Output).
-
-(* [alloc::vec::Vec::index_mut]: backward function 0 *)
-Axiom alloc_vec_Vec_index_mut_back :
-  forall (T Idx : Type) (inst : core_slice_index_SliceIndex Idx (slice T))
-  (Self : alloc_vec_Vec T) (i : Idx) (x : inst.(core_slice_index_SliceIndex_Output)), result (alloc_vec_Vec T).
+  (Self : alloc_vec_Vec T) (i : Idx),
+  result (inst.(core_slice_index_SliceIndex_Output) *
+          (inst.(core_slice_index_SliceIndex_Output) -> result (alloc_vec_Vec T))).
 
 (* Trait implementation: [alloc::vec::Vec] *)
 Definition alloc_vec_Vec_coreopsindexIndexInst (T Idx : Type)
@@ -890,7 +884,6 @@ Definition alloc_vec_Vec_coreopsindexIndexMutInst (T Idx : Type)
   core_ops_index_IndexMut (alloc_vec_Vec T) Idx := {|
   core_ops_index_IndexMut_indexInst := alloc_vec_Vec_coreopsindexIndexInst T Idx inst;
   core_ops_index_IndexMut_index_mut := alloc_vec_Vec_index_mut T Idx inst;
-  core_ops_index_IndexMut_index_mut_back := alloc_vec_Vec_index_mut_back T Idx inst;
 |}.
 
 (*** Theorems *)
@@ -901,10 +894,6 @@ Axiom alloc_vec_Vec_index_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usiz
 
 Axiom alloc_vec_Vec_index_mut_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
   alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i =
-    alloc_vec_Vec_index_usize v i.
-
-Axiom alloc_vec_Vec_index_mut_back_eq : forall {a : Type} (v : alloc_vec_Vec a) (i : usize) (x : a),
-  alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x =
-    alloc_vec_Vec_update_usize v i x.
+    alloc_vec_Vec_index_mut_usize v i.
 
 End Primitives.
diff --git a/tests/coq/traits/Traits.v b/tests/coq/traits/Traits.v
index 2448e8f3..7055e25d 100644
--- a/tests/coq/traits/Traits.v
+++ b/tests/coq/traits/Traits.v
@@ -17,7 +17,7 @@ Record BoolTrait_t (Self : Type) := mkBoolTrait_t {
 Arguments mkBoolTrait_t { _ }.
 Arguments BoolTrait_t_get_bool { _ }.
 
-(** [traits::{bool}::get_bool]: forward function
+(** [traits::{bool}::get_bool]:
     Source: 'src/traits.rs', lines 12:4-12:30 *)
 Definition bool_get_bool (self : bool) : result bool :=
   Return self.
@@ -28,24 +28,24 @@ Definition traits_BoolTraitBoolInst : BoolTrait_t bool := {|
   BoolTrait_t_get_bool := bool_get_bool;
 |}.
 
-(** [traits::BoolTrait::ret_true]: forward function
+(** [traits::BoolTrait::ret_true]:
     Source: 'src/traits.rs', lines 6:4-6:30 *)
 Definition boolTrait_ret_true
   {Self : Type} (self_clause : BoolTrait_t Self) (self : Self) : result bool :=
   Return true
 .
 
-(** [traits::test_bool_trait_bool]: forward function
+(** [traits::test_bool_trait_bool]:
     Source: 'src/traits.rs', lines 17:0-17:44 *)
 Definition test_bool_trait_bool (x : bool) : result bool :=
   b <- bool_get_bool x;
   if b then boolTrait_ret_true traits_BoolTraitBoolInst x else Return false
 .
 
-(** [traits::{core::option::Option<T>#1}::get_bool]: forward function
+(** [traits::{core::option::Option<T>#1}::get_bool]:
     Source: 'src/traits.rs', lines 23:4-23:30 *)
 Definition option_get_bool (T : Type) (self : option T) : result bool :=
-  match self with | None => Return false | Some t => Return true end
+  match self with | None => Return false | Some _ => Return true end
 .
 
 (** Trait implementation: [traits::{core::option::Option<T>#1}]
@@ -55,7 +55,7 @@ Definition traits_BoolTraitcoreoptionOptionTInst (T : Type) : BoolTrait_t
   BoolTrait_t_get_bool := option_get_bool T;
 |}.
 
-(** [traits::test_bool_trait_option]: forward function
+(** [traits::test_bool_trait_option]:
     Source: 'src/traits.rs', lines 31:0-31:54 *)
 Definition test_bool_trait_option (T : Type) (x : option T) : result bool :=
   b <- option_get_bool T x;
@@ -64,7 +64,7 @@ Definition test_bool_trait_option (T : Type) (x : option T) : result bool :=
   else Return false
 .
 
-(** [traits::test_bool_trait]: forward function
+(** [traits::test_bool_trait]:
     Source: 'src/traits.rs', lines 35:0-35:50 *)
 Definition test_bool_trait
   (T : Type) (boolTraitTInst : BoolTrait_t T) (x : T) : result bool :=
@@ -80,7 +80,7 @@ Record ToU64_t (Self : Type) := mkToU64_t {
 Arguments mkToU64_t { _ }.
 Arguments ToU64_t_to_u64 { _ }.
 
-(** [traits::{u64#2}::to_u64]: forward function
+(** [traits::{u64#2}::to_u64]:
     Source: 'src/traits.rs', lines 44:4-44:26 *)
 Definition u64_to_u64 (self : u64) : result u64 :=
   Return self.
@@ -91,14 +91,14 @@ Definition traits_ToU64U64Inst : ToU64_t u64 := {|
   ToU64_t_to_u64 := u64_to_u64;
 |}.
 
-(** [traits::{(A, A)#3}::to_u64]: forward function
+(** [traits::{(A, A)#3}::to_u64]:
     Source: 'src/traits.rs', lines 50:4-50:26 *)
 Definition pair_to_u64
   (A : Type) (toU64AInst : ToU64_t A) (self : (A * A)) : result u64 :=
-  let (t, t0) := self in
+  let (t, t1) := self in
   i <- toU64AInst.(ToU64_t_to_u64) t;
-  i0 <- toU64AInst.(ToU64_t_to_u64) t0;
-  u64_add i i0
+  i1 <- toU64AInst.(ToU64_t_to_u64) t1;
+  u64_add i i1
 .
 
 (** Trait implementation: [traits::{(A, A)#3}]
@@ -108,20 +108,20 @@ Definition traits_ToU64TupleAAInst (A : Type) (toU64AInst : ToU64_t A) :
   ToU64_t_to_u64 := pair_to_u64 A toU64AInst;
 |}.
 
-(** [traits::f]: forward function
+(** [traits::f]:
     Source: 'src/traits.rs', lines 55:0-55:36 *)
 Definition f (T : Type) (toU64TInst : ToU64_t T) (x : (T * T)) : result u64 :=
   pair_to_u64 T toU64TInst x
 .
 
-(** [traits::g]: forward function
+(** [traits::g]:
     Source: 'src/traits.rs', lines 59:0-61:18 *)
 Definition g
   (T : Type) (toU64TupleTTInst : ToU64_t (T * T)) (x : (T * T)) : result u64 :=
   toU64TupleTTInst.(ToU64_t_to_u64) x
 .
 
-(** [traits::h0]: forward function
+(** [traits::h0]:
     Source: 'src/traits.rs', lines 66:0-66:24 *)
 Definition h0 (x : u64) : result u64 :=
   u64_to_u64 x.
@@ -133,7 +133,7 @@ Record Wrapper_t (T : Type) := mkWrapper_t { wrapper_x : T; }.
 Arguments mkWrapper_t { _ }.
 Arguments wrapper_x { _ }.
 
-(** [traits::{traits::Wrapper<T>#4}::to_u64]: forward function
+(** [traits::{traits::Wrapper<T>#4}::to_u64]:
     Source: 'src/traits.rs', lines 75:4-75:26 *)
 Definition wrapper_to_u64
   (T : Type) (toU64TInst : ToU64_t T) (self : Wrapper_t T) : result u64 :=
@@ -147,13 +147,13 @@ Definition traits_ToU64traitsWrapperTInst (T : Type) (toU64TInst : ToU64_t T) :
   ToU64_t_to_u64 := wrapper_to_u64 T toU64TInst;
 |}.
 
-(** [traits::h1]: forward function
+(** [traits::h1]:
     Source: 'src/traits.rs', lines 80:0-80:33 *)
 Definition h1 (x : Wrapper_t u64) : result u64 :=
   wrapper_to_u64 u64 traits_ToU64U64Inst x
 .
 
-(** [traits::h2]: forward function
+(** [traits::h2]:
     Source: 'src/traits.rs', lines 84:0-84:41 *)
 Definition h2
   (T : Type) (toU64TInst : ToU64_t T) (x : Wrapper_t T) : result u64 :=
@@ -169,7 +169,7 @@ Record ToType_t (Self T : Type) := mkToType_t {
 Arguments mkToType_t { _ _ }.
 Arguments ToType_t_to_type { _ _ }.
 
-(** [traits::{u64#5}::to_type]: forward function
+(** [traits::{u64#5}::to_type]:
     Source: 'src/traits.rs', lines 93:4-93:28 *)
 Definition u64_to_type (self : u64) : result bool :=
   Return (self s> 0%u64).
@@ -190,7 +190,7 @@ Record OfType_t (Self : Type) := mkOfType_t {
 Arguments mkOfType_t { _ }.
 Arguments OfType_t_of_type { _ }.
 
-(** [traits::h3]: forward function
+(** [traits::h3]:
     Source: 'src/traits.rs', lines 104:0-104:50 *)
 Definition h3
   (T1 T2 : Type) (ofTypeT1Inst : OfType_t T1) (toTypeT2T1Inst : ToType_t T2 T1)
@@ -211,7 +211,7 @@ Arguments mkOfTypeBis_t { _ _ }.
 Arguments OfTypeBis_tOfTypeBis_t_ToTypeTSelfInst { _ _ }.
 Arguments OfTypeBis_t_of_type { _ _ }.
 
-(** [traits::h4]: forward function
+(** [traits::h4]:
     Source: 'src/traits.rs', lines 118:0-118:57 *)
 Definition h4
   (T1 T2 : Type) (ofTypeBisT1T2Inst : OfTypeBis_t T1 T2) (toTypeT2T1Inst :
@@ -238,7 +238,7 @@ Record TestType_test_TestTrait_t (Self : Type) := mkTestType_test_TestTrait_t {
 Arguments mkTestType_test_TestTrait_t { _ }.
 Arguments TestType_test_TestTrait_t_test { _ }.
 
-(** [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]: forward function
+(** [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]:
     Source: 'src/traits.rs', lines 139:12-139:34 *)
 Definition testType_test_TestType1_test
   (self : TestType_test_TestType1_t) : result bool :=
@@ -252,21 +252,21 @@ Definition traits_TestType_test_TestTraittraitstraitsTestTypeTtestTestType1Inst
   TestType_test_TestTrait_t_test := testType_test_TestType1_test;
 |}.
 
-(** [traits::{traits::TestType<T>#6}::test]: forward function
+(** [traits::{traits::TestType<T>#6}::test]:
     Source: 'src/traits.rs', lines 126:4-126:36 *)
 Definition testType_test
   (T : Type) (toU64TInst : ToU64_t T) (self : TestType_t T) (x : T) :
   result bool
   :=
-  x0 <- toU64TInst.(ToU64_t_to_u64) x;
-  if x0 s> 0%u64 then testType_test_TestType1_test 0%u64 else Return false
+  x1 <- toU64TInst.(ToU64_t_to_u64) x;
+  if x1 s> 0%u64 then testType_test_TestType1_test 0%u64 else Return false
 .
 
 (** [traits::BoolWrapper]
     Source: 'src/traits.rs', lines 150:0-150:22 *)
 Definition BoolWrapper_t : Type := bool.
 
-(** [traits::{traits::BoolWrapper#7}::to_type]: forward function
+(** [traits::{traits::BoolWrapper#7}::to_type]:
     Source: 'src/traits.rs', lines 156:4-156:25 *)
 Definition boolWrapper_to_type
   (T : Type) (toTypeBoolTInst : ToType_t bool T) (self : BoolWrapper_t) :
@@ -312,8 +312,7 @@ Arguments WithConstTy_t_f { _ _ }.
 Definition bool_len1_body : result usize := Return 12%usize.
 Definition bool_len1_c : usize := bool_len1_body%global.
 
-(** [traits::{bool#8}::f]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [traits::{bool#8}::f]:
     Source: 'src/traits.rs', lines 180:4-180:39 *)
 Definition bool_f (i : u64) (a : array u8 32%usize) : result u64 :=
   Return i.
@@ -329,7 +328,7 @@ Definition traits_WithConstTyBool32Inst : WithConstTy_t bool 32%usize := {|
   WithConstTy_t_f := bool_f;
 |}.
 
-(** [traits::use_with_const_ty1]: forward function
+(** [traits::use_with_const_ty1]:
     Source: 'src/traits.rs', lines 183:0-183:75 *)
 Definition use_with_const_ty1
   (H : Type) (LEN : usize) (withConstTyHLENInst : WithConstTy_t H LEN) :
@@ -338,7 +337,7 @@ Definition use_with_const_ty1
   let i := withConstTyHLENInst.(WithConstTy_tWithConstTy_t_LEN1) in Return i
 .
 
-(** [traits::use_with_const_ty2]: forward function
+(** [traits::use_with_const_ty2]:
     Source: 'src/traits.rs', lines 187:0-187:73 *)
 Definition use_with_const_ty2
   (H : Type) (LEN : usize) (withConstTyHLENInst : WithConstTy_t H LEN)
@@ -348,7 +347,7 @@ Definition use_with_const_ty2
   Return tt
 .
 
-(** [traits::use_with_const_ty3]: forward function
+(** [traits::use_with_const_ty3]:
     Source: 'src/traits.rs', lines 189:0-189:80 *)
 Definition use_with_const_ty3
   (H : Type) (LEN : usize) (withConstTyHLENInst : WithConstTy_t H LEN)
@@ -359,12 +358,12 @@ Definition use_with_const_ty3
     x
 .
 
-(** [traits::test_where1]: forward function
+(** [traits::test_where1]:
     Source: 'src/traits.rs', lines 193:0-193:40 *)
 Definition test_where1 (T : Type) (_x : T) : result unit :=
   Return tt.
 
-(** [traits::test_where2]: forward function
+(** [traits::test_where2]:
     Source: 'src/traits.rs', lines 194:0-194:57 *)
 Definition test_where2
   (T : Type) (withConstTyT32Inst : WithConstTy_t T 32%usize) (_x : u32) :
@@ -403,16 +402,25 @@ Arguments mkChildTrait_t { _ }.
 Arguments ChildTrait_tChildTrait_t_ParentTrait0SelfInst { _ }.
 Arguments ChildTrait_tChildTrait_t_ParentTrait1SelfInst { _ }.
 
-(** [traits::test_child_trait1]: forward function
-    Source: 'src/traits.rs', lines 209:0-209:56 *)
+(** [traits::test_parent_trait0]:
+    Source: 'src/traits.rs', lines 208:0-208:57 *)
+Definition test_parent_trait0
+  (T : Type) (parentTrait0TInst : ParentTrait0_t T) (x : T) :
+  result parentTrait0TInst.(ParentTrait0_tParentTrait0_t_W)
+  :=
+  parentTrait0TInst.(ParentTrait0_t_get_w) x
+.
+
+(** [traits::test_child_trait1]:
+    Source: 'src/traits.rs', lines 213:0-213:56 *)
 Definition test_child_trait1
   (T : Type) (childTraitTInst : ChildTrait_t T) (x : T) : result string :=
   childTraitTInst.(ChildTrait_tChildTrait_t_ParentTrait0SelfInst).(ParentTrait0_t_get_name)
     x
 .
 
-(** [traits::test_child_trait2]: forward function
-    Source: 'src/traits.rs', lines 213:0-213:54 *)
+(** [traits::test_child_trait2]:
+    Source: 'src/traits.rs', lines 217:0-217:54 *)
 Definition test_child_trait2
   (T : Type) (childTraitTInst : ChildTrait_t T) (x : T) :
   result
@@ -422,8 +430,8 @@ Definition test_child_trait2
     x
 .
 
-(** [traits::order1]: forward function
-    Source: 'src/traits.rs', lines 219:0-219:59 *)
+(** [traits::order1]:
+    Source: 'src/traits.rs', lines 223:0-223:59 *)
 Definition order1
   (T U : Type) (parentTrait0TInst : ParentTrait0_t T) (parentTrait0UInst :
   ParentTrait0_t U) :
@@ -433,7 +441,7 @@ Definition order1
 .
 
 (** Trait declaration: [traits::ChildTrait1]
-    Source: 'src/traits.rs', lines 222:0-222:35 *)
+    Source: 'src/traits.rs', lines 226:0-226:35 *)
 Record ChildTrait1_t (Self : Type) := mkChildTrait1_t {
   ChildTrait1_tChildTrait1_t_ParentTrait1SelfInst : ParentTrait1_t Self;
 }.
@@ -442,19 +450,19 @@ Arguments mkChildTrait1_t { _ }.
 Arguments ChildTrait1_tChildTrait1_t_ParentTrait1SelfInst { _ }.
 
 (** Trait implementation: [traits::{usize#9}]
-    Source: 'src/traits.rs', lines 224:0-224:27 *)
+    Source: 'src/traits.rs', lines 228:0-228:27 *)
 Definition traits_ParentTrait1UsizeInst : ParentTrait1_t usize
   := mkParentTrait1_t.
 
 (** Trait implementation: [traits::{usize#10}]
-    Source: 'src/traits.rs', lines 225:0-225:26 *)
+    Source: 'src/traits.rs', lines 229:0-229:26 *)
 Definition traits_ChildTrait1UsizeInst : ChildTrait1_t usize := {|
   ChildTrait1_tChildTrait1_t_ParentTrait1SelfInst :=
     traits_ParentTrait1UsizeInst;
 |}.
 
 (** Trait declaration: [traits::Iterator]
-    Source: 'src/traits.rs', lines 229:0-229:18 *)
+    Source: 'src/traits.rs', lines 233:0-233:18 *)
 Record Iterator_t (Self : Type) := mkIterator_t {
   Iterator_tIterator_t_Item : Type;
 }.
@@ -463,7 +471,7 @@ Arguments mkIterator_t { _ }.
 Arguments Iterator_tIterator_t_Item { _ }.
 
 (** Trait declaration: [traits::IntoIterator]
-    Source: 'src/traits.rs', lines 233:0-233:22 *)
+    Source: 'src/traits.rs', lines 237:0-237:22 *)
 Record IntoIterator_t (Self : Type) := mkIntoIterator_t {
   IntoIterator_tIntoIterator_t_Item : Type;
   IntoIterator_tIntoIterator_t_IntoIter : Type;
@@ -480,13 +488,13 @@ Arguments IntoIterator_tIntoIterator_t_IntoIter_clause_0 { _ }.
 Arguments IntoIterator_t_into_iter { _ }.
 
 (** Trait declaration: [traits::FromResidual]
-    Source: 'src/traits.rs', lines 250:0-250:21 *)
+    Source: 'src/traits.rs', lines 254:0-254:21 *)
 Record FromResidual_t (Self T : Type) := mkFromResidual_t{}.
 
 Arguments mkFromResidual_t { _ _ }.
 
 (** Trait declaration: [traits::Try]
-    Source: 'src/traits.rs', lines 246:0-246:48 *)
+    Source: 'src/traits.rs', lines 250:0-250:48 *)
 Record Try_t (Self : Type) := mkTry_t {
   Try_tTry_t_Residual : Type;
   Try_tTry_t_FromResidualSelftraitsTrySelfResidualInst : FromResidual_t Self
@@ -498,7 +506,7 @@ Arguments Try_tTry_t_Residual { _ }.
 Arguments Try_tTry_t_FromResidualSelftraitsTrySelfResidualInst { _ }.
 
 (** Trait declaration: [traits::WithTarget]
-    Source: 'src/traits.rs', lines 252:0-252:20 *)
+    Source: 'src/traits.rs', lines 256:0-256:20 *)
 Record WithTarget_t (Self : Type) := mkWithTarget_t {
   WithTarget_tWithTarget_t_Target : Type;
 }.
@@ -507,7 +515,7 @@ Arguments mkWithTarget_t { _ }.
 Arguments WithTarget_tWithTarget_t_Target { _ }.
 
 (** Trait declaration: [traits::ParentTrait2]
-    Source: 'src/traits.rs', lines 256:0-256:22 *)
+    Source: 'src/traits.rs', lines 260:0-260:22 *)
 Record ParentTrait2_t (Self : Type) := mkParentTrait2_t {
   ParentTrait2_tParentTrait2_t_U : Type;
   ParentTrait2_tParentTrait2_t_U_clause_0 : WithTarget_t
@@ -519,7 +527,7 @@ Arguments ParentTrait2_tParentTrait2_t_U { _ }.
 Arguments ParentTrait2_tParentTrait2_t_U_clause_0 { _ }.
 
 (** Trait declaration: [traits::ChildTrait2]
-    Source: 'src/traits.rs', lines 260:0-260:35 *)
+    Source: 'src/traits.rs', lines 264:0-264:35 *)
 Record ChildTrait2_t (Self : Type) := mkChildTrait2_t {
   ChildTrait2_tChildTrait2_t_ParentTrait2SelfInst : ParentTrait2_t Self;
   ChildTrait2_t_convert :
@@ -533,25 +541,25 @@ Arguments ChildTrait2_tChildTrait2_t_ParentTrait2SelfInst { _ }.
 Arguments ChildTrait2_t_convert { _ }.
 
 (** Trait implementation: [traits::{u32#11}]
-    Source: 'src/traits.rs', lines 264:0-264:23 *)
+    Source: 'src/traits.rs', lines 268:0-268:23 *)
 Definition traits_WithTargetU32Inst : WithTarget_t u32 := {|
   WithTarget_tWithTarget_t_Target := u32;
 |}.
 
 (** Trait implementation: [traits::{u32#12}]
-    Source: 'src/traits.rs', lines 268:0-268:25 *)
+    Source: 'src/traits.rs', lines 272:0-272:25 *)
 Definition traits_ParentTrait2U32Inst : ParentTrait2_t u32 := {|
   ParentTrait2_tParentTrait2_t_U := u32;
   ParentTrait2_tParentTrait2_t_U_clause_0 := traits_WithTargetU32Inst;
 |}.
 
-(** [traits::{u32#13}::convert]: forward function
-    Source: 'src/traits.rs', lines 273:4-273:29 *)
+(** [traits::{u32#13}::convert]:
+    Source: 'src/traits.rs', lines 277:4-277:29 *)
 Definition u32_convert (x : u32) : result u32 :=
   Return x.
 
 (** Trait implementation: [traits::{u32#13}]
-    Source: 'src/traits.rs', lines 272:0-272:24 *)
+    Source: 'src/traits.rs', lines 276:0-276:24 *)
 Definition traits_ChildTrait2U32Inst : ChildTrait2_t u32 := {|
   ChildTrait2_tChildTrait2_t_ParentTrait2SelfInst :=
     traits_ParentTrait2U32Inst;
@@ -559,7 +567,7 @@ Definition traits_ChildTrait2U32Inst : ChildTrait2_t u32 := {|
 |}.
 
 (** Trait declaration: [traits::CFnOnce]
-    Source: 'src/traits.rs', lines 286:0-286:23 *)
+    Source: 'src/traits.rs', lines 290:0-290:23 *)
 Record CFnOnce_t (Self Args : Type) := mkCFnOnce_t {
   CFnOnce_tCFnOnce_t_Output : Type;
   CFnOnce_t_call_once : Self -> Args -> result CFnOnce_tCFnOnce_t_Output;
@@ -570,31 +578,48 @@ Arguments CFnOnce_tCFnOnce_t_Output { _ _ }.
 Arguments CFnOnce_t_call_once { _ _ }.
 
 (** Trait declaration: [traits::CFnMut]
-    Source: 'src/traits.rs', lines 292:0-292:37 *)
+    Source: 'src/traits.rs', lines 296:0-296:37 *)
 Record CFnMut_t (Self Args : Type) := mkCFnMut_t {
   CFnMut_tCFnMut_t_CFnOnceSelfArgsInst : CFnOnce_t Self Args;
   CFnMut_t_call_mut : Self -> Args -> result
-    (CFnMut_tCFnMut_t_CFnOnceSelfArgsInst).(CFnOnce_tCFnOnce_t_Output);
-  CFnMut_t_call_mut_back : Self -> Args ->
-    (CFnMut_tCFnMut_t_CFnOnceSelfArgsInst).(CFnOnce_tCFnOnce_t_Output) ->
-    result Self;
+    ((CFnMut_tCFnMut_t_CFnOnceSelfArgsInst).(CFnOnce_tCFnOnce_t_Output) *
+    Self);
 }.
 
 Arguments mkCFnMut_t { _ _ }.
 Arguments CFnMut_tCFnMut_t_CFnOnceSelfArgsInst { _ _ }.
 Arguments CFnMut_t_call_mut { _ _ }.
-Arguments CFnMut_t_call_mut_back { _ _ }.
 
 (** Trait declaration: [traits::CFn]
-    Source: 'src/traits.rs', lines 296:0-296:33 *)
+    Source: 'src/traits.rs', lines 300:0-300:33 *)
 Record CFn_t (Self Args : Type) := mkCFn_t {
   CFn_tCFn_t_CFnMutSelfArgsInst : CFnMut_t Self Args;
-  CFn_t_call_mut : Self -> Args -> result
+  CFn_t_call : Self -> Args -> result
     (CFn_tCFn_t_CFnMutSelfArgsInst).(CFnMut_tCFnMut_t_CFnOnceSelfArgsInst).(CFnOnce_tCFnOnce_t_Output);
 }.
 
 Arguments mkCFn_t { _ _ }.
 Arguments CFn_tCFn_t_CFnMutSelfArgsInst { _ _ }.
-Arguments CFn_t_call_mut { _ _ }.
+Arguments CFn_t_call { _ _ }.
+
+(** Trait declaration: [traits::GetTrait]
+    Source: 'src/traits.rs', lines 304:0-304:18 *)
+Record GetTrait_t (Self : Type) := mkGetTrait_t {
+  GetTrait_tGetTrait_t_W : Type;
+  GetTrait_t_get_w : Self -> result GetTrait_tGetTrait_t_W;
+}.
+
+Arguments mkGetTrait_t { _ }.
+Arguments GetTrait_tGetTrait_t_W { _ }.
+Arguments GetTrait_t_get_w { _ }.
+
+(** [traits::test_get_trait]:
+    Source: 'src/traits.rs', lines 309:0-309:49 *)
+Definition test_get_trait
+  (T : Type) (getTraitTInst : GetTrait_t T) (x : T) :
+  result getTraitTInst.(GetTrait_tGetTrait_t_W)
+  :=
+  getTraitTInst.(GetTrait_t_get_w) x
+.
 
 End Traits.
diff --git a/tests/fstar-split/array/Array.Clauses.Template.fst b/tests/fstar-split/array/Array.Clauses.Template.fst
new file mode 100644
index 00000000..b2f2649c
--- /dev/null
+++ b/tests/fstar-split/array/Array.Clauses.Template.fst
@@ -0,0 +1,21 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [array]: templates for the decreases clauses *)
+module Array.Clauses.Template
+open Primitives
+open Array.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [array::sum]: decreases clause
+    Source: 'src/array.rs', lines 242:0-250:1 *)
+unfold
+let sum_loop_decreases (s : slice u32) (sum1 : u32) (i : usize) : nat =
+  admit ()
+
+(** [array::sum2]: decreases clause
+    Source: 'src/array.rs', lines 252:0-261:1 *)
+unfold
+let sum2_loop_decreases (s : slice u32) (s2 : slice u32) (sum1 : u32)
+  (i : usize) : nat =
+  admit ()
+
diff --git a/tests/fstar-split/array/Array.Clauses.fst b/tests/fstar-split/array/Array.Clauses.fst
new file mode 100644
index 00000000..68cbf216
--- /dev/null
+++ b/tests/fstar-split/array/Array.Clauses.fst
@@ -0,0 +1,19 @@
+(** [array]: decreases clauses *)
+module Array.Clauses
+open Primitives
+open Array.Types
+open FStar.List.Tot
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [array::sum]: decreases clause *)
+unfold
+let sum_loop_decreases (s : slice u32) (sum : u32) (i : usize) : nat =
+  if i < length s then length s - i else 0
+
+(** [array::sum2]: decreases clause *)
+unfold
+let sum2_loop_decreases (s : slice u32) (s2 : slice u32) (sum : u32)
+  (i : usize) : nat =
+  if i < length s then length s - i else 0
+
diff --git a/tests/fstar-split/array/Array.Funs.fst b/tests/fstar-split/array/Array.Funs.fst
new file mode 100644
index 00000000..30b19702
--- /dev/null
+++ b/tests/fstar-split/array/Array.Funs.fst
@@ -0,0 +1,445 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [array]: function definitions *)
+module Array.Funs
+open Primitives
+include Array.Types
+include Array.Clauses
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [array::incr]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/array.rs', lines 8:0-8:24 *)
+let incr (x : u32) : result u32 =
+  u32_add x 1
+
+(** [array::array_to_shared_slice_]: forward function
+    Source: 'src/array.rs', lines 16:0-16:53 *)
+let array_to_shared_slice_ (t : Type0) (s : array t 32) : result (slice t) =
+  array_to_slice t 32 s
+
+(** [array::array_to_mut_slice_]: forward function
+    Source: 'src/array.rs', lines 21:0-21:58 *)
+let array_to_mut_slice_ (t : Type0) (s : array t 32) : result (slice t) =
+  array_to_slice t 32 s
+
+(** [array::array_to_mut_slice_]: backward function 0
+    Source: 'src/array.rs', lines 21:0-21:58 *)
+let array_to_mut_slice__back
+  (t : Type0) (s : array t 32) (ret : slice t) : result (array t 32) =
+  array_from_slice t 32 s ret
+
+(** [array::array_len]: forward function
+    Source: 'src/array.rs', lines 25:0-25:40 *)
+let array_len (t : Type0) (s : array t 32) : result usize =
+  let* s1 = array_to_slice t 32 s in let i = slice_len t s1 in Return i
+
+(** [array::shared_array_len]: forward function
+    Source: 'src/array.rs', lines 29:0-29:48 *)
+let shared_array_len (t : Type0) (s : array t 32) : result usize =
+  let* s1 = array_to_slice t 32 s in let i = slice_len t s1 in Return i
+
+(** [array::shared_slice_len]: forward function
+    Source: 'src/array.rs', lines 33:0-33:44 *)
+let shared_slice_len (t : Type0) (s : slice t) : result usize =
+  let i = slice_len t s in Return i
+
+(** [array::index_array_shared]: forward function
+    Source: 'src/array.rs', lines 37:0-37:57 *)
+let index_array_shared (t : Type0) (s : array t 32) (i : usize) : result t =
+  array_index_usize t 32 s i
+
+(** [array::index_array_u32]: forward function
+    Source: 'src/array.rs', lines 44:0-44:53 *)
+let index_array_u32 (s : array u32 32) (i : usize) : result u32 =
+  array_index_usize u32 32 s i
+
+(** [array::index_array_copy]: forward function
+    Source: 'src/array.rs', lines 48:0-48:45 *)
+let index_array_copy (x : array u32 32) : result u32 =
+  array_index_usize u32 32 x 0
+
+(** [array::index_mut_array]: forward function
+    Source: 'src/array.rs', lines 52:0-52:62 *)
+let index_mut_array (t : Type0) (s : array t 32) (i : usize) : result t =
+  array_index_usize t 32 s i
+
+(** [array::index_mut_array]: backward function 0
+    Source: 'src/array.rs', lines 52:0-52:62 *)
+let index_mut_array_back
+  (t : Type0) (s : array t 32) (i : usize) (ret : t) : result (array t 32) =
+  array_update_usize t 32 s i ret
+
+(** [array::index_slice]: forward function
+    Source: 'src/array.rs', lines 56:0-56:46 *)
+let index_slice (t : Type0) (s : slice t) (i : usize) : result t =
+  slice_index_usize t s i
+
+(** [array::index_mut_slice]: forward function
+    Source: 'src/array.rs', lines 60:0-60:58 *)
+let index_mut_slice (t : Type0) (s : slice t) (i : usize) : result t =
+  slice_index_usize t s i
+
+(** [array::index_mut_slice]: backward function 0
+    Source: 'src/array.rs', lines 60:0-60:58 *)
+let index_mut_slice_back
+  (t : Type0) (s : slice t) (i : usize) (ret : t) : result (slice t) =
+  slice_update_usize t s i ret
+
+(** [array::slice_subslice_shared_]: forward function
+    Source: 'src/array.rs', lines 64:0-64:70 *)
+let slice_subslice_shared_
+  (x : slice u32) (y : usize) (z : usize) : result (slice u32) =
+  core_slice_index_Slice_index u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
+    { start = y; end_ = z }
+
+(** [array::slice_subslice_mut_]: forward function
+    Source: 'src/array.rs', lines 68:0-68:75 *)
+let slice_subslice_mut_
+  (x : slice u32) (y : usize) (z : usize) : result (slice u32) =
+  core_slice_index_Slice_index_mut u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
+    { start = y; end_ = z }
+
+(** [array::slice_subslice_mut_]: backward function 0
+    Source: 'src/array.rs', lines 68:0-68:75 *)
+let slice_subslice_mut__back
+  (x : slice u32) (y : usize) (z : usize) (ret : slice u32) :
+  result (slice u32)
+  =
+  core_slice_index_Slice_index_mut_back u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
+    { start = y; end_ = z } ret
+
+(** [array::array_to_slice_shared_]: forward function
+    Source: 'src/array.rs', lines 72:0-72:54 *)
+let array_to_slice_shared_ (x : array u32 32) : result (slice u32) =
+  array_to_slice u32 32 x
+
+(** [array::array_to_slice_mut_]: forward function
+    Source: 'src/array.rs', lines 76:0-76:59 *)
+let array_to_slice_mut_ (x : array u32 32) : result (slice u32) =
+  array_to_slice u32 32 x
+
+(** [array::array_to_slice_mut_]: backward function 0
+    Source: 'src/array.rs', lines 76:0-76:59 *)
+let array_to_slice_mut__back
+  (x : array u32 32) (ret : slice u32) : result (array u32 32) =
+  array_from_slice u32 32 x ret
+
+(** [array::array_subslice_shared_]: forward function
+    Source: 'src/array.rs', lines 80:0-80:74 *)
+let array_subslice_shared_
+  (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
+  core_array_Array_index u32 (core_ops_range_Range usize) 32
+    (core_ops_index_IndexSliceTIInst u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
+    { start = y; end_ = z }
+
+(** [array::array_subslice_mut_]: forward function
+    Source: 'src/array.rs', lines 84:0-84:79 *)
+let array_subslice_mut_
+  (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
+  core_array_Array_index_mut u32 (core_ops_range_Range usize) 32
+    (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
+    { start = y; end_ = z }
+
+(** [array::array_subslice_mut_]: backward function 0
+    Source: 'src/array.rs', lines 84:0-84:79 *)
+let array_subslice_mut__back
+  (x : array u32 32) (y : usize) (z : usize) (ret : slice u32) :
+  result (array u32 32)
+  =
+  core_array_Array_index_mut_back u32 (core_ops_range_Range usize) 32
+    (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
+    { start = y; end_ = z } ret
+
+(** [array::index_slice_0]: forward function
+    Source: 'src/array.rs', lines 88:0-88:38 *)
+let index_slice_0 (t : Type0) (s : slice t) : result t =
+  slice_index_usize t s 0
+
+(** [array::index_array_0]: forward function
+    Source: 'src/array.rs', lines 92:0-92:42 *)
+let index_array_0 (t : Type0) (s : array t 32) : result t =
+  array_index_usize t 32 s 0
+
+(** [array::index_index_array]: forward function
+    Source: 'src/array.rs', lines 103:0-103:71 *)
+let index_index_array
+  (s : array (array u32 32) 32) (i : usize) (j : usize) : result u32 =
+  let* a = array_index_usize (array u32 32) 32 s i in
+  array_index_usize u32 32 a j
+
+(** [array::update_update_array]: forward function
+    Source: 'src/array.rs', lines 114:0-114:70 *)
+let update_update_array
+  (s : array (array u32 32) 32) (i : usize) (j : usize) : result unit =
+  let* a = array_index_usize (array u32 32) 32 s i in
+  let* a1 = array_update_usize u32 32 a j 0 in
+  let* _ = array_update_usize (array u32 32) 32 s i a1 in
+  Return ()
+
+(** [array::array_local_deep_copy]: forward function
+    Source: 'src/array.rs', lines 118:0-118:43 *)
+let array_local_deep_copy (x : array u32 32) : result unit =
+  Return ()
+
+(** [array::take_array]: forward function
+    Source: 'src/array.rs', lines 122:0-122:30 *)
+let take_array (a : array u32 2) : result unit =
+  Return ()
+
+(** [array::take_array_borrow]: forward function
+    Source: 'src/array.rs', lines 123:0-123:38 *)
+let take_array_borrow (a : array u32 2) : result unit =
+  Return ()
+
+(** [array::take_slice]: forward function
+    Source: 'src/array.rs', lines 124:0-124:28 *)
+let take_slice (s : slice u32) : result unit =
+  Return ()
+
+(** [array::take_mut_slice]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/array.rs', lines 125:0-125:36 *)
+let take_mut_slice (s : slice u32) : result (slice u32) =
+  Return s
+
+(** [array::const_array]: forward function
+    Source: 'src/array.rs', lines 127:0-127:32 *)
+let const_array : result (array u32 2) =
+  Return (mk_array u32 2 [ 0; 0 ])
+
+(** [array::const_slice]: forward function
+    Source: 'src/array.rs', lines 131:0-131:20 *)
+let const_slice : result unit =
+  let* _ = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in Return ()
+
+(** [array::take_all]: forward function
+    Source: 'src/array.rs', lines 141:0-141:17 *)
+let take_all : result unit =
+  let* _ = take_array (mk_array u32 2 [ 0; 0 ]) in
+  let* _ = take_array_borrow (mk_array u32 2 [ 0; 0 ]) in
+  let* s = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* _ = take_slice s in
+  let* s1 = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* s2 = take_mut_slice s1 in
+  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s2 in
+  Return ()
+
+(** [array::index_array]: forward function
+    Source: 'src/array.rs', lines 155:0-155:38 *)
+let index_array (x : array u32 2) : result u32 =
+  array_index_usize u32 2 x 0
+
+(** [array::index_array_borrow]: forward function
+    Source: 'src/array.rs', lines 158:0-158:46 *)
+let index_array_borrow (x : array u32 2) : result u32 =
+  array_index_usize u32 2 x 0
+
+(** [array::index_slice_u32_0]: forward function
+    Source: 'src/array.rs', lines 162:0-162:42 *)
+let index_slice_u32_0 (x : slice u32) : result u32 =
+  slice_index_usize u32 x 0
+
+(** [array::index_mut_slice_u32_0]: forward function
+    Source: 'src/array.rs', lines 166:0-166:50 *)
+let index_mut_slice_u32_0 (x : slice u32) : result u32 =
+  slice_index_usize u32 x 0
+
+(** [array::index_mut_slice_u32_0]: backward function 0
+    Source: 'src/array.rs', lines 166:0-166:50 *)
+let index_mut_slice_u32_0_back (x : slice u32) : result (slice u32) =
+  let* _ = slice_index_usize u32 x 0 in Return x
+
+(** [array::index_all]: forward function
+    Source: 'src/array.rs', lines 170:0-170:25 *)
+let index_all : result u32 =
+  let* i = index_array (mk_array u32 2 [ 0; 0 ]) in
+  let* i1 = index_array (mk_array u32 2 [ 0; 0 ]) in
+  let* i2 = u32_add i i1 in
+  let* i3 = index_array_borrow (mk_array u32 2 [ 0; 0 ]) in
+  let* i4 = u32_add i2 i3 in
+  let* s = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* i5 = index_slice_u32_0 s in
+  let* i6 = u32_add i4 i5 in
+  let* s1 = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* i7 = index_mut_slice_u32_0 s1 in
+  let* i8 = u32_add i6 i7 in
+  let* s2 = index_mut_slice_u32_0_back s1 in
+  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s2 in
+  Return i8
+
+(** [array::update_array]: forward function
+    Source: 'src/array.rs', lines 184:0-184:36 *)
+let update_array (x : array u32 2) : result unit =
+  let* _ = array_update_usize u32 2 x 0 1 in Return ()
+
+(** [array::update_array_mut_borrow]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/array.rs', lines 187:0-187:48 *)
+let update_array_mut_borrow (x : array u32 2) : result (array u32 2) =
+  array_update_usize u32 2 x 0 1
+
+(** [array::update_mut_slice]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/array.rs', lines 190:0-190:38 *)
+let update_mut_slice (x : slice u32) : result (slice u32) =
+  slice_update_usize u32 x 0 1
+
+(** [array::update_all]: forward function
+    Source: 'src/array.rs', lines 194:0-194:19 *)
+let update_all : result unit =
+  let* _ = update_array (mk_array u32 2 [ 0; 0 ]) in
+  let* x = update_array_mut_borrow (mk_array u32 2 [ 0; 0 ]) in
+  let* s = array_to_slice u32 2 x in
+  let* s1 = update_mut_slice s in
+  let* _ = array_from_slice u32 2 x s1 in
+  Return ()
+
+(** [array::range_all]: forward function
+    Source: 'src/array.rs', lines 205:0-205:18 *)
+let range_all : result unit =
+  let* s =
+    core_array_Array_index_mut u32 (core_ops_range_Range usize) 4
+      (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
+      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32))
+      (mk_array u32 4 [ 0; 0; 0; 0 ]) { start = 1; end_ = 3 } in
+  let* s1 = update_mut_slice s in
+  let* _ =
+    core_array_Array_index_mut_back u32 (core_ops_range_Range usize) 4
+      (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
+      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32))
+      (mk_array u32 4 [ 0; 0; 0; 0 ]) { start = 1; end_ = 3 } s1 in
+  Return ()
+
+(** [array::deref_array_borrow]: forward function
+    Source: 'src/array.rs', lines 214:0-214:46 *)
+let deref_array_borrow (x : array u32 2) : result u32 =
+  array_index_usize u32 2 x 0
+
+(** [array::deref_array_mut_borrow]: forward function
+    Source: 'src/array.rs', lines 219:0-219:54 *)
+let deref_array_mut_borrow (x : array u32 2) : result u32 =
+  array_index_usize u32 2 x 0
+
+(** [array::deref_array_mut_borrow]: backward function 0
+    Source: 'src/array.rs', lines 219:0-219:54 *)
+let deref_array_mut_borrow_back (x : array u32 2) : result (array u32 2) =
+  let* _ = array_index_usize u32 2 x 0 in Return x
+
+(** [array::take_array_t]: forward function
+    Source: 'src/array.rs', lines 227:0-227:31 *)
+let take_array_t (a : array aB_t 2) : result unit =
+  Return ()
+
+(** [array::non_copyable_array]: forward function
+    Source: 'src/array.rs', lines 229:0-229:27 *)
+let non_copyable_array : result unit =
+  let* _ = take_array_t (mk_array aB_t 2 [ AB_A; AB_B ]) in Return ()
+
+(** [array::sum]: loop 0: forward function
+    Source: 'src/array.rs', lines 242:0-250:1 *)
+let rec sum_loop
+  (s : slice u32) (sum1 : u32) (i : usize) :
+  Tot (result u32) (decreases (sum_loop_decreases s sum1 i))
+  =
+  let i1 = slice_len u32 s in
+  if i < i1
+  then
+    let* i2 = slice_index_usize u32 s i in
+    let* sum3 = u32_add sum1 i2 in
+    let* i3 = usize_add i 1 in
+    sum_loop s sum3 i3
+  else Return sum1
+
+(** [array::sum]: forward function
+    Source: 'src/array.rs', lines 242:0-242:28 *)
+let sum (s : slice u32) : result u32 =
+  sum_loop s 0 0
+
+(** [array::sum2]: loop 0: forward function
+    Source: 'src/array.rs', lines 252:0-261:1 *)
+let rec sum2_loop
+  (s : slice u32) (s2 : slice u32) (sum1 : u32) (i : usize) :
+  Tot (result u32) (decreases (sum2_loop_decreases s s2 sum1 i))
+  =
+  let i1 = slice_len u32 s in
+  if i < i1
+  then
+    let* i2 = slice_index_usize u32 s i in
+    let* i3 = slice_index_usize u32 s2 i in
+    let* i4 = u32_add i2 i3 in
+    let* sum3 = u32_add sum1 i4 in
+    let* i5 = usize_add i 1 in
+    sum2_loop s s2 sum3 i5
+  else Return sum1
+
+(** [array::sum2]: forward function
+    Source: 'src/array.rs', lines 252:0-252:41 *)
+let sum2 (s : slice u32) (s2 : slice u32) : result u32 =
+  let i = slice_len u32 s in
+  let i1 = slice_len u32 s2 in
+  if not (i = i1) then Fail Failure else sum2_loop s s2 0 0
+
+(** [array::f0]: forward function
+    Source: 'src/array.rs', lines 263:0-263:11 *)
+let f0 : result unit =
+  let* s = array_to_slice u32 2 (mk_array u32 2 [ 1; 2 ]) in
+  let* s1 = slice_update_usize u32 s 0 1 in
+  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 1; 2 ]) s1 in
+  Return ()
+
+(** [array::f1]: forward function
+    Source: 'src/array.rs', lines 268:0-268:11 *)
+let f1 : result unit =
+  let* _ = array_update_usize u32 2 (mk_array u32 2 [ 1; 2 ]) 0 1 in Return ()
+
+(** [array::f2]: forward function
+    Source: 'src/array.rs', lines 273:0-273:17 *)
+let f2 (i : u32) : result unit =
+  Return ()
+
+(** [array::f4]: forward function
+    Source: 'src/array.rs', lines 282:0-282:54 *)
+let f4 (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
+  core_array_Array_index u32 (core_ops_range_Range usize) 32
+    (core_ops_index_IndexSliceTIInst u32 (core_ops_range_Range usize)
+    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
+    { start = y; end_ = z }
+
+(** [array::f3]: forward function
+    Source: 'src/array.rs', lines 275:0-275:18 *)
+let f3 : result u32 =
+  let* i = array_index_usize u32 2 (mk_array u32 2 [ 1; 2 ]) 0 in
+  let* _ = f2 i in
+  let b = array_repeat u32 32 0 in
+  let* s = array_to_slice u32 2 (mk_array u32 2 [ 1; 2 ]) in
+  let* s1 = f4 b 16 18 in
+  sum2 s s1
+
+(** [array::SZ]
+    Source: 'src/array.rs', lines 286:0-286:19 *)
+let sz_body : result usize = Return 32
+let sz_c : usize = eval_global sz_body
+
+(** [array::f5]: forward function
+    Source: 'src/array.rs', lines 289:0-289:31 *)
+let f5 (x : array u32 32) : result u32 =
+  array_index_usize u32 32 x 0
+
+(** [array::ite]: forward function
+    Source: 'src/array.rs', lines 294:0-294:12 *)
+let ite : result unit =
+  let* s = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* s1 = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* s2 = index_mut_slice_u32_0_back s1 in
+  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s2 in
+  let* s3 = index_mut_slice_u32_0_back s in
+  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s3 in
+  Return ()
+
diff --git a/tests/fstar-split/array/Array.Types.fst b/tests/fstar-split/array/Array.Types.fst
new file mode 100644
index 00000000..312f6018
--- /dev/null
+++ b/tests/fstar-split/array/Array.Types.fst
@@ -0,0 +1,11 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [array]: type definitions *)
+module Array.Types
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [array::AB]
+    Source: 'src/array.rs', lines 3:0-3:11 *)
+type aB_t = | AB_A : aB_t | AB_B : aB_t
+
diff --git a/tests/fstar-split/array/Makefile b/tests/fstar-split/array/Makefile
new file mode 100644
index 00000000..fa7d1f36
--- /dev/null
+++ b/tests/fstar-split/array/Makefile
@@ -0,0 +1,49 @@
+# This file was automatically generated - modify ../Makefile.template instead
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/array/Primitives.fst b/tests/fstar-split/array/Primitives.fst
new file mode 100644
index 00000000..a3ffbde4
--- /dev/null
+++ b/tests/fstar-split/array/Primitives.fst
@@ -0,0 +1,884 @@
+/// This file lists primitive and assumed functions and types
+module Primitives
+open FStar.Mul
+open FStar.List.Tot
+
+#set-options "--z3rlimit 15 --fuel 0 --ifuel 1"
+
+(*** Utilities *)
+val list_update (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a) :
+  ls':list a{
+    length ls' = length ls /\
+    index ls' i == x
+  }
+#push-options "--fuel 1"
+let rec list_update #a ls i x =
+  match ls with
+  | x' :: ls -> if i = 0 then x :: ls else x' :: list_update ls (i-1) x
+#pop-options
+
+(*** Result *)
+type error : Type0 =
+| Failure
+| OutOfFuel
+
+type result (a : Type0) : Type0 =
+| Return : v:a -> result a
+| Fail : e:error -> result a
+
+// Monadic return operator
+unfold let return (#a : Type0) (x : a) : result a = Return x
+
+// Monadic bind operator.
+// Allows to use the notation:
+// ```
+// let* x = y in
+// ...
+// ```
+unfold let (let*) (#a #b : Type0) (m: result a)
+  (f: (x:a) -> Pure (result b) (requires (m == Return x)) (ensures fun _ -> True)) :
+  result b =
+  match m with
+  | Return x -> f x
+  | Fail e   -> Fail e
+
+// Monadic assert(...)
+let massert (b:bool) : result unit = if b then Return () else Fail Failure
+
+// Normalize and unwrap a successful result (used for globals).
+let eval_global (#a : Type0) (x : result a{Return? (normalize_term x)}) : a = Return?.v x
+
+(*** Misc *)
+type char = FStar.Char.char
+type string = string
+
+let is_zero (n: nat) : bool = n = 0
+let decrease (n: nat{n > 0}) : nat = n - 1
+
+let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
+let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+
+// We don't really use raw pointers for now
+type mut_raw_ptr (t : Type0) = { v : t }
+type const_raw_ptr (t : Type0) = { v : t }
+
+(*** Scalars *)
+/// Rem.: most of the following code was partially generated
+
+assume val size_numbits : pos
+
+// TODO: we could use FStar.Int.int_t and FStar.UInt.int_t
+
+let isize_min : int = -9223372036854775808 // TODO: should be opaque
+let isize_max : int = 9223372036854775807 // TODO: should be opaque
+let i8_min : int = -128
+let i8_max : int = 127
+let i16_min : int = -32768
+let i16_max : int = 32767
+let i32_min : int = -2147483648
+let i32_max : int = 2147483647
+let i64_min : int = -9223372036854775808
+let i64_max : int = 9223372036854775807
+let i128_min : int = -170141183460469231731687303715884105728
+let i128_max : int = 170141183460469231731687303715884105727
+let usize_min : int = 0
+let usize_max : int = 4294967295 // TODO: should be opaque
+let u8_min : int = 0
+let u8_max : int = 255
+let u16_min : int = 0
+let u16_max : int = 65535
+let u32_min : int = 0
+let u32_max : int = 4294967295
+let u64_min : int = 0
+let u64_max : int = 18446744073709551615
+let u128_min : int = 0
+let u128_max : int = 340282366920938463463374607431768211455
+
+type scalar_ty =
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+let is_unsigned = function
+  | Isize | I8 | I16 | I32 | I64 | I128 -> false
+  | Usize | U8 | U16 | U32 | U64 | U128 -> true
+
+let scalar_min (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_min
+  | I8 -> i8_min
+  | I16 -> i16_min
+  | I32 -> i32_min
+  | I64 -> i64_min
+  | I128 -> i128_min
+  | Usize -> usize_min
+  | U8 -> u8_min
+  | U16 -> u16_min
+  | U32 -> u32_min
+  | U64 -> u64_min
+  | U128 -> u128_min
+
+let scalar_max (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_max
+  | I8 -> i8_max
+  | I16 -> i16_max
+  | I32 -> i32_max
+  | I64 -> i64_max
+  | I128 -> i128_max
+  | Usize -> usize_max
+  | U8 -> u8_max
+  | U16 -> u16_max
+  | U32 -> u32_max
+  | U64 -> u64_max
+  | U128 -> u128_max
+
+type scalar (ty : scalar_ty) : eqtype = x:int{scalar_min ty <= x && x <= scalar_max ty}
+
+let mk_scalar (ty : scalar_ty) (x : int) : result (scalar ty) =
+  if scalar_min ty <= x && scalar_max ty >= x then Return x else Fail Failure
+
+let scalar_neg (#ty : scalar_ty) (x : scalar ty) : result (scalar ty) = mk_scalar ty (-x)
+
+let scalar_div (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (x / y) else Fail Failure
+
+/// The remainder operation
+let int_rem (x : int) (y : int{y <> 0}) : int =
+  if x >= 0 then (x % y) else -(x % y)
+
+(* Checking consistency with Rust *)
+let _ = assert_norm(int_rem 1 2 = 1)
+let _ = assert_norm(int_rem (-1) 2 = -1)
+let _ = assert_norm(int_rem 1 (-2) = 1)
+let _ = assert_norm(int_rem (-1) (-2) = -1)
+
+let scalar_rem (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (int_rem x y) else Fail Failure
+
+let scalar_add (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x + y)
+
+let scalar_sub (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x - y)
+
+let scalar_mul (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x * y)
+
+let scalar_xor (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logxor #8 x y
+  | U16 -> FStar.UInt.logxor #16 x y
+  | U32 -> FStar.UInt.logxor #32 x y
+  | U64 -> FStar.UInt.logxor #64 x y
+  | U128 -> FStar.UInt.logxor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logxor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logxor #16 x y
+  | I32 -> FStar.Int.logxor #32 x y
+  | I64 -> FStar.Int.logxor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logxor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_or (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logor #8 x y
+  | U16 -> FStar.UInt.logor #16 x y
+  | U32 -> FStar.UInt.logor #32 x y
+  | U64 -> FStar.UInt.logor #64 x y
+  | U128 -> FStar.UInt.logor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logor #16 x y
+  | I32 -> FStar.Int.logor #32 x y
+  | I64 -> FStar.Int.logor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_and (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logand #8 x y
+  | U16 -> FStar.UInt.logand #16 x y
+  | U32 -> FStar.UInt.logand #32 x y
+  | U64 -> FStar.UInt.logand #64 x y
+  | U128 -> FStar.UInt.logand #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logand #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logand #16 x y
+  | I32 -> FStar.Int.logand #32 x y
+  | I64 -> FStar.Int.logand #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logand #128 x y
+  | Isize -> admit() // TODO
+
+// Shift left
+let scalar_shl (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+// Shift right
+let scalar_shr (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+(** Cast an integer from a [src_ty] to a [tgt_ty] *)
+// TODO: check the semantics of casts in Rust
+let scalar_cast (src_ty : scalar_ty) (tgt_ty : scalar_ty) (x : scalar src_ty) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty x
+
+// This can't fail, but for now we make all casts faillible (easier for the translation)
+let scalar_cast_bool (tgt_ty : scalar_ty) (x : bool) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty (if x then 1 else 0)
+
+/// The scalar types
+type isize : eqtype = scalar Isize
+type i8    : eqtype = scalar I8
+type i16   : eqtype = scalar I16
+type i32   : eqtype = scalar I32
+type i64   : eqtype = scalar I64
+type i128  : eqtype = scalar I128
+type usize : eqtype = scalar Usize
+type u8    : eqtype = scalar U8
+type u16   : eqtype = scalar U16
+type u32   : eqtype = scalar U32
+type u64   : eqtype = scalar U64
+type u128  : eqtype = scalar U128
+
+
+let core_isize_min : isize = isize_min
+let core_isize_max : isize = isize_max
+let core_i8_min    : i8 = i8_min
+let core_i8_max    : i8 = i8_max
+let core_i16_min   : i16 = i16_min
+let core_i16_max   : i16 = i16_max
+let core_i32_min   : i32 = i32_min
+let core_i32_max   : i32 = i32_max
+let core_i64_min   : i64 = i64_min
+let core_i64_max   : i64 = i64_max
+let core_i128_min  : i128 = i128_min
+let core_i128_max  : i128 = i128_max
+
+let core_usize_min : usize = usize_min
+let core_usize_max : usize = usize_max
+let core_u8_min    : u8 = u8_min
+let core_u8_max    : u8 = u8_max
+let core_u16_min   : u16 = u16_min
+let core_u16_max   : u16 = u16_max
+let core_u32_min   : u32 = u32_min
+let core_u32_max   : u32 = u32_max
+let core_u64_min   : u64 = u64_min
+let core_u64_max   : u64 = u64_max
+let core_u128_min  : u128 = u128_min
+let core_u128_max  : u128 = u128_max
+
+/// Negation
+let isize_neg = scalar_neg #Isize
+let i8_neg = scalar_neg #I8
+let i16_neg = scalar_neg #I16
+let i32_neg = scalar_neg #I32
+let i64_neg = scalar_neg #I64
+let i128_neg = scalar_neg #I128
+
+/// Division
+let isize_div = scalar_div #Isize
+let i8_div = scalar_div #I8
+let i16_div = scalar_div #I16
+let i32_div = scalar_div #I32
+let i64_div = scalar_div #I64
+let i128_div = scalar_div #I128
+let usize_div = scalar_div #Usize
+let u8_div = scalar_div #U8
+let u16_div = scalar_div #U16
+let u32_div = scalar_div #U32
+let u64_div = scalar_div #U64
+let u128_div = scalar_div #U128
+
+/// Remainder
+let isize_rem = scalar_rem #Isize
+let i8_rem = scalar_rem #I8
+let i16_rem = scalar_rem #I16
+let i32_rem = scalar_rem #I32
+let i64_rem = scalar_rem #I64
+let i128_rem = scalar_rem #I128
+let usize_rem = scalar_rem #Usize
+let u8_rem = scalar_rem #U8
+let u16_rem = scalar_rem #U16
+let u32_rem = scalar_rem #U32
+let u64_rem = scalar_rem #U64
+let u128_rem = scalar_rem #U128
+
+/// Addition
+let isize_add = scalar_add #Isize
+let i8_add = scalar_add #I8
+let i16_add = scalar_add #I16
+let i32_add = scalar_add #I32
+let i64_add = scalar_add #I64
+let i128_add = scalar_add #I128
+let usize_add = scalar_add #Usize
+let u8_add = scalar_add #U8
+let u16_add = scalar_add #U16
+let u32_add = scalar_add #U32
+let u64_add = scalar_add #U64
+let u128_add = scalar_add #U128
+
+/// Subtraction
+let isize_sub = scalar_sub #Isize
+let i8_sub = scalar_sub #I8
+let i16_sub = scalar_sub #I16
+let i32_sub = scalar_sub #I32
+let i64_sub = scalar_sub #I64
+let i128_sub = scalar_sub #I128
+let usize_sub = scalar_sub #Usize
+let u8_sub = scalar_sub #U8
+let u16_sub = scalar_sub #U16
+let u32_sub = scalar_sub #U32
+let u64_sub = scalar_sub #U64
+let u128_sub = scalar_sub #U128
+
+/// Multiplication
+let isize_mul = scalar_mul #Isize
+let i8_mul = scalar_mul #I8
+let i16_mul = scalar_mul #I16
+let i32_mul = scalar_mul #I32
+let i64_mul = scalar_mul #I64
+let i128_mul = scalar_mul #I128
+let usize_mul = scalar_mul #Usize
+let u8_mul = scalar_mul #U8
+let u16_mul = scalar_mul #U16
+let u32_mul = scalar_mul #U32
+let u64_mul = scalar_mul #U64
+let u128_mul = scalar_mul #U128
+
+/// Xor
+let u8_xor = scalar_xor #U8
+let u16_xor = scalar_xor #U16
+let u32_xor = scalar_xor #U32
+let u64_xor = scalar_xor #U64
+let u128_xor = scalar_xor #U128
+let usize_xor = scalar_xor #Usize
+let i8_xor = scalar_xor #I8
+let i16_xor = scalar_xor #I16
+let i32_xor = scalar_xor #I32
+let i64_xor = scalar_xor #I64
+let i128_xor = scalar_xor #I128
+let isize_xor = scalar_xor #Isize
+
+/// Or
+let u8_or = scalar_or #U8
+let u16_or = scalar_or #U16
+let u32_or = scalar_or #U32
+let u64_or = scalar_or #U64
+let u128_or = scalar_or #U128
+let usize_or = scalar_or #Usize
+let i8_or = scalar_or #I8
+let i16_or = scalar_or #I16
+let i32_or = scalar_or #I32
+let i64_or = scalar_or #I64
+let i128_or = scalar_or #I128
+let isize_or = scalar_or #Isize
+
+/// And
+let u8_and = scalar_and #U8
+let u16_and = scalar_and #U16
+let u32_and = scalar_and #U32
+let u64_and = scalar_and #U64
+let u128_and = scalar_and #U128
+let usize_and = scalar_and #Usize
+let i8_and = scalar_and #I8
+let i16_and = scalar_and #I16
+let i32_and = scalar_and #I32
+let i64_and = scalar_and #I64
+let i128_and = scalar_and #I128
+let isize_and = scalar_and #Isize
+
+/// Shift left
+let u8_shl #ty = scalar_shl #U8 #ty
+let u16_shl #ty = scalar_shl #U16 #ty
+let u32_shl #ty = scalar_shl #U32 #ty
+let u64_shl #ty = scalar_shl #U64 #ty
+let u128_shl #ty = scalar_shl #U128 #ty
+let usize_shl #ty = scalar_shl #Usize #ty
+let i8_shl #ty = scalar_shl #I8 #ty
+let i16_shl #ty = scalar_shl #I16 #ty
+let i32_shl #ty = scalar_shl #I32 #ty
+let i64_shl #ty = scalar_shl #I64 #ty
+let i128_shl #ty = scalar_shl #I128 #ty
+let isize_shl #ty = scalar_shl #Isize #ty
+
+/// Shift right
+let u8_shr #ty = scalar_shr #U8 #ty
+let u16_shr #ty = scalar_shr #U16 #ty
+let u32_shr #ty = scalar_shr #U32 #ty
+let u64_shr #ty = scalar_shr #U64 #ty
+let u128_shr #ty = scalar_shr #U128 #ty
+let usize_shr #ty = scalar_shr #Usize #ty
+let i8_shr #ty = scalar_shr #I8 #ty
+let i16_shr #ty = scalar_shr #I16 #ty
+let i32_shr #ty = scalar_shr #I32 #ty
+let i64_shr #ty = scalar_shr #I64 #ty
+let i128_shr #ty = scalar_shr #I128 #ty
+let isize_shr #ty = scalar_shr #Isize #ty
+
+(*** core::ops *)
+
+// Trait declaration: [core::ops::index::Index]
+noeq type core_ops_index_Index (self idx : Type0) = {
+  output : Type0;
+  index : self → idx → result output
+}
+
+// Trait declaration: [core::ops::index::IndexMut]
+noeq type core_ops_index_IndexMut (self idx : Type0) = {
+  indexInst : core_ops_index_Index self idx;
+  index_mut : self → idx → result indexInst.output;
+  index_mut_back : self → idx → indexInst.output → result self;
+}
+
+// Trait declaration [core::ops::deref::Deref]
+noeq type core_ops_deref_Deref (self : Type0) = {
+  target : Type0;
+  deref : self → result target;
+}
+
+// Trait declaration [core::ops::deref::DerefMut]
+noeq type core_ops_deref_DerefMut (self : Type0) = {
+  derefInst : core_ops_deref_Deref self;
+  deref_mut : self → result derefInst.target;
+  deref_mut_back : self → derefInst.target → result self;
+}
+
+type core_ops_range_Range (a : Type0) = {
+  start : a;
+  end_ : a;
+}
+
+(*** [alloc] *)
+
+let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
+  target = self;
+  deref = alloc_boxed_Box_deref self;
+}
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
+  derefInst = alloc_boxed_Box_coreopsDerefInst self;
+  deref_mut = alloc_boxed_Box_deref_mut self;
+  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
+}
+
+(*** Array *)
+type array (a : Type0) (n : usize) = s:list a{length s = n}
+
+// We tried putting the normalize_term condition as a refinement on the list
+// but it didn't work. It works with the requires clause.
+let mk_array (a : Type0) (n : usize)
+  (l : list a) :
+  Pure (array a n)
+  (requires (normalize_term(FStar.List.Tot.length l) = n))
+  (ensures (fun _ -> True)) =
+  normalize_term_spec (FStar.List.Tot.length l);
+  l
+
+let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Slice *)
+type slice (a : Type0) = s:list a{length s <= usize_max}
+
+let slice_len (a : Type0) (s : slice a) : usize = length s
+
+let slice_index_usize (a : Type0) (x : slice a) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (slice a) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Subslices *)
+
+let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
+let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : result (array a n) =
+  if length s = n then Return s
+  else Fail Failure
+
+// TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
+let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let array_update_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) (ns : slice a) : result (array a n) =
+  admit()
+
+let array_repeat (a : Type0) (n : usize) (x : a) : array a n =
+  admit()
+
+let slice_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let slice_update_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) (ns : slice a) : result (slice a) =
+  admit()
+
+(*** Vector *)
+type alloc_vec_Vec (a : Type0) = v:list a{length v <= usize_max}
+
+let alloc_vec_Vec_new (a  : Type0) : alloc_vec_Vec a = assert_norm(length #a [] == 0); []
+let alloc_vec_Vec_len (a : Type0) (v : alloc_vec_Vec a) : usize = length v
+
+// Helper
+let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : result a =
+  if i < length v then Return (index v i) else Fail Failure
+// Helper
+let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
+  Pure (result (alloc_vec_Vec a))
+  (requires True)
+  (ensures (fun res ->
+    match res with
+    | Fail e -> e == Failure
+    | Return v' -> length v' = length v + 1)) =
+  if length v < usize_max then begin
+    (**) assert_norm(length [x] == 1);
+    (**) append_length v [x];
+    (**) assert(length (append v [x]) = length v + 1);
+    Return (append v [x])
+    end
+  else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
+  if i < length v then Return () else Fail Failure
+let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// Trait declaration: [core::slice::index::private_slice_index::Sealed]
+type core_slice_index_private_slice_index_Sealed (self : Type0) = unit
+
+// Trait declaration: [core::slice::index::SliceIndex]
+noeq type core_slice_index_SliceIndex (self t : Type0) = {
+  sealedInst : core_slice_index_private_slice_index_Sealed self;
+  output : Type0;
+  get : self → t → result (option output);
+  get_mut : self → t → result (option output);
+  get_mut_back : self → t → option output → result t;
+  get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
+  get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
+  index : self → t → result output;
+  index_mut : self → t → result output;
+  index_mut_back : self → t → output → result t;
+}
+
+// [core::slice::index::[T]::index]: forward function
+let core_slice_index_Slice_index
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (s : slice t) (i : idx) : result inst.output =
+  let* x = inst.get i s in
+  match x with
+  | None -> Fail Failure
+  | Some x -> Return x
+
+// [core::slice::index::Range:::get]: forward function
+let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize) (s : slice t) :
+  result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: forward function
+let core_slice_index_RangeUsize_get_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: backward function 0
+let core_slice_index_RangeUsize_get_mut_back
+  (t : Type0) :
+  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_unchecked]: forward function
+let core_slice_index_RangeUsize_get_unchecked
+  (t : Type0) :
+  core_ops_range_Range usize → const_raw_ptr (slice t) → result (const_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::get_unchecked_mut]: forward function
+let core_slice_index_RangeUsize_get_unchecked_mut
+  (t : Type0) :
+  core_ops_range_Range usize → mut_raw_ptr (slice t) → result (mut_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::index]: forward function
+let core_slice_index_RangeUsize_index
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: forward function
+let core_slice_index_RangeUsize_index_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: backward function 0
+let core_slice_index_RangeUsize_index_mut_back
+  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::[T]::index_mut]: forward function
+let core_slice_index_Slice_index_mut
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → result inst.output =
+  admit () // 
+
+// [core::slice::index::[T]::index_mut]: backward function 0
+let core_slice_index_Slice_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → inst.output → result (slice t) =
+  admit () // TODO
+
+// [core::array::[T; N]::index]: forward function
+let core_array_Array_index
+  (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
+  (a : array t n) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: forward function
+let core_array_Array_index_mut
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) : result inst.indexInst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: backward function 0
+let core_array_Array_index_mut_back
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::Range]
+let core_slice_index_private_slice_index_SealedRangeUsizeInst
+  : core_slice_index_private_slice_index_Sealed (core_ops_range_Range usize) = ()
+
+// Trait implementation: [core::slice::index::Range]
+let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex (core_ops_range_Range usize) (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedRangeUsizeInst;
+  output = slice t;
+  get = core_slice_index_RangeUsize_get t;
+  get_mut = core_slice_index_RangeUsize_get_mut t;
+  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
+  get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
+  index = core_slice_index_RangeUsize_index t;
+  index_mut = core_slice_index_RangeUsize_index_mut t;
+  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (slice t) idx = {
+  output = inst.output;
+  index = core_slice_index_Slice_index t idx inst;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (slice t) idx = {
+  indexInst = core_ops_index_IndexSliceTIInst t idx inst;
+  index_mut = core_slice_index_Slice_index_mut t idx inst;
+  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexArrayInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_Index (slice t) idx) :
+  core_ops_index_Index (array t n) idx = {
+  output = inst.output;
+  index = core_array_Array_index t idx n inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_IndexMut (slice t) idx) :
+  core_ops_index_IndexMut (array t n) idx = {
+  indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
+  index_mut = core_array_Array_index_mut t idx n inst;
+  index_mut_back = core_array_Array_index_mut_back t idx n inst;
+}
+
+// [core::slice::index::usize::get]: forward function
+let core_slice_index_usize_get
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: forward function
+let core_slice_index_usize_get_mut
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: backward function 0
+let core_slice_index_usize_get_mut_back
+  (t : Type0) : usize → slice t → option t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked]: forward function
+let core_slice_index_usize_get_unchecked
+  (t : Type0) : usize → const_raw_ptr (slice t) → result (const_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked_mut]: forward function
+let core_slice_index_usize_get_unchecked_mut
+  (t : Type0) : usize → mut_raw_ptr (slice t) → result (mut_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::index]: forward function
+let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: forward function
+let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: backward function 0
+let core_slice_index_usize_index_mut_back
+  (t : Type0) : usize → slice t → t → result (slice t) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::usize]
+let core_slice_index_private_slice_index_SealedUsizeInst
+  : core_slice_index_private_slice_index_Sealed usize = ()
+
+// Trait implementation: [core::slice::index::usize]
+let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex usize (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedUsizeInst;
+  output = t;
+  get = core_slice_index_usize_get t;
+  get_mut = core_slice_index_usize_get_mut t;
+  get_mut_back = core_slice_index_usize_get_mut_back t;
+  get_unchecked = core_slice_index_usize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
+  index = core_slice_index_usize_index t;
+  index_mut = core_slice_index_usize_index_mut t;
+  index_mut_back = core_slice_index_usize_index_mut_back t;
+}
+
+// [alloc::vec::Vec::index]: forward function
+let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: forward function
+let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: backward function 0
+let alloc_vec_Vec_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  admit () // TODO
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (alloc_vec_Vec t) idx = {
+  output = inst.output;
+  index = alloc_vec_Vec_index t idx inst;
+}
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
+  indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
+  index_mut = alloc_vec_Vec_index_mut t idx inst;
+  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
+}
+
+(*** Theorems *)
+
+let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
+  Lemma (
+    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
+      alloc_vec_Vec_update_usize v i x)
+  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
+  =
+  admit()
diff --git a/tests/fstar-split/betree/BetreeMain.Clauses.Template.fst b/tests/fstar-split/betree/BetreeMain.Clauses.Template.fst
new file mode 100644
index 00000000..537705c5
--- /dev/null
+++ b/tests/fstar-split/betree/BetreeMain.Clauses.Template.fst
@@ -0,0 +1,117 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [betree_main]: templates for the decreases clauses *)
+module BetreeMain.Clauses.Template
+open Primitives
+open BetreeMain.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]: decreases clause
+    Source: 'src/betree.rs', lines 276:4-276:24 *)
+unfold
+let betree_List_len_decreases (t : Type0) (self : betree_List_t t) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]: decreases clause
+    Source: 'src/betree.rs', lines 284:4-284:51 *)
+unfold
+let betree_List_split_at_decreases (t : Type0) (self : betree_List_t t)
+  (n : u64) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]: decreases clause
+    Source: 'src/betree.rs', lines 339:4-339:73 *)
+unfold
+let betree_ListTupleU64T_partition_at_pivot_decreases (t : Type0)
+  (self : betree_List_t (u64 & t)) (pivot : u64) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: decreases clause
+    Source: 'src/betree.rs', lines 789:4-792:34 *)
+unfold
+let betree_Node_lookup_first_message_for_key_decreases (key : u64)
+  (msgs : betree_List_t (u64 & betree_Message_t)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]: decreases clause
+    Source: 'src/betree.rs', lines 636:4-636:80 *)
+unfold
+let betree_Node_lookup_in_bindings_decreases (key : u64)
+  (bindings : betree_List_t (u64 & u64)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: decreases clause
+    Source: 'src/betree.rs', lines 819:4-819:90 *)
+unfold
+let betree_Node_apply_upserts_decreases
+  (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
+  (key : u64) (st : state) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: decreases clause
+    Source: 'src/betree.rs', lines 395:4-395:63 *)
+unfold
+let betree_Internal_lookup_in_children_decreases (self : betree_Internal_t)
+  (key : u64) (st : state) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: decreases clause
+    Source: 'src/betree.rs', lines 709:4-709:58 *)
+unfold
+let betree_Node_lookup_decreases (self : betree_Node_t) (key : u64)
+  (st : state) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]: decreases clause
+    Source: 'src/betree.rs', lines 674:4-674:77 *)
+unfold
+let betree_Node_filter_messages_for_key_decreases (key : u64)
+  (msgs : betree_List_t (u64 & betree_Message_t)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: decreases clause
+    Source: 'src/betree.rs', lines 689:4-692:34 *)
+unfold
+let betree_Node_lookup_first_message_after_key_decreases (key : u64)
+  (msgs : betree_List_t (u64 & betree_Message_t)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]: decreases clause
+    Source: 'src/betree.rs', lines 502:4-505:5 *)
+unfold
+let betree_Node_apply_messages_to_internal_decreases
+  (msgs : betree_List_t (u64 & betree_Message_t))
+  (new_msgs : betree_List_t (u64 & betree_Message_t)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: decreases clause
+    Source: 'src/betree.rs', lines 653:4-656:32 *)
+unfold
+let betree_Node_lookup_mut_in_bindings_decreases (key : u64)
+  (bindings : betree_List_t (u64 & u64)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]: decreases clause
+    Source: 'src/betree.rs', lines 444:4-447:5 *)
+unfold
+let betree_Node_apply_messages_to_leaf_decreases
+  (bindings : betree_List_t (u64 & u64))
+  (new_msgs : betree_List_t (u64 & betree_Message_t)) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: decreases clause
+    Source: 'src/betree.rs', lines 410:4-415:26 *)
+unfold
+let betree_Internal_flush_decreases (self : betree_Internal_t)
+  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
+  (content : betree_List_t (u64 & betree_Message_t)) (st : state) : nat =
+  admit ()
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: decreases clause
+    Source: 'src/betree.rs', lines 588:4-593:5 *)
+unfold
+let betree_Node_apply_messages_decreases (self : betree_Node_t)
+  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
+  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) : nat =
+  admit ()
+
diff --git a/tests/fstar-split/betree/BetreeMain.Clauses.fst b/tests/fstar-split/betree/BetreeMain.Clauses.fst
new file mode 100644
index 00000000..21f953d1
--- /dev/null
+++ b/tests/fstar-split/betree/BetreeMain.Clauses.fst
@@ -0,0 +1,210 @@
+(** [betree_main]: templates for the decreases clauses *)
+module BetreeMain.Clauses
+open Primitives
+open BetreeMain.Types
+
+#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
+
+(*** Well-founded relations *)
+
+(* We had a few issues when proving termination of the mutually recursive functions:
+ * - betree_Internal_flush
+ * - betree_Node_apply_messages
+ *
+ * The quantity which effectively decreases is:
+ *   (betree_size, messages_length)
+ *   where messages_length is 0 when there are no messages
+ *   (and where we use the lexicographic ordering, of course)
+ *
+ * However, the `%[...]` and `{:well-founded ...} notations are not available outside
+ * of `decrease` clauses.
+ * 
+ * We thus resorted to writing and proving correct a well-founded relation over
+ * pairs of natural numbers. The trick is that `<<` can be used outside of decrease
+ * clauses, and can be used to trigger SMT patterns.
+ *
+ * What follows is adapted from:
+ * https://www.fstar-lang.org/tutorial/book/part2/part2_well_founded.html
+ *
+ * Also, the following PR might make things easier:
+ * https://github.com/FStarLang/FStar/pull/2561
+ *)
+
+module P = FStar.Preorder
+module W = FStar.WellFounded
+module L = FStar.LexicographicOrdering
+
+let lt_nat (x y:nat) : Type = x < y == true
+let rec wf_lt_nat (x:nat)
+  : W.acc lt_nat x
+  = W.AccIntro (fun y _ -> wf_lt_nat y)
+
+// A type abbreviation for a pair of nats
+let nat_pair = (x:nat & nat)
+
+// Making a lexicographic ordering from a pair of nat ordering
+let lex_order_nat_pair  : P.relation nat_pair =
+  L.lex_t lt_nat (fun _ -> lt_nat)
+
+// The lex order on nat pairs is well-founded, using our general proof
+// of lexicographic composition of well-founded orders
+let lex_order_nat_pair_wf : W.well_founded lex_order_nat_pair =
+  L.lex_t_wf wf_lt_nat (fun _ -> wf_lt_nat)
+
+// A utility to introduce lt_nat
+let mk_lt_nat (x:nat) (y:nat { x < y }) : lt_nat x y =
+  let _ : equals (x < y) true = Refl in
+  ()
+    
+// A utility to make a lex ordering of nat pairs
+let mk_lex_order_nat_pair (xy0:nat_pair) 
+                          (xy1:nat_pair {
+                            let (|x0, y0|) = xy0 in
+                            let (|x1, y1|) = xy1 in
+                            x0 < x1 \/ (x0 == x1 /\ y0 < y1)
+                          }) : lex_order_nat_pair xy0 xy1 =
+  let (|x0, y0|) = xy0 in
+  let (|x1, y1|) = xy1 in
+  if x0 < x1 then L.Left_lex x0 x1 y0 y1 (mk_lt_nat x0 x1)
+  else L.Right_lex x0 y0 y1 (mk_lt_nat y0 y1)
+
+let rec coerce #a #r #x (p:W.acc #a r x) : Tot (W.acc r x) (decreases p) =
+  W.AccIntro (fun y r -> coerce (p.access_smaller y r))
+
+let coerce_wf #a #r (p: (x:a -> W.acc r x)) : x:a -> W.acc r x =
+  fun x -> coerce (p x)
+
+(* We need this axiom, which comes from the following discussion:
+ * https://github.com/FStarLang/FStar/issues/1916
+ * An issue here is that the `{well-founded ... }` notation
+ *)
+assume
+val axiom_well_founded (a : Type) (rel : a -> a -> Type0)
+  (rwf : W.well_founded #a rel) (x y : a) :
+  Lemma (requires (rel x y)) (ensures (x << y))
+
+(* This lemma has a pattern (which makes it work) *)
+let wf_nat_pair_lem (p0 p1 : nat_pair) :
+  Lemma
+  (requires (
+    let (|x0, y0|) = p0 in
+    let (|x1, y1|) = p1 in
+    x0 < x1 || (x0 = x1 && y0 < y1)))
+  (ensures (p0 << p1))
+  [SMTPat (p0 << p1)] =
+  let rel = lex_order_nat_pair in
+  let rel_wf = lex_order_nat_pair_wf in
+  let _ = mk_lex_order_nat_pair p0 p1 in
+  assert(rel p0 p1);
+  axiom_well_founded nat_pair rel rel_wf p0 p1
+
+(*** Decrease clauses *)
+/// "Standard" decrease clauses
+
+(** [betree_main::betree::List::{1}::len]: decreases clause *)
+unfold
+let betree_List_len_decreases (t : Type0) (self : betree_List_t t) : betree_List_t t =
+  self
+
+(** [betree_main::betree::List::{1}::split_at]: decreases clause *)
+unfold
+let betree_List_split_at_decreases (t : Type0) (self : betree_List_t t)
+  (n : u64) : nat =
+  n
+
+(** [betree_main::betree::List::{2}::partition_at_pivot]: decreases clause *)
+unfold
+let betree_ListTupleU64T_partition_at_pivot_decreases (t : Type0)
+  (self : betree_List_t (u64 & t)) (pivot : u64) : betree_List_t (u64 & t) =
+  self
+
+(** [betree_main::betree::Node::{5}::lookup_in_bindings]: decreases clause *)
+unfold
+let betree_Node_lookup_in_bindings_decreases (key : u64)
+  (bindings : betree_List_t (u64 & u64)) : betree_List_t (u64 & u64) =
+  bindings
+
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: decreases clause *)
+unfold
+let betree_Node_lookup_first_message_for_key_decreases (key : u64)
+  (msgs : betree_List_t (u64 & betree_Message_t)) : betree_List_t (u64 & betree_Message_t) =
+  msgs
+
+(** [betree_main::betree::Node::{5}::apply_upserts]: decreases clause *)
+unfold
+let betree_Node_apply_upserts_decreases
+  (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
+  (key : u64) (st : state) : betree_List_t (u64 & betree_Message_t) =
+  msgs
+
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: decreases clause *)
+unfold
+let betree_Internal_lookup_in_children_decreases (self : betree_Internal_t)
+  (key : u64) (st : state) : betree_Internal_t =
+  self
+
+(** [betree_main::betree::Node::{5}::lookup]: decreases clause *)
+unfold
+let betree_Node_lookup_decreases (self : betree_Node_t) (key : u64)
+  (st : state) : betree_Node_t =
+  self
+
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: decreases clause *)
+unfold
+let betree_Node_lookup_mut_in_bindings_decreases (key : u64)
+  (bindings : betree_List_t (u64 & u64)) : betree_List_t (u64 & u64) =
+  bindings
+
+unfold
+let betree_Node_apply_messages_to_leaf_decreases
+  (bindings : betree_List_t (u64 & u64))
+  (new_msgs : betree_List_t (u64 & betree_Message_t)) : betree_List_t (u64 & betree_Message_t) =
+  new_msgs
+
+(** [betree_main::betree::Node::{5}::filter_messages_for_key]: decreases clause *)
+unfold
+let betree_Node_filter_messages_for_key_decreases (key : u64)
+  (msgs : betree_List_t (u64 & betree_Message_t)) : betree_List_t (u64 & betree_Message_t) =
+  msgs
+
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: decreases clause *)
+unfold
+let betree_Node_lookup_first_message_after_key_decreases (key : u64)
+  (msgs : betree_List_t (u64 & betree_Message_t)) : betree_List_t (u64 & betree_Message_t) =
+  msgs
+
+let betree_Node_apply_messages_to_internal_decreases
+  (msgs : betree_List_t (u64 & betree_Message_t))
+  (new_msgs : betree_List_t (u64 & betree_Message_t)) : betree_List_t (u64 & betree_Message_t) =
+  new_msgs
+
+(*** Decrease clauses - nat_pair *)
+/// The following decrease clauses use the [nat_pair] definition and the well-founded
+/// relation proven above.
+
+let rec betree_size (bt : betree_Node_t) : nat =
+  match bt with
+  | Betree_Node_Internal node -> 1 + betree_Internal_size node
+  | Betree_Node_Leaf _ -> 1
+
+and betree_Internal_size (node : betree_Internal_t) : nat =
+  1 + betree_size node.left + betree_size node.right
+
+let rec betree_List_len (#a : Type0) (ls : betree_List_t a) : nat =
+  match ls with
+  | Betree_List_Cons _ tl -> 1 + betree_List_len tl
+  | Betree_List_Nil -> 0
+
+(** [betree_main::betree::Internal::{4}::flush]: decreases clause *)
+unfold
+let betree_Internal_flush_decreases (self : betree_Internal_t)
+  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
+  (content : betree_List_t (u64 & betree_Message_t)) (st : state) : nat_pair =
+  (|betree_Internal_size self, 0|)
+
+(** [betree_main::betree::Node::{5}::apply_messages]: decreases clause *)
+unfold
+let betree_Node_apply_messages_decreases (self : betree_Node_t)
+  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
+  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) : nat_pair =
+  (|betree_size self, betree_List_len msgs|)
diff --git a/tests/fstar-split/betree/BetreeMain.Funs.fst b/tests/fstar-split/betree/BetreeMain.Funs.fst
new file mode 100644
index 00000000..6890488a
--- /dev/null
+++ b/tests/fstar-split/betree/BetreeMain.Funs.fst
@@ -0,0 +1,1011 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [betree_main]: function definitions *)
+module BetreeMain.Funs
+open Primitives
+include BetreeMain.Types
+include BetreeMain.FunsExternal
+include BetreeMain.Clauses
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [betree_main::betree::load_internal_node]: forward function
+    Source: 'src/betree.rs', lines 36:0-36:52 *)
+let betree_load_internal_node
+  (id : u64) (st : state) :
+  result (state & (betree_List_t (u64 & betree_Message_t)))
+  =
+  betree_utils_load_internal_node id st
+
+(** [betree_main::betree::store_internal_node]: forward function
+    Source: 'src/betree.rs', lines 41:0-41:60 *)
+let betree_store_internal_node
+  (id : u64) (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
+  result (state & unit)
+  =
+  let* (st1, _) = betree_utils_store_internal_node id content st in
+  Return (st1, ())
+
+(** [betree_main::betree::load_leaf_node]: forward function
+    Source: 'src/betree.rs', lines 46:0-46:44 *)
+let betree_load_leaf_node
+  (id : u64) (st : state) : result (state & (betree_List_t (u64 & u64))) =
+  betree_utils_load_leaf_node id st
+
+(** [betree_main::betree::store_leaf_node]: forward function
+    Source: 'src/betree.rs', lines 51:0-51:52 *)
+let betree_store_leaf_node
+  (id : u64) (content : betree_List_t (u64 & u64)) (st : state) :
+  result (state & unit)
+  =
+  let* (st1, _) = betree_utils_store_leaf_node id content st in
+  Return (st1, ())
+
+(** [betree_main::betree::fresh_node_id]: forward function
+    Source: 'src/betree.rs', lines 55:0-55:48 *)
+let betree_fresh_node_id (counter : u64) : result u64 =
+  let* _ = u64_add counter 1 in Return counter
+
+(** [betree_main::betree::fresh_node_id]: backward function 0
+    Source: 'src/betree.rs', lines 55:0-55:48 *)
+let betree_fresh_node_id_back (counter : u64) : result u64 =
+  u64_add counter 1
+
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]: forward function
+    Source: 'src/betree.rs', lines 206:4-206:20 *)
+let betree_NodeIdCounter_new : result betree_NodeIdCounter_t =
+  Return { next_node_id = 0 }
+
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: forward function
+    Source: 'src/betree.rs', lines 210:4-210:36 *)
+let betree_NodeIdCounter_fresh_id
+  (self : betree_NodeIdCounter_t) : result u64 =
+  let* _ = u64_add self.next_node_id 1 in Return self.next_node_id
+
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: backward function 0
+    Source: 'src/betree.rs', lines 210:4-210:36 *)
+let betree_NodeIdCounter_fresh_id_back
+  (self : betree_NodeIdCounter_t) : result betree_NodeIdCounter_t =
+  let* i = u64_add self.next_node_id 1 in Return { next_node_id = i }
+
+(** [betree_main::betree::upsert_update]: forward function
+    Source: 'src/betree.rs', lines 234:0-234:70 *)
+let betree_upsert_update
+  (prev : option u64) (st : betree_UpsertFunState_t) : result u64 =
+  begin match prev with
+  | None ->
+    begin match st with
+    | Betree_UpsertFunState_Add v -> Return v
+    | Betree_UpsertFunState_Sub _ -> Return 0
+    end
+  | Some prev1 ->
+    begin match st with
+    | Betree_UpsertFunState_Add v ->
+      let* margin = u64_sub core_u64_max prev1 in
+      if margin >= v then u64_add prev1 v else Return core_u64_max
+    | Betree_UpsertFunState_Sub v ->
+      if prev1 >= v then u64_sub prev1 v else Return 0
+    end
+  end
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]: forward function
+    Source: 'src/betree.rs', lines 276:4-276:24 *)
+let rec betree_List_len
+  (t : Type0) (self : betree_List_t t) :
+  Tot (result u64) (decreases (betree_List_len_decreases t self))
+  =
+  begin match self with
+  | Betree_List_Cons _ tl -> let* i = betree_List_len t tl in u64_add 1 i
+  | Betree_List_Nil -> Return 0
+  end
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]: forward function
+    Source: 'src/betree.rs', lines 284:4-284:51 *)
+let rec betree_List_split_at
+  (t : Type0) (self : betree_List_t t) (n : u64) :
+  Tot (result ((betree_List_t t) & (betree_List_t t)))
+  (decreases (betree_List_split_at_decreases t self n))
+  =
+  if n = 0
+  then Return (Betree_List_Nil, self)
+  else
+    begin match self with
+    | Betree_List_Cons hd tl ->
+      let* i = u64_sub n 1 in
+      let* p = betree_List_split_at t tl i in
+      let (ls0, ls1) = p in
+      let l = ls0 in
+      Return (Betree_List_Cons hd l, ls1)
+    | Betree_List_Nil -> Fail Failure
+    end
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/betree.rs', lines 299:4-299:34 *)
+let betree_List_push_front
+  (t : Type0) (self : betree_List_t t) (x : t) : result (betree_List_t t) =
+  let tl = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+  let l = tl in
+  Return (Betree_List_Cons x l)
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: forward function
+    Source: 'src/betree.rs', lines 306:4-306:32 *)
+let betree_List_pop_front (t : Type0) (self : betree_List_t t) : result t =
+  let ls = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+  begin match ls with
+  | Betree_List_Cons x _ -> Return x
+  | Betree_List_Nil -> Fail Failure
+  end
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: backward function 0
+    Source: 'src/betree.rs', lines 306:4-306:32 *)
+let betree_List_pop_front_back
+  (t : Type0) (self : betree_List_t t) : result (betree_List_t t) =
+  let ls = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+  begin match ls with
+  | Betree_List_Cons _ tl -> Return tl
+  | Betree_List_Nil -> Fail Failure
+  end
+
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]: forward function
+    Source: 'src/betree.rs', lines 318:4-318:22 *)
+let betree_List_hd (t : Type0) (self : betree_List_t t) : result t =
+  begin match self with
+  | Betree_List_Cons hd _ -> Return hd
+  | Betree_List_Nil -> Fail Failure
+  end
+
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]: forward function
+    Source: 'src/betree.rs', lines 327:4-327:44 *)
+let betree_ListTupleU64T_head_has_key
+  (t : Type0) (self : betree_List_t (u64 & t)) (key : u64) : result bool =
+  begin match self with
+  | Betree_List_Cons hd _ -> let (i, _) = hd in Return (i = key)
+  | Betree_List_Nil -> Return false
+  end
+
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]: forward function
+    Source: 'src/betree.rs', lines 339:4-339:73 *)
+let rec betree_ListTupleU64T_partition_at_pivot
+  (t : Type0) (self : betree_List_t (u64 & t)) (pivot : u64) :
+  Tot (result ((betree_List_t (u64 & t)) & (betree_List_t (u64 & t))))
+  (decreases (betree_ListTupleU64T_partition_at_pivot_decreases t self pivot))
+  =
+  begin match self with
+  | Betree_List_Cons hd tl ->
+    let (i, x) = hd in
+    if i >= pivot
+    then Return (Betree_List_Nil, Betree_List_Cons (i, x) tl)
+    else
+      let* p = betree_ListTupleU64T_partition_at_pivot t tl pivot in
+      let (ls0, ls1) = p in
+      let l = ls0 in
+      Return (Betree_List_Cons (i, x) l, ls1)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Betree_List_Nil)
+  end
+
+(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: forward function
+    Source: 'src/betree.rs', lines 359:4-364:17 *)
+let betree_Leaf_split
+  (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
+  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
+  (st : state) :
+  result (state & betree_Internal_t)
+  =
+  let* p = betree_List_split_at (u64 & u64) content params.split_size in
+  let (content0, content1) = p in
+  let* p1 = betree_List_hd (u64 & u64) content1 in
+  let (pivot, _) = p1 in
+  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* node_id_cnt1 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
+  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt1 in
+  let* (st1, _) = betree_store_leaf_node id0 content0 st in
+  let* (st2, _) = betree_store_leaf_node id1 content1 st1 in
+  let n = Betree_Node_Leaf { id = id0; size = params.split_size } in
+  let n1 = Betree_Node_Leaf { id = id1; size = params.split_size } in
+  Return (st2, { id = self.id; pivot = pivot; left = n; right = n1 })
+
+(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 2
+    Source: 'src/betree.rs', lines 359:4-364:17 *)
+let betree_Leaf_split_back
+  (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
+  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
+  (st : state) :
+  result betree_NodeIdCounter_t
+  =
+  let* p = betree_List_split_at (u64 & u64) content params.split_size in
+  let (content0, content1) = p in
+  let* _ = betree_List_hd (u64 & u64) content1 in
+  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* node_id_cnt1 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
+  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt1 in
+  let* (st1, _) = betree_store_leaf_node id0 content0 st in
+  let* _ = betree_store_leaf_node id1 content1 st1 in
+  betree_NodeIdCounter_fresh_id_back node_id_cnt1
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: forward function
+    Source: 'src/betree.rs', lines 789:4-792:34 *)
+let rec betree_Node_lookup_first_message_for_key
+  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_lookup_first_message_for_key_decreases key msgs))
+  =
+  begin match msgs with
+  | Betree_List_Cons x next_msgs ->
+    let (i, m) = x in
+    if i >= key
+    then Return (Betree_List_Cons (i, m) next_msgs)
+    else betree_Node_lookup_first_message_for_key key next_msgs
+  | Betree_List_Nil -> Return Betree_List_Nil
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: backward function 0
+    Source: 'src/betree.rs', lines 789:4-792:34 *)
+let rec betree_Node_lookup_first_message_for_key_back
+  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t))
+  (ret : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_lookup_first_message_for_key_decreases key msgs))
+  =
+  begin match msgs with
+  | Betree_List_Cons x next_msgs ->
+    let (i, m) = x in
+    if i >= key
+    then Return ret
+    else
+      let* next_msgs1 =
+        betree_Node_lookup_first_message_for_key_back key next_msgs ret in
+      Return (Betree_List_Cons (i, m) next_msgs1)
+  | Betree_List_Nil -> Return ret
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]: forward function
+    Source: 'src/betree.rs', lines 636:4-636:80 *)
+let rec betree_Node_lookup_in_bindings
+  (key : u64) (bindings : betree_List_t (u64 & u64)) :
+  Tot (result (option u64))
+  (decreases (betree_Node_lookup_in_bindings_decreases key bindings))
+  =
+  begin match bindings with
+  | Betree_List_Cons hd tl ->
+    let (i, i1) = hd in
+    if i = key
+    then Return (Some i1)
+    else if i > key then Return None else betree_Node_lookup_in_bindings key tl
+  | Betree_List_Nil -> Return None
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: forward function
+    Source: 'src/betree.rs', lines 819:4-819:90 *)
+let rec betree_Node_apply_upserts
+  (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
+  (key : u64) (st : state) :
+  Tot (result (state & u64))
+  (decreases (betree_Node_apply_upserts_decreases msgs prev key st))
+  =
+  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs key in
+  if b
+  then
+    let* msg = betree_List_pop_front (u64 & betree_Message_t) msgs in
+    let (_, m) = msg in
+    begin match m with
+    | Betree_Message_Insert _ -> Fail Failure
+    | Betree_Message_Delete -> Fail Failure
+    | Betree_Message_Upsert s ->
+      let* v = betree_upsert_update prev s in
+      let* msgs1 = betree_List_pop_front_back (u64 & betree_Message_t) msgs in
+      betree_Node_apply_upserts msgs1 (Some v) key st
+    end
+  else
+    let* (st1, v) = core_option_Option_unwrap u64 prev st in
+    let* _ =
+      betree_List_push_front (u64 & betree_Message_t) msgs (key,
+        Betree_Message_Insert v) in
+    Return (st1, v)
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: backward function 0
+    Source: 'src/betree.rs', lines 819:4-819:90 *)
+let rec betree_Node_apply_upserts_back
+  (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
+  (key : u64) (st : state) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_apply_upserts_decreases msgs prev key st))
+  =
+  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs key in
+  if b
+  then
+    let* msg = betree_List_pop_front (u64 & betree_Message_t) msgs in
+    let (_, m) = msg in
+    begin match m with
+    | Betree_Message_Insert _ -> Fail Failure
+    | Betree_Message_Delete -> Fail Failure
+    | Betree_Message_Upsert s ->
+      let* v = betree_upsert_update prev s in
+      let* msgs1 = betree_List_pop_front_back (u64 & betree_Message_t) msgs in
+      betree_Node_apply_upserts_back msgs1 (Some v) key st
+    end
+  else
+    let* (_, v) = core_option_Option_unwrap u64 prev st in
+    betree_List_push_front (u64 & betree_Message_t) msgs (key,
+      Betree_Message_Insert v)
+
+(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: forward function
+    Source: 'src/betree.rs', lines 395:4-395:63 *)
+let rec betree_Internal_lookup_in_children
+  (self : betree_Internal_t) (key : u64) (st : state) :
+  Tot (result (state & (option u64)))
+  (decreases (betree_Internal_lookup_in_children_decreases self key st))
+  =
+  if key < self.pivot
+  then betree_Node_lookup self.left key st
+  else betree_Node_lookup self.right key st
+
+(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: backward function 0
+    Source: 'src/betree.rs', lines 395:4-395:63 *)
+and betree_Internal_lookup_in_children_back
+  (self : betree_Internal_t) (key : u64) (st : state) :
+  Tot (result betree_Internal_t)
+  (decreases (betree_Internal_lookup_in_children_decreases self key st))
+  =
+  if key < self.pivot
+  then
+    let* n = betree_Node_lookup_back self.left key st in
+    Return { self with left = n }
+  else
+    let* n = betree_Node_lookup_back self.right key st in
+    Return { self with right = n }
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: forward function
+    Source: 'src/betree.rs', lines 709:4-709:58 *)
+and betree_Node_lookup
+  (self : betree_Node_t) (key : u64) (st : state) :
+  Tot (result (state & (option u64)))
+  (decreases (betree_Node_lookup_decreases self key st))
+  =
+  begin match self with
+  | Betree_Node_Internal node ->
+    let* (st1, msgs) = betree_load_internal_node node.id st in
+    let* pending = betree_Node_lookup_first_message_for_key key msgs in
+    begin match pending with
+    | Betree_List_Cons p l ->
+      let (k, msg) = p in
+      if k <> key
+      then
+        let* (st2, o) = betree_Internal_lookup_in_children node key st1 in
+        let* _ =
+          betree_Node_lookup_first_message_for_key_back key msgs
+            (Betree_List_Cons (k, msg) l) in
+        Return (st2, o)
+      else
+        begin match msg with
+        | Betree_Message_Insert v ->
+          let* _ =
+            betree_Node_lookup_first_message_for_key_back key msgs
+              (Betree_List_Cons (k, Betree_Message_Insert v) l) in
+          Return (st1, Some v)
+        | Betree_Message_Delete ->
+          let* _ =
+            betree_Node_lookup_first_message_for_key_back key msgs
+              (Betree_List_Cons (k, Betree_Message_Delete) l) in
+          Return (st1, None)
+        | Betree_Message_Upsert ufs ->
+          let* (st2, v) = betree_Internal_lookup_in_children node key st1 in
+          let* (st3, v1) =
+            betree_Node_apply_upserts (Betree_List_Cons (k,
+              Betree_Message_Upsert ufs) l) v key st2 in
+          let* node1 = betree_Internal_lookup_in_children_back node key st1 in
+          let* pending1 =
+            betree_Node_apply_upserts_back (Betree_List_Cons (k,
+              Betree_Message_Upsert ufs) l) v key st2 in
+          let* msgs1 =
+            betree_Node_lookup_first_message_for_key_back key msgs pending1 in
+          let* (st4, _) = betree_store_internal_node node1.id msgs1 st3 in
+          Return (st4, Some v1)
+        end
+    | Betree_List_Nil ->
+      let* (st2, o) = betree_Internal_lookup_in_children node key st1 in
+      let* _ =
+        betree_Node_lookup_first_message_for_key_back key msgs Betree_List_Nil
+        in
+      Return (st2, o)
+    end
+  | Betree_Node_Leaf node ->
+    let* (st1, bindings) = betree_load_leaf_node node.id st in
+    let* o = betree_Node_lookup_in_bindings key bindings in
+    Return (st1, o)
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: backward function 0
+    Source: 'src/betree.rs', lines 709:4-709:58 *)
+and betree_Node_lookup_back
+  (self : betree_Node_t) (key : u64) (st : state) :
+  Tot (result betree_Node_t)
+  (decreases (betree_Node_lookup_decreases self key st))
+  =
+  begin match self with
+  | Betree_Node_Internal node ->
+    let* (st1, msgs) = betree_load_internal_node node.id st in
+    let* pending = betree_Node_lookup_first_message_for_key key msgs in
+    begin match pending with
+    | Betree_List_Cons p l ->
+      let (k, msg) = p in
+      if k <> key
+      then
+        let* _ =
+          betree_Node_lookup_first_message_for_key_back key msgs
+            (Betree_List_Cons (k, msg) l) in
+        let* node1 = betree_Internal_lookup_in_children_back node key st1 in
+        Return (Betree_Node_Internal node1)
+      else
+        begin match msg with
+        | Betree_Message_Insert v ->
+          let* _ =
+            betree_Node_lookup_first_message_for_key_back key msgs
+              (Betree_List_Cons (k, Betree_Message_Insert v) l) in
+          Return (Betree_Node_Internal node)
+        | Betree_Message_Delete ->
+          let* _ =
+            betree_Node_lookup_first_message_for_key_back key msgs
+              (Betree_List_Cons (k, Betree_Message_Delete) l) in
+          Return (Betree_Node_Internal node)
+        | Betree_Message_Upsert ufs ->
+          let* (st2, v) = betree_Internal_lookup_in_children node key st1 in
+          let* (st3, _) =
+            betree_Node_apply_upserts (Betree_List_Cons (k,
+              Betree_Message_Upsert ufs) l) v key st2 in
+          let* node1 = betree_Internal_lookup_in_children_back node key st1 in
+          let* pending1 =
+            betree_Node_apply_upserts_back (Betree_List_Cons (k,
+              Betree_Message_Upsert ufs) l) v key st2 in
+          let* msgs1 =
+            betree_Node_lookup_first_message_for_key_back key msgs pending1 in
+          let* _ = betree_store_internal_node node1.id msgs1 st3 in
+          Return (Betree_Node_Internal node1)
+        end
+    | Betree_List_Nil ->
+      let* _ =
+        betree_Node_lookup_first_message_for_key_back key msgs Betree_List_Nil
+        in
+      let* node1 = betree_Internal_lookup_in_children_back node key st1 in
+      Return (Betree_Node_Internal node1)
+    end
+  | Betree_Node_Leaf node ->
+    let* (_, bindings) = betree_load_leaf_node node.id st in
+    let* _ = betree_Node_lookup_in_bindings key bindings in
+    Return (Betree_Node_Leaf node)
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/betree.rs', lines 674:4-674:77 *)
+let rec betree_Node_filter_messages_for_key
+  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_filter_messages_for_key_decreases key msgs))
+  =
+  begin match msgs with
+  | Betree_List_Cons p l ->
+    let (k, m) = p in
+    if k = key
+    then
+      let* msgs1 =
+        betree_List_pop_front_back (u64 & betree_Message_t) (Betree_List_Cons
+          (k, m) l) in
+      betree_Node_filter_messages_for_key key msgs1
+    else Return (Betree_List_Cons (k, m) l)
+  | Betree_List_Nil -> Return Betree_List_Nil
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: forward function
+    Source: 'src/betree.rs', lines 689:4-692:34 *)
+let rec betree_Node_lookup_first_message_after_key
+  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_lookup_first_message_after_key_decreases key msgs))
+  =
+  begin match msgs with
+  | Betree_List_Cons p next_msgs ->
+    let (k, m) = p in
+    if k = key
+    then betree_Node_lookup_first_message_after_key key next_msgs
+    else Return (Betree_List_Cons (k, m) next_msgs)
+  | Betree_List_Nil -> Return Betree_List_Nil
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: backward function 0
+    Source: 'src/betree.rs', lines 689:4-692:34 *)
+let rec betree_Node_lookup_first_message_after_key_back
+  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t))
+  (ret : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_lookup_first_message_after_key_decreases key msgs))
+  =
+  begin match msgs with
+  | Betree_List_Cons p next_msgs ->
+    let (k, m) = p in
+    if k = key
+    then
+      let* next_msgs1 =
+        betree_Node_lookup_first_message_after_key_back key next_msgs ret in
+      Return (Betree_List_Cons (k, m) next_msgs1)
+    else Return ret
+  | Betree_List_Nil -> Return ret
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/betree.rs', lines 521:4-521:89 *)
+let betree_Node_apply_to_internal
+  (msgs : betree_List_t (u64 & betree_Message_t)) (key : u64)
+  (new_msg : betree_Message_t) :
+  result (betree_List_t (u64 & betree_Message_t))
+  =
+  let* msgs1 = betree_Node_lookup_first_message_for_key key msgs in
+  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs1 key in
+  if b
+  then
+    begin match new_msg with
+    | Betree_Message_Insert i ->
+      let* msgs2 = betree_Node_filter_messages_for_key key msgs1 in
+      let* msgs3 =
+        betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
+          Betree_Message_Insert i) in
+      betree_Node_lookup_first_message_for_key_back key msgs msgs3
+    | Betree_Message_Delete ->
+      let* msgs2 = betree_Node_filter_messages_for_key key msgs1 in
+      let* msgs3 =
+        betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
+          Betree_Message_Delete) in
+      betree_Node_lookup_first_message_for_key_back key msgs msgs3
+    | Betree_Message_Upsert s ->
+      let* p = betree_List_hd (u64 & betree_Message_t) msgs1 in
+      let (_, m) = p in
+      begin match m with
+      | Betree_Message_Insert prev ->
+        let* v = betree_upsert_update (Some prev) s in
+        let* msgs2 = betree_List_pop_front_back (u64 & betree_Message_t) msgs1
+          in
+        let* msgs3 =
+          betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
+            Betree_Message_Insert v) in
+        betree_Node_lookup_first_message_for_key_back key msgs msgs3
+      | Betree_Message_Delete ->
+        let* v = betree_upsert_update None s in
+        let* msgs2 = betree_List_pop_front_back (u64 & betree_Message_t) msgs1
+          in
+        let* msgs3 =
+          betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
+            Betree_Message_Insert v) in
+        betree_Node_lookup_first_message_for_key_back key msgs msgs3
+      | Betree_Message_Upsert _ ->
+        let* msgs2 = betree_Node_lookup_first_message_after_key key msgs1 in
+        let* msgs3 =
+          betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
+            Betree_Message_Upsert s) in
+        let* msgs4 =
+          betree_Node_lookup_first_message_after_key_back key msgs1 msgs3 in
+        betree_Node_lookup_first_message_for_key_back key msgs msgs4
+      end
+    end
+  else
+    let* msgs2 =
+      betree_List_push_front (u64 & betree_Message_t) msgs1 (key, new_msg) in
+    betree_Node_lookup_first_message_for_key_back key msgs msgs2
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/betree.rs', lines 502:4-505:5 *)
+let rec betree_Node_apply_messages_to_internal
+  (msgs : betree_List_t (u64 & betree_Message_t))
+  (new_msgs : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  (decreases (betree_Node_apply_messages_to_internal_decreases msgs new_msgs))
+  =
+  begin match new_msgs with
+  | Betree_List_Cons new_msg new_msgs_tl ->
+    let (i, m) = new_msg in
+    let* msgs1 = betree_Node_apply_to_internal msgs i m in
+    betree_Node_apply_messages_to_internal msgs1 new_msgs_tl
+  | Betree_List_Nil -> Return msgs
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: forward function
+    Source: 'src/betree.rs', lines 653:4-656:32 *)
+let rec betree_Node_lookup_mut_in_bindings
+  (key : u64) (bindings : betree_List_t (u64 & u64)) :
+  Tot (result (betree_List_t (u64 & u64)))
+  (decreases (betree_Node_lookup_mut_in_bindings_decreases key bindings))
+  =
+  begin match bindings with
+  | Betree_List_Cons hd tl ->
+    let (i, i1) = hd in
+    if i >= key
+    then Return (Betree_List_Cons (i, i1) tl)
+    else betree_Node_lookup_mut_in_bindings key tl
+  | Betree_List_Nil -> Return Betree_List_Nil
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: backward function 0
+    Source: 'src/betree.rs', lines 653:4-656:32 *)
+let rec betree_Node_lookup_mut_in_bindings_back
+  (key : u64) (bindings : betree_List_t (u64 & u64))
+  (ret : betree_List_t (u64 & u64)) :
+  Tot (result (betree_List_t (u64 & u64)))
+  (decreases (betree_Node_lookup_mut_in_bindings_decreases key bindings))
+  =
+  begin match bindings with
+  | Betree_List_Cons hd tl ->
+    let (i, i1) = hd in
+    if i >= key
+    then Return ret
+    else
+      let* tl1 = betree_Node_lookup_mut_in_bindings_back key tl ret in
+      Return (Betree_List_Cons (i, i1) tl1)
+  | Betree_List_Nil -> Return ret
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/betree.rs', lines 460:4-460:87 *)
+let betree_Node_apply_to_leaf
+  (bindings : betree_List_t (u64 & u64)) (key : u64)
+  (new_msg : betree_Message_t) :
+  result (betree_List_t (u64 & u64))
+  =
+  let* bindings1 = betree_Node_lookup_mut_in_bindings key bindings in
+  let* b = betree_ListTupleU64T_head_has_key u64 bindings1 key in
+  if b
+  then
+    let* hd = betree_List_pop_front (u64 & u64) bindings1 in
+    begin match new_msg with
+    | Betree_Message_Insert v ->
+      let* bindings2 = betree_List_pop_front_back (u64 & u64) bindings1 in
+      let* bindings3 = betree_List_push_front (u64 & u64) bindings2 (key, v) in
+      betree_Node_lookup_mut_in_bindings_back key bindings bindings3
+    | Betree_Message_Delete ->
+      let* bindings2 = betree_List_pop_front_back (u64 & u64) bindings1 in
+      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
+    | Betree_Message_Upsert s ->
+      let (_, i) = hd in
+      let* v = betree_upsert_update (Some i) s in
+      let* bindings2 = betree_List_pop_front_back (u64 & u64) bindings1 in
+      let* bindings3 = betree_List_push_front (u64 & u64) bindings2 (key, v) in
+      betree_Node_lookup_mut_in_bindings_back key bindings bindings3
+    end
+  else
+    begin match new_msg with
+    | Betree_Message_Insert v ->
+      let* bindings2 = betree_List_push_front (u64 & u64) bindings1 (key, v) in
+      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
+    | Betree_Message_Delete ->
+      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
+    | Betree_Message_Upsert s ->
+      let* v = betree_upsert_update None s in
+      let* bindings2 = betree_List_push_front (u64 & u64) bindings1 (key, v) in
+      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
+    end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/betree.rs', lines 444:4-447:5 *)
+let rec betree_Node_apply_messages_to_leaf
+  (bindings : betree_List_t (u64 & u64))
+  (new_msgs : betree_List_t (u64 & betree_Message_t)) :
+  Tot (result (betree_List_t (u64 & u64)))
+  (decreases (betree_Node_apply_messages_to_leaf_decreases bindings new_msgs))
+  =
+  begin match new_msgs with
+  | Betree_List_Cons new_msg new_msgs_tl ->
+    let (i, m) = new_msg in
+    let* bindings1 = betree_Node_apply_to_leaf bindings i m in
+    betree_Node_apply_messages_to_leaf bindings1 new_msgs_tl
+  | Betree_List_Nil -> Return bindings
+  end
+
+(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: forward function
+    Source: 'src/betree.rs', lines 410:4-415:26 *)
+let rec betree_Internal_flush
+  (self : betree_Internal_t) (params : betree_Params_t)
+  (node_id_cnt : betree_NodeIdCounter_t)
+  (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
+  Tot (result (state & (betree_List_t (u64 & betree_Message_t))))
+  (decreases (
+    betree_Internal_flush_decreases self params node_id_cnt content st))
+  =
+  let* p =
+    betree_ListTupleU64T_partition_at_pivot betree_Message_t content self.pivot
+    in
+  let (msgs_left, msgs_right) = p in
+  let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
+  if len_left >= params.min_flush_size
+  then
+    let* (st1, _) =
+      betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
+    let* (_, node_id_cnt1) =
+      betree_Node_apply_messages_back self.left params node_id_cnt msgs_left st
+      in
+    let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
+    if len_right >= params.min_flush_size
+    then
+      let* (st2, _) =
+        betree_Node_apply_messages self.right params node_id_cnt1 msgs_right
+          st1 in
+      let* _ =
+        betree_Node_apply_messages_back self.right params node_id_cnt1
+          msgs_right st1 in
+      Return (st2, Betree_List_Nil)
+    else Return (st1, msgs_right)
+  else
+    let* (st1, _) =
+      betree_Node_apply_messages self.right params node_id_cnt msgs_right st in
+    let* _ =
+      betree_Node_apply_messages_back self.right params node_id_cnt msgs_right
+        st in
+    Return (st1, msgs_left)
+
+(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: backward function 0
+    Source: 'src/betree.rs', lines 410:4-415:26 *)
+and betree_Internal_flush_back
+  (self : betree_Internal_t) (params : betree_Params_t)
+  (node_id_cnt : betree_NodeIdCounter_t)
+  (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
+  Tot (result (betree_Internal_t & betree_NodeIdCounter_t))
+  (decreases (
+    betree_Internal_flush_decreases self params node_id_cnt content st))
+  =
+  let* p =
+    betree_ListTupleU64T_partition_at_pivot betree_Message_t content self.pivot
+    in
+  let (msgs_left, msgs_right) = p in
+  let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
+  if len_left >= params.min_flush_size
+  then
+    let* (st1, _) =
+      betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
+    let* (n, node_id_cnt1) =
+      betree_Node_apply_messages_back self.left params node_id_cnt msgs_left st
+      in
+    let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
+    if len_right >= params.min_flush_size
+    then
+      let* (n1, node_id_cnt2) =
+        betree_Node_apply_messages_back self.right params node_id_cnt1
+          msgs_right st1 in
+      Return ({ self with left = n; right = n1 }, node_id_cnt2)
+    else Return ({ self with left = n }, node_id_cnt1)
+  else
+    let* (n, node_id_cnt1) =
+      betree_Node_apply_messages_back self.right params node_id_cnt msgs_right
+        st in
+    Return ({ self with right = n }, node_id_cnt1)
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: forward function
+    Source: 'src/betree.rs', lines 588:4-593:5 *)
+and betree_Node_apply_messages
+  (self : betree_Node_t) (params : betree_Params_t)
+  (node_id_cnt : betree_NodeIdCounter_t)
+  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) :
+  Tot (result (state & unit))
+  (decreases (
+    betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
+  =
+  begin match self with
+  | Betree_Node_Internal node ->
+    let* (st1, content) = betree_load_internal_node node.id st in
+    let* content1 = betree_Node_apply_messages_to_internal content msgs in
+    let* num_msgs = betree_List_len (u64 & betree_Message_t) content1 in
+    if num_msgs >= params.min_flush_size
+    then
+      let* (st2, content2) =
+        betree_Internal_flush node params node_id_cnt content1 st1 in
+      let* (node1, _) =
+        betree_Internal_flush_back node params node_id_cnt content1 st1 in
+      let* (st3, _) = betree_store_internal_node node1.id content2 st2 in
+      Return (st3, ())
+    else
+      let* (st2, _) = betree_store_internal_node node.id content1 st1 in
+      Return (st2, ())
+  | Betree_Node_Leaf node ->
+    let* (st1, content) = betree_load_leaf_node node.id st in
+    let* content1 = betree_Node_apply_messages_to_leaf content msgs in
+    let* len = betree_List_len (u64 & u64) content1 in
+    let* i = u64_mul 2 params.split_size in
+    if len >= i
+    then
+      let* (st2, _) = betree_Leaf_split node content1 params node_id_cnt st1 in
+      let* (st3, _) = betree_store_leaf_node node.id Betree_List_Nil st2 in
+      Return (st3, ())
+    else
+      let* (st2, _) = betree_store_leaf_node node.id content1 st1 in
+      Return (st2, ())
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: backward function 0
+    Source: 'src/betree.rs', lines 588:4-593:5 *)
+and betree_Node_apply_messages_back
+  (self : betree_Node_t) (params : betree_Params_t)
+  (node_id_cnt : betree_NodeIdCounter_t)
+  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) :
+  Tot (result (betree_Node_t & betree_NodeIdCounter_t))
+  (decreases (
+    betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
+  =
+  begin match self with
+  | Betree_Node_Internal node ->
+    let* (st1, content) = betree_load_internal_node node.id st in
+    let* content1 = betree_Node_apply_messages_to_internal content msgs in
+    let* num_msgs = betree_List_len (u64 & betree_Message_t) content1 in
+    if num_msgs >= params.min_flush_size
+    then
+      let* (st2, content2) =
+        betree_Internal_flush node params node_id_cnt content1 st1 in
+      let* (node1, node_id_cnt1) =
+        betree_Internal_flush_back node params node_id_cnt content1 st1 in
+      let* _ = betree_store_internal_node node1.id content2 st2 in
+      Return (Betree_Node_Internal node1, node_id_cnt1)
+    else
+      let* _ = betree_store_internal_node node.id content1 st1 in
+      Return (Betree_Node_Internal node, node_id_cnt)
+  | Betree_Node_Leaf node ->
+    let* (st1, content) = betree_load_leaf_node node.id st in
+    let* content1 = betree_Node_apply_messages_to_leaf content msgs in
+    let* len = betree_List_len (u64 & u64) content1 in
+    let* i = u64_mul 2 params.split_size in
+    if len >= i
+    then
+      let* (st2, new_node) =
+        betree_Leaf_split node content1 params node_id_cnt st1 in
+      let* _ = betree_store_leaf_node node.id Betree_List_Nil st2 in
+      let* node_id_cnt1 =
+        betree_Leaf_split_back node content1 params node_id_cnt st1 in
+      Return (Betree_Node_Internal new_node, node_id_cnt1)
+    else
+      let* _ = betree_store_leaf_node node.id content1 st1 in
+      Return (Betree_Node_Leaf { node with size = len }, node_id_cnt)
+  end
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: forward function
+    Source: 'src/betree.rs', lines 576:4-582:5 *)
+let betree_Node_apply
+  (self : betree_Node_t) (params : betree_Params_t)
+  (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
+  (new_msg : betree_Message_t) (st : state) :
+  result (state & unit)
+  =
+  let l = Betree_List_Nil in
+  let* (st1, _) =
+    betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
+      new_msg) l) st in
+  let* _ =
+    betree_Node_apply_messages_back self params node_id_cnt (Betree_List_Cons
+      (key, new_msg) l) st in
+  Return (st1, ())
+
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 0
+    Source: 'src/betree.rs', lines 576:4-582:5 *)
+let betree_Node_apply_back
+  (self : betree_Node_t) (params : betree_Params_t)
+  (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
+  (new_msg : betree_Message_t) (st : state) :
+  result (betree_Node_t & betree_NodeIdCounter_t)
+  =
+  let l = Betree_List_Nil in
+  betree_Node_apply_messages_back self params node_id_cnt (Betree_List_Cons
+    (key, new_msg) l) st
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]: forward function
+    Source: 'src/betree.rs', lines 849:4-849:60 *)
+let betree_BeTree_new
+  (min_flush_size : u64) (split_size : u64) (st : state) :
+  result (state & betree_BeTree_t)
+  =
+  let* node_id_cnt = betree_NodeIdCounter_new in
+  let* id = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* (st1, _) = betree_store_leaf_node id Betree_List_Nil st in
+  let* node_id_cnt1 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
+  Return (st1,
+    {
+      params = { min_flush_size = min_flush_size; split_size = split_size };
+      node_id_cnt = node_id_cnt1;
+      root = (Betree_Node_Leaf { id = id; size = 0 })
+    })
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: forward function
+    Source: 'src/betree.rs', lines 868:4-868:47 *)
+let betree_BeTree_apply
+  (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t) (st : state) :
+  result (state & unit)
+  =
+  let* (st1, _) =
+    betree_Node_apply self.root self.params self.node_id_cnt key msg st in
+  let* _ =
+    betree_Node_apply_back self.root self.params self.node_id_cnt key msg st in
+  Return (st1, ())
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: backward function 0
+    Source: 'src/betree.rs', lines 868:4-868:47 *)
+let betree_BeTree_apply_back
+  (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t) (st : state) :
+  result betree_BeTree_t
+  =
+  let* (n, nic) =
+    betree_Node_apply_back self.root self.params self.node_id_cnt key msg st in
+  Return { self with node_id_cnt = nic; root = n }
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: forward function
+    Source: 'src/betree.rs', lines 874:4-874:52 *)
+let betree_BeTree_insert
+  (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
+  result (state & unit)
+  =
+  let* (st1, _) = betree_BeTree_apply self key (Betree_Message_Insert value) st
+    in
+  let* _ = betree_BeTree_apply_back self key (Betree_Message_Insert value) st
+    in
+  Return (st1, ())
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: backward function 0
+    Source: 'src/betree.rs', lines 874:4-874:52 *)
+let betree_BeTree_insert_back
+  (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
+  result betree_BeTree_t
+  =
+  betree_BeTree_apply_back self key (Betree_Message_Insert value) st
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: forward function
+    Source: 'src/betree.rs', lines 880:4-880:38 *)
+let betree_BeTree_delete
+  (self : betree_BeTree_t) (key : u64) (st : state) : result (state & unit) =
+  let* (st1, _) = betree_BeTree_apply self key Betree_Message_Delete st in
+  let* _ = betree_BeTree_apply_back self key Betree_Message_Delete st in
+  Return (st1, ())
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: backward function 0
+    Source: 'src/betree.rs', lines 880:4-880:38 *)
+let betree_BeTree_delete_back
+  (self : betree_BeTree_t) (key : u64) (st : state) : result betree_BeTree_t =
+  betree_BeTree_apply_back self key Betree_Message_Delete st
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: forward function
+    Source: 'src/betree.rs', lines 886:4-886:59 *)
+let betree_BeTree_upsert
+  (self : betree_BeTree_t) (key : u64) (upd : betree_UpsertFunState_t)
+  (st : state) :
+  result (state & unit)
+  =
+  let* (st1, _) = betree_BeTree_apply self key (Betree_Message_Upsert upd) st
+    in
+  let* _ = betree_BeTree_apply_back self key (Betree_Message_Upsert upd) st in
+  Return (st1, ())
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: backward function 0
+    Source: 'src/betree.rs', lines 886:4-886:59 *)
+let betree_BeTree_upsert_back
+  (self : betree_BeTree_t) (key : u64) (upd : betree_UpsertFunState_t)
+  (st : state) :
+  result betree_BeTree_t
+  =
+  betree_BeTree_apply_back self key (Betree_Message_Upsert upd) st
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: forward function
+    Source: 'src/betree.rs', lines 895:4-895:62 *)
+let betree_BeTree_lookup
+  (self : betree_BeTree_t) (key : u64) (st : state) :
+  result (state & (option u64))
+  =
+  betree_Node_lookup self.root key st
+
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: backward function 0
+    Source: 'src/betree.rs', lines 895:4-895:62 *)
+let betree_BeTree_lookup_back
+  (self : betree_BeTree_t) (key : u64) (st : state) : result betree_BeTree_t =
+  let* n = betree_Node_lookup_back self.root key st in
+  Return { self with root = n }
+
+(** [betree_main::main]: forward function
+    Source: 'src/betree_main.rs', lines 5:0-5:9 *)
+let main : result unit =
+  Return ()
+
+(** Unit test for [betree_main::main] *)
+let _ = assert_norm (main = Return ())
+
diff --git a/tests/fstar-split/betree/BetreeMain.FunsExternal.fsti b/tests/fstar-split/betree/BetreeMain.FunsExternal.fsti
new file mode 100644
index 00000000..cd2f956f
--- /dev/null
+++ b/tests/fstar-split/betree/BetreeMain.FunsExternal.fsti
@@ -0,0 +1,35 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [betree_main]: external function declarations *)
+module BetreeMain.FunsExternal
+open Primitives
+include BetreeMain.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [betree_main::betree_utils::load_internal_node]: forward function
+    Source: 'src/betree_utils.rs', lines 98:0-98:63 *)
+val betree_utils_load_internal_node
+  : u64 -> state -> result (state & (betree_List_t (u64 & betree_Message_t)))
+
+(** [betree_main::betree_utils::store_internal_node]: forward function
+    Source: 'src/betree_utils.rs', lines 115:0-115:71 *)
+val betree_utils_store_internal_node
+  :
+  u64 -> betree_List_t (u64 & betree_Message_t) -> state -> result (state &
+    unit)
+
+(** [betree_main::betree_utils::load_leaf_node]: forward function
+    Source: 'src/betree_utils.rs', lines 132:0-132:55 *)
+val betree_utils_load_leaf_node
+  : u64 -> state -> result (state & (betree_List_t (u64 & u64)))
+
+(** [betree_main::betree_utils::store_leaf_node]: forward function
+    Source: 'src/betree_utils.rs', lines 145:0-145:63 *)
+val betree_utils_store_leaf_node
+  : u64 -> betree_List_t (u64 & u64) -> state -> result (state & unit)
+
+(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
+val core_option_Option_unwrap
+  (t : Type0) : option t -> state -> result (state & t)
+
diff --git a/tests/fstar-split/betree/BetreeMain.Types.fst b/tests/fstar-split/betree/BetreeMain.Types.fst
new file mode 100644
index 00000000..b87219b2
--- /dev/null
+++ b/tests/fstar-split/betree/BetreeMain.Types.fst
@@ -0,0 +1,61 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [betree_main]: type definitions *)
+module BetreeMain.Types
+open Primitives
+include BetreeMain.TypesExternal
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [betree_main::betree::List]
+    Source: 'src/betree.rs', lines 17:0-17:23 *)
+type betree_List_t (t : Type0) =
+| Betree_List_Cons : t -> betree_List_t t -> betree_List_t t
+| Betree_List_Nil : betree_List_t t
+
+(** [betree_main::betree::UpsertFunState]
+    Source: 'src/betree.rs', lines 63:0-63:23 *)
+type betree_UpsertFunState_t =
+| Betree_UpsertFunState_Add : u64 -> betree_UpsertFunState_t
+| Betree_UpsertFunState_Sub : u64 -> betree_UpsertFunState_t
+
+(** [betree_main::betree::Message]
+    Source: 'src/betree.rs', lines 69:0-69:23 *)
+type betree_Message_t =
+| Betree_Message_Insert : u64 -> betree_Message_t
+| Betree_Message_Delete : betree_Message_t
+| Betree_Message_Upsert : betree_UpsertFunState_t -> betree_Message_t
+
+(** [betree_main::betree::Leaf]
+    Source: 'src/betree.rs', lines 167:0-167:11 *)
+type betree_Leaf_t = { id : u64; size : u64; }
+
+(** [betree_main::betree::Internal]
+    Source: 'src/betree.rs', lines 156:0-156:15 *)
+type betree_Internal_t =
+{
+  id : u64; pivot : u64; left : betree_Node_t; right : betree_Node_t;
+}
+
+(** [betree_main::betree::Node]
+    Source: 'src/betree.rs', lines 179:0-179:9 *)
+and betree_Node_t =
+| Betree_Node_Internal : betree_Internal_t -> betree_Node_t
+| Betree_Node_Leaf : betree_Leaf_t -> betree_Node_t
+
+(** [betree_main::betree::Params]
+    Source: 'src/betree.rs', lines 187:0-187:13 *)
+type betree_Params_t = { min_flush_size : u64; split_size : u64; }
+
+(** [betree_main::betree::NodeIdCounter]
+    Source: 'src/betree.rs', lines 201:0-201:20 *)
+type betree_NodeIdCounter_t = { next_node_id : u64; }
+
+(** [betree_main::betree::BeTree]
+    Source: 'src/betree.rs', lines 218:0-218:17 *)
+type betree_BeTree_t =
+{
+  params : betree_Params_t;
+  node_id_cnt : betree_NodeIdCounter_t;
+  root : betree_Node_t;
+}
+
diff --git a/tests/fstar-split/betree/BetreeMain.TypesExternal.fsti b/tests/fstar-split/betree/BetreeMain.TypesExternal.fsti
new file mode 100644
index 00000000..1b2c53a6
--- /dev/null
+++ b/tests/fstar-split/betree/BetreeMain.TypesExternal.fsti
@@ -0,0 +1,10 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [betree_main]: external type declarations *)
+module BetreeMain.TypesExternal
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** The state type used in the state-error monad *)
+val state : Type0
+
diff --git a/tests/fstar-split/betree/Makefile b/tests/fstar-split/betree/Makefile
new file mode 100644
index 00000000..fa7d1f36
--- /dev/null
+++ b/tests/fstar-split/betree/Makefile
@@ -0,0 +1,49 @@
+# This file was automatically generated - modify ../Makefile.template instead
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/betree/Primitives.fst b/tests/fstar-split/betree/Primitives.fst
new file mode 100644
index 00000000..a3ffbde4
--- /dev/null
+++ b/tests/fstar-split/betree/Primitives.fst
@@ -0,0 +1,884 @@
+/// This file lists primitive and assumed functions and types
+module Primitives
+open FStar.Mul
+open FStar.List.Tot
+
+#set-options "--z3rlimit 15 --fuel 0 --ifuel 1"
+
+(*** Utilities *)
+val list_update (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a) :
+  ls':list a{
+    length ls' = length ls /\
+    index ls' i == x
+  }
+#push-options "--fuel 1"
+let rec list_update #a ls i x =
+  match ls with
+  | x' :: ls -> if i = 0 then x :: ls else x' :: list_update ls (i-1) x
+#pop-options
+
+(*** Result *)
+type error : Type0 =
+| Failure
+| OutOfFuel
+
+type result (a : Type0) : Type0 =
+| Return : v:a -> result a
+| Fail : e:error -> result a
+
+// Monadic return operator
+unfold let return (#a : Type0) (x : a) : result a = Return x
+
+// Monadic bind operator.
+// Allows to use the notation:
+// ```
+// let* x = y in
+// ...
+// ```
+unfold let (let*) (#a #b : Type0) (m: result a)
+  (f: (x:a) -> Pure (result b) (requires (m == Return x)) (ensures fun _ -> True)) :
+  result b =
+  match m with
+  | Return x -> f x
+  | Fail e   -> Fail e
+
+// Monadic assert(...)
+let massert (b:bool) : result unit = if b then Return () else Fail Failure
+
+// Normalize and unwrap a successful result (used for globals).
+let eval_global (#a : Type0) (x : result a{Return? (normalize_term x)}) : a = Return?.v x
+
+(*** Misc *)
+type char = FStar.Char.char
+type string = string
+
+let is_zero (n: nat) : bool = n = 0
+let decrease (n: nat{n > 0}) : nat = n - 1
+
+let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
+let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+
+// We don't really use raw pointers for now
+type mut_raw_ptr (t : Type0) = { v : t }
+type const_raw_ptr (t : Type0) = { v : t }
+
+(*** Scalars *)
+/// Rem.: most of the following code was partially generated
+
+assume val size_numbits : pos
+
+// TODO: we could use FStar.Int.int_t and FStar.UInt.int_t
+
+let isize_min : int = -9223372036854775808 // TODO: should be opaque
+let isize_max : int = 9223372036854775807 // TODO: should be opaque
+let i8_min : int = -128
+let i8_max : int = 127
+let i16_min : int = -32768
+let i16_max : int = 32767
+let i32_min : int = -2147483648
+let i32_max : int = 2147483647
+let i64_min : int = -9223372036854775808
+let i64_max : int = 9223372036854775807
+let i128_min : int = -170141183460469231731687303715884105728
+let i128_max : int = 170141183460469231731687303715884105727
+let usize_min : int = 0
+let usize_max : int = 4294967295 // TODO: should be opaque
+let u8_min : int = 0
+let u8_max : int = 255
+let u16_min : int = 0
+let u16_max : int = 65535
+let u32_min : int = 0
+let u32_max : int = 4294967295
+let u64_min : int = 0
+let u64_max : int = 18446744073709551615
+let u128_min : int = 0
+let u128_max : int = 340282366920938463463374607431768211455
+
+type scalar_ty =
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+let is_unsigned = function
+  | Isize | I8 | I16 | I32 | I64 | I128 -> false
+  | Usize | U8 | U16 | U32 | U64 | U128 -> true
+
+let scalar_min (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_min
+  | I8 -> i8_min
+  | I16 -> i16_min
+  | I32 -> i32_min
+  | I64 -> i64_min
+  | I128 -> i128_min
+  | Usize -> usize_min
+  | U8 -> u8_min
+  | U16 -> u16_min
+  | U32 -> u32_min
+  | U64 -> u64_min
+  | U128 -> u128_min
+
+let scalar_max (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_max
+  | I8 -> i8_max
+  | I16 -> i16_max
+  | I32 -> i32_max
+  | I64 -> i64_max
+  | I128 -> i128_max
+  | Usize -> usize_max
+  | U8 -> u8_max
+  | U16 -> u16_max
+  | U32 -> u32_max
+  | U64 -> u64_max
+  | U128 -> u128_max
+
+type scalar (ty : scalar_ty) : eqtype = x:int{scalar_min ty <= x && x <= scalar_max ty}
+
+let mk_scalar (ty : scalar_ty) (x : int) : result (scalar ty) =
+  if scalar_min ty <= x && scalar_max ty >= x then Return x else Fail Failure
+
+let scalar_neg (#ty : scalar_ty) (x : scalar ty) : result (scalar ty) = mk_scalar ty (-x)
+
+let scalar_div (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (x / y) else Fail Failure
+
+/// The remainder operation
+let int_rem (x : int) (y : int{y <> 0}) : int =
+  if x >= 0 then (x % y) else -(x % y)
+
+(* Checking consistency with Rust *)
+let _ = assert_norm(int_rem 1 2 = 1)
+let _ = assert_norm(int_rem (-1) 2 = -1)
+let _ = assert_norm(int_rem 1 (-2) = 1)
+let _ = assert_norm(int_rem (-1) (-2) = -1)
+
+let scalar_rem (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (int_rem x y) else Fail Failure
+
+let scalar_add (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x + y)
+
+let scalar_sub (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x - y)
+
+let scalar_mul (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x * y)
+
+let scalar_xor (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logxor #8 x y
+  | U16 -> FStar.UInt.logxor #16 x y
+  | U32 -> FStar.UInt.logxor #32 x y
+  | U64 -> FStar.UInt.logxor #64 x y
+  | U128 -> FStar.UInt.logxor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logxor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logxor #16 x y
+  | I32 -> FStar.Int.logxor #32 x y
+  | I64 -> FStar.Int.logxor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logxor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_or (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logor #8 x y
+  | U16 -> FStar.UInt.logor #16 x y
+  | U32 -> FStar.UInt.logor #32 x y
+  | U64 -> FStar.UInt.logor #64 x y
+  | U128 -> FStar.UInt.logor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logor #16 x y
+  | I32 -> FStar.Int.logor #32 x y
+  | I64 -> FStar.Int.logor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_and (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logand #8 x y
+  | U16 -> FStar.UInt.logand #16 x y
+  | U32 -> FStar.UInt.logand #32 x y
+  | U64 -> FStar.UInt.logand #64 x y
+  | U128 -> FStar.UInt.logand #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logand #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logand #16 x y
+  | I32 -> FStar.Int.logand #32 x y
+  | I64 -> FStar.Int.logand #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logand #128 x y
+  | Isize -> admit() // TODO
+
+// Shift left
+let scalar_shl (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+// Shift right
+let scalar_shr (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+(** Cast an integer from a [src_ty] to a [tgt_ty] *)
+// TODO: check the semantics of casts in Rust
+let scalar_cast (src_ty : scalar_ty) (tgt_ty : scalar_ty) (x : scalar src_ty) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty x
+
+// This can't fail, but for now we make all casts faillible (easier for the translation)
+let scalar_cast_bool (tgt_ty : scalar_ty) (x : bool) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty (if x then 1 else 0)
+
+/// The scalar types
+type isize : eqtype = scalar Isize
+type i8    : eqtype = scalar I8
+type i16   : eqtype = scalar I16
+type i32   : eqtype = scalar I32
+type i64   : eqtype = scalar I64
+type i128  : eqtype = scalar I128
+type usize : eqtype = scalar Usize
+type u8    : eqtype = scalar U8
+type u16   : eqtype = scalar U16
+type u32   : eqtype = scalar U32
+type u64   : eqtype = scalar U64
+type u128  : eqtype = scalar U128
+
+
+let core_isize_min : isize = isize_min
+let core_isize_max : isize = isize_max
+let core_i8_min    : i8 = i8_min
+let core_i8_max    : i8 = i8_max
+let core_i16_min   : i16 = i16_min
+let core_i16_max   : i16 = i16_max
+let core_i32_min   : i32 = i32_min
+let core_i32_max   : i32 = i32_max
+let core_i64_min   : i64 = i64_min
+let core_i64_max   : i64 = i64_max
+let core_i128_min  : i128 = i128_min
+let core_i128_max  : i128 = i128_max
+
+let core_usize_min : usize = usize_min
+let core_usize_max : usize = usize_max
+let core_u8_min    : u8 = u8_min
+let core_u8_max    : u8 = u8_max
+let core_u16_min   : u16 = u16_min
+let core_u16_max   : u16 = u16_max
+let core_u32_min   : u32 = u32_min
+let core_u32_max   : u32 = u32_max
+let core_u64_min   : u64 = u64_min
+let core_u64_max   : u64 = u64_max
+let core_u128_min  : u128 = u128_min
+let core_u128_max  : u128 = u128_max
+
+/// Negation
+let isize_neg = scalar_neg #Isize
+let i8_neg = scalar_neg #I8
+let i16_neg = scalar_neg #I16
+let i32_neg = scalar_neg #I32
+let i64_neg = scalar_neg #I64
+let i128_neg = scalar_neg #I128
+
+/// Division
+let isize_div = scalar_div #Isize
+let i8_div = scalar_div #I8
+let i16_div = scalar_div #I16
+let i32_div = scalar_div #I32
+let i64_div = scalar_div #I64
+let i128_div = scalar_div #I128
+let usize_div = scalar_div #Usize
+let u8_div = scalar_div #U8
+let u16_div = scalar_div #U16
+let u32_div = scalar_div #U32
+let u64_div = scalar_div #U64
+let u128_div = scalar_div #U128
+
+/// Remainder
+let isize_rem = scalar_rem #Isize
+let i8_rem = scalar_rem #I8
+let i16_rem = scalar_rem #I16
+let i32_rem = scalar_rem #I32
+let i64_rem = scalar_rem #I64
+let i128_rem = scalar_rem #I128
+let usize_rem = scalar_rem #Usize
+let u8_rem = scalar_rem #U8
+let u16_rem = scalar_rem #U16
+let u32_rem = scalar_rem #U32
+let u64_rem = scalar_rem #U64
+let u128_rem = scalar_rem #U128
+
+/// Addition
+let isize_add = scalar_add #Isize
+let i8_add = scalar_add #I8
+let i16_add = scalar_add #I16
+let i32_add = scalar_add #I32
+let i64_add = scalar_add #I64
+let i128_add = scalar_add #I128
+let usize_add = scalar_add #Usize
+let u8_add = scalar_add #U8
+let u16_add = scalar_add #U16
+let u32_add = scalar_add #U32
+let u64_add = scalar_add #U64
+let u128_add = scalar_add #U128
+
+/// Subtraction
+let isize_sub = scalar_sub #Isize
+let i8_sub = scalar_sub #I8
+let i16_sub = scalar_sub #I16
+let i32_sub = scalar_sub #I32
+let i64_sub = scalar_sub #I64
+let i128_sub = scalar_sub #I128
+let usize_sub = scalar_sub #Usize
+let u8_sub = scalar_sub #U8
+let u16_sub = scalar_sub #U16
+let u32_sub = scalar_sub #U32
+let u64_sub = scalar_sub #U64
+let u128_sub = scalar_sub #U128
+
+/// Multiplication
+let isize_mul = scalar_mul #Isize
+let i8_mul = scalar_mul #I8
+let i16_mul = scalar_mul #I16
+let i32_mul = scalar_mul #I32
+let i64_mul = scalar_mul #I64
+let i128_mul = scalar_mul #I128
+let usize_mul = scalar_mul #Usize
+let u8_mul = scalar_mul #U8
+let u16_mul = scalar_mul #U16
+let u32_mul = scalar_mul #U32
+let u64_mul = scalar_mul #U64
+let u128_mul = scalar_mul #U128
+
+/// Xor
+let u8_xor = scalar_xor #U8
+let u16_xor = scalar_xor #U16
+let u32_xor = scalar_xor #U32
+let u64_xor = scalar_xor #U64
+let u128_xor = scalar_xor #U128
+let usize_xor = scalar_xor #Usize
+let i8_xor = scalar_xor #I8
+let i16_xor = scalar_xor #I16
+let i32_xor = scalar_xor #I32
+let i64_xor = scalar_xor #I64
+let i128_xor = scalar_xor #I128
+let isize_xor = scalar_xor #Isize
+
+/// Or
+let u8_or = scalar_or #U8
+let u16_or = scalar_or #U16
+let u32_or = scalar_or #U32
+let u64_or = scalar_or #U64
+let u128_or = scalar_or #U128
+let usize_or = scalar_or #Usize
+let i8_or = scalar_or #I8
+let i16_or = scalar_or #I16
+let i32_or = scalar_or #I32
+let i64_or = scalar_or #I64
+let i128_or = scalar_or #I128
+let isize_or = scalar_or #Isize
+
+/// And
+let u8_and = scalar_and #U8
+let u16_and = scalar_and #U16
+let u32_and = scalar_and #U32
+let u64_and = scalar_and #U64
+let u128_and = scalar_and #U128
+let usize_and = scalar_and #Usize
+let i8_and = scalar_and #I8
+let i16_and = scalar_and #I16
+let i32_and = scalar_and #I32
+let i64_and = scalar_and #I64
+let i128_and = scalar_and #I128
+let isize_and = scalar_and #Isize
+
+/// Shift left
+let u8_shl #ty = scalar_shl #U8 #ty
+let u16_shl #ty = scalar_shl #U16 #ty
+let u32_shl #ty = scalar_shl #U32 #ty
+let u64_shl #ty = scalar_shl #U64 #ty
+let u128_shl #ty = scalar_shl #U128 #ty
+let usize_shl #ty = scalar_shl #Usize #ty
+let i8_shl #ty = scalar_shl #I8 #ty
+let i16_shl #ty = scalar_shl #I16 #ty
+let i32_shl #ty = scalar_shl #I32 #ty
+let i64_shl #ty = scalar_shl #I64 #ty
+let i128_shl #ty = scalar_shl #I128 #ty
+let isize_shl #ty = scalar_shl #Isize #ty
+
+/// Shift right
+let u8_shr #ty = scalar_shr #U8 #ty
+let u16_shr #ty = scalar_shr #U16 #ty
+let u32_shr #ty = scalar_shr #U32 #ty
+let u64_shr #ty = scalar_shr #U64 #ty
+let u128_shr #ty = scalar_shr #U128 #ty
+let usize_shr #ty = scalar_shr #Usize #ty
+let i8_shr #ty = scalar_shr #I8 #ty
+let i16_shr #ty = scalar_shr #I16 #ty
+let i32_shr #ty = scalar_shr #I32 #ty
+let i64_shr #ty = scalar_shr #I64 #ty
+let i128_shr #ty = scalar_shr #I128 #ty
+let isize_shr #ty = scalar_shr #Isize #ty
+
+(*** core::ops *)
+
+// Trait declaration: [core::ops::index::Index]
+noeq type core_ops_index_Index (self idx : Type0) = {
+  output : Type0;
+  index : self → idx → result output
+}
+
+// Trait declaration: [core::ops::index::IndexMut]
+noeq type core_ops_index_IndexMut (self idx : Type0) = {
+  indexInst : core_ops_index_Index self idx;
+  index_mut : self → idx → result indexInst.output;
+  index_mut_back : self → idx → indexInst.output → result self;
+}
+
+// Trait declaration [core::ops::deref::Deref]
+noeq type core_ops_deref_Deref (self : Type0) = {
+  target : Type0;
+  deref : self → result target;
+}
+
+// Trait declaration [core::ops::deref::DerefMut]
+noeq type core_ops_deref_DerefMut (self : Type0) = {
+  derefInst : core_ops_deref_Deref self;
+  deref_mut : self → result derefInst.target;
+  deref_mut_back : self → derefInst.target → result self;
+}
+
+type core_ops_range_Range (a : Type0) = {
+  start : a;
+  end_ : a;
+}
+
+(*** [alloc] *)
+
+let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
+  target = self;
+  deref = alloc_boxed_Box_deref self;
+}
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
+  derefInst = alloc_boxed_Box_coreopsDerefInst self;
+  deref_mut = alloc_boxed_Box_deref_mut self;
+  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
+}
+
+(*** Array *)
+type array (a : Type0) (n : usize) = s:list a{length s = n}
+
+// We tried putting the normalize_term condition as a refinement on the list
+// but it didn't work. It works with the requires clause.
+let mk_array (a : Type0) (n : usize)
+  (l : list a) :
+  Pure (array a n)
+  (requires (normalize_term(FStar.List.Tot.length l) = n))
+  (ensures (fun _ -> True)) =
+  normalize_term_spec (FStar.List.Tot.length l);
+  l
+
+let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Slice *)
+type slice (a : Type0) = s:list a{length s <= usize_max}
+
+let slice_len (a : Type0) (s : slice a) : usize = length s
+
+let slice_index_usize (a : Type0) (x : slice a) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (slice a) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Subslices *)
+
+let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
+let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : result (array a n) =
+  if length s = n then Return s
+  else Fail Failure
+
+// TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
+let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let array_update_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) (ns : slice a) : result (array a n) =
+  admit()
+
+let array_repeat (a : Type0) (n : usize) (x : a) : array a n =
+  admit()
+
+let slice_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let slice_update_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) (ns : slice a) : result (slice a) =
+  admit()
+
+(*** Vector *)
+type alloc_vec_Vec (a : Type0) = v:list a{length v <= usize_max}
+
+let alloc_vec_Vec_new (a  : Type0) : alloc_vec_Vec a = assert_norm(length #a [] == 0); []
+let alloc_vec_Vec_len (a : Type0) (v : alloc_vec_Vec a) : usize = length v
+
+// Helper
+let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : result a =
+  if i < length v then Return (index v i) else Fail Failure
+// Helper
+let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
+  Pure (result (alloc_vec_Vec a))
+  (requires True)
+  (ensures (fun res ->
+    match res with
+    | Fail e -> e == Failure
+    | Return v' -> length v' = length v + 1)) =
+  if length v < usize_max then begin
+    (**) assert_norm(length [x] == 1);
+    (**) append_length v [x];
+    (**) assert(length (append v [x]) = length v + 1);
+    Return (append v [x])
+    end
+  else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
+  if i < length v then Return () else Fail Failure
+let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// Trait declaration: [core::slice::index::private_slice_index::Sealed]
+type core_slice_index_private_slice_index_Sealed (self : Type0) = unit
+
+// Trait declaration: [core::slice::index::SliceIndex]
+noeq type core_slice_index_SliceIndex (self t : Type0) = {
+  sealedInst : core_slice_index_private_slice_index_Sealed self;
+  output : Type0;
+  get : self → t → result (option output);
+  get_mut : self → t → result (option output);
+  get_mut_back : self → t → option output → result t;
+  get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
+  get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
+  index : self → t → result output;
+  index_mut : self → t → result output;
+  index_mut_back : self → t → output → result t;
+}
+
+// [core::slice::index::[T]::index]: forward function
+let core_slice_index_Slice_index
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (s : slice t) (i : idx) : result inst.output =
+  let* x = inst.get i s in
+  match x with
+  | None -> Fail Failure
+  | Some x -> Return x
+
+// [core::slice::index::Range:::get]: forward function
+let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize) (s : slice t) :
+  result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: forward function
+let core_slice_index_RangeUsize_get_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: backward function 0
+let core_slice_index_RangeUsize_get_mut_back
+  (t : Type0) :
+  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_unchecked]: forward function
+let core_slice_index_RangeUsize_get_unchecked
+  (t : Type0) :
+  core_ops_range_Range usize → const_raw_ptr (slice t) → result (const_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::get_unchecked_mut]: forward function
+let core_slice_index_RangeUsize_get_unchecked_mut
+  (t : Type0) :
+  core_ops_range_Range usize → mut_raw_ptr (slice t) → result (mut_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::index]: forward function
+let core_slice_index_RangeUsize_index
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: forward function
+let core_slice_index_RangeUsize_index_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: backward function 0
+let core_slice_index_RangeUsize_index_mut_back
+  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::[T]::index_mut]: forward function
+let core_slice_index_Slice_index_mut
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → result inst.output =
+  admit () // 
+
+// [core::slice::index::[T]::index_mut]: backward function 0
+let core_slice_index_Slice_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → inst.output → result (slice t) =
+  admit () // TODO
+
+// [core::array::[T; N]::index]: forward function
+let core_array_Array_index
+  (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
+  (a : array t n) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: forward function
+let core_array_Array_index_mut
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) : result inst.indexInst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: backward function 0
+let core_array_Array_index_mut_back
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::Range]
+let core_slice_index_private_slice_index_SealedRangeUsizeInst
+  : core_slice_index_private_slice_index_Sealed (core_ops_range_Range usize) = ()
+
+// Trait implementation: [core::slice::index::Range]
+let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex (core_ops_range_Range usize) (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedRangeUsizeInst;
+  output = slice t;
+  get = core_slice_index_RangeUsize_get t;
+  get_mut = core_slice_index_RangeUsize_get_mut t;
+  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
+  get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
+  index = core_slice_index_RangeUsize_index t;
+  index_mut = core_slice_index_RangeUsize_index_mut t;
+  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (slice t) idx = {
+  output = inst.output;
+  index = core_slice_index_Slice_index t idx inst;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (slice t) idx = {
+  indexInst = core_ops_index_IndexSliceTIInst t idx inst;
+  index_mut = core_slice_index_Slice_index_mut t idx inst;
+  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexArrayInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_Index (slice t) idx) :
+  core_ops_index_Index (array t n) idx = {
+  output = inst.output;
+  index = core_array_Array_index t idx n inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_IndexMut (slice t) idx) :
+  core_ops_index_IndexMut (array t n) idx = {
+  indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
+  index_mut = core_array_Array_index_mut t idx n inst;
+  index_mut_back = core_array_Array_index_mut_back t idx n inst;
+}
+
+// [core::slice::index::usize::get]: forward function
+let core_slice_index_usize_get
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: forward function
+let core_slice_index_usize_get_mut
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: backward function 0
+let core_slice_index_usize_get_mut_back
+  (t : Type0) : usize → slice t → option t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked]: forward function
+let core_slice_index_usize_get_unchecked
+  (t : Type0) : usize → const_raw_ptr (slice t) → result (const_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked_mut]: forward function
+let core_slice_index_usize_get_unchecked_mut
+  (t : Type0) : usize → mut_raw_ptr (slice t) → result (mut_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::index]: forward function
+let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: forward function
+let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: backward function 0
+let core_slice_index_usize_index_mut_back
+  (t : Type0) : usize → slice t → t → result (slice t) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::usize]
+let core_slice_index_private_slice_index_SealedUsizeInst
+  : core_slice_index_private_slice_index_Sealed usize = ()
+
+// Trait implementation: [core::slice::index::usize]
+let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex usize (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedUsizeInst;
+  output = t;
+  get = core_slice_index_usize_get t;
+  get_mut = core_slice_index_usize_get_mut t;
+  get_mut_back = core_slice_index_usize_get_mut_back t;
+  get_unchecked = core_slice_index_usize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
+  index = core_slice_index_usize_index t;
+  index_mut = core_slice_index_usize_index_mut t;
+  index_mut_back = core_slice_index_usize_index_mut_back t;
+}
+
+// [alloc::vec::Vec::index]: forward function
+let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: forward function
+let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: backward function 0
+let alloc_vec_Vec_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  admit () // TODO
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (alloc_vec_Vec t) idx = {
+  output = inst.output;
+  index = alloc_vec_Vec_index t idx inst;
+}
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
+  indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
+  index_mut = alloc_vec_Vec_index_mut t idx inst;
+  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
+}
+
+(*** Theorems *)
+
+let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
+  Lemma (
+    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
+      alloc_vec_Vec_update_usize v i x)
+  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
+  =
+  admit()
diff --git a/tests/fstar-split/hashmap/Hashmap.Clauses.Template.fst b/tests/fstar-split/hashmap/Hashmap.Clauses.Template.fst
new file mode 100644
index 00000000..2733b371
--- /dev/null
+++ b/tests/fstar-split/hashmap/Hashmap.Clauses.Template.fst
@@ -0,0 +1,71 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap]: templates for the decreases clauses *)
+module Hashmap.Clauses.Template
+open Primitives
+open Hashmap.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: decreases clause
+    Source: 'src/hashmap.rs', lines 50:4-56:5 *)
+unfold
+let hashMap_allocate_slots_loop_decreases (t : Type0)
+  (slots : alloc_vec_Vec (list_t t)) (n : usize) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::clear]: decreases clause
+    Source: 'src/hashmap.rs', lines 80:4-88:5 *)
+unfold
+let hashMap_clear_loop_decreases (t : Type0) (slots : alloc_vec_Vec (list_t t))
+  (i : usize) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
+unfold
+let hashMap_insert_in_list_loop_decreases (t : Type0) (key : usize) (value : t)
+  (ls : list_t t) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 183:4-196:5 *)
+unfold
+let hashMap_move_elements_from_list_loop_decreases (t : Type0)
+  (ntable : hashMap_t t) (ls : list_t t) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]: decreases clause
+    Source: 'src/hashmap.rs', lines 171:4-180:5 *)
+unfold
+let hashMap_move_elements_loop_decreases (t : Type0) (ntable : hashMap_t t)
+  (slots : alloc_vec_Vec (list_t t)) (i : usize) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 206:4-219:5 *)
+unfold
+let hashMap_contains_key_in_list_loop_decreases (t : Type0) (key : usize)
+  (ls : list_t t) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 224:4-237:5 *)
+unfold
+let hashMap_get_in_list_loop_decreases (t : Type0) (key : usize)
+  (ls : list_t t) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
+unfold
+let hashMap_get_mut_in_list_loop_decreases (t : Type0) (ls : list_t t)
+  (key : usize) : nat =
+  admit ()
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
+unfold
+let hashMap_remove_from_list_loop_decreases (t : Type0) (key : usize)
+  (ls : list_t t) : nat =
+  admit ()
+
diff --git a/tests/fstar-split/hashmap/Hashmap.Clauses.fst b/tests/fstar-split/hashmap/Hashmap.Clauses.fst
new file mode 100644
index 00000000..6c699d05
--- /dev/null
+++ b/tests/fstar-split/hashmap/Hashmap.Clauses.fst
@@ -0,0 +1,61 @@
+(** [hashmap]: the decreases clauses *)
+module Hashmap.Clauses
+open Primitives
+open FStar.List.Tot
+open Hashmap.Types
+
+#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
+
+(** [hashmap::HashMap::allocate_slots]: decreases clause *)
+unfold
+let hashMap_allocate_slots_loop_decreases (t : Type0)
+  (slots : alloc_vec_Vec (list_t t)) (n : usize) : nat = n
+
+(** [hashmap::HashMap::clear]: decreases clause *)
+unfold
+let hashMap_clear_loop_decreases (t : Type0) (slots : alloc_vec_Vec (list_t t))
+  (i : usize) : nat =
+  if i < length slots then length slots - i else 0
+
+(** [hashmap::HashMap::insert_in_list]: decreases clause *)
+unfold
+let hashMap_insert_in_list_loop_decreases (t : Type0) (key : usize) (value : t)
+  (ls : list_t t) : list_t t =
+  ls
+
+(** [hashmap::HashMap::move_elements_from_list]: decreases clause *)
+unfold
+let hashMap_move_elements_from_list_loop_decreases (t : Type0)
+  (ntable : hashMap_t t) (ls : list_t t) : list_t t =
+  ls
+
+(** [hashmap::HashMap::move_elements]: decreases clause *)
+unfold
+let hashMap_move_elements_loop_decreases (t : Type0) (ntable : hashMap_t t)
+  (slots : alloc_vec_Vec (list_t t)) (i : usize) : nat =
+  if i < length slots then length slots - i else 0
+
+(** [hashmap::HashMap::contains_key_in_list]: decreases clause *)
+unfold
+let hashMap_contains_key_in_list_loop_decreases (t : Type0) (key : usize)
+  (ls : list_t t) : list_t t =
+  ls
+
+(** [hashmap::HashMap::get_in_list]: decreases clause *)
+unfold
+let hashMap_get_in_list_loop_decreases (t : Type0) (key : usize) (ls : list_t t) :
+  list_t t =
+  ls
+
+(** [hashmap::HashMap::get_mut_in_list]: decreases clause *)
+unfold
+let hashMap_get_mut_in_list_loop_decreases (t : Type0) (ls : list_t t)
+  (key : usize) : list_t t =
+  ls
+
+(** [hashmap::HashMap::remove_from_list]: decreases clause *)
+unfold
+let hashMap_remove_from_list_loop_decreases (t : Type0) (key : usize)
+  (ls : list_t t) : list_t t =
+  ls
+
diff --git a/tests/fstar-split/hashmap/Hashmap.Funs.fst b/tests/fstar-split/hashmap/Hashmap.Funs.fst
new file mode 100644
index 00000000..79327183
--- /dev/null
+++ b/tests/fstar-split/hashmap/Hashmap.Funs.fst
@@ -0,0 +1,529 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap]: function definitions *)
+module Hashmap.Funs
+open Primitives
+include Hashmap.Types
+include Hashmap.Clauses
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap::hash_key]: forward function
+    Source: 'src/hashmap.rs', lines 27:0-27:32 *)
+let hash_key (k : usize) : result usize =
+  Return k
+
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 50:4-56:5 *)
+let rec hashMap_allocate_slots_loop
+  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (n : usize) :
+  Tot (result (alloc_vec_Vec (list_t t)))
+  (decreases (hashMap_allocate_slots_loop_decreases t slots n))
+  =
+  if n > 0
+  then
+    let* slots1 = alloc_vec_Vec_push (list_t t) slots List_Nil in
+    let* n1 = usize_sub n 1 in
+    hashMap_allocate_slots_loop t slots1 n1
+  else Return slots
+
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: forward function
+    Source: 'src/hashmap.rs', lines 50:4-50:76 *)
+let hashMap_allocate_slots
+  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (n : usize) :
+  result (alloc_vec_Vec (list_t t))
+  =
+  hashMap_allocate_slots_loop t slots n
+
+(** [hashmap::{hashmap::HashMap<T>}::new_with_capacity]: forward function
+    Source: 'src/hashmap.rs', lines 59:4-63:13 *)
+let hashMap_new_with_capacity
+  (t : Type0) (capacity : usize) (max_load_dividend : usize)
+  (max_load_divisor : usize) :
+  result (hashMap_t t)
+  =
+  let v = alloc_vec_Vec_new (list_t t) in
+  let* slots = hashMap_allocate_slots t v capacity in
+  let* i = usize_mul capacity max_load_dividend in
+  let* i1 = usize_div i max_load_divisor in
+  Return
+    {
+      num_entries = 0;
+      max_load_factor = (max_load_dividend, max_load_divisor);
+      max_load = i1;
+      slots = slots
+    }
+
+(** [hashmap::{hashmap::HashMap<T>}::new]: forward function
+    Source: 'src/hashmap.rs', lines 75:4-75:24 *)
+let hashMap_new (t : Type0) : result (hashMap_t t) =
+  hashMap_new_with_capacity t 32 4 5
+
+(** [hashmap::{hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 80:4-88:5 *)
+let rec hashMap_clear_loop
+  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (i : usize) :
+  Tot (result (alloc_vec_Vec (list_t t)))
+  (decreases (hashMap_clear_loop_decreases t slots i))
+  =
+  let i1 = alloc_vec_Vec_len (list_t t) slots in
+  if i < i1
+  then
+    let* i2 = usize_add i 1 in
+    let* slots1 =
+      alloc_vec_Vec_index_mut_back (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i
+        List_Nil in
+    hashMap_clear_loop t slots1 i2
+  else Return slots
+
+(** [hashmap::{hashmap::HashMap<T>}::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 80:4-80:27 *)
+let hashMap_clear (t : Type0) (self : hashMap_t t) : result (hashMap_t t) =
+  let* v = hashMap_clear_loop t self.slots 0 in
+  Return { self with num_entries = 0; slots = v }
+
+(** [hashmap::{hashmap::HashMap<T>}::len]: forward function
+    Source: 'src/hashmap.rs', lines 90:4-90:30 *)
+let hashMap_len (t : Type0) (self : hashMap_t t) : result usize =
+  Return self.num_entries
+
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
+let rec hashMap_insert_in_list_loop
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
+  Tot (result bool)
+  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+  =
+  begin match ls with
+  | List_Cons ckey _ tl ->
+    if ckey = key
+    then Return false
+    else hashMap_insert_in_list_loop t key value tl
+  | List_Nil -> Return true
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
+let hashMap_insert_in_list
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) : result bool =
+  hashMap_insert_in_list_loop t key value ls
+
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
+    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
+let rec hashMap_insert_in_list_loop_back
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
+  Tot (result (list_t t))
+  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+  =
+  begin match ls with
+  | List_Cons ckey cvalue tl ->
+    if ckey = key
+    then Return (List_Cons ckey value tl)
+    else
+      let* tl1 = hashMap_insert_in_list_loop_back t key value tl in
+      Return (List_Cons ckey cvalue tl1)
+  | List_Nil -> let l = List_Nil in Return (List_Cons key value l)
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: backward function 0
+    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
+let hashMap_insert_in_list_back
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) : result (list_t t) =
+  hashMap_insert_in_list_loop_back t key value ls
+
+(** [hashmap::{hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 117:4-117:54 *)
+let hashMap_insert_no_resize
+  (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  result (hashMap_t t)
+  =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  let* inserted = hashMap_insert_in_list t key value l in
+  if inserted
+  then
+    let* i1 = usize_add self.num_entries 1 in
+    let* l1 = hashMap_insert_in_list_back t key value l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+        hash_mod l1 in
+    Return { self with num_entries = i1; slots = v }
+  else
+    let* l1 = hashMap_insert_in_list_back t key value l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+        hash_mod l1 in
+    Return { self with slots = v }
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 183:4-196:5 *)
+let rec hashMap_move_elements_from_list_loop
+  (t : Type0) (ntable : hashMap_t t) (ls : list_t t) :
+  Tot (result (hashMap_t t))
+  (decreases (hashMap_move_elements_from_list_loop_decreases t ntable ls))
+  =
+  begin match ls with
+  | List_Cons k v tl ->
+    let* ntable1 = hashMap_insert_no_resize t ntable k v in
+    hashMap_move_elements_from_list_loop t ntable1 tl
+  | List_Nil -> Return ntable
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 183:4-183:72 *)
+let hashMap_move_elements_from_list
+  (t : Type0) (ntable : hashMap_t t) (ls : list_t t) : result (hashMap_t t) =
+  hashMap_move_elements_from_list_loop t ntable ls
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 171:4-180:5 *)
+let rec hashMap_move_elements_loop
+  (t : Type0) (ntable : hashMap_t t) (slots : alloc_vec_Vec (list_t t))
+  (i : usize) :
+  Tot (result ((hashMap_t t) & (alloc_vec_Vec (list_t t))))
+  (decreases (hashMap_move_elements_loop_decreases t ntable slots i))
+  =
+  let i1 = alloc_vec_Vec_len (list_t t) slots in
+  if i < i1
+  then
+    let* l =
+      alloc_vec_Vec_index_mut (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i in
+    let ls = core_mem_replace (list_t t) l List_Nil in
+    let* ntable1 = hashMap_move_elements_from_list t ntable ls in
+    let* i2 = usize_add i 1 in
+    let l1 = core_mem_replace_back (list_t t) l List_Nil in
+    let* slots1 =
+      alloc_vec_Vec_index_mut_back (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i l1 in
+    hashMap_move_elements_loop t ntable1 slots1 i2
+  else Return (ntable, slots)
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 171:4-171:95 *)
+let hashMap_move_elements
+  (t : Type0) (ntable : hashMap_t t) (slots : alloc_vec_Vec (list_t t))
+  (i : usize) :
+  result ((hashMap_t t) & (alloc_vec_Vec (list_t t)))
+  =
+  hashMap_move_elements_loop t ntable slots i
+
+(** [hashmap::{hashmap::HashMap<T>}::try_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 140:4-140:28 *)
+let hashMap_try_resize
+  (t : Type0) (self : hashMap_t t) : result (hashMap_t t) =
+  let* max_usize = scalar_cast U32 Usize core_u32_max in
+  let capacity = alloc_vec_Vec_len (list_t t) self.slots in
+  let* n1 = usize_div max_usize 2 in
+  let (i, i1) = self.max_load_factor in
+  let* i2 = usize_div n1 i in
+  if capacity <= i2
+  then
+    let* i3 = usize_mul capacity 2 in
+    let* ntable = hashMap_new_with_capacity t i3 i i1 in
+    let* (ntable1, _) = hashMap_move_elements t ntable self.slots 0 in
+    Return
+      { ntable1 with num_entries = self.num_entries; max_load_factor = (i, i1)
+      }
+  else Return { self with max_load_factor = (i, i1) }
+
+(** [hashmap::{hashmap::HashMap<T>}::insert]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 129:4-129:48 *)
+let hashMap_insert
+  (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  result (hashMap_t t)
+  =
+  let* self1 = hashMap_insert_no_resize t self key value in
+  let* i = hashMap_len t self1 in
+  if i > self1.max_load then hashMap_try_resize t self1 else Return self1
+
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 206:4-219:5 *)
+let rec hashMap_contains_key_in_list_loop
+  (t : Type0) (key : usize) (ls : list_t t) :
+  Tot (result bool)
+  (decreases (hashMap_contains_key_in_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | List_Cons ckey _ tl ->
+    if ckey = key
+    then Return true
+    else hashMap_contains_key_in_list_loop t key tl
+  | List_Nil -> Return false
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 206:4-206:68 *)
+let hashMap_contains_key_in_list
+  (t : Type0) (key : usize) (ls : list_t t) : result bool =
+  hashMap_contains_key_in_list_loop t key ls
+
+(** [hashmap::{hashmap::HashMap<T>}::contains_key]: forward function
+    Source: 'src/hashmap.rs', lines 199:4-199:49 *)
+let hashMap_contains_key
+  (t : Type0) (self : hashMap_t t) (key : usize) : result bool =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  hashMap_contains_key_in_list t key l
+
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 224:4-237:5 *)
+let rec hashMap_get_in_list_loop
+  (t : Type0) (key : usize) (ls : list_t t) :
+  Tot (result t) (decreases (hashMap_get_in_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | List_Cons ckey cvalue tl ->
+    if ckey = key then Return cvalue else hashMap_get_in_list_loop t key tl
+  | List_Nil -> Fail Failure
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 224:4-224:70 *)
+let hashMap_get_in_list (t : Type0) (key : usize) (ls : list_t t) : result t =
+  hashMap_get_in_list_loop t key ls
+
+(** [hashmap::{hashmap::HashMap<T>}::get]: forward function
+    Source: 'src/hashmap.rs', lines 239:4-239:55 *)
+let hashMap_get (t : Type0) (self : hashMap_t t) (key : usize) : result t =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  hashMap_get_in_list t key l
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
+let rec hashMap_get_mut_in_list_loop
+  (t : Type0) (ls : list_t t) (key : usize) :
+  Tot (result t) (decreases (hashMap_get_mut_in_list_loop_decreases t ls key))
+  =
+  begin match ls with
+  | List_Cons ckey cvalue tl ->
+    if ckey = key then Return cvalue else hashMap_get_mut_in_list_loop t tl key
+  | List_Nil -> Fail Failure
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
+let hashMap_get_mut_in_list
+  (t : Type0) (ls : list_t t) (key : usize) : result t =
+  hashMap_get_mut_in_list_loop t ls key
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
+    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
+let rec hashMap_get_mut_in_list_loop_back
+  (t : Type0) (ls : list_t t) (key : usize) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (hashMap_get_mut_in_list_loop_decreases t ls key))
+  =
+  begin match ls with
+  | List_Cons ckey cvalue tl ->
+    if ckey = key
+    then Return (List_Cons ckey ret tl)
+    else
+      let* tl1 = hashMap_get_mut_in_list_loop_back t tl key ret in
+      Return (List_Cons ckey cvalue tl1)
+  | List_Nil -> Fail Failure
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
+let hashMap_get_mut_in_list_back
+  (t : Type0) (ls : list_t t) (key : usize) (ret : t) : result (list_t t) =
+  hashMap_get_mut_in_list_loop_back t ls key ret
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut]: forward function
+    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
+let hashMap_get_mut (t : Type0) (self : hashMap_t t) (key : usize) : result t =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  hashMap_get_mut_in_list t l key
+
+(** [hashmap::{hashmap::HashMap<T>}::get_mut]: backward function 0
+    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
+let hashMap_get_mut_back
+  (t : Type0) (self : hashMap_t t) (key : usize) (ret : t) :
+  result (hashMap_t t)
+  =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  let* l1 = hashMap_get_mut_in_list_back t l key ret in
+  let* v =
+    alloc_vec_Vec_index_mut_back (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod l1 in
+  Return { self with slots = v }
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
+let rec hashMap_remove_from_list_loop
+  (t : Type0) (key : usize) (ls : list_t t) :
+  Tot (result (option t))
+  (decreases (hashMap_remove_from_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | List_Cons ckey x tl ->
+    if ckey = key
+    then
+      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
+      begin match mv_ls with
+      | List_Cons _ cvalue _ -> Return (Some cvalue)
+      | List_Nil -> Fail Failure
+      end
+    else hashMap_remove_from_list_loop t key tl
+  | List_Nil -> Return None
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: forward function
+    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
+let hashMap_remove_from_list
+  (t : Type0) (key : usize) (ls : list_t t) : result (option t) =
+  hashMap_remove_from_list_loop t key ls
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
+    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
+let rec hashMap_remove_from_list_loop_back
+  (t : Type0) (key : usize) (ls : list_t t) :
+  Tot (result (list_t t))
+  (decreases (hashMap_remove_from_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | List_Cons ckey x tl ->
+    if ckey = key
+    then
+      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
+      begin match mv_ls with
+      | List_Cons _ _ tl1 -> Return tl1
+      | List_Nil -> Fail Failure
+      end
+    else
+      let* tl1 = hashMap_remove_from_list_loop_back t key tl in
+      Return (List_Cons ckey x tl1)
+  | List_Nil -> Return List_Nil
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: backward function 1
+    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
+let hashMap_remove_from_list_back
+  (t : Type0) (key : usize) (ls : list_t t) : result (list_t t) =
+  hashMap_remove_from_list_loop_back t key ls
+
+(** [hashmap::{hashmap::HashMap<T>}::remove]: forward function
+    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
+let hashMap_remove
+  (t : Type0) (self : hashMap_t t) (key : usize) : result (option t) =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  let* x = hashMap_remove_from_list t key l in
+  begin match x with
+  | None -> Return None
+  | Some x1 -> let* _ = usize_sub self.num_entries 1 in Return (Some x1)
+  end
+
+(** [hashmap::{hashmap::HashMap<T>}::remove]: backward function 0
+    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
+let hashMap_remove_back
+  (t : Type0) (self : hashMap_t t) (key : usize) : result (hashMap_t t) =
+  let* hash = hash_key key in
+  let i = alloc_vec_Vec_len (list_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (list_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+      hash_mod in
+  let* x = hashMap_remove_from_list t key l in
+  begin match x with
+  | None ->
+    let* l1 = hashMap_remove_from_list_back t key l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+        hash_mod l1 in
+    Return { self with slots = v }
+  | Some _ ->
+    let* i1 = usize_sub self.num_entries 1 in
+    let* l1 = hashMap_remove_from_list_back t key l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
+        hash_mod l1 in
+    Return { self with num_entries = i1; slots = v }
+  end
+
+(** [hashmap::test1]: forward function
+    Source: 'src/hashmap.rs', lines 315:0-315:10 *)
+let test1 : result unit =
+  let* hm = hashMap_new u64 in
+  let* hm1 = hashMap_insert u64 hm 0 42 in
+  let* hm2 = hashMap_insert u64 hm1 128 18 in
+  let* hm3 = hashMap_insert u64 hm2 1024 138 in
+  let* hm4 = hashMap_insert u64 hm3 1056 256 in
+  let* i = hashMap_get u64 hm4 128 in
+  if not (i = 18)
+  then Fail Failure
+  else
+    let* hm5 = hashMap_get_mut_back u64 hm4 1024 56 in
+    let* i1 = hashMap_get u64 hm5 1024 in
+    if not (i1 = 56)
+    then Fail Failure
+    else
+      let* x = hashMap_remove u64 hm5 1024 in
+      begin match x with
+      | None -> Fail Failure
+      | Some x1 ->
+        if not (x1 = 56)
+        then Fail Failure
+        else
+          let* hm6 = hashMap_remove_back u64 hm5 1024 in
+          let* i2 = hashMap_get u64 hm6 0 in
+          if not (i2 = 42)
+          then Fail Failure
+          else
+            let* i3 = hashMap_get u64 hm6 128 in
+            if not (i3 = 18)
+            then Fail Failure
+            else
+              let* i4 = hashMap_get u64 hm6 1056 in
+              if not (i4 = 256) then Fail Failure else Return ()
+      end
+
diff --git a/tests/fstar-split/hashmap/Hashmap.Properties.fst b/tests/fstar-split/hashmap/Hashmap.Properties.fst
new file mode 100644
index 00000000..def520f0
--- /dev/null
+++ b/tests/fstar-split/hashmap/Hashmap.Properties.fst
@@ -0,0 +1,3186 @@
+(** Properties about the hashmap *)
+module Hashmap.Properties
+open Primitives
+open FStar.List.Tot
+open FStar.Mul
+open Hashmap.Types
+open Hashmap.Clauses
+open Hashmap.Funs
+
+#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
+
+let _align_fsti = ()
+
+/// The proofs:
+/// ===========
+/// 
+/// The proof strategy is to do exactly as with Low* proofs (we initially tried to
+/// prove more properties in one go, but it was a mistake):
+/// - prove that, under some preconditions, the low-level functions translated
+///   from Rust refine some higher-level functions
+/// - do functional proofs about those high-level functions to prove interesting
+///   properties about the hash map operations, and invariant preservation
+/// - combine everything
+///
+/// The fact that we work in a pure setting allows us to be more modular than when
+/// working with effects. For instance we can do a case disjunction (see the proofs
+/// for insert, which study the cases where the key is already/not in the hash map
+/// in separate proofs - we had initially tried to do them in one step: it is doable
+/// but requires some work, and the F* response time quickly becomes annoying while
+/// making progress, so we split them). We can also easily prove a refinement lemma,
+/// study the model, *then* combine those to also prove that the low-level function
+/// preserves the invariants, rather than do everything at once as is usually the
+/// case when doing intrinsic proofs with effects (I remember that having to prove
+/// invariants in one go *and* a refinement step, even small, can be extremely
+/// difficult in Low*).
+
+
+(*** Utilities *)
+
+/// We need many small helpers and lemmas, mostly about lists (and the ones we list
+/// here are not in the standard F* library).
+
+val index_append_lem (#a : Type0) (ls0 ls1 : list a) (i : nat{i < length ls0 + length ls1}) :
+  Lemma (
+    (i < length ls0 ==> index (ls0 @ ls1) i == index ls0 i) /\
+    (i >= length ls0 ==> index (ls0 @ ls1) i == index ls1 (i - length ls0)))
+  [SMTPat (index (ls0 @ ls1) i)]
+
+#push-options "--fuel 1"
+let rec index_append_lem #a ls0 ls1 i =
+  match ls0 with
+  | [] -> ()
+  | x :: ls0' ->
+    if i = 0 then ()
+    else index_append_lem ls0' ls1 (i-1)
+#pop-options
+
+val index_map_lem (#a #b: Type0) (f : a -> Tot b) (ls : list a)
+  (i : nat{i < length ls}) :
+  Lemma (
+    index (map f ls) i == f (index ls i))
+  [SMTPat (index (map f ls) i)]
+
+#push-options "--fuel 1"
+let rec index_map_lem #a #b f ls i =
+  match ls with
+  | [] -> ()
+  | x :: ls' ->
+    if i = 0 then ()
+    else index_map_lem f ls' (i-1)
+#pop-options
+
+val for_all_append (#a : Type0) (f : a -> Tot bool) (ls0 ls1 : list a) :
+  Lemma (for_all f (ls0 @ ls1) = (for_all f ls0 && for_all f ls1))
+
+#push-options "--fuel 1"
+let rec for_all_append #a f ls0 ls1 =
+  match ls0 with
+  | [] -> ()
+  | x :: ls0' ->
+    for_all_append f ls0' ls1
+#pop-options
+
+/// Filter a list, stopping after we removed one element
+val filter_one (#a : Type) (f : a -> bool) (ls : list a) : list a
+
+let rec filter_one #a f ls =
+  match ls with
+  | [] -> []
+  | x :: ls' -> if f x then x :: filter_one f ls' else ls'
+
+val find_append (#a : Type) (f : a -> bool) (ls0 ls1 : list a) :
+  Lemma (
+    find f (ls0 @ ls1) ==
+    begin match find f ls0 with
+    | Some x -> Some x
+    | None -> find f ls1
+    end)
+
+#push-options "--fuel 1"
+let rec find_append #a f ls0 ls1 =
+  match ls0 with
+  | [] -> ()
+  | x :: ls0' ->
+    if f x then
+    begin
+      assert(ls0 @ ls1 == x :: (ls0' @ ls1));
+      assert(find f (ls0 @ ls1) == find f (x :: (ls0' @ ls1)));
+      // Why do I have to do this?! Is it because of subtyping??
+      assert(
+        match find f (ls0 @ ls1) with
+        | Some x' -> x' == x
+        | None -> False)
+    end
+    else find_append f ls0' ls1
+#pop-options
+
+val length_flatten_update :
+     #a:Type
+  -> ls:list (list a)
+  -> i:nat{i < length ls}
+  -> x:list a ->
+  Lemma (
+    // We want this property:
+    // ```
+    // length (flatten (list_update ls i x)) =
+    //   length (flatten ls) - length (index ls i) + length x
+    // ```
+    length (flatten (list_update ls i x)) + length (index ls i) =
+    length (flatten ls) + length x)
+
+#push-options "--fuel 1"
+let rec length_flatten_update #a ls i x =
+  match ls with
+  | x' :: ls' ->
+    assert(flatten ls == x' @ flatten ls'); // Triggers patterns
+    assert(length (flatten ls) == length x' + length (flatten ls'));
+    if i = 0 then
+      begin
+      let ls1 = x :: ls' in
+      assert(list_update ls i x == ls1);
+      assert(flatten ls1 == x @ flatten ls'); // Triggers patterns
+      assert(length (flatten ls1) == length x + length (flatten ls'));
+      ()
+      end
+    else
+      begin
+      length_flatten_update ls' (i-1) x;
+      let ls1 = x' :: list_update ls' (i-1) x in
+      assert(flatten ls1 == x' @ flatten (list_update ls' (i-1) x)) // Triggers patterns
+      end
+#pop-options
+
+val length_flatten_index :
+     #a:Type
+  -> ls:list (list a)
+  -> i:nat{i < length ls} ->
+  Lemma (
+    length (flatten ls) >= length (index ls i))
+
+#push-options "--fuel 1"
+let rec length_flatten_index #a ls i =
+  match ls with
+  | x' :: ls' ->
+    assert(flatten ls == x' @ flatten ls'); // Triggers patterns
+    assert(length (flatten ls) == length x' + length (flatten ls'));
+    if i = 0 then ()
+    else length_flatten_index ls' (i-1)
+#pop-options
+
+val forall_index_equiv_list_for_all
+  (#a : Type) (pred : a -> Tot bool) (ls : list a) :
+  Lemma ((forall (i:nat{i < length ls}). pred (index ls i)) <==> for_all pred ls)
+
+#push-options "--fuel 1"
+let rec forall_index_equiv_list_for_all pred ls =
+  match ls with
+  | [] -> ()
+  | x :: ls' ->
+    assert(forall (i:nat{i < length ls'}). index ls' i == index ls (i+1));
+    assert(forall (i:nat{0 < i /\ i < length ls}). index ls i == index ls' (i-1));
+    assert(index ls 0 == x);
+    forall_index_equiv_list_for_all pred ls'
+#pop-options
+
+val find_update:
+     #a:Type
+  -> f:(a -> Tot bool)
+  -> ls:list a
+  -> x:a
+  -> ls':list a{length ls' == length ls}
+#push-options "--fuel 1"
+let rec find_update #a f ls x =
+  match ls with
+  | [] -> []
+  | hd::tl ->
+    if f hd then x :: tl else hd :: find_update f tl x
+#pop-options
+
+val pairwise_distinct : #a:eqtype -> ls:list a -> Tot bool
+let rec pairwise_distinct (#a : eqtype) (ls : list a) : Tot bool =
+  match ls with
+  | [] -> true
+  | x :: ls' -> List.Tot.for_all (fun y -> x <> y) ls' && pairwise_distinct ls'
+
+val pairwise_rel : #a:Type -> pred:(a -> a -> Tot bool) -> ls:list a -> Tot bool
+let rec pairwise_rel #a pred ls =
+  match ls with
+  | [] -> true
+  | x :: ls' ->
+    for_all (pred x) ls' && pairwise_rel pred ls' 
+
+#push-options "--fuel 1"
+let rec flatten_append (#a : Type) (l1 l2: list (list a)) :
+  Lemma (flatten (l1 @ l2) == flatten l1 @ flatten l2) =
+  match l1 with
+  | [] -> ()
+  | x :: l1' ->
+    flatten_append l1' l2;
+    append_assoc x (flatten l1') (flatten l2)
+#pop-options
+
+/// We don't use anonymous functions as parameters to other functions, but rather
+/// introduce auxiliary functions instead: otherwise we can't reason (because
+/// F*'s encoding to the SMT is imprecise for functions)
+let fst_is_disctinct (#a : eqtype) (#b : Type0) (p0 : a & b) (p1 : a & b) : Type0 =
+  fst p0 <> fst p1
+
+(*** Lemmas about Primitives *)
+/// TODO: move those lemmas
+
+// TODO: rename to 'insert'?
+val list_update_index_dif_lem
+  (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a)
+  (j : nat{j < length ls}) :
+  Lemma (requires (j <> i))
+  (ensures (index (list_update ls i x) j == index ls j))
+  [SMTPat (index (list_update ls i x) j)]
+
+#push-options "--fuel 1"
+let rec list_update_index_dif_lem #a ls i x j =
+  match ls with
+  | x' :: ls ->
+    if i = 0 then ()
+    else if j = 0 then ()
+    else
+     list_update_index_dif_lem ls (i-1) x (j-1)
+#pop-options
+
+val map_list_update_lem
+  (#a #b: Type0) (f : a -> Tot b)
+  (ls : list a) (i : nat{i < length ls}) (x : a) :
+  Lemma (list_update (map f ls) i (f x) == map f (list_update ls i x))
+  [SMTPat (list_update (map f ls) i (f x))]
+
+#push-options "--fuel 1"
+let rec map_list_update_lem #a #b f ls i x =
+  match ls with
+  | x' :: ls' ->
+    if i = 0 then ()
+    else map_list_update_lem f ls' (i-1) x
+#pop-options
+
+(*** Invariants, models *)
+
+(**** Internals *)
+/// The following invariants, models, representation functions... are mostly
+/// for the purpose of the proofs.
+
+let is_pos_usize (n : nat) : Type0 = 0 < n /\ n <= usize_max
+type pos_usize = x:usize{x > 0}
+
+type binding (t : Type0) = key & t
+
+type slots_t (t : Type0) = alloc_vec_Vec (list_t t)
+
+/// We represent hash maps as associative lists
+type assoc_list (t : Type0) = list (binding t)
+
+/// Representation function for [list_t]
+let rec list_t_v (#t : Type0) (ls : list_t t) : assoc_list t =
+  match ls with
+  | List_Nil -> []
+  | List_Cons k v tl -> (k,v) :: list_t_v tl
+
+let list_t_len (#t : Type0) (ls : list_t t) : nat = length (list_t_v ls)
+let list_t_index (#t : Type0) (ls : list_t t) (i : nat{i < list_t_len ls}) : binding t =
+  index (list_t_v ls) i
+
+type slot_s (t : Type0) = list (binding t)
+type slots_s (t : Type0) = list (slot_s t)
+
+type slot_t (t : Type0) = list_t t
+let slot_t_v #t = list_t_v #t
+
+/// Representation function for the slots.
+let slots_t_v (#t : Type0) (slots : slots_t t) : slots_s t =
+  map slot_t_v slots
+
+/// Representation function for the slots, seen as an associative list.
+let slots_t_al_v (#t : Type0) (slots : slots_t t) : assoc_list t =
+  flatten (map list_t_v slots)
+
+/// High-level type for the hash-map, seen as a list of associative lists (one
+/// list per slot). This is the representation we use most, internally. Note that
+/// we later introduce a [map_s] representation, which is the one used in the
+/// lemmas shown to the user.
+type hashMap_s t = list (slot_s t)
+
+// TODO: why not always have the condition on the length?
+// 'nes': "non-empty slots"
+type hashMap_s_nes (t : Type0) : Type0 =
+  hm:hashMap_s t{is_pos_usize (length hm)}
+
+/// Representation function for [hashMap_t] as a list of slots
+let hashMap_t_v (#t : Type0) (hm : hashMap_t t) : hashMap_s t =
+  map list_t_v hm.slots
+
+/// Representation function for [hashMap_t] as an associative list
+let hashMap_t_al_v (#t : Type0) (hm : hashMap_t t) : assoc_list t =
+  flatten (hashMap_t_v hm)
+
+// 'nes': "non-empty slots"
+type hashMap_t_nes (t : Type0) : Type0 =
+  hm:hashMap_t t{is_pos_usize (length hm.slots)}
+
+let hash_key_s (k : key) : hash =
+  Return?.v (hash_key k)
+
+let hash_mod_key (k : key) (len : usize{len > 0}) : hash =
+  (hash_key_s k) % len
+
+let not_same_key (#t : Type0) (k : key) (b : binding t) : bool = fst b <> k
+let same_key (#t : Type0) (k : key) (b : binding t) : bool = fst b = k
+
+// We take a [nat] instead of a [hash] on purpose
+let same_hash_mod_key (#t : Type0) (len : usize{len > 0}) (h : nat) (b : binding t) : bool =
+  hash_mod_key (fst b) len = h
+
+let binding_neq (#t : Type0) (b0 b1 : binding t) : bool = fst b0 <> fst b1
+
+let hashMap_t_len_s (#t : Type0) (hm : hashMap_t t) : nat =
+  hm.num_entries
+
+let assoc_list_find (#t : Type0) (k : key) (slot : assoc_list t) : option t =
+  match find (same_key k) slot with
+  | None -> None
+  | Some (_, v) -> Some v
+
+let slot_s_find (#t : Type0) (k : key) (slot : list (binding t)) : option t =
+  assoc_list_find k slot
+
+let slot_t_find_s (#t : Type0) (k : key) (slot : list_t t) : option t =
+  slot_s_find k (slot_t_v slot)
+
+// This is a simpler version of the "find" function, which captures the essence
+// of what happens and operates on [hashMap_s].
+let hashMap_s_find
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (k : key) : option t =
+  let i = hash_mod_key k (length hm) in
+  let slot = index hm i in
+  slot_s_find k slot
+
+let hashMap_s_len
+  (#t : Type0) (hm : hashMap_s t) :
+  nat =
+  length (flatten hm)
+
+// Same as above, but operates on [hashMap_t]
+// Note that we don't reuse the above function on purpose: converting to a
+// [hashMap_s] then looking up an element is not the same as what we
+// wrote below.
+let hashMap_t_find_s
+  (#t : Type0) (hm : hashMap_t t{length hm.slots > 0}) (k : key) : option t =
+  let slots = hm.slots in
+  let i = hash_mod_key k (length slots) in
+  let slot = index slots i in
+  slot_t_find_s k slot
+
+/// Invariants for the slots
+
+let slot_s_inv
+  (#t : Type0) (len : usize{len > 0}) (i : usize) (slot : list (binding t)) : bool =
+  // All the bindings are in the proper slot
+  for_all (same_hash_mod_key len i) slot &&
+  // All the keys are pairwise distinct
+  pairwise_rel binding_neq slot
+
+let slot_t_inv (#t : Type0) (len : usize{len > 0}) (i : usize) (slot : list_t t) : bool =
+  slot_s_inv len i (slot_t_v slot)
+
+let slots_s_inv (#t : Type0) (slots : slots_s t{length slots <= usize_max}) : Type0 =
+  forall(i:nat{i < length slots}).
+  {:pattern index slots i}
+  slot_s_inv (length slots) i (index slots i)
+
+// At some point we tried to rewrite this in terms of [slots_s_inv]. However it
+// made a lot of proofs fail because those proofs relied on the [index_map_lem]
+// pattern. We tried writing others lemmas with patterns (like [slots_s_inv]
+// implies [slots_t_inv]) but it didn't succeed, so we keep things as they are.
+let slots_t_inv (#t : Type0) (slots : slots_t t{length slots <= usize_max}) : Type0 =
+  forall(i:nat{i < length slots}).
+  {:pattern index slots i}
+  slot_t_inv (length slots) i (index slots i)
+
+let hashMap_s_inv (#t : Type0) (hm : hashMap_s t) : Type0 =
+  length hm <= usize_max /\
+  length hm > 0 /\
+  slots_s_inv hm
+
+/// Base invariant for the hashmap (the complete invariant can be temporarily
+/// broken between the moment we inserted an element and the moment we resize)
+let hashMap_t_base_inv (#t : Type0) (hm : hashMap_t t) : Type0 =
+  let al = hashMap_t_al_v hm in
+  // [num_entries] correctly tracks the number of entries in the table
+  // Note that it gives us that the length of the slots array is <= usize_max:
+  // [> length <= usize_max
+  // (because hashMap_num_entries has type `usize`)
+  hm.num_entries = length al /\
+  // Slots invariant
+  slots_t_inv hm.slots /\
+  // The capacity must be > 0 (otherwise we can't resize, because we
+  // multiply the capacity by two!)
+  length hm.slots > 0 /\
+  // Load computation
+  begin
+  let capacity = length hm.slots in
+  let (dividend, divisor) = hm.max_load_factor in
+  0 < dividend /\ dividend < divisor /\
+  capacity * dividend >= divisor /\
+  hm.max_load = (capacity * dividend) / divisor
+  end
+
+/// We often need to frame some values
+let hashMap_t_same_params (#t : Type0) (hm0 hm1 : hashMap_t t) : Type0 =
+  length hm0.slots = length hm1.slots /\
+  hm0.max_load = hm1.max_load /\
+  hm0.max_load_factor = hm1.max_load_factor
+
+/// The following invariants, etc. are meant to be revealed to the user through
+/// the .fsti.
+
+/// Invariant for the hashmap
+let hashMap_t_inv (#t : Type0) (hm : hashMap_t t) : Type0 =
+  // Base invariant
+  hashMap_t_base_inv hm /\
+  // The hash map is either: not overloaded, or we can't resize it
+  begin
+  let (dividend, divisor) = hm.max_load_factor in
+  hm.num_entries <= hm.max_load
+  || length hm.slots * 2 * dividend > usize_max
+  end
+
+(*** .fsti *)
+/// We reveal slightly different version of the above functions to the user
+
+let len_s (#t : Type0) (hm : hashMap_t t) : nat = hashMap_t_len_s hm
+
+/// This version doesn't take any precondition (contrary to [hashMap_t_find_s])
+let find_s (#t : Type0) (hm : hashMap_t t) (k : key) : option t =
+  if length hm.slots = 0 then None
+  else hashMap_t_find_s hm k
+
+(*** Overloading *)
+
+let hashMap_not_overloaded_lem #t hm = ()
+
+(*** allocate_slots *)
+
+/// Auxiliary lemma
+val slots_t_all_nil_inv_lem
+  (#t : Type0) (slots : alloc_vec_Vec (list_t t){length slots <= usize_max}) :
+  Lemma (requires (forall (i:nat{i < length slots}). index slots i == List_Nil))
+  (ensures (slots_t_inv slots))
+
+#push-options "--fuel 1"
+let slots_t_all_nil_inv_lem #t slots = ()
+#pop-options
+
+val slots_t_al_v_all_nil_is_empty_lem
+  (#t : Type0) (slots : alloc_vec_Vec (list_t t)) :
+  Lemma (requires (forall (i:nat{i < length slots}). index slots i == List_Nil))
+  (ensures (slots_t_al_v slots == []))
+
+#push-options "--fuel 1"
+let rec slots_t_al_v_all_nil_is_empty_lem #t slots =
+ match slots with
+ | [] -> ()
+ | s :: slots' ->
+   assert(forall (i:nat{i < length slots'}). index slots' i == index slots (i+1));
+   slots_t_al_v_all_nil_is_empty_lem #t slots';
+   assert(slots_t_al_v slots == list_t_v s @ slots_t_al_v slots');
+   assert(slots_t_al_v slots == list_t_v s);
+   assert(index slots 0 == List_Nil)
+#pop-options
+
+/// [allocate_slots]
+val hashMap_allocate_slots_lem
+  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (n : usize) :
+  Lemma
+  (requires (length slots + n <= usize_max))
+  (ensures (
+   match hashMap_allocate_slots t slots n with
+   | Fail _ -> False
+   | Return slots' ->
+     length slots' = length slots + n /\
+     // We leave the already allocated slots unchanged
+     (forall (i:nat{i < length slots}). index slots' i == index slots i) /\
+     // We allocate n additional empty slots
+     (forall (i:nat{length slots <= i /\ i < length slots'}). index slots' i == List_Nil)))
+  (decreases (hashMap_allocate_slots_loop_decreases t slots n))
+
+#push-options "--fuel 1"
+let rec hashMap_allocate_slots_lem t slots n =
+  begin match n with
+  | 0 -> ()
+  | _ ->
+    begin match alloc_vec_Vec_push (list_t t) slots List_Nil with
+    | Fail _ -> ()
+    | Return slots1 ->
+      begin match usize_sub n 1 with
+      | Fail _ -> ()
+      | Return i ->
+        hashMap_allocate_slots_lem t slots1 i;
+        begin match hashMap_allocate_slots t slots1 i with
+        | Fail _ -> ()
+        | Return slots2 ->
+          assert(length slots1 = length slots + 1);
+          assert(slots1 == slots @ [List_Nil]); // Triggers patterns
+          assert(index slots1 (length slots) == index [List_Nil] 0); // Triggers patterns
+          assert(index slots1 (length slots) == List_Nil)
+        end
+      end
+    end
+  end
+#pop-options
+
+(*** new_with_capacity *)
+/// Under proper conditions, [new_with_capacity] doesn't fail and returns an empty hash map.
+val hashMap_new_with_capacity_lem
+  (t : Type0) (capacity : usize)
+  (max_load_dividend : usize) (max_load_divisor : usize) :
+  Lemma
+  (requires (
+    0 < max_load_dividend /\
+    max_load_dividend < max_load_divisor /\
+    0 < capacity /\
+    capacity * max_load_dividend >= max_load_divisor /\
+    capacity * max_load_dividend <= usize_max))
+  (ensures (
+    match hashMap_new_with_capacity t capacity max_load_dividend max_load_divisor with
+    | Fail _ -> False
+    | Return hm ->
+      // The hash map invariant is satisfied
+      hashMap_t_inv hm /\
+      // The parameters are correct
+      hm.max_load_factor = (max_load_dividend, max_load_divisor) /\
+      hm.max_load = (capacity * max_load_dividend) / max_load_divisor /\
+      // The hash map has the specified capacity - we need to reveal this
+      // otherwise the pre of [hashMap_t_find_s] is not satisfied.
+      length hm.slots = capacity /\
+      // The hash map has 0 values
+      hashMap_t_len_s hm = 0 /\
+      // It contains no bindings
+      (forall k. hashMap_t_find_s hm k == None) /\
+      // We need this low-level property for the invariant
+      (forall(i:nat{i < length hm.slots}). index hm.slots i == List_Nil)))
+
+#push-options "--z3rlimit 50 --fuel 1"
+let hashMap_new_with_capacity_lem (t : Type0) (capacity : usize)
+  (max_load_dividend : usize) (max_load_divisor : usize) =
+  let v = alloc_vec_Vec_new (list_t t) in
+  assert(length v = 0);
+  hashMap_allocate_slots_lem t v capacity;
+  begin match hashMap_allocate_slots t v capacity with
+  | Fail _ -> assert(False)
+  | Return v0 ->
+    begin match usize_mul capacity max_load_dividend with
+    | Fail _ -> assert(False)
+    | Return i ->
+      begin match usize_div i max_load_divisor with
+      | Fail _ -> assert(False)
+      | Return i0 ->
+          let hm = MkhashMap_t 0 (max_load_dividend, max_load_divisor) i0 v0 in
+          slots_t_all_nil_inv_lem v0;
+          slots_t_al_v_all_nil_is_empty_lem hm.slots
+      end
+    end
+  end
+#pop-options
+
+(*** new *)
+
+/// [new] doesn't fail and returns an empty hash map
+val hashMap_new_lem_aux (t : Type0) :
+  Lemma
+  (ensures (
+    match hashMap_new t with
+    | Fail _ -> False
+    | Return hm ->
+      // The hash map invariant is satisfied
+      hashMap_t_inv hm /\
+      // The hash map has 0 values
+      hashMap_t_len_s hm = 0 /\
+      // It contains no bindings
+      (forall k. hashMap_t_find_s hm k == None)))
+
+#push-options "--fuel 1"
+let hashMap_new_lem_aux t =
+  hashMap_new_with_capacity_lem t 32 4 5;
+  match hashMap_new_with_capacity t 32 4 5 with
+  | Fail _ -> ()
+  | Return hm -> ()
+#pop-options
+
+/// The lemma we reveal in the .fsti
+let hashMap_new_lem t = hashMap_new_lem_aux t
+
+(*** clear *)
+/// [clear]: the loop doesn't fail and simply clears the slots starting at index i
+#push-options "--fuel 1"
+let rec hashMap_clear_loop_lem
+  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (i : usize) :
+  Lemma
+  (ensures (
+    match hashMap_clear_loop t slots i with
+    | Fail _ -> False
+    | Return slots' ->
+      // The length is preserved
+      length slots' == length slots /\
+      // The slots before i are left unchanged
+      (forall (j:nat{j < i /\ j < length slots}). index slots' j == index slots j) /\
+      // The slots after i are set to List_Nil
+      (forall (j:nat{i <= j /\ j < length slots}). index slots' j == List_Nil)))
+  (decreases (hashMap_clear_loop_decreases t slots i))
+  =
+  let i0 = alloc_vec_Vec_len (list_t t) slots in
+  let b = i < i0 in
+  if b
+  then
+    begin match alloc_vec_Vec_update_usize slots i List_Nil with
+    | Fail _ -> ()
+    | Return v ->
+      begin match usize_add i 1 with
+      | Fail _ -> ()
+      | Return i1 ->
+        hashMap_clear_loop_lem t v i1;
+        begin match hashMap_clear_loop t v i1 with
+        | Fail _ -> ()
+        | Return slots1 ->
+          assert(length slots1 == length slots);
+          assert(forall (j:nat{i+1 <= j /\ j < length slots}). index slots1 j == List_Nil);
+          assert(index slots1 i == List_Nil)
+        end
+      end
+    end
+  else ()
+#pop-options
+
+/// [clear] doesn't fail and turns the hash map into an empty map
+val hashMap_clear_lem_aux
+  (#t : Type0) (self : hashMap_t t) :
+  Lemma
+  (requires (hashMap_t_base_inv self))
+  (ensures (
+    match hashMap_clear t self with
+    | Fail _ -> False
+    | Return hm ->
+      // The hash map invariant is satisfied
+      hashMap_t_base_inv hm /\
+      // We preserved the parameters
+      hashMap_t_same_params hm self /\
+      // The hash map has 0 values
+      hashMap_t_len_s hm = 0 /\
+      // It contains no bindings
+      (forall k. hashMap_t_find_s hm k == None)))
+
+// Being lazy: fuel 1 helps a lot...
+#push-options "--fuel 1"
+let hashMap_clear_lem_aux #t self =
+  let p = self.max_load_factor in
+  let i = self.max_load in
+  let v = self.slots in
+  hashMap_clear_loop_lem t v 0;
+  begin match hashMap_clear_loop t v 0 with
+  | Fail _ -> ()
+  | Return slots1 ->
+    slots_t_al_v_all_nil_is_empty_lem slots1;
+    let hm1 = MkhashMap_t 0 p i slots1 in
+    assert(hashMap_t_base_inv hm1);
+    assert(hashMap_t_inv hm1)
+  end
+#pop-options
+
+let hashMap_clear_lem #t self = hashMap_clear_lem_aux #t self
+
+(*** len *)
+
+/// [len]: we link it to a non-failing function.
+/// Rk.: we might want to make an analysis to not use an error monad to translate
+/// functions which statically can't fail.
+let hashMap_len_lem #t self = ()
+
+
+(*** insert_in_list *)
+
+(**** insert_in_list'fwd *)
+
+/// [insert_in_list]: returns true iff the key is not in the list (functional version)
+val hashMap_insert_in_list_lem
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (ensures (
+    match hashMap_insert_in_list t key value ls with
+    | Fail _ -> False
+    | Return b ->
+      b <==> (slot_t_find_s key ls == None)))
+  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+
+#push-options "--fuel 1"
+let rec hashMap_insert_in_list_lem t key value ls =
+  begin match ls with
+  | List_Cons ckey cvalue ls0 ->
+    let b = ckey = key in
+    if b
+    then ()
+    else
+      begin
+      hashMap_insert_in_list_lem t key value ls0;
+      match hashMap_insert_in_list t key value ls0 with
+      | Fail _ -> ()
+      | Return b0 -> ()
+      end
+  | List_Nil ->
+    assert(list_t_v ls == []);
+    assert_norm(find (same_key #t key) [] == None)
+  end
+#pop-options
+
+(**** insert_in_list'back *)
+
+/// The proofs about [insert_in_list] backward are easier to do in several steps:
+/// extrinsic proofs to the rescue!
+/// We first prove that [insert_in_list] refines the function we wrote above, then
+/// use this function to prove the invariants, etc.
+
+/// We write a helper which "captures" what [insert_in_list] does.
+/// We then reason about this helper to prove the high-level properties we want
+/// (functional properties, preservation of invariants, etc.).
+let hashMap_insert_in_list_s
+  (#t : Type0) (key : usize) (value : t) (ls : list (binding t)) :
+  list (binding t) =
+  // Check if there is already a binding for the key
+  match find (same_key key) ls with
+  | None ->
+    // No binding: append the binding to the end
+    ls @ [(key,value)]
+  | Some _ ->
+    // There is already a binding: update it
+    find_update (same_key key) ls (key,value)
+
+/// [insert_in_list]: if the key is not in the map, appends a new bindings (functional version)
+val hashMap_insert_in_list_back_lem_append_s
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (requires (
+    slot_t_find_s key ls == None))
+  (ensures (
+    match hashMap_insert_in_list_back t key value ls with
+    | Fail _ -> False
+    | Return ls' ->
+      list_t_v ls' == list_t_v ls @ [(key,value)]))
+  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+
+#push-options "--fuel 1"
+let rec hashMap_insert_in_list_back_lem_append_s t key value ls =
+  begin match ls with
+  | List_Cons ckey cvalue ls0 ->
+    let b = ckey = key in
+    if b
+    then ()
+    else
+      begin
+      hashMap_insert_in_list_back_lem_append_s t key value ls0;
+      match hashMap_insert_in_list_back t key value ls0 with
+      | Fail _ -> ()
+      | Return l -> ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+/// [insert_in_list]: if the key is in the map, we update the binding (functional version)
+val hashMap_insert_in_list_back_lem_update_s
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (requires (
+    Some? (find (same_key key) (list_t_v ls))))
+  (ensures (
+    match hashMap_insert_in_list_back t key value ls with
+    | Fail _ -> False
+    | Return ls' ->
+      list_t_v ls' == find_update (same_key key) (list_t_v ls) (key,value)))
+  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+
+#push-options "--fuel 1"
+let rec hashMap_insert_in_list_back_lem_update_s t key value ls =
+  begin match ls with
+  | List_Cons ckey cvalue ls0 ->
+    let b = ckey = key in
+    if b
+    then ()
+    else
+      begin
+      hashMap_insert_in_list_back_lem_update_s t key value ls0;
+      match hashMap_insert_in_list_back t key value ls0 with
+      | Fail _ -> ()
+      | Return l -> ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+/// Put everything together
+val hashMap_insert_in_list_back_lem_s
+  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (ensures (
+    match hashMap_insert_in_list_back t key value ls with
+    | Fail _ -> False
+    | Return ls' ->
+      list_t_v ls' == hashMap_insert_in_list_s key value (list_t_v ls)))
+
+let hashMap_insert_in_list_back_lem_s t key value ls =
+  match find (same_key key) (list_t_v ls) with
+  | None -> hashMap_insert_in_list_back_lem_append_s t key value ls
+  | Some _ -> hashMap_insert_in_list_back_lem_update_s t key value ls
+
+(**** Invariants of insert_in_list_s *)
+
+/// Auxiliary lemmas
+/// We work on [hashMap_insert_in_list_s], the "high-level" version of [insert_in_list'back].
+///
+/// Note that in F* we can't have recursive proofs inside of other proofs, contrary
+/// to Coq, which makes it a bit cumbersome to prove auxiliary results like the
+/// following ones...
+
+(** Auxiliary lemmas: append case *)
+
+val slot_t_v_for_all_binding_neq_append_lem
+  (t : Type0) (key : usize) (value : t) (ls : list (binding t)) (b : binding t) :
+  Lemma
+  (requires (
+    fst b <> key /\
+    for_all (binding_neq b) ls /\
+    slot_s_find key ls == None))
+  (ensures (
+    for_all (binding_neq b) (ls @ [(key,value)])))
+
+#push-options "--fuel 1"
+let rec slot_t_v_for_all_binding_neq_append_lem t key value ls b =
+  match ls with
+  | [] -> ()
+  | (ck, cv) :: cls ->
+    slot_t_v_for_all_binding_neq_append_lem t key value cls b
+#pop-options
+
+val slot_s_inv_not_find_append_end_inv_lem
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
+  Lemma
+  (requires (
+    slot_s_inv len (hash_mod_key key len) ls /\
+    slot_s_find key ls == None))
+  (ensures (
+    let ls' = ls @ [(key,value)] in
+    slot_s_inv len (hash_mod_key key len) ls' /\
+    (slot_s_find key ls' == Some value) /\
+    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
+
+#push-options "--fuel 1"
+let rec slot_s_inv_not_find_append_end_inv_lem t len key value ls =
+  match ls with
+  | [] -> ()
+  | (ck, cv) :: cls ->
+    slot_s_inv_not_find_append_end_inv_lem t len key value cls;
+    let h = hash_mod_key key len in
+    let ls' = ls @ [(key,value)] in
+    assert(for_all (same_hash_mod_key len h) ls');
+    slot_t_v_for_all_binding_neq_append_lem t key value cls (ck, cv);
+    assert(pairwise_rel binding_neq ls');
+    assert(slot_s_inv len h ls')
+#pop-options
+
+/// [insert_in_list]: if the key is not in the map, appends a new bindings
+val hashMap_insert_in_list_s_lem_append
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
+  Lemma
+  (requires (
+    slot_s_inv len (hash_mod_key key len) ls /\
+    slot_s_find key ls == None))
+  (ensures (
+    let ls' = hashMap_insert_in_list_s key value ls in
+    ls' == ls @ [(key,value)] /\
+    // The invariant is preserved
+    slot_s_inv len (hash_mod_key key len) ls' /\
+    // [key] maps to [value]
+    slot_s_find key ls' == Some value /\
+    // The other bindings are preserved
+    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
+
+let hashMap_insert_in_list_s_lem_append t len key value ls =
+  slot_s_inv_not_find_append_end_inv_lem t len key value ls
+
+/// [insert_in_list]: if the key is not in the map, appends a new bindings (quantifiers)
+/// Rk.: we don't use this lemma.
+/// TODO: remove?
+val hashMap_insert_in_list_back_lem_append
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (requires (
+    slot_t_inv len (hash_mod_key key len) ls /\
+    slot_t_find_s key ls == None))
+  (ensures (
+    match hashMap_insert_in_list_back t key value ls with
+    | Fail _ -> False
+    | Return ls' ->
+      list_t_v ls' == list_t_v ls @ [(key,value)] /\
+      // The invariant is preserved
+      slot_t_inv len (hash_mod_key key len) ls' /\
+      // [key] maps to [value]
+      slot_t_find_s key ls' == Some value /\
+      // The other bindings are preserved
+      (forall k'. k' <> key ==> slot_t_find_s k' ls' == slot_t_find_s k' ls)))
+
+let hashMap_insert_in_list_back_lem_append t len key value ls =
+  hashMap_insert_in_list_back_lem_s t key value ls;
+  hashMap_insert_in_list_s_lem_append t len key value (list_t_v ls)
+
+(** Auxiliary lemmas: update case *)
+
+val slot_s_find_update_for_all_binding_neq_append_lem
+  (t : Type0) (key : usize) (value : t) (ls : list (binding t)) (b : binding t) :
+  Lemma
+  (requires (
+    fst b <> key /\
+    for_all (binding_neq b) ls))
+  (ensures (
+    let ls' = find_update (same_key key) ls (key, value) in
+    for_all (binding_neq b) ls'))
+
+#push-options "--fuel 1"
+let rec slot_s_find_update_for_all_binding_neq_append_lem t key value ls b =
+  match ls with
+  | [] -> ()
+  | (ck, cv) :: cls ->
+    slot_s_find_update_for_all_binding_neq_append_lem t key value cls b
+#pop-options
+
+/// Annoying auxiliary lemma we have to prove because there is no way to reason
+/// properly about closures.
+/// I'm really enjoying my time.
+val for_all_binding_neq_value_indep
+  (#t : Type0) (key : key) (v0 v1 : t) (ls : list (binding t)) :
+  Lemma (for_all (binding_neq (key,v0)) ls = for_all (binding_neq (key,v1)) ls)
+
+#push-options "--fuel 1"
+let rec for_all_binding_neq_value_indep #t key v0 v1 ls =
+  match ls with
+  | [] -> ()
+  | _ :: ls' -> for_all_binding_neq_value_indep #t key v0 v1 ls'
+#pop-options
+
+val slot_s_inv_find_append_end_inv_lem
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
+  Lemma
+  (requires (
+    slot_s_inv len (hash_mod_key key len) ls /\
+    Some? (slot_s_find key ls)))
+  (ensures (
+    let ls' = find_update (same_key key) ls (key, value) in
+    slot_s_inv len (hash_mod_key key len) ls' /\
+    (slot_s_find key ls' == Some value) /\
+    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
+
+#push-options "--z3rlimit 50 --fuel 1"
+let rec slot_s_inv_find_append_end_inv_lem t len key value ls =
+  match ls with
+  | [] -> ()
+  | (ck, cv) :: cls ->
+    let h = hash_mod_key key len in
+    let ls' = find_update (same_key key) ls (key, value) in
+    if ck = key then
+      begin
+      assert(ls' == (ck,value) :: cls);
+      assert(for_all (same_hash_mod_key len h) ls');
+      // For pairwise_rel: binding_neq (ck, value) is actually independent
+      // of `value`. Slightly annoying to prove in F*...
+      assert(for_all (binding_neq (ck,cv)) cls);
+      for_all_binding_neq_value_indep key cv value cls;
+      assert(for_all (binding_neq (ck,value)) cls);
+      assert(pairwise_rel binding_neq ls');
+      assert(slot_s_inv len (hash_mod_key key len) ls')
+      end
+    else
+      begin
+      slot_s_inv_find_append_end_inv_lem t len key value cls;
+      assert(for_all (same_hash_mod_key len h) ls');
+      slot_s_find_update_for_all_binding_neq_append_lem t key value cls (ck, cv);
+      assert(pairwise_rel binding_neq ls');
+      assert(slot_s_inv len h ls')
+      end
+#pop-options
+
+/// [insert_in_list]: if the key is in the map, update the bindings
+val hashMap_insert_in_list_s_lem_update
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
+  Lemma
+  (requires (
+    slot_s_inv len (hash_mod_key key len) ls /\
+    Some? (slot_s_find key ls)))
+  (ensures (
+    let ls' = hashMap_insert_in_list_s key value ls in
+    ls' == find_update (same_key key) ls (key,value) /\
+    // The invariant is preserved
+    slot_s_inv len (hash_mod_key key len) ls' /\
+    // [key] maps to [value]
+    slot_s_find key ls' == Some value /\
+    // The other bindings are preserved
+    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
+
+let hashMap_insert_in_list_s_lem_update t len key value ls =
+  slot_s_inv_find_append_end_inv_lem t len key value ls
+
+
+/// [insert_in_list]: if the key is in the map, update the bindings
+/// TODO: not used: remove?
+val hashMap_insert_in_list_back_lem_update
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (requires (
+    slot_t_inv len (hash_mod_key key len) ls /\
+    Some? (slot_t_find_s key ls)))
+  (ensures (
+    match hashMap_insert_in_list_back t key value ls with
+    | Fail _ -> False
+    | Return ls' ->
+      let als = list_t_v ls in
+      list_t_v ls' == find_update (same_key key) als (key,value) /\
+      // The invariant is preserved
+      slot_t_inv len (hash_mod_key key len) ls' /\
+      // [key] maps to [value]
+      slot_t_find_s key ls' == Some value /\
+      // The other bindings are preserved
+      (forall k'. k' <> key ==> slot_t_find_s k' ls' == slot_t_find_s k' ls)))
+
+let hashMap_insert_in_list_back_lem_update t len key value ls =
+  hashMap_insert_in_list_back_lem_s t key value ls;
+  hashMap_insert_in_list_s_lem_update t len key value (list_t_v ls)
+
+(** Final lemmas about [insert_in_list] *)
+
+/// High-level version
+val hashMap_insert_in_list_s_lem
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
+  Lemma
+  (requires (
+    slot_s_inv len (hash_mod_key key len) ls))
+  (ensures (
+    let ls' = hashMap_insert_in_list_s key value ls in
+    // The invariant is preserved
+    slot_s_inv len (hash_mod_key key len) ls' /\
+    // [key] maps to [value]
+    slot_s_find key ls' == Some value /\
+    // The other bindings are preserved
+    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls) /\
+    // The length is incremented, iff we inserted a new key
+    (match slot_s_find key ls with
+     | None -> length ls' = length ls + 1
+     | Some _ -> length ls' = length ls)))
+
+let hashMap_insert_in_list_s_lem t len key value ls =
+  match slot_s_find key ls with
+  | None ->
+    assert_norm(length [(key,value)] = 1);
+    hashMap_insert_in_list_s_lem_append t len key value ls
+  | Some _ ->
+    hashMap_insert_in_list_s_lem_update t len key value ls
+
+/// [insert_in_list]
+/// TODO: not used: remove?
+val hashMap_insert_in_list_back_lem
+  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list_t t) :
+  Lemma
+  (requires (slot_t_inv len (hash_mod_key key len) ls))
+  (ensures (
+    match hashMap_insert_in_list_back t key value ls with
+    | Fail _ -> False
+    | Return ls' ->
+      // The invariant is preserved
+      slot_t_inv len (hash_mod_key key len) ls' /\
+      // [key] maps to [value]
+      slot_t_find_s key ls' == Some value /\
+      // The other bindings are preserved
+      (forall k'. k' <> key ==> slot_t_find_s k' ls' == slot_t_find_s k' ls) /\
+      // The length is incremented, iff we inserted a new key
+      (match slot_t_find_s key ls with
+       | None ->
+         list_t_v ls' == list_t_v ls @ [(key,value)] /\
+         list_t_len ls' = list_t_len ls + 1
+       | Some _ ->
+         list_t_v ls' == find_update (same_key key) (list_t_v ls) (key,value) /\
+         list_t_len ls' = list_t_len ls)))
+  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+
+let hashMap_insert_in_list_back_lem t len key value ls =
+  hashMap_insert_in_list_back_lem_s t key value ls;
+  hashMap_insert_in_list_s_lem t len key value (list_t_v ls)
+
+(*** insert_no_resize *)
+
+(**** Refinement proof *)
+/// Same strategy as for [insert_in_list]: we introduce a high-level version of
+/// the function, and reason about it.
+/// We work on [hashMap_s] (we use a higher-level view of the hash-map, but
+/// not too high).
+
+/// A high-level version of insert, which doesn't check if the table is saturated
+let hashMap_insert_no_fail_s
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (key : usize) (value : t) :
+  hashMap_s t =
+  let len = length hm in
+  let i = hash_mod_key key len in
+  let slot = index hm i in
+  let slot' = hashMap_insert_in_list_s key value slot in
+  let hm' = list_update hm i slot' in
+  hm'
+
+// TODO: at some point I used hashMap_s_nes and it broke proofs...x
+let hashMap_insert_no_resize_s
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (key : usize) (value : t) :
+  result (hashMap_s t) =
+  // Check if the table is saturated (too many entries, and we need to insert one)
+  let num_entries = length (flatten hm) in
+  if None? (hashMap_s_find hm key) && num_entries = usize_max then Fail Failure
+  else Return (hashMap_insert_no_fail_s hm key value)
+
+/// Prove that [hashMap_insert_no_resize_s] is refined by
+/// [hashMap_insert_no_resize'fwd_back]
+val hashMap_insert_no_resize_lem_s
+  (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  Lemma
+  (requires (
+    hashMap_t_base_inv self /\
+    hashMap_s_len (hashMap_t_v self) = hashMap_t_len_s self))
+  (ensures (
+    begin
+    match hashMap_insert_no_resize t self key value,
+          hashMap_insert_no_resize_s (hashMap_t_v self) key value
+    with
+    | Fail _, Fail _ -> True
+    | Return hm, Return hm_v ->
+      hashMap_t_base_inv hm /\
+      hashMap_t_same_params hm self /\
+      hashMap_t_v hm == hm_v /\
+      hashMap_s_len hm_v == hashMap_t_len_s hm
+    | _ -> False
+    end))
+
+let hashMap_insert_no_resize_lem_s t self key value =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let i0 = self.num_entries in
+    let p = self.max_load_factor in
+    let i1 = self.max_load in
+    let v = self.slots in
+    let i2 = alloc_vec_Vec_len (list_t t) v in
+    let len = length v in
+    begin match usize_rem i i2 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        begin
+        // Checking that: list_t_v (index ...) == index (hashMap_t_v ...) ...
+        assert(list_t_v l == index (hashMap_t_v self) hash_mod);
+        hashMap_insert_in_list_lem t key value l;
+        match hashMap_insert_in_list t key value l with
+        | Fail _ -> ()
+        | Return b ->
+          assert(b = None? (slot_s_find key (list_t_v l)));
+          hashMap_insert_in_list_back_lem t len key value l;
+          if b
+          then
+            begin match usize_add i0 1 with
+            | Fail _ -> ()
+            | Return i3 ->
+              begin
+              match hashMap_insert_in_list_back t key value l with
+              | Fail _ -> ()
+              | Return l0 ->
+                begin match alloc_vec_Vec_update_usize v hash_mod l0 with
+                | Fail _ -> ()
+                | Return v0 ->
+                  let self_v = hashMap_t_v self in
+                  let hm = MkhashMap_t i3 p i1 v0 in
+                  let hm_v = hashMap_t_v hm in
+                  assert(hm_v == list_update self_v hash_mod (list_t_v l0));
+                  assert_norm(length [(key,value)] = 1);
+                  assert(length (list_t_v l0) = length (list_t_v l) + 1);
+                  length_flatten_update self_v hash_mod (list_t_v l0);
+                  assert(hashMap_s_len hm_v = hashMap_t_len_s hm)
+                end
+              end
+            end
+          else
+            begin
+            match hashMap_insert_in_list_back t key value l with
+            | Fail _ -> ()
+            | Return l0 ->
+              begin match alloc_vec_Vec_update_usize v hash_mod l0 with
+              | Fail _ -> ()
+              | Return v0 ->
+                let self_v = hashMap_t_v self in
+                let hm = MkhashMap_t i0 p i1 v0 in
+                let hm_v = hashMap_t_v hm in
+                assert(hm_v == list_update self_v hash_mod (list_t_v l0));
+                assert(length (list_t_v l0) = length (list_t_v l));
+                length_flatten_update self_v hash_mod (list_t_v l0);
+                assert(hashMap_s_len hm_v = hashMap_t_len_s hm)
+              end
+            end
+        end
+      end
+    end
+  end
+
+(**** insert_{no_fail,no_resize}: invariants *)
+
+let hashMap_s_updated_binding
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (key : usize) (opt_value : option t) (hm' : hashMap_s_nes t) : Type0 =
+  // [key] maps to [value]
+  hashMap_s_find hm' key == opt_value /\
+  // The other bindings are preserved
+  (forall k'. k' <> key ==> hashMap_s_find hm' k' == hashMap_s_find hm k')
+
+let insert_post (#t : Type0) (hm : hashMap_s_nes t)
+  (key : usize) (value : t) (hm' : hashMap_s_nes t) : Type0 =
+  // The invariant is preserved
+  hashMap_s_inv hm' /\
+  // [key] maps to [value] and the other bindings are preserved
+  hashMap_s_updated_binding hm key (Some value) hm' /\
+  // The length is incremented, iff we inserted a new key
+  (match hashMap_s_find hm key with
+   | None -> hashMap_s_len hm' = hashMap_s_len hm + 1
+   | Some _ -> hashMap_s_len hm' = hashMap_s_len hm)
+
+val hashMap_insert_no_fail_s_lem
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (key : usize) (value : t) :
+  Lemma
+  (requires (hashMap_s_inv hm))
+  (ensures (
+    let hm' = hashMap_insert_no_fail_s hm key value in
+    insert_post hm key value hm'))
+
+let hashMap_insert_no_fail_s_lem #t hm key value =
+  let len = length hm in
+  let i = hash_mod_key key len in
+  let slot = index hm i in
+  hashMap_insert_in_list_s_lem t len key value slot;
+  let slot' = hashMap_insert_in_list_s key value slot in
+  length_flatten_update hm i slot'
+
+val hashMap_insert_no_resize_s_lem
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (key : usize) (value : t) :
+  Lemma
+  (requires (hashMap_s_inv hm))
+  (ensures (
+    match hashMap_insert_no_resize_s hm key value with
+    | Fail _ ->
+      // Can fail only if we need to create a new binding in
+      // an already saturated map
+      hashMap_s_len hm = usize_max /\
+      None? (hashMap_s_find hm key)
+    | Return hm' ->
+      insert_post hm key value hm'))
+
+let hashMap_insert_no_resize_s_lem #t hm key value =
+  let num_entries = length (flatten hm) in
+  if None? (hashMap_s_find hm key) && num_entries = usize_max then ()
+  else hashMap_insert_no_fail_s_lem hm key value
+
+
+(**** find after insert *)
+/// Lemmas about what happens if we call [find] after an insertion
+
+val hashMap_insert_no_resize_s_get_same_lem
+  (#t : Type0) (hm : hashMap_s t)
+  (key : usize) (value : t) :
+  Lemma (requires (hashMap_s_inv hm))
+  (ensures (
+    match hashMap_insert_no_resize_s hm key value with
+    | Fail _ -> True
+    | Return hm' ->
+      hashMap_s_find hm' key == Some value))
+
+let hashMap_insert_no_resize_s_get_same_lem #t hm key value =
+  let num_entries = length (flatten hm) in
+  if None? (hashMap_s_find hm key) && num_entries = usize_max then ()
+  else
+    begin
+    let hm' = Return?.v (hashMap_insert_no_resize_s hm key value) in
+    let len = length hm in
+    let i = hash_mod_key key len in
+    let slot = index hm i in
+    hashMap_insert_in_list_s_lem t len key value slot
+   end
+
+val hashMap_insert_no_resize_s_get_diff_lem
+  (#t : Type0) (hm : hashMap_s t)
+  (key : usize) (value : t) (key' : usize{key' <> key}) :
+  Lemma (requires (hashMap_s_inv hm))
+  (ensures (
+    match hashMap_insert_no_resize_s hm key value with
+    | Fail _ -> True
+    | Return hm' ->
+      hashMap_s_find hm' key' == hashMap_s_find hm key'))
+
+let hashMap_insert_no_resize_s_get_diff_lem #t hm key value key' =
+  let num_entries = length (flatten hm) in
+  if None? (hashMap_s_find hm key) && num_entries = usize_max then ()
+  else
+    begin
+    let hm' = Return?.v (hashMap_insert_no_resize_s hm key value) in
+    let len = length hm in
+    let i = hash_mod_key key len in
+    let slot = index hm i in
+    hashMap_insert_in_list_s_lem t len key value slot;
+    let i' = hash_mod_key key' len in
+    if i <> i' then ()
+    else
+      begin
+      ()
+      end
+   end
+
+
+(*** move_elements_from_list *)
+
+/// Having a great time here: if we use `result (hashMap_s_res t)` as the
+/// return type for [hashMap_move_elements_from_list_s] instead of having this
+/// awkward match, the proof of [hashMap_move_elements_lem_refin] fails.
+/// I guess it comes from F*'s poor subtyping.
+/// Followingly, I'm not taking any chance and using [result_hashMap_s]
+/// everywhere.
+type result_hashMap_s_nes (t : Type0) : Type0 =
+  res:result (hashMap_s t) {
+    match res with
+    | Fail _ -> True
+    | Return hm -> is_pos_usize (length hm)
+  }
+
+let rec hashMap_move_elements_from_list_s
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (ls : slot_s t) :
+  // Do *NOT* use `result (hashMap_s t)`
+  Tot (result_hashMap_s_nes t)
+  (decreases ls) =
+  match ls with
+  | [] -> Return hm
+  | (key, value) :: ls' ->
+    match hashMap_insert_no_resize_s hm key value with
+    | Fail e -> Fail e
+    | Return hm' ->
+      hashMap_move_elements_from_list_s hm' ls'
+
+/// Refinement lemma
+val hashMap_move_elements_from_list_lem
+  (t : Type0) (ntable : hashMap_t_nes t) (ls : list_t t) :
+  Lemma (requires (hashMap_t_base_inv ntable))
+  (ensures (
+    match hashMap_move_elements_from_list t ntable ls,
+          hashMap_move_elements_from_list_s (hashMap_t_v ntable) (slot_t_v ls)
+    with
+    | Fail _, Fail _ -> True
+    | Return hm', Return hm_v ->
+      hashMap_t_base_inv hm' /\
+      hashMap_t_v hm' == hm_v /\
+      hashMap_t_same_params hm' ntable
+    | _ -> False))
+  (decreases (hashMap_move_elements_from_list_loop_decreases t ntable ls))
+
+#push-options "--fuel 1"
+let rec hashMap_move_elements_from_list_lem t ntable ls =
+  begin match ls with
+  | List_Cons k v tl ->
+    assert(list_t_v ls == (k, v) :: list_t_v tl);
+    let ls_v = list_t_v ls in
+    let (_,_) :: tl_v = ls_v in
+    hashMap_insert_no_resize_lem_s t ntable k v;
+    begin match hashMap_insert_no_resize t ntable k v with
+    | Fail _ -> ()
+    | Return h ->
+      let h_v = Return?.v (hashMap_insert_no_resize_s (hashMap_t_v ntable) k v) in
+      assert(hashMap_t_v h == h_v);
+      hashMap_move_elements_from_list_lem t h tl;
+      begin match hashMap_move_elements_from_list t h tl with
+      | Fail _ -> ()
+      | Return h0 -> ()
+      end
+    end
+  | List_Nil -> ()
+  end
+#pop-options
+
+(*** move_elements *)
+
+(**** move_elements: refinement 0 *)
+/// The proof for [hashMap_move_elements_lem_refin] broke so many times
+/// (while it is supposed to be super simple!) that we decided to add one refinement
+/// level, to really do things step by step...
+/// Doing this refinement layer made me notice that maybe the problem came from
+/// the fact that at some point we have to prove `list_t_v List_Nil == []`: I
+/// added the corresponding assert to help Z3 and everything became stable.
+/// I finally didn't use this "simple" refinement lemma, but I still keep it here
+/// because it allows for easy comparisons with [hashMap_move_elements_s].
+
+/// [hashMap_move_elements] refines this function, which is actually almost
+/// the same (just a little bit shorter and cleaner, and has a pre).
+///
+/// The way I wrote the high-level model is the following:
+/// - I copy-pasted the definition of [hashMap_move_elements], wrote the
+///   signature which links this new definition to [hashMap_move_elements] and
+///   checked that the proof passed
+/// - I gradually simplified it, while making sure the proof still passes
+#push-options "--fuel 1"
+let rec hashMap_move_elements_s_simpl
+  (t : Type0) (ntable : hashMap_t t)
+  (slots : alloc_vec_Vec (list_t t))
+  (i : usize{i <= length slots /\ length slots <= usize_max}) :
+  Pure (result ((hashMap_t t) & (alloc_vec_Vec (list_t t))))
+  (requires (True))
+  (ensures (fun res ->
+    match res, hashMap_move_elements t ntable slots i with
+    | Fail _, Fail _ -> True
+    | Return (ntable1, slots1), Return (ntable2, slots2) ->
+      ntable1 == ntable2 /\
+      slots1 == slots2
+    | _ -> False))
+  (decreases (hashMap_move_elements_loop_decreases t ntable slots i))
+  =
+  if i < length slots
+  then
+    let slot = index slots i in
+    begin match hashMap_move_elements_from_list t ntable slot with
+    | Fail e -> Fail e
+    | Return hm' ->
+      let slots' = list_update slots i List_Nil in
+      hashMap_move_elements_s_simpl t hm' slots' (i+1)
+    end
+  else Return (ntable, slots)
+#pop-options
+
+(**** move_elements: refinement 1 *)
+/// We prove a second refinement lemma: calling [move_elements] refines a function
+/// which, for every slot, moves the element out of the slot. This first model is
+/// almost exactly the translated function, it just uses `list` instead of `list_t`.
+
+// Note that we ignore the returned slots (we thus don't return a pair:
+// only the new hash map in which we moved the elements from the slots):
+// this returned value is not used.
+let rec hashMap_move_elements_s
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (slots : slots_s t) (i : usize{i <= length slots /\ length slots <= usize_max}) :
+  Tot (result_hashMap_s_nes t)
+  (decreases (length slots - i)) =
+  let len = length slots in
+  if i < len then
+    begin
+    let slot = index slots i in
+    match hashMap_move_elements_from_list_s hm slot with
+    | Fail e -> Fail e
+    | Return hm' ->
+      let slots' = list_update slots i [] in
+      hashMap_move_elements_s hm' slots' (i+1)
+    end
+  else Return hm
+
+val hashMap_move_elements_lem_refin
+  (t : Type0) (ntable : hashMap_t t)
+  (slots : alloc_vec_Vec (list_t t)) (i : usize{i <= length slots}) :
+  Lemma
+  (requires (
+    hashMap_t_base_inv ntable))
+  (ensures (
+    match hashMap_move_elements t ntable slots i,
+          hashMap_move_elements_s (hashMap_t_v ntable) (slots_t_v slots) i
+    with
+    | Fail _, Fail _ -> True // We will prove later that this is not possible
+    | Return (ntable', _), Return ntable'_v ->
+      hashMap_t_base_inv ntable' /\
+      hashMap_t_v ntable' == ntable'_v /\
+      hashMap_t_same_params ntable' ntable
+    | _ -> False))
+ (decreases (length slots - i))
+
+#restart-solver
+#push-options "--fuel 1"
+let rec hashMap_move_elements_lem_refin t ntable slots i =
+  assert(hashMap_t_base_inv ntable);
+  let i0 = alloc_vec_Vec_len (list_t t) slots in
+  let b = i < i0 in
+  if b
+  then
+    begin match alloc_vec_Vec_index_usize slots i with
+    | Fail _ -> ()
+    | Return l ->
+      let l0 = core_mem_replace (list_t t) l List_Nil in
+      assert(l0 == l);
+      hashMap_move_elements_from_list_lem t ntable l0;
+      begin match hashMap_move_elements_from_list t ntable l0 with
+      | Fail _ -> ()
+      | Return h ->
+        let l1 = core_mem_replace_back (list_t t) l List_Nil in
+        assert(l1 == List_Nil);
+        assert(slot_t_v #t List_Nil == []); // THIS IS IMPORTANT
+        begin match alloc_vec_Vec_update_usize slots i l1 with
+        | Fail _ -> ()
+        | Return v ->
+          begin match usize_add i 1 with
+          | Fail _ -> ()
+          | Return i1 ->
+            hashMap_move_elements_lem_refin t h v i1;
+            begin match hashMap_move_elements t h v i1 with
+            | Fail _ ->
+              assert(Fail? (hashMap_move_elements t ntable slots i));
+              ()
+            | Return (ntable', v0) -> ()
+            end
+          end
+        end
+      end
+    end
+  else ()
+#pop-options
+
+
+(**** move_elements: refinement 2 *)
+/// We prove a second refinement lemma: calling [move_elements] refines a function
+/// which moves every binding of the hash map seen as *one* associative list
+/// (and not a list of lists).
+
+/// [ntable] is the hash map to which we move the elements
+/// [slots] is the current hash map, from which we remove the elements, and seen
+///         as a "flat" associative list (and not a list of lists)
+/// This is actually exactly [hashMap_move_elements_from_list_s]...
+let rec hashMap_move_elements_s_flat
+  (#t : Type0) (ntable : hashMap_s_nes t)
+  (slots : assoc_list t) :
+  Tot (result_hashMap_s_nes t)
+  (decreases slots) =
+  match slots with
+  | [] -> Return ntable
+  | (k,v) :: slots' ->
+    match hashMap_insert_no_resize_s ntable k v with
+    | Fail e -> Fail e
+    | Return ntable' ->
+      hashMap_move_elements_s_flat ntable' slots'
+
+/// The refinment lemmas
+/// First, auxiliary helpers.
+
+/// Flatten a list of lists, starting at index i
+val flatten_i :
+     #a:Type
+  -> l:list (list a)
+  -> i:nat{i <= length l}
+  -> Tot (list a) (decreases (length l - i))
+
+let rec flatten_i l i =
+  if i < length l then
+    index l i @ flatten_i l (i+1)
+  else []
+
+let _ = assert(let l = [1;2] in l == hd l :: tl l)
+
+val flatten_i_incr :
+     #a:Type
+  -> l:list (list a)
+  -> i:nat{Cons? l /\ i+1 <= length l} ->
+  Lemma
+  (ensures (
+    (**) assert_norm(length (hd l :: tl l) == 1 + length (tl l));
+    flatten_i l (i+1) == flatten_i (tl l) i))
+  (decreases (length l - (i+1)))
+
+#push-options "--fuel 1"
+let rec flatten_i_incr l i =
+  let x :: tl = l in
+  if i + 1 < length l then
+    begin
+    assert(flatten_i l (i+1) == index l (i+1) @ flatten_i l (i+2));
+    flatten_i_incr l (i+1);
+    assert(flatten_i l (i+2) == flatten_i tl (i+1));
+    assert(index l (i+1) == index tl i)
+    end
+  else ()
+#pop-options
+
+val flatten_0_is_flatten :
+     #a:Type
+  -> l:list (list a) ->
+  Lemma
+  (ensures (flatten_i l 0 == flatten l))
+
+#push-options "--fuel 1"
+let rec flatten_0_is_flatten #a l =
+  match l with
+  | [] -> ()
+  | x :: l' ->
+    flatten_i_incr l 0;
+    flatten_0_is_flatten l'
+#pop-options
+
+/// Auxiliary lemma
+val flatten_nil_prefix_as_flatten_i :
+     #a:Type
+  -> l:list (list a)
+  -> i:nat{i <= length l} ->
+  Lemma (requires (forall (j:nat{j < i}). index l j == []))
+  (ensures (flatten l == flatten_i l i))
+
+#push-options "--fuel 1"
+let rec flatten_nil_prefix_as_flatten_i #a l i =
+  if i = 0 then flatten_0_is_flatten l
+  else
+    begin
+    let x :: l' = l in
+    assert(index l 0 == []);
+    assert(x == []);
+    assert(flatten l == flatten l');
+    flatten_i_incr l (i-1);
+    assert(flatten_i l i == flatten_i l' (i-1));
+    assert(forall (j:nat{j < length l'}). index l' j == index l (j+1));
+    flatten_nil_prefix_as_flatten_i l' (i-1);
+    assert(flatten l' == flatten_i l' (i-1))
+    end
+#pop-options
+
+/// The proof is trivial, the functions are the same.
+/// Just keeping two definitions to allow changes...
+val hashMap_move_elements_from_list_s_as_flat_lem
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (ls : slot_s t) :
+  Lemma
+  (ensures (
+    hashMap_move_elements_from_list_s hm ls ==
+    hashMap_move_elements_s_flat hm ls))
+  (decreases ls)
+
+#push-options "--fuel 1"
+let rec hashMap_move_elements_from_list_s_as_flat_lem #t hm ls =
+  match ls with
+  | [] -> ()
+  | (key, value) :: ls' ->
+    match hashMap_insert_no_resize_s hm key value with
+    | Fail _ -> ()
+    | Return hm' ->
+      hashMap_move_elements_from_list_s_as_flat_lem hm' ls'
+#pop-options
+
+/// Composition of two calls to [hashMap_move_elements_s_flat]
+let hashMap_move_elements_s_flat_comp
+  (#t : Type0) (hm : hashMap_s_nes t) (slot0 slot1 : slot_s t) :
+  Tot (result_hashMap_s_nes t) =
+  match hashMap_move_elements_s_flat hm slot0 with
+  | Fail e -> Fail e
+  | Return hm1 -> hashMap_move_elements_s_flat hm1 slot1
+
+/// High-level desc:
+/// move_elements (move_elements hm slot0) slo1 == move_elements hm (slot0 @ slot1)
+val hashMap_move_elements_s_flat_append_lem
+  (#t : Type0) (hm : hashMap_s_nes t) (slot0 slot1 : slot_s t) :
+  Lemma
+  (ensures (
+    match hashMap_move_elements_s_flat_comp hm slot0 slot1,
+          hashMap_move_elements_s_flat hm (slot0 @ slot1)
+    with
+    | Fail _, Fail _ -> True
+    | Return hm1, Return hm2 -> hm1 == hm2
+    | _ -> False))
+  (decreases (slot0))
+
+#push-options "--fuel 1"
+let rec hashMap_move_elements_s_flat_append_lem #t hm slot0 slot1 =
+  match slot0 with
+  | [] -> ()
+  | (k,v) :: slot0' ->
+    match hashMap_insert_no_resize_s hm k v with
+    | Fail _ -> ()
+    | Return hm' ->
+      hashMap_move_elements_s_flat_append_lem hm' slot0' slot1
+#pop-options
+
+val flatten_i_same_suffix (#a : Type) (l0 l1 : list (list a)) (i : nat) :
+  Lemma
+  (requires (
+    i <= length l0 /\
+    length l0 = length l1 /\
+    (forall (j:nat{i <= j /\ j < length l0}). index l0 j == index l1 j)))
+  (ensures (flatten_i l0 i == flatten_i l1 i))
+  (decreases (length l0 - i))
+
+#push-options "--fuel 1"
+let rec flatten_i_same_suffix #a l0 l1 i =
+  if i < length l0 then
+    flatten_i_same_suffix l0 l1 (i+1)
+  else ()
+#pop-options
+
+/// Refinement lemma:
+/// [hashMap_move_elements_s] refines [hashMap_move_elements_s_flat]
+/// (actually the functions are equal on all inputs).
+val hashMap_move_elements_s_lem_refin_flat
+  (#t : Type0) (hm : hashMap_s_nes t)
+  (slots : slots_s t)
+  (i : nat{i <= length slots /\ length slots <= usize_max}) :
+  Lemma
+  (ensures (
+    match hashMap_move_elements_s hm slots i,
+          hashMap_move_elements_s_flat hm (flatten_i slots i)
+    with
+    | Fail _, Fail _ -> True
+    | Return hm, Return hm' -> hm == hm'
+    | _ -> False))
+  (decreases (length slots - i))
+
+#push-options "--fuel 1"
+let rec hashMap_move_elements_s_lem_refin_flat #t hm slots i =
+  let len = length slots in
+  if i < len then
+    begin
+    let slot = index slots i in
+    hashMap_move_elements_from_list_s_as_flat_lem hm slot;
+    match hashMap_move_elements_from_list_s hm slot with
+    | Fail _ ->
+      assert(flatten_i slots i == slot @ flatten_i slots (i+1));
+      hashMap_move_elements_s_flat_append_lem hm slot (flatten_i slots (i+1));
+      assert(Fail? (hashMap_move_elements_s_flat hm (flatten_i slots i)))
+    | Return hm' ->
+      let slots' = list_update slots i [] in
+      flatten_i_same_suffix slots slots' (i+1);
+      hashMap_move_elements_s_lem_refin_flat hm' slots' (i+1);
+      hashMap_move_elements_s_flat_append_lem hm slot (flatten_i slots' (i+1));
+      ()
+    end
+  else ()
+#pop-options
+
+let assoc_list_inv (#t : Type0) (al : assoc_list t) : Type0 =
+  // All the keys are pairwise distinct
+  pairwise_rel binding_neq al
+
+let disjoint_hm_al_on_key
+  (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) (k : key) : Type0 =
+  match hashMap_s_find hm k, assoc_list_find k al with
+  | Some _, None
+  | None, Some _
+  | None, None -> True
+  | Some _, Some _ -> False
+
+/// Playing a dangerous game here: using forall quantifiers
+let disjoint_hm_al (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) : Type0 =
+  forall (k:key). disjoint_hm_al_on_key hm al k
+
+let find_in_union_hm_al
+  (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) (k : key) :
+  option t =
+  match hashMap_s_find hm k with
+  | Some b -> Some b
+  | None -> assoc_list_find k al
+
+/// Auxiliary lemma
+val for_all_binding_neq_find_lem (#t : Type0) (k : key) (v : t) (al : assoc_list t) :
+  Lemma (requires (for_all (binding_neq (k,v)) al))
+  (ensures (assoc_list_find k al == None))
+
+#push-options "--fuel 1"
+let rec for_all_binding_neq_find_lem #t k v al =
+  match al with
+  | [] -> ()
+  | b :: al' -> for_all_binding_neq_find_lem k v al'
+#pop-options
+
+val hashMap_move_elements_s_flat_lem
+  (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) :
+  Lemma
+  (requires (
+    // Invariants
+    hashMap_s_inv hm /\
+    assoc_list_inv al /\
+    // The two are disjoint
+    disjoint_hm_al hm al /\
+    // We can add all the elements to the hashmap
+    hashMap_s_len hm + length al <= usize_max))
+  (ensures (
+    match hashMap_move_elements_s_flat hm al with
+    | Fail _ -> False // We can't fail
+    | Return hm' ->
+      // The invariant is preserved
+      hashMap_s_inv hm' /\
+      // The new hash map is the union of the two maps
+      (forall (k:key). hashMap_s_find hm' k == find_in_union_hm_al hm al k) /\
+      hashMap_s_len hm' = hashMap_s_len hm + length al))
+  (decreases al)
+
+#restart-solver
+#push-options "--z3rlimit 200 --fuel 1"
+let rec hashMap_move_elements_s_flat_lem #t hm al =
+  match al with
+  | [] -> ()
+  | (k,v) :: al' ->
+    hashMap_insert_no_resize_s_lem hm k v;
+    match hashMap_insert_no_resize_s hm k v with
+    | Fail _ -> ()
+    | Return hm' ->
+      assert(hashMap_s_inv hm');
+      assert(assoc_list_inv al');
+      let disjoint_lem (k' : key) :
+        Lemma (disjoint_hm_al_on_key hm' al' k')
+        [SMTPat (disjoint_hm_al_on_key hm' al' k')] =
+        if k' = k then
+          begin
+          assert(hashMap_s_find hm' k' == Some v);
+          for_all_binding_neq_find_lem k v al';
+          assert(assoc_list_find k' al' == None)
+          end
+        else
+          begin
+          assert(hashMap_s_find hm' k' == hashMap_s_find hm k');
+          assert(assoc_list_find k' al' == assoc_list_find k' al)
+          end
+      in
+      assert(disjoint_hm_al hm' al');
+      assert(hashMap_s_len hm' + length al' <= usize_max);
+      hashMap_move_elements_s_flat_lem hm' al'
+#pop-options
+
+/// We need to prove that the invariants on the "low-level" representations of
+/// the hash map imply the invariants on the "high-level" representations.
+
+val slots_t_inv_implies_slots_s_inv
+  (#t : Type0) (slots : slots_t t{length slots <= usize_max}) :
+  Lemma (requires (slots_t_inv slots))
+  (ensures (slots_s_inv (slots_t_v slots)))
+
+let slots_t_inv_implies_slots_s_inv #t slots =
+  // Ok, works fine: this lemma was useless.
+  // Problem is: I can never really predict for sure with F*...
+  ()
+
+val hashMap_t_base_inv_implies_hashMap_s_inv
+  (#t : Type0) (hm : hashMap_t t) :
+  Lemma (requires (hashMap_t_base_inv hm))
+  (ensures (hashMap_s_inv (hashMap_t_v hm)))
+
+let hashMap_t_base_inv_implies_hashMap_s_inv #t hm = () // same as previous
+
+/// Introducing a "partial" version of the hash map invariant, which operates on
+/// a suffix of the hash map.
+let partial_hashMap_s_inv
+  (#t : Type0) (len : usize{len > 0}) (offset : usize)
+  (hm : hashMap_s t{offset + length hm <= usize_max}) : Type0 =
+  forall(i:nat{i < length hm}). {:pattern index hm i} slot_s_inv len (offset + i) (index hm i)
+
+/// Auxiliary lemma.
+/// If a binding comes from a slot i, then its key is different from the keys
+/// of the bindings in the other slots (because the hashes of the keys are distinct).
+val binding_in_previous_slot_implies_neq
+  (#t : Type0) (len : usize{len > 0})
+  (i : usize) (b : binding t)
+  (offset : usize{i < offset})
+  (slots : hashMap_s t{offset + length slots <= usize_max}) :
+  Lemma
+  (requires (
+    // The binding comes from a slot not in [slots]
+    hash_mod_key (fst b) len = i /\
+    // The slots are the well-formed suffix of a hash map
+    partial_hashMap_s_inv len offset slots))
+  (ensures (
+    for_all (binding_neq b) (flatten slots)))
+  (decreases slots)
+
+#push-options "--z3rlimit 100 --fuel 1"
+let rec binding_in_previous_slot_implies_neq #t len i b offset slots =
+  match slots with
+  | [] -> ()
+  | s :: slots' ->
+    assert(slot_s_inv len offset (index slots 0)); // Triggers patterns
+    assert(slot_s_inv len offset s);
+    // Proving TARGET. We use quantifiers.
+    assert(for_all (same_hash_mod_key len offset) s);
+    forall_index_equiv_list_for_all (same_hash_mod_key len offset) s;
+    assert(forall (i:nat{i < length s}). same_hash_mod_key len offset (index s i));
+    let aux (i:nat{i < length s}) :
+      Lemma
+      (requires (same_hash_mod_key len offset (index s i)))
+      (ensures (binding_neq b (index s i)))
+      [SMTPat (index s i)] = ()
+    in
+    assert(forall (i:nat{i < length s}). binding_neq b (index s i));
+    forall_index_equiv_list_for_all (binding_neq b) s;
+    assert(for_all (binding_neq b) s); // TARGET
+    //
+    assert(forall (i:nat{i < length slots'}). index slots' i == index slots (i+1)); // Triggers instantiations
+    binding_in_previous_slot_implies_neq len i b (offset+1) slots';
+    for_all_append (binding_neq b) s (flatten slots')    
+#pop-options
+
+val partial_hashMap_s_inv_implies_assoc_list_lem
+  (#t : Type0) (len : usize{len > 0}) (offset : usize)
+  (hm : hashMap_s t{offset + length hm <= usize_max}) :
+  Lemma
+  (requires (
+    partial_hashMap_s_inv len offset hm))
+  (ensures (assoc_list_inv (flatten hm)))
+  (decreases (length hm + length (flatten hm)))
+
+#push-options "--fuel 1"
+let rec partial_hashMap_s_inv_implies_assoc_list_lem #t len offset hm =
+  match hm with
+  | [] -> ()
+  | slot :: hm' ->
+    assert(flatten hm == slot @ flatten hm');
+    assert(forall (i:nat{i < length hm'}). index hm' i == index hm (i+1)); // Triggers instantiations
+    match slot with
+    | [] ->
+      assert(flatten hm == flatten hm');
+      assert(partial_hashMap_s_inv len (offset+1) hm'); // Triggers instantiations
+      partial_hashMap_s_inv_implies_assoc_list_lem len (offset+1) hm'
+    | x :: slot' ->
+      assert(flatten (slot' :: hm') == slot' @ flatten hm');
+      let hm'' = slot' :: hm' in
+      assert(forall (i:nat{0 < i /\ i < length hm''}). index hm'' i == index hm i); // Triggers instantiations
+      assert(forall (i:nat{0 < i /\ i < length hm''}). slot_s_inv len (offset + i) (index hm'' i));
+      assert(index hm 0 == slot); // Triggers instantiations
+      assert(slot_s_inv len offset slot);
+      assert(slot_s_inv len offset slot');
+      assert(partial_hashMap_s_inv len offset hm'');
+      partial_hashMap_s_inv_implies_assoc_list_lem len offset (slot' :: hm');
+      // Proving that the key in `x` is different from all the other keys in
+      // the flattened map
+      assert(for_all (binding_neq x) slot');
+      for_all_append (binding_neq x) slot' (flatten hm');
+      assert(partial_hashMap_s_inv len (offset+1) hm');
+      binding_in_previous_slot_implies_neq #t len offset x (offset+1) hm';
+      assert(for_all (binding_neq x) (flatten hm'));
+      assert(for_all (binding_neq x) (flatten (slot' :: hm')))
+#pop-options
+
+val hashMap_s_inv_implies_assoc_list_lem
+  (#t : Type0) (hm : hashMap_s t) :
+  Lemma (requires (hashMap_s_inv hm))
+  (ensures (assoc_list_inv (flatten hm)))
+
+let hashMap_s_inv_implies_assoc_list_lem #t hm =
+  partial_hashMap_s_inv_implies_assoc_list_lem (length hm) 0 hm
+
+val hashMap_t_base_inv_implies_assoc_list_lem
+  (#t : Type0) (hm : hashMap_t t):
+  Lemma (requires (hashMap_t_base_inv hm))
+  (ensures (assoc_list_inv (hashMap_t_al_v hm)))
+
+let hashMap_t_base_inv_implies_assoc_list_lem #t hm =
+  hashMap_s_inv_implies_assoc_list_lem (hashMap_t_v hm)
+
+/// For some reason, we can't write the below [forall] directly in the [ensures]
+/// clause of the next lemma: it makes Z3 fails even with a huge rlimit.
+/// I have no idea what's going on.
+let hashMap_is_assoc_list
+  (#t : Type0) (ntable : hashMap_t t{length ntable.slots > 0})
+  (al : assoc_list t) : Type0 =
+  (forall (k:key). hashMap_t_find_s ntable k == assoc_list_find k al)
+
+let partial_hashMap_s_find
+  (#t : Type0) (len : usize{len > 0}) (offset : usize)
+  (hm : hashMap_s_nes t{offset + length hm = len})
+  (k : key{hash_mod_key k len >= offset}) : option t =
+  let i = hash_mod_key k len in
+  let slot = index hm (i - offset) in
+  slot_s_find k slot
+
+val not_same_hash_key_not_found_in_slot
+  (#t : Type0) (len : usize{len > 0})
+  (k : key)
+  (i : usize)
+  (slot : slot_s t) :
+  Lemma
+  (requires (
+    hash_mod_key k len <> i /\
+    slot_s_inv len i slot))
+  (ensures (slot_s_find k slot == None))
+
+#push-options "--fuel 1"
+let rec not_same_hash_key_not_found_in_slot #t len k i slot =
+  match slot with
+  | [] -> ()
+  | (k',v) :: slot' -> not_same_hash_key_not_found_in_slot len k i slot'
+#pop-options
+
+/// Small variation of [binding_in_previous_slot_implies_neq]: if the hash of
+/// a key links it to a previous slot, it can't be found in the slots after.
+val key_in_previous_slot_implies_not_found
+  (#t : Type0) (len : usize{len > 0})
+  (k : key)
+  (offset : usize)
+  (slots : hashMap_s t{offset + length slots = len}) :
+  Lemma
+  (requires (
+    // The binding comes from a slot not in [slots]
+    hash_mod_key k len < offset /\
+    // The slots are the well-formed suffix of a hash map
+    partial_hashMap_s_inv len offset slots))
+  (ensures (
+    assoc_list_find k (flatten slots) == None))
+  (decreases slots)
+
+#push-options "--fuel 1"
+let rec key_in_previous_slot_implies_not_found #t len k offset slots =
+  match slots with
+  | [] -> ()
+  | slot :: slots' ->
+    find_append (same_key k) slot (flatten slots');
+    assert(index slots 0 == slot); // Triggers instantiations
+    not_same_hash_key_not_found_in_slot #t len k offset slot;
+    assert(assoc_list_find k slot == None);
+    assert(forall (i:nat{i < length slots'}). index slots' i == index slots (i+1)); // Triggers instantiations
+    key_in_previous_slot_implies_not_found len k (offset+1) slots'
+#pop-options  
+
+val partial_hashMap_s_is_assoc_list_lem
+  (#t : Type0) (len : usize{len > 0}) (offset : usize)
+  (hm : hashMap_s_nes t{offset + length hm = len})
+  (k : key{hash_mod_key k len >= offset}) :
+  Lemma
+  (requires (
+    partial_hashMap_s_inv len offset hm))
+  (ensures (
+    partial_hashMap_s_find len offset hm k == assoc_list_find k (flatten hm)))
+  (decreases hm)
+
+#push-options "--fuel 1"
+let rec partial_hashMap_s_is_assoc_list_lem #t len offset hm k =
+  match hm with
+  | [] -> ()
+  | slot :: hm' ->
+    let h = hash_mod_key k len in
+    let i = h - offset in
+    if i = 0 then
+      begin
+      // We must look in the current slot
+      assert(partial_hashMap_s_find len offset hm k == slot_s_find k slot);
+      find_append (same_key k) slot (flatten hm');
+      assert(forall (i:nat{i < length hm'}). index hm' i == index hm (i+1)); // Triggers instantiations
+      key_in_previous_slot_implies_not_found #t len k (offset+1) hm';
+      assert( // Of course, writing `== None` doesn't work...
+        match find (same_key k) (flatten hm') with
+        | None -> True
+        | Some _ -> False);
+      assert(
+        find (same_key k) (flatten hm) ==
+        begin match find (same_key k) slot with
+        | Some x -> Some x
+        | None -> find (same_key k) (flatten hm')
+        end);
+      ()
+      end
+    else
+      begin
+      // We must ignore the current slot
+      assert(partial_hashMap_s_find len offset hm k ==
+             partial_hashMap_s_find len (offset+1) hm' k);
+      find_append (same_key k) slot (flatten hm');
+      assert(index hm 0 == slot); // Triggers instantiations
+      not_same_hash_key_not_found_in_slot #t len k offset slot;
+      assert(forall (i:nat{i < length hm'}). index hm' i == index hm (i+1)); // Triggers instantiations
+      partial_hashMap_s_is_assoc_list_lem #t len (offset+1) hm' k
+      end
+#pop-options
+
+val hashMap_is_assoc_list_lem (#t : Type0) (hm : hashMap_t t) :
+  Lemma (requires (hashMap_t_base_inv hm))
+  (ensures (hashMap_is_assoc_list hm (hashMap_t_al_v hm)))
+
+let hashMap_is_assoc_list_lem #t hm =
+  let aux (k:key) :
+    Lemma (hashMap_t_find_s hm k == assoc_list_find k (hashMap_t_al_v hm))
+    [SMTPat (hashMap_t_find_s hm k)] =
+    let hm_v = hashMap_t_v hm in
+    let len = length hm_v in
+    partial_hashMap_s_is_assoc_list_lem #t len 0 hm_v k
+  in
+  ()
+
+/// The final lemma about [move_elements]: calling it on an empty hash table moves
+/// all the elements to this empty table.
+val hashMap_move_elements_lem
+  (t : Type0) (ntable : hashMap_t t) (slots : alloc_vec_Vec (list_t t)) :
+  Lemma
+  (requires (
+    let al = flatten (slots_t_v slots) in
+    hashMap_t_base_inv ntable /\
+    length al <= usize_max /\
+    assoc_list_inv al /\
+    // The table is empty
+    hashMap_t_len_s ntable = 0 /\
+    (forall (k:key). hashMap_t_find_s ntable k  == None)))
+  (ensures (
+    let al = flatten (slots_t_v slots) in
+    match hashMap_move_elements t ntable slots 0,
+          hashMap_move_elements_s_flat (hashMap_t_v ntable) al
+    with
+    | Return (ntable', _), Return ntable'_v ->
+      // The invariant is preserved
+      hashMap_t_base_inv ntable' /\
+      // We preserved the parameters
+      hashMap_t_same_params ntable' ntable /\
+      // The table has the same number of slots
+      length ntable'.slots = length ntable.slots /\
+      // The count is good
+      hashMap_t_len_s ntable' = length al /\
+      // The table can be linked to its model (we need this only to reveal
+      // "pretty" functional lemmas to the user in the fsti - so that we
+      // can write lemmas with SMT patterns - this is very F* specific)
+      hashMap_t_v ntable' == ntable'_v /\
+      // The new table contains exactly all the bindings from the slots
+      // Rk.: see the comment for [hashMap_is_assoc_list]
+      hashMap_is_assoc_list ntable' al
+    | _ -> False // We can only succeed
+    ))
+
+// Weird, dirty things happen below.
+// Manually unfolding some postconditions allowed to make the proof pass,
+// and also revealed the reason why some proofs failed with "Unknown assertion
+// failed" (resulting in the call to [flatten_0_is_flatten] for instance).
+// I think manually unfolding the postconditions allowed to account for the
+// lack of ifuel (this kind of proofs is annoying, really).
+#restart-solver
+#push-options "--z3rlimit 100"
+let hashMap_move_elements_lem t ntable slots =
+  let ntable_v = hashMap_t_v ntable in
+  let slots_v = slots_t_v slots in
+  let al = flatten slots_v in
+  hashMap_move_elements_lem_refin t ntable slots 0;
+  begin
+  match hashMap_move_elements t ntable slots 0,
+        hashMap_move_elements_s ntable_v slots_v 0
+  with
+  | Fail _, Fail _ -> ()
+  | Return (ntable', _), Return ntable'_v ->
+    assert(hashMap_t_base_inv ntable');
+    assert(hashMap_t_v ntable' == ntable'_v)
+  | _ -> assert(False)
+  end;
+  hashMap_move_elements_s_lem_refin_flat ntable_v slots_v 0;
+  begin
+  match hashMap_move_elements_s ntable_v slots_v 0,
+        hashMap_move_elements_s_flat ntable_v (flatten_i slots_v 0)
+  with
+  | Fail _, Fail _ -> ()
+  | Return hm, Return hm' -> assert(hm == hm')
+  | _ -> assert(False)
+  end;
+  flatten_0_is_flatten slots_v; // flatten_i slots_v 0 == flatten slots_v
+  hashMap_move_elements_s_flat_lem ntable_v al;
+  match hashMap_move_elements t ntable slots 0,
+        hashMap_move_elements_s_flat ntable_v al
+  with
+  | Return (ntable', _), Return ntable'_v ->
+    assert(hashMap_t_base_inv ntable');
+    assert(length ntable'.slots = length ntable.slots);
+    assert(hashMap_t_len_s ntable' = length al);
+    assert(hashMap_t_v ntable' == ntable'_v);
+    assert(hashMap_is_assoc_list ntable' al)
+  | _ -> assert(False)
+#pop-options
+
+(*** try_resize *)
+
+/// High-level model 1.
+/// This is one is slightly "crude": we just simplify a bit the function.
+
+let hashMap_try_resize_s_simpl
+  (#t : Type0)
+  (hm : hashMap_t t) :
+  Pure  (result (hashMap_t t))
+  (requires (
+    let (divid, divis) = hm.max_load_factor in
+    divid > 0 /\ divis > 0))
+  (ensures (fun _ -> True)) =
+  let capacity = length hm.slots in
+  let (divid, divis) = hm.max_load_factor in
+  if capacity <= (usize_max / 2) / divid then
+    let ncapacity : usize = capacity * 2 in
+    begin match hashMap_new_with_capacity t ncapacity divid divis with
+    | Fail e -> Fail e
+    | Return ntable ->
+      match hashMap_move_elements t ntable hm.slots 0 with
+      | Fail e -> Fail e
+      | Return (ntable', _) ->
+        let hm =
+          { hm with slots = ntable'.slots;
+                    max_load = ntable'.max_load }
+        in
+        Return hm
+    end
+  else Return hm
+
+val hashMap_try_resize_lem_refin
+  (t : Type0) (self : hashMap_t t) :
+  Lemma
+  (requires (
+    let (divid, divis) = self.max_load_factor in
+    divid > 0 /\ divis > 0))
+  (ensures (
+    match hashMap_try_resize t self,
+          hashMap_try_resize_s_simpl self
+    with
+    | Fail _, Fail _ -> True
+    | Return hm1, Return hm2 -> hm1 == hm2
+    | _ -> False))
+
+let hashMap_try_resize_lem_refin t self = ()
+
+/// Isolating arithmetic proofs
+
+let gt_lem0 (n m q : nat) :
+  Lemma (requires (m > 0 /\ n > q))
+  (ensures (n * m > q * m)) = ()
+
+let ge_lem0 (n m q : nat) :
+  Lemma (requires (m > 0 /\ n >= q))
+  (ensures (n * m >= q * m)) = ()
+
+let gt_ge_trans (n m p : nat) :
+  Lemma (requires (n > m /\ m >= p)) (ensures (n > p)) = ()
+
+let ge_trans (n m p : nat) :
+  Lemma (requires (n >= m /\ m >= p)) (ensures (n >= p)) = ()
+
+#push-options "--z3rlimit 200"
+let gt_lem1 (n m q : nat) :
+  Lemma (requires (m > 0 /\ n > q / m)) (ensures (n * m > q)) =
+  assert(n >= q / m + 1);
+  ge_lem0 n m (q / m + 1);
+  assert(n * m >= (q / m) * m + m)
+#pop-options
+
+let gt_lem2 (n m p q : nat) :
+  Lemma (requires (m > 0 /\ p > 0 /\ n > (q / m) / p)) (ensures (n * m * p > q)) =
+  gt_lem1 n p (q / m);
+  assert(n * p > q / m);
+  gt_lem1 (n * p) m q
+
+let ge_lem1 (n m q : nat) :
+  Lemma (requires (n >= m /\ q > 0))
+  (ensures (n / q >= m / q)) =
+  FStar.Math.Lemmas.lemma_div_le m n q
+
+#restart-solver
+#push-options "--z3rlimit 200"
+let times_divid_lem (n m p : pos) : Lemma ((n * m) / p >= n * (m / p))
+  =
+  FStar.Math.Lemmas.multiply_fractions m p;
+  assert(m >= (m / p) * p);
+  assert(n * m >= n * (m / p) * p); //
+  ge_lem1 (n * m) (n * (m / p) * p) p;
+  assert((n * m) / p >= (n * (m / p) * p) / p);
+  assert(n * (m / p) * p = (n * (m / p)) * p);
+  FStar.Math.Lemmas.cancel_mul_div (n * (m / p)) p;
+  assert(((n * (m / p)) * p) / p = n * (m / p))
+#pop-options
+
+/// The good old arithmetic proofs and their unstability...
+/// At some point I thought it was stable because it worked with `--quake 100`.
+/// Of course, it broke the next time I checked the file...
+/// It seems things are ok when we check this proof on its own, but not when
+/// it is sent at the same time as the one above (though we put #restart-solver!).
+/// I also tried `--quake 1/100` to no avail: it seems that when Z3 decides to
+/// fail the first one, it fails them all. I inserted #restart-solver before
+/// the previous lemma to see if it had an effect (of course not).
+val new_max_load_lem
+  (len : usize) (capacity : usize{capacity > 0})
+  (divid : usize{divid > 0}) (divis : usize{divis > 0}) :
+  Lemma
+  (requires (
+    let max_load = (capacity * divid) / divis in
+    let ncapacity = 2 * capacity in
+    let nmax_load = (ncapacity * divid) / divis in
+    capacity > 0 /\ 0 < divid /\ divid < divis /\
+    capacity * divid >= divis /\
+    len = max_load + 1))
+  (ensures (
+    let max_load = (capacity * divid) / divis in
+    let ncapacity = 2 * capacity in
+    let nmax_load = (ncapacity * divid) / divis in
+    len <= nmax_load))
+
+let mul_assoc (a b c : nat) : Lemma (a * b * c == a * (b * c)) = ()
+
+let ge_lem2 (a b c d : nat) : Lemma (requires (a >= b + c /\ c >= d)) (ensures (a >= b + d)) = ()
+let ge_div_lem1 (a b : nat) : Lemma (requires (a >= b /\ b > 0)) (ensures (a / b >= 1)) = ()
+
+#restart-solver
+#push-options "--z3rlimit 100 --z3cliopt smt.arith.nl=false"
+let new_max_load_lem len capacity divid divis =
+  FStar.Math.Lemmas.paren_mul_left 2 capacity divid;
+  mul_assoc 2 capacity divid;
+  // The following assertion often breaks though it is given by the above
+  // lemma. I really don't know what to do (I deactivated non-linear
+  // arithmetic and added the previous lemma call, moved the assertion up,
+  // boosted the rlimit...).
+  assert(2 * capacity * divid == 2 * (capacity * divid));
+  let max_load = (capacity * divid) / divis in
+  let ncapacity = 2 * capacity in
+  let nmax_load = (ncapacity * divid) / divis in
+  assert(nmax_load = (2 * capacity * divid) / divis);
+  times_divid_lem 2 (capacity * divid) divis;
+  assert((2 * (capacity * divid)) / divis >= 2 * ((capacity * divid) / divis));
+  assert(nmax_load >= 2 * ((capacity * divid) / divis));
+  assert(nmax_load >= 2 * max_load);
+  assert(nmax_load >= max_load + max_load);
+  ge_div_lem1 (capacity * divid) divis;
+  ge_lem2 nmax_load max_load max_load 1;
+  assert(nmax_load >= max_load + 1)
+#pop-options
+
+val hashMap_try_resize_s_simpl_lem (#t : Type0) (hm : hashMap_t t) :
+  Lemma
+  (requires (
+    // The base invariant is satisfied
+    hashMap_t_base_inv hm /\
+    // However, the "full" invariant is broken, as we call [try_resize]
+    // only if the current number of entries is > the max load.
+    // 
+    // There are two situations:
+    // - either we just reached the max load
+    // - or we were already saturated and can't resize
+    (let (dividend, divisor) = hm.max_load_factor in
+     hm.num_entries == hm.max_load + 1 \/
+     length hm.slots * 2 * dividend > usize_max)
+  ))
+  (ensures (
+    match hashMap_try_resize_s_simpl hm with
+    | Fail _ -> False
+    | Return hm' ->
+      // The full invariant is now satisfied (the full invariant is "base
+      // invariant" + the map is not overloaded (or can't be resized because
+      // already too big)
+      hashMap_t_inv hm' /\
+      // It contains the same bindings as the initial map
+      (forall (k:key). hashMap_t_find_s hm' k == hashMap_t_find_s hm k)))
+
+#restart-solver
+#push-options "--z3rlimit 400"
+let hashMap_try_resize_s_simpl_lem #t hm =
+  let capacity = length hm.slots in
+  let (divid, divis) = hm.max_load_factor in
+  if capacity <= (usize_max / 2) / divid then
+    begin
+    let ncapacity : usize = capacity * 2 in
+    assert(ncapacity * divid <= usize_max);
+    assert(hashMap_t_len_s hm = hm.max_load + 1);
+    new_max_load_lem (hashMap_t_len_s hm) capacity divid divis;
+    hashMap_new_with_capacity_lem t ncapacity divid divis;
+    match hashMap_new_with_capacity t ncapacity divid divis with
+    | Fail _ -> ()
+    | Return ntable ->
+      let slots = hm.slots in
+      let al = flatten (slots_t_v slots) in
+      // Proving that: length al = hm.num_entries
+      assert(al == flatten (map slot_t_v slots));
+      assert(al == flatten (map list_t_v slots));
+      assert(hashMap_t_al_v hm == flatten (hashMap_t_v hm));
+      assert(hashMap_t_al_v hm == flatten (map list_t_v hm.slots));
+      assert(al == hashMap_t_al_v hm);
+      assert(hashMap_t_base_inv ntable);
+      assert(length al = hm.num_entries);
+      assert(length al <= usize_max);
+      hashMap_t_base_inv_implies_assoc_list_lem hm;
+      assert(assoc_list_inv al);
+      assert(hashMap_t_len_s ntable = 0);
+      assert(forall (k:key). hashMap_t_find_s ntable k  == None);
+      hashMap_move_elements_lem t ntable hm.slots;
+      match hashMap_move_elements t ntable hm.slots 0 with
+      | Fail _ -> ()
+      | Return (ntable', _) ->
+        hashMap_is_assoc_list_lem hm;
+        assert(hashMap_is_assoc_list hm (hashMap_t_al_v hm));
+        let hm' =
+          { hm with slots = ntable'.slots;
+                    max_load = ntable'.max_load }
+        in
+        assert(hashMap_t_base_inv ntable');
+        assert(hashMap_t_base_inv hm');
+        assert(hashMap_t_len_s hm' = hashMap_t_len_s hm);
+        new_max_load_lem (hashMap_t_len_s hm') capacity divid divis;
+        assert(hashMap_t_len_s hm' <= hm'.max_load); // Requires a lemma
+        assert(hashMap_t_inv hm')
+    end
+  else
+    begin
+    gt_lem2 capacity 2 divid usize_max;
+    assert(capacity * 2 * divid > usize_max)
+    end
+#pop-options
+
+let hashMap_t_same_bindings  (#t : Type0) (hm hm' : hashMap_t_nes t) : Type0 =
+  forall (k:key). hashMap_t_find_s hm k == hashMap_t_find_s hm' k
+
+/// The final lemma about [try_resize]
+val hashMap_try_resize_lem (#t : Type0) (hm : hashMap_t t) :
+  Lemma
+  (requires (
+    hashMap_t_base_inv hm /\
+    // However, the "full" invariant is broken, as we call [try_resize]
+    // only if the current number of entries is > the max load.
+    // 
+    // There are two situations:
+    // - either we just reached the max load
+    // - or we were already saturated and can't resize
+    (let (dividend, divisor) = hm.max_load_factor in
+     hm.num_entries == hm.max_load + 1 \/
+     length hm.slots * 2 * dividend > usize_max)))
+  (ensures (
+    match hashMap_try_resize t hm with
+    | Fail _ -> False
+    | Return hm' ->
+      // The full invariant is now satisfied (the full invariant is "base
+      // invariant" + the map is not overloaded (or can't be resized because
+      // already too big)
+      hashMap_t_inv hm' /\
+      // The length is the same
+      hashMap_t_len_s hm' = hashMap_t_len_s hm /\
+      // It contains the same bindings as the initial map
+      hashMap_t_same_bindings hm' hm))
+
+let hashMap_try_resize_lem #t hm =
+  hashMap_try_resize_lem_refin t hm;
+  hashMap_try_resize_s_simpl_lem hm
+
+(*** insert *)
+
+/// The high-level model (very close to the original function: we don't need something
+/// very high level, just to clean it a bit)
+let hashMap_insert_s
+  (#t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  result (hashMap_t t) =
+  match hashMap_insert_no_resize t self key value with
+  | Fail e -> Fail e
+  | Return hm' ->
+    if hashMap_t_len_s hm' > hm'.max_load then
+      hashMap_try_resize t hm'
+    else Return hm'
+
+val hashMap_insert_lem_refin
+  (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  Lemma (requires True)
+  (ensures (
+    match hashMap_insert t self key value,
+          hashMap_insert_s self key value
+    with
+    | Fail _, Fail _ -> True
+    | Return hm1, Return hm2 -> hm1 == hm2
+    | _ -> False))
+
+let hashMap_insert_lem_refin t self key value = ()
+
+/// Helper
+let hashMap_insert_bindings_lem
+  (t : Type0) (self : hashMap_t_nes t) (key : usize) (value : t)
+  (hm' hm'' : hashMap_t_nes t) :
+  Lemma
+  (requires (
+     hashMap_s_updated_binding (hashMap_t_v self) key
+                                (Some value) (hashMap_t_v hm') /\
+     hashMap_t_same_bindings hm' hm''))
+  (ensures (
+     hashMap_s_updated_binding (hashMap_t_v self) key
+                                (Some value) (hashMap_t_v hm'')))
+  = ()
+
+val hashMap_insert_lem_aux
+  (#t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  Lemma (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_insert t self key value with
+    | Fail _ ->
+      // We can fail only if:
+      // - the key is not in the map and we need to add it
+      // - we are already saturated
+      hashMap_t_len_s self = usize_max /\
+      None? (hashMap_t_find_s self key)
+    | Return hm' ->
+      // The invariant is preserved
+      hashMap_t_inv hm' /\
+      // [key] maps to [value] and the other bindings are preserved
+      hashMap_s_updated_binding (hashMap_t_v self) key (Some value) (hashMap_t_v hm') /\
+      // The length is incremented, iff we inserted a new key
+      (match hashMap_t_find_s self key with
+       | None -> hashMap_t_len_s hm' = hashMap_t_len_s self + 1
+       | Some _ -> hashMap_t_len_s hm' = hashMap_t_len_s self)))
+
+#restart-solver
+#push-options "--z3rlimit 200"
+let hashMap_insert_lem_aux #t self key value =
+  hashMap_insert_no_resize_lem_s t self key value;
+  hashMap_insert_no_resize_s_lem (hashMap_t_v self) key value;
+  match hashMap_insert_no_resize t self key value with
+  | Fail _ -> ()
+  | Return hm' ->
+    // Expanding the post of [hashMap_insert_no_resize_lem_s]
+    let self_v = hashMap_t_v self in
+    let hm'_v = Return?.v (hashMap_insert_no_resize_s self_v key value) in
+    assert(hashMap_t_base_inv hm');
+    assert(hashMap_t_same_params hm' self);
+    assert(hashMap_t_v hm' == hm'_v);
+    assert(hashMap_s_len hm'_v == hashMap_t_len_s hm');
+    // Expanding the post of [hashMap_insert_no_resize_s_lem]
+    assert(insert_post self_v key value hm'_v);
+    // Expanding [insert_post]
+    assert(hashMap_s_inv hm'_v);
+    assert(
+      match hashMap_s_find self_v key with
+      | None -> hashMap_s_len hm'_v = hashMap_s_len self_v + 1
+      | Some _ -> hashMap_s_len hm'_v = hashMap_s_len self_v);
+    if hashMap_t_len_s hm' > hm'.max_load then
+      begin
+      hashMap_try_resize_lem hm';
+      // Expanding the post of [hashMap_try_resize_lem]
+      let hm'' = Return?.v (hashMap_try_resize t hm') in
+      assert(hashMap_t_inv hm'');
+      let hm''_v = hashMap_t_v hm'' in
+      assert(forall k. hashMap_t_find_s hm'' k == hashMap_t_find_s hm' k);
+      assert(hashMap_t_len_s hm'' = hashMap_t_len_s hm'); // TODO
+      // Proving the post
+      assert(hashMap_t_inv hm'');
+      hashMap_insert_bindings_lem t self key value hm' hm'';
+      assert(
+        match hashMap_t_find_s self key with
+         | None -> hashMap_t_len_s hm'' = hashMap_t_len_s self + 1
+         | Some _ -> hashMap_t_len_s hm'' = hashMap_t_len_s self)
+      end
+    else ()
+#pop-options
+
+let hashMap_insert_lem #t self key value =
+  hashMap_insert_lem_aux #t self key value
+
+(*** contains_key *)
+
+(**** contains_key_in_list *)
+
+val hashMap_contains_key_in_list_lem
+  (#t : Type0) (key : usize) (ls : list_t t) :
+  Lemma
+  (ensures (
+    match hashMap_contains_key_in_list t key ls with
+    | Fail _ -> False
+    | Return b ->
+      b = Some? (slot_t_find_s key ls)))
+
+
+#push-options "--fuel 1"
+let rec hashMap_contains_key_in_list_lem #t key ls =
+  match ls with
+  | List_Cons ckey x ls0 ->
+    let b = ckey = key in
+    if b
+    then ()
+    else
+      begin
+      hashMap_contains_key_in_list_lem key ls0;
+      match hashMap_contains_key_in_list t key ls0 with
+      | Fail _ -> ()
+      | Return b0 -> ()
+      end
+  | List_Nil -> ()
+#pop-options
+
+(**** contains_key *)
+
+val hashMap_contains_key_lem_aux
+  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
+  Lemma
+  (ensures (
+    match hashMap_contains_key t self key with
+    | Fail _ -> False
+    | Return b -> b = Some? (hashMap_t_find_s self key)))
+
+let hashMap_contains_key_lem_aux #t self key =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let v = self.slots in
+    let i0 = alloc_vec_Vec_len (list_t t) v in
+    begin match usize_rem i i0 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        hashMap_contains_key_in_list_lem key l;
+        begin match hashMap_contains_key_in_list t key l with
+        | Fail _ -> ()
+        | Return b -> ()
+        end
+      end
+    end
+  end
+
+/// The lemma in the .fsti
+let hashMap_contains_key_lem #t self key =
+  hashMap_contains_key_lem_aux #t self key
+
+(*** get *)
+
+(**** get_in_list *)
+
+val hashMap_get_in_list_lem
+  (#t : Type0) (key : usize) (ls : list_t t) :
+  Lemma
+  (ensures (
+    match hashMap_get_in_list t key ls, slot_t_find_s key ls with
+    | Fail _, None -> True
+    | Return x, Some x' -> x == x'
+    | _ -> False))
+
+#push-options "--fuel 1"
+let rec hashMap_get_in_list_lem #t key ls =
+  begin match ls with
+  | List_Cons ckey cvalue ls0 ->
+    let b = ckey = key in
+    if b
+    then ()
+    else
+      begin
+      hashMap_get_in_list_lem key ls0;
+      match hashMap_get_in_list t key ls0 with
+      | Fail _ -> ()
+      | Return x -> ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+(**** get *)
+
+val hashMap_get_lem_aux
+  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
+  Lemma
+  (ensures (
+    match hashMap_get t self key, hashMap_t_find_s self key with
+    | Fail _, None -> True
+    | Return x, Some x' -> x == x'
+    | _ -> False))
+
+let hashMap_get_lem_aux #t self key =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let v = self.slots in
+    let i0 = alloc_vec_Vec_len (list_t t) v in
+    begin match usize_rem i i0 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        begin
+        hashMap_get_in_list_lem key l;
+        match hashMap_get_in_list t key l with
+        | Fail _ -> ()
+        | Return x -> ()
+        end
+      end
+    end
+  end
+
+/// .fsti
+let hashMap_get_lem #t self key = hashMap_get_lem_aux #t self key
+
+(*** get_mut'fwd *)
+
+
+(**** get_mut_in_list'fwd *)
+
+val hashMap_get_mut_in_list_loop_lem
+  (#t : Type0) (ls : list_t t) (key : usize) :
+  Lemma
+  (ensures (
+    match hashMap_get_mut_in_list_loop t ls key, slot_t_find_s key ls with
+    | Fail _, None -> True
+    | Return x, Some x' -> x == x'
+    | _ -> False))
+
+#push-options "--fuel 1"
+let rec hashMap_get_mut_in_list_loop_lem #t ls key =
+  begin match ls with
+  | List_Cons ckey cvalue ls0 ->
+    let b = ckey = key in
+    if b
+    then ()
+    else
+      begin
+      hashMap_get_mut_in_list_loop_lem ls0 key;
+      match hashMap_get_mut_in_list_loop t ls0 key with
+      | Fail _ -> ()
+      | Return x -> ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+(**** get_mut'fwd *)
+
+val hashMap_get_mut_lem_aux
+  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
+  Lemma
+  (ensures (
+    match hashMap_get_mut t self key, hashMap_t_find_s self key with
+    | Fail _, None -> True
+    | Return x, Some x' -> x == x'
+    | _ -> False))
+
+let hashMap_get_mut_lem_aux #t self key =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let v = self.slots in
+    let i0 = alloc_vec_Vec_len (list_t t) v in
+    begin match usize_rem i i0 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        begin
+        hashMap_get_mut_in_list_loop_lem l key;
+        match hashMap_get_mut_in_list_loop t l key with
+        | Fail _ -> ()
+        | Return x -> ()
+        end
+      end
+    end
+  end
+
+let hashMap_get_mut_lem #t self key =
+  hashMap_get_mut_lem_aux #t self key
+
+(*** get_mut'back *)
+
+(**** get_mut_in_list'back *)
+
+val hashMap_get_mut_in_list_loop_back_lem
+  (#t : Type0) (ls : list_t t) (key : usize) (ret : t) :
+  Lemma
+  (requires (Some? (slot_t_find_s key ls)))
+  (ensures (
+    match hashMap_get_mut_in_list_loop_back t ls key ret with
+    | Fail _ -> False
+    | Return ls' -> list_t_v ls' == find_update (same_key key) (list_t_v ls) (key,ret)
+    | _ -> False))
+
+#push-options "--fuel 1"
+let rec hashMap_get_mut_in_list_loop_back_lem #t ls key ret =
+  begin match ls with
+  | List_Cons ckey cvalue ls0 ->
+    let b = ckey = key in
+    if b
+    then let ls1 = List_Cons ckey ret ls0 in ()
+    else
+      begin
+      hashMap_get_mut_in_list_loop_back_lem ls0 key ret;
+      match hashMap_get_mut_in_list_loop_back t ls0 key ret with
+      | Fail _ -> ()
+      | Return l -> let ls1 = List_Cons ckey cvalue l in ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+(**** get_mut'back *)
+
+/// Refinement lemma
+val hashMap_get_mut_back_lem_refin
+  (#t : Type0) (self : hashMap_t t{length self.slots > 0})
+  (key : usize) (ret : t) :
+  Lemma
+  (requires (Some? (hashMap_t_find_s self key)))
+  (ensures (
+    match hashMap_get_mut_back t self key ret with
+    | Fail _ -> False
+    | Return hm' ->
+      hashMap_t_v hm' == hashMap_insert_no_fail_s (hashMap_t_v self) key ret))
+
+let hashMap_get_mut_back_lem_refin #t self key ret =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let i0 = self.num_entries in
+    let p = self.max_load_factor in
+    let i1 = self.max_load in
+    let v = self.slots in
+    let i2 = alloc_vec_Vec_len (list_t t) v in
+    begin match usize_rem i i2 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        begin
+        hashMap_get_mut_in_list_loop_back_lem l key ret;
+        match hashMap_get_mut_in_list_loop_back t l key ret with
+        | Fail _ -> ()
+        | Return l0 ->
+          begin match alloc_vec_Vec_update_usize v hash_mod l0 with
+          | Fail _ -> ()
+          | Return v0 -> let self0 = MkhashMap_t i0 p i1 v0 in ()
+          end
+        end
+      end
+    end
+  end
+
+/// Final lemma
+val hashMap_get_mut_back_lem_aux
+  (#t : Type0) (hm : hashMap_t t)
+  (key : usize) (ret : t) :
+  Lemma
+  (requires (
+    hashMap_t_inv hm /\
+    Some? (hashMap_t_find_s hm key)))
+  (ensures (
+    match hashMap_get_mut_back t hm key ret with
+    | Fail _ -> False
+    | Return hm' ->
+      // Functional spec
+      hashMap_t_v hm' == hashMap_insert_no_fail_s (hashMap_t_v hm) key ret /\
+     // The invariant is preserved
+     hashMap_t_inv hm' /\
+     // The length is preserved
+     hashMap_t_len_s hm' = hashMap_t_len_s hm /\
+     // [key] maps to [value]
+     hashMap_t_find_s hm' key == Some ret /\
+     // The other bindings are preserved
+     (forall k'. k' <> key ==> hashMap_t_find_s hm' k' == hashMap_t_find_s hm k')))
+
+let hashMap_get_mut_back_lem_aux #t hm key ret =
+  let hm_v = hashMap_t_v hm in
+  hashMap_get_mut_back_lem_refin hm key ret;
+  match hashMap_get_mut_back t hm key ret with
+  | Fail _ -> assert(False)
+  | Return hm' ->
+    hashMap_insert_no_fail_s_lem hm_v key ret
+
+/// .fsti
+let hashMap_get_mut_back_lem #t hm key ret = hashMap_get_mut_back_lem_aux hm key ret
+
+(*** remove'fwd *)
+
+val hashMap_remove_from_list_lem
+  (#t : Type0) (key : usize) (ls : list_t t) :
+  Lemma
+  (ensures (
+    match hashMap_remove_from_list t key ls with
+    | Fail _ -> False
+    | Return opt_x ->
+      opt_x == slot_t_find_s key ls /\
+      (Some? opt_x ==> length (slot_t_v ls) > 0)))
+
+#push-options "--fuel 1"
+let rec hashMap_remove_from_list_lem #t key ls =
+  begin match ls with
+  | List_Cons ckey x tl ->
+    let b = ckey = key in
+    if b
+    then
+      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
+      begin match mv_ls with
+      | List_Cons i cvalue tl0 -> ()
+      | List_Nil -> ()
+      end
+    else
+      begin
+      hashMap_remove_from_list_lem key tl;
+      match hashMap_remove_from_list t key tl with
+      | Fail _ -> ()
+      | Return opt -> ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+val hashMap_remove_lem_aux
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (
+    // We need the invariant to prove that upon decrementing the entries counter,
+    // the counter doesn't become negative
+    hashMap_t_inv self))
+  (ensures (
+    match hashMap_remove t self key with
+    | Fail _ -> False
+    | Return opt_x -> opt_x == hashMap_t_find_s self key))
+
+let hashMap_remove_lem_aux #t self key =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let i0 = self.num_entries in
+    let v = self.slots in
+    let i1 = alloc_vec_Vec_len (list_t t) v in
+    begin match usize_rem i i1 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        begin
+        hashMap_remove_from_list_lem key l;
+        match hashMap_remove_from_list t key l with
+        | Fail _ -> ()
+        | Return x ->
+          begin match x with
+          | None -> ()
+          | Some x0 ->
+            begin
+            assert(l == index v hash_mod);
+            assert(length (list_t_v #t l) > 0);
+            length_flatten_index (hashMap_t_v self) hash_mod;
+            match usize_sub i0 1 with
+            | Fail _ -> ()
+            | Return _ -> ()
+            end
+          end
+        end
+      end
+    end
+  end
+
+/// .fsti
+let hashMap_remove_lem #t self key = hashMap_remove_lem_aux #t self key
+
+(*** remove'back *)
+
+(**** Refinement proofs *)
+
+/// High-level model for [remove_from_list'back]
+let hashMap_remove_from_list_s
+  (#t : Type0) (key : usize) (ls : slot_s t) :
+  slot_s t =
+  filter_one (not_same_key key) ls
+
+/// Refinement lemma
+val hashMap_remove_from_list_back_lem_refin
+  (#t : Type0) (key : usize) (ls : list_t t) :
+  Lemma
+  (ensures (
+    match hashMap_remove_from_list_back t key ls with
+    | Fail _ -> False
+    | Return ls' ->
+      list_t_v ls' == hashMap_remove_from_list_s key (list_t_v ls) /\
+      // The length is decremented, iff the key was in the slot
+      (let len = length (list_t_v ls) in
+       let len' = length (list_t_v ls') in
+       match slot_s_find key (list_t_v ls) with
+       | None -> len = len'
+       | Some _ -> len = len' + 1)))
+
+#push-options "--fuel 1"
+let rec hashMap_remove_from_list_back_lem_refin #t key ls =
+  begin match ls with
+  | List_Cons ckey x tl ->
+    let b = ckey = key in
+    if b
+    then
+      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
+      begin match mv_ls with
+      | List_Cons i cvalue tl0 -> ()
+      | List_Nil -> ()
+      end
+    else
+      begin
+      hashMap_remove_from_list_back_lem_refin key tl;
+      match hashMap_remove_from_list_back t key tl with
+      | Fail _ -> ()
+      | Return l -> let ls0 = List_Cons ckey x l in ()
+      end
+  | List_Nil -> ()
+  end
+#pop-options
+
+/// High-level model for [remove_from_list'back]
+let hashMap_remove_s
+  (#t : Type0) (self : hashMap_s_nes t) (key : usize) :
+  hashMap_s t =
+  let len = length self in
+  let hash = hash_mod_key key len in
+  let slot = index self hash in
+  let slot' = hashMap_remove_from_list_s key slot in
+  list_update self hash slot'
+
+/// Refinement lemma
+val hashMap_remove_back_lem_refin
+  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
+  Lemma
+  (requires (
+    // We need the invariant to prove that upon decrementing the entries counter,
+    // the counter doesn't become negative
+    hashMap_t_inv self))
+  (ensures (
+    match hashMap_remove_back t self key with
+    | Fail _ -> False
+    | Return hm' ->
+      hashMap_t_same_params hm' self /\
+      hashMap_t_v hm' == hashMap_remove_s (hashMap_t_v self) key /\
+      // The length is decremented iff the key was in the map
+      (let len = hashMap_t_len_s self in
+       let len' = hashMap_t_len_s hm' in
+       match hashMap_t_find_s self key with
+       | None -> len = len'
+       | Some _ -> len = len' + 1)))
+
+let hashMap_remove_back_lem_refin #t self key =
+  begin match hash_key key with
+  | Fail _ -> ()
+  | Return i ->
+    let i0 = self.num_entries in
+    let p = self.max_load_factor in
+    let i1 = self.max_load in
+    let v = self.slots in
+    let i2 = alloc_vec_Vec_len (list_t t) v in
+    begin match usize_rem i i2 with
+    | Fail _ -> ()
+    | Return hash_mod ->
+      begin match alloc_vec_Vec_index_usize v hash_mod with
+      | Fail _ -> ()
+      | Return l ->
+        begin
+        hashMap_remove_from_list_lem key l;
+        match hashMap_remove_from_list t key l with
+        | Fail _ -> ()
+        | Return x ->
+          begin match x with
+          | None ->
+            begin
+            hashMap_remove_from_list_back_lem_refin key l;
+            match hashMap_remove_from_list_back t key l with
+            | Fail _ -> ()
+            | Return l0 ->
+              begin
+              length_flatten_update (slots_t_v v) hash_mod (list_t_v l0);
+              match alloc_vec_Vec_update_usize v hash_mod l0 with
+              | Fail _ -> ()
+              | Return v0 -> ()
+              end
+            end
+          | Some x0 ->
+            begin
+            assert(l == index v hash_mod);
+            assert(length (list_t_v #t l) > 0);
+            length_flatten_index (hashMap_t_v self) hash_mod;
+            match usize_sub i0 1 with
+            | Fail _ -> ()
+            | Return i3 ->
+              begin
+              hashMap_remove_from_list_back_lem_refin key l;
+              match hashMap_remove_from_list_back t key l with
+              | Fail _ -> ()
+              | Return l0 ->
+                begin
+                length_flatten_update (slots_t_v v) hash_mod (list_t_v l0);
+                match alloc_vec_Vec_update_usize v hash_mod l0 with
+                | Fail _ -> ()
+                | Return v0 -> ()
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+
+(**** Invariants, high-level properties *)
+
+val hashMap_remove_from_list_s_lem
+  (#t : Type0) (k : usize) (slot : slot_s t) (len : usize{len > 0}) (i : usize) :
+  Lemma
+  (requires (slot_s_inv len i slot))
+  (ensures (
+    let slot' = hashMap_remove_from_list_s k slot in
+    slot_s_inv len i slot' /\
+    slot_s_find k slot' == None /\
+    (forall (k':key{k' <> k}). slot_s_find k' slot' == slot_s_find k' slot) /\
+    // This postcondition is necessary to prove that the invariant is preserved
+    // in the recursive calls. This allows us to do the proof in one go.
+    (forall (b:binding t). for_all (binding_neq b) slot ==> for_all (binding_neq b) slot')
+  ))
+
+#push-options "--fuel 1"
+let rec hashMap_remove_from_list_s_lem #t key slot len i =
+  match slot with
+  | [] -> ()
+  | (k',v) :: slot' ->
+    if k' <> key then
+      begin
+      hashMap_remove_from_list_s_lem key slot' len i;
+      let slot'' = hashMap_remove_from_list_s key slot' in
+      assert(for_all (same_hash_mod_key len i) ((k',v)::slot''));
+      assert(for_all (binding_neq (k',v)) slot'); // Triggers instanciation
+      assert(for_all (binding_neq (k',v)) slot'')
+      end
+    else
+      begin
+      assert(for_all (binding_neq (k',v)) slot');
+      for_all_binding_neq_find_lem key v slot'
+      end
+#pop-options
+
+val hashMap_remove_s_lem
+  (#t : Type0) (self : hashMap_s_nes t) (key : usize) :
+  Lemma
+  (requires (hashMap_s_inv self))
+  (ensures (
+    let hm' = hashMap_remove_s self key in
+    // The invariant is preserved
+    hashMap_s_inv hm' /\
+    // We updated the binding
+    hashMap_s_updated_binding self key None hm'))
+
+let hashMap_remove_s_lem #t self key =
+  let len = length self in
+  let hash = hash_mod_key key len in
+  let slot = index self hash in
+  hashMap_remove_from_list_s_lem key slot len hash;
+  let slot' = hashMap_remove_from_list_s key slot in
+  let hm' = list_update self hash slot' in
+  assert(hashMap_s_inv self)
+
+/// Final lemma about [remove'back]
+val hashMap_remove_back_lem_aux
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_remove_back t self key with
+    | Fail _ -> False
+    | Return hm' ->
+      hashMap_t_inv self /\
+      hashMap_t_same_params hm' self /\
+      // We updated the binding
+      hashMap_s_updated_binding (hashMap_t_v self) key None (hashMap_t_v hm') /\
+      hashMap_t_v hm' == hashMap_remove_s (hashMap_t_v self) key /\
+      // The length is decremented iff the key was in the map
+      (let len = hashMap_t_len_s self in
+       let len' = hashMap_t_len_s hm' in
+       match hashMap_t_find_s self key with
+       | None -> len = len'
+       | Some _ -> len = len' + 1)))
+
+let hashMap_remove_back_lem_aux #t self key =
+  hashMap_remove_back_lem_refin self key;
+  hashMap_remove_s_lem (hashMap_t_v self) key
+
+/// .fsti
+let hashMap_remove_back_lem #t self key =
+  hashMap_remove_back_lem_aux #t self key
diff --git a/tests/fstar-split/hashmap/Hashmap.Properties.fsti b/tests/fstar-split/hashmap/Hashmap.Properties.fsti
new file mode 100644
index 00000000..26c0ec06
--- /dev/null
+++ b/tests/fstar-split/hashmap/Hashmap.Properties.fsti
@@ -0,0 +1,267 @@
+(** Properties about the hashmap *)
+module Hashmap.Properties
+open Primitives
+open FStar.List.Tot
+open FStar.Mul
+open Hashmap.Types
+open Hashmap.Clauses
+open Hashmap.Funs
+
+#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
+
+// Small trick to align the .fst and the .fsti
+val _align_fsti : unit
+
+(*** Utilities *)
+
+type key : eqtype = usize
+
+type hash : eqtype = usize
+
+val hashMap_t_inv (#t : Type0) (hm : hashMap_t t) : Type0
+
+val len_s (#t : Type0) (hm : hashMap_t t) : nat
+
+val find_s (#t : Type0) (hm : hashMap_t t) (k : key) : option t
+
+(*** Overloading *)
+
+/// Upon inserting *new* entries in the hash map, the slots vector is resized
+/// whenever we reach the max load, unless we can't resize anymore because
+/// there are already too many entries. This way, we maintain performance by
+/// limiting the hash collisions.
+/// This is expressed by the following property, which is maintained in the hash
+/// map invariant.
+val hashMap_not_overloaded_lem (#t : Type0) (hm : hashMap_t t) :
+  Lemma
+  (requires (hashMap_t_inv hm))
+  (ensures (
+    // The capacity is the number of slots
+    let capacity = length hm.slots in
+    // The max load factor defines a threshold on the number of entries:
+    // if there are more entries than a given fraction of the number of slots,
+    // we resize the slots vector to limit the hash collisions
+    let (dividend, divisor) = hm.max_load_factor in
+    // technicality: this postcondition won't typecheck if we don't reveal
+    // that divisor > 0 (because of the division)
+    divisor > 0 /\
+    begin
+    // The max load, computed as a fraction of the capacity
+    let max_load = (capacity * dividend) / divisor in
+    // The number of entries inserted in the map is given by [len_s] (see
+    // the functional correctness lemmas, which state how this number evolves):
+    let len = len_s hm in
+    // We prove that:
+    // - either the number of entries is <= than the max load threshold
+    len <= max_load
+    // - or we couldn't resize the map, because then the arithmetic computations
+    //   would overflow (note that we always multiply the number of slots by 2)
+    || 2* capacity * dividend > usize_max
+    end))
+
+(*** Functional correctness *)
+(**** [new'fwd] *)
+
+/// [new] doesn't fail and returns an empty hash map
+val hashMap_new_lem (t : Type0) :
+  Lemma
+  (ensures (
+    match hashMap_new t with
+    | Fail _ -> False
+    | Return hm ->
+      // The hash map invariant is satisfied
+      hashMap_t_inv hm /\
+      // The hash map has a length of 0
+      len_s hm = 0 /\
+      // It contains no bindings
+      (forall k. find_s hm k == None)))
+
+(**** [clear] *)
+
+/// [clear] doesn't fail and turns the hash map into an empty map
+val hashMap_clear_lem
+  (#t : Type0) (self : hashMap_t t) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_clear t self with
+    | Fail _ -> False
+    | Return hm ->
+      // The hash map invariant is satisfied
+      hashMap_t_inv hm /\
+      // The hash map has a length of 0
+      len_s hm = 0 /\
+      // It contains no bindings
+      (forall k. find_s hm k == None)))
+
+(**** [len] *)
+
+/// [len] can't fail and returns the length (the number of elements) of the hash map
+val hashMap_len_lem (#t : Type0) (self : hashMap_t t) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_len t self with
+    | Fail _ -> False
+    | Return l -> l = len_s self))
+
+
+(**** [insert'fwd_back] *)
+
+/// The backward function for [insert] (note it is named "...insert'fwd_back" because
+/// the forward function doesn't return anything, and was thus filtered - in a
+/// sense the effect of applying the forward function then the backward function is
+/// entirely encompassed by the effect of the backward function alone).
+/// 
+/// [insert'fwd_back] simply inserts a binding.
+val hashMap_insert_lem
+  (#t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_insert t self key value with
+    | Fail _ ->
+      // We can fail only if:
+      // - the key is not in the map and we thus need to add it
+      None? (find_s self key) /\
+      // - and we are already saturated (we can't increment the internal counter)
+      len_s self = usize_max
+    | Return hm' ->
+      // The invariant is preserved
+      hashMap_t_inv hm' /\
+      // [key] maps to [value]
+      find_s hm' key == Some value /\
+      // The other bindings are preserved
+      (forall k'. k' <> key ==> find_s hm' k' == find_s self k') /\
+      begin
+      // The length is incremented, iff we inserted a new key
+      match find_s self key with
+      | None -> len_s hm' = len_s self + 1
+      | Some _ -> len_s hm' = len_s self
+      end))
+
+
+(**** [contains_key] *)
+
+/// [contains_key'fwd] can't fail and returns `true` if and only if there is
+/// a binding for key [key]
+val hashMap_contains_key_lem
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_contains_key t self key with
+    | Fail _ -> False
+    | Return b -> b = Some? (find_s self key)))
+
+(**** [get'fwd] *)
+
+/// [get] returns (a shared borrow to) the binding for key [key]
+val hashMap_get_lem
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_get t self key, find_s self key with
+    | Fail _, None -> True
+    | Return x, Some x' -> x == x'
+    | _ -> False))
+
+(**** [get_mut'fwd] *)
+
+/// [get_mut'fwd] returns (a mutable borrow to) the binding for key [key].
+/// 
+/// The *forward* function models the action of getting a borrow to an element
+/// in Rust, which gives the possibility of modifying this element in place. Then,
+/// upon ending the borrow, the effect of the modification is modelled in the
+/// translation through a call to the backward function.
+val hashMap_get_mut_lem
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_get_mut t self key, find_s self key with
+    | Fail _, None -> True
+    | Return x, Some x' -> x == x'
+    | _ -> False))
+
+
+(**** [get_mut'back] *)
+
+/// [get_mut'back] updates the binding for key [key], without failing.
+/// A call to [get_mut'back] must follow a call to [get_mut'fwd], which gives
+/// us that there must be a binding for key [key] in the map (otherwise we
+/// can't prove the absence of failure).
+val hashMap_get_mut_back_lem
+  (#t : Type0) (hm : hashMap_t t) (key : usize) (ret : t) :
+  Lemma
+  (requires (
+    hashMap_t_inv hm /\
+    // A call to the backward function must follow a call to the forward
+    // function, whose success gives us that there is a binding for the key.
+    // In the case of *forward* functions, "success" has to be understood as
+    // the absence of panics. When translating code from Rust to pure lambda
+    // calculus, we have the property that the generated calls to the backward
+    // functions can't fail (because their are preceded by calls to forward
+    // functions, which must then have succeeded before): for a backward function,
+    // "failure" is to be understood as the semantics getting stuck.
+    // This is of course true unless we filtered the call to the forward function
+    // because its effect is encompassed by the backward function, as with
+    // [hashMap_clear]).
+    Some? (find_s hm key)))
+  (ensures (
+    match hashMap_get_mut_back t hm key ret with
+    | Fail _ -> False // Can't fail
+    | Return hm' ->
+     // The invariant is preserved
+     hashMap_t_inv hm' /\
+     // The length is preserved
+     len_s hm' = len_s hm /\
+     // [key] maps to the update value, [ret]
+     find_s hm' key == Some ret /\
+     // The other bindings are preserved
+     (forall k'. k' <> key ==> find_s hm' k' == find_s hm k')))
+
+(**** [remove'fwd] *)
+
+/// [remove'fwd] returns the (optional) element which has been removed from the map
+/// (the rust function *moves* it out of the map). Note that the effect of the update
+/// on the map is modelles through the call to [remove'back] ([remove] takes a
+/// mutable borrow to the hash map as parameter).
+val hashMap_remove_lem
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_remove t self key with
+    | Fail _ -> False
+    | Return opt_x -> opt_x == find_s self key))
+
+
+(**** [remove'back] *)
+
+/// The hash map given as parameter to [remove] is given through a mutable borrow:
+/// hence the backward function which gives back the updated map, without the
+/// binding.
+val hashMap_remove_back_lem
+  (#t : Type0) (self : hashMap_t t) (key : usize) :
+  Lemma
+  (requires (hashMap_t_inv self))
+  (ensures (
+    match hashMap_remove_back t self key with
+    | Fail _ -> False
+    | Return hm' ->
+      // The invariant is preserved
+      hashMap_t_inv self /\
+      // The binding for [key] is not there anymore
+      find_s hm' key == None /\
+      // The other bindings are preserved
+      (forall k'. k' <> key ==> find_s hm' k' == find_s self k') /\
+      begin
+      // The length is decremented iff the key was in the map
+      let len = len_s self in
+      let len' = len_s hm' in
+      match find_s self key with
+      | None -> len = len'
+      | Some _ -> len = len' + 1
+      end))
diff --git a/tests/fstar-split/hashmap/Hashmap.Types.fst b/tests/fstar-split/hashmap/Hashmap.Types.fst
new file mode 100644
index 00000000..ef96b1e9
--- /dev/null
+++ b/tests/fstar-split/hashmap/Hashmap.Types.fst
@@ -0,0 +1,23 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap]: type definitions *)
+module Hashmap.Types
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap::List]
+    Source: 'src/hashmap.rs', lines 19:0-19:16 *)
+type list_t (t : Type0) =
+| List_Cons : usize -> t -> list_t t -> list_t t
+| List_Nil : list_t t
+
+(** [hashmap::HashMap]
+    Source: 'src/hashmap.rs', lines 35:0-35:21 *)
+type hashMap_t (t : Type0) =
+{
+  num_entries : usize;
+  max_load_factor : (usize & usize);
+  max_load : usize;
+  slots : alloc_vec_Vec (list_t t);
+}
+
diff --git a/tests/fstar-split/hashmap/Makefile b/tests/fstar-split/hashmap/Makefile
new file mode 100644
index 00000000..fa7d1f36
--- /dev/null
+++ b/tests/fstar-split/hashmap/Makefile
@@ -0,0 +1,49 @@
+# This file was automatically generated - modify ../Makefile.template instead
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/hashmap/Primitives.fst b/tests/fstar-split/hashmap/Primitives.fst
new file mode 100644
index 00000000..a3ffbde4
--- /dev/null
+++ b/tests/fstar-split/hashmap/Primitives.fst
@@ -0,0 +1,884 @@
+/// This file lists primitive and assumed functions and types
+module Primitives
+open FStar.Mul
+open FStar.List.Tot
+
+#set-options "--z3rlimit 15 --fuel 0 --ifuel 1"
+
+(*** Utilities *)
+val list_update (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a) :
+  ls':list a{
+    length ls' = length ls /\
+    index ls' i == x
+  }
+#push-options "--fuel 1"
+let rec list_update #a ls i x =
+  match ls with
+  | x' :: ls -> if i = 0 then x :: ls else x' :: list_update ls (i-1) x
+#pop-options
+
+(*** Result *)
+type error : Type0 =
+| Failure
+| OutOfFuel
+
+type result (a : Type0) : Type0 =
+| Return : v:a -> result a
+| Fail : e:error -> result a
+
+// Monadic return operator
+unfold let return (#a : Type0) (x : a) : result a = Return x
+
+// Monadic bind operator.
+// Allows to use the notation:
+// ```
+// let* x = y in
+// ...
+// ```
+unfold let (let*) (#a #b : Type0) (m: result a)
+  (f: (x:a) -> Pure (result b) (requires (m == Return x)) (ensures fun _ -> True)) :
+  result b =
+  match m with
+  | Return x -> f x
+  | Fail e   -> Fail e
+
+// Monadic assert(...)
+let massert (b:bool) : result unit = if b then Return () else Fail Failure
+
+// Normalize and unwrap a successful result (used for globals).
+let eval_global (#a : Type0) (x : result a{Return? (normalize_term x)}) : a = Return?.v x
+
+(*** Misc *)
+type char = FStar.Char.char
+type string = string
+
+let is_zero (n: nat) : bool = n = 0
+let decrease (n: nat{n > 0}) : nat = n - 1
+
+let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
+let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+
+// We don't really use raw pointers for now
+type mut_raw_ptr (t : Type0) = { v : t }
+type const_raw_ptr (t : Type0) = { v : t }
+
+(*** Scalars *)
+/// Rem.: most of the following code was partially generated
+
+assume val size_numbits : pos
+
+// TODO: we could use FStar.Int.int_t and FStar.UInt.int_t
+
+let isize_min : int = -9223372036854775808 // TODO: should be opaque
+let isize_max : int = 9223372036854775807 // TODO: should be opaque
+let i8_min : int = -128
+let i8_max : int = 127
+let i16_min : int = -32768
+let i16_max : int = 32767
+let i32_min : int = -2147483648
+let i32_max : int = 2147483647
+let i64_min : int = -9223372036854775808
+let i64_max : int = 9223372036854775807
+let i128_min : int = -170141183460469231731687303715884105728
+let i128_max : int = 170141183460469231731687303715884105727
+let usize_min : int = 0
+let usize_max : int = 4294967295 // TODO: should be opaque
+let u8_min : int = 0
+let u8_max : int = 255
+let u16_min : int = 0
+let u16_max : int = 65535
+let u32_min : int = 0
+let u32_max : int = 4294967295
+let u64_min : int = 0
+let u64_max : int = 18446744073709551615
+let u128_min : int = 0
+let u128_max : int = 340282366920938463463374607431768211455
+
+type scalar_ty =
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+let is_unsigned = function
+  | Isize | I8 | I16 | I32 | I64 | I128 -> false
+  | Usize | U8 | U16 | U32 | U64 | U128 -> true
+
+let scalar_min (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_min
+  | I8 -> i8_min
+  | I16 -> i16_min
+  | I32 -> i32_min
+  | I64 -> i64_min
+  | I128 -> i128_min
+  | Usize -> usize_min
+  | U8 -> u8_min
+  | U16 -> u16_min
+  | U32 -> u32_min
+  | U64 -> u64_min
+  | U128 -> u128_min
+
+let scalar_max (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_max
+  | I8 -> i8_max
+  | I16 -> i16_max
+  | I32 -> i32_max
+  | I64 -> i64_max
+  | I128 -> i128_max
+  | Usize -> usize_max
+  | U8 -> u8_max
+  | U16 -> u16_max
+  | U32 -> u32_max
+  | U64 -> u64_max
+  | U128 -> u128_max
+
+type scalar (ty : scalar_ty) : eqtype = x:int{scalar_min ty <= x && x <= scalar_max ty}
+
+let mk_scalar (ty : scalar_ty) (x : int) : result (scalar ty) =
+  if scalar_min ty <= x && scalar_max ty >= x then Return x else Fail Failure
+
+let scalar_neg (#ty : scalar_ty) (x : scalar ty) : result (scalar ty) = mk_scalar ty (-x)
+
+let scalar_div (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (x / y) else Fail Failure
+
+/// The remainder operation
+let int_rem (x : int) (y : int{y <> 0}) : int =
+  if x >= 0 then (x % y) else -(x % y)
+
+(* Checking consistency with Rust *)
+let _ = assert_norm(int_rem 1 2 = 1)
+let _ = assert_norm(int_rem (-1) 2 = -1)
+let _ = assert_norm(int_rem 1 (-2) = 1)
+let _ = assert_norm(int_rem (-1) (-2) = -1)
+
+let scalar_rem (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (int_rem x y) else Fail Failure
+
+let scalar_add (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x + y)
+
+let scalar_sub (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x - y)
+
+let scalar_mul (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x * y)
+
+let scalar_xor (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logxor #8 x y
+  | U16 -> FStar.UInt.logxor #16 x y
+  | U32 -> FStar.UInt.logxor #32 x y
+  | U64 -> FStar.UInt.logxor #64 x y
+  | U128 -> FStar.UInt.logxor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logxor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logxor #16 x y
+  | I32 -> FStar.Int.logxor #32 x y
+  | I64 -> FStar.Int.logxor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logxor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_or (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logor #8 x y
+  | U16 -> FStar.UInt.logor #16 x y
+  | U32 -> FStar.UInt.logor #32 x y
+  | U64 -> FStar.UInt.logor #64 x y
+  | U128 -> FStar.UInt.logor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logor #16 x y
+  | I32 -> FStar.Int.logor #32 x y
+  | I64 -> FStar.Int.logor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_and (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logand #8 x y
+  | U16 -> FStar.UInt.logand #16 x y
+  | U32 -> FStar.UInt.logand #32 x y
+  | U64 -> FStar.UInt.logand #64 x y
+  | U128 -> FStar.UInt.logand #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logand #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logand #16 x y
+  | I32 -> FStar.Int.logand #32 x y
+  | I64 -> FStar.Int.logand #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logand #128 x y
+  | Isize -> admit() // TODO
+
+// Shift left
+let scalar_shl (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+// Shift right
+let scalar_shr (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+(** Cast an integer from a [src_ty] to a [tgt_ty] *)
+// TODO: check the semantics of casts in Rust
+let scalar_cast (src_ty : scalar_ty) (tgt_ty : scalar_ty) (x : scalar src_ty) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty x
+
+// This can't fail, but for now we make all casts faillible (easier for the translation)
+let scalar_cast_bool (tgt_ty : scalar_ty) (x : bool) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty (if x then 1 else 0)
+
+/// The scalar types
+type isize : eqtype = scalar Isize
+type i8    : eqtype = scalar I8
+type i16   : eqtype = scalar I16
+type i32   : eqtype = scalar I32
+type i64   : eqtype = scalar I64
+type i128  : eqtype = scalar I128
+type usize : eqtype = scalar Usize
+type u8    : eqtype = scalar U8
+type u16   : eqtype = scalar U16
+type u32   : eqtype = scalar U32
+type u64   : eqtype = scalar U64
+type u128  : eqtype = scalar U128
+
+
+let core_isize_min : isize = isize_min
+let core_isize_max : isize = isize_max
+let core_i8_min    : i8 = i8_min
+let core_i8_max    : i8 = i8_max
+let core_i16_min   : i16 = i16_min
+let core_i16_max   : i16 = i16_max
+let core_i32_min   : i32 = i32_min
+let core_i32_max   : i32 = i32_max
+let core_i64_min   : i64 = i64_min
+let core_i64_max   : i64 = i64_max
+let core_i128_min  : i128 = i128_min
+let core_i128_max  : i128 = i128_max
+
+let core_usize_min : usize = usize_min
+let core_usize_max : usize = usize_max
+let core_u8_min    : u8 = u8_min
+let core_u8_max    : u8 = u8_max
+let core_u16_min   : u16 = u16_min
+let core_u16_max   : u16 = u16_max
+let core_u32_min   : u32 = u32_min
+let core_u32_max   : u32 = u32_max
+let core_u64_min   : u64 = u64_min
+let core_u64_max   : u64 = u64_max
+let core_u128_min  : u128 = u128_min
+let core_u128_max  : u128 = u128_max
+
+/// Negation
+let isize_neg = scalar_neg #Isize
+let i8_neg = scalar_neg #I8
+let i16_neg = scalar_neg #I16
+let i32_neg = scalar_neg #I32
+let i64_neg = scalar_neg #I64
+let i128_neg = scalar_neg #I128
+
+/// Division
+let isize_div = scalar_div #Isize
+let i8_div = scalar_div #I8
+let i16_div = scalar_div #I16
+let i32_div = scalar_div #I32
+let i64_div = scalar_div #I64
+let i128_div = scalar_div #I128
+let usize_div = scalar_div #Usize
+let u8_div = scalar_div #U8
+let u16_div = scalar_div #U16
+let u32_div = scalar_div #U32
+let u64_div = scalar_div #U64
+let u128_div = scalar_div #U128
+
+/// Remainder
+let isize_rem = scalar_rem #Isize
+let i8_rem = scalar_rem #I8
+let i16_rem = scalar_rem #I16
+let i32_rem = scalar_rem #I32
+let i64_rem = scalar_rem #I64
+let i128_rem = scalar_rem #I128
+let usize_rem = scalar_rem #Usize
+let u8_rem = scalar_rem #U8
+let u16_rem = scalar_rem #U16
+let u32_rem = scalar_rem #U32
+let u64_rem = scalar_rem #U64
+let u128_rem = scalar_rem #U128
+
+/// Addition
+let isize_add = scalar_add #Isize
+let i8_add = scalar_add #I8
+let i16_add = scalar_add #I16
+let i32_add = scalar_add #I32
+let i64_add = scalar_add #I64
+let i128_add = scalar_add #I128
+let usize_add = scalar_add #Usize
+let u8_add = scalar_add #U8
+let u16_add = scalar_add #U16
+let u32_add = scalar_add #U32
+let u64_add = scalar_add #U64
+let u128_add = scalar_add #U128
+
+/// Subtraction
+let isize_sub = scalar_sub #Isize
+let i8_sub = scalar_sub #I8
+let i16_sub = scalar_sub #I16
+let i32_sub = scalar_sub #I32
+let i64_sub = scalar_sub #I64
+let i128_sub = scalar_sub #I128
+let usize_sub = scalar_sub #Usize
+let u8_sub = scalar_sub #U8
+let u16_sub = scalar_sub #U16
+let u32_sub = scalar_sub #U32
+let u64_sub = scalar_sub #U64
+let u128_sub = scalar_sub #U128
+
+/// Multiplication
+let isize_mul = scalar_mul #Isize
+let i8_mul = scalar_mul #I8
+let i16_mul = scalar_mul #I16
+let i32_mul = scalar_mul #I32
+let i64_mul = scalar_mul #I64
+let i128_mul = scalar_mul #I128
+let usize_mul = scalar_mul #Usize
+let u8_mul = scalar_mul #U8
+let u16_mul = scalar_mul #U16
+let u32_mul = scalar_mul #U32
+let u64_mul = scalar_mul #U64
+let u128_mul = scalar_mul #U128
+
+/// Xor
+let u8_xor = scalar_xor #U8
+let u16_xor = scalar_xor #U16
+let u32_xor = scalar_xor #U32
+let u64_xor = scalar_xor #U64
+let u128_xor = scalar_xor #U128
+let usize_xor = scalar_xor #Usize
+let i8_xor = scalar_xor #I8
+let i16_xor = scalar_xor #I16
+let i32_xor = scalar_xor #I32
+let i64_xor = scalar_xor #I64
+let i128_xor = scalar_xor #I128
+let isize_xor = scalar_xor #Isize
+
+/// Or
+let u8_or = scalar_or #U8
+let u16_or = scalar_or #U16
+let u32_or = scalar_or #U32
+let u64_or = scalar_or #U64
+let u128_or = scalar_or #U128
+let usize_or = scalar_or #Usize
+let i8_or = scalar_or #I8
+let i16_or = scalar_or #I16
+let i32_or = scalar_or #I32
+let i64_or = scalar_or #I64
+let i128_or = scalar_or #I128
+let isize_or = scalar_or #Isize
+
+/// And
+let u8_and = scalar_and #U8
+let u16_and = scalar_and #U16
+let u32_and = scalar_and #U32
+let u64_and = scalar_and #U64
+let u128_and = scalar_and #U128
+let usize_and = scalar_and #Usize
+let i8_and = scalar_and #I8
+let i16_and = scalar_and #I16
+let i32_and = scalar_and #I32
+let i64_and = scalar_and #I64
+let i128_and = scalar_and #I128
+let isize_and = scalar_and #Isize
+
+/// Shift left
+let u8_shl #ty = scalar_shl #U8 #ty
+let u16_shl #ty = scalar_shl #U16 #ty
+let u32_shl #ty = scalar_shl #U32 #ty
+let u64_shl #ty = scalar_shl #U64 #ty
+let u128_shl #ty = scalar_shl #U128 #ty
+let usize_shl #ty = scalar_shl #Usize #ty
+let i8_shl #ty = scalar_shl #I8 #ty
+let i16_shl #ty = scalar_shl #I16 #ty
+let i32_shl #ty = scalar_shl #I32 #ty
+let i64_shl #ty = scalar_shl #I64 #ty
+let i128_shl #ty = scalar_shl #I128 #ty
+let isize_shl #ty = scalar_shl #Isize #ty
+
+/// Shift right
+let u8_shr #ty = scalar_shr #U8 #ty
+let u16_shr #ty = scalar_shr #U16 #ty
+let u32_shr #ty = scalar_shr #U32 #ty
+let u64_shr #ty = scalar_shr #U64 #ty
+let u128_shr #ty = scalar_shr #U128 #ty
+let usize_shr #ty = scalar_shr #Usize #ty
+let i8_shr #ty = scalar_shr #I8 #ty
+let i16_shr #ty = scalar_shr #I16 #ty
+let i32_shr #ty = scalar_shr #I32 #ty
+let i64_shr #ty = scalar_shr #I64 #ty
+let i128_shr #ty = scalar_shr #I128 #ty
+let isize_shr #ty = scalar_shr #Isize #ty
+
+(*** core::ops *)
+
+// Trait declaration: [core::ops::index::Index]
+noeq type core_ops_index_Index (self idx : Type0) = {
+  output : Type0;
+  index : self → idx → result output
+}
+
+// Trait declaration: [core::ops::index::IndexMut]
+noeq type core_ops_index_IndexMut (self idx : Type0) = {
+  indexInst : core_ops_index_Index self idx;
+  index_mut : self → idx → result indexInst.output;
+  index_mut_back : self → idx → indexInst.output → result self;
+}
+
+// Trait declaration [core::ops::deref::Deref]
+noeq type core_ops_deref_Deref (self : Type0) = {
+  target : Type0;
+  deref : self → result target;
+}
+
+// Trait declaration [core::ops::deref::DerefMut]
+noeq type core_ops_deref_DerefMut (self : Type0) = {
+  derefInst : core_ops_deref_Deref self;
+  deref_mut : self → result derefInst.target;
+  deref_mut_back : self → derefInst.target → result self;
+}
+
+type core_ops_range_Range (a : Type0) = {
+  start : a;
+  end_ : a;
+}
+
+(*** [alloc] *)
+
+let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
+  target = self;
+  deref = alloc_boxed_Box_deref self;
+}
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
+  derefInst = alloc_boxed_Box_coreopsDerefInst self;
+  deref_mut = alloc_boxed_Box_deref_mut self;
+  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
+}
+
+(*** Array *)
+type array (a : Type0) (n : usize) = s:list a{length s = n}
+
+// We tried putting the normalize_term condition as a refinement on the list
+// but it didn't work. It works with the requires clause.
+let mk_array (a : Type0) (n : usize)
+  (l : list a) :
+  Pure (array a n)
+  (requires (normalize_term(FStar.List.Tot.length l) = n))
+  (ensures (fun _ -> True)) =
+  normalize_term_spec (FStar.List.Tot.length l);
+  l
+
+let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Slice *)
+type slice (a : Type0) = s:list a{length s <= usize_max}
+
+let slice_len (a : Type0) (s : slice a) : usize = length s
+
+let slice_index_usize (a : Type0) (x : slice a) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (slice a) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Subslices *)
+
+let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
+let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : result (array a n) =
+  if length s = n then Return s
+  else Fail Failure
+
+// TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
+let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let array_update_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) (ns : slice a) : result (array a n) =
+  admit()
+
+let array_repeat (a : Type0) (n : usize) (x : a) : array a n =
+  admit()
+
+let slice_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let slice_update_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) (ns : slice a) : result (slice a) =
+  admit()
+
+(*** Vector *)
+type alloc_vec_Vec (a : Type0) = v:list a{length v <= usize_max}
+
+let alloc_vec_Vec_new (a  : Type0) : alloc_vec_Vec a = assert_norm(length #a [] == 0); []
+let alloc_vec_Vec_len (a : Type0) (v : alloc_vec_Vec a) : usize = length v
+
+// Helper
+let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : result a =
+  if i < length v then Return (index v i) else Fail Failure
+// Helper
+let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
+  Pure (result (alloc_vec_Vec a))
+  (requires True)
+  (ensures (fun res ->
+    match res with
+    | Fail e -> e == Failure
+    | Return v' -> length v' = length v + 1)) =
+  if length v < usize_max then begin
+    (**) assert_norm(length [x] == 1);
+    (**) append_length v [x];
+    (**) assert(length (append v [x]) = length v + 1);
+    Return (append v [x])
+    end
+  else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
+  if i < length v then Return () else Fail Failure
+let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// Trait declaration: [core::slice::index::private_slice_index::Sealed]
+type core_slice_index_private_slice_index_Sealed (self : Type0) = unit
+
+// Trait declaration: [core::slice::index::SliceIndex]
+noeq type core_slice_index_SliceIndex (self t : Type0) = {
+  sealedInst : core_slice_index_private_slice_index_Sealed self;
+  output : Type0;
+  get : self → t → result (option output);
+  get_mut : self → t → result (option output);
+  get_mut_back : self → t → option output → result t;
+  get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
+  get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
+  index : self → t → result output;
+  index_mut : self → t → result output;
+  index_mut_back : self → t → output → result t;
+}
+
+// [core::slice::index::[T]::index]: forward function
+let core_slice_index_Slice_index
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (s : slice t) (i : idx) : result inst.output =
+  let* x = inst.get i s in
+  match x with
+  | None -> Fail Failure
+  | Some x -> Return x
+
+// [core::slice::index::Range:::get]: forward function
+let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize) (s : slice t) :
+  result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: forward function
+let core_slice_index_RangeUsize_get_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: backward function 0
+let core_slice_index_RangeUsize_get_mut_back
+  (t : Type0) :
+  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_unchecked]: forward function
+let core_slice_index_RangeUsize_get_unchecked
+  (t : Type0) :
+  core_ops_range_Range usize → const_raw_ptr (slice t) → result (const_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::get_unchecked_mut]: forward function
+let core_slice_index_RangeUsize_get_unchecked_mut
+  (t : Type0) :
+  core_ops_range_Range usize → mut_raw_ptr (slice t) → result (mut_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::index]: forward function
+let core_slice_index_RangeUsize_index
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: forward function
+let core_slice_index_RangeUsize_index_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: backward function 0
+let core_slice_index_RangeUsize_index_mut_back
+  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::[T]::index_mut]: forward function
+let core_slice_index_Slice_index_mut
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → result inst.output =
+  admit () // 
+
+// [core::slice::index::[T]::index_mut]: backward function 0
+let core_slice_index_Slice_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → inst.output → result (slice t) =
+  admit () // TODO
+
+// [core::array::[T; N]::index]: forward function
+let core_array_Array_index
+  (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
+  (a : array t n) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: forward function
+let core_array_Array_index_mut
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) : result inst.indexInst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: backward function 0
+let core_array_Array_index_mut_back
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::Range]
+let core_slice_index_private_slice_index_SealedRangeUsizeInst
+  : core_slice_index_private_slice_index_Sealed (core_ops_range_Range usize) = ()
+
+// Trait implementation: [core::slice::index::Range]
+let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex (core_ops_range_Range usize) (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedRangeUsizeInst;
+  output = slice t;
+  get = core_slice_index_RangeUsize_get t;
+  get_mut = core_slice_index_RangeUsize_get_mut t;
+  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
+  get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
+  index = core_slice_index_RangeUsize_index t;
+  index_mut = core_slice_index_RangeUsize_index_mut t;
+  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (slice t) idx = {
+  output = inst.output;
+  index = core_slice_index_Slice_index t idx inst;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (slice t) idx = {
+  indexInst = core_ops_index_IndexSliceTIInst t idx inst;
+  index_mut = core_slice_index_Slice_index_mut t idx inst;
+  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexArrayInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_Index (slice t) idx) :
+  core_ops_index_Index (array t n) idx = {
+  output = inst.output;
+  index = core_array_Array_index t idx n inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_IndexMut (slice t) idx) :
+  core_ops_index_IndexMut (array t n) idx = {
+  indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
+  index_mut = core_array_Array_index_mut t idx n inst;
+  index_mut_back = core_array_Array_index_mut_back t idx n inst;
+}
+
+// [core::slice::index::usize::get]: forward function
+let core_slice_index_usize_get
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: forward function
+let core_slice_index_usize_get_mut
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: backward function 0
+let core_slice_index_usize_get_mut_back
+  (t : Type0) : usize → slice t → option t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked]: forward function
+let core_slice_index_usize_get_unchecked
+  (t : Type0) : usize → const_raw_ptr (slice t) → result (const_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked_mut]: forward function
+let core_slice_index_usize_get_unchecked_mut
+  (t : Type0) : usize → mut_raw_ptr (slice t) → result (mut_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::index]: forward function
+let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: forward function
+let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: backward function 0
+let core_slice_index_usize_index_mut_back
+  (t : Type0) : usize → slice t → t → result (slice t) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::usize]
+let core_slice_index_private_slice_index_SealedUsizeInst
+  : core_slice_index_private_slice_index_Sealed usize = ()
+
+// Trait implementation: [core::slice::index::usize]
+let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex usize (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedUsizeInst;
+  output = t;
+  get = core_slice_index_usize_get t;
+  get_mut = core_slice_index_usize_get_mut t;
+  get_mut_back = core_slice_index_usize_get_mut_back t;
+  get_unchecked = core_slice_index_usize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
+  index = core_slice_index_usize_index t;
+  index_mut = core_slice_index_usize_index_mut t;
+  index_mut_back = core_slice_index_usize_index_mut_back t;
+}
+
+// [alloc::vec::Vec::index]: forward function
+let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: forward function
+let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: backward function 0
+let alloc_vec_Vec_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  admit () // TODO
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (alloc_vec_Vec t) idx = {
+  output = inst.output;
+  index = alloc_vec_Vec_index t idx inst;
+}
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
+  indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
+  index_mut = alloc_vec_Vec_index_mut t idx inst;
+  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
+}
+
+(*** Theorems *)
+
+let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
+  Lemma (
+    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
+      alloc_vec_Vec_update_usize v i x)
+  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
+  =
+  admit()
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.Template.fst b/tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.Template.fst
new file mode 100644
index 00000000..7b274f59
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.Template.fst
@@ -0,0 +1,72 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap_main]: templates for the decreases clauses *)
+module HashmapMain.Clauses.Template
+open Primitives
+open HashmapMain.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: decreases clause
+    Source: 'src/hashmap.rs', lines 50:4-56:5 *)
+unfold
+let hashmap_HashMap_allocate_slots_loop_decreases (t : Type0)
+  (slots : alloc_vec_Vec (hashmap_List_t t)) (n : usize) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: decreases clause
+    Source: 'src/hashmap.rs', lines 80:4-88:5 *)
+unfold
+let hashmap_HashMap_clear_loop_decreases (t : Type0)
+  (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
+unfold
+let hashmap_HashMap_insert_in_list_loop_decreases (t : Type0) (key : usize)
+  (value : t) (ls : hashmap_List_t t) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 183:4-196:5 *)
+unfold
+let hashmap_HashMap_move_elements_from_list_loop_decreases (t : Type0)
+  (ntable : hashmap_HashMap_t t) (ls : hashmap_List_t t) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: decreases clause
+    Source: 'src/hashmap.rs', lines 171:4-180:5 *)
+unfold
+let hashmap_HashMap_move_elements_loop_decreases (t : Type0)
+  (ntable : hashmap_HashMap_t t) (slots : alloc_vec_Vec (hashmap_List_t t))
+  (i : usize) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 206:4-219:5 *)
+unfold
+let hashmap_HashMap_contains_key_in_list_loop_decreases (t : Type0)
+  (key : usize) (ls : hashmap_List_t t) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 224:4-237:5 *)
+unfold
+let hashmap_HashMap_get_in_list_loop_decreases (t : Type0) (key : usize)
+  (ls : hashmap_List_t t) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
+unfold
+let hashmap_HashMap_get_mut_in_list_loop_decreases (t : Type0)
+  (ls : hashmap_List_t t) (key : usize) : nat =
+  admit ()
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: decreases clause
+    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
+unfold
+let hashmap_HashMap_remove_from_list_loop_decreases (t : Type0) (key : usize)
+  (ls : hashmap_List_t t) : nat =
+  admit ()
+
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.fst b/tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.fst
new file mode 100644
index 00000000..be5a4ab1
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.Clauses.fst
@@ -0,0 +1,61 @@
+(** [hashmap]: the decreases clauses *)
+module HashmapMain.Clauses
+open Primitives
+open FStar.List.Tot
+open HashmapMain.Types
+
+#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
+
+(** [hashmap::HashMap::allocate_slots]: decreases clause *)
+unfold
+let hashmap_HashMap_allocate_slots_loop_decreases (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t))
+  (n : usize) : nat = n
+
+(** [hashmap::HashMap::clear]: decreases clause *)
+unfold
+let hashmap_HashMap_clear_loop_decreases (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t))
+  (i : usize) : nat =
+  if i < length slots then length slots - i else 0
+
+(** [hashmap::HashMap::insert_in_list]: decreases clause *)
+unfold
+let hashmap_HashMap_insert_in_list_loop_decreases (t : Type0) (key : usize) (value : t)
+  (ls : hashmap_List_t t) : hashmap_List_t t =
+  ls
+
+(** [hashmap::HashMap::move_elements_from_list]: decreases clause *)
+unfold
+let hashmap_HashMap_move_elements_from_list_loop_decreases (t : Type0)
+  (ntable : hashmap_HashMap_t t) (ls : hashmap_List_t t) : hashmap_List_t t =
+  ls
+
+(** [hashmap::HashMap::move_elements]: decreases clause *)
+unfold
+let hashmap_HashMap_move_elements_loop_decreases (t : Type0) (ntable : hashmap_HashMap_t t)
+  (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) : nat =
+  if i < length slots then length slots - i else 0
+
+(** [hashmap::HashMap::contains_key_in_list]: decreases clause *)
+unfold
+let hashmap_HashMap_contains_key_in_list_loop_decreases (t : Type0) (key : usize)
+  (ls : hashmap_List_t t) : hashmap_List_t t =
+  ls
+
+(** [hashmap::HashMap::get_in_list]: decreases clause *)
+unfold
+let hashmap_HashMap_get_in_list_loop_decreases (t : Type0) (key : usize) (ls : hashmap_List_t t) :
+  hashmap_List_t t =
+  ls
+
+(** [hashmap::HashMap::get_mut_in_list]: decreases clause *)
+unfold
+let hashmap_HashMap_get_mut_in_list_loop_decreases (t : Type0)
+  (ls : hashmap_List_t t) (key : usize) : hashmap_List_t t =
+  ls
+
+(** [hashmap::HashMap::remove_from_list]: decreases clause *)
+unfold
+let hashmap_HashMap_remove_from_list_loop_decreases (t : Type0) (key : usize)
+  (ls : hashmap_List_t t) : hashmap_List_t t =
+  ls
+
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst b/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst
new file mode 100644
index 00000000..b2800e1e
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst
@@ -0,0 +1,576 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap_main]: function definitions *)
+module HashmapMain.Funs
+open Primitives
+include HashmapMain.Types
+include HashmapMain.FunsExternal
+include HashmapMain.Clauses
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap_main::hashmap::hash_key]: forward function
+    Source: 'src/hashmap.rs', lines 27:0-27:32 *)
+let hashmap_hash_key (k : usize) : result usize =
+  Return k
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 50:4-56:5 *)
+let rec hashmap_HashMap_allocate_slots_loop
+  (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t)) (n : usize) :
+  Tot (result (alloc_vec_Vec (hashmap_List_t t)))
+  (decreases (hashmap_HashMap_allocate_slots_loop_decreases t slots n))
+  =
+  if n > 0
+  then
+    let* slots1 = alloc_vec_Vec_push (hashmap_List_t t) slots Hashmap_List_Nil
+      in
+    let* n1 = usize_sub n 1 in
+    hashmap_HashMap_allocate_slots_loop t slots1 n1
+  else Return slots
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: forward function
+    Source: 'src/hashmap.rs', lines 50:4-50:76 *)
+let hashmap_HashMap_allocate_slots
+  (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t)) (n : usize) :
+  result (alloc_vec_Vec (hashmap_List_t t))
+  =
+  hashmap_HashMap_allocate_slots_loop t slots n
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]: forward function
+    Source: 'src/hashmap.rs', lines 59:4-63:13 *)
+let hashmap_HashMap_new_with_capacity
+  (t : Type0) (capacity : usize) (max_load_dividend : usize)
+  (max_load_divisor : usize) :
+  result (hashmap_HashMap_t t)
+  =
+  let v = alloc_vec_Vec_new (hashmap_List_t t) in
+  let* slots = hashmap_HashMap_allocate_slots t v capacity in
+  let* i = usize_mul capacity max_load_dividend in
+  let* i1 = usize_div i max_load_divisor in
+  Return
+    {
+      num_entries = 0;
+      max_load_factor = (max_load_dividend, max_load_divisor);
+      max_load = i1;
+      slots = slots
+    }
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]: forward function
+    Source: 'src/hashmap.rs', lines 75:4-75:24 *)
+let hashmap_HashMap_new (t : Type0) : result (hashmap_HashMap_t t) =
+  hashmap_HashMap_new_with_capacity t 32 4 5
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 80:4-88:5 *)
+let rec hashmap_HashMap_clear_loop
+  (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) :
+  Tot (result (alloc_vec_Vec (hashmap_List_t t)))
+  (decreases (hashmap_HashMap_clear_loop_decreases t slots i))
+  =
+  let i1 = alloc_vec_Vec_len (hashmap_List_t t) slots in
+  if i < i1
+  then
+    let* i2 = usize_add i 1 in
+    let* slots1 =
+      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t)) slots i
+        Hashmap_List_Nil in
+    hashmap_HashMap_clear_loop t slots1 i2
+  else Return slots
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 80:4-80:27 *)
+let hashmap_HashMap_clear
+  (t : Type0) (self : hashmap_HashMap_t t) : result (hashmap_HashMap_t t) =
+  let* v = hashmap_HashMap_clear_loop t self.slots 0 in
+  Return { self with num_entries = 0; slots = v }
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]: forward function
+    Source: 'src/hashmap.rs', lines 90:4-90:30 *)
+let hashmap_HashMap_len
+  (t : Type0) (self : hashmap_HashMap_t t) : result usize =
+  Return self.num_entries
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
+let rec hashmap_HashMap_insert_in_list_loop
+  (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) :
+  Tot (result bool)
+  (decreases (hashmap_HashMap_insert_in_list_loop_decreases t key value ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey _ tl ->
+    if ckey = key
+    then Return false
+    else hashmap_HashMap_insert_in_list_loop t key value tl
+  | Hashmap_List_Nil -> Return true
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
+let hashmap_HashMap_insert_in_list
+  (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) : result bool =
+  hashmap_HashMap_insert_in_list_loop t key value ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
+    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
+let rec hashmap_HashMap_insert_in_list_loop_back
+  (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) :
+  Tot (result (hashmap_List_t t))
+  (decreases (hashmap_HashMap_insert_in_list_loop_decreases t key value ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey cvalue tl ->
+    if ckey = key
+    then Return (Hashmap_List_Cons ckey value tl)
+    else
+      let* tl1 = hashmap_HashMap_insert_in_list_loop_back t key value tl in
+      Return (Hashmap_List_Cons ckey cvalue tl1)
+  | Hashmap_List_Nil ->
+    let l = Hashmap_List_Nil in Return (Hashmap_List_Cons key value l)
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: backward function 0
+    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
+let hashmap_HashMap_insert_in_list_back
+  (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) :
+  result (hashmap_List_t t)
+  =
+  hashmap_HashMap_insert_in_list_loop_back t key value ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 117:4-117:54 *)
+let hashmap_HashMap_insert_no_resize
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) (value : t) :
+  result (hashmap_HashMap_t t)
+  =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  let* inserted = hashmap_HashMap_insert_in_list t key value l in
+  if inserted
+  then
+    let* i1 = usize_add self.num_entries 1 in
+    let* l1 = hashmap_HashMap_insert_in_list_back t key value l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+        self.slots hash_mod l1 in
+    Return { self with num_entries = i1; slots = v }
+  else
+    let* l1 = hashmap_HashMap_insert_in_list_back t key value l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+        self.slots hash_mod l1 in
+    Return { self with slots = v }
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 183:4-196:5 *)
+let rec hashmap_HashMap_move_elements_from_list_loop
+  (t : Type0) (ntable : hashmap_HashMap_t t) (ls : hashmap_List_t t) :
+  Tot (result (hashmap_HashMap_t t))
+  (decreases (
+    hashmap_HashMap_move_elements_from_list_loop_decreases t ntable ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons k v tl ->
+    let* ntable1 = hashmap_HashMap_insert_no_resize t ntable k v in
+    hashmap_HashMap_move_elements_from_list_loop t ntable1 tl
+  | Hashmap_List_Nil -> Return ntable
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 183:4-183:72 *)
+let hashmap_HashMap_move_elements_from_list
+  (t : Type0) (ntable : hashmap_HashMap_t t) (ls : hashmap_List_t t) :
+  result (hashmap_HashMap_t t)
+  =
+  hashmap_HashMap_move_elements_from_list_loop t ntable ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 171:4-180:5 *)
+let rec hashmap_HashMap_move_elements_loop
+  (t : Type0) (ntable : hashmap_HashMap_t t)
+  (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) :
+  Tot (result ((hashmap_HashMap_t t) & (alloc_vec_Vec (hashmap_List_t t))))
+  (decreases (hashmap_HashMap_move_elements_loop_decreases t ntable slots i))
+  =
+  let i1 = alloc_vec_Vec_len (hashmap_List_t t) slots in
+  if i < i1
+  then
+    let* l =
+      alloc_vec_Vec_index_mut (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t)) slots i
+      in
+    let ls = core_mem_replace (hashmap_List_t t) l Hashmap_List_Nil in
+    let* ntable1 = hashmap_HashMap_move_elements_from_list t ntable ls in
+    let* i2 = usize_add i 1 in
+    let l1 = core_mem_replace_back (hashmap_List_t t) l Hashmap_List_Nil in
+    let* slots1 =
+      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t)) slots i
+        l1 in
+    hashmap_HashMap_move_elements_loop t ntable1 slots1 i2
+  else Return (ntable, slots)
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 171:4-171:95 *)
+let hashmap_HashMap_move_elements
+  (t : Type0) (ntable : hashmap_HashMap_t t)
+  (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) :
+  result ((hashmap_HashMap_t t) & (alloc_vec_Vec (hashmap_List_t t)))
+  =
+  hashmap_HashMap_move_elements_loop t ntable slots i
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 140:4-140:28 *)
+let hashmap_HashMap_try_resize
+  (t : Type0) (self : hashmap_HashMap_t t) : result (hashmap_HashMap_t t) =
+  let* max_usize = scalar_cast U32 Usize core_u32_max in
+  let capacity = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* n1 = usize_div max_usize 2 in
+  let (i, i1) = self.max_load_factor in
+  let* i2 = usize_div n1 i in
+  if capacity <= i2
+  then
+    let* i3 = usize_mul capacity 2 in
+    let* ntable = hashmap_HashMap_new_with_capacity t i3 i i1 in
+    let* (ntable1, _) = hashmap_HashMap_move_elements t ntable self.slots 0 in
+    Return
+      { ntable1 with num_entries = self.num_entries; max_load_factor = (i, i1)
+      }
+  else Return { self with max_load_factor = (i, i1) }
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/hashmap.rs', lines 129:4-129:48 *)
+let hashmap_HashMap_insert
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) (value : t) :
+  result (hashmap_HashMap_t t)
+  =
+  let* self1 = hashmap_HashMap_insert_no_resize t self key value in
+  let* i = hashmap_HashMap_len t self1 in
+  if i > self1.max_load
+  then hashmap_HashMap_try_resize t self1
+  else Return self1
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 206:4-219:5 *)
+let rec hashmap_HashMap_contains_key_in_list_loop
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) :
+  Tot (result bool)
+  (decreases (hashmap_HashMap_contains_key_in_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey _ tl ->
+    if ckey = key
+    then Return true
+    else hashmap_HashMap_contains_key_in_list_loop t key tl
+  | Hashmap_List_Nil -> Return false
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 206:4-206:68 *)
+let hashmap_HashMap_contains_key_in_list
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) : result bool =
+  hashmap_HashMap_contains_key_in_list_loop t key ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]: forward function
+    Source: 'src/hashmap.rs', lines 199:4-199:49 *)
+let hashmap_HashMap_contains_key
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result bool =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  hashmap_HashMap_contains_key_in_list t key l
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 224:4-237:5 *)
+let rec hashmap_HashMap_get_in_list_loop
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) :
+  Tot (result t)
+  (decreases (hashmap_HashMap_get_in_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey cvalue tl ->
+    if ckey = key
+    then Return cvalue
+    else hashmap_HashMap_get_in_list_loop t key tl
+  | Hashmap_List_Nil -> Fail Failure
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 224:4-224:70 *)
+let hashmap_HashMap_get_in_list
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) : result t =
+  hashmap_HashMap_get_in_list_loop t key ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]: forward function
+    Source: 'src/hashmap.rs', lines 239:4-239:55 *)
+let hashmap_HashMap_get
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result t =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  hashmap_HashMap_get_in_list t key l
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
+let rec hashmap_HashMap_get_mut_in_list_loop
+  (t : Type0) (ls : hashmap_List_t t) (key : usize) :
+  Tot (result t)
+  (decreases (hashmap_HashMap_get_mut_in_list_loop_decreases t ls key))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey cvalue tl ->
+    if ckey = key
+    then Return cvalue
+    else hashmap_HashMap_get_mut_in_list_loop t tl key
+  | Hashmap_List_Nil -> Fail Failure
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: forward function
+    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
+let hashmap_HashMap_get_mut_in_list
+  (t : Type0) (ls : hashmap_List_t t) (key : usize) : result t =
+  hashmap_HashMap_get_mut_in_list_loop t ls key
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
+    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
+let rec hashmap_HashMap_get_mut_in_list_loop_back
+  (t : Type0) (ls : hashmap_List_t t) (key : usize) (ret : t) :
+  Tot (result (hashmap_List_t t))
+  (decreases (hashmap_HashMap_get_mut_in_list_loop_decreases t ls key))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey cvalue tl ->
+    if ckey = key
+    then Return (Hashmap_List_Cons ckey ret tl)
+    else
+      let* tl1 = hashmap_HashMap_get_mut_in_list_loop_back t tl key ret in
+      Return (Hashmap_List_Cons ckey cvalue tl1)
+  | Hashmap_List_Nil -> Fail Failure
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
+let hashmap_HashMap_get_mut_in_list_back
+  (t : Type0) (ls : hashmap_List_t t) (key : usize) (ret : t) :
+  result (hashmap_List_t t)
+  =
+  hashmap_HashMap_get_mut_in_list_loop_back t ls key ret
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: forward function
+    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
+let hashmap_HashMap_get_mut
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result t =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  hashmap_HashMap_get_mut_in_list t l key
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: backward function 0
+    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
+let hashmap_HashMap_get_mut_back
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) (ret : t) :
+  result (hashmap_HashMap_t t)
+  =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  let* l1 = hashmap_HashMap_get_mut_in_list_back t l key ret in
+  let* v =
+    alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod l1 in
+  Return { self with slots = v }
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
+    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
+let rec hashmap_HashMap_remove_from_list_loop
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) :
+  Tot (result (option t))
+  (decreases (hashmap_HashMap_remove_from_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey x tl ->
+    if ckey = key
+    then
+      let mv_ls =
+        core_mem_replace (hashmap_List_t t) (Hashmap_List_Cons ckey x tl)
+          Hashmap_List_Nil in
+      begin match mv_ls with
+      | Hashmap_List_Cons _ cvalue _ -> Return (Some cvalue)
+      | Hashmap_List_Nil -> Fail Failure
+      end
+    else hashmap_HashMap_remove_from_list_loop t key tl
+  | Hashmap_List_Nil -> Return None
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: forward function
+    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
+let hashmap_HashMap_remove_from_list
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) : result (option t) =
+  hashmap_HashMap_remove_from_list_loop t key ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
+    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
+let rec hashmap_HashMap_remove_from_list_loop_back
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) :
+  Tot (result (hashmap_List_t t))
+  (decreases (hashmap_HashMap_remove_from_list_loop_decreases t key ls))
+  =
+  begin match ls with
+  | Hashmap_List_Cons ckey x tl ->
+    if ckey = key
+    then
+      let mv_ls =
+        core_mem_replace (hashmap_List_t t) (Hashmap_List_Cons ckey x tl)
+          Hashmap_List_Nil in
+      begin match mv_ls with
+      | Hashmap_List_Cons _ _ tl1 -> Return tl1
+      | Hashmap_List_Nil -> Fail Failure
+      end
+    else
+      let* tl1 = hashmap_HashMap_remove_from_list_loop_back t key tl in
+      Return (Hashmap_List_Cons ckey x tl1)
+  | Hashmap_List_Nil -> Return Hashmap_List_Nil
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: backward function 1
+    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
+let hashmap_HashMap_remove_from_list_back
+  (t : Type0) (key : usize) (ls : hashmap_List_t t) :
+  result (hashmap_List_t t)
+  =
+  hashmap_HashMap_remove_from_list_loop_back t key ls
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: forward function
+    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
+let hashmap_HashMap_remove
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result (option t) =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  let* x = hashmap_HashMap_remove_from_list t key l in
+  begin match x with
+  | None -> Return None
+  | Some x1 -> let* _ = usize_sub self.num_entries 1 in Return (Some x1)
+  end
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: backward function 0
+    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
+let hashmap_HashMap_remove_back
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) :
+  result (hashmap_HashMap_t t)
+  =
+  let* hash = hashmap_hash_key key in
+  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
+  let* hash_mod = usize_rem hash i in
+  let* l =
+    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+      self.slots hash_mod in
+  let* x = hashmap_HashMap_remove_from_list t key l in
+  begin match x with
+  | None ->
+    let* l1 = hashmap_HashMap_remove_from_list_back t key l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+        self.slots hash_mod l1 in
+    Return { self with slots = v }
+  | Some _ ->
+    let* i1 = usize_sub self.num_entries 1 in
+    let* l1 = hashmap_HashMap_remove_from_list_back t key l in
+    let* v =
+      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
+        self.slots hash_mod l1 in
+    Return { self with num_entries = i1; slots = v }
+  end
+
+(** [hashmap_main::hashmap::test1]: forward function
+    Source: 'src/hashmap.rs', lines 315:0-315:10 *)
+let hashmap_test1 : result unit =
+  let* hm = hashmap_HashMap_new u64 in
+  let* hm1 = hashmap_HashMap_insert u64 hm 0 42 in
+  let* hm2 = hashmap_HashMap_insert u64 hm1 128 18 in
+  let* hm3 = hashmap_HashMap_insert u64 hm2 1024 138 in
+  let* hm4 = hashmap_HashMap_insert u64 hm3 1056 256 in
+  let* i = hashmap_HashMap_get u64 hm4 128 in
+  if not (i = 18)
+  then Fail Failure
+  else
+    let* hm5 = hashmap_HashMap_get_mut_back u64 hm4 1024 56 in
+    let* i1 = hashmap_HashMap_get u64 hm5 1024 in
+    if not (i1 = 56)
+    then Fail Failure
+    else
+      let* x = hashmap_HashMap_remove u64 hm5 1024 in
+      begin match x with
+      | None -> Fail Failure
+      | Some x1 ->
+        if not (x1 = 56)
+        then Fail Failure
+        else
+          let* hm6 = hashmap_HashMap_remove_back u64 hm5 1024 in
+          let* i2 = hashmap_HashMap_get u64 hm6 0 in
+          if not (i2 = 42)
+          then Fail Failure
+          else
+            let* i3 = hashmap_HashMap_get u64 hm6 128 in
+            if not (i3 = 18)
+            then Fail Failure
+            else
+              let* i4 = hashmap_HashMap_get u64 hm6 1056 in
+              if not (i4 = 256) then Fail Failure else Return ()
+      end
+
+(** [hashmap_main::insert_on_disk]: forward function
+    Source: 'src/hashmap_main.rs', lines 7:0-7:43 *)
+let insert_on_disk
+  (key : usize) (value : u64) (st : state) : result (state & unit) =
+  let* (st1, hm) = hashmap_utils_deserialize st in
+  let* hm1 = hashmap_HashMap_insert u64 hm key value in
+  let* (st2, _) = hashmap_utils_serialize hm1 st1 in
+  Return (st2, ())
+
+(** [hashmap_main::main]: forward function
+    Source: 'src/hashmap_main.rs', lines 16:0-16:13 *)
+let main : result unit =
+  Return ()
+
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.FunsExternal.fsti b/tests/fstar-split/hashmap_on_disk/HashmapMain.FunsExternal.fsti
new file mode 100644
index 00000000..b00bbcde
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.FunsExternal.fsti
@@ -0,0 +1,18 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap_main]: external function declarations *)
+module HashmapMain.FunsExternal
+open Primitives
+include HashmapMain.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap_main::hashmap_utils::deserialize]: forward function
+    Source: 'src/hashmap_utils.rs', lines 10:0-10:43 *)
+val hashmap_utils_deserialize
+  : state -> result (state & (hashmap_HashMap_t u64))
+
+(** [hashmap_main::hashmap_utils::serialize]: forward function
+    Source: 'src/hashmap_utils.rs', lines 5:0-5:42 *)
+val hashmap_utils_serialize
+  : hashmap_HashMap_t u64 -> state -> result (state & unit)
+
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.Properties.fst b/tests/fstar-split/hashmap_on_disk/HashmapMain.Properties.fst
new file mode 100644
index 00000000..358df29e
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.Properties.fst
@@ -0,0 +1,48 @@
+(** Properties about the hashmap written on disk *)
+module HashmapMain.Properties
+open Primitives
+open HashmapMain.Funs
+
+#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
+
+/// Below, we focus on the functions to read from disk/write to disk to showcase
+/// how such reasoning which mixes opaque functions together with a state-error
+/// monad can be performed.
+
+(*** Hypotheses *)
+
+/// [state_v] gives us the hash map currently stored on disk
+assume
+val state_v : state -> hashmap_HashMap_t u64
+
+/// [serialize] updates the hash map stored on disk
+assume
+val serialize_lem (hm : hashmap_HashMap_t u64) (st : state) : Lemma (
+  match hashmap_utils_serialize hm st with
+  | Fail _ -> True
+  | Return (st', ()) -> state_v st' == hm)
+  [SMTPat (hashmap_utils_serialize hm st)]
+
+/// [deserialize] gives us the hash map stored on disk, without updating it
+assume
+val deserialize_lem (st : state) : Lemma (
+  match hashmap_utils_deserialize st with
+  | Fail _ -> True
+  | Return (st', hm) -> hm == state_v st /\ st' == st)
+  [SMTPat (hashmap_utils_deserialize st)]
+
+(*** Lemmas *)
+
+/// The obvious lemma about [insert_on_disk]: the updated hash map stored on disk
+/// is exactly the hash map produced from inserting the binding ([key], [value])
+/// in the hash map previously stored on disk.
+val insert_on_disk_lem (key : usize) (value : u64) (st : state) : Lemma (
+  match insert_on_disk key value st with
+  | Fail _ -> True
+  | Return (st', ()) ->
+    let hm = state_v st in
+    match hashmap_HashMap_insert u64 hm key value with
+    | Fail _ -> False
+    | Return hm' -> hm' == state_v st')
+
+let insert_on_disk_lem key value st = ()
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.Types.fst b/tests/fstar-split/hashmap_on_disk/HashmapMain.Types.fst
new file mode 100644
index 00000000..afebcde3
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.Types.fst
@@ -0,0 +1,24 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap_main]: type definitions *)
+module HashmapMain.Types
+open Primitives
+include HashmapMain.TypesExternal
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [hashmap_main::hashmap::List]
+    Source: 'src/hashmap.rs', lines 19:0-19:16 *)
+type hashmap_List_t (t : Type0) =
+| Hashmap_List_Cons : usize -> t -> hashmap_List_t t -> hashmap_List_t t
+| Hashmap_List_Nil : hashmap_List_t t
+
+(** [hashmap_main::hashmap::HashMap]
+    Source: 'src/hashmap.rs', lines 35:0-35:21 *)
+type hashmap_HashMap_t (t : Type0) =
+{
+  num_entries : usize;
+  max_load_factor : (usize & usize);
+  max_load : usize;
+  slots : alloc_vec_Vec (hashmap_List_t t);
+}
+
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.TypesExternal.fsti b/tests/fstar-split/hashmap_on_disk/HashmapMain.TypesExternal.fsti
new file mode 100644
index 00000000..75747408
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.TypesExternal.fsti
@@ -0,0 +1,10 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [hashmap_main]: external type declarations *)
+module HashmapMain.TypesExternal
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** The state type used in the state-error monad *)
+val state : Type0
+
diff --git a/tests/fstar-split/hashmap_on_disk/Makefile b/tests/fstar-split/hashmap_on_disk/Makefile
new file mode 100644
index 00000000..fa7d1f36
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/Makefile
@@ -0,0 +1,49 @@
+# This file was automatically generated - modify ../Makefile.template instead
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/hashmap_on_disk/Primitives.fst b/tests/fstar-split/hashmap_on_disk/Primitives.fst
new file mode 100644
index 00000000..a3ffbde4
--- /dev/null
+++ b/tests/fstar-split/hashmap_on_disk/Primitives.fst
@@ -0,0 +1,884 @@
+/// This file lists primitive and assumed functions and types
+module Primitives
+open FStar.Mul
+open FStar.List.Tot
+
+#set-options "--z3rlimit 15 --fuel 0 --ifuel 1"
+
+(*** Utilities *)
+val list_update (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a) :
+  ls':list a{
+    length ls' = length ls /\
+    index ls' i == x
+  }
+#push-options "--fuel 1"
+let rec list_update #a ls i x =
+  match ls with
+  | x' :: ls -> if i = 0 then x :: ls else x' :: list_update ls (i-1) x
+#pop-options
+
+(*** Result *)
+type error : Type0 =
+| Failure
+| OutOfFuel
+
+type result (a : Type0) : Type0 =
+| Return : v:a -> result a
+| Fail : e:error -> result a
+
+// Monadic return operator
+unfold let return (#a : Type0) (x : a) : result a = Return x
+
+// Monadic bind operator.
+// Allows to use the notation:
+// ```
+// let* x = y in
+// ...
+// ```
+unfold let (let*) (#a #b : Type0) (m: result a)
+  (f: (x:a) -> Pure (result b) (requires (m == Return x)) (ensures fun _ -> True)) :
+  result b =
+  match m with
+  | Return x -> f x
+  | Fail e   -> Fail e
+
+// Monadic assert(...)
+let massert (b:bool) : result unit = if b then Return () else Fail Failure
+
+// Normalize and unwrap a successful result (used for globals).
+let eval_global (#a : Type0) (x : result a{Return? (normalize_term x)}) : a = Return?.v x
+
+(*** Misc *)
+type char = FStar.Char.char
+type string = string
+
+let is_zero (n: nat) : bool = n = 0
+let decrease (n: nat{n > 0}) : nat = n - 1
+
+let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
+let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+
+// We don't really use raw pointers for now
+type mut_raw_ptr (t : Type0) = { v : t }
+type const_raw_ptr (t : Type0) = { v : t }
+
+(*** Scalars *)
+/// Rem.: most of the following code was partially generated
+
+assume val size_numbits : pos
+
+// TODO: we could use FStar.Int.int_t and FStar.UInt.int_t
+
+let isize_min : int = -9223372036854775808 // TODO: should be opaque
+let isize_max : int = 9223372036854775807 // TODO: should be opaque
+let i8_min : int = -128
+let i8_max : int = 127
+let i16_min : int = -32768
+let i16_max : int = 32767
+let i32_min : int = -2147483648
+let i32_max : int = 2147483647
+let i64_min : int = -9223372036854775808
+let i64_max : int = 9223372036854775807
+let i128_min : int = -170141183460469231731687303715884105728
+let i128_max : int = 170141183460469231731687303715884105727
+let usize_min : int = 0
+let usize_max : int = 4294967295 // TODO: should be opaque
+let u8_min : int = 0
+let u8_max : int = 255
+let u16_min : int = 0
+let u16_max : int = 65535
+let u32_min : int = 0
+let u32_max : int = 4294967295
+let u64_min : int = 0
+let u64_max : int = 18446744073709551615
+let u128_min : int = 0
+let u128_max : int = 340282366920938463463374607431768211455
+
+type scalar_ty =
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+let is_unsigned = function
+  | Isize | I8 | I16 | I32 | I64 | I128 -> false
+  | Usize | U8 | U16 | U32 | U64 | U128 -> true
+
+let scalar_min (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_min
+  | I8 -> i8_min
+  | I16 -> i16_min
+  | I32 -> i32_min
+  | I64 -> i64_min
+  | I128 -> i128_min
+  | Usize -> usize_min
+  | U8 -> u8_min
+  | U16 -> u16_min
+  | U32 -> u32_min
+  | U64 -> u64_min
+  | U128 -> u128_min
+
+let scalar_max (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_max
+  | I8 -> i8_max
+  | I16 -> i16_max
+  | I32 -> i32_max
+  | I64 -> i64_max
+  | I128 -> i128_max
+  | Usize -> usize_max
+  | U8 -> u8_max
+  | U16 -> u16_max
+  | U32 -> u32_max
+  | U64 -> u64_max
+  | U128 -> u128_max
+
+type scalar (ty : scalar_ty) : eqtype = x:int{scalar_min ty <= x && x <= scalar_max ty}
+
+let mk_scalar (ty : scalar_ty) (x : int) : result (scalar ty) =
+  if scalar_min ty <= x && scalar_max ty >= x then Return x else Fail Failure
+
+let scalar_neg (#ty : scalar_ty) (x : scalar ty) : result (scalar ty) = mk_scalar ty (-x)
+
+let scalar_div (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (x / y) else Fail Failure
+
+/// The remainder operation
+let int_rem (x : int) (y : int{y <> 0}) : int =
+  if x >= 0 then (x % y) else -(x % y)
+
+(* Checking consistency with Rust *)
+let _ = assert_norm(int_rem 1 2 = 1)
+let _ = assert_norm(int_rem (-1) 2 = -1)
+let _ = assert_norm(int_rem 1 (-2) = 1)
+let _ = assert_norm(int_rem (-1) (-2) = -1)
+
+let scalar_rem (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (int_rem x y) else Fail Failure
+
+let scalar_add (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x + y)
+
+let scalar_sub (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x - y)
+
+let scalar_mul (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x * y)
+
+let scalar_xor (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logxor #8 x y
+  | U16 -> FStar.UInt.logxor #16 x y
+  | U32 -> FStar.UInt.logxor #32 x y
+  | U64 -> FStar.UInt.logxor #64 x y
+  | U128 -> FStar.UInt.logxor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logxor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logxor #16 x y
+  | I32 -> FStar.Int.logxor #32 x y
+  | I64 -> FStar.Int.logxor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logxor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_or (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logor #8 x y
+  | U16 -> FStar.UInt.logor #16 x y
+  | U32 -> FStar.UInt.logor #32 x y
+  | U64 -> FStar.UInt.logor #64 x y
+  | U128 -> FStar.UInt.logor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logor #16 x y
+  | I32 -> FStar.Int.logor #32 x y
+  | I64 -> FStar.Int.logor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_and (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logand #8 x y
+  | U16 -> FStar.UInt.logand #16 x y
+  | U32 -> FStar.UInt.logand #32 x y
+  | U64 -> FStar.UInt.logand #64 x y
+  | U128 -> FStar.UInt.logand #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logand #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logand #16 x y
+  | I32 -> FStar.Int.logand #32 x y
+  | I64 -> FStar.Int.logand #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logand #128 x y
+  | Isize -> admit() // TODO
+
+// Shift left
+let scalar_shl (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+// Shift right
+let scalar_shr (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+(** Cast an integer from a [src_ty] to a [tgt_ty] *)
+// TODO: check the semantics of casts in Rust
+let scalar_cast (src_ty : scalar_ty) (tgt_ty : scalar_ty) (x : scalar src_ty) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty x
+
+// This can't fail, but for now we make all casts faillible (easier for the translation)
+let scalar_cast_bool (tgt_ty : scalar_ty) (x : bool) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty (if x then 1 else 0)
+
+/// The scalar types
+type isize : eqtype = scalar Isize
+type i8    : eqtype = scalar I8
+type i16   : eqtype = scalar I16
+type i32   : eqtype = scalar I32
+type i64   : eqtype = scalar I64
+type i128  : eqtype = scalar I128
+type usize : eqtype = scalar Usize
+type u8    : eqtype = scalar U8
+type u16   : eqtype = scalar U16
+type u32   : eqtype = scalar U32
+type u64   : eqtype = scalar U64
+type u128  : eqtype = scalar U128
+
+
+let core_isize_min : isize = isize_min
+let core_isize_max : isize = isize_max
+let core_i8_min    : i8 = i8_min
+let core_i8_max    : i8 = i8_max
+let core_i16_min   : i16 = i16_min
+let core_i16_max   : i16 = i16_max
+let core_i32_min   : i32 = i32_min
+let core_i32_max   : i32 = i32_max
+let core_i64_min   : i64 = i64_min
+let core_i64_max   : i64 = i64_max
+let core_i128_min  : i128 = i128_min
+let core_i128_max  : i128 = i128_max
+
+let core_usize_min : usize = usize_min
+let core_usize_max : usize = usize_max
+let core_u8_min    : u8 = u8_min
+let core_u8_max    : u8 = u8_max
+let core_u16_min   : u16 = u16_min
+let core_u16_max   : u16 = u16_max
+let core_u32_min   : u32 = u32_min
+let core_u32_max   : u32 = u32_max
+let core_u64_min   : u64 = u64_min
+let core_u64_max   : u64 = u64_max
+let core_u128_min  : u128 = u128_min
+let core_u128_max  : u128 = u128_max
+
+/// Negation
+let isize_neg = scalar_neg #Isize
+let i8_neg = scalar_neg #I8
+let i16_neg = scalar_neg #I16
+let i32_neg = scalar_neg #I32
+let i64_neg = scalar_neg #I64
+let i128_neg = scalar_neg #I128
+
+/// Division
+let isize_div = scalar_div #Isize
+let i8_div = scalar_div #I8
+let i16_div = scalar_div #I16
+let i32_div = scalar_div #I32
+let i64_div = scalar_div #I64
+let i128_div = scalar_div #I128
+let usize_div = scalar_div #Usize
+let u8_div = scalar_div #U8
+let u16_div = scalar_div #U16
+let u32_div = scalar_div #U32
+let u64_div = scalar_div #U64
+let u128_div = scalar_div #U128
+
+/// Remainder
+let isize_rem = scalar_rem #Isize
+let i8_rem = scalar_rem #I8
+let i16_rem = scalar_rem #I16
+let i32_rem = scalar_rem #I32
+let i64_rem = scalar_rem #I64
+let i128_rem = scalar_rem #I128
+let usize_rem = scalar_rem #Usize
+let u8_rem = scalar_rem #U8
+let u16_rem = scalar_rem #U16
+let u32_rem = scalar_rem #U32
+let u64_rem = scalar_rem #U64
+let u128_rem = scalar_rem #U128
+
+/// Addition
+let isize_add = scalar_add #Isize
+let i8_add = scalar_add #I8
+let i16_add = scalar_add #I16
+let i32_add = scalar_add #I32
+let i64_add = scalar_add #I64
+let i128_add = scalar_add #I128
+let usize_add = scalar_add #Usize
+let u8_add = scalar_add #U8
+let u16_add = scalar_add #U16
+let u32_add = scalar_add #U32
+let u64_add = scalar_add #U64
+let u128_add = scalar_add #U128
+
+/// Subtraction
+let isize_sub = scalar_sub #Isize
+let i8_sub = scalar_sub #I8
+let i16_sub = scalar_sub #I16
+let i32_sub = scalar_sub #I32
+let i64_sub = scalar_sub #I64
+let i128_sub = scalar_sub #I128
+let usize_sub = scalar_sub #Usize
+let u8_sub = scalar_sub #U8
+let u16_sub = scalar_sub #U16
+let u32_sub = scalar_sub #U32
+let u64_sub = scalar_sub #U64
+let u128_sub = scalar_sub #U128
+
+/// Multiplication
+let isize_mul = scalar_mul #Isize
+let i8_mul = scalar_mul #I8
+let i16_mul = scalar_mul #I16
+let i32_mul = scalar_mul #I32
+let i64_mul = scalar_mul #I64
+let i128_mul = scalar_mul #I128
+let usize_mul = scalar_mul #Usize
+let u8_mul = scalar_mul #U8
+let u16_mul = scalar_mul #U16
+let u32_mul = scalar_mul #U32
+let u64_mul = scalar_mul #U64
+let u128_mul = scalar_mul #U128
+
+/// Xor
+let u8_xor = scalar_xor #U8
+let u16_xor = scalar_xor #U16
+let u32_xor = scalar_xor #U32
+let u64_xor = scalar_xor #U64
+let u128_xor = scalar_xor #U128
+let usize_xor = scalar_xor #Usize
+let i8_xor = scalar_xor #I8
+let i16_xor = scalar_xor #I16
+let i32_xor = scalar_xor #I32
+let i64_xor = scalar_xor #I64
+let i128_xor = scalar_xor #I128
+let isize_xor = scalar_xor #Isize
+
+/// Or
+let u8_or = scalar_or #U8
+let u16_or = scalar_or #U16
+let u32_or = scalar_or #U32
+let u64_or = scalar_or #U64
+let u128_or = scalar_or #U128
+let usize_or = scalar_or #Usize
+let i8_or = scalar_or #I8
+let i16_or = scalar_or #I16
+let i32_or = scalar_or #I32
+let i64_or = scalar_or #I64
+let i128_or = scalar_or #I128
+let isize_or = scalar_or #Isize
+
+/// And
+let u8_and = scalar_and #U8
+let u16_and = scalar_and #U16
+let u32_and = scalar_and #U32
+let u64_and = scalar_and #U64
+let u128_and = scalar_and #U128
+let usize_and = scalar_and #Usize
+let i8_and = scalar_and #I8
+let i16_and = scalar_and #I16
+let i32_and = scalar_and #I32
+let i64_and = scalar_and #I64
+let i128_and = scalar_and #I128
+let isize_and = scalar_and #Isize
+
+/// Shift left
+let u8_shl #ty = scalar_shl #U8 #ty
+let u16_shl #ty = scalar_shl #U16 #ty
+let u32_shl #ty = scalar_shl #U32 #ty
+let u64_shl #ty = scalar_shl #U64 #ty
+let u128_shl #ty = scalar_shl #U128 #ty
+let usize_shl #ty = scalar_shl #Usize #ty
+let i8_shl #ty = scalar_shl #I8 #ty
+let i16_shl #ty = scalar_shl #I16 #ty
+let i32_shl #ty = scalar_shl #I32 #ty
+let i64_shl #ty = scalar_shl #I64 #ty
+let i128_shl #ty = scalar_shl #I128 #ty
+let isize_shl #ty = scalar_shl #Isize #ty
+
+/// Shift right
+let u8_shr #ty = scalar_shr #U8 #ty
+let u16_shr #ty = scalar_shr #U16 #ty
+let u32_shr #ty = scalar_shr #U32 #ty
+let u64_shr #ty = scalar_shr #U64 #ty
+let u128_shr #ty = scalar_shr #U128 #ty
+let usize_shr #ty = scalar_shr #Usize #ty
+let i8_shr #ty = scalar_shr #I8 #ty
+let i16_shr #ty = scalar_shr #I16 #ty
+let i32_shr #ty = scalar_shr #I32 #ty
+let i64_shr #ty = scalar_shr #I64 #ty
+let i128_shr #ty = scalar_shr #I128 #ty
+let isize_shr #ty = scalar_shr #Isize #ty
+
+(*** core::ops *)
+
+// Trait declaration: [core::ops::index::Index]
+noeq type core_ops_index_Index (self idx : Type0) = {
+  output : Type0;
+  index : self → idx → result output
+}
+
+// Trait declaration: [core::ops::index::IndexMut]
+noeq type core_ops_index_IndexMut (self idx : Type0) = {
+  indexInst : core_ops_index_Index self idx;
+  index_mut : self → idx → result indexInst.output;
+  index_mut_back : self → idx → indexInst.output → result self;
+}
+
+// Trait declaration [core::ops::deref::Deref]
+noeq type core_ops_deref_Deref (self : Type0) = {
+  target : Type0;
+  deref : self → result target;
+}
+
+// Trait declaration [core::ops::deref::DerefMut]
+noeq type core_ops_deref_DerefMut (self : Type0) = {
+  derefInst : core_ops_deref_Deref self;
+  deref_mut : self → result derefInst.target;
+  deref_mut_back : self → derefInst.target → result self;
+}
+
+type core_ops_range_Range (a : Type0) = {
+  start : a;
+  end_ : a;
+}
+
+(*** [alloc] *)
+
+let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
+  target = self;
+  deref = alloc_boxed_Box_deref self;
+}
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
+  derefInst = alloc_boxed_Box_coreopsDerefInst self;
+  deref_mut = alloc_boxed_Box_deref_mut self;
+  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
+}
+
+(*** Array *)
+type array (a : Type0) (n : usize) = s:list a{length s = n}
+
+// We tried putting the normalize_term condition as a refinement on the list
+// but it didn't work. It works with the requires clause.
+let mk_array (a : Type0) (n : usize)
+  (l : list a) :
+  Pure (array a n)
+  (requires (normalize_term(FStar.List.Tot.length l) = n))
+  (ensures (fun _ -> True)) =
+  normalize_term_spec (FStar.List.Tot.length l);
+  l
+
+let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Slice *)
+type slice (a : Type0) = s:list a{length s <= usize_max}
+
+let slice_len (a : Type0) (s : slice a) : usize = length s
+
+let slice_index_usize (a : Type0) (x : slice a) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (slice a) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Subslices *)
+
+let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
+let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : result (array a n) =
+  if length s = n then Return s
+  else Fail Failure
+
+// TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
+let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let array_update_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) (ns : slice a) : result (array a n) =
+  admit()
+
+let array_repeat (a : Type0) (n : usize) (x : a) : array a n =
+  admit()
+
+let slice_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let slice_update_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) (ns : slice a) : result (slice a) =
+  admit()
+
+(*** Vector *)
+type alloc_vec_Vec (a : Type0) = v:list a{length v <= usize_max}
+
+let alloc_vec_Vec_new (a  : Type0) : alloc_vec_Vec a = assert_norm(length #a [] == 0); []
+let alloc_vec_Vec_len (a : Type0) (v : alloc_vec_Vec a) : usize = length v
+
+// Helper
+let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : result a =
+  if i < length v then Return (index v i) else Fail Failure
+// Helper
+let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
+  Pure (result (alloc_vec_Vec a))
+  (requires True)
+  (ensures (fun res ->
+    match res with
+    | Fail e -> e == Failure
+    | Return v' -> length v' = length v + 1)) =
+  if length v < usize_max then begin
+    (**) assert_norm(length [x] == 1);
+    (**) append_length v [x];
+    (**) assert(length (append v [x]) = length v + 1);
+    Return (append v [x])
+    end
+  else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
+  if i < length v then Return () else Fail Failure
+let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// Trait declaration: [core::slice::index::private_slice_index::Sealed]
+type core_slice_index_private_slice_index_Sealed (self : Type0) = unit
+
+// Trait declaration: [core::slice::index::SliceIndex]
+noeq type core_slice_index_SliceIndex (self t : Type0) = {
+  sealedInst : core_slice_index_private_slice_index_Sealed self;
+  output : Type0;
+  get : self → t → result (option output);
+  get_mut : self → t → result (option output);
+  get_mut_back : self → t → option output → result t;
+  get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
+  get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
+  index : self → t → result output;
+  index_mut : self → t → result output;
+  index_mut_back : self → t → output → result t;
+}
+
+// [core::slice::index::[T]::index]: forward function
+let core_slice_index_Slice_index
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (s : slice t) (i : idx) : result inst.output =
+  let* x = inst.get i s in
+  match x with
+  | None -> Fail Failure
+  | Some x -> Return x
+
+// [core::slice::index::Range:::get]: forward function
+let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize) (s : slice t) :
+  result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: forward function
+let core_slice_index_RangeUsize_get_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: backward function 0
+let core_slice_index_RangeUsize_get_mut_back
+  (t : Type0) :
+  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_unchecked]: forward function
+let core_slice_index_RangeUsize_get_unchecked
+  (t : Type0) :
+  core_ops_range_Range usize → const_raw_ptr (slice t) → result (const_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::get_unchecked_mut]: forward function
+let core_slice_index_RangeUsize_get_unchecked_mut
+  (t : Type0) :
+  core_ops_range_Range usize → mut_raw_ptr (slice t) → result (mut_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::index]: forward function
+let core_slice_index_RangeUsize_index
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: forward function
+let core_slice_index_RangeUsize_index_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: backward function 0
+let core_slice_index_RangeUsize_index_mut_back
+  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::[T]::index_mut]: forward function
+let core_slice_index_Slice_index_mut
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → result inst.output =
+  admit () // 
+
+// [core::slice::index::[T]::index_mut]: backward function 0
+let core_slice_index_Slice_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → inst.output → result (slice t) =
+  admit () // TODO
+
+// [core::array::[T; N]::index]: forward function
+let core_array_Array_index
+  (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
+  (a : array t n) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: forward function
+let core_array_Array_index_mut
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) : result inst.indexInst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: backward function 0
+let core_array_Array_index_mut_back
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::Range]
+let core_slice_index_private_slice_index_SealedRangeUsizeInst
+  : core_slice_index_private_slice_index_Sealed (core_ops_range_Range usize) = ()
+
+// Trait implementation: [core::slice::index::Range]
+let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex (core_ops_range_Range usize) (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedRangeUsizeInst;
+  output = slice t;
+  get = core_slice_index_RangeUsize_get t;
+  get_mut = core_slice_index_RangeUsize_get_mut t;
+  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
+  get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
+  index = core_slice_index_RangeUsize_index t;
+  index_mut = core_slice_index_RangeUsize_index_mut t;
+  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (slice t) idx = {
+  output = inst.output;
+  index = core_slice_index_Slice_index t idx inst;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (slice t) idx = {
+  indexInst = core_ops_index_IndexSliceTIInst t idx inst;
+  index_mut = core_slice_index_Slice_index_mut t idx inst;
+  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexArrayInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_Index (slice t) idx) :
+  core_ops_index_Index (array t n) idx = {
+  output = inst.output;
+  index = core_array_Array_index t idx n inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_IndexMut (slice t) idx) :
+  core_ops_index_IndexMut (array t n) idx = {
+  indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
+  index_mut = core_array_Array_index_mut t idx n inst;
+  index_mut_back = core_array_Array_index_mut_back t idx n inst;
+}
+
+// [core::slice::index::usize::get]: forward function
+let core_slice_index_usize_get
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: forward function
+let core_slice_index_usize_get_mut
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: backward function 0
+let core_slice_index_usize_get_mut_back
+  (t : Type0) : usize → slice t → option t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked]: forward function
+let core_slice_index_usize_get_unchecked
+  (t : Type0) : usize → const_raw_ptr (slice t) → result (const_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked_mut]: forward function
+let core_slice_index_usize_get_unchecked_mut
+  (t : Type0) : usize → mut_raw_ptr (slice t) → result (mut_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::index]: forward function
+let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: forward function
+let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: backward function 0
+let core_slice_index_usize_index_mut_back
+  (t : Type0) : usize → slice t → t → result (slice t) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::usize]
+let core_slice_index_private_slice_index_SealedUsizeInst
+  : core_slice_index_private_slice_index_Sealed usize = ()
+
+// Trait implementation: [core::slice::index::usize]
+let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex usize (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedUsizeInst;
+  output = t;
+  get = core_slice_index_usize_get t;
+  get_mut = core_slice_index_usize_get_mut t;
+  get_mut_back = core_slice_index_usize_get_mut_back t;
+  get_unchecked = core_slice_index_usize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
+  index = core_slice_index_usize_index t;
+  index_mut = core_slice_index_usize_index_mut t;
+  index_mut_back = core_slice_index_usize_index_mut_back t;
+}
+
+// [alloc::vec::Vec::index]: forward function
+let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: forward function
+let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: backward function 0
+let alloc_vec_Vec_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  admit () // TODO
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (alloc_vec_Vec t) idx = {
+  output = inst.output;
+  index = alloc_vec_Vec_index t idx inst;
+}
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
+  indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
+  index_mut = alloc_vec_Vec_index_mut t idx inst;
+  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
+}
+
+(*** Theorems *)
+
+let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
+  Lemma (
+    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
+      alloc_vec_Vec_update_usize v i x)
+  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
+  =
+  admit()
diff --git a/tests/fstar-split/misc/Bitwise.fst b/tests/fstar-split/misc/Bitwise.fst
new file mode 100644
index 00000000..d7ba2c57
--- /dev/null
+++ b/tests/fstar-split/misc/Bitwise.fst
@@ -0,0 +1,32 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [bitwise] *)
+module Bitwise
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [bitwise::shift_u32]: forward function
+    Source: 'src/bitwise.rs', lines 3:0-3:31 *)
+let shift_u32 (a : u32) : result u32 =
+  let* t = u32_shr #Usize a 16 in u32_shl #Usize t 16
+
+(** [bitwise::shift_i32]: forward function
+    Source: 'src/bitwise.rs', lines 10:0-10:31 *)
+let shift_i32 (a : i32) : result i32 =
+  let* t = i32_shr #Isize a 16 in i32_shl #Isize t 16
+
+(** [bitwise::xor_u32]: forward function
+    Source: 'src/bitwise.rs', lines 17:0-17:37 *)
+let xor_u32 (a : u32) (b : u32) : result u32 =
+  Return (u32_xor a b)
+
+(** [bitwise::or_u32]: forward function
+    Source: 'src/bitwise.rs', lines 21:0-21:36 *)
+let or_u32 (a : u32) (b : u32) : result u32 =
+  Return (u32_or a b)
+
+(** [bitwise::and_u32]: forward function
+    Source: 'src/bitwise.rs', lines 25:0-25:37 *)
+let and_u32 (a : u32) (b : u32) : result u32 =
+  Return (u32_and a b)
+
diff --git a/tests/fstar-split/misc/Constants.fst b/tests/fstar-split/misc/Constants.fst
new file mode 100644
index 00000000..7e56cc20
--- /dev/null
+++ b/tests/fstar-split/misc/Constants.fst
@@ -0,0 +1,145 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [constants] *)
+module Constants
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [constants::X0]
+    Source: 'src/constants.rs', lines 5:0-5:17 *)
+let x0_body : result u32 = Return 0
+let x0_c : u32 = eval_global x0_body
+
+(** [constants::X1]
+    Source: 'src/constants.rs', lines 7:0-7:17 *)
+let x1_body : result u32 = Return core_u32_max
+let x1_c : u32 = eval_global x1_body
+
+(** [constants::X2]
+    Source: 'src/constants.rs', lines 10:0-10:17 *)
+let x2_body : result u32 = Return 3
+let x2_c : u32 = eval_global x2_body
+
+(** [constants::incr]: forward function
+    Source: 'src/constants.rs', lines 17:0-17:32 *)
+let incr (n : u32) : result u32 =
+  u32_add n 1
+
+(** [constants::X3]
+    Source: 'src/constants.rs', lines 15:0-15:17 *)
+let x3_body : result u32 = incr 32
+let x3_c : u32 = eval_global x3_body
+
+(** [constants::mk_pair0]: forward function
+    Source: 'src/constants.rs', lines 23:0-23:51 *)
+let mk_pair0 (x : u32) (y : u32) : result (u32 & u32) =
+  Return (x, y)
+
+(** [constants::Pair]
+    Source: 'src/constants.rs', lines 36:0-36:23 *)
+type pair_t (t1 t2 : Type0) = { x : t1; y : t2; }
+
+(** [constants::mk_pair1]: forward function
+    Source: 'src/constants.rs', lines 27:0-27:55 *)
+let mk_pair1 (x : u32) (y : u32) : result (pair_t u32 u32) =
+  Return { x = x; y = y }
+
+(** [constants::P0]
+    Source: 'src/constants.rs', lines 31:0-31:24 *)
+let p0_body : result (u32 & u32) = mk_pair0 0 1
+let p0_c : (u32 & u32) = eval_global p0_body
+
+(** [constants::P1]
+    Source: 'src/constants.rs', lines 32:0-32:28 *)
+let p1_body : result (pair_t u32 u32) = mk_pair1 0 1
+let p1_c : pair_t u32 u32 = eval_global p1_body
+
+(** [constants::P2]
+    Source: 'src/constants.rs', lines 33:0-33:24 *)
+let p2_body : result (u32 & u32) = Return (0, 1)
+let p2_c : (u32 & u32) = eval_global p2_body
+
+(** [constants::P3]
+    Source: 'src/constants.rs', lines 34:0-34:28 *)
+let p3_body : result (pair_t u32 u32) = Return { x = 0; y = 1 }
+let p3_c : pair_t u32 u32 = eval_global p3_body
+
+(** [constants::Wrap]
+    Source: 'src/constants.rs', lines 49:0-49:18 *)
+type wrap_t (t : Type0) = { value : t; }
+
+(** [constants::{constants::Wrap<T>}::new]: forward function
+    Source: 'src/constants.rs', lines 54:4-54:41 *)
+let wrap_new (t : Type0) (value : t) : result (wrap_t t) =
+  Return { value = value }
+
+(** [constants::Y]
+    Source: 'src/constants.rs', lines 41:0-41:22 *)
+let y_body : result (wrap_t i32) = wrap_new i32 2
+let y_c : wrap_t i32 = eval_global y_body
+
+(** [constants::unwrap_y]: forward function
+    Source: 'src/constants.rs', lines 43:0-43:30 *)
+let unwrap_y : result i32 =
+  Return y_c.value
+
+(** [constants::YVAL]
+    Source: 'src/constants.rs', lines 47:0-47:19 *)
+let yval_body : result i32 = unwrap_y
+let yval_c : i32 = eval_global yval_body
+
+(** [constants::get_z1::Z1]
+    Source: 'src/constants.rs', lines 62:4-62:17 *)
+let get_z1_z1_body : result i32 = Return 3
+let get_z1_z1_c : i32 = eval_global get_z1_z1_body
+
+(** [constants::get_z1]: forward function
+    Source: 'src/constants.rs', lines 61:0-61:28 *)
+let get_z1 : result i32 =
+  Return get_z1_z1_c
+
+(** [constants::add]: forward function
+    Source: 'src/constants.rs', lines 66:0-66:39 *)
+let add (a : i32) (b : i32) : result i32 =
+  i32_add a b
+
+(** [constants::Q1]
+    Source: 'src/constants.rs', lines 74:0-74:17 *)
+let q1_body : result i32 = Return 5
+let q1_c : i32 = eval_global q1_body
+
+(** [constants::Q2]
+    Source: 'src/constants.rs', lines 75:0-75:17 *)
+let q2_body : result i32 = Return q1_c
+let q2_c : i32 = eval_global q2_body
+
+(** [constants::Q3]
+    Source: 'src/constants.rs', lines 76:0-76:17 *)
+let q3_body : result i32 = add q2_c 3
+let q3_c : i32 = eval_global q3_body
+
+(** [constants::get_z2]: forward function
+    Source: 'src/constants.rs', lines 70:0-70:28 *)
+let get_z2 : result i32 =
+  let* i = get_z1 in let* i1 = add i q3_c in add q1_c i1
+
+(** [constants::S1]
+    Source: 'src/constants.rs', lines 80:0-80:18 *)
+let s1_body : result u32 = Return 6
+let s1_c : u32 = eval_global s1_body
+
+(** [constants::S2]
+    Source: 'src/constants.rs', lines 81:0-81:18 *)
+let s2_body : result u32 = incr s1_c
+let s2_c : u32 = eval_global s2_body
+
+(** [constants::S3]
+    Source: 'src/constants.rs', lines 82:0-82:29 *)
+let s3_body : result (pair_t u32 u32) = Return p3_c
+let s3_c : pair_t u32 u32 = eval_global s3_body
+
+(** [constants::S4]
+    Source: 'src/constants.rs', lines 83:0-83:29 *)
+let s4_body : result (pair_t u32 u32) = mk_pair1 7 8
+let s4_c : pair_t u32 u32 = eval_global s4_body
+
diff --git a/tests/fstar-split/misc/External.Funs.fst b/tests/fstar-split/misc/External.Funs.fst
new file mode 100644
index 00000000..3b84697e
--- /dev/null
+++ b/tests/fstar-split/misc/External.Funs.fst
@@ -0,0 +1,84 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [external]: function definitions *)
+module External.Funs
+open Primitives
+include External.Types
+include External.FunsExternal
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [external::swap]: forward function
+    Source: 'src/external.rs', lines 6:0-6:46 *)
+let swap (t : Type0) (x : t) (y : t) (st : state) : result (state & unit) =
+  let* (st1, _) = core_mem_swap t x y st in
+  let* (st2, _) = core_mem_swap_back0 t x y st st1 in
+  let* (st3, _) = core_mem_swap_back1 t x y st st2 in
+  Return (st3, ())
+
+(** [external::swap]: backward function 0
+    Source: 'src/external.rs', lines 6:0-6:46 *)
+let swap_back
+  (t : Type0) (x : t) (y : t) (st : state) (st1 : state) :
+  result (state & (t & t))
+  =
+  let* (st2, _) = core_mem_swap t x y st in
+  let* (st3, x1) = core_mem_swap_back0 t x y st st2 in
+  let* (_, y1) = core_mem_swap_back1 t x y st st3 in
+  Return (st1, (x1, y1))
+
+(** [external::test_new_non_zero_u32]: forward function
+    Source: 'src/external.rs', lines 11:0-11:60 *)
+let test_new_non_zero_u32
+  (x : u32) (st : state) : result (state & core_num_nonzero_NonZeroU32_t) =
+  let* (st1, o) = core_num_nonzero_NonZeroU32_new x st in
+  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st1
+
+(** [external::test_vec]: forward function
+    Source: 'src/external.rs', lines 17:0-17:17 *)
+let test_vec : result unit =
+  let v = alloc_vec_Vec_new u32 in
+  let* _ = alloc_vec_Vec_push u32 v 0 in
+  Return ()
+
+(** Unit test for [external::test_vec] *)
+let _ = assert_norm (test_vec = Return ())
+
+(** [external::custom_swap]: forward function
+    Source: 'src/external.rs', lines 24:0-24:66 *)
+let custom_swap (t : Type0) (x : t) (y : t) (st : state) : result (state & t) =
+  let* (st1, _) = core_mem_swap t x y st in
+  let* (st2, x1) = core_mem_swap_back0 t x y st st1 in
+  let* (st3, _) = core_mem_swap_back1 t x y st st2 in
+  Return (st3, x1)
+
+(** [external::custom_swap]: backward function 0
+    Source: 'src/external.rs', lines 24:0-24:66 *)
+let custom_swap_back
+  (t : Type0) (x : t) (y : t) (st : state) (ret : t) (st1 : state) :
+  result (state & (t & t))
+  =
+  let* (st2, _) = core_mem_swap t x y st in
+  let* (st3, _) = core_mem_swap_back0 t x y st st2 in
+  let* (_, y1) = core_mem_swap_back1 t x y st st3 in
+  Return (st1, (ret, y1))
+
+(** [external::test_custom_swap]: forward function
+    Source: 'src/external.rs', lines 29:0-29:59 *)
+let test_custom_swap (x : u32) (y : u32) (st : state) : result (state & unit) =
+  let* (st1, _) = custom_swap u32 x y st in Return (st1, ())
+
+(** [external::test_custom_swap]: backward function 0
+    Source: 'src/external.rs', lines 29:0-29:59 *)
+let test_custom_swap_back
+  (x : u32) (y : u32) (st : state) (st1 : state) :
+  result (state & (u32 & u32))
+  =
+  custom_swap_back u32 x y st 1 st1
+
+(** [external::test_swap_non_zero]: forward function
+    Source: 'src/external.rs', lines 35:0-35:44 *)
+let test_swap_non_zero (x : u32) (st : state) : result (state & u32) =
+  let* (st1, _) = swap u32 x 0 st in
+  let* (st2, (x1, _)) = swap_back u32 x 0 st st1 in
+  if x1 = 0 then Fail Failure else Return (st2, x1)
+
diff --git a/tests/fstar-split/misc/External.FunsExternal.fsti b/tests/fstar-split/misc/External.FunsExternal.fsti
new file mode 100644
index 00000000..923a1101
--- /dev/null
+++ b/tests/fstar-split/misc/External.FunsExternal.fsti
@@ -0,0 +1,32 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [external]: external function declarations *)
+module External.FunsExternal
+open Primitives
+include External.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [core::mem::swap]: forward function
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
+val core_mem_swap (t : Type0) : t -> t -> state -> result (state & unit)
+
+(** [core::mem::swap]: backward function 0
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
+val core_mem_swap_back0
+  (t : Type0) : t -> t -> state -> state -> result (state & t)
+
+(** [core::mem::swap]: backward function 1
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
+val core_mem_swap_back1
+  (t : Type0) : t -> t -> state -> state -> result (state & t)
+
+(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]: forward function
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/num/nonzero.rs', lines 79:16-79:57 *)
+val core_num_nonzero_NonZeroU32_new
+  : u32 -> state -> result (state & (option core_num_nonzero_NonZeroU32_t))
+
+(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
+val core_option_Option_unwrap
+  (t : Type0) : option t -> state -> result (state & t)
+
diff --git a/tests/fstar-split/misc/External.Types.fst b/tests/fstar-split/misc/External.Types.fst
new file mode 100644
index 00000000..4fbcec47
--- /dev/null
+++ b/tests/fstar-split/misc/External.Types.fst
@@ -0,0 +1,8 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [external]: type definitions *)
+module External.Types
+open Primitives
+include External.TypesExternal
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
diff --git a/tests/fstar-split/misc/External.TypesExternal.fsti b/tests/fstar-split/misc/External.TypesExternal.fsti
new file mode 100644
index 00000000..4bfbe0c5
--- /dev/null
+++ b/tests/fstar-split/misc/External.TypesExternal.fsti
@@ -0,0 +1,14 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [external]: external type declarations *)
+module External.TypesExternal
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [core::num::nonzero::NonZeroU32]
+    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/num/nonzero.rs', lines 50:12-50:33 *)
+val core_num_nonzero_NonZeroU32_t : Type0
+
+(** The state type used in the state-error monad *)
+val state : Type0
+
diff --git a/tests/fstar-split/misc/Loops.Clauses.Template.fst b/tests/fstar-split/misc/Loops.Clauses.Template.fst
new file mode 100644
index 00000000..6be351c6
--- /dev/null
+++ b/tests/fstar-split/misc/Loops.Clauses.Template.fst
@@ -0,0 +1,131 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [loops]: templates for the decreases clauses *)
+module Loops.Clauses.Template
+open Primitives
+open Loops.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [loops::sum]: decreases clause
+    Source: 'src/loops.rs', lines 4:0-14:1 *)
+unfold let sum_loop_decreases (max : u32) (i : u32) (s : u32) : nat = admit ()
+
+(** [loops::sum_with_mut_borrows]: decreases clause
+    Source: 'src/loops.rs', lines 19:0-31:1 *)
+unfold
+let sum_with_mut_borrows_loop_decreases (max : u32) (mi : u32) (ms : u32) : nat
+  =
+  admit ()
+
+(** [loops::sum_with_shared_borrows]: decreases clause
+    Source: 'src/loops.rs', lines 34:0-48:1 *)
+unfold
+let sum_with_shared_borrows_loop_decreases (max : u32) (i : u32) (s : u32) :
+  nat =
+  admit ()
+
+(** [loops::clear]: decreases clause
+    Source: 'src/loops.rs', lines 52:0-58:1 *)
+unfold
+let clear_loop_decreases (v : alloc_vec_Vec u32) (i : usize) : nat = admit ()
+
+(** [loops::list_mem]: decreases clause
+    Source: 'src/loops.rs', lines 66:0-75:1 *)
+unfold let list_mem_loop_decreases (x : u32) (ls : list_t u32) : nat = admit ()
+
+(** [loops::list_nth_mut_loop]: decreases clause
+    Source: 'src/loops.rs', lines 78:0-88:1 *)
+unfold
+let list_nth_mut_loop_loop_decreases (t : Type0) (ls : list_t t) (i : u32) :
+  nat =
+  admit ()
+
+(** [loops::list_nth_shared_loop]: decreases clause
+    Source: 'src/loops.rs', lines 91:0-101:1 *)
+unfold
+let list_nth_shared_loop_loop_decreases (t : Type0) (ls : list_t t) (i : u32) :
+  nat =
+  admit ()
+
+(** [loops::get_elem_mut]: decreases clause
+    Source: 'src/loops.rs', lines 103:0-117:1 *)
+unfold
+let get_elem_mut_loop_decreases (x : usize) (ls : list_t usize) : nat =
+  admit ()
+
+(** [loops::get_elem_shared]: decreases clause
+    Source: 'src/loops.rs', lines 119:0-133:1 *)
+unfold
+let get_elem_shared_loop_decreases (x : usize) (ls : list_t usize) : nat =
+  admit ()
+
+(** [loops::list_nth_mut_loop_with_id]: decreases clause
+    Source: 'src/loops.rs', lines 144:0-155:1 *)
+unfold
+let list_nth_mut_loop_with_id_loop_decreases (t : Type0) (i : u32)
+  (ls : list_t t) : nat =
+  admit ()
+
+(** [loops::list_nth_shared_loop_with_id]: decreases clause
+    Source: 'src/loops.rs', lines 158:0-169:1 *)
+unfold
+let list_nth_shared_loop_with_id_loop_decreases (t : Type0) (i : u32)
+  (ls : list_t t) : nat =
+  admit ()
+
+(** [loops::list_nth_mut_loop_pair]: decreases clause
+    Source: 'src/loops.rs', lines 174:0-195:1 *)
+unfold
+let list_nth_mut_loop_pair_loop_decreases (t : Type0) (ls0 : list_t t)
+  (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_shared_loop_pair]: decreases clause
+    Source: 'src/loops.rs', lines 198:0-219:1 *)
+unfold
+let list_nth_shared_loop_pair_loop_decreases (t : Type0) (ls0 : list_t t)
+  (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_mut_loop_pair_merge]: decreases clause
+    Source: 'src/loops.rs', lines 223:0-238:1 *)
+unfold
+let list_nth_mut_loop_pair_merge_loop_decreases (t : Type0) (ls0 : list_t t)
+  (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_shared_loop_pair_merge]: decreases clause
+    Source: 'src/loops.rs', lines 241:0-256:1 *)
+unfold
+let list_nth_shared_loop_pair_merge_loop_decreases (t : Type0) (ls0 : list_t t)
+  (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_mut_shared_loop_pair]: decreases clause
+    Source: 'src/loops.rs', lines 259:0-274:1 *)
+unfold
+let list_nth_mut_shared_loop_pair_loop_decreases (t : Type0) (ls0 : list_t t)
+  (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_mut_shared_loop_pair_merge]: decreases clause
+    Source: 'src/loops.rs', lines 278:0-293:1 *)
+unfold
+let list_nth_mut_shared_loop_pair_merge_loop_decreases (t : Type0)
+  (ls0 : list_t t) (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_shared_mut_loop_pair]: decreases clause
+    Source: 'src/loops.rs', lines 297:0-312:1 *)
+unfold
+let list_nth_shared_mut_loop_pair_loop_decreases (t : Type0) (ls0 : list_t t)
+  (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
+(** [loops::list_nth_shared_mut_loop_pair_merge]: decreases clause
+    Source: 'src/loops.rs', lines 316:0-331:1 *)
+unfold
+let list_nth_shared_mut_loop_pair_merge_loop_decreases (t : Type0)
+  (ls0 : list_t t) (ls1 : list_t t) (i : u32) : nat =
+  admit ()
+
diff --git a/tests/fstar-split/misc/Loops.Clauses.fst b/tests/fstar-split/misc/Loops.Clauses.fst
new file mode 100644
index 00000000..75194437
--- /dev/null
+++ b/tests/fstar-split/misc/Loops.Clauses.fst
@@ -0,0 +1,107 @@
+(** [loops]: templates for the decreases clauses *)
+module Loops.Clauses
+open Primitives
+open Loops.Types
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [loops::sum]: decreases clause *)
+unfold let sum_loop_decreases (max : u32) (i : u32) (s : u32) : nat =
+  if i <= max then max - i else 0
+
+(** [loops::sum_with_mut_borrows]: decreases clause *)
+unfold
+let sum_with_mut_borrows_loop_decreases (max : u32) (mi : u32) (ms : u32) : nat =
+  if max >= mi then max - mi else 0
+
+(** [loops::sum_with_shared_borrows]: decreases clause *)
+unfold
+let sum_with_shared_borrows_loop_decreases (max : u32) (i : u32) (s : u32) : nat =
+  if max >= i then max - i else 0
+
+(** [loops::clear]: decreases clause *)
+unfold let clear_loop_decreases (v : alloc_vec_Vec u32) (i : usize) : nat =
+  if i <= List.Tot.length v then List.Tot.length v - i else 0
+
+(** [loops::list_mem]: decreases clause *)
+unfold let list_mem_loop_decreases (i : u32) (ls : list_t u32) : list_t u32 =
+  ls
+
+(** [loops::list_nth_mut_loop]: decreases clause *)
+unfold
+let list_nth_mut_loop_loop_decreases (t : Type0) (ls : list_t t) (i : u32) : nat =
+  i
+
+(** [loops::list_nth_shared_loop]: decreases clause *)
+unfold
+let list_nth_shared_loop_loop_decreases (t : Type0) (ls : list_t t) (i : u32) : list_t t =
+  ls
+
+(** [loops::get_elem_mut]: decreases clause *)
+unfold
+let get_elem_mut_loop_decreases (x : usize) (ls : list_t usize) : list_t usize = ls
+
+(** [loops::get_elem_shared]: decreases clause *)
+unfold
+let get_elem_shared_loop_decreases (x : usize) (ls : list_t usize) : list_t usize =
+  ls
+
+(** [loops::list_nth_mut_loop_with_id]: decreases clause *)
+unfold
+let list_nth_mut_loop_with_id_loop_decreases (t : Type0) (i : u32) (ls : list_t t) :
+  list_t t =
+  ls
+
+(** [loops::list_nth_shared_loop_with_id]: decreases clause *)
+unfold
+let list_nth_shared_loop_with_id_loop_decreases (t : Type0) (i : u32)
+  (ls : list_t t) : list_t t =
+  ls
+
+(** [loops::list_nth_mut_loop_pair]: decreases clause *)
+unfold
+let list_nth_mut_loop_pair_loop_decreases (t : Type0) (l : list_t t) (l0 : list_t t)
+  (i : u32) : nat =
+  i
+
+(** [loops::list_nth_shared_loop_pair]: decreases clause *)
+unfold
+let list_nth_shared_loop_pair_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : list_t t =
+  l
+
+(** [loops::list_nth_mut_loop_pair_merge]: decreases clause *)
+unfold
+let list_nth_mut_loop_pair_merge_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : nat =
+  i
+
+(** [loops::list_nth_shared_loop_pair_merge]: decreases clause *)
+unfold
+let list_nth_shared_loop_pair_merge_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : list_t t =
+  l
+
+(** [loops::list_nth_mut_shared_loop_pair]: decreases clause *)
+unfold
+let list_nth_mut_shared_loop_pair_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : list_t t =
+  l
+
+(** [loops::list_nth_mut_shared_loop_pair_merge]: decreases clause *)
+unfold
+let list_nth_mut_shared_loop_pair_merge_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : list_t t =
+  l
+
+(** [loops::list_nth_shared_mut_loop_pair]: decreases clause *)
+unfold
+let list_nth_shared_mut_loop_pair_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : list_t t =
+  l
+
+(** [loops::list_nth_shared_mut_loop_pair_merge]: decreases clause *)
+unfold
+let list_nth_shared_mut_loop_pair_merge_loop_decreases (t : Type0) (l : list_t t)
+  (l0 : list_t t) (i : u32) : list_t t =
+  l
diff --git a/tests/fstar-split/misc/Loops.Funs.fst b/tests/fstar-split/misc/Loops.Funs.fst
new file mode 100644
index 00000000..3168fddb
--- /dev/null
+++ b/tests/fstar-split/misc/Loops.Funs.fst
@@ -0,0 +1,734 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [loops]: function definitions *)
+module Loops.Funs
+open Primitives
+include Loops.Types
+include Loops.Clauses
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [loops::sum]: loop 0: forward function
+    Source: 'src/loops.rs', lines 4:0-14:1 *)
+let rec sum_loop
+  (max : u32) (i : u32) (s : u32) :
+  Tot (result u32) (decreases (sum_loop_decreases max i s))
+  =
+  if i < max
+  then let* s1 = u32_add s i in let* i1 = u32_add i 1 in sum_loop max i1 s1
+  else u32_mul s 2
+
+(** [loops::sum]: forward function
+    Source: 'src/loops.rs', lines 4:0-4:27 *)
+let sum (max : u32) : result u32 =
+  sum_loop max 0 0
+
+(** [loops::sum_with_mut_borrows]: loop 0: forward function
+    Source: 'src/loops.rs', lines 19:0-31:1 *)
+let rec sum_with_mut_borrows_loop
+  (max : u32) (mi : u32) (ms : u32) :
+  Tot (result u32) (decreases (sum_with_mut_borrows_loop_decreases max mi ms))
+  =
+  if mi < max
+  then
+    let* ms1 = u32_add ms mi in
+    let* mi1 = u32_add mi 1 in
+    sum_with_mut_borrows_loop max mi1 ms1
+  else u32_mul ms 2
+
+(** [loops::sum_with_mut_borrows]: forward function
+    Source: 'src/loops.rs', lines 19:0-19:44 *)
+let sum_with_mut_borrows (max : u32) : result u32 =
+  sum_with_mut_borrows_loop max 0 0
+
+(** [loops::sum_with_shared_borrows]: loop 0: forward function
+    Source: 'src/loops.rs', lines 34:0-48:1 *)
+let rec sum_with_shared_borrows_loop
+  (max : u32) (i : u32) (s : u32) :
+  Tot (result u32) (decreases (sum_with_shared_borrows_loop_decreases max i s))
+  =
+  if i < max
+  then
+    let* i1 = u32_add i 1 in
+    let* s1 = u32_add s i1 in
+    sum_with_shared_borrows_loop max i1 s1
+  else u32_mul s 2
+
+(** [loops::sum_with_shared_borrows]: forward function
+    Source: 'src/loops.rs', lines 34:0-34:47 *)
+let sum_with_shared_borrows (max : u32) : result u32 =
+  sum_with_shared_borrows_loop max 0 0
+
+(** [loops::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/loops.rs', lines 52:0-58:1 *)
+let rec clear_loop
+  (v : alloc_vec_Vec u32) (i : usize) :
+  Tot (result (alloc_vec_Vec u32)) (decreases (clear_loop_decreases v i))
+  =
+  let i1 = alloc_vec_Vec_len u32 v in
+  if i < i1
+  then
+    let* i2 = usize_add i 1 in
+    let* v1 =
+      alloc_vec_Vec_index_mut_back u32 usize
+        (core_slice_index_SliceIndexUsizeSliceTInst u32) v i 0 in
+    clear_loop v1 i2
+  else Return v
+
+(** [loops::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/loops.rs', lines 52:0-52:30 *)
+let clear (v : alloc_vec_Vec u32) : result (alloc_vec_Vec u32) =
+  clear_loop v 0
+
+(** [loops::list_mem]: loop 0: forward function
+    Source: 'src/loops.rs', lines 66:0-75:1 *)
+let rec list_mem_loop
+  (x : u32) (ls : list_t u32) :
+  Tot (result bool) (decreases (list_mem_loop_decreases x ls))
+  =
+  begin match ls with
+  | List_Cons y tl -> if y = x then Return true else list_mem_loop x tl
+  | List_Nil -> Return false
+  end
+
+(** [loops::list_mem]: forward function
+    Source: 'src/loops.rs', lines 66:0-66:52 *)
+let list_mem (x : u32) (ls : list_t u32) : result bool =
+  list_mem_loop x ls
+
+(** [loops::list_nth_mut_loop]: loop 0: forward function
+    Source: 'src/loops.rs', lines 78:0-88:1 *)
+let rec list_nth_mut_loop_loop
+  (t : Type0) (ls : list_t t) (i : u32) :
+  Tot (result t) (decreases (list_nth_mut_loop_loop_decreases t ls i))
+  =
+  begin match ls with
+  | List_Cons x tl ->
+    if i = 0
+    then Return x
+    else let* i1 = u32_sub i 1 in list_nth_mut_loop_loop t tl i1
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop]: forward function
+    Source: 'src/loops.rs', lines 78:0-78:71 *)
+let list_nth_mut_loop (t : Type0) (ls : list_t t) (i : u32) : result t =
+  list_nth_mut_loop_loop t ls i
+
+(** [loops::list_nth_mut_loop]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 78:0-88:1 *)
+let rec list_nth_mut_loop_loop_back
+  (t : Type0) (ls : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t)) (decreases (list_nth_mut_loop_loop_decreases t ls i))
+  =
+  begin match ls with
+  | List_Cons x tl ->
+    if i = 0
+    then Return (List_Cons ret tl)
+    else
+      let* i1 = u32_sub i 1 in
+      let* tl1 = list_nth_mut_loop_loop_back t tl i1 ret in
+      Return (List_Cons x tl1)
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop]: backward function 0
+    Source: 'src/loops.rs', lines 78:0-78:71 *)
+let list_nth_mut_loop_back
+  (t : Type0) (ls : list_t t) (i : u32) (ret : t) : result (list_t t) =
+  list_nth_mut_loop_loop_back t ls i ret
+
+(** [loops::list_nth_shared_loop]: loop 0: forward function
+    Source: 'src/loops.rs', lines 91:0-101:1 *)
+let rec list_nth_shared_loop_loop
+  (t : Type0) (ls : list_t t) (i : u32) :
+  Tot (result t) (decreases (list_nth_shared_loop_loop_decreases t ls i))
+  =
+  begin match ls with
+  | List_Cons x tl ->
+    if i = 0
+    then Return x
+    else let* i1 = u32_sub i 1 in list_nth_shared_loop_loop t tl i1
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_loop]: forward function
+    Source: 'src/loops.rs', lines 91:0-91:66 *)
+let list_nth_shared_loop (t : Type0) (ls : list_t t) (i : u32) : result t =
+  list_nth_shared_loop_loop t ls i
+
+(** [loops::get_elem_mut]: loop 0: forward function
+    Source: 'src/loops.rs', lines 103:0-117:1 *)
+let rec get_elem_mut_loop
+  (x : usize) (ls : list_t usize) :
+  Tot (result usize) (decreases (get_elem_mut_loop_decreases x ls))
+  =
+  begin match ls with
+  | List_Cons y tl -> if y = x then Return y else get_elem_mut_loop x tl
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::get_elem_mut]: forward function
+    Source: 'src/loops.rs', lines 103:0-103:73 *)
+let get_elem_mut
+  (slots : alloc_vec_Vec (list_t usize)) (x : usize) : result usize =
+  let* l =
+    alloc_vec_Vec_index_mut (list_t usize) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 in
+  get_elem_mut_loop x l
+
+(** [loops::get_elem_mut]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 103:0-117:1 *)
+let rec get_elem_mut_loop_back
+  (x : usize) (ls : list_t usize) (ret : usize) :
+  Tot (result (list_t usize)) (decreases (get_elem_mut_loop_decreases x ls))
+  =
+  begin match ls with
+  | List_Cons y tl ->
+    if y = x
+    then Return (List_Cons ret tl)
+    else let* tl1 = get_elem_mut_loop_back x tl ret in Return (List_Cons y tl1)
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::get_elem_mut]: backward function 0
+    Source: 'src/loops.rs', lines 103:0-103:73 *)
+let get_elem_mut_back
+  (slots : alloc_vec_Vec (list_t usize)) (x : usize) (ret : usize) :
+  result (alloc_vec_Vec (list_t usize))
+  =
+  let* l =
+    alloc_vec_Vec_index_mut (list_t usize) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 in
+  let* l1 = get_elem_mut_loop_back x l ret in
+  alloc_vec_Vec_index_mut_back (list_t usize) usize
+    (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 l1
+
+(** [loops::get_elem_shared]: loop 0: forward function
+    Source: 'src/loops.rs', lines 119:0-133:1 *)
+let rec get_elem_shared_loop
+  (x : usize) (ls : list_t usize) :
+  Tot (result usize) (decreases (get_elem_shared_loop_decreases x ls))
+  =
+  begin match ls with
+  | List_Cons y tl -> if y = x then Return y else get_elem_shared_loop x tl
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::get_elem_shared]: forward function
+    Source: 'src/loops.rs', lines 119:0-119:68 *)
+let get_elem_shared
+  (slots : alloc_vec_Vec (list_t usize)) (x : usize) : result usize =
+  let* l =
+    alloc_vec_Vec_index (list_t usize) usize
+      (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 in
+  get_elem_shared_loop x l
+
+(** [loops::id_mut]: forward function
+    Source: 'src/loops.rs', lines 135:0-135:50 *)
+let id_mut (t : Type0) (ls : list_t t) : result (list_t t) =
+  Return ls
+
+(** [loops::id_mut]: backward function 0
+    Source: 'src/loops.rs', lines 135:0-135:50 *)
+let id_mut_back
+  (t : Type0) (ls : list_t t) (ret : list_t t) : result (list_t t) =
+  Return ret
+
+(** [loops::id_shared]: forward function
+    Source: 'src/loops.rs', lines 139:0-139:45 *)
+let id_shared (t : Type0) (ls : list_t t) : result (list_t t) =
+  Return ls
+
+(** [loops::list_nth_mut_loop_with_id]: loop 0: forward function
+    Source: 'src/loops.rs', lines 144:0-155:1 *)
+let rec list_nth_mut_loop_with_id_loop
+  (t : Type0) (i : u32) (ls : list_t t) :
+  Tot (result t) (decreases (list_nth_mut_loop_with_id_loop_decreases t i ls))
+  =
+  begin match ls with
+  | List_Cons x tl ->
+    if i = 0
+    then Return x
+    else let* i1 = u32_sub i 1 in list_nth_mut_loop_with_id_loop t i1 tl
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_with_id]: forward function
+    Source: 'src/loops.rs', lines 144:0-144:75 *)
+let list_nth_mut_loop_with_id
+  (t : Type0) (ls : list_t t) (i : u32) : result t =
+  let* ls1 = id_mut t ls in list_nth_mut_loop_with_id_loop t i ls1
+
+(** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 144:0-155:1 *)
+let rec list_nth_mut_loop_with_id_loop_back
+  (t : Type0) (i : u32) (ls : list_t t) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_mut_loop_with_id_loop_decreases t i ls))
+  =
+  begin match ls with
+  | List_Cons x tl ->
+    if i = 0
+    then Return (List_Cons ret tl)
+    else
+      let* i1 = u32_sub i 1 in
+      let* tl1 = list_nth_mut_loop_with_id_loop_back t i1 tl ret in
+      Return (List_Cons x tl1)
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_with_id]: backward function 0
+    Source: 'src/loops.rs', lines 144:0-144:75 *)
+let list_nth_mut_loop_with_id_back
+  (t : Type0) (ls : list_t t) (i : u32) (ret : t) : result (list_t t) =
+  let* ls1 = id_mut t ls in
+  let* l = list_nth_mut_loop_with_id_loop_back t i ls1 ret in
+  id_mut_back t ls l
+
+(** [loops::list_nth_shared_loop_with_id]: loop 0: forward function
+    Source: 'src/loops.rs', lines 158:0-169:1 *)
+let rec list_nth_shared_loop_with_id_loop
+  (t : Type0) (i : u32) (ls : list_t t) :
+  Tot (result t)
+  (decreases (list_nth_shared_loop_with_id_loop_decreases t i ls))
+  =
+  begin match ls with
+  | List_Cons x tl ->
+    if i = 0
+    then Return x
+    else let* i1 = u32_sub i 1 in list_nth_shared_loop_with_id_loop t i1 tl
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_loop_with_id]: forward function
+    Source: 'src/loops.rs', lines 158:0-158:70 *)
+let list_nth_shared_loop_with_id
+  (t : Type0) (ls : list_t t) (i : u32) : result t =
+  let* ls1 = id_shared t ls in list_nth_shared_loop_with_id_loop t i ls1
+
+(** [loops::list_nth_mut_loop_pair]: loop 0: forward function
+    Source: 'src/loops.rs', lines 174:0-195:1 *)
+let rec list_nth_mut_loop_pair_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_mut_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else let* i1 = u32_sub i 1 in list_nth_mut_loop_pair_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_pair]: forward function
+    Source: 'src/loops.rs', lines 174:0-178:27 *)
+let list_nth_mut_loop_pair
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_mut_loop_pair_loop t ls0 ls1 i
+
+(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 174:0-195:1 *)
+let rec list_nth_mut_loop_pair_loop_back'a
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_mut_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons _ tl1 ->
+      if i = 0
+      then Return (List_Cons ret tl0)
+      else
+        let* i1 = u32_sub i 1 in
+        let* tl01 = list_nth_mut_loop_pair_loop_back'a t tl0 tl1 i1 ret in
+        Return (List_Cons x0 tl01)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_pair]: backward function 0
+    Source: 'src/loops.rs', lines 174:0-178:27 *)
+let list_nth_mut_loop_pair_back'a
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  result (list_t t)
+  =
+  list_nth_mut_loop_pair_loop_back'a t ls0 ls1 i ret
+
+(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1
+    Source: 'src/loops.rs', lines 174:0-195:1 *)
+let rec list_nth_mut_loop_pair_loop_back'b
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_mut_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons _ tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (List_Cons ret tl1)
+      else
+        let* i1 = u32_sub i 1 in
+        let* tl11 = list_nth_mut_loop_pair_loop_back'b t tl0 tl1 i1 ret in
+        Return (List_Cons x1 tl11)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_pair]: backward function 1
+    Source: 'src/loops.rs', lines 174:0-178:27 *)
+let list_nth_mut_loop_pair_back'b
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  result (list_t t)
+  =
+  list_nth_mut_loop_pair_loop_back'b t ls0 ls1 i ret
+
+(** [loops::list_nth_shared_loop_pair]: loop 0: forward function
+    Source: 'src/loops.rs', lines 198:0-219:1 *)
+let rec list_nth_shared_loop_pair_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_shared_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else let* i1 = u32_sub i 1 in list_nth_shared_loop_pair_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_loop_pair]: forward function
+    Source: 'src/loops.rs', lines 198:0-202:19 *)
+let list_nth_shared_loop_pair
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_shared_loop_pair_loop t ls0 ls1 i
+
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function
+    Source: 'src/loops.rs', lines 223:0-238:1 *)
+let rec list_nth_mut_loop_pair_merge_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else
+        let* i1 = u32_sub i 1 in list_nth_mut_loop_pair_merge_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_pair_merge]: forward function
+    Source: 'src/loops.rs', lines 223:0-227:27 *)
+let list_nth_mut_loop_pair_merge
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_mut_loop_pair_merge_loop t ls0 ls1 i
+
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 223:0-238:1 *)
+let rec list_nth_mut_loop_pair_merge_loop_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : (t & t)) :
+  Tot (result ((list_t t) & (list_t t)))
+  (decreases (list_nth_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then let (x, x2) = ret in Return (List_Cons x tl0, List_Cons x2 tl1)
+      else
+        let* i1 = u32_sub i 1 in
+        let* (tl01, tl11) =
+          list_nth_mut_loop_pair_merge_loop_back t tl0 tl1 i1 ret in
+        Return (List_Cons x0 tl01, List_Cons x1 tl11)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_loop_pair_merge]: backward function 0
+    Source: 'src/loops.rs', lines 223:0-227:27 *)
+let list_nth_mut_loop_pair_merge_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : (t & t)) :
+  result ((list_t t) & (list_t t))
+  =
+  list_nth_mut_loop_pair_merge_loop_back t ls0 ls1 i ret
+
+(** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function
+    Source: 'src/loops.rs', lines 241:0-256:1 *)
+let rec list_nth_shared_loop_pair_merge_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_shared_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else
+        let* i1 = u32_sub i 1 in
+        list_nth_shared_loop_pair_merge_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_loop_pair_merge]: forward function
+    Source: 'src/loops.rs', lines 241:0-245:19 *)
+let list_nth_shared_loop_pair_merge
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_shared_loop_pair_merge_loop t ls0 ls1 i
+
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function
+    Source: 'src/loops.rs', lines 259:0-274:1 *)
+let rec list_nth_mut_shared_loop_pair_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_mut_shared_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else
+        let* i1 = u32_sub i 1 in
+        list_nth_mut_shared_loop_pair_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_shared_loop_pair]: forward function
+    Source: 'src/loops.rs', lines 259:0-263:23 *)
+let list_nth_mut_shared_loop_pair
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_mut_shared_loop_pair_loop t ls0 ls1 i
+
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 259:0-274:1 *)
+let rec list_nth_mut_shared_loop_pair_loop_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_mut_shared_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons _ tl1 ->
+      if i = 0
+      then Return (List_Cons ret tl0)
+      else
+        let* i1 = u32_sub i 1 in
+        let* tl01 = list_nth_mut_shared_loop_pair_loop_back t tl0 tl1 i1 ret in
+        Return (List_Cons x0 tl01)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_shared_loop_pair]: backward function 0
+    Source: 'src/loops.rs', lines 259:0-263:23 *)
+let list_nth_mut_shared_loop_pair_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  result (list_t t)
+  =
+  list_nth_mut_shared_loop_pair_loop_back t ls0 ls1 i ret
+
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function
+    Source: 'src/loops.rs', lines 278:0-293:1 *)
+let rec list_nth_mut_shared_loop_pair_merge_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_mut_shared_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else
+        let* i1 = u32_sub i 1 in
+        list_nth_mut_shared_loop_pair_merge_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_shared_loop_pair_merge]: forward function
+    Source: 'src/loops.rs', lines 278:0-282:23 *)
+let list_nth_mut_shared_loop_pair_merge
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_mut_shared_loop_pair_merge_loop t ls0 ls1 i
+
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 278:0-293:1 *)
+let rec list_nth_mut_shared_loop_pair_merge_loop_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_mut_shared_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons _ tl1 ->
+      if i = 0
+      then Return (List_Cons ret tl0)
+      else
+        let* i1 = u32_sub i 1 in
+        let* tl01 =
+          list_nth_mut_shared_loop_pair_merge_loop_back t tl0 tl1 i1 ret in
+        Return (List_Cons x0 tl01)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0
+    Source: 'src/loops.rs', lines 278:0-282:23 *)
+let list_nth_mut_shared_loop_pair_merge_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  result (list_t t)
+  =
+  list_nth_mut_shared_loop_pair_merge_loop_back t ls0 ls1 i ret
+
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function
+    Source: 'src/loops.rs', lines 297:0-312:1 *)
+let rec list_nth_shared_mut_loop_pair_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_shared_mut_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else
+        let* i1 = u32_sub i 1 in
+        list_nth_shared_mut_loop_pair_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_mut_loop_pair]: forward function
+    Source: 'src/loops.rs', lines 297:0-301:23 *)
+let list_nth_shared_mut_loop_pair
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_shared_mut_loop_pair_loop t ls0 ls1 i
+
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1
+    Source: 'src/loops.rs', lines 297:0-312:1 *)
+let rec list_nth_shared_mut_loop_pair_loop_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_shared_mut_loop_pair_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons _ tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (List_Cons ret tl1)
+      else
+        let* i1 = u32_sub i 1 in
+        let* tl11 = list_nth_shared_mut_loop_pair_loop_back t tl0 tl1 i1 ret in
+        Return (List_Cons x1 tl11)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_mut_loop_pair]: backward function 1
+    Source: 'src/loops.rs', lines 297:0-301:23 *)
+let list_nth_shared_mut_loop_pair_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  result (list_t t)
+  =
+  list_nth_shared_mut_loop_pair_loop_back t ls0 ls1 i ret
+
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function
+    Source: 'src/loops.rs', lines 316:0-331:1 *)
+let rec list_nth_shared_mut_loop_pair_merge_loop
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  Tot (result (t & t))
+  (decreases (list_nth_shared_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons x0 tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (x0, x1)
+      else
+        let* i1 = u32_sub i 1 in
+        list_nth_shared_mut_loop_pair_merge_loop t tl0 tl1 i1
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_mut_loop_pair_merge]: forward function
+    Source: 'src/loops.rs', lines 316:0-320:23 *)
+let list_nth_shared_mut_loop_pair_merge
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
+  list_nth_shared_mut_loop_pair_merge_loop t ls0 ls1 i
+
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0
+    Source: 'src/loops.rs', lines 316:0-331:1 *)
+let rec list_nth_shared_mut_loop_pair_merge_loop_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  Tot (result (list_t t))
+  (decreases (list_nth_shared_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
+  =
+  begin match ls0 with
+  | List_Cons _ tl0 ->
+    begin match ls1 with
+    | List_Cons x1 tl1 ->
+      if i = 0
+      then Return (List_Cons ret tl1)
+      else
+        let* i1 = u32_sub i 1 in
+        let* tl11 =
+          list_nth_shared_mut_loop_pair_merge_loop_back t tl0 tl1 i1 ret in
+        Return (List_Cons x1 tl11)
+    | List_Nil -> Fail Failure
+    end
+  | List_Nil -> Fail Failure
+  end
+
+(** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0
+    Source: 'src/loops.rs', lines 316:0-320:23 *)
+let list_nth_shared_mut_loop_pair_merge_back
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
+  result (list_t t)
+  =
+  list_nth_shared_mut_loop_pair_merge_loop_back t ls0 ls1 i ret
+
diff --git a/tests/fstar-split/misc/Loops.Types.fst b/tests/fstar-split/misc/Loops.Types.fst
new file mode 100644
index 00000000..8aa38290
--- /dev/null
+++ b/tests/fstar-split/misc/Loops.Types.fst
@@ -0,0 +1,13 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [loops]: type definitions *)
+module Loops.Types
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [loops::List]
+    Source: 'src/loops.rs', lines 60:0-60:16 *)
+type list_t (t : Type0) =
+| List_Cons : t -> list_t t -> list_t t
+| List_Nil : list_t t
+
diff --git a/tests/fstar-split/misc/Paper.fst b/tests/fstar-split/misc/Paper.fst
new file mode 100644
index 00000000..2dc804de
--- /dev/null
+++ b/tests/fstar-split/misc/Paper.fst
@@ -0,0 +1,110 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [paper] *)
+module Paper
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [paper::ref_incr]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/paper.rs', lines 4:0-4:28 *)
+let ref_incr (x : i32) : result i32 =
+  i32_add x 1
+
+(** [paper::test_incr]: forward function
+    Source: 'src/paper.rs', lines 8:0-8:18 *)
+let test_incr : result unit =
+  let* x = ref_incr 0 in if not (x = 1) then Fail Failure else Return ()
+
+(** Unit test for [paper::test_incr] *)
+let _ = assert_norm (test_incr = Return ())
+
+(** [paper::choose]: forward function
+    Source: 'src/paper.rs', lines 15:0-15:70 *)
+let choose (t : Type0) (b : bool) (x : t) (y : t) : result t =
+  if b then Return x else Return y
+
+(** [paper::choose]: backward function 0
+    Source: 'src/paper.rs', lines 15:0-15:70 *)
+let choose_back
+  (t : Type0) (b : bool) (x : t) (y : t) (ret : t) : result (t & t) =
+  if b then Return (ret, y) else Return (x, ret)
+
+(** [paper::test_choose]: forward function
+    Source: 'src/paper.rs', lines 23:0-23:20 *)
+let test_choose : result unit =
+  let* z = choose i32 true 0 0 in
+  let* z1 = i32_add z 1 in
+  if not (z1 = 1)
+  then Fail Failure
+  else
+    let* (x, y) = choose_back i32 true 0 0 z1 in
+    if not (x = 1)
+    then Fail Failure
+    else if not (y = 0) then Fail Failure else Return ()
+
+(** Unit test for [paper::test_choose] *)
+let _ = assert_norm (test_choose = Return ())
+
+(** [paper::List]
+    Source: 'src/paper.rs', lines 35:0-35:16 *)
+type list_t (t : Type0) =
+| List_Cons : t -> list_t t -> list_t t
+| List_Nil : list_t t
+
+(** [paper::list_nth_mut]: forward function
+    Source: 'src/paper.rs', lines 42:0-42:67 *)
+let rec list_nth_mut (t : Type0) (l : list_t t) (i : u32) : result t =
+  begin match l with
+  | List_Cons x tl ->
+    if i = 0 then Return x else let* i1 = u32_sub i 1 in list_nth_mut t tl i1
+  | List_Nil -> Fail Failure
+  end
+
+(** [paper::list_nth_mut]: backward function 0
+    Source: 'src/paper.rs', lines 42:0-42:67 *)
+let rec list_nth_mut_back
+  (t : Type0) (l : list_t t) (i : u32) (ret : t) : result (list_t t) =
+  begin match l with
+  | List_Cons x tl ->
+    if i = 0
+    then Return (List_Cons ret tl)
+    else
+      let* i1 = u32_sub i 1 in
+      let* tl1 = list_nth_mut_back t tl i1 ret in
+      Return (List_Cons x tl1)
+  | List_Nil -> Fail Failure
+  end
+
+(** [paper::sum]: forward function
+    Source: 'src/paper.rs', lines 57:0-57:32 *)
+let rec sum (l : list_t i32) : result i32 =
+  begin match l with
+  | List_Cons x tl -> let* i = sum tl in i32_add x i
+  | List_Nil -> Return 0
+  end
+
+(** [paper::test_nth]: forward function
+    Source: 'src/paper.rs', lines 68:0-68:17 *)
+let test_nth : result unit =
+  let l = List_Nil in
+  let l1 = List_Cons 3 l in
+  let l2 = List_Cons 2 l1 in
+  let* x = list_nth_mut i32 (List_Cons 1 l2) 2 in
+  let* x1 = i32_add x 1 in
+  let* l3 = list_nth_mut_back i32 (List_Cons 1 l2) 2 x1 in
+  let* i = sum l3 in
+  if not (i = 7) then Fail Failure else Return ()
+
+(** Unit test for [paper::test_nth] *)
+let _ = assert_norm (test_nth = Return ())
+
+(** [paper::call_choose]: forward function
+    Source: 'src/paper.rs', lines 76:0-76:44 *)
+let call_choose (p : (u32 & u32)) : result u32 =
+  let (px, py) = p in
+  let* pz = choose u32 true px py in
+  let* pz1 = u32_add pz 1 in
+  let* (px1, _) = choose_back u32 true px py pz1 in
+  Return px1
+
diff --git a/tests/fstar-split/misc/PoloniusList.fst b/tests/fstar-split/misc/PoloniusList.fst
new file mode 100644
index 00000000..8a8b7ae3
--- /dev/null
+++ b/tests/fstar-split/misc/PoloniusList.fst
@@ -0,0 +1,34 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [polonius_list] *)
+module PoloniusList
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** [polonius_list::List]
+    Source: 'src/polonius_list.rs', lines 3:0-3:16 *)
+type list_t (t : Type0) =
+| List_Cons : t -> list_t t -> list_t t
+| List_Nil : list_t t
+
+(** [polonius_list::get_list_at_x]: forward function
+    Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
+let rec get_list_at_x (ls : list_t u32) (x : u32) : result (list_t u32) =
+  begin match ls with
+  | List_Cons hd tl ->
+    if hd = x then Return (List_Cons hd tl) else get_list_at_x tl x
+  | List_Nil -> Return List_Nil
+  end
+
+(** [polonius_list::get_list_at_x]: backward function 0
+    Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
+let rec get_list_at_x_back
+  (ls : list_t u32) (x : u32) (ret : list_t u32) : result (list_t u32) =
+  begin match ls with
+  | List_Cons hd tl ->
+    if hd = x
+    then Return ret
+    else let* tl1 = get_list_at_x_back tl x ret in Return (List_Cons hd tl1)
+  | List_Nil -> Return ret
+  end
+
diff --git a/tests/fstar-split/traits/Makefile b/tests/fstar-split/traits/Makefile
new file mode 100644
index 00000000..fa7d1f36
--- /dev/null
+++ b/tests/fstar-split/traits/Makefile
@@ -0,0 +1,49 @@
+# This file was automatically generated - modify ../Makefile.template instead
+INCLUDE_DIRS = .
+
+FSTAR_INCLUDES = $(addprefix --include ,$(INCLUDE_DIRS))
+
+FSTAR_HINTS ?= --use_hints --use_hint_hashes --record_hints
+
+FSTAR_OPTIONS = $(FSTAR_HINTS) \
+  --cache_checked_modules $(FSTAR_INCLUDES) --cmi \
+  --warn_error '+241@247+285-274' \
+
+FSTAR_EXE ?= fstar.exe
+FSTAR_NO_FLAGS = $(FSTAR_EXE) --already_cached 'Prims FStar LowStar Steel' --odir obj --cache_dir obj
+
+FSTAR = $(FSTAR_NO_FLAGS) $(FSTAR_OPTIONS)
+
+# The F* roots are used to compute the dependency graph, and generate the .depend file
+FSTAR_ROOTS ?= $(wildcard *.fst *.fsti)
+
+# Build all the files
+all: $(addprefix obj/,$(addsuffix .checked,$(FSTAR_ROOTS)))
+
+# This is the right way to ensure the .depend file always gets re-built.
+ifeq (,$(filter %-in,$(MAKECMDGOALS)))
+ifndef NODEPEND
+ifndef MAKE_RESTARTS
+.depend: .FORCE
+	$(FSTAR_NO_FLAGS) --dep full $(notdir $(FSTAR_ROOTS)) > $@
+
+.PHONY: .FORCE
+.FORCE:
+endif
+endif
+
+include .depend
+endif
+
+# For the interactive mode
+%.fst-in %.fsti-in:
+	@echo $(FSTAR_OPTIONS)
+
+# Generete the .checked files in batch mode
+%.checked:
+	$(FSTAR) $(FSTAR_OPTIONS) $< && \
+	touch -c $@
+
+.PHONY: clean
+clean:
+	rm -f obj/*
diff --git a/tests/fstar-split/traits/Primitives.fst b/tests/fstar-split/traits/Primitives.fst
new file mode 100644
index 00000000..a3ffbde4
--- /dev/null
+++ b/tests/fstar-split/traits/Primitives.fst
@@ -0,0 +1,884 @@
+/// This file lists primitive and assumed functions and types
+module Primitives
+open FStar.Mul
+open FStar.List.Tot
+
+#set-options "--z3rlimit 15 --fuel 0 --ifuel 1"
+
+(*** Utilities *)
+val list_update (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a) :
+  ls':list a{
+    length ls' = length ls /\
+    index ls' i == x
+  }
+#push-options "--fuel 1"
+let rec list_update #a ls i x =
+  match ls with
+  | x' :: ls -> if i = 0 then x :: ls else x' :: list_update ls (i-1) x
+#pop-options
+
+(*** Result *)
+type error : Type0 =
+| Failure
+| OutOfFuel
+
+type result (a : Type0) : Type0 =
+| Return : v:a -> result a
+| Fail : e:error -> result a
+
+// Monadic return operator
+unfold let return (#a : Type0) (x : a) : result a = Return x
+
+// Monadic bind operator.
+// Allows to use the notation:
+// ```
+// let* x = y in
+// ...
+// ```
+unfold let (let*) (#a #b : Type0) (m: result a)
+  (f: (x:a) -> Pure (result b) (requires (m == Return x)) (ensures fun _ -> True)) :
+  result b =
+  match m with
+  | Return x -> f x
+  | Fail e   -> Fail e
+
+// Monadic assert(...)
+let massert (b:bool) : result unit = if b then Return () else Fail Failure
+
+// Normalize and unwrap a successful result (used for globals).
+let eval_global (#a : Type0) (x : result a{Return? (normalize_term x)}) : a = Return?.v x
+
+(*** Misc *)
+type char = FStar.Char.char
+type string = string
+
+let is_zero (n: nat) : bool = n = 0
+let decrease (n: nat{n > 0}) : nat = n - 1
+
+let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
+let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+
+// We don't really use raw pointers for now
+type mut_raw_ptr (t : Type0) = { v : t }
+type const_raw_ptr (t : Type0) = { v : t }
+
+(*** Scalars *)
+/// Rem.: most of the following code was partially generated
+
+assume val size_numbits : pos
+
+// TODO: we could use FStar.Int.int_t and FStar.UInt.int_t
+
+let isize_min : int = -9223372036854775808 // TODO: should be opaque
+let isize_max : int = 9223372036854775807 // TODO: should be opaque
+let i8_min : int = -128
+let i8_max : int = 127
+let i16_min : int = -32768
+let i16_max : int = 32767
+let i32_min : int = -2147483648
+let i32_max : int = 2147483647
+let i64_min : int = -9223372036854775808
+let i64_max : int = 9223372036854775807
+let i128_min : int = -170141183460469231731687303715884105728
+let i128_max : int = 170141183460469231731687303715884105727
+let usize_min : int = 0
+let usize_max : int = 4294967295 // TODO: should be opaque
+let u8_min : int = 0
+let u8_max : int = 255
+let u16_min : int = 0
+let u16_max : int = 65535
+let u32_min : int = 0
+let u32_max : int = 4294967295
+let u64_min : int = 0
+let u64_max : int = 18446744073709551615
+let u128_min : int = 0
+let u128_max : int = 340282366920938463463374607431768211455
+
+type scalar_ty =
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+let is_unsigned = function
+  | Isize | I8 | I16 | I32 | I64 | I128 -> false
+  | Usize | U8 | U16 | U32 | U64 | U128 -> true
+
+let scalar_min (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_min
+  | I8 -> i8_min
+  | I16 -> i16_min
+  | I32 -> i32_min
+  | I64 -> i64_min
+  | I128 -> i128_min
+  | Usize -> usize_min
+  | U8 -> u8_min
+  | U16 -> u16_min
+  | U32 -> u32_min
+  | U64 -> u64_min
+  | U128 -> u128_min
+
+let scalar_max (ty : scalar_ty) : int =
+  match ty with
+  | Isize -> isize_max
+  | I8 -> i8_max
+  | I16 -> i16_max
+  | I32 -> i32_max
+  | I64 -> i64_max
+  | I128 -> i128_max
+  | Usize -> usize_max
+  | U8 -> u8_max
+  | U16 -> u16_max
+  | U32 -> u32_max
+  | U64 -> u64_max
+  | U128 -> u128_max
+
+type scalar (ty : scalar_ty) : eqtype = x:int{scalar_min ty <= x && x <= scalar_max ty}
+
+let mk_scalar (ty : scalar_ty) (x : int) : result (scalar ty) =
+  if scalar_min ty <= x && scalar_max ty >= x then Return x else Fail Failure
+
+let scalar_neg (#ty : scalar_ty) (x : scalar ty) : result (scalar ty) = mk_scalar ty (-x)
+
+let scalar_div (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (x / y) else Fail Failure
+
+/// The remainder operation
+let int_rem (x : int) (y : int{y <> 0}) : int =
+  if x >= 0 then (x % y) else -(x % y)
+
+(* Checking consistency with Rust *)
+let _ = assert_norm(int_rem 1 2 = 1)
+let _ = assert_norm(int_rem (-1) 2 = -1)
+let _ = assert_norm(int_rem 1 (-2) = 1)
+let _ = assert_norm(int_rem (-1) (-2) = -1)
+
+let scalar_rem (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  if y <> 0 then mk_scalar ty (int_rem x y) else Fail Failure
+
+let scalar_add (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x + y)
+
+let scalar_sub (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x - y)
+
+let scalar_mul (#ty : scalar_ty) (x : scalar ty) (y : scalar ty) : result (scalar ty) =
+  mk_scalar ty (x * y)
+
+let scalar_xor (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logxor #8 x y
+  | U16 -> FStar.UInt.logxor #16 x y
+  | U32 -> FStar.UInt.logxor #32 x y
+  | U64 -> FStar.UInt.logxor #64 x y
+  | U128 -> FStar.UInt.logxor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logxor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logxor #16 x y
+  | I32 -> FStar.Int.logxor #32 x y
+  | I64 -> FStar.Int.logxor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logxor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_or (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logor #8 x y
+  | U16 -> FStar.UInt.logor #16 x y
+  | U32 -> FStar.UInt.logor #32 x y
+  | U64 -> FStar.UInt.logor #64 x y
+  | U128 -> FStar.UInt.logor #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logor #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logor #16 x y
+  | I32 -> FStar.Int.logor #32 x y
+  | I64 -> FStar.Int.logor #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logor #128 x y
+  | Isize -> admit() // TODO
+
+let scalar_and (#ty : scalar_ty)
+    (x : scalar ty) (y : scalar ty) : scalar ty =
+  match ty with
+  | U8 -> FStar.UInt.logand #8 x y
+  | U16 -> FStar.UInt.logand #16 x y
+  | U32 -> FStar.UInt.logand #32 x y
+  | U64 -> FStar.UInt.logand #64 x y
+  | U128 -> FStar.UInt.logand #128 x y
+  | Usize -> admit() // TODO
+  | I8 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 8);
+    normalize_spec (scalar I8);
+    FStar.Int.logand #8 x y
+  | I16 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 16);
+    normalize_spec (scalar I16);
+    FStar.Int.logand #16 x y
+  | I32 -> FStar.Int.logand #32 x y
+  | I64 -> FStar.Int.logand #64 x y
+  | I128 ->
+    // Encoding issues...
+    normalize_spec (FStar.Int.int_t 128);
+    normalize_spec (scalar I128);
+    FStar.Int.logand #128 x y
+  | Isize -> admit() // TODO
+
+// Shift left
+let scalar_shl (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+// Shift right
+let scalar_shr (#ty0 #ty1 : scalar_ty)
+    (x : scalar ty0) (y : scalar ty1) : result (scalar ty0) =
+  admit()
+
+(** Cast an integer from a [src_ty] to a [tgt_ty] *)
+// TODO: check the semantics of casts in Rust
+let scalar_cast (src_ty : scalar_ty) (tgt_ty : scalar_ty) (x : scalar src_ty) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty x
+
+// This can't fail, but for now we make all casts faillible (easier for the translation)
+let scalar_cast_bool (tgt_ty : scalar_ty) (x : bool) : result (scalar tgt_ty) =
+  mk_scalar tgt_ty (if x then 1 else 0)
+
+/// The scalar types
+type isize : eqtype = scalar Isize
+type i8    : eqtype = scalar I8
+type i16   : eqtype = scalar I16
+type i32   : eqtype = scalar I32
+type i64   : eqtype = scalar I64
+type i128  : eqtype = scalar I128
+type usize : eqtype = scalar Usize
+type u8    : eqtype = scalar U8
+type u16   : eqtype = scalar U16
+type u32   : eqtype = scalar U32
+type u64   : eqtype = scalar U64
+type u128  : eqtype = scalar U128
+
+
+let core_isize_min : isize = isize_min
+let core_isize_max : isize = isize_max
+let core_i8_min    : i8 = i8_min
+let core_i8_max    : i8 = i8_max
+let core_i16_min   : i16 = i16_min
+let core_i16_max   : i16 = i16_max
+let core_i32_min   : i32 = i32_min
+let core_i32_max   : i32 = i32_max
+let core_i64_min   : i64 = i64_min
+let core_i64_max   : i64 = i64_max
+let core_i128_min  : i128 = i128_min
+let core_i128_max  : i128 = i128_max
+
+let core_usize_min : usize = usize_min
+let core_usize_max : usize = usize_max
+let core_u8_min    : u8 = u8_min
+let core_u8_max    : u8 = u8_max
+let core_u16_min   : u16 = u16_min
+let core_u16_max   : u16 = u16_max
+let core_u32_min   : u32 = u32_min
+let core_u32_max   : u32 = u32_max
+let core_u64_min   : u64 = u64_min
+let core_u64_max   : u64 = u64_max
+let core_u128_min  : u128 = u128_min
+let core_u128_max  : u128 = u128_max
+
+/// Negation
+let isize_neg = scalar_neg #Isize
+let i8_neg = scalar_neg #I8
+let i16_neg = scalar_neg #I16
+let i32_neg = scalar_neg #I32
+let i64_neg = scalar_neg #I64
+let i128_neg = scalar_neg #I128
+
+/// Division
+let isize_div = scalar_div #Isize
+let i8_div = scalar_div #I8
+let i16_div = scalar_div #I16
+let i32_div = scalar_div #I32
+let i64_div = scalar_div #I64
+let i128_div = scalar_div #I128
+let usize_div = scalar_div #Usize
+let u8_div = scalar_div #U8
+let u16_div = scalar_div #U16
+let u32_div = scalar_div #U32
+let u64_div = scalar_div #U64
+let u128_div = scalar_div #U128
+
+/// Remainder
+let isize_rem = scalar_rem #Isize
+let i8_rem = scalar_rem #I8
+let i16_rem = scalar_rem #I16
+let i32_rem = scalar_rem #I32
+let i64_rem = scalar_rem #I64
+let i128_rem = scalar_rem #I128
+let usize_rem = scalar_rem #Usize
+let u8_rem = scalar_rem #U8
+let u16_rem = scalar_rem #U16
+let u32_rem = scalar_rem #U32
+let u64_rem = scalar_rem #U64
+let u128_rem = scalar_rem #U128
+
+/// Addition
+let isize_add = scalar_add #Isize
+let i8_add = scalar_add #I8
+let i16_add = scalar_add #I16
+let i32_add = scalar_add #I32
+let i64_add = scalar_add #I64
+let i128_add = scalar_add #I128
+let usize_add = scalar_add #Usize
+let u8_add = scalar_add #U8
+let u16_add = scalar_add #U16
+let u32_add = scalar_add #U32
+let u64_add = scalar_add #U64
+let u128_add = scalar_add #U128
+
+/// Subtraction
+let isize_sub = scalar_sub #Isize
+let i8_sub = scalar_sub #I8
+let i16_sub = scalar_sub #I16
+let i32_sub = scalar_sub #I32
+let i64_sub = scalar_sub #I64
+let i128_sub = scalar_sub #I128
+let usize_sub = scalar_sub #Usize
+let u8_sub = scalar_sub #U8
+let u16_sub = scalar_sub #U16
+let u32_sub = scalar_sub #U32
+let u64_sub = scalar_sub #U64
+let u128_sub = scalar_sub #U128
+
+/// Multiplication
+let isize_mul = scalar_mul #Isize
+let i8_mul = scalar_mul #I8
+let i16_mul = scalar_mul #I16
+let i32_mul = scalar_mul #I32
+let i64_mul = scalar_mul #I64
+let i128_mul = scalar_mul #I128
+let usize_mul = scalar_mul #Usize
+let u8_mul = scalar_mul #U8
+let u16_mul = scalar_mul #U16
+let u32_mul = scalar_mul #U32
+let u64_mul = scalar_mul #U64
+let u128_mul = scalar_mul #U128
+
+/// Xor
+let u8_xor = scalar_xor #U8
+let u16_xor = scalar_xor #U16
+let u32_xor = scalar_xor #U32
+let u64_xor = scalar_xor #U64
+let u128_xor = scalar_xor #U128
+let usize_xor = scalar_xor #Usize
+let i8_xor = scalar_xor #I8
+let i16_xor = scalar_xor #I16
+let i32_xor = scalar_xor #I32
+let i64_xor = scalar_xor #I64
+let i128_xor = scalar_xor #I128
+let isize_xor = scalar_xor #Isize
+
+/// Or
+let u8_or = scalar_or #U8
+let u16_or = scalar_or #U16
+let u32_or = scalar_or #U32
+let u64_or = scalar_or #U64
+let u128_or = scalar_or #U128
+let usize_or = scalar_or #Usize
+let i8_or = scalar_or #I8
+let i16_or = scalar_or #I16
+let i32_or = scalar_or #I32
+let i64_or = scalar_or #I64
+let i128_or = scalar_or #I128
+let isize_or = scalar_or #Isize
+
+/// And
+let u8_and = scalar_and #U8
+let u16_and = scalar_and #U16
+let u32_and = scalar_and #U32
+let u64_and = scalar_and #U64
+let u128_and = scalar_and #U128
+let usize_and = scalar_and #Usize
+let i8_and = scalar_and #I8
+let i16_and = scalar_and #I16
+let i32_and = scalar_and #I32
+let i64_and = scalar_and #I64
+let i128_and = scalar_and #I128
+let isize_and = scalar_and #Isize
+
+/// Shift left
+let u8_shl #ty = scalar_shl #U8 #ty
+let u16_shl #ty = scalar_shl #U16 #ty
+let u32_shl #ty = scalar_shl #U32 #ty
+let u64_shl #ty = scalar_shl #U64 #ty
+let u128_shl #ty = scalar_shl #U128 #ty
+let usize_shl #ty = scalar_shl #Usize #ty
+let i8_shl #ty = scalar_shl #I8 #ty
+let i16_shl #ty = scalar_shl #I16 #ty
+let i32_shl #ty = scalar_shl #I32 #ty
+let i64_shl #ty = scalar_shl #I64 #ty
+let i128_shl #ty = scalar_shl #I128 #ty
+let isize_shl #ty = scalar_shl #Isize #ty
+
+/// Shift right
+let u8_shr #ty = scalar_shr #U8 #ty
+let u16_shr #ty = scalar_shr #U16 #ty
+let u32_shr #ty = scalar_shr #U32 #ty
+let u64_shr #ty = scalar_shr #U64 #ty
+let u128_shr #ty = scalar_shr #U128 #ty
+let usize_shr #ty = scalar_shr #Usize #ty
+let i8_shr #ty = scalar_shr #I8 #ty
+let i16_shr #ty = scalar_shr #I16 #ty
+let i32_shr #ty = scalar_shr #I32 #ty
+let i64_shr #ty = scalar_shr #I64 #ty
+let i128_shr #ty = scalar_shr #I128 #ty
+let isize_shr #ty = scalar_shr #Isize #ty
+
+(*** core::ops *)
+
+// Trait declaration: [core::ops::index::Index]
+noeq type core_ops_index_Index (self idx : Type0) = {
+  output : Type0;
+  index : self → idx → result output
+}
+
+// Trait declaration: [core::ops::index::IndexMut]
+noeq type core_ops_index_IndexMut (self idx : Type0) = {
+  indexInst : core_ops_index_Index self idx;
+  index_mut : self → idx → result indexInst.output;
+  index_mut_back : self → idx → indexInst.output → result self;
+}
+
+// Trait declaration [core::ops::deref::Deref]
+noeq type core_ops_deref_Deref (self : Type0) = {
+  target : Type0;
+  deref : self → result target;
+}
+
+// Trait declaration [core::ops::deref::DerefMut]
+noeq type core_ops_deref_DerefMut (self : Type0) = {
+  derefInst : core_ops_deref_Deref self;
+  deref_mut : self → result derefInst.target;
+  deref_mut_back : self → derefInst.target → result self;
+}
+
+type core_ops_range_Range (a : Type0) = {
+  start : a;
+  end_ : a;
+}
+
+(*** [alloc] *)
+
+let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
+  target = self;
+  deref = alloc_boxed_Box_deref self;
+}
+
+// Trait instance
+let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
+  derefInst = alloc_boxed_Box_coreopsDerefInst self;
+  deref_mut = alloc_boxed_Box_deref_mut self;
+  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
+}
+
+(*** Array *)
+type array (a : Type0) (n : usize) = s:list a{length s = n}
+
+// We tried putting the normalize_term condition as a refinement on the list
+// but it didn't work. It works with the requires clause.
+let mk_array (a : Type0) (n : usize)
+  (l : list a) :
+  Pure (array a n)
+  (requires (normalize_term(FStar.List.Tot.length l) = n))
+  (ensures (fun _ -> True)) =
+  normalize_term_spec (FStar.List.Tot.length l);
+  l
+
+let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Slice *)
+type slice (a : Type0) = s:list a{length s <= usize_max}
+
+let slice_len (a : Type0) (s : slice a) : usize = length s
+
+let slice_index_usize (a : Type0) (x : slice a) (i : usize) : result a =
+  if i < length x then Return (index x i)
+  else Fail Failure
+
+let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (slice a) =
+  if i < length x then Return (list_update x i nx)
+  else Fail Failure
+
+(*** Subslices *)
+
+let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
+let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : result (array a n) =
+  if length s = n then Return s
+  else Fail Failure
+
+// TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
+let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let array_update_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) (ns : slice a) : result (array a n) =
+  admit()
+
+let array_repeat (a : Type0) (n : usize) (x : a) : array a n =
+  admit()
+
+let slice_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) : result (slice a) =
+  admit()
+
+let slice_update_subslice (a : Type0) (x : slice a) (r : core_ops_range_Range usize) (ns : slice a) : result (slice a) =
+  admit()
+
+(*** Vector *)
+type alloc_vec_Vec (a : Type0) = v:list a{length v <= usize_max}
+
+let alloc_vec_Vec_new (a  : Type0) : alloc_vec_Vec a = assert_norm(length #a [] == 0); []
+let alloc_vec_Vec_len (a : Type0) (v : alloc_vec_Vec a) : usize = length v
+
+// Helper
+let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : result a =
+  if i < length v then Return (index v i) else Fail Failure
+// Helper
+let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
+  Pure (result (alloc_vec_Vec a))
+  (requires True)
+  (ensures (fun res ->
+    match res with
+    | Fail e -> e == Failure
+    | Return v' -> length v' = length v + 1)) =
+  if length v < usize_max then begin
+    (**) assert_norm(length [x] == 1);
+    (**) append_length v [x];
+    (**) assert(length (append v [x]) = length v + 1);
+    Return (append v [x])
+    end
+  else Fail Failure
+
+// The **forward** function shouldn't be used
+let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
+  if i < length v then Return () else Fail Failure
+let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
+  if i < length v then Return (list_update v i x) else Fail Failure
+
+// Trait declaration: [core::slice::index::private_slice_index::Sealed]
+type core_slice_index_private_slice_index_Sealed (self : Type0) = unit
+
+// Trait declaration: [core::slice::index::SliceIndex]
+noeq type core_slice_index_SliceIndex (self t : Type0) = {
+  sealedInst : core_slice_index_private_slice_index_Sealed self;
+  output : Type0;
+  get : self → t → result (option output);
+  get_mut : self → t → result (option output);
+  get_mut_back : self → t → option output → result t;
+  get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
+  get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
+  index : self → t → result output;
+  index_mut : self → t → result output;
+  index_mut_back : self → t → output → result t;
+}
+
+// [core::slice::index::[T]::index]: forward function
+let core_slice_index_Slice_index
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (s : slice t) (i : idx) : result inst.output =
+  let* x = inst.get i s in
+  match x with
+  | None -> Fail Failure
+  | Some x -> Return x
+
+// [core::slice::index::Range:::get]: forward function
+let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize) (s : slice t) :
+  result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: forward function
+let core_slice_index_RangeUsize_get_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_mut]: backward function 0
+let core_slice_index_RangeUsize_get_mut_back
+  (t : Type0) :
+  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::get_unchecked]: forward function
+let core_slice_index_RangeUsize_get_unchecked
+  (t : Type0) :
+  core_ops_range_Range usize → const_raw_ptr (slice t) → result (const_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::get_unchecked_mut]: forward function
+let core_slice_index_RangeUsize_get_unchecked_mut
+  (t : Type0) :
+  core_ops_range_Range usize → mut_raw_ptr (slice t) → result (mut_raw_ptr (slice t)) =
+  // Don't know what the model should be - for now we always fail to make
+  // sure code which uses it fails
+  fun _ _ -> Fail Failure
+
+// [core::slice::index::Range::index]: forward function
+let core_slice_index_RangeUsize_index
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: forward function
+let core_slice_index_RangeUsize_index_mut
+  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::Range::index_mut]: backward function 0
+let core_slice_index_RangeUsize_index_mut_back
+  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::[T]::index_mut]: forward function
+let core_slice_index_Slice_index_mut
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → result inst.output =
+  admit () // 
+
+// [core::slice::index::[T]::index_mut]: backward function 0
+let core_slice_index_Slice_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
+  slice t → idx → inst.output → result (slice t) =
+  admit () // TODO
+
+// [core::array::[T; N]::index]: forward function
+let core_array_Array_index
+  (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
+  (a : array t n) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: forward function
+let core_array_Array_index_mut
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) : result inst.indexInst.output =
+  admit () // TODO
+
+// [core::array::[T; N]::index_mut]: backward function 0
+let core_array_Array_index_mut_back
+  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
+  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::Range]
+let core_slice_index_private_slice_index_SealedRangeUsizeInst
+  : core_slice_index_private_slice_index_Sealed (core_ops_range_Range usize) = ()
+
+// Trait implementation: [core::slice::index::Range]
+let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex (core_ops_range_Range usize) (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedRangeUsizeInst;
+  output = slice t;
+  get = core_slice_index_RangeUsize_get t;
+  get_mut = core_slice_index_RangeUsize_get_mut t;
+  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
+  get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
+  index = core_slice_index_RangeUsize_index t;
+  index_mut = core_slice_index_RangeUsize_index_mut t;
+  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (slice t) idx = {
+  output = inst.output;
+  index = core_slice_index_Slice_index t idx inst;
+}
+
+// Trait implementation: [core::slice::index::[T]]
+let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (slice t) idx = {
+  indexInst = core_ops_index_IndexSliceTIInst t idx inst;
+  index_mut = core_slice_index_Slice_index_mut t idx inst;
+  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexArrayInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_Index (slice t) idx) :
+  core_ops_index_Index (array t n) idx = {
+  output = inst.output;
+  index = core_array_Array_index t idx n inst;
+}
+
+// Trait implementation: [core::array::[T; N]]
+let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
+  (inst : core_ops_index_IndexMut (slice t) idx) :
+  core_ops_index_IndexMut (array t n) idx = {
+  indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
+  index_mut = core_array_Array_index_mut t idx n inst;
+  index_mut_back = core_array_Array_index_mut_back t idx n inst;
+}
+
+// [core::slice::index::usize::get]: forward function
+let core_slice_index_usize_get
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: forward function
+let core_slice_index_usize_get_mut
+  (t : Type0) : usize → slice t → result (option t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_mut]: backward function 0
+let core_slice_index_usize_get_mut_back
+  (t : Type0) : usize → slice t → option t → result (slice t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked]: forward function
+let core_slice_index_usize_get_unchecked
+  (t : Type0) : usize → const_raw_ptr (slice t) → result (const_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::get_unchecked_mut]: forward function
+let core_slice_index_usize_get_unchecked_mut
+  (t : Type0) : usize → mut_raw_ptr (slice t) → result (mut_raw_ptr t) =
+  admit () // TODO
+
+// [core::slice::index::usize::index]: forward function
+let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: forward function
+let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
+  admit () // TODO
+
+// [core::slice::index::usize::index_mut]: backward function 0
+let core_slice_index_usize_index_mut_back
+  (t : Type0) : usize → slice t → t → result (slice t) =
+  admit () // TODO
+
+// Trait implementation: [core::slice::index::private_slice_index::usize]
+let core_slice_index_private_slice_index_SealedUsizeInst
+  : core_slice_index_private_slice_index_Sealed usize = ()
+
+// Trait implementation: [core::slice::index::usize]
+let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
+  core_slice_index_SliceIndex usize (slice t) = {
+  sealedInst = core_slice_index_private_slice_index_SealedUsizeInst;
+  output = t;
+  get = core_slice_index_usize_get t;
+  get_mut = core_slice_index_usize_get_mut t;
+  get_mut_back = core_slice_index_usize_get_mut_back t;
+  get_unchecked = core_slice_index_usize_get_unchecked t;
+  get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
+  index = core_slice_index_usize_index t;
+  index_mut = core_slice_index_usize_index_mut t;
+  index_mut_back = core_slice_index_usize_index_mut_back t;
+}
+
+// [alloc::vec::Vec::index]: forward function
+let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: forward function
+let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
+  admit () // TODO
+
+// [alloc::vec::Vec::index_mut]: backward function 0
+let alloc_vec_Vec_index_mut_back
+  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
+  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  admit () // TODO
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_Index (alloc_vec_Vec t) idx = {
+  output = inst.output;
+  index = alloc_vec_Vec_index t idx inst;
+}
+
+// Trait implementation: [alloc::vec::Vec]
+let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
+  (inst : core_slice_index_SliceIndex idx (slice t)) :
+  core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
+  indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
+  index_mut = alloc_vec_Vec_index_mut t idx inst;
+  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
+}
+
+(*** Theorems *)
+
+let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
+  Lemma (
+    alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
+      alloc_vec_Vec_index_usize v i)
+  [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
+  =
+  admit()
+
+let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
+  Lemma (
+    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
+      alloc_vec_Vec_update_usize v i x)
+  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
+  =
+  admit()
diff --git a/tests/fstar-split/traits/Traits.fst b/tests/fstar-split/traits/Traits.fst
new file mode 100644
index 00000000..29a001b2
--- /dev/null
+++ b/tests/fstar-split/traits/Traits.fst
@@ -0,0 +1,476 @@
+(** THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS *)
+(** [traits] *)
+module Traits
+open Primitives
+
+#set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
+
+(** Trait declaration: [traits::BoolTrait]
+    Source: 'src/traits.rs', lines 1:0-1:19 *)
+noeq type boolTrait_t (self : Type0) = { get_bool : self -> result bool; }
+
+(** [traits::{bool}::get_bool]: forward function
+    Source: 'src/traits.rs', lines 12:4-12:30 *)
+let bool_get_bool (self : bool) : result bool =
+  Return self
+
+(** Trait implementation: [traits::{bool}]
+    Source: 'src/traits.rs', lines 11:0-11:23 *)
+let traits_BoolTraitBoolInst : boolTrait_t bool = { get_bool = bool_get_bool; }
+
+(** [traits::BoolTrait::ret_true]: forward function
+    Source: 'src/traits.rs', lines 6:4-6:30 *)
+let boolTrait_ret_true
+  (#self : Type0) (self_clause : boolTrait_t self) (self1 : self) :
+  result bool
+  =
+  Return true
+
+(** [traits::test_bool_trait_bool]: forward function
+    Source: 'src/traits.rs', lines 17:0-17:44 *)
+let test_bool_trait_bool (x : bool) : result bool =
+  let* b = bool_get_bool x in
+  if b then boolTrait_ret_true traits_BoolTraitBoolInst x else Return false
+
+(** [traits::{core::option::Option<T>#1}::get_bool]: forward function
+    Source: 'src/traits.rs', lines 23:4-23:30 *)
+let option_get_bool (t : Type0) (self : option t) : result bool =
+  begin match self with | None -> Return false | Some _ -> Return true end
+
+(** Trait implementation: [traits::{core::option::Option<T>#1}]
+    Source: 'src/traits.rs', lines 22:0-22:31 *)
+let traits_BoolTraitcoreoptionOptionTInst (t : Type0) : boolTrait_t (option t)
+  = {
+  get_bool = option_get_bool t;
+}
+
+(** [traits::test_bool_trait_option]: forward function
+    Source: 'src/traits.rs', lines 31:0-31:54 *)
+let test_bool_trait_option (t : Type0) (x : option t) : result bool =
+  let* b = option_get_bool t x in
+  if b
+  then boolTrait_ret_true (traits_BoolTraitcoreoptionOptionTInst t) x
+  else Return false
+
+(** [traits::test_bool_trait]: forward function
+    Source: 'src/traits.rs', lines 35:0-35:50 *)
+let test_bool_trait
+  (t : Type0) (boolTraitTInst : boolTrait_t t) (x : t) : result bool =
+  boolTraitTInst.get_bool x
+
+(** Trait declaration: [traits::ToU64]
+    Source: 'src/traits.rs', lines 39:0-39:15 *)
+noeq type toU64_t (self : Type0) = { to_u64 : self -> result u64; }
+
+(** [traits::{u64#2}::to_u64]: forward function
+    Source: 'src/traits.rs', lines 44:4-44:26 *)
+let u64_to_u64 (self : u64) : result u64 =
+  Return self
+
+(** Trait implementation: [traits::{u64#2}]
+    Source: 'src/traits.rs', lines 43:0-43:18 *)
+let traits_ToU64U64Inst : toU64_t u64 = { to_u64 = u64_to_u64; }
+
+(** [traits::{(A, A)#3}::to_u64]: forward function
+    Source: 'src/traits.rs', lines 50:4-50:26 *)
+let pair_to_u64
+  (a : Type0) (toU64AInst : toU64_t a) (self : (a & a)) : result u64 =
+  let (x, x1) = self in
+  let* i = toU64AInst.to_u64 x in
+  let* i1 = toU64AInst.to_u64 x1 in
+  u64_add i i1
+
+(** Trait implementation: [traits::{(A, A)#3}]
+    Source: 'src/traits.rs', lines 49:0-49:31 *)
+let traits_ToU64TupleAAInst (a : Type0) (toU64AInst : toU64_t a) : toU64_t (a &
+  a) = {
+  to_u64 = pair_to_u64 a toU64AInst;
+}
+
+(** [traits::f]: forward function
+    Source: 'src/traits.rs', lines 55:0-55:36 *)
+let f (t : Type0) (toU64TInst : toU64_t t) (x : (t & t)) : result u64 =
+  pair_to_u64 t toU64TInst x
+
+(** [traits::g]: forward function
+    Source: 'src/traits.rs', lines 59:0-61:18 *)
+let g
+  (t : Type0) (toU64TupleTTInst : toU64_t (t & t)) (x : (t & t)) : result u64 =
+  toU64TupleTTInst.to_u64 x
+
+(** [traits::h0]: forward function
+    Source: 'src/traits.rs', lines 66:0-66:24 *)
+let h0 (x : u64) : result u64 =
+  u64_to_u64 x
+
+(** [traits::Wrapper]
+    Source: 'src/traits.rs', lines 70:0-70:21 *)
+type wrapper_t (t : Type0) = { x : t; }
+
+(** [traits::{traits::Wrapper<T>#4}::to_u64]: forward function
+    Source: 'src/traits.rs', lines 75:4-75:26 *)
+let wrapper_to_u64
+  (t : Type0) (toU64TInst : toU64_t t) (self : wrapper_t t) : result u64 =
+  toU64TInst.to_u64 self.x
+
+(** Trait implementation: [traits::{traits::Wrapper<T>#4}]
+    Source: 'src/traits.rs', lines 74:0-74:35 *)
+let traits_ToU64traitsWrapperTInst (t : Type0) (toU64TInst : toU64_t t) :
+  toU64_t (wrapper_t t) = {
+  to_u64 = wrapper_to_u64 t toU64TInst;
+}
+
+(** [traits::h1]: forward function
+    Source: 'src/traits.rs', lines 80:0-80:33 *)
+let h1 (x : wrapper_t u64) : result u64 =
+  wrapper_to_u64 u64 traits_ToU64U64Inst x
+
+(** [traits::h2]: forward function
+    Source: 'src/traits.rs', lines 84:0-84:41 *)
+let h2 (t : Type0) (toU64TInst : toU64_t t) (x : wrapper_t t) : result u64 =
+  wrapper_to_u64 t toU64TInst x
+
+(** Trait declaration: [traits::ToType]
+    Source: 'src/traits.rs', lines 88:0-88:19 *)
+noeq type toType_t (self t : Type0) = { to_type : self -> result t; }
+
+(** [traits::{u64#5}::to_type]: forward function
+    Source: 'src/traits.rs', lines 93:4-93:28 *)
+let u64_to_type (self : u64) : result bool =
+  Return (self > 0)
+
+(** Trait implementation: [traits::{u64#5}]
+    Source: 'src/traits.rs', lines 92:0-92:25 *)
+let traits_ToTypeU64BoolInst : toType_t u64 bool = { to_type = u64_to_type; }
+
+(** Trait declaration: [traits::OfType]
+    Source: 'src/traits.rs', lines 98:0-98:16 *)
+noeq type ofType_t (self : Type0) = {
+  of_type : (t : Type0) -> (toTypeTSelfInst : toType_t t self) -> t -> result
+    self;
+}
+
+(** [traits::h3]: forward function
+    Source: 'src/traits.rs', lines 104:0-104:50 *)
+let h3
+  (t1 t2 : Type0) (ofTypeT1Inst : ofType_t t1) (toTypeT2T1Inst : toType_t t2
+  t1) (y : t2) :
+  result t1
+  =
+  ofTypeT1Inst.of_type t2 toTypeT2T1Inst y
+
+(** Trait declaration: [traits::OfTypeBis]
+    Source: 'src/traits.rs', lines 109:0-109:36 *)
+noeq type ofTypeBis_t (self t : Type0) = {
+  toTypeTSelfInst : toType_t t self;
+  of_type : t -> result self;
+}
+
+(** [traits::h4]: forward function
+    Source: 'src/traits.rs', lines 118:0-118:57 *)
+let h4
+  (t1 t2 : Type0) (ofTypeBisT1T2Inst : ofTypeBis_t t1 t2) (toTypeT2T1Inst :
+  toType_t t2 t1) (y : t2) :
+  result t1
+  =
+  ofTypeBisT1T2Inst.of_type y
+
+(** [traits::TestType]
+    Source: 'src/traits.rs', lines 122:0-122:22 *)
+type testType_t (t : Type0) = t
+
+(** [traits::{traits::TestType<T>#6}::test::TestType1]
+    Source: 'src/traits.rs', lines 127:8-127:24 *)
+type testType_test_TestType1_t = u64
+
+(** Trait declaration: [traits::{traits::TestType<T>#6}::test::TestTrait]
+    Source: 'src/traits.rs', lines 128:8-128:23 *)
+noeq type testType_test_TestTrait_t (self : Type0) = {
+  test : self -> result bool;
+}
+
+(** [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]: forward function
+    Source: 'src/traits.rs', lines 139:12-139:34 *)
+let testType_test_TestType1_test
+  (self : testType_test_TestType1_t) : result bool =
+  Return (self > 1)
+
+(** Trait implementation: [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}]
+    Source: 'src/traits.rs', lines 138:8-138:36 *)
+let traits_TestType_test_TestTraittraitstraitsTestTypeTtestTestType1Inst :
+  testType_test_TestTrait_t testType_test_TestType1_t = {
+  test = testType_test_TestType1_test;
+}
+
+(** [traits::{traits::TestType<T>#6}::test]: forward function
+    Source: 'src/traits.rs', lines 126:4-126:36 *)
+let testType_test
+  (t : Type0) (toU64TInst : toU64_t t) (self : testType_t t) (x : t) :
+  result bool
+  =
+  let* x1 = toU64TInst.to_u64 x in
+  if x1 > 0 then testType_test_TestType1_test 0 else Return false
+
+(** [traits::BoolWrapper]
+    Source: 'src/traits.rs', lines 150:0-150:22 *)
+type boolWrapper_t = bool
+
+(** [traits::{traits::BoolWrapper#7}::to_type]: forward function
+    Source: 'src/traits.rs', lines 156:4-156:25 *)
+let boolWrapper_to_type
+  (t : Type0) (toTypeBoolTInst : toType_t bool t) (self : boolWrapper_t) :
+  result t
+  =
+  toTypeBoolTInst.to_type self
+
+(** Trait implementation: [traits::{traits::BoolWrapper#7}]
+    Source: 'src/traits.rs', lines 152:0-152:33 *)
+let traits_ToTypetraitsBoolWrapperTInst (t : Type0) (toTypeBoolTInst : toType_t
+  bool t) : toType_t boolWrapper_t t = {
+  to_type = boolWrapper_to_type t toTypeBoolTInst;
+}
+
+(** [traits::WithConstTy::LEN2]
+    Source: 'src/traits.rs', lines 164:4-164:21 *)
+let with_const_ty_len2_body : result usize = Return 32
+let with_const_ty_len2_c : usize = eval_global with_const_ty_len2_body
+
+(** Trait declaration: [traits::WithConstTy]
+    Source: 'src/traits.rs', lines 161:0-161:39 *)
+noeq type withConstTy_t (self : Type0) (len : usize) = {
+  cLEN1 : usize;
+  cLEN2 : usize;
+  tV : Type0;
+  tW : Type0;
+  tW_clause_0 : toU64_t tW;
+  f : tW -> array u8 len -> result tW;
+}
+
+(** [traits::{bool#8}::LEN1]
+    Source: 'src/traits.rs', lines 175:4-175:21 *)
+let bool_len1_body : result usize = Return 12
+let bool_len1_c : usize = eval_global bool_len1_body
+
+(** [traits::{bool#8}::f]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ())
+    Source: 'src/traits.rs', lines 180:4-180:39 *)
+let bool_f (i : u64) (a : array u8 32) : result u64 =
+  Return i
+
+(** Trait implementation: [traits::{bool#8}]
+    Source: 'src/traits.rs', lines 174:0-174:29 *)
+let traits_WithConstTyBool32Inst : withConstTy_t bool 32 = {
+  cLEN1 = bool_len1_c;
+  cLEN2 = with_const_ty_len2_c;
+  tV = u8;
+  tW = u64;
+  tW_clause_0 = traits_ToU64U64Inst;
+  f = bool_f;
+}
+
+(** [traits::use_with_const_ty1]: forward function
+    Source: 'src/traits.rs', lines 183:0-183:75 *)
+let use_with_const_ty1
+  (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len) :
+  result usize
+  =
+  let i = withConstTyHLENInst.cLEN1 in Return i
+
+(** [traits::use_with_const_ty2]: forward function
+    Source: 'src/traits.rs', lines 187:0-187:73 *)
+let use_with_const_ty2
+  (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len)
+  (w : withConstTyHLENInst.tW) :
+  result unit
+  =
+  Return ()
+
+(** [traits::use_with_const_ty3]: forward function
+    Source: 'src/traits.rs', lines 189:0-189:80 *)
+let use_with_const_ty3
+  (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len)
+  (x : withConstTyHLENInst.tW) :
+  result u64
+  =
+  withConstTyHLENInst.tW_clause_0.to_u64 x
+
+(** [traits::test_where1]: forward function
+    Source: 'src/traits.rs', lines 193:0-193:40 *)
+let test_where1 (t : Type0) (_x : t) : result unit =
+  Return ()
+
+(** [traits::test_where2]: forward function
+    Source: 'src/traits.rs', lines 194:0-194:57 *)
+let test_where2
+  (t : Type0) (withConstTyT32Inst : withConstTy_t t 32) (_x : u32) :
+  result unit
+  =
+  Return ()
+
+(** Trait declaration: [traits::ParentTrait0]
+    Source: 'src/traits.rs', lines 200:0-200:22 *)
+noeq type parentTrait0_t (self : Type0) = {
+  tW : Type0;
+  get_name : self -> result string;
+  get_w : self -> result tW;
+}
+
+(** Trait declaration: [traits::ParentTrait1]
+    Source: 'src/traits.rs', lines 205:0-205:22 *)
+type parentTrait1_t (self : Type0) = unit
+
+(** Trait declaration: [traits::ChildTrait]
+    Source: 'src/traits.rs', lines 206:0-206:49 *)
+noeq type childTrait_t (self : Type0) = {
+  parentTrait0SelfInst : parentTrait0_t self;
+  parentTrait1SelfInst : parentTrait1_t self;
+}
+
+(** [traits::test_parent_trait0]: forward function
+    Source: 'src/traits.rs', lines 208:0-208:57 *)
+let test_parent_trait0
+  (t : Type0) (parentTrait0TInst : parentTrait0_t t) (x : t) :
+  result parentTrait0TInst.tW
+  =
+  parentTrait0TInst.get_w x
+
+(** [traits::test_child_trait1]: forward function
+    Source: 'src/traits.rs', lines 213:0-213:56 *)
+let test_child_trait1
+  (t : Type0) (childTraitTInst : childTrait_t t) (x : t) : result string =
+  childTraitTInst.parentTrait0SelfInst.get_name x
+
+(** [traits::test_child_trait2]: forward function
+    Source: 'src/traits.rs', lines 217:0-217:54 *)
+let test_child_trait2
+  (t : Type0) (childTraitTInst : childTrait_t t) (x : t) :
+  result childTraitTInst.parentTrait0SelfInst.tW
+  =
+  childTraitTInst.parentTrait0SelfInst.get_w x
+
+(** [traits::order1]: forward function
+    Source: 'src/traits.rs', lines 223:0-223:59 *)
+let order1
+  (t u : Type0) (parentTrait0TInst : parentTrait0_t t) (parentTrait0UInst :
+  parentTrait0_t u) :
+  result unit
+  =
+  Return ()
+
+(** Trait declaration: [traits::ChildTrait1]
+    Source: 'src/traits.rs', lines 226:0-226:35 *)
+noeq type childTrait1_t (self : Type0) = {
+  parentTrait1SelfInst : parentTrait1_t self;
+}
+
+(** Trait implementation: [traits::{usize#9}]
+    Source: 'src/traits.rs', lines 228:0-228:27 *)
+let traits_ParentTrait1UsizeInst : parentTrait1_t usize = ()
+
+(** Trait implementation: [traits::{usize#10}]
+    Source: 'src/traits.rs', lines 229:0-229:26 *)
+let traits_ChildTrait1UsizeInst : childTrait1_t usize = {
+  parentTrait1SelfInst = traits_ParentTrait1UsizeInst;
+}
+
+(** Trait declaration: [traits::Iterator]
+    Source: 'src/traits.rs', lines 233:0-233:18 *)
+noeq type iterator_t (self : Type0) = { tItem : Type0; }
+
+(** Trait declaration: [traits::IntoIterator]
+    Source: 'src/traits.rs', lines 237:0-237:22 *)
+noeq type intoIterator_t (self : Type0) = {
+  tItem : Type0;
+  tIntoIter : Type0;
+  tIntoIter_clause_0 : iterator_t tIntoIter;
+  into_iter : self -> result tIntoIter;
+}
+
+(** Trait declaration: [traits::FromResidual]
+    Source: 'src/traits.rs', lines 254:0-254:21 *)
+type fromResidual_t (self t : Type0) = unit
+
+(** Trait declaration: [traits::Try]
+    Source: 'src/traits.rs', lines 250:0-250:48 *)
+noeq type try_t (self : Type0) = {
+  tResidual : Type0;
+  fromResidualSelftraitsTrySelfResidualInst : fromResidual_t self tResidual;
+}
+
+(** Trait declaration: [traits::WithTarget]
+    Source: 'src/traits.rs', lines 256:0-256:20 *)
+noeq type withTarget_t (self : Type0) = { tTarget : Type0; }
+
+(** Trait declaration: [traits::ParentTrait2]
+    Source: 'src/traits.rs', lines 260:0-260:22 *)
+noeq type parentTrait2_t (self : Type0) = {
+  tU : Type0;
+  tU_clause_0 : withTarget_t tU;
+}
+
+(** Trait declaration: [traits::ChildTrait2]
+    Source: 'src/traits.rs', lines 264:0-264:35 *)
+noeq type childTrait2_t (self : Type0) = {
+  parentTrait2SelfInst : parentTrait2_t self;
+  convert : parentTrait2SelfInst.tU -> result
+    parentTrait2SelfInst.tU_clause_0.tTarget;
+}
+
+(** Trait implementation: [traits::{u32#11}]
+    Source: 'src/traits.rs', lines 268:0-268:23 *)
+let traits_WithTargetU32Inst : withTarget_t u32 = { tTarget = u32; }
+
+(** Trait implementation: [traits::{u32#12}]
+    Source: 'src/traits.rs', lines 272:0-272:25 *)
+let traits_ParentTrait2U32Inst : parentTrait2_t u32 = {
+  tU = u32;
+  tU_clause_0 = traits_WithTargetU32Inst;
+}
+
+(** [traits::{u32#13}::convert]: forward function
+    Source: 'src/traits.rs', lines 277:4-277:29 *)
+let u32_convert (x : u32) : result u32 =
+  Return x
+
+(** Trait implementation: [traits::{u32#13}]
+    Source: 'src/traits.rs', lines 276:0-276:24 *)
+let traits_ChildTrait2U32Inst : childTrait2_t u32 = {
+  parentTrait2SelfInst = traits_ParentTrait2U32Inst;
+  convert = u32_convert;
+}
+
+(** Trait declaration: [traits::CFnOnce]
+    Source: 'src/traits.rs', lines 290:0-290:23 *)
+noeq type cFnOnce_t (self args : Type0) = {
+  tOutput : Type0;
+  call_once : self -> args -> result tOutput;
+}
+
+(** Trait declaration: [traits::CFnMut]
+    Source: 'src/traits.rs', lines 296:0-296:37 *)
+noeq type cFnMut_t (self args : Type0) = {
+  cFnOnceSelfArgsInst : cFnOnce_t self args;
+  call_mut : self -> args -> result cFnOnceSelfArgsInst.tOutput;
+  call_mut_back : self -> args -> result self;
+}
+
+(** Trait declaration: [traits::CFn]
+    Source: 'src/traits.rs', lines 300:0-300:33 *)
+noeq type cFn_t (self args : Type0) = {
+  cFnMutSelfArgsInst : cFnMut_t self args;
+  call : self -> args -> result cFnMutSelfArgsInst.cFnOnceSelfArgsInst.tOutput;
+}
+
+(** Trait declaration: [traits::GetTrait]
+    Source: 'src/traits.rs', lines 304:0-304:18 *)
+noeq type getTrait_t (self : Type0) = { tW : Type0; get_w : self -> result tW;
+}
+
+(** [traits::test_get_trait]: forward function
+    Source: 'src/traits.rs', lines 309:0-309:49 *)
+let test_get_trait
+  (t : Type0) (getTraitTInst : getTrait_t t) (x : t) :
+  result getTraitTInst.tW
+  =
+  getTraitTInst.get_w x
+
diff --git a/tests/fstar/array/Array.Clauses.Template.fst b/tests/fstar/array/Array.Clauses.Template.fst
index 84347ab9..b2f2649c 100644
--- a/tests/fstar/array/Array.Clauses.Template.fst
+++ b/tests/fstar/array/Array.Clauses.Template.fst
@@ -9,13 +9,13 @@ open Array.Types
 (** [array::sum]: decreases clause
     Source: 'src/array.rs', lines 242:0-250:1 *)
 unfold
-let sum_loop_decreases (s : slice u32) (sum0 : u32) (i : usize) : nat =
+let sum_loop_decreases (s : slice u32) (sum1 : u32) (i : usize) : nat =
   admit ()
 
 (** [array::sum2]: decreases clause
     Source: 'src/array.rs', lines 252:0-261:1 *)
 unfold
-let sum2_loop_decreases (s : slice u32) (s2 : slice u32) (sum0 : u32)
+let sum2_loop_decreases (s : slice u32) (s2 : slice u32) (sum1 : u32)
   (i : usize) : nat =
   admit ()
 
diff --git a/tests/fstar/array/Array.Funs.fst b/tests/fstar/array/Array.Funs.fst
index 935bd9c9..da4164bc 100644
--- a/tests/fstar/array/Array.Funs.fst
+++ b/tests/fstar/array/Array.Funs.fst
@@ -7,86 +7,82 @@ include Array.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [array::incr]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::incr]:
     Source: 'src/array.rs', lines 8:0-8:24 *)
 let incr (x : u32) : result u32 =
   u32_add x 1
 
-(** [array::array_to_shared_slice_]: forward function
+(** [array::array_to_shared_slice_]:
     Source: 'src/array.rs', lines 16:0-16:53 *)
 let array_to_shared_slice_ (t : Type0) (s : array t 32) : result (slice t) =
   array_to_slice t 32 s
 
-(** [array::array_to_mut_slice_]: forward function
+(** [array::array_to_mut_slice_]:
     Source: 'src/array.rs', lines 21:0-21:58 *)
-let array_to_mut_slice_ (t : Type0) (s : array t 32) : result (slice t) =
-  array_to_slice t 32 s
-
-(** [array::array_to_mut_slice_]: backward function 0
-    Source: 'src/array.rs', lines 21:0-21:58 *)
-let array_to_mut_slice__back
-  (t : Type0) (s : array t 32) (ret : slice t) : result (array t 32) =
-  array_from_slice t 32 s ret
+let array_to_mut_slice_
+  (t : Type0) (s : array t 32) :
+  result ((slice t) & (slice t -> result (array t 32)))
+  =
+  let* (s1, to_slice_mut_back) = array_to_slice_mut t 32 s in
+  let back = fun ret -> to_slice_mut_back ret in
+  Return (s1, back)
 
-(** [array::array_len]: forward function
+(** [array::array_len]:
     Source: 'src/array.rs', lines 25:0-25:40 *)
 let array_len (t : Type0) (s : array t 32) : result usize =
-  let* s0 = array_to_slice t 32 s in let i = slice_len t s0 in Return i
+  let* s1 = array_to_slice t 32 s in let i = slice_len t s1 in Return i
 
-(** [array::shared_array_len]: forward function
+(** [array::shared_array_len]:
     Source: 'src/array.rs', lines 29:0-29:48 *)
 let shared_array_len (t : Type0) (s : array t 32) : result usize =
-  let* s0 = array_to_slice t 32 s in let i = slice_len t s0 in Return i
+  let* s1 = array_to_slice t 32 s in let i = slice_len t s1 in Return i
 
-(** [array::shared_slice_len]: forward function
+(** [array::shared_slice_len]:
     Source: 'src/array.rs', lines 33:0-33:44 *)
 let shared_slice_len (t : Type0) (s : slice t) : result usize =
   let i = slice_len t s in Return i
 
-(** [array::index_array_shared]: forward function
+(** [array::index_array_shared]:
     Source: 'src/array.rs', lines 37:0-37:57 *)
 let index_array_shared (t : Type0) (s : array t 32) (i : usize) : result t =
   array_index_usize t 32 s i
 
-(** [array::index_array_u32]: forward function
+(** [array::index_array_u32]:
     Source: 'src/array.rs', lines 44:0-44:53 *)
 let index_array_u32 (s : array u32 32) (i : usize) : result u32 =
   array_index_usize u32 32 s i
 
-(** [array::index_array_copy]: forward function
+(** [array::index_array_copy]:
     Source: 'src/array.rs', lines 48:0-48:45 *)
 let index_array_copy (x : array u32 32) : result u32 =
   array_index_usize u32 32 x 0
 
-(** [array::index_mut_array]: forward function
-    Source: 'src/array.rs', lines 52:0-52:62 *)
-let index_mut_array (t : Type0) (s : array t 32) (i : usize) : result t =
-  array_index_usize t 32 s i
-
-(** [array::index_mut_array]: backward function 0
+(** [array::index_mut_array]:
     Source: 'src/array.rs', lines 52:0-52:62 *)
-let index_mut_array_back
-  (t : Type0) (s : array t 32) (i : usize) (ret : t) : result (array t 32) =
-  array_update_usize t 32 s i ret
+let index_mut_array
+  (t : Type0) (s : array t 32) (i : usize) :
+  result (t & (t -> result (array t 32)))
+  =
+  let* (x, index_mut_back) = array_index_mut_usize t 32 s i in
+  let back = fun ret -> index_mut_back ret in
+  Return (x, back)
 
-(** [array::index_slice]: forward function
+(** [array::index_slice]:
     Source: 'src/array.rs', lines 56:0-56:46 *)
 let index_slice (t : Type0) (s : slice t) (i : usize) : result t =
   slice_index_usize t s i
 
-(** [array::index_mut_slice]: forward function
-    Source: 'src/array.rs', lines 60:0-60:58 *)
-let index_mut_slice (t : Type0) (s : slice t) (i : usize) : result t =
-  slice_index_usize t s i
-
-(** [array::index_mut_slice]: backward function 0
+(** [array::index_mut_slice]:
     Source: 'src/array.rs', lines 60:0-60:58 *)
-let index_mut_slice_back
-  (t : Type0) (s : slice t) (i : usize) (ret : t) : result (slice t) =
-  slice_update_usize t s i ret
+let index_mut_slice
+  (t : Type0) (s : slice t) (i : usize) :
+  result (t & (t -> result (slice t)))
+  =
+  let* (x, index_mut_back) = slice_index_mut_usize t s i in
+  let back = fun ret -> index_mut_back ret in
+  Return (x, back)
 
-(** [array::slice_subslice_shared_]: forward function
+(** [array::slice_subslice_shared_]:
     Source: 'src/array.rs', lines 64:0-64:70 *)
 let slice_subslice_shared_
   (x : slice u32) (y : usize) (z : usize) : result (slice u32) =
@@ -94,41 +90,35 @@ let slice_subslice_shared_
     (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
     { start = y; end_ = z }
 
-(** [array::slice_subslice_mut_]: forward function
+(** [array::slice_subslice_mut_]:
     Source: 'src/array.rs', lines 68:0-68:75 *)
 let slice_subslice_mut_
-  (x : slice u32) (y : usize) (z : usize) : result (slice u32) =
-  core_slice_index_Slice_index_mut u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
-    { start = y; end_ = z }
-
-(** [array::slice_subslice_mut_]: backward function 0
-    Source: 'src/array.rs', lines 68:0-68:75 *)
-let slice_subslice_mut__back
-  (x : slice u32) (y : usize) (z : usize) (ret : slice u32) :
-  result (slice u32)
+  (x : slice u32) (y : usize) (z : usize) :
+  result ((slice u32) & (slice u32 -> result (slice u32)))
   =
-  core_slice_index_Slice_index_mut_back u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
-    { start = y; end_ = z } ret
-
-(** [array::array_to_slice_shared_]: forward function
+  let* (s, index_mut_back) =
+    core_slice_index_Slice_index_mut u32 (core_ops_range_Range usize)
+      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
+      { start = y; end_ = z } in
+  let back = fun ret -> index_mut_back ret in
+  Return (s, back)
+
+(** [array::array_to_slice_shared_]:
     Source: 'src/array.rs', lines 72:0-72:54 *)
 let array_to_slice_shared_ (x : array u32 32) : result (slice u32) =
   array_to_slice u32 32 x
 
-(** [array::array_to_slice_mut_]: forward function
+(** [array::array_to_slice_mut_]:
     Source: 'src/array.rs', lines 76:0-76:59 *)
-let array_to_slice_mut_ (x : array u32 32) : result (slice u32) =
-  array_to_slice u32 32 x
-
-(** [array::array_to_slice_mut_]: backward function 0
-    Source: 'src/array.rs', lines 76:0-76:59 *)
-let array_to_slice_mut__back
-  (x : array u32 32) (ret : slice u32) : result (array u32 32) =
-  array_from_slice u32 32 x ret
+let array_to_slice_mut_
+  (x : array u32 32) :
+  result ((slice u32) & (slice u32 -> result (array u32 32)))
+  =
+  let* (s, to_slice_mut_back) = array_to_slice_mut u32 32 x in
+  let back = fun ret -> to_slice_mut_back ret in
+  Return (s, back)
 
-(** [array::array_subslice_shared_]: forward function
+(** [array::array_subslice_shared_]:
     Source: 'src/array.rs', lines 80:0-80:74 *)
 let array_subslice_shared_
   (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
@@ -137,274 +127,263 @@ let array_subslice_shared_
     (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
     { start = y; end_ = z }
 
-(** [array::array_subslice_mut_]: forward function
+(** [array::array_subslice_mut_]:
     Source: 'src/array.rs', lines 84:0-84:79 *)
 let array_subslice_mut_
-  (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
-  core_array_Array_index_mut u32 (core_ops_range_Range usize) 32
-    (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
-    { start = y; end_ = z }
-
-(** [array::array_subslice_mut_]: backward function 0
-    Source: 'src/array.rs', lines 84:0-84:79 *)
-let array_subslice_mut__back
-  (x : array u32 32) (y : usize) (z : usize) (ret : slice u32) :
-  result (array u32 32)
+  (x : array u32 32) (y : usize) (z : usize) :
+  result ((slice u32) & (slice u32 -> result (array u32 32)))
   =
-  core_array_Array_index_mut_back u32 (core_ops_range_Range usize) 32
-    (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
-    (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
-    { start = y; end_ = z } ret
+  let* (s, index_mut_back) =
+    core_array_Array_index_mut u32 (core_ops_range_Range usize) 32
+      (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
+      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
+      { start = y; end_ = z } in
+  let back = fun ret -> index_mut_back ret in
+  Return (s, back)
 
-(** [array::index_slice_0]: forward function
+(** [array::index_slice_0]:
     Source: 'src/array.rs', lines 88:0-88:38 *)
 let index_slice_0 (t : Type0) (s : slice t) : result t =
   slice_index_usize t s 0
 
-(** [array::index_array_0]: forward function
+(** [array::index_array_0]:
     Source: 'src/array.rs', lines 92:0-92:42 *)
 let index_array_0 (t : Type0) (s : array t 32) : result t =
   array_index_usize t 32 s 0
 
-(** [array::index_index_array]: forward function
+(** [array::index_index_array]:
     Source: 'src/array.rs', lines 103:0-103:71 *)
 let index_index_array
   (s : array (array u32 32) 32) (i : usize) (j : usize) : result u32 =
   let* a = array_index_usize (array u32 32) 32 s i in
   array_index_usize u32 32 a j
 
-(** [array::update_update_array]: forward function
+(** [array::update_update_array]:
     Source: 'src/array.rs', lines 114:0-114:70 *)
 let update_update_array
   (s : array (array u32 32) 32) (i : usize) (j : usize) : result unit =
-  let* a = array_index_usize (array u32 32) 32 s i in
-  let* a0 = array_update_usize u32 32 a j 0 in
-  let* _ = array_update_usize (array u32 32) 32 s i a0 in
+  let* (a, index_mut_back) = array_index_mut_usize (array u32 32) 32 s i in
+  let* (_, index_mut_back1) = array_index_mut_usize u32 32 a j in
+  let* a1 = index_mut_back1 0 in
+  let* _ = index_mut_back a1 in
   Return ()
 
-(** [array::array_local_deep_copy]: forward function
+(** [array::array_local_deep_copy]:
     Source: 'src/array.rs', lines 118:0-118:43 *)
 let array_local_deep_copy (x : array u32 32) : result unit =
   Return ()
 
-(** [array::take_array]: forward function
+(** [array::take_array]:
     Source: 'src/array.rs', lines 122:0-122:30 *)
 let take_array (a : array u32 2) : result unit =
   Return ()
 
-(** [array::take_array_borrow]: forward function
+(** [array::take_array_borrow]:
     Source: 'src/array.rs', lines 123:0-123:38 *)
 let take_array_borrow (a : array u32 2) : result unit =
   Return ()
 
-(** [array::take_slice]: forward function
+(** [array::take_slice]:
     Source: 'src/array.rs', lines 124:0-124:28 *)
 let take_slice (s : slice u32) : result unit =
   Return ()
 
-(** [array::take_mut_slice]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::take_mut_slice]:
     Source: 'src/array.rs', lines 125:0-125:36 *)
 let take_mut_slice (s : slice u32) : result (slice u32) =
   Return s
 
-(** [array::const_array]: forward function
+(** [array::const_array]:
     Source: 'src/array.rs', lines 127:0-127:32 *)
 let const_array : result (array u32 2) =
   Return (mk_array u32 2 [ 0; 0 ])
 
-(** [array::const_slice]: forward function
+(** [array::const_slice]:
     Source: 'src/array.rs', lines 131:0-131:20 *)
 let const_slice : result unit =
   let* _ = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in Return ()
 
-(** [array::take_all]: forward function
+(** [array::take_all]:
     Source: 'src/array.rs', lines 141:0-141:17 *)
 let take_all : result unit =
+  let* _ = take_array (mk_array u32 2 [ 0; 0 ]) in
   let* _ = take_array (mk_array u32 2 [ 0; 0 ]) in
   let* _ = take_array_borrow (mk_array u32 2 [ 0; 0 ]) in
   let* s = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
   let* _ = take_slice s in
-  let* s0 = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
-  let* s1 = take_mut_slice s0 in
-  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s1 in
+  let* (s1, to_slice_mut_back) =
+    array_to_slice_mut u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* s2 = take_mut_slice s1 in
+  let* _ = to_slice_mut_back s2 in
   Return ()
 
-(** [array::index_array]: forward function
+(** [array::index_array]:
     Source: 'src/array.rs', lines 155:0-155:38 *)
 let index_array (x : array u32 2) : result u32 =
   array_index_usize u32 2 x 0
 
-(** [array::index_array_borrow]: forward function
+(** [array::index_array_borrow]:
     Source: 'src/array.rs', lines 158:0-158:46 *)
 let index_array_borrow (x : array u32 2) : result u32 =
   array_index_usize u32 2 x 0
 
-(** [array::index_slice_u32_0]: forward function
+(** [array::index_slice_u32_0]:
     Source: 'src/array.rs', lines 162:0-162:42 *)
 let index_slice_u32_0 (x : slice u32) : result u32 =
   slice_index_usize u32 x 0
 
-(** [array::index_mut_slice_u32_0]: forward function
-    Source: 'src/array.rs', lines 166:0-166:50 *)
-let index_mut_slice_u32_0 (x : slice u32) : result u32 =
-  slice_index_usize u32 x 0
-
-(** [array::index_mut_slice_u32_0]: backward function 0
+(** [array::index_mut_slice_u32_0]:
     Source: 'src/array.rs', lines 166:0-166:50 *)
-let index_mut_slice_u32_0_back (x : slice u32) : result (slice u32) =
-  let* _ = slice_index_usize u32 x 0 in Return x
+let index_mut_slice_u32_0 (x : slice u32) : result (u32 & (slice u32)) =
+  let* i = slice_index_usize u32 x 0 in Return (i, x)
 
-(** [array::index_all]: forward function
+(** [array::index_all]:
     Source: 'src/array.rs', lines 170:0-170:25 *)
 let index_all : result u32 =
   let* i = index_array (mk_array u32 2 [ 0; 0 ]) in
-  let* i0 = index_array (mk_array u32 2 [ 0; 0 ]) in
-  let* i1 = u32_add i i0 in
-  let* i2 = index_array_borrow (mk_array u32 2 [ 0; 0 ]) in
-  let* i3 = u32_add i1 i2 in
+  let* i1 = index_array (mk_array u32 2 [ 0; 0 ]) in
+  let* i2 = u32_add i i1 in
+  let* i3 = index_array_borrow (mk_array u32 2 [ 0; 0 ]) in
+  let* i4 = u32_add i2 i3 in
   let* s = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
-  let* i4 = index_slice_u32_0 s in
-  let* i5 = u32_add i3 i4 in
-  let* s0 = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
-  let* i6 = index_mut_slice_u32_0 s0 in
-  let* i7 = u32_add i5 i6 in
-  let* s1 = index_mut_slice_u32_0_back s0 in
-  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s1 in
-  Return i7
-
-(** [array::update_array]: forward function
+  let* i5 = index_slice_u32_0 s in
+  let* i6 = u32_add i4 i5 in
+  let* (s1, to_slice_mut_back) =
+    array_to_slice_mut u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* (i7, s2) = index_mut_slice_u32_0 s1 in
+  let* i8 = u32_add i6 i7 in
+  let* _ = to_slice_mut_back s2 in
+  Return i8
+
+(** [array::update_array]:
     Source: 'src/array.rs', lines 184:0-184:36 *)
 let update_array (x : array u32 2) : result unit =
-  let* _ = array_update_usize u32 2 x 0 1 in Return ()
+  let* (_, index_mut_back) = array_index_mut_usize u32 2 x 0 in
+  let* _ = index_mut_back 1 in
+  Return ()
 
-(** [array::update_array_mut_borrow]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::update_array_mut_borrow]:
     Source: 'src/array.rs', lines 187:0-187:48 *)
 let update_array_mut_borrow (x : array u32 2) : result (array u32 2) =
-  array_update_usize u32 2 x 0 1
+  let* (_, index_mut_back) = array_index_mut_usize u32 2 x 0 in
+  index_mut_back 1
 
-(** [array::update_mut_slice]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [array::update_mut_slice]:
     Source: 'src/array.rs', lines 190:0-190:38 *)
 let update_mut_slice (x : slice u32) : result (slice u32) =
-  slice_update_usize u32 x 0 1
+  let* (_, index_mut_back) = slice_index_mut_usize u32 x 0 in index_mut_back 1
 
-(** [array::update_all]: forward function
+(** [array::update_all]:
     Source: 'src/array.rs', lines 194:0-194:19 *)
 let update_all : result unit =
   let* _ = update_array (mk_array u32 2 [ 0; 0 ]) in
-  let* x = update_array_mut_borrow (mk_array u32 2 [ 0; 0 ]) in
-  let* s = array_to_slice u32 2 x in
-  let* s0 = update_mut_slice s in
-  let* _ = array_from_slice u32 2 x s0 in
+  let* _ = update_array (mk_array u32 2 [ 0; 0 ]) in
+  let* a = update_array_mut_borrow (mk_array u32 2 [ 0; 0 ]) in
+  let* (s, to_slice_mut_back) = array_to_slice_mut u32 2 a in
+  let* s1 = update_mut_slice s in
+  let* _ = to_slice_mut_back s1 in
   Return ()
 
-(** [array::range_all]: forward function
+(** [array::range_all]:
     Source: 'src/array.rs', lines 205:0-205:18 *)
 let range_all : result unit =
-  let* s =
+  let* (s, index_mut_back) =
     core_array_Array_index_mut u32 (core_ops_range_Range usize) 4
       (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
       (core_slice_index_SliceIndexRangeUsizeSliceTInst u32))
       (mk_array u32 4 [ 0; 0; 0; 0 ]) { start = 1; end_ = 3 } in
-  let* s0 = update_mut_slice s in
-  let* _ =
-    core_array_Array_index_mut_back u32 (core_ops_range_Range usize) 4
-      (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
-      (core_slice_index_SliceIndexRangeUsizeSliceTInst u32))
-      (mk_array u32 4 [ 0; 0; 0; 0 ]) { start = 1; end_ = 3 } s0 in
+  let* s1 = update_mut_slice s in
+  let* _ = index_mut_back s1 in
   Return ()
 
-(** [array::deref_array_borrow]: forward function
+(** [array::deref_array_borrow]:
     Source: 'src/array.rs', lines 214:0-214:46 *)
 let deref_array_borrow (x : array u32 2) : result u32 =
   array_index_usize u32 2 x 0
 
-(** [array::deref_array_mut_borrow]: forward function
+(** [array::deref_array_mut_borrow]:
     Source: 'src/array.rs', lines 219:0-219:54 *)
-let deref_array_mut_borrow (x : array u32 2) : result u32 =
-  array_index_usize u32 2 x 0
+let deref_array_mut_borrow (x : array u32 2) : result (u32 & (array u32 2)) =
+  let* i = array_index_usize u32 2 x 0 in Return (i, x)
 
-(** [array::deref_array_mut_borrow]: backward function 0
-    Source: 'src/array.rs', lines 219:0-219:54 *)
-let deref_array_mut_borrow_back (x : array u32 2) : result (array u32 2) =
-  let* _ = array_index_usize u32 2 x 0 in Return x
-
-(** [array::take_array_t]: forward function
+(** [array::take_array_t]:
     Source: 'src/array.rs', lines 227:0-227:31 *)
 let take_array_t (a : array aB_t 2) : result unit =
   Return ()
 
-(** [array::non_copyable_array]: forward function
+(** [array::non_copyable_array]:
     Source: 'src/array.rs', lines 229:0-229:27 *)
 let non_copyable_array : result unit =
   let* _ = take_array_t (mk_array aB_t 2 [ AB_A; AB_B ]) in Return ()
 
-(** [array::sum]: loop 0: forward function
+(** [array::sum]: loop 0:
     Source: 'src/array.rs', lines 242:0-250:1 *)
 let rec sum_loop
-  (s : slice u32) (sum0 : u32) (i : usize) :
-  Tot (result u32) (decreases (sum_loop_decreases s sum0 i))
+  (s : slice u32) (sum1 : u32) (i : usize) :
+  Tot (result u32) (decreases (sum_loop_decreases s sum1 i))
   =
-  let i0 = slice_len u32 s in
-  if i < i0
+  let i1 = slice_len u32 s in
+  if i < i1
   then
-    let* i1 = slice_index_usize u32 s i in
-    let* sum1 = u32_add sum0 i1 in
-    let* i2 = usize_add i 1 in
-    sum_loop s sum1 i2
-  else Return sum0
+    let* i2 = slice_index_usize u32 s i in
+    let* sum3 = u32_add sum1 i2 in
+    let* i3 = usize_add i 1 in
+    sum_loop s sum3 i3
+  else Return sum1
 
-(** [array::sum]: forward function
+(** [array::sum]:
     Source: 'src/array.rs', lines 242:0-242:28 *)
 let sum (s : slice u32) : result u32 =
   sum_loop s 0 0
 
-(** [array::sum2]: loop 0: forward function
+(** [array::sum2]: loop 0:
     Source: 'src/array.rs', lines 252:0-261:1 *)
 let rec sum2_loop
-  (s : slice u32) (s2 : slice u32) (sum0 : u32) (i : usize) :
-  Tot (result u32) (decreases (sum2_loop_decreases s s2 sum0 i))
+  (s : slice u32) (s2 : slice u32) (sum1 : u32) (i : usize) :
+  Tot (result u32) (decreases (sum2_loop_decreases s s2 sum1 i))
   =
-  let i0 = slice_len u32 s in
-  if i < i0
+  let i1 = slice_len u32 s in
+  if i < i1
   then
-    let* i1 = slice_index_usize u32 s i in
-    let* i2 = slice_index_usize u32 s2 i in
-    let* i3 = u32_add i1 i2 in
-    let* sum1 = u32_add sum0 i3 in
-    let* i4 = usize_add i 1 in
-    sum2_loop s s2 sum1 i4
-  else Return sum0
-
-(** [array::sum2]: forward function
+    let* i2 = slice_index_usize u32 s i in
+    let* i3 = slice_index_usize u32 s2 i in
+    let* i4 = u32_add i2 i3 in
+    let* sum3 = u32_add sum1 i4 in
+    let* i5 = usize_add i 1 in
+    sum2_loop s s2 sum3 i5
+  else Return sum1
+
+(** [array::sum2]:
     Source: 'src/array.rs', lines 252:0-252:41 *)
 let sum2 (s : slice u32) (s2 : slice u32) : result u32 =
   let i = slice_len u32 s in
-  let i0 = slice_len u32 s2 in
-  if not (i = i0) then Fail Failure else sum2_loop s s2 0 0
+  let i1 = slice_len u32 s2 in
+  if not (i = i1) then Fail Failure else sum2_loop s s2 0 0
 
-(** [array::f0]: forward function
+(** [array::f0]:
     Source: 'src/array.rs', lines 263:0-263:11 *)
 let f0 : result unit =
-  let* s = array_to_slice u32 2 (mk_array u32 2 [ 1; 2 ]) in
-  let* s0 = slice_update_usize u32 s 0 1 in
-  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 1; 2 ]) s0 in
+  let* (s, to_slice_mut_back) =
+    array_to_slice_mut u32 2 (mk_array u32 2 [ 1; 2 ]) in
+  let* (_, index_mut_back) = slice_index_mut_usize u32 s 0 in
+  let* s1 = index_mut_back 1 in
+  let* _ = to_slice_mut_back s1 in
   Return ()
 
-(** [array::f1]: forward function
+(** [array::f1]:
     Source: 'src/array.rs', lines 268:0-268:11 *)
 let f1 : result unit =
-  let* _ = array_update_usize u32 2 (mk_array u32 2 [ 1; 2 ]) 0 1 in Return ()
+  let* (_, index_mut_back) =
+    array_index_mut_usize u32 2 (mk_array u32 2 [ 1; 2 ]) 0 in
+  let* _ = index_mut_back 1 in
+  Return ()
 
-(** [array::f2]: forward function
+(** [array::f2]:
     Source: 'src/array.rs', lines 273:0-273:17 *)
 let f2 (i : u32) : result unit =
   Return ()
 
-(** [array::f4]: forward function
+(** [array::f4]:
     Source: 'src/array.rs', lines 282:0-282:54 *)
 let f4 (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
   core_array_Array_index u32 (core_ops_range_Range usize) 32
@@ -412,34 +391,36 @@ let f4 (x : array u32 32) (y : usize) (z : usize) : result (slice u32) =
     (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
     { start = y; end_ = z }
 
-(** [array::f3]: forward function
+(** [array::f3]:
     Source: 'src/array.rs', lines 275:0-275:18 *)
 let f3 : result u32 =
   let* i = array_index_usize u32 2 (mk_array u32 2 [ 1; 2 ]) 0 in
   let* _ = f2 i in
   let b = array_repeat u32 32 0 in
   let* s = array_to_slice u32 2 (mk_array u32 2 [ 1; 2 ]) in
-  let* s0 = f4 b 16 18 in
-  sum2 s s0
+  let* s1 = f4 b 16 18 in
+  sum2 s s1
 
 (** [array::SZ]
     Source: 'src/array.rs', lines 286:0-286:19 *)
 let sz_body : result usize = Return 32
 let sz_c : usize = eval_global sz_body
 
-(** [array::f5]: forward function
+(** [array::f5]:
     Source: 'src/array.rs', lines 289:0-289:31 *)
 let f5 (x : array u32 32) : result u32 =
   array_index_usize u32 32 x 0
 
-(** [array::ite]: forward function
+(** [array::ite]:
     Source: 'src/array.rs', lines 294:0-294:12 *)
 let ite : result unit =
-  let* s = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
-  let* s0 = array_to_slice u32 2 (mk_array u32 2 [ 0; 0 ]) in
-  let* s1 = index_mut_slice_u32_0_back s0 in
-  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s1 in
-  let* s2 = index_mut_slice_u32_0_back s in
-  let* _ = array_from_slice u32 2 (mk_array u32 2 [ 0; 0 ]) s2 in
+  let* (s, to_slice_mut_back) =
+    array_to_slice_mut u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* (_, s1) = index_mut_slice_u32_0 s in
+  let* (s2, to_slice_mut_back1) =
+    array_to_slice_mut u32 2 (mk_array u32 2 [ 0; 0 ]) in
+  let* (_, s3) = index_mut_slice_u32_0 s2 in
+  let* _ = to_slice_mut_back1 s3 in
+  let* _ = to_slice_mut_back s1 in
   Return ()
 
diff --git a/tests/fstar/array/Primitives.fst b/tests/fstar/array/Primitives.fst
index a3ffbde4..fca80829 100644
--- a/tests/fstar/array/Primitives.fst
+++ b/tests/fstar/array/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -535,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -552,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -559,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
@@ -588,8 +603,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +625,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +636,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +658,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +684,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +703,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +718,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +738,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +754,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +762,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +781,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +796,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +809,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +827,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +842,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/fstar/betree/BetreeMain.Funs.fst b/tests/fstar/betree/BetreeMain.Funs.fst
index f844b0ec..a3065f3d 100644
--- a/tests/fstar/betree/BetreeMain.Funs.fst
+++ b/tests/fstar/betree/BetreeMain.Funs.fst
@@ -8,7 +8,7 @@ include BetreeMain.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree::load_internal_node]: forward function
+(** [betree_main::betree::load_internal_node]:
     Source: 'src/betree.rs', lines 36:0-36:52 *)
 let betree_load_internal_node
   (id : u64) (st : state) :
@@ -16,58 +16,48 @@ let betree_load_internal_node
   =
   betree_utils_load_internal_node id st
 
-(** [betree_main::betree::store_internal_node]: forward function
+(** [betree_main::betree::store_internal_node]:
     Source: 'src/betree.rs', lines 41:0-41:60 *)
 let betree_store_internal_node
   (id : u64) (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
   result (state & unit)
   =
-  let* (st0, _) = betree_utils_store_internal_node id content st in
-  Return (st0, ())
+  let* (st1, _) = betree_utils_store_internal_node id content st in
+  Return (st1, ())
 
-(** [betree_main::betree::load_leaf_node]: forward function
+(** [betree_main::betree::load_leaf_node]:
     Source: 'src/betree.rs', lines 46:0-46:44 *)
 let betree_load_leaf_node
   (id : u64) (st : state) : result (state & (betree_List_t (u64 & u64))) =
   betree_utils_load_leaf_node id st
 
-(** [betree_main::betree::store_leaf_node]: forward function
+(** [betree_main::betree::store_leaf_node]:
     Source: 'src/betree.rs', lines 51:0-51:52 *)
 let betree_store_leaf_node
   (id : u64) (content : betree_List_t (u64 & u64)) (st : state) :
   result (state & unit)
   =
-  let* (st0, _) = betree_utils_store_leaf_node id content st in
-  Return (st0, ())
+  let* (st1, _) = betree_utils_store_leaf_node id content st in
+  Return (st1, ())
 
-(** [betree_main::betree::fresh_node_id]: forward function
+(** [betree_main::betree::fresh_node_id]:
     Source: 'src/betree.rs', lines 55:0-55:48 *)
-let betree_fresh_node_id (counter : u64) : result u64 =
-  let* _ = u64_add counter 1 in Return counter
+let betree_fresh_node_id (counter : u64) : result (u64 & u64) =
+  let* counter1 = u64_add counter 1 in Return (counter, counter1)
 
-(** [betree_main::betree::fresh_node_id]: backward function 0
-    Source: 'src/betree.rs', lines 55:0-55:48 *)
-let betree_fresh_node_id_back (counter : u64) : result u64 =
-  u64_add counter 1
-
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]: forward function
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]:
     Source: 'src/betree.rs', lines 206:4-206:20 *)
 let betree_NodeIdCounter_new : result betree_NodeIdCounter_t =
   Return { next_node_id = 0 }
 
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: forward function
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]:
     Source: 'src/betree.rs', lines 210:4-210:36 *)
 let betree_NodeIdCounter_fresh_id
-  (self : betree_NodeIdCounter_t) : result u64 =
-  let* _ = u64_add self.next_node_id 1 in Return self.next_node_id
-
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: backward function 0
-    Source: 'src/betree.rs', lines 210:4-210:36 *)
-let betree_NodeIdCounter_fresh_id_back
-  (self : betree_NodeIdCounter_t) : result betree_NodeIdCounter_t =
-  let* i = u64_add self.next_node_id 1 in Return { next_node_id = i }
+  (self : betree_NodeIdCounter_t) : result (u64 & betree_NodeIdCounter_t) =
+  let* i = u64_add self.next_node_id 1 in
+  Return (self.next_node_id, { next_node_id = i })
 
-(** [betree_main::betree::upsert_update]: forward function
+(** [betree_main::betree::upsert_update]:
     Source: 'src/betree.rs', lines 234:0-234:70 *)
 let betree_upsert_update
   (prev : option u64) (st : betree_UpsertFunState_t) : result u64 =
@@ -75,30 +65,30 @@ let betree_upsert_update
   | None ->
     begin match st with
     | Betree_UpsertFunState_Add v -> Return v
-    | Betree_UpsertFunState_Sub i -> Return 0
+    | Betree_UpsertFunState_Sub _ -> Return 0
     end
-  | Some prev0 ->
+  | Some prev1 ->
     begin match st with
     | Betree_UpsertFunState_Add v ->
-      let* margin = u64_sub core_u64_max prev0 in
-      if margin >= v then u64_add prev0 v else Return core_u64_max
+      let* margin = u64_sub core_u64_max prev1 in
+      if margin >= v then u64_add prev1 v else Return core_u64_max
     | Betree_UpsertFunState_Sub v ->
-      if prev0 >= v then u64_sub prev0 v else Return 0
+      if prev1 >= v then u64_sub prev1 v else Return 0
     end
   end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]:
     Source: 'src/betree.rs', lines 276:4-276:24 *)
 let rec betree_List_len
   (t : Type0) (self : betree_List_t t) :
   Tot (result u64) (decreases (betree_List_len_decreases t self))
   =
   begin match self with
-  | Betree_List_Cons x tl -> let* i = betree_List_len t tl in u64_add 1 i
+  | Betree_List_Cons _ tl -> let* i = betree_List_len t tl in u64_add 1 i
   | Betree_List_Nil -> Return 0
   end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]:
     Source: 'src/betree.rs', lines 284:4-284:51 *)
 let rec betree_List_split_at
   (t : Type0) (self : betree_List_t t) (n : u64) :
@@ -118,52 +108,42 @@ let rec betree_List_split_at
     | Betree_List_Nil -> Fail Failure
     end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]:
     Source: 'src/betree.rs', lines 299:4-299:34 *)
 let betree_List_push_front
   (t : Type0) (self : betree_List_t t) (x : t) : result (betree_List_t t) =
-  let tl = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+  let (tl, _) = core_mem_replace (betree_List_t t) self Betree_List_Nil in
   let l = tl in
   Return (Betree_List_Cons x l)
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: forward function
-    Source: 'src/betree.rs', lines 306:4-306:32 *)
-let betree_List_pop_front (t : Type0) (self : betree_List_t t) : result t =
-  let ls = core_mem_replace (betree_List_t t) self Betree_List_Nil in
-  begin match ls with
-  | Betree_List_Cons x tl -> Return x
-  | Betree_List_Nil -> Fail Failure
-  end
-
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: backward function 0
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
     Source: 'src/betree.rs', lines 306:4-306:32 *)
-let betree_List_pop_front_back
-  (t : Type0) (self : betree_List_t t) : result (betree_List_t t) =
-  let ls = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+let betree_List_pop_front
+  (t : Type0) (self : betree_List_t t) : result (t & (betree_List_t t)) =
+  let (ls, _) = core_mem_replace (betree_List_t t) self Betree_List_Nil in
   begin match ls with
-  | Betree_List_Cons x tl -> Return tl
+  | Betree_List_Cons x tl -> Return (x, tl)
   | Betree_List_Nil -> Fail Failure
   end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]:
     Source: 'src/betree.rs', lines 318:4-318:22 *)
 let betree_List_hd (t : Type0) (self : betree_List_t t) : result t =
   begin match self with
-  | Betree_List_Cons hd l -> Return hd
+  | Betree_List_Cons hd _ -> Return hd
   | Betree_List_Nil -> Fail Failure
   end
 
-(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]: forward function
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]:
     Source: 'src/betree.rs', lines 327:4-327:44 *)
 let betree_ListTupleU64T_head_has_key
   (t : Type0) (self : betree_List_t (u64 & t)) (key : u64) : result bool =
   begin match self with
-  | Betree_List_Cons hd l -> let (i, _) = hd in Return (i = key)
+  | Betree_List_Cons hd _ -> let (i, _) = hd in Return (i = key)
   | Betree_List_Nil -> Return false
   end
 
-(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]: forward function
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]:
     Source: 'src/betree.rs', lines 339:4-339:73 *)
 let rec betree_ListTupleU64T_partition_at_pivot
   (t : Type0) (self : betree_List_t (u64 & t)) (pivot : u64) :
@@ -183,82 +163,54 @@ let rec betree_ListTupleU64T_partition_at_pivot
   | Betree_List_Nil -> Return (Betree_List_Nil, Betree_List_Nil)
   end
 
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: forward function
+(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]:
     Source: 'src/betree.rs', lines 359:4-364:17 *)
 let betree_Leaf_split
   (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
   (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
   (st : state) :
-  result (state & betree_Internal_t)
+  result (state & (betree_Internal_t & betree_NodeIdCounter_t))
   =
   let* p = betree_List_split_at (u64 & u64) content params.split_size in
   let (content0, content1) = p in
-  let* p0 = betree_List_hd (u64 & u64) content1 in
-  let (pivot, _) = p0 in
-  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt0 in
-  let* (st0, _) = betree_store_leaf_node id0 content0 st in
-  let* (st1, _) = betree_store_leaf_node id1 content1 st0 in
+  let* p1 = betree_List_hd (u64 & u64) content1 in
+  let (pivot, _) = p1 in
+  let* (id0, nic) = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* (id1, nic1) = betree_NodeIdCounter_fresh_id nic in
+  let* (st1, _) = betree_store_leaf_node id0 content0 st in
+  let* (st2, _) = betree_store_leaf_node id1 content1 st1 in
   let n = Betree_Node_Leaf { id = id0; size = params.split_size } in
-  let n0 = Betree_Node_Leaf { id = id1; size = params.split_size } in
-  Return (st1, { id = self.id; pivot = pivot; left = n; right = n0 })
+  let n1 = Betree_Node_Leaf { id = id1; size = params.split_size } in
+  Return (st2, ({ id = self.id; pivot = pivot; left = n; right = n1 }, nic1))
 
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 2
-    Source: 'src/betree.rs', lines 359:4-364:17 *)
-let betree_Leaf_split_back
-  (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
-  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
-  (st : state) :
-  result betree_NodeIdCounter_t
-  =
-  let* p = betree_List_split_at (u64 & u64) content params.split_size in
-  let (content0, content1) = p in
-  let* _ = betree_List_hd (u64 & u64) content1 in
-  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt0 in
-  let* (st0, _) = betree_store_leaf_node id0 content0 st in
-  let* _ = betree_store_leaf_node id1 content1 st0 in
-  betree_NodeIdCounter_fresh_id_back node_id_cnt0
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]:
     Source: 'src/betree.rs', lines 789:4-792:34 *)
 let rec betree_Node_lookup_first_message_for_key
   (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
-  (decreases (betree_Node_lookup_first_message_for_key_decreases key msgs))
-  =
-  begin match msgs with
-  | Betree_List_Cons x next_msgs ->
-    let (i, m) = x in
-    if i >= key
-    then Return (Betree_List_Cons (i, m) next_msgs)
-    else betree_Node_lookup_first_message_for_key key next_msgs
-  | Betree_List_Nil -> Return Betree_List_Nil
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: backward function 0
-    Source: 'src/betree.rs', lines 789:4-792:34 *)
-let rec betree_Node_lookup_first_message_for_key_back
-  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t))
-  (ret : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  Tot (result ((betree_List_t (u64 & betree_Message_t)) & (betree_List_t (u64 &
+    betree_Message_t) -> result (betree_List_t (u64 & betree_Message_t)))))
   (decreases (betree_Node_lookup_first_message_for_key_decreases key msgs))
   =
   begin match msgs with
   | Betree_List_Cons x next_msgs ->
     let (i, m) = x in
     if i >= key
-    then Return ret
+    then
+      let back_'a = fun ret -> Return ret in
+      Return (Betree_List_Cons (i, m) next_msgs, back_'a)
     else
-      let* next_msgs0 =
-        betree_Node_lookup_first_message_for_key_back key next_msgs ret in
-      Return (Betree_List_Cons (i, m) next_msgs0)
-  | Betree_List_Nil -> Return ret
+      let* (l, lookup_first_message_for_key_back) =
+        betree_Node_lookup_first_message_for_key key next_msgs in
+      let back_'a =
+        fun ret ->
+          let* next_msgs1 = lookup_first_message_for_key_back ret in
+          Return (Betree_List_Cons (i, m) next_msgs1) in
+      Return (l, back_'a)
+  | Betree_List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
     Source: 'src/betree.rs', lines 636:4-636:80 *)
 let rec betree_Node_lookup_in_bindings
   (key : u64) (bindings : betree_List_t (u64 & u64)) :
@@ -267,215 +219,110 @@ let rec betree_Node_lookup_in_bindings
   =
   begin match bindings with
   | Betree_List_Cons hd tl ->
-    let (i, i0) = hd in
+    let (i, i1) = hd in
     if i = key
-    then Return (Some i0)
+    then Return (Some i1)
     else if i > key then Return None else betree_Node_lookup_in_bindings key tl
   | Betree_List_Nil -> Return None
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]:
     Source: 'src/betree.rs', lines 819:4-819:90 *)
 let rec betree_Node_apply_upserts
   (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
   (key : u64) (st : state) :
-  Tot (result (state & u64))
+  Tot (result (state & (u64 & (betree_List_t (u64 & betree_Message_t)))))
   (decreases (betree_Node_apply_upserts_decreases msgs prev key st))
   =
   let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs key in
   if b
   then
-    let* msg = betree_List_pop_front (u64 & betree_Message_t) msgs in
+    let* (msg, l) = betree_List_pop_front (u64 & betree_Message_t) msgs in
     let (_, m) = msg in
     begin match m with
-    | Betree_Message_Insert i -> Fail Failure
+    | Betree_Message_Insert _ -> Fail Failure
     | Betree_Message_Delete -> Fail Failure
     | Betree_Message_Upsert s ->
       let* v = betree_upsert_update prev s in
-      let* msgs0 = betree_List_pop_front_back (u64 & betree_Message_t) msgs in
-      betree_Node_apply_upserts msgs0 (Some v) key st
+      betree_Node_apply_upserts l (Some v) key st
     end
   else
-    let* (st0, v) = core_option_Option_unwrap u64 prev st in
-    let* _ =
+    let* (st1, v) = core_option_Option_unwrap u64 prev st in
+    let* l =
       betree_List_push_front (u64 & betree_Message_t) msgs (key,
         Betree_Message_Insert v) in
-    Return (st0, v)
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: backward function 0
-    Source: 'src/betree.rs', lines 819:4-819:90 *)
-let rec betree_Node_apply_upserts_back
-  (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
-  (key : u64) (st : state) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
-  (decreases (betree_Node_apply_upserts_decreases msgs prev key st))
-  =
-  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs key in
-  if b
-  then
-    let* msg = betree_List_pop_front (u64 & betree_Message_t) msgs in
-    let (_, m) = msg in
-    begin match m with
-    | Betree_Message_Insert i -> Fail Failure
-    | Betree_Message_Delete -> Fail Failure
-    | Betree_Message_Upsert s ->
-      let* v = betree_upsert_update prev s in
-      let* msgs0 = betree_List_pop_front_back (u64 & betree_Message_t) msgs in
-      betree_Node_apply_upserts_back msgs0 (Some v) key st
-    end
-  else
-    let* (_, v) = core_option_Option_unwrap u64 prev st in
-    betree_List_push_front (u64 & betree_Message_t) msgs (key,
-      Betree_Message_Insert v)
+    Return (st1, (v, l))
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: forward function
+(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]:
     Source: 'src/betree.rs', lines 395:4-395:63 *)
 let rec betree_Internal_lookup_in_children
   (self : betree_Internal_t) (key : u64) (st : state) :
-  Tot (result (state & (option u64)))
-  (decreases (betree_Internal_lookup_in_children_decreases self key st))
-  =
-  if key < self.pivot
-  then betree_Node_lookup self.left key st
-  else betree_Node_lookup self.right key st
-
-(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: backward function 0
-    Source: 'src/betree.rs', lines 395:4-395:63 *)
-and betree_Internal_lookup_in_children_back
-  (self : betree_Internal_t) (key : u64) (st : state) :
-  Tot (result betree_Internal_t)
+  Tot (result (state & ((option u64) & betree_Internal_t)))
   (decreases (betree_Internal_lookup_in_children_decreases self key st))
   =
   if key < self.pivot
   then
-    let* n = betree_Node_lookup_back self.left key st in
-    Return { self with left = n }
+    let* (st1, (o, n)) = betree_Node_lookup self.left key st in
+    Return (st1, (o, { self with left = n }))
   else
-    let* n = betree_Node_lookup_back self.right key st in
-    Return { self with right = n }
+    let* (st1, (o, n)) = betree_Node_lookup self.right key st in
+    Return (st1, (o, { self with right = n }))
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]:
     Source: 'src/betree.rs', lines 709:4-709:58 *)
 and betree_Node_lookup
   (self : betree_Node_t) (key : u64) (st : state) :
-  Tot (result (state & (option u64)))
+  Tot (result (state & ((option u64) & betree_Node_t)))
   (decreases (betree_Node_lookup_decreases self key st))
   =
   begin match self with
   | Betree_Node_Internal node ->
-    let* (st0, msgs) = betree_load_internal_node node.id st in
-    let* pending = betree_Node_lookup_first_message_for_key key msgs in
+    let* (st1, msgs) = betree_load_internal_node node.id st in
+    let* (pending, lookup_first_message_for_key_back) =
+      betree_Node_lookup_first_message_for_key key msgs in
     begin match pending with
     | Betree_List_Cons p l ->
       let (k, msg) = p in
       if k <> key
       then
-        let* (st1, o) = betree_Internal_lookup_in_children node key st0 in
+        let* (st2, (o, i)) = betree_Internal_lookup_in_children node key st1 in
         let* _ =
-          betree_Node_lookup_first_message_for_key_back key msgs
-            (Betree_List_Cons (k, msg) l) in
-        Return (st1, o)
+          lookup_first_message_for_key_back (Betree_List_Cons (k, msg) l) in
+        Return (st2, (o, Betree_Node_Internal i))
       else
         begin match msg with
         | Betree_Message_Insert v ->
           let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Insert v) l) in
-          Return (st0, Some v)
+            lookup_first_message_for_key_back (Betree_List_Cons (k,
+              Betree_Message_Insert v) l) in
+          Return (st1, (Some v, Betree_Node_Internal node))
         | Betree_Message_Delete ->
           let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Delete) l) in
-          Return (st0, None)
+            lookup_first_message_for_key_back (Betree_List_Cons (k,
+              Betree_Message_Delete) l) in
+          Return (st1, (None, Betree_Node_Internal node))
         | Betree_Message_Upsert ufs ->
-          let* (st1, v) = betree_Internal_lookup_in_children node key st0 in
-          let* (st2, v0) =
+          let* (st2, (v, i)) = betree_Internal_lookup_in_children node key st1
+            in
+          let* (st3, (v1, l1)) =
             betree_Node_apply_upserts (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st1 in
-          let* node0 = betree_Internal_lookup_in_children_back node key st0 in
-          let* pending0 =
-            betree_Node_apply_upserts_back (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st1 in
-          let* msgs0 =
-            betree_Node_lookup_first_message_for_key_back key msgs pending0 in
-          let* (st3, _) = betree_store_internal_node node0.id msgs0 st2 in
-          Return (st3, Some v0)
+              Betree_Message_Upsert ufs) l) v key st2 in
+          let* msgs1 = lookup_first_message_for_key_back l1 in
+          let* (st4, _) = betree_store_internal_node i.id msgs1 st3 in
+          Return (st4, (Some v1, Betree_Node_Internal i))
         end
     | Betree_List_Nil ->
-      let* (st1, o) = betree_Internal_lookup_in_children node key st0 in
-      let* _ =
-        betree_Node_lookup_first_message_for_key_back key msgs Betree_List_Nil
-        in
-      Return (st1, o)
+      let* (st2, (o, i)) = betree_Internal_lookup_in_children node key st1 in
+      let* _ = lookup_first_message_for_key_back Betree_List_Nil in
+      Return (st2, (o, Betree_Node_Internal i))
     end
   | Betree_Node_Leaf node ->
-    let* (st0, bindings) = betree_load_leaf_node node.id st in
+    let* (st1, bindings) = betree_load_leaf_node node.id st in
     let* o = betree_Node_lookup_in_bindings key bindings in
-    Return (st0, o)
+    Return (st1, (o, Betree_Node_Leaf node))
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: backward function 0
-    Source: 'src/betree.rs', lines 709:4-709:58 *)
-and betree_Node_lookup_back
-  (self : betree_Node_t) (key : u64) (st : state) :
-  Tot (result betree_Node_t)
-  (decreases (betree_Node_lookup_decreases self key st))
-  =
-  begin match self with
-  | Betree_Node_Internal node ->
-    let* (st0, msgs) = betree_load_internal_node node.id st in
-    let* pending = betree_Node_lookup_first_message_for_key key msgs in
-    begin match pending with
-    | Betree_List_Cons p l ->
-      let (k, msg) = p in
-      if k <> key
-      then
-        let* _ =
-          betree_Node_lookup_first_message_for_key_back key msgs
-            (Betree_List_Cons (k, msg) l) in
-        let* node0 = betree_Internal_lookup_in_children_back node key st0 in
-        Return (Betree_Node_Internal node0)
-      else
-        begin match msg with
-        | Betree_Message_Insert v ->
-          let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Insert v) l) in
-          Return (Betree_Node_Internal node)
-        | Betree_Message_Delete ->
-          let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Delete) l) in
-          Return (Betree_Node_Internal node)
-        | Betree_Message_Upsert ufs ->
-          let* (st1, v) = betree_Internal_lookup_in_children node key st0 in
-          let* (st2, _) =
-            betree_Node_apply_upserts (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st1 in
-          let* node0 = betree_Internal_lookup_in_children_back node key st0 in
-          let* pending0 =
-            betree_Node_apply_upserts_back (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st1 in
-          let* msgs0 =
-            betree_Node_lookup_first_message_for_key_back key msgs pending0 in
-          let* _ = betree_store_internal_node node0.id msgs0 st2 in
-          Return (Betree_Node_Internal node0)
-        end
-    | Betree_List_Nil ->
-      let* _ =
-        betree_Node_lookup_first_message_for_key_back key msgs Betree_List_Nil
-        in
-      let* node0 = betree_Internal_lookup_in_children_back node key st0 in
-      Return (Betree_Node_Internal node0)
-    end
-  | Betree_Node_Leaf node ->
-    let* (_, bindings) = betree_load_leaf_node node.id st in
-    let* _ = betree_Node_lookup_in_bindings key bindings in
-    Return (Betree_Node_Leaf node)
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]:
     Source: 'src/betree.rs', lines 674:4-674:77 *)
 let rec betree_Node_filter_messages_for_key
   (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
@@ -487,36 +334,20 @@ let rec betree_Node_filter_messages_for_key
     let (k, m) = p in
     if k = key
     then
-      let* msgs0 =
-        betree_List_pop_front_back (u64 & betree_Message_t) (Betree_List_Cons
-          (k, m) l) in
-      betree_Node_filter_messages_for_key key msgs0
+      let* (_, l1) =
+        betree_List_pop_front (u64 & betree_Message_t) (Betree_List_Cons (k, m)
+          l) in
+      betree_Node_filter_messages_for_key key l1
     else Return (Betree_List_Cons (k, m) l)
   | Betree_List_Nil -> Return Betree_List_Nil
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]:
     Source: 'src/betree.rs', lines 689:4-692:34 *)
 let rec betree_Node_lookup_first_message_after_key
   (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
-  (decreases (betree_Node_lookup_first_message_after_key_decreases key msgs))
-  =
-  begin match msgs with
-  | Betree_List_Cons p next_msgs ->
-    let (k, m) = p in
-    if k = key
-    then betree_Node_lookup_first_message_after_key key next_msgs
-    else Return (Betree_List_Cons (k, m) next_msgs)
-  | Betree_List_Nil -> Return Betree_List_Nil
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: backward function 0
-    Source: 'src/betree.rs', lines 689:4-692:34 *)
-let rec betree_Node_lookup_first_message_after_key_back
-  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t))
-  (ret : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  Tot (result ((betree_List_t (u64 & betree_Message_t)) & (betree_List_t (u64 &
+    betree_Message_t) -> result (betree_List_t (u64 & betree_Message_t)))))
   (decreases (betree_Node_lookup_first_message_after_key_decreases key msgs))
   =
   begin match msgs with
@@ -524,75 +355,79 @@ let rec betree_Node_lookup_first_message_after_key_back
     let (k, m) = p in
     if k = key
     then
-      let* next_msgs0 =
-        betree_Node_lookup_first_message_after_key_back key next_msgs ret in
-      Return (Betree_List_Cons (k, m) next_msgs0)
-    else Return ret
-  | Betree_List_Nil -> Return ret
+      let* (l, lookup_first_message_after_key_back) =
+        betree_Node_lookup_first_message_after_key key next_msgs in
+      let back_'a =
+        fun ret ->
+          let* next_msgs1 = lookup_first_message_after_key_back ret in
+          Return (Betree_List_Cons (k, m) next_msgs1) in
+      Return (l, back_'a)
+    else
+      let back_'a = fun ret -> Return ret in
+      Return (Betree_List_Cons (k, m) next_msgs, back_'a)
+  | Betree_List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
     Source: 'src/betree.rs', lines 521:4-521:89 *)
 let betree_Node_apply_to_internal
   (msgs : betree_List_t (u64 & betree_Message_t)) (key : u64)
   (new_msg : betree_Message_t) :
   result (betree_List_t (u64 & betree_Message_t))
   =
-  let* msgs0 = betree_Node_lookup_first_message_for_key key msgs in
-  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs0 key in
+  let* (msgs1, lookup_first_message_for_key_back) =
+    betree_Node_lookup_first_message_for_key key msgs in
+  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs1 key in
   if b
   then
     begin match new_msg with
     | Betree_Message_Insert i ->
-      let* msgs1 = betree_Node_filter_messages_for_key key msgs0 in
-      let* msgs2 =
-        betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+      let* l = betree_Node_filter_messages_for_key key msgs1 in
+      let* l1 =
+        betree_List_push_front (u64 & betree_Message_t) l (key,
           Betree_Message_Insert i) in
-      betree_Node_lookup_first_message_for_key_back key msgs msgs2
+      lookup_first_message_for_key_back l1
     | Betree_Message_Delete ->
-      let* msgs1 = betree_Node_filter_messages_for_key key msgs0 in
-      let* msgs2 =
-        betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+      let* l = betree_Node_filter_messages_for_key key msgs1 in
+      let* l1 =
+        betree_List_push_front (u64 & betree_Message_t) l (key,
           Betree_Message_Delete) in
-      betree_Node_lookup_first_message_for_key_back key msgs msgs2
+      lookup_first_message_for_key_back l1
     | Betree_Message_Upsert s ->
-      let* p = betree_List_hd (u64 & betree_Message_t) msgs0 in
+      let* p = betree_List_hd (u64 & betree_Message_t) msgs1 in
       let (_, m) = p in
       begin match m with
       | Betree_Message_Insert prev ->
         let* v = betree_upsert_update (Some prev) s in
-        let* msgs1 = betree_List_pop_front_back (u64 & betree_Message_t) msgs0
-          in
-        let* msgs2 =
-          betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+        let* (_, l) = betree_List_pop_front (u64 & betree_Message_t) msgs1 in
+        let* l1 =
+          betree_List_push_front (u64 & betree_Message_t) l (key,
             Betree_Message_Insert v) in
-        betree_Node_lookup_first_message_for_key_back key msgs msgs2
+        lookup_first_message_for_key_back l1
       | Betree_Message_Delete ->
+        let* (_, l) = betree_List_pop_front (u64 & betree_Message_t) msgs1 in
         let* v = betree_upsert_update None s in
-        let* msgs1 = betree_List_pop_front_back (u64 & betree_Message_t) msgs0
-          in
-        let* msgs2 =
-          betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+        let* l1 =
+          betree_List_push_front (u64 & betree_Message_t) l (key,
             Betree_Message_Insert v) in
-        betree_Node_lookup_first_message_for_key_back key msgs msgs2
-      | Betree_Message_Upsert ufs ->
-        let* msgs1 = betree_Node_lookup_first_message_after_key key msgs0 in
-        let* msgs2 =
-          betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+        lookup_first_message_for_key_back l1
+      | Betree_Message_Upsert _ ->
+        let* (msgs2, lookup_first_message_after_key_back) =
+          betree_Node_lookup_first_message_after_key key msgs1 in
+        let* l =
+          betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
             Betree_Message_Upsert s) in
-        let* msgs3 =
-          betree_Node_lookup_first_message_after_key_back key msgs0 msgs2 in
-        betree_Node_lookup_first_message_for_key_back key msgs msgs3
+        let* msgs3 = lookup_first_message_after_key_back l in
+        lookup_first_message_for_key_back msgs3
       end
     end
   else
-    let* msgs1 =
-      betree_List_push_front (u64 & betree_Message_t) msgs0 (key, new_msg) in
-    betree_Node_lookup_first_message_for_key_back key msgs msgs1
+    let* l =
+      betree_List_push_front (u64 & betree_Message_t) msgs1 (key, new_msg) in
+    lookup_first_message_for_key_back l
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]:
     Source: 'src/betree.rs', lines 502:4-505:5 *)
 let rec betree_Node_apply_messages_to_internal
   (msgs : betree_List_t (u64 & betree_Message_t))
@@ -603,89 +438,75 @@ let rec betree_Node_apply_messages_to_internal
   begin match new_msgs with
   | Betree_List_Cons new_msg new_msgs_tl ->
     let (i, m) = new_msg in
-    let* msgs0 = betree_Node_apply_to_internal msgs i m in
-    betree_Node_apply_messages_to_internal msgs0 new_msgs_tl
+    let* l = betree_Node_apply_to_internal msgs i m in
+    betree_Node_apply_messages_to_internal l new_msgs_tl
   | Betree_List_Nil -> Return msgs
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]:
     Source: 'src/betree.rs', lines 653:4-656:32 *)
 let rec betree_Node_lookup_mut_in_bindings
   (key : u64) (bindings : betree_List_t (u64 & u64)) :
-  Tot (result (betree_List_t (u64 & u64)))
-  (decreases (betree_Node_lookup_mut_in_bindings_decreases key bindings))
-  =
-  begin match bindings with
-  | Betree_List_Cons hd tl ->
-    let (i, i0) = hd in
-    if i >= key
-    then Return (Betree_List_Cons (i, i0) tl)
-    else betree_Node_lookup_mut_in_bindings key tl
-  | Betree_List_Nil -> Return Betree_List_Nil
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: backward function 0
-    Source: 'src/betree.rs', lines 653:4-656:32 *)
-let rec betree_Node_lookup_mut_in_bindings_back
-  (key : u64) (bindings : betree_List_t (u64 & u64))
-  (ret : betree_List_t (u64 & u64)) :
-  Tot (result (betree_List_t (u64 & u64)))
+  Tot (result ((betree_List_t (u64 & u64)) & (betree_List_t (u64 & u64) ->
+    result (betree_List_t (u64 & u64)))))
   (decreases (betree_Node_lookup_mut_in_bindings_decreases key bindings))
   =
   begin match bindings with
   | Betree_List_Cons hd tl ->
-    let (i, i0) = hd in
+    let (i, i1) = hd in
     if i >= key
-    then Return ret
+    then
+      let back_'a = fun ret -> Return ret in
+      Return (Betree_List_Cons (i, i1) tl, back_'a)
     else
-      let* tl0 = betree_Node_lookup_mut_in_bindings_back key tl ret in
-      Return (Betree_List_Cons (i, i0) tl0)
-  | Betree_List_Nil -> Return ret
+      let* (l, lookup_mut_in_bindings_back) =
+        betree_Node_lookup_mut_in_bindings key tl in
+      let back_'a =
+        fun ret ->
+          let* tl1 = lookup_mut_in_bindings_back ret in
+          Return (Betree_List_Cons (i, i1) tl1) in
+      Return (l, back_'a)
+  | Betree_List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
     Source: 'src/betree.rs', lines 460:4-460:87 *)
 let betree_Node_apply_to_leaf
   (bindings : betree_List_t (u64 & u64)) (key : u64)
   (new_msg : betree_Message_t) :
   result (betree_List_t (u64 & u64))
   =
-  let* bindings0 = betree_Node_lookup_mut_in_bindings key bindings in
-  let* b = betree_ListTupleU64T_head_has_key u64 bindings0 key in
+  let* (bindings1, lookup_mut_in_bindings_back) =
+    betree_Node_lookup_mut_in_bindings key bindings in
+  let* b = betree_ListTupleU64T_head_has_key u64 bindings1 key in
   if b
   then
-    let* hd = betree_List_pop_front (u64 & u64) bindings0 in
+    let* (hd, l) = betree_List_pop_front (u64 & u64) bindings1 in
     begin match new_msg with
     | Betree_Message_Insert v ->
-      let* bindings1 = betree_List_pop_front_back (u64 & u64) bindings0 in
-      let* bindings2 = betree_List_push_front (u64 & u64) bindings1 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
-    | Betree_Message_Delete ->
-      let* bindings1 = betree_List_pop_front_back (u64 & u64) bindings0 in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
+      let* l1 = betree_List_push_front (u64 & u64) l (key, v) in
+      lookup_mut_in_bindings_back l1
+    | Betree_Message_Delete -> lookup_mut_in_bindings_back l
     | Betree_Message_Upsert s ->
       let (_, i) = hd in
       let* v = betree_upsert_update (Some i) s in
-      let* bindings1 = betree_List_pop_front_back (u64 & u64) bindings0 in
-      let* bindings2 = betree_List_push_front (u64 & u64) bindings1 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
+      let* l1 = betree_List_push_front (u64 & u64) l (key, v) in
+      lookup_mut_in_bindings_back l1
     end
   else
     begin match new_msg with
     | Betree_Message_Insert v ->
-      let* bindings1 = betree_List_push_front (u64 & u64) bindings0 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
-    | Betree_Message_Delete ->
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings0
+      let* l = betree_List_push_front (u64 & u64) bindings1 (key, v) in
+      lookup_mut_in_bindings_back l
+    | Betree_Message_Delete -> lookup_mut_in_bindings_back bindings1
     | Betree_Message_Upsert s ->
       let* v = betree_upsert_update None s in
-      let* bindings1 = betree_List_push_front (u64 & u64) bindings0 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
+      let* l = betree_List_push_front (u64 & u64) bindings1 (key, v) in
+      lookup_mut_in_bindings_back l
     end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]:
     Source: 'src/betree.rs', lines 444:4-447:5 *)
 let rec betree_Node_apply_messages_to_leaf
   (bindings : betree_List_t (u64 & u64))
@@ -696,18 +517,19 @@ let rec betree_Node_apply_messages_to_leaf
   begin match new_msgs with
   | Betree_List_Cons new_msg new_msgs_tl ->
     let (i, m) = new_msg in
-    let* bindings0 = betree_Node_apply_to_leaf bindings i m in
-    betree_Node_apply_messages_to_leaf bindings0 new_msgs_tl
+    let* l = betree_Node_apply_to_leaf bindings i m in
+    betree_Node_apply_messages_to_leaf l new_msgs_tl
   | Betree_List_Nil -> Return bindings
   end
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: forward function
+(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]:
     Source: 'src/betree.rs', lines 410:4-415:26 *)
 let rec betree_Internal_flush
   (self : betree_Internal_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t)
   (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
-  Tot (result (state & (betree_List_t (u64 & betree_Message_t))))
+  Tot (result (state & ((betree_List_t (u64 & betree_Message_t)) &
+    (betree_Internal_t & betree_NodeIdCounter_t))))
   (decreases (
     betree_Internal_flush_decreases self params node_id_cnt content st))
   =
@@ -718,290 +540,143 @@ let rec betree_Internal_flush
   let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
   if len_left >= params.min_flush_size
   then
-    let* (st0, _) =
+    let* (st1, p1) =
       betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
-    let* (_, node_id_cnt0) =
-      betree_Node_apply_messages_back self.left params node_id_cnt msgs_left st
-      in
+    let (n, node_id_cnt1) = p1 in
     let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
     if len_right >= params.min_flush_size
     then
-      let* (st1, _) =
-        betree_Node_apply_messages self.right params node_id_cnt0 msgs_right
-          st0 in
-      let* _ =
-        betree_Node_apply_messages_back self.right params node_id_cnt0
-          msgs_right st0 in
-      Return (st1, Betree_List_Nil)
-    else Return (st0, msgs_right)
+      let* (st2, p2) =
+        betree_Node_apply_messages self.right params node_id_cnt1 msgs_right
+          st1 in
+      let (n1, node_id_cnt2) = p2 in
+      Return (st2, (Betree_List_Nil, ({ self with left = n; right = n1 },
+        node_id_cnt2)))
+    else Return (st1, (msgs_right, ({ self with left = n }, node_id_cnt1)))
   else
-    let* (st0, _) =
+    let* (st1, p1) =
       betree_Node_apply_messages self.right params node_id_cnt msgs_right st in
-    let* _ =
-      betree_Node_apply_messages_back self.right params node_id_cnt msgs_right
-        st in
-    Return (st0, msgs_left)
+    let (n, node_id_cnt1) = p1 in
+    Return (st1, (msgs_left, ({ self with right = n }, node_id_cnt1)))
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: backward function 0
-    Source: 'src/betree.rs', lines 410:4-415:26 *)
-and betree_Internal_flush_back
-  (self : betree_Internal_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
-  Tot (result (betree_Internal_t & betree_NodeIdCounter_t))
-  (decreases (
-    betree_Internal_flush_decreases self params node_id_cnt content st))
-  =
-  let* p =
-    betree_ListTupleU64T_partition_at_pivot betree_Message_t content self.pivot
-    in
-  let (msgs_left, msgs_right) = p in
-  let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
-  if len_left >= params.min_flush_size
-  then
-    let* (st0, _) =
-      betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
-    let* (n, node_id_cnt0) =
-      betree_Node_apply_messages_back self.left params node_id_cnt msgs_left st
-      in
-    let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
-    if len_right >= params.min_flush_size
-    then
-      let* (n0, node_id_cnt1) =
-        betree_Node_apply_messages_back self.right params node_id_cnt0
-          msgs_right st0 in
-      Return ({ self with left = n; right = n0 }, node_id_cnt1)
-    else Return ({ self with left = n }, node_id_cnt0)
-  else
-    let* (n, node_id_cnt0) =
-      betree_Node_apply_messages_back self.right params node_id_cnt msgs_right
-        st in
-    Return ({ self with right = n }, node_id_cnt0)
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]:
     Source: 'src/betree.rs', lines 588:4-593:5 *)
 and betree_Node_apply_messages
   (self : betree_Node_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t)
   (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) :
-  Tot (result (state & unit))
-  (decreases (
-    betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
-  =
-  begin match self with
-  | Betree_Node_Internal node ->
-    let* (st0, content) = betree_load_internal_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_internal content msgs in
-    let* num_msgs = betree_List_len (u64 & betree_Message_t) content0 in
-    if num_msgs >= params.min_flush_size
-    then
-      let* (st1, content1) =
-        betree_Internal_flush node params node_id_cnt content0 st0 in
-      let* (node0, _) =
-        betree_Internal_flush_back node params node_id_cnt content0 st0 in
-      let* (st2, _) = betree_store_internal_node node0.id content1 st1 in
-      Return (st2, ())
-    else
-      let* (st1, _) = betree_store_internal_node node.id content0 st0 in
-      Return (st1, ())
-  | Betree_Node_Leaf node ->
-    let* (st0, content) = betree_load_leaf_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_leaf content msgs in
-    let* len = betree_List_len (u64 & u64) content0 in
-    let* i = u64_mul 2 params.split_size in
-    if len >= i
-    then
-      let* (st1, _) = betree_Leaf_split node content0 params node_id_cnt st0 in
-      let* (st2, _) = betree_store_leaf_node node.id Betree_List_Nil st1 in
-      Return (st2, ())
-    else
-      let* (st1, _) = betree_store_leaf_node node.id content0 st0 in
-      Return (st1, ())
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: backward function 0
-    Source: 'src/betree.rs', lines 588:4-593:5 *)
-and betree_Node_apply_messages_back
-  (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) :
-  Tot (result (betree_Node_t & betree_NodeIdCounter_t))
+  Tot (result (state & (betree_Node_t & betree_NodeIdCounter_t)))
   (decreases (
     betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
   =
   begin match self with
   | Betree_Node_Internal node ->
-    let* (st0, content) = betree_load_internal_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_internal content msgs in
-    let* num_msgs = betree_List_len (u64 & betree_Message_t) content0 in
+    let* (st1, content) = betree_load_internal_node node.id st in
+    let* l = betree_Node_apply_messages_to_internal content msgs in
+    let* num_msgs = betree_List_len (u64 & betree_Message_t) l in
     if num_msgs >= params.min_flush_size
     then
-      let* (st1, content1) =
-        betree_Internal_flush node params node_id_cnt content0 st0 in
-      let* (node0, node_id_cnt0) =
-        betree_Internal_flush_back node params node_id_cnt content0 st0 in
-      let* _ = betree_store_internal_node node0.id content1 st1 in
-      Return (Betree_Node_Internal node0, node_id_cnt0)
+      let* (st2, (content1, p)) =
+        betree_Internal_flush node params node_id_cnt l st1 in
+      let (node1, node_id_cnt1) = p in
+      let* (st3, _) = betree_store_internal_node node1.id content1 st2 in
+      Return (st3, (Betree_Node_Internal node1, node_id_cnt1))
     else
-      let* _ = betree_store_internal_node node.id content0 st0 in
-      Return (Betree_Node_Internal node, node_id_cnt)
+      let* (st2, _) = betree_store_internal_node node.id l st1 in
+      Return (st2, (Betree_Node_Internal node, node_id_cnt))
   | Betree_Node_Leaf node ->
-    let* (st0, content) = betree_load_leaf_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_leaf content msgs in
-    let* len = betree_List_len (u64 & u64) content0 in
+    let* (st1, content) = betree_load_leaf_node node.id st in
+    let* l = betree_Node_apply_messages_to_leaf content msgs in
+    let* len = betree_List_len (u64 & u64) l in
     let* i = u64_mul 2 params.split_size in
     if len >= i
     then
-      let* (st1, new_node) =
-        betree_Leaf_split node content0 params node_id_cnt st0 in
-      let* _ = betree_store_leaf_node node.id Betree_List_Nil st1 in
-      let* node_id_cnt0 =
-        betree_Leaf_split_back node content0 params node_id_cnt st0 in
-      Return (Betree_Node_Internal new_node, node_id_cnt0)
+      let* (st2, (new_node, nic)) =
+        betree_Leaf_split node l params node_id_cnt st1 in
+      let* (st3, _) = betree_store_leaf_node node.id Betree_List_Nil st2 in
+      Return (st3, (Betree_Node_Internal new_node, nic))
     else
-      let* _ = betree_store_leaf_node node.id content0 st0 in
-      Return (Betree_Node_Leaf { node with size = len }, node_id_cnt)
+      let* (st2, _) = betree_store_leaf_node node.id l st1 in
+      Return (st2, (Betree_Node_Leaf { node with size = len }, node_id_cnt))
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply]:
     Source: 'src/betree.rs', lines 576:4-582:5 *)
 let betree_Node_apply
   (self : betree_Node_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
   (new_msg : betree_Message_t) (st : state) :
-  result (state & unit)
+  result (state & (betree_Node_t & betree_NodeIdCounter_t))
   =
   let l = Betree_List_Nil in
-  let* (st0, _) =
+  let* (st1, p) =
     betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
       new_msg) l) st in
-  let* _ =
-    betree_Node_apply_messages_back self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st in
-  Return (st0, ())
+  let (self1, node_id_cnt1) = p in
+  Return (st1, (self1, node_id_cnt1))
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 0
-    Source: 'src/betree.rs', lines 576:4-582:5 *)
-let betree_Node_apply_back
-  (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
-  (new_msg : betree_Message_t) (st : state) :
-  result (betree_Node_t & betree_NodeIdCounter_t)
-  =
-  let l = Betree_List_Nil in
-  betree_Node_apply_messages_back self params node_id_cnt (Betree_List_Cons
-    (key, new_msg) l) st
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]:
     Source: 'src/betree.rs', lines 849:4-849:60 *)
 let betree_BeTree_new
   (min_flush_size : u64) (split_size : u64) (st : state) :
   result (state & betree_BeTree_t)
   =
   let* node_id_cnt = betree_NodeIdCounter_new in
-  let* id = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* (st0, _) = betree_store_leaf_node id Betree_List_Nil st in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  Return (st0,
+  let* (id, nic) = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* (st1, _) = betree_store_leaf_node id Betree_List_Nil st in
+  Return (st1,
     {
       params = { min_flush_size = min_flush_size; split_size = split_size };
-      node_id_cnt = node_id_cnt0;
+      node_id_cnt = nic;
       root = (Betree_Node_Leaf { id = id; size = 0 })
     })
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]:
     Source: 'src/betree.rs', lines 868:4-868:47 *)
 let betree_BeTree_apply
   (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t) (st : state) :
-  result (state & unit)
+  result (state & betree_BeTree_t)
   =
-  let* (st0, _) =
+  let* (st1, p) =
     betree_Node_apply self.root self.params self.node_id_cnt key msg st in
-  let* _ =
-    betree_Node_apply_back self.root self.params self.node_id_cnt key msg st in
-  Return (st0, ())
+  let (n, nic) = p in
+  Return (st1, { self with node_id_cnt = nic; root = n })
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: backward function 0
-    Source: 'src/betree.rs', lines 868:4-868:47 *)
-let betree_BeTree_apply_back
-  (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t) (st : state) :
-  result betree_BeTree_t
-  =
-  let* (n, nic) =
-    betree_Node_apply_back self.root self.params self.node_id_cnt key msg st in
-  Return { self with node_id_cnt = nic; root = n }
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]:
     Source: 'src/betree.rs', lines 874:4-874:52 *)
 let betree_BeTree_insert
   (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
-  result (state & unit)
-  =
-  let* (st0, _) = betree_BeTree_apply self key (Betree_Message_Insert value) st
-    in
-  let* _ = betree_BeTree_apply_back self key (Betree_Message_Insert value) st
-    in
-  Return (st0, ())
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: backward function 0
-    Source: 'src/betree.rs', lines 874:4-874:52 *)
-let betree_BeTree_insert_back
-  (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
-  result betree_BeTree_t
+  result (state & betree_BeTree_t)
   =
-  betree_BeTree_apply_back self key (Betree_Message_Insert value) st
+  betree_BeTree_apply self key (Betree_Message_Insert value) st
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]:
     Source: 'src/betree.rs', lines 880:4-880:38 *)
 let betree_BeTree_delete
-  (self : betree_BeTree_t) (key : u64) (st : state) : result (state & unit) =
-  let* (st0, _) = betree_BeTree_apply self key Betree_Message_Delete st in
-  let* _ = betree_BeTree_apply_back self key Betree_Message_Delete st in
-  Return (st0, ())
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: backward function 0
-    Source: 'src/betree.rs', lines 880:4-880:38 *)
-let betree_BeTree_delete_back
-  (self : betree_BeTree_t) (key : u64) (st : state) : result betree_BeTree_t =
-  betree_BeTree_apply_back self key Betree_Message_Delete st
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: forward function
-    Source: 'src/betree.rs', lines 886:4-886:59 *)
-let betree_BeTree_upsert
-  (self : betree_BeTree_t) (key : u64) (upd : betree_UpsertFunState_t)
-  (st : state) :
-  result (state & unit)
+  (self : betree_BeTree_t) (key : u64) (st : state) :
+  result (state & betree_BeTree_t)
   =
-  let* (st0, _) = betree_BeTree_apply self key (Betree_Message_Upsert upd) st
-    in
-  let* _ = betree_BeTree_apply_back self key (Betree_Message_Upsert upd) st in
-  Return (st0, ())
+  betree_BeTree_apply self key Betree_Message_Delete st
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: backward function 0
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]:
     Source: 'src/betree.rs', lines 886:4-886:59 *)
-let betree_BeTree_upsert_back
+let betree_BeTree_upsert
   (self : betree_BeTree_t) (key : u64) (upd : betree_UpsertFunState_t)
   (st : state) :
-  result betree_BeTree_t
+  result (state & betree_BeTree_t)
   =
-  betree_BeTree_apply_back self key (Betree_Message_Upsert upd) st
+  betree_BeTree_apply self key (Betree_Message_Upsert upd) st
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]:
     Source: 'src/betree.rs', lines 895:4-895:62 *)
 let betree_BeTree_lookup
   (self : betree_BeTree_t) (key : u64) (st : state) :
-  result (state & (option u64))
+  result (state & ((option u64) & betree_BeTree_t))
   =
-  betree_Node_lookup self.root key st
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: backward function 0
-    Source: 'src/betree.rs', lines 895:4-895:62 *)
-let betree_BeTree_lookup_back
-  (self : betree_BeTree_t) (key : u64) (st : state) : result betree_BeTree_t =
-  let* n = betree_Node_lookup_back self.root key st in
-  Return { self with root = n }
+  let* (st1, (o, n)) = betree_Node_lookup self.root key st in
+  Return (st1, (o, { self with root = n }))
 
-(** [betree_main::main]: forward function
+(** [betree_main::main]:
     Source: 'src/betree_main.rs', lines 5:0-5:9 *)
 let main : result unit =
   Return ()
diff --git a/tests/fstar/betree/BetreeMain.FunsExternal.fsti b/tests/fstar/betree/BetreeMain.FunsExternal.fsti
index cd2f956f..de9b96fd 100644
--- a/tests/fstar/betree/BetreeMain.FunsExternal.fsti
+++ b/tests/fstar/betree/BetreeMain.FunsExternal.fsti
@@ -6,29 +6,29 @@ include BetreeMain.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree_utils::load_internal_node]: forward function
+(** [betree_main::betree_utils::load_internal_node]:
     Source: 'src/betree_utils.rs', lines 98:0-98:63 *)
 val betree_utils_load_internal_node
   : u64 -> state -> result (state & (betree_List_t (u64 & betree_Message_t)))
 
-(** [betree_main::betree_utils::store_internal_node]: forward function
+(** [betree_main::betree_utils::store_internal_node]:
     Source: 'src/betree_utils.rs', lines 115:0-115:71 *)
 val betree_utils_store_internal_node
   :
   u64 -> betree_List_t (u64 & betree_Message_t) -> state -> result (state &
     unit)
 
-(** [betree_main::betree_utils::load_leaf_node]: forward function
+(** [betree_main::betree_utils::load_leaf_node]:
     Source: 'src/betree_utils.rs', lines 132:0-132:55 *)
 val betree_utils_load_leaf_node
   : u64 -> state -> result (state & (betree_List_t (u64 & u64)))
 
-(** [betree_main::betree_utils::store_leaf_node]: forward function
+(** [betree_main::betree_utils::store_leaf_node]:
     Source: 'src/betree_utils.rs', lines 145:0-145:63 *)
 val betree_utils_store_leaf_node
   : u64 -> betree_List_t (u64 & u64) -> state -> result (state & unit)
 
-(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+(** [core::option::{core::option::Option<T>}::unwrap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
 val core_option_Option_unwrap
   (t : Type0) : option t -> state -> result (state & t)
diff --git a/tests/fstar/betree/Primitives.fst b/tests/fstar/betree/Primitives.fst
index a3ffbde4..fca80829 100644
--- a/tests/fstar/betree/Primitives.fst
+++ b/tests/fstar/betree/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -535,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -552,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -559,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
@@ -588,8 +603,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +625,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +636,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +658,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +684,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +703,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +718,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +738,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +754,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +762,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +781,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +796,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +809,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +827,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +842,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst b/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
index 6c3c2161..a3065f3d 100644
--- a/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
+++ b/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
@@ -8,7 +8,7 @@ include BetreeMain.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree::load_internal_node]: forward function
+(** [betree_main::betree::load_internal_node]:
     Source: 'src/betree.rs', lines 36:0-36:52 *)
 let betree_load_internal_node
   (id : u64) (st : state) :
@@ -16,58 +16,48 @@ let betree_load_internal_node
   =
   betree_utils_load_internal_node id st
 
-(** [betree_main::betree::store_internal_node]: forward function
+(** [betree_main::betree::store_internal_node]:
     Source: 'src/betree.rs', lines 41:0-41:60 *)
 let betree_store_internal_node
   (id : u64) (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
   result (state & unit)
   =
-  let* (st0, _) = betree_utils_store_internal_node id content st in
-  Return (st0, ())
+  let* (st1, _) = betree_utils_store_internal_node id content st in
+  Return (st1, ())
 
-(** [betree_main::betree::load_leaf_node]: forward function
+(** [betree_main::betree::load_leaf_node]:
     Source: 'src/betree.rs', lines 46:0-46:44 *)
 let betree_load_leaf_node
   (id : u64) (st : state) : result (state & (betree_List_t (u64 & u64))) =
   betree_utils_load_leaf_node id st
 
-(** [betree_main::betree::store_leaf_node]: forward function
+(** [betree_main::betree::store_leaf_node]:
     Source: 'src/betree.rs', lines 51:0-51:52 *)
 let betree_store_leaf_node
   (id : u64) (content : betree_List_t (u64 & u64)) (st : state) :
   result (state & unit)
   =
-  let* (st0, _) = betree_utils_store_leaf_node id content st in
-  Return (st0, ())
-
-(** [betree_main::betree::fresh_node_id]: forward function
-    Source: 'src/betree.rs', lines 55:0-55:48 *)
-let betree_fresh_node_id (counter : u64) : result u64 =
-  let* _ = u64_add counter 1 in Return counter
+  let* (st1, _) = betree_utils_store_leaf_node id content st in
+  Return (st1, ())
 
-(** [betree_main::betree::fresh_node_id]: backward function 0
+(** [betree_main::betree::fresh_node_id]:
     Source: 'src/betree.rs', lines 55:0-55:48 *)
-let betree_fresh_node_id_back (counter : u64) : result u64 =
-  u64_add counter 1
+let betree_fresh_node_id (counter : u64) : result (u64 & u64) =
+  let* counter1 = u64_add counter 1 in Return (counter, counter1)
 
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]: forward function
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]:
     Source: 'src/betree.rs', lines 206:4-206:20 *)
 let betree_NodeIdCounter_new : result betree_NodeIdCounter_t =
   Return { next_node_id = 0 }
 
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: forward function
+(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]:
     Source: 'src/betree.rs', lines 210:4-210:36 *)
 let betree_NodeIdCounter_fresh_id
-  (self : betree_NodeIdCounter_t) : result u64 =
-  let* _ = u64_add self.next_node_id 1 in Return self.next_node_id
+  (self : betree_NodeIdCounter_t) : result (u64 & betree_NodeIdCounter_t) =
+  let* i = u64_add self.next_node_id 1 in
+  Return (self.next_node_id, { next_node_id = i })
 
-(** [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: backward function 0
-    Source: 'src/betree.rs', lines 210:4-210:36 *)
-let betree_NodeIdCounter_fresh_id_back
-  (self : betree_NodeIdCounter_t) : result betree_NodeIdCounter_t =
-  let* i = u64_add self.next_node_id 1 in Return { next_node_id = i }
-
-(** [betree_main::betree::upsert_update]: forward function
+(** [betree_main::betree::upsert_update]:
     Source: 'src/betree.rs', lines 234:0-234:70 *)
 let betree_upsert_update
   (prev : option u64) (st : betree_UpsertFunState_t) : result u64 =
@@ -75,30 +65,30 @@ let betree_upsert_update
   | None ->
     begin match st with
     | Betree_UpsertFunState_Add v -> Return v
-    | Betree_UpsertFunState_Sub i -> Return 0
+    | Betree_UpsertFunState_Sub _ -> Return 0
     end
-  | Some prev0 ->
+  | Some prev1 ->
     begin match st with
     | Betree_UpsertFunState_Add v ->
-      let* margin = u64_sub core_u64_max prev0 in
-      if margin >= v then u64_add prev0 v else Return core_u64_max
+      let* margin = u64_sub core_u64_max prev1 in
+      if margin >= v then u64_add prev1 v else Return core_u64_max
     | Betree_UpsertFunState_Sub v ->
-      if prev0 >= v then u64_sub prev0 v else Return 0
+      if prev1 >= v then u64_sub prev1 v else Return 0
     end
   end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::len]:
     Source: 'src/betree.rs', lines 276:4-276:24 *)
 let rec betree_List_len
   (t : Type0) (self : betree_List_t t) :
   Tot (result u64) (decreases (betree_List_len_decreases t self))
   =
   begin match self with
-  | Betree_List_Cons x tl -> let* i = betree_List_len t tl in u64_add 1 i
+  | Betree_List_Cons _ tl -> let* i = betree_List_len t tl in u64_add 1 i
   | Betree_List_Nil -> Return 0
   end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]:
     Source: 'src/betree.rs', lines 284:4-284:51 *)
 let rec betree_List_split_at
   (t : Type0) (self : betree_List_t t) (n : u64) :
@@ -118,52 +108,42 @@ let rec betree_List_split_at
     | Betree_List_Nil -> Fail Failure
     end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]:
     Source: 'src/betree.rs', lines 299:4-299:34 *)
 let betree_List_push_front
   (t : Type0) (self : betree_List_t t) (x : t) : result (betree_List_t t) =
-  let tl = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+  let (tl, _) = core_mem_replace (betree_List_t t) self Betree_List_Nil in
   let l = tl in
   Return (Betree_List_Cons x l)
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: forward function
-    Source: 'src/betree.rs', lines 306:4-306:32 *)
-let betree_List_pop_front (t : Type0) (self : betree_List_t t) : result t =
-  let ls = core_mem_replace (betree_List_t t) self Betree_List_Nil in
-  begin match ls with
-  | Betree_List_Cons x tl -> Return x
-  | Betree_List_Nil -> Fail Failure
-  end
-
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: backward function 0
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
     Source: 'src/betree.rs', lines 306:4-306:32 *)
-let betree_List_pop_front_back
-  (t : Type0) (self : betree_List_t t) : result (betree_List_t t) =
-  let ls = core_mem_replace (betree_List_t t) self Betree_List_Nil in
+let betree_List_pop_front
+  (t : Type0) (self : betree_List_t t) : result (t & (betree_List_t t)) =
+  let (ls, _) = core_mem_replace (betree_List_t t) self Betree_List_Nil in
   begin match ls with
-  | Betree_List_Cons x tl -> Return tl
+  | Betree_List_Cons x tl -> Return (x, tl)
   | Betree_List_Nil -> Fail Failure
   end
 
-(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]: forward function
+(** [betree_main::betree::{betree_main::betree::List<T>#1}::hd]:
     Source: 'src/betree.rs', lines 318:4-318:22 *)
 let betree_List_hd (t : Type0) (self : betree_List_t t) : result t =
   begin match self with
-  | Betree_List_Cons hd l -> Return hd
+  | Betree_List_Cons hd _ -> Return hd
   | Betree_List_Nil -> Fail Failure
   end
 
-(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]: forward function
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]:
     Source: 'src/betree.rs', lines 327:4-327:44 *)
 let betree_ListTupleU64T_head_has_key
   (t : Type0) (self : betree_List_t (u64 & t)) (key : u64) : result bool =
   begin match self with
-  | Betree_List_Cons hd l -> let (i, _) = hd in Return (i = key)
+  | Betree_List_Cons hd _ -> let (i, _) = hd in Return (i = key)
   | Betree_List_Nil -> Return false
   end
 
-(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]: forward function
+(** [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]:
     Source: 'src/betree.rs', lines 339:4-339:73 *)
 let rec betree_ListTupleU64T_partition_at_pivot
   (t : Type0) (self : betree_List_t (u64 & t)) (pivot : u64) :
@@ -183,119 +163,54 @@ let rec betree_ListTupleU64T_partition_at_pivot
   | Betree_List_Nil -> Return (Betree_List_Nil, Betree_List_Nil)
   end
 
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: forward function
+(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]:
     Source: 'src/betree.rs', lines 359:4-364:17 *)
 let betree_Leaf_split
   (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
   (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
   (st : state) :
-  result (state & betree_Internal_t)
-  =
-  let* p = betree_List_split_at (u64 & u64) content params.split_size in
-  let (content0, content1) = p in
-  let* p0 = betree_List_hd (u64 & u64) content1 in
-  let (pivot, _) = p0 in
-  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt0 in
-  let* (st0, _) = betree_store_leaf_node id0 content0 st in
-  let* (st1, _) = betree_store_leaf_node id1 content1 st0 in
-  let n = Betree_Node_Leaf { id = id0; size = params.split_size } in
-  let n0 = Betree_Node_Leaf { id = id1; size = params.split_size } in
-  Return (st1, { id = self.id; pivot = pivot; left = n; right = n0 })
-
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 0
-    Source: 'src/betree.rs', lines 359:4-364:17 *)
-let betree_Leaf_split_back0
-  (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
-  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
-  (st : state) (st0 : state) :
-  result (state & unit)
-  =
-  let* p = betree_List_split_at (u64 & u64) content params.split_size in
-  let (content0, content1) = p in
-  let* _ = betree_List_hd (u64 & u64) content1 in
-  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt0 in
-  let* (st1, _) = betree_store_leaf_node id0 content0 st in
-  let* _ = betree_store_leaf_node id1 content1 st1 in
-  Return (st0, ())
-
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 1
-    Source: 'src/betree.rs', lines 359:4-364:17 *)
-let betree_Leaf_split_back1
-  (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
-  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
-  (st : state) (st0 : state) :
-  result (state & unit)
+  result (state & (betree_Internal_t & betree_NodeIdCounter_t))
   =
   let* p = betree_List_split_at (u64 & u64) content params.split_size in
   let (content0, content1) = p in
-  let* _ = betree_List_hd (u64 & u64) content1 in
-  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt0 in
+  let* p1 = betree_List_hd (u64 & u64) content1 in
+  let (pivot, _) = p1 in
+  let* (id0, nic) = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* (id1, nic1) = betree_NodeIdCounter_fresh_id nic in
   let* (st1, _) = betree_store_leaf_node id0 content0 st in
-  let* _ = betree_store_leaf_node id1 content1 st1 in
-  Return (st0, ())
-
-(** [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 2
-    Source: 'src/betree.rs', lines 359:4-364:17 *)
-let betree_Leaf_split_back2
-  (self : betree_Leaf_t) (content : betree_List_t (u64 & u64))
-  (params : betree_Params_t) (node_id_cnt : betree_NodeIdCounter_t)
-  (st : state) (st0 : state) :
-  result (state & betree_NodeIdCounter_t)
-  =
-  let* p = betree_List_split_at (u64 & u64) content params.split_size in
-  let (content0, content1) = p in
-  let* _ = betree_List_hd (u64 & u64) content1 in
-  let* id0 = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  let* id1 = betree_NodeIdCounter_fresh_id node_id_cnt0 in
-  let* (st1, _) = betree_store_leaf_node id0 content0 st in
-  let* _ = betree_store_leaf_node id1 content1 st1 in
-  let* node_id_cnt1 = betree_NodeIdCounter_fresh_id_back node_id_cnt0 in
-  Return (st0, node_id_cnt1)
+  let* (st2, _) = betree_store_leaf_node id1 content1 st1 in
+  let n = Betree_Node_Leaf { id = id0; size = params.split_size } in
+  let n1 = Betree_Node_Leaf { id = id1; size = params.split_size } in
+  Return (st2, ({ id = self.id; pivot = pivot; left = n; right = n1 }, nic1))
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]:
     Source: 'src/betree.rs', lines 789:4-792:34 *)
 let rec betree_Node_lookup_first_message_for_key
   (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  Tot (result ((betree_List_t (u64 & betree_Message_t)) & (betree_List_t (u64 &
+    betree_Message_t) -> result (betree_List_t (u64 & betree_Message_t)))))
   (decreases (betree_Node_lookup_first_message_for_key_decreases key msgs))
   =
   begin match msgs with
   | Betree_List_Cons x next_msgs ->
     let (i, m) = x in
     if i >= key
-    then Return (Betree_List_Cons (i, m) next_msgs)
-    else betree_Node_lookup_first_message_for_key key next_msgs
-  | Betree_List_Nil -> Return Betree_List_Nil
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: backward function 0
-    Source: 'src/betree.rs', lines 789:4-792:34 *)
-let rec betree_Node_lookup_first_message_for_key_back
-  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t))
-  (ret : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
-  (decreases (betree_Node_lookup_first_message_for_key_decreases key msgs))
-  =
-  begin match msgs with
-  | Betree_List_Cons x next_msgs ->
-    let (i, m) = x in
-    if i >= key
-    then Return ret
+    then
+      let back_'a = fun ret -> Return ret in
+      Return (Betree_List_Cons (i, m) next_msgs, back_'a)
     else
-      let* next_msgs0 =
-        betree_Node_lookup_first_message_for_key_back key next_msgs ret in
-      Return (Betree_List_Cons (i, m) next_msgs0)
-  | Betree_List_Nil -> Return ret
+      let* (l, lookup_first_message_for_key_back) =
+        betree_Node_lookup_first_message_for_key key next_msgs in
+      let back_'a =
+        fun ret ->
+          let* next_msgs1 = lookup_first_message_for_key_back ret in
+          Return (Betree_List_Cons (i, m) next_msgs1) in
+      Return (l, back_'a)
+  | Betree_List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
     Source: 'src/betree.rs', lines 636:4-636:80 *)
 let rec betree_Node_lookup_in_bindings
   (key : u64) (bindings : betree_List_t (u64 & u64)) :
@@ -304,221 +219,110 @@ let rec betree_Node_lookup_in_bindings
   =
   begin match bindings with
   | Betree_List_Cons hd tl ->
-    let (i, i0) = hd in
+    let (i, i1) = hd in
     if i = key
-    then Return (Some i0)
+    then Return (Some i1)
     else if i > key then Return None else betree_Node_lookup_in_bindings key tl
   | Betree_List_Nil -> Return None
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]:
     Source: 'src/betree.rs', lines 819:4-819:90 *)
 let rec betree_Node_apply_upserts
   (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
   (key : u64) (st : state) :
-  Tot (result (state & u64))
-  (decreases (betree_Node_apply_upserts_decreases msgs prev key st))
-  =
-  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs key in
-  if b
-  then
-    let* msg = betree_List_pop_front (u64 & betree_Message_t) msgs in
-    let (_, m) = msg in
-    begin match m with
-    | Betree_Message_Insert i -> Fail Failure
-    | Betree_Message_Delete -> Fail Failure
-    | Betree_Message_Upsert s ->
-      let* v = betree_upsert_update prev s in
-      let* msgs0 = betree_List_pop_front_back (u64 & betree_Message_t) msgs in
-      betree_Node_apply_upserts msgs0 (Some v) key st
-    end
-  else
-    let* (st0, v) = core_option_Option_unwrap u64 prev st in
-    let* _ =
-      betree_List_push_front (u64 & betree_Message_t) msgs (key,
-        Betree_Message_Insert v) in
-    Return (st0, v)
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: backward function 0
-    Source: 'src/betree.rs', lines 819:4-819:90 *)
-let rec betree_Node_apply_upserts_back
-  (msgs : betree_List_t (u64 & betree_Message_t)) (prev : option u64)
-  (key : u64) (st : state) (st0 : state) :
-  Tot (result (state & (betree_List_t (u64 & betree_Message_t))))
+  Tot (result (state & (u64 & (betree_List_t (u64 & betree_Message_t)))))
   (decreases (betree_Node_apply_upserts_decreases msgs prev key st))
   =
   let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs key in
   if b
   then
-    let* msg = betree_List_pop_front (u64 & betree_Message_t) msgs in
+    let* (msg, l) = betree_List_pop_front (u64 & betree_Message_t) msgs in
     let (_, m) = msg in
     begin match m with
-    | Betree_Message_Insert i -> Fail Failure
+    | Betree_Message_Insert _ -> Fail Failure
     | Betree_Message_Delete -> Fail Failure
     | Betree_Message_Upsert s ->
       let* v = betree_upsert_update prev s in
-      let* msgs0 = betree_List_pop_front_back (u64 & betree_Message_t) msgs in
-      betree_Node_apply_upserts_back msgs0 (Some v) key st st0
+      betree_Node_apply_upserts l (Some v) key st
     end
   else
-    let* (_, v) = core_option_Option_unwrap u64 prev st in
-    let* msgs0 =
+    let* (st1, v) = core_option_Option_unwrap u64 prev st in
+    let* l =
       betree_List_push_front (u64 & betree_Message_t) msgs (key,
         Betree_Message_Insert v) in
-    Return (st0, msgs0)
+    Return (st1, (v, l))
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: forward function
+(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]:
     Source: 'src/betree.rs', lines 395:4-395:63 *)
 let rec betree_Internal_lookup_in_children
   (self : betree_Internal_t) (key : u64) (st : state) :
-  Tot (result (state & (option u64)))
-  (decreases (betree_Internal_lookup_in_children_decreases self key st))
-  =
-  if key < self.pivot
-  then betree_Node_lookup self.left key st
-  else betree_Node_lookup self.right key st
-
-(** [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: backward function 0
-    Source: 'src/betree.rs', lines 395:4-395:63 *)
-and betree_Internal_lookup_in_children_back
-  (self : betree_Internal_t) (key : u64) (st : state) (st0 : state) :
-  Tot (result (state & betree_Internal_t))
+  Tot (result (state & ((option u64) & betree_Internal_t)))
   (decreases (betree_Internal_lookup_in_children_decreases self key st))
   =
   if key < self.pivot
   then
-    let* (st1, n) = betree_Node_lookup_back self.left key st st0 in
-    Return (st1, { self with left = n })
+    let* (st1, (o, n)) = betree_Node_lookup self.left key st in
+    Return (st1, (o, { self with left = n }))
   else
-    let* (st1, n) = betree_Node_lookup_back self.right key st st0 in
-    Return (st1, { self with right = n })
+    let* (st1, (o, n)) = betree_Node_lookup self.right key st in
+    Return (st1, (o, { self with right = n }))
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]:
     Source: 'src/betree.rs', lines 709:4-709:58 *)
 and betree_Node_lookup
   (self : betree_Node_t) (key : u64) (st : state) :
-  Tot (result (state & (option u64)))
-  (decreases (betree_Node_lookup_decreases self key st))
-  =
-  begin match self with
-  | Betree_Node_Internal node ->
-    let* (st0, msgs) = betree_load_internal_node node.id st in
-    let* pending = betree_Node_lookup_first_message_for_key key msgs in
-    begin match pending with
-    | Betree_List_Cons p l ->
-      let (k, msg) = p in
-      if k <> key
-      then
-        let* (st1, o) = betree_Internal_lookup_in_children node key st0 in
-        let* _ =
-          betree_Node_lookup_first_message_for_key_back key msgs
-            (Betree_List_Cons (k, msg) l) in
-        Return (st1, o)
-      else
-        begin match msg with
-        | Betree_Message_Insert v ->
-          let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Insert v) l) in
-          Return (st0, Some v)
-        | Betree_Message_Delete ->
-          let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Delete) l) in
-          Return (st0, None)
-        | Betree_Message_Upsert ufs ->
-          let* (st1, v) = betree_Internal_lookup_in_children node key st0 in
-          let* (st2, v0) =
-            betree_Node_apply_upserts (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st1 in
-          let* (st3, node0) =
-            betree_Internal_lookup_in_children_back node key st0 st2 in
-          let* (st4, pending0) =
-            betree_Node_apply_upserts_back (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st1 st3 in
-          let* msgs0 =
-            betree_Node_lookup_first_message_for_key_back key msgs pending0 in
-          let* (st5, _) = betree_store_internal_node node0.id msgs0 st4 in
-          Return (st5, Some v0)
-        end
-    | Betree_List_Nil ->
-      let* (st1, o) = betree_Internal_lookup_in_children node key st0 in
-      let* _ =
-        betree_Node_lookup_first_message_for_key_back key msgs Betree_List_Nil
-        in
-      Return (st1, o)
-    end
-  | Betree_Node_Leaf node ->
-    let* (st0, bindings) = betree_load_leaf_node node.id st in
-    let* o = betree_Node_lookup_in_bindings key bindings in
-    Return (st0, o)
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup]: backward function 0
-    Source: 'src/betree.rs', lines 709:4-709:58 *)
-and betree_Node_lookup_back
-  (self : betree_Node_t) (key : u64) (st : state) (st0 : state) :
-  Tot (result (state & betree_Node_t))
+  Tot (result (state & ((option u64) & betree_Node_t)))
   (decreases (betree_Node_lookup_decreases self key st))
   =
   begin match self with
   | Betree_Node_Internal node ->
     let* (st1, msgs) = betree_load_internal_node node.id st in
-    let* pending = betree_Node_lookup_first_message_for_key key msgs in
+    let* (pending, lookup_first_message_for_key_back) =
+      betree_Node_lookup_first_message_for_key key msgs in
     begin match pending with
     | Betree_List_Cons p l ->
       let (k, msg) = p in
       if k <> key
       then
+        let* (st2, (o, i)) = betree_Internal_lookup_in_children node key st1 in
         let* _ =
-          betree_Node_lookup_first_message_for_key_back key msgs
-            (Betree_List_Cons (k, msg) l) in
-        let* (st2, node0) =
-          betree_Internal_lookup_in_children_back node key st1 st0 in
-        Return (st2, Betree_Node_Internal node0)
+          lookup_first_message_for_key_back (Betree_List_Cons (k, msg) l) in
+        Return (st2, (o, Betree_Node_Internal i))
       else
         begin match msg with
         | Betree_Message_Insert v ->
           let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Insert v) l) in
-          Return (st0, Betree_Node_Internal node)
+            lookup_first_message_for_key_back (Betree_List_Cons (k,
+              Betree_Message_Insert v) l) in
+          Return (st1, (Some v, Betree_Node_Internal node))
         | Betree_Message_Delete ->
           let* _ =
-            betree_Node_lookup_first_message_for_key_back key msgs
-              (Betree_List_Cons (k, Betree_Message_Delete) l) in
-          Return (st0, Betree_Node_Internal node)
+            lookup_first_message_for_key_back (Betree_List_Cons (k,
+              Betree_Message_Delete) l) in
+          Return (st1, (None, Betree_Node_Internal node))
         | Betree_Message_Upsert ufs ->
-          let* (st2, v) = betree_Internal_lookup_in_children node key st1 in
-          let* (st3, _) =
+          let* (st2, (v, i)) = betree_Internal_lookup_in_children node key st1
+            in
+          let* (st3, (v1, l1)) =
             betree_Node_apply_upserts (Betree_List_Cons (k,
               Betree_Message_Upsert ufs) l) v key st2 in
-          let* (st4, node0) =
-            betree_Internal_lookup_in_children_back node key st1 st3 in
-          let* (st5, pending0) =
-            betree_Node_apply_upserts_back (Betree_List_Cons (k,
-              Betree_Message_Upsert ufs) l) v key st2 st4 in
-          let* msgs0 =
-            betree_Node_lookup_first_message_for_key_back key msgs pending0 in
-          let* _ = betree_store_internal_node node0.id msgs0 st5 in
-          Return (st0, Betree_Node_Internal node0)
+          let* msgs1 = lookup_first_message_for_key_back l1 in
+          let* (st4, _) = betree_store_internal_node i.id msgs1 st3 in
+          Return (st4, (Some v1, Betree_Node_Internal i))
         end
     | Betree_List_Nil ->
-      let* _ =
-        betree_Node_lookup_first_message_for_key_back key msgs Betree_List_Nil
-        in
-      let* (st2, node0) =
-        betree_Internal_lookup_in_children_back node key st1 st0 in
-      Return (st2, Betree_Node_Internal node0)
+      let* (st2, (o, i)) = betree_Internal_lookup_in_children node key st1 in
+      let* _ = lookup_first_message_for_key_back Betree_List_Nil in
+      Return (st2, (o, Betree_Node_Internal i))
     end
   | Betree_Node_Leaf node ->
-    let* (_, bindings) = betree_load_leaf_node node.id st in
-    let* _ = betree_Node_lookup_in_bindings key bindings in
-    Return (st0, Betree_Node_Leaf node)
+    let* (st1, bindings) = betree_load_leaf_node node.id st in
+    let* o = betree_Node_lookup_in_bindings key bindings in
+    Return (st1, (o, Betree_Node_Leaf node))
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]:
     Source: 'src/betree.rs', lines 674:4-674:77 *)
 let rec betree_Node_filter_messages_for_key
   (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
@@ -530,36 +334,20 @@ let rec betree_Node_filter_messages_for_key
     let (k, m) = p in
     if k = key
     then
-      let* msgs0 =
-        betree_List_pop_front_back (u64 & betree_Message_t) (Betree_List_Cons
-          (k, m) l) in
-      betree_Node_filter_messages_for_key key msgs0
+      let* (_, l1) =
+        betree_List_pop_front (u64 & betree_Message_t) (Betree_List_Cons (k, m)
+          l) in
+      betree_Node_filter_messages_for_key key l1
     else Return (Betree_List_Cons (k, m) l)
   | Betree_List_Nil -> Return Betree_List_Nil
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]:
     Source: 'src/betree.rs', lines 689:4-692:34 *)
 let rec betree_Node_lookup_first_message_after_key
   (key : u64) (msgs : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
-  (decreases (betree_Node_lookup_first_message_after_key_decreases key msgs))
-  =
-  begin match msgs with
-  | Betree_List_Cons p next_msgs ->
-    let (k, m) = p in
-    if k = key
-    then betree_Node_lookup_first_message_after_key key next_msgs
-    else Return (Betree_List_Cons (k, m) next_msgs)
-  | Betree_List_Nil -> Return Betree_List_Nil
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: backward function 0
-    Source: 'src/betree.rs', lines 689:4-692:34 *)
-let rec betree_Node_lookup_first_message_after_key_back
-  (key : u64) (msgs : betree_List_t (u64 & betree_Message_t))
-  (ret : betree_List_t (u64 & betree_Message_t)) :
-  Tot (result (betree_List_t (u64 & betree_Message_t)))
+  Tot (result ((betree_List_t (u64 & betree_Message_t)) & (betree_List_t (u64 &
+    betree_Message_t) -> result (betree_List_t (u64 & betree_Message_t)))))
   (decreases (betree_Node_lookup_first_message_after_key_decreases key msgs))
   =
   begin match msgs with
@@ -567,75 +355,79 @@ let rec betree_Node_lookup_first_message_after_key_back
     let (k, m) = p in
     if k = key
     then
-      let* next_msgs0 =
-        betree_Node_lookup_first_message_after_key_back key next_msgs ret in
-      Return (Betree_List_Cons (k, m) next_msgs0)
-    else Return ret
-  | Betree_List_Nil -> Return ret
+      let* (l, lookup_first_message_after_key_back) =
+        betree_Node_lookup_first_message_after_key key next_msgs in
+      let back_'a =
+        fun ret ->
+          let* next_msgs1 = lookup_first_message_after_key_back ret in
+          Return (Betree_List_Cons (k, m) next_msgs1) in
+      Return (l, back_'a)
+    else
+      let back_'a = fun ret -> Return ret in
+      Return (Betree_List_Cons (k, m) next_msgs, back_'a)
+  | Betree_List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
     Source: 'src/betree.rs', lines 521:4-521:89 *)
 let betree_Node_apply_to_internal
   (msgs : betree_List_t (u64 & betree_Message_t)) (key : u64)
   (new_msg : betree_Message_t) :
   result (betree_List_t (u64 & betree_Message_t))
   =
-  let* msgs0 = betree_Node_lookup_first_message_for_key key msgs in
-  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs0 key in
+  let* (msgs1, lookup_first_message_for_key_back) =
+    betree_Node_lookup_first_message_for_key key msgs in
+  let* b = betree_ListTupleU64T_head_has_key betree_Message_t msgs1 key in
   if b
   then
     begin match new_msg with
     | Betree_Message_Insert i ->
-      let* msgs1 = betree_Node_filter_messages_for_key key msgs0 in
-      let* msgs2 =
-        betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+      let* l = betree_Node_filter_messages_for_key key msgs1 in
+      let* l1 =
+        betree_List_push_front (u64 & betree_Message_t) l (key,
           Betree_Message_Insert i) in
-      betree_Node_lookup_first_message_for_key_back key msgs msgs2
+      lookup_first_message_for_key_back l1
     | Betree_Message_Delete ->
-      let* msgs1 = betree_Node_filter_messages_for_key key msgs0 in
-      let* msgs2 =
-        betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+      let* l = betree_Node_filter_messages_for_key key msgs1 in
+      let* l1 =
+        betree_List_push_front (u64 & betree_Message_t) l (key,
           Betree_Message_Delete) in
-      betree_Node_lookup_first_message_for_key_back key msgs msgs2
+      lookup_first_message_for_key_back l1
     | Betree_Message_Upsert s ->
-      let* p = betree_List_hd (u64 & betree_Message_t) msgs0 in
+      let* p = betree_List_hd (u64 & betree_Message_t) msgs1 in
       let (_, m) = p in
       begin match m with
       | Betree_Message_Insert prev ->
         let* v = betree_upsert_update (Some prev) s in
-        let* msgs1 = betree_List_pop_front_back (u64 & betree_Message_t) msgs0
-          in
-        let* msgs2 =
-          betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+        let* (_, l) = betree_List_pop_front (u64 & betree_Message_t) msgs1 in
+        let* l1 =
+          betree_List_push_front (u64 & betree_Message_t) l (key,
             Betree_Message_Insert v) in
-        betree_Node_lookup_first_message_for_key_back key msgs msgs2
+        lookup_first_message_for_key_back l1
       | Betree_Message_Delete ->
+        let* (_, l) = betree_List_pop_front (u64 & betree_Message_t) msgs1 in
         let* v = betree_upsert_update None s in
-        let* msgs1 = betree_List_pop_front_back (u64 & betree_Message_t) msgs0
-          in
-        let* msgs2 =
-          betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+        let* l1 =
+          betree_List_push_front (u64 & betree_Message_t) l (key,
             Betree_Message_Insert v) in
-        betree_Node_lookup_first_message_for_key_back key msgs msgs2
-      | Betree_Message_Upsert ufs ->
-        let* msgs1 = betree_Node_lookup_first_message_after_key key msgs0 in
-        let* msgs2 =
-          betree_List_push_front (u64 & betree_Message_t) msgs1 (key,
+        lookup_first_message_for_key_back l1
+      | Betree_Message_Upsert _ ->
+        let* (msgs2, lookup_first_message_after_key_back) =
+          betree_Node_lookup_first_message_after_key key msgs1 in
+        let* l =
+          betree_List_push_front (u64 & betree_Message_t) msgs2 (key,
             Betree_Message_Upsert s) in
-        let* msgs3 =
-          betree_Node_lookup_first_message_after_key_back key msgs0 msgs2 in
-        betree_Node_lookup_first_message_for_key_back key msgs msgs3
+        let* msgs3 = lookup_first_message_after_key_back l in
+        lookup_first_message_for_key_back msgs3
       end
     end
   else
-    let* msgs1 =
-      betree_List_push_front (u64 & betree_Message_t) msgs0 (key, new_msg) in
-    betree_Node_lookup_first_message_for_key_back key msgs msgs1
+    let* l =
+      betree_List_push_front (u64 & betree_Message_t) msgs1 (key, new_msg) in
+    lookup_first_message_for_key_back l
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]:
     Source: 'src/betree.rs', lines 502:4-505:5 *)
 let rec betree_Node_apply_messages_to_internal
   (msgs : betree_List_t (u64 & betree_Message_t))
@@ -646,89 +438,75 @@ let rec betree_Node_apply_messages_to_internal
   begin match new_msgs with
   | Betree_List_Cons new_msg new_msgs_tl ->
     let (i, m) = new_msg in
-    let* msgs0 = betree_Node_apply_to_internal msgs i m in
-    betree_Node_apply_messages_to_internal msgs0 new_msgs_tl
+    let* l = betree_Node_apply_to_internal msgs i m in
+    betree_Node_apply_messages_to_internal l new_msgs_tl
   | Betree_List_Nil -> Return msgs
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]:
     Source: 'src/betree.rs', lines 653:4-656:32 *)
 let rec betree_Node_lookup_mut_in_bindings
   (key : u64) (bindings : betree_List_t (u64 & u64)) :
-  Tot (result (betree_List_t (u64 & u64)))
+  Tot (result ((betree_List_t (u64 & u64)) & (betree_List_t (u64 & u64) ->
+    result (betree_List_t (u64 & u64)))))
   (decreases (betree_Node_lookup_mut_in_bindings_decreases key bindings))
   =
   begin match bindings with
   | Betree_List_Cons hd tl ->
-    let (i, i0) = hd in
+    let (i, i1) = hd in
     if i >= key
-    then Return (Betree_List_Cons (i, i0) tl)
-    else betree_Node_lookup_mut_in_bindings key tl
-  | Betree_List_Nil -> Return Betree_List_Nil
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: backward function 0
-    Source: 'src/betree.rs', lines 653:4-656:32 *)
-let rec betree_Node_lookup_mut_in_bindings_back
-  (key : u64) (bindings : betree_List_t (u64 & u64))
-  (ret : betree_List_t (u64 & u64)) :
-  Tot (result (betree_List_t (u64 & u64)))
-  (decreases (betree_Node_lookup_mut_in_bindings_decreases key bindings))
-  =
-  begin match bindings with
-  | Betree_List_Cons hd tl ->
-    let (i, i0) = hd in
-    if i >= key
-    then Return ret
+    then
+      let back_'a = fun ret -> Return ret in
+      Return (Betree_List_Cons (i, i1) tl, back_'a)
     else
-      let* tl0 = betree_Node_lookup_mut_in_bindings_back key tl ret in
-      Return (Betree_List_Cons (i, i0) tl0)
-  | Betree_List_Nil -> Return ret
+      let* (l, lookup_mut_in_bindings_back) =
+        betree_Node_lookup_mut_in_bindings key tl in
+      let back_'a =
+        fun ret ->
+          let* tl1 = lookup_mut_in_bindings_back ret in
+          Return (Betree_List_Cons (i, i1) tl1) in
+      Return (l, back_'a)
+  | Betree_List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
     Source: 'src/betree.rs', lines 460:4-460:87 *)
 let betree_Node_apply_to_leaf
   (bindings : betree_List_t (u64 & u64)) (key : u64)
   (new_msg : betree_Message_t) :
   result (betree_List_t (u64 & u64))
   =
-  let* bindings0 = betree_Node_lookup_mut_in_bindings key bindings in
-  let* b = betree_ListTupleU64T_head_has_key u64 bindings0 key in
+  let* (bindings1, lookup_mut_in_bindings_back) =
+    betree_Node_lookup_mut_in_bindings key bindings in
+  let* b = betree_ListTupleU64T_head_has_key u64 bindings1 key in
   if b
   then
-    let* hd = betree_List_pop_front (u64 & u64) bindings0 in
+    let* (hd, l) = betree_List_pop_front (u64 & u64) bindings1 in
     begin match new_msg with
     | Betree_Message_Insert v ->
-      let* bindings1 = betree_List_pop_front_back (u64 & u64) bindings0 in
-      let* bindings2 = betree_List_push_front (u64 & u64) bindings1 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
-    | Betree_Message_Delete ->
-      let* bindings1 = betree_List_pop_front_back (u64 & u64) bindings0 in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
+      let* l1 = betree_List_push_front (u64 & u64) l (key, v) in
+      lookup_mut_in_bindings_back l1
+    | Betree_Message_Delete -> lookup_mut_in_bindings_back l
     | Betree_Message_Upsert s ->
       let (_, i) = hd in
       let* v = betree_upsert_update (Some i) s in
-      let* bindings1 = betree_List_pop_front_back (u64 & u64) bindings0 in
-      let* bindings2 = betree_List_push_front (u64 & u64) bindings1 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings2
+      let* l1 = betree_List_push_front (u64 & u64) l (key, v) in
+      lookup_mut_in_bindings_back l1
     end
   else
     begin match new_msg with
     | Betree_Message_Insert v ->
-      let* bindings1 = betree_List_push_front (u64 & u64) bindings0 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
-    | Betree_Message_Delete ->
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings0
+      let* l = betree_List_push_front (u64 & u64) bindings1 (key, v) in
+      lookup_mut_in_bindings_back l
+    | Betree_Message_Delete -> lookup_mut_in_bindings_back bindings1
     | Betree_Message_Upsert s ->
       let* v = betree_upsert_update None s in
-      let* bindings1 = betree_List_push_front (u64 & u64) bindings0 (key, v) in
-      betree_Node_lookup_mut_in_bindings_back key bindings bindings1
+      let* l = betree_List_push_front (u64 & u64) bindings1 (key, v) in
+      lookup_mut_in_bindings_back l
     end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]:
     Source: 'src/betree.rs', lines 444:4-447:5 *)
 let rec betree_Node_apply_messages_to_leaf
   (bindings : betree_List_t (u64 & u64))
@@ -739,69 +517,19 @@ let rec betree_Node_apply_messages_to_leaf
   begin match new_msgs with
   | Betree_List_Cons new_msg new_msgs_tl ->
     let (i, m) = new_msg in
-    let* bindings0 = betree_Node_apply_to_leaf bindings i m in
-    betree_Node_apply_messages_to_leaf bindings0 new_msgs_tl
+    let* l = betree_Node_apply_to_leaf bindings i m in
+    betree_Node_apply_messages_to_leaf l new_msgs_tl
   | Betree_List_Nil -> Return bindings
   end
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: forward function
+(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]:
     Source: 'src/betree.rs', lines 410:4-415:26 *)
 let rec betree_Internal_flush
   (self : betree_Internal_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t)
   (content : betree_List_t (u64 & betree_Message_t)) (st : state) :
-  Tot (result (state & (betree_List_t (u64 & betree_Message_t))))
-  (decreases (
-    betree_Internal_flush_decreases self params node_id_cnt content st))
-  =
-  let* p =
-    betree_ListTupleU64T_partition_at_pivot betree_Message_t content self.pivot
-    in
-  let (msgs_left, msgs_right) = p in
-  let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
-  if len_left >= params.min_flush_size
-  then
-    let* (st0, _) =
-      betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
-    let* (st1, (_, node_id_cnt0)) =
-      betree_Node_apply_messages_back'a self.left params node_id_cnt msgs_left
-        st st0 in
-    let* (st2, ()) =
-      betree_Node_apply_messages_back1 self.left params node_id_cnt msgs_left
-        st st1 in
-    let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
-    if len_right >= params.min_flush_size
-    then
-      let* (st3, _) =
-        betree_Node_apply_messages self.right params node_id_cnt0 msgs_right
-          st2 in
-      let* (st4, (_, _)) =
-        betree_Node_apply_messages_back'a self.right params node_id_cnt0
-          msgs_right st2 st3 in
-      let* (st5, ()) =
-        betree_Node_apply_messages_back1 self.right params node_id_cnt0
-          msgs_right st2 st4 in
-      Return (st5, Betree_List_Nil)
-    else Return (st2, msgs_right)
-  else
-    let* (st0, _) =
-      betree_Node_apply_messages self.right params node_id_cnt msgs_right st in
-    let* (st1, (_, _)) =
-      betree_Node_apply_messages_back'a self.right params node_id_cnt
-        msgs_right st st0 in
-    let* (st2, ()) =
-      betree_Node_apply_messages_back1 self.right params node_id_cnt msgs_right
-        st st1 in
-    Return (st2, msgs_left)
-
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: backward function 0
-    Source: 'src/betree.rs', lines 410:4-415:26 *)
-and betree_Internal_flush_back'a
-  (self : betree_Internal_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (content : betree_List_t (u64 & betree_Message_t)) (st : state) (st0 : state)
-  :
-  Tot (result (state & (betree_Internal_t & betree_NodeIdCounter_t)))
+  Tot (result (state & ((betree_List_t (u64 & betree_Message_t)) &
+    (betree_Internal_t & betree_NodeIdCounter_t))))
   (decreases (
     betree_Internal_flush_decreases self params node_id_cnt content st))
   =
@@ -812,138 +540,31 @@ and betree_Internal_flush_back'a
   let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
   if len_left >= params.min_flush_size
   then
-    let* (st1, _) =
+    let* (st1, p1) =
       betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
-    let* (st2, (n, node_id_cnt0)) =
-      betree_Node_apply_messages_back'a self.left params node_id_cnt msgs_left
-        st st1 in
-    let* (st3, ()) =
-      betree_Node_apply_messages_back1 self.left params node_id_cnt msgs_left
-        st st2 in
+    let (n, node_id_cnt1) = p1 in
     let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
     if len_right >= params.min_flush_size
     then
-      let* (st4, _) =
-        betree_Node_apply_messages self.right params node_id_cnt0 msgs_right
-          st3 in
-      let* (st5, (n0, node_id_cnt1)) =
-        betree_Node_apply_messages_back'a self.right params node_id_cnt0
-          msgs_right st3 st4 in
-      let* _ =
-        betree_Node_apply_messages_back1 self.right params node_id_cnt0
-          msgs_right st3 st5 in
-      Return (st0, ({ self with left = n; right = n0 }, node_id_cnt1))
-    else Return (st0, ({ self with left = n }, node_id_cnt0))
+      let* (st2, p2) =
+        betree_Node_apply_messages self.right params node_id_cnt1 msgs_right
+          st1 in
+      let (n1, node_id_cnt2) = p2 in
+      Return (st2, (Betree_List_Nil, ({ self with left = n; right = n1 },
+        node_id_cnt2)))
+    else Return (st1, (msgs_right, ({ self with left = n }, node_id_cnt1)))
   else
-    let* (st1, _) =
+    let* (st1, p1) =
       betree_Node_apply_messages self.right params node_id_cnt msgs_right st in
-    let* (st2, (n, node_id_cnt0)) =
-      betree_Node_apply_messages_back'a self.right params node_id_cnt
-        msgs_right st st1 in
-    let* _ =
-      betree_Node_apply_messages_back1 self.right params node_id_cnt msgs_right
-        st st2 in
-    Return (st0, ({ self with right = n }, node_id_cnt0))
+    let (n, node_id_cnt1) = p1 in
+    Return (st1, (msgs_left, ({ self with right = n }, node_id_cnt1)))
 
-(** [betree_main::betree::{betree_main::betree::Internal#4}::flush]: backward function 1
-    Source: 'src/betree.rs', lines 410:4-415:26 *)
-and betree_Internal_flush_back1
-  (self : betree_Internal_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (content : betree_List_t (u64 & betree_Message_t)) (st : state) (st0 : state)
-  :
-  Tot (result (state & unit))
-  (decreases (
-    betree_Internal_flush_decreases self params node_id_cnt content st))
-  =
-  let* p =
-    betree_ListTupleU64T_partition_at_pivot betree_Message_t content self.pivot
-    in
-  let (msgs_left, msgs_right) = p in
-  let* len_left = betree_List_len (u64 & betree_Message_t) msgs_left in
-  if len_left >= params.min_flush_size
-  then
-    let* (st1, _) =
-      betree_Node_apply_messages self.left params node_id_cnt msgs_left st in
-    let* (st2, (_, node_id_cnt0)) =
-      betree_Node_apply_messages_back'a self.left params node_id_cnt msgs_left
-        st st1 in
-    let* (st3, ()) =
-      betree_Node_apply_messages_back1 self.left params node_id_cnt msgs_left
-        st st2 in
-    let* len_right = betree_List_len (u64 & betree_Message_t) msgs_right in
-    if len_right >= params.min_flush_size
-    then
-      let* (st4, _) =
-        betree_Node_apply_messages self.right params node_id_cnt0 msgs_right
-          st3 in
-      let* (st5, (_, _)) =
-        betree_Node_apply_messages_back'a self.right params node_id_cnt0
-          msgs_right st3 st4 in
-      let* _ =
-        betree_Node_apply_messages_back1 self.right params node_id_cnt0
-          msgs_right st3 st5 in
-      Return (st0, ())
-    else Return (st0, ())
-  else
-    let* (st1, _) =
-      betree_Node_apply_messages self.right params node_id_cnt msgs_right st in
-    let* (st2, (_, _)) =
-      betree_Node_apply_messages_back'a self.right params node_id_cnt
-        msgs_right st st1 in
-    let* _ =
-      betree_Node_apply_messages_back1 self.right params node_id_cnt msgs_right
-        st st2 in
-    Return (st0, ())
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]:
     Source: 'src/betree.rs', lines 588:4-593:5 *)
 and betree_Node_apply_messages
   (self : betree_Node_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t)
   (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) :
-  Tot (result (state & unit))
-  (decreases (
-    betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
-  =
-  begin match self with
-  | Betree_Node_Internal node ->
-    let* (st0, content) = betree_load_internal_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_internal content msgs in
-    let* num_msgs = betree_List_len (u64 & betree_Message_t) content0 in
-    if num_msgs >= params.min_flush_size
-    then
-      let* (st1, content1) =
-        betree_Internal_flush node params node_id_cnt content0 st0 in
-      let* (st2, (node0, _)) =
-        betree_Internal_flush_back'a node params node_id_cnt content0 st0 st1
-        in
-      let* (st3, _) = betree_store_internal_node node0.id content1 st2 in
-      Return (st3, ())
-    else
-      let* (st1, _) = betree_store_internal_node node.id content0 st0 in
-      Return (st1, ())
-  | Betree_Node_Leaf node ->
-    let* (st0, content) = betree_load_leaf_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_leaf content msgs in
-    let* len = betree_List_len (u64 & u64) content0 in
-    let* i = u64_mul 2 params.split_size in
-    if len >= i
-    then
-      let* (st1, _) = betree_Leaf_split node content0 params node_id_cnt st0 in
-      let* (st2, _) = betree_store_leaf_node node.id Betree_List_Nil st1 in
-      betree_Leaf_split_back0 node content0 params node_id_cnt st0 st2
-    else
-      let* (st1, _) = betree_store_leaf_node node.id content0 st0 in
-      Return (st1, ())
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: backward function 0
-    Source: 'src/betree.rs', lines 588:4-593:5 *)
-and betree_Node_apply_messages_back'a
-  (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) (st0 : state) :
   Tot (result (state & (betree_Node_t & betree_NodeIdCounter_t)))
   (decreases (
     betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
@@ -951,277 +572,111 @@ and betree_Node_apply_messages_back'a
   begin match self with
   | Betree_Node_Internal node ->
     let* (st1, content) = betree_load_internal_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_internal content msgs in
-    let* num_msgs = betree_List_len (u64 & betree_Message_t) content0 in
-    if num_msgs >= params.min_flush_size
-    then
-      let* (st2, content1) =
-        betree_Internal_flush node params node_id_cnt content0 st1 in
-      let* (st3, (node0, node_id_cnt0)) =
-        betree_Internal_flush_back'a node params node_id_cnt content0 st1 st2
-        in
-      let* _ = betree_store_internal_node node0.id content1 st3 in
-      Return (st0, (Betree_Node_Internal node0, node_id_cnt0))
-    else
-      let* _ = betree_store_internal_node node.id content0 st1 in
-      Return (st0, (Betree_Node_Internal node, node_id_cnt))
-  | Betree_Node_Leaf node ->
-    let* (st1, content) = betree_load_leaf_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_leaf content msgs in
-    let* len = betree_List_len (u64 & u64) content0 in
-    let* i = u64_mul 2 params.split_size in
-    if len >= i
-    then
-      let* (st2, new_node) =
-        betree_Leaf_split node content0 params node_id_cnt st1 in
-      let* (st3, _) = betree_store_leaf_node node.id Betree_List_Nil st2 in
-      let* _ = betree_Leaf_split_back0 node content0 params node_id_cnt st1 st3
-        in
-      let* (st4, node_id_cnt0) =
-        betree_Leaf_split_back2 node content0 params node_id_cnt st1 st0 in
-      Return (st4, (Betree_Node_Internal new_node, node_id_cnt0))
-    else
-      let* _ = betree_store_leaf_node node.id content0 st1 in
-      Return (st0, (Betree_Node_Leaf { node with size = len }, node_id_cnt))
-  end
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: backward function 1
-    Source: 'src/betree.rs', lines 588:4-593:5 *)
-and betree_Node_apply_messages_back1
-  (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t)
-  (msgs : betree_List_t (u64 & betree_Message_t)) (st : state) (st0 : state) :
-  Tot (result (state & unit))
-  (decreases (
-    betree_Node_apply_messages_decreases self params node_id_cnt msgs st))
-  =
-  begin match self with
-  | Betree_Node_Internal node ->
-    let* (st1, content) = betree_load_internal_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_internal content msgs in
-    let* num_msgs = betree_List_len (u64 & betree_Message_t) content0 in
+    let* l = betree_Node_apply_messages_to_internal content msgs in
+    let* num_msgs = betree_List_len (u64 & betree_Message_t) l in
     if num_msgs >= params.min_flush_size
     then
-      let* (st2, content1) =
-        betree_Internal_flush node params node_id_cnt content0 st1 in
-      let* (st3, (node0, _)) =
-        betree_Internal_flush_back'a node params node_id_cnt content0 st1 st2
-        in
-      let* _ = betree_store_internal_node node0.id content1 st3 in
-      betree_Internal_flush_back1 node params node_id_cnt content0 st1 st0
+      let* (st2, (content1, p)) =
+        betree_Internal_flush node params node_id_cnt l st1 in
+      let (node1, node_id_cnt1) = p in
+      let* (st3, _) = betree_store_internal_node node1.id content1 st2 in
+      Return (st3, (Betree_Node_Internal node1, node_id_cnt1))
     else
-      let* _ = betree_store_internal_node node.id content0 st1 in
-      Return (st0, ())
+      let* (st2, _) = betree_store_internal_node node.id l st1 in
+      Return (st2, (Betree_Node_Internal node, node_id_cnt))
   | Betree_Node_Leaf node ->
     let* (st1, content) = betree_load_leaf_node node.id st in
-    let* content0 = betree_Node_apply_messages_to_leaf content msgs in
-    let* len = betree_List_len (u64 & u64) content0 in
+    let* l = betree_Node_apply_messages_to_leaf content msgs in
+    let* len = betree_List_len (u64 & u64) l in
     let* i = u64_mul 2 params.split_size in
     if len >= i
     then
-      let* (st2, _) = betree_Leaf_split node content0 params node_id_cnt st1 in
+      let* (st2, (new_node, nic)) =
+        betree_Leaf_split node l params node_id_cnt st1 in
       let* (st3, _) = betree_store_leaf_node node.id Betree_List_Nil st2 in
-      let* _ = betree_Leaf_split_back0 node content0 params node_id_cnt st1 st3
-        in
-      betree_Leaf_split_back1 node content0 params node_id_cnt st1 st0
+      Return (st3, (Betree_Node_Internal new_node, nic))
     else
-      let* _ = betree_store_leaf_node node.id content0 st1 in Return (st0, ())
+      let* (st2, _) = betree_store_leaf_node node.id l st1 in
+      Return (st2, (Betree_Node_Leaf { node with size = len }, node_id_cnt))
   end
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: forward function
+(** [betree_main::betree::{betree_main::betree::Node#5}::apply]:
     Source: 'src/betree.rs', lines 576:4-582:5 *)
 let betree_Node_apply
   (self : betree_Node_t) (params : betree_Params_t)
   (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
   (new_msg : betree_Message_t) (st : state) :
-  result (state & unit)
-  =
-  let l = Betree_List_Nil in
-  let* (st0, _) =
-    betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
-      new_msg) l) st in
-  let* (st1, (_, _)) =
-    betree_Node_apply_messages_back'a self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st st0 in
-  betree_Node_apply_messages_back1 self params node_id_cnt (Betree_List_Cons
-    (key, new_msg) l) st st1
-
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 0
-    Source: 'src/betree.rs', lines 576:4-582:5 *)
-let betree_Node_apply_back'a
-  (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
-  (new_msg : betree_Message_t) (st : state) (st0 : state) :
   result (state & (betree_Node_t & betree_NodeIdCounter_t))
   =
   let l = Betree_List_Nil in
-  let* (st1, _) =
+  let* (st1, p) =
     betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
       new_msg) l) st in
-  let* (st2, (self0, node_id_cnt0)) =
-    betree_Node_apply_messages_back'a self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st st1 in
-  let* _ =
-    betree_Node_apply_messages_back1 self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st st2 in
-  Return (st0, (self0, node_id_cnt0))
+  let (self1, node_id_cnt1) = p in
+  Return (st1, (self1, node_id_cnt1))
 
-(** [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 1
-    Source: 'src/betree.rs', lines 576:4-582:5 *)
-let betree_Node_apply_back1
-  (self : betree_Node_t) (params : betree_Params_t)
-  (node_id_cnt : betree_NodeIdCounter_t) (key : u64)
-  (new_msg : betree_Message_t) (st : state) (st0 : state) :
-  result (state & unit)
-  =
-  let l = Betree_List_Nil in
-  let* (st1, _) =
-    betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
-      new_msg) l) st in
-  let* (st2, (_, _)) =
-    betree_Node_apply_messages_back'a self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st st1 in
-  let* _ =
-    betree_Node_apply_messages_back1 self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st st2 in
-  Return (st0, ())
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::new]:
     Source: 'src/betree.rs', lines 849:4-849:60 *)
 let betree_BeTree_new
   (min_flush_size : u64) (split_size : u64) (st : state) :
   result (state & betree_BeTree_t)
   =
   let* node_id_cnt = betree_NodeIdCounter_new in
-  let* id = betree_NodeIdCounter_fresh_id node_id_cnt in
-  let* (st0, _) = betree_store_leaf_node id Betree_List_Nil st in
-  let* node_id_cnt0 = betree_NodeIdCounter_fresh_id_back node_id_cnt in
-  Return (st0,
+  let* (id, nic) = betree_NodeIdCounter_fresh_id node_id_cnt in
+  let* (st1, _) = betree_store_leaf_node id Betree_List_Nil st in
+  Return (st1,
     {
       params = { min_flush_size = min_flush_size; split_size = split_size };
-      node_id_cnt = node_id_cnt0;
+      node_id_cnt = nic;
       root = (Betree_Node_Leaf { id = id; size = 0 })
     })
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]:
     Source: 'src/betree.rs', lines 868:4-868:47 *)
 let betree_BeTree_apply
   (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t) (st : state) :
-  result (state & unit)
-  =
-  let* (st0, _) =
-    betree_Node_apply self.root self.params self.node_id_cnt key msg st in
-  let* (st1, (_, _)) =
-    betree_Node_apply_back'a self.root self.params self.node_id_cnt key msg st
-      st0 in
-  betree_Node_apply_back1 self.root self.params self.node_id_cnt key msg st st1
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: backward function 0
-    Source: 'src/betree.rs', lines 868:4-868:47 *)
-let betree_BeTree_apply_back
-  (self : betree_BeTree_t) (key : u64) (msg : betree_Message_t) (st : state)
-  (st0 : state) :
   result (state & betree_BeTree_t)
   =
-  let* (st1, _) =
+  let* (st1, p) =
     betree_Node_apply self.root self.params self.node_id_cnt key msg st in
-  let* (st2, (n, nic)) =
-    betree_Node_apply_back'a self.root self.params self.node_id_cnt key msg st
-      st1 in
-  let* _ =
-    betree_Node_apply_back1 self.root self.params self.node_id_cnt key msg st
-      st2 in
-  Return (st0, { self with node_id_cnt = nic; root = n })
+  let (n, nic) = p in
+  Return (st1, { self with node_id_cnt = nic; root = n })
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]:
     Source: 'src/betree.rs', lines 874:4-874:52 *)
 let betree_BeTree_insert
   (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) :
-  result (state & unit)
-  =
-  let* (st0, _) = betree_BeTree_apply self key (Betree_Message_Insert value) st
-    in
-  let* (st1, _) =
-    betree_BeTree_apply_back self key (Betree_Message_Insert value) st st0 in
-  Return (st1, ())
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: backward function 0
-    Source: 'src/betree.rs', lines 874:4-874:52 *)
-let betree_BeTree_insert_back
-  (self : betree_BeTree_t) (key : u64) (value : u64) (st : state) (st0 : state)
-  :
   result (state & betree_BeTree_t)
   =
-  let* (st1, _) = betree_BeTree_apply self key (Betree_Message_Insert value) st
-    in
-  let* (_, self0) =
-    betree_BeTree_apply_back self key (Betree_Message_Insert value) st st1 in
-  Return (st0, self0)
+  betree_BeTree_apply self key (Betree_Message_Insert value) st
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]:
     Source: 'src/betree.rs', lines 880:4-880:38 *)
 let betree_BeTree_delete
-  (self : betree_BeTree_t) (key : u64) (st : state) : result (state & unit) =
-  let* (st0, _) = betree_BeTree_apply self key Betree_Message_Delete st in
-  let* (st1, _) =
-    betree_BeTree_apply_back self key Betree_Message_Delete st st0 in
-  Return (st1, ())
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: backward function 0
-    Source: 'src/betree.rs', lines 880:4-880:38 *)
-let betree_BeTree_delete_back
-  (self : betree_BeTree_t) (key : u64) (st : state) (st0 : state) :
+  (self : betree_BeTree_t) (key : u64) (st : state) :
   result (state & betree_BeTree_t)
   =
-  let* (st1, _) = betree_BeTree_apply self key Betree_Message_Delete st in
-  let* (_, self0) =
-    betree_BeTree_apply_back self key Betree_Message_Delete st st1 in
-  Return (st0, self0)
+  betree_BeTree_apply self key Betree_Message_Delete st
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]:
     Source: 'src/betree.rs', lines 886:4-886:59 *)
 let betree_BeTree_upsert
   (self : betree_BeTree_t) (key : u64) (upd : betree_UpsertFunState_t)
   (st : state) :
-  result (state & unit)
-  =
-  let* (st0, _) = betree_BeTree_apply self key (Betree_Message_Upsert upd) st
-    in
-  let* (st1, _) =
-    betree_BeTree_apply_back self key (Betree_Message_Upsert upd) st st0 in
-  Return (st1, ())
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: backward function 0
-    Source: 'src/betree.rs', lines 886:4-886:59 *)
-let betree_BeTree_upsert_back
-  (self : betree_BeTree_t) (key : u64) (upd : betree_UpsertFunState_t)
-  (st : state) (st0 : state) :
   result (state & betree_BeTree_t)
   =
-  let* (st1, _) = betree_BeTree_apply self key (Betree_Message_Upsert upd) st
-    in
-  let* (_, self0) =
-    betree_BeTree_apply_back self key (Betree_Message_Upsert upd) st st1 in
-  Return (st0, self0)
+  betree_BeTree_apply self key (Betree_Message_Upsert upd) st
 
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: forward function
+(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]:
     Source: 'src/betree.rs', lines 895:4-895:62 *)
 let betree_BeTree_lookup
   (self : betree_BeTree_t) (key : u64) (st : state) :
-  result (state & (option u64))
-  =
-  betree_Node_lookup self.root key st
-
-(** [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: backward function 0
-    Source: 'src/betree.rs', lines 895:4-895:62 *)
-let betree_BeTree_lookup_back
-  (self : betree_BeTree_t) (key : u64) (st : state) (st0 : state) :
-  result (state & betree_BeTree_t)
+  result (state & ((option u64) & betree_BeTree_t))
   =
-  let* (st1, n) = betree_Node_lookup_back self.root key st st0 in
-  Return (st1, { self with root = n })
+  let* (st1, (o, n)) = betree_Node_lookup self.root key st in
+  Return (st1, (o, { self with root = n }))
 
-(** [betree_main::main]: forward function
+(** [betree_main::main]:
     Source: 'src/betree_main.rs', lines 5:0-5:9 *)
 let main : result unit =
   Return ()
diff --git a/tests/fstar/betree_back_stateful/BetreeMain.FunsExternal.fsti b/tests/fstar/betree_back_stateful/BetreeMain.FunsExternal.fsti
index cd2f956f..de9b96fd 100644
--- a/tests/fstar/betree_back_stateful/BetreeMain.FunsExternal.fsti
+++ b/tests/fstar/betree_back_stateful/BetreeMain.FunsExternal.fsti
@@ -6,29 +6,29 @@ include BetreeMain.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree_utils::load_internal_node]: forward function
+(** [betree_main::betree_utils::load_internal_node]:
     Source: 'src/betree_utils.rs', lines 98:0-98:63 *)
 val betree_utils_load_internal_node
   : u64 -> state -> result (state & (betree_List_t (u64 & betree_Message_t)))
 
-(** [betree_main::betree_utils::store_internal_node]: forward function
+(** [betree_main::betree_utils::store_internal_node]:
     Source: 'src/betree_utils.rs', lines 115:0-115:71 *)
 val betree_utils_store_internal_node
   :
   u64 -> betree_List_t (u64 & betree_Message_t) -> state -> result (state &
     unit)
 
-(** [betree_main::betree_utils::load_leaf_node]: forward function
+(** [betree_main::betree_utils::load_leaf_node]:
     Source: 'src/betree_utils.rs', lines 132:0-132:55 *)
 val betree_utils_load_leaf_node
   : u64 -> state -> result (state & (betree_List_t (u64 & u64)))
 
-(** [betree_main::betree_utils::store_leaf_node]: forward function
+(** [betree_main::betree_utils::store_leaf_node]:
     Source: 'src/betree_utils.rs', lines 145:0-145:63 *)
 val betree_utils_store_leaf_node
   : u64 -> betree_List_t (u64 & u64) -> state -> result (state & unit)
 
-(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+(** [core::option::{core::option::Option<T>}::unwrap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
 val core_option_Option_unwrap
   (t : Type0) : option t -> state -> result (state & t)
diff --git a/tests/fstar/betree_back_stateful/Primitives.fst b/tests/fstar/betree_back_stateful/Primitives.fst
index a3ffbde4..fca80829 100644
--- a/tests/fstar/betree_back_stateful/Primitives.fst
+++ b/tests/fstar/betree_back_stateful/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -535,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -552,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -559,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
@@ -588,8 +603,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +625,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +636,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +658,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +684,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +703,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +718,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +738,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +754,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +762,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +781,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +796,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +809,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +827,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +842,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/fstar/hashmap/Hashmap.Funs.fst b/tests/fstar/hashmap/Hashmap.Funs.fst
index e6cd1411..9fc5d8a0 100644
--- a/tests/fstar/hashmap/Hashmap.Funs.fst
+++ b/tests/fstar/hashmap/Hashmap.Funs.fst
@@ -7,12 +7,12 @@ include Hashmap.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [hashmap::hash_key]: forward function
+(** [hashmap::hash_key]:
     Source: 'src/hashmap.rs', lines 27:0-27:32 *)
 let hash_key (k : usize) : result usize =
   Return k
 
-(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0:
     Source: 'src/hashmap.rs', lines 50:4-56:5 *)
 let rec hashMap_allocate_slots_loop
   (t : Type0) (slots : alloc_vec_Vec (list_t t)) (n : usize) :
@@ -21,12 +21,12 @@ let rec hashMap_allocate_slots_loop
   =
   if n > 0
   then
-    let* slots0 = alloc_vec_Vec_push (list_t t) slots List_Nil in
-    let* n0 = usize_sub n 1 in
-    hashMap_allocate_slots_loop t slots0 n0
+    let* v = alloc_vec_Vec_push (list_t t) slots List_Nil in
+    let* n1 = usize_sub n 1 in
+    hashMap_allocate_slots_loop t v n1
   else Return slots
 
-(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::allocate_slots]:
     Source: 'src/hashmap.rs', lines 50:4-50:76 *)
 let hashMap_allocate_slots
   (t : Type0) (slots : alloc_vec_Vec (list_t t)) (n : usize) :
@@ -34,7 +34,7 @@ let hashMap_allocate_slots
   =
   hashMap_allocate_slots_loop t slots n
 
-(** [hashmap::{hashmap::HashMap<T>}::new_with_capacity]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::new_with_capacity]:
     Source: 'src/hashmap.rs', lines 59:4-63:13 *)
 let hashMap_new_with_capacity
   (t : Type0) (capacity : usize) (max_load_dividend : usize)
@@ -44,97 +44,75 @@ let hashMap_new_with_capacity
   let v = alloc_vec_Vec_new (list_t t) in
   let* slots = hashMap_allocate_slots t v capacity in
   let* i = usize_mul capacity max_load_dividend in
-  let* i0 = usize_div i max_load_divisor in
+  let* i1 = usize_div i max_load_divisor in
   Return
     {
       num_entries = 0;
       max_load_factor = (max_load_dividend, max_load_divisor);
-      max_load = i0;
+      max_load = i1;
       slots = slots
     }
 
-(** [hashmap::{hashmap::HashMap<T>}::new]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::new]:
     Source: 'src/hashmap.rs', lines 75:4-75:24 *)
 let hashMap_new (t : Type0) : result (hashMap_t t) =
   hashMap_new_with_capacity t 32 4 5
 
-(** [hashmap::{hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::clear]: loop 0:
     Source: 'src/hashmap.rs', lines 80:4-88:5 *)
 let rec hashMap_clear_loop
   (t : Type0) (slots : alloc_vec_Vec (list_t t)) (i : usize) :
   Tot (result (alloc_vec_Vec (list_t t)))
   (decreases (hashMap_clear_loop_decreases t slots i))
   =
-  let i0 = alloc_vec_Vec_len (list_t t) slots in
-  if i < i0
+  let i1 = alloc_vec_Vec_len (list_t t) slots in
+  if i < i1
   then
-    let* i1 = usize_add i 1 in
-    let* slots0 =
-      alloc_vec_Vec_index_mut_back (list_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i
-        List_Nil in
-    hashMap_clear_loop t slots0 i1
+    let* (_, index_mut_back) =
+      alloc_vec_Vec_index_mut (list_t t) usize
+        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i in
+    let* i2 = usize_add i 1 in
+    let* slots1 = index_mut_back List_Nil in
+    hashMap_clear_loop t slots1 i2
   else Return slots
 
-(** [hashmap::{hashmap::HashMap<T>}::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::clear]:
     Source: 'src/hashmap.rs', lines 80:4-80:27 *)
 let hashMap_clear (t : Type0) (self : hashMap_t t) : result (hashMap_t t) =
-  let* v = hashMap_clear_loop t self.slots 0 in
-  Return { self with num_entries = 0; slots = v }
+  let* back = hashMap_clear_loop t self.slots 0 in
+  Return { self with num_entries = 0; slots = back }
 
-(** [hashmap::{hashmap::HashMap<T>}::len]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::len]:
     Source: 'src/hashmap.rs', lines 90:4-90:30 *)
 let hashMap_len (t : Type0) (self : hashMap_t t) : result usize =
   Return self.num_entries
 
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 97:4-114:5 *)
 let rec hashMap_insert_in_list_loop
   (t : Type0) (key : usize) (value : t) (ls : list_t t) :
-  Tot (result bool)
+  Tot (result (bool & (list_t t)))
   (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
   =
   begin match ls with
   | List_Cons ckey cvalue tl ->
     if ckey = key
-    then Return false
-    else hashMap_insert_in_list_loop t key value tl
-  | List_Nil -> Return true
+    then Return (false, List_Cons ckey value tl)
+    else
+      let* (b, back) = hashMap_insert_in_list_loop t key value tl in
+      Return (b, List_Cons ckey cvalue back)
+  | List_Nil -> let l = List_Nil in Return (true, List_Cons key value l)
   end
 
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]:
     Source: 'src/hashmap.rs', lines 97:4-97:71 *)
 let hashMap_insert_in_list
-  (t : Type0) (key : usize) (value : t) (ls : list_t t) : result bool =
-  hashMap_insert_in_list_loop t key value ls
-
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
-let rec hashMap_insert_in_list_loop_back
   (t : Type0) (key : usize) (value : t) (ls : list_t t) :
-  Tot (result (list_t t))
-  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
+  result (bool & (list_t t))
   =
-  begin match ls with
-  | List_Cons ckey cvalue tl ->
-    if ckey = key
-    then Return (List_Cons ckey value tl)
-    else
-      let* tl0 = hashMap_insert_in_list_loop_back t key value tl in
-      Return (List_Cons ckey cvalue tl0)
-  | List_Nil -> let l = List_Nil in Return (List_Cons key value l)
-  end
-
-(** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: backward function 0
-    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
-let hashMap_insert_in_list_back
-  (t : Type0) (key : usize) (value : t) (ls : list_t t) : result (list_t t) =
-  hashMap_insert_in_list_loop_back t key value ls
+  hashMap_insert_in_list_loop t key value ls
 
-(** [hashmap::{hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::insert_no_resize]:
     Source: 'src/hashmap.rs', lines 117:4-117:54 *)
 let hashMap_insert_no_resize
   (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
@@ -143,30 +121,19 @@ let hashMap_insert_no_resize
   let* hash = hash_key key in
   let i = alloc_vec_Vec_len (list_t t) self.slots in
   let* hash_mod = usize_rem hash i in
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (list_t t) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
       hash_mod in
-  let* inserted = hashMap_insert_in_list t key value l in
+  let* (inserted, l1) = hashMap_insert_in_list t key value l in
   if inserted
   then
-    let* i0 = usize_add self.num_entries 1 in
-    let* l0 = hashMap_insert_in_list_back t key value l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (list_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-        hash_mod l0 in
-    Return { self with num_entries = i0; slots = v }
-  else
-    let* l0 = hashMap_insert_in_list_back t key value l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (list_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-        hash_mod l0 in
-    Return { self with slots = v }
-
-(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+    let* i1 = usize_add self.num_entries 1 in
+    let* v = index_mut_back l1 in
+    Return { self with num_entries = i1; slots = v }
+  else let* v = index_mut_back l1 in Return { self with slots = v }
+
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 183:4-196:5 *)
 let rec hashMap_move_elements_from_list_loop
   (t : Type0) (ntable : hashMap_t t) (ls : list_t t) :
@@ -175,20 +142,18 @@ let rec hashMap_move_elements_from_list_loop
   =
   begin match ls with
   | List_Cons k v tl ->
-    let* ntable0 = hashMap_insert_no_resize t ntable k v in
-    hashMap_move_elements_from_list_loop t ntable0 tl
+    let* hm = hashMap_insert_no_resize t ntable k v in
+    hashMap_move_elements_from_list_loop t hm tl
   | List_Nil -> Return ntable
   end
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]:
     Source: 'src/hashmap.rs', lines 183:4-183:72 *)
 let hashMap_move_elements_from_list
   (t : Type0) (ntable : hashMap_t t) (ls : list_t t) : result (hashMap_t t) =
   hashMap_move_elements_from_list_loop t ntable ls
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0:
     Source: 'src/hashmap.rs', lines 171:4-180:5 *)
 let rec hashMap_move_elements_loop
   (t : Type0) (ntable : hashMap_t t) (slots : alloc_vec_Vec (list_t t))
@@ -196,64 +161,63 @@ let rec hashMap_move_elements_loop
   Tot (result ((hashMap_t t) & (alloc_vec_Vec (list_t t))))
   (decreases (hashMap_move_elements_loop_decreases t ntable slots i))
   =
-  let i0 = alloc_vec_Vec_len (list_t t) slots in
-  if i < i0
+  let i1 = alloc_vec_Vec_len (list_t t) slots in
+  if i < i1
   then
-    let* l =
+    let* (l, index_mut_back) =
       alloc_vec_Vec_index_mut (list_t t) usize
         (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i in
-    let ls = core_mem_replace (list_t t) l List_Nil in
-    let* ntable0 = hashMap_move_elements_from_list t ntable ls in
-    let* i1 = usize_add i 1 in
-    let l0 = core_mem_replace_back (list_t t) l List_Nil in
-    let* slots0 =
-      alloc_vec_Vec_index_mut_back (list_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) slots i l0 in
-    hashMap_move_elements_loop t ntable0 slots0 i1
+    let (ls, l1) = core_mem_replace (list_t t) l List_Nil in
+    let* hm = hashMap_move_elements_from_list t ntable ls in
+    let* i2 = usize_add i 1 in
+    let* slots1 = index_mut_back l1 in
+    let* back_'a = hashMap_move_elements_loop t hm slots1 i2 in
+    let (hm1, v) = back_'a in
+    Return (hm1, v)
   else Return (ntable, slots)
 
-(** [hashmap::{hashmap::HashMap<T>}::move_elements]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::move_elements]:
     Source: 'src/hashmap.rs', lines 171:4-171:95 *)
 let hashMap_move_elements
   (t : Type0) (ntable : hashMap_t t) (slots : alloc_vec_Vec (list_t t))
   (i : usize) :
   result ((hashMap_t t) & (alloc_vec_Vec (list_t t)))
   =
-  hashMap_move_elements_loop t ntable slots i
+  let* back_'a = hashMap_move_elements_loop t ntable slots i in
+  let (hm, v) = back_'a in
+  Return (hm, v)
 
-(** [hashmap::{hashmap::HashMap<T>}::try_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::try_resize]:
     Source: 'src/hashmap.rs', lines 140:4-140:28 *)
 let hashMap_try_resize
   (t : Type0) (self : hashMap_t t) : result (hashMap_t t) =
   let* max_usize = scalar_cast U32 Usize core_u32_max in
   let capacity = alloc_vec_Vec_len (list_t t) self.slots in
   let* n1 = usize_div max_usize 2 in
-  let (i, i0) = self.max_load_factor in
-  let* i1 = usize_div n1 i in
-  if capacity <= i1
+  let (i, i1) = self.max_load_factor in
+  let* i2 = usize_div n1 i in
+  if capacity <= i2
   then
-    let* i2 = usize_mul capacity 2 in
-    let* ntable = hashMap_new_with_capacity t i2 i i0 in
-    let* (ntable0, _) = hashMap_move_elements t ntable self.slots 0 in
+    let* i3 = usize_mul capacity 2 in
+    let* ntable = hashMap_new_with_capacity t i3 i i1 in
+    let* p = hashMap_move_elements t ntable self.slots 0 in
+    let (ntable1, _) = p in
     Return
-      { ntable0 with num_entries = self.num_entries; max_load_factor = (i, i0)
+      { ntable1 with num_entries = self.num_entries; max_load_factor = (i, i1)
       }
-  else Return { self with max_load_factor = (i, i0) }
+  else Return { self with max_load_factor = (i, i1) }
 
-(** [hashmap::{hashmap::HashMap<T>}::insert]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap::{hashmap::HashMap<T>}::insert]:
     Source: 'src/hashmap.rs', lines 129:4-129:48 *)
 let hashMap_insert
   (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
   result (hashMap_t t)
   =
-  let* self0 = hashMap_insert_no_resize t self key value in
-  let* i = hashMap_len t self0 in
-  if i > self0.max_load then hashMap_try_resize t self0 else Return self0
+  let* hm = hashMap_insert_no_resize t self key value in
+  let* i = hashMap_len t hm in
+  if i > hm.max_load then hashMap_try_resize t hm else Return hm
 
-(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 206:4-219:5 *)
 let rec hashMap_contains_key_in_list_loop
   (t : Type0) (key : usize) (ls : list_t t) :
@@ -261,20 +225,20 @@ let rec hashMap_contains_key_in_list_loop
   (decreases (hashMap_contains_key_in_list_loop_decreases t key ls))
   =
   begin match ls with
-  | List_Cons ckey x tl ->
+  | List_Cons ckey _ tl ->
     if ckey = key
     then Return true
     else hashMap_contains_key_in_list_loop t key tl
   | List_Nil -> Return false
   end
 
-(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]:
     Source: 'src/hashmap.rs', lines 206:4-206:68 *)
 let hashMap_contains_key_in_list
   (t : Type0) (key : usize) (ls : list_t t) : result bool =
   hashMap_contains_key_in_list_loop t key ls
 
-(** [hashmap::{hashmap::HashMap<T>}::contains_key]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::contains_key]:
     Source: 'src/hashmap.rs', lines 199:4-199:49 *)
 let hashMap_contains_key
   (t : Type0) (self : hashMap_t t) (key : usize) : result bool =
@@ -287,7 +251,7 @@ let hashMap_contains_key
       hash_mod in
   hashMap_contains_key_in_list t key l
 
-(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 224:4-237:5 *)
 let rec hashMap_get_in_list_loop
   (t : Type0) (key : usize) (ls : list_t t) :
@@ -299,12 +263,12 @@ let rec hashMap_get_in_list_loop
   | List_Nil -> Fail Failure
   end
 
-(** [hashmap::{hashmap::HashMap<T>}::get_in_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_in_list]:
     Source: 'src/hashmap.rs', lines 224:4-224:70 *)
 let hashMap_get_in_list (t : Type0) (key : usize) (ls : list_t t) : result t =
   hashMap_get_in_list_loop t key ls
 
-(** [hashmap::{hashmap::HashMap<T>}::get]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get]:
     Source: 'src/hashmap.rs', lines 239:4-239:55 *)
 let hashMap_get (t : Type0) (self : hashMap_t t) (key : usize) : result t =
   let* hash = hash_key key in
@@ -316,214 +280,147 @@ let hashMap_get (t : Type0) (self : hashMap_t t) (key : usize) : result t =
       hash_mod in
   hashMap_get_in_list t key l
 
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 245:4-254:5 *)
 let rec hashMap_get_mut_in_list_loop
   (t : Type0) (ls : list_t t) (key : usize) :
-  Tot (result t) (decreases (hashMap_get_mut_in_list_loop_decreases t ls key))
-  =
-  begin match ls with
-  | List_Cons ckey cvalue tl ->
-    if ckey = key then Return cvalue else hashMap_get_mut_in_list_loop t tl key
-  | List_Nil -> Fail Failure
-  end
-
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: forward function
-    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-let hashMap_get_mut_in_list
-  (t : Type0) (ls : list_t t) (key : usize) : result t =
-  hashMap_get_mut_in_list_loop t ls key
-
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
-let rec hashMap_get_mut_in_list_loop_back
-  (t : Type0) (ls : list_t t) (key : usize) (ret : t) :
-  Tot (result (list_t t))
+  Tot (result (t & (t -> result (list_t t))))
   (decreases (hashMap_get_mut_in_list_loop_decreases t ls key))
   =
   begin match ls with
   | List_Cons ckey cvalue tl ->
     if ckey = key
-    then Return (List_Cons ckey ret tl)
+    then
+      let back_'a = fun ret -> Return (List_Cons ckey ret tl) in
+      Return (cvalue, back_'a)
     else
-      let* tl0 = hashMap_get_mut_in_list_loop_back t tl key ret in
-      Return (List_Cons ckey cvalue tl0)
+      let* (x, back_'a) = hashMap_get_mut_in_list_loop t tl key in
+      let back_'a1 =
+        fun ret -> let* tl1 = back_'a ret in Return (List_Cons ckey cvalue tl1)
+        in
+      Return (x, back_'a1)
   | List_Nil -> Fail Failure
   end
 
-(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+(** [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]:
     Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-let hashMap_get_mut_in_list_back
-  (t : Type0) (ls : list_t t) (key : usize) (ret : t) : result (list_t t) =
-  hashMap_get_mut_in_list_loop_back t ls key ret
-
-(** [hashmap::{hashmap::HashMap<T>}::get_mut]: forward function
-    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
-let hashMap_get_mut (t : Type0) (self : hashMap_t t) (key : usize) : result t =
-  let* hash = hash_key key in
-  let i = alloc_vec_Vec_len (list_t t) self.slots in
-  let* hash_mod = usize_rem hash i in
-  let* l =
-    alloc_vec_Vec_index_mut (list_t t) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-      hash_mod in
-  hashMap_get_mut_in_list t l key
+let hashMap_get_mut_in_list
+  (t : Type0) (ls : list_t t) (key : usize) :
+  result (t & (t -> result (list_t t)))
+  =
+  let* (x, back_'a) = hashMap_get_mut_in_list_loop t ls key in
+  let back_'a1 = fun ret -> back_'a ret in
+  Return (x, back_'a1)
 
-(** [hashmap::{hashmap::HashMap<T>}::get_mut]: backward function 0
+(** [hashmap::{hashmap::HashMap<T>}::get_mut]:
     Source: 'src/hashmap.rs', lines 257:4-257:67 *)
-let hashMap_get_mut_back
-  (t : Type0) (self : hashMap_t t) (key : usize) (ret : t) :
-  result (hashMap_t t)
+let hashMap_get_mut
+  (t : Type0) (self : hashMap_t t) (key : usize) :
+  result (t & (t -> result (hashMap_t t)))
   =
   let* hash = hash_key key in
   let i = alloc_vec_Vec_len (list_t t) self.slots in
   let* hash_mod = usize_rem hash i in
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (list_t t) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
       hash_mod in
-  let* l0 = hashMap_get_mut_in_list_back t l key ret in
-  let* v =
-    alloc_vec_Vec_index_mut_back (list_t t) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-      hash_mod l0 in
-  Return { self with slots = v }
-
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
+  let* (x, get_mut_in_list_back) = hashMap_get_mut_in_list t l key in
+  let back_'a =
+    fun ret ->
+      let* l1 = get_mut_in_list_back ret in
+      let* v = index_mut_back l1 in
+      Return { self with slots = v } in
+  Return (x, back_'a)
+
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 265:4-291:5 *)
 let rec hashMap_remove_from_list_loop
   (t : Type0) (key : usize) (ls : list_t t) :
-  Tot (result (option t))
+  Tot (result ((option t) & (list_t t)))
   (decreases (hashMap_remove_from_list_loop_decreases t key ls))
   =
   begin match ls with
   | List_Cons ckey x tl ->
     if ckey = key
     then
-      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
+      let (mv_ls, _) =
+        core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
       begin match mv_ls with
-      | List_Cons i cvalue tl0 -> Return (Some cvalue)
+      | List_Cons _ cvalue tl1 -> Return (Some cvalue, tl1)
       | List_Nil -> Fail Failure
       end
-    else hashMap_remove_from_list_loop t key tl
-  | List_Nil -> Return None
+    else
+      let* (o, back) = hashMap_remove_from_list_loop t key tl in
+      Return (o, List_Cons ckey x back)
+  | List_Nil -> Return (None, List_Nil)
   end
 
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]:
     Source: 'src/hashmap.rs', lines 265:4-265:69 *)
 let hashMap_remove_from_list
-  (t : Type0) (key : usize) (ls : list_t t) : result (option t) =
-  hashMap_remove_from_list_loop t key ls
-
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
-let rec hashMap_remove_from_list_loop_back
   (t : Type0) (key : usize) (ls : list_t t) :
-  Tot (result (list_t t))
-  (decreases (hashMap_remove_from_list_loop_decreases t key ls))
+  result ((option t) & (list_t t))
   =
-  begin match ls with
-  | List_Cons ckey x tl ->
-    if ckey = key
-    then
-      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
-      begin match mv_ls with
-      | List_Cons i cvalue tl0 -> Return tl0
-      | List_Nil -> Fail Failure
-      end
-    else
-      let* tl0 = hashMap_remove_from_list_loop_back t key tl in
-      Return (List_Cons ckey x tl0)
-  | List_Nil -> Return List_Nil
-  end
-
-(** [hashmap::{hashmap::HashMap<T>}::remove_from_list]: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
-let hashMap_remove_from_list_back
-  (t : Type0) (key : usize) (ls : list_t t) : result (list_t t) =
-  hashMap_remove_from_list_loop_back t key ls
+  hashMap_remove_from_list_loop t key ls
 
-(** [hashmap::{hashmap::HashMap<T>}::remove]: forward function
+(** [hashmap::{hashmap::HashMap<T>}::remove]:
     Source: 'src/hashmap.rs', lines 294:4-294:52 *)
 let hashMap_remove
-  (t : Type0) (self : hashMap_t t) (key : usize) : result (option t) =
-  let* hash = hash_key key in
-  let i = alloc_vec_Vec_len (list_t t) self.slots in
-  let* hash_mod = usize_rem hash i in
-  let* l =
-    alloc_vec_Vec_index_mut (list_t t) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-      hash_mod in
-  let* x = hashMap_remove_from_list t key l in
-  begin match x with
-  | None -> Return None
-  | Some x0 -> let* _ = usize_sub self.num_entries 1 in Return (Some x0)
-  end
-
-(** [hashmap::{hashmap::HashMap<T>}::remove]: backward function 0
-    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
-let hashMap_remove_back
-  (t : Type0) (self : hashMap_t t) (key : usize) : result (hashMap_t t) =
+  (t : Type0) (self : hashMap_t t) (key : usize) :
+  result ((option t) & (hashMap_t t))
+  =
   let* hash = hash_key key in
   let i = alloc_vec_Vec_len (list_t t) self.slots in
   let* hash_mod = usize_rem hash i in
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (list_t t) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
       hash_mod in
-  let* x = hashMap_remove_from_list t key l in
+  let* (x, l1) = hashMap_remove_from_list t key l in
   begin match x with
   | None ->
-    let* l0 = hashMap_remove_from_list_back t key l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (list_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-        hash_mod l0 in
-    Return { self with slots = v }
-  | Some x0 ->
-    let* i0 = usize_sub self.num_entries 1 in
-    let* l0 = hashMap_remove_from_list_back t key l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (list_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (list_t t)) self.slots
-        hash_mod l0 in
-    Return { self with num_entries = i0; slots = v }
+    let* v = index_mut_back l1 in Return (None, { self with slots = v })
+  | Some x1 ->
+    let* i1 = usize_sub self.num_entries 1 in
+    let* v = index_mut_back l1 in
+    Return (Some x1, { self with num_entries = i1; slots = v })
   end
 
-(** [hashmap::test1]: forward function
+(** [hashmap::test1]:
     Source: 'src/hashmap.rs', lines 315:0-315:10 *)
 let test1 : result unit =
   let* hm = hashMap_new u64 in
-  let* hm0 = hashMap_insert u64 hm 0 42 in
-  let* hm1 = hashMap_insert u64 hm0 128 18 in
-  let* hm2 = hashMap_insert u64 hm1 1024 138 in
-  let* hm3 = hashMap_insert u64 hm2 1056 256 in
-  let* i = hashMap_get u64 hm3 128 in
+  let* hm1 = hashMap_insert u64 hm 0 42 in
+  let* hm2 = hashMap_insert u64 hm1 128 18 in
+  let* hm3 = hashMap_insert u64 hm2 1024 138 in
+  let* hm4 = hashMap_insert u64 hm3 1056 256 in
+  let* i = hashMap_get u64 hm4 128 in
   if not (i = 18)
   then Fail Failure
   else
-    let* hm4 = hashMap_get_mut_back u64 hm3 1024 56 in
-    let* i0 = hashMap_get u64 hm4 1024 in
-    if not (i0 = 56)
+    let* (_, get_mut_back) = hashMap_get_mut u64 hm4 1024 in
+    let* hm5 = get_mut_back 56 in
+    let* i1 = hashMap_get u64 hm5 1024 in
+    if not (i1 = 56)
     then Fail Failure
     else
-      let* x = hashMap_remove u64 hm4 1024 in
+      let* (x, hm6) = hashMap_remove u64 hm5 1024 in
       begin match x with
       | None -> Fail Failure
-      | Some x0 ->
-        if not (x0 = 56)
+      | Some x1 ->
+        if not (x1 = 56)
         then Fail Failure
         else
-          let* hm5 = hashMap_remove_back u64 hm4 1024 in
-          let* i1 = hashMap_get u64 hm5 0 in
-          if not (i1 = 42)
+          let* i2 = hashMap_get u64 hm6 0 in
+          if not (i2 = 42)
           then Fail Failure
           else
-            let* i2 = hashMap_get u64 hm5 128 in
-            if not (i2 = 18)
+            let* i3 = hashMap_get u64 hm6 128 in
+            if not (i3 = 18)
             then Fail Failure
             else
-              let* i3 = hashMap_get u64 hm5 1056 in
-              if not (i3 = 256) then Fail Failure else Return ()
+              let* i4 = hashMap_get u64 hm6 1056 in
+              if not (i4 = 256) then Fail Failure else Return ()
       end
 
diff --git a/tests/fstar/hashmap/Hashmap.Properties.fst b/tests/fstar/hashmap/Hashmap.Properties.fst
deleted file mode 100644
index def520f0..00000000
--- a/tests/fstar/hashmap/Hashmap.Properties.fst
+++ /dev/null
@@ -1,3186 +0,0 @@
-(** Properties about the hashmap *)
-module Hashmap.Properties
-open Primitives
-open FStar.List.Tot
-open FStar.Mul
-open Hashmap.Types
-open Hashmap.Clauses
-open Hashmap.Funs
-
-#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
-
-let _align_fsti = ()
-
-/// The proofs:
-/// ===========
-/// 
-/// The proof strategy is to do exactly as with Low* proofs (we initially tried to
-/// prove more properties in one go, but it was a mistake):
-/// - prove that, under some preconditions, the low-level functions translated
-///   from Rust refine some higher-level functions
-/// - do functional proofs about those high-level functions to prove interesting
-///   properties about the hash map operations, and invariant preservation
-/// - combine everything
-///
-/// The fact that we work in a pure setting allows us to be more modular than when
-/// working with effects. For instance we can do a case disjunction (see the proofs
-/// for insert, which study the cases where the key is already/not in the hash map
-/// in separate proofs - we had initially tried to do them in one step: it is doable
-/// but requires some work, and the F* response time quickly becomes annoying while
-/// making progress, so we split them). We can also easily prove a refinement lemma,
-/// study the model, *then* combine those to also prove that the low-level function
-/// preserves the invariants, rather than do everything at once as is usually the
-/// case when doing intrinsic proofs with effects (I remember that having to prove
-/// invariants in one go *and* a refinement step, even small, can be extremely
-/// difficult in Low*).
-
-
-(*** Utilities *)
-
-/// We need many small helpers and lemmas, mostly about lists (and the ones we list
-/// here are not in the standard F* library).
-
-val index_append_lem (#a : Type0) (ls0 ls1 : list a) (i : nat{i < length ls0 + length ls1}) :
-  Lemma (
-    (i < length ls0 ==> index (ls0 @ ls1) i == index ls0 i) /\
-    (i >= length ls0 ==> index (ls0 @ ls1) i == index ls1 (i - length ls0)))
-  [SMTPat (index (ls0 @ ls1) i)]
-
-#push-options "--fuel 1"
-let rec index_append_lem #a ls0 ls1 i =
-  match ls0 with
-  | [] -> ()
-  | x :: ls0' ->
-    if i = 0 then ()
-    else index_append_lem ls0' ls1 (i-1)
-#pop-options
-
-val index_map_lem (#a #b: Type0) (f : a -> Tot b) (ls : list a)
-  (i : nat{i < length ls}) :
-  Lemma (
-    index (map f ls) i == f (index ls i))
-  [SMTPat (index (map f ls) i)]
-
-#push-options "--fuel 1"
-let rec index_map_lem #a #b f ls i =
-  match ls with
-  | [] -> ()
-  | x :: ls' ->
-    if i = 0 then ()
-    else index_map_lem f ls' (i-1)
-#pop-options
-
-val for_all_append (#a : Type0) (f : a -> Tot bool) (ls0 ls1 : list a) :
-  Lemma (for_all f (ls0 @ ls1) = (for_all f ls0 && for_all f ls1))
-
-#push-options "--fuel 1"
-let rec for_all_append #a f ls0 ls1 =
-  match ls0 with
-  | [] -> ()
-  | x :: ls0' ->
-    for_all_append f ls0' ls1
-#pop-options
-
-/// Filter a list, stopping after we removed one element
-val filter_one (#a : Type) (f : a -> bool) (ls : list a) : list a
-
-let rec filter_one #a f ls =
-  match ls with
-  | [] -> []
-  | x :: ls' -> if f x then x :: filter_one f ls' else ls'
-
-val find_append (#a : Type) (f : a -> bool) (ls0 ls1 : list a) :
-  Lemma (
-    find f (ls0 @ ls1) ==
-    begin match find f ls0 with
-    | Some x -> Some x
-    | None -> find f ls1
-    end)
-
-#push-options "--fuel 1"
-let rec find_append #a f ls0 ls1 =
-  match ls0 with
-  | [] -> ()
-  | x :: ls0' ->
-    if f x then
-    begin
-      assert(ls0 @ ls1 == x :: (ls0' @ ls1));
-      assert(find f (ls0 @ ls1) == find f (x :: (ls0' @ ls1)));
-      // Why do I have to do this?! Is it because of subtyping??
-      assert(
-        match find f (ls0 @ ls1) with
-        | Some x' -> x' == x
-        | None -> False)
-    end
-    else find_append f ls0' ls1
-#pop-options
-
-val length_flatten_update :
-     #a:Type
-  -> ls:list (list a)
-  -> i:nat{i < length ls}
-  -> x:list a ->
-  Lemma (
-    // We want this property:
-    // ```
-    // length (flatten (list_update ls i x)) =
-    //   length (flatten ls) - length (index ls i) + length x
-    // ```
-    length (flatten (list_update ls i x)) + length (index ls i) =
-    length (flatten ls) + length x)
-
-#push-options "--fuel 1"
-let rec length_flatten_update #a ls i x =
-  match ls with
-  | x' :: ls' ->
-    assert(flatten ls == x' @ flatten ls'); // Triggers patterns
-    assert(length (flatten ls) == length x' + length (flatten ls'));
-    if i = 0 then
-      begin
-      let ls1 = x :: ls' in
-      assert(list_update ls i x == ls1);
-      assert(flatten ls1 == x @ flatten ls'); // Triggers patterns
-      assert(length (flatten ls1) == length x + length (flatten ls'));
-      ()
-      end
-    else
-      begin
-      length_flatten_update ls' (i-1) x;
-      let ls1 = x' :: list_update ls' (i-1) x in
-      assert(flatten ls1 == x' @ flatten (list_update ls' (i-1) x)) // Triggers patterns
-      end
-#pop-options
-
-val length_flatten_index :
-     #a:Type
-  -> ls:list (list a)
-  -> i:nat{i < length ls} ->
-  Lemma (
-    length (flatten ls) >= length (index ls i))
-
-#push-options "--fuel 1"
-let rec length_flatten_index #a ls i =
-  match ls with
-  | x' :: ls' ->
-    assert(flatten ls == x' @ flatten ls'); // Triggers patterns
-    assert(length (flatten ls) == length x' + length (flatten ls'));
-    if i = 0 then ()
-    else length_flatten_index ls' (i-1)
-#pop-options
-
-val forall_index_equiv_list_for_all
-  (#a : Type) (pred : a -> Tot bool) (ls : list a) :
-  Lemma ((forall (i:nat{i < length ls}). pred (index ls i)) <==> for_all pred ls)
-
-#push-options "--fuel 1"
-let rec forall_index_equiv_list_for_all pred ls =
-  match ls with
-  | [] -> ()
-  | x :: ls' ->
-    assert(forall (i:nat{i < length ls'}). index ls' i == index ls (i+1));
-    assert(forall (i:nat{0 < i /\ i < length ls}). index ls i == index ls' (i-1));
-    assert(index ls 0 == x);
-    forall_index_equiv_list_for_all pred ls'
-#pop-options
-
-val find_update:
-     #a:Type
-  -> f:(a -> Tot bool)
-  -> ls:list a
-  -> x:a
-  -> ls':list a{length ls' == length ls}
-#push-options "--fuel 1"
-let rec find_update #a f ls x =
-  match ls with
-  | [] -> []
-  | hd::tl ->
-    if f hd then x :: tl else hd :: find_update f tl x
-#pop-options
-
-val pairwise_distinct : #a:eqtype -> ls:list a -> Tot bool
-let rec pairwise_distinct (#a : eqtype) (ls : list a) : Tot bool =
-  match ls with
-  | [] -> true
-  | x :: ls' -> List.Tot.for_all (fun y -> x <> y) ls' && pairwise_distinct ls'
-
-val pairwise_rel : #a:Type -> pred:(a -> a -> Tot bool) -> ls:list a -> Tot bool
-let rec pairwise_rel #a pred ls =
-  match ls with
-  | [] -> true
-  | x :: ls' ->
-    for_all (pred x) ls' && pairwise_rel pred ls' 
-
-#push-options "--fuel 1"
-let rec flatten_append (#a : Type) (l1 l2: list (list a)) :
-  Lemma (flatten (l1 @ l2) == flatten l1 @ flatten l2) =
-  match l1 with
-  | [] -> ()
-  | x :: l1' ->
-    flatten_append l1' l2;
-    append_assoc x (flatten l1') (flatten l2)
-#pop-options
-
-/// We don't use anonymous functions as parameters to other functions, but rather
-/// introduce auxiliary functions instead: otherwise we can't reason (because
-/// F*'s encoding to the SMT is imprecise for functions)
-let fst_is_disctinct (#a : eqtype) (#b : Type0) (p0 : a & b) (p1 : a & b) : Type0 =
-  fst p0 <> fst p1
-
-(*** Lemmas about Primitives *)
-/// TODO: move those lemmas
-
-// TODO: rename to 'insert'?
-val list_update_index_dif_lem
-  (#a : Type0) (ls : list a) (i : nat{i < length ls}) (x : a)
-  (j : nat{j < length ls}) :
-  Lemma (requires (j <> i))
-  (ensures (index (list_update ls i x) j == index ls j))
-  [SMTPat (index (list_update ls i x) j)]
-
-#push-options "--fuel 1"
-let rec list_update_index_dif_lem #a ls i x j =
-  match ls with
-  | x' :: ls ->
-    if i = 0 then ()
-    else if j = 0 then ()
-    else
-     list_update_index_dif_lem ls (i-1) x (j-1)
-#pop-options
-
-val map_list_update_lem
-  (#a #b: Type0) (f : a -> Tot b)
-  (ls : list a) (i : nat{i < length ls}) (x : a) :
-  Lemma (list_update (map f ls) i (f x) == map f (list_update ls i x))
-  [SMTPat (list_update (map f ls) i (f x))]
-
-#push-options "--fuel 1"
-let rec map_list_update_lem #a #b f ls i x =
-  match ls with
-  | x' :: ls' ->
-    if i = 0 then ()
-    else map_list_update_lem f ls' (i-1) x
-#pop-options
-
-(*** Invariants, models *)
-
-(**** Internals *)
-/// The following invariants, models, representation functions... are mostly
-/// for the purpose of the proofs.
-
-let is_pos_usize (n : nat) : Type0 = 0 < n /\ n <= usize_max
-type pos_usize = x:usize{x > 0}
-
-type binding (t : Type0) = key & t
-
-type slots_t (t : Type0) = alloc_vec_Vec (list_t t)
-
-/// We represent hash maps as associative lists
-type assoc_list (t : Type0) = list (binding t)
-
-/// Representation function for [list_t]
-let rec list_t_v (#t : Type0) (ls : list_t t) : assoc_list t =
-  match ls with
-  | List_Nil -> []
-  | List_Cons k v tl -> (k,v) :: list_t_v tl
-
-let list_t_len (#t : Type0) (ls : list_t t) : nat = length (list_t_v ls)
-let list_t_index (#t : Type0) (ls : list_t t) (i : nat{i < list_t_len ls}) : binding t =
-  index (list_t_v ls) i
-
-type slot_s (t : Type0) = list (binding t)
-type slots_s (t : Type0) = list (slot_s t)
-
-type slot_t (t : Type0) = list_t t
-let slot_t_v #t = list_t_v #t
-
-/// Representation function for the slots.
-let slots_t_v (#t : Type0) (slots : slots_t t) : slots_s t =
-  map slot_t_v slots
-
-/// Representation function for the slots, seen as an associative list.
-let slots_t_al_v (#t : Type0) (slots : slots_t t) : assoc_list t =
-  flatten (map list_t_v slots)
-
-/// High-level type for the hash-map, seen as a list of associative lists (one
-/// list per slot). This is the representation we use most, internally. Note that
-/// we later introduce a [map_s] representation, which is the one used in the
-/// lemmas shown to the user.
-type hashMap_s t = list (slot_s t)
-
-// TODO: why not always have the condition on the length?
-// 'nes': "non-empty slots"
-type hashMap_s_nes (t : Type0) : Type0 =
-  hm:hashMap_s t{is_pos_usize (length hm)}
-
-/// Representation function for [hashMap_t] as a list of slots
-let hashMap_t_v (#t : Type0) (hm : hashMap_t t) : hashMap_s t =
-  map list_t_v hm.slots
-
-/// Representation function for [hashMap_t] as an associative list
-let hashMap_t_al_v (#t : Type0) (hm : hashMap_t t) : assoc_list t =
-  flatten (hashMap_t_v hm)
-
-// 'nes': "non-empty slots"
-type hashMap_t_nes (t : Type0) : Type0 =
-  hm:hashMap_t t{is_pos_usize (length hm.slots)}
-
-let hash_key_s (k : key) : hash =
-  Return?.v (hash_key k)
-
-let hash_mod_key (k : key) (len : usize{len > 0}) : hash =
-  (hash_key_s k) % len
-
-let not_same_key (#t : Type0) (k : key) (b : binding t) : bool = fst b <> k
-let same_key (#t : Type0) (k : key) (b : binding t) : bool = fst b = k
-
-// We take a [nat] instead of a [hash] on purpose
-let same_hash_mod_key (#t : Type0) (len : usize{len > 0}) (h : nat) (b : binding t) : bool =
-  hash_mod_key (fst b) len = h
-
-let binding_neq (#t : Type0) (b0 b1 : binding t) : bool = fst b0 <> fst b1
-
-let hashMap_t_len_s (#t : Type0) (hm : hashMap_t t) : nat =
-  hm.num_entries
-
-let assoc_list_find (#t : Type0) (k : key) (slot : assoc_list t) : option t =
-  match find (same_key k) slot with
-  | None -> None
-  | Some (_, v) -> Some v
-
-let slot_s_find (#t : Type0) (k : key) (slot : list (binding t)) : option t =
-  assoc_list_find k slot
-
-let slot_t_find_s (#t : Type0) (k : key) (slot : list_t t) : option t =
-  slot_s_find k (slot_t_v slot)
-
-// This is a simpler version of the "find" function, which captures the essence
-// of what happens and operates on [hashMap_s].
-let hashMap_s_find
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (k : key) : option t =
-  let i = hash_mod_key k (length hm) in
-  let slot = index hm i in
-  slot_s_find k slot
-
-let hashMap_s_len
-  (#t : Type0) (hm : hashMap_s t) :
-  nat =
-  length (flatten hm)
-
-// Same as above, but operates on [hashMap_t]
-// Note that we don't reuse the above function on purpose: converting to a
-// [hashMap_s] then looking up an element is not the same as what we
-// wrote below.
-let hashMap_t_find_s
-  (#t : Type0) (hm : hashMap_t t{length hm.slots > 0}) (k : key) : option t =
-  let slots = hm.slots in
-  let i = hash_mod_key k (length slots) in
-  let slot = index slots i in
-  slot_t_find_s k slot
-
-/// Invariants for the slots
-
-let slot_s_inv
-  (#t : Type0) (len : usize{len > 0}) (i : usize) (slot : list (binding t)) : bool =
-  // All the bindings are in the proper slot
-  for_all (same_hash_mod_key len i) slot &&
-  // All the keys are pairwise distinct
-  pairwise_rel binding_neq slot
-
-let slot_t_inv (#t : Type0) (len : usize{len > 0}) (i : usize) (slot : list_t t) : bool =
-  slot_s_inv len i (slot_t_v slot)
-
-let slots_s_inv (#t : Type0) (slots : slots_s t{length slots <= usize_max}) : Type0 =
-  forall(i:nat{i < length slots}).
-  {:pattern index slots i}
-  slot_s_inv (length slots) i (index slots i)
-
-// At some point we tried to rewrite this in terms of [slots_s_inv]. However it
-// made a lot of proofs fail because those proofs relied on the [index_map_lem]
-// pattern. We tried writing others lemmas with patterns (like [slots_s_inv]
-// implies [slots_t_inv]) but it didn't succeed, so we keep things as they are.
-let slots_t_inv (#t : Type0) (slots : slots_t t{length slots <= usize_max}) : Type0 =
-  forall(i:nat{i < length slots}).
-  {:pattern index slots i}
-  slot_t_inv (length slots) i (index slots i)
-
-let hashMap_s_inv (#t : Type0) (hm : hashMap_s t) : Type0 =
-  length hm <= usize_max /\
-  length hm > 0 /\
-  slots_s_inv hm
-
-/// Base invariant for the hashmap (the complete invariant can be temporarily
-/// broken between the moment we inserted an element and the moment we resize)
-let hashMap_t_base_inv (#t : Type0) (hm : hashMap_t t) : Type0 =
-  let al = hashMap_t_al_v hm in
-  // [num_entries] correctly tracks the number of entries in the table
-  // Note that it gives us that the length of the slots array is <= usize_max:
-  // [> length <= usize_max
-  // (because hashMap_num_entries has type `usize`)
-  hm.num_entries = length al /\
-  // Slots invariant
-  slots_t_inv hm.slots /\
-  // The capacity must be > 0 (otherwise we can't resize, because we
-  // multiply the capacity by two!)
-  length hm.slots > 0 /\
-  // Load computation
-  begin
-  let capacity = length hm.slots in
-  let (dividend, divisor) = hm.max_load_factor in
-  0 < dividend /\ dividend < divisor /\
-  capacity * dividend >= divisor /\
-  hm.max_load = (capacity * dividend) / divisor
-  end
-
-/// We often need to frame some values
-let hashMap_t_same_params (#t : Type0) (hm0 hm1 : hashMap_t t) : Type0 =
-  length hm0.slots = length hm1.slots /\
-  hm0.max_load = hm1.max_load /\
-  hm0.max_load_factor = hm1.max_load_factor
-
-/// The following invariants, etc. are meant to be revealed to the user through
-/// the .fsti.
-
-/// Invariant for the hashmap
-let hashMap_t_inv (#t : Type0) (hm : hashMap_t t) : Type0 =
-  // Base invariant
-  hashMap_t_base_inv hm /\
-  // The hash map is either: not overloaded, or we can't resize it
-  begin
-  let (dividend, divisor) = hm.max_load_factor in
-  hm.num_entries <= hm.max_load
-  || length hm.slots * 2 * dividend > usize_max
-  end
-
-(*** .fsti *)
-/// We reveal slightly different version of the above functions to the user
-
-let len_s (#t : Type0) (hm : hashMap_t t) : nat = hashMap_t_len_s hm
-
-/// This version doesn't take any precondition (contrary to [hashMap_t_find_s])
-let find_s (#t : Type0) (hm : hashMap_t t) (k : key) : option t =
-  if length hm.slots = 0 then None
-  else hashMap_t_find_s hm k
-
-(*** Overloading *)
-
-let hashMap_not_overloaded_lem #t hm = ()
-
-(*** allocate_slots *)
-
-/// Auxiliary lemma
-val slots_t_all_nil_inv_lem
-  (#t : Type0) (slots : alloc_vec_Vec (list_t t){length slots <= usize_max}) :
-  Lemma (requires (forall (i:nat{i < length slots}). index slots i == List_Nil))
-  (ensures (slots_t_inv slots))
-
-#push-options "--fuel 1"
-let slots_t_all_nil_inv_lem #t slots = ()
-#pop-options
-
-val slots_t_al_v_all_nil_is_empty_lem
-  (#t : Type0) (slots : alloc_vec_Vec (list_t t)) :
-  Lemma (requires (forall (i:nat{i < length slots}). index slots i == List_Nil))
-  (ensures (slots_t_al_v slots == []))
-
-#push-options "--fuel 1"
-let rec slots_t_al_v_all_nil_is_empty_lem #t slots =
- match slots with
- | [] -> ()
- | s :: slots' ->
-   assert(forall (i:nat{i < length slots'}). index slots' i == index slots (i+1));
-   slots_t_al_v_all_nil_is_empty_lem #t slots';
-   assert(slots_t_al_v slots == list_t_v s @ slots_t_al_v slots');
-   assert(slots_t_al_v slots == list_t_v s);
-   assert(index slots 0 == List_Nil)
-#pop-options
-
-/// [allocate_slots]
-val hashMap_allocate_slots_lem
-  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (n : usize) :
-  Lemma
-  (requires (length slots + n <= usize_max))
-  (ensures (
-   match hashMap_allocate_slots t slots n with
-   | Fail _ -> False
-   | Return slots' ->
-     length slots' = length slots + n /\
-     // We leave the already allocated slots unchanged
-     (forall (i:nat{i < length slots}). index slots' i == index slots i) /\
-     // We allocate n additional empty slots
-     (forall (i:nat{length slots <= i /\ i < length slots'}). index slots' i == List_Nil)))
-  (decreases (hashMap_allocate_slots_loop_decreases t slots n))
-
-#push-options "--fuel 1"
-let rec hashMap_allocate_slots_lem t slots n =
-  begin match n with
-  | 0 -> ()
-  | _ ->
-    begin match alloc_vec_Vec_push (list_t t) slots List_Nil with
-    | Fail _ -> ()
-    | Return slots1 ->
-      begin match usize_sub n 1 with
-      | Fail _ -> ()
-      | Return i ->
-        hashMap_allocate_slots_lem t slots1 i;
-        begin match hashMap_allocate_slots t slots1 i with
-        | Fail _ -> ()
-        | Return slots2 ->
-          assert(length slots1 = length slots + 1);
-          assert(slots1 == slots @ [List_Nil]); // Triggers patterns
-          assert(index slots1 (length slots) == index [List_Nil] 0); // Triggers patterns
-          assert(index slots1 (length slots) == List_Nil)
-        end
-      end
-    end
-  end
-#pop-options
-
-(*** new_with_capacity *)
-/// Under proper conditions, [new_with_capacity] doesn't fail and returns an empty hash map.
-val hashMap_new_with_capacity_lem
-  (t : Type0) (capacity : usize)
-  (max_load_dividend : usize) (max_load_divisor : usize) :
-  Lemma
-  (requires (
-    0 < max_load_dividend /\
-    max_load_dividend < max_load_divisor /\
-    0 < capacity /\
-    capacity * max_load_dividend >= max_load_divisor /\
-    capacity * max_load_dividend <= usize_max))
-  (ensures (
-    match hashMap_new_with_capacity t capacity max_load_dividend max_load_divisor with
-    | Fail _ -> False
-    | Return hm ->
-      // The hash map invariant is satisfied
-      hashMap_t_inv hm /\
-      // The parameters are correct
-      hm.max_load_factor = (max_load_dividend, max_load_divisor) /\
-      hm.max_load = (capacity * max_load_dividend) / max_load_divisor /\
-      // The hash map has the specified capacity - we need to reveal this
-      // otherwise the pre of [hashMap_t_find_s] is not satisfied.
-      length hm.slots = capacity /\
-      // The hash map has 0 values
-      hashMap_t_len_s hm = 0 /\
-      // It contains no bindings
-      (forall k. hashMap_t_find_s hm k == None) /\
-      // We need this low-level property for the invariant
-      (forall(i:nat{i < length hm.slots}). index hm.slots i == List_Nil)))
-
-#push-options "--z3rlimit 50 --fuel 1"
-let hashMap_new_with_capacity_lem (t : Type0) (capacity : usize)
-  (max_load_dividend : usize) (max_load_divisor : usize) =
-  let v = alloc_vec_Vec_new (list_t t) in
-  assert(length v = 0);
-  hashMap_allocate_slots_lem t v capacity;
-  begin match hashMap_allocate_slots t v capacity with
-  | Fail _ -> assert(False)
-  | Return v0 ->
-    begin match usize_mul capacity max_load_dividend with
-    | Fail _ -> assert(False)
-    | Return i ->
-      begin match usize_div i max_load_divisor with
-      | Fail _ -> assert(False)
-      | Return i0 ->
-          let hm = MkhashMap_t 0 (max_load_dividend, max_load_divisor) i0 v0 in
-          slots_t_all_nil_inv_lem v0;
-          slots_t_al_v_all_nil_is_empty_lem hm.slots
-      end
-    end
-  end
-#pop-options
-
-(*** new *)
-
-/// [new] doesn't fail and returns an empty hash map
-val hashMap_new_lem_aux (t : Type0) :
-  Lemma
-  (ensures (
-    match hashMap_new t with
-    | Fail _ -> False
-    | Return hm ->
-      // The hash map invariant is satisfied
-      hashMap_t_inv hm /\
-      // The hash map has 0 values
-      hashMap_t_len_s hm = 0 /\
-      // It contains no bindings
-      (forall k. hashMap_t_find_s hm k == None)))
-
-#push-options "--fuel 1"
-let hashMap_new_lem_aux t =
-  hashMap_new_with_capacity_lem t 32 4 5;
-  match hashMap_new_with_capacity t 32 4 5 with
-  | Fail _ -> ()
-  | Return hm -> ()
-#pop-options
-
-/// The lemma we reveal in the .fsti
-let hashMap_new_lem t = hashMap_new_lem_aux t
-
-(*** clear *)
-/// [clear]: the loop doesn't fail and simply clears the slots starting at index i
-#push-options "--fuel 1"
-let rec hashMap_clear_loop_lem
-  (t : Type0) (slots : alloc_vec_Vec (list_t t)) (i : usize) :
-  Lemma
-  (ensures (
-    match hashMap_clear_loop t slots i with
-    | Fail _ -> False
-    | Return slots' ->
-      // The length is preserved
-      length slots' == length slots /\
-      // The slots before i are left unchanged
-      (forall (j:nat{j < i /\ j < length slots}). index slots' j == index slots j) /\
-      // The slots after i are set to List_Nil
-      (forall (j:nat{i <= j /\ j < length slots}). index slots' j == List_Nil)))
-  (decreases (hashMap_clear_loop_decreases t slots i))
-  =
-  let i0 = alloc_vec_Vec_len (list_t t) slots in
-  let b = i < i0 in
-  if b
-  then
-    begin match alloc_vec_Vec_update_usize slots i List_Nil with
-    | Fail _ -> ()
-    | Return v ->
-      begin match usize_add i 1 with
-      | Fail _ -> ()
-      | Return i1 ->
-        hashMap_clear_loop_lem t v i1;
-        begin match hashMap_clear_loop t v i1 with
-        | Fail _ -> ()
-        | Return slots1 ->
-          assert(length slots1 == length slots);
-          assert(forall (j:nat{i+1 <= j /\ j < length slots}). index slots1 j == List_Nil);
-          assert(index slots1 i == List_Nil)
-        end
-      end
-    end
-  else ()
-#pop-options
-
-/// [clear] doesn't fail and turns the hash map into an empty map
-val hashMap_clear_lem_aux
-  (#t : Type0) (self : hashMap_t t) :
-  Lemma
-  (requires (hashMap_t_base_inv self))
-  (ensures (
-    match hashMap_clear t self with
-    | Fail _ -> False
-    | Return hm ->
-      // The hash map invariant is satisfied
-      hashMap_t_base_inv hm /\
-      // We preserved the parameters
-      hashMap_t_same_params hm self /\
-      // The hash map has 0 values
-      hashMap_t_len_s hm = 0 /\
-      // It contains no bindings
-      (forall k. hashMap_t_find_s hm k == None)))
-
-// Being lazy: fuel 1 helps a lot...
-#push-options "--fuel 1"
-let hashMap_clear_lem_aux #t self =
-  let p = self.max_load_factor in
-  let i = self.max_load in
-  let v = self.slots in
-  hashMap_clear_loop_lem t v 0;
-  begin match hashMap_clear_loop t v 0 with
-  | Fail _ -> ()
-  | Return slots1 ->
-    slots_t_al_v_all_nil_is_empty_lem slots1;
-    let hm1 = MkhashMap_t 0 p i slots1 in
-    assert(hashMap_t_base_inv hm1);
-    assert(hashMap_t_inv hm1)
-  end
-#pop-options
-
-let hashMap_clear_lem #t self = hashMap_clear_lem_aux #t self
-
-(*** len *)
-
-/// [len]: we link it to a non-failing function.
-/// Rk.: we might want to make an analysis to not use an error monad to translate
-/// functions which statically can't fail.
-let hashMap_len_lem #t self = ()
-
-
-(*** insert_in_list *)
-
-(**** insert_in_list'fwd *)
-
-/// [insert_in_list]: returns true iff the key is not in the list (functional version)
-val hashMap_insert_in_list_lem
-  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (ensures (
-    match hashMap_insert_in_list t key value ls with
-    | Fail _ -> False
-    | Return b ->
-      b <==> (slot_t_find_s key ls == None)))
-  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
-
-#push-options "--fuel 1"
-let rec hashMap_insert_in_list_lem t key value ls =
-  begin match ls with
-  | List_Cons ckey cvalue ls0 ->
-    let b = ckey = key in
-    if b
-    then ()
-    else
-      begin
-      hashMap_insert_in_list_lem t key value ls0;
-      match hashMap_insert_in_list t key value ls0 with
-      | Fail _ -> ()
-      | Return b0 -> ()
-      end
-  | List_Nil ->
-    assert(list_t_v ls == []);
-    assert_norm(find (same_key #t key) [] == None)
-  end
-#pop-options
-
-(**** insert_in_list'back *)
-
-/// The proofs about [insert_in_list] backward are easier to do in several steps:
-/// extrinsic proofs to the rescue!
-/// We first prove that [insert_in_list] refines the function we wrote above, then
-/// use this function to prove the invariants, etc.
-
-/// We write a helper which "captures" what [insert_in_list] does.
-/// We then reason about this helper to prove the high-level properties we want
-/// (functional properties, preservation of invariants, etc.).
-let hashMap_insert_in_list_s
-  (#t : Type0) (key : usize) (value : t) (ls : list (binding t)) :
-  list (binding t) =
-  // Check if there is already a binding for the key
-  match find (same_key key) ls with
-  | None ->
-    // No binding: append the binding to the end
-    ls @ [(key,value)]
-  | Some _ ->
-    // There is already a binding: update it
-    find_update (same_key key) ls (key,value)
-
-/// [insert_in_list]: if the key is not in the map, appends a new bindings (functional version)
-val hashMap_insert_in_list_back_lem_append_s
-  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (requires (
-    slot_t_find_s key ls == None))
-  (ensures (
-    match hashMap_insert_in_list_back t key value ls with
-    | Fail _ -> False
-    | Return ls' ->
-      list_t_v ls' == list_t_v ls @ [(key,value)]))
-  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
-
-#push-options "--fuel 1"
-let rec hashMap_insert_in_list_back_lem_append_s t key value ls =
-  begin match ls with
-  | List_Cons ckey cvalue ls0 ->
-    let b = ckey = key in
-    if b
-    then ()
-    else
-      begin
-      hashMap_insert_in_list_back_lem_append_s t key value ls0;
-      match hashMap_insert_in_list_back t key value ls0 with
-      | Fail _ -> ()
-      | Return l -> ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-/// [insert_in_list]: if the key is in the map, we update the binding (functional version)
-val hashMap_insert_in_list_back_lem_update_s
-  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (requires (
-    Some? (find (same_key key) (list_t_v ls))))
-  (ensures (
-    match hashMap_insert_in_list_back t key value ls with
-    | Fail _ -> False
-    | Return ls' ->
-      list_t_v ls' == find_update (same_key key) (list_t_v ls) (key,value)))
-  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
-
-#push-options "--fuel 1"
-let rec hashMap_insert_in_list_back_lem_update_s t key value ls =
-  begin match ls with
-  | List_Cons ckey cvalue ls0 ->
-    let b = ckey = key in
-    if b
-    then ()
-    else
-      begin
-      hashMap_insert_in_list_back_lem_update_s t key value ls0;
-      match hashMap_insert_in_list_back t key value ls0 with
-      | Fail _ -> ()
-      | Return l -> ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-/// Put everything together
-val hashMap_insert_in_list_back_lem_s
-  (t : Type0) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (ensures (
-    match hashMap_insert_in_list_back t key value ls with
-    | Fail _ -> False
-    | Return ls' ->
-      list_t_v ls' == hashMap_insert_in_list_s key value (list_t_v ls)))
-
-let hashMap_insert_in_list_back_lem_s t key value ls =
-  match find (same_key key) (list_t_v ls) with
-  | None -> hashMap_insert_in_list_back_lem_append_s t key value ls
-  | Some _ -> hashMap_insert_in_list_back_lem_update_s t key value ls
-
-(**** Invariants of insert_in_list_s *)
-
-/// Auxiliary lemmas
-/// We work on [hashMap_insert_in_list_s], the "high-level" version of [insert_in_list'back].
-///
-/// Note that in F* we can't have recursive proofs inside of other proofs, contrary
-/// to Coq, which makes it a bit cumbersome to prove auxiliary results like the
-/// following ones...
-
-(** Auxiliary lemmas: append case *)
-
-val slot_t_v_for_all_binding_neq_append_lem
-  (t : Type0) (key : usize) (value : t) (ls : list (binding t)) (b : binding t) :
-  Lemma
-  (requires (
-    fst b <> key /\
-    for_all (binding_neq b) ls /\
-    slot_s_find key ls == None))
-  (ensures (
-    for_all (binding_neq b) (ls @ [(key,value)])))
-
-#push-options "--fuel 1"
-let rec slot_t_v_for_all_binding_neq_append_lem t key value ls b =
-  match ls with
-  | [] -> ()
-  | (ck, cv) :: cls ->
-    slot_t_v_for_all_binding_neq_append_lem t key value cls b
-#pop-options
-
-val slot_s_inv_not_find_append_end_inv_lem
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
-  Lemma
-  (requires (
-    slot_s_inv len (hash_mod_key key len) ls /\
-    slot_s_find key ls == None))
-  (ensures (
-    let ls' = ls @ [(key,value)] in
-    slot_s_inv len (hash_mod_key key len) ls' /\
-    (slot_s_find key ls' == Some value) /\
-    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
-
-#push-options "--fuel 1"
-let rec slot_s_inv_not_find_append_end_inv_lem t len key value ls =
-  match ls with
-  | [] -> ()
-  | (ck, cv) :: cls ->
-    slot_s_inv_not_find_append_end_inv_lem t len key value cls;
-    let h = hash_mod_key key len in
-    let ls' = ls @ [(key,value)] in
-    assert(for_all (same_hash_mod_key len h) ls');
-    slot_t_v_for_all_binding_neq_append_lem t key value cls (ck, cv);
-    assert(pairwise_rel binding_neq ls');
-    assert(slot_s_inv len h ls')
-#pop-options
-
-/// [insert_in_list]: if the key is not in the map, appends a new bindings
-val hashMap_insert_in_list_s_lem_append
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
-  Lemma
-  (requires (
-    slot_s_inv len (hash_mod_key key len) ls /\
-    slot_s_find key ls == None))
-  (ensures (
-    let ls' = hashMap_insert_in_list_s key value ls in
-    ls' == ls @ [(key,value)] /\
-    // The invariant is preserved
-    slot_s_inv len (hash_mod_key key len) ls' /\
-    // [key] maps to [value]
-    slot_s_find key ls' == Some value /\
-    // The other bindings are preserved
-    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
-
-let hashMap_insert_in_list_s_lem_append t len key value ls =
-  slot_s_inv_not_find_append_end_inv_lem t len key value ls
-
-/// [insert_in_list]: if the key is not in the map, appends a new bindings (quantifiers)
-/// Rk.: we don't use this lemma.
-/// TODO: remove?
-val hashMap_insert_in_list_back_lem_append
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (requires (
-    slot_t_inv len (hash_mod_key key len) ls /\
-    slot_t_find_s key ls == None))
-  (ensures (
-    match hashMap_insert_in_list_back t key value ls with
-    | Fail _ -> False
-    | Return ls' ->
-      list_t_v ls' == list_t_v ls @ [(key,value)] /\
-      // The invariant is preserved
-      slot_t_inv len (hash_mod_key key len) ls' /\
-      // [key] maps to [value]
-      slot_t_find_s key ls' == Some value /\
-      // The other bindings are preserved
-      (forall k'. k' <> key ==> slot_t_find_s k' ls' == slot_t_find_s k' ls)))
-
-let hashMap_insert_in_list_back_lem_append t len key value ls =
-  hashMap_insert_in_list_back_lem_s t key value ls;
-  hashMap_insert_in_list_s_lem_append t len key value (list_t_v ls)
-
-(** Auxiliary lemmas: update case *)
-
-val slot_s_find_update_for_all_binding_neq_append_lem
-  (t : Type0) (key : usize) (value : t) (ls : list (binding t)) (b : binding t) :
-  Lemma
-  (requires (
-    fst b <> key /\
-    for_all (binding_neq b) ls))
-  (ensures (
-    let ls' = find_update (same_key key) ls (key, value) in
-    for_all (binding_neq b) ls'))
-
-#push-options "--fuel 1"
-let rec slot_s_find_update_for_all_binding_neq_append_lem t key value ls b =
-  match ls with
-  | [] -> ()
-  | (ck, cv) :: cls ->
-    slot_s_find_update_for_all_binding_neq_append_lem t key value cls b
-#pop-options
-
-/// Annoying auxiliary lemma we have to prove because there is no way to reason
-/// properly about closures.
-/// I'm really enjoying my time.
-val for_all_binding_neq_value_indep
-  (#t : Type0) (key : key) (v0 v1 : t) (ls : list (binding t)) :
-  Lemma (for_all (binding_neq (key,v0)) ls = for_all (binding_neq (key,v1)) ls)
-
-#push-options "--fuel 1"
-let rec for_all_binding_neq_value_indep #t key v0 v1 ls =
-  match ls with
-  | [] -> ()
-  | _ :: ls' -> for_all_binding_neq_value_indep #t key v0 v1 ls'
-#pop-options
-
-val slot_s_inv_find_append_end_inv_lem
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
-  Lemma
-  (requires (
-    slot_s_inv len (hash_mod_key key len) ls /\
-    Some? (slot_s_find key ls)))
-  (ensures (
-    let ls' = find_update (same_key key) ls (key, value) in
-    slot_s_inv len (hash_mod_key key len) ls' /\
-    (slot_s_find key ls' == Some value) /\
-    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
-
-#push-options "--z3rlimit 50 --fuel 1"
-let rec slot_s_inv_find_append_end_inv_lem t len key value ls =
-  match ls with
-  | [] -> ()
-  | (ck, cv) :: cls ->
-    let h = hash_mod_key key len in
-    let ls' = find_update (same_key key) ls (key, value) in
-    if ck = key then
-      begin
-      assert(ls' == (ck,value) :: cls);
-      assert(for_all (same_hash_mod_key len h) ls');
-      // For pairwise_rel: binding_neq (ck, value) is actually independent
-      // of `value`. Slightly annoying to prove in F*...
-      assert(for_all (binding_neq (ck,cv)) cls);
-      for_all_binding_neq_value_indep key cv value cls;
-      assert(for_all (binding_neq (ck,value)) cls);
-      assert(pairwise_rel binding_neq ls');
-      assert(slot_s_inv len (hash_mod_key key len) ls')
-      end
-    else
-      begin
-      slot_s_inv_find_append_end_inv_lem t len key value cls;
-      assert(for_all (same_hash_mod_key len h) ls');
-      slot_s_find_update_for_all_binding_neq_append_lem t key value cls (ck, cv);
-      assert(pairwise_rel binding_neq ls');
-      assert(slot_s_inv len h ls')
-      end
-#pop-options
-
-/// [insert_in_list]: if the key is in the map, update the bindings
-val hashMap_insert_in_list_s_lem_update
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
-  Lemma
-  (requires (
-    slot_s_inv len (hash_mod_key key len) ls /\
-    Some? (slot_s_find key ls)))
-  (ensures (
-    let ls' = hashMap_insert_in_list_s key value ls in
-    ls' == find_update (same_key key) ls (key,value) /\
-    // The invariant is preserved
-    slot_s_inv len (hash_mod_key key len) ls' /\
-    // [key] maps to [value]
-    slot_s_find key ls' == Some value /\
-    // The other bindings are preserved
-    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls)))
-
-let hashMap_insert_in_list_s_lem_update t len key value ls =
-  slot_s_inv_find_append_end_inv_lem t len key value ls
-
-
-/// [insert_in_list]: if the key is in the map, update the bindings
-/// TODO: not used: remove?
-val hashMap_insert_in_list_back_lem_update
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (requires (
-    slot_t_inv len (hash_mod_key key len) ls /\
-    Some? (slot_t_find_s key ls)))
-  (ensures (
-    match hashMap_insert_in_list_back t key value ls with
-    | Fail _ -> False
-    | Return ls' ->
-      let als = list_t_v ls in
-      list_t_v ls' == find_update (same_key key) als (key,value) /\
-      // The invariant is preserved
-      slot_t_inv len (hash_mod_key key len) ls' /\
-      // [key] maps to [value]
-      slot_t_find_s key ls' == Some value /\
-      // The other bindings are preserved
-      (forall k'. k' <> key ==> slot_t_find_s k' ls' == slot_t_find_s k' ls)))
-
-let hashMap_insert_in_list_back_lem_update t len key value ls =
-  hashMap_insert_in_list_back_lem_s t key value ls;
-  hashMap_insert_in_list_s_lem_update t len key value (list_t_v ls)
-
-(** Final lemmas about [insert_in_list] *)
-
-/// High-level version
-val hashMap_insert_in_list_s_lem
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list (binding t)) :
-  Lemma
-  (requires (
-    slot_s_inv len (hash_mod_key key len) ls))
-  (ensures (
-    let ls' = hashMap_insert_in_list_s key value ls in
-    // The invariant is preserved
-    slot_s_inv len (hash_mod_key key len) ls' /\
-    // [key] maps to [value]
-    slot_s_find key ls' == Some value /\
-    // The other bindings are preserved
-    (forall k'. k' <> key ==> slot_s_find k' ls' == slot_s_find k' ls) /\
-    // The length is incremented, iff we inserted a new key
-    (match slot_s_find key ls with
-     | None -> length ls' = length ls + 1
-     | Some _ -> length ls' = length ls)))
-
-let hashMap_insert_in_list_s_lem t len key value ls =
-  match slot_s_find key ls with
-  | None ->
-    assert_norm(length [(key,value)] = 1);
-    hashMap_insert_in_list_s_lem_append t len key value ls
-  | Some _ ->
-    hashMap_insert_in_list_s_lem_update t len key value ls
-
-/// [insert_in_list]
-/// TODO: not used: remove?
-val hashMap_insert_in_list_back_lem
-  (t : Type0) (len : usize{len > 0}) (key : usize) (value : t) (ls : list_t t) :
-  Lemma
-  (requires (slot_t_inv len (hash_mod_key key len) ls))
-  (ensures (
-    match hashMap_insert_in_list_back t key value ls with
-    | Fail _ -> False
-    | Return ls' ->
-      // The invariant is preserved
-      slot_t_inv len (hash_mod_key key len) ls' /\
-      // [key] maps to [value]
-      slot_t_find_s key ls' == Some value /\
-      // The other bindings are preserved
-      (forall k'. k' <> key ==> slot_t_find_s k' ls' == slot_t_find_s k' ls) /\
-      // The length is incremented, iff we inserted a new key
-      (match slot_t_find_s key ls with
-       | None ->
-         list_t_v ls' == list_t_v ls @ [(key,value)] /\
-         list_t_len ls' = list_t_len ls + 1
-       | Some _ ->
-         list_t_v ls' == find_update (same_key key) (list_t_v ls) (key,value) /\
-         list_t_len ls' = list_t_len ls)))
-  (decreases (hashMap_insert_in_list_loop_decreases t key value ls))
-
-let hashMap_insert_in_list_back_lem t len key value ls =
-  hashMap_insert_in_list_back_lem_s t key value ls;
-  hashMap_insert_in_list_s_lem t len key value (list_t_v ls)
-
-(*** insert_no_resize *)
-
-(**** Refinement proof *)
-/// Same strategy as for [insert_in_list]: we introduce a high-level version of
-/// the function, and reason about it.
-/// We work on [hashMap_s] (we use a higher-level view of the hash-map, but
-/// not too high).
-
-/// A high-level version of insert, which doesn't check if the table is saturated
-let hashMap_insert_no_fail_s
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (key : usize) (value : t) :
-  hashMap_s t =
-  let len = length hm in
-  let i = hash_mod_key key len in
-  let slot = index hm i in
-  let slot' = hashMap_insert_in_list_s key value slot in
-  let hm' = list_update hm i slot' in
-  hm'
-
-// TODO: at some point I used hashMap_s_nes and it broke proofs...x
-let hashMap_insert_no_resize_s
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (key : usize) (value : t) :
-  result (hashMap_s t) =
-  // Check if the table is saturated (too many entries, and we need to insert one)
-  let num_entries = length (flatten hm) in
-  if None? (hashMap_s_find hm key) && num_entries = usize_max then Fail Failure
-  else Return (hashMap_insert_no_fail_s hm key value)
-
-/// Prove that [hashMap_insert_no_resize_s] is refined by
-/// [hashMap_insert_no_resize'fwd_back]
-val hashMap_insert_no_resize_lem_s
-  (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
-  Lemma
-  (requires (
-    hashMap_t_base_inv self /\
-    hashMap_s_len (hashMap_t_v self) = hashMap_t_len_s self))
-  (ensures (
-    begin
-    match hashMap_insert_no_resize t self key value,
-          hashMap_insert_no_resize_s (hashMap_t_v self) key value
-    with
-    | Fail _, Fail _ -> True
-    | Return hm, Return hm_v ->
-      hashMap_t_base_inv hm /\
-      hashMap_t_same_params hm self /\
-      hashMap_t_v hm == hm_v /\
-      hashMap_s_len hm_v == hashMap_t_len_s hm
-    | _ -> False
-    end))
-
-let hashMap_insert_no_resize_lem_s t self key value =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let i0 = self.num_entries in
-    let p = self.max_load_factor in
-    let i1 = self.max_load in
-    let v = self.slots in
-    let i2 = alloc_vec_Vec_len (list_t t) v in
-    let len = length v in
-    begin match usize_rem i i2 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        begin
-        // Checking that: list_t_v (index ...) == index (hashMap_t_v ...) ...
-        assert(list_t_v l == index (hashMap_t_v self) hash_mod);
-        hashMap_insert_in_list_lem t key value l;
-        match hashMap_insert_in_list t key value l with
-        | Fail _ -> ()
-        | Return b ->
-          assert(b = None? (slot_s_find key (list_t_v l)));
-          hashMap_insert_in_list_back_lem t len key value l;
-          if b
-          then
-            begin match usize_add i0 1 with
-            | Fail _ -> ()
-            | Return i3 ->
-              begin
-              match hashMap_insert_in_list_back t key value l with
-              | Fail _ -> ()
-              | Return l0 ->
-                begin match alloc_vec_Vec_update_usize v hash_mod l0 with
-                | Fail _ -> ()
-                | Return v0 ->
-                  let self_v = hashMap_t_v self in
-                  let hm = MkhashMap_t i3 p i1 v0 in
-                  let hm_v = hashMap_t_v hm in
-                  assert(hm_v == list_update self_v hash_mod (list_t_v l0));
-                  assert_norm(length [(key,value)] = 1);
-                  assert(length (list_t_v l0) = length (list_t_v l) + 1);
-                  length_flatten_update self_v hash_mod (list_t_v l0);
-                  assert(hashMap_s_len hm_v = hashMap_t_len_s hm)
-                end
-              end
-            end
-          else
-            begin
-            match hashMap_insert_in_list_back t key value l with
-            | Fail _ -> ()
-            | Return l0 ->
-              begin match alloc_vec_Vec_update_usize v hash_mod l0 with
-              | Fail _ -> ()
-              | Return v0 ->
-                let self_v = hashMap_t_v self in
-                let hm = MkhashMap_t i0 p i1 v0 in
-                let hm_v = hashMap_t_v hm in
-                assert(hm_v == list_update self_v hash_mod (list_t_v l0));
-                assert(length (list_t_v l0) = length (list_t_v l));
-                length_flatten_update self_v hash_mod (list_t_v l0);
-                assert(hashMap_s_len hm_v = hashMap_t_len_s hm)
-              end
-            end
-        end
-      end
-    end
-  end
-
-(**** insert_{no_fail,no_resize}: invariants *)
-
-let hashMap_s_updated_binding
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (key : usize) (opt_value : option t) (hm' : hashMap_s_nes t) : Type0 =
-  // [key] maps to [value]
-  hashMap_s_find hm' key == opt_value /\
-  // The other bindings are preserved
-  (forall k'. k' <> key ==> hashMap_s_find hm' k' == hashMap_s_find hm k')
-
-let insert_post (#t : Type0) (hm : hashMap_s_nes t)
-  (key : usize) (value : t) (hm' : hashMap_s_nes t) : Type0 =
-  // The invariant is preserved
-  hashMap_s_inv hm' /\
-  // [key] maps to [value] and the other bindings are preserved
-  hashMap_s_updated_binding hm key (Some value) hm' /\
-  // The length is incremented, iff we inserted a new key
-  (match hashMap_s_find hm key with
-   | None -> hashMap_s_len hm' = hashMap_s_len hm + 1
-   | Some _ -> hashMap_s_len hm' = hashMap_s_len hm)
-
-val hashMap_insert_no_fail_s_lem
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (key : usize) (value : t) :
-  Lemma
-  (requires (hashMap_s_inv hm))
-  (ensures (
-    let hm' = hashMap_insert_no_fail_s hm key value in
-    insert_post hm key value hm'))
-
-let hashMap_insert_no_fail_s_lem #t hm key value =
-  let len = length hm in
-  let i = hash_mod_key key len in
-  let slot = index hm i in
-  hashMap_insert_in_list_s_lem t len key value slot;
-  let slot' = hashMap_insert_in_list_s key value slot in
-  length_flatten_update hm i slot'
-
-val hashMap_insert_no_resize_s_lem
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (key : usize) (value : t) :
-  Lemma
-  (requires (hashMap_s_inv hm))
-  (ensures (
-    match hashMap_insert_no_resize_s hm key value with
-    | Fail _ ->
-      // Can fail only if we need to create a new binding in
-      // an already saturated map
-      hashMap_s_len hm = usize_max /\
-      None? (hashMap_s_find hm key)
-    | Return hm' ->
-      insert_post hm key value hm'))
-
-let hashMap_insert_no_resize_s_lem #t hm key value =
-  let num_entries = length (flatten hm) in
-  if None? (hashMap_s_find hm key) && num_entries = usize_max then ()
-  else hashMap_insert_no_fail_s_lem hm key value
-
-
-(**** find after insert *)
-/// Lemmas about what happens if we call [find] after an insertion
-
-val hashMap_insert_no_resize_s_get_same_lem
-  (#t : Type0) (hm : hashMap_s t)
-  (key : usize) (value : t) :
-  Lemma (requires (hashMap_s_inv hm))
-  (ensures (
-    match hashMap_insert_no_resize_s hm key value with
-    | Fail _ -> True
-    | Return hm' ->
-      hashMap_s_find hm' key == Some value))
-
-let hashMap_insert_no_resize_s_get_same_lem #t hm key value =
-  let num_entries = length (flatten hm) in
-  if None? (hashMap_s_find hm key) && num_entries = usize_max then ()
-  else
-    begin
-    let hm' = Return?.v (hashMap_insert_no_resize_s hm key value) in
-    let len = length hm in
-    let i = hash_mod_key key len in
-    let slot = index hm i in
-    hashMap_insert_in_list_s_lem t len key value slot
-   end
-
-val hashMap_insert_no_resize_s_get_diff_lem
-  (#t : Type0) (hm : hashMap_s t)
-  (key : usize) (value : t) (key' : usize{key' <> key}) :
-  Lemma (requires (hashMap_s_inv hm))
-  (ensures (
-    match hashMap_insert_no_resize_s hm key value with
-    | Fail _ -> True
-    | Return hm' ->
-      hashMap_s_find hm' key' == hashMap_s_find hm key'))
-
-let hashMap_insert_no_resize_s_get_diff_lem #t hm key value key' =
-  let num_entries = length (flatten hm) in
-  if None? (hashMap_s_find hm key) && num_entries = usize_max then ()
-  else
-    begin
-    let hm' = Return?.v (hashMap_insert_no_resize_s hm key value) in
-    let len = length hm in
-    let i = hash_mod_key key len in
-    let slot = index hm i in
-    hashMap_insert_in_list_s_lem t len key value slot;
-    let i' = hash_mod_key key' len in
-    if i <> i' then ()
-    else
-      begin
-      ()
-      end
-   end
-
-
-(*** move_elements_from_list *)
-
-/// Having a great time here: if we use `result (hashMap_s_res t)` as the
-/// return type for [hashMap_move_elements_from_list_s] instead of having this
-/// awkward match, the proof of [hashMap_move_elements_lem_refin] fails.
-/// I guess it comes from F*'s poor subtyping.
-/// Followingly, I'm not taking any chance and using [result_hashMap_s]
-/// everywhere.
-type result_hashMap_s_nes (t : Type0) : Type0 =
-  res:result (hashMap_s t) {
-    match res with
-    | Fail _ -> True
-    | Return hm -> is_pos_usize (length hm)
-  }
-
-let rec hashMap_move_elements_from_list_s
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (ls : slot_s t) :
-  // Do *NOT* use `result (hashMap_s t)`
-  Tot (result_hashMap_s_nes t)
-  (decreases ls) =
-  match ls with
-  | [] -> Return hm
-  | (key, value) :: ls' ->
-    match hashMap_insert_no_resize_s hm key value with
-    | Fail e -> Fail e
-    | Return hm' ->
-      hashMap_move_elements_from_list_s hm' ls'
-
-/// Refinement lemma
-val hashMap_move_elements_from_list_lem
-  (t : Type0) (ntable : hashMap_t_nes t) (ls : list_t t) :
-  Lemma (requires (hashMap_t_base_inv ntable))
-  (ensures (
-    match hashMap_move_elements_from_list t ntable ls,
-          hashMap_move_elements_from_list_s (hashMap_t_v ntable) (slot_t_v ls)
-    with
-    | Fail _, Fail _ -> True
-    | Return hm', Return hm_v ->
-      hashMap_t_base_inv hm' /\
-      hashMap_t_v hm' == hm_v /\
-      hashMap_t_same_params hm' ntable
-    | _ -> False))
-  (decreases (hashMap_move_elements_from_list_loop_decreases t ntable ls))
-
-#push-options "--fuel 1"
-let rec hashMap_move_elements_from_list_lem t ntable ls =
-  begin match ls with
-  | List_Cons k v tl ->
-    assert(list_t_v ls == (k, v) :: list_t_v tl);
-    let ls_v = list_t_v ls in
-    let (_,_) :: tl_v = ls_v in
-    hashMap_insert_no_resize_lem_s t ntable k v;
-    begin match hashMap_insert_no_resize t ntable k v with
-    | Fail _ -> ()
-    | Return h ->
-      let h_v = Return?.v (hashMap_insert_no_resize_s (hashMap_t_v ntable) k v) in
-      assert(hashMap_t_v h == h_v);
-      hashMap_move_elements_from_list_lem t h tl;
-      begin match hashMap_move_elements_from_list t h tl with
-      | Fail _ -> ()
-      | Return h0 -> ()
-      end
-    end
-  | List_Nil -> ()
-  end
-#pop-options
-
-(*** move_elements *)
-
-(**** move_elements: refinement 0 *)
-/// The proof for [hashMap_move_elements_lem_refin] broke so many times
-/// (while it is supposed to be super simple!) that we decided to add one refinement
-/// level, to really do things step by step...
-/// Doing this refinement layer made me notice that maybe the problem came from
-/// the fact that at some point we have to prove `list_t_v List_Nil == []`: I
-/// added the corresponding assert to help Z3 and everything became stable.
-/// I finally didn't use this "simple" refinement lemma, but I still keep it here
-/// because it allows for easy comparisons with [hashMap_move_elements_s].
-
-/// [hashMap_move_elements] refines this function, which is actually almost
-/// the same (just a little bit shorter and cleaner, and has a pre).
-///
-/// The way I wrote the high-level model is the following:
-/// - I copy-pasted the definition of [hashMap_move_elements], wrote the
-///   signature which links this new definition to [hashMap_move_elements] and
-///   checked that the proof passed
-/// - I gradually simplified it, while making sure the proof still passes
-#push-options "--fuel 1"
-let rec hashMap_move_elements_s_simpl
-  (t : Type0) (ntable : hashMap_t t)
-  (slots : alloc_vec_Vec (list_t t))
-  (i : usize{i <= length slots /\ length slots <= usize_max}) :
-  Pure (result ((hashMap_t t) & (alloc_vec_Vec (list_t t))))
-  (requires (True))
-  (ensures (fun res ->
-    match res, hashMap_move_elements t ntable slots i with
-    | Fail _, Fail _ -> True
-    | Return (ntable1, slots1), Return (ntable2, slots2) ->
-      ntable1 == ntable2 /\
-      slots1 == slots2
-    | _ -> False))
-  (decreases (hashMap_move_elements_loop_decreases t ntable slots i))
-  =
-  if i < length slots
-  then
-    let slot = index slots i in
-    begin match hashMap_move_elements_from_list t ntable slot with
-    | Fail e -> Fail e
-    | Return hm' ->
-      let slots' = list_update slots i List_Nil in
-      hashMap_move_elements_s_simpl t hm' slots' (i+1)
-    end
-  else Return (ntable, slots)
-#pop-options
-
-(**** move_elements: refinement 1 *)
-/// We prove a second refinement lemma: calling [move_elements] refines a function
-/// which, for every slot, moves the element out of the slot. This first model is
-/// almost exactly the translated function, it just uses `list` instead of `list_t`.
-
-// Note that we ignore the returned slots (we thus don't return a pair:
-// only the new hash map in which we moved the elements from the slots):
-// this returned value is not used.
-let rec hashMap_move_elements_s
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (slots : slots_s t) (i : usize{i <= length slots /\ length slots <= usize_max}) :
-  Tot (result_hashMap_s_nes t)
-  (decreases (length slots - i)) =
-  let len = length slots in
-  if i < len then
-    begin
-    let slot = index slots i in
-    match hashMap_move_elements_from_list_s hm slot with
-    | Fail e -> Fail e
-    | Return hm' ->
-      let slots' = list_update slots i [] in
-      hashMap_move_elements_s hm' slots' (i+1)
-    end
-  else Return hm
-
-val hashMap_move_elements_lem_refin
-  (t : Type0) (ntable : hashMap_t t)
-  (slots : alloc_vec_Vec (list_t t)) (i : usize{i <= length slots}) :
-  Lemma
-  (requires (
-    hashMap_t_base_inv ntable))
-  (ensures (
-    match hashMap_move_elements t ntable slots i,
-          hashMap_move_elements_s (hashMap_t_v ntable) (slots_t_v slots) i
-    with
-    | Fail _, Fail _ -> True // We will prove later that this is not possible
-    | Return (ntable', _), Return ntable'_v ->
-      hashMap_t_base_inv ntable' /\
-      hashMap_t_v ntable' == ntable'_v /\
-      hashMap_t_same_params ntable' ntable
-    | _ -> False))
- (decreases (length slots - i))
-
-#restart-solver
-#push-options "--fuel 1"
-let rec hashMap_move_elements_lem_refin t ntable slots i =
-  assert(hashMap_t_base_inv ntable);
-  let i0 = alloc_vec_Vec_len (list_t t) slots in
-  let b = i < i0 in
-  if b
-  then
-    begin match alloc_vec_Vec_index_usize slots i with
-    | Fail _ -> ()
-    | Return l ->
-      let l0 = core_mem_replace (list_t t) l List_Nil in
-      assert(l0 == l);
-      hashMap_move_elements_from_list_lem t ntable l0;
-      begin match hashMap_move_elements_from_list t ntable l0 with
-      | Fail _ -> ()
-      | Return h ->
-        let l1 = core_mem_replace_back (list_t t) l List_Nil in
-        assert(l1 == List_Nil);
-        assert(slot_t_v #t List_Nil == []); // THIS IS IMPORTANT
-        begin match alloc_vec_Vec_update_usize slots i l1 with
-        | Fail _ -> ()
-        | Return v ->
-          begin match usize_add i 1 with
-          | Fail _ -> ()
-          | Return i1 ->
-            hashMap_move_elements_lem_refin t h v i1;
-            begin match hashMap_move_elements t h v i1 with
-            | Fail _ ->
-              assert(Fail? (hashMap_move_elements t ntable slots i));
-              ()
-            | Return (ntable', v0) -> ()
-            end
-          end
-        end
-      end
-    end
-  else ()
-#pop-options
-
-
-(**** move_elements: refinement 2 *)
-/// We prove a second refinement lemma: calling [move_elements] refines a function
-/// which moves every binding of the hash map seen as *one* associative list
-/// (and not a list of lists).
-
-/// [ntable] is the hash map to which we move the elements
-/// [slots] is the current hash map, from which we remove the elements, and seen
-///         as a "flat" associative list (and not a list of lists)
-/// This is actually exactly [hashMap_move_elements_from_list_s]...
-let rec hashMap_move_elements_s_flat
-  (#t : Type0) (ntable : hashMap_s_nes t)
-  (slots : assoc_list t) :
-  Tot (result_hashMap_s_nes t)
-  (decreases slots) =
-  match slots with
-  | [] -> Return ntable
-  | (k,v) :: slots' ->
-    match hashMap_insert_no_resize_s ntable k v with
-    | Fail e -> Fail e
-    | Return ntable' ->
-      hashMap_move_elements_s_flat ntable' slots'
-
-/// The refinment lemmas
-/// First, auxiliary helpers.
-
-/// Flatten a list of lists, starting at index i
-val flatten_i :
-     #a:Type
-  -> l:list (list a)
-  -> i:nat{i <= length l}
-  -> Tot (list a) (decreases (length l - i))
-
-let rec flatten_i l i =
-  if i < length l then
-    index l i @ flatten_i l (i+1)
-  else []
-
-let _ = assert(let l = [1;2] in l == hd l :: tl l)
-
-val flatten_i_incr :
-     #a:Type
-  -> l:list (list a)
-  -> i:nat{Cons? l /\ i+1 <= length l} ->
-  Lemma
-  (ensures (
-    (**) assert_norm(length (hd l :: tl l) == 1 + length (tl l));
-    flatten_i l (i+1) == flatten_i (tl l) i))
-  (decreases (length l - (i+1)))
-
-#push-options "--fuel 1"
-let rec flatten_i_incr l i =
-  let x :: tl = l in
-  if i + 1 < length l then
-    begin
-    assert(flatten_i l (i+1) == index l (i+1) @ flatten_i l (i+2));
-    flatten_i_incr l (i+1);
-    assert(flatten_i l (i+2) == flatten_i tl (i+1));
-    assert(index l (i+1) == index tl i)
-    end
-  else ()
-#pop-options
-
-val flatten_0_is_flatten :
-     #a:Type
-  -> l:list (list a) ->
-  Lemma
-  (ensures (flatten_i l 0 == flatten l))
-
-#push-options "--fuel 1"
-let rec flatten_0_is_flatten #a l =
-  match l with
-  | [] -> ()
-  | x :: l' ->
-    flatten_i_incr l 0;
-    flatten_0_is_flatten l'
-#pop-options
-
-/// Auxiliary lemma
-val flatten_nil_prefix_as_flatten_i :
-     #a:Type
-  -> l:list (list a)
-  -> i:nat{i <= length l} ->
-  Lemma (requires (forall (j:nat{j < i}). index l j == []))
-  (ensures (flatten l == flatten_i l i))
-
-#push-options "--fuel 1"
-let rec flatten_nil_prefix_as_flatten_i #a l i =
-  if i = 0 then flatten_0_is_flatten l
-  else
-    begin
-    let x :: l' = l in
-    assert(index l 0 == []);
-    assert(x == []);
-    assert(flatten l == flatten l');
-    flatten_i_incr l (i-1);
-    assert(flatten_i l i == flatten_i l' (i-1));
-    assert(forall (j:nat{j < length l'}). index l' j == index l (j+1));
-    flatten_nil_prefix_as_flatten_i l' (i-1);
-    assert(flatten l' == flatten_i l' (i-1))
-    end
-#pop-options
-
-/// The proof is trivial, the functions are the same.
-/// Just keeping two definitions to allow changes...
-val hashMap_move_elements_from_list_s_as_flat_lem
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (ls : slot_s t) :
-  Lemma
-  (ensures (
-    hashMap_move_elements_from_list_s hm ls ==
-    hashMap_move_elements_s_flat hm ls))
-  (decreases ls)
-
-#push-options "--fuel 1"
-let rec hashMap_move_elements_from_list_s_as_flat_lem #t hm ls =
-  match ls with
-  | [] -> ()
-  | (key, value) :: ls' ->
-    match hashMap_insert_no_resize_s hm key value with
-    | Fail _ -> ()
-    | Return hm' ->
-      hashMap_move_elements_from_list_s_as_flat_lem hm' ls'
-#pop-options
-
-/// Composition of two calls to [hashMap_move_elements_s_flat]
-let hashMap_move_elements_s_flat_comp
-  (#t : Type0) (hm : hashMap_s_nes t) (slot0 slot1 : slot_s t) :
-  Tot (result_hashMap_s_nes t) =
-  match hashMap_move_elements_s_flat hm slot0 with
-  | Fail e -> Fail e
-  | Return hm1 -> hashMap_move_elements_s_flat hm1 slot1
-
-/// High-level desc:
-/// move_elements (move_elements hm slot0) slo1 == move_elements hm (slot0 @ slot1)
-val hashMap_move_elements_s_flat_append_lem
-  (#t : Type0) (hm : hashMap_s_nes t) (slot0 slot1 : slot_s t) :
-  Lemma
-  (ensures (
-    match hashMap_move_elements_s_flat_comp hm slot0 slot1,
-          hashMap_move_elements_s_flat hm (slot0 @ slot1)
-    with
-    | Fail _, Fail _ -> True
-    | Return hm1, Return hm2 -> hm1 == hm2
-    | _ -> False))
-  (decreases (slot0))
-
-#push-options "--fuel 1"
-let rec hashMap_move_elements_s_flat_append_lem #t hm slot0 slot1 =
-  match slot0 with
-  | [] -> ()
-  | (k,v) :: slot0' ->
-    match hashMap_insert_no_resize_s hm k v with
-    | Fail _ -> ()
-    | Return hm' ->
-      hashMap_move_elements_s_flat_append_lem hm' slot0' slot1
-#pop-options
-
-val flatten_i_same_suffix (#a : Type) (l0 l1 : list (list a)) (i : nat) :
-  Lemma
-  (requires (
-    i <= length l0 /\
-    length l0 = length l1 /\
-    (forall (j:nat{i <= j /\ j < length l0}). index l0 j == index l1 j)))
-  (ensures (flatten_i l0 i == flatten_i l1 i))
-  (decreases (length l0 - i))
-
-#push-options "--fuel 1"
-let rec flatten_i_same_suffix #a l0 l1 i =
-  if i < length l0 then
-    flatten_i_same_suffix l0 l1 (i+1)
-  else ()
-#pop-options
-
-/// Refinement lemma:
-/// [hashMap_move_elements_s] refines [hashMap_move_elements_s_flat]
-/// (actually the functions are equal on all inputs).
-val hashMap_move_elements_s_lem_refin_flat
-  (#t : Type0) (hm : hashMap_s_nes t)
-  (slots : slots_s t)
-  (i : nat{i <= length slots /\ length slots <= usize_max}) :
-  Lemma
-  (ensures (
-    match hashMap_move_elements_s hm slots i,
-          hashMap_move_elements_s_flat hm (flatten_i slots i)
-    with
-    | Fail _, Fail _ -> True
-    | Return hm, Return hm' -> hm == hm'
-    | _ -> False))
-  (decreases (length slots - i))
-
-#push-options "--fuel 1"
-let rec hashMap_move_elements_s_lem_refin_flat #t hm slots i =
-  let len = length slots in
-  if i < len then
-    begin
-    let slot = index slots i in
-    hashMap_move_elements_from_list_s_as_flat_lem hm slot;
-    match hashMap_move_elements_from_list_s hm slot with
-    | Fail _ ->
-      assert(flatten_i slots i == slot @ flatten_i slots (i+1));
-      hashMap_move_elements_s_flat_append_lem hm slot (flatten_i slots (i+1));
-      assert(Fail? (hashMap_move_elements_s_flat hm (flatten_i slots i)))
-    | Return hm' ->
-      let slots' = list_update slots i [] in
-      flatten_i_same_suffix slots slots' (i+1);
-      hashMap_move_elements_s_lem_refin_flat hm' slots' (i+1);
-      hashMap_move_elements_s_flat_append_lem hm slot (flatten_i slots' (i+1));
-      ()
-    end
-  else ()
-#pop-options
-
-let assoc_list_inv (#t : Type0) (al : assoc_list t) : Type0 =
-  // All the keys are pairwise distinct
-  pairwise_rel binding_neq al
-
-let disjoint_hm_al_on_key
-  (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) (k : key) : Type0 =
-  match hashMap_s_find hm k, assoc_list_find k al with
-  | Some _, None
-  | None, Some _
-  | None, None -> True
-  | Some _, Some _ -> False
-
-/// Playing a dangerous game here: using forall quantifiers
-let disjoint_hm_al (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) : Type0 =
-  forall (k:key). disjoint_hm_al_on_key hm al k
-
-let find_in_union_hm_al
-  (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) (k : key) :
-  option t =
-  match hashMap_s_find hm k with
-  | Some b -> Some b
-  | None -> assoc_list_find k al
-
-/// Auxiliary lemma
-val for_all_binding_neq_find_lem (#t : Type0) (k : key) (v : t) (al : assoc_list t) :
-  Lemma (requires (for_all (binding_neq (k,v)) al))
-  (ensures (assoc_list_find k al == None))
-
-#push-options "--fuel 1"
-let rec for_all_binding_neq_find_lem #t k v al =
-  match al with
-  | [] -> ()
-  | b :: al' -> for_all_binding_neq_find_lem k v al'
-#pop-options
-
-val hashMap_move_elements_s_flat_lem
-  (#t : Type0) (hm : hashMap_s_nes t) (al : assoc_list t) :
-  Lemma
-  (requires (
-    // Invariants
-    hashMap_s_inv hm /\
-    assoc_list_inv al /\
-    // The two are disjoint
-    disjoint_hm_al hm al /\
-    // We can add all the elements to the hashmap
-    hashMap_s_len hm + length al <= usize_max))
-  (ensures (
-    match hashMap_move_elements_s_flat hm al with
-    | Fail _ -> False // We can't fail
-    | Return hm' ->
-      // The invariant is preserved
-      hashMap_s_inv hm' /\
-      // The new hash map is the union of the two maps
-      (forall (k:key). hashMap_s_find hm' k == find_in_union_hm_al hm al k) /\
-      hashMap_s_len hm' = hashMap_s_len hm + length al))
-  (decreases al)
-
-#restart-solver
-#push-options "--z3rlimit 200 --fuel 1"
-let rec hashMap_move_elements_s_flat_lem #t hm al =
-  match al with
-  | [] -> ()
-  | (k,v) :: al' ->
-    hashMap_insert_no_resize_s_lem hm k v;
-    match hashMap_insert_no_resize_s hm k v with
-    | Fail _ -> ()
-    | Return hm' ->
-      assert(hashMap_s_inv hm');
-      assert(assoc_list_inv al');
-      let disjoint_lem (k' : key) :
-        Lemma (disjoint_hm_al_on_key hm' al' k')
-        [SMTPat (disjoint_hm_al_on_key hm' al' k')] =
-        if k' = k then
-          begin
-          assert(hashMap_s_find hm' k' == Some v);
-          for_all_binding_neq_find_lem k v al';
-          assert(assoc_list_find k' al' == None)
-          end
-        else
-          begin
-          assert(hashMap_s_find hm' k' == hashMap_s_find hm k');
-          assert(assoc_list_find k' al' == assoc_list_find k' al)
-          end
-      in
-      assert(disjoint_hm_al hm' al');
-      assert(hashMap_s_len hm' + length al' <= usize_max);
-      hashMap_move_elements_s_flat_lem hm' al'
-#pop-options
-
-/// We need to prove that the invariants on the "low-level" representations of
-/// the hash map imply the invariants on the "high-level" representations.
-
-val slots_t_inv_implies_slots_s_inv
-  (#t : Type0) (slots : slots_t t{length slots <= usize_max}) :
-  Lemma (requires (slots_t_inv slots))
-  (ensures (slots_s_inv (slots_t_v slots)))
-
-let slots_t_inv_implies_slots_s_inv #t slots =
-  // Ok, works fine: this lemma was useless.
-  // Problem is: I can never really predict for sure with F*...
-  ()
-
-val hashMap_t_base_inv_implies_hashMap_s_inv
-  (#t : Type0) (hm : hashMap_t t) :
-  Lemma (requires (hashMap_t_base_inv hm))
-  (ensures (hashMap_s_inv (hashMap_t_v hm)))
-
-let hashMap_t_base_inv_implies_hashMap_s_inv #t hm = () // same as previous
-
-/// Introducing a "partial" version of the hash map invariant, which operates on
-/// a suffix of the hash map.
-let partial_hashMap_s_inv
-  (#t : Type0) (len : usize{len > 0}) (offset : usize)
-  (hm : hashMap_s t{offset + length hm <= usize_max}) : Type0 =
-  forall(i:nat{i < length hm}). {:pattern index hm i} slot_s_inv len (offset + i) (index hm i)
-
-/// Auxiliary lemma.
-/// If a binding comes from a slot i, then its key is different from the keys
-/// of the bindings in the other slots (because the hashes of the keys are distinct).
-val binding_in_previous_slot_implies_neq
-  (#t : Type0) (len : usize{len > 0})
-  (i : usize) (b : binding t)
-  (offset : usize{i < offset})
-  (slots : hashMap_s t{offset + length slots <= usize_max}) :
-  Lemma
-  (requires (
-    // The binding comes from a slot not in [slots]
-    hash_mod_key (fst b) len = i /\
-    // The slots are the well-formed suffix of a hash map
-    partial_hashMap_s_inv len offset slots))
-  (ensures (
-    for_all (binding_neq b) (flatten slots)))
-  (decreases slots)
-
-#push-options "--z3rlimit 100 --fuel 1"
-let rec binding_in_previous_slot_implies_neq #t len i b offset slots =
-  match slots with
-  | [] -> ()
-  | s :: slots' ->
-    assert(slot_s_inv len offset (index slots 0)); // Triggers patterns
-    assert(slot_s_inv len offset s);
-    // Proving TARGET. We use quantifiers.
-    assert(for_all (same_hash_mod_key len offset) s);
-    forall_index_equiv_list_for_all (same_hash_mod_key len offset) s;
-    assert(forall (i:nat{i < length s}). same_hash_mod_key len offset (index s i));
-    let aux (i:nat{i < length s}) :
-      Lemma
-      (requires (same_hash_mod_key len offset (index s i)))
-      (ensures (binding_neq b (index s i)))
-      [SMTPat (index s i)] = ()
-    in
-    assert(forall (i:nat{i < length s}). binding_neq b (index s i));
-    forall_index_equiv_list_for_all (binding_neq b) s;
-    assert(for_all (binding_neq b) s); // TARGET
-    //
-    assert(forall (i:nat{i < length slots'}). index slots' i == index slots (i+1)); // Triggers instantiations
-    binding_in_previous_slot_implies_neq len i b (offset+1) slots';
-    for_all_append (binding_neq b) s (flatten slots')    
-#pop-options
-
-val partial_hashMap_s_inv_implies_assoc_list_lem
-  (#t : Type0) (len : usize{len > 0}) (offset : usize)
-  (hm : hashMap_s t{offset + length hm <= usize_max}) :
-  Lemma
-  (requires (
-    partial_hashMap_s_inv len offset hm))
-  (ensures (assoc_list_inv (flatten hm)))
-  (decreases (length hm + length (flatten hm)))
-
-#push-options "--fuel 1"
-let rec partial_hashMap_s_inv_implies_assoc_list_lem #t len offset hm =
-  match hm with
-  | [] -> ()
-  | slot :: hm' ->
-    assert(flatten hm == slot @ flatten hm');
-    assert(forall (i:nat{i < length hm'}). index hm' i == index hm (i+1)); // Triggers instantiations
-    match slot with
-    | [] ->
-      assert(flatten hm == flatten hm');
-      assert(partial_hashMap_s_inv len (offset+1) hm'); // Triggers instantiations
-      partial_hashMap_s_inv_implies_assoc_list_lem len (offset+1) hm'
-    | x :: slot' ->
-      assert(flatten (slot' :: hm') == slot' @ flatten hm');
-      let hm'' = slot' :: hm' in
-      assert(forall (i:nat{0 < i /\ i < length hm''}). index hm'' i == index hm i); // Triggers instantiations
-      assert(forall (i:nat{0 < i /\ i < length hm''}). slot_s_inv len (offset + i) (index hm'' i));
-      assert(index hm 0 == slot); // Triggers instantiations
-      assert(slot_s_inv len offset slot);
-      assert(slot_s_inv len offset slot');
-      assert(partial_hashMap_s_inv len offset hm'');
-      partial_hashMap_s_inv_implies_assoc_list_lem len offset (slot' :: hm');
-      // Proving that the key in `x` is different from all the other keys in
-      // the flattened map
-      assert(for_all (binding_neq x) slot');
-      for_all_append (binding_neq x) slot' (flatten hm');
-      assert(partial_hashMap_s_inv len (offset+1) hm');
-      binding_in_previous_slot_implies_neq #t len offset x (offset+1) hm';
-      assert(for_all (binding_neq x) (flatten hm'));
-      assert(for_all (binding_neq x) (flatten (slot' :: hm')))
-#pop-options
-
-val hashMap_s_inv_implies_assoc_list_lem
-  (#t : Type0) (hm : hashMap_s t) :
-  Lemma (requires (hashMap_s_inv hm))
-  (ensures (assoc_list_inv (flatten hm)))
-
-let hashMap_s_inv_implies_assoc_list_lem #t hm =
-  partial_hashMap_s_inv_implies_assoc_list_lem (length hm) 0 hm
-
-val hashMap_t_base_inv_implies_assoc_list_lem
-  (#t : Type0) (hm : hashMap_t t):
-  Lemma (requires (hashMap_t_base_inv hm))
-  (ensures (assoc_list_inv (hashMap_t_al_v hm)))
-
-let hashMap_t_base_inv_implies_assoc_list_lem #t hm =
-  hashMap_s_inv_implies_assoc_list_lem (hashMap_t_v hm)
-
-/// For some reason, we can't write the below [forall] directly in the [ensures]
-/// clause of the next lemma: it makes Z3 fails even with a huge rlimit.
-/// I have no idea what's going on.
-let hashMap_is_assoc_list
-  (#t : Type0) (ntable : hashMap_t t{length ntable.slots > 0})
-  (al : assoc_list t) : Type0 =
-  (forall (k:key). hashMap_t_find_s ntable k == assoc_list_find k al)
-
-let partial_hashMap_s_find
-  (#t : Type0) (len : usize{len > 0}) (offset : usize)
-  (hm : hashMap_s_nes t{offset + length hm = len})
-  (k : key{hash_mod_key k len >= offset}) : option t =
-  let i = hash_mod_key k len in
-  let slot = index hm (i - offset) in
-  slot_s_find k slot
-
-val not_same_hash_key_not_found_in_slot
-  (#t : Type0) (len : usize{len > 0})
-  (k : key)
-  (i : usize)
-  (slot : slot_s t) :
-  Lemma
-  (requires (
-    hash_mod_key k len <> i /\
-    slot_s_inv len i slot))
-  (ensures (slot_s_find k slot == None))
-
-#push-options "--fuel 1"
-let rec not_same_hash_key_not_found_in_slot #t len k i slot =
-  match slot with
-  | [] -> ()
-  | (k',v) :: slot' -> not_same_hash_key_not_found_in_slot len k i slot'
-#pop-options
-
-/// Small variation of [binding_in_previous_slot_implies_neq]: if the hash of
-/// a key links it to a previous slot, it can't be found in the slots after.
-val key_in_previous_slot_implies_not_found
-  (#t : Type0) (len : usize{len > 0})
-  (k : key)
-  (offset : usize)
-  (slots : hashMap_s t{offset + length slots = len}) :
-  Lemma
-  (requires (
-    // The binding comes from a slot not in [slots]
-    hash_mod_key k len < offset /\
-    // The slots are the well-formed suffix of a hash map
-    partial_hashMap_s_inv len offset slots))
-  (ensures (
-    assoc_list_find k (flatten slots) == None))
-  (decreases slots)
-
-#push-options "--fuel 1"
-let rec key_in_previous_slot_implies_not_found #t len k offset slots =
-  match slots with
-  | [] -> ()
-  | slot :: slots' ->
-    find_append (same_key k) slot (flatten slots');
-    assert(index slots 0 == slot); // Triggers instantiations
-    not_same_hash_key_not_found_in_slot #t len k offset slot;
-    assert(assoc_list_find k slot == None);
-    assert(forall (i:nat{i < length slots'}). index slots' i == index slots (i+1)); // Triggers instantiations
-    key_in_previous_slot_implies_not_found len k (offset+1) slots'
-#pop-options  
-
-val partial_hashMap_s_is_assoc_list_lem
-  (#t : Type0) (len : usize{len > 0}) (offset : usize)
-  (hm : hashMap_s_nes t{offset + length hm = len})
-  (k : key{hash_mod_key k len >= offset}) :
-  Lemma
-  (requires (
-    partial_hashMap_s_inv len offset hm))
-  (ensures (
-    partial_hashMap_s_find len offset hm k == assoc_list_find k (flatten hm)))
-  (decreases hm)
-
-#push-options "--fuel 1"
-let rec partial_hashMap_s_is_assoc_list_lem #t len offset hm k =
-  match hm with
-  | [] -> ()
-  | slot :: hm' ->
-    let h = hash_mod_key k len in
-    let i = h - offset in
-    if i = 0 then
-      begin
-      // We must look in the current slot
-      assert(partial_hashMap_s_find len offset hm k == slot_s_find k slot);
-      find_append (same_key k) slot (flatten hm');
-      assert(forall (i:nat{i < length hm'}). index hm' i == index hm (i+1)); // Triggers instantiations
-      key_in_previous_slot_implies_not_found #t len k (offset+1) hm';
-      assert( // Of course, writing `== None` doesn't work...
-        match find (same_key k) (flatten hm') with
-        | None -> True
-        | Some _ -> False);
-      assert(
-        find (same_key k) (flatten hm) ==
-        begin match find (same_key k) slot with
-        | Some x -> Some x
-        | None -> find (same_key k) (flatten hm')
-        end);
-      ()
-      end
-    else
-      begin
-      // We must ignore the current slot
-      assert(partial_hashMap_s_find len offset hm k ==
-             partial_hashMap_s_find len (offset+1) hm' k);
-      find_append (same_key k) slot (flatten hm');
-      assert(index hm 0 == slot); // Triggers instantiations
-      not_same_hash_key_not_found_in_slot #t len k offset slot;
-      assert(forall (i:nat{i < length hm'}). index hm' i == index hm (i+1)); // Triggers instantiations
-      partial_hashMap_s_is_assoc_list_lem #t len (offset+1) hm' k
-      end
-#pop-options
-
-val hashMap_is_assoc_list_lem (#t : Type0) (hm : hashMap_t t) :
-  Lemma (requires (hashMap_t_base_inv hm))
-  (ensures (hashMap_is_assoc_list hm (hashMap_t_al_v hm)))
-
-let hashMap_is_assoc_list_lem #t hm =
-  let aux (k:key) :
-    Lemma (hashMap_t_find_s hm k == assoc_list_find k (hashMap_t_al_v hm))
-    [SMTPat (hashMap_t_find_s hm k)] =
-    let hm_v = hashMap_t_v hm in
-    let len = length hm_v in
-    partial_hashMap_s_is_assoc_list_lem #t len 0 hm_v k
-  in
-  ()
-
-/// The final lemma about [move_elements]: calling it on an empty hash table moves
-/// all the elements to this empty table.
-val hashMap_move_elements_lem
-  (t : Type0) (ntable : hashMap_t t) (slots : alloc_vec_Vec (list_t t)) :
-  Lemma
-  (requires (
-    let al = flatten (slots_t_v slots) in
-    hashMap_t_base_inv ntable /\
-    length al <= usize_max /\
-    assoc_list_inv al /\
-    // The table is empty
-    hashMap_t_len_s ntable = 0 /\
-    (forall (k:key). hashMap_t_find_s ntable k  == None)))
-  (ensures (
-    let al = flatten (slots_t_v slots) in
-    match hashMap_move_elements t ntable slots 0,
-          hashMap_move_elements_s_flat (hashMap_t_v ntable) al
-    with
-    | Return (ntable', _), Return ntable'_v ->
-      // The invariant is preserved
-      hashMap_t_base_inv ntable' /\
-      // We preserved the parameters
-      hashMap_t_same_params ntable' ntable /\
-      // The table has the same number of slots
-      length ntable'.slots = length ntable.slots /\
-      // The count is good
-      hashMap_t_len_s ntable' = length al /\
-      // The table can be linked to its model (we need this only to reveal
-      // "pretty" functional lemmas to the user in the fsti - so that we
-      // can write lemmas with SMT patterns - this is very F* specific)
-      hashMap_t_v ntable' == ntable'_v /\
-      // The new table contains exactly all the bindings from the slots
-      // Rk.: see the comment for [hashMap_is_assoc_list]
-      hashMap_is_assoc_list ntable' al
-    | _ -> False // We can only succeed
-    ))
-
-// Weird, dirty things happen below.
-// Manually unfolding some postconditions allowed to make the proof pass,
-// and also revealed the reason why some proofs failed with "Unknown assertion
-// failed" (resulting in the call to [flatten_0_is_flatten] for instance).
-// I think manually unfolding the postconditions allowed to account for the
-// lack of ifuel (this kind of proofs is annoying, really).
-#restart-solver
-#push-options "--z3rlimit 100"
-let hashMap_move_elements_lem t ntable slots =
-  let ntable_v = hashMap_t_v ntable in
-  let slots_v = slots_t_v slots in
-  let al = flatten slots_v in
-  hashMap_move_elements_lem_refin t ntable slots 0;
-  begin
-  match hashMap_move_elements t ntable slots 0,
-        hashMap_move_elements_s ntable_v slots_v 0
-  with
-  | Fail _, Fail _ -> ()
-  | Return (ntable', _), Return ntable'_v ->
-    assert(hashMap_t_base_inv ntable');
-    assert(hashMap_t_v ntable' == ntable'_v)
-  | _ -> assert(False)
-  end;
-  hashMap_move_elements_s_lem_refin_flat ntable_v slots_v 0;
-  begin
-  match hashMap_move_elements_s ntable_v slots_v 0,
-        hashMap_move_elements_s_flat ntable_v (flatten_i slots_v 0)
-  with
-  | Fail _, Fail _ -> ()
-  | Return hm, Return hm' -> assert(hm == hm')
-  | _ -> assert(False)
-  end;
-  flatten_0_is_flatten slots_v; // flatten_i slots_v 0 == flatten slots_v
-  hashMap_move_elements_s_flat_lem ntable_v al;
-  match hashMap_move_elements t ntable slots 0,
-        hashMap_move_elements_s_flat ntable_v al
-  with
-  | Return (ntable', _), Return ntable'_v ->
-    assert(hashMap_t_base_inv ntable');
-    assert(length ntable'.slots = length ntable.slots);
-    assert(hashMap_t_len_s ntable' = length al);
-    assert(hashMap_t_v ntable' == ntable'_v);
-    assert(hashMap_is_assoc_list ntable' al)
-  | _ -> assert(False)
-#pop-options
-
-(*** try_resize *)
-
-/// High-level model 1.
-/// This is one is slightly "crude": we just simplify a bit the function.
-
-let hashMap_try_resize_s_simpl
-  (#t : Type0)
-  (hm : hashMap_t t) :
-  Pure  (result (hashMap_t t))
-  (requires (
-    let (divid, divis) = hm.max_load_factor in
-    divid > 0 /\ divis > 0))
-  (ensures (fun _ -> True)) =
-  let capacity = length hm.slots in
-  let (divid, divis) = hm.max_load_factor in
-  if capacity <= (usize_max / 2) / divid then
-    let ncapacity : usize = capacity * 2 in
-    begin match hashMap_new_with_capacity t ncapacity divid divis with
-    | Fail e -> Fail e
-    | Return ntable ->
-      match hashMap_move_elements t ntable hm.slots 0 with
-      | Fail e -> Fail e
-      | Return (ntable', _) ->
-        let hm =
-          { hm with slots = ntable'.slots;
-                    max_load = ntable'.max_load }
-        in
-        Return hm
-    end
-  else Return hm
-
-val hashMap_try_resize_lem_refin
-  (t : Type0) (self : hashMap_t t) :
-  Lemma
-  (requires (
-    let (divid, divis) = self.max_load_factor in
-    divid > 0 /\ divis > 0))
-  (ensures (
-    match hashMap_try_resize t self,
-          hashMap_try_resize_s_simpl self
-    with
-    | Fail _, Fail _ -> True
-    | Return hm1, Return hm2 -> hm1 == hm2
-    | _ -> False))
-
-let hashMap_try_resize_lem_refin t self = ()
-
-/// Isolating arithmetic proofs
-
-let gt_lem0 (n m q : nat) :
-  Lemma (requires (m > 0 /\ n > q))
-  (ensures (n * m > q * m)) = ()
-
-let ge_lem0 (n m q : nat) :
-  Lemma (requires (m > 0 /\ n >= q))
-  (ensures (n * m >= q * m)) = ()
-
-let gt_ge_trans (n m p : nat) :
-  Lemma (requires (n > m /\ m >= p)) (ensures (n > p)) = ()
-
-let ge_trans (n m p : nat) :
-  Lemma (requires (n >= m /\ m >= p)) (ensures (n >= p)) = ()
-
-#push-options "--z3rlimit 200"
-let gt_lem1 (n m q : nat) :
-  Lemma (requires (m > 0 /\ n > q / m)) (ensures (n * m > q)) =
-  assert(n >= q / m + 1);
-  ge_lem0 n m (q / m + 1);
-  assert(n * m >= (q / m) * m + m)
-#pop-options
-
-let gt_lem2 (n m p q : nat) :
-  Lemma (requires (m > 0 /\ p > 0 /\ n > (q / m) / p)) (ensures (n * m * p > q)) =
-  gt_lem1 n p (q / m);
-  assert(n * p > q / m);
-  gt_lem1 (n * p) m q
-
-let ge_lem1 (n m q : nat) :
-  Lemma (requires (n >= m /\ q > 0))
-  (ensures (n / q >= m / q)) =
-  FStar.Math.Lemmas.lemma_div_le m n q
-
-#restart-solver
-#push-options "--z3rlimit 200"
-let times_divid_lem (n m p : pos) : Lemma ((n * m) / p >= n * (m / p))
-  =
-  FStar.Math.Lemmas.multiply_fractions m p;
-  assert(m >= (m / p) * p);
-  assert(n * m >= n * (m / p) * p); //
-  ge_lem1 (n * m) (n * (m / p) * p) p;
-  assert((n * m) / p >= (n * (m / p) * p) / p);
-  assert(n * (m / p) * p = (n * (m / p)) * p);
-  FStar.Math.Lemmas.cancel_mul_div (n * (m / p)) p;
-  assert(((n * (m / p)) * p) / p = n * (m / p))
-#pop-options
-
-/// The good old arithmetic proofs and their unstability...
-/// At some point I thought it was stable because it worked with `--quake 100`.
-/// Of course, it broke the next time I checked the file...
-/// It seems things are ok when we check this proof on its own, but not when
-/// it is sent at the same time as the one above (though we put #restart-solver!).
-/// I also tried `--quake 1/100` to no avail: it seems that when Z3 decides to
-/// fail the first one, it fails them all. I inserted #restart-solver before
-/// the previous lemma to see if it had an effect (of course not).
-val new_max_load_lem
-  (len : usize) (capacity : usize{capacity > 0})
-  (divid : usize{divid > 0}) (divis : usize{divis > 0}) :
-  Lemma
-  (requires (
-    let max_load = (capacity * divid) / divis in
-    let ncapacity = 2 * capacity in
-    let nmax_load = (ncapacity * divid) / divis in
-    capacity > 0 /\ 0 < divid /\ divid < divis /\
-    capacity * divid >= divis /\
-    len = max_load + 1))
-  (ensures (
-    let max_load = (capacity * divid) / divis in
-    let ncapacity = 2 * capacity in
-    let nmax_load = (ncapacity * divid) / divis in
-    len <= nmax_load))
-
-let mul_assoc (a b c : nat) : Lemma (a * b * c == a * (b * c)) = ()
-
-let ge_lem2 (a b c d : nat) : Lemma (requires (a >= b + c /\ c >= d)) (ensures (a >= b + d)) = ()
-let ge_div_lem1 (a b : nat) : Lemma (requires (a >= b /\ b > 0)) (ensures (a / b >= 1)) = ()
-
-#restart-solver
-#push-options "--z3rlimit 100 --z3cliopt smt.arith.nl=false"
-let new_max_load_lem len capacity divid divis =
-  FStar.Math.Lemmas.paren_mul_left 2 capacity divid;
-  mul_assoc 2 capacity divid;
-  // The following assertion often breaks though it is given by the above
-  // lemma. I really don't know what to do (I deactivated non-linear
-  // arithmetic and added the previous lemma call, moved the assertion up,
-  // boosted the rlimit...).
-  assert(2 * capacity * divid == 2 * (capacity * divid));
-  let max_load = (capacity * divid) / divis in
-  let ncapacity = 2 * capacity in
-  let nmax_load = (ncapacity * divid) / divis in
-  assert(nmax_load = (2 * capacity * divid) / divis);
-  times_divid_lem 2 (capacity * divid) divis;
-  assert((2 * (capacity * divid)) / divis >= 2 * ((capacity * divid) / divis));
-  assert(nmax_load >= 2 * ((capacity * divid) / divis));
-  assert(nmax_load >= 2 * max_load);
-  assert(nmax_load >= max_load + max_load);
-  ge_div_lem1 (capacity * divid) divis;
-  ge_lem2 nmax_load max_load max_load 1;
-  assert(nmax_load >= max_load + 1)
-#pop-options
-
-val hashMap_try_resize_s_simpl_lem (#t : Type0) (hm : hashMap_t t) :
-  Lemma
-  (requires (
-    // The base invariant is satisfied
-    hashMap_t_base_inv hm /\
-    // However, the "full" invariant is broken, as we call [try_resize]
-    // only if the current number of entries is > the max load.
-    // 
-    // There are two situations:
-    // - either we just reached the max load
-    // - or we were already saturated and can't resize
-    (let (dividend, divisor) = hm.max_load_factor in
-     hm.num_entries == hm.max_load + 1 \/
-     length hm.slots * 2 * dividend > usize_max)
-  ))
-  (ensures (
-    match hashMap_try_resize_s_simpl hm with
-    | Fail _ -> False
-    | Return hm' ->
-      // The full invariant is now satisfied (the full invariant is "base
-      // invariant" + the map is not overloaded (or can't be resized because
-      // already too big)
-      hashMap_t_inv hm' /\
-      // It contains the same bindings as the initial map
-      (forall (k:key). hashMap_t_find_s hm' k == hashMap_t_find_s hm k)))
-
-#restart-solver
-#push-options "--z3rlimit 400"
-let hashMap_try_resize_s_simpl_lem #t hm =
-  let capacity = length hm.slots in
-  let (divid, divis) = hm.max_load_factor in
-  if capacity <= (usize_max / 2) / divid then
-    begin
-    let ncapacity : usize = capacity * 2 in
-    assert(ncapacity * divid <= usize_max);
-    assert(hashMap_t_len_s hm = hm.max_load + 1);
-    new_max_load_lem (hashMap_t_len_s hm) capacity divid divis;
-    hashMap_new_with_capacity_lem t ncapacity divid divis;
-    match hashMap_new_with_capacity t ncapacity divid divis with
-    | Fail _ -> ()
-    | Return ntable ->
-      let slots = hm.slots in
-      let al = flatten (slots_t_v slots) in
-      // Proving that: length al = hm.num_entries
-      assert(al == flatten (map slot_t_v slots));
-      assert(al == flatten (map list_t_v slots));
-      assert(hashMap_t_al_v hm == flatten (hashMap_t_v hm));
-      assert(hashMap_t_al_v hm == flatten (map list_t_v hm.slots));
-      assert(al == hashMap_t_al_v hm);
-      assert(hashMap_t_base_inv ntable);
-      assert(length al = hm.num_entries);
-      assert(length al <= usize_max);
-      hashMap_t_base_inv_implies_assoc_list_lem hm;
-      assert(assoc_list_inv al);
-      assert(hashMap_t_len_s ntable = 0);
-      assert(forall (k:key). hashMap_t_find_s ntable k  == None);
-      hashMap_move_elements_lem t ntable hm.slots;
-      match hashMap_move_elements t ntable hm.slots 0 with
-      | Fail _ -> ()
-      | Return (ntable', _) ->
-        hashMap_is_assoc_list_lem hm;
-        assert(hashMap_is_assoc_list hm (hashMap_t_al_v hm));
-        let hm' =
-          { hm with slots = ntable'.slots;
-                    max_load = ntable'.max_load }
-        in
-        assert(hashMap_t_base_inv ntable');
-        assert(hashMap_t_base_inv hm');
-        assert(hashMap_t_len_s hm' = hashMap_t_len_s hm);
-        new_max_load_lem (hashMap_t_len_s hm') capacity divid divis;
-        assert(hashMap_t_len_s hm' <= hm'.max_load); // Requires a lemma
-        assert(hashMap_t_inv hm')
-    end
-  else
-    begin
-    gt_lem2 capacity 2 divid usize_max;
-    assert(capacity * 2 * divid > usize_max)
-    end
-#pop-options
-
-let hashMap_t_same_bindings  (#t : Type0) (hm hm' : hashMap_t_nes t) : Type0 =
-  forall (k:key). hashMap_t_find_s hm k == hashMap_t_find_s hm' k
-
-/// The final lemma about [try_resize]
-val hashMap_try_resize_lem (#t : Type0) (hm : hashMap_t t) :
-  Lemma
-  (requires (
-    hashMap_t_base_inv hm /\
-    // However, the "full" invariant is broken, as we call [try_resize]
-    // only if the current number of entries is > the max load.
-    // 
-    // There are two situations:
-    // - either we just reached the max load
-    // - or we were already saturated and can't resize
-    (let (dividend, divisor) = hm.max_load_factor in
-     hm.num_entries == hm.max_load + 1 \/
-     length hm.slots * 2 * dividend > usize_max)))
-  (ensures (
-    match hashMap_try_resize t hm with
-    | Fail _ -> False
-    | Return hm' ->
-      // The full invariant is now satisfied (the full invariant is "base
-      // invariant" + the map is not overloaded (or can't be resized because
-      // already too big)
-      hashMap_t_inv hm' /\
-      // The length is the same
-      hashMap_t_len_s hm' = hashMap_t_len_s hm /\
-      // It contains the same bindings as the initial map
-      hashMap_t_same_bindings hm' hm))
-
-let hashMap_try_resize_lem #t hm =
-  hashMap_try_resize_lem_refin t hm;
-  hashMap_try_resize_s_simpl_lem hm
-
-(*** insert *)
-
-/// The high-level model (very close to the original function: we don't need something
-/// very high level, just to clean it a bit)
-let hashMap_insert_s
-  (#t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
-  result (hashMap_t t) =
-  match hashMap_insert_no_resize t self key value with
-  | Fail e -> Fail e
-  | Return hm' ->
-    if hashMap_t_len_s hm' > hm'.max_load then
-      hashMap_try_resize t hm'
-    else Return hm'
-
-val hashMap_insert_lem_refin
-  (t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
-  Lemma (requires True)
-  (ensures (
-    match hashMap_insert t self key value,
-          hashMap_insert_s self key value
-    with
-    | Fail _, Fail _ -> True
-    | Return hm1, Return hm2 -> hm1 == hm2
-    | _ -> False))
-
-let hashMap_insert_lem_refin t self key value = ()
-
-/// Helper
-let hashMap_insert_bindings_lem
-  (t : Type0) (self : hashMap_t_nes t) (key : usize) (value : t)
-  (hm' hm'' : hashMap_t_nes t) :
-  Lemma
-  (requires (
-     hashMap_s_updated_binding (hashMap_t_v self) key
-                                (Some value) (hashMap_t_v hm') /\
-     hashMap_t_same_bindings hm' hm''))
-  (ensures (
-     hashMap_s_updated_binding (hashMap_t_v self) key
-                                (Some value) (hashMap_t_v hm'')))
-  = ()
-
-val hashMap_insert_lem_aux
-  (#t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
-  Lemma (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_insert t self key value with
-    | Fail _ ->
-      // We can fail only if:
-      // - the key is not in the map and we need to add it
-      // - we are already saturated
-      hashMap_t_len_s self = usize_max /\
-      None? (hashMap_t_find_s self key)
-    | Return hm' ->
-      // The invariant is preserved
-      hashMap_t_inv hm' /\
-      // [key] maps to [value] and the other bindings are preserved
-      hashMap_s_updated_binding (hashMap_t_v self) key (Some value) (hashMap_t_v hm') /\
-      // The length is incremented, iff we inserted a new key
-      (match hashMap_t_find_s self key with
-       | None -> hashMap_t_len_s hm' = hashMap_t_len_s self + 1
-       | Some _ -> hashMap_t_len_s hm' = hashMap_t_len_s self)))
-
-#restart-solver
-#push-options "--z3rlimit 200"
-let hashMap_insert_lem_aux #t self key value =
-  hashMap_insert_no_resize_lem_s t self key value;
-  hashMap_insert_no_resize_s_lem (hashMap_t_v self) key value;
-  match hashMap_insert_no_resize t self key value with
-  | Fail _ -> ()
-  | Return hm' ->
-    // Expanding the post of [hashMap_insert_no_resize_lem_s]
-    let self_v = hashMap_t_v self in
-    let hm'_v = Return?.v (hashMap_insert_no_resize_s self_v key value) in
-    assert(hashMap_t_base_inv hm');
-    assert(hashMap_t_same_params hm' self);
-    assert(hashMap_t_v hm' == hm'_v);
-    assert(hashMap_s_len hm'_v == hashMap_t_len_s hm');
-    // Expanding the post of [hashMap_insert_no_resize_s_lem]
-    assert(insert_post self_v key value hm'_v);
-    // Expanding [insert_post]
-    assert(hashMap_s_inv hm'_v);
-    assert(
-      match hashMap_s_find self_v key with
-      | None -> hashMap_s_len hm'_v = hashMap_s_len self_v + 1
-      | Some _ -> hashMap_s_len hm'_v = hashMap_s_len self_v);
-    if hashMap_t_len_s hm' > hm'.max_load then
-      begin
-      hashMap_try_resize_lem hm';
-      // Expanding the post of [hashMap_try_resize_lem]
-      let hm'' = Return?.v (hashMap_try_resize t hm') in
-      assert(hashMap_t_inv hm'');
-      let hm''_v = hashMap_t_v hm'' in
-      assert(forall k. hashMap_t_find_s hm'' k == hashMap_t_find_s hm' k);
-      assert(hashMap_t_len_s hm'' = hashMap_t_len_s hm'); // TODO
-      // Proving the post
-      assert(hashMap_t_inv hm'');
-      hashMap_insert_bindings_lem t self key value hm' hm'';
-      assert(
-        match hashMap_t_find_s self key with
-         | None -> hashMap_t_len_s hm'' = hashMap_t_len_s self + 1
-         | Some _ -> hashMap_t_len_s hm'' = hashMap_t_len_s self)
-      end
-    else ()
-#pop-options
-
-let hashMap_insert_lem #t self key value =
-  hashMap_insert_lem_aux #t self key value
-
-(*** contains_key *)
-
-(**** contains_key_in_list *)
-
-val hashMap_contains_key_in_list_lem
-  (#t : Type0) (key : usize) (ls : list_t t) :
-  Lemma
-  (ensures (
-    match hashMap_contains_key_in_list t key ls with
-    | Fail _ -> False
-    | Return b ->
-      b = Some? (slot_t_find_s key ls)))
-
-
-#push-options "--fuel 1"
-let rec hashMap_contains_key_in_list_lem #t key ls =
-  match ls with
-  | List_Cons ckey x ls0 ->
-    let b = ckey = key in
-    if b
-    then ()
-    else
-      begin
-      hashMap_contains_key_in_list_lem key ls0;
-      match hashMap_contains_key_in_list t key ls0 with
-      | Fail _ -> ()
-      | Return b0 -> ()
-      end
-  | List_Nil -> ()
-#pop-options
-
-(**** contains_key *)
-
-val hashMap_contains_key_lem_aux
-  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
-  Lemma
-  (ensures (
-    match hashMap_contains_key t self key with
-    | Fail _ -> False
-    | Return b -> b = Some? (hashMap_t_find_s self key)))
-
-let hashMap_contains_key_lem_aux #t self key =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let v = self.slots in
-    let i0 = alloc_vec_Vec_len (list_t t) v in
-    begin match usize_rem i i0 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        hashMap_contains_key_in_list_lem key l;
-        begin match hashMap_contains_key_in_list t key l with
-        | Fail _ -> ()
-        | Return b -> ()
-        end
-      end
-    end
-  end
-
-/// The lemma in the .fsti
-let hashMap_contains_key_lem #t self key =
-  hashMap_contains_key_lem_aux #t self key
-
-(*** get *)
-
-(**** get_in_list *)
-
-val hashMap_get_in_list_lem
-  (#t : Type0) (key : usize) (ls : list_t t) :
-  Lemma
-  (ensures (
-    match hashMap_get_in_list t key ls, slot_t_find_s key ls with
-    | Fail _, None -> True
-    | Return x, Some x' -> x == x'
-    | _ -> False))
-
-#push-options "--fuel 1"
-let rec hashMap_get_in_list_lem #t key ls =
-  begin match ls with
-  | List_Cons ckey cvalue ls0 ->
-    let b = ckey = key in
-    if b
-    then ()
-    else
-      begin
-      hashMap_get_in_list_lem key ls0;
-      match hashMap_get_in_list t key ls0 with
-      | Fail _ -> ()
-      | Return x -> ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-(**** get *)
-
-val hashMap_get_lem_aux
-  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
-  Lemma
-  (ensures (
-    match hashMap_get t self key, hashMap_t_find_s self key with
-    | Fail _, None -> True
-    | Return x, Some x' -> x == x'
-    | _ -> False))
-
-let hashMap_get_lem_aux #t self key =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let v = self.slots in
-    let i0 = alloc_vec_Vec_len (list_t t) v in
-    begin match usize_rem i i0 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        begin
-        hashMap_get_in_list_lem key l;
-        match hashMap_get_in_list t key l with
-        | Fail _ -> ()
-        | Return x -> ()
-        end
-      end
-    end
-  end
-
-/// .fsti
-let hashMap_get_lem #t self key = hashMap_get_lem_aux #t self key
-
-(*** get_mut'fwd *)
-
-
-(**** get_mut_in_list'fwd *)
-
-val hashMap_get_mut_in_list_loop_lem
-  (#t : Type0) (ls : list_t t) (key : usize) :
-  Lemma
-  (ensures (
-    match hashMap_get_mut_in_list_loop t ls key, slot_t_find_s key ls with
-    | Fail _, None -> True
-    | Return x, Some x' -> x == x'
-    | _ -> False))
-
-#push-options "--fuel 1"
-let rec hashMap_get_mut_in_list_loop_lem #t ls key =
-  begin match ls with
-  | List_Cons ckey cvalue ls0 ->
-    let b = ckey = key in
-    if b
-    then ()
-    else
-      begin
-      hashMap_get_mut_in_list_loop_lem ls0 key;
-      match hashMap_get_mut_in_list_loop t ls0 key with
-      | Fail _ -> ()
-      | Return x -> ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-(**** get_mut'fwd *)
-
-val hashMap_get_mut_lem_aux
-  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
-  Lemma
-  (ensures (
-    match hashMap_get_mut t self key, hashMap_t_find_s self key with
-    | Fail _, None -> True
-    | Return x, Some x' -> x == x'
-    | _ -> False))
-
-let hashMap_get_mut_lem_aux #t self key =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let v = self.slots in
-    let i0 = alloc_vec_Vec_len (list_t t) v in
-    begin match usize_rem i i0 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        begin
-        hashMap_get_mut_in_list_loop_lem l key;
-        match hashMap_get_mut_in_list_loop t l key with
-        | Fail _ -> ()
-        | Return x -> ()
-        end
-      end
-    end
-  end
-
-let hashMap_get_mut_lem #t self key =
-  hashMap_get_mut_lem_aux #t self key
-
-(*** get_mut'back *)
-
-(**** get_mut_in_list'back *)
-
-val hashMap_get_mut_in_list_loop_back_lem
-  (#t : Type0) (ls : list_t t) (key : usize) (ret : t) :
-  Lemma
-  (requires (Some? (slot_t_find_s key ls)))
-  (ensures (
-    match hashMap_get_mut_in_list_loop_back t ls key ret with
-    | Fail _ -> False
-    | Return ls' -> list_t_v ls' == find_update (same_key key) (list_t_v ls) (key,ret)
-    | _ -> False))
-
-#push-options "--fuel 1"
-let rec hashMap_get_mut_in_list_loop_back_lem #t ls key ret =
-  begin match ls with
-  | List_Cons ckey cvalue ls0 ->
-    let b = ckey = key in
-    if b
-    then let ls1 = List_Cons ckey ret ls0 in ()
-    else
-      begin
-      hashMap_get_mut_in_list_loop_back_lem ls0 key ret;
-      match hashMap_get_mut_in_list_loop_back t ls0 key ret with
-      | Fail _ -> ()
-      | Return l -> let ls1 = List_Cons ckey cvalue l in ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-(**** get_mut'back *)
-
-/// Refinement lemma
-val hashMap_get_mut_back_lem_refin
-  (#t : Type0) (self : hashMap_t t{length self.slots > 0})
-  (key : usize) (ret : t) :
-  Lemma
-  (requires (Some? (hashMap_t_find_s self key)))
-  (ensures (
-    match hashMap_get_mut_back t self key ret with
-    | Fail _ -> False
-    | Return hm' ->
-      hashMap_t_v hm' == hashMap_insert_no_fail_s (hashMap_t_v self) key ret))
-
-let hashMap_get_mut_back_lem_refin #t self key ret =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let i0 = self.num_entries in
-    let p = self.max_load_factor in
-    let i1 = self.max_load in
-    let v = self.slots in
-    let i2 = alloc_vec_Vec_len (list_t t) v in
-    begin match usize_rem i i2 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        begin
-        hashMap_get_mut_in_list_loop_back_lem l key ret;
-        match hashMap_get_mut_in_list_loop_back t l key ret with
-        | Fail _ -> ()
-        | Return l0 ->
-          begin match alloc_vec_Vec_update_usize v hash_mod l0 with
-          | Fail _ -> ()
-          | Return v0 -> let self0 = MkhashMap_t i0 p i1 v0 in ()
-          end
-        end
-      end
-    end
-  end
-
-/// Final lemma
-val hashMap_get_mut_back_lem_aux
-  (#t : Type0) (hm : hashMap_t t)
-  (key : usize) (ret : t) :
-  Lemma
-  (requires (
-    hashMap_t_inv hm /\
-    Some? (hashMap_t_find_s hm key)))
-  (ensures (
-    match hashMap_get_mut_back t hm key ret with
-    | Fail _ -> False
-    | Return hm' ->
-      // Functional spec
-      hashMap_t_v hm' == hashMap_insert_no_fail_s (hashMap_t_v hm) key ret /\
-     // The invariant is preserved
-     hashMap_t_inv hm' /\
-     // The length is preserved
-     hashMap_t_len_s hm' = hashMap_t_len_s hm /\
-     // [key] maps to [value]
-     hashMap_t_find_s hm' key == Some ret /\
-     // The other bindings are preserved
-     (forall k'. k' <> key ==> hashMap_t_find_s hm' k' == hashMap_t_find_s hm k')))
-
-let hashMap_get_mut_back_lem_aux #t hm key ret =
-  let hm_v = hashMap_t_v hm in
-  hashMap_get_mut_back_lem_refin hm key ret;
-  match hashMap_get_mut_back t hm key ret with
-  | Fail _ -> assert(False)
-  | Return hm' ->
-    hashMap_insert_no_fail_s_lem hm_v key ret
-
-/// .fsti
-let hashMap_get_mut_back_lem #t hm key ret = hashMap_get_mut_back_lem_aux hm key ret
-
-(*** remove'fwd *)
-
-val hashMap_remove_from_list_lem
-  (#t : Type0) (key : usize) (ls : list_t t) :
-  Lemma
-  (ensures (
-    match hashMap_remove_from_list t key ls with
-    | Fail _ -> False
-    | Return opt_x ->
-      opt_x == slot_t_find_s key ls /\
-      (Some? opt_x ==> length (slot_t_v ls) > 0)))
-
-#push-options "--fuel 1"
-let rec hashMap_remove_from_list_lem #t key ls =
-  begin match ls with
-  | List_Cons ckey x tl ->
-    let b = ckey = key in
-    if b
-    then
-      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
-      begin match mv_ls with
-      | List_Cons i cvalue tl0 -> ()
-      | List_Nil -> ()
-      end
-    else
-      begin
-      hashMap_remove_from_list_lem key tl;
-      match hashMap_remove_from_list t key tl with
-      | Fail _ -> ()
-      | Return opt -> ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-val hashMap_remove_lem_aux
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (
-    // We need the invariant to prove that upon decrementing the entries counter,
-    // the counter doesn't become negative
-    hashMap_t_inv self))
-  (ensures (
-    match hashMap_remove t self key with
-    | Fail _ -> False
-    | Return opt_x -> opt_x == hashMap_t_find_s self key))
-
-let hashMap_remove_lem_aux #t self key =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let i0 = self.num_entries in
-    let v = self.slots in
-    let i1 = alloc_vec_Vec_len (list_t t) v in
-    begin match usize_rem i i1 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        begin
-        hashMap_remove_from_list_lem key l;
-        match hashMap_remove_from_list t key l with
-        | Fail _ -> ()
-        | Return x ->
-          begin match x with
-          | None -> ()
-          | Some x0 ->
-            begin
-            assert(l == index v hash_mod);
-            assert(length (list_t_v #t l) > 0);
-            length_flatten_index (hashMap_t_v self) hash_mod;
-            match usize_sub i0 1 with
-            | Fail _ -> ()
-            | Return _ -> ()
-            end
-          end
-        end
-      end
-    end
-  end
-
-/// .fsti
-let hashMap_remove_lem #t self key = hashMap_remove_lem_aux #t self key
-
-(*** remove'back *)
-
-(**** Refinement proofs *)
-
-/// High-level model for [remove_from_list'back]
-let hashMap_remove_from_list_s
-  (#t : Type0) (key : usize) (ls : slot_s t) :
-  slot_s t =
-  filter_one (not_same_key key) ls
-
-/// Refinement lemma
-val hashMap_remove_from_list_back_lem_refin
-  (#t : Type0) (key : usize) (ls : list_t t) :
-  Lemma
-  (ensures (
-    match hashMap_remove_from_list_back t key ls with
-    | Fail _ -> False
-    | Return ls' ->
-      list_t_v ls' == hashMap_remove_from_list_s key (list_t_v ls) /\
-      // The length is decremented, iff the key was in the slot
-      (let len = length (list_t_v ls) in
-       let len' = length (list_t_v ls') in
-       match slot_s_find key (list_t_v ls) with
-       | None -> len = len'
-       | Some _ -> len = len' + 1)))
-
-#push-options "--fuel 1"
-let rec hashMap_remove_from_list_back_lem_refin #t key ls =
-  begin match ls with
-  | List_Cons ckey x tl ->
-    let b = ckey = key in
-    if b
-    then
-      let mv_ls = core_mem_replace (list_t t) (List_Cons ckey x tl) List_Nil in
-      begin match mv_ls with
-      | List_Cons i cvalue tl0 -> ()
-      | List_Nil -> ()
-      end
-    else
-      begin
-      hashMap_remove_from_list_back_lem_refin key tl;
-      match hashMap_remove_from_list_back t key tl with
-      | Fail _ -> ()
-      | Return l -> let ls0 = List_Cons ckey x l in ()
-      end
-  | List_Nil -> ()
-  end
-#pop-options
-
-/// High-level model for [remove_from_list'back]
-let hashMap_remove_s
-  (#t : Type0) (self : hashMap_s_nes t) (key : usize) :
-  hashMap_s t =
-  let len = length self in
-  let hash = hash_mod_key key len in
-  let slot = index self hash in
-  let slot' = hashMap_remove_from_list_s key slot in
-  list_update self hash slot'
-
-/// Refinement lemma
-val hashMap_remove_back_lem_refin
-  (#t : Type0) (self : hashMap_t_nes t) (key : usize) :
-  Lemma
-  (requires (
-    // We need the invariant to prove that upon decrementing the entries counter,
-    // the counter doesn't become negative
-    hashMap_t_inv self))
-  (ensures (
-    match hashMap_remove_back t self key with
-    | Fail _ -> False
-    | Return hm' ->
-      hashMap_t_same_params hm' self /\
-      hashMap_t_v hm' == hashMap_remove_s (hashMap_t_v self) key /\
-      // The length is decremented iff the key was in the map
-      (let len = hashMap_t_len_s self in
-       let len' = hashMap_t_len_s hm' in
-       match hashMap_t_find_s self key with
-       | None -> len = len'
-       | Some _ -> len = len' + 1)))
-
-let hashMap_remove_back_lem_refin #t self key =
-  begin match hash_key key with
-  | Fail _ -> ()
-  | Return i ->
-    let i0 = self.num_entries in
-    let p = self.max_load_factor in
-    let i1 = self.max_load in
-    let v = self.slots in
-    let i2 = alloc_vec_Vec_len (list_t t) v in
-    begin match usize_rem i i2 with
-    | Fail _ -> ()
-    | Return hash_mod ->
-      begin match alloc_vec_Vec_index_usize v hash_mod with
-      | Fail _ -> ()
-      | Return l ->
-        begin
-        hashMap_remove_from_list_lem key l;
-        match hashMap_remove_from_list t key l with
-        | Fail _ -> ()
-        | Return x ->
-          begin match x with
-          | None ->
-            begin
-            hashMap_remove_from_list_back_lem_refin key l;
-            match hashMap_remove_from_list_back t key l with
-            | Fail _ -> ()
-            | Return l0 ->
-              begin
-              length_flatten_update (slots_t_v v) hash_mod (list_t_v l0);
-              match alloc_vec_Vec_update_usize v hash_mod l0 with
-              | Fail _ -> ()
-              | Return v0 -> ()
-              end
-            end
-          | Some x0 ->
-            begin
-            assert(l == index v hash_mod);
-            assert(length (list_t_v #t l) > 0);
-            length_flatten_index (hashMap_t_v self) hash_mod;
-            match usize_sub i0 1 with
-            | Fail _ -> ()
-            | Return i3 ->
-              begin
-              hashMap_remove_from_list_back_lem_refin key l;
-              match hashMap_remove_from_list_back t key l with
-              | Fail _ -> ()
-              | Return l0 ->
-                begin
-                length_flatten_update (slots_t_v v) hash_mod (list_t_v l0);
-                match alloc_vec_Vec_update_usize v hash_mod l0 with
-                | Fail _ -> ()
-                | Return v0 -> ()
-                end
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-
-(**** Invariants, high-level properties *)
-
-val hashMap_remove_from_list_s_lem
-  (#t : Type0) (k : usize) (slot : slot_s t) (len : usize{len > 0}) (i : usize) :
-  Lemma
-  (requires (slot_s_inv len i slot))
-  (ensures (
-    let slot' = hashMap_remove_from_list_s k slot in
-    slot_s_inv len i slot' /\
-    slot_s_find k slot' == None /\
-    (forall (k':key{k' <> k}). slot_s_find k' slot' == slot_s_find k' slot) /\
-    // This postcondition is necessary to prove that the invariant is preserved
-    // in the recursive calls. This allows us to do the proof in one go.
-    (forall (b:binding t). for_all (binding_neq b) slot ==> for_all (binding_neq b) slot')
-  ))
-
-#push-options "--fuel 1"
-let rec hashMap_remove_from_list_s_lem #t key slot len i =
-  match slot with
-  | [] -> ()
-  | (k',v) :: slot' ->
-    if k' <> key then
-      begin
-      hashMap_remove_from_list_s_lem key slot' len i;
-      let slot'' = hashMap_remove_from_list_s key slot' in
-      assert(for_all (same_hash_mod_key len i) ((k',v)::slot''));
-      assert(for_all (binding_neq (k',v)) slot'); // Triggers instanciation
-      assert(for_all (binding_neq (k',v)) slot'')
-      end
-    else
-      begin
-      assert(for_all (binding_neq (k',v)) slot');
-      for_all_binding_neq_find_lem key v slot'
-      end
-#pop-options
-
-val hashMap_remove_s_lem
-  (#t : Type0) (self : hashMap_s_nes t) (key : usize) :
-  Lemma
-  (requires (hashMap_s_inv self))
-  (ensures (
-    let hm' = hashMap_remove_s self key in
-    // The invariant is preserved
-    hashMap_s_inv hm' /\
-    // We updated the binding
-    hashMap_s_updated_binding self key None hm'))
-
-let hashMap_remove_s_lem #t self key =
-  let len = length self in
-  let hash = hash_mod_key key len in
-  let slot = index self hash in
-  hashMap_remove_from_list_s_lem key slot len hash;
-  let slot' = hashMap_remove_from_list_s key slot in
-  let hm' = list_update self hash slot' in
-  assert(hashMap_s_inv self)
-
-/// Final lemma about [remove'back]
-val hashMap_remove_back_lem_aux
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_remove_back t self key with
-    | Fail _ -> False
-    | Return hm' ->
-      hashMap_t_inv self /\
-      hashMap_t_same_params hm' self /\
-      // We updated the binding
-      hashMap_s_updated_binding (hashMap_t_v self) key None (hashMap_t_v hm') /\
-      hashMap_t_v hm' == hashMap_remove_s (hashMap_t_v self) key /\
-      // The length is decremented iff the key was in the map
-      (let len = hashMap_t_len_s self in
-       let len' = hashMap_t_len_s hm' in
-       match hashMap_t_find_s self key with
-       | None -> len = len'
-       | Some _ -> len = len' + 1)))
-
-let hashMap_remove_back_lem_aux #t self key =
-  hashMap_remove_back_lem_refin self key;
-  hashMap_remove_s_lem (hashMap_t_v self) key
-
-/// .fsti
-let hashMap_remove_back_lem #t self key =
-  hashMap_remove_back_lem_aux #t self key
diff --git a/tests/fstar/hashmap/Hashmap.Properties.fsti b/tests/fstar/hashmap/Hashmap.Properties.fsti
deleted file mode 100644
index 26c0ec06..00000000
--- a/tests/fstar/hashmap/Hashmap.Properties.fsti
+++ /dev/null
@@ -1,267 +0,0 @@
-(** Properties about the hashmap *)
-module Hashmap.Properties
-open Primitives
-open FStar.List.Tot
-open FStar.Mul
-open Hashmap.Types
-open Hashmap.Clauses
-open Hashmap.Funs
-
-#set-options "--z3rlimit 50 --fuel 0 --ifuel 1"
-
-// Small trick to align the .fst and the .fsti
-val _align_fsti : unit
-
-(*** Utilities *)
-
-type key : eqtype = usize
-
-type hash : eqtype = usize
-
-val hashMap_t_inv (#t : Type0) (hm : hashMap_t t) : Type0
-
-val len_s (#t : Type0) (hm : hashMap_t t) : nat
-
-val find_s (#t : Type0) (hm : hashMap_t t) (k : key) : option t
-
-(*** Overloading *)
-
-/// Upon inserting *new* entries in the hash map, the slots vector is resized
-/// whenever we reach the max load, unless we can't resize anymore because
-/// there are already too many entries. This way, we maintain performance by
-/// limiting the hash collisions.
-/// This is expressed by the following property, which is maintained in the hash
-/// map invariant.
-val hashMap_not_overloaded_lem (#t : Type0) (hm : hashMap_t t) :
-  Lemma
-  (requires (hashMap_t_inv hm))
-  (ensures (
-    // The capacity is the number of slots
-    let capacity = length hm.slots in
-    // The max load factor defines a threshold on the number of entries:
-    // if there are more entries than a given fraction of the number of slots,
-    // we resize the slots vector to limit the hash collisions
-    let (dividend, divisor) = hm.max_load_factor in
-    // technicality: this postcondition won't typecheck if we don't reveal
-    // that divisor > 0 (because of the division)
-    divisor > 0 /\
-    begin
-    // The max load, computed as a fraction of the capacity
-    let max_load = (capacity * dividend) / divisor in
-    // The number of entries inserted in the map is given by [len_s] (see
-    // the functional correctness lemmas, which state how this number evolves):
-    let len = len_s hm in
-    // We prove that:
-    // - either the number of entries is <= than the max load threshold
-    len <= max_load
-    // - or we couldn't resize the map, because then the arithmetic computations
-    //   would overflow (note that we always multiply the number of slots by 2)
-    || 2* capacity * dividend > usize_max
-    end))
-
-(*** Functional correctness *)
-(**** [new'fwd] *)
-
-/// [new] doesn't fail and returns an empty hash map
-val hashMap_new_lem (t : Type0) :
-  Lemma
-  (ensures (
-    match hashMap_new t with
-    | Fail _ -> False
-    | Return hm ->
-      // The hash map invariant is satisfied
-      hashMap_t_inv hm /\
-      // The hash map has a length of 0
-      len_s hm = 0 /\
-      // It contains no bindings
-      (forall k. find_s hm k == None)))
-
-(**** [clear] *)
-
-/// [clear] doesn't fail and turns the hash map into an empty map
-val hashMap_clear_lem
-  (#t : Type0) (self : hashMap_t t) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_clear t self with
-    | Fail _ -> False
-    | Return hm ->
-      // The hash map invariant is satisfied
-      hashMap_t_inv hm /\
-      // The hash map has a length of 0
-      len_s hm = 0 /\
-      // It contains no bindings
-      (forall k. find_s hm k == None)))
-
-(**** [len] *)
-
-/// [len] can't fail and returns the length (the number of elements) of the hash map
-val hashMap_len_lem (#t : Type0) (self : hashMap_t t) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_len t self with
-    | Fail _ -> False
-    | Return l -> l = len_s self))
-
-
-(**** [insert'fwd_back] *)
-
-/// The backward function for [insert] (note it is named "...insert'fwd_back" because
-/// the forward function doesn't return anything, and was thus filtered - in a
-/// sense the effect of applying the forward function then the backward function is
-/// entirely encompassed by the effect of the backward function alone).
-/// 
-/// [insert'fwd_back] simply inserts a binding.
-val hashMap_insert_lem
-  (#t : Type0) (self : hashMap_t t) (key : usize) (value : t) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_insert t self key value with
-    | Fail _ ->
-      // We can fail only if:
-      // - the key is not in the map and we thus need to add it
-      None? (find_s self key) /\
-      // - and we are already saturated (we can't increment the internal counter)
-      len_s self = usize_max
-    | Return hm' ->
-      // The invariant is preserved
-      hashMap_t_inv hm' /\
-      // [key] maps to [value]
-      find_s hm' key == Some value /\
-      // The other bindings are preserved
-      (forall k'. k' <> key ==> find_s hm' k' == find_s self k') /\
-      begin
-      // The length is incremented, iff we inserted a new key
-      match find_s self key with
-      | None -> len_s hm' = len_s self + 1
-      | Some _ -> len_s hm' = len_s self
-      end))
-
-
-(**** [contains_key] *)
-
-/// [contains_key'fwd] can't fail and returns `true` if and only if there is
-/// a binding for key [key]
-val hashMap_contains_key_lem
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_contains_key t self key with
-    | Fail _ -> False
-    | Return b -> b = Some? (find_s self key)))
-
-(**** [get'fwd] *)
-
-/// [get] returns (a shared borrow to) the binding for key [key]
-val hashMap_get_lem
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_get t self key, find_s self key with
-    | Fail _, None -> True
-    | Return x, Some x' -> x == x'
-    | _ -> False))
-
-(**** [get_mut'fwd] *)
-
-/// [get_mut'fwd] returns (a mutable borrow to) the binding for key [key].
-/// 
-/// The *forward* function models the action of getting a borrow to an element
-/// in Rust, which gives the possibility of modifying this element in place. Then,
-/// upon ending the borrow, the effect of the modification is modelled in the
-/// translation through a call to the backward function.
-val hashMap_get_mut_lem
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_get_mut t self key, find_s self key with
-    | Fail _, None -> True
-    | Return x, Some x' -> x == x'
-    | _ -> False))
-
-
-(**** [get_mut'back] *)
-
-/// [get_mut'back] updates the binding for key [key], without failing.
-/// A call to [get_mut'back] must follow a call to [get_mut'fwd], which gives
-/// us that there must be a binding for key [key] in the map (otherwise we
-/// can't prove the absence of failure).
-val hashMap_get_mut_back_lem
-  (#t : Type0) (hm : hashMap_t t) (key : usize) (ret : t) :
-  Lemma
-  (requires (
-    hashMap_t_inv hm /\
-    // A call to the backward function must follow a call to the forward
-    // function, whose success gives us that there is a binding for the key.
-    // In the case of *forward* functions, "success" has to be understood as
-    // the absence of panics. When translating code from Rust to pure lambda
-    // calculus, we have the property that the generated calls to the backward
-    // functions can't fail (because their are preceded by calls to forward
-    // functions, which must then have succeeded before): for a backward function,
-    // "failure" is to be understood as the semantics getting stuck.
-    // This is of course true unless we filtered the call to the forward function
-    // because its effect is encompassed by the backward function, as with
-    // [hashMap_clear]).
-    Some? (find_s hm key)))
-  (ensures (
-    match hashMap_get_mut_back t hm key ret with
-    | Fail _ -> False // Can't fail
-    | Return hm' ->
-     // The invariant is preserved
-     hashMap_t_inv hm' /\
-     // The length is preserved
-     len_s hm' = len_s hm /\
-     // [key] maps to the update value, [ret]
-     find_s hm' key == Some ret /\
-     // The other bindings are preserved
-     (forall k'. k' <> key ==> find_s hm' k' == find_s hm k')))
-
-(**** [remove'fwd] *)
-
-/// [remove'fwd] returns the (optional) element which has been removed from the map
-/// (the rust function *moves* it out of the map). Note that the effect of the update
-/// on the map is modelles through the call to [remove'back] ([remove] takes a
-/// mutable borrow to the hash map as parameter).
-val hashMap_remove_lem
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_remove t self key with
-    | Fail _ -> False
-    | Return opt_x -> opt_x == find_s self key))
-
-
-(**** [remove'back] *)
-
-/// The hash map given as parameter to [remove] is given through a mutable borrow:
-/// hence the backward function which gives back the updated map, without the
-/// binding.
-val hashMap_remove_back_lem
-  (#t : Type0) (self : hashMap_t t) (key : usize) :
-  Lemma
-  (requires (hashMap_t_inv self))
-  (ensures (
-    match hashMap_remove_back t self key with
-    | Fail _ -> False
-    | Return hm' ->
-      // The invariant is preserved
-      hashMap_t_inv self /\
-      // The binding for [key] is not there anymore
-      find_s hm' key == None /\
-      // The other bindings are preserved
-      (forall k'. k' <> key ==> find_s hm' k' == find_s self k') /\
-      begin
-      // The length is decremented iff the key was in the map
-      let len = len_s self in
-      let len' = len_s hm' in
-      match find_s self key with
-      | None -> len = len'
-      | Some _ -> len = len' + 1
-      end))
diff --git a/tests/fstar/hashmap/Primitives.fst b/tests/fstar/hashmap/Primitives.fst
index a3ffbde4..fca80829 100644
--- a/tests/fstar/hashmap/Primitives.fst
+++ b/tests/fstar/hashmap/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -535,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -552,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -559,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
@@ -588,8 +603,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +625,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +636,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +658,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +684,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +703,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +718,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +738,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +754,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +762,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +781,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +796,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +809,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +827,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +842,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst b/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
index f2d09a38..3a042678 100644
--- a/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
+++ b/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
@@ -8,12 +8,12 @@ include HashmapMain.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [hashmap_main::hashmap::hash_key]: forward function
+(** [hashmap_main::hashmap::hash_key]:
     Source: 'src/hashmap.rs', lines 27:0-27:32 *)
 let hashmap_hash_key (k : usize) : result usize =
   Return k
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0:
     Source: 'src/hashmap.rs', lines 50:4-56:5 *)
 let rec hashmap_HashMap_allocate_slots_loop
   (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t)) (n : usize) :
@@ -22,13 +22,12 @@ let rec hashmap_HashMap_allocate_slots_loop
   =
   if n > 0
   then
-    let* slots0 = alloc_vec_Vec_push (hashmap_List_t t) slots Hashmap_List_Nil
-      in
-    let* n0 = usize_sub n 1 in
-    hashmap_HashMap_allocate_slots_loop t slots0 n0
+    let* v = alloc_vec_Vec_push (hashmap_List_t t) slots Hashmap_List_Nil in
+    let* n1 = usize_sub n 1 in
+    hashmap_HashMap_allocate_slots_loop t v n1
   else Return slots
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]:
     Source: 'src/hashmap.rs', lines 50:4-50:76 *)
 let hashmap_HashMap_allocate_slots
   (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t)) (n : usize) :
@@ -36,7 +35,7 @@ let hashmap_HashMap_allocate_slots
   =
   hashmap_HashMap_allocate_slots_loop t slots n
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]:
     Source: 'src/hashmap.rs', lines 59:4-63:13 *)
 let hashmap_HashMap_new_with_capacity
   (t : Type0) (capacity : usize) (max_load_dividend : usize)
@@ -46,102 +45,79 @@ let hashmap_HashMap_new_with_capacity
   let v = alloc_vec_Vec_new (hashmap_List_t t) in
   let* slots = hashmap_HashMap_allocate_slots t v capacity in
   let* i = usize_mul capacity max_load_dividend in
-  let* i0 = usize_div i max_load_divisor in
+  let* i1 = usize_div i max_load_divisor in
   Return
     {
       num_entries = 0;
       max_load_factor = (max_load_dividend, max_load_divisor);
-      max_load = i0;
+      max_load = i1;
       slots = slots
     }
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]:
     Source: 'src/hashmap.rs', lines 75:4-75:24 *)
 let hashmap_HashMap_new (t : Type0) : result (hashmap_HashMap_t t) =
   hashmap_HashMap_new_with_capacity t 32 4 5
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0:
     Source: 'src/hashmap.rs', lines 80:4-88:5 *)
 let rec hashmap_HashMap_clear_loop
   (t : Type0) (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) :
   Tot (result (alloc_vec_Vec (hashmap_List_t t)))
   (decreases (hashmap_HashMap_clear_loop_decreases t slots i))
   =
-  let i0 = alloc_vec_Vec_len (hashmap_List_t t) slots in
-  if i < i0
+  let i1 = alloc_vec_Vec_len (hashmap_List_t t) slots in
+  if i < i1
   then
-    let* i1 = usize_add i 1 in
-    let* slots0 =
-      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
+    let* (_, index_mut_back) =
+      alloc_vec_Vec_index_mut (hashmap_List_t t) usize
         (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t)) slots i
-        Hashmap_List_Nil in
-    hashmap_HashMap_clear_loop t slots0 i1
+      in
+    let* i2 = usize_add i 1 in
+    let* slots1 = index_mut_back Hashmap_List_Nil in
+    hashmap_HashMap_clear_loop t slots1 i2
   else Return slots
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]:
     Source: 'src/hashmap.rs', lines 80:4-80:27 *)
 let hashmap_HashMap_clear
   (t : Type0) (self : hashmap_HashMap_t t) : result (hashmap_HashMap_t t) =
-  let* v = hashmap_HashMap_clear_loop t self.slots 0 in
-  Return { self with num_entries = 0; slots = v }
+  let* back = hashmap_HashMap_clear_loop t self.slots 0 in
+  Return { self with num_entries = 0; slots = back }
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]:
     Source: 'src/hashmap.rs', lines 90:4-90:30 *)
 let hashmap_HashMap_len
   (t : Type0) (self : hashmap_HashMap_t t) : result usize =
   Return self.num_entries
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 97:4-114:5 *)
 let rec hashmap_HashMap_insert_in_list_loop
   (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) :
-  Tot (result bool)
+  Tot (result (bool & (hashmap_List_t t)))
   (decreases (hashmap_HashMap_insert_in_list_loop_decreases t key value ls))
   =
   begin match ls with
   | Hashmap_List_Cons ckey cvalue tl ->
     if ckey = key
-    then Return false
-    else hashmap_HashMap_insert_in_list_loop t key value tl
-  | Hashmap_List_Nil -> Return true
-  end
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: forward function
-    Source: 'src/hashmap.rs', lines 97:4-97:71 *)
-let hashmap_HashMap_insert_in_list
-  (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) : result bool =
-  hashmap_HashMap_insert_in_list_loop t key value ls
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 97:4-114:5 *)
-let rec hashmap_HashMap_insert_in_list_loop_back
-  (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) :
-  Tot (result (hashmap_List_t t))
-  (decreases (hashmap_HashMap_insert_in_list_loop_decreases t key value ls))
-  =
-  begin match ls with
-  | Hashmap_List_Cons ckey cvalue tl ->
-    if ckey = key
-    then Return (Hashmap_List_Cons ckey value tl)
+    then Return (false, Hashmap_List_Cons ckey value tl)
     else
-      let* tl0 = hashmap_HashMap_insert_in_list_loop_back t key value tl in
-      Return (Hashmap_List_Cons ckey cvalue tl0)
+      let* (b, back) = hashmap_HashMap_insert_in_list_loop t key value tl in
+      Return (b, Hashmap_List_Cons ckey cvalue back)
   | Hashmap_List_Nil ->
-    let l = Hashmap_List_Nil in Return (Hashmap_List_Cons key value l)
+    let l = Hashmap_List_Nil in Return (true, Hashmap_List_Cons key value l)
   end
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: backward function 0
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]:
     Source: 'src/hashmap.rs', lines 97:4-97:71 *)
-let hashmap_HashMap_insert_in_list_back
+let hashmap_HashMap_insert_in_list
   (t : Type0) (key : usize) (value : t) (ls : hashmap_List_t t) :
-  result (hashmap_List_t t)
+  result (bool & (hashmap_List_t t))
   =
-  hashmap_HashMap_insert_in_list_loop_back t key value ls
+  hashmap_HashMap_insert_in_list_loop t key value ls
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]:
     Source: 'src/hashmap.rs', lines 117:4-117:54 *)
 let hashmap_HashMap_insert_no_resize
   (t : Type0) (self : hashmap_HashMap_t t) (key : usize) (value : t) :
@@ -150,30 +126,19 @@ let hashmap_HashMap_insert_no_resize
   let* hash = hashmap_hash_key key in
   let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
   let* hash_mod = usize_rem hash i in
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (hashmap_List_t t) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
       self.slots hash_mod in
-  let* inserted = hashmap_HashMap_insert_in_list t key value l in
+  let* (inserted, l1) = hashmap_HashMap_insert_in_list t key value l in
   if inserted
   then
-    let* i0 = usize_add self.num_entries 1 in
-    let* l0 = hashmap_HashMap_insert_in_list_back t key value l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-        self.slots hash_mod l0 in
-    Return { self with num_entries = i0; slots = v }
-  else
-    let* l0 = hashmap_HashMap_insert_in_list_back t key value l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-        self.slots hash_mod l0 in
-    Return { self with slots = v }
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+    let* i1 = usize_add self.num_entries 1 in
+    let* v = index_mut_back l1 in
+    Return { self with num_entries = i1; slots = v }
+  else let* v = index_mut_back l1 in Return { self with slots = v }
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 183:4-196:5 *)
 let rec hashmap_HashMap_move_elements_from_list_loop
   (t : Type0) (ntable : hashmap_HashMap_t t) (ls : hashmap_List_t t) :
@@ -183,13 +148,12 @@ let rec hashmap_HashMap_move_elements_from_list_loop
   =
   begin match ls with
   | Hashmap_List_Cons k v tl ->
-    let* ntable0 = hashmap_HashMap_insert_no_resize t ntable k v in
-    hashmap_HashMap_move_elements_from_list_loop t ntable0 tl
+    let* hm = hashmap_HashMap_insert_no_resize t ntable k v in
+    hashmap_HashMap_move_elements_from_list_loop t hm tl
   | Hashmap_List_Nil -> Return ntable
   end
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]:
     Source: 'src/hashmap.rs', lines 183:4-183:72 *)
 let hashmap_HashMap_move_elements_from_list
   (t : Type0) (ntable : hashmap_HashMap_t t) (ls : hashmap_List_t t) :
@@ -197,8 +161,7 @@ let hashmap_HashMap_move_elements_from_list
   =
   hashmap_HashMap_move_elements_from_list_loop t ntable ls
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0:
     Source: 'src/hashmap.rs', lines 171:4-180:5 *)
 let rec hashmap_HashMap_move_elements_loop
   (t : Type0) (ntable : hashmap_HashMap_t t)
@@ -206,68 +169,64 @@ let rec hashmap_HashMap_move_elements_loop
   Tot (result ((hashmap_HashMap_t t) & (alloc_vec_Vec (hashmap_List_t t))))
   (decreases (hashmap_HashMap_move_elements_loop_decreases t ntable slots i))
   =
-  let i0 = alloc_vec_Vec_len (hashmap_List_t t) slots in
-  if i < i0
+  let i1 = alloc_vec_Vec_len (hashmap_List_t t) slots in
+  if i < i1
   then
-    let* l =
+    let* (l, index_mut_back) =
       alloc_vec_Vec_index_mut (hashmap_List_t t) usize
         (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t)) slots i
       in
-    let ls = core_mem_replace (hashmap_List_t t) l Hashmap_List_Nil in
-    let* ntable0 = hashmap_HashMap_move_elements_from_list t ntable ls in
-    let* i1 = usize_add i 1 in
-    let l0 = core_mem_replace_back (hashmap_List_t t) l Hashmap_List_Nil in
-    let* slots0 =
-      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t)) slots i
-        l0 in
-    hashmap_HashMap_move_elements_loop t ntable0 slots0 i1
+    let (ls, l1) = core_mem_replace (hashmap_List_t t) l Hashmap_List_Nil in
+    let* hm = hashmap_HashMap_move_elements_from_list t ntable ls in
+    let* i2 = usize_add i 1 in
+    let* slots1 = index_mut_back l1 in
+    let* back_'a = hashmap_HashMap_move_elements_loop t hm slots1 i2 in
+    let (hm1, v) = back_'a in
+    Return (hm1, v)
   else Return (ntable, slots)
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]:
     Source: 'src/hashmap.rs', lines 171:4-171:95 *)
 let hashmap_HashMap_move_elements
   (t : Type0) (ntable : hashmap_HashMap_t t)
   (slots : alloc_vec_Vec (hashmap_List_t t)) (i : usize) :
   result ((hashmap_HashMap_t t) & (alloc_vec_Vec (hashmap_List_t t)))
   =
-  hashmap_HashMap_move_elements_loop t ntable slots i
+  let* back_'a = hashmap_HashMap_move_elements_loop t ntable slots i in
+  let (hm, v) = back_'a in
+  Return (hm, v)
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]:
     Source: 'src/hashmap.rs', lines 140:4-140:28 *)
 let hashmap_HashMap_try_resize
   (t : Type0) (self : hashmap_HashMap_t t) : result (hashmap_HashMap_t t) =
   let* max_usize = scalar_cast U32 Usize core_u32_max in
   let capacity = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
   let* n1 = usize_div max_usize 2 in
-  let (i, i0) = self.max_load_factor in
-  let* i1 = usize_div n1 i in
-  if capacity <= i1
+  let (i, i1) = self.max_load_factor in
+  let* i2 = usize_div n1 i in
+  if capacity <= i2
   then
-    let* i2 = usize_mul capacity 2 in
-    let* ntable = hashmap_HashMap_new_with_capacity t i2 i i0 in
-    let* (ntable0, _) = hashmap_HashMap_move_elements t ntable self.slots 0 in
+    let* i3 = usize_mul capacity 2 in
+    let* ntable = hashmap_HashMap_new_with_capacity t i3 i i1 in
+    let* p = hashmap_HashMap_move_elements t ntable self.slots 0 in
+    let (ntable1, _) = p in
     Return
-      { ntable0 with num_entries = self.num_entries; max_load_factor = (i, i0)
+      { ntable1 with num_entries = self.num_entries; max_load_factor = (i, i1)
       }
-  else Return { self with max_load_factor = (i, i0) }
+  else Return { self with max_load_factor = (i, i1) }
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]:
     Source: 'src/hashmap.rs', lines 129:4-129:48 *)
 let hashmap_HashMap_insert
   (t : Type0) (self : hashmap_HashMap_t t) (key : usize) (value : t) :
   result (hashmap_HashMap_t t)
   =
-  let* self0 = hashmap_HashMap_insert_no_resize t self key value in
-  let* i = hashmap_HashMap_len t self0 in
-  if i > self0.max_load
-  then hashmap_HashMap_try_resize t self0
-  else Return self0
+  let* hm = hashmap_HashMap_insert_no_resize t self key value in
+  let* i = hashmap_HashMap_len t hm in
+  if i > hm.max_load then hashmap_HashMap_try_resize t hm else Return hm
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 206:4-219:5 *)
 let rec hashmap_HashMap_contains_key_in_list_loop
   (t : Type0) (key : usize) (ls : hashmap_List_t t) :
@@ -275,20 +234,20 @@ let rec hashmap_HashMap_contains_key_in_list_loop
   (decreases (hashmap_HashMap_contains_key_in_list_loop_decreases t key ls))
   =
   begin match ls with
-  | Hashmap_List_Cons ckey x tl ->
+  | Hashmap_List_Cons ckey _ tl ->
     if ckey = key
     then Return true
     else hashmap_HashMap_contains_key_in_list_loop t key tl
   | Hashmap_List_Nil -> Return false
   end
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]:
     Source: 'src/hashmap.rs', lines 206:4-206:68 *)
 let hashmap_HashMap_contains_key_in_list
   (t : Type0) (key : usize) (ls : hashmap_List_t t) : result bool =
   hashmap_HashMap_contains_key_in_list_loop t key ls
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]:
     Source: 'src/hashmap.rs', lines 199:4-199:49 *)
 let hashmap_HashMap_contains_key
   (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result bool =
@@ -301,7 +260,7 @@ let hashmap_HashMap_contains_key
       self.slots hash_mod in
   hashmap_HashMap_contains_key_in_list t key l
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 224:4-237:5 *)
 let rec hashmap_HashMap_get_in_list_loop
   (t : Type0) (key : usize) (ls : hashmap_List_t t) :
@@ -316,13 +275,13 @@ let rec hashmap_HashMap_get_in_list_loop
   | Hashmap_List_Nil -> Fail Failure
   end
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]:
     Source: 'src/hashmap.rs', lines 224:4-224:70 *)
 let hashmap_HashMap_get_in_list
   (t : Type0) (key : usize) (ls : hashmap_List_t t) : result t =
   hashmap_HashMap_get_in_list_loop t key ls
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]:
     Source: 'src/hashmap.rs', lines 239:4-239:55 *)
 let hashmap_HashMap_get
   (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result t =
@@ -335,241 +294,162 @@ let hashmap_HashMap_get
       self.slots hash_mod in
   hashmap_HashMap_get_in_list t key l
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0:
     Source: 'src/hashmap.rs', lines 245:4-254:5 *)
 let rec hashmap_HashMap_get_mut_in_list_loop
   (t : Type0) (ls : hashmap_List_t t) (key : usize) :
-  Tot (result t)
-  (decreases (hashmap_HashMap_get_mut_in_list_loop_decreases t ls key))
-  =
-  begin match ls with
-  | Hashmap_List_Cons ckey cvalue tl ->
-    if ckey = key
-    then Return cvalue
-    else hashmap_HashMap_get_mut_in_list_loop t tl key
-  | Hashmap_List_Nil -> Fail Failure
-  end
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: forward function
-    Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-let hashmap_HashMap_get_mut_in_list
-  (t : Type0) (ls : hashmap_List_t t) (key : usize) : result t =
-  hashmap_HashMap_get_mut_in_list_loop t ls key
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
-    Source: 'src/hashmap.rs', lines 245:4-254:5 *)
-let rec hashmap_HashMap_get_mut_in_list_loop_back
-  (t : Type0) (ls : hashmap_List_t t) (key : usize) (ret : t) :
-  Tot (result (hashmap_List_t t))
+  Tot (result (t & (t -> result (hashmap_List_t t))))
   (decreases (hashmap_HashMap_get_mut_in_list_loop_decreases t ls key))
   =
   begin match ls with
   | Hashmap_List_Cons ckey cvalue tl ->
     if ckey = key
-    then Return (Hashmap_List_Cons ckey ret tl)
+    then
+      let back_'a = fun ret -> Return (Hashmap_List_Cons ckey ret tl) in
+      Return (cvalue, back_'a)
     else
-      let* tl0 = hashmap_HashMap_get_mut_in_list_loop_back t tl key ret in
-      Return (Hashmap_List_Cons ckey cvalue tl0)
+      let* (x, back_'a) = hashmap_HashMap_get_mut_in_list_loop t tl key in
+      let back_'a1 =
+        fun ret ->
+          let* tl1 = back_'a ret in Return (Hashmap_List_Cons ckey cvalue tl1)
+        in
+      Return (x, back_'a1)
   | Hashmap_List_Nil -> Fail Failure
   end
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]:
     Source: 'src/hashmap.rs', lines 245:4-245:86 *)
-let hashmap_HashMap_get_mut_in_list_back
-  (t : Type0) (ls : hashmap_List_t t) (key : usize) (ret : t) :
-  result (hashmap_List_t t)
+let hashmap_HashMap_get_mut_in_list
+  (t : Type0) (ls : hashmap_List_t t) (key : usize) :
+  result (t & (t -> result (hashmap_List_t t)))
   =
-  hashmap_HashMap_get_mut_in_list_loop_back t ls key ret
+  let* (x, back_'a) = hashmap_HashMap_get_mut_in_list_loop t ls key in
+  let back_'a1 = fun ret -> back_'a ret in
+  Return (x, back_'a1)
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]:
     Source: 'src/hashmap.rs', lines 257:4-257:67 *)
 let hashmap_HashMap_get_mut
-  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result t =
-  let* hash = hashmap_hash_key key in
-  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
-  let* hash_mod = usize_rem hash i in
-  let* l =
-    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-      self.slots hash_mod in
-  hashmap_HashMap_get_mut_in_list t l key
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: backward function 0
-    Source: 'src/hashmap.rs', lines 257:4-257:67 *)
-let hashmap_HashMap_get_mut_back
-  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) (ret : t) :
-  result (hashmap_HashMap_t t)
+  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) :
+  result (t & (t -> result (hashmap_HashMap_t t)))
   =
   let* hash = hashmap_hash_key key in
   let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
   let* hash_mod = usize_rem hash i in
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (hashmap_List_t t) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
       self.slots hash_mod in
-  let* l0 = hashmap_HashMap_get_mut_in_list_back t l key ret in
-  let* v =
-    alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-      self.slots hash_mod l0 in
-  Return { self with slots = v }
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
+  let* (x, get_mut_in_list_back) = hashmap_HashMap_get_mut_in_list t l key in
+  let back_'a =
+    fun ret ->
+      let* l1 = get_mut_in_list_back ret in
+      let* v = index_mut_back l1 in
+      Return { self with slots = v } in
+  Return (x, back_'a)
+
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0:
     Source: 'src/hashmap.rs', lines 265:4-291:5 *)
 let rec hashmap_HashMap_remove_from_list_loop
   (t : Type0) (key : usize) (ls : hashmap_List_t t) :
-  Tot (result (option t))
+  Tot (result ((option t) & (hashmap_List_t t)))
   (decreases (hashmap_HashMap_remove_from_list_loop_decreases t key ls))
   =
   begin match ls with
   | Hashmap_List_Cons ckey x tl ->
     if ckey = key
     then
-      let mv_ls =
+      let (mv_ls, _) =
         core_mem_replace (hashmap_List_t t) (Hashmap_List_Cons ckey x tl)
           Hashmap_List_Nil in
       begin match mv_ls with
-      | Hashmap_List_Cons i cvalue tl0 -> Return (Some cvalue)
-      | Hashmap_List_Nil -> Fail Failure
-      end
-    else hashmap_HashMap_remove_from_list_loop t key tl
-  | Hashmap_List_Nil -> Return None
-  end
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: forward function
-    Source: 'src/hashmap.rs', lines 265:4-265:69 *)
-let hashmap_HashMap_remove_from_list
-  (t : Type0) (key : usize) (ls : hashmap_List_t t) : result (option t) =
-  hashmap_HashMap_remove_from_list_loop t key ls
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
-    Source: 'src/hashmap.rs', lines 265:4-291:5 *)
-let rec hashmap_HashMap_remove_from_list_loop_back
-  (t : Type0) (key : usize) (ls : hashmap_List_t t) :
-  Tot (result (hashmap_List_t t))
-  (decreases (hashmap_HashMap_remove_from_list_loop_decreases t key ls))
-  =
-  begin match ls with
-  | Hashmap_List_Cons ckey x tl ->
-    if ckey = key
-    then
-      let mv_ls =
-        core_mem_replace (hashmap_List_t t) (Hashmap_List_Cons ckey x tl)
-          Hashmap_List_Nil in
-      begin match mv_ls with
-      | Hashmap_List_Cons i cvalue tl0 -> Return tl0
+      | Hashmap_List_Cons _ cvalue tl1 -> Return (Some cvalue, tl1)
       | Hashmap_List_Nil -> Fail Failure
       end
     else
-      let* tl0 = hashmap_HashMap_remove_from_list_loop_back t key tl in
-      Return (Hashmap_List_Cons ckey x tl0)
-  | Hashmap_List_Nil -> Return Hashmap_List_Nil
+      let* (o, back) = hashmap_HashMap_remove_from_list_loop t key tl in
+      Return (o, Hashmap_List_Cons ckey x back)
+  | Hashmap_List_Nil -> Return (None, Hashmap_List_Nil)
   end
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: backward function 1
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]:
     Source: 'src/hashmap.rs', lines 265:4-265:69 *)
-let hashmap_HashMap_remove_from_list_back
+let hashmap_HashMap_remove_from_list
   (t : Type0) (key : usize) (ls : hashmap_List_t t) :
-  result (hashmap_List_t t)
+  result ((option t) & (hashmap_List_t t))
   =
-  hashmap_HashMap_remove_from_list_loop_back t key ls
+  hashmap_HashMap_remove_from_list_loop t key ls
 
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: forward function
+(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]:
     Source: 'src/hashmap.rs', lines 294:4-294:52 *)
 let hashmap_HashMap_remove
-  (t : Type0) (self : hashmap_HashMap_t t) (key : usize) : result (option t) =
-  let* hash = hashmap_hash_key key in
-  let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
-  let* hash_mod = usize_rem hash i in
-  let* l =
-    alloc_vec_Vec_index_mut (hashmap_List_t t) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-      self.slots hash_mod in
-  let* x = hashmap_HashMap_remove_from_list t key l in
-  begin match x with
-  | None -> Return None
-  | Some x0 -> let* _ = usize_sub self.num_entries 1 in Return (Some x0)
-  end
-
-(** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: backward function 0
-    Source: 'src/hashmap.rs', lines 294:4-294:52 *)
-let hashmap_HashMap_remove_back
   (t : Type0) (self : hashmap_HashMap_t t) (key : usize) :
-  result (hashmap_HashMap_t t)
+  result ((option t) & (hashmap_HashMap_t t))
   =
   let* hash = hashmap_hash_key key in
   let i = alloc_vec_Vec_len (hashmap_List_t t) self.slots in
   let* hash_mod = usize_rem hash i in
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (hashmap_List_t t) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
       self.slots hash_mod in
-  let* x = hashmap_HashMap_remove_from_list t key l in
+  let* (x, l1) = hashmap_HashMap_remove_from_list t key l in
   begin match x with
   | None ->
-    let* l0 = hashmap_HashMap_remove_from_list_back t key l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-        self.slots hash_mod l0 in
-    Return { self with slots = v }
-  | Some x0 ->
-    let* i0 = usize_sub self.num_entries 1 in
-    let* l0 = hashmap_HashMap_remove_from_list_back t key l in
-    let* v =
-      alloc_vec_Vec_index_mut_back (hashmap_List_t t) usize
-        (core_slice_index_SliceIndexUsizeSliceTInst (hashmap_List_t t))
-        self.slots hash_mod l0 in
-    Return { self with num_entries = i0; slots = v }
+    let* v = index_mut_back l1 in Return (None, { self with slots = v })
+  | Some x1 ->
+    let* i1 = usize_sub self.num_entries 1 in
+    let* v = index_mut_back l1 in
+    Return (Some x1, { self with num_entries = i1; slots = v })
   end
 
-(** [hashmap_main::hashmap::test1]: forward function
+(** [hashmap_main::hashmap::test1]:
     Source: 'src/hashmap.rs', lines 315:0-315:10 *)
 let hashmap_test1 : result unit =
   let* hm = hashmap_HashMap_new u64 in
-  let* hm0 = hashmap_HashMap_insert u64 hm 0 42 in
-  let* hm1 = hashmap_HashMap_insert u64 hm0 128 18 in
-  let* hm2 = hashmap_HashMap_insert u64 hm1 1024 138 in
-  let* hm3 = hashmap_HashMap_insert u64 hm2 1056 256 in
-  let* i = hashmap_HashMap_get u64 hm3 128 in
+  let* hm1 = hashmap_HashMap_insert u64 hm 0 42 in
+  let* hm2 = hashmap_HashMap_insert u64 hm1 128 18 in
+  let* hm3 = hashmap_HashMap_insert u64 hm2 1024 138 in
+  let* hm4 = hashmap_HashMap_insert u64 hm3 1056 256 in
+  let* i = hashmap_HashMap_get u64 hm4 128 in
   if not (i = 18)
   then Fail Failure
   else
-    let* hm4 = hashmap_HashMap_get_mut_back u64 hm3 1024 56 in
-    let* i0 = hashmap_HashMap_get u64 hm4 1024 in
-    if not (i0 = 56)
+    let* (_, get_mut_back) = hashmap_HashMap_get_mut u64 hm4 1024 in
+    let* hm5 = get_mut_back 56 in
+    let* i1 = hashmap_HashMap_get u64 hm5 1024 in
+    if not (i1 = 56)
     then Fail Failure
     else
-      let* x = hashmap_HashMap_remove u64 hm4 1024 in
+      let* (x, hm6) = hashmap_HashMap_remove u64 hm5 1024 in
       begin match x with
       | None -> Fail Failure
-      | Some x0 ->
-        if not (x0 = 56)
+      | Some x1 ->
+        if not (x1 = 56)
         then Fail Failure
         else
-          let* hm5 = hashmap_HashMap_remove_back u64 hm4 1024 in
-          let* i1 = hashmap_HashMap_get u64 hm5 0 in
-          if not (i1 = 42)
+          let* i2 = hashmap_HashMap_get u64 hm6 0 in
+          if not (i2 = 42)
           then Fail Failure
           else
-            let* i2 = hashmap_HashMap_get u64 hm5 128 in
-            if not (i2 = 18)
+            let* i3 = hashmap_HashMap_get u64 hm6 128 in
+            if not (i3 = 18)
             then Fail Failure
             else
-              let* i3 = hashmap_HashMap_get u64 hm5 1056 in
-              if not (i3 = 256) then Fail Failure else Return ()
+              let* i4 = hashmap_HashMap_get u64 hm6 1056 in
+              if not (i4 = 256) then Fail Failure else Return ()
       end
 
-(** [hashmap_main::insert_on_disk]: forward function
+(** [hashmap_main::insert_on_disk]:
     Source: 'src/hashmap_main.rs', lines 7:0-7:43 *)
 let insert_on_disk
   (key : usize) (value : u64) (st : state) : result (state & unit) =
-  let* (st0, hm) = hashmap_utils_deserialize st in
-  let* hm0 = hashmap_HashMap_insert u64 hm key value in
-  let* (st1, _) = hashmap_utils_serialize hm0 st0 in
-  Return (st1, ())
+  let* (st1, hm) = hashmap_utils_deserialize st in
+  let* hm1 = hashmap_HashMap_insert u64 hm key value in
+  let* (st2, _) = hashmap_utils_serialize hm1 st1 in
+  Return (st2, ())
 
-(** [hashmap_main::main]: forward function
+(** [hashmap_main::main]:
     Source: 'src/hashmap_main.rs', lines 16:0-16:13 *)
 let main : result unit =
   Return ()
diff --git a/tests/fstar/hashmap_on_disk/HashmapMain.FunsExternal.fsti b/tests/fstar/hashmap_on_disk/HashmapMain.FunsExternal.fsti
index b00bbcde..50a6509f 100644
--- a/tests/fstar/hashmap_on_disk/HashmapMain.FunsExternal.fsti
+++ b/tests/fstar/hashmap_on_disk/HashmapMain.FunsExternal.fsti
@@ -6,12 +6,12 @@ include HashmapMain.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [hashmap_main::hashmap_utils::deserialize]: forward function
+(** [hashmap_main::hashmap_utils::deserialize]:
     Source: 'src/hashmap_utils.rs', lines 10:0-10:43 *)
 val hashmap_utils_deserialize
   : state -> result (state & (hashmap_HashMap_t u64))
 
-(** [hashmap_main::hashmap_utils::serialize]: forward function
+(** [hashmap_main::hashmap_utils::serialize]:
     Source: 'src/hashmap_utils.rs', lines 5:0-5:42 *)
 val hashmap_utils_serialize
   : hashmap_HashMap_t u64 -> state -> result (state & unit)
diff --git a/tests/fstar/hashmap_on_disk/Primitives.fst b/tests/fstar/hashmap_on_disk/Primitives.fst
index a3ffbde4..fca80829 100644
--- a/tests/fstar/hashmap_on_disk/Primitives.fst
+++ b/tests/fstar/hashmap_on_disk/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -535,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -552,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -559,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
@@ -588,8 +603,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +625,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +636,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +658,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +684,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +703,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +718,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +738,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +754,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +762,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +781,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +796,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +809,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +827,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +842,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/fstar/misc/Bitwise.fst b/tests/fstar/misc/Bitwise.fst
index d7ba2c57..7330f07a 100644
--- a/tests/fstar/misc/Bitwise.fst
+++ b/tests/fstar/misc/Bitwise.fst
@@ -5,27 +5,27 @@ open Primitives
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [bitwise::shift_u32]: forward function
+(** [bitwise::shift_u32]:
     Source: 'src/bitwise.rs', lines 3:0-3:31 *)
 let shift_u32 (a : u32) : result u32 =
   let* t = u32_shr #Usize a 16 in u32_shl #Usize t 16
 
-(** [bitwise::shift_i32]: forward function
+(** [bitwise::shift_i32]:
     Source: 'src/bitwise.rs', lines 10:0-10:31 *)
 let shift_i32 (a : i32) : result i32 =
   let* t = i32_shr #Isize a 16 in i32_shl #Isize t 16
 
-(** [bitwise::xor_u32]: forward function
+(** [bitwise::xor_u32]:
     Source: 'src/bitwise.rs', lines 17:0-17:37 *)
 let xor_u32 (a : u32) (b : u32) : result u32 =
   Return (u32_xor a b)
 
-(** [bitwise::or_u32]: forward function
+(** [bitwise::or_u32]:
     Source: 'src/bitwise.rs', lines 21:0-21:36 *)
 let or_u32 (a : u32) (b : u32) : result u32 =
   Return (u32_or a b)
 
-(** [bitwise::and_u32]: forward function
+(** [bitwise::and_u32]:
     Source: 'src/bitwise.rs', lines 25:0-25:37 *)
 let and_u32 (a : u32) (b : u32) : result u32 =
   Return (u32_and a b)
diff --git a/tests/fstar/misc/Constants.fst b/tests/fstar/misc/Constants.fst
index daeefbb0..7bf42b46 100644
--- a/tests/fstar/misc/Constants.fst
+++ b/tests/fstar/misc/Constants.fst
@@ -20,7 +20,7 @@ let x1_c : u32 = eval_global x1_body
 let x2_body : result u32 = Return 3
 let x2_c : u32 = eval_global x2_body
 
-(** [constants::incr]: forward function
+(** [constants::incr]:
     Source: 'src/constants.rs', lines 17:0-17:32 *)
 let incr (n : u32) : result u32 =
   u32_add n 1
@@ -30,7 +30,7 @@ let incr (n : u32) : result u32 =
 let x3_body : result u32 = incr 32
 let x3_c : u32 = eval_global x3_body
 
-(** [constants::mk_pair0]: forward function
+(** [constants::mk_pair0]:
     Source: 'src/constants.rs', lines 23:0-23:51 *)
 let mk_pair0 (x : u32) (y : u32) : result (u32 & u32) =
   Return (x, y)
@@ -39,7 +39,7 @@ let mk_pair0 (x : u32) (y : u32) : result (u32 & u32) =
     Source: 'src/constants.rs', lines 36:0-36:23 *)
 type pair_t (t1 t2 : Type0) = { x : t1; y : t2; }
 
-(** [constants::mk_pair1]: forward function
+(** [constants::mk_pair1]:
     Source: 'src/constants.rs', lines 27:0-27:55 *)
 let mk_pair1 (x : u32) (y : u32) : result (pair_t u32 u32) =
   Return { x = x; y = y }
@@ -68,7 +68,7 @@ let p3_c : pair_t u32 u32 = eval_global p3_body
     Source: 'src/constants.rs', lines 49:0-49:18 *)
 type wrap_t (t : Type0) = { value : t; }
 
-(** [constants::{constants::Wrap<T>}::new]: forward function
+(** [constants::{constants::Wrap<T>}::new]:
     Source: 'src/constants.rs', lines 54:4-54:41 *)
 let wrap_new (t : Type0) (value : t) : result (wrap_t t) =
   Return { value = value }
@@ -78,7 +78,7 @@ let wrap_new (t : Type0) (value : t) : result (wrap_t t) =
 let y_body : result (wrap_t i32) = wrap_new i32 2
 let y_c : wrap_t i32 = eval_global y_body
 
-(** [constants::unwrap_y]: forward function
+(** [constants::unwrap_y]:
     Source: 'src/constants.rs', lines 43:0-43:30 *)
 let unwrap_y : result i32 =
   Return y_c.value
@@ -93,12 +93,12 @@ let yval_c : i32 = eval_global yval_body
 let get_z1_z1_body : result i32 = Return 3
 let get_z1_z1_c : i32 = eval_global get_z1_z1_body
 
-(** [constants::get_z1]: forward function
+(** [constants::get_z1]:
     Source: 'src/constants.rs', lines 61:0-61:28 *)
 let get_z1 : result i32 =
   Return get_z1_z1_c
 
-(** [constants::add]: forward function
+(** [constants::add]:
     Source: 'src/constants.rs', lines 66:0-66:39 *)
 let add (a : i32) (b : i32) : result i32 =
   i32_add a b
@@ -118,10 +118,10 @@ let q2_c : i32 = eval_global q2_body
 let q3_body : result i32 = add q2_c 3
 let q3_c : i32 = eval_global q3_body
 
-(** [constants::get_z2]: forward function
+(** [constants::get_z2]:
     Source: 'src/constants.rs', lines 70:0-70:28 *)
 let get_z2 : result i32 =
-  let* i = get_z1 in let* i0 = add i q3_c in add q1_c i0
+  let* i = get_z1 in let* i1 = add i q3_c in add q1_c i1
 
 (** [constants::S1]
     Source: 'src/constants.rs', lines 80:0-80:18 *)
diff --git a/tests/fstar/misc/External.Funs.fst b/tests/fstar/misc/External.Funs.fst
index 00995634..bb1b9a64 100644
--- a/tests/fstar/misc/External.Funs.fst
+++ b/tests/fstar/misc/External.Funs.fst
@@ -7,33 +7,19 @@ include External.FunsExternal
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [external::swap]: forward function
+(** [external::swap]:
     Source: 'src/external.rs', lines 6:0-6:46 *)
-let swap (t : Type0) (x : t) (y : t) (st : state) : result (state & unit) =
-  let* (st0, _) = core_mem_swap t x y st in
-  let* (st1, _) = core_mem_swap_back0 t x y st st0 in
-  let* (st2, _) = core_mem_swap_back1 t x y st st1 in
-  Return (st2, ())
+let swap (t : Type0) (x : t) (y : t) (st : state) : result (state & (t & t)) =
+  core_mem_swap t x y st
 
-(** [external::swap]: backward function 0
-    Source: 'src/external.rs', lines 6:0-6:46 *)
-let swap_back
-  (t : Type0) (x : t) (y : t) (st : state) (st0 : state) :
-  result (state & (t & t))
-  =
-  let* (st1, _) = core_mem_swap t x y st in
-  let* (st2, x0) = core_mem_swap_back0 t x y st st1 in
-  let* (_, y0) = core_mem_swap_back1 t x y st st2 in
-  Return (st0, (x0, y0))
-
-(** [external::test_new_non_zero_u32]: forward function
+(** [external::test_new_non_zero_u32]:
     Source: 'src/external.rs', lines 11:0-11:60 *)
 let test_new_non_zero_u32
   (x : u32) (st : state) : result (state & core_num_nonzero_NonZeroU32_t) =
-  let* (st0, o) = core_num_nonzero_NonZeroU32_new x st in
-  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st0
+  let* (st1, o) = core_num_nonzero_NonZeroU32_new x st in
+  core_option_Option_unwrap core_num_nonzero_NonZeroU32_t o st1
 
-(** [external::test_vec]: forward function
+(** [external::test_vec]:
     Source: 'src/external.rs', lines 17:0-17:17 *)
 let test_vec : result unit =
   let v = alloc_vec_Vec_new u32 in
@@ -43,42 +29,28 @@ let test_vec : result unit =
 (** Unit test for [external::test_vec] *)
 let _ = assert_norm (test_vec = Return ())
 
-(** [external::custom_swap]: forward function
-    Source: 'src/external.rs', lines 24:0-24:66 *)
-let custom_swap (t : Type0) (x : t) (y : t) (st : state) : result (state & t) =
-  let* (st0, _) = core_mem_swap t x y st in
-  let* (st1, x0) = core_mem_swap_back0 t x y st st0 in
-  let* (st2, _) = core_mem_swap_back1 t x y st st1 in
-  Return (st2, x0)
-
-(** [external::custom_swap]: backward function 0
+(** [external::custom_swap]:
     Source: 'src/external.rs', lines 24:0-24:66 *)
-let custom_swap_back
-  (t : Type0) (x : t) (y : t) (st : state) (ret : t) (st0 : state) :
-  result (state & (t & t))
+let custom_swap
+  (t : Type0) (x : t) (y : t) (st : state) :
+  result (state & (t & (t -> state -> result (state & (t & t)))))
   =
-  let* (st1, _) = core_mem_swap t x y st in
-  let* (st2, _) = core_mem_swap_back0 t x y st st1 in
-  let* (_, y0) = core_mem_swap_back1 t x y st st2 in
-  Return (st0, (ret, y0))
-
-(** [external::test_custom_swap]: forward function
-    Source: 'src/external.rs', lines 29:0-29:59 *)
-let test_custom_swap (x : u32) (y : u32) (st : state) : result (state & unit) =
-  let* (st0, _) = custom_swap u32 x y st in Return (st0, ())
+  let* (st1, (x1, x2)) = core_mem_swap t x y st in
+  let back_'a = fun ret st2 -> Return (st2, (ret, x2)) in
+  Return (st1, (x1, back_'a))
 
-(** [external::test_custom_swap]: backward function 0
+(** [external::test_custom_swap]:
     Source: 'src/external.rs', lines 29:0-29:59 *)
-let test_custom_swap_back
-  (x : u32) (y : u32) (st : state) (st0 : state) :
-  result (state & (u32 & u32))
-  =
-  custom_swap_back u32 x y st 1 st0
+let test_custom_swap
+  (x : u32) (y : u32) (st : state) : result (state & (u32 & u32)) =
+  let* (st1, (_, custom_swap_back)) = custom_swap u32 x y st in
+  let* (_, (x1, y1)) = custom_swap_back 1 st1 in
+  Return (st1, (x1, y1))
 
-(** [external::test_swap_non_zero]: forward function
+(** [external::test_swap_non_zero]:
     Source: 'src/external.rs', lines 35:0-35:44 *)
 let test_swap_non_zero (x : u32) (st : state) : result (state & u32) =
-  let* (st0, _) = swap u32 x 0 st in
-  let* (st1, (x0, _)) = swap_back u32 x 0 st st0 in
-  if x0 = 0 then Fail Failure else Return (st1, x0)
+  let* (st1, p) = swap u32 x 0 st in
+  let (x1, _) = p in
+  if x1 = 0 then Fail Failure else Return (st1, x1)
 
diff --git a/tests/fstar/misc/External.FunsExternal.fsti b/tests/fstar/misc/External.FunsExternal.fsti
index 923a1101..a412aea9 100644
--- a/tests/fstar/misc/External.FunsExternal.fsti
+++ b/tests/fstar/misc/External.FunsExternal.fsti
@@ -6,26 +6,16 @@ include External.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [core::mem::swap]: forward function
+(** [core::mem::swap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-val core_mem_swap (t : Type0) : t -> t -> state -> result (state & unit)
+val core_mem_swap (t : Type0) : t -> t -> state -> result (state & (t & t))
 
-(** [core::mem::swap]: backward function 0
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-val core_mem_swap_back0
-  (t : Type0) : t -> t -> state -> state -> result (state & t)
-
-(** [core::mem::swap]: backward function 1
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-val core_mem_swap_back1
-  (t : Type0) : t -> t -> state -> state -> result (state & t)
-
-(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]: forward function
+(** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/num/nonzero.rs', lines 79:16-79:57 *)
 val core_num_nonzero_NonZeroU32_new
   : u32 -> state -> result (state & (option core_num_nonzero_NonZeroU32_t))
 
-(** [core::option::{core::option::Option<T>}::unwrap]: forward function
+(** [core::option::{core::option::Option<T>}::unwrap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 *)
 val core_option_Option_unwrap
   (t : Type0) : option t -> state -> result (state & t)
diff --git a/tests/fstar/misc/Loops.Funs.fst b/tests/fstar/misc/Loops.Funs.fst
index d2ac5561..a047c170 100644
--- a/tests/fstar/misc/Loops.Funs.fst
+++ b/tests/fstar/misc/Loops.Funs.fst
@@ -7,22 +7,22 @@ include Loops.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [loops::sum]: loop 0: forward function
+(** [loops::sum]: loop 0:
     Source: 'src/loops.rs', lines 4:0-14:1 *)
 let rec sum_loop
   (max : u32) (i : u32) (s : u32) :
   Tot (result u32) (decreases (sum_loop_decreases max i s))
   =
   if i < max
-  then let* s0 = u32_add s i in let* i0 = u32_add i 1 in sum_loop max i0 s0
+  then let* s1 = u32_add s i in let* i1 = u32_add i 1 in sum_loop max i1 s1
   else u32_mul s 2
 
-(** [loops::sum]: forward function
+(** [loops::sum]:
     Source: 'src/loops.rs', lines 4:0-4:27 *)
 let sum (max : u32) : result u32 =
   sum_loop max 0 0
 
-(** [loops::sum_with_mut_borrows]: loop 0: forward function
+(** [loops::sum_with_mut_borrows]: loop 0:
     Source: 'src/loops.rs', lines 19:0-31:1 *)
 let rec sum_with_mut_borrows_loop
   (max : u32) (mi : u32) (ms : u32) :
@@ -30,17 +30,17 @@ let rec sum_with_mut_borrows_loop
   =
   if mi < max
   then
-    let* ms0 = u32_add ms mi in
-    let* mi0 = u32_add mi 1 in
-    sum_with_mut_borrows_loop max mi0 ms0
+    let* ms1 = u32_add ms mi in
+    let* mi1 = u32_add mi 1 in
+    sum_with_mut_borrows_loop max mi1 ms1
   else u32_mul ms 2
 
-(** [loops::sum_with_mut_borrows]: forward function
+(** [loops::sum_with_mut_borrows]:
     Source: 'src/loops.rs', lines 19:0-19:44 *)
 let sum_with_mut_borrows (max : u32) : result u32 =
   sum_with_mut_borrows_loop max 0 0
 
-(** [loops::sum_with_shared_borrows]: loop 0: forward function
+(** [loops::sum_with_shared_borrows]: loop 0:
     Source: 'src/loops.rs', lines 34:0-48:1 *)
 let rec sum_with_shared_borrows_loop
   (max : u32) (i : u32) (s : u32) :
@@ -48,40 +48,39 @@ let rec sum_with_shared_borrows_loop
   =
   if i < max
   then
-    let* i0 = u32_add i 1 in
-    let* s0 = u32_add s i0 in
-    sum_with_shared_borrows_loop max i0 s0
+    let* i1 = u32_add i 1 in
+    let* s1 = u32_add s i1 in
+    sum_with_shared_borrows_loop max i1 s1
   else u32_mul s 2
 
-(** [loops::sum_with_shared_borrows]: forward function
+(** [loops::sum_with_shared_borrows]:
     Source: 'src/loops.rs', lines 34:0-34:47 *)
 let sum_with_shared_borrows (max : u32) : result u32 =
   sum_with_shared_borrows_loop max 0 0
 
-(** [loops::clear]: loop 0: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [loops::clear]: loop 0:
     Source: 'src/loops.rs', lines 52:0-58:1 *)
 let rec clear_loop
   (v : alloc_vec_Vec u32) (i : usize) :
   Tot (result (alloc_vec_Vec u32)) (decreases (clear_loop_decreases v i))
   =
-  let i0 = alloc_vec_Vec_len u32 v in
-  if i < i0
+  let i1 = alloc_vec_Vec_len u32 v in
+  if i < i1
   then
-    let* i1 = usize_add i 1 in
-    let* v0 =
-      alloc_vec_Vec_index_mut_back u32 usize
-        (core_slice_index_SliceIndexUsizeSliceTInst u32) v i 0 in
-    clear_loop v0 i1
+    let* (_, index_mut_back) =
+      alloc_vec_Vec_index_mut u32 usize
+        (core_slice_index_SliceIndexUsizeSliceTInst u32) v i in
+    let* i2 = usize_add i 1 in
+    let* v1 = index_mut_back 0 in
+    clear_loop v1 i2
   else Return v
 
-(** [loops::clear]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [loops::clear]:
     Source: 'src/loops.rs', lines 52:0-52:30 *)
 let clear (v : alloc_vec_Vec u32) : result (alloc_vec_Vec u32) =
   clear_loop v 0
 
-(** [loops::list_mem]: loop 0: forward function
+(** [loops::list_mem]: loop 0:
     Source: 'src/loops.rs', lines 66:0-75:1 *)
 let rec list_mem_loop
   (x : u32) (ls : list_t u32) :
@@ -92,54 +91,41 @@ let rec list_mem_loop
   | List_Nil -> Return false
   end
 
-(** [loops::list_mem]: forward function
+(** [loops::list_mem]:
     Source: 'src/loops.rs', lines 66:0-66:52 *)
 let list_mem (x : u32) (ls : list_t u32) : result bool =
   list_mem_loop x ls
 
-(** [loops::list_nth_mut_loop]: loop 0: forward function
+(** [loops::list_nth_mut_loop]: loop 0:
     Source: 'src/loops.rs', lines 78:0-88:1 *)
 let rec list_nth_mut_loop_loop
   (t : Type0) (ls : list_t t) (i : u32) :
-  Tot (result t) (decreases (list_nth_mut_loop_loop_decreases t ls i))
+  Tot (result (t & (t -> result (list_t t))))
+  (decreases (list_nth_mut_loop_loop_decreases t ls i))
   =
   begin match ls with
   | List_Cons x tl ->
     if i = 0
-    then Return x
-    else let* i0 = u32_sub i 1 in list_nth_mut_loop_loop t tl i0
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_loop]: forward function
-    Source: 'src/loops.rs', lines 78:0-78:71 *)
-let list_nth_mut_loop (t : Type0) (ls : list_t t) (i : u32) : result t =
-  list_nth_mut_loop_loop t ls i
-
-(** [loops::list_nth_mut_loop]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 78:0-88:1 *)
-let rec list_nth_mut_loop_loop_back
-  (t : Type0) (ls : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t)) (decreases (list_nth_mut_loop_loop_decreases t ls i))
-  =
-  begin match ls with
-  | List_Cons x tl ->
-    if i = 0
-    then Return (List_Cons ret tl)
+    then let back = fun ret -> Return (List_Cons ret tl) in Return (x, back)
     else
-      let* i0 = u32_sub i 1 in
-      let* tl0 = list_nth_mut_loop_loop_back t tl i0 ret in
-      Return (List_Cons x tl0)
+      let* i1 = u32_sub i 1 in
+      let* (x1, back) = list_nth_mut_loop_loop t tl i1 in
+      let back1 = fun ret -> let* tl1 = back ret in Return (List_Cons x tl1) in
+      Return (x1, back1)
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop]: backward function 0
+(** [loops::list_nth_mut_loop]:
     Source: 'src/loops.rs', lines 78:0-78:71 *)
-let list_nth_mut_loop_back
-  (t : Type0) (ls : list_t t) (i : u32) (ret : t) : result (list_t t) =
-  list_nth_mut_loop_loop_back t ls i ret
+let list_nth_mut_loop
+  (t : Type0) (ls : list_t t) (i : u32) :
+  result (t & (t -> result (list_t t)))
+  =
+  let* (x, back) = list_nth_mut_loop_loop t ls i in
+  let back1 = fun ret -> back ret in
+  Return (x, back1)
 
-(** [loops::list_nth_shared_loop]: loop 0: forward function
+(** [loops::list_nth_shared_loop]: loop 0:
     Source: 'src/loops.rs', lines 91:0-101:1 *)
 let rec list_nth_shared_loop_loop
   (t : Type0) (ls : list_t t) (i : u32) :
@@ -149,63 +135,47 @@ let rec list_nth_shared_loop_loop
   | List_Cons x tl ->
     if i = 0
     then Return x
-    else let* i0 = u32_sub i 1 in list_nth_shared_loop_loop t tl i0
+    else let* i1 = u32_sub i 1 in list_nth_shared_loop_loop t tl i1
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop]: forward function
+(** [loops::list_nth_shared_loop]:
     Source: 'src/loops.rs', lines 91:0-91:66 *)
 let list_nth_shared_loop (t : Type0) (ls : list_t t) (i : u32) : result t =
   list_nth_shared_loop_loop t ls i
 
-(** [loops::get_elem_mut]: loop 0: forward function
+(** [loops::get_elem_mut]: loop 0:
     Source: 'src/loops.rs', lines 103:0-117:1 *)
 let rec get_elem_mut_loop
   (x : usize) (ls : list_t usize) :
-  Tot (result usize) (decreases (get_elem_mut_loop_decreases x ls))
-  =
-  begin match ls with
-  | List_Cons y tl -> if y = x then Return y else get_elem_mut_loop x tl
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::get_elem_mut]: forward function
-    Source: 'src/loops.rs', lines 103:0-103:73 *)
-let get_elem_mut
-  (slots : alloc_vec_Vec (list_t usize)) (x : usize) : result usize =
-  let* l =
-    alloc_vec_Vec_index_mut (list_t usize) usize
-      (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 in
-  get_elem_mut_loop x l
-
-(** [loops::get_elem_mut]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 103:0-117:1 *)
-let rec get_elem_mut_loop_back
-  (x : usize) (ls : list_t usize) (ret : usize) :
-  Tot (result (list_t usize)) (decreases (get_elem_mut_loop_decreases x ls))
+  Tot (result (usize & (usize -> result (list_t usize))))
+  (decreases (get_elem_mut_loop_decreases x ls))
   =
   begin match ls with
   | List_Cons y tl ->
     if y = x
-    then Return (List_Cons ret tl)
-    else let* tl0 = get_elem_mut_loop_back x tl ret in Return (List_Cons y tl0)
+    then let back = fun ret -> Return (List_Cons ret tl) in Return (y, back)
+    else
+      let* (i, back) = get_elem_mut_loop x tl in
+      let back1 = fun ret -> let* tl1 = back ret in Return (List_Cons y tl1) in
+      Return (i, back1)
   | List_Nil -> Fail Failure
   end
 
-(** [loops::get_elem_mut]: backward function 0
+(** [loops::get_elem_mut]:
     Source: 'src/loops.rs', lines 103:0-103:73 *)
-let get_elem_mut_back
-  (slots : alloc_vec_Vec (list_t usize)) (x : usize) (ret : usize) :
-  result (alloc_vec_Vec (list_t usize))
+let get_elem_mut
+  (slots : alloc_vec_Vec (list_t usize)) (x : usize) :
+  result (usize & (usize -> result (alloc_vec_Vec (list_t usize))))
   =
-  let* l =
+  let* (l, index_mut_back) =
     alloc_vec_Vec_index_mut (list_t usize) usize
       (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 in
-  let* l0 = get_elem_mut_loop_back x l ret in
-  alloc_vec_Vec_index_mut_back (list_t usize) usize
-    (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 l0
+  let* (i, back) = get_elem_mut_loop x l in
+  let back1 = fun ret -> let* l1 = back ret in index_mut_back l1 in
+  Return (i, back1)
 
-(** [loops::get_elem_shared]: loop 0: forward function
+(** [loops::get_elem_shared]: loop 0:
     Source: 'src/loops.rs', lines 119:0-133:1 *)
 let rec get_elem_shared_loop
   (x : usize) (ls : list_t usize) :
@@ -216,7 +186,7 @@ let rec get_elem_shared_loop
   | List_Nil -> Fail Failure
   end
 
-(** [loops::get_elem_shared]: forward function
+(** [loops::get_elem_shared]:
     Source: 'src/loops.rs', lines 119:0-119:68 *)
 let get_elem_shared
   (slots : alloc_vec_Vec (list_t usize)) (x : usize) : result usize =
@@ -225,69 +195,50 @@ let get_elem_shared
       (core_slice_index_SliceIndexUsizeSliceTInst (list_t usize)) slots 0 in
   get_elem_shared_loop x l
 
-(** [loops::id_mut]: forward function
-    Source: 'src/loops.rs', lines 135:0-135:50 *)
-let id_mut (t : Type0) (ls : list_t t) : result (list_t t) =
-  Return ls
-
-(** [loops::id_mut]: backward function 0
+(** [loops::id_mut]:
     Source: 'src/loops.rs', lines 135:0-135:50 *)
-let id_mut_back
-  (t : Type0) (ls : list_t t) (ret : list_t t) : result (list_t t) =
-  Return ret
+let id_mut
+  (t : Type0) (ls : list_t t) :
+  result ((list_t t) & (list_t t -> result (list_t t)))
+  =
+  let back = fun ret -> Return ret in Return (ls, back)
 
-(** [loops::id_shared]: forward function
+(** [loops::id_shared]:
     Source: 'src/loops.rs', lines 139:0-139:45 *)
 let id_shared (t : Type0) (ls : list_t t) : result (list_t t) =
   Return ls
 
-(** [loops::list_nth_mut_loop_with_id]: loop 0: forward function
+(** [loops::list_nth_mut_loop_with_id]: loop 0:
     Source: 'src/loops.rs', lines 144:0-155:1 *)
 let rec list_nth_mut_loop_with_id_loop
   (t : Type0) (i : u32) (ls : list_t t) :
-  Tot (result t) (decreases (list_nth_mut_loop_with_id_loop_decreases t i ls))
-  =
-  begin match ls with
-  | List_Cons x tl ->
-    if i = 0
-    then Return x
-    else let* i0 = u32_sub i 1 in list_nth_mut_loop_with_id_loop t i0 tl
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_loop_with_id]: forward function
-    Source: 'src/loops.rs', lines 144:0-144:75 *)
-let list_nth_mut_loop_with_id
-  (t : Type0) (ls : list_t t) (i : u32) : result t =
-  let* ls0 = id_mut t ls in list_nth_mut_loop_with_id_loop t i ls0
-
-(** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 144:0-155:1 *)
-let rec list_nth_mut_loop_with_id_loop_back
-  (t : Type0) (i : u32) (ls : list_t t) (ret : t) :
-  Tot (result (list_t t))
+  Tot (result (t & (t -> result (list_t t))))
   (decreases (list_nth_mut_loop_with_id_loop_decreases t i ls))
   =
   begin match ls with
   | List_Cons x tl ->
     if i = 0
-    then Return (List_Cons ret tl)
+    then let back = fun ret -> Return (List_Cons ret tl) in Return (x, back)
     else
-      let* i0 = u32_sub i 1 in
-      let* tl0 = list_nth_mut_loop_with_id_loop_back t i0 tl ret in
-      Return (List_Cons x tl0)
+      let* i1 = u32_sub i 1 in
+      let* (x1, back) = list_nth_mut_loop_with_id_loop t i1 tl in
+      let back1 = fun ret -> let* tl1 = back ret in Return (List_Cons x tl1) in
+      Return (x1, back1)
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_with_id]: backward function 0
+(** [loops::list_nth_mut_loop_with_id]:
     Source: 'src/loops.rs', lines 144:0-144:75 *)
-let list_nth_mut_loop_with_id_back
-  (t : Type0) (ls : list_t t) (i : u32) (ret : t) : result (list_t t) =
-  let* ls0 = id_mut t ls in
-  let* l = list_nth_mut_loop_with_id_loop_back t i ls0 ret in
-  id_mut_back t ls l
+let list_nth_mut_loop_with_id
+  (t : Type0) (ls : list_t t) (i : u32) :
+  result (t & (t -> result (list_t t)))
+  =
+  let* (ls1, id_mut_back) = id_mut t ls in
+  let* (x, back) = list_nth_mut_loop_with_id_loop t i ls1 in
+  let back1 = fun ret -> let* l = back ret in id_mut_back l in
+  Return (x, back1)
 
-(** [loops::list_nth_shared_loop_with_id]: loop 0: forward function
+(** [loops::list_nth_shared_loop_with_id]: loop 0:
     Source: 'src/loops.rs', lines 158:0-169:1 *)
 let rec list_nth_shared_loop_with_id_loop
   (t : Type0) (i : u32) (ls : list_t t) :
@@ -298,46 +249,21 @@ let rec list_nth_shared_loop_with_id_loop
   | List_Cons x tl ->
     if i = 0
     then Return x
-    else let* i0 = u32_sub i 1 in list_nth_shared_loop_with_id_loop t i0 tl
+    else let* i1 = u32_sub i 1 in list_nth_shared_loop_with_id_loop t i1 tl
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop_with_id]: forward function
+(** [loops::list_nth_shared_loop_with_id]:
     Source: 'src/loops.rs', lines 158:0-158:70 *)
 let list_nth_shared_loop_with_id
   (t : Type0) (ls : list_t t) (i : u32) : result t =
-  let* ls0 = id_shared t ls in list_nth_shared_loop_with_id_loop t i ls0
+  let* ls1 = id_shared t ls in list_nth_shared_loop_with_id_loop t i ls1
 
-(** [loops::list_nth_mut_loop_pair]: loop 0: forward function
+(** [loops::list_nth_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 174:0-195:1 *)
 let rec list_nth_mut_loop_pair_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
-  Tot (result (t & t))
-  (decreases (list_nth_mut_loop_pair_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then Return (x0, x1)
-      else let* i0 = u32_sub i 1 in list_nth_mut_loop_pair_loop t tl0 tl1 i0
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_loop_pair]: forward function
-    Source: 'src/loops.rs', lines 174:0-178:27 *)
-let list_nth_mut_loop_pair
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
-  list_nth_mut_loop_pair_loop t ls0 ls1 i
-
-(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 174:0-195:1 *)
-let rec list_nth_mut_loop_pair_loop_back'a
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t))
+  Tot (result ((t & t) & (t -> result (list_t t)) & (t -> result (list_t t))))
   (decreases (list_nth_mut_loop_pair_loop_decreases t ls0 ls1 i))
   =
   begin match ls0 with
@@ -345,55 +271,36 @@ let rec list_nth_mut_loop_pair_loop_back'a
     begin match ls1 with
     | List_Cons x1 tl1 ->
       if i = 0
-      then Return (List_Cons ret tl0)
+      then
+        let back_'a = fun ret -> Return (List_Cons ret tl0) in
+        let back_'b = fun ret -> Return (List_Cons ret tl1) in
+        Return ((x0, x1), back_'a, back_'b)
       else
-        let* i0 = u32_sub i 1 in
-        let* tl00 = list_nth_mut_loop_pair_loop_back'a t tl0 tl1 i0 ret in
-        Return (List_Cons x0 tl00)
+        let* i1 = u32_sub i 1 in
+        let* (p, back_'a, back_'b) = list_nth_mut_loop_pair_loop t tl0 tl1 i1
+          in
+        let back_'a1 =
+          fun ret -> let* tl01 = back_'a ret in Return (List_Cons x0 tl01) in
+        let back_'b1 =
+          fun ret -> let* tl11 = back_'b ret in Return (List_Cons x1 tl11) in
+        Return (p, back_'a1, back_'b1)
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair]: backward function 0
+(** [loops::list_nth_mut_loop_pair]:
     Source: 'src/loops.rs', lines 174:0-178:27 *)
-let list_nth_mut_loop_pair_back'a
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  result (list_t t)
-  =
-  list_nth_mut_loop_pair_loop_back'a t ls0 ls1 i ret
-
-(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1
-    Source: 'src/loops.rs', lines 174:0-195:1 *)
-let rec list_nth_mut_loop_pair_loop_back'b
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t))
-  (decreases (list_nth_mut_loop_pair_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then Return (List_Cons ret tl1)
-      else
-        let* i0 = u32_sub i 1 in
-        let* tl10 = list_nth_mut_loop_pair_loop_back'b t tl0 tl1 i0 ret in
-        Return (List_Cons x1 tl10)
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_loop_pair]: backward function 1
-    Source: 'src/loops.rs', lines 174:0-178:27 *)
-let list_nth_mut_loop_pair_back'b
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  result (list_t t)
+let list_nth_mut_loop_pair
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  result ((t & t) & (t -> result (list_t t)) & (t -> result (list_t t)))
   =
-  list_nth_mut_loop_pair_loop_back'b t ls0 ls1 i ret
+  let* (p, back_'a, back_'b) = list_nth_mut_loop_pair_loop t ls0 ls1 i in
+  let back_'a1 = fun ret -> back_'a ret in
+  let back_'b1 = fun ret -> back_'b ret in
+  Return (p, back_'a1, back_'b1)
 
-(** [loops::list_nth_shared_loop_pair]: loop 0: forward function
+(** [loops::list_nth_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 198:0-219:1 *)
 let rec list_nth_shared_loop_pair_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
@@ -406,23 +313,23 @@ let rec list_nth_shared_loop_pair_loop
     | List_Cons x1 tl1 ->
       if i = 0
       then Return (x0, x1)
-      else let* i0 = u32_sub i 1 in list_nth_shared_loop_pair_loop t tl0 tl1 i0
+      else let* i1 = u32_sub i 1 in list_nth_shared_loop_pair_loop t tl0 tl1 i1
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop_pair]: forward function
+(** [loops::list_nth_shared_loop_pair]:
     Source: 'src/loops.rs', lines 198:0-202:19 *)
 let list_nth_shared_loop_pair
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_shared_loop_pair_loop t ls0 ls1 i
 
-(** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 223:0-238:1 *)
 let rec list_nth_mut_loop_pair_merge_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
-  Tot (result (t & t))
+  Tot (result ((t & t) & ((t & t) -> result ((list_t t) & (list_t t)))))
   (decreases (list_nth_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
   =
   begin match ls0 with
@@ -430,52 +337,35 @@ let rec list_nth_mut_loop_pair_merge_loop
     begin match ls1 with
     | List_Cons x1 tl1 ->
       if i = 0
-      then Return (x0, x1)
+      then
+        let back_'a =
+          fun ret ->
+            let (x, x2) = ret in Return (List_Cons x tl0, List_Cons x2 tl1) in
+        Return ((x0, x1), back_'a)
       else
-        let* i0 = u32_sub i 1 in list_nth_mut_loop_pair_merge_loop t tl0 tl1 i0
+        let* i1 = u32_sub i 1 in
+        let* (p, back_'a) = list_nth_mut_loop_pair_merge_loop t tl0 tl1 i1 in
+        let back_'a1 =
+          fun ret ->
+            let* (tl01, tl11) = back_'a ret in
+            Return (List_Cons x0 tl01, List_Cons x1 tl11) in
+        Return (p, back_'a1)
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair_merge]: forward function
+(** [loops::list_nth_mut_loop_pair_merge]:
     Source: 'src/loops.rs', lines 223:0-227:27 *)
 let list_nth_mut_loop_pair_merge
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
-  list_nth_mut_loop_pair_merge_loop t ls0 ls1 i
-
-(** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 223:0-238:1 *)
-let rec list_nth_mut_loop_pair_merge_loop_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : (t & t)) :
-  Tot (result ((list_t t) & (list_t t)))
-  (decreases (list_nth_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then let (x, x2) = ret in Return (List_Cons x tl0, List_Cons x2 tl1)
-      else
-        let* i0 = u32_sub i 1 in
-        let* (tl00, tl10) =
-          list_nth_mut_loop_pair_merge_loop_back t tl0 tl1 i0 ret in
-        Return (List_Cons x0 tl00, List_Cons x1 tl10)
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 223:0-227:27 *)
-let list_nth_mut_loop_pair_merge_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : (t & t)) :
-  result ((list_t t) & (list_t t))
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  result ((t & t) & ((t & t) -> result ((list_t t) & (list_t t))))
   =
-  list_nth_mut_loop_pair_merge_loop_back t ls0 ls1 i ret
+  let* (p, back_'a) = list_nth_mut_loop_pair_merge_loop t ls0 ls1 i in
+  let back_'a1 = fun ret -> back_'a ret in
+  Return (p, back_'a1)
 
-(** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 241:0-256:1 *)
 let rec list_nth_shared_loop_pair_merge_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
@@ -489,24 +379,24 @@ let rec list_nth_shared_loop_pair_merge_loop
       if i = 0
       then Return (x0, x1)
       else
-        let* i0 = u32_sub i 1 in
-        list_nth_shared_loop_pair_merge_loop t tl0 tl1 i0
+        let* i1 = u32_sub i 1 in
+        list_nth_shared_loop_pair_merge_loop t tl0 tl1 i1
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop_pair_merge]: forward function
+(** [loops::list_nth_shared_loop_pair_merge]:
     Source: 'src/loops.rs', lines 241:0-245:19 *)
 let list_nth_shared_loop_pair_merge
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_shared_loop_pair_merge_loop t ls0 ls1 i
 
-(** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 259:0-274:1 *)
 let rec list_nth_mut_shared_loop_pair_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
-  Tot (result (t & t))
+  Tot (result ((t & t) & (t -> result (list_t t))))
   (decreases (list_nth_mut_shared_loop_pair_loop_decreases t ls0 ls1 i))
   =
   begin match ls0 with
@@ -514,56 +404,35 @@ let rec list_nth_mut_shared_loop_pair_loop
     begin match ls1 with
     | List_Cons x1 tl1 ->
       if i = 0
-      then Return (x0, x1)
+      then
+        let back_'a = fun ret -> Return (List_Cons ret tl0) in
+        Return ((x0, x1), back_'a)
       else
-        let* i0 = u32_sub i 1 in
-        list_nth_mut_shared_loop_pair_loop t tl0 tl1 i0
+        let* i1 = u32_sub i 1 in
+        let* (p, back_'a) = list_nth_mut_shared_loop_pair_loop t tl0 tl1 i1 in
+        let back_'a1 =
+          fun ret -> let* tl01 = back_'a ret in Return (List_Cons x0 tl01) in
+        Return (p, back_'a1)
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_shared_loop_pair]: forward function
+(** [loops::list_nth_mut_shared_loop_pair]:
     Source: 'src/loops.rs', lines 259:0-263:23 *)
 let list_nth_mut_shared_loop_pair
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
-  list_nth_mut_shared_loop_pair_loop t ls0 ls1 i
-
-(** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 259:0-274:1 *)
-let rec list_nth_mut_shared_loop_pair_loop_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t))
-  (decreases (list_nth_mut_shared_loop_pair_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then Return (List_Cons ret tl0)
-      else
-        let* i0 = u32_sub i 1 in
-        let* tl00 = list_nth_mut_shared_loop_pair_loop_back t tl0 tl1 i0 ret in
-        Return (List_Cons x0 tl00)
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_shared_loop_pair]: backward function 0
-    Source: 'src/loops.rs', lines 259:0-263:23 *)
-let list_nth_mut_shared_loop_pair_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  result (list_t t)
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  result ((t & t) & (t -> result (list_t t)))
   =
-  list_nth_mut_shared_loop_pair_loop_back t ls0 ls1 i ret
+  let* (p, back_'a) = list_nth_mut_shared_loop_pair_loop t ls0 ls1 i in
+  let back_'a1 = fun ret -> back_'a ret in
+  Return (p, back_'a1)
 
-(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 278:0-293:1 *)
 let rec list_nth_mut_shared_loop_pair_merge_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
-  Tot (result (t & t))
+  Tot (result ((t & t) & (t -> result (list_t t))))
   (decreases (list_nth_mut_shared_loop_pair_merge_loop_decreases t ls0 ls1 i))
   =
   begin match ls0 with
@@ -571,57 +440,36 @@ let rec list_nth_mut_shared_loop_pair_merge_loop
     begin match ls1 with
     | List_Cons x1 tl1 ->
       if i = 0
-      then Return (x0, x1)
+      then
+        let back_'a = fun ret -> Return (List_Cons ret tl0) in
+        Return ((x0, x1), back_'a)
       else
-        let* i0 = u32_sub i 1 in
-        list_nth_mut_shared_loop_pair_merge_loop t tl0 tl1 i0
+        let* i1 = u32_sub i 1 in
+        let* (p, back_'a) =
+          list_nth_mut_shared_loop_pair_merge_loop t tl0 tl1 i1 in
+        let back_'a1 =
+          fun ret -> let* tl01 = back_'a ret in Return (List_Cons x0 tl01) in
+        Return (p, back_'a1)
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_shared_loop_pair_merge]: forward function
+(** [loops::list_nth_mut_shared_loop_pair_merge]:
     Source: 'src/loops.rs', lines 278:0-282:23 *)
 let list_nth_mut_shared_loop_pair_merge
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
-  list_nth_mut_shared_loop_pair_merge_loop t ls0 ls1 i
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 278:0-293:1 *)
-let rec list_nth_mut_shared_loop_pair_merge_loop_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t))
-  (decreases (list_nth_mut_shared_loop_pair_merge_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then Return (List_Cons ret tl0)
-      else
-        let* i0 = u32_sub i 1 in
-        let* tl00 =
-          list_nth_mut_shared_loop_pair_merge_loop_back t tl0 tl1 i0 ret in
-        Return (List_Cons x0 tl00)
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 278:0-282:23 *)
-let list_nth_mut_shared_loop_pair_merge_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  result (list_t t)
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  result ((t & t) & (t -> result (list_t t)))
   =
-  list_nth_mut_shared_loop_pair_merge_loop_back t ls0 ls1 i ret
+  let* (p, back_'a) = list_nth_mut_shared_loop_pair_merge_loop t ls0 ls1 i in
+  let back_'a1 = fun ret -> back_'a ret in
+  Return (p, back_'a1)
 
-(** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 297:0-312:1 *)
 let rec list_nth_shared_mut_loop_pair_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
-  Tot (result (t & t))
+  Tot (result ((t & t) & (t -> result (list_t t))))
   (decreases (list_nth_shared_mut_loop_pair_loop_decreases t ls0 ls1 i))
   =
   begin match ls0 with
@@ -629,56 +477,35 @@ let rec list_nth_shared_mut_loop_pair_loop
     begin match ls1 with
     | List_Cons x1 tl1 ->
       if i = 0
-      then Return (x0, x1)
+      then
+        let back_'b = fun ret -> Return (List_Cons ret tl1) in
+        Return ((x0, x1), back_'b)
       else
-        let* i0 = u32_sub i 1 in
-        list_nth_shared_mut_loop_pair_loop t tl0 tl1 i0
+        let* i1 = u32_sub i 1 in
+        let* (p, back_'b) = list_nth_shared_mut_loop_pair_loop t tl0 tl1 i1 in
+        let back_'b1 =
+          fun ret -> let* tl11 = back_'b ret in Return (List_Cons x1 tl11) in
+        Return (p, back_'b1)
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_mut_loop_pair]: forward function
+(** [loops::list_nth_shared_mut_loop_pair]:
     Source: 'src/loops.rs', lines 297:0-301:23 *)
 let list_nth_shared_mut_loop_pair
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
-  list_nth_shared_mut_loop_pair_loop t ls0 ls1 i
-
-(** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1
-    Source: 'src/loops.rs', lines 297:0-312:1 *)
-let rec list_nth_shared_mut_loop_pair_loop_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t))
-  (decreases (list_nth_shared_mut_loop_pair_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then Return (List_Cons ret tl1)
-      else
-        let* i0 = u32_sub i 1 in
-        let* tl10 = list_nth_shared_mut_loop_pair_loop_back t tl0 tl1 i0 ret in
-        Return (List_Cons x1 tl10)
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_shared_mut_loop_pair]: backward function 1
-    Source: 'src/loops.rs', lines 297:0-301:23 *)
-let list_nth_shared_mut_loop_pair_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  result (list_t t)
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  result ((t & t) & (t -> result (list_t t)))
   =
-  list_nth_shared_mut_loop_pair_loop_back t ls0 ls1 i ret
+  let* (p, back_'b) = list_nth_shared_mut_loop_pair_loop t ls0 ls1 i in
+  let back_'b1 = fun ret -> back_'b ret in
+  Return (p, back_'b1)
 
-(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 316:0-331:1 *)
 let rec list_nth_shared_mut_loop_pair_merge_loop
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
-  Tot (result (t & t))
+  Tot (result ((t & t) & (t -> result (list_t t))))
   (decreases (list_nth_shared_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
   =
   begin match ls0 with
@@ -686,49 +513,28 @@ let rec list_nth_shared_mut_loop_pair_merge_loop
     begin match ls1 with
     | List_Cons x1 tl1 ->
       if i = 0
-      then Return (x0, x1)
+      then
+        let back_'a = fun ret -> Return (List_Cons ret tl1) in
+        Return ((x0, x1), back_'a)
       else
-        let* i0 = u32_sub i 1 in
-        list_nth_shared_mut_loop_pair_merge_loop t tl0 tl1 i0
+        let* i1 = u32_sub i 1 in
+        let* (p, back_'a) =
+          list_nth_shared_mut_loop_pair_merge_loop t tl0 tl1 i1 in
+        let back_'a1 =
+          fun ret -> let* tl11 = back_'a ret in Return (List_Cons x1 tl11) in
+        Return (p, back_'a1)
     | List_Nil -> Fail Failure
     end
   | List_Nil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_mut_loop_pair_merge]: forward function
+(** [loops::list_nth_shared_mut_loop_pair_merge]:
     Source: 'src/loops.rs', lines 316:0-320:23 *)
 let list_nth_shared_mut_loop_pair_merge
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
-  list_nth_shared_mut_loop_pair_merge_loop t ls0 ls1 i
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0
-    Source: 'src/loops.rs', lines 316:0-331:1 *)
-let rec list_nth_shared_mut_loop_pair_merge_loop_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  Tot (result (list_t t))
-  (decreases (list_nth_shared_mut_loop_pair_merge_loop_decreases t ls0 ls1 i))
-  =
-  begin match ls0 with
-  | List_Cons x0 tl0 ->
-    begin match ls1 with
-    | List_Cons x1 tl1 ->
-      if i = 0
-      then Return (List_Cons ret tl1)
-      else
-        let* i0 = u32_sub i 1 in
-        let* tl10 =
-          list_nth_shared_mut_loop_pair_merge_loop_back t tl0 tl1 i0 ret in
-        Return (List_Cons x1 tl10)
-    | List_Nil -> Fail Failure
-    end
-  | List_Nil -> Fail Failure
-  end
-
-(** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0
-    Source: 'src/loops.rs', lines 316:0-320:23 *)
-let list_nth_shared_mut_loop_pair_merge_back
-  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
-  result (list_t t)
+  (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
+  result ((t & t) & (t -> result (list_t t)))
   =
-  list_nth_shared_mut_loop_pair_merge_loop_back t ls0 ls1 i ret
+  let* (p, back_'a) = list_nth_shared_mut_loop_pair_merge_loop t ls0 ls1 i in
+  let back_'a1 = fun ret -> back_'a ret in
+  Return (p, back_'a1)
 
diff --git a/tests/fstar/misc/Paper.fst b/tests/fstar/misc/Paper.fst
index 14bc59e8..c6082929 100644
--- a/tests/fstar/misc/Paper.fst
+++ b/tests/fstar/misc/Paper.fst
@@ -5,40 +5,36 @@ open Primitives
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [paper::ref_incr]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [paper::ref_incr]:
     Source: 'src/paper.rs', lines 4:0-4:28 *)
 let ref_incr (x : i32) : result i32 =
   i32_add x 1
 
-(** [paper::test_incr]: forward function
+(** [paper::test_incr]:
     Source: 'src/paper.rs', lines 8:0-8:18 *)
 let test_incr : result unit =
-  let* x = ref_incr 0 in if not (x = 1) then Fail Failure else Return ()
+  let* i = ref_incr 0 in if not (i = 1) then Fail Failure else Return ()
 
 (** Unit test for [paper::test_incr] *)
 let _ = assert_norm (test_incr = Return ())
 
-(** [paper::choose]: forward function
+(** [paper::choose]:
     Source: 'src/paper.rs', lines 15:0-15:70 *)
-let choose (t : Type0) (b : bool) (x : t) (y : t) : result t =
-  if b then Return x else Return y
+let choose
+  (t : Type0) (b : bool) (x : t) (y : t) : result (t & (t -> result (t & t))) =
+  if b
+  then let back_'a = fun ret -> Return (ret, y) in Return (x, back_'a)
+  else let back_'a = fun ret -> Return (x, ret) in Return (y, back_'a)
 
-(** [paper::choose]: backward function 0
-    Source: 'src/paper.rs', lines 15:0-15:70 *)
-let choose_back
-  (t : Type0) (b : bool) (x : t) (y : t) (ret : t) : result (t & t) =
-  if b then Return (ret, y) else Return (x, ret)
-
-(** [paper::test_choose]: forward function
+(** [paper::test_choose]:
     Source: 'src/paper.rs', lines 23:0-23:20 *)
 let test_choose : result unit =
-  let* z = choose i32 true 0 0 in
-  let* z0 = i32_add z 1 in
-  if not (z0 = 1)
+  let* (z, choose_back) = choose i32 true 0 0 in
+  let* z1 = i32_add z 1 in
+  if not (z1 = 1)
   then Fail Failure
   else
-    let* (x, y) = choose_back i32 true 0 0 z0 in
+    let* (x, y) = choose_back z1 in
     if not (x = 1)
     then Fail Failure
     else if not (y = 0) then Fail Failure else Return ()
@@ -52,31 +48,28 @@ type list_t (t : Type0) =
 | List_Cons : t -> list_t t -> list_t t
 | List_Nil : list_t t
 
-(** [paper::list_nth_mut]: forward function
-    Source: 'src/paper.rs', lines 42:0-42:67 *)
-let rec list_nth_mut (t : Type0) (l : list_t t) (i : u32) : result t =
-  begin match l with
-  | List_Cons x tl ->
-    if i = 0 then Return x else let* i0 = u32_sub i 1 in list_nth_mut t tl i0
-  | List_Nil -> Fail Failure
-  end
-
-(** [paper::list_nth_mut]: backward function 0
+(** [paper::list_nth_mut]:
     Source: 'src/paper.rs', lines 42:0-42:67 *)
-let rec list_nth_mut_back
-  (t : Type0) (l : list_t t) (i : u32) (ret : t) : result (list_t t) =
+let rec list_nth_mut
+  (t : Type0) (l : list_t t) (i : u32) :
+  result (t & (t -> result (list_t t)))
+  =
   begin match l with
   | List_Cons x tl ->
     if i = 0
-    then Return (List_Cons ret tl)
+    then
+      let back_'a = fun ret -> Return (List_Cons ret tl) in Return (x, back_'a)
     else
-      let* i0 = u32_sub i 1 in
-      let* tl0 = list_nth_mut_back t tl i0 ret in
-      Return (List_Cons x tl0)
+      let* i1 = u32_sub i 1 in
+      let* (x1, list_nth_mut_back) = list_nth_mut t tl i1 in
+      let back_'a =
+        fun ret -> let* tl1 = list_nth_mut_back ret in Return (List_Cons x tl1)
+        in
+      Return (x1, back_'a)
   | List_Nil -> Fail Failure
   end
 
-(** [paper::sum]: forward function
+(** [paper::sum]:
     Source: 'src/paper.rs', lines 57:0-57:32 *)
 let rec sum (l : list_t i32) : result i32 =
   begin match l with
@@ -84,27 +77,27 @@ let rec sum (l : list_t i32) : result i32 =
   | List_Nil -> Return 0
   end
 
-(** [paper::test_nth]: forward function
+(** [paper::test_nth]:
     Source: 'src/paper.rs', lines 68:0-68:17 *)
 let test_nth : result unit =
   let l = List_Nil in
-  let l0 = List_Cons 3 l in
-  let l1 = List_Cons 2 l0 in
-  let* x = list_nth_mut i32 (List_Cons 1 l1) 2 in
-  let* x0 = i32_add x 1 in
-  let* l2 = list_nth_mut_back i32 (List_Cons 1 l1) 2 x0 in
-  let* i = sum l2 in
+  let l1 = List_Cons 3 l in
+  let l2 = List_Cons 2 l1 in
+  let* (x, list_nth_mut_back) = list_nth_mut i32 (List_Cons 1 l2) 2 in
+  let* x1 = i32_add x 1 in
+  let* l3 = list_nth_mut_back x1 in
+  let* i = sum l3 in
   if not (i = 7) then Fail Failure else Return ()
 
 (** Unit test for [paper::test_nth] *)
 let _ = assert_norm (test_nth = Return ())
 
-(** [paper::call_choose]: forward function
+(** [paper::call_choose]:
     Source: 'src/paper.rs', lines 76:0-76:44 *)
 let call_choose (p : (u32 & u32)) : result u32 =
   let (px, py) = p in
-  let* pz = choose u32 true px py in
-  let* pz0 = u32_add pz 1 in
-  let* (px0, _) = choose_back u32 true px py pz0 in
-  Return px0
+  let* (pz, choose_back) = choose u32 true px py in
+  let* pz1 = u32_add pz 1 in
+  let* (px1, _) = choose_back pz1 in
+  Return px1
 
diff --git a/tests/fstar/misc/PoloniusList.fst b/tests/fstar/misc/PoloniusList.fst
index 188b22d8..cbe7d6b8 100644
--- a/tests/fstar/misc/PoloniusList.fst
+++ b/tests/fstar/misc/PoloniusList.fst
@@ -11,24 +11,24 @@ type list_t (t : Type0) =
 | List_Cons : t -> list_t t -> list_t t
 | List_Nil : list_t t
 
-(** [polonius_list::get_list_at_x]: forward function
+(** [polonius_list::get_list_at_x]:
     Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
-let rec get_list_at_x (ls : list_t u32) (x : u32) : result (list_t u32) =
-  begin match ls with
-  | List_Cons hd tl ->
-    if hd = x then Return (List_Cons hd tl) else get_list_at_x tl x
-  | List_Nil -> Return List_Nil
-  end
-
-(** [polonius_list::get_list_at_x]: backward function 0
-    Source: 'src/polonius_list.rs', lines 13:0-13:76 *)
-let rec get_list_at_x_back
-  (ls : list_t u32) (x : u32) (ret : list_t u32) : result (list_t u32) =
+let rec get_list_at_x
+  (ls : list_t u32) (x : u32) :
+  result ((list_t u32) & (list_t u32 -> result (list_t u32)))
+  =
   begin match ls with
   | List_Cons hd tl ->
     if hd = x
-    then Return ret
-    else let* tl0 = get_list_at_x_back tl x ret in Return (List_Cons hd tl0)
-  | List_Nil -> Return ret
+    then
+      let back_'a = fun ret -> Return ret in Return (List_Cons hd tl, back_'a)
+    else
+      let* (l, get_list_at_x_back) = get_list_at_x tl x in
+      let back_'a =
+        fun ret ->
+          let* tl1 = get_list_at_x_back ret in Return (List_Cons hd tl1) in
+      Return (l, back_'a)
+  | List_Nil ->
+    let back_'a = fun ret -> Return ret in Return (List_Nil, back_'a)
   end
 
diff --git a/tests/fstar/misc/Primitives.fst b/tests/fstar/misc/Primitives.fst
index 6b8dbeb7..fca80829 100644
--- a/tests/fstar/misc/Primitives.fst
+++ b/tests/fstar/misc/Primitives.fst
@@ -55,7 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a & (a -> a) = (x, (fun x -> x))
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -531,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -548,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -555,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
diff --git a/tests/fstar/traits/Primitives.fst b/tests/fstar/traits/Primitives.fst
index a3ffbde4..fca80829 100644
--- a/tests/fstar/traits/Primitives.fst
+++ b/tests/fstar/traits/Primitives.fst
@@ -55,8 +55,7 @@ type string = string
 let is_zero (n: nat) : bool = n = 0
 let decrease (n: nat{n > 0}) : nat = n - 1
 
-let core_mem_replace (a : Type0) (x : a) (y : a) : a = x
-let core_mem_replace_back (a : Type0) (x : a) (y : a) : a = y
+let core_mem_replace (a : Type0) (x : a) (y : a) : a & a = (x, x)
 
 // We don't really use raw pointers for now
 type mut_raw_ptr (t : Type0) = { v : t }
@@ -477,8 +476,7 @@ noeq type core_ops_index_Index (self idx : Type0) = {
 // Trait declaration: [core::ops::index::IndexMut]
 noeq type core_ops_index_IndexMut (self idx : Type0) = {
   indexInst : core_ops_index_Index self idx;
-  index_mut : self → idx → result indexInst.output;
-  index_mut_back : self → idx → indexInst.output → result self;
+  index_mut : self → idx → result (indexInst.output & (indexInst.output → result self));
 }
 
 // Trait declaration [core::ops::deref::Deref]
@@ -490,8 +488,7 @@ noeq type core_ops_deref_Deref (self : Type0) = {
 // Trait declaration [core::ops::deref::DerefMut]
 noeq type core_ops_deref_DerefMut (self : Type0) = {
   derefInst : core_ops_deref_Deref self;
-  deref_mut : self → result derefInst.target;
-  deref_mut_back : self → derefInst.target → result self;
+  deref_mut : self → result (derefInst.target & (derefInst.target → result self));
 }
 
 type core_ops_range_Range (a : Type0) = {
@@ -502,8 +499,8 @@ type core_ops_range_Range (a : Type0) = {
 (*** [alloc] *)
 
 let alloc_boxed_Box_deref (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result t = Return x
-let alloc_boxed_Box_deref_mut_back (t : Type) (_ : t) (x : t) : result t = Return x
+let alloc_boxed_Box_deref_mut (t : Type0) (x : t) : result (t & (t -> result t)) =
+  Return (x, (fun x -> Return x))
 
 // Trait instance
 let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self = {
@@ -515,7 +512,6 @@ let alloc_boxed_Box_coreopsDerefInst (self : Type0) : core_ops_deref_Deref self
 let alloc_boxed_Box_coreopsDerefMutInst (self : Type0) : core_ops_deref_DerefMut self = {
   derefInst = alloc_boxed_Box_coreopsDerefInst self;
   deref_mut = alloc_boxed_Box_deref_mut self;
-  deref_mut_back = alloc_boxed_Box_deref_mut_back self;
 }
 
 (*** Array *)
@@ -535,10 +531,18 @@ let array_index_usize (a : Type0) (n : usize) (x : array a n) (i : usize) : resu
   if i < length x then Return (index x i)
   else Fail Failure
 
-let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) : result (array a n) =
+let array_update_usize (a : Type0) (n : usize) (x : array a n) (i : usize) (nx : a) :
+  result (array a n) =
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let array_index_mut_usize (a : Type0) (n : usize) (x : array a n) (i : usize) :
+  result (a & (a -> result (array a n))) =
+  match array_index_usize a n x i with
+  | Fail e -> Fail e
+  | Return v ->
+    Return (v, array_update_usize a n x i)
+
 (*** Slice *)
 type slice (a : Type0) = s:list a{length s <= usize_max}
 
@@ -552,6 +556,13 @@ let slice_update_usize (a : Type0) (x : slice a) (i : usize) (nx : a) : result (
   if i < length x then Return (list_update x i nx)
   else Fail Failure
 
+let slice_index_mut_usize (a : Type0) (s : slice a) (i : usize) :
+  result (a & (a -> result (slice a))) =
+  match slice_index_usize a s i with
+  | Fail e -> Fail e
+  | Return x ->
+    Return (x, slice_update_usize a s i)
+
 (*** Subslices *)
 
 let array_to_slice (a : Type0) (n : usize) (x : array a n) : result (slice a) = Return x
@@ -559,6 +570,10 @@ let array_from_slice (a : Type0) (n : usize) (x : array a n) (s : slice a) : res
   if length s = n then Return s
   else Fail Failure
 
+let array_to_slice_mut (a : Type0) (n : usize) (x : array a n) :
+  result (slice a & (slice a -> result (array a n))) =
+  Return (x, array_from_slice a n x)
+
 // TODO: finish the definitions below (there lacks [List.drop] and [List.take] in the standard library *)
 let array_subslice (a : Type0) (n : usize) (x : array a n) (r : core_ops_range_Range usize) : result (slice a) =
   admit()
@@ -588,8 +603,13 @@ let alloc_vec_Vec_index_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) : r
 let alloc_vec_Vec_update_usize (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_push_fwd (a  : Type0) (v : alloc_vec_Vec a) (x : a) : unit = ()
+let alloc_vec_Vec_index_mut_usize (#a : Type0) (v: alloc_vec_Vec a) (i: usize) :
+  result (a & (a → result (alloc_vec_Vec a))) =
+  match alloc_vec_Vec_index_usize v i with
+  | Return x ->
+    Return (x, alloc_vec_Vec_update_usize v i)
+  | Fail e -> Fail e
+
 let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
   Pure (result (alloc_vec_Vec a))
   (requires True)
@@ -605,9 +625,6 @@ let alloc_vec_Vec_push (a  : Type0) (v : alloc_vec_Vec a) (x : a) :
     end
   else Fail Failure
 
-// The **forward** function shouldn't be used
-let alloc_vec_Vec_insert_fwd (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result unit =
-  if i < length v then Return () else Fail Failure
 let alloc_vec_Vec_insert (a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) : result (alloc_vec_Vec a) =
   if i < length v then Return (list_update v i x) else Fail Failure
 
@@ -619,13 +636,11 @@ noeq type core_slice_index_SliceIndex (self t : Type0) = {
   sealedInst : core_slice_index_private_slice_index_Sealed self;
   output : Type0;
   get : self → t → result (option output);
-  get_mut : self → t → result (option output);
-  get_mut_back : self → t → option output → result t;
+  get_mut : self → t → result (option output & (option output -> result t));
   get_unchecked : self → const_raw_ptr t → result (const_raw_ptr output);
   get_unchecked_mut : self → mut_raw_ptr t → result (mut_raw_ptr output);
   index : self → t → result output;
-  index_mut : self → t → result output;
-  index_mut_back : self → t → output → result t;
+  index_mut : self → t → result (output & (output -> result t));
 }
 
 // [core::slice::index::[T]::index]: forward function
@@ -643,14 +658,8 @@ let core_slice_index_RangeUsize_get (t : Type0) (i : core_ops_range_Range usize)
   admit () // TODO
 
 // [core::slice::index::Range::get_mut]: forward function
-let core_slice_index_RangeUsize_get_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (option (slice t)) =
-  admit () // TODO
-
-// [core::slice::index::Range::get_mut]: backward function 0
-let core_slice_index_RangeUsize_get_mut_back
-  (t : Type0) :
-  core_ops_range_Range usize → slice t → option (slice t) → result (slice t) =
+let core_slice_index_RangeUsize_get_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (option (slice t) & (option (slice t) -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::Range::get_unchecked]: forward function
@@ -675,27 +684,16 @@ let core_slice_index_RangeUsize_index
   admit () // TODO
 
 // [core::slice::index::Range::index_mut]: forward function
-let core_slice_index_RangeUsize_index_mut
-  (t : Type0) : core_ops_range_Range usize → slice t → result (slice t) =
-  admit () // TODO
-
-// [core::slice::index::Range::index_mut]: backward function 0
-let core_slice_index_RangeUsize_index_mut_back
-  (t : Type0) : core_ops_range_Range usize → slice t → slice t → result (slice t) =
+let core_slice_index_RangeUsize_index_mut (t : Type0) :
+  core_ops_range_Range usize → slice t → result (slice t & (slice t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::[T]::index_mut]: forward function
 let core_slice_index_Slice_index_mut
   (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → result inst.output =
+  slice t → idx → result (inst.output & (inst.output -> result (slice t))) =
   admit () // 
 
-// [core::slice::index::[T]::index_mut]: backward function 0
-let core_slice_index_Slice_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t)) :
-  slice t → idx → inst.output → result (slice t) =
-  admit () // TODO
-
 // [core::array::[T; N]::index]: forward function
 let core_array_Array_index
   (t idx : Type0) (n : usize) (inst : core_ops_index_Index (slice t) idx)
@@ -705,13 +703,8 @@ let core_array_Array_index
 // [core::array::[T; N]::index_mut]: forward function
 let core_array_Array_index_mut
   (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) : result inst.indexInst.output =
-  admit () // TODO
-
-// [core::array::[T; N]::index_mut]: backward function 0
-let core_array_Array_index_mut_back
-  (t idx : Type0) (n : usize) (inst : core_ops_index_IndexMut (slice t) idx)
-  (a : array t n) (i : idx) (x : inst.indexInst.output) : result (array t n) =
+  (a : array t n) (i : idx) :
+  result (inst.indexInst.output & (inst.indexInst.output -> result (array t n))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::Range]
@@ -725,12 +718,10 @@ let core_slice_index_SliceIndexRangeUsizeSliceTInst (t : Type0) :
   output = slice t;
   get = core_slice_index_RangeUsize_get t;
   get_mut = core_slice_index_RangeUsize_get_mut t;
-  get_mut_back = core_slice_index_RangeUsize_get_mut_back t;
   get_unchecked = core_slice_index_RangeUsize_get_unchecked t;
   get_unchecked_mut = core_slice_index_RangeUsize_get_unchecked_mut t;
   index = core_slice_index_RangeUsize_index t;
   index_mut = core_slice_index_RangeUsize_index_mut t;
-  index_mut_back = core_slice_index_RangeUsize_index_mut_back t;
 }
 
 // Trait implementation: [core::slice::index::[T]]
@@ -747,7 +738,6 @@ let core_ops_index_IndexMutSliceTIInst (t idx : Type0)
   core_ops_index_IndexMut (slice t) idx = {
   indexInst = core_ops_index_IndexSliceTIInst t idx inst;
   index_mut = core_slice_index_Slice_index_mut t idx inst;
-  index_mut_back = core_slice_index_Slice_index_mut_back t idx inst;
 }
 
 // Trait implementation: [core::array::[T; N]]
@@ -764,7 +754,6 @@ let core_ops_index_IndexMutArrayIInst (t idx : Type0) (n : usize)
   core_ops_index_IndexMut (array t n) idx = {
   indexInst = core_ops_index_IndexArrayInst t idx n inst.indexInst;
   index_mut = core_array_Array_index_mut t idx n inst;
-  index_mut_back = core_array_Array_index_mut_back t idx n inst;
 }
 
 // [core::slice::index::usize::get]: forward function
@@ -773,13 +762,8 @@ let core_slice_index_usize_get
   admit () // TODO
 
 // [core::slice::index::usize::get_mut]: forward function
-let core_slice_index_usize_get_mut
-  (t : Type0) : usize → slice t → result (option t) =
-  admit () // TODO
-
-// [core::slice::index::usize::get_mut]: backward function 0
-let core_slice_index_usize_get_mut_back
-  (t : Type0) : usize → slice t → option t → result (slice t) =
+let core_slice_index_usize_get_mut (t : Type0) :
+  usize → slice t → result (option t & (option t -> result (slice t))) =
   admit () // TODO
 
 // [core::slice::index::usize::get_unchecked]: forward function
@@ -797,12 +781,8 @@ let core_slice_index_usize_index (t : Type0) : usize → slice t → result t =
   admit () // TODO
 
 // [core::slice::index::usize::index_mut]: forward function
-let core_slice_index_usize_index_mut (t : Type0) : usize → slice t → result t =
-  admit () // TODO
-
-// [core::slice::index::usize::index_mut]: backward function 0
-let core_slice_index_usize_index_mut_back
-  (t : Type0) : usize → slice t → t → result (slice t) =
+let core_slice_index_usize_index_mut (t : Type0) :
+  usize → slice t → result (t & (t -> result (slice t))) =
   admit () // TODO
 
 // Trait implementation: [core::slice::index::private_slice_index::usize]
@@ -816,12 +796,10 @@ let core_slice_index_SliceIndexUsizeSliceTInst (t : Type0) :
   output = t;
   get = core_slice_index_usize_get t;
   get_mut = core_slice_index_usize_get_mut t;
-  get_mut_back = core_slice_index_usize_get_mut_back t;
   get_unchecked = core_slice_index_usize_get_unchecked t;
   get_unchecked_mut = core_slice_index_usize_get_unchecked_mut t;
   index = core_slice_index_usize_index t;
   index_mut = core_slice_index_usize_index_mut t;
-  index_mut_back = core_slice_index_usize_index_mut_back t;
 }
 
 // [alloc::vec::Vec::index]: forward function
@@ -831,13 +809,8 @@ let alloc_vec_Vec_index (t idx : Type0) (inst : core_slice_index_SliceIndex idx
 
 // [alloc::vec::Vec::index_mut]: forward function
 let alloc_vec_Vec_index_mut (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) : result inst.output =
-  admit () // TODO
-
-// [alloc::vec::Vec::index_mut]: backward function 0
-let alloc_vec_Vec_index_mut_back
-  (t idx : Type0) (inst : core_slice_index_SliceIndex idx (slice t))
-  (self : alloc_vec_Vec t) (i : idx) (x : inst.output) : result (alloc_vec_Vec t) =
+  (self : alloc_vec_Vec t) (i : idx) :
+  result (inst.output & (inst.output -> result (alloc_vec_Vec t))) =
   admit () // TODO
 
 // Trait implementation: [alloc::vec::Vec]
@@ -854,7 +827,6 @@ let alloc_vec_Vec_coreopsindexIndexMutInst (t idx : Type0)
   core_ops_index_IndexMut (alloc_vec_Vec t) idx = {
   indexInst = alloc_vec_Vec_coreopsindexIndexInst t idx inst;
   index_mut = alloc_vec_Vec_index_mut t idx inst;
-  index_mut_back = alloc_vec_Vec_index_mut_back t idx inst;
 }
 
 (*** Theorems *)
@@ -870,15 +842,7 @@ let alloc_vec_Vec_index_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
 let alloc_vec_Vec_index_mut_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) :
   Lemma (
     alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i ==
-      alloc_vec_Vec_index_usize v i)
+      alloc_vec_Vec_index_mut_usize v i)
   [SMTPat (alloc_vec_Vec_index_mut a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i)]
   =
   admit()
-
-let alloc_vec_Vec_index_mut_back_eq (#a : Type0) (v : alloc_vec_Vec a) (i : usize) (x : a) :
-  Lemma (
-    alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x ==
-      alloc_vec_Vec_update_usize v i x)
-  [SMTPat (alloc_vec_Vec_index_mut_back a usize (core_slice_index_SliceIndexUsizeSliceTInst a) v i x)]
-  =
-  admit()
diff --git a/tests/fstar/traits/Traits.fst b/tests/fstar/traits/Traits.fst
index 7d504cb5..3543bd73 100644
--- a/tests/fstar/traits/Traits.fst
+++ b/tests/fstar/traits/Traits.fst
@@ -9,7 +9,7 @@ open Primitives
     Source: 'src/traits.rs', lines 1:0-1:19 *)
 noeq type boolTrait_t (self : Type0) = { get_bool : self -> result bool; }
 
-(** [traits::{bool}::get_bool]: forward function
+(** [traits::{bool}::get_bool]:
     Source: 'src/traits.rs', lines 12:4-12:30 *)
 let bool_get_bool (self : bool) : result bool =
   Return self
@@ -18,24 +18,24 @@ let bool_get_bool (self : bool) : result bool =
     Source: 'src/traits.rs', lines 11:0-11:23 *)
 let traits_BoolTraitBoolInst : boolTrait_t bool = { get_bool = bool_get_bool; }
 
-(** [traits::BoolTrait::ret_true]: forward function
+(** [traits::BoolTrait::ret_true]:
     Source: 'src/traits.rs', lines 6:4-6:30 *)
 let boolTrait_ret_true
-  (#self : Type0) (self_clause : boolTrait_t self) (self0 : self) :
+  (#self : Type0) (self_clause : boolTrait_t self) (self1 : self) :
   result bool
   =
   Return true
 
-(** [traits::test_bool_trait_bool]: forward function
+(** [traits::test_bool_trait_bool]:
     Source: 'src/traits.rs', lines 17:0-17:44 *)
 let test_bool_trait_bool (x : bool) : result bool =
   let* b = bool_get_bool x in
   if b then boolTrait_ret_true traits_BoolTraitBoolInst x else Return false
 
-(** [traits::{core::option::Option<T>#1}::get_bool]: forward function
+(** [traits::{core::option::Option<T>#1}::get_bool]:
     Source: 'src/traits.rs', lines 23:4-23:30 *)
 let option_get_bool (t : Type0) (self : option t) : result bool =
-  begin match self with | None -> Return false | Some x -> Return true end
+  begin match self with | None -> Return false | Some _ -> Return true end
 
 (** Trait implementation: [traits::{core::option::Option<T>#1}]
     Source: 'src/traits.rs', lines 22:0-22:31 *)
@@ -44,7 +44,7 @@ let traits_BoolTraitcoreoptionOptionTInst (t : Type0) : boolTrait_t (option t)
   get_bool = option_get_bool t;
 }
 
-(** [traits::test_bool_trait_option]: forward function
+(** [traits::test_bool_trait_option]:
     Source: 'src/traits.rs', lines 31:0-31:54 *)
 let test_bool_trait_option (t : Type0) (x : option t) : result bool =
   let* b = option_get_bool t x in
@@ -52,7 +52,7 @@ let test_bool_trait_option (t : Type0) (x : option t) : result bool =
   then boolTrait_ret_true (traits_BoolTraitcoreoptionOptionTInst t) x
   else Return false
 
-(** [traits::test_bool_trait]: forward function
+(** [traits::test_bool_trait]:
     Source: 'src/traits.rs', lines 35:0-35:50 *)
 let test_bool_trait
   (t : Type0) (boolTraitTInst : boolTrait_t t) (x : t) : result bool =
@@ -62,7 +62,7 @@ let test_bool_trait
     Source: 'src/traits.rs', lines 39:0-39:15 *)
 noeq type toU64_t (self : Type0) = { to_u64 : self -> result u64; }
 
-(** [traits::{u64#2}::to_u64]: forward function
+(** [traits::{u64#2}::to_u64]:
     Source: 'src/traits.rs', lines 44:4-44:26 *)
 let u64_to_u64 (self : u64) : result u64 =
   Return self
@@ -71,14 +71,14 @@ let u64_to_u64 (self : u64) : result u64 =
     Source: 'src/traits.rs', lines 43:0-43:18 *)
 let traits_ToU64U64Inst : toU64_t u64 = { to_u64 = u64_to_u64; }
 
-(** [traits::{(A, A)#3}::to_u64]: forward function
+(** [traits::{(A, A)#3}::to_u64]:
     Source: 'src/traits.rs', lines 50:4-50:26 *)
 let pair_to_u64
   (a : Type0) (toU64AInst : toU64_t a) (self : (a & a)) : result u64 =
-  let (x, x0) = self in
+  let (x, x1) = self in
   let* i = toU64AInst.to_u64 x in
-  let* i0 = toU64AInst.to_u64 x0 in
-  u64_add i i0
+  let* i1 = toU64AInst.to_u64 x1 in
+  u64_add i i1
 
 (** Trait implementation: [traits::{(A, A)#3}]
     Source: 'src/traits.rs', lines 49:0-49:31 *)
@@ -87,18 +87,18 @@ let traits_ToU64TupleAAInst (a : Type0) (toU64AInst : toU64_t a) : toU64_t (a &
   to_u64 = pair_to_u64 a toU64AInst;
 }
 
-(** [traits::f]: forward function
+(** [traits::f]:
     Source: 'src/traits.rs', lines 55:0-55:36 *)
 let f (t : Type0) (toU64TInst : toU64_t t) (x : (t & t)) : result u64 =
   pair_to_u64 t toU64TInst x
 
-(** [traits::g]: forward function
+(** [traits::g]:
     Source: 'src/traits.rs', lines 59:0-61:18 *)
 let g
   (t : Type0) (toU64TupleTTInst : toU64_t (t & t)) (x : (t & t)) : result u64 =
   toU64TupleTTInst.to_u64 x
 
-(** [traits::h0]: forward function
+(** [traits::h0]:
     Source: 'src/traits.rs', lines 66:0-66:24 *)
 let h0 (x : u64) : result u64 =
   u64_to_u64 x
@@ -107,7 +107,7 @@ let h0 (x : u64) : result u64 =
     Source: 'src/traits.rs', lines 70:0-70:21 *)
 type wrapper_t (t : Type0) = { x : t; }
 
-(** [traits::{traits::Wrapper<T>#4}::to_u64]: forward function
+(** [traits::{traits::Wrapper<T>#4}::to_u64]:
     Source: 'src/traits.rs', lines 75:4-75:26 *)
 let wrapper_to_u64
   (t : Type0) (toU64TInst : toU64_t t) (self : wrapper_t t) : result u64 =
@@ -120,12 +120,12 @@ let traits_ToU64traitsWrapperTInst (t : Type0) (toU64TInst : toU64_t t) :
   to_u64 = wrapper_to_u64 t toU64TInst;
 }
 
-(** [traits::h1]: forward function
+(** [traits::h1]:
     Source: 'src/traits.rs', lines 80:0-80:33 *)
 let h1 (x : wrapper_t u64) : result u64 =
   wrapper_to_u64 u64 traits_ToU64U64Inst x
 
-(** [traits::h2]: forward function
+(** [traits::h2]:
     Source: 'src/traits.rs', lines 84:0-84:41 *)
 let h2 (t : Type0) (toU64TInst : toU64_t t) (x : wrapper_t t) : result u64 =
   wrapper_to_u64 t toU64TInst x
@@ -134,7 +134,7 @@ let h2 (t : Type0) (toU64TInst : toU64_t t) (x : wrapper_t t) : result u64 =
     Source: 'src/traits.rs', lines 88:0-88:19 *)
 noeq type toType_t (self t : Type0) = { to_type : self -> result t; }
 
-(** [traits::{u64#5}::to_type]: forward function
+(** [traits::{u64#5}::to_type]:
     Source: 'src/traits.rs', lines 93:4-93:28 *)
 let u64_to_type (self : u64) : result bool =
   Return (self > 0)
@@ -150,7 +150,7 @@ noeq type ofType_t (self : Type0) = {
     self;
 }
 
-(** [traits::h3]: forward function
+(** [traits::h3]:
     Source: 'src/traits.rs', lines 104:0-104:50 *)
 let h3
   (t1 t2 : Type0) (ofTypeT1Inst : ofType_t t1) (toTypeT2T1Inst : toType_t t2
@@ -166,7 +166,7 @@ noeq type ofTypeBis_t (self t : Type0) = {
   of_type : t -> result self;
 }
 
-(** [traits::h4]: forward function
+(** [traits::h4]:
     Source: 'src/traits.rs', lines 118:0-118:57 *)
 let h4
   (t1 t2 : Type0) (ofTypeBisT1T2Inst : ofTypeBis_t t1 t2) (toTypeT2T1Inst :
@@ -189,7 +189,7 @@ noeq type testType_test_TestTrait_t (self : Type0) = {
   test : self -> result bool;
 }
 
-(** [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]: forward function
+(** [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]:
     Source: 'src/traits.rs', lines 139:12-139:34 *)
 let testType_test_TestType1_test
   (self : testType_test_TestType1_t) : result bool =
@@ -202,20 +202,20 @@ let traits_TestType_test_TestTraittraitstraitsTestTypeTtestTestType1Inst :
   test = testType_test_TestType1_test;
 }
 
-(** [traits::{traits::TestType<T>#6}::test]: forward function
+(** [traits::{traits::TestType<T>#6}::test]:
     Source: 'src/traits.rs', lines 126:4-126:36 *)
 let testType_test
   (t : Type0) (toU64TInst : toU64_t t) (self : testType_t t) (x : t) :
   result bool
   =
-  let* x0 = toU64TInst.to_u64 x in
-  if x0 > 0 then testType_test_TestType1_test 0 else Return false
+  let* x1 = toU64TInst.to_u64 x in
+  if x1 > 0 then testType_test_TestType1_test 0 else Return false
 
 (** [traits::BoolWrapper]
     Source: 'src/traits.rs', lines 150:0-150:22 *)
 type boolWrapper_t = bool
 
-(** [traits::{traits::BoolWrapper#7}::to_type]: forward function
+(** [traits::{traits::BoolWrapper#7}::to_type]:
     Source: 'src/traits.rs', lines 156:4-156:25 *)
 let boolWrapper_to_type
   (t : Type0) (toTypeBoolTInst : toType_t bool t) (self : boolWrapper_t) :
@@ -251,8 +251,7 @@ noeq type withConstTy_t (self : Type0) (len : usize) = {
 let bool_len1_body : result usize = Return 12
 let bool_len1_c : usize = eval_global bool_len1_body
 
-(** [traits::{bool#8}::f]: merged forward/backward function
-    (there is a single backward function, and the forward function returns ())
+(** [traits::{bool#8}::f]:
     Source: 'src/traits.rs', lines 180:4-180:39 *)
 let bool_f (i : u64) (a : array u8 32) : result u64 =
   Return i
@@ -268,7 +267,7 @@ let traits_WithConstTyBool32Inst : withConstTy_t bool 32 = {
   f = bool_f;
 }
 
-(** [traits::use_with_const_ty1]: forward function
+(** [traits::use_with_const_ty1]:
     Source: 'src/traits.rs', lines 183:0-183:75 *)
 let use_with_const_ty1
   (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len) :
@@ -276,7 +275,7 @@ let use_with_const_ty1
   =
   let i = withConstTyHLENInst.cLEN1 in Return i
 
-(** [traits::use_with_const_ty2]: forward function
+(** [traits::use_with_const_ty2]:
     Source: 'src/traits.rs', lines 187:0-187:73 *)
 let use_with_const_ty2
   (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len)
@@ -285,7 +284,7 @@ let use_with_const_ty2
   =
   Return ()
 
-(** [traits::use_with_const_ty3]: forward function
+(** [traits::use_with_const_ty3]:
     Source: 'src/traits.rs', lines 189:0-189:80 *)
 let use_with_const_ty3
   (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len)
@@ -294,12 +293,12 @@ let use_with_const_ty3
   =
   withConstTyHLENInst.tW_clause_0.to_u64 x
 
-(** [traits::test_where1]: forward function
+(** [traits::test_where1]:
     Source: 'src/traits.rs', lines 193:0-193:40 *)
 let test_where1 (t : Type0) (_x : t) : result unit =
   Return ()
 
-(** [traits::test_where2]: forward function
+(** [traits::test_where2]:
     Source: 'src/traits.rs', lines 194:0-194:57 *)
 let test_where2
   (t : Type0) (withConstTyT32Inst : withConstTy_t t 32) (_x : u32) :
@@ -326,22 +325,30 @@ noeq type childTrait_t (self : Type0) = {
   parentTrait1SelfInst : parentTrait1_t self;
 }
 
-(** [traits::test_child_trait1]: forward function
-    Source: 'src/traits.rs', lines 209:0-209:56 *)
+(** [traits::test_parent_trait0]:
+    Source: 'src/traits.rs', lines 208:0-208:57 *)
+let test_parent_trait0
+  (t : Type0) (parentTrait0TInst : parentTrait0_t t) (x : t) :
+  result parentTrait0TInst.tW
+  =
+  parentTrait0TInst.get_w x
+
+(** [traits::test_child_trait1]:
+    Source: 'src/traits.rs', lines 213:0-213:56 *)
 let test_child_trait1
   (t : Type0) (childTraitTInst : childTrait_t t) (x : t) : result string =
   childTraitTInst.parentTrait0SelfInst.get_name x
 
-(** [traits::test_child_trait2]: forward function
-    Source: 'src/traits.rs', lines 213:0-213:54 *)
+(** [traits::test_child_trait2]:
+    Source: 'src/traits.rs', lines 217:0-217:54 *)
 let test_child_trait2
   (t : Type0) (childTraitTInst : childTrait_t t) (x : t) :
   result childTraitTInst.parentTrait0SelfInst.tW
   =
   childTraitTInst.parentTrait0SelfInst.get_w x
 
-(** [traits::order1]: forward function
-    Source: 'src/traits.rs', lines 219:0-219:59 *)
+(** [traits::order1]:
+    Source: 'src/traits.rs', lines 223:0-223:59 *)
 let order1
   (t u : Type0) (parentTrait0TInst : parentTrait0_t t) (parentTrait0UInst :
   parentTrait0_t u) :
@@ -350,27 +357,27 @@ let order1
   Return ()
 
 (** Trait declaration: [traits::ChildTrait1]
-    Source: 'src/traits.rs', lines 222:0-222:35 *)
+    Source: 'src/traits.rs', lines 226:0-226:35 *)
 noeq type childTrait1_t (self : Type0) = {
   parentTrait1SelfInst : parentTrait1_t self;
 }
 
 (** Trait implementation: [traits::{usize#9}]
-    Source: 'src/traits.rs', lines 224:0-224:27 *)
+    Source: 'src/traits.rs', lines 228:0-228:27 *)
 let traits_ParentTrait1UsizeInst : parentTrait1_t usize = ()
 
 (** Trait implementation: [traits::{usize#10}]
-    Source: 'src/traits.rs', lines 225:0-225:26 *)
+    Source: 'src/traits.rs', lines 229:0-229:26 *)
 let traits_ChildTrait1UsizeInst : childTrait1_t usize = {
   parentTrait1SelfInst = traits_ParentTrait1UsizeInst;
 }
 
 (** Trait declaration: [traits::Iterator]
-    Source: 'src/traits.rs', lines 229:0-229:18 *)
+    Source: 'src/traits.rs', lines 233:0-233:18 *)
 noeq type iterator_t (self : Type0) = { tItem : Type0; }
 
 (** Trait declaration: [traits::IntoIterator]
-    Source: 'src/traits.rs', lines 233:0-233:22 *)
+    Source: 'src/traits.rs', lines 237:0-237:22 *)
 noeq type intoIterator_t (self : Type0) = {
   tItem : Type0;
   tIntoIter : Type0;
@@ -379,29 +386,29 @@ noeq type intoIterator_t (self : Type0) = {
 }
 
 (** Trait declaration: [traits::FromResidual]
-    Source: 'src/traits.rs', lines 250:0-250:21 *)
+    Source: 'src/traits.rs', lines 254:0-254:21 *)
 type fromResidual_t (self t : Type0) = unit
 
 (** Trait declaration: [traits::Try]
-    Source: 'src/traits.rs', lines 246:0-246:48 *)
+    Source: 'src/traits.rs', lines 250:0-250:48 *)
 noeq type try_t (self : Type0) = {
   tResidual : Type0;
   fromResidualSelftraitsTrySelfResidualInst : fromResidual_t self tResidual;
 }
 
 (** Trait declaration: [traits::WithTarget]
-    Source: 'src/traits.rs', lines 252:0-252:20 *)
+    Source: 'src/traits.rs', lines 256:0-256:20 *)
 noeq type withTarget_t (self : Type0) = { tTarget : Type0; }
 
 (** Trait declaration: [traits::ParentTrait2]
-    Source: 'src/traits.rs', lines 256:0-256:22 *)
+    Source: 'src/traits.rs', lines 260:0-260:22 *)
 noeq type parentTrait2_t (self : Type0) = {
   tU : Type0;
   tU_clause_0 : withTarget_t tU;
 }
 
 (** Trait declaration: [traits::ChildTrait2]
-    Source: 'src/traits.rs', lines 260:0-260:35 *)
+    Source: 'src/traits.rs', lines 264:0-264:35 *)
 noeq type childTrait2_t (self : Type0) = {
   parentTrait2SelfInst : parentTrait2_t self;
   convert : parentTrait2SelfInst.tU -> result
@@ -409,48 +416,59 @@ noeq type childTrait2_t (self : Type0) = {
 }
 
 (** Trait implementation: [traits::{u32#11}]
-    Source: 'src/traits.rs', lines 264:0-264:23 *)
+    Source: 'src/traits.rs', lines 268:0-268:23 *)
 let traits_WithTargetU32Inst : withTarget_t u32 = { tTarget = u32; }
 
 (** Trait implementation: [traits::{u32#12}]
-    Source: 'src/traits.rs', lines 268:0-268:25 *)
+    Source: 'src/traits.rs', lines 272:0-272:25 *)
 let traits_ParentTrait2U32Inst : parentTrait2_t u32 = {
   tU = u32;
   tU_clause_0 = traits_WithTargetU32Inst;
 }
 
-(** [traits::{u32#13}::convert]: forward function
-    Source: 'src/traits.rs', lines 273:4-273:29 *)
+(** [traits::{u32#13}::convert]:
+    Source: 'src/traits.rs', lines 277:4-277:29 *)
 let u32_convert (x : u32) : result u32 =
   Return x
 
 (** Trait implementation: [traits::{u32#13}]
-    Source: 'src/traits.rs', lines 272:0-272:24 *)
+    Source: 'src/traits.rs', lines 276:0-276:24 *)
 let traits_ChildTrait2U32Inst : childTrait2_t u32 = {
   parentTrait2SelfInst = traits_ParentTrait2U32Inst;
   convert = u32_convert;
 }
 
 (** Trait declaration: [traits::CFnOnce]
-    Source: 'src/traits.rs', lines 286:0-286:23 *)
+    Source: 'src/traits.rs', lines 290:0-290:23 *)
 noeq type cFnOnce_t (self args : Type0) = {
   tOutput : Type0;
   call_once : self -> args -> result tOutput;
 }
 
 (** Trait declaration: [traits::CFnMut]
-    Source: 'src/traits.rs', lines 292:0-292:37 *)
+    Source: 'src/traits.rs', lines 296:0-296:37 *)
 noeq type cFnMut_t (self args : Type0) = {
   cFnOnceSelfArgsInst : cFnOnce_t self args;
-  call_mut : self -> args -> result cFnOnceSelfArgsInst.tOutput;
-  call_mut_back : self -> args -> cFnOnceSelfArgsInst.tOutput -> result self;
+  call_mut : self -> args -> result (cFnOnceSelfArgsInst.tOutput & self);
 }
 
 (** Trait declaration: [traits::CFn]
-    Source: 'src/traits.rs', lines 296:0-296:33 *)
+    Source: 'src/traits.rs', lines 300:0-300:33 *)
 noeq type cFn_t (self args : Type0) = {
   cFnMutSelfArgsInst : cFnMut_t self args;
-  call_mut : self -> args -> result
-    cFnMutSelfArgsInst.cFnOnceSelfArgsInst.tOutput;
+  call : self -> args -> result cFnMutSelfArgsInst.cFnOnceSelfArgsInst.tOutput;
+}
+
+(** Trait declaration: [traits::GetTrait]
+    Source: 'src/traits.rs', lines 304:0-304:18 *)
+noeq type getTrait_t (self : Type0) = { tW : Type0; get_w : self -> result tW;
 }
 
+(** [traits::test_get_trait]:
+    Source: 'src/traits.rs', lines 309:0-309:49 *)
+let test_get_trait
+  (t : Type0) (getTraitTInst : getTrait_t t) (x : t) :
+  result getTraitTInst.tW
+  =
+  getTraitTInst.get_w x
+
diff --git a/tests/lean/Array.lean b/tests/lean/Array.lean
index 25dad3cf..20f3425e 100644
--- a/tests/lean/Array.lean
+++ b/tests/lean/Array.lean
@@ -11,99 +11,94 @@ inductive AB :=
 | A : AB
 | B : AB
 
-/- [array::incr]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [array::incr]:
    Source: 'src/array.rs', lines 8:0-8:24 -/
 def incr (x : U32) : Result U32 :=
   x + 1#u32
 
-/- [array::array_to_shared_slice_]: forward function
+/- [array::array_to_shared_slice_]:
    Source: 'src/array.rs', lines 16:0-16:53 -/
 def array_to_shared_slice_
   (T : Type) (s : Array T 32#usize) : Result (Slice T) :=
   Array.to_slice T 32#usize s
 
-/- [array::array_to_mut_slice_]: forward function
+/- [array::array_to_mut_slice_]:
    Source: 'src/array.rs', lines 21:0-21:58 -/
-def array_to_mut_slice_ (T : Type) (s : Array T 32#usize) : Result (Slice T) :=
-  Array.to_slice T 32#usize s
-
-/- [array::array_to_mut_slice_]: backward function 0
-   Source: 'src/array.rs', lines 21:0-21:58 -/
-def array_to_mut_slice__back
-  (T : Type) (s : Array T 32#usize) (ret : Slice T) :
-  Result (Array T 32#usize)
+def array_to_mut_slice_
+  (T : Type) (s : Array T 32#usize) :
+  Result ((Slice T) × (Slice T → Result (Array T 32#usize)))
   :=
-  Array.from_slice T 32#usize s ret
+  do
+  let (s1, to_slice_mut_back) ← Array.to_slice_mut T 32#usize s
+  let back := fun ret => to_slice_mut_back ret
+  Result.ret (s1, back)
 
-/- [array::array_len]: forward function
+/- [array::array_len]:
    Source: 'src/array.rs', lines 25:0-25:40 -/
 def array_len (T : Type) (s : Array T 32#usize) : Result Usize :=
   do
-    let s0 ← Array.to_slice T 32#usize s
-    let i := Slice.len T s0
-    Result.ret i
+  let s1 ← Array.to_slice T 32#usize s
+  let i := Slice.len T s1
+  Result.ret i
 
-/- [array::shared_array_len]: forward function
+/- [array::shared_array_len]:
    Source: 'src/array.rs', lines 29:0-29:48 -/
 def shared_array_len (T : Type) (s : Array T 32#usize) : Result Usize :=
   do
-    let s0 ← Array.to_slice T 32#usize s
-    let i := Slice.len T s0
-    Result.ret i
+  let s1 ← Array.to_slice T 32#usize s
+  let i := Slice.len T s1
+  Result.ret i
 
-/- [array::shared_slice_len]: forward function
+/- [array::shared_slice_len]:
    Source: 'src/array.rs', lines 33:0-33:44 -/
 def shared_slice_len (T : Type) (s : Slice T) : Result Usize :=
   let i := Slice.len T s
   Result.ret i
 
-/- [array::index_array_shared]: forward function
+/- [array::index_array_shared]:
    Source: 'src/array.rs', lines 37:0-37:57 -/
 def index_array_shared
   (T : Type) (s : Array T 32#usize) (i : Usize) : Result T :=
   Array.index_usize T 32#usize s i
 
-/- [array::index_array_u32]: forward function
+/- [array::index_array_u32]:
    Source: 'src/array.rs', lines 44:0-44:53 -/
 def index_array_u32 (s : Array U32 32#usize) (i : Usize) : Result U32 :=
   Array.index_usize U32 32#usize s i
 
-/- [array::index_array_copy]: forward function
+/- [array::index_array_copy]:
    Source: 'src/array.rs', lines 48:0-48:45 -/
 def index_array_copy (x : Array U32 32#usize) : Result U32 :=
   Array.index_usize U32 32#usize x 0#usize
 
-/- [array::index_mut_array]: forward function
+/- [array::index_mut_array]:
    Source: 'src/array.rs', lines 52:0-52:62 -/
-def index_mut_array (T : Type) (s : Array T 32#usize) (i : Usize) : Result T :=
-  Array.index_usize T 32#usize s i
-
-/- [array::index_mut_array]: backward function 0
-   Source: 'src/array.rs', lines 52:0-52:62 -/
-def index_mut_array_back
-  (T : Type) (s : Array T 32#usize) (i : Usize) (ret : T) :
-  Result (Array T 32#usize)
+def index_mut_array
+  (T : Type) (s : Array T 32#usize) (i : Usize) :
+  Result (T × (T → Result (Array T 32#usize)))
   :=
-  Array.update_usize T 32#usize s i ret
+  do
+  let (t, index_mut_back) ← Array.index_mut_usize T 32#usize s i
+  let back := fun ret => index_mut_back ret
+  Result.ret (t, back)
 
-/- [array::index_slice]: forward function
+/- [array::index_slice]:
    Source: 'src/array.rs', lines 56:0-56:46 -/
 def index_slice (T : Type) (s : Slice T) (i : Usize) : Result T :=
   Slice.index_usize T s i
 
-/- [array::index_mut_slice]: forward function
+/- [array::index_mut_slice]:
    Source: 'src/array.rs', lines 60:0-60:58 -/
-def index_mut_slice (T : Type) (s : Slice T) (i : Usize) : Result T :=
-  Slice.index_usize T s i
-
-/- [array::index_mut_slice]: backward function 0
-   Source: 'src/array.rs', lines 60:0-60:58 -/
-def index_mut_slice_back
-  (T : Type) (s : Slice T) (i : Usize) (ret : T) : Result (Slice T) :=
-  Slice.update_usize T s i ret
+def index_mut_slice
+  (T : Type) (s : Slice T) (i : Usize) :
+  Result (T × (T → Result (Slice T)))
+  :=
+  do
+  let (t, index_mut_back) ← Slice.index_mut_usize T s i
+  let back := fun ret => index_mut_back ret
+  Result.ret (t, back)
 
-/- [array::slice_subslice_shared_]: forward function
+/- [array::slice_subslice_shared_]:
    Source: 'src/array.rs', lines 64:0-64:70 -/
 def slice_subslice_shared_
   (x : Slice U32) (y : Usize) (z : Usize) : Result (Slice U32) :=
@@ -111,41 +106,37 @@ def slice_subslice_shared_
     (core.slice.index.SliceIndexRangeUsizeSliceTInst U32) x
     { start := y, end_ := z }
 
-/- [array::slice_subslice_mut_]: forward function
+/- [array::slice_subslice_mut_]:
    Source: 'src/array.rs', lines 68:0-68:75 -/
 def slice_subslice_mut_
-  (x : Slice U32) (y : Usize) (z : Usize) : Result (Slice U32) :=
-  core.slice.index.Slice.index_mut U32 (core.ops.range.Range Usize)
-    (core.slice.index.SliceIndexRangeUsizeSliceTInst U32) x
-    { start := y, end_ := z }
-
-/- [array::slice_subslice_mut_]: backward function 0
-   Source: 'src/array.rs', lines 68:0-68:75 -/
-def slice_subslice_mut__back
-  (x : Slice U32) (y : Usize) (z : Usize) (ret : Slice U32) :
-  Result (Slice U32)
+  (x : Slice U32) (y : Usize) (z : Usize) :
+  Result ((Slice U32) × (Slice U32 → Result (Slice U32)))
   :=
-  core.slice.index.Slice.index_mut_back U32 (core.ops.range.Range Usize)
-    (core.slice.index.SliceIndexRangeUsizeSliceTInst U32) x
-    { start := y, end_ := z } ret
-
-/- [array::array_to_slice_shared_]: forward function
+  do
+  let (s, index_mut_back) ←
+    core.slice.index.Slice.index_mut U32 (core.ops.range.Range Usize)
+      (core.slice.index.SliceIndexRangeUsizeSliceTInst U32) x
+      { start := y, end_ := z }
+  let back := fun ret => index_mut_back ret
+  Result.ret (s, back)
+
+/- [array::array_to_slice_shared_]:
    Source: 'src/array.rs', lines 72:0-72:54 -/
 def array_to_slice_shared_ (x : Array U32 32#usize) : Result (Slice U32) :=
   Array.to_slice U32 32#usize x
 
-/- [array::array_to_slice_mut_]: forward function
+/- [array::array_to_slice_mut_]:
    Source: 'src/array.rs', lines 76:0-76:59 -/
-def array_to_slice_mut_ (x : Array U32 32#usize) : Result (Slice U32) :=
-  Array.to_slice U32 32#usize x
-
-/- [array::array_to_slice_mut_]: backward function 0
-   Source: 'src/array.rs', lines 76:0-76:59 -/
-def array_to_slice_mut__back
-  (x : Array U32 32#usize) (ret : Slice U32) : Result (Array U32 32#usize) :=
-  Array.from_slice U32 32#usize x ret
+def array_to_slice_mut_
+  (x : Array U32 32#usize) :
+  Result ((Slice U32) × (Slice U32 → Result (Array U32 32#usize)))
+  :=
+  do
+  let (s, to_slice_mut_back) ← Array.to_slice_mut U32 32#usize x
+  let back := fun ret => to_slice_mut_back ret
+  Result.ret (s, back)
 
-/- [array::array_subslice_shared_]: forward function
+/- [array::array_subslice_shared_]:
    Source: 'src/array.rs', lines 80:0-80:74 -/
 def array_subslice_shared_
   (x : Array U32 32#usize) (y : Usize) (z : Usize) : Result (Slice U32) :=
@@ -154,311 +145,295 @@ def array_subslice_shared_
     (core.slice.index.SliceIndexRangeUsizeSliceTInst U32)) x
     { start := y, end_ := z }
 
-/- [array::array_subslice_mut_]: forward function
+/- [array::array_subslice_mut_]:
    Source: 'src/array.rs', lines 84:0-84:79 -/
 def array_subslice_mut_
-  (x : Array U32 32#usize) (y : Usize) (z : Usize) : Result (Slice U32) :=
-  core.array.Array.index_mut U32 (core.ops.range.Range Usize) 32#usize
-    (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
-    (core.slice.index.SliceIndexRangeUsizeSliceTInst U32)) x
-    { start := y, end_ := z }
-
-/- [array::array_subslice_mut_]: backward function 0
-   Source: 'src/array.rs', lines 84:0-84:79 -/
-def array_subslice_mut__back
-  (x : Array U32 32#usize) (y : Usize) (z : Usize) (ret : Slice U32) :
-  Result (Array U32 32#usize)
+  (x : Array U32 32#usize) (y : Usize) (z : Usize) :
+  Result ((Slice U32) × (Slice U32 → Result (Array U32 32#usize)))
   :=
-  core.array.Array.index_mut_back U32 (core.ops.range.Range Usize) 32#usize
-    (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
-    (core.slice.index.SliceIndexRangeUsizeSliceTInst U32)) x
-    { start := y, end_ := z } ret
-
-/- [array::index_slice_0]: forward function
+  do
+  let (s, index_mut_back) ←
+    core.array.Array.index_mut U32 (core.ops.range.Range Usize) 32#usize
+      (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
+      (core.slice.index.SliceIndexRangeUsizeSliceTInst U32)) x
+      { start := y, end_ := z }
+  let back := fun ret => index_mut_back ret
+  Result.ret (s, back)
+
+/- [array::index_slice_0]:
    Source: 'src/array.rs', lines 88:0-88:38 -/
 def index_slice_0 (T : Type) (s : Slice T) : Result T :=
   Slice.index_usize T s 0#usize
 
-/- [array::index_array_0]: forward function
+/- [array::index_array_0]:
    Source: 'src/array.rs', lines 92:0-92:42 -/
 def index_array_0 (T : Type) (s : Array T 32#usize) : Result T :=
   Array.index_usize T 32#usize s 0#usize
 
-/- [array::index_index_array]: forward function
+/- [array::index_index_array]:
    Source: 'src/array.rs', lines 103:0-103:71 -/
 def index_index_array
   (s : Array (Array U32 32#usize) 32#usize) (i : Usize) (j : Usize) :
   Result U32
   :=
   do
-    let a ← Array.index_usize (Array U32 32#usize) 32#usize s i
-    Array.index_usize U32 32#usize a j
+  let a ← Array.index_usize (Array U32 32#usize) 32#usize s i
+  Array.index_usize U32 32#usize a j
 
-/- [array::update_update_array]: forward function
+/- [array::update_update_array]:
    Source: 'src/array.rs', lines 114:0-114:70 -/
 def update_update_array
   (s : Array (Array U32 32#usize) 32#usize) (i : Usize) (j : Usize) :
   Result Unit
   :=
   do
-    let a ← Array.index_usize (Array U32 32#usize) 32#usize s i
-    let a0 ← Array.update_usize U32 32#usize a j 0#u32
-    let _ ← Array.update_usize (Array U32 32#usize) 32#usize s i a0
-    Result.ret ()
+  let (a, index_mut_back) ←
+    Array.index_mut_usize (Array U32 32#usize) 32#usize s i
+  let (_, index_mut_back1) ← Array.index_mut_usize U32 32#usize a j
+  let a1 ← index_mut_back1 0#u32
+  let _ ← index_mut_back a1
+  Result.ret ()
 
-/- [array::array_local_deep_copy]: forward function
+/- [array::array_local_deep_copy]:
    Source: 'src/array.rs', lines 118:0-118:43 -/
 def array_local_deep_copy (x : Array U32 32#usize) : Result Unit :=
   Result.ret ()
 
-/- [array::take_array]: forward function
+/- [array::take_array]:
    Source: 'src/array.rs', lines 122:0-122:30 -/
 def take_array (a : Array U32 2#usize) : Result Unit :=
   Result.ret ()
 
-/- [array::take_array_borrow]: forward function
+/- [array::take_array_borrow]:
    Source: 'src/array.rs', lines 123:0-123:38 -/
 def take_array_borrow (a : Array U32 2#usize) : Result Unit :=
   Result.ret ()
 
-/- [array::take_slice]: forward function
+/- [array::take_slice]:
    Source: 'src/array.rs', lines 124:0-124:28 -/
 def take_slice (s : Slice U32) : Result Unit :=
   Result.ret ()
 
-/- [array::take_mut_slice]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [array::take_mut_slice]:
    Source: 'src/array.rs', lines 125:0-125:36 -/
 def take_mut_slice (s : Slice U32) : Result (Slice U32) :=
   Result.ret s
 
-/- [array::const_array]: forward function
+/- [array::const_array]:
    Source: 'src/array.rs', lines 127:0-127:32 -/
 def const_array : Result (Array U32 2#usize) :=
   Result.ret (Array.make U32 2#usize [ 0#u32, 0#u32 ])
 
-/- [array::const_slice]: forward function
+/- [array::const_slice]:
    Source: 'src/array.rs', lines 131:0-131:20 -/
 def const_slice : Result Unit :=
   do
-    let _ ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    Result.ret ()
+  let _ ←
+    Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  Result.ret ()
 
-/- [array::take_all]: forward function
+/- [array::take_all]:
    Source: 'src/array.rs', lines 141:0-141:17 -/
 def take_all : Result Unit :=
   do
-    let _ ← take_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let _ ← take_array_borrow (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let s ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let _ ← take_slice s
-    let s0 ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let s1 ← take_mut_slice s0
-    let _ ←
-      Array.from_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ]) s1
-    Result.ret ()
-
-/- [array::index_array]: forward function
+  let _ ← take_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let _ ← take_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let _ ← take_array_borrow (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let s ←
+    Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let _ ← take_slice s
+  let (s1, to_slice_mut_back) ←
+    Array.to_slice_mut U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let s2 ← take_mut_slice s1
+  let _ ← to_slice_mut_back s2
+  Result.ret ()
+
+/- [array::index_array]:
    Source: 'src/array.rs', lines 155:0-155:38 -/
 def index_array (x : Array U32 2#usize) : Result U32 :=
   Array.index_usize U32 2#usize x 0#usize
 
-/- [array::index_array_borrow]: forward function
+/- [array::index_array_borrow]:
    Source: 'src/array.rs', lines 158:0-158:46 -/
 def index_array_borrow (x : Array U32 2#usize) : Result U32 :=
   Array.index_usize U32 2#usize x 0#usize
 
-/- [array::index_slice_u32_0]: forward function
+/- [array::index_slice_u32_0]:
    Source: 'src/array.rs', lines 162:0-162:42 -/
 def index_slice_u32_0 (x : Slice U32) : Result U32 :=
   Slice.index_usize U32 x 0#usize
 
-/- [array::index_mut_slice_u32_0]: forward function
+/- [array::index_mut_slice_u32_0]:
    Source: 'src/array.rs', lines 166:0-166:50 -/
-def index_mut_slice_u32_0 (x : Slice U32) : Result U32 :=
-  Slice.index_usize U32 x 0#usize
-
-/- [array::index_mut_slice_u32_0]: backward function 0
-   Source: 'src/array.rs', lines 166:0-166:50 -/
-def index_mut_slice_u32_0_back (x : Slice U32) : Result (Slice U32) :=
+def index_mut_slice_u32_0 (x : Slice U32) : Result (U32 × (Slice U32)) :=
   do
-    let _ ← Slice.index_usize U32 x 0#usize
-    Result.ret x
+  let i ← Slice.index_usize U32 x 0#usize
+  Result.ret (i, x)
 
-/- [array::index_all]: forward function
+/- [array::index_all]:
    Source: 'src/array.rs', lines 170:0-170:25 -/
 def index_all : Result U32 :=
   do
-    let i ← index_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let i0 ← index_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let i1 ← i + i0
-    let i2 ← index_array_borrow (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let i3 ← i1 + i2
-    let s ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let i4 ← index_slice_u32_0 s
-    let i5 ← i3 + i4
-    let s0 ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let i6 ← index_mut_slice_u32_0 s0
-    let i7 ← i5 + i6
-    let s1 ← index_mut_slice_u32_0_back s0
-    let _ ←
-      Array.from_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ]) s1
-    Result.ret i7
-
-/- [array::update_array]: forward function
+  let i ← index_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let i1 ← index_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let i2 ← i + i1
+  let i3 ← index_array_borrow (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let i4 ← i2 + i3
+  let s ←
+    Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let i5 ← index_slice_u32_0 s
+  let i6 ← i4 + i5
+  let (s1, to_slice_mut_back) ←
+    Array.to_slice_mut U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let (i7, s2) ← index_mut_slice_u32_0 s1
+  let i8 ← i6 + i7
+  let _ ← to_slice_mut_back s2
+  Result.ret i8
+
+/- [array::update_array]:
    Source: 'src/array.rs', lines 184:0-184:36 -/
 def update_array (x : Array U32 2#usize) : Result Unit :=
   do
-    let _ ← Array.update_usize U32 2#usize x 0#usize 1#u32
-    Result.ret ()
+  let (_, index_mut_back) ← Array.index_mut_usize U32 2#usize x 0#usize
+  let _ ← index_mut_back 1#u32
+  Result.ret ()
 
-/- [array::update_array_mut_borrow]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [array::update_array_mut_borrow]:
    Source: 'src/array.rs', lines 187:0-187:48 -/
 def update_array_mut_borrow
   (x : Array U32 2#usize) : Result (Array U32 2#usize) :=
-  Array.update_usize U32 2#usize x 0#usize 1#u32
+  do
+  let (_, index_mut_back) ← Array.index_mut_usize U32 2#usize x 0#usize
+  index_mut_back 1#u32
 
-/- [array::update_mut_slice]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [array::update_mut_slice]:
    Source: 'src/array.rs', lines 190:0-190:38 -/
 def update_mut_slice (x : Slice U32) : Result (Slice U32) :=
-  Slice.update_usize U32 x 0#usize 1#u32
+  do
+  let (_, index_mut_back) ← Slice.index_mut_usize U32 x 0#usize
+  index_mut_back 1#u32
 
-/- [array::update_all]: forward function
+/- [array::update_all]:
    Source: 'src/array.rs', lines 194:0-194:19 -/
 def update_all : Result Unit :=
   do
-    let _ ← update_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let x ← update_array_mut_borrow (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let s ← Array.to_slice U32 2#usize x
-    let s0 ← update_mut_slice s
-    let _ ← Array.from_slice U32 2#usize x s0
-    Result.ret ()
-
-/- [array::range_all]: forward function
+  let _ ← update_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let _ ← update_array (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let a ← update_array_mut_borrow (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let (s, to_slice_mut_back) ← Array.to_slice_mut U32 2#usize a
+  let s1 ← update_mut_slice s
+  let _ ← to_slice_mut_back s1
+  Result.ret ()
+
+/- [array::range_all]:
    Source: 'src/array.rs', lines 205:0-205:18 -/
 def range_all : Result Unit :=
   do
-    let s ←
-      core.array.Array.index_mut U32 (core.ops.range.Range Usize) 4#usize
-        (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
-        (core.slice.index.SliceIndexRangeUsizeSliceTInst U32))
-        (Array.make U32 4#usize [ 0#u32, 0#u32, 0#u32, 0#u32 ])
-        { start := 1#usize, end_ := 3#usize }
-    let s0 ← update_mut_slice s
-    let _ ←
-      core.array.Array.index_mut_back U32 (core.ops.range.Range Usize) 4#usize
-        (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
-        (core.slice.index.SliceIndexRangeUsizeSliceTInst U32))
-        (Array.make U32 4#usize [ 0#u32, 0#u32, 0#u32, 0#u32 ])
-        { start := 1#usize, end_ := 3#usize } s0
-    Result.ret ()
-
-/- [array::deref_array_borrow]: forward function
+  let (s, index_mut_back) ←
+    core.array.Array.index_mut U32 (core.ops.range.Range Usize) 4#usize
+      (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
+      (core.slice.index.SliceIndexRangeUsizeSliceTInst U32))
+      (Array.make U32 4#usize [ 0#u32, 0#u32, 0#u32, 0#u32 ])
+      { start := 1#usize, end_ := 3#usize }
+  let s1 ← update_mut_slice s
+  let _ ← index_mut_back s1
+  Result.ret ()
+
+/- [array::deref_array_borrow]:
    Source: 'src/array.rs', lines 214:0-214:46 -/
 def deref_array_borrow (x : Array U32 2#usize) : Result U32 :=
   Array.index_usize U32 2#usize x 0#usize
 
-/- [array::deref_array_mut_borrow]: forward function
-   Source: 'src/array.rs', lines 219:0-219:54 -/
-def deref_array_mut_borrow (x : Array U32 2#usize) : Result U32 :=
-  Array.index_usize U32 2#usize x 0#usize
-
-/- [array::deref_array_mut_borrow]: backward function 0
+/- [array::deref_array_mut_borrow]:
    Source: 'src/array.rs', lines 219:0-219:54 -/
-def deref_array_mut_borrow_back
-  (x : Array U32 2#usize) : Result (Array U32 2#usize) :=
+def deref_array_mut_borrow
+  (x : Array U32 2#usize) : Result (U32 × (Array U32 2#usize)) :=
   do
-    let _ ← Array.index_usize U32 2#usize x 0#usize
-    Result.ret x
+  let i ← Array.index_usize U32 2#usize x 0#usize
+  Result.ret (i, x)
 
-/- [array::take_array_t]: forward function
+/- [array::take_array_t]:
    Source: 'src/array.rs', lines 227:0-227:31 -/
 def take_array_t (a : Array AB 2#usize) : Result Unit :=
   Result.ret ()
 
-/- [array::non_copyable_array]: forward function
+/- [array::non_copyable_array]:
    Source: 'src/array.rs', lines 229:0-229:27 -/
 def non_copyable_array : Result Unit :=
   do
-    let _ ← take_array_t (Array.make AB 2#usize [ AB.A, AB.B ])
-    Result.ret ()
+  let _ ← take_array_t (Array.make AB 2#usize [ AB.A, AB.B ])
+  Result.ret ()
 
-/- [array::sum]: loop 0: forward function
+/- [array::sum]: loop 0:
    Source: 'src/array.rs', lines 242:0-250:1 -/
-divergent def sum_loop (s : Slice U32) (sum0 : U32) (i : Usize) : Result U32 :=
-  let i0 := Slice.len U32 s
-  if i < i0
+divergent def sum_loop (s : Slice U32) (sum1 : U32) (i : Usize) : Result U32 :=
+  let i1 := Slice.len U32 s
+  if i < i1
   then
     do
-      let i1 ← Slice.index_usize U32 s i
-      let sum1 ← sum0 + i1
-      let i2 ← i + 1#usize
-      sum_loop s sum1 i2
-  else Result.ret sum0
+    let i2 ← Slice.index_usize U32 s i
+    let sum3 ← sum1 + i2
+    let i3 ← i + 1#usize
+    sum_loop s sum3 i3
+  else Result.ret sum1
 
-/- [array::sum]: forward function
+/- [array::sum]:
    Source: 'src/array.rs', lines 242:0-242:28 -/
 def sum (s : Slice U32) : Result U32 :=
   sum_loop s 0#u32 0#usize
 
-/- [array::sum2]: loop 0: forward function
+/- [array::sum2]: loop 0:
    Source: 'src/array.rs', lines 252:0-261:1 -/
 divergent def sum2_loop
-  (s : Slice U32) (s2 : Slice U32) (sum0 : U32) (i : Usize) : Result U32 :=
-  let i0 := Slice.len U32 s
-  if i < i0
+  (s : Slice U32) (s2 : Slice U32) (sum1 : U32) (i : Usize) : Result U32 :=
+  let i1 := Slice.len U32 s
+  if i < i1
   then
     do
-      let i1 ← Slice.index_usize U32 s i
-      let i2 ← Slice.index_usize U32 s2 i
-      let i3 ← i1 + i2
-      let sum1 ← sum0 + i3
-      let i4 ← i + 1#usize
-      sum2_loop s s2 sum1 i4
-  else Result.ret sum0
-
-/- [array::sum2]: forward function
+    let i2 ← Slice.index_usize U32 s i
+    let i3 ← Slice.index_usize U32 s2 i
+    let i4 ← i2 + i3
+    let sum3 ← sum1 + i4
+    let i5 ← i + 1#usize
+    sum2_loop s s2 sum3 i5
+  else Result.ret sum1
+
+/- [array::sum2]:
    Source: 'src/array.rs', lines 252:0-252:41 -/
 def sum2 (s : Slice U32) (s2 : Slice U32) : Result U32 :=
   let i := Slice.len U32 s
-  let i0 := Slice.len U32 s2
-  if not (i = i0)
+  let i1 := Slice.len U32 s2
+  if not (i = i1)
   then Result.fail .panic
   else sum2_loop s s2 0#u32 0#usize
 
-/- [array::f0]: forward function
+/- [array::f0]:
    Source: 'src/array.rs', lines 263:0-263:11 -/
 def f0 : Result Unit :=
   do
-    let s ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
-    let s0 ← Slice.update_usize U32 s 0#usize 1#u32
-    let _ ←
-      Array.from_slice U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ]) s0
-    Result.ret ()
-
-/- [array::f1]: forward function
+  let (s, to_slice_mut_back) ←
+    Array.to_slice_mut U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
+  let (_, index_mut_back) ← Slice.index_mut_usize U32 s 0#usize
+  let s1 ← index_mut_back 1#u32
+  let _ ← to_slice_mut_back s1
+  Result.ret ()
+
+/- [array::f1]:
    Source: 'src/array.rs', lines 268:0-268:11 -/
 def f1 : Result Unit :=
   do
-    let _ ←
-      Array.update_usize U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
-        0#usize 1#u32
-    Result.ret ()
+  let (_, index_mut_back) ←
+    Array.index_mut_usize U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
+      0#usize
+  let _ ← index_mut_back 1#u32
+  Result.ret ()
 
-/- [array::f2]: forward function
+/- [array::f2]:
    Source: 'src/array.rs', lines 273:0-273:17 -/
 def f2 (i : U32) : Result Unit :=
   Result.ret ()
 
-/- [array::f4]: forward function
+/- [array::f4]:
    Source: 'src/array.rs', lines 282:0-282:54 -/
 def f4 (x : Array U32 32#usize) (y : Usize) (z : Usize) : Result (Slice U32) :=
   core.array.Array.index U32 (core.ops.range.Range Usize) 32#usize
@@ -466,44 +441,42 @@ def f4 (x : Array U32 32#usize) (y : Usize) (z : Usize) : Result (Slice U32) :=
     (core.slice.index.SliceIndexRangeUsizeSliceTInst U32)) x
     { start := y, end_ := z }
 
-/- [array::f3]: forward function
+/- [array::f3]:
    Source: 'src/array.rs', lines 275:0-275:18 -/
 def f3 : Result U32 :=
   do
-    let i ←
-      Array.index_usize U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
-        0#usize
-    let _ ← f2 i
-    let b := Array.repeat U32 32#usize 0#u32
-    let s ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
-    let s0 ← f4 b 16#usize 18#usize
-    sum2 s s0
+  let i ←
+    Array.index_usize U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
+      0#usize
+  let _ ← f2 i
+  let b := Array.repeat U32 32#usize 0#u32
+  let s ←
+    Array.to_slice U32 2#usize (Array.make U32 2#usize [ 1#u32, 2#u32 ])
+  let s1 ← f4 b 16#usize 18#usize
+  sum2 s s1
 
 /- [array::SZ]
    Source: 'src/array.rs', lines 286:0-286:19 -/
 def sz_body : Result Usize := Result.ret 32#usize
 def sz_c : Usize := eval_global sz_body (by simp)
 
-/- [array::f5]: forward function
+/- [array::f5]:
    Source: 'src/array.rs', lines 289:0-289:31 -/
 def f5 (x : Array U32 32#usize) : Result U32 :=
   Array.index_usize U32 32#usize x 0#usize
 
-/- [array::ite]: forward function
+/- [array::ite]:
    Source: 'src/array.rs', lines 294:0-294:12 -/
 def ite : Result Unit :=
   do
-    let s ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let s0 ←
-      Array.to_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
-    let s1 ← index_mut_slice_u32_0_back s0
-    let _ ←
-      Array.from_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ]) s1
-    let s2 ← index_mut_slice_u32_0_back s
-    let _ ←
-      Array.from_slice U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ]) s2
-    Result.ret ()
+  let (s, to_slice_mut_back) ←
+    Array.to_slice_mut U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let (_, s1) ← index_mut_slice_u32_0 s
+  let (s2, to_slice_mut_back1) ←
+    Array.to_slice_mut U32 2#usize (Array.make U32 2#usize [ 0#u32, 0#u32 ])
+  let (_, s3) ← index_mut_slice_u32_0 s2
+  let _ ← to_slice_mut_back1 s3
+  let _ ← to_slice_mut_back s1
+  Result.ret ()
 
 end array
diff --git a/tests/lean/BetreeMain/Funs.lean b/tests/lean/BetreeMain/Funs.lean
index 0d7cb984..4e64d217 100644
--- a/tests/lean/BetreeMain/Funs.lean
+++ b/tests/lean/BetreeMain/Funs.lean
@@ -7,7 +7,7 @@ open Primitives
 
 namespace betree_main
 
-/- [betree_main::betree::load_internal_node]: forward function
+/- [betree_main::betree::load_internal_node]:
    Source: 'src/betree.rs', lines 36:0-36:52 -/
 def betree.load_internal_node
   (id : U64) (st : State) :
@@ -15,65 +15,53 @@ def betree.load_internal_node
   :=
   betree_utils.load_internal_node id st
 
-/- [betree_main::betree::store_internal_node]: forward function
+/- [betree_main::betree::store_internal_node]:
    Source: 'src/betree.rs', lines 41:0-41:60 -/
 def betree.store_internal_node
   (id : U64) (content : betree.List (U64 × betree.Message)) (st : State) :
   Result (State × Unit)
   :=
   do
-    let (st0, _) ← betree_utils.store_internal_node id content st
-    Result.ret (st0, ())
+  let (st1, _) ← betree_utils.store_internal_node id content st
+  Result.ret (st1, ())
 
-/- [betree_main::betree::load_leaf_node]: forward function
+/- [betree_main::betree::load_leaf_node]:
    Source: 'src/betree.rs', lines 46:0-46:44 -/
 def betree.load_leaf_node
   (id : U64) (st : State) : Result (State × (betree.List (U64 × U64))) :=
   betree_utils.load_leaf_node id st
 
-/- [betree_main::betree::store_leaf_node]: forward function
+/- [betree_main::betree::store_leaf_node]:
    Source: 'src/betree.rs', lines 51:0-51:52 -/
 def betree.store_leaf_node
   (id : U64) (content : betree.List (U64 × U64)) (st : State) :
   Result (State × Unit)
   :=
   do
-    let (st0, _) ← betree_utils.store_leaf_node id content st
-    Result.ret (st0, ())
+  let (st1, _) ← betree_utils.store_leaf_node id content st
+  Result.ret (st1, ())
 
-/- [betree_main::betree::fresh_node_id]: forward function
+/- [betree_main::betree::fresh_node_id]:
    Source: 'src/betree.rs', lines 55:0-55:48 -/
-def betree.fresh_node_id (counter : U64) : Result U64 :=
+def betree.fresh_node_id (counter : U64) : Result (U64 × U64) :=
   do
-    let _ ← counter + 1#u64
-    Result.ret counter
+  let counter1 ← counter + 1#u64
+  Result.ret (counter, counter1)
 
-/- [betree_main::betree::fresh_node_id]: backward function 0
-   Source: 'src/betree.rs', lines 55:0-55:48 -/
-def betree.fresh_node_id_back (counter : U64) : Result U64 :=
-  counter + 1#u64
-
-/- [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]: forward function
+/- [betree_main::betree::{betree_main::betree::NodeIdCounter}::new]:
    Source: 'src/betree.rs', lines 206:4-206:20 -/
 def betree.NodeIdCounter.new : Result betree.NodeIdCounter :=
   Result.ret { next_node_id := 0#u64 }
 
-/- [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: forward function
+/- [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]:
    Source: 'src/betree.rs', lines 210:4-210:36 -/
-def betree.NodeIdCounter.fresh_id (self : betree.NodeIdCounter) : Result U64 :=
+def betree.NodeIdCounter.fresh_id
+  (self : betree.NodeIdCounter) : Result (U64 × betree.NodeIdCounter) :=
   do
-    let _ ← self.next_node_id + 1#u64
-    Result.ret self.next_node_id
+  let i ← self.next_node_id + 1#u64
+  Result.ret (self.next_node_id, { next_node_id := i })
 
-/- [betree_main::betree::{betree_main::betree::NodeIdCounter}::fresh_id]: backward function 0
-   Source: 'src/betree.rs', lines 210:4-210:36 -/
-def betree.NodeIdCounter.fresh_id_back
-  (self : betree.NodeIdCounter) : Result betree.NodeIdCounter :=
-  do
-    let i ← self.next_node_id + 1#u64
-    Result.ret { next_node_id := i }
-
-/- [betree_main::betree::upsert_update]: forward function
+/- [betree_main::betree::upsert_update]:
    Source: 'src/betree.rs', lines 234:0-234:70 -/
 def betree.upsert_update
   (prev : Option U64) (st : betree.UpsertFunState) : Result U64 :=
@@ -81,30 +69,30 @@ def betree.upsert_update
   | none =>
     match st with
     | betree.UpsertFunState.Add v => Result.ret v
-    | betree.UpsertFunState.Sub i => Result.ret 0#u64
-  | some prev0 =>
+    | betree.UpsertFunState.Sub _ => Result.ret 0#u64
+  | some prev1 =>
     match st with
     | betree.UpsertFunState.Add v =>
       do
-        let margin ← core_u64_max - prev0
-        if margin >= v
-        then prev0 + v
-        else Result.ret core_u64_max
+      let margin ← core_u64_max - prev1
+      if margin >= v
+      then prev1 + v
+      else Result.ret core_u64_max
     | betree.UpsertFunState.Sub v =>
-      if prev0 >= v
-      then prev0 - v
+      if prev1 >= v
+      then prev1 - v
       else Result.ret 0#u64
 
-/- [betree_main::betree::{betree_main::betree::List<T>#1}::len]: forward function
+/- [betree_main::betree::{betree_main::betree::List<T>#1}::len]:
    Source: 'src/betree.rs', lines 276:4-276:24 -/
 divergent def betree.List.len (T : Type) (self : betree.List T) : Result U64 :=
   match self with
-  | betree.List.Cons t tl => do
-                               let i ← betree.List.len T tl
-                               1#u64 + i
+  | betree.List.Cons _ tl => do
+                             let i ← betree.List.len T tl
+                             1#u64 + i
   | betree.List.Nil => Result.ret 0#u64
 
-/- [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]: forward function
+/- [betree_main::betree::{betree_main::betree::List<T>#1}::split_at]:
    Source: 'src/betree.rs', lines 284:4-284:51 -/
 divergent def betree.List.split_at
   (T : Type) (self : betree.List T) (n : U64) :
@@ -116,56 +104,47 @@ divergent def betree.List.split_at
     match self with
     | betree.List.Cons hd tl =>
       do
-        let i ← n - 1#u64
-        let p ← betree.List.split_at T tl i
-        let (ls0, ls1) := p
-        let l := ls0
-        Result.ret (betree.List.Cons hd l, ls1)
+      let i ← n - 1#u64
+      let p ← betree.List.split_at T tl i
+      let (ls0, ls1) := p
+      let l := ls0
+      Result.ret (betree.List.Cons hd l, ls1)
     | betree.List.Nil => Result.fail .panic
 
-/- [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]:
    Source: 'src/betree.rs', lines 299:4-299:34 -/
 def betree.List.push_front
   (T : Type) (self : betree.List T) (x : T) : Result (betree.List T) :=
-  let tl := core.mem.replace (betree.List T) self betree.List.Nil
+  let (tl, _) := core.mem.replace (betree.List T) self betree.List.Nil
   let l := tl
   Result.ret (betree.List.Cons x l)
 
-/- [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: forward function
-   Source: 'src/betree.rs', lines 306:4-306:32 -/
-def betree.List.pop_front (T : Type) (self : betree.List T) : Result T :=
-  let ls := core.mem.replace (betree.List T) self betree.List.Nil
-  match ls with
-  | betree.List.Cons x tl => Result.ret x
-  | betree.List.Nil => Result.fail .panic
-
-/- [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: backward function 0
+/- [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
    Source: 'src/betree.rs', lines 306:4-306:32 -/
-def betree.List.pop_front_back
-  (T : Type) (self : betree.List T) : Result (betree.List T) :=
-  let ls := core.mem.replace (betree.List T) self betree.List.Nil
+def betree.List.pop_front
+  (T : Type) (self : betree.List T) : Result (T × (betree.List T)) :=
+  let (ls, _) := core.mem.replace (betree.List T) self betree.List.Nil
   match ls with
-  | betree.List.Cons x tl => Result.ret tl
+  | betree.List.Cons x tl => Result.ret (x, tl)
   | betree.List.Nil => Result.fail .panic
 
-/- [betree_main::betree::{betree_main::betree::List<T>#1}::hd]: forward function
+/- [betree_main::betree::{betree_main::betree::List<T>#1}::hd]:
    Source: 'src/betree.rs', lines 318:4-318:22 -/
 def betree.List.hd (T : Type) (self : betree.List T) : Result T :=
   match self with
-  | betree.List.Cons hd l => Result.ret hd
+  | betree.List.Cons hd _ => Result.ret hd
   | betree.List.Nil => Result.fail .panic
 
-/- [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]: forward function
+/- [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::head_has_key]:
    Source: 'src/betree.rs', lines 327:4-327:44 -/
 def betree.ListTupleU64T.head_has_key
   (T : Type) (self : betree.List (U64 × T)) (key : U64) : Result Bool :=
   match self with
-  | betree.List.Cons hd l => let (i, _) := hd
+  | betree.List.Cons hd _ => let (i, _) := hd
                              Result.ret (i = key)
   | betree.List.Nil => Result.ret false
 
-/- [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]: forward function
+/- [betree_main::betree::{betree_main::betree::List<(u64, T)>#2}::partition_at_pivot]:
    Source: 'src/betree.rs', lines 339:4-339:73 -/
 divergent def betree.ListTupleU64T.partition_at_pivot
   (T : Type) (self : betree.List (U64 × T)) (pivot : U64) :
@@ -178,334 +157,191 @@ divergent def betree.ListTupleU64T.partition_at_pivot
     then Result.ret (betree.List.Nil, betree.List.Cons (i, t) tl)
     else
       do
-        let p ← betree.ListTupleU64T.partition_at_pivot T tl pivot
-        let (ls0, ls1) := p
-        let l := ls0
-        Result.ret (betree.List.Cons (i, t) l, ls1)
+      let p ← betree.ListTupleU64T.partition_at_pivot T tl pivot
+      let (ls0, ls1) := p
+      let l := ls0
+      Result.ret (betree.List.Cons (i, t) l, ls1)
   | betree.List.Nil => Result.ret (betree.List.Nil, betree.List.Nil)
 
-/- [betree_main::betree::{betree_main::betree::Leaf#3}::split]: forward function
+/- [betree_main::betree::{betree_main::betree::Leaf#3}::split]:
    Source: 'src/betree.rs', lines 359:4-364:17 -/
 def betree.Leaf.split
   (self : betree.Leaf) (content : betree.List (U64 × U64))
   (params : betree.Params) (node_id_cnt : betree.NodeIdCounter) (st : State) :
-  Result (State × betree.Internal)
+  Result (State × (betree.Internal × betree.NodeIdCounter))
   :=
   do
-    let p ← betree.List.split_at (U64 × U64) content params.split_size
-    let (content0, content1) := p
-    let p0 ← betree.List.hd (U64 × U64) content1
-    let (pivot, _) := p0
-    let id0 ← betree.NodeIdCounter.fresh_id node_id_cnt
-    let node_id_cnt0 ← betree.NodeIdCounter.fresh_id_back node_id_cnt
-    let id1 ← betree.NodeIdCounter.fresh_id node_id_cnt0
-    let (st0, _) ← betree.store_leaf_node id0 content0 st
-    let (st1, _) ← betree.store_leaf_node id1 content1 st0
-    let n := betree.Node.Leaf { id := id0, size := params.split_size }
-    let n0 := betree.Node.Leaf { id := id1, size := params.split_size }
-    Result.ret (st1, betree.Internal.mk self.id pivot n n0)
-
-/- [betree_main::betree::{betree_main::betree::Leaf#3}::split]: backward function 2
-   Source: 'src/betree.rs', lines 359:4-364:17 -/
-def betree.Leaf.split_back
-  (self : betree.Leaf) (content : betree.List (U64 × U64))
-  (params : betree.Params) (node_id_cnt : betree.NodeIdCounter) (st : State) :
-  Result betree.NodeIdCounter
-  :=
-  do
-    let p ← betree.List.split_at (U64 × U64) content params.split_size
-    let (content0, content1) := p
-    let _ ← betree.List.hd (U64 × U64) content1
-    let id0 ← betree.NodeIdCounter.fresh_id node_id_cnt
-    let node_id_cnt0 ← betree.NodeIdCounter.fresh_id_back node_id_cnt
-    let id1 ← betree.NodeIdCounter.fresh_id node_id_cnt0
-    let (st0, _) ← betree.store_leaf_node id0 content0 st
-    let _ ← betree.store_leaf_node id1 content1 st0
-    betree.NodeIdCounter.fresh_id_back node_id_cnt0
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: forward function
+  let p ← betree.List.split_at (U64 × U64) content params.split_size
+  let (content0, content1) := p
+  let p1 ← betree.List.hd (U64 × U64) content1
+  let (pivot, _) := p1
+  let (id0, nic) ← betree.NodeIdCounter.fresh_id node_id_cnt
+  let (id1, nic1) ← betree.NodeIdCounter.fresh_id nic
+  let (st1, _) ← betree.store_leaf_node id0 content0 st
+  let (st2, _) ← betree.store_leaf_node id1 content1 st1
+  let n := betree.Node.Leaf { id := id0, size := params.split_size }
+  let n1 := betree.Node.Leaf { id := id1, size := params.split_size }
+  Result.ret (st2, (betree.Internal.mk self.id pivot n n1, nic1))
+
+/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]:
    Source: 'src/betree.rs', lines 789:4-792:34 -/
 divergent def betree.Node.lookup_first_message_for_key
   (key : U64) (msgs : betree.List (U64 × betree.Message)) :
-  Result (betree.List (U64 × betree.Message))
+  Result ((betree.List (U64 × betree.Message)) × (betree.List (U64 ×
+    betree.Message) → Result (betree.List (U64 × betree.Message))))
   :=
   match msgs with
   | betree.List.Cons x next_msgs =>
     let (i, m) := x
     if i >= key
-    then Result.ret (betree.List.Cons (i, m) next_msgs)
-    else betree.Node.lookup_first_message_for_key key next_msgs
-  | betree.List.Nil => Result.ret betree.List.Nil
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_for_key]: backward function 0
-   Source: 'src/betree.rs', lines 789:4-792:34 -/
-divergent def betree.Node.lookup_first_message_for_key_back
-  (key : U64) (msgs : betree.List (U64 × betree.Message))
-  (ret : betree.List (U64 × betree.Message)) :
-  Result (betree.List (U64 × betree.Message))
-  :=
-  match msgs with
-  | betree.List.Cons x next_msgs =>
-    let (i, m) := x
-    if i >= key
-    then Result.ret ret
+    then
+      let back_'a := fun ret => Result.ret ret
+      Result.ret (betree.List.Cons (i, m) next_msgs, back_'a)
     else
       do
-        let next_msgs0 ←
-          betree.Node.lookup_first_message_for_key_back key next_msgs ret
-        Result.ret (betree.List.Cons (i, m) next_msgs0)
-  | betree.List.Nil => Result.ret ret
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]: forward function
+      let (l, lookup_first_message_for_key_back) ←
+        betree.Node.lookup_first_message_for_key key next_msgs
+      let back_'a :=
+        fun ret =>
+          do
+          let next_msgs1 ← lookup_first_message_for_key_back ret
+          Result.ret (betree.List.Cons (i, m) next_msgs1)
+      Result.ret (l, back_'a)
+  | betree.List.Nil =>
+    let back_'a := fun ret => Result.ret ret
+    Result.ret (betree.List.Nil, back_'a)
+
+/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
    Source: 'src/betree.rs', lines 636:4-636:80 -/
 divergent def betree.Node.lookup_in_bindings
   (key : U64) (bindings : betree.List (U64 × U64)) : Result (Option U64) :=
   match bindings with
   | betree.List.Cons hd tl =>
-    let (i, i0) := hd
+    let (i, i1) := hd
     if i = key
-    then Result.ret (some i0)
+    then Result.ret (some i1)
     else
       if i > key
       then Result.ret none
       else betree.Node.lookup_in_bindings key tl
   | betree.List.Nil => Result.ret none
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: forward function
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]:
    Source: 'src/betree.rs', lines 819:4-819:90 -/
 divergent def betree.Node.apply_upserts
   (msgs : betree.List (U64 × betree.Message)) (prev : Option U64) (key : U64)
   (st : State) :
-  Result (State × U64)
+  Result (State × (U64 × (betree.List (U64 × betree.Message))))
   :=
   do
-    let b ← betree.ListTupleU64T.head_has_key betree.Message msgs key
-    if b
-    then
-      do
-        let msg ← betree.List.pop_front (U64 × betree.Message) msgs
-        let (_, m) := msg
-        match m with
-        | betree.Message.Insert i => Result.fail .panic
-        | betree.Message.Delete => Result.fail .panic
-        | betree.Message.Upsert s =>
-          do
-            let v ← betree.upsert_update prev s
-            let msgs0 ←
-              betree.List.pop_front_back (U64 × betree.Message) msgs
-            betree.Node.apply_upserts msgs0 (some v) key st
-    else
-      do
-        let (st0, v) ← core.option.Option.unwrap U64 prev st
-        let _ ←
-          betree.List.push_front (U64 × betree.Message) msgs (key,
-            betree.Message.Insert v)
-        Result.ret (st0, v)
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_upserts]: backward function 0
-   Source: 'src/betree.rs', lines 819:4-819:90 -/
-divergent def betree.Node.apply_upserts_back
-  (msgs : betree.List (U64 × betree.Message)) (prev : Option U64) (key : U64)
-  (st : State) :
-  Result (betree.List (U64 × betree.Message))
-  :=
-  do
-    let b ← betree.ListTupleU64T.head_has_key betree.Message msgs key
-    if b
-    then
-      do
-        let msg ← betree.List.pop_front (U64 × betree.Message) msgs
-        let (_, m) := msg
-        match m with
-        | betree.Message.Insert i => Result.fail .panic
-        | betree.Message.Delete => Result.fail .panic
-        | betree.Message.Upsert s =>
-          do
-            let v ← betree.upsert_update prev s
-            let msgs0 ←
-              betree.List.pop_front_back (U64 × betree.Message) msgs
-            betree.Node.apply_upserts_back msgs0 (some v) key st
-    else
+  let b ← betree.ListTupleU64T.head_has_key betree.Message msgs key
+  if b
+  then
+    do
+    let (msg, l) ← betree.List.pop_front (U64 × betree.Message) msgs
+    let (_, m) := msg
+    match m with
+    | betree.Message.Insert _ => Result.fail .panic
+    | betree.Message.Delete => Result.fail .panic
+    | betree.Message.Upsert s =>
       do
-        let (_, v) ← core.option.Option.unwrap U64 prev st
-        betree.List.push_front (U64 × betree.Message) msgs (key,
-          betree.Message.Insert v)
+      let v ← betree.upsert_update prev s
+      betree.Node.apply_upserts l (some v) key st
+  else
+    do
+    let (st1, v) ← core.option.Option.unwrap U64 prev st
+    let l ←
+      betree.List.push_front (U64 × betree.Message) msgs (key,
+        betree.Message.Insert v)
+    Result.ret (st1, (v, l))
 
-/- [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: forward function
+/- [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]:
    Source: 'src/betree.rs', lines 395:4-395:63 -/
 mutual divergent def betree.Internal.lookup_in_children
   (self : betree.Internal) (key : U64) (st : State) :
-  Result (State × (Option U64))
+  Result (State × ((Option U64) × betree.Internal))
   :=
-  let ⟨ _, i, n, n0 ⟩ := self
-  if key < i
-  then betree.Node.lookup n key st
-  else betree.Node.lookup n0 key st
-
-/- [betree_main::betree::{betree_main::betree::Internal#4}::lookup_in_children]: backward function 0
-   Source: 'src/betree.rs', lines 395:4-395:63 -/
-divergent def betree.Internal.lookup_in_children_back
-  (self : betree.Internal) (key : U64) (st : State) : Result betree.Internal :=
-  let ⟨ i, i0, n, n0 ⟩ := self
-  if key < i0
+  let ⟨ i, i1, n, n1 ⟩ := self
+  if key < i1
   then
     do
-      let n1 ← betree.Node.lookup_back n key st
-      Result.ret (betree.Internal.mk i i0 n1 n0)
+    let (st1, (o, n2)) ← betree.Node.lookup n key st
+    Result.ret (st1, (o, betree.Internal.mk i i1 n2 n1))
   else
     do
-      let n1 ← betree.Node.lookup_back n0 key st
-      Result.ret (betree.Internal.mk i i0 n n1)
+    let (st1, (o, n2)) ← betree.Node.lookup n1 key st
+    Result.ret (st1, (o, betree.Internal.mk i i1 n n2))
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup]: forward function
+/- [betree_main::betree::{betree_main::betree::Node#5}::lookup]:
    Source: 'src/betree.rs', lines 709:4-709:58 -/
 divergent def betree.Node.lookup
   (self : betree.Node) (key : U64) (st : State) :
-  Result (State × (Option U64))
+  Result (State × ((Option U64) × betree.Node))
   :=
   match self with
   | betree.Node.Internal node =>
     do
-      let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, msgs) ← betree.load_internal_node i st
-      let pending ← betree.Node.lookup_first_message_for_key key msgs
-      match pending with
-      | betree.List.Cons p l =>
-        let (k, msg) := p
-        if k != key
-        then
-          do
-            let (st1, o) ←
-              betree.Internal.lookup_in_children (betree.Internal.mk i i0 n n0)
-                key st0
-            let _ ←
-              betree.Node.lookup_first_message_for_key_back key msgs
-                (betree.List.Cons (k, msg) l)
-            Result.ret (st1, o)
-        else
-          match msg with
-          | betree.Message.Insert v =>
-            do
-              let _ ←
-                betree.Node.lookup_first_message_for_key_back key msgs
-                  (betree.List.Cons (k, betree.Message.Insert v) l)
-              Result.ret (st0, some v)
-          | betree.Message.Delete =>
-            do
-              let _ ←
-                betree.Node.lookup_first_message_for_key_back key msgs
-                  (betree.List.Cons (k, betree.Message.Delete) l)
-              Result.ret (st0, none)
-          | betree.Message.Upsert ufs =>
-            do
-              let (st1, v) ←
-                betree.Internal.lookup_in_children (betree.Internal.mk i i0 n
-                  n0) key st0
-              let (st2, v0) ←
-                betree.Node.apply_upserts (betree.List.Cons (k,
-                  betree.Message.Upsert ufs) l) v key st1
-              let node0 ←
-                betree.Internal.lookup_in_children_back (betree.Internal.mk i
-                  i0 n n0) key st0
-              let ⟨ i1, _, _, _ ⟩ := node0
-              let pending0 ←
-                betree.Node.apply_upserts_back (betree.List.Cons (k,
-                  betree.Message.Upsert ufs) l) v key st1
-              let msgs0 ←
-                betree.Node.lookup_first_message_for_key_back key msgs pending0
-              let (st3, _) ← betree.store_internal_node i1 msgs0 st2
-              Result.ret (st3, some v0)
-      | betree.List.Nil =>
+    let ⟨ i, i1, n, n1 ⟩ := node
+    let (st1, msgs) ← betree.load_internal_node i st
+    let (pending, lookup_first_message_for_key_back) ←
+      betree.Node.lookup_first_message_for_key key msgs
+    match pending with
+    | betree.List.Cons p l =>
+      let (k, msg) := p
+      if k != key
+      then
         do
-          let (st1, o) ←
-            betree.Internal.lookup_in_children (betree.Internal.mk i i0 n n0)
-              key st0
+        let (st2, (o, i2)) ←
+          betree.Internal.lookup_in_children (betree.Internal.mk i i1 n n1) key
+            st1
+        let _ ←
+          lookup_first_message_for_key_back (betree.List.Cons (k, msg) l)
+        Result.ret (st2, (o, betree.Node.Internal i2))
+      else
+        match msg with
+        | betree.Message.Insert v =>
+          do
           let _ ←
-            betree.Node.lookup_first_message_for_key_back key msgs
-              betree.List.Nil
-          Result.ret (st1, o)
-  | betree.Node.Leaf node =>
-    do
-      let (st0, bindings) ← betree.load_leaf_node node.id st
-      let o ← betree.Node.lookup_in_bindings key bindings
-      Result.ret (st0, o)
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup]: backward function 0
-   Source: 'src/betree.rs', lines 709:4-709:58 -/
-divergent def betree.Node.lookup_back
-  (self : betree.Node) (key : U64) (st : State) : Result betree.Node :=
-  match self with
-  | betree.Node.Internal node =>
-    do
-      let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, msgs) ← betree.load_internal_node i st
-      let pending ← betree.Node.lookup_first_message_for_key key msgs
-      match pending with
-      | betree.List.Cons p l =>
-        let (k, msg) := p
-        if k != key
-        then
+            lookup_first_message_for_key_back (betree.List.Cons (k,
+              betree.Message.Insert v) l)
+          Result.ret (st1, (some v, betree.Node.Internal (betree.Internal.mk i
+            i1 n n1)))
+        | betree.Message.Delete =>
           do
-            let _ ←
-              betree.Node.lookup_first_message_for_key_back key msgs
-                (betree.List.Cons (k, msg) l)
-            let node0 ←
-              betree.Internal.lookup_in_children_back (betree.Internal.mk i i0
-                n n0) key st0
-            Result.ret (betree.Node.Internal node0)
-        else
-          match msg with
-          | betree.Message.Insert v =>
-            do
-              let _ ←
-                betree.Node.lookup_first_message_for_key_back key msgs
-                  (betree.List.Cons (k, betree.Message.Insert v) l)
-              Result.ret (betree.Node.Internal (betree.Internal.mk i i0 n n0))
-          | betree.Message.Delete =>
-            do
-              let _ ←
-                betree.Node.lookup_first_message_for_key_back key msgs
-                  (betree.List.Cons (k, betree.Message.Delete) l)
-              Result.ret (betree.Node.Internal (betree.Internal.mk i i0 n n0))
-          | betree.Message.Upsert ufs =>
-            do
-              let (st1, v) ←
-                betree.Internal.lookup_in_children (betree.Internal.mk i i0 n
-                  n0) key st0
-              let (st2, _) ←
-                betree.Node.apply_upserts (betree.List.Cons (k,
-                  betree.Message.Upsert ufs) l) v key st1
-              let node0 ←
-                betree.Internal.lookup_in_children_back (betree.Internal.mk i
-                  i0 n n0) key st0
-              let ⟨ i1, i2, n1, n2 ⟩ := node0
-              let pending0 ←
-                betree.Node.apply_upserts_back (betree.List.Cons (k,
-                  betree.Message.Upsert ufs) l) v key st1
-              let msgs0 ←
-                betree.Node.lookup_first_message_for_key_back key msgs pending0
-              let _ ← betree.store_internal_node i1 msgs0 st2
-              Result.ret (betree.Node.Internal (betree.Internal.mk i1 i2 n1
-                n2))
-      | betree.List.Nil =>
-        do
           let _ ←
-            betree.Node.lookup_first_message_for_key_back key msgs
-              betree.List.Nil
-          let node0 ←
-            betree.Internal.lookup_in_children_back (betree.Internal.mk i i0 n
-              n0) key st0
-          Result.ret (betree.Node.Internal node0)
+            lookup_first_message_for_key_back (betree.List.Cons (k,
+              betree.Message.Delete) l)
+          Result.ret (st1, (none, betree.Node.Internal (betree.Internal.mk i i1
+            n n1)))
+        | betree.Message.Upsert ufs =>
+          do
+          let (st2, (v, i2)) ←
+            betree.Internal.lookup_in_children (betree.Internal.mk i i1 n n1)
+              key st1
+          let (st3, (v1, l1)) ←
+            betree.Node.apply_upserts (betree.List.Cons (k,
+              betree.Message.Upsert ufs) l) v key st2
+          let ⟨ i3, i4, n2, n3 ⟩ := i2
+          let msgs1 ← lookup_first_message_for_key_back l1
+          let (st4, _) ← betree.store_internal_node i3 msgs1 st3
+          Result.ret (st4, (some v1, betree.Node.Internal (betree.Internal.mk
+            i3 i4 n2 n3)))
+    | betree.List.Nil =>
+      do
+      let (st2, (o, i2)) ←
+        betree.Internal.lookup_in_children (betree.Internal.mk i i1 n n1) key
+          st1
+      let _ ← lookup_first_message_for_key_back betree.List.Nil
+      Result.ret (st2, (o, betree.Node.Internal i2))
   | betree.Node.Leaf node =>
     do
-      let (_, bindings) ← betree.load_leaf_node node.id st
-      let _ ← betree.Node.lookup_in_bindings key bindings
-      Result.ret (betree.Node.Leaf node)
+    let (st1, bindings) ← betree.load_leaf_node node.id st
+    let o ← betree.Node.lookup_in_bindings key bindings
+    Result.ret (st1, (o, betree.Node.Leaf node))
 
 end
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [betree_main::betree::{betree_main::betree::Node#5}::filter_messages_for_key]:
    Source: 'src/betree.rs', lines 674:4-674:77 -/
 divergent def betree.Node.filter_messages_for_key
   (key : U64) (msgs : betree.List (U64 × betree.Message)) :
@@ -517,33 +353,19 @@ divergent def betree.Node.filter_messages_for_key
     if k = key
     then
       do
-        let msgs0 ←
-          betree.List.pop_front_back (U64 × betree.Message) (betree.List.Cons
-            (k, m) l)
-        betree.Node.filter_messages_for_key key msgs0
+      let (_, l1) ←
+        betree.List.pop_front (U64 × betree.Message) (betree.List.Cons (k, m)
+          l)
+      betree.Node.filter_messages_for_key key l1
     else Result.ret (betree.List.Cons (k, m) l)
   | betree.List.Nil => Result.ret betree.List.Nil
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: forward function
+/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]:
    Source: 'src/betree.rs', lines 689:4-692:34 -/
 divergent def betree.Node.lookup_first_message_after_key
   (key : U64) (msgs : betree.List (U64 × betree.Message)) :
-  Result (betree.List (U64 × betree.Message))
-  :=
-  match msgs with
-  | betree.List.Cons p next_msgs =>
-    let (k, m) := p
-    if k = key
-    then betree.Node.lookup_first_message_after_key key next_msgs
-    else Result.ret (betree.List.Cons (k, m) next_msgs)
-  | betree.List.Nil => Result.ret betree.List.Nil
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_first_message_after_key]: backward function 0
-   Source: 'src/betree.rs', lines 689:4-692:34 -/
-divergent def betree.Node.lookup_first_message_after_key_back
-  (key : U64) (msgs : betree.List (U64 × betree.Message))
-  (ret : betree.List (U64 × betree.Message)) :
-  Result (betree.List (U64 × betree.Message))
+  Result ((betree.List (U64 × betree.Message)) × (betree.List (U64 ×
+    betree.Message) → Result (betree.List (U64 × betree.Message))))
   :=
   match msgs with
   | betree.List.Cons p next_msgs =>
@@ -551,14 +373,22 @@ divergent def betree.Node.lookup_first_message_after_key_back
     if k = key
     then
       do
-        let next_msgs0 ←
-          betree.Node.lookup_first_message_after_key_back key next_msgs ret
-        Result.ret (betree.List.Cons (k, m) next_msgs0)
-    else Result.ret ret
-  | betree.List.Nil => Result.ret ret
+      let (l, lookup_first_message_after_key_back) ←
+        betree.Node.lookup_first_message_after_key key next_msgs
+      let back_'a :=
+        fun ret =>
+          do
+          let next_msgs1 ← lookup_first_message_after_key_back ret
+          Result.ret (betree.List.Cons (k, m) next_msgs1)
+      Result.ret (l, back_'a)
+    else
+      let back_'a := fun ret => Result.ret ret
+      Result.ret (betree.List.Cons (k, m) next_msgs, back_'a)
+  | betree.List.Nil =>
+    let back_'a := fun ret => Result.ret ret
+    Result.ret (betree.List.Nil, back_'a)
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
    Source: 'src/betree.rs', lines 521:4-521:89 -/
 def betree.Node.apply_to_internal
   (msgs : betree.List (U64 × betree.Message)) (key : U64)
@@ -566,66 +396,63 @@ def betree.Node.apply_to_internal
   Result (betree.List (U64 × betree.Message))
   :=
   do
-    let msgs0 ← betree.Node.lookup_first_message_for_key key msgs
-    let b ← betree.ListTupleU64T.head_has_key betree.Message msgs0 key
-    if b
-    then
-      match new_msg with
-      | betree.Message.Insert i =>
+  let (msgs1, lookup_first_message_for_key_back) ←
+    betree.Node.lookup_first_message_for_key key msgs
+  let b ← betree.ListTupleU64T.head_has_key betree.Message msgs1 key
+  if b
+  then
+    match new_msg with
+    | betree.Message.Insert i =>
+      do
+      let l ← betree.Node.filter_messages_for_key key msgs1
+      let l1 ←
+        betree.List.push_front (U64 × betree.Message) l (key,
+          betree.Message.Insert i)
+      lookup_first_message_for_key_back l1
+    | betree.Message.Delete =>
+      do
+      let l ← betree.Node.filter_messages_for_key key msgs1
+      let l1 ←
+        betree.List.push_front (U64 × betree.Message) l (key,
+          betree.Message.Delete)
+      lookup_first_message_for_key_back l1
+    | betree.Message.Upsert s =>
+      do
+      let p ← betree.List.hd (U64 × betree.Message) msgs1
+      let (_, m) := p
+      match m with
+      | betree.Message.Insert prev =>
         do
-          let msgs1 ← betree.Node.filter_messages_for_key key msgs0
-          let msgs2 ←
-            betree.List.push_front (U64 × betree.Message) msgs1 (key,
-              betree.Message.Insert i)
-          betree.Node.lookup_first_message_for_key_back key msgs msgs2
+        let v ← betree.upsert_update (some prev) s
+        let (_, l) ← betree.List.pop_front (U64 × betree.Message) msgs1
+        let l1 ←
+          betree.List.push_front (U64 × betree.Message) l (key,
+            betree.Message.Insert v)
+        lookup_first_message_for_key_back l1
       | betree.Message.Delete =>
         do
-          let msgs1 ← betree.Node.filter_messages_for_key key msgs0
-          let msgs2 ←
-            betree.List.push_front (U64 × betree.Message) msgs1 (key,
-              betree.Message.Delete)
-          betree.Node.lookup_first_message_for_key_back key msgs msgs2
-      | betree.Message.Upsert s =>
+        let (_, l) ← betree.List.pop_front (U64 × betree.Message) msgs1
+        let v ← betree.upsert_update none s
+        let l1 ←
+          betree.List.push_front (U64 × betree.Message) l (key,
+            betree.Message.Insert v)
+        lookup_first_message_for_key_back l1
+      | betree.Message.Upsert _ =>
         do
-          let p ← betree.List.hd (U64 × betree.Message) msgs0
-          let (_, m) := p
-          match m with
-          | betree.Message.Insert prev =>
-            do
-              let v ← betree.upsert_update (some prev) s
-              let msgs1 ←
-                betree.List.pop_front_back (U64 × betree.Message) msgs0
-              let msgs2 ←
-                betree.List.push_front (U64 × betree.Message) msgs1 (key,
-                  betree.Message.Insert v)
-              betree.Node.lookup_first_message_for_key_back key msgs msgs2
-          | betree.Message.Delete =>
-            do
-              let v ← betree.upsert_update none s
-              let msgs1 ←
-                betree.List.pop_front_back (U64 × betree.Message) msgs0
-              let msgs2 ←
-                betree.List.push_front (U64 × betree.Message) msgs1 (key,
-                  betree.Message.Insert v)
-              betree.Node.lookup_first_message_for_key_back key msgs msgs2
-          | betree.Message.Upsert ufs =>
-            do
-              let msgs1 ←
-                betree.Node.lookup_first_message_after_key key msgs0
-              let msgs2 ←
-                betree.List.push_front (U64 × betree.Message) msgs1 (key,
-                  betree.Message.Upsert s)
-              let msgs3 ←
-                betree.Node.lookup_first_message_after_key_back key msgs0 msgs2
-              betree.Node.lookup_first_message_for_key_back key msgs msgs3
-    else
-      do
-        let msgs1 ←
-          betree.List.push_front (U64 × betree.Message) msgs0 (key, new_msg)
-        betree.Node.lookup_first_message_for_key_back key msgs msgs1
+        let (msgs2, lookup_first_message_after_key_back) ←
+          betree.Node.lookup_first_message_after_key key msgs1
+        let l ←
+          betree.List.push_front (U64 × betree.Message) msgs2 (key,
+            betree.Message.Upsert s)
+        let msgs3 ← lookup_first_message_after_key_back l
+        lookup_first_message_for_key_back msgs3
+  else
+    do
+    let l ←
+      betree.List.push_front (U64 × betree.Message) msgs1 (key, new_msg)
+    lookup_first_message_for_key_back l
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_internal]:
    Source: 'src/betree.rs', lines 502:4-505:5 -/
 divergent def betree.Node.apply_messages_to_internal
   (msgs : betree.List (U64 × betree.Message))
@@ -635,45 +462,40 @@ divergent def betree.Node.apply_messages_to_internal
   match new_msgs with
   | betree.List.Cons new_msg new_msgs_tl =>
     do
-      let (i, m) := new_msg
-      let msgs0 ← betree.Node.apply_to_internal msgs i m
-      betree.Node.apply_messages_to_internal msgs0 new_msgs_tl
+    let (i, m) := new_msg
+    let l ← betree.Node.apply_to_internal msgs i m
+    betree.Node.apply_messages_to_internal l new_msgs_tl
   | betree.List.Nil => Result.ret msgs
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: forward function
+/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]:
    Source: 'src/betree.rs', lines 653:4-656:32 -/
 divergent def betree.Node.lookup_mut_in_bindings
   (key : U64) (bindings : betree.List (U64 × U64)) :
-  Result (betree.List (U64 × U64))
+  Result ((betree.List (U64 × U64)) × (betree.List (U64 × U64) → Result
+    (betree.List (U64 × U64))))
   :=
   match bindings with
   | betree.List.Cons hd tl =>
-    let (i, i0) := hd
+    let (i, i1) := hd
     if i >= key
-    then Result.ret (betree.List.Cons (i, i0) tl)
-    else betree.Node.lookup_mut_in_bindings key tl
-  | betree.List.Nil => Result.ret betree.List.Nil
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::lookup_mut_in_bindings]: backward function 0
-   Source: 'src/betree.rs', lines 653:4-656:32 -/
-divergent def betree.Node.lookup_mut_in_bindings_back
-  (key : U64) (bindings : betree.List (U64 × U64))
-  (ret : betree.List (U64 × U64)) :
-  Result (betree.List (U64 × U64))
-  :=
-  match bindings with
-  | betree.List.Cons hd tl =>
-    let (i, i0) := hd
-    if i >= key
-    then Result.ret ret
+    then
+      let back_'a := fun ret => Result.ret ret
+      Result.ret (betree.List.Cons (i, i1) tl, back_'a)
     else
       do
-        let tl0 ← betree.Node.lookup_mut_in_bindings_back key tl ret
-        Result.ret (betree.List.Cons (i, i0) tl0)
-  | betree.List.Nil => Result.ret ret
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+      let (l, lookup_mut_in_bindings_back) ←
+        betree.Node.lookup_mut_in_bindings key tl
+      let back_'a :=
+        fun ret =>
+          do
+          let tl1 ← lookup_mut_in_bindings_back ret
+          Result.ret (betree.List.Cons (i, i1) tl1)
+      Result.ret (l, back_'a)
+  | betree.List.Nil =>
+    let back_'a := fun ret => Result.ret ret
+    Result.ret (betree.List.Nil, back_'a)
+
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
    Source: 'src/betree.rs', lines 460:4-460:87 -/
 def betree.Node.apply_to_leaf
   (bindings : betree.List (U64 × U64)) (key : U64) (new_msg : betree.Message)
@@ -681,49 +503,39 @@ def betree.Node.apply_to_leaf
   Result (betree.List (U64 × U64))
   :=
   do
-    let bindings0 ← betree.Node.lookup_mut_in_bindings key bindings
-    let b ← betree.ListTupleU64T.head_has_key U64 bindings0 key
-    if b
-    then
+  let (bindings1, lookup_mut_in_bindings_back) ←
+    betree.Node.lookup_mut_in_bindings key bindings
+  let b ← betree.ListTupleU64T.head_has_key U64 bindings1 key
+  if b
+  then
+    do
+    let (hd, l) ← betree.List.pop_front (U64 × U64) bindings1
+    match new_msg with
+    | betree.Message.Insert v =>
       do
-        let hd ← betree.List.pop_front (U64 × U64) bindings0
-        match new_msg with
-        | betree.Message.Insert v =>
-          do
-            let bindings1 ← betree.List.pop_front_back (U64 × U64) bindings0
-            let bindings2 ←
-              betree.List.push_front (U64 × U64) bindings1 (key, v)
-            betree.Node.lookup_mut_in_bindings_back key bindings bindings2
-        | betree.Message.Delete =>
-          do
-            let bindings1 ← betree.List.pop_front_back (U64 × U64) bindings0
-            betree.Node.lookup_mut_in_bindings_back key bindings bindings1
-        | betree.Message.Upsert s =>
-          do
-            let (_, i) := hd
-            let v ← betree.upsert_update (some i) s
-            let bindings1 ← betree.List.pop_front_back (U64 × U64) bindings0
-            let bindings2 ←
-              betree.List.push_front (U64 × U64) bindings1 (key, v)
-            betree.Node.lookup_mut_in_bindings_back key bindings bindings2
-    else
-      match new_msg with
-      | betree.Message.Insert v =>
-        do
-          let bindings1 ←
-            betree.List.push_front (U64 × U64) bindings0 (key, v)
-          betree.Node.lookup_mut_in_bindings_back key bindings bindings1
-      | betree.Message.Delete =>
-        betree.Node.lookup_mut_in_bindings_back key bindings bindings0
-      | betree.Message.Upsert s =>
-        do
-          let v ← betree.upsert_update none s
-          let bindings1 ←
-            betree.List.push_front (U64 × U64) bindings0 (key, v)
-          betree.Node.lookup_mut_in_bindings_back key bindings bindings1
+      let l1 ← betree.List.push_front (U64 × U64) l (key, v)
+      lookup_mut_in_bindings_back l1
+    | betree.Message.Delete => lookup_mut_in_bindings_back l
+    | betree.Message.Upsert s =>
+      do
+      let (_, i) := hd
+      let v ← betree.upsert_update (some i) s
+      let l1 ← betree.List.push_front (U64 × U64) l (key, v)
+      lookup_mut_in_bindings_back l1
+  else
+    match new_msg with
+    | betree.Message.Insert v =>
+      do
+      let l ← betree.List.push_front (U64 × U64) bindings1 (key, v)
+      lookup_mut_in_bindings_back l
+    | betree.Message.Delete => lookup_mut_in_bindings_back bindings1
+    | betree.Message.Upsert s =>
+      do
+      let v ← betree.upsert_update none s
+      let l ← betree.List.push_front (U64 × U64) bindings1 (key, v)
+      lookup_mut_in_bindings_back l
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages_to_leaf]:
    Source: 'src/betree.rs', lines 444:4-447:5 -/
 divergent def betree.Node.apply_messages_to_leaf
   (bindings : betree.List (U64 × U64))
@@ -733,337 +545,183 @@ divergent def betree.Node.apply_messages_to_leaf
   match new_msgs with
   | betree.List.Cons new_msg new_msgs_tl =>
     do
-      let (i, m) := new_msg
-      let bindings0 ← betree.Node.apply_to_leaf bindings i m
-      betree.Node.apply_messages_to_leaf bindings0 new_msgs_tl
+    let (i, m) := new_msg
+    let l ← betree.Node.apply_to_leaf bindings i m
+    betree.Node.apply_messages_to_leaf l new_msgs_tl
   | betree.List.Nil => Result.ret bindings
 
-/- [betree_main::betree::{betree_main::betree::Internal#4}::flush]: forward function
+/- [betree_main::betree::{betree_main::betree::Internal#4}::flush]:
    Source: 'src/betree.rs', lines 410:4-415:26 -/
 mutual divergent def betree.Internal.flush
   (self : betree.Internal) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter)
   (content : betree.List (U64 × betree.Message)) (st : State) :
-  Result (State × (betree.List (U64 × betree.Message)))
-  :=
-  do
-    let ⟨ _, i, n, n0 ⟩ := self
-    let p ← betree.ListTupleU64T.partition_at_pivot betree.Message content i
-    let (msgs_left, msgs_right) := p
-    let len_left ← betree.List.len (U64 × betree.Message) msgs_left
-    if len_left >= params.min_flush_size
-    then
-      do
-        let (st0, _) ←
-          betree.Node.apply_messages n params node_id_cnt msgs_left st
-        let (_, node_id_cnt0) ←
-          betree.Node.apply_messages_back n params node_id_cnt msgs_left st
-        let len_right ← betree.List.len (U64 × betree.Message) msgs_right
-        if len_right >= params.min_flush_size
-        then
-          do
-            let (st1, _) ←
-              betree.Node.apply_messages n0 params node_id_cnt0 msgs_right st0
-            let _ ←
-              betree.Node.apply_messages_back n0 params node_id_cnt0 msgs_right
-                st0
-            Result.ret (st1, betree.List.Nil)
-        else Result.ret (st0, msgs_right)
-    else
-      do
-        let (st0, _) ←
-          betree.Node.apply_messages n0 params node_id_cnt msgs_right st
-        let _ ←
-          betree.Node.apply_messages_back n0 params node_id_cnt msgs_right st
-        Result.ret (st0, msgs_left)
-
-/- [betree_main::betree::{betree_main::betree::Internal#4}::flush]: backward function 0
-   Source: 'src/betree.rs', lines 410:4-415:26 -/
-divergent def betree.Internal.flush_back
-  (self : betree.Internal) (params : betree.Params)
-  (node_id_cnt : betree.NodeIdCounter)
-  (content : betree.List (U64 × betree.Message)) (st : State) :
-  Result (betree.Internal × betree.NodeIdCounter)
+  Result (State × ((betree.List (U64 × betree.Message)) × (betree.Internal
+    × betree.NodeIdCounter)))
   :=
   do
-    let ⟨ i, i0, n, n0 ⟩ := self
-    let p ← betree.ListTupleU64T.partition_at_pivot betree.Message content i0
-    let (msgs_left, msgs_right) := p
-    let len_left ← betree.List.len (U64 × betree.Message) msgs_left
-    if len_left >= params.min_flush_size
+  let ⟨ i, i1, n, n1 ⟩ := self
+  let p ← betree.ListTupleU64T.partition_at_pivot betree.Message content i1
+  let (msgs_left, msgs_right) := p
+  let len_left ← betree.List.len (U64 × betree.Message) msgs_left
+  if len_left >= params.min_flush_size
+  then
+    do
+    let (st1, p1) ←
+      betree.Node.apply_messages n params node_id_cnt msgs_left st
+    let (n2, node_id_cnt1) := p1
+    let len_right ← betree.List.len (U64 × betree.Message) msgs_right
+    if len_right >= params.min_flush_size
     then
       do
-        let (st0, _) ←
-          betree.Node.apply_messages n params node_id_cnt msgs_left st
-        let (n1, node_id_cnt0) ←
-          betree.Node.apply_messages_back n params node_id_cnt msgs_left st
-        let len_right ← betree.List.len (U64 × betree.Message) msgs_right
-        if len_right >= params.min_flush_size
-        then
-          do
-            let (n2, node_id_cnt1) ←
-              betree.Node.apply_messages_back n0 params node_id_cnt0 msgs_right
-                st0
-            Result.ret (betree.Internal.mk i i0 n1 n2, node_id_cnt1)
-        else Result.ret (betree.Internal.mk i i0 n1 n0, node_id_cnt0)
+      let (st2, p2) ←
+        betree.Node.apply_messages n1 params node_id_cnt1 msgs_right st1
+      let (n3, node_id_cnt2) := p2
+      Result.ret (st2, (betree.List.Nil, (betree.Internal.mk i i1 n2 n3,
+        node_id_cnt2)))
     else
-      do
-        let (n1, node_id_cnt0) ←
-          betree.Node.apply_messages_back n0 params node_id_cnt msgs_right st
-        Result.ret (betree.Internal.mk i i0 n n1, node_id_cnt0)
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: forward function
-   Source: 'src/betree.rs', lines 588:4-593:5 -/
-divergent def betree.Node.apply_messages
-  (self : betree.Node) (params : betree.Params)
-  (node_id_cnt : betree.NodeIdCounter)
-  (msgs : betree.List (U64 × betree.Message)) (st : State) :
-  Result (State × Unit)
-  :=
-  match self with
-  | betree.Node.Internal node =>
-    do
-      let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, content) ← betree.load_internal_node i st
-      let content0 ← betree.Node.apply_messages_to_internal content msgs
-      let num_msgs ← betree.List.len (U64 × betree.Message) content0
-      if num_msgs >= params.min_flush_size
-      then
-        do
-          let (st1, content1) ←
-            betree.Internal.flush (betree.Internal.mk i i0 n n0) params
-              node_id_cnt content0 st0
-          let (node0, _) ←
-            betree.Internal.flush_back (betree.Internal.mk i i0 n n0) params
-              node_id_cnt content0 st0
-          let ⟨ i1, _, _, _ ⟩ := node0
-          let (st2, _) ← betree.store_internal_node i1 content1 st1
-          Result.ret (st2, ())
-      else
-        do
-          let (st1, _) ← betree.store_internal_node i content0 st0
-          Result.ret (st1, ())
-  | betree.Node.Leaf node =>
+      Result.ret (st1, (msgs_right, (betree.Internal.mk i i1 n2 n1,
+        node_id_cnt1)))
+  else
     do
-      let (st0, content) ← betree.load_leaf_node node.id st
-      let content0 ← betree.Node.apply_messages_to_leaf content msgs
-      let len ← betree.List.len (U64 × U64) content0
-      let i ← 2#u64 * params.split_size
-      if len >= i
-      then
-        do
-          let (st1, _) ←
-            betree.Leaf.split node content0 params node_id_cnt st0
-          let (st2, _) ← betree.store_leaf_node node.id betree.List.Nil st1
-          Result.ret (st2, ())
-      else
-        do
-          let (st1, _) ← betree.store_leaf_node node.id content0 st0
-          Result.ret (st1, ())
+    let (st1, p1) ←
+      betree.Node.apply_messages n1 params node_id_cnt msgs_right st
+    let (n2, node_id_cnt1) := p1
+    Result.ret (st1, (msgs_left, (betree.Internal.mk i i1 n n2, node_id_cnt1)))
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]: backward function 0
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply_messages]:
    Source: 'src/betree.rs', lines 588:4-593:5 -/
-divergent def betree.Node.apply_messages_back
+divergent def betree.Node.apply_messages
   (self : betree.Node) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter)
   (msgs : betree.List (U64 × betree.Message)) (st : State) :
-  Result (betree.Node × betree.NodeIdCounter)
+  Result (State × (betree.Node × betree.NodeIdCounter))
   :=
   match self with
   | betree.Node.Internal node =>
     do
-      let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, content) ← betree.load_internal_node i st
-      let content0 ← betree.Node.apply_messages_to_internal content msgs
-      let num_msgs ← betree.List.len (U64 × betree.Message) content0
-      if num_msgs >= params.min_flush_size
-      then
-        do
-          let (st1, content1) ←
-            betree.Internal.flush (betree.Internal.mk i i0 n n0) params
-              node_id_cnt content0 st0
-          let (node0, node_id_cnt0) ←
-            betree.Internal.flush_back (betree.Internal.mk i i0 n n0) params
-              node_id_cnt content0 st0
-          let ⟨ i1, i2, n1, n2 ⟩ := node0
-          let _ ← betree.store_internal_node i1 content1 st1
-          Result.ret (betree.Node.Internal (betree.Internal.mk i1 i2 n1 n2),
-            node_id_cnt0)
-      else
-        do
-          let _ ← betree.store_internal_node i content0 st0
-          Result.ret (betree.Node.Internal (betree.Internal.mk i i0 n n0),
-            node_id_cnt)
+    let ⟨ i, i1, n, n1 ⟩ := node
+    let (st1, content) ← betree.load_internal_node i st
+    let l ← betree.Node.apply_messages_to_internal content msgs
+    let num_msgs ← betree.List.len (U64 × betree.Message) l
+    if num_msgs >= params.min_flush_size
+    then
+      do
+      let (st2, (content1, p)) ←
+        betree.Internal.flush (betree.Internal.mk i i1 n n1) params node_id_cnt
+          l st1
+      let (node1, node_id_cnt1) := p
+      let ⟨ i2, i3, n2, n3 ⟩ := node1
+      let (st3, _) ← betree.store_internal_node i2 content1 st2
+      Result.ret (st3, (betree.Node.Internal (betree.Internal.mk i2 i3 n2 n3),
+        node_id_cnt1))
+    else
+      do
+      let (st2, _) ← betree.store_internal_node i l st1
+      Result.ret (st2, (betree.Node.Internal (betree.Internal.mk i i1 n n1),
+        node_id_cnt))
   | betree.Node.Leaf node =>
     do
-      let (st0, content) ← betree.load_leaf_node node.id st
-      let content0 ← betree.Node.apply_messages_to_leaf content msgs
-      let len ← betree.List.len (U64 × U64) content0
-      let i ← 2#u64 * params.split_size
-      if len >= i
-      then
-        do
-          let (st1, new_node) ←
-            betree.Leaf.split node content0 params node_id_cnt st0
-          let _ ← betree.store_leaf_node node.id betree.List.Nil st1
-          let node_id_cnt0 ←
-            betree.Leaf.split_back node content0 params node_id_cnt st0
-          Result.ret (betree.Node.Internal new_node, node_id_cnt0)
-      else
-        do
-          let _ ← betree.store_leaf_node node.id content0 st0
-          Result.ret (betree.Node.Leaf { node with size := len }, node_id_cnt)
+    let (st1, content) ← betree.load_leaf_node node.id st
+    let l ← betree.Node.apply_messages_to_leaf content msgs
+    let len ← betree.List.len (U64 × U64) l
+    let i ← 2#u64 * params.split_size
+    if len >= i
+    then
+      do
+      let (st2, (new_node, nic)) ←
+        betree.Leaf.split node l params node_id_cnt st1
+      let (st3, _) ← betree.store_leaf_node node.id betree.List.Nil st2
+      Result.ret (st3, (betree.Node.Internal new_node, nic))
+    else
+      do
+      let (st2, _) ← betree.store_leaf_node node.id l st1
+      Result.ret (st2, (betree.Node.Leaf { node with size := len },
+        node_id_cnt))
 
 end
 
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply]: forward function
+/- [betree_main::betree::{betree_main::betree::Node#5}::apply]:
    Source: 'src/betree.rs', lines 576:4-582:5 -/
 def betree.Node.apply
   (self : betree.Node) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter) (key : U64) (new_msg : betree.Message)
   (st : State) :
-  Result (State × Unit)
+  Result (State × (betree.Node × betree.NodeIdCounter))
   :=
   do
-    let l := betree.List.Nil
-    let (st0, _) ←
-      betree.Node.apply_messages self params node_id_cnt (betree.List.Cons
-        (key, new_msg) l) st
-    let _ ←
-      betree.Node.apply_messages_back self params node_id_cnt (betree.List.Cons
-        (key, new_msg) l) st
-    Result.ret (st0, ())
-
-/- [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 0
-   Source: 'src/betree.rs', lines 576:4-582:5 -/
-def betree.Node.apply_back
-  (self : betree.Node) (params : betree.Params)
-  (node_id_cnt : betree.NodeIdCounter) (key : U64) (new_msg : betree.Message)
-  (st : State) :
-  Result (betree.Node × betree.NodeIdCounter)
-  :=
   let l := betree.List.Nil
-  betree.Node.apply_messages_back self params node_id_cnt (betree.List.Cons
-    (key, new_msg) l) st
+  let (st1, p) ←
+    betree.Node.apply_messages self params node_id_cnt (betree.List.Cons (key,
+      new_msg) l) st
+  let (self1, node_id_cnt1) := p
+  Result.ret (st1, (self1, node_id_cnt1))
 
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::new]: forward function
+/- [betree_main::betree::{betree_main::betree::BeTree#6}::new]:
    Source: 'src/betree.rs', lines 849:4-849:60 -/
 def betree.BeTree.new
   (min_flush_size : U64) (split_size : U64) (st : State) :
   Result (State × betree.BeTree)
   :=
   do
-    let node_id_cnt ← betree.NodeIdCounter.new
-    let id ← betree.NodeIdCounter.fresh_id node_id_cnt
-    let (st0, _) ← betree.store_leaf_node id betree.List.Nil st
-    let node_id_cnt0 ← betree.NodeIdCounter.fresh_id_back node_id_cnt
-    Result.ret (st0,
-      {
-        params :=
-          { min_flush_size := min_flush_size, split_size := split_size },
-        node_id_cnt := node_id_cnt0,
-        root := (betree.Node.Leaf { id := id, size := 0#u64 })
-      })
-
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: forward function
+  let node_id_cnt ← betree.NodeIdCounter.new
+  let (id, nic) ← betree.NodeIdCounter.fresh_id node_id_cnt
+  let (st1, _) ← betree.store_leaf_node id betree.List.Nil st
+  Result.ret (st1,
+    {
+      params := { min_flush_size := min_flush_size, split_size := split_size },
+      node_id_cnt := nic,
+      root := (betree.Node.Leaf { id := id, size := 0#u64 })
+    })
+
+/- [betree_main::betree::{betree_main::betree::BeTree#6}::apply]:
    Source: 'src/betree.rs', lines 868:4-868:47 -/
 def betree.BeTree.apply
   (self : betree.BeTree) (key : U64) (msg : betree.Message) (st : State) :
-  Result (State × Unit)
-  :=
-  do
-    let (st0, _) ←
-      betree.Node.apply self.root self.params self.node_id_cnt key msg st
-    let _ ←
-      betree.Node.apply_back self.root self.params self.node_id_cnt key msg st
-    Result.ret (st0, ())
-
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::apply]: backward function 0
-   Source: 'src/betree.rs', lines 868:4-868:47 -/
-def betree.BeTree.apply_back
-  (self : betree.BeTree) (key : U64) (msg : betree.Message) (st : State) :
-  Result betree.BeTree
+  Result (State × betree.BeTree)
   :=
   do
-    let (n, nic) ←
-      betree.Node.apply_back self.root self.params self.node_id_cnt key msg st
-    Result.ret { self with node_id_cnt := nic, root := n }
+  let (st1, p) ←
+    betree.Node.apply self.root self.params self.node_id_cnt key msg st
+  let (n, nic) := p
+  Result.ret (st1, { self with node_id_cnt := nic, root := n })
 
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: forward function
+/- [betree_main::betree::{betree_main::betree::BeTree#6}::insert]:
    Source: 'src/betree.rs', lines 874:4-874:52 -/
 def betree.BeTree.insert
   (self : betree.BeTree) (key : U64) (value : U64) (st : State) :
-  Result (State × Unit)
-  :=
-  do
-    let (st0, _) ←
-      betree.BeTree.apply self key (betree.Message.Insert value) st
-    let _ ←
-      betree.BeTree.apply_back self key (betree.Message.Insert value) st
-    Result.ret (st0, ())
-
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::insert]: backward function 0
-   Source: 'src/betree.rs', lines 874:4-874:52 -/
-def betree.BeTree.insert_back
-  (self : betree.BeTree) (key : U64) (value : U64) (st : State) :
-  Result betree.BeTree
+  Result (State × betree.BeTree)
   :=
-  betree.BeTree.apply_back self key (betree.Message.Insert value) st
+  betree.BeTree.apply self key (betree.Message.Insert value) st
 
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: forward function
+/- [betree_main::betree::{betree_main::betree::BeTree#6}::delete]:
    Source: 'src/betree.rs', lines 880:4-880:38 -/
 def betree.BeTree.delete
-  (self : betree.BeTree) (key : U64) (st : State) : Result (State × Unit) :=
-  do
-    let (st0, _) ← betree.BeTree.apply self key betree.Message.Delete st
-    let _ ← betree.BeTree.apply_back self key betree.Message.Delete st
-    Result.ret (st0, ())
-
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::delete]: backward function 0
-   Source: 'src/betree.rs', lines 880:4-880:38 -/
-def betree.BeTree.delete_back
-  (self : betree.BeTree) (key : U64) (st : State) : Result betree.BeTree :=
-  betree.BeTree.apply_back self key betree.Message.Delete st
-
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: forward function
-   Source: 'src/betree.rs', lines 886:4-886:59 -/
-def betree.BeTree.upsert
-  (self : betree.BeTree) (key : U64) (upd : betree.UpsertFunState) (st : State)
-  :
-  Result (State × Unit)
+  (self : betree.BeTree) (key : U64) (st : State) :
+  Result (State × betree.BeTree)
   :=
-  do
-    let (st0, _) ←
-      betree.BeTree.apply self key (betree.Message.Upsert upd) st
-    let _ ← betree.BeTree.apply_back self key (betree.Message.Upsert upd) st
-    Result.ret (st0, ())
+  betree.BeTree.apply self key betree.Message.Delete st
 
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]: backward function 0
+/- [betree_main::betree::{betree_main::betree::BeTree#6}::upsert]:
    Source: 'src/betree.rs', lines 886:4-886:59 -/
-def betree.BeTree.upsert_back
+def betree.BeTree.upsert
   (self : betree.BeTree) (key : U64) (upd : betree.UpsertFunState) (st : State)
   :
-  Result betree.BeTree
+  Result (State × betree.BeTree)
   :=
-  betree.BeTree.apply_back self key (betree.Message.Upsert upd) st
+  betree.BeTree.apply self key (betree.Message.Upsert upd) st
 
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: forward function
+/- [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]:
    Source: 'src/betree.rs', lines 895:4-895:62 -/
 def betree.BeTree.lookup
   (self : betree.BeTree) (key : U64) (st : State) :
-  Result (State × (Option U64))
+  Result (State × ((Option U64) × betree.BeTree))
   :=
-  betree.Node.lookup self.root key st
-
-/- [betree_main::betree::{betree_main::betree::BeTree#6}::lookup]: backward function 0
-   Source: 'src/betree.rs', lines 895:4-895:62 -/
-def betree.BeTree.lookup_back
-  (self : betree.BeTree) (key : U64) (st : State) : Result betree.BeTree :=
   do
-    let n ← betree.Node.lookup_back self.root key st
-    Result.ret { self with root := n }
+  let (st1, (o, n)) ← betree.Node.lookup self.root key st
+  Result.ret (st1, (o, { self with root := n }))
 
-/- [betree_main::main]: forward function
+/- [betree_main::main]:
    Source: 'src/betree_main.rs', lines 5:0-5:9 -/
 def main : Result Unit :=
   Result.ret ()
diff --git a/tests/lean/BetreeMain/FunsExternal_Template.lean b/tests/lean/BetreeMain/FunsExternal_Template.lean
index 95f88873..eaa4b6c2 100644
--- a/tests/lean/BetreeMain/FunsExternal_Template.lean
+++ b/tests/lean/BetreeMain/FunsExternal_Template.lean
@@ -6,29 +6,29 @@ import BetreeMain.Types
 open Primitives
 open betree_main
 
-/- [betree_main::betree_utils::load_internal_node]: forward function
+/- [betree_main::betree_utils::load_internal_node]:
    Source: 'src/betree_utils.rs', lines 98:0-98:63 -/
 axiom betree_utils.load_internal_node
   : U64 → State → Result (State × (betree.List (U64 × betree.Message)))
 
-/- [betree_main::betree_utils::store_internal_node]: forward function
+/- [betree_main::betree_utils::store_internal_node]:
    Source: 'src/betree_utils.rs', lines 115:0-115:71 -/
 axiom betree_utils.store_internal_node
   :
   U64 → betree.List (U64 × betree.Message) → State → Result (State ×
     Unit)
 
-/- [betree_main::betree_utils::load_leaf_node]: forward function
+/- [betree_main::betree_utils::load_leaf_node]:
    Source: 'src/betree_utils.rs', lines 132:0-132:55 -/
 axiom betree_utils.load_leaf_node
   : U64 → State → Result (State × (betree.List (U64 × U64)))
 
-/- [betree_main::betree_utils::store_leaf_node]: forward function
+/- [betree_main::betree_utils::store_leaf_node]:
    Source: 'src/betree_utils.rs', lines 145:0-145:63 -/
 axiom betree_utils.store_leaf_node
   : U64 → betree.List (U64 × U64) → State → Result (State × Unit)
 
-/- [core::option::{core::option::Option<T>}::unwrap]: forward function
+/- [core::option::{core::option::Option<T>}::unwrap]:
    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 -/
 axiom core.option.Option.unwrap
   (T : Type) : Option T → State → Result (State × T)
diff --git a/tests/lean/Bitwise.lean b/tests/lean/Bitwise.lean
index c8538aa2..7c47e3dd 100644
--- a/tests/lean/Bitwise.lean
+++ b/tests/lean/Bitwise.lean
@@ -5,31 +5,31 @@ open Primitives
 
 namespace bitwise
 
-/- [bitwise::shift_u32]: forward function
+/- [bitwise::shift_u32]:
    Source: 'src/bitwise.rs', lines 3:0-3:31 -/
 def shift_u32 (a : U32) : Result U32 :=
   do
-    let t ← a >>> 16#usize
-    t <<< 16#usize
+  let t ← a >>> 16#usize
+  t <<< 16#usize
 
-/- [bitwise::shift_i32]: forward function
+/- [bitwise::shift_i32]:
    Source: 'src/bitwise.rs', lines 10:0-10:31 -/
 def shift_i32 (a : I32) : Result I32 :=
   do
-    let t ← a >>> 16#isize
-    t <<< 16#isize
+  let t ← a >>> 16#isize
+  t <<< 16#isize
 
-/- [bitwise::xor_u32]: forward function
+/- [bitwise::xor_u32]:
    Source: 'src/bitwise.rs', lines 17:0-17:37 -/
 def xor_u32 (a : U32) (b : U32) : Result U32 :=
   Result.ret (a ^^^ b)
 
-/- [bitwise::or_u32]: forward function
+/- [bitwise::or_u32]:
    Source: 'src/bitwise.rs', lines 21:0-21:36 -/
 def or_u32 (a : U32) (b : U32) : Result U32 :=
   Result.ret (a ||| b)
 
-/- [bitwise::and_u32]: forward function
+/- [bitwise::and_u32]:
    Source: 'src/bitwise.rs', lines 25:0-25:37 -/
 def and_u32 (a : U32) (b : U32) : Result U32 :=
   Result.ret (a &&& b)
diff --git a/tests/lean/Constants.lean b/tests/lean/Constants.lean
index 80864427..2912805f 100644
--- a/tests/lean/Constants.lean
+++ b/tests/lean/Constants.lean
@@ -20,7 +20,7 @@ def x1_c : U32 := eval_global x1_body (by simp)
 def x2_body : Result U32 := Result.ret 3#u32
 def x2_c : U32 := eval_global x2_body (by simp)
 
-/- [constants::incr]: forward function
+/- [constants::incr]:
    Source: 'src/constants.rs', lines 17:0-17:32 -/
 def incr (n : U32) : Result U32 :=
   n + 1#u32
@@ -30,7 +30,7 @@ def incr (n : U32) : Result U32 :=
 def x3_body : Result U32 := incr 32#u32
 def x3_c : U32 := eval_global x3_body (by simp)
 
-/- [constants::mk_pair0]: forward function
+/- [constants::mk_pair0]:
    Source: 'src/constants.rs', lines 23:0-23:51 -/
 def mk_pair0 (x : U32) (y : U32) : Result (U32 × U32) :=
   Result.ret (x, y)
@@ -41,7 +41,7 @@ structure Pair (T1 T2 : Type) where
   x : T1
   y : T2
 
-/- [constants::mk_pair1]: forward function
+/- [constants::mk_pair1]:
    Source: 'src/constants.rs', lines 27:0-27:55 -/
 def mk_pair1 (x : U32) (y : U32) : Result (Pair U32 U32) :=
   Result.ret { x := x, y := y }
@@ -71,7 +71,7 @@ def p3_c : Pair U32 U32 := eval_global p3_body (by simp)
 structure Wrap (T : Type) where
   value : T
 
-/- [constants::{constants::Wrap<T>}::new]: forward function
+/- [constants::{constants::Wrap<T>}::new]:
    Source: 'src/constants.rs', lines 54:4-54:41 -/
 def Wrap.new (T : Type) (value : T) : Result (Wrap T) :=
   Result.ret { value := value }
@@ -81,7 +81,7 @@ def Wrap.new (T : Type) (value : T) : Result (Wrap T) :=
 def y_body : Result (Wrap I32) := Wrap.new I32 2#i32
 def y_c : Wrap I32 := eval_global y_body (by simp)
 
-/- [constants::unwrap_y]: forward function
+/- [constants::unwrap_y]:
    Source: 'src/constants.rs', lines 43:0-43:30 -/
 def unwrap_y : Result I32 :=
   Result.ret y_c.value
@@ -96,12 +96,12 @@ def yval_c : I32 := eval_global yval_body (by simp)
 def get_z1_z1_body : Result I32 := Result.ret 3#i32
 def get_z1_z1_c : I32 := eval_global get_z1_z1_body (by simp)
 
-/- [constants::get_z1]: forward function
+/- [constants::get_z1]:
    Source: 'src/constants.rs', lines 61:0-61:28 -/
 def get_z1 : Result I32 :=
   Result.ret get_z1_z1_c
 
-/- [constants::add]: forward function
+/- [constants::add]:
    Source: 'src/constants.rs', lines 66:0-66:39 -/
 def add (a : I32) (b : I32) : Result I32 :=
   a + b
@@ -121,13 +121,13 @@ def q2_c : I32 := eval_global q2_body (by simp)
 def q3_body : Result I32 := add q2_c 3#i32
 def q3_c : I32 := eval_global q3_body (by simp)
 
-/- [constants::get_z2]: forward function
+/- [constants::get_z2]:
    Source: 'src/constants.rs', lines 70:0-70:28 -/
 def get_z2 : Result I32 :=
   do
-    let i ← get_z1
-    let i0 ← add i q3_c
-    add q1_c i0
+  let i ← get_z1
+  let i1 ← add i q3_c
+  add q1_c i1
 
 /- [constants::S1]
    Source: 'src/constants.rs', lines 80:0-80:18 -/
diff --git a/tests/lean/External/Funs.lean b/tests/lean/External/Funs.lean
index 48ec6ad5..88ced82d 100644
--- a/tests/lean/External/Funs.lean
+++ b/tests/lean/External/Funs.lean
@@ -7,92 +7,59 @@ open Primitives
 
 namespace external
 
-/- [external::swap]: forward function
+/- [external::swap]:
    Source: 'src/external.rs', lines 6:0-6:46 -/
-def swap (T : Type) (x : T) (y : T) (st : State) : Result (State × Unit) :=
-  do
-    let (st0, _) ← core.mem.swap T x y st
-    let (st1, _) ← core.mem.swap_back0 T x y st st0
-    let (st2, _) ← core.mem.swap_back1 T x y st st1
-    Result.ret (st2, ())
-
-/- [external::swap]: backward function 0
-   Source: 'src/external.rs', lines 6:0-6:46 -/
-def swap_back
-  (T : Type) (x : T) (y : T) (st : State) (st0 : State) :
-  Result (State × (T × T))
-  :=
-  do
-    let (st1, _) ← core.mem.swap T x y st
-    let (st2, x0) ← core.mem.swap_back0 T x y st st1
-    let (_, y0) ← core.mem.swap_back1 T x y st st2
-    Result.ret (st0, (x0, y0))
+def swap
+  (T : Type) (x : T) (y : T) (st : State) : Result (State × (T × T)) :=
+  core.mem.swap T x y st
 
-/- [external::test_new_non_zero_u32]: forward function
+/- [external::test_new_non_zero_u32]:
    Source: 'src/external.rs', lines 11:0-11:60 -/
 def test_new_non_zero_u32
   (x : U32) (st : State) : Result (State × core.num.nonzero.NonZeroU32) :=
   do
-    let (st0, o) ← core.num.nonzero.NonZeroU32.new x st
-    core.option.Option.unwrap core.num.nonzero.NonZeroU32 o st0
+  let (st1, o) ← core.num.nonzero.NonZeroU32.new x st
+  core.option.Option.unwrap core.num.nonzero.NonZeroU32 o st1
 
-/- [external::test_vec]: forward function
+/- [external::test_vec]:
    Source: 'src/external.rs', lines 17:0-17:17 -/
 def test_vec : Result Unit :=
   do
-    let v := alloc.vec.Vec.new U32
-    let _ ← alloc.vec.Vec.push U32 v 0#u32
-    Result.ret ()
+  let v := alloc.vec.Vec.new U32
+  let _ ← alloc.vec.Vec.push U32 v 0#u32
+  Result.ret ()
 
 /- Unit test for [external::test_vec] -/
 #assert (test_vec == Result.ret ())
 
-/- [external::custom_swap]: forward function
+/- [external::custom_swap]:
    Source: 'src/external.rs', lines 24:0-24:66 -/
 def custom_swap
-  (T : Type) (x : T) (y : T) (st : State) : Result (State × T) :=
-  do
-    let (st0, _) ← core.mem.swap T x y st
-    let (st1, x0) ← core.mem.swap_back0 T x y st st0
-    let (st2, _) ← core.mem.swap_back1 T x y st st1
-    Result.ret (st2, x0)
-
-/- [external::custom_swap]: backward function 0
-   Source: 'src/external.rs', lines 24:0-24:66 -/
-def custom_swap_back
-  (T : Type) (x : T) (y : T) (st : State) (ret : T) (st0 : State) :
-  Result (State × (T × T))
+  (T : Type) (x : T) (y : T) (st : State) :
+  Result (State × (T × (T → State → Result (State × (T × T)))))
   :=
   do
-    let (st1, _) ← core.mem.swap T x y st
-    let (st2, _) ← core.mem.swap_back0 T x y st st1
-    let (_, y0) ← core.mem.swap_back1 T x y st st2
-    Result.ret (st0, (ret, y0))
+  let (st1, (t, t1)) ← core.mem.swap T x y st
+  let back_'a := fun ret st2 => Result.ret (st2, (ret, t1))
+  Result.ret (st1, (t, back_'a))
 
-/- [external::test_custom_swap]: forward function
+/- [external::test_custom_swap]:
    Source: 'src/external.rs', lines 29:0-29:59 -/
 def test_custom_swap
-  (x : U32) (y : U32) (st : State) : Result (State × Unit) :=
+  (x : U32) (y : U32) (st : State) : Result (State × (U32 × U32)) :=
   do
-    let (st0, _) ← custom_swap U32 x y st
-    Result.ret (st0, ())
-
-/- [external::test_custom_swap]: backward function 0
-   Source: 'src/external.rs', lines 29:0-29:59 -/
-def test_custom_swap_back
-  (x : U32) (y : U32) (st : State) (st0 : State) :
-  Result (State × (U32 × U32))
-  :=
-  custom_swap_back U32 x y st 1#u32 st0
+  let (st1, (_, custom_swap_back)) ← custom_swap U32 x y st
+  let (_, (x1, y1)) ← custom_swap_back 1#u32 st1
+  Result.ret (st1, (x1, y1))
 
-/- [external::test_swap_non_zero]: forward function
+/- [external::test_swap_non_zero]:
    Source: 'src/external.rs', lines 35:0-35:44 -/
 def test_swap_non_zero (x : U32) (st : State) : Result (State × U32) :=
   do
-    let (st0, _) ← swap U32 x 0#u32 st
-    let (st1, (x0, _)) ← swap_back U32 x 0#u32 st st0
-    if x0 = 0#u32
-    then Result.fail .panic
-    else Result.ret (st1, x0)
+  let (st1, p) ← swap U32 x 0#u32 st
+  let (x1, _) := p
+  if x1 = 0#u32
+  then Result.fail .panic
+  else Result.ret (st1, x1)
 
 end external
diff --git a/tests/lean/External/FunsExternal_Template.lean b/tests/lean/External/FunsExternal_Template.lean
index 55cd6bb5..7e237369 100644
--- a/tests/lean/External/FunsExternal_Template.lean
+++ b/tests/lean/External/FunsExternal_Template.lean
@@ -6,26 +6,17 @@ import External.Types
 open Primitives
 open external
 
-/- [core::mem::swap]: forward function
+/- [core::mem::swap]:
    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 -/
-axiom core.mem.swap (T : Type) : T → T → State → Result (State × Unit)
+axiom core.mem.swap
+  (T : Type) : T → T → State → Result (State × (T × T))
 
-/- [core::mem::swap]: backward function 0
-   Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 -/
-axiom core.mem.swap_back0
-  (T : Type) : T → T → State → State → Result (State × T)
-
-/- [core::mem::swap]: backward function 1
-   Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 -/
-axiom core.mem.swap_back1
-  (T : Type) : T → T → State → State → Result (State × T)
-
-/- [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]: forward function
+/- [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]:
    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/num/nonzero.rs', lines 79:16-79:57 -/
 axiom core.num.nonzero.NonZeroU32.new
   : U32 → State → Result (State × (Option core.num.nonzero.NonZeroU32))
 
-/- [core::option::{core::option::Option<T>}::unwrap]: forward function
+/- [core::option::{core::option::Option<T>}::unwrap]:
    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/option.rs', lines 932:4-932:34 -/
 axiom core.option.Option.unwrap
   (T : Type) : Option T → State → Result (State × T)
diff --git a/tests/lean/Hashmap/Funs.lean b/tests/lean/Hashmap/Funs.lean
index e03981a2..32ed2b33 100644
--- a/tests/lean/Hashmap/Funs.lean
+++ b/tests/lean/Hashmap/Funs.lean
@@ -6,12 +6,12 @@ open Primitives
 
 namespace hashmap
 
-/- [hashmap::hash_key]: forward function
+/- [hashmap::hash_key]:
    Source: 'src/hashmap.rs', lines 27:0-27:32 -/
 def hash_key (k : Usize) : Result Usize :=
   Result.ret k
 
-/- [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+/- [hashmap::{hashmap::HashMap<T>}::allocate_slots]: loop 0:
    Source: 'src/hashmap.rs', lines 50:4-56:5 -/
 divergent def HashMap.allocate_slots_loop
   (T : Type) (slots : alloc.vec.Vec (List T)) (n : Usize) :
@@ -20,12 +20,12 @@ divergent def HashMap.allocate_slots_loop
   if n > 0#usize
   then
     do
-      let slots0 ← alloc.vec.Vec.push (List T) slots List.Nil
-      let n0 ← n - 1#usize
-      HashMap.allocate_slots_loop T slots0 n0
+    let v ← alloc.vec.Vec.push (List T) slots List.Nil
+    let n1 ← n - 1#usize
+    HashMap.allocate_slots_loop T v n1
   else Result.ret slots
 
-/- [hashmap::{hashmap::HashMap<T>}::allocate_slots]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::allocate_slots]:
    Source: 'src/hashmap.rs', lines 50:4-50:76 -/
 def HashMap.allocate_slots
   (T : Type) (slots : alloc.vec.Vec (List T)) (n : Usize) :
@@ -33,7 +33,7 @@ def HashMap.allocate_slots
   :=
   HashMap.allocate_slots_loop T slots n
 
-/- [hashmap::{hashmap::HashMap<T>}::new_with_capacity]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::new_with_capacity]:
    Source: 'src/hashmap.rs', lines 59:4-63:13 -/
 def HashMap.new_with_capacity
   (T : Type) (capacity : Usize) (max_load_dividend : Usize)
@@ -41,252 +41,222 @@ def HashMap.new_with_capacity
   Result (HashMap T)
   :=
   do
-    let v := alloc.vec.Vec.new (List T)
-    let slots ← HashMap.allocate_slots T v capacity
-    let i ← capacity * max_load_dividend
-    let i0 ← i / max_load_divisor
-    Result.ret
-      {
-        num_entries := 0#usize,
-        max_load_factor := (max_load_dividend, max_load_divisor),
-        max_load := i0,
-        slots := slots
-      }
-
-/- [hashmap::{hashmap::HashMap<T>}::new]: forward function
+  let v := alloc.vec.Vec.new (List T)
+  let slots ← HashMap.allocate_slots T v capacity
+  let i ← capacity * max_load_dividend
+  let i1 ← i / max_load_divisor
+  Result.ret
+    {
+      num_entries := 0#usize,
+      max_load_factor := (max_load_dividend, max_load_divisor),
+      max_load := i1,
+      slots := slots
+    }
+
+/- [hashmap::{hashmap::HashMap<T>}::new]:
    Source: 'src/hashmap.rs', lines 75:4-75:24 -/
 def HashMap.new (T : Type) : Result (HashMap T) :=
   HashMap.new_with_capacity T 32#usize 4#usize 5#usize
 
-/- [hashmap::{hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::clear]: loop 0:
    Source: 'src/hashmap.rs', lines 80:4-88:5 -/
 divergent def HashMap.clear_loop
   (T : Type) (slots : alloc.vec.Vec (List T)) (i : Usize) :
   Result (alloc.vec.Vec (List T))
   :=
-  let i0 := alloc.vec.Vec.len (List T) slots
-  if i < i0
+  let i1 := alloc.vec.Vec.len (List T) slots
+  if i < i1
   then
     do
-      let i1 ← i + 1#usize
-      let slots0 ←
-        alloc.vec.Vec.index_mut_back (List T) Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst (List T)) slots i
-          List.Nil
-      HashMap.clear_loop T slots0 i1
+    let (_, index_mut_back) ←
+      alloc.vec.Vec.index_mut (List T) Usize
+        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) slots i
+    let i2 ← i + 1#usize
+    let slots1 ← index_mut_back List.Nil
+    HashMap.clear_loop T slots1 i2
   else Result.ret slots
 
-/- [hashmap::{hashmap::HashMap<T>}::clear]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::clear]:
    Source: 'src/hashmap.rs', lines 80:4-80:27 -/
 def HashMap.clear (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
-    let v ← HashMap.clear_loop T self.slots 0#usize
-    Result.ret { self with num_entries := 0#usize, slots := v }
+  let back ← HashMap.clear_loop T self.slots 0#usize
+  Result.ret { self with num_entries := 0#usize, slots := back }
 
-/- [hashmap::{hashmap::HashMap<T>}::len]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::len]:
    Source: 'src/hashmap.rs', lines 90:4-90:30 -/
 def HashMap.len (T : Type) (self : HashMap T) : Result Usize :=
   Result.ret self.num_entries
 
-/- [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+/- [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 97:4-114:5 -/
 divergent def HashMap.insert_in_list_loop
-  (T : Type) (key : Usize) (value : T) (ls : List T) : Result Bool :=
-  match ls with
-  | List.Cons ckey cvalue tl =>
-    if ckey = key
-    then Result.ret false
-    else HashMap.insert_in_list_loop T key value tl
-  | List.Nil => Result.ret true
-
-/- [hashmap::{hashmap::HashMap<T>}::insert_in_list]: forward function
-   Source: 'src/hashmap.rs', lines 97:4-97:71 -/
-def HashMap.insert_in_list
-  (T : Type) (key : Usize) (value : T) (ls : List T) : Result Bool :=
-  HashMap.insert_in_list_loop T key value ls
-
-/- [hashmap::{hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
-   Source: 'src/hashmap.rs', lines 97:4-114:5 -/
-divergent def HashMap.insert_in_list_loop_back
-  (T : Type) (key : Usize) (value : T) (ls : List T) : Result (List T) :=
+  (T : Type) (key : Usize) (value : T) (ls : List T) :
+  Result (Bool × (List T))
+  :=
   match ls with
   | List.Cons ckey cvalue tl =>
     if ckey = key
-    then Result.ret (List.Cons ckey value tl)
+    then Result.ret (false, List.Cons ckey value tl)
     else
       do
-        let tl0 ← HashMap.insert_in_list_loop_back T key value tl
-        Result.ret (List.Cons ckey cvalue tl0)
+      let (b, back) ← HashMap.insert_in_list_loop T key value tl
+      Result.ret (b, List.Cons ckey cvalue back)
   | List.Nil => let l := List.Nil
-                Result.ret (List.Cons key value l)
+                Result.ret (true, List.Cons key value l)
 
-/- [hashmap::{hashmap::HashMap<T>}::insert_in_list]: backward function 0
+/- [hashmap::{hashmap::HashMap<T>}::insert_in_list]:
    Source: 'src/hashmap.rs', lines 97:4-97:71 -/
-def HashMap.insert_in_list_back
-  (T : Type) (key : Usize) (value : T) (ls : List T) : Result (List T) :=
-  HashMap.insert_in_list_loop_back T key value ls
+def HashMap.insert_in_list
+  (T : Type) (key : Usize) (value : T) (ls : List T) :
+  Result (Bool × (List T))
+  :=
+  HashMap.insert_in_list_loop T key value ls
 
-/- [hashmap::{hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::insert_no_resize]:
    Source: 'src/hashmap.rs', lines 117:4-117:54 -/
 def HashMap.insert_no_resize
   (T : Type) (self : HashMap T) (key : Usize) (value : T) :
   Result (HashMap T)
   :=
   do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    let inserted ← HashMap.insert_in_list T key value l
-    if inserted
-    then
-      do
-        let i0 ← self.num_entries + 1#usize
-        let l0 ← HashMap.insert_in_list_back T key value l
-        let v ←
-          alloc.vec.Vec.index_mut_back (List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-            hash_mod l0
-        Result.ret { self with num_entries := i0, slots := v }
-    else
-      do
-        let l0 ← HashMap.insert_in_list_back T key value l
-        let v ←
-          alloc.vec.Vec.index_mut_back (List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-            hash_mod l0
-        Result.ret { self with slots := v }
-
-/- [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+  let hash ← hash_key key
+  let i := alloc.vec.Vec.len (List T) self.slots
+  let hash_mod ← hash % i
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots hash_mod
+  let (inserted, l1) ← HashMap.insert_in_list T key value l
+  if inserted
+  then
+    do
+    let i1 ← self.num_entries + 1#usize
+    let v ← index_mut_back l1
+    Result.ret { self with num_entries := i1, slots := v }
+  else do
+       let v ← index_mut_back l1
+       Result.ret { self with slots := v }
+
+/- [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: loop 0:
    Source: 'src/hashmap.rs', lines 183:4-196:5 -/
 divergent def HashMap.move_elements_from_list_loop
   (T : Type) (ntable : HashMap T) (ls : List T) : Result (HashMap T) :=
   match ls with
   | List.Cons k v tl =>
     do
-      let ntable0 ← HashMap.insert_no_resize T ntable k v
-      HashMap.move_elements_from_list_loop T ntable0 tl
+    let hm ← HashMap.insert_no_resize T ntable k v
+    HashMap.move_elements_from_list_loop T hm tl
   | List.Nil => Result.ret ntable
 
-/- [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::move_elements_from_list]:
    Source: 'src/hashmap.rs', lines 183:4-183:72 -/
 def HashMap.move_elements_from_list
   (T : Type) (ntable : HashMap T) (ls : List T) : Result (HashMap T) :=
   HashMap.move_elements_from_list_loop T ntable ls
 
-/- [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::move_elements]: loop 0:
    Source: 'src/hashmap.rs', lines 171:4-180:5 -/
 divergent def HashMap.move_elements_loop
   (T : Type) (ntable : HashMap T) (slots : alloc.vec.Vec (List T)) (i : Usize)
   :
   Result ((HashMap T) × (alloc.vec.Vec (List T)))
   :=
-  let i0 := alloc.vec.Vec.len (List T) slots
-  if i < i0
+  let i1 := alloc.vec.Vec.len (List T) slots
+  if i < i1
   then
     do
-      let l ←
-        alloc.vec.Vec.index_mut (List T) Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst (List T)) slots i
-      let ls := core.mem.replace (List T) l List.Nil
-      let ntable0 ← HashMap.move_elements_from_list T ntable ls
-      let i1 ← i + 1#usize
-      let l0 := core.mem.replace_back (List T) l List.Nil
-      let slots0 ←
-        alloc.vec.Vec.index_mut_back (List T) Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst (List T)) slots i l0
-      HashMap.move_elements_loop T ntable0 slots0 i1
+    let (l, index_mut_back) ←
+      alloc.vec.Vec.index_mut (List T) Usize
+        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) slots i
+    let (ls, l1) := core.mem.replace (List T) l List.Nil
+    let hm ← HashMap.move_elements_from_list T ntable ls
+    let i2 ← i + 1#usize
+    let slots1 ← index_mut_back l1
+    let back_'a ← HashMap.move_elements_loop T hm slots1 i2
+    let (hm1, v) := back_'a
+    Result.ret (hm1, v)
   else Result.ret (ntable, slots)
 
-/- [hashmap::{hashmap::HashMap<T>}::move_elements]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::move_elements]:
    Source: 'src/hashmap.rs', lines 171:4-171:95 -/
 def HashMap.move_elements
   (T : Type) (ntable : HashMap T) (slots : alloc.vec.Vec (List T)) (i : Usize)
   :
   Result ((HashMap T) × (alloc.vec.Vec (List T)))
   :=
-  HashMap.move_elements_loop T ntable slots i
+  do
+  let back_'a ← HashMap.move_elements_loop T ntable slots i
+  let (hm, v) := back_'a
+  Result.ret (hm, v)
 
-/- [hashmap::{hashmap::HashMap<T>}::try_resize]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap::{hashmap::HashMap<T>}::try_resize]:
    Source: 'src/hashmap.rs', lines 140:4-140:28 -/
 def HashMap.try_resize (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
-    let max_usize ← Scalar.cast .Usize core_u32_max
-    let capacity := alloc.vec.Vec.len (List T) self.slots
-    let n1 ← max_usize / 2#usize
-    let (i, i0) := self.max_load_factor
-    let i1 ← n1 / i
-    if capacity <= i1
-    then
-      do
-        let i2 ← capacity * 2#usize
-        let ntable ← HashMap.new_with_capacity T i2 i i0
-        let (ntable0, _) ← HashMap.move_elements T ntable self.slots 0#usize
-        Result.ret
-          {
-            ntable0
-              with
-              num_entries := self.num_entries, max_load_factor := (i, i0)
-          }
-    else Result.ret { self with max_load_factor := (i, i0) }
-
-/- [hashmap::{hashmap::HashMap<T>}::insert]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+  let max_usize ← Scalar.cast .Usize core_u32_max
+  let capacity := alloc.vec.Vec.len (List T) self.slots
+  let n1 ← max_usize / 2#usize
+  let (i, i1) := self.max_load_factor
+  let i2 ← n1 / i
+  if capacity <= i2
+  then
+    do
+    let i3 ← capacity * 2#usize
+    let ntable ← HashMap.new_with_capacity T i3 i i1
+    let p ← HashMap.move_elements T ntable self.slots 0#usize
+    let (ntable1, _) := p
+    Result.ret
+      {
+        ntable1
+          with
+          num_entries := self.num_entries, max_load_factor := (i, i1)
+      }
+  else Result.ret { self with max_load_factor := (i, i1) }
+
+/- [hashmap::{hashmap::HashMap<T>}::insert]:
    Source: 'src/hashmap.rs', lines 129:4-129:48 -/
 def HashMap.insert
   (T : Type) (self : HashMap T) (key : Usize) (value : T) :
   Result (HashMap T)
   :=
   do
-    let self0 ← HashMap.insert_no_resize T self key value
-    let i ← HashMap.len T self0
-    if i > self0.max_load
-    then HashMap.try_resize T self0
-    else Result.ret self0
+  let hm ← HashMap.insert_no_resize T self key value
+  let i ← HashMap.len T hm
+  if i > hm.max_load
+  then HashMap.try_resize T hm
+  else Result.ret hm
 
-/- [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+/- [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 206:4-219:5 -/
 divergent def HashMap.contains_key_in_list_loop
   (T : Type) (key : Usize) (ls : List T) : Result Bool :=
   match ls with
-  | List.Cons ckey t tl =>
+  | List.Cons ckey _ tl =>
     if ckey = key
     then Result.ret true
     else HashMap.contains_key_in_list_loop T key tl
   | List.Nil => Result.ret false
 
-/- [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::contains_key_in_list]:
    Source: 'src/hashmap.rs', lines 206:4-206:68 -/
 def HashMap.contains_key_in_list
   (T : Type) (key : Usize) (ls : List T) : Result Bool :=
   HashMap.contains_key_in_list_loop T key ls
 
-/- [hashmap::{hashmap::HashMap<T>}::contains_key]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::contains_key]:
    Source: 'src/hashmap.rs', lines 199:4-199:49 -/
 def HashMap.contains_key
   (T : Type) (self : HashMap T) (key : Usize) : Result Bool :=
   do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    HashMap.contains_key_in_list T key l
-
-/- [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+  let hash ← hash_key key
+  let i := alloc.vec.Vec.len (List T) self.slots
+  let hash_mod ← hash % i
+  let l ←
+    alloc.vec.Vec.index (List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots hash_mod
+  HashMap.contains_key_in_list T key l
+
+/- [hashmap::{hashmap::HashMap<T>}::get_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 224:4-237:5 -/
 divergent def HashMap.get_in_list_loop
   (T : Type) (key : Usize) (ls : List T) : Result T :=
@@ -297,231 +267,171 @@ divergent def HashMap.get_in_list_loop
     else HashMap.get_in_list_loop T key tl
   | List.Nil => Result.fail .panic
 
-/- [hashmap::{hashmap::HashMap<T>}::get_in_list]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::get_in_list]:
    Source: 'src/hashmap.rs', lines 224:4-224:70 -/
 def HashMap.get_in_list (T : Type) (key : Usize) (ls : List T) : Result T :=
   HashMap.get_in_list_loop T key ls
 
-/- [hashmap::{hashmap::HashMap<T>}::get]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::get]:
    Source: 'src/hashmap.rs', lines 239:4-239:55 -/
 def HashMap.get (T : Type) (self : HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    HashMap.get_in_list T key l
-
-/- [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+  let hash ← hash_key key
+  let i := alloc.vec.Vec.len (List T) self.slots
+  let hash_mod ← hash % i
+  let l ←
+    alloc.vec.Vec.index (List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots hash_mod
+  HashMap.get_in_list T key l
+
+/- [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 245:4-254:5 -/
 divergent def HashMap.get_mut_in_list_loop
-  (T : Type) (ls : List T) (key : Usize) : Result T :=
-  match ls with
-  | List.Cons ckey cvalue tl =>
-    if ckey = key
-    then Result.ret cvalue
-    else HashMap.get_mut_in_list_loop T tl key
-  | List.Nil => Result.fail .panic
-
-/- [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: forward function
-   Source: 'src/hashmap.rs', lines 245:4-245:86 -/
-def HashMap.get_mut_in_list
-  (T : Type) (ls : List T) (key : Usize) : Result T :=
-  HashMap.get_mut_in_list_loop T ls key
-
-/- [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
-   Source: 'src/hashmap.rs', lines 245:4-254:5 -/
-divergent def HashMap.get_mut_in_list_loop_back
-  (T : Type) (ls : List T) (key : Usize) (ret : T) : Result (List T) :=
+  (T : Type) (ls : List T) (key : Usize) :
+  Result (T × (T → Result (List T)))
+  :=
   match ls with
   | List.Cons ckey cvalue tl =>
     if ckey = key
-    then Result.ret (List.Cons ckey ret tl)
+    then
+      let back_'a := fun ret => Result.ret (List.Cons ckey ret tl)
+      Result.ret (cvalue, back_'a)
     else
       do
-        let tl0 ← HashMap.get_mut_in_list_loop_back T tl key ret
-        Result.ret (List.Cons ckey cvalue tl0)
+      let (t, back_'a) ← HashMap.get_mut_in_list_loop T tl key
+      let back_'a1 :=
+        fun ret =>
+          do
+          let tl1 ← back_'a ret
+          Result.ret (List.Cons ckey cvalue tl1)
+      Result.ret (t, back_'a1)
   | List.Nil => Result.fail .panic
 
-/- [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+/- [hashmap::{hashmap::HashMap<T>}::get_mut_in_list]:
    Source: 'src/hashmap.rs', lines 245:4-245:86 -/
-def HashMap.get_mut_in_list_back
-  (T : Type) (ls : List T) (key : Usize) (ret : T) : Result (List T) :=
-  HashMap.get_mut_in_list_loop_back T ls key ret
-
-/- [hashmap::{hashmap::HashMap<T>}::get_mut]: forward function
-   Source: 'src/hashmap.rs', lines 257:4-257:67 -/
-def HashMap.get_mut (T : Type) (self : HashMap T) (key : Usize) : Result T :=
+def HashMap.get_mut_in_list
+  (T : Type) (ls : List T) (key : Usize) :
+  Result (T × (T → Result (List T)))
+  :=
   do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    HashMap.get_mut_in_list T l key
+  let (t, back_'a) ← HashMap.get_mut_in_list_loop T ls key
+  let back_'a1 := fun ret => back_'a ret
+  Result.ret (t, back_'a1)
 
-/- [hashmap::{hashmap::HashMap<T>}::get_mut]: backward function 0
+/- [hashmap::{hashmap::HashMap<T>}::get_mut]:
    Source: 'src/hashmap.rs', lines 257:4-257:67 -/
-def HashMap.get_mut_back
-  (T : Type) (self : HashMap T) (key : Usize) (ret : T) : Result (HashMap T) :=
+def HashMap.get_mut
+  (T : Type) (self : HashMap T) (key : Usize) :
+  Result (T × (T → Result (HashMap T)))
+  :=
   do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    let l0 ← HashMap.get_mut_in_list_back T l key ret
-    let v ←
-      alloc.vec.Vec.index_mut_back (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod l0
-    Result.ret { self with slots := v }
-
-/- [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
-   Source: 'src/hashmap.rs', lines 265:4-291:5 -/
-divergent def HashMap.remove_from_list_loop
-  (T : Type) (key : Usize) (ls : List T) : Result (Option T) :=
-  match ls with
-  | List.Cons ckey t tl =>
-    if ckey = key
-    then
-      let mv_ls := core.mem.replace (List T) (List.Cons ckey t tl) List.Nil
-      match mv_ls with
-      | List.Cons i cvalue tl0 => Result.ret (some cvalue)
-      | List.Nil => Result.fail .panic
-    else HashMap.remove_from_list_loop T key tl
-  | List.Nil => Result.ret none
-
-/- [hashmap::{hashmap::HashMap<T>}::remove_from_list]: forward function
-   Source: 'src/hashmap.rs', lines 265:4-265:69 -/
-def HashMap.remove_from_list
-  (T : Type) (key : Usize) (ls : List T) : Result (Option T) :=
-  HashMap.remove_from_list_loop T key ls
+  let hash ← hash_key key
+  let i := alloc.vec.Vec.len (List T) self.slots
+  let hash_mod ← hash % i
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots hash_mod
+  let (t, get_mut_in_list_back) ← HashMap.get_mut_in_list T l key
+  let back_'a :=
+    fun ret =>
+      do
+      let l1 ← get_mut_in_list_back ret
+      let v ← index_mut_back l1
+      Result.ret { self with slots := v }
+  Result.ret (t, back_'a)
 
-/- [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
+/- [hashmap::{hashmap::HashMap<T>}::remove_from_list]: loop 0:
    Source: 'src/hashmap.rs', lines 265:4-291:5 -/
-divergent def HashMap.remove_from_list_loop_back
-  (T : Type) (key : Usize) (ls : List T) : Result (List T) :=
+divergent def HashMap.remove_from_list_loop
+  (T : Type) (key : Usize) (ls : List T) : Result ((Option T) × (List T)) :=
   match ls with
   | List.Cons ckey t tl =>
     if ckey = key
     then
-      let mv_ls := core.mem.replace (List T) (List.Cons ckey t tl) List.Nil
+      let (mv_ls, _) :=
+        core.mem.replace (List T) (List.Cons ckey t tl) List.Nil
       match mv_ls with
-      | List.Cons i cvalue tl0 => Result.ret tl0
+      | List.Cons _ cvalue tl1 => Result.ret (some cvalue, tl1)
       | List.Nil => Result.fail .panic
     else
       do
-        let tl0 ← HashMap.remove_from_list_loop_back T key tl
-        Result.ret (List.Cons ckey t tl0)
-  | List.Nil => Result.ret List.Nil
+      let (o, back) ← HashMap.remove_from_list_loop T key tl
+      Result.ret (o, List.Cons ckey t back)
+  | List.Nil => Result.ret (none, List.Nil)
 
-/- [hashmap::{hashmap::HashMap<T>}::remove_from_list]: backward function 1
+/- [hashmap::{hashmap::HashMap<T>}::remove_from_list]:
    Source: 'src/hashmap.rs', lines 265:4-265:69 -/
-def HashMap.remove_from_list_back
-  (T : Type) (key : Usize) (ls : List T) : Result (List T) :=
-  HashMap.remove_from_list_loop_back T key ls
+def HashMap.remove_from_list
+  (T : Type) (key : Usize) (ls : List T) : Result ((Option T) × (List T)) :=
+  HashMap.remove_from_list_loop T key ls
 
-/- [hashmap::{hashmap::HashMap<T>}::remove]: forward function
+/- [hashmap::{hashmap::HashMap<T>}::remove]:
    Source: 'src/hashmap.rs', lines 294:4-294:52 -/
 def HashMap.remove
-  (T : Type) (self : HashMap T) (key : Usize) : Result (Option T) :=
-  do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    let x ← HashMap.remove_from_list T key l
-    match x with
-    | none => Result.ret none
-    | some x0 => do
-                   let _ ← self.num_entries - 1#usize
-                   Result.ret (some x0)
-
-/- [hashmap::{hashmap::HashMap<T>}::remove]: backward function 0
-   Source: 'src/hashmap.rs', lines 294:4-294:52 -/
-def HashMap.remove_back
-  (T : Type) (self : HashMap T) (key : Usize) : Result (HashMap T) :=
+  (T : Type) (self : HashMap T) (key : Usize) :
+  Result ((Option T) × (HashMap T))
+  :=
   do
-    let hash ← hash_key key
-    let i := alloc.vec.Vec.len (List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-        hash_mod
-    let x ← HashMap.remove_from_list T key l
-    match x with
-    | none =>
-      do
-        let l0 ← HashMap.remove_from_list_back T key l
-        let v ←
-          alloc.vec.Vec.index_mut_back (List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-            hash_mod l0
-        Result.ret { self with slots := v }
-    | some x0 =>
-      do
-        let i0 ← self.num_entries - 1#usize
-        let l0 ← HashMap.remove_from_list_back T key l
-        let v ←
-          alloc.vec.Vec.index_mut_back (List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots
-            hash_mod l0
-        Result.ret { self with num_entries := i0, slots := v }
-
-/- [hashmap::test1]: forward function
+  let hash ← hash_key key
+  let i := alloc.vec.Vec.len (List T) self.slots
+  let hash_mod ← hash % i
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (List T)) self.slots hash_mod
+  let (x, l1) ← HashMap.remove_from_list T key l
+  match x with
+  | none =>
+    do
+    let v ← index_mut_back l1
+    Result.ret (none, { self with slots := v })
+  | some x1 =>
+    do
+    let i1 ← self.num_entries - 1#usize
+    let v ← index_mut_back l1
+    Result.ret (some x1, { self with num_entries := i1, slots := v })
+
+/- [hashmap::test1]:
    Source: 'src/hashmap.rs', lines 315:0-315:10 -/
 def test1 : Result Unit :=
   do
-    let hm ← HashMap.new U64
-    let hm0 ← HashMap.insert U64 hm 0#usize 42#u64
-    let hm1 ← HashMap.insert U64 hm0 128#usize 18#u64
-    let hm2 ← HashMap.insert U64 hm1 1024#usize 138#u64
-    let hm3 ← HashMap.insert U64 hm2 1056#usize 256#u64
-    let i ← HashMap.get U64 hm3 128#usize
-    if not (i = 18#u64)
+  let hm ← HashMap.new U64
+  let hm1 ← HashMap.insert U64 hm 0#usize 42#u64
+  let hm2 ← HashMap.insert U64 hm1 128#usize 18#u64
+  let hm3 ← HashMap.insert U64 hm2 1024#usize 138#u64
+  let hm4 ← HashMap.insert U64 hm3 1056#usize 256#u64
+  let i ← HashMap.get U64 hm4 128#usize
+  if not (i = 18#u64)
+  then Result.fail .panic
+  else
+    do
+    let (_, get_mut_back) ← HashMap.get_mut U64 hm4 1024#usize
+    let hm5 ← get_mut_back 56#u64
+    let i1 ← HashMap.get U64 hm5 1024#usize
+    if not (i1 = 56#u64)
     then Result.fail .panic
     else
       do
-        let hm4 ← HashMap.get_mut_back U64 hm3 1024#usize 56#u64
-        let i0 ← HashMap.get U64 hm4 1024#usize
-        if not (i0 = 56#u64)
+      let (x, hm6) ← HashMap.remove U64 hm5 1024#usize
+      match x with
+      | none => Result.fail .panic
+      | some x1 =>
+        if not (x1 = 56#u64)
         then Result.fail .panic
         else
           do
-            let x ← HashMap.remove U64 hm4 1024#usize
-            match x with
-            | none => Result.fail .panic
-            | some x0 =>
-              if not (x0 = 56#u64)
+          let i2 ← HashMap.get U64 hm6 0#usize
+          if not (i2 = 42#u64)
+          then Result.fail .panic
+          else
+            do
+            let i3 ← HashMap.get U64 hm6 128#usize
+            if not (i3 = 18#u64)
+            then Result.fail .panic
+            else
+              do
+              let i4 ← HashMap.get U64 hm6 1056#usize
+              if not (i4 = 256#u64)
               then Result.fail .panic
-              else
-                do
-                  let hm5 ← HashMap.remove_back U64 hm4 1024#usize
-                  let i1 ← HashMap.get U64 hm5 0#usize
-                  if not (i1 = 42#u64)
-                  then Result.fail .panic
-                  else
-                    do
-                      let i2 ← HashMap.get U64 hm5 128#usize
-                      if not (i2 = 18#u64)
-                      then Result.fail .panic
-                      else
-                        do
-                          let i3 ← HashMap.get U64 hm5 1056#usize
-                          if not (i3 = 256#u64)
-                          then Result.fail .panic
-                          else Result.ret ()
+              else Result.ret ()
 
 end hashmap
diff --git a/tests/lean/HashmapMain/Funs.lean b/tests/lean/HashmapMain/Funs.lean
index f87ad355..9bfb5070 100644
--- a/tests/lean/HashmapMain/Funs.lean
+++ b/tests/lean/HashmapMain/Funs.lean
@@ -7,12 +7,12 @@ open Primitives
 
 namespace hashmap_main
 
-/- [hashmap_main::hashmap::hash_key]: forward function
+/- [hashmap_main::hashmap::hash_key]:
    Source: 'src/hashmap.rs', lines 27:0-27:32 -/
 def hashmap.hash_key (k : Usize) : Result Usize :=
   Result.ret k
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: loop 0:
    Source: 'src/hashmap.rs', lines 50:4-56:5 -/
 divergent def hashmap.HashMap.allocate_slots_loop
   (T : Type) (slots : alloc.vec.Vec (hashmap.List T)) (n : Usize) :
@@ -21,12 +21,12 @@ divergent def hashmap.HashMap.allocate_slots_loop
   if n > 0#usize
   then
     do
-      let slots0 ← alloc.vec.Vec.push (hashmap.List T) slots hashmap.List.Nil
-      let n0 ← n - 1#usize
-      hashmap.HashMap.allocate_slots_loop T slots0 n0
+    let v ← alloc.vec.Vec.push (hashmap.List T) slots hashmap.List.Nil
+    let n1 ← n - 1#usize
+    hashmap.HashMap.allocate_slots_loop T v n1
   else Result.ret slots
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::allocate_slots]:
    Source: 'src/hashmap.rs', lines 50:4-50:76 -/
 def hashmap.HashMap.allocate_slots
   (T : Type) (slots : alloc.vec.Vec (hashmap.List T)) (n : Usize) :
@@ -34,7 +34,7 @@ def hashmap.HashMap.allocate_slots
   :=
   hashmap.HashMap.allocate_slots_loop T slots n
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new_with_capacity]:
    Source: 'src/hashmap.rs', lines 59:4-63:13 -/
 def hashmap.HashMap.new_with_capacity
   (T : Type) (capacity : Usize) (max_load_dividend : Usize)
@@ -42,136 +42,106 @@ def hashmap.HashMap.new_with_capacity
   Result (hashmap.HashMap T)
   :=
   do
-    let v := alloc.vec.Vec.new (hashmap.List T)
-    let slots ← hashmap.HashMap.allocate_slots T v capacity
-    let i ← capacity * max_load_dividend
-    let i0 ← i / max_load_divisor
-    Result.ret
-      {
-        num_entries := 0#usize,
-        max_load_factor := (max_load_dividend, max_load_divisor),
-        max_load := i0,
-        slots := slots
-      }
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]: forward function
+  let v := alloc.vec.Vec.new (hashmap.List T)
+  let slots ← hashmap.HashMap.allocate_slots T v capacity
+  let i ← capacity * max_load_dividend
+  let i1 ← i / max_load_divisor
+  Result.ret
+    {
+      num_entries := 0#usize,
+      max_load_factor := (max_load_dividend, max_load_divisor),
+      max_load := i1,
+      slots := slots
+    }
+
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::new]:
    Source: 'src/hashmap.rs', lines 75:4-75:24 -/
 def hashmap.HashMap.new (T : Type) : Result (hashmap.HashMap T) :=
   hashmap.HashMap.new_with_capacity T 32#usize 4#usize 5#usize
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: loop 0:
    Source: 'src/hashmap.rs', lines 80:4-88:5 -/
 divergent def hashmap.HashMap.clear_loop
   (T : Type) (slots : alloc.vec.Vec (hashmap.List T)) (i : Usize) :
   Result (alloc.vec.Vec (hashmap.List T))
   :=
-  let i0 := alloc.vec.Vec.len (hashmap.List T) slots
-  if i < i0
+  let i1 := alloc.vec.Vec.len (hashmap.List T) slots
+  if i < i1
   then
     do
-      let i1 ← i + 1#usize
-      let slots0 ←
-        alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) slots i
-          hashmap.List.Nil
-      hashmap.HashMap.clear_loop T slots0 i1
+    let (_, index_mut_back) ←
+      alloc.vec.Vec.index_mut (hashmap.List T) Usize
+        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) slots i
+    let i2 ← i + 1#usize
+    let slots1 ← index_mut_back hashmap.List.Nil
+    hashmap.HashMap.clear_loop T slots1 i2
   else Result.ret slots
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::clear]:
    Source: 'src/hashmap.rs', lines 80:4-80:27 -/
 def hashmap.HashMap.clear
   (T : Type) (self : hashmap.HashMap T) : Result (hashmap.HashMap T) :=
   do
-    let v ← hashmap.HashMap.clear_loop T self.slots 0#usize
-    Result.ret { self with num_entries := 0#usize, slots := v }
+  let back ← hashmap.HashMap.clear_loop T self.slots 0#usize
+  Result.ret { self with num_entries := 0#usize, slots := back }
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::len]:
    Source: 'src/hashmap.rs', lines 90:4-90:30 -/
 def hashmap.HashMap.len (T : Type) (self : hashmap.HashMap T) : Result Usize :=
   Result.ret self.num_entries
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 97:4-114:5 -/
 divergent def hashmap.HashMap.insert_in_list_loop
-  (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) : Result Bool :=
-  match ls with
-  | hashmap.List.Cons ckey cvalue tl =>
-    if ckey = key
-    then Result.ret false
-    else hashmap.HashMap.insert_in_list_loop T key value tl
-  | hashmap.List.Nil => Result.ret true
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: forward function
-   Source: 'src/hashmap.rs', lines 97:4-97:71 -/
-def hashmap.HashMap.insert_in_list
-  (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) : Result Bool :=
-  hashmap.HashMap.insert_in_list_loop T key value ls
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: loop 0: backward function 0
-   Source: 'src/hashmap.rs', lines 97:4-114:5 -/
-divergent def hashmap.HashMap.insert_in_list_loop_back
   (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) :
-  Result (hashmap.List T)
+  Result (Bool × (hashmap.List T))
   :=
   match ls with
   | hashmap.List.Cons ckey cvalue tl =>
     if ckey = key
-    then Result.ret (hashmap.List.Cons ckey value tl)
+    then Result.ret (false, hashmap.List.Cons ckey value tl)
     else
       do
-        let tl0 ← hashmap.HashMap.insert_in_list_loop_back T key value tl
-        Result.ret (hashmap.List.Cons ckey cvalue tl0)
+      let (b, back) ← hashmap.HashMap.insert_in_list_loop T key value tl
+      Result.ret (b, hashmap.List.Cons ckey cvalue back)
   | hashmap.List.Nil =>
     let l := hashmap.List.Nil
-    Result.ret (hashmap.List.Cons key value l)
+    Result.ret (true, hashmap.List.Cons key value l)
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: backward function 0
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]:
    Source: 'src/hashmap.rs', lines 97:4-97:71 -/
-def hashmap.HashMap.insert_in_list_back
+def hashmap.HashMap.insert_in_list
   (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) :
-  Result (hashmap.List T)
+  Result (Bool × (hashmap.List T))
   :=
-  hashmap.HashMap.insert_in_list_loop_back T key value ls
+  hashmap.HashMap.insert_in_list_loop T key value ls
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_no_resize]:
    Source: 'src/hashmap.rs', lines 117:4-117:54 -/
 def hashmap.HashMap.insert_no_resize
   (T : Type) (self : hashmap.HashMap T) (key : Usize) (value : T) :
   Result (hashmap.HashMap T)
   :=
   do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    let inserted ← hashmap.HashMap.insert_in_list T key value l
-    if inserted
-    then
-      do
-        let i0 ← self.num_entries + 1#usize
-        let l0 ← hashmap.HashMap.insert_in_list_back T key value l
-        let v ←
-          alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-            self.slots hash_mod l0
-        Result.ret { self with num_entries := i0, slots := v }
-    else
-      do
-        let l0 ← hashmap.HashMap.insert_in_list_back T key value l
-        let v ←
-          alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-            self.slots hash_mod l0
-        Result.ret { self with slots := v }
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+  let hash ← hashmap.hash_key key
+  let i := alloc.vec.Vec.len (hashmap.List T) self.slots
+  let hash_mod ← hash % i
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (hashmap.List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) self.slots
+      hash_mod
+  let (inserted, l1) ← hashmap.HashMap.insert_in_list T key value l
+  if inserted
+  then
+    do
+    let i1 ← self.num_entries + 1#usize
+    let v ← index_mut_back l1
+    Result.ret { self with num_entries := i1, slots := v }
+  else do
+       let v ← index_mut_back l1
+       Result.ret { self with slots := v }
+
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: loop 0:
    Source: 'src/hashmap.rs', lines 183:4-196:5 -/
 divergent def hashmap.HashMap.move_elements_from_list_loop
   (T : Type) (ntable : hashmap.HashMap T) (ls : hashmap.List T) :
@@ -180,12 +150,11 @@ divergent def hashmap.HashMap.move_elements_from_list_loop
   match ls with
   | hashmap.List.Cons k v tl =>
     do
-      let ntable0 ← hashmap.HashMap.insert_no_resize T ntable k v
-      hashmap.HashMap.move_elements_from_list_loop T ntable0 tl
+    let hm ← hashmap.HashMap.insert_no_resize T ntable k v
+    hashmap.HashMap.move_elements_from_list_loop T hm tl
   | hashmap.List.Nil => Result.ret ntable
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements_from_list]:
    Source: 'src/hashmap.rs', lines 183:4-183:72 -/
 def hashmap.HashMap.move_elements_from_list
   (T : Type) (ntable : hashmap.HashMap T) (ls : hashmap.List T) :
@@ -193,114 +162,111 @@ def hashmap.HashMap.move_elements_from_list
   :=
   hashmap.HashMap.move_elements_from_list_loop T ntable ls
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: loop 0:
    Source: 'src/hashmap.rs', lines 171:4-180:5 -/
 divergent def hashmap.HashMap.move_elements_loop
   (T : Type) (ntable : hashmap.HashMap T)
   (slots : alloc.vec.Vec (hashmap.List T)) (i : Usize) :
   Result ((hashmap.HashMap T) × (alloc.vec.Vec (hashmap.List T)))
   :=
-  let i0 := alloc.vec.Vec.len (hashmap.List T) slots
-  if i < i0
+  let i1 := alloc.vec.Vec.len (hashmap.List T) slots
+  if i < i1
   then
     do
-      let l ←
-        alloc.vec.Vec.index_mut (hashmap.List T) Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) slots i
-      let ls := core.mem.replace (hashmap.List T) l hashmap.List.Nil
-      let ntable0 ← hashmap.HashMap.move_elements_from_list T ntable ls
-      let i1 ← i + 1#usize
-      let l0 := core.mem.replace_back (hashmap.List T) l hashmap.List.Nil
-      let slots0 ←
-        alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) slots i
-          l0
-      hashmap.HashMap.move_elements_loop T ntable0 slots0 i1
+    let (l, index_mut_back) ←
+      alloc.vec.Vec.index_mut (hashmap.List T) Usize
+        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) slots i
+    let (ls, l1) := core.mem.replace (hashmap.List T) l hashmap.List.Nil
+    let hm ← hashmap.HashMap.move_elements_from_list T ntable ls
+    let i2 ← i + 1#usize
+    let slots1 ← index_mut_back l1
+    let back_'a ← hashmap.HashMap.move_elements_loop T hm slots1 i2
+    let (hm1, v) := back_'a
+    Result.ret (hm1, v)
   else Result.ret (ntable, slots)
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::move_elements]:
    Source: 'src/hashmap.rs', lines 171:4-171:95 -/
 def hashmap.HashMap.move_elements
   (T : Type) (ntable : hashmap.HashMap T)
   (slots : alloc.vec.Vec (hashmap.List T)) (i : Usize) :
   Result ((hashmap.HashMap T) × (alloc.vec.Vec (hashmap.List T)))
   :=
-  hashmap.HashMap.move_elements_loop T ntable slots i
+  do
+  let back_'a ← hashmap.HashMap.move_elements_loop T ntable slots i
+  let (hm, v) := back_'a
+  Result.ret (hm, v)
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::try_resize]:
    Source: 'src/hashmap.rs', lines 140:4-140:28 -/
 def hashmap.HashMap.try_resize
   (T : Type) (self : hashmap.HashMap T) : Result (hashmap.HashMap T) :=
   do
-    let max_usize ← Scalar.cast .Usize core_u32_max
-    let capacity := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let n1 ← max_usize / 2#usize
-    let (i, i0) := self.max_load_factor
-    let i1 ← n1 / i
-    if capacity <= i1
-    then
-      do
-        let i2 ← capacity * 2#usize
-        let ntable ← hashmap.HashMap.new_with_capacity T i2 i i0
-        let (ntable0, _) ←
-          hashmap.HashMap.move_elements T ntable self.slots 0#usize
-        Result.ret
-          {
-            ntable0
-              with
-              num_entries := self.num_entries, max_load_factor := (i, i0)
-          }
-    else Result.ret { self with max_load_factor := (i, i0) }
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+  let max_usize ← Scalar.cast .Usize core_u32_max
+  let capacity := alloc.vec.Vec.len (hashmap.List T) self.slots
+  let n1 ← max_usize / 2#usize
+  let (i, i1) := self.max_load_factor
+  let i2 ← n1 / i
+  if capacity <= i2
+  then
+    do
+    let i3 ← capacity * 2#usize
+    let ntable ← hashmap.HashMap.new_with_capacity T i3 i i1
+    let p ← hashmap.HashMap.move_elements T ntable self.slots 0#usize
+    let (ntable1, _) := p
+    Result.ret
+      {
+        ntable1
+          with
+          num_entries := self.num_entries, max_load_factor := (i, i1)
+      }
+  else Result.ret { self with max_load_factor := (i, i1) }
+
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert]:
    Source: 'src/hashmap.rs', lines 129:4-129:48 -/
 def hashmap.HashMap.insert
   (T : Type) (self : hashmap.HashMap T) (key : Usize) (value : T) :
   Result (hashmap.HashMap T)
   :=
   do
-    let self0 ← hashmap.HashMap.insert_no_resize T self key value
-    let i ← hashmap.HashMap.len T self0
-    if i > self0.max_load
-    then hashmap.HashMap.try_resize T self0
-    else Result.ret self0
+  let hm ← hashmap.HashMap.insert_no_resize T self key value
+  let i ← hashmap.HashMap.len T hm
+  if i > hm.max_load
+  then hashmap.HashMap.try_resize T hm
+  else Result.ret hm
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 206:4-219:5 -/
 divergent def hashmap.HashMap.contains_key_in_list_loop
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result Bool :=
   match ls with
-  | hashmap.List.Cons ckey t tl =>
+  | hashmap.List.Cons ckey _ tl =>
     if ckey = key
     then Result.ret true
     else hashmap.HashMap.contains_key_in_list_loop T key tl
   | hashmap.List.Nil => Result.ret false
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key_in_list]:
    Source: 'src/hashmap.rs', lines 206:4-206:68 -/
 def hashmap.HashMap.contains_key_in_list
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result Bool :=
   hashmap.HashMap.contains_key_in_list_loop T key ls
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::contains_key]:
    Source: 'src/hashmap.rs', lines 199:4-199:49 -/
 def hashmap.HashMap.contains_key
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result Bool :=
   do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    hashmap.HashMap.contains_key_in_list T key l
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0: forward function
+  let hash ← hashmap.hash_key key
+  let i := alloc.vec.Vec.len (hashmap.List T) self.slots
+  let hash_mod ← hash % i
+  let l ←
+    alloc.vec.Vec.index (hashmap.List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) self.slots
+      hash_mod
+  hashmap.HashMap.contains_key_in_list T key l
+
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 224:4-237:5 -/
 divergent def hashmap.HashMap.get_in_list_loop
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result T :=
@@ -311,259 +277,194 @@ divergent def hashmap.HashMap.get_in_list_loop
     else hashmap.HashMap.get_in_list_loop T key tl
   | hashmap.List.Nil => Result.fail .panic
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_in_list]:
    Source: 'src/hashmap.rs', lines 224:4-224:70 -/
 def hashmap.HashMap.get_in_list
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result T :=
   hashmap.HashMap.get_in_list_loop T key ls
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get]:
    Source: 'src/hashmap.rs', lines 239:4-239:55 -/
 def hashmap.HashMap.get
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    hashmap.HashMap.get_in_list T key l
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: forward function
+  let hash ← hashmap.hash_key key
+  let i := alloc.vec.Vec.len (hashmap.List T) self.slots
+  let hash_mod ← hash % i
+  let l ←
+    alloc.vec.Vec.index (hashmap.List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) self.slots
+      hash_mod
+  hashmap.HashMap.get_in_list T key l
+
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0:
    Source: 'src/hashmap.rs', lines 245:4-254:5 -/
 divergent def hashmap.HashMap.get_mut_in_list_loop
-  (T : Type) (ls : hashmap.List T) (key : Usize) : Result T :=
-  match ls with
-  | hashmap.List.Cons ckey cvalue tl =>
-    if ckey = key
-    then Result.ret cvalue
-    else hashmap.HashMap.get_mut_in_list_loop T tl key
-  | hashmap.List.Nil => Result.fail .panic
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: forward function
-   Source: 'src/hashmap.rs', lines 245:4-245:86 -/
-def hashmap.HashMap.get_mut_in_list
-  (T : Type) (ls : hashmap.List T) (key : Usize) : Result T :=
-  hashmap.HashMap.get_mut_in_list_loop T ls key
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: loop 0: backward function 0
-   Source: 'src/hashmap.rs', lines 245:4-254:5 -/
-divergent def hashmap.HashMap.get_mut_in_list_loop_back
-  (T : Type) (ls : hashmap.List T) (key : Usize) (ret : T) :
-  Result (hashmap.List T)
+  (T : Type) (ls : hashmap.List T) (key : Usize) :
+  Result (T × (T → Result (hashmap.List T)))
   :=
   match ls with
   | hashmap.List.Cons ckey cvalue tl =>
     if ckey = key
-    then Result.ret (hashmap.List.Cons ckey ret tl)
+    then
+      let back_'a := fun ret => Result.ret (hashmap.List.Cons ckey ret tl)
+      Result.ret (cvalue, back_'a)
     else
       do
-        let tl0 ← hashmap.HashMap.get_mut_in_list_loop_back T tl key ret
-        Result.ret (hashmap.List.Cons ckey cvalue tl0)
+      let (t, back_'a) ← hashmap.HashMap.get_mut_in_list_loop T tl key
+      let back_'a1 :=
+        fun ret =>
+          do
+          let tl1 ← back_'a ret
+          Result.ret (hashmap.List.Cons ckey cvalue tl1)
+      Result.ret (t, back_'a1)
   | hashmap.List.Nil => Result.fail .panic
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]: backward function 0
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut_in_list]:
    Source: 'src/hashmap.rs', lines 245:4-245:86 -/
-def hashmap.HashMap.get_mut_in_list_back
-  (T : Type) (ls : hashmap.List T) (key : Usize) (ret : T) :
-  Result (hashmap.List T)
+def hashmap.HashMap.get_mut_in_list
+  (T : Type) (ls : hashmap.List T) (key : Usize) :
+  Result (T × (T → Result (hashmap.List T)))
   :=
-  hashmap.HashMap.get_mut_in_list_loop_back T ls key ret
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: forward function
-   Source: 'src/hashmap.rs', lines 257:4-257:67 -/
-def hashmap.HashMap.get_mut
-  (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    hashmap.HashMap.get_mut_in_list T l key
+  let (t, back_'a) ← hashmap.HashMap.get_mut_in_list_loop T ls key
+  let back_'a1 := fun ret => back_'a ret
+  Result.ret (t, back_'a1)
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]: backward function 0
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]:
    Source: 'src/hashmap.rs', lines 257:4-257:67 -/
-def hashmap.HashMap.get_mut_back
-  (T : Type) (self : hashmap.HashMap T) (key : Usize) (ret : T) :
-  Result (hashmap.HashMap T)
+def hashmap.HashMap.get_mut
+  (T : Type) (self : hashmap.HashMap T) (key : Usize) :
+  Result (T × (T → Result (hashmap.HashMap T)))
   :=
   do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    let l0 ← hashmap.HashMap.get_mut_in_list_back T l key ret
-    let v ←
-      alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod l0
-    Result.ret { self with slots := v }
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: forward function
-   Source: 'src/hashmap.rs', lines 265:4-291:5 -/
-divergent def hashmap.HashMap.remove_from_list_loop
-  (T : Type) (key : Usize) (ls : hashmap.List T) : Result (Option T) :=
-  match ls with
-  | hashmap.List.Cons ckey t tl =>
-    if ckey = key
-    then
-      let mv_ls :=
-        core.mem.replace (hashmap.List T) (hashmap.List.Cons ckey t tl)
-          hashmap.List.Nil
-      match mv_ls with
-      | hashmap.List.Cons i cvalue tl0 => Result.ret (some cvalue)
-      | hashmap.List.Nil => Result.fail .panic
-    else hashmap.HashMap.remove_from_list_loop T key tl
-  | hashmap.List.Nil => Result.ret none
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: forward function
-   Source: 'src/hashmap.rs', lines 265:4-265:69 -/
-def hashmap.HashMap.remove_from_list
-  (T : Type) (key : Usize) (ls : hashmap.List T) : Result (Option T) :=
-  hashmap.HashMap.remove_from_list_loop T key ls
+  let hash ← hashmap.hash_key key
+  let i := alloc.vec.Vec.len (hashmap.List T) self.slots
+  let hash_mod ← hash % i
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (hashmap.List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) self.slots
+      hash_mod
+  let (t, get_mut_in_list_back) ← hashmap.HashMap.get_mut_in_list T l key
+  let back_'a :=
+    fun ret =>
+      do
+      let l1 ← get_mut_in_list_back ret
+      let v ← index_mut_back l1
+      Result.ret { self with slots := v }
+  Result.ret (t, back_'a)
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0: backward function 1
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: loop 0:
    Source: 'src/hashmap.rs', lines 265:4-291:5 -/
-divergent def hashmap.HashMap.remove_from_list_loop_back
-  (T : Type) (key : Usize) (ls : hashmap.List T) : Result (hashmap.List T) :=
+divergent def hashmap.HashMap.remove_from_list_loop
+  (T : Type) (key : Usize) (ls : hashmap.List T) :
+  Result ((Option T) × (hashmap.List T))
+  :=
   match ls with
   | hashmap.List.Cons ckey t tl =>
     if ckey = key
     then
-      let mv_ls :=
+      let (mv_ls, _) :=
         core.mem.replace (hashmap.List T) (hashmap.List.Cons ckey t tl)
           hashmap.List.Nil
       match mv_ls with
-      | hashmap.List.Cons i cvalue tl0 => Result.ret tl0
+      | hashmap.List.Cons _ cvalue tl1 => Result.ret (some cvalue, tl1)
       | hashmap.List.Nil => Result.fail .panic
     else
       do
-        let tl0 ← hashmap.HashMap.remove_from_list_loop_back T key tl
-        Result.ret (hashmap.List.Cons ckey t tl0)
-  | hashmap.List.Nil => Result.ret hashmap.List.Nil
+      let (o, back) ← hashmap.HashMap.remove_from_list_loop T key tl
+      Result.ret (o, hashmap.List.Cons ckey t back)
+  | hashmap.List.Nil => Result.ret (none, hashmap.List.Nil)
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]: backward function 1
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove_from_list]:
    Source: 'src/hashmap.rs', lines 265:4-265:69 -/
-def hashmap.HashMap.remove_from_list_back
-  (T : Type) (key : Usize) (ls : hashmap.List T) : Result (hashmap.List T) :=
-  hashmap.HashMap.remove_from_list_loop_back T key ls
+def hashmap.HashMap.remove_from_list
+  (T : Type) (key : Usize) (ls : hashmap.List T) :
+  Result ((Option T) × (hashmap.List T))
+  :=
+  hashmap.HashMap.remove_from_list_loop T key ls
 
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: forward function
+/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]:
    Source: 'src/hashmap.rs', lines 294:4-294:52 -/
 def hashmap.HashMap.remove
-  (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result (Option T) :=
-  do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    let x ← hashmap.HashMap.remove_from_list T key l
-    match x with
-    | none => Result.ret none
-    | some x0 => do
-                   let _ ← self.num_entries - 1#usize
-                   Result.ret (some x0)
-
-/- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::remove]: backward function 0
-   Source: 'src/hashmap.rs', lines 294:4-294:52 -/
-def hashmap.HashMap.remove_back
   (T : Type) (self : hashmap.HashMap T) (key : Usize) :
-  Result (hashmap.HashMap T)
+  Result ((Option T) × (hashmap.HashMap T))
   :=
   do
-    let hash ← hashmap.hash_key key
-    let i := alloc.vec.Vec.len (hashmap.List T) self.slots
-    let hash_mod ← hash % i
-    let l ←
-      alloc.vec.Vec.index_mut (hashmap.List T) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-        self.slots hash_mod
-    let x ← hashmap.HashMap.remove_from_list T key l
-    match x with
-    | none =>
-      do
-        let l0 ← hashmap.HashMap.remove_from_list_back T key l
-        let v ←
-          alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-            self.slots hash_mod l0
-        Result.ret { self with slots := v }
-    | some x0 =>
-      do
-        let i0 ← self.num_entries - 1#usize
-        let l0 ← hashmap.HashMap.remove_from_list_back T key l
-        let v ←
-          alloc.vec.Vec.index_mut_back (hashmap.List T) Usize
-            (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T))
-            self.slots hash_mod l0
-        Result.ret { self with num_entries := i0, slots := v }
-
-/- [hashmap_main::hashmap::test1]: forward function
+  let hash ← hashmap.hash_key key
+  let i := alloc.vec.Vec.len (hashmap.List T) self.slots
+  let hash_mod ← hash % i
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (hashmap.List T) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (hashmap.List T)) self.slots
+      hash_mod
+  let (x, l1) ← hashmap.HashMap.remove_from_list T key l
+  match x with
+  | none =>
+    do
+    let v ← index_mut_back l1
+    Result.ret (none, { self with slots := v })
+  | some x1 =>
+    do
+    let i1 ← self.num_entries - 1#usize
+    let v ← index_mut_back l1
+    Result.ret (some x1, { self with num_entries := i1, slots := v })
+
+/- [hashmap_main::hashmap::test1]:
    Source: 'src/hashmap.rs', lines 315:0-315:10 -/
 def hashmap.test1 : Result Unit :=
   do
-    let hm ← hashmap.HashMap.new U64
-    let hm0 ← hashmap.HashMap.insert U64 hm 0#usize 42#u64
-    let hm1 ← hashmap.HashMap.insert U64 hm0 128#usize 18#u64
-    let hm2 ← hashmap.HashMap.insert U64 hm1 1024#usize 138#u64
-    let hm3 ← hashmap.HashMap.insert U64 hm2 1056#usize 256#u64
-    let i ← hashmap.HashMap.get U64 hm3 128#usize
-    if not (i = 18#u64)
+  let hm ← hashmap.HashMap.new U64
+  let hm1 ← hashmap.HashMap.insert U64 hm 0#usize 42#u64
+  let hm2 ← hashmap.HashMap.insert U64 hm1 128#usize 18#u64
+  let hm3 ← hashmap.HashMap.insert U64 hm2 1024#usize 138#u64
+  let hm4 ← hashmap.HashMap.insert U64 hm3 1056#usize 256#u64
+  let i ← hashmap.HashMap.get U64 hm4 128#usize
+  if not (i = 18#u64)
+  then Result.fail .panic
+  else
+    do
+    let (_, get_mut_back) ← hashmap.HashMap.get_mut U64 hm4 1024#usize
+    let hm5 ← get_mut_back 56#u64
+    let i1 ← hashmap.HashMap.get U64 hm5 1024#usize
+    if not (i1 = 56#u64)
     then Result.fail .panic
     else
       do
-        let hm4 ← hashmap.HashMap.get_mut_back U64 hm3 1024#usize 56#u64
-        let i0 ← hashmap.HashMap.get U64 hm4 1024#usize
-        if not (i0 = 56#u64)
+      let (x, hm6) ← hashmap.HashMap.remove U64 hm5 1024#usize
+      match x with
+      | none => Result.fail .panic
+      | some x1 =>
+        if not (x1 = 56#u64)
         then Result.fail .panic
         else
           do
-            let x ← hashmap.HashMap.remove U64 hm4 1024#usize
-            match x with
-            | none => Result.fail .panic
-            | some x0 =>
-              if not (x0 = 56#u64)
+          let i2 ← hashmap.HashMap.get U64 hm6 0#usize
+          if not (i2 = 42#u64)
+          then Result.fail .panic
+          else
+            do
+            let i3 ← hashmap.HashMap.get U64 hm6 128#usize
+            if not (i3 = 18#u64)
+            then Result.fail .panic
+            else
+              do
+              let i4 ← hashmap.HashMap.get U64 hm6 1056#usize
+              if not (i4 = 256#u64)
               then Result.fail .panic
-              else
-                do
-                  let hm5 ← hashmap.HashMap.remove_back U64 hm4 1024#usize
-                  let i1 ← hashmap.HashMap.get U64 hm5 0#usize
-                  if not (i1 = 42#u64)
-                  then Result.fail .panic
-                  else
-                    do
-                      let i2 ← hashmap.HashMap.get U64 hm5 128#usize
-                      if not (i2 = 18#u64)
-                      then Result.fail .panic
-                      else
-                        do
-                          let i3 ← hashmap.HashMap.get U64 hm5 1056#usize
-                          if not (i3 = 256#u64)
-                          then Result.fail .panic
-                          else Result.ret ()
-
-/- [hashmap_main::insert_on_disk]: forward function
+              else Result.ret ()
+
+/- [hashmap_main::insert_on_disk]:
    Source: 'src/hashmap_main.rs', lines 7:0-7:43 -/
 def insert_on_disk
   (key : Usize) (value : U64) (st : State) : Result (State × Unit) :=
   do
-    let (st0, hm) ← hashmap_utils.deserialize st
-    let hm0 ← hashmap.HashMap.insert U64 hm key value
-    let (st1, _) ← hashmap_utils.serialize hm0 st0
-    Result.ret (st1, ())
+  let (st1, hm) ← hashmap_utils.deserialize st
+  let hm1 ← hashmap.HashMap.insert U64 hm key value
+  let (st2, _) ← hashmap_utils.serialize hm1 st1
+  Result.ret (st2, ())
 
-/- [hashmap_main::main]: forward function
+/- [hashmap_main::main]:
    Source: 'src/hashmap_main.rs', lines 16:0-16:13 -/
 def main : Result Unit :=
   Result.ret ()
diff --git a/tests/lean/HashmapMain/FunsExternal_Template.lean b/tests/lean/HashmapMain/FunsExternal_Template.lean
index 02ca5b0e..c09edbd2 100644
--- a/tests/lean/HashmapMain/FunsExternal_Template.lean
+++ b/tests/lean/HashmapMain/FunsExternal_Template.lean
@@ -6,12 +6,12 @@ import HashmapMain.Types
 open Primitives
 open hashmap_main
 
-/- [hashmap_main::hashmap_utils::deserialize]: forward function
+/- [hashmap_main::hashmap_utils::deserialize]:
    Source: 'src/hashmap_utils.rs', lines 10:0-10:43 -/
 axiom hashmap_utils.deserialize
   : State → Result (State × (hashmap.HashMap U64))
 
-/- [hashmap_main::hashmap_utils::serialize]: forward function
+/- [hashmap_main::hashmap_utils::serialize]:
    Source: 'src/hashmap_utils.rs', lines 5:0-5:42 -/
 axiom hashmap_utils.serialize
   : hashmap.HashMap U64 → State → Result (State × Unit)
diff --git a/tests/lean/Loops.lean b/tests/lean/Loops.lean
index 08aa08a5..805ecabc 100644
--- a/tests/lean/Loops.lean
+++ b/tests/lean/Loops.lean
@@ -5,73 +5,72 @@ open Primitives
 
 namespace loops
 
-/- [loops::sum]: loop 0: forward function
+/- [loops::sum]: loop 0:
    Source: 'src/loops.rs', lines 4:0-14:1 -/
 divergent def sum_loop (max : U32) (i : U32) (s : U32) : Result U32 :=
   if i < max
   then do
-         let s0 ← s + i
-         let i0 ← i + 1#u32
-         sum_loop max i0 s0
+       let s1 ← s + i
+       let i1 ← i + 1#u32
+       sum_loop max i1 s1
   else s * 2#u32
 
-/- [loops::sum]: forward function
+/- [loops::sum]:
    Source: 'src/loops.rs', lines 4:0-4:27 -/
 def sum (max : U32) : Result U32 :=
   sum_loop max 0#u32 0#u32
 
-/- [loops::sum_with_mut_borrows]: loop 0: forward function
+/- [loops::sum_with_mut_borrows]: loop 0:
    Source: 'src/loops.rs', lines 19:0-31:1 -/
 divergent def sum_with_mut_borrows_loop
   (max : U32) (mi : U32) (ms : U32) : Result U32 :=
   if mi < max
   then
     do
-      let ms0 ← ms + mi
-      let mi0 ← mi + 1#u32
-      sum_with_mut_borrows_loop max mi0 ms0
+    let ms1 ← ms + mi
+    let mi1 ← mi + 1#u32
+    sum_with_mut_borrows_loop max mi1 ms1
   else ms * 2#u32
 
-/- [loops::sum_with_mut_borrows]: forward function
+/- [loops::sum_with_mut_borrows]:
    Source: 'src/loops.rs', lines 19:0-19:44 -/
 def sum_with_mut_borrows (max : U32) : Result U32 :=
   sum_with_mut_borrows_loop max 0#u32 0#u32
 
-/- [loops::sum_with_shared_borrows]: loop 0: forward function
+/- [loops::sum_with_shared_borrows]: loop 0:
    Source: 'src/loops.rs', lines 34:0-48:1 -/
 divergent def sum_with_shared_borrows_loop
   (max : U32) (i : U32) (s : U32) : Result U32 :=
   if i < max
   then
     do
-      let i0 ← i + 1#u32
-      let s0 ← s + i0
-      sum_with_shared_borrows_loop max i0 s0
+    let i1 ← i + 1#u32
+    let s1 ← s + i1
+    sum_with_shared_borrows_loop max i1 s1
   else s * 2#u32
 
-/- [loops::sum_with_shared_borrows]: forward function
+/- [loops::sum_with_shared_borrows]:
    Source: 'src/loops.rs', lines 34:0-34:47 -/
 def sum_with_shared_borrows (max : U32) : Result U32 :=
   sum_with_shared_borrows_loop max 0#u32 0#u32
 
-/- [loops::clear]: loop 0: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [loops::clear]: loop 0:
    Source: 'src/loops.rs', lines 52:0-58:1 -/
 divergent def clear_loop
   (v : alloc.vec.Vec U32) (i : Usize) : Result (alloc.vec.Vec U32) :=
-  let i0 := alloc.vec.Vec.len U32 v
-  if i < i0
+  let i1 := alloc.vec.Vec.len U32 v
+  if i < i1
   then
     do
-      let i1 ← i + 1#usize
-      let v0 ←
-        alloc.vec.Vec.index_mut_back U32 Usize
-          (core.slice.index.SliceIndexUsizeSliceTInst U32) v i 0#u32
-      clear_loop v0 i1
+    let (_, index_mut_back) ←
+      alloc.vec.Vec.index_mut U32 Usize
+        (core.slice.index.SliceIndexUsizeSliceTInst U32) v i
+    let i2 ← i + 1#usize
+    let v1 ← index_mut_back 0#u32
+    clear_loop v1 i2
   else Result.ret v
 
-/- [loops::clear]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [loops::clear]:
    Source: 'src/loops.rs', lines 52:0-52:30 -/
 def clear (v : alloc.vec.Vec U32) : Result (alloc.vec.Vec U32) :=
   clear_loop v 0#usize
@@ -82,7 +81,7 @@ inductive List (T : Type) :=
 | Cons : T → List T → List T
 | Nil : List T
 
-/- [loops::list_mem]: loop 0: forward function
+/- [loops::list_mem]: loop 0:
    Source: 'src/loops.rs', lines 66:0-75:1 -/
 divergent def list_mem_loop (x : U32) (ls : List U32) : Result Bool :=
   match ls with
@@ -91,51 +90,42 @@ divergent def list_mem_loop (x : U32) (ls : List U32) : Result Bool :=
                       else list_mem_loop x tl
   | List.Nil => Result.ret false
 
-/- [loops::list_mem]: forward function
+/- [loops::list_mem]:
    Source: 'src/loops.rs', lines 66:0-66:52 -/
 def list_mem (x : U32) (ls : List U32) : Result Bool :=
   list_mem_loop x ls
 
-/- [loops::list_nth_mut_loop]: loop 0: forward function
+/- [loops::list_nth_mut_loop]: loop 0:
    Source: 'src/loops.rs', lines 78:0-88:1 -/
 divergent def list_nth_mut_loop_loop
-  (T : Type) (ls : List T) (i : U32) : Result T :=
-  match ls with
-  | List.Cons x tl =>
-    if i = 0#u32
-    then Result.ret x
-    else do
-           let i0 ← i - 1#u32
-           list_nth_mut_loop_loop T tl i0
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_loop]: forward function
-   Source: 'src/loops.rs', lines 78:0-78:71 -/
-def list_nth_mut_loop (T : Type) (ls : List T) (i : U32) : Result T :=
-  list_nth_mut_loop_loop T ls i
-
-/- [loops::list_nth_mut_loop]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 78:0-88:1 -/
-divergent def list_nth_mut_loop_loop_back
-  (T : Type) (ls : List T) (i : U32) (ret : T) : Result (List T) :=
+  (T : Type) (ls : List T) (i : U32) : Result (T × (T → Result (List T))) :=
   match ls with
   | List.Cons x tl =>
     if i = 0#u32
-    then Result.ret (List.Cons ret tl)
+    then
+      let back := fun ret => Result.ret (List.Cons ret tl)
+      Result.ret (x, back)
     else
       do
-        let i0 ← i - 1#u32
-        let tl0 ← list_nth_mut_loop_loop_back T tl i0 ret
-        Result.ret (List.Cons x tl0)
+      let i1 ← i - 1#u32
+      let (t, back) ← list_nth_mut_loop_loop T tl i1
+      let back1 :=
+        fun ret => do
+                   let tl1 ← back ret
+                   Result.ret (List.Cons x tl1)
+      Result.ret (t, back1)
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_mut_loop]: backward function 0
+/- [loops::list_nth_mut_loop]:
    Source: 'src/loops.rs', lines 78:0-78:71 -/
-def list_nth_mut_loop_back
-  (T : Type) (ls : List T) (i : U32) (ret : T) : Result (List T) :=
-  list_nth_mut_loop_loop_back T ls i ret
+def list_nth_mut_loop
+  (T : Type) (ls : List T) (i : U32) : Result (T × (T → Result (List T))) :=
+  do
+  let (t, back) ← list_nth_mut_loop_loop T ls i
+  let back1 := fun ret => back ret
+  Result.ret (t, back1)
 
-/- [loops::list_nth_shared_loop]: loop 0: forward function
+/- [loops::list_nth_shared_loop]: loop 0:
    Source: 'src/loops.rs', lines 91:0-101:1 -/
 divergent def list_nth_shared_loop_loop
   (T : Type) (ls : List T) (i : U32) : Result T :=
@@ -144,64 +134,54 @@ divergent def list_nth_shared_loop_loop
     if i = 0#u32
     then Result.ret x
     else do
-           let i0 ← i - 1#u32
-           list_nth_shared_loop_loop T tl i0
+         let i1 ← i - 1#u32
+         list_nth_shared_loop_loop T tl i1
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_shared_loop]: forward function
+/- [loops::list_nth_shared_loop]:
    Source: 'src/loops.rs', lines 91:0-91:66 -/
 def list_nth_shared_loop (T : Type) (ls : List T) (i : U32) : Result T :=
   list_nth_shared_loop_loop T ls i
 
-/- [loops::get_elem_mut]: loop 0: forward function
+/- [loops::get_elem_mut]: loop 0:
    Source: 'src/loops.rs', lines 103:0-117:1 -/
-divergent def get_elem_mut_loop (x : Usize) (ls : List Usize) : Result Usize :=
-  match ls with
-  | List.Cons y tl => if y = x
-                      then Result.ret y
-                      else get_elem_mut_loop x tl
-  | List.Nil => Result.fail .panic
-
-/- [loops::get_elem_mut]: forward function
-   Source: 'src/loops.rs', lines 103:0-103:73 -/
-def get_elem_mut
-  (slots : alloc.vec.Vec (List Usize)) (x : Usize) : Result Usize :=
-  do
-    let l ←
-      alloc.vec.Vec.index_mut (List Usize) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List Usize)) slots 0#usize
-    get_elem_mut_loop x l
-
-/- [loops::get_elem_mut]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 103:0-117:1 -/
-divergent def get_elem_mut_loop_back
-  (x : Usize) (ls : List Usize) (ret : Usize) : Result (List Usize) :=
+divergent def get_elem_mut_loop
+  (x : Usize) (ls : List Usize) :
+  Result (Usize × (Usize → Result (List Usize)))
+  :=
   match ls with
   | List.Cons y tl =>
     if y = x
-    then Result.ret (List.Cons ret tl)
+    then
+      let back := fun ret => Result.ret (List.Cons ret tl)
+      Result.ret (y, back)
     else
       do
-        let tl0 ← get_elem_mut_loop_back x tl ret
-        Result.ret (List.Cons y tl0)
+      let (i, back) ← get_elem_mut_loop x tl
+      let back1 :=
+        fun ret => do
+                   let tl1 ← back ret
+                   Result.ret (List.Cons y tl1)
+      Result.ret (i, back1)
   | List.Nil => Result.fail .panic
 
-/- [loops::get_elem_mut]: backward function 0
+/- [loops::get_elem_mut]:
    Source: 'src/loops.rs', lines 103:0-103:73 -/
-def get_elem_mut_back
-  (slots : alloc.vec.Vec (List Usize)) (x : Usize) (ret : Usize) :
-  Result (alloc.vec.Vec (List Usize))
+def get_elem_mut
+  (slots : alloc.vec.Vec (List Usize)) (x : Usize) :
+  Result (Usize × (Usize → Result (alloc.vec.Vec (List Usize))))
   :=
   do
-    let l ←
-      alloc.vec.Vec.index_mut (List Usize) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List Usize)) slots 0#usize
-    let l0 ← get_elem_mut_loop_back x l ret
-    alloc.vec.Vec.index_mut_back (List Usize) Usize
+  let (l, index_mut_back) ←
+    alloc.vec.Vec.index_mut (List Usize) Usize
       (core.slice.index.SliceIndexUsizeSliceTInst (List Usize)) slots 0#usize
-      l0
+  let (i, back) ← get_elem_mut_loop x l
+  let back1 := fun ret => do
+                          let l1 ← back ret
+                          index_mut_back l1
+  Result.ret (i, back1)
 
-/- [loops::get_elem_shared]: loop 0: forward function
+/- [loops::get_elem_shared]: loop 0:
    Source: 'src/loops.rs', lines 119:0-133:1 -/
 divergent def get_elem_shared_loop
   (x : Usize) (ls : List Usize) : Result Usize :=
@@ -211,76 +191,64 @@ divergent def get_elem_shared_loop
                       else get_elem_shared_loop x tl
   | List.Nil => Result.fail .panic
 
-/- [loops::get_elem_shared]: forward function
+/- [loops::get_elem_shared]:
    Source: 'src/loops.rs', lines 119:0-119:68 -/
 def get_elem_shared
   (slots : alloc.vec.Vec (List Usize)) (x : Usize) : Result Usize :=
   do
-    let l ←
-      alloc.vec.Vec.index (List Usize) Usize
-        (core.slice.index.SliceIndexUsizeSliceTInst (List Usize)) slots 0#usize
-    get_elem_shared_loop x l
-
-/- [loops::id_mut]: forward function
-   Source: 'src/loops.rs', lines 135:0-135:50 -/
-def id_mut (T : Type) (ls : List T) : Result (List T) :=
-  Result.ret ls
+  let l ←
+    alloc.vec.Vec.index (List Usize) Usize
+      (core.slice.index.SliceIndexUsizeSliceTInst (List Usize)) slots 0#usize
+  get_elem_shared_loop x l
 
-/- [loops::id_mut]: backward function 0
+/- [loops::id_mut]:
    Source: 'src/loops.rs', lines 135:0-135:50 -/
-def id_mut_back (T : Type) (ls : List T) (ret : List T) : Result (List T) :=
-  Result.ret ret
+def id_mut
+  (T : Type) (ls : List T) :
+  Result ((List T) × (List T → Result (List T)))
+  :=
+  let back := fun ret => Result.ret ret
+  Result.ret (ls, back)
 
-/- [loops::id_shared]: forward function
+/- [loops::id_shared]:
    Source: 'src/loops.rs', lines 139:0-139:45 -/
 def id_shared (T : Type) (ls : List T) : Result (List T) :=
   Result.ret ls
 
-/- [loops::list_nth_mut_loop_with_id]: loop 0: forward function
+/- [loops::list_nth_mut_loop_with_id]: loop 0:
    Source: 'src/loops.rs', lines 144:0-155:1 -/
 divergent def list_nth_mut_loop_with_id_loop
-  (T : Type) (i : U32) (ls : List T) : Result T :=
+  (T : Type) (i : U32) (ls : List T) : Result (T × (T → Result (List T))) :=
   match ls with
   | List.Cons x tl =>
     if i = 0#u32
-    then Result.ret x
-    else do
-           let i0 ← i - 1#u32
-           list_nth_mut_loop_with_id_loop T i0 tl
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_loop_with_id]: forward function
-   Source: 'src/loops.rs', lines 144:0-144:75 -/
-def list_nth_mut_loop_with_id (T : Type) (ls : List T) (i : U32) : Result T :=
-  do
-    let ls0 ← id_mut T ls
-    list_nth_mut_loop_with_id_loop T i ls0
-
-/- [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 144:0-155:1 -/
-divergent def list_nth_mut_loop_with_id_loop_back
-  (T : Type) (i : U32) (ls : List T) (ret : T) : Result (List T) :=
-  match ls with
-  | List.Cons x tl =>
-    if i = 0#u32
-    then Result.ret (List.Cons ret tl)
+    then
+      let back := fun ret => Result.ret (List.Cons ret tl)
+      Result.ret (x, back)
     else
       do
-        let i0 ← i - 1#u32
-        let tl0 ← list_nth_mut_loop_with_id_loop_back T i0 tl ret
-        Result.ret (List.Cons x tl0)
+      let i1 ← i - 1#u32
+      let (t, back) ← list_nth_mut_loop_with_id_loop T i1 tl
+      let back1 :=
+        fun ret => do
+                   let tl1 ← back ret
+                   Result.ret (List.Cons x tl1)
+      Result.ret (t, back1)
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_mut_loop_with_id]: backward function 0
+/- [loops::list_nth_mut_loop_with_id]:
    Source: 'src/loops.rs', lines 144:0-144:75 -/
-def list_nth_mut_loop_with_id_back
-  (T : Type) (ls : List T) (i : U32) (ret : T) : Result (List T) :=
+def list_nth_mut_loop_with_id
+  (T : Type) (ls : List T) (i : U32) : Result (T × (T → Result (List T))) :=
   do
-    let ls0 ← id_mut T ls
-    let l ← list_nth_mut_loop_with_id_loop_back T i ls0 ret
-    id_mut_back T ls l
-
-/- [loops::list_nth_shared_loop_with_id]: loop 0: forward function
+  let (ls1, id_mut_back) ← id_mut T ls
+  let (t, back) ← list_nth_mut_loop_with_id_loop T i ls1
+  let back1 := fun ret => do
+                          let l ← back ret
+                          id_mut_back l
+  Result.ret (t, back1)
+
+/- [loops::list_nth_shared_loop_with_id]: loop 0:
    Source: 'src/loops.rs', lines 158:0-169:1 -/
 divergent def list_nth_shared_loop_with_id_loop
   (T : Type) (i : U32) (ls : List T) : Result T :=
@@ -289,97 +257,62 @@ divergent def list_nth_shared_loop_with_id_loop
     if i = 0#u32
     then Result.ret x
     else do
-           let i0 ← i - 1#u32
-           list_nth_shared_loop_with_id_loop T i0 tl
+         let i1 ← i - 1#u32
+         list_nth_shared_loop_with_id_loop T i1 tl
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_shared_loop_with_id]: forward function
+/- [loops::list_nth_shared_loop_with_id]:
    Source: 'src/loops.rs', lines 158:0-158:70 -/
 def list_nth_shared_loop_with_id
   (T : Type) (ls : List T) (i : U32) : Result T :=
   do
-    let ls0 ← id_shared T ls
-    list_nth_shared_loop_with_id_loop T i ls0
+  let ls1 ← id_shared T ls
+  list_nth_shared_loop_with_id_loop T i ls1
 
-/- [loops::list_nth_mut_loop_pair]: loop 0: forward function
+/- [loops::list_nth_mut_loop_pair]: loop 0:
    Source: 'src/loops.rs', lines 174:0-195:1 -/
 divergent def list_nth_mut_loop_pair_loop
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (x0, x1)
-      else do
-             let i0 ← i - 1#u32
-             list_nth_mut_loop_pair_loop T tl0 tl1 i0
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_loop_pair]: forward function
-   Source: 'src/loops.rs', lines 174:0-178:27 -/
-def list_nth_mut_loop_pair
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_loop_pair_loop T ls0 ls1 i
-
-/- [loops::list_nth_mut_loop_pair]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 174:0-195:1 -/
-divergent def list_nth_mut_loop_pair_loop_back'a
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)) × (T → Result (List T)))
   :=
   match ls0 with
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
       if i = 0#u32
-      then Result.ret (List.Cons ret tl0)
+      then
+        let back_'a := fun ret => Result.ret (List.Cons ret tl0)
+        let back_'b := fun ret => Result.ret (List.Cons ret tl1)
+        Result.ret ((x0, x1), back_'a, back_'b)
       else
         do
-          let i0 ← i - 1#u32
-          let tl00 ← list_nth_mut_loop_pair_loop_back'a T tl0 tl1 i0 ret
-          Result.ret (List.Cons x0 tl00)
+        let i1 ← i - 1#u32
+        let (p, back_'a, back_'b) ← list_nth_mut_loop_pair_loop T tl0 tl1 i1
+        let back_'a1 :=
+          fun ret => do
+                     let tl01 ← back_'a ret
+                     Result.ret (List.Cons x0 tl01)
+        let back_'b1 :=
+          fun ret => do
+                     let tl11 ← back_'b ret
+                     Result.ret (List.Cons x1 tl11)
+        Result.ret (p, back_'a1, back_'b1)
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_mut_loop_pair]: backward function 0
+/- [loops::list_nth_mut_loop_pair]:
    Source: 'src/loops.rs', lines 174:0-178:27 -/
-def list_nth_mut_loop_pair_back'a
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
-  :=
-  list_nth_mut_loop_pair_loop_back'a T ls0 ls1 i ret
-
-/- [loops::list_nth_mut_loop_pair]: loop 0: backward function 1
-   Source: 'src/loops.rs', lines 174:0-195:1 -/
-divergent def list_nth_mut_loop_pair_loop_back'b
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
-  :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (List.Cons ret tl1)
-      else
-        do
-          let i0 ← i - 1#u32
-          let tl10 ← list_nth_mut_loop_pair_loop_back'b T tl0 tl1 i0 ret
-          Result.ret (List.Cons x1 tl10)
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_loop_pair]: backward function 1
-   Source: 'src/loops.rs', lines 174:0-178:27 -/
-def list_nth_mut_loop_pair_back'b
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+def list_nth_mut_loop_pair
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)) × (T → Result (List T)))
   :=
-  list_nth_mut_loop_pair_loop_back'b T ls0 ls1 i ret
+  do
+  let (p, back_'a, back_'b) ← list_nth_mut_loop_pair_loop T ls0 ls1 i
+  let back_'a1 := fun ret => back_'a ret
+  let back_'b1 := fun ret => back_'b ret
+  Result.ret (p, back_'a1, back_'b1)
 
-/- [loops::list_nth_shared_loop_pair]: loop 0: forward function
+/- [loops::list_nth_shared_loop_pair]: loop 0:
    Source: 'src/loops.rs', lines 198:0-219:1 -/
 divergent def list_nth_shared_loop_pair_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
@@ -390,71 +323,59 @@ divergent def list_nth_shared_loop_pair_loop
       if i = 0#u32
       then Result.ret (x0, x1)
       else do
-             let i0 ← i - 1#u32
-             list_nth_shared_loop_pair_loop T tl0 tl1 i0
+           let i1 ← i - 1#u32
+           list_nth_shared_loop_pair_loop T tl0 tl1 i1
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_shared_loop_pair]: forward function
+/- [loops::list_nth_shared_loop_pair]:
    Source: 'src/loops.rs', lines 198:0-202:19 -/
 def list_nth_shared_loop_pair
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   list_nth_shared_loop_pair_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function
+/- [loops::list_nth_mut_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 223:0-238:1 -/
 divergent def list_nth_mut_loop_pair_merge_loop
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (x0, x1)
-      else
-        do
-          let i0 ← i - 1#u32
-          list_nth_mut_loop_pair_merge_loop T tl0 tl1 i0
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_loop_pair_merge]: forward function
-   Source: 'src/loops.rs', lines 223:0-227:27 -/
-def list_nth_mut_loop_pair_merge
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_loop_pair_merge_loop T ls0 ls1 i
-
-/- [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 223:0-238:1 -/
-divergent def list_nth_mut_loop_pair_merge_loop_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : (T × T)) :
-  Result ((List T) × (List T))
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × ((T × T) → Result ((List T) × (List T))))
   :=
   match ls0 with
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
       if i = 0#u32
-      then let (t, t0) := ret
-           Result.ret (List.Cons t tl0, List.Cons t0 tl1)
+      then
+        let back_'a :=
+          fun ret =>
+            let (t, t1) := ret
+            Result.ret (List.Cons t tl0, List.Cons t1 tl1)
+        Result.ret ((x0, x1), back_'a)
       else
         do
-          let i0 ← i - 1#u32
-          let (tl00, tl10) ←
-            list_nth_mut_loop_pair_merge_loop_back T tl0 tl1 i0 ret
-          Result.ret (List.Cons x0 tl00, List.Cons x1 tl10)
+        let i1 ← i - 1#u32
+        let (p, back_'a) ← list_nth_mut_loop_pair_merge_loop T tl0 tl1 i1
+        let back_'a1 :=
+          fun ret =>
+            do
+            let (tl01, tl11) ← back_'a ret
+            Result.ret (List.Cons x0 tl01, List.Cons x1 tl11)
+        Result.ret (p, back_'a1)
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_mut_loop_pair_merge]: backward function 0
+/- [loops::list_nth_mut_loop_pair_merge]:
    Source: 'src/loops.rs', lines 223:0-227:27 -/
-def list_nth_mut_loop_pair_merge_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : (T × T)) :
-  Result ((List T) × (List T))
+def list_nth_mut_loop_pair_merge
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × ((T × T) → Result ((List T) × (List T))))
   :=
-  list_nth_mut_loop_pair_merge_loop_back T ls0 ls1 i ret
+  do
+  let (p, back_'a) ← list_nth_mut_loop_pair_merge_loop T ls0 ls1 i
+  let back_'a1 := fun ret => back_'a ret
+  Result.ret (p, back_'a1)
 
-/- [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function
+/- [loops::list_nth_shared_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 241:0-256:1 -/
 divergent def list_nth_shared_loop_pair_merge_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
@@ -466,221 +387,165 @@ divergent def list_nth_shared_loop_pair_merge_loop
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - 1#u32
-          list_nth_shared_loop_pair_merge_loop T tl0 tl1 i0
+        let i1 ← i - 1#u32
+        list_nth_shared_loop_pair_merge_loop T tl0 tl1 i1
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_shared_loop_pair_merge]: forward function
+/- [loops::list_nth_shared_loop_pair_merge]:
    Source: 'src/loops.rs', lines 241:0-245:19 -/
 def list_nth_shared_loop_pair_merge
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   list_nth_shared_loop_pair_merge_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function
+/- [loops::list_nth_mut_shared_loop_pair]: loop 0:
    Source: 'src/loops.rs', lines 259:0-274:1 -/
 divergent def list_nth_mut_shared_loop_pair_loop
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (x0, x1)
-      else
-        do
-          let i0 ← i - 1#u32
-          list_nth_mut_shared_loop_pair_loop T tl0 tl1 i0
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_shared_loop_pair]: forward function
-   Source: 'src/loops.rs', lines 259:0-263:23 -/
-def list_nth_mut_shared_loop_pair
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_shared_loop_pair_loop T ls0 ls1 i
-
-/- [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 259:0-274:1 -/
-divergent def list_nth_mut_shared_loop_pair_loop_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
   match ls0 with
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
       if i = 0#u32
-      then Result.ret (List.Cons ret tl0)
+      then
+        let back_'a := fun ret => Result.ret (List.Cons ret tl0)
+        Result.ret ((x0, x1), back_'a)
       else
         do
-          let i0 ← i - 1#u32
-          let tl00 ← list_nth_mut_shared_loop_pair_loop_back T tl0 tl1 i0 ret
-          Result.ret (List.Cons x0 tl00)
+        let i1 ← i - 1#u32
+        let (p, back_'a) ← list_nth_mut_shared_loop_pair_loop T tl0 tl1 i1
+        let back_'a1 :=
+          fun ret => do
+                     let tl01 ← back_'a ret
+                     Result.ret (List.Cons x0 tl01)
+        Result.ret (p, back_'a1)
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_mut_shared_loop_pair]: backward function 0
+/- [loops::list_nth_mut_shared_loop_pair]:
    Source: 'src/loops.rs', lines 259:0-263:23 -/
-def list_nth_mut_shared_loop_pair_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+def list_nth_mut_shared_loop_pair
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
-  list_nth_mut_shared_loop_pair_loop_back T ls0 ls1 i ret
+  do
+  let (p, back_'a) ← list_nth_mut_shared_loop_pair_loop T ls0 ls1 i
+  let back_'a1 := fun ret => back_'a ret
+  Result.ret (p, back_'a1)
 
-/- [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function
+/- [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 278:0-293:1 -/
 divergent def list_nth_mut_shared_loop_pair_merge_loop
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (x0, x1)
-      else
-        do
-          let i0 ← i - 1#u32
-          list_nth_mut_shared_loop_pair_merge_loop T tl0 tl1 i0
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_mut_shared_loop_pair_merge]: forward function
-   Source: 'src/loops.rs', lines 278:0-282:23 -/
-def list_nth_mut_shared_loop_pair_merge
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_shared_loop_pair_merge_loop T ls0 ls1 i
-
-/- [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 278:0-293:1 -/
-divergent def list_nth_mut_shared_loop_pair_merge_loop_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
   match ls0 with
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
       if i = 0#u32
-      then Result.ret (List.Cons ret tl0)
+      then
+        let back_'a := fun ret => Result.ret (List.Cons ret tl0)
+        Result.ret ((x0, x1), back_'a)
       else
         do
-          let i0 ← i - 1#u32
-          let tl00 ←
-            list_nth_mut_shared_loop_pair_merge_loop_back T tl0 tl1 i0 ret
-          Result.ret (List.Cons x0 tl00)
+        let i1 ← i - 1#u32
+        let (p, back_'a) ←
+          list_nth_mut_shared_loop_pair_merge_loop T tl0 tl1 i1
+        let back_'a1 :=
+          fun ret => do
+                     let tl01 ← back_'a ret
+                     Result.ret (List.Cons x0 tl01)
+        Result.ret (p, back_'a1)
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0
+/- [loops::list_nth_mut_shared_loop_pair_merge]:
    Source: 'src/loops.rs', lines 278:0-282:23 -/
-def list_nth_mut_shared_loop_pair_merge_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+def list_nth_mut_shared_loop_pair_merge
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
-  list_nth_mut_shared_loop_pair_merge_loop_back T ls0 ls1 i ret
+  do
+  let (p, back_'a) ← list_nth_mut_shared_loop_pair_merge_loop T ls0 ls1 i
+  let back_'a1 := fun ret => back_'a ret
+  Result.ret (p, back_'a1)
 
-/- [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function
+/- [loops::list_nth_shared_mut_loop_pair]: loop 0:
    Source: 'src/loops.rs', lines 297:0-312:1 -/
 divergent def list_nth_shared_mut_loop_pair_loop
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (x0, x1)
-      else
-        do
-          let i0 ← i - 1#u32
-          list_nth_shared_mut_loop_pair_loop T tl0 tl1 i0
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_shared_mut_loop_pair]: forward function
-   Source: 'src/loops.rs', lines 297:0-301:23 -/
-def list_nth_shared_mut_loop_pair
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_shared_mut_loop_pair_loop T ls0 ls1 i
-
-/- [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1
-   Source: 'src/loops.rs', lines 297:0-312:1 -/
-divergent def list_nth_shared_mut_loop_pair_loop_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
   match ls0 with
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
       if i = 0#u32
-      then Result.ret (List.Cons ret tl1)
+      then
+        let back_'b := fun ret => Result.ret (List.Cons ret tl1)
+        Result.ret ((x0, x1), back_'b)
       else
         do
-          let i0 ← i - 1#u32
-          let tl10 ← list_nth_shared_mut_loop_pair_loop_back T tl0 tl1 i0 ret
-          Result.ret (List.Cons x1 tl10)
+        let i1 ← i - 1#u32
+        let (p, back_'b) ← list_nth_shared_mut_loop_pair_loop T tl0 tl1 i1
+        let back_'b1 :=
+          fun ret => do
+                     let tl11 ← back_'b ret
+                     Result.ret (List.Cons x1 tl11)
+        Result.ret (p, back_'b1)
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_shared_mut_loop_pair]: backward function 1
+/- [loops::list_nth_shared_mut_loop_pair]:
    Source: 'src/loops.rs', lines 297:0-301:23 -/
-def list_nth_shared_mut_loop_pair_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+def list_nth_shared_mut_loop_pair
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
-  list_nth_shared_mut_loop_pair_loop_back T ls0 ls1 i ret
+  do
+  let (p, back_'b) ← list_nth_shared_mut_loop_pair_loop T ls0 ls1 i
+  let back_'b1 := fun ret => back_'b ret
+  Result.ret (p, back_'b1)
 
-/- [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function
+/- [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 316:0-331:1 -/
 divergent def list_nth_shared_mut_loop_pair_merge_loop
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  match ls0 with
-  | List.Cons x0 tl0 =>
-    match ls1 with
-    | List.Cons x1 tl1 =>
-      if i = 0#u32
-      then Result.ret (x0, x1)
-      else
-        do
-          let i0 ← i - 1#u32
-          list_nth_shared_mut_loop_pair_merge_loop T tl0 tl1 i0
-    | List.Nil => Result.fail .panic
-  | List.Nil => Result.fail .panic
-
-/- [loops::list_nth_shared_mut_loop_pair_merge]: forward function
-   Source: 'src/loops.rs', lines 316:0-320:23 -/
-def list_nth_shared_mut_loop_pair_merge
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_shared_mut_loop_pair_merge_loop T ls0 ls1 i
-
-/- [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0
-   Source: 'src/loops.rs', lines 316:0-331:1 -/
-divergent def list_nth_shared_mut_loop_pair_merge_loop_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
   match ls0 with
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
       if i = 0#u32
-      then Result.ret (List.Cons ret tl1)
+      then
+        let back_'a := fun ret => Result.ret (List.Cons ret tl1)
+        Result.ret ((x0, x1), back_'a)
       else
         do
-          let i0 ← i - 1#u32
-          let tl10 ←
-            list_nth_shared_mut_loop_pair_merge_loop_back T tl0 tl1 i0 ret
-          Result.ret (List.Cons x1 tl10)
+        let i1 ← i - 1#u32
+        let (p, back_'a) ←
+          list_nth_shared_mut_loop_pair_merge_loop T tl0 tl1 i1
+        let back_'a1 :=
+          fun ret => do
+                     let tl11 ← back_'a ret
+                     Result.ret (List.Cons x1 tl11)
+        Result.ret (p, back_'a1)
     | List.Nil => Result.fail .panic
   | List.Nil => Result.fail .panic
 
-/- [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0
+/- [loops::list_nth_shared_mut_loop_pair_merge]:
    Source: 'src/loops.rs', lines 316:0-320:23 -/
-def list_nth_shared_mut_loop_pair_merge_back
-  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret : T) :
-  Result (List T)
+def list_nth_shared_mut_loop_pair_merge
+  (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) :
+  Result ((T × T) × (T → Result (List T)))
   :=
-  list_nth_shared_mut_loop_pair_merge_loop_back T ls0 ls1 i ret
+  do
+  let (p, back_'a) ← list_nth_shared_mut_loop_pair_merge_loop T ls0 ls1 i
+  let back_'a1 := fun ret => back_'a ret
+  Result.ret (p, back_'a1)
 
 end loops
diff --git a/tests/lean/Paper.lean b/tests/lean/Paper.lean
index 08386bb7..015fec84 100644
--- a/tests/lean/Paper.lean
+++ b/tests/lean/Paper.lean
@@ -5,55 +5,51 @@ open Primitives
 
 namespace paper
 
-/- [paper::ref_incr]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [paper::ref_incr]:
    Source: 'src/paper.rs', lines 4:0-4:28 -/
 def ref_incr (x : I32) : Result I32 :=
   x + 1#i32
 
-/- [paper::test_incr]: forward function
+/- [paper::test_incr]:
    Source: 'src/paper.rs', lines 8:0-8:18 -/
 def test_incr : Result Unit :=
   do
-    let x ← ref_incr 0#i32
-    if not (x = 1#i32)
-    then Result.fail .panic
-    else Result.ret ()
+  let i ← ref_incr 0#i32
+  if not (i = 1#i32)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [paper::test_incr] -/
 #assert (test_incr == Result.ret ())
 
-/- [paper::choose]: forward function
-   Source: 'src/paper.rs', lines 15:0-15:70 -/
-def choose (T : Type) (b : Bool) (x : T) (y : T) : Result T :=
-  if b
-  then Result.ret x
-  else Result.ret y
-
-/- [paper::choose]: backward function 0
+/- [paper::choose]:
    Source: 'src/paper.rs', lines 15:0-15:70 -/
-def choose_back
-  (T : Type) (b : Bool) (x : T) (y : T) (ret : T) : Result (T × T) :=
+def choose
+  (T : Type) (b : Bool) (x : T) (y : T) :
+  Result (T × (T → Result (T × T)))
+  :=
   if b
-  then Result.ret (ret, y)
-  else Result.ret (x, ret)
+  then let back_'a := fun ret => Result.ret (ret, y)
+       Result.ret (x, back_'a)
+  else let back_'a := fun ret => Result.ret (x, ret)
+       Result.ret (y, back_'a)
 
-/- [paper::test_choose]: forward function
+/- [paper::test_choose]:
    Source: 'src/paper.rs', lines 23:0-23:20 -/
 def test_choose : Result Unit :=
   do
-    let z ← choose I32 true 0#i32 0#i32
-    let z0 ← z + 1#i32
-    if not (z0 = 1#i32)
+  let (z, choose_back) ← choose I32 true 0#i32 0#i32
+  let z1 ← z + 1#i32
+  if not (z1 = 1#i32)
+  then Result.fail .panic
+  else
+    do
+    let (x, y) ← choose_back z1
+    if not (x = 1#i32)
     then Result.fail .panic
-    else
-      do
-        let (x, y) ← choose_back I32 true 0#i32 0#i32 z0
-        if not (x = 1#i32)
-        then Result.fail .panic
-        else if not (y = 0#i32)
-             then Result.fail .panic
-             else Result.ret ()
+    else if not (y = 0#i32)
+         then Result.fail .panic
+         else Result.ret ()
 
 /- Unit test for [paper::test_choose] -/
 #assert (test_choose == Result.ret ())
@@ -64,68 +60,63 @@ inductive List (T : Type) :=
 | Cons : T → List T → List T
 | Nil : List T
 
-/- [paper::list_nth_mut]: forward function
+/- [paper::list_nth_mut]:
    Source: 'src/paper.rs', lines 42:0-42:67 -/
-divergent def list_nth_mut (T : Type) (l : List T) (i : U32) : Result T :=
+divergent def list_nth_mut
+  (T : Type) (l : List T) (i : U32) : Result (T × (T → Result (List T))) :=
   match l with
   | List.Cons x tl =>
     if i = 0#u32
-    then Result.ret x
-    else do
-           let i0 ← i - 1#u32
-           list_nth_mut T tl i0
-  | List.Nil => Result.fail .panic
-
-/- [paper::list_nth_mut]: backward function 0
-   Source: 'src/paper.rs', lines 42:0-42:67 -/
-divergent def list_nth_mut_back
-  (T : Type) (l : List T) (i : U32) (ret : T) : Result (List T) :=
-  match l with
-  | List.Cons x tl =>
-    if i = 0#u32
-    then Result.ret (List.Cons ret tl)
+    then
+      let back_'a := fun ret => Result.ret (List.Cons ret tl)
+      Result.ret (x, back_'a)
     else
       do
-        let i0 ← i - 1#u32
-        let tl0 ← list_nth_mut_back T tl i0 ret
-        Result.ret (List.Cons x tl0)
+      let i1 ← i - 1#u32
+      let (t, list_nth_mut_back) ← list_nth_mut T tl i1
+      let back_'a :=
+        fun ret =>
+          do
+          let tl1 ← list_nth_mut_back ret
+          Result.ret (List.Cons x tl1)
+      Result.ret (t, back_'a)
   | List.Nil => Result.fail .panic
 
-/- [paper::sum]: forward function
+/- [paper::sum]:
    Source: 'src/paper.rs', lines 57:0-57:32 -/
 divergent def sum (l : List I32) : Result I32 :=
   match l with
   | List.Cons x tl => do
-                        let i ← sum tl
-                        x + i
+                      let i ← sum tl
+                      x + i
   | List.Nil => Result.ret 0#i32
 
-/- [paper::test_nth]: forward function
+/- [paper::test_nth]:
    Source: 'src/paper.rs', lines 68:0-68:17 -/
 def test_nth : Result Unit :=
   do
-    let l := List.Nil
-    let l0 := List.Cons 3#i32 l
-    let l1 := List.Cons 2#i32 l0
-    let x ← list_nth_mut I32 (List.Cons 1#i32 l1) 2#u32
-    let x0 ← x + 1#i32
-    let l2 ← list_nth_mut_back I32 (List.Cons 1#i32 l1) 2#u32 x0
-    let i ← sum l2
-    if not (i = 7#i32)
-    then Result.fail .panic
-    else Result.ret ()
+  let l := List.Nil
+  let l1 := List.Cons 3#i32 l
+  let l2 := List.Cons 2#i32 l1
+  let (x, list_nth_mut_back) ← list_nth_mut I32 (List.Cons 1#i32 l2) 2#u32
+  let x1 ← x + 1#i32
+  let l3 ← list_nth_mut_back x1
+  let i ← sum l3
+  if not (i = 7#i32)
+  then Result.fail .panic
+  else Result.ret ()
 
 /- Unit test for [paper::test_nth] -/
 #assert (test_nth == Result.ret ())
 
-/- [paper::call_choose]: forward function
+/- [paper::call_choose]:
    Source: 'src/paper.rs', lines 76:0-76:44 -/
 def call_choose (p : (U32 × U32)) : Result U32 :=
   do
-    let (px, py) := p
-    let pz ← choose U32 true px py
-    let pz0 ← pz + 1#u32
-    let (px0, _) ← choose_back U32 true px py pz0
-    Result.ret px0
+  let (px, py) := p
+  let (pz, choose_back) ← choose U32 true px py
+  let pz1 ← pz + 1#u32
+  let (px1, _) ← choose_back pz1
+  Result.ret px1
 
 end paper
diff --git a/tests/lean/PoloniusList.lean b/tests/lean/PoloniusList.lean
index 37f0dffb..a485adbe 100644
--- a/tests/lean/PoloniusList.lean
+++ b/tests/lean/PoloniusList.lean
@@ -11,28 +11,29 @@ inductive List (T : Type) :=
 | Cons : T → List T → List T
 | Nil : List T
 
-/- [polonius_list::get_list_at_x]: forward function
+/- [polonius_list::get_list_at_x]:
    Source: 'src/polonius_list.rs', lines 13:0-13:76 -/
-divergent def get_list_at_x (ls : List U32) (x : U32) : Result (List U32) :=
+divergent def get_list_at_x
+  (ls : List U32) (x : U32) :
+  Result ((List U32) × (List U32 → Result (List U32)))
+  :=
   match ls with
   | List.Cons hd tl =>
     if hd = x
-    then Result.ret (List.Cons hd tl)
-    else get_list_at_x tl x
-  | List.Nil => Result.ret List.Nil
-
-/- [polonius_list::get_list_at_x]: backward function 0
-   Source: 'src/polonius_list.rs', lines 13:0-13:76 -/
-divergent def get_list_at_x_back
-  (ls : List U32) (x : U32) (ret : List U32) : Result (List U32) :=
-  match ls with
-  | List.Cons hd tl =>
-    if hd = x
-    then Result.ret ret
+    then
+      let back_'a := fun ret => Result.ret ret
+      Result.ret (List.Cons hd tl, back_'a)
     else
       do
-        let tl0 ← get_list_at_x_back tl x ret
-        Result.ret (List.Cons hd tl0)
-  | List.Nil => Result.ret ret
+      let (l, get_list_at_x_back) ← get_list_at_x tl x
+      let back_'a :=
+        fun ret =>
+          do
+          let tl1 ← get_list_at_x_back ret
+          Result.ret (List.Cons hd tl1)
+      Result.ret (l, back_'a)
+  | List.Nil =>
+    let back_'a := fun ret => Result.ret ret
+    Result.ret (List.Nil, back_'a)
 
 end polonius_list
diff --git a/tests/lean/Traits.lean b/tests/lean/Traits.lean
index 17118203..63d07d85 100644
--- a/tests/lean/Traits.lean
+++ b/tests/lean/Traits.lean
@@ -10,7 +10,7 @@ namespace traits
 structure BoolTrait (Self : Type) where
   get_bool : Self → Result Bool
 
-/- [traits::{bool}::get_bool]: forward function
+/- [traits::{bool}::get_bool]:
    Source: 'src/traits.rs', lines 12:4-12:30 -/
 def Bool.get_bool (self : Bool) : Result Bool :=
   Result.ret self
@@ -21,27 +21,27 @@ def traits.BoolTraitBoolInst : BoolTrait Bool := {
   get_bool := Bool.get_bool
 }
 
-/- [traits::BoolTrait::ret_true]: forward function
+/- [traits::BoolTrait::ret_true]:
    Source: 'src/traits.rs', lines 6:4-6:30 -/
 def BoolTrait.ret_true
   {Self : Type} (self_clause : BoolTrait Self) (self : Self) : Result Bool :=
   Result.ret true
 
-/- [traits::test_bool_trait_bool]: forward function
+/- [traits::test_bool_trait_bool]:
    Source: 'src/traits.rs', lines 17:0-17:44 -/
 def test_bool_trait_bool (x : Bool) : Result Bool :=
   do
-    let b ← Bool.get_bool x
-    if b
-    then BoolTrait.ret_true traits.BoolTraitBoolInst x
-    else Result.ret false
+  let b ← Bool.get_bool x
+  if b
+  then BoolTrait.ret_true traits.BoolTraitBoolInst x
+  else Result.ret false
 
-/- [traits::{core::option::Option<T>#1}::get_bool]: forward function
+/- [traits::{core::option::Option<T>#1}::get_bool]:
    Source: 'src/traits.rs', lines 23:4-23:30 -/
 def Option.get_bool (T : Type) (self : Option T) : Result Bool :=
   match self with
   | none => Result.ret false
-  | some t => Result.ret true
+  | some _ => Result.ret true
 
 /- Trait implementation: [traits::{core::option::Option<T>#1}]
    Source: 'src/traits.rs', lines 22:0-22:31 -/
@@ -50,16 +50,16 @@ def traits.BoolTraitcoreoptionOptionTInst (T : Type) : BoolTrait (Option T)
   get_bool := Option.get_bool T
 }
 
-/- [traits::test_bool_trait_option]: forward function
+/- [traits::test_bool_trait_option]:
    Source: 'src/traits.rs', lines 31:0-31:54 -/
 def test_bool_trait_option (T : Type) (x : Option T) : Result Bool :=
   do
-    let b ← Option.get_bool T x
-    if b
-    then BoolTrait.ret_true (traits.BoolTraitcoreoptionOptionTInst T) x
-    else Result.ret false
+  let b ← Option.get_bool T x
+  if b
+  then BoolTrait.ret_true (traits.BoolTraitcoreoptionOptionTInst T) x
+  else Result.ret false
 
-/- [traits::test_bool_trait]: forward function
+/- [traits::test_bool_trait]:
    Source: 'src/traits.rs', lines 35:0-35:50 -/
 def test_bool_trait
   (T : Type) (BoolTraitTInst : BoolTrait T) (x : T) : Result Bool :=
@@ -70,7 +70,7 @@ def test_bool_trait
 structure ToU64 (Self : Type) where
   to_u64 : Self → Result U64
 
-/- [traits::{u64#2}::to_u64]: forward function
+/- [traits::{u64#2}::to_u64]:
    Source: 'src/traits.rs', lines 44:4-44:26 -/
 def U64.to_u64 (self : U64) : Result U64 :=
   Result.ret self
@@ -81,15 +81,15 @@ def traits.ToU64U64Inst : ToU64 U64 := {
   to_u64 := U64.to_u64
 }
 
-/- [traits::{(A, A)#3}::to_u64]: forward function
+/- [traits::{(A, A)#3}::to_u64]:
    Source: 'src/traits.rs', lines 50:4-50:26 -/
 def Pair.to_u64
   (A : Type) (ToU64AInst : ToU64 A) (self : (A × A)) : Result U64 :=
   do
-    let (t, t0) := self
-    let i ← ToU64AInst.to_u64 t
-    let i0 ← ToU64AInst.to_u64 t0
-    i + i0
+  let (t, t1) := self
+  let i ← ToU64AInst.to_u64 t
+  let i1 ← ToU64AInst.to_u64 t1
+  i + i1
 
 /- Trait implementation: [traits::{(A, A)#3}]
    Source: 'src/traits.rs', lines 49:0-49:31 -/
@@ -98,18 +98,18 @@ def traits.ToU64TupleAAInst (A : Type) (ToU64AInst : ToU64 A) : ToU64 (A × A)
   to_u64 := Pair.to_u64 A ToU64AInst
 }
 
-/- [traits::f]: forward function
+/- [traits::f]:
    Source: 'src/traits.rs', lines 55:0-55:36 -/
 def f (T : Type) (ToU64TInst : ToU64 T) (x : (T × T)) : Result U64 :=
   Pair.to_u64 T ToU64TInst x
 
-/- [traits::g]: forward function
+/- [traits::g]:
    Source: 'src/traits.rs', lines 59:0-61:18 -/
 def g
   (T : Type) (ToU64TupleTTInst : ToU64 (T × T)) (x : (T × T)) : Result U64 :=
   ToU64TupleTTInst.to_u64 x
 
-/- [traits::h0]: forward function
+/- [traits::h0]:
    Source: 'src/traits.rs', lines 66:0-66:24 -/
 def h0 (x : U64) : Result U64 :=
   U64.to_u64 x
@@ -119,7 +119,7 @@ def h0 (x : U64) : Result U64 :=
 structure Wrapper (T : Type) where
   x : T
 
-/- [traits::{traits::Wrapper<T>#4}::to_u64]: forward function
+/- [traits::{traits::Wrapper<T>#4}::to_u64]:
    Source: 'src/traits.rs', lines 75:4-75:26 -/
 def Wrapper.to_u64
   (T : Type) (ToU64TInst : ToU64 T) (self : Wrapper T) : Result U64 :=
@@ -132,12 +132,12 @@ def traits.ToU64traitsWrapperTInst (T : Type) (ToU64TInst : ToU64 T) : ToU64
   to_u64 := Wrapper.to_u64 T ToU64TInst
 }
 
-/- [traits::h1]: forward function
+/- [traits::h1]:
    Source: 'src/traits.rs', lines 80:0-80:33 -/
 def h1 (x : Wrapper U64) : Result U64 :=
   Wrapper.to_u64 U64 traits.ToU64U64Inst x
 
-/- [traits::h2]: forward function
+/- [traits::h2]:
    Source: 'src/traits.rs', lines 84:0-84:41 -/
 def h2 (T : Type) (ToU64TInst : ToU64 T) (x : Wrapper T) : Result U64 :=
   Wrapper.to_u64 T ToU64TInst x
@@ -147,7 +147,7 @@ def h2 (T : Type) (ToU64TInst : ToU64 T) (x : Wrapper T) : Result U64 :=
 structure ToType (Self T : Type) where
   to_type : Self → Result T
 
-/- [traits::{u64#5}::to_type]: forward function
+/- [traits::{u64#5}::to_type]:
    Source: 'src/traits.rs', lines 93:4-93:28 -/
 def U64.to_type (self : U64) : Result Bool :=
   Result.ret (self > 0#u64)
@@ -164,7 +164,7 @@ structure OfType (Self : Type) where
   of_type : forall (T : Type) (ToTypeTSelfInst : ToType T Self), T → Result
     Self
 
-/- [traits::h3]: forward function
+/- [traits::h3]:
    Source: 'src/traits.rs', lines 104:0-104:50 -/
 def h3
   (T1 T2 : Type) (OfTypeT1Inst : OfType T1) (ToTypeT2T1Inst : ToType T2 T1)
@@ -179,7 +179,7 @@ structure OfTypeBis (Self T : Type) where
   ToTypeTSelfInst : ToType T Self
   of_type : T → Result Self
 
-/- [traits::h4]: forward function
+/- [traits::h4]:
    Source: 'src/traits.rs', lines 118:0-118:57 -/
 def h4
   (T1 T2 : Type) (OfTypeBisT1T2Inst : OfTypeBis T1 T2) (ToTypeT2T1Inst : ToType
@@ -201,7 +201,7 @@ def h4
 structure TestType.test.TestTrait (Self : Type) where
   test : Self → Result Bool
 
-/- [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]: forward function
+/- [traits::{traits::TestType<T>#6}::test::{traits::{traits::TestType<T>#6}::test::TestType1}::test]:
    Source: 'src/traits.rs', lines 139:12-139:34 -/
 def TestType.test.TestType1.test
   (self : TestType.test.TestType1) : Result Bool :=
@@ -214,23 +214,23 @@ def traits.TestType.test.TestTraittraitstraitsTestTypeTtestTestType1Inst :
   test := TestType.test.TestType1.test
 }
 
-/- [traits::{traits::TestType<T>#6}::test]: forward function
+/- [traits::{traits::TestType<T>#6}::test]:
    Source: 'src/traits.rs', lines 126:4-126:36 -/
 def TestType.test
   (T : Type) (ToU64TInst : ToU64 T) (self : TestType T) (x : T) :
   Result Bool
   :=
   do
-    let x0 ← ToU64TInst.to_u64 x
-    if x0 > 0#u64
-    then TestType.test.TestType1.test 0#u64
-    else Result.ret false
+  let x1 ← ToU64TInst.to_u64 x
+  if x1 > 0#u64
+  then TestType.test.TestType1.test 0#u64
+  else Result.ret false
 
 /- [traits::BoolWrapper]
    Source: 'src/traits.rs', lines 150:0-150:22 -/
 @[reducible] def BoolWrapper := Bool
 
-/- [traits::{traits::BoolWrapper#7}::to_type]: forward function
+/- [traits::{traits::BoolWrapper#7}::to_type]:
    Source: 'src/traits.rs', lines 156:4-156:25 -/
 def BoolWrapper.to_type
   (T : Type) (ToTypeBoolTInst : ToType Bool T) (self : BoolWrapper) :
@@ -266,8 +266,7 @@ structure WithConstTy (Self : Type) (LEN : Usize) where
 def bool_len1_body : Result Usize := Result.ret 12#usize
 def bool_len1_c : Usize := eval_global bool_len1_body (by simp)
 
-/- [traits::{bool#8}::f]: merged forward/backward function
-   (there is a single backward function, and the forward function returns ())
+/- [traits::{bool#8}::f]:
    Source: 'src/traits.rs', lines 180:4-180:39 -/
 def Bool.f (i : U64) (a : Array U8 32#usize) : Result U64 :=
   Result.ret i
@@ -283,7 +282,7 @@ def traits.WithConstTyBool32Inst : WithConstTy Bool 32#usize := {
   f := Bool.f
 }
 
-/- [traits::use_with_const_ty1]: forward function
+/- [traits::use_with_const_ty1]:
    Source: 'src/traits.rs', lines 183:0-183:75 -/
 def use_with_const_ty1
   (H : Type) (LEN : Usize) (WithConstTyHLENInst : WithConstTy H LEN) :
@@ -292,7 +291,7 @@ def use_with_const_ty1
   let i := WithConstTyHLENInst.LEN1
   Result.ret i
 
-/- [traits::use_with_const_ty2]: forward function
+/- [traits::use_with_const_ty2]:
    Source: 'src/traits.rs', lines 187:0-187:73 -/
 def use_with_const_ty2
   (H : Type) (LEN : Usize) (WithConstTyHLENInst : WithConstTy H LEN)
@@ -301,7 +300,7 @@ def use_with_const_ty2
   :=
   Result.ret ()
 
-/- [traits::use_with_const_ty3]: forward function
+/- [traits::use_with_const_ty3]:
    Source: 'src/traits.rs', lines 189:0-189:80 -/
 def use_with_const_ty3
   (H : Type) (LEN : Usize) (WithConstTyHLENInst : WithConstTy H LEN)
@@ -310,12 +309,12 @@ def use_with_const_ty3
   :=
   WithConstTyHLENInst.W_clause_0.to_u64 x
 
-/- [traits::test_where1]: forward function
+/- [traits::test_where1]:
    Source: 'src/traits.rs', lines 193:0-193:40 -/
 def test_where1 (T : Type) (_x : T) : Result Unit :=
   Result.ret ()
 
-/- [traits::test_where2]: forward function
+/- [traits::test_where2]:
    Source: 'src/traits.rs', lines 194:0-194:57 -/
 def test_where2
   (T : Type) (WithConstTyT32Inst : WithConstTy T 32#usize) (_x : U32) :
@@ -340,22 +339,30 @@ structure ChildTrait (Self : Type) where
   ParentTrait0SelfInst : ParentTrait0 Self
   ParentTrait1SelfInst : ParentTrait1 Self
 
-/- [traits::test_child_trait1]: forward function
-   Source: 'src/traits.rs', lines 209:0-209:56 -/
+/- [traits::test_parent_trait0]:
+   Source: 'src/traits.rs', lines 208:0-208:57 -/
+def test_parent_trait0
+  (T : Type) (ParentTrait0TInst : ParentTrait0 T) (x : T) :
+  Result ParentTrait0TInst.W
+  :=
+  ParentTrait0TInst.get_w x
+
+/- [traits::test_child_trait1]:
+   Source: 'src/traits.rs', lines 213:0-213:56 -/
 def test_child_trait1
   (T : Type) (ChildTraitTInst : ChildTrait T) (x : T) : Result String :=
   ChildTraitTInst.ParentTrait0SelfInst.get_name x
 
-/- [traits::test_child_trait2]: forward function
-   Source: 'src/traits.rs', lines 213:0-213:54 -/
+/- [traits::test_child_trait2]:
+   Source: 'src/traits.rs', lines 217:0-217:54 -/
 def test_child_trait2
   (T : Type) (ChildTraitTInst : ChildTrait T) (x : T) :
   Result ChildTraitTInst.ParentTrait0SelfInst.W
   :=
   ChildTraitTInst.ParentTrait0SelfInst.get_w x
 
-/- [traits::order1]: forward function
-   Source: 'src/traits.rs', lines 219:0-219:59 -/
+/- [traits::order1]:
+   Source: 'src/traits.rs', lines 223:0-223:59 -/
 def order1
   (T U : Type) (ParentTrait0TInst : ParentTrait0 T) (ParentTrait0UInst :
   ParentTrait0 U) :
@@ -364,28 +371,28 @@ def order1
   Result.ret ()
 
 /- Trait declaration: [traits::ChildTrait1]
-   Source: 'src/traits.rs', lines 222:0-222:35 -/
+   Source: 'src/traits.rs', lines 226:0-226:35 -/
 structure ChildTrait1 (Self : Type) where
   ParentTrait1SelfInst : ParentTrait1 Self
 
 /- Trait implementation: [traits::{usize#9}]
-   Source: 'src/traits.rs', lines 224:0-224:27 -/
+   Source: 'src/traits.rs', lines 228:0-228:27 -/
 def traits.ParentTrait1UsizeInst : ParentTrait1 Usize := {
 }
 
 /- Trait implementation: [traits::{usize#10}]
-   Source: 'src/traits.rs', lines 225:0-225:26 -/
+   Source: 'src/traits.rs', lines 229:0-229:26 -/
 def traits.ChildTrait1UsizeInst : ChildTrait1 Usize := {
   ParentTrait1SelfInst := traits.ParentTrait1UsizeInst
 }
 
 /- Trait declaration: [traits::Iterator]
-   Source: 'src/traits.rs', lines 229:0-229:18 -/
+   Source: 'src/traits.rs', lines 233:0-233:18 -/
 structure Iterator (Self : Type) where
   Item : Type
 
 /- Trait declaration: [traits::IntoIterator]
-   Source: 'src/traits.rs', lines 233:0-233:22 -/
+   Source: 'src/traits.rs', lines 237:0-237:22 -/
 structure IntoIterator (Self : Type) where
   Item : Type
   IntoIter : Type
@@ -393,76 +400,86 @@ structure IntoIterator (Self : Type) where
   into_iter : Self → Result IntoIter
 
 /- Trait declaration: [traits::FromResidual]
-   Source: 'src/traits.rs', lines 250:0-250:21 -/
+   Source: 'src/traits.rs', lines 254:0-254:21 -/
 structure FromResidual (Self T : Type) where
 
 /- Trait declaration: [traits::Try]
-   Source: 'src/traits.rs', lines 246:0-246:48 -/
+   Source: 'src/traits.rs', lines 250:0-250:48 -/
 structure Try (Self : Type) where
   Residual : Type
   FromResidualSelftraitsTrySelfResidualInst : FromResidual Self Residual
 
 /- Trait declaration: [traits::WithTarget]
-   Source: 'src/traits.rs', lines 252:0-252:20 -/
+   Source: 'src/traits.rs', lines 256:0-256:20 -/
 structure WithTarget (Self : Type) where
   Target : Type
 
 /- Trait declaration: [traits::ParentTrait2]
-   Source: 'src/traits.rs', lines 256:0-256:22 -/
+   Source: 'src/traits.rs', lines 260:0-260:22 -/
 structure ParentTrait2 (Self : Type) where
   U : Type
   U_clause_0 : WithTarget U
 
 /- Trait declaration: [traits::ChildTrait2]
-   Source: 'src/traits.rs', lines 260:0-260:35 -/
+   Source: 'src/traits.rs', lines 264:0-264:35 -/
 structure ChildTrait2 (Self : Type) where
   ParentTrait2SelfInst : ParentTrait2 Self
   convert : ParentTrait2SelfInst.U → Result
     ParentTrait2SelfInst.U_clause_0.Target
 
 /- Trait implementation: [traits::{u32#11}]
-   Source: 'src/traits.rs', lines 264:0-264:23 -/
+   Source: 'src/traits.rs', lines 268:0-268:23 -/
 def traits.WithTargetU32Inst : WithTarget U32 := {
   Target := U32
 }
 
 /- Trait implementation: [traits::{u32#12}]
-   Source: 'src/traits.rs', lines 268:0-268:25 -/
+   Source: 'src/traits.rs', lines 272:0-272:25 -/
 def traits.ParentTrait2U32Inst : ParentTrait2 U32 := {
   U := U32
   U_clause_0 := traits.WithTargetU32Inst
 }
 
-/- [traits::{u32#13}::convert]: forward function
-   Source: 'src/traits.rs', lines 273:4-273:29 -/
+/- [traits::{u32#13}::convert]:
+   Source: 'src/traits.rs', lines 277:4-277:29 -/
 def U32.convert (x : U32) : Result U32 :=
   Result.ret x
 
 /- Trait implementation: [traits::{u32#13}]
-   Source: 'src/traits.rs', lines 272:0-272:24 -/
+   Source: 'src/traits.rs', lines 276:0-276:24 -/
 def traits.ChildTrait2U32Inst : ChildTrait2 U32 := {
   ParentTrait2SelfInst := traits.ParentTrait2U32Inst
   convert := U32.convert
 }
 
 /- Trait declaration: [traits::CFnOnce]
-   Source: 'src/traits.rs', lines 286:0-286:23 -/
+   Source: 'src/traits.rs', lines 290:0-290:23 -/
 structure CFnOnce (Self Args : Type) where
   Output : Type
   call_once : Self → Args → Result Output
 
 /- Trait declaration: [traits::CFnMut]
-   Source: 'src/traits.rs', lines 292:0-292:37 -/
+   Source: 'src/traits.rs', lines 296:0-296:37 -/
 structure CFnMut (Self Args : Type) where
   CFnOnceSelfArgsInst : CFnOnce Self Args
-  call_mut : Self → Args → Result CFnOnceSelfArgsInst.Output
-  call_mut_back : Self → Args → CFnOnceSelfArgsInst.Output → Result Self
+  call_mut : Self → Args → Result (CFnOnceSelfArgsInst.Output × Self)
 
 /- Trait declaration: [traits::CFn]
-   Source: 'src/traits.rs', lines 296:0-296:33 -/
+   Source: 'src/traits.rs', lines 300:0-300:33 -/
 structure CFn (Self Args : Type) where
   CFnMutSelfArgsInst : CFnMut Self Args
-  call_mut : Self → Args → Result
-    CFnMutSelfArgsInst.CFnOnceSelfArgsInst.Output
+  call : Self → Args → Result CFnMutSelfArgsInst.CFnOnceSelfArgsInst.Output
+
+/- Trait declaration: [traits::GetTrait]
+   Source: 'src/traits.rs', lines 304:0-304:18 -/
+structure GetTrait (Self : Type) where
+  W : Type
+  get_w : Self → Result W
+
+/- [traits::test_get_trait]:
+   Source: 'src/traits.rs', lines 309:0-309:49 -/
+def test_get_trait
+  (T : Type) (GetTraitTInst : GetTrait T) (x : T) : Result GetTraitTInst.W :=
+  GetTraitTInst.get_w x
 
 end traits
-- 
cgit v1.2.3


From 091f9f0f49db3c581a33d29470323ab417744845 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sat, 23 Dec 2023 00:16:53 +0100
Subject: Update the proof of the hashmap in Lean

---
 tests/lean/Hashmap/Properties.lean | 144 ++++++++++++-------------------------
 1 file changed, 44 insertions(+), 100 deletions(-)

(limited to 'tests')

diff --git a/tests/lean/Hashmap/Properties.lean b/tests/lean/Hashmap/Properties.lean
index e79c422d..7215e286 100644
--- a/tests/lean/Hashmap/Properties.lean
+++ b/tests/lean/Hashmap/Properties.lean
@@ -55,71 +55,6 @@ theorem match_lawful_beq [BEq α] [LawfulBEq α] [DecidableEq α] (x y : α) :
   (x == y) = (if x = y then true else false) := by
   split <;> simp_all
 
-@[pspec]
-theorem insert_in_list_spec0 {α : Type} (key: Usize) (value: α) (ls: List α) :
-  ∃ b,
-    insert_in_list α key value ls = ret b ∧
-    (b ↔ ls.lookup key = none)
-  := match ls with
-  | .Nil => by simp [insert_in_list, insert_in_list_loop]
-  | .Cons k v tl =>
-    if h: k = key then -- TODO: The order of k/key matters
-      by
-        simp [insert_in_list]
-        rw [insert_in_list_loop]
-        simp [h]
-    else
-      have ⟨ b, hi ⟩ := insert_in_list_spec0 key value tl
-      by
-        exists b
-        simp [insert_in_list]
-        rw [insert_in_list_loop] -- TODO: Using simp leads to infinite recursion
-        simp only [insert_in_list] at hi
-        simp [*]
-
--- Variation: use progress
-theorem insert_in_list_spec1 {α : Type} (key: Usize) (value: α) (ls: List α) :
-  ∃ b,
-    insert_in_list α key value ls = ret b ∧
-    (b ↔ ls.lookup key = none)
-  := match ls with
-  | .Nil => by simp [insert_in_list, insert_in_list_loop]
-  | .Cons k v tl =>
-    if h: k = key then -- TODO: The order of k/key matters
-      by
-        simp [insert_in_list]
-        rw [insert_in_list_loop]
-        simp [h]
-    else
-      by
-        simp only [insert_in_list]
-        rw [insert_in_list_loop]
-        conv => rhs; ext; simp [*]
-        progress keep heq as ⟨ b, hi ⟩
-        simp only [insert_in_list] at heq
-        exists b
-
--- Variation: use tactics from the beginning
-theorem insert_in_list_spec2 {α : Type} (key: Usize) (value: α) (ls: List α) :
-  ∃ b,
-    insert_in_list α key value ls = ret b ∧
-    (b ↔ (ls.lookup key = none))
-  := by
-  induction ls
-  case Nil => simp [insert_in_list, insert_in_list_loop]
-  case Cons k v tl ih =>
-    simp only [insert_in_list]
-    rw [insert_in_list_loop]
-    simp only
-    if h: k = key then
-     simp [h]
-    else
-     conv => rhs; ext; left; simp [h] -- TODO: Simplify
-     simp only [insert_in_list] at ih;
-     -- TODO: give the possibility of using underscores
-     progress as ⟨ b, h ⟩
-     simp [*]
-
 def distinct_keys (ls : Core.List (Usize × α)) := ls.pairwise_rel (λ x y => x.fst ≠ y.fst)
 
 def hash_mod_key (k : Usize) (l : Int) : Int :=
@@ -175,11 +110,16 @@ def inv (hm : HashMap α) : Prop :=
   base_inv hm
   -- TODO: either the hashmap is not overloaded, or we can't resize it
 
-theorem insert_in_list_back_spec_aux {α : Type} (l : Int) (key: Usize) (value: α) (l0: List α)
+-- This rewriting lemma is problematic below
+attribute [-simp] Bool.exists_bool
+
+theorem insert_in_list_spec_aux {α : Type} (l : Int) (key: Usize) (value: α) (l0: List α)
   (hinv : slot_s_inv_hash l (hash_mod_key key l) l0.v)
   (hdk : distinct_keys l0.v) :
-  ∃ l1,
-    insert_in_list_back α key value l0 = ret l1 ∧
+  ∃ b l1,
+    insert_in_list α key value l0 = ret (b, l1) ∧
+    -- The boolean is true ↔ we inserted a new binding
+    (b ↔ (l0.lookup key = none)) ∧
     -- We update the binding
     l1.lookup key = value ∧
     (∀ k, k ≠ key → l1.lookup k = l0.lookup k) ∧
@@ -193,16 +133,19 @@ theorem insert_in_list_back_spec_aux {α : Type} (l : Int) (key: Usize) (value:
     distinct_keys l1.v ∧
     -- We need this auxiliary property to prove that the keys distinct properties is preserved
     (∀ k, k ≠ key → l0.v.allP (λ (k1, _) => k ≠ k1) → l1.v.allP (λ (k1, _) => k ≠ k1))
-  := match l0 with
-  | .Nil => by checkpoint
+  :=
+  match l0 with
+  | .Nil => by
+    exists true -- TODO: why do we need to do this?
     simp (config := {contextual := true})
-      [insert_in_list_back, insert_in_list_loop_back,
+      [insert_in_list, insert_in_list_loop,
        List.v, slot_s_inv_hash, distinct_keys, List.pairwise_rel]
   | .Cons k v tl0 =>
-     if h: k = key then by checkpoint
-       simp [insert_in_list_back]
-       rw [insert_in_list_loop_back]
+     if h: k = key then by
+       rw [insert_in_list]
+       rw [insert_in_list_loop]
        simp [h]
+       exists false; simp -- TODO: why do we need to do this?
        split_conjs
        . intros; simp [*]
        . simp [List.v, slot_s_inv_hash] at *
@@ -210,17 +153,17 @@ theorem insert_in_list_back_spec_aux {α : Type} (l : Int) (key: Usize) (value:
        . simp [*, distinct_keys] at *
          apply hdk
        . tauto
-     else by checkpoint
-       simp [insert_in_list_back]
-       rw [insert_in_list_loop_back]
+     else by
+       rw [insert_in_list]
+       rw [insert_in_list_loop]
        simp [h]
        have : slot_s_inv_hash l (hash_mod_key key l) (List.v tl0) := by checkpoint
          simp_all [List.v, slot_s_inv_hash]
        have : distinct_keys (List.v tl0) := by checkpoint
          simp [distinct_keys] at hdk
          simp [hdk, distinct_keys]
-       progress keep heq as ⟨ tl1 .. ⟩
-       simp only [insert_in_list_back] at heq
+       progress keep heq as ⟨ b, tl1 .. ⟩
+       simp only [insert_in_list] at heq
        have : slot_s_inv_hash l (hash_mod_key key l) (List.v (List.Cons k v tl1)) := by checkpoint
          simp [List.v, slot_s_inv_hash] at *
          simp [*]
@@ -228,14 +171,16 @@ theorem insert_in_list_back_spec_aux {α : Type} (l : Int) (key: Usize) (value:
          simp [distinct_keys] at *
          simp [*]
        -- TODO: canonize addition by default?
+       exists b
        simp_all [Int.add_assoc, Int.add_comm, Int.add_left_comm]
 
 @[pspec]
-theorem insert_in_list_back_spec {α : Type} (l : Int) (key: Usize) (value: α) (l0: List α)
+theorem insert_in_list_spec {α : Type} (l : Int) (key: Usize) (value: α) (l0: List α)
   (hinv : slot_s_inv_hash l (hash_mod_key key l) l0.v)
   (hdk : distinct_keys l0.v) :
-  ∃ l1,
-    insert_in_list_back α key value l0 = ret l1 ∧
+  ∃ b l1,
+    insert_in_list α key value l0 = ret (b, l1) ∧
+    (b ↔ (l0.lookup key = none)) ∧
     -- We update the binding
     l1.lookup key = value ∧
     (∀ k, k ≠ key → l1.lookup k = l0.lookup k) ∧
@@ -248,7 +193,8 @@ theorem insert_in_list_back_spec {α : Type} (l : Int) (key: Usize) (value: α)
     -- The keys are distinct
     distinct_keys l1.v
   := by
-  progress with insert_in_list_back_spec_aux as ⟨ l1 .. ⟩
+  progress with insert_in_list_spec_aux as ⟨ b, l1 .. ⟩
+  exists b
   exists l1
 
 @[simp]
@@ -286,7 +232,7 @@ set_option pp.coercions false -- do not print coercions with ↑ (this doesn't p
 
 -- The proof below is a bit expensive, so we need to increase the maximum number
 -- of heart beats
-set_option maxHeartbeats 400000
+set_option maxHeartbeats 1000000
 
 theorem insert_no_resize_spec {α : Type} (hm : HashMap α) (key : Usize) (value : α)
   (hinv : hm.inv) (hnsat : hm.lookup key = none → hm.len_s < Usize.max) :
@@ -315,9 +261,19 @@ theorem insert_no_resize_spec {α : Type} (hm : HashMap α) (key : Usize) (value
       simp [hinv]
     -- TODO: we want to automate that
     simp [*, Int.emod_lt_of_pos]
-  progress as ⟨ l, h_leq ⟩
-  -- TODO: make progress use the names written in the goal
-  progress as ⟨ inserted ⟩
+  progress as ⟨ l, index_mut_back, h_leq, h_index_mut_back ⟩
+  simp [h_index_mut_back] at *; clear h_index_mut_back index_mut_back
+  have h_slot :
+    slot_s_inv_hash hm.slots.length (hash_mod_key key hm.slots.length) l.v := by
+    simp [inv] at hinv
+    have h := (hinv.right.left hash_mod.val (by assumption) (by assumption)).right
+    simp [slot_t_inv, hhm] at h
+    simp [h, hhm, h_leq]
+  have hd : distinct_keys l.v := by
+    simp [inv, slots_t_inv, slot_t_inv] at hinv
+    have h := hinv.right.left hash_mod.val (by assumption) (by assumption)
+    simp [h, h_leq]
+  progress as ⟨ inserted, l0, _, _, _, _, hlen .. ⟩
   rw [if_update_eq] -- TODO: necessary because we don't have a join
   -- TODO: progress to ...
   have hipost :
@@ -336,20 +292,9 @@ theorem insert_no_resize_spec {α : Type} (hm : HashMap α) (key : Usize) (value
     else
       simp [*, Pure.pure]
   progress as ⟨ i0 ⟩
-  have h_slot : slot_s_inv_hash hm.slots.length (hash_mod_key key hm.slots.length) l.v
-    := by
-    simp [inv] at hinv
-    have h := (hinv.right.left hash_mod.val (by assumption) (by assumption)).right
-    simp [slot_t_inv, hhm] at h
-    simp [h, hhm, h_leq]
-  have hd : distinct_keys l.v := by checkpoint
-    simp [inv, slots_t_inv, slot_t_inv] at hinv
-    have h := hinv.right.left hash_mod.val (by assumption) (by assumption)
-    simp [h, h_leq]
   -- TODO: hide the variables and only keep the props
   -- TODO: allow providing terms to progress to instantiate the meta variables
   -- which are not propositions
-  progress as ⟨ l0, _, _, _, hlen .. ⟩
   progress keep hv as ⟨ v, h_veq ⟩
   -- TODO: update progress to automate that
   -- TODO: later I don't want to inline nhm - we need to control simp: deactivate
@@ -428,8 +373,7 @@ theorem insert_no_resize_spec {α : Type} (hm : HashMap α) (key : Usize) (value
         simp [*]
       else
         simp [*]
-    . -- TODO: simp[*] fails: "(deterministic) timeout at 'whnf'"
-      simp [hinv, h_veq, nhm_eq]
+    . simp [hinv, h_veq, nhm_eq]
   simp_all
 
 end HashMap
-- 
cgit v1.2.3


From 6fd112a30d12cda6390ea3b856a81096d6bcedfe Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sat, 23 Dec 2023 00:17:07 +0100
Subject: Fix a minor issue in the Lean tests

---
 tests/lean/External/FunsExternal.lean | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

(limited to 'tests')

diff --git a/tests/lean/External/FunsExternal.lean b/tests/lean/External/FunsExternal.lean
index aae11ba1..63830abc 100644
--- a/tests/lean/External/FunsExternal.lean
+++ b/tests/lean/External/FunsExternal.lean
@@ -8,22 +8,11 @@ open external
 
 /- [core::mem::swap] -/
 def core.mem.swap
-  (T : Type) : T → T → State → Result (State × Unit) :=
-  fun _x _y s => .ret (s, ())
-
-/- [core::mem::swap] -/
-def core.mem.swap_back0
-  (T : Type) : T → T → State → State → Result (State × T) :=
-  fun _x y _s0 s1 => .ret (s1, y)
-
-/- [core::mem::swap] -/
-def core.mem.swap_back1
-  (T : Type) : T → T → State → State → Result (State × T) :=
-  fun x _y _s0 s1 => .ret (s1, x)
+  (T : Type) : T → T → State → Result (State × (T × T)) :=
+  fun x y s => .ret (s, (y, x))
 
 /- [core::num::nonzero::NonZeroU32::{14}::new] -/
-def core.num.nonzero.NonZeroU32.new
-  :
+def core.num.nonzero.NonZeroU32.new :
   U32 → State → Result (State × (Option core_num_nonzero_non_zero_u32_t)) :=
   fun _ _ => .fail .panic
 
-- 
cgit v1.2.3


From b6ef8ee33802e75409c3bd2b82e7b5ad22f1d053 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sat, 23 Dec 2023 00:41:25 +0100
Subject: Improve the micro passes to eliminate pattern `let f := fun x => g x`

---
 tests/coq/misc/Loops.v          | 26 ++++++++------------------
 tests/fstar/misc/Loops.Funs.fst | 25 ++++++++-----------------
 tests/lean/Loops.lean           | 25 ++++++++-----------------
 3 files changed, 24 insertions(+), 52 deletions(-)

(limited to 'tests')

diff --git a/tests/coq/misc/Loops.v b/tests/coq/misc/Loops.v
index 313c2cfd..cc76f359 100644
--- a/tests/coq/misc/Loops.v
+++ b/tests/coq/misc/Loops.v
@@ -160,10 +160,7 @@ Definition list_nth_mut_loop
   (T : Type) (n : nat) (ls : List_t T) (i : u32) :
   result (T * (T -> result (List_t T)))
   :=
-  p <- list_nth_mut_loop_loop T n ls i;
-  let (t, back) := p in
-  let back1 := fun (ret : T) => back ret in
-  Return (t, back1)
+  p <- list_nth_mut_loop_loop T n ls i; let (t, back) := p in Return (t, back)
 .
 
 (** [loops::list_nth_shared_loop]: loop 0:
@@ -265,7 +262,7 @@ Definition id_mut
   (T : Type) (ls : List_t T) :
   result ((List_t T) * (List_t T -> result (List_t T)))
   :=
-  let back := fun (ret : List_t T) => Return ret in Return (ls, back)
+  Return (ls, Return)
 .
 
 (** [loops::id_shared]:
@@ -382,9 +379,7 @@ Definition list_nth_mut_loop_pair
   :=
   t <- list_nth_mut_loop_pair_loop T n ls0 ls1 i;
   let (p, back_'a, back_'b) := t in
-  let back_'a1 := fun (ret : T) => back_'a ret in
-  let back_'b1 := fun (ret : T) => back_'b ret in
-  Return (p, back_'a1, back_'b1)
+  Return (p, back_'a, back_'b)
 .
 
 (** [loops::list_nth_shared_loop_pair]: loop 0:
@@ -465,8 +460,7 @@ Definition list_nth_mut_loop_pair_merge
   :=
   p <- list_nth_mut_loop_pair_merge_loop T n ls0 ls1 i;
   let (p1, back_'a) := p in
-  let back_'a1 := fun (ret : (T * T)) => back_'a ret in
-  Return (p1, back_'a1)
+  Return (p1, back_'a)
 .
 
 (** [loops::list_nth_shared_loop_pair_merge]: loop 0:
@@ -542,8 +536,7 @@ Definition list_nth_mut_shared_loop_pair
   :=
   p <- list_nth_mut_shared_loop_pair_loop T n ls0 ls1 i;
   let (p1, back_'a) := p in
-  let back_'a1 := fun (ret : T) => back_'a ret in
-  Return (p1, back_'a1)
+  Return (p1, back_'a)
 .
 
 (** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
@@ -585,8 +578,7 @@ Definition list_nth_mut_shared_loop_pair_merge
   :=
   p <- list_nth_mut_shared_loop_pair_merge_loop T n ls0 ls1 i;
   let (p1, back_'a) := p in
-  let back_'a1 := fun (ret : T) => back_'a ret in
-  Return (p1, back_'a1)
+  Return (p1, back_'a)
 .
 
 (** [loops::list_nth_shared_mut_loop_pair]: loop 0:
@@ -628,8 +620,7 @@ Definition list_nth_shared_mut_loop_pair
   :=
   p <- list_nth_shared_mut_loop_pair_loop T n ls0 ls1 i;
   let (p1, back_'b) := p in
-  let back_'b1 := fun (ret : T) => back_'b ret in
-  Return (p1, back_'b1)
+  Return (p1, back_'b)
 .
 
 (** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
@@ -671,8 +662,7 @@ Definition list_nth_shared_mut_loop_pair_merge
   :=
   p <- list_nth_shared_mut_loop_pair_merge_loop T n ls0 ls1 i;
   let (p1, back_'a) := p in
-  let back_'a1 := fun (ret : T) => back_'a ret in
-  Return (p1, back_'a1)
+  Return (p1, back_'a)
 .
 
 End Loops.
diff --git a/tests/fstar/misc/Loops.Funs.fst b/tests/fstar/misc/Loops.Funs.fst
index a047c170..88389300 100644
--- a/tests/fstar/misc/Loops.Funs.fst
+++ b/tests/fstar/misc/Loops.Funs.fst
@@ -121,9 +121,7 @@ let list_nth_mut_loop
   (t : Type0) (ls : list_t t) (i : u32) :
   result (t & (t -> result (list_t t)))
   =
-  let* (x, back) = list_nth_mut_loop_loop t ls i in
-  let back1 = fun ret -> back ret in
-  Return (x, back1)
+  let* (x, back) = list_nth_mut_loop_loop t ls i in Return (x, back)
 
 (** [loops::list_nth_shared_loop]: loop 0:
     Source: 'src/loops.rs', lines 91:0-101:1 *)
@@ -201,7 +199,7 @@ let id_mut
   (t : Type0) (ls : list_t t) :
   result ((list_t t) & (list_t t -> result (list_t t)))
   =
-  let back = fun ret -> Return ret in Return (ls, back)
+  Return (ls, Return)
 
 (** [loops::id_shared]:
     Source: 'src/loops.rs', lines 139:0-139:45 *)
@@ -296,9 +294,7 @@ let list_nth_mut_loop_pair
   result ((t & t) & (t -> result (list_t t)) & (t -> result (list_t t)))
   =
   let* (p, back_'a, back_'b) = list_nth_mut_loop_pair_loop t ls0 ls1 i in
-  let back_'a1 = fun ret -> back_'a ret in
-  let back_'b1 = fun ret -> back_'b ret in
-  Return (p, back_'a1, back_'b1)
+  Return (p, back_'a, back_'b)
 
 (** [loops::list_nth_shared_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 198:0-219:1 *)
@@ -362,8 +358,7 @@ let list_nth_mut_loop_pair_merge
   result ((t & t) & ((t & t) -> result ((list_t t) & (list_t t))))
   =
   let* (p, back_'a) = list_nth_mut_loop_pair_merge_loop t ls0 ls1 i in
-  let back_'a1 = fun ret -> back_'a ret in
-  Return (p, back_'a1)
+  Return (p, back_'a)
 
 (** [loops::list_nth_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 241:0-256:1 *)
@@ -425,8 +420,7 @@ let list_nth_mut_shared_loop_pair
   result ((t & t) & (t -> result (list_t t)))
   =
   let* (p, back_'a) = list_nth_mut_shared_loop_pair_loop t ls0 ls1 i in
-  let back_'a1 = fun ret -> back_'a ret in
-  Return (p, back_'a1)
+  Return (p, back_'a)
 
 (** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 278:0-293:1 *)
@@ -462,8 +456,7 @@ let list_nth_mut_shared_loop_pair_merge
   result ((t & t) & (t -> result (list_t t)))
   =
   let* (p, back_'a) = list_nth_mut_shared_loop_pair_merge_loop t ls0 ls1 i in
-  let back_'a1 = fun ret -> back_'a ret in
-  Return (p, back_'a1)
+  Return (p, back_'a)
 
 (** [loops::list_nth_shared_mut_loop_pair]: loop 0:
     Source: 'src/loops.rs', lines 297:0-312:1 *)
@@ -498,8 +491,7 @@ let list_nth_shared_mut_loop_pair
   result ((t & t) & (t -> result (list_t t)))
   =
   let* (p, back_'b) = list_nth_shared_mut_loop_pair_loop t ls0 ls1 i in
-  let back_'b1 = fun ret -> back_'b ret in
-  Return (p, back_'b1)
+  Return (p, back_'b)
 
 (** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
     Source: 'src/loops.rs', lines 316:0-331:1 *)
@@ -535,6 +527,5 @@ let list_nth_shared_mut_loop_pair_merge
   result ((t & t) & (t -> result (list_t t)))
   =
   let* (p, back_'a) = list_nth_shared_mut_loop_pair_merge_loop t ls0 ls1 i in
-  let back_'a1 = fun ret -> back_'a ret in
-  Return (p, back_'a1)
+  Return (p, back_'a)
 
diff --git a/tests/lean/Loops.lean b/tests/lean/Loops.lean
index 805ecabc..fbb4616f 100644
--- a/tests/lean/Loops.lean
+++ b/tests/lean/Loops.lean
@@ -122,8 +122,7 @@ def list_nth_mut_loop
   (T : Type) (ls : List T) (i : U32) : Result (T × (T → Result (List T))) :=
   do
   let (t, back) ← list_nth_mut_loop_loop T ls i
-  let back1 := fun ret => back ret
-  Result.ret (t, back1)
+  Result.ret (t, back)
 
 /- [loops::list_nth_shared_loop]: loop 0:
    Source: 'src/loops.rs', lines 91:0-101:1 -/
@@ -207,8 +206,7 @@ def id_mut
   (T : Type) (ls : List T) :
   Result ((List T) × (List T → Result (List T)))
   :=
-  let back := fun ret => Result.ret ret
-  Result.ret (ls, back)
+  Result.ret (ls, Result.ret)
 
 /- [loops::id_shared]:
    Source: 'src/loops.rs', lines 139:0-139:45 -/
@@ -308,9 +306,7 @@ def list_nth_mut_loop_pair
   :=
   do
   let (p, back_'a, back_'b) ← list_nth_mut_loop_pair_loop T ls0 ls1 i
-  let back_'a1 := fun ret => back_'a ret
-  let back_'b1 := fun ret => back_'b ret
-  Result.ret (p, back_'a1, back_'b1)
+  Result.ret (p, back_'a, back_'b)
 
 /- [loops::list_nth_shared_loop_pair]: loop 0:
    Source: 'src/loops.rs', lines 198:0-219:1 -/
@@ -372,8 +368,7 @@ def list_nth_mut_loop_pair_merge
   :=
   do
   let (p, back_'a) ← list_nth_mut_loop_pair_merge_loop T ls0 ls1 i
-  let back_'a1 := fun ret => back_'a ret
-  Result.ret (p, back_'a1)
+  Result.ret (p, back_'a)
 
 /- [loops::list_nth_shared_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 241:0-256:1 -/
@@ -432,8 +427,7 @@ def list_nth_mut_shared_loop_pair
   :=
   do
   let (p, back_'a) ← list_nth_mut_shared_loop_pair_loop T ls0 ls1 i
-  let back_'a1 := fun ret => back_'a ret
-  Result.ret (p, back_'a1)
+  Result.ret (p, back_'a)
 
 /- [loops::list_nth_mut_shared_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 278:0-293:1 -/
@@ -470,8 +464,7 @@ def list_nth_mut_shared_loop_pair_merge
   :=
   do
   let (p, back_'a) ← list_nth_mut_shared_loop_pair_merge_loop T ls0 ls1 i
-  let back_'a1 := fun ret => back_'a ret
-  Result.ret (p, back_'a1)
+  Result.ret (p, back_'a)
 
 /- [loops::list_nth_shared_mut_loop_pair]: loop 0:
    Source: 'src/loops.rs', lines 297:0-312:1 -/
@@ -507,8 +500,7 @@ def list_nth_shared_mut_loop_pair
   :=
   do
   let (p, back_'b) ← list_nth_shared_mut_loop_pair_loop T ls0 ls1 i
-  let back_'b1 := fun ret => back_'b ret
-  Result.ret (p, back_'b1)
+  Result.ret (p, back_'b)
 
 /- [loops::list_nth_shared_mut_loop_pair_merge]: loop 0:
    Source: 'src/loops.rs', lines 316:0-331:1 -/
@@ -545,7 +537,6 @@ def list_nth_shared_mut_loop_pair_merge
   :=
   do
   let (p, back_'a) ← list_nth_shared_mut_loop_pair_merge_loop T ls0 ls1 i
-  let back_'a1 := fun ret => back_'a ret
-  Result.ret (p, back_'a1)
+  Result.ret (p, back_'a)
 
 end loops
-- 
cgit v1.2.3


From a4decc7654bc6f3301c0174124d21fdbc2dbc708 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sat, 23 Dec 2023 00:59:55 +0100
Subject: Regenerate the files

---
 tests/coq/array/Array.v                            | 18 ++++------
 tests/coq/betree/BetreeMain_Funs.v                 | 40 ++++++----------------
 tests/coq/hashmap/Hashmap_Funs.v                   |  8 ++---
 tests/coq/hashmap_on_disk/HashmapMain_Funs.v       | 10 +++---
 tests/coq/misc/External_Funs.v                     |  4 +--
 tests/coq/misc/NoNestedBorrows.v                   | 37 ++++++++------------
 tests/coq/misc/Paper.v                             | 11 +++---
 tests/coq/misc/PoloniusList.v                      |  8 ++---
 tests/coq/traits/Traits.v                          |  2 +-
 tests/fstar-split/betree/BetreeMain.Funs.fst       | 17 ++++-----
 tests/fstar-split/hashmap/Hashmap.Funs.fst         |  6 ++--
 .../hashmap_on_disk/HashmapMain.Funs.fst           |  8 ++---
 tests/fstar-split/misc/External.Funs.fst           |  4 +--
 tests/fstar-split/misc/NoNestedBorrows.fst         | 26 ++++++--------
 tests/fstar-split/misc/Paper.fst                   | 11 +++---
 tests/fstar-split/traits/Traits.fst                |  2 +-
 tests/fstar/array/Array.Funs.fst                   | 18 ++++------
 tests/fstar/betree/BetreeMain.Funs.fst             | 33 ++++++------------
 .../fstar/betree_back_stateful/BetreeMain.Funs.fst | 33 ++++++------------
 tests/fstar/hashmap/Hashmap.Funs.fst               |  9 +++--
 tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst   | 10 +++---
 tests/fstar/misc/External.Funs.fst                 |  4 +--
 tests/fstar/misc/NoNestedBorrows.fst               | 37 ++++++++------------
 tests/fstar/misc/Paper.fst                         | 11 +++---
 tests/fstar/misc/PoloniusList.fst                  |  6 ++--
 tests/fstar/traits/Traits.fst                      |  2 +-
 tests/lean/Array.lean                              | 18 ++++------
 tests/lean/BetreeMain/Funs.lean                    | 36 ++++++-------------
 tests/lean/External/Funs.lean                      |  3 +-
 tests/lean/Hashmap/Funs.lean                       |  9 ++---
 tests/lean/HashmapMain/Funs.lean                   | 11 +++---
 tests/lean/NoNestedBorrows.lean                    | 36 ++++++++-----------
 tests/lean/Paper.lean                              | 11 +++---
 tests/lean/PoloniusList.lean                       |  8 ++---
 tests/lean/Traits.lean                             |  3 +-
 35 files changed, 183 insertions(+), 327 deletions(-)

(limited to 'tests')

diff --git a/tests/coq/array/Array.v b/tests/coq/array/Array.v
index faa0e92c..3a30413a 100644
--- a/tests/coq/array/Array.v
+++ b/tests/coq/array/Array.v
@@ -32,8 +32,7 @@ Definition array_to_mut_slice_
   :=
   p <- array_to_slice_mut T 32%usize s;
   let (s1, to_slice_mut_back) := p in
-  let back := fun (ret : slice T) => to_slice_mut_back ret in
-  Return (s1, back)
+  Return (s1, to_slice_mut_back)
 .
 
 (** [array::array_len]:
@@ -81,8 +80,7 @@ Definition index_mut_array
   :=
   p <- array_index_mut_usize T 32%usize s i;
   let (t, index_mut_back) := p in
-  let back := fun (ret : T) => index_mut_back ret in
-  Return (t, back)
+  Return (t, index_mut_back)
 .
 
 (** [array::index_slice]:
@@ -99,8 +97,7 @@ Definition index_mut_slice
   :=
   p <- slice_index_mut_usize T s i;
   let (t, index_mut_back) := p in
-  let back := fun (ret : T) => index_mut_back ret in
-  Return (t, back)
+  Return (t, index_mut_back)
 .
 
 (** [array::slice_subslice_shared_]:
@@ -123,8 +120,7 @@ Definition slice_subslice_mut_
       (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
       {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |};
   let (s, index_mut_back) := p in
-  let back := fun (ret : slice u32) => index_mut_back ret in
-  Return (s, back)
+  Return (s, index_mut_back)
 .
 
 (** [array::array_to_slice_shared_]:
@@ -142,8 +138,7 @@ Definition array_to_slice_mut_
   :=
   p <- array_to_slice_mut u32 32%usize x;
   let (s, to_slice_mut_back) := p in
-  let back := fun (ret : slice u32) => to_slice_mut_back ret in
-  Return (s, back)
+  Return (s, to_slice_mut_back)
 .
 
 (** [array::array_subslice_shared_]:
@@ -168,8 +163,7 @@ Definition array_subslice_mut_
       (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
       {| core_ops_range_Range_start := y; core_ops_range_Range_end_ := z |};
   let (s, index_mut_back) := p in
-  let back := fun (ret : slice u32) => index_mut_back ret in
-  Return (s, back)
+  Return (s, index_mut_back)
 .
 
 (** [array::index_slice_0]:
diff --git a/tests/coq/betree/BetreeMain_Funs.v b/tests/coq/betree/BetreeMain_Funs.v
index 516bc7b7..cefab0f4 100644
--- a/tests/coq/betree/BetreeMain_Funs.v
+++ b/tests/coq/betree/BetreeMain_Funs.v
@@ -123,8 +123,7 @@ Fixpoint betree_List_split_at
         i <- u64_sub n1 1%u64;
         p <- betree_List_split_at T n2 tl i;
         let (ls0, ls1) := p in
-        let l := ls0 in
-        Return (Betree_List_Cons hd l, ls1)
+        Return (Betree_List_Cons hd ls0, ls1)
       | Betree_List_Nil => Fail_ Failure
       end
   end
@@ -135,8 +134,7 @@ Fixpoint betree_List_split_at
 Definition betree_List_push_front
   (T : Type) (self : betree_List_t T) (x : T) : result (betree_List_t T) :=
   let (tl, _) := core_mem_replace (betree_List_t T) self Betree_List_Nil in
-  let l := tl in
-  Return (Betree_List_Cons x l)
+  Return (Betree_List_Cons x tl)
 .
 
 (** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
@@ -186,8 +184,7 @@ Fixpoint betree_ListTupleU64T_partition_at_pivot
       else (
         p <- betree_ListTupleU64T_partition_at_pivot T n1 tl pivot;
         let (ls0, ls1) := p in
-        let l := ls0 in
-        Return (Betree_List_Cons (i, t) l, ls1))
+        Return (Betree_List_Cons (i, t) ls0, ls1))
     | Betree_List_Nil => Return (Betree_List_Nil, Betree_List_Nil)
     end
   end
@@ -242,10 +239,7 @@ Fixpoint betree_Node_lookup_first_message_for_key
     | Betree_List_Cons x next_msgs =>
       let (i, m) := x in
       if i s>= key
-      then
-        let back_'a :=
-          fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
-        Return (Betree_List_Cons (i, m) next_msgs, back_'a)
+      then Return (Betree_List_Cons (i, m) next_msgs, Return)
       else (
         p <- betree_Node_lookup_first_message_for_key n1 key next_msgs;
         let (l, lookup_first_message_for_key_back) := p in
@@ -254,10 +248,7 @@ Fixpoint betree_Node_lookup_first_message_for_key
             next_msgs1 <- lookup_first_message_for_key_back ret;
             Return (Betree_List_Cons (i, m) next_msgs1) in
         Return (l, back_'a))
-    | Betree_List_Nil =>
-      let back_'a :=
-        fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
-      Return (Betree_List_Nil, back_'a)
+    | Betree_List_Nil => Return (Betree_List_Nil, Return)
     end
   end
 .
@@ -456,14 +447,8 @@ Fixpoint betree_Node_lookup_first_message_after_key
             next_msgs1 <- lookup_first_message_after_key_back ret;
             Return (Betree_List_Cons (k, m) next_msgs1) in
         Return (l, back_'a))
-      else
-        let back_'a :=
-          fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
-        Return (Betree_List_Cons (k, m) next_msgs, back_'a)
-    | Betree_List_Nil =>
-      let back_'a :=
-        fun (ret : betree_List_t (u64 * betree_Message_t)) => Return ret in
-      Return (Betree_List_Nil, back_'a)
+      else Return (Betree_List_Cons (k, m) next_msgs, Return)
+    | Betree_List_Nil => Return (Betree_List_Nil, Return)
     end
   end
 .
@@ -562,9 +547,7 @@ Fixpoint betree_Node_lookup_mut_in_bindings
     | Betree_List_Cons hd tl =>
       let (i, i1) := hd in
       if i s>= key
-      then
-        let back_'a := fun (ret : betree_List_t (u64 * u64)) => Return ret in
-        Return (Betree_List_Cons (i, i1) tl, back_'a)
+      then Return (Betree_List_Cons (i, i1) tl, Return)
       else (
         p <- betree_Node_lookup_mut_in_bindings n1 key tl;
         let (l, lookup_mut_in_bindings_back) := p in
@@ -573,9 +556,7 @@ Fixpoint betree_Node_lookup_mut_in_bindings
             tl1 <- lookup_mut_in_bindings_back ret;
             Return (Betree_List_Cons (i, i1) tl1) in
         Return (l, back_'a))
-    | Betree_List_Nil =>
-      let back_'a := fun (ret : betree_List_t (u64 * u64)) => Return ret in
-      Return (Betree_List_Nil, back_'a)
+    | Betree_List_Nil => Return (Betree_List_Nil, Return)
     end
   end
 .
@@ -751,10 +732,9 @@ Definition betree_Node_apply
   (new_msg : betree_Message_t) (st : state) :
   result (state * (betree_Node_t * betree_NodeIdCounter_t))
   :=
-  let l := Betree_List_Nil in
   p <-
     betree_Node_apply_messages n self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st;
+      (key, new_msg) Betree_List_Nil) st;
   let (st1, p1) := p in
   let (self1, node_id_cnt1) := p1 in
   Return (st1, (self1, node_id_cnt1))
diff --git a/tests/coq/hashmap/Hashmap_Funs.v b/tests/coq/hashmap/Hashmap_Funs.v
index 5cd9fe70..0478edbe 100644
--- a/tests/coq/hashmap/Hashmap_Funs.v
+++ b/tests/coq/hashmap/Hashmap_Funs.v
@@ -49,8 +49,7 @@ Definition hashMap_new_with_capacity
   (max_load_divisor : usize) :
   result (HashMap_t T)
   :=
-  let v := alloc_vec_Vec_new (List_t T) in
-  slots <- hashMap_allocate_slots T n v capacity;
+  slots <- hashMap_allocate_slots T n (alloc_vec_Vec_new (List_t T)) capacity;
   i <- usize_mul capacity max_load_dividend;
   i1 <- usize_div i max_load_divisor;
   Return
@@ -128,7 +127,7 @@ Fixpoint hashMap_insert_in_list_loop
         p <- hashMap_insert_in_list_loop T n1 key value tl;
         let (b, back) := p in
         Return (b, List_Cons ckey cvalue back))
-    | List_Nil => let l := List_Nil in Return (true, List_Cons key value l)
+    | List_Nil => Return (true, List_Cons key value List_Nil)
     end
   end
 .
@@ -401,8 +400,7 @@ Definition hashMap_get_mut_in_list
   :=
   p <- hashMap_get_mut_in_list_loop T n ls key;
   let (t, back_'a) := p in
-  let back_'a1 := fun (ret : T) => back_'a ret in
-  Return (t, back_'a1)
+  Return (t, back_'a)
 .
 
 (** [hashmap::{hashmap::HashMap<T>}::get_mut]:
diff --git a/tests/coq/hashmap_on_disk/HashmapMain_Funs.v b/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
index b74fa61a..6a7eeb2d 100644
--- a/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
+++ b/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
@@ -53,8 +53,9 @@ Definition hashmap_HashMap_new_with_capacity
   (max_load_divisor : usize) :
   result (hashmap_HashMap_t T)
   :=
-  let v := alloc_vec_Vec_new (hashmap_List_t T) in
-  slots <- hashmap_HashMap_allocate_slots T n v capacity;
+  slots <-
+    hashmap_HashMap_allocate_slots T n (alloc_vec_Vec_new (hashmap_List_t T))
+      capacity;
   i <- usize_mul capacity max_load_dividend;
   i1 <- usize_div i max_load_divisor;
   Return
@@ -138,7 +139,7 @@ Fixpoint hashmap_HashMap_insert_in_list_loop
         let (b, back) := p in
         Return (b, Hashmap_List_Cons ckey cvalue back))
     | Hashmap_List_Nil =>
-      let l := Hashmap_List_Nil in Return (true, Hashmap_List_Cons key value l)
+      Return (true, Hashmap_List_Cons key value Hashmap_List_Nil)
     end
   end
 .
@@ -424,8 +425,7 @@ Definition hashmap_HashMap_get_mut_in_list
   :=
   p <- hashmap_HashMap_get_mut_in_list_loop T n ls key;
   let (t, back_'a) := p in
-  let back_'a1 := fun (ret : T) => back_'a ret in
-  Return (t, back_'a1)
+  Return (t, back_'a)
 .
 
 (** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]:
diff --git a/tests/coq/misc/External_Funs.v b/tests/coq/misc/External_Funs.v
index 049f5d39..91ea88c9 100644
--- a/tests/coq/misc/External_Funs.v
+++ b/tests/coq/misc/External_Funs.v
@@ -31,9 +31,7 @@ Definition test_new_non_zero_u32
 (** [external::test_vec]:
     Source: 'src/external.rs', lines 17:0-17:17 *)
 Definition test_vec : result unit :=
-  let v := alloc_vec_Vec_new u32 in
-  _ <- alloc_vec_Vec_push u32 v 0%u32;
-  Return tt
+  _ <- alloc_vec_Vec_push u32 (alloc_vec_Vec_new u32) 0%u32; Return tt
 .
 
 (** Unit test for [external::test_vec] *)
diff --git a/tests/coq/misc/NoNestedBorrows.v b/tests/coq/misc/NoNestedBorrows.v
index 081c65c3..8857d4b6 100644
--- a/tests/coq/misc/NoNestedBorrows.v
+++ b/tests/coq/misc/NoNestedBorrows.v
@@ -244,11 +244,10 @@ Check (test_list1 )%return.
 (** [no_nested_borrows::test_box1]:
     Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 *)
 Definition test_box1 : result unit :=
-  let b := 0%i32 in
-  p <- alloc_boxed_Box_deref_mut i32 b;
+  p <- alloc_boxed_Box_deref_mut i32 0%i32;
   let (_, deref_mut_back) := p in
-  b1 <- deref_mut_back 1%i32;
-  x <- alloc_boxed_Box_deref i32 b1;
+  b <- deref_mut_back 1%i32;
+  x <- alloc_boxed_Box_deref i32 b;
   if negb (x s= 1%i32) then Fail_ Failure else Return tt
 .
 
@@ -290,8 +289,7 @@ Definition is_cons (T : Type) (l : List_t T) : result bool :=
 (** [no_nested_borrows::test_is_cons]:
     Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 *)
 Definition test_is_cons : result unit :=
-  let l := List_Nil in
-  b <- is_cons i32 (List_Cons 0%i32 l);
+  b <- is_cons i32 (List_Cons 0%i32 List_Nil);
   if negb b then Fail_ Failure else Return tt
 .
 
@@ -310,8 +308,7 @@ Definition split_list (T : Type) (l : List_t T) : result (T * (List_t T)) :=
 (** [no_nested_borrows::test_split_list]:
     Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 *)
 Definition test_split_list : result unit :=
-  let l := List_Nil in
-  p <- split_list i32 (List_Cons 0%i32 l);
+  p <- split_list i32 (List_Cons 0%i32 List_Nil);
   let (hd, _) := p in
   if negb (hd s= 0%i32) then Fail_ Failure else Return tt
 .
@@ -436,26 +433,25 @@ Definition list_rev (T : Type) (l : List_t T) : result (List_t T) :=
 (** [no_nested_borrows::test_list_functions]:
     Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 *)
 Definition test_list_functions : result unit :=
-  let l := List_Nil in
-  let l1 := List_Cons 2%i32 l in
-  let l2 := List_Cons 1%i32 l1 in
-  i <- list_length i32 (List_Cons 0%i32 l2);
+  let l := List_Cons 2%i32 List_Nil in
+  let l1 := List_Cons 1%i32 l in
+  i <- list_length i32 (List_Cons 0%i32 l1);
   if negb (i s= 3%u32)
   then Fail_ Failure
   else (
-    i1 <- list_nth_shared i32 (List_Cons 0%i32 l2) 0%u32;
+    i1 <- list_nth_shared i32 (List_Cons 0%i32 l1) 0%u32;
     if negb (i1 s= 0%i32)
     then Fail_ Failure
     else (
-      i2 <- list_nth_shared i32 (List_Cons 0%i32 l2) 1%u32;
+      i2 <- list_nth_shared i32 (List_Cons 0%i32 l1) 1%u32;
       if negb (i2 s= 1%i32)
       then Fail_ Failure
       else (
-        i3 <- list_nth_shared i32 (List_Cons 0%i32 l2) 2%u32;
+        i3 <- list_nth_shared i32 (List_Cons 0%i32 l1) 2%u32;
         if negb (i3 s= 2%i32)
         then Fail_ Failure
         else (
-          p <- list_nth_mut i32 (List_Cons 0%i32 l2) 1%u32;
+          p <- list_nth_mut i32 (List_Cons 0%i32 l1) 1%u32;
           let (_, list_nth_mut_back) := p in
           ls <- list_nth_mut_back 3%i32;
           i4 <- list_nth_shared i32 ls 0%u32;
@@ -502,9 +498,7 @@ Definition id_mut_pair3
   (T1 T2 : Type) (x : T1) (y : T2) :
   result ((T1 * T2) * (T1 -> result T1) * (T2 -> result T2))
   :=
-  let back_'a := fun (ret : T1) => Return ret in
-  let back_'b := fun (ret : T2) => Return ret in
-  Return ((x, y), back_'a, back_'b)
+  Return ((x, y), Return, Return)
 .
 
 (** [no_nested_borrows::id_mut_pair4]:
@@ -513,10 +507,7 @@ Definition id_mut_pair4
   (T1 T2 : Type) (p : (T1 * T2)) :
   result ((T1 * T2) * (T1 -> result T1) * (T2 -> result T2))
   :=
-  let (t, t1) := p in
-  let back_'a := fun (ret : T1) => Return ret in
-  let back_'b := fun (ret : T2) => Return ret in
-  Return ((t, t1), back_'a, back_'b)
+  let (t, t1) := p in Return ((t, t1), Return, Return)
 .
 
 (** [no_nested_borrows::StructWithTuple]
diff --git a/tests/coq/misc/Paper.v b/tests/coq/misc/Paper.v
index e46df0ce..769cf34c 100644
--- a/tests/coq/misc/Paper.v
+++ b/tests/coq/misc/Paper.v
@@ -96,14 +96,13 @@ Fixpoint sum (l : List_t i32) : result i32 :=
 (** [paper::test_nth]:
     Source: 'src/paper.rs', lines 68:0-68:17 *)
 Definition test_nth : result unit :=
-  let l := List_Nil in
-  let l1 := List_Cons 3%i32 l in
-  let l2 := List_Cons 2%i32 l1 in
-  p <- list_nth_mut i32 (List_Cons 1%i32 l2) 2%u32;
+  let l := List_Cons 3%i32 List_Nil in
+  let l1 := List_Cons 2%i32 l in
+  p <- list_nth_mut i32 (List_Cons 1%i32 l1) 2%u32;
   let (x, list_nth_mut_back) := p in
   x1 <- i32_add x 1%i32;
-  l3 <- list_nth_mut_back x1;
-  i <- sum l3;
+  l2 <- list_nth_mut_back x1;
+  i <- sum l2;
   if negb (i s= 7%i32) then Fail_ Failure else Return tt
 .
 
diff --git a/tests/coq/misc/PoloniusList.v b/tests/coq/misc/PoloniusList.v
index 7e967855..8f403a8e 100644
--- a/tests/coq/misc/PoloniusList.v
+++ b/tests/coq/misc/PoloniusList.v
@@ -27,9 +27,7 @@ Fixpoint get_list_at_x
   match ls with
   | List_Cons hd tl =>
     if hd s= x
-    then
-      let back_'a := fun (ret : List_t u32) => Return ret in
-      Return (List_Cons hd tl, back_'a)
+    then Return (List_Cons hd tl, Return)
     else (
       p <- get_list_at_x tl x;
       let (l, get_list_at_x_back) := p in
@@ -37,9 +35,7 @@ Fixpoint get_list_at_x
         fun (ret : List_t u32) =>
           tl1 <- get_list_at_x_back ret; Return (List_Cons hd tl1) in
       Return (l, back_'a))
-  | List_Nil =>
-    let back_'a := fun (ret : List_t u32) => Return ret in
-    Return (List_Nil, back_'a)
+  | List_Nil => Return (List_Nil, Return)
   end
 .
 
diff --git a/tests/coq/traits/Traits.v b/tests/coq/traits/Traits.v
index 7055e25d..7abf2021 100644
--- a/tests/coq/traits/Traits.v
+++ b/tests/coq/traits/Traits.v
@@ -334,7 +334,7 @@ Definition use_with_const_ty1
   (H : Type) (LEN : usize) (withConstTyHLENInst : WithConstTy_t H LEN) :
   result usize
   :=
-  let i := withConstTyHLENInst.(WithConstTy_tWithConstTy_t_LEN1) in Return i
+  Return withConstTyHLENInst.(WithConstTy_tWithConstTy_t_LEN1)
 .
 
 (** [traits::use_with_const_ty2]:
diff --git a/tests/fstar-split/betree/BetreeMain.Funs.fst b/tests/fstar-split/betree/BetreeMain.Funs.fst
index 6890488a..33133236 100644
--- a/tests/fstar-split/betree/BetreeMain.Funs.fst
+++ b/tests/fstar-split/betree/BetreeMain.Funs.fst
@@ -113,8 +113,7 @@ let rec betree_List_split_at
       let* i = u64_sub n 1 in
       let* p = betree_List_split_at t tl i in
       let (ls0, ls1) = p in
-      let l = ls0 in
-      Return (Betree_List_Cons hd l, ls1)
+      Return (Betree_List_Cons hd ls0, ls1)
     | Betree_List_Nil -> Fail Failure
     end
 
@@ -124,8 +123,7 @@ let rec betree_List_split_at
 let betree_List_push_front
   (t : Type0) (self : betree_List_t t) (x : t) : result (betree_List_t t) =
   let tl = core_mem_replace (betree_List_t t) self Betree_List_Nil in
-  let l = tl in
-  Return (Betree_List_Cons x l)
+  Return (Betree_List_Cons x tl)
 
 (** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]: forward function
     Source: 'src/betree.rs', lines 306:4-306:32 *)
@@ -178,8 +176,7 @@ let rec betree_ListTupleU64T_partition_at_pivot
     else
       let* p = betree_ListTupleU64T_partition_at_pivot t tl pivot in
       let (ls0, ls1) = p in
-      let l = ls0 in
-      Return (Betree_List_Cons (i, x) l, ls1)
+      Return (Betree_List_Cons (i, x) ls0, ls1)
   | Betree_List_Nil -> Return (Betree_List_Nil, Betree_List_Nil)
   end
 
@@ -871,13 +868,12 @@ let betree_Node_apply
   (new_msg : betree_Message_t) (st : state) :
   result (state & unit)
   =
-  let l = Betree_List_Nil in
   let* (st1, _) =
     betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
-      new_msg) l) st in
+      new_msg) Betree_List_Nil) st in
   let* _ =
     betree_Node_apply_messages_back self params node_id_cnt (Betree_List_Cons
-      (key, new_msg) l) st in
+      (key, new_msg) Betree_List_Nil) st in
   Return (st1, ())
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::apply]: backward function 0
@@ -888,9 +884,8 @@ let betree_Node_apply_back
   (new_msg : betree_Message_t) (st : state) :
   result (betree_Node_t & betree_NodeIdCounter_t)
   =
-  let l = Betree_List_Nil in
   betree_Node_apply_messages_back self params node_id_cnt (Betree_List_Cons
-    (key, new_msg) l) st
+    (key, new_msg) Betree_List_Nil) st
 
 (** [betree_main::betree::{betree_main::betree::BeTree#6}::new]: forward function
     Source: 'src/betree.rs', lines 849:4-849:60 *)
diff --git a/tests/fstar-split/hashmap/Hashmap.Funs.fst b/tests/fstar-split/hashmap/Hashmap.Funs.fst
index 79327183..290d49ee 100644
--- a/tests/fstar-split/hashmap/Hashmap.Funs.fst
+++ b/tests/fstar-split/hashmap/Hashmap.Funs.fst
@@ -41,8 +41,8 @@ let hashMap_new_with_capacity
   (max_load_divisor : usize) :
   result (hashMap_t t)
   =
-  let v = alloc_vec_Vec_new (list_t t) in
-  let* slots = hashMap_allocate_slots t v capacity in
+  let* slots = hashMap_allocate_slots t (alloc_vec_Vec_new (list_t t)) capacity
+    in
   let* i = usize_mul capacity max_load_dividend in
   let* i1 = usize_div i max_load_divisor in
   Return
@@ -124,7 +124,7 @@ let rec hashMap_insert_in_list_loop_back
     else
       let* tl1 = hashMap_insert_in_list_loop_back t key value tl in
       Return (List_Cons ckey cvalue tl1)
-  | List_Nil -> let l = List_Nil in Return (List_Cons key value l)
+  | List_Nil -> Return (List_Cons key value List_Nil)
   end
 
 (** [hashmap::{hashmap::HashMap<T>}::insert_in_list]: backward function 0
diff --git a/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst b/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst
index b2800e1e..2e2d54b8 100644
--- a/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst
+++ b/tests/fstar-split/hashmap_on_disk/HashmapMain.Funs.fst
@@ -43,8 +43,9 @@ let hashmap_HashMap_new_with_capacity
   (max_load_divisor : usize) :
   result (hashmap_HashMap_t t)
   =
-  let v = alloc_vec_Vec_new (hashmap_List_t t) in
-  let* slots = hashmap_HashMap_allocate_slots t v capacity in
+  let* slots =
+    hashmap_HashMap_allocate_slots t (alloc_vec_Vec_new (hashmap_List_t t))
+      capacity in
   let* i = usize_mul capacity max_load_dividend in
   let* i1 = usize_div i max_load_divisor in
   Return
@@ -128,8 +129,7 @@ let rec hashmap_HashMap_insert_in_list_loop_back
     else
       let* tl1 = hashmap_HashMap_insert_in_list_loop_back t key value tl in
       Return (Hashmap_List_Cons ckey cvalue tl1)
-  | Hashmap_List_Nil ->
-    let l = Hashmap_List_Nil in Return (Hashmap_List_Cons key value l)
+  | Hashmap_List_Nil -> Return (Hashmap_List_Cons key value Hashmap_List_Nil)
   end
 
 (** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]: backward function 0
diff --git a/tests/fstar-split/misc/External.Funs.fst b/tests/fstar-split/misc/External.Funs.fst
index 3b84697e..65382549 100644
--- a/tests/fstar-split/misc/External.Funs.fst
+++ b/tests/fstar-split/misc/External.Funs.fst
@@ -36,9 +36,7 @@ let test_new_non_zero_u32
 (** [external::test_vec]: forward function
     Source: 'src/external.rs', lines 17:0-17:17 *)
 let test_vec : result unit =
-  let v = alloc_vec_Vec_new u32 in
-  let* _ = alloc_vec_Vec_push u32 v 0 in
-  Return ()
+  let* _ = alloc_vec_Vec_push u32 (alloc_vec_Vec_new u32) 0 in Return ()
 
 (** Unit test for [external::test_vec] *)
 let _ = assert_norm (test_vec = Return ())
diff --git a/tests/fstar-split/misc/NoNestedBorrows.fst b/tests/fstar-split/misc/NoNestedBorrows.fst
index 41bb7a06..53e1d300 100644
--- a/tests/fstar-split/misc/NoNestedBorrows.fst
+++ b/tests/fstar-split/misc/NoNestedBorrows.fst
@@ -220,9 +220,8 @@ let _ = assert_norm (test_list1 = Return ())
 (** [no_nested_borrows::test_box1]: forward function
     Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 *)
 let test_box1 : result unit =
-  let b = 0 in
-  let* b1 = alloc_boxed_Box_deref_mut_back i32 b 1 in
-  let* x = alloc_boxed_Box_deref i32 b1 in
+  let* b = alloc_boxed_Box_deref_mut_back i32 0 1 in
+  let* x = alloc_boxed_Box_deref i32 b in
   if not (x = 1) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_box1] *)
@@ -262,8 +261,7 @@ let is_cons (t : Type0) (l : list_t t) : result bool =
 (** [no_nested_borrows::test_is_cons]: forward function
     Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 *)
 let test_is_cons : result unit =
-  let l = List_Nil in
-  let* b = is_cons i32 (List_Cons 0 l) in
+  let* b = is_cons i32 (List_Cons 0 List_Nil) in
   if not b then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_is_cons] *)
@@ -280,8 +278,7 @@ let split_list (t : Type0) (l : list_t t) : result (t & (list_t t)) =
 (** [no_nested_borrows::test_split_list]: forward function
     Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 *)
 let test_split_list : result unit =
-  let l = List_Nil in
-  let* p = split_list i32 (List_Cons 0 l) in
+  let* p = split_list i32 (List_Cons 0 List_Nil) in
   let (hd, _) = p in
   if not (hd = 0) then Fail Failure else Return ()
 
@@ -393,26 +390,25 @@ let list_rev (t : Type0) (l : list_t t) : result (list_t t) =
 (** [no_nested_borrows::test_list_functions]: forward function
     Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 *)
 let test_list_functions : result unit =
-  let l = List_Nil in
-  let l1 = List_Cons 2 l in
-  let l2 = List_Cons 1 l1 in
-  let* i = list_length i32 (List_Cons 0 l2) in
+  let l = List_Cons 2 List_Nil in
+  let l1 = List_Cons 1 l in
+  let* i = list_length i32 (List_Cons 0 l1) in
   if not (i = 3)
   then Fail Failure
   else
-    let* i1 = list_nth_shared i32 (List_Cons 0 l2) 0 in
+    let* i1 = list_nth_shared i32 (List_Cons 0 l1) 0 in
     if not (i1 = 0)
     then Fail Failure
     else
-      let* i2 = list_nth_shared i32 (List_Cons 0 l2) 1 in
+      let* i2 = list_nth_shared i32 (List_Cons 0 l1) 1 in
       if not (i2 = 1)
       then Fail Failure
       else
-        let* i3 = list_nth_shared i32 (List_Cons 0 l2) 2 in
+        let* i3 = list_nth_shared i32 (List_Cons 0 l1) 2 in
         if not (i3 = 2)
         then Fail Failure
         else
-          let* ls = list_nth_mut_back i32 (List_Cons 0 l2) 1 3 in
+          let* ls = list_nth_mut_back i32 (List_Cons 0 l1) 1 3 in
           let* i4 = list_nth_shared i32 ls 0 in
           if not (i4 = 0)
           then Fail Failure
diff --git a/tests/fstar-split/misc/Paper.fst b/tests/fstar-split/misc/Paper.fst
index 2dc804de..0c44d78b 100644
--- a/tests/fstar-split/misc/Paper.fst
+++ b/tests/fstar-split/misc/Paper.fst
@@ -87,13 +87,12 @@ let rec sum (l : list_t i32) : result i32 =
 (** [paper::test_nth]: forward function
     Source: 'src/paper.rs', lines 68:0-68:17 *)
 let test_nth : result unit =
-  let l = List_Nil in
-  let l1 = List_Cons 3 l in
-  let l2 = List_Cons 2 l1 in
-  let* x = list_nth_mut i32 (List_Cons 1 l2) 2 in
+  let l = List_Cons 3 List_Nil in
+  let l1 = List_Cons 2 l in
+  let* x = list_nth_mut i32 (List_Cons 1 l1) 2 in
   let* x1 = i32_add x 1 in
-  let* l3 = list_nth_mut_back i32 (List_Cons 1 l2) 2 x1 in
-  let* i = sum l3 in
+  let* l2 = list_nth_mut_back i32 (List_Cons 1 l1) 2 x1 in
+  let* i = sum l2 in
   if not (i = 7) then Fail Failure else Return ()
 
 (** Unit test for [paper::test_nth] *)
diff --git a/tests/fstar-split/traits/Traits.fst b/tests/fstar-split/traits/Traits.fst
index 29a001b2..d3847590 100644
--- a/tests/fstar-split/traits/Traits.fst
+++ b/tests/fstar-split/traits/Traits.fst
@@ -274,7 +274,7 @@ let use_with_const_ty1
   (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len) :
   result usize
   =
-  let i = withConstTyHLENInst.cLEN1 in Return i
+  Return withConstTyHLENInst.cLEN1
 
 (** [traits::use_with_const_ty2]: forward function
     Source: 'src/traits.rs', lines 187:0-187:73 *)
diff --git a/tests/fstar/array/Array.Funs.fst b/tests/fstar/array/Array.Funs.fst
index da4164bc..4193ba7d 100644
--- a/tests/fstar/array/Array.Funs.fst
+++ b/tests/fstar/array/Array.Funs.fst
@@ -24,8 +24,7 @@ let array_to_mut_slice_
   result ((slice t) & (slice t -> result (array t 32)))
   =
   let* (s1, to_slice_mut_back) = array_to_slice_mut t 32 s in
-  let back = fun ret -> to_slice_mut_back ret in
-  Return (s1, back)
+  Return (s1, to_slice_mut_back)
 
 (** [array::array_len]:
     Source: 'src/array.rs', lines 25:0-25:40 *)
@@ -64,8 +63,7 @@ let index_mut_array
   result (t & (t -> result (array t 32)))
   =
   let* (x, index_mut_back) = array_index_mut_usize t 32 s i in
-  let back = fun ret -> index_mut_back ret in
-  Return (x, back)
+  Return (x, index_mut_back)
 
 (** [array::index_slice]:
     Source: 'src/array.rs', lines 56:0-56:46 *)
@@ -79,8 +77,7 @@ let index_mut_slice
   result (t & (t -> result (slice t)))
   =
   let* (x, index_mut_back) = slice_index_mut_usize t s i in
-  let back = fun ret -> index_mut_back ret in
-  Return (x, back)
+  Return (x, index_mut_back)
 
 (** [array::slice_subslice_shared_]:
     Source: 'src/array.rs', lines 64:0-64:70 *)
@@ -100,8 +97,7 @@ let slice_subslice_mut_
     core_slice_index_Slice_index_mut u32 (core_ops_range_Range usize)
       (core_slice_index_SliceIndexRangeUsizeSliceTInst u32) x
       { start = y; end_ = z } in
-  let back = fun ret -> index_mut_back ret in
-  Return (s, back)
+  Return (s, index_mut_back)
 
 (** [array::array_to_slice_shared_]:
     Source: 'src/array.rs', lines 72:0-72:54 *)
@@ -115,8 +111,7 @@ let array_to_slice_mut_
   result ((slice u32) & (slice u32 -> result (array u32 32)))
   =
   let* (s, to_slice_mut_back) = array_to_slice_mut u32 32 x in
-  let back = fun ret -> to_slice_mut_back ret in
-  Return (s, back)
+  Return (s, to_slice_mut_back)
 
 (** [array::array_subslice_shared_]:
     Source: 'src/array.rs', lines 80:0-80:74 *)
@@ -138,8 +133,7 @@ let array_subslice_mut_
       (core_ops_index_IndexMutSliceTIInst u32 (core_ops_range_Range usize)
       (core_slice_index_SliceIndexRangeUsizeSliceTInst u32)) x
       { start = y; end_ = z } in
-  let back = fun ret -> index_mut_back ret in
-  Return (s, back)
+  Return (s, index_mut_back)
 
 (** [array::index_slice_0]:
     Source: 'src/array.rs', lines 88:0-88:38 *)
diff --git a/tests/fstar/betree/BetreeMain.Funs.fst b/tests/fstar/betree/BetreeMain.Funs.fst
index a3065f3d..196f120c 100644
--- a/tests/fstar/betree/BetreeMain.Funs.fst
+++ b/tests/fstar/betree/BetreeMain.Funs.fst
@@ -103,8 +103,7 @@ let rec betree_List_split_at
       let* i = u64_sub n 1 in
       let* p = betree_List_split_at t tl i in
       let (ls0, ls1) = p in
-      let l = ls0 in
-      Return (Betree_List_Cons hd l, ls1)
+      Return (Betree_List_Cons hd ls0, ls1)
     | Betree_List_Nil -> Fail Failure
     end
 
@@ -113,8 +112,7 @@ let rec betree_List_split_at
 let betree_List_push_front
   (t : Type0) (self : betree_List_t t) (x : t) : result (betree_List_t t) =
   let (tl, _) = core_mem_replace (betree_List_t t) self Betree_List_Nil in
-  let l = tl in
-  Return (Betree_List_Cons x l)
+  Return (Betree_List_Cons x tl)
 
 (** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
     Source: 'src/betree.rs', lines 306:4-306:32 *)
@@ -158,8 +156,7 @@ let rec betree_ListTupleU64T_partition_at_pivot
     else
       let* p = betree_ListTupleU64T_partition_at_pivot t tl pivot in
       let (ls0, ls1) = p in
-      let l = ls0 in
-      Return (Betree_List_Cons (i, x) l, ls1)
+      Return (Betree_List_Cons (i, x) ls0, ls1)
   | Betree_List_Nil -> Return (Betree_List_Nil, Betree_List_Nil)
   end
 
@@ -195,9 +192,7 @@ let rec betree_Node_lookup_first_message_for_key
   | Betree_List_Cons x next_msgs ->
     let (i, m) = x in
     if i >= key
-    then
-      let back_'a = fun ret -> Return ret in
-      Return (Betree_List_Cons (i, m) next_msgs, back_'a)
+    then Return (Betree_List_Cons (i, m) next_msgs, Return)
     else
       let* (l, lookup_first_message_for_key_back) =
         betree_Node_lookup_first_message_for_key key next_msgs in
@@ -206,8 +201,7 @@ let rec betree_Node_lookup_first_message_for_key
           let* next_msgs1 = lookup_first_message_for_key_back ret in
           Return (Betree_List_Cons (i, m) next_msgs1) in
       Return (l, back_'a)
-  | Betree_List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Return)
   end
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
@@ -362,11 +356,8 @@ let rec betree_Node_lookup_first_message_after_key
           let* next_msgs1 = lookup_first_message_after_key_back ret in
           Return (Betree_List_Cons (k, m) next_msgs1) in
       Return (l, back_'a)
-    else
-      let back_'a = fun ret -> Return ret in
-      Return (Betree_List_Cons (k, m) next_msgs, back_'a)
-  | Betree_List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
+    else Return (Betree_List_Cons (k, m) next_msgs, Return)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Return)
   end
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
@@ -455,9 +446,7 @@ let rec betree_Node_lookup_mut_in_bindings
   | Betree_List_Cons hd tl ->
     let (i, i1) = hd in
     if i >= key
-    then
-      let back_'a = fun ret -> Return ret in
-      Return (Betree_List_Cons (i, i1) tl, back_'a)
+    then Return (Betree_List_Cons (i, i1) tl, Return)
     else
       let* (l, lookup_mut_in_bindings_back) =
         betree_Node_lookup_mut_in_bindings key tl in
@@ -466,8 +455,7 @@ let rec betree_Node_lookup_mut_in_bindings
           let* tl1 = lookup_mut_in_bindings_back ret in
           Return (Betree_List_Cons (i, i1) tl1) in
       Return (l, back_'a)
-  | Betree_List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Return)
   end
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
@@ -608,10 +596,9 @@ let betree_Node_apply
   (new_msg : betree_Message_t) (st : state) :
   result (state & (betree_Node_t & betree_NodeIdCounter_t))
   =
-  let l = Betree_List_Nil in
   let* (st1, p) =
     betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
-      new_msg) l) st in
+      new_msg) Betree_List_Nil) st in
   let (self1, node_id_cnt1) = p in
   Return (st1, (self1, node_id_cnt1))
 
diff --git a/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst b/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
index a3065f3d..196f120c 100644
--- a/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
+++ b/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
@@ -103,8 +103,7 @@ let rec betree_List_split_at
       let* i = u64_sub n 1 in
       let* p = betree_List_split_at t tl i in
       let (ls0, ls1) = p in
-      let l = ls0 in
-      Return (Betree_List_Cons hd l, ls1)
+      Return (Betree_List_Cons hd ls0, ls1)
     | Betree_List_Nil -> Fail Failure
     end
 
@@ -113,8 +112,7 @@ let rec betree_List_split_at
 let betree_List_push_front
   (t : Type0) (self : betree_List_t t) (x : t) : result (betree_List_t t) =
   let (tl, _) = core_mem_replace (betree_List_t t) self Betree_List_Nil in
-  let l = tl in
-  Return (Betree_List_Cons x l)
+  Return (Betree_List_Cons x tl)
 
 (** [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
     Source: 'src/betree.rs', lines 306:4-306:32 *)
@@ -158,8 +156,7 @@ let rec betree_ListTupleU64T_partition_at_pivot
     else
       let* p = betree_ListTupleU64T_partition_at_pivot t tl pivot in
       let (ls0, ls1) = p in
-      let l = ls0 in
-      Return (Betree_List_Cons (i, x) l, ls1)
+      Return (Betree_List_Cons (i, x) ls0, ls1)
   | Betree_List_Nil -> Return (Betree_List_Nil, Betree_List_Nil)
   end
 
@@ -195,9 +192,7 @@ let rec betree_Node_lookup_first_message_for_key
   | Betree_List_Cons x next_msgs ->
     let (i, m) = x in
     if i >= key
-    then
-      let back_'a = fun ret -> Return ret in
-      Return (Betree_List_Cons (i, m) next_msgs, back_'a)
+    then Return (Betree_List_Cons (i, m) next_msgs, Return)
     else
       let* (l, lookup_first_message_for_key_back) =
         betree_Node_lookup_first_message_for_key key next_msgs in
@@ -206,8 +201,7 @@ let rec betree_Node_lookup_first_message_for_key
           let* next_msgs1 = lookup_first_message_for_key_back ret in
           Return (Betree_List_Cons (i, m) next_msgs1) in
       Return (l, back_'a)
-  | Betree_List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Return)
   end
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
@@ -362,11 +356,8 @@ let rec betree_Node_lookup_first_message_after_key
           let* next_msgs1 = lookup_first_message_after_key_back ret in
           Return (Betree_List_Cons (k, m) next_msgs1) in
       Return (l, back_'a)
-    else
-      let back_'a = fun ret -> Return ret in
-      Return (Betree_List_Cons (k, m) next_msgs, back_'a)
-  | Betree_List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
+    else Return (Betree_List_Cons (k, m) next_msgs, Return)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Return)
   end
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
@@ -455,9 +446,7 @@ let rec betree_Node_lookup_mut_in_bindings
   | Betree_List_Cons hd tl ->
     let (i, i1) = hd in
     if i >= key
-    then
-      let back_'a = fun ret -> Return ret in
-      Return (Betree_List_Cons (i, i1) tl, back_'a)
+    then Return (Betree_List_Cons (i, i1) tl, Return)
     else
       let* (l, lookup_mut_in_bindings_back) =
         betree_Node_lookup_mut_in_bindings key tl in
@@ -466,8 +455,7 @@ let rec betree_Node_lookup_mut_in_bindings
           let* tl1 = lookup_mut_in_bindings_back ret in
           Return (Betree_List_Cons (i, i1) tl1) in
       Return (l, back_'a)
-  | Betree_List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (Betree_List_Nil, back_'a)
+  | Betree_List_Nil -> Return (Betree_List_Nil, Return)
   end
 
 (** [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
@@ -608,10 +596,9 @@ let betree_Node_apply
   (new_msg : betree_Message_t) (st : state) :
   result (state & (betree_Node_t & betree_NodeIdCounter_t))
   =
-  let l = Betree_List_Nil in
   let* (st1, p) =
     betree_Node_apply_messages self params node_id_cnt (Betree_List_Cons (key,
-      new_msg) l) st in
+      new_msg) Betree_List_Nil) st in
   let (self1, node_id_cnt1) = p in
   Return (st1, (self1, node_id_cnt1))
 
diff --git a/tests/fstar/hashmap/Hashmap.Funs.fst b/tests/fstar/hashmap/Hashmap.Funs.fst
index 9fc5d8a0..447f9b49 100644
--- a/tests/fstar/hashmap/Hashmap.Funs.fst
+++ b/tests/fstar/hashmap/Hashmap.Funs.fst
@@ -41,8 +41,8 @@ let hashMap_new_with_capacity
   (max_load_divisor : usize) :
   result (hashMap_t t)
   =
-  let v = alloc_vec_Vec_new (list_t t) in
-  let* slots = hashMap_allocate_slots t v capacity in
+  let* slots = hashMap_allocate_slots t (alloc_vec_Vec_new (list_t t)) capacity
+    in
   let* i = usize_mul capacity max_load_dividend in
   let* i1 = usize_div i max_load_divisor in
   Return
@@ -101,7 +101,7 @@ let rec hashMap_insert_in_list_loop
     else
       let* (b, back) = hashMap_insert_in_list_loop t key value tl in
       Return (b, List_Cons ckey cvalue back)
-  | List_Nil -> let l = List_Nil in Return (true, List_Cons key value l)
+  | List_Nil -> Return (true, List_Cons key value List_Nil)
   end
 
 (** [hashmap::{hashmap::HashMap<T>}::insert_in_list]:
@@ -309,8 +309,7 @@ let hashMap_get_mut_in_list
   result (t & (t -> result (list_t t)))
   =
   let* (x, back_'a) = hashMap_get_mut_in_list_loop t ls key in
-  let back_'a1 = fun ret -> back_'a ret in
-  Return (x, back_'a1)
+  Return (x, back_'a)
 
 (** [hashmap::{hashmap::HashMap<T>}::get_mut]:
     Source: 'src/hashmap.rs', lines 257:4-257:67 *)
diff --git a/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst b/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
index 3a042678..b16dcada 100644
--- a/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
+++ b/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
@@ -42,8 +42,9 @@ let hashmap_HashMap_new_with_capacity
   (max_load_divisor : usize) :
   result (hashmap_HashMap_t t)
   =
-  let v = alloc_vec_Vec_new (hashmap_List_t t) in
-  let* slots = hashmap_HashMap_allocate_slots t v capacity in
+  let* slots =
+    hashmap_HashMap_allocate_slots t (alloc_vec_Vec_new (hashmap_List_t t))
+      capacity in
   let* i = usize_mul capacity max_load_dividend in
   let* i1 = usize_div i max_load_divisor in
   Return
@@ -106,7 +107,7 @@ let rec hashmap_HashMap_insert_in_list_loop
       let* (b, back) = hashmap_HashMap_insert_in_list_loop t key value tl in
       Return (b, Hashmap_List_Cons ckey cvalue back)
   | Hashmap_List_Nil ->
-    let l = Hashmap_List_Nil in Return (true, Hashmap_List_Cons key value l)
+    Return (true, Hashmap_List_Cons key value Hashmap_List_Nil)
   end
 
 (** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]:
@@ -324,8 +325,7 @@ let hashmap_HashMap_get_mut_in_list
   result (t & (t -> result (hashmap_List_t t)))
   =
   let* (x, back_'a) = hashmap_HashMap_get_mut_in_list_loop t ls key in
-  let back_'a1 = fun ret -> back_'a ret in
-  Return (x, back_'a1)
+  Return (x, back_'a)
 
 (** [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]:
     Source: 'src/hashmap.rs', lines 257:4-257:67 *)
diff --git a/tests/fstar/misc/External.Funs.fst b/tests/fstar/misc/External.Funs.fst
index bb1b9a64..6672b523 100644
--- a/tests/fstar/misc/External.Funs.fst
+++ b/tests/fstar/misc/External.Funs.fst
@@ -22,9 +22,7 @@ let test_new_non_zero_u32
 (** [external::test_vec]:
     Source: 'src/external.rs', lines 17:0-17:17 *)
 let test_vec : result unit =
-  let v = alloc_vec_Vec_new u32 in
-  let* _ = alloc_vec_Vec_push u32 v 0 in
-  Return ()
+  let* _ = alloc_vec_Vec_push u32 (alloc_vec_Vec_new u32) 0 in Return ()
 
 (** Unit test for [external::test_vec] *)
 let _ = assert_norm (test_vec = Return ())
diff --git a/tests/fstar/misc/NoNestedBorrows.fst b/tests/fstar/misc/NoNestedBorrows.fst
index 0fd0c1dc..ffcc32f3 100644
--- a/tests/fstar/misc/NoNestedBorrows.fst
+++ b/tests/fstar/misc/NoNestedBorrows.fst
@@ -220,10 +220,9 @@ let _ = assert_norm (test_list1 = Return ())
 (** [no_nested_borrows::test_box1]:
     Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 *)
 let test_box1 : result unit =
-  let b = 0 in
-  let* (_, deref_mut_back) = alloc_boxed_Box_deref_mut i32 b in
-  let* b1 = deref_mut_back 1 in
-  let* x = alloc_boxed_Box_deref i32 b1 in
+  let* (_, deref_mut_back) = alloc_boxed_Box_deref_mut i32 0 in
+  let* b = deref_mut_back 1 in
+  let* x = alloc_boxed_Box_deref i32 b in
   if not (x = 1) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_box1] *)
@@ -263,8 +262,7 @@ let is_cons (t : Type0) (l : list_t t) : result bool =
 (** [no_nested_borrows::test_is_cons]:
     Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 *)
 let test_is_cons : result unit =
-  let l = List_Nil in
-  let* b = is_cons i32 (List_Cons 0 l) in
+  let* b = is_cons i32 (List_Cons 0 List_Nil) in
   if not b then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_is_cons] *)
@@ -281,8 +279,7 @@ let split_list (t : Type0) (l : list_t t) : result (t & (list_t t)) =
 (** [no_nested_borrows::test_split_list]:
     Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 *)
 let test_split_list : result unit =
-  let l = List_Nil in
-  let* p = split_list i32 (List_Cons 0 l) in
+  let* p = split_list i32 (List_Cons 0 List_Nil) in
   let (hd, _) = p in
   if not (hd = 0) then Fail Failure else Return ()
 
@@ -388,26 +385,25 @@ let list_rev (t : Type0) (l : list_t t) : result (list_t t) =
 (** [no_nested_borrows::test_list_functions]:
     Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 *)
 let test_list_functions : result unit =
-  let l = List_Nil in
-  let l1 = List_Cons 2 l in
-  let l2 = List_Cons 1 l1 in
-  let* i = list_length i32 (List_Cons 0 l2) in
+  let l = List_Cons 2 List_Nil in
+  let l1 = List_Cons 1 l in
+  let* i = list_length i32 (List_Cons 0 l1) in
   if not (i = 3)
   then Fail Failure
   else
-    let* i1 = list_nth_shared i32 (List_Cons 0 l2) 0 in
+    let* i1 = list_nth_shared i32 (List_Cons 0 l1) 0 in
     if not (i1 = 0)
     then Fail Failure
     else
-      let* i2 = list_nth_shared i32 (List_Cons 0 l2) 1 in
+      let* i2 = list_nth_shared i32 (List_Cons 0 l1) 1 in
       if not (i2 = 1)
       then Fail Failure
       else
-        let* i3 = list_nth_shared i32 (List_Cons 0 l2) 2 in
+        let* i3 = list_nth_shared i32 (List_Cons 0 l1) 2 in
         if not (i3 = 2)
         then Fail Failure
         else
-          let* (_, list_nth_mut_back) = list_nth_mut i32 (List_Cons 0 l2) 1 in
+          let* (_, list_nth_mut_back) = list_nth_mut i32 (List_Cons 0 l1) 1 in
           let* ls = list_nth_mut_back 3 in
           let* i4 = list_nth_shared i32 ls 0 in
           if not (i4 = 0)
@@ -448,9 +444,7 @@ let id_mut_pair3
   (t1 t2 : Type0) (x : t1) (y : t2) :
   result ((t1 & t2) & (t1 -> result t1) & (t2 -> result t2))
   =
-  let back_'a = fun ret -> Return ret in
-  let back_'b = fun ret -> Return ret in
-  Return ((x, y), back_'a, back_'b)
+  Return ((x, y), Return, Return)
 
 (** [no_nested_borrows::id_mut_pair4]:
     Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 *)
@@ -458,10 +452,7 @@ let id_mut_pair4
   (t1 t2 : Type0) (p : (t1 & t2)) :
   result ((t1 & t2) & (t1 -> result t1) & (t2 -> result t2))
   =
-  let (x, x1) = p in
-  let back_'a = fun ret -> Return ret in
-  let back_'b = fun ret -> Return ret in
-  Return ((x, x1), back_'a, back_'b)
+  let (x, x1) = p in Return ((x, x1), Return, Return)
 
 (** [no_nested_borrows::StructWithTuple]
     Source: 'src/no_nested_borrows.rs', lines 433:0-433:34 *)
diff --git a/tests/fstar/misc/Paper.fst b/tests/fstar/misc/Paper.fst
index c6082929..cf4dc454 100644
--- a/tests/fstar/misc/Paper.fst
+++ b/tests/fstar/misc/Paper.fst
@@ -80,13 +80,12 @@ let rec sum (l : list_t i32) : result i32 =
 (** [paper::test_nth]:
     Source: 'src/paper.rs', lines 68:0-68:17 *)
 let test_nth : result unit =
-  let l = List_Nil in
-  let l1 = List_Cons 3 l in
-  let l2 = List_Cons 2 l1 in
-  let* (x, list_nth_mut_back) = list_nth_mut i32 (List_Cons 1 l2) 2 in
+  let l = List_Cons 3 List_Nil in
+  let l1 = List_Cons 2 l in
+  let* (x, list_nth_mut_back) = list_nth_mut i32 (List_Cons 1 l1) 2 in
   let* x1 = i32_add x 1 in
-  let* l3 = list_nth_mut_back x1 in
-  let* i = sum l3 in
+  let* l2 = list_nth_mut_back x1 in
+  let* i = sum l2 in
   if not (i = 7) then Fail Failure else Return ()
 
 (** Unit test for [paper::test_nth] *)
diff --git a/tests/fstar/misc/PoloniusList.fst b/tests/fstar/misc/PoloniusList.fst
index cbe7d6b8..b477802b 100644
--- a/tests/fstar/misc/PoloniusList.fst
+++ b/tests/fstar/misc/PoloniusList.fst
@@ -20,15 +20,13 @@ let rec get_list_at_x
   begin match ls with
   | List_Cons hd tl ->
     if hd = x
-    then
-      let back_'a = fun ret -> Return ret in Return (List_Cons hd tl, back_'a)
+    then Return (List_Cons hd tl, Return)
     else
       let* (l, get_list_at_x_back) = get_list_at_x tl x in
       let back_'a =
         fun ret ->
           let* tl1 = get_list_at_x_back ret in Return (List_Cons hd tl1) in
       Return (l, back_'a)
-  | List_Nil ->
-    let back_'a = fun ret -> Return ret in Return (List_Nil, back_'a)
+  | List_Nil -> Return (List_Nil, Return)
   end
 
diff --git a/tests/fstar/traits/Traits.fst b/tests/fstar/traits/Traits.fst
index 3543bd73..cb9c1654 100644
--- a/tests/fstar/traits/Traits.fst
+++ b/tests/fstar/traits/Traits.fst
@@ -273,7 +273,7 @@ let use_with_const_ty1
   (h : Type0) (len : usize) (withConstTyHLENInst : withConstTy_t h len) :
   result usize
   =
-  let i = withConstTyHLENInst.cLEN1 in Return i
+  Return withConstTyHLENInst.cLEN1
 
 (** [traits::use_with_const_ty2]:
     Source: 'src/traits.rs', lines 187:0-187:73 *)
diff --git a/tests/lean/Array.lean b/tests/lean/Array.lean
index 20f3425e..7785a208 100644
--- a/tests/lean/Array.lean
+++ b/tests/lean/Array.lean
@@ -30,8 +30,7 @@ def array_to_mut_slice_
   :=
   do
   let (s1, to_slice_mut_back) ← Array.to_slice_mut T 32#usize s
-  let back := fun ret => to_slice_mut_back ret
-  Result.ret (s1, back)
+  Result.ret (s1, to_slice_mut_back)
 
 /- [array::array_len]:
    Source: 'src/array.rs', lines 25:0-25:40 -/
@@ -79,8 +78,7 @@ def index_mut_array
   :=
   do
   let (t, index_mut_back) ← Array.index_mut_usize T 32#usize s i
-  let back := fun ret => index_mut_back ret
-  Result.ret (t, back)
+  Result.ret (t, index_mut_back)
 
 /- [array::index_slice]:
    Source: 'src/array.rs', lines 56:0-56:46 -/
@@ -95,8 +93,7 @@ def index_mut_slice
   :=
   do
   let (t, index_mut_back) ← Slice.index_mut_usize T s i
-  let back := fun ret => index_mut_back ret
-  Result.ret (t, back)
+  Result.ret (t, index_mut_back)
 
 /- [array::slice_subslice_shared_]:
    Source: 'src/array.rs', lines 64:0-64:70 -/
@@ -117,8 +114,7 @@ def slice_subslice_mut_
     core.slice.index.Slice.index_mut U32 (core.ops.range.Range Usize)
       (core.slice.index.SliceIndexRangeUsizeSliceTInst U32) x
       { start := y, end_ := z }
-  let back := fun ret => index_mut_back ret
-  Result.ret (s, back)
+  Result.ret (s, index_mut_back)
 
 /- [array::array_to_slice_shared_]:
    Source: 'src/array.rs', lines 72:0-72:54 -/
@@ -133,8 +129,7 @@ def array_to_slice_mut_
   :=
   do
   let (s, to_slice_mut_back) ← Array.to_slice_mut U32 32#usize x
-  let back := fun ret => to_slice_mut_back ret
-  Result.ret (s, back)
+  Result.ret (s, to_slice_mut_back)
 
 /- [array::array_subslice_shared_]:
    Source: 'src/array.rs', lines 80:0-80:74 -/
@@ -157,8 +152,7 @@ def array_subslice_mut_
       (core.ops.index.IndexMutSliceTIInst U32 (core.ops.range.Range Usize)
       (core.slice.index.SliceIndexRangeUsizeSliceTInst U32)) x
       { start := y, end_ := z }
-  let back := fun ret => index_mut_back ret
-  Result.ret (s, back)
+  Result.ret (s, index_mut_back)
 
 /- [array::index_slice_0]:
    Source: 'src/array.rs', lines 88:0-88:38 -/
diff --git a/tests/lean/BetreeMain/Funs.lean b/tests/lean/BetreeMain/Funs.lean
index 4e64d217..96daa197 100644
--- a/tests/lean/BetreeMain/Funs.lean
+++ b/tests/lean/BetreeMain/Funs.lean
@@ -107,8 +107,7 @@ divergent def betree.List.split_at
       let i ← n - 1#u64
       let p ← betree.List.split_at T tl i
       let (ls0, ls1) := p
-      let l := ls0
-      Result.ret (betree.List.Cons hd l, ls1)
+      Result.ret (betree.List.Cons hd ls0, ls1)
     | betree.List.Nil => Result.fail .panic
 
 /- [betree_main::betree::{betree_main::betree::List<T>#1}::push_front]:
@@ -116,8 +115,7 @@ divergent def betree.List.split_at
 def betree.List.push_front
   (T : Type) (self : betree.List T) (x : T) : Result (betree.List T) :=
   let (tl, _) := core.mem.replace (betree.List T) self betree.List.Nil
-  let l := tl
-  Result.ret (betree.List.Cons x l)
+  Result.ret (betree.List.Cons x tl)
 
 /- [betree_main::betree::{betree_main::betree::List<T>#1}::pop_front]:
    Source: 'src/betree.rs', lines 306:4-306:32 -/
@@ -159,8 +157,7 @@ divergent def betree.ListTupleU64T.partition_at_pivot
       do
       let p ← betree.ListTupleU64T.partition_at_pivot T tl pivot
       let (ls0, ls1) := p
-      let l := ls0
-      Result.ret (betree.List.Cons (i, t) l, ls1)
+      Result.ret (betree.List.Cons (i, t) ls0, ls1)
   | betree.List.Nil => Result.ret (betree.List.Nil, betree.List.Nil)
 
 /- [betree_main::betree::{betree_main::betree::Leaf#3}::split]:
@@ -194,9 +191,7 @@ divergent def betree.Node.lookup_first_message_for_key
   | betree.List.Cons x next_msgs =>
     let (i, m) := x
     if i >= key
-    then
-      let back_'a := fun ret => Result.ret ret
-      Result.ret (betree.List.Cons (i, m) next_msgs, back_'a)
+    then Result.ret (betree.List.Cons (i, m) next_msgs, Result.ret)
     else
       do
       let (l, lookup_first_message_for_key_back) ←
@@ -207,9 +202,7 @@ divergent def betree.Node.lookup_first_message_for_key
           let next_msgs1 ← lookup_first_message_for_key_back ret
           Result.ret (betree.List.Cons (i, m) next_msgs1)
       Result.ret (l, back_'a)
-  | betree.List.Nil =>
-    let back_'a := fun ret => Result.ret ret
-    Result.ret (betree.List.Nil, back_'a)
+  | betree.List.Nil => Result.ret (betree.List.Nil, Result.ret)
 
 /- [betree_main::betree::{betree_main::betree::Node#5}::lookup_in_bindings]:
    Source: 'src/betree.rs', lines 636:4-636:80 -/
@@ -381,12 +374,8 @@ divergent def betree.Node.lookup_first_message_after_key
           let next_msgs1 ← lookup_first_message_after_key_back ret
           Result.ret (betree.List.Cons (k, m) next_msgs1)
       Result.ret (l, back_'a)
-    else
-      let back_'a := fun ret => Result.ret ret
-      Result.ret (betree.List.Cons (k, m) next_msgs, back_'a)
-  | betree.List.Nil =>
-    let back_'a := fun ret => Result.ret ret
-    Result.ret (betree.List.Nil, back_'a)
+    else Result.ret (betree.List.Cons (k, m) next_msgs, Result.ret)
+  | betree.List.Nil => Result.ret (betree.List.Nil, Result.ret)
 
 /- [betree_main::betree::{betree_main::betree::Node#5}::apply_to_internal]:
    Source: 'src/betree.rs', lines 521:4-521:89 -/
@@ -478,9 +467,7 @@ divergent def betree.Node.lookup_mut_in_bindings
   | betree.List.Cons hd tl =>
     let (i, i1) := hd
     if i >= key
-    then
-      let back_'a := fun ret => Result.ret ret
-      Result.ret (betree.List.Cons (i, i1) tl, back_'a)
+    then Result.ret (betree.List.Cons (i, i1) tl, Result.ret)
     else
       do
       let (l, lookup_mut_in_bindings_back) ←
@@ -491,9 +478,7 @@ divergent def betree.Node.lookup_mut_in_bindings
           let tl1 ← lookup_mut_in_bindings_back ret
           Result.ret (betree.List.Cons (i, i1) tl1)
       Result.ret (l, back_'a)
-  | betree.List.Nil =>
-    let back_'a := fun ret => Result.ret ret
-    Result.ret (betree.List.Nil, back_'a)
+  | betree.List.Nil => Result.ret (betree.List.Nil, Result.ret)
 
 /- [betree_main::betree::{betree_main::betree::Node#5}::apply_to_leaf]:
    Source: 'src/betree.rs', lines 460:4-460:87 -/
@@ -650,10 +635,9 @@ def betree.Node.apply
   Result (State × (betree.Node × betree.NodeIdCounter))
   :=
   do
-  let l := betree.List.Nil
   let (st1, p) ←
     betree.Node.apply_messages self params node_id_cnt (betree.List.Cons (key,
-      new_msg) l) st
+      new_msg) betree.List.Nil) st
   let (self1, node_id_cnt1) := p
   Result.ret (st1, (self1, node_id_cnt1))
 
diff --git a/tests/lean/External/Funs.lean b/tests/lean/External/Funs.lean
index 88ced82d..db15aacc 100644
--- a/tests/lean/External/Funs.lean
+++ b/tests/lean/External/Funs.lean
@@ -25,8 +25,7 @@ def test_new_non_zero_u32
    Source: 'src/external.rs', lines 17:0-17:17 -/
 def test_vec : Result Unit :=
   do
-  let v := alloc.vec.Vec.new U32
-  let _ ← alloc.vec.Vec.push U32 v 0#u32
+  let _ ← alloc.vec.Vec.push U32 (alloc.vec.Vec.new U32) 0#u32
   Result.ret ()
 
 /- Unit test for [external::test_vec] -/
diff --git a/tests/lean/Hashmap/Funs.lean b/tests/lean/Hashmap/Funs.lean
index 32ed2b33..3978bfc7 100644
--- a/tests/lean/Hashmap/Funs.lean
+++ b/tests/lean/Hashmap/Funs.lean
@@ -41,8 +41,7 @@ def HashMap.new_with_capacity
   Result (HashMap T)
   :=
   do
-  let v := alloc.vec.Vec.new (List T)
-  let slots ← HashMap.allocate_slots T v capacity
+  let slots ← HashMap.allocate_slots T (alloc.vec.Vec.new (List T)) capacity
   let i ← capacity * max_load_dividend
   let i1 ← i / max_load_divisor
   Result.ret
@@ -102,8 +101,7 @@ divergent def HashMap.insert_in_list_loop
       do
       let (b, back) ← HashMap.insert_in_list_loop T key value tl
       Result.ret (b, List.Cons ckey cvalue back)
-  | List.Nil => let l := List.Nil
-                Result.ret (true, List.Cons key value l)
+  | List.Nil => Result.ret (true, List.Cons key value List.Nil)
 
 /- [hashmap::{hashmap::HashMap<T>}::insert_in_list]:
    Source: 'src/hashmap.rs', lines 97:4-97:71 -/
@@ -315,8 +313,7 @@ def HashMap.get_mut_in_list
   :=
   do
   let (t, back_'a) ← HashMap.get_mut_in_list_loop T ls key
-  let back_'a1 := fun ret => back_'a ret
-  Result.ret (t, back_'a1)
+  Result.ret (t, back_'a)
 
 /- [hashmap::{hashmap::HashMap<T>}::get_mut]:
    Source: 'src/hashmap.rs', lines 257:4-257:67 -/
diff --git a/tests/lean/HashmapMain/Funs.lean b/tests/lean/HashmapMain/Funs.lean
index 9bfb5070..ebed2570 100644
--- a/tests/lean/HashmapMain/Funs.lean
+++ b/tests/lean/HashmapMain/Funs.lean
@@ -42,8 +42,9 @@ def hashmap.HashMap.new_with_capacity
   Result (hashmap.HashMap T)
   :=
   do
-  let v := alloc.vec.Vec.new (hashmap.List T)
-  let slots ← hashmap.HashMap.allocate_slots T v capacity
+  let slots ←
+    hashmap.HashMap.allocate_slots T (alloc.vec.Vec.new (hashmap.List T))
+      capacity
   let i ← capacity * max_load_dividend
   let i1 ← i / max_load_divisor
   Result.ret
@@ -105,8 +106,7 @@ divergent def hashmap.HashMap.insert_in_list_loop
       let (b, back) ← hashmap.HashMap.insert_in_list_loop T key value tl
       Result.ret (b, hashmap.List.Cons ckey cvalue back)
   | hashmap.List.Nil =>
-    let l := hashmap.List.Nil
-    Result.ret (true, hashmap.List.Cons key value l)
+    Result.ret (true, hashmap.List.Cons key value hashmap.List.Nil)
 
 /- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::insert_in_list]:
    Source: 'src/hashmap.rs', lines 97:4-97:71 -/
@@ -328,8 +328,7 @@ def hashmap.HashMap.get_mut_in_list
   :=
   do
   let (t, back_'a) ← hashmap.HashMap.get_mut_in_list_loop T ls key
-  let back_'a1 := fun ret => back_'a ret
-  Result.ret (t, back_'a1)
+  Result.ret (t, back_'a)
 
 /- [hashmap_main::hashmap::{hashmap_main::hashmap::HashMap<T>}::get_mut]:
    Source: 'src/hashmap.rs', lines 257:4-257:67 -/
diff --git a/tests/lean/NoNestedBorrows.lean b/tests/lean/NoNestedBorrows.lean
index cb0aac10..0dd29429 100644
--- a/tests/lean/NoNestedBorrows.lean
+++ b/tests/lean/NoNestedBorrows.lean
@@ -244,10 +244,9 @@ def test_list1 : Result Unit :=
    Source: 'src/no_nested_borrows.rs', lines 208:0-208:18 -/
 def test_box1 : Result Unit :=
   do
-  let b := 0#i32
-  let (_, deref_mut_back) ← alloc.boxed.Box.deref_mut I32 b
-  let b1 ← deref_mut_back 1#i32
-  let x ← alloc.boxed.Box.deref I32 b1
+  let (_, deref_mut_back) ← alloc.boxed.Box.deref_mut I32 0#i32
+  let b ← deref_mut_back 1#i32
+  let x ← alloc.boxed.Box.deref I32 b
   if not (x = 1#i32)
   then Result.fail .panic
   else Result.ret ()
@@ -297,8 +296,7 @@ def is_cons (T : Type) (l : List T) : Result Bool :=
    Source: 'src/no_nested_borrows.rs', lines 253:0-253:21 -/
 def test_is_cons : Result Unit :=
   do
-  let l := List.Nil
-  let b ← is_cons I32 (List.Cons 0#i32 l)
+  let b ← is_cons I32 (List.Cons 0#i32 List.Nil)
   if not b
   then Result.fail .panic
   else Result.ret ()
@@ -317,8 +315,7 @@ def split_list (T : Type) (l : List T) : Result (T × (List T)) :=
    Source: 'src/no_nested_borrows.rs', lines 267:0-267:24 -/
 def test_split_list : Result Unit :=
   do
-  let l := List.Nil
-  let p ← split_list I32 (List.Cons 0#i32 l)
+  let p ← split_list I32 (List.Cons 0#i32 List.Nil)
   let (hd, _) := p
   if not (hd = 0#i32)
   then Result.fail .panic
@@ -441,31 +438,30 @@ def list_rev (T : Type) (l : List T) : Result (List T) :=
    Source: 'src/no_nested_borrows.rs', lines 398:0-398:28 -/
 def test_list_functions : Result Unit :=
   do
-  let l := List.Nil
-  let l1 := List.Cons 2#i32 l
-  let l2 := List.Cons 1#i32 l1
-  let i ← list_length I32 (List.Cons 0#i32 l2)
+  let l := List.Cons 2#i32 List.Nil
+  let l1 := List.Cons 1#i32 l
+  let i ← list_length I32 (List.Cons 0#i32 l1)
   if not (i = 3#u32)
   then Result.fail .panic
   else
     do
-    let i1 ← list_nth_shared I32 (List.Cons 0#i32 l2) 0#u32
+    let i1 ← list_nth_shared I32 (List.Cons 0#i32 l1) 0#u32
     if not (i1 = 0#i32)
     then Result.fail .panic
     else
       do
-      let i2 ← list_nth_shared I32 (List.Cons 0#i32 l2) 1#u32
+      let i2 ← list_nth_shared I32 (List.Cons 0#i32 l1) 1#u32
       if not (i2 = 1#i32)
       then Result.fail .panic
       else
         do
-        let i3 ← list_nth_shared I32 (List.Cons 0#i32 l2) 2#u32
+        let i3 ← list_nth_shared I32 (List.Cons 0#i32 l1) 2#u32
         if not (i3 = 2#i32)
         then Result.fail .panic
         else
           do
           let (_, list_nth_mut_back) ←
-            list_nth_mut I32 (List.Cons 0#i32 l2) 1#u32
+            list_nth_mut I32 (List.Cons 0#i32 l1) 1#u32
           let ls ← list_nth_mut_back 3#i32
           let i4 ← list_nth_shared I32 ls 0#u32
           if not (i4 = 0#i32)
@@ -512,9 +508,7 @@ def id_mut_pair3
   (T1 T2 : Type) (x : T1) (y : T2) :
   Result ((T1 × T2) × (T1 → Result T1) × (T2 → Result T2))
   :=
-  let back_'a := fun ret => Result.ret ret
-  let back_'b := fun ret => Result.ret ret
-  Result.ret ((x, y), back_'a, back_'b)
+  Result.ret ((x, y), Result.ret, Result.ret)
 
 /- [no_nested_borrows::id_mut_pair4]:
    Source: 'src/no_nested_borrows.rs', lines 426:0-426:92 -/
@@ -523,9 +517,7 @@ def id_mut_pair4
   Result ((T1 × T2) × (T1 → Result T1) × (T2 → Result T2))
   :=
   let (t, t1) := p
-  let back_'a := fun ret => Result.ret ret
-  let back_'b := fun ret => Result.ret ret
-  Result.ret ((t, t1), back_'a, back_'b)
+  Result.ret ((t, t1), Result.ret, Result.ret)
 
 /- [no_nested_borrows::StructWithTuple]
    Source: 'src/no_nested_borrows.rs', lines 433:0-433:34 -/
diff --git a/tests/lean/Paper.lean b/tests/lean/Paper.lean
index 015fec84..a35c8db0 100644
--- a/tests/lean/Paper.lean
+++ b/tests/lean/Paper.lean
@@ -95,13 +95,12 @@ divergent def sum (l : List I32) : Result I32 :=
    Source: 'src/paper.rs', lines 68:0-68:17 -/
 def test_nth : Result Unit :=
   do
-  let l := List.Nil
-  let l1 := List.Cons 3#i32 l
-  let l2 := List.Cons 2#i32 l1
-  let (x, list_nth_mut_back) ← list_nth_mut I32 (List.Cons 1#i32 l2) 2#u32
+  let l := List.Cons 3#i32 List.Nil
+  let l1 := List.Cons 2#i32 l
+  let (x, list_nth_mut_back) ← list_nth_mut I32 (List.Cons 1#i32 l1) 2#u32
   let x1 ← x + 1#i32
-  let l3 ← list_nth_mut_back x1
-  let i ← sum l3
+  let l2 ← list_nth_mut_back x1
+  let i ← sum l2
   if not (i = 7#i32)
   then Result.fail .panic
   else Result.ret ()
diff --git a/tests/lean/PoloniusList.lean b/tests/lean/PoloniusList.lean
index a485adbe..59c557a0 100644
--- a/tests/lean/PoloniusList.lean
+++ b/tests/lean/PoloniusList.lean
@@ -20,9 +20,7 @@ divergent def get_list_at_x
   match ls with
   | List.Cons hd tl =>
     if hd = x
-    then
-      let back_'a := fun ret => Result.ret ret
-      Result.ret (List.Cons hd tl, back_'a)
+    then Result.ret (List.Cons hd tl, Result.ret)
     else
       do
       let (l, get_list_at_x_back) ← get_list_at_x tl x
@@ -32,8 +30,6 @@ divergent def get_list_at_x
           let tl1 ← get_list_at_x_back ret
           Result.ret (List.Cons hd tl1)
       Result.ret (l, back_'a)
-  | List.Nil =>
-    let back_'a := fun ret => Result.ret ret
-    Result.ret (List.Nil, back_'a)
+  | List.Nil => Result.ret (List.Nil, Result.ret)
 
 end polonius_list
diff --git a/tests/lean/Traits.lean b/tests/lean/Traits.lean
index 63d07d85..35f9e5bf 100644
--- a/tests/lean/Traits.lean
+++ b/tests/lean/Traits.lean
@@ -288,8 +288,7 @@ def use_with_const_ty1
   (H : Type) (LEN : Usize) (WithConstTyHLENInst : WithConstTy H LEN) :
   Result Usize
   :=
-  let i := WithConstTyHLENInst.LEN1
-  Result.ret i
+  Result.ret WithConstTyHLENInst.LEN1
 
 /- [traits::use_with_const_ty2]:
    Source: 'src/traits.rs', lines 187:0-187:73 -/
-- 
cgit v1.2.3


From a52939b5119e2751570582533bf27828724c2e9f Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sat, 23 Dec 2023 01:18:37 +0100
Subject: Fix an issue when deconstructing tuples in Coq

---
 tests/coq/misc/Loops.v | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'tests')

diff --git a/tests/coq/misc/Loops.v b/tests/coq/misc/Loops.v
index cc76f359..af920d41 100644
--- a/tests/coq/misc/Loops.v
+++ b/tests/coq/misc/Loops.v
@@ -358,7 +358,7 @@ Fixpoint list_nth_mut_loop_pair_loop
         else (
           i1 <- u32_sub i 1%u32;
           t <- list_nth_mut_loop_pair_loop T n1 tl0 tl1 i1;
-          let (p, back_'a, back_'b) := t in
+          let '(p, back_'a, back_'b) := t in
           let back_'a1 :=
             fun (ret : T) => tl01 <- back_'a ret; Return (List_Cons x0 tl01) in
           let back_'b1 :=
@@ -378,7 +378,7 @@ Definition list_nth_mut_loop_pair
   result ((T * T) * (T -> result (List_t T)) * (T -> result (List_t T)))
   :=
   t <- list_nth_mut_loop_pair_loop T n ls0 ls1 i;
-  let (p, back_'a, back_'b) := t in
+  let '(p, back_'a, back_'b) := t in
   Return (p, back_'a, back_'b)
 .
 
-- 
cgit v1.2.3


From d178a184142ad5edd9735149ecba385f6721c3bf Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sat, 23 Dec 2023 01:20:48 +0100
Subject: Fix an issue in External_FunsExternal.v

---
 tests/coq/misc/External_FunsExternal.v | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

(limited to 'tests')

diff --git a/tests/coq/misc/External_FunsExternal.v b/tests/coq/misc/External_FunsExternal.v
index a8c5756a..e9655f57 100644
--- a/tests/coq/misc/External_FunsExternal.v
+++ b/tests/coq/misc/External_FunsExternal.v
@@ -10,22 +10,10 @@ Require Export External_Types.
 Include External_Types.
 Module External_FunsExternal.
 
-(** [core::mem::swap]: forward function
+(** [core::mem::swap]:
     Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap :
-  forall(T : Type), T -> T -> state -> result (state * unit)
-.
-
-(** [core::mem::swap]: backward function 0
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap_back0 :
-  forall(T : Type), T -> T -> state -> state -> result (state * T)
-.
-
-(** [core::mem::swap]: backward function 1
-    Source: '/rustc/d59363ad0b6391b7fc5bbb02c9ccf9300eef3753/library/core/src/mem/mod.rs', lines 726:0-726:42 *)
-Axiom core_mem_swap_back1 :
-  forall(T : Type), T -> T -> state -> state -> result (state * T)
+Definition core_mem_swap (T : Type) (x : T) (y : T) (s : state) :=
+  Return (s, (y, x))
 .
 
 (** [core::num::nonzero::{core::num::nonzero::NonZeroU32#14}::new]: forward function
-- 
cgit v1.2.3