\BOOKMARK [1][-]{section.1}{Introduction}{}% 1 \BOOKMARK [1][-]{section.2}{Preliminaries}{}% 2 \BOOKMARK [2][-]{subsection.2.1}{System Model}{section.2}% 3 \BOOKMARK [3][-]{subsubsection.2.1.1}{State and invariant}{subsection.2.1}% 4 \BOOKMARK [3][-]{subsubsection.2.1.2}{Operations}{subsection.2.1}% 5 \BOOKMARK [3][-]{subsubsection.2.1.3}{Updates}{subsection.2.1}% 6 \BOOKMARK [2][-]{subsection.2.2}{Properties and associated proof rules}{section.2}% 7 \BOOKMARK [3][-]{subsubsection.2.2.1}{Sequential safety}{subsection.2.2}% 8 \BOOKMARK [3][-]{subsubsection.2.2.2}{Convergence}{subsection.2.2}% 9 \BOOKMARK [3][-]{subsubsection.2.2.3}{Precondition stability}{subsection.2.2}% 10 \BOOKMARK [3][-]{subsubsection.2.2.4}{Mechanized verification}{subsection.2.2}% 11 \BOOKMARK [1][-]{section.3}{Sequential specification of a tree}{}% 12 \BOOKMARK [2][-]{subsection.3.1}{State}{section.3}% 13 \BOOKMARK [2][-]{subsection.3.2}{Invariant}{section.3}% 14 \BOOKMARK [2][-]{subsection.3.3}{Operations}{section.3}% 15 \BOOKMARK [2][-]{subsection.3.4}{Mechanized verification of the sequential specification}{section.3}% 16 \BOOKMARK [1][-]{section.4}{Concurrent tree specification}{}% 17 \BOOKMARK [2][-]{subsection.4.1}{Precondition stability}{section.4}% 18 \BOOKMARK [3][-]{subsubsection.4.1.1}{Stability of add operation}{subsection.4.1}% 19 \BOOKMARK [3][-]{subsubsection.4.1.2}{Stability of remove operation}{subsection.4.1}% 20 \BOOKMARK [3][-]{subsubsection.4.1.3}{Stability of move operation}{subsection.4.1}% 21 \BOOKMARK [2][-]{subsection.4.2}{Safety of concurrent moves}{section.4}% 22 \BOOKMARK [2][-]{subsection.4.3}{Convergence}{section.4}% 23 \BOOKMARK [2][-]{subsection.4.4}{Safe specification of a replicated tree}{section.4}% 24 \BOOKMARK [2][-]{subsection.4.5}{Mechanized verification of the concurrent specification}{section.4}% 25 \BOOKMARK [3][-]{subsubsection.4.5.1}{Provable concurrent execution}{subsection.4.5}% 26 \BOOKMARK [1][-]{section.5}{Evaluation}{}% 27 \BOOKMARK [1][-]{section.6}{Related work}{}% 28 \BOOKMARK [1][-]{section.7}{Discussion}{}% 29 \BOOKMARK [2][-]{subsubsection.7.0.1}{Moving from causal consistency to eventual consistency}{section.7}% 30 \BOOKMARK [3][-]{subsubsection.7.0.2}{Message overhead for conflict resolution}{subsubsection.7.0.1}% 31 \BOOKMARK [1][-]{section.8}{Conclusion}{}% 32