From mathcomp Require Import all_ssreflect.
Require Import edone preliminaries digraph sgraph mgraph set_tac.

Set Implicit Arguments.
Unset Strict Implicit.
Unset Printing Implicit Defensive.

Set Bullet Behavior "Strict Subproofs".

Graph Connectivty

In this file we prove Menger's Theorem and some of its most well-known and most-used corollaries. The proof follows Göring's "Short Proof of Menger's Theorem". The two most central notions in the proof are those of an AB-separator and an AB-connector.

Connectors, Separators, and Separations


Section SeparatorConnector.
Variables (G : diGraph).
Implicit Types (x y z u v : G) (A B S U V : {set G}).

There are two notions af separators used in the literature, "AB-separators" (i.e., sets disconnecting two not necessariliy disjoint sets of vertices) and "(vertex) separarors" (i.e., sets of vertices disconnecting a given graph).

Definition separator (A B S : {set G}) :=
  forall (a b : G) (p : Path a b), a \in A -> b \in B -> exists2 s, s \in S & s \in p.

Lemma separatorI A B S :
  (forall (a b : G) (p : Path a b), irred p -> a \in A -> b \in B -> exists2 s, s \in S & s \in p)
  -> separator A B S.
Proof.
  move => H a b p aA bB. case: (uncycle p) => p' sub_p Ip. case: (H _ _ p') => //.
  move => s sS /sub_p sp. by exists s.
Qed.

Definition separatorb (A B S : {set G}) :=
  [forall a in A, forall b in B, forall p : IPath a b, exists s in S, s \in p].

Lemma separatorP (A B S : {set G}) : reflect (separator A B S) (separatorb A B S).
Proof.
  rewrite /separatorb. apply: (iffP forall_inP) => [H|H a aA].
  - apply: separatorI => a b p Ip aA bB.
    move/(_ _ aA) : H => /forall_inP /(_ _ bB) /forallP /(_ (Sub p Ip)) /exists_inP [s sS in_p].
    by exists s.
  - apply/forall_inP => b bB. apply/forallP => [[p ?]]. apply/exists_inP.
    case: (H a b p) => // s S1 S2. by exists s.
Qed.

Lemma separatorPn (A B S : {set G}) :
  reflect (exists x y (p: IPath x y), [/\ x \in A, y \in B & [disjoint p & S]]) (~~ separatorb A B S).
Proof.
  rewrite negb_forall_in. apply: (iffP exists_inP).
  - case => x xA /forall_inPn [y] yB /forallPn [p] /exists_inPn H.
    exists x; exists y; exists p; split => //. apply/disjointP => z Z1 /H. by rewrite Z1.
  - case => x [y] [p] [aA yB /disjointP D]. exists x => //. apply/forall_inPn; exists y => //.
    apply/forallPn; exists p. apply/exists_inPn => z /D H. exact/negP.
Qed.

Lemma separator_cap A B S : separator A B S -> A :&: B \subset S.
Proof.
  move => sepS. apply/subsetP => x /setIP [xA xB].
  case: (sepS _ _ (idp x)) => // s in_S. by rewrite mem_idp => /eqP <-.
Qed.

Lemma separator_min A B S : separator A B S -> #|A :&: B| <= #|S|.
Proof. move/separator_cap. exact: subset_leq_card. Qed.

Definition separates x y U := [/\ x \notin U, y \notin U & forall p : Path x y, exists2 z, z \in p & z \in U].

Standard trick to show decidability: quantify only over irredundant paths
Definition separatesb x y U := [&& x \notin U, y \notin U & [forall p : IPath x y, exists z in p, z \in U]].

Lemma separatesI x y (U : {set G}) :
  [/\ x \notin U, y \notin U & forall p : Path x y, irred p -> exists2 z, z \in p & z \in U] -> separates x y U.
Proof.
  case => S1 S2 S3. split => // p. case: (uncycle p) => p' sub_p Ip'.
  case: (S3 _ Ip') => z Z1 Z2. exists z => //. exact: sub_p.
Qed.

Lemma separatesP x y U : reflect (separates x y U) (separatesb x y U).
Proof.
  apply: (iffP and3P) => [[? ? A]|[? ? A]].
  - apply: separatesI. split => // p Ip.
    move/forallP/(_ (Build_IPath Ip)) : A.
    case/exists_inP => z Z1 Z2. by exists z.
  - split => //. apply/forallP => p. by move/exists_inP : (A p).
Qed.
Arguments separatesP {x y U}.

Fact separatesNeq x y U : separates x y U -> x != y.
Proof.
  case => Hx _ Hp. apply: contraNN Hx => /eqP C. subst y. case: (Hp (idp x)).
  move => ?. by rewrite mem_idp => /eqP->.
Qed.

TOTHINK: conn_disjoint could also be expressed as x \in p i -> x \in p j -> i = j NOTE: Unlike the definition of Göring, we do not allow single edge paths inside A :&: B
Record connector (A B : {set G}) n (p : 'I_n -> pathS G) : Prop :=
  { conn_irred : forall i, irred (tagged (p i));
    conn_begin : forall i, [set x in p i] :&: A = [set fst (p i)];
    conn_end : forall i, [set x in p i] :&: B = [set lst (p i)];
    conn_disjoint : forall i j, i != j -> [set x in p i] :&: [set x in p j] = set0 }.

Section ConnectorTheory.
Variables (A B : {set G}) (n : nat) (p : 'I_n -> pathS G).
Hypothesis conn_p : connector A B p.

Lemma connector_fst i : fst (p i) \in A.
Proof.
  move/setP : (conn_begin conn_p i) => /(_ (fst (p i))).
  rewrite !inE eqxx. by case/andP.
Qed.

Lemma connector_lst i : lst (p i) \in B.
Proof.
  move/setP : (conn_end conn_p i) => /(_ (lst (p i))).
  rewrite !inE eqxx. by case/andP.
Qed.

Lemma connector_left i x : x \in p i -> x \in A -> x = fst (p i).
Proof.
  move => in_pi in_A. move/setP : (conn_begin conn_p i) => /(_ x).
  rewrite !inE in_pi in_A /=. by move/esym/eqP.
Qed.

Lemma connector_right i x : x \in p i -> x \in B -> x = lst (p i).
Proof.
  move => in_pi in_B. move/setP : (conn_end conn_p i) => /(_ x).
  rewrite !inE in_pi in_B /=. by move/esym/eqP.
Qed.

Lemma lst_idp i : lst (p i) \in A -> lst (p i) = fst (p i).
Proof.
  move => H. move/setP : (conn_begin conn_p i) => /(_ (lst (p i))).
  rewrite !inE H. by move/esym/eqP.
Qed.

Lemma fst_idp i : fst (p i) \in B -> fst (p i) = lst (p i).
Proof.
  move => H. move/setP : (conn_end conn_p i) => /(_ (fst (p i))).
  rewrite !inE H. by move/esym/eqP.
Qed.

Lemma connector_eq i j x : x \in p i -> x \in p j -> i = j.
Proof.
  move => Hi Hj. apply: contraTeq isT => /(conn_disjoint conn_p)/setP/(_ x).
  by rewrite !inE Hi Hj.
Qed.

Lemma fst_lst_eq i j : fst (p i) = lst (p j) -> i = j.
Proof.
  move => E. apply: (connector_eq (x := fst (p i))); first exact: fst_mem.
  by rewrite E lst_mem.
Qed.

Lemma fst_inj : injective (@fst G \o p).
Proof.
  apply/injectiveP.
  apply: wlog_neg => /injectivePn [i] [j] /(conn_disjoint conn_p)/setP S /= H.
  move/(_ (fst (p i))) : S. by rewrite !inE H fst_mem.
Qed.

Lemma lst_inj : injective (@lst G \o p).
Proof.
  apply/injectiveP.
  apply: wlog_neg => /injectivePn [i] [j] /(conn_disjoint conn_p)/setP S /= H.
  move/(_ (lst (p i))) : S. by rewrite !inE H lst_mem.
Qed.

End ConnectorTheory.

Lemma connector_extend A B n (p : 'I_n -> pathS G) x y i :
  x \notin \bigcup_i [set z in p i] -> fst (p i) = y -> x -- y -> x \notin B ->
  connector A B p -> exists q : 'I_n -> pathS G, connector (x |: (A :\ y)) B q.
Proof.
  move => Hx Hy xy xB conn_p.
  have xDy : x != y.
  { apply: contraNneq Hx => ->. apply/bigcupP; exists i => //. by rewrite inE -Hy fst_mem. }
  set A' := _ |: _.
  pose q (j : 'I_n) := if j == i then pcatS (PathS (edgep xy)) (p j) else p j.
  have Hj (j : 'I_n) u : j != i -> u \in tagged (p j) -> (u == y = false)*(u == x = false).
  { move => jDi u_pi. split.
    - apply: contra_eqF (conn_disjoint conn_p jDi) => /eqP ?; subst.
      apply/set0Pn; exists (fst (p i)). by rewrite !inE u_pi.
    - apply: contraNF Hx => /eqP <-. apply/bigcupP; exists j => //. by rewrite inE. }
  exists q. split.
  - move => j. rewrite /q /=.
    case: (altP (j =P i)) => [E|D]; last exact: (conn_irred conn_p).
    subst j. rewrite [p i]pathS_eta. subst y. rewrite pcatSE /= irred_edgeL.
    rewrite (conn_irred conn_p) andbT. apply: contraNN Hx => Hx.
    apply/bigcupP. exists i => //. by rewrite inE.
  - move => j. rewrite /q. case: (altP (j =P i)) => [E|D].
    + subst j. rewrite [p i]pathS_eta. subst y. rewrite pcatSE /=.
      apply/setP => u. rewrite [A']lock !inE -lock. apply/andP/idP.
      * rewrite !inE mem_edgep /=. case: (altP (u =P x)) => [-> //|/=].
        rewrite -/(fst (p i)). case: (altP (u =P fst (p i))) => [_ _ [_ ?] //|].
        rewrite /= -/(fst (p i)) => [H1 H2 [H3 H4]].
        by rewrite -(connector_left conn_p _ H4) ?eqxx in H1.
      * move/eqP->. by rewrite mem_edgep /= !inE eqxx.
    + rewrite -(conn_begin conn_p).
      apply/setP => u. rewrite !inE. case e: (u \in _) => //=. by rewrite !(Hj j) /=.
  - move => j. rewrite /q. case: (altP (j =P i)) => [E|D]; last exact: (conn_end conn_p).
    subst j. rewrite [p i]pathS_eta. subst y. rewrite pcatSE /= -/(lst _).
    apply/setP => u. rewrite -(conn_end conn_p i) !inE -mem_pcat. case uB : (u \in B) => //.
    rewrite !andbT. apply/edgeLP/idP => /=; last by right. case => [?|//].
    subst. by rewrite uB in xB.
  - move => j1 j2. rewrite /q.
    have jP j : i != j -> [set x0 in pcatS (PathS (edgep xy)) (p i)] :&: [set x0 in p j] = set0.
    { move => jDi. rewrite [p i]pathS_eta. subst y. rewrite pcatSE.
      apply: contra_eq (conn_disjoint conn_p jDi). case/set0Pn => u /setIP [].
      rewrite 2!inE /=. case/edgeLP => /= [-> Hx'|Hu ?].
      * apply: contraNN Hx => _. apply/bigcupP; exists j => //. by rewrite inE.
      * apply/set0Pn. exists u. by rewrite !inE Hu. }
    case: (altP (j1 =P i)); case: (altP (j2 =P i)).
    + move => -> -> . by rewrite eqxx.
    + rewrite eq_sym => Hj2 ->. exact: jP.
    + rewrite eq_sym setIC. move => -> Hj2 _. exact: jP.
    + move => _ _. exact: (conn_disjoint conn_p).
Qed.

Lemma connector_sep P A B n (p q : 'I_n -> pathS G) i j x :
  separator A B P -> connector A P p -> connector P B q ->
  x \in p i -> x \in q j -> (x \in P) (* * (lst (p i) = fst (q j)) *).
Proof.
  move => sep_P con_p con_q x_pi x_qj.
  case def_pi : (p i) => [[u v] /= pi].
  case def_qj : (q j) => [[u' v'] /= qj]. rewrite -!/(PathS _) in def_pi def_qj.
  have [x_pi' x_qj'] : x \in pi /\ x \in qj by rewrite def_pi def_qj in x_pi x_qj.
  have Ip : irred pi. { move: (conn_irred con_p i). by rewrite def_pi. }
  have Iq : irred qj. { move: (conn_irred con_q j). by rewrite def_qj. }
  case/(isplitP Ip) def_p : _ / x_pi' => {Ip} [p1 p2 Ip1 Ip2 Ip].
  case/(isplitP Iq) def_q : _ / x_qj' => {Iq} [q1 q2 Iq1 Iq2 Iq].
  case: (sep_P _ _ (pcat p1 q2)).
  - move: (connector_fst con_p i). by rewrite def_pi.
  - move: (connector_lst con_q j). by rewrite def_qj.
  - move => s in_P. rewrite inE. case/orP => [in_p1|in_q2].
    + suff ? : s = v by subst s; rewrite [v]Ip // inE in in_P.
      rewrite [s](connector_right con_p (i := i)) // def_pi //.
      change (s \in pi). by rewrite def_p inE in_p1.
    + suff ? : s = u' by subst s; rewrite [u']Iq // inE in in_P.
      rewrite [s](connector_left con_q (i := j)) // def_qj //.
      change (s \in qj). by rewrite def_q inE in_q2.
Qed.

Lemma connector_cat (P A B : {set G}) n (p q : 'I_n -> pathS G) :
  #|P| = n -> separator A B P ->
  connector A P p -> connector P B q ->
  exists (r : 'I_n -> pathS G), connector A B r.
Proof.
  move => card_P. subst n. move => sep_P con_p con_q.
  (* For every i, we can obtain some j such that p i and q j compose. *)
  have mtch i : { j | fst (q j) = lst (p i) }.
  { pose x := lst (p i).
    have Hx : x \in codom (@fst G \o q).
    { apply: (inj_card_onto_pred (P := mem P)).
      - exact: fst_inj con_q.
      - move => j. exact: connector_fst con_q _.
      - by rewrite card_ord.
      - exact: connector_lst con_p _. }
    exists (iinv Hx). rewrite -[fst _]/((@fst G \o q) (iinv Hx)). by rewrite f_iinv. }
  have mtch_inj : injective (fun i => sval (mtch i)).
  { move => i i' E. move: (svalP (mtch i')). rewrite -E (svalP (mtch i)).
    exact : (lst_inj con_p). }
  (* Compose matching paths *)
  pose pq i := pcatS (p i) (q (sval (mtch i))).
  (* Elimination lemma for pq to encapsulate dependent types reasoning *)
  have pqE i : exists j x y z (pi : Path x y) (qi : Path y z),
      [/\ p i = PathS pi, j = sval (mtch i), q j = PathS qi & pq i = PathS (pcat pi qi) ].
  { pose j := sval (mtch i).
    have jP := svalP (mtch i) : fst (q j) = lst (p i).
    exists j. exists (fst (p i)). exists (lst (p i)). exists (lst (q j)).
    exists (tagged (p i)). exists (castL jP (tagged (q j))). split => //.
    - by rewrite {1}[p i]pathS_eta.
    - rewrite {1}[q j]pathS_eta. move: (jP). rewrite -jP => jP'.
      by rewrite (eq_irrelevance jP' erefl).
    - rewrite /pq -/j. rewrite -pcatSE -pathS_eta. move: (jP). rewrite -jP => jP'.
      by rewrite (eq_irrelevance jP' erefl) /= -pathS_eta. }
  have sepP i j x : x \in p i -> x \in q j -> x \in P.
  { exact: connector_sep sep_P con_p con_q. }
  exists pq. split.
  - move => i. move: (pqE i) => [j] [x] [y] [z] [pi] [qj] [Ep Ej Eq ->] /=.
    apply: irred_catI => [u u_p u_q||].
    + have uP : u \in P. apply: (sepP i j u); rewrite ?Ep ?Eq //.
      move: (conn_end con_p i) => /setP/(_ u). rewrite Ep !inE /= u_p uP /=.
      by move/esym/eqP.
    + move: (conn_irred con_p i). by rewrite Ep.
    + move: (conn_irred con_q j). by rewrite Eq.
  - move => i. move: (pqE i) => [j] [x] [y] [z] [pi] [qj] [Ep Ej Eq ->] /=.
    apply/setP => u. rewrite !inE /=. apply/andP/eqP => [[/orP[u_pi|u_qj] uA]|->].
    + move/(_ i u): (connector_left con_p). rewrite Ep /= u_pi uA. by apply.
    + suff ? : u = y.
      { subst. suff: lst (p i) = fst (p i) by rewrite Ep.
        apply: (lst_idp con_p _). by rewrite !Ep. }
      (* y is the only element of P in qj, so if u != y, the uz-path avoids P *)
      have Iq : irred qj. move: (conn_irred con_q j). by rewrite Eq.
      case/(isplitP Iq) def_q : _ / u_qj => [q1 q2 _ _ I].
      have zB : z \in B. { move: (connector_lst con_q j). by rewrite Eq. }
      case: (sep_P _ _ q2) => // s sP in_q2.
      have ? : s = y.
      { by rewrite [s](connector_left con_q (i := j)) // Eq // def_q mem_pcat in_q2. }
      subst s. by rewrite [y]I // inE.
    + by rewrite inE /fst/= [x](_ : _ = fst (p i)) ?(connector_fst con_p) // Ep.
  - (* symmetric to the argument above *)
    move => i. move: (pqE i) => [j] [x] [y] [z] [pi] [qj] [Ep Ej Eq ->] /=.
    apply/setP => u. rewrite !inE /=. apply/andP/eqP => [[/orP[u_pi|u_qj] uB]|->].
    + have uz : u = y.
      { have Ip : irred pi. move: (conn_irred con_p i). by rewrite Ep.
        case/(isplitP Ip) def_p : _ / u_pi => [p1 p2 _ _ I].
        have xA : x \in A. { move: (connector_fst con_p i). by rewrite Ep. }
        case: (sep_P _ _ p1) => // s sP in_p1.
        have ? : s = y.
        { by rewrite [s](connector_right con_p (i := i)) // Ep // def_p mem_pcat in_p1. }
        subst s. by rewrite [y]I // inE. }
      subst u.
      suff: fst (q j) = lst (q j). by rewrite Eq.
      apply: (fst_idp con_q _). by rewrite Eq.
    + move/(_ j u): (connector_right con_q). rewrite Eq /= u_qj uB. by apply.
    + by rewrite inE /lst/= [z](_ : _ = lst (q j)) ?(connector_lst con_q) // Eq.
  - move => i j iDj.
    move: (pqE i) => [i2] [x] [y] [z] [pi] [qi2] [Ep Ei Eq ->] /=.
    move: (pqE j) => [j2] [x'] [y'] [z'] [pj] [qj2] [Ep' Ej Eq' ->] /=.
    apply/eqP. apply: wlog_neg. case/set0Pn => u. rewrite !inE => /andP[].
    case/orP => Hi; case/orP => Hj; case: notF.
    + move/setP/(_ u): (conn_disjoint con_p iDj). by rewrite Ep Ep' !inE Hi Hj.
    + have uP : u \in P.
      { apply: (@connector_sep P A B _ p q i j2 u) => //; by rewrite ?Ep ?Eq'. }
      have [? ?] : y' = u /\ y = u.
      { split.
        - by rewrite {1}[u](connector_left con_q (i := j2)) ?Eq'.
        - by rewrite {1}[u](connector_right con_p (i := i)) ?Ep. }
      subst y' y. apply: contraNT iDj => _. apply/eqP. apply: mtch_inj.
      rewrite -Ei -Ej. apply: (connector_eq con_q (x := u)); by rewrite ?Eq ?Eq' inE.
    + have uP : u \in P.
      { apply: (@connector_sep P A B _ p q j i2 u) => // ; by rewrite ?Ep' ?Eq. }
      have [? ?] : y' = u /\ y = u.
      { split.
        - by rewrite {1}[u](connector_right con_p (i := j)) ?Ep'.
        - by rewrite {1}[u](connector_left con_q (i := i2)) ?Eq. }
      subst y' y. apply: contraNT iDj => _. apply/eqP. apply: mtch_inj.
      rewrite -Ei -Ej. apply: (connector_eq con_q (x := u)); by rewrite ?Eq ?Eq' inE.
    + apply: contraNT iDj => _. apply/eqP. apply: mtch_inj. rewrite -Ei -Ej.
      apply: contraTeq isT => iDj.
      move/setP/(_ u): (conn_disjoint con_q iDj). by rewrite Eq Eq' !inE Hi Hj.
Qed.

Lemma trivial_connector A B : exists p : 'I_#|A :&: B| -> pathS G, connector A B p.
Proof.
  exists (fun i => PathS (idp (enum_val i))). split.
  - move => i /=. exact: irred_idp.
  - move => i /=. case/setIP : (enum_valP i) => iA iB. apply/setP => z.
    rewrite !inE /= mem_idp. case e: (_ == _) => //. by rewrite (eqP e).
  - move => i /=. case/setIP : (enum_valP i) => iA iB. apply/setP => z.
    rewrite !inE /= mem_idp. case e: (_ == _) => //. by rewrite (eqP e).
  - move => i j. apply: contraNeq => /set0Pn [x /setIP[]].
    by rewrite !inE /= !mem_idp => /eqP-> /eqP /enum_val_inj->.
Qed.

Lemma sub_connector A B n m (p : 'I_m -> pathS G) :
  n <= m -> connector A B p -> exists q : 'I_n -> pathS G, connector A B q.
Proof.
  move => n_leq_m conn_p. pose W := widen_ord n_leq_m. exists (fun i => p (W i)).
  case: conn_p => C1 C2 C3 C4. split => // i j. exact:(C4 (W i) (W j)).
Qed.

End SeparatorConnector.
Arguments separatesP {G x y U}.

Section VSeparator.
Variable (G : sgraph).
Implicit Types (x y z u v : G) (S U V : {set G}).

Fact separates0P x y : reflect (separates x y set0) (~~ connect edge_rel x y).
Proof.
  apply:(iffP idP) => [nconn_xy|].
  - rewrite /separates !inE. split => // p. by rewrite Path_connect in nconn_xy.
  - case => _ _ H. apply/negP. case/uPathP => p _. case: (H p) => z. by rewrite inE.
Qed.

TODO: this does not actually depend on G being simple
Lemma separatesNE x y (U : {set G}) :
  x \notin U -> y \notin U -> ~ separates x y U -> connect (restrict [predC U] edge_rel) x y.
Proof.
  move => xU yU /(introN separatesP). rewrite /separatesb xU yU !negb_and //= negb_forall.
  case: (altP (x =P y)) => [<-|xDy H]; first by rewrite connect0.
  apply/uPathRP => //. case/existsP : H => p Hp. exists p => //.
  by rewrite -disjoint_subset disjoint_exists.
Qed.

Definition vseparator U := exists x y, separates x y U.

Lemma vseparatorNE U x y : ~ vseparator U -> ~ separates x y U.
Proof. move => nsepU sepU. by apply nsepU; exists x; exists y. Qed.

Lemma svseparator_connected S :
  smallest vseparator S -> 0 < #|S| -> connected [set: G].
Proof.
  move => SS gt0 x y _ _.
  have: (connect (restrict [predC set0] sedge) x y).
  { apply (@separatesNE x y set0); rewrite ?inE => //. rewrite -(@cards0 G) in gt0.
    move: (below_smallest SS gt0). exact: vseparatorNE. }
  rewrite !restrictE //; intro; rewrite !inE //.
Qed.

vseparators do not make precises what the separated comonents are, i.e., a vseparator can disconnect the graph into more than two components. Hence, we also define separations, which make the separated sides explicit
Definition separation V1 V2 :=
  ((forall x, x \in V1 :|: V2) * (forall x1 x2, x1 \notin V2 -> x2 \notin V1 -> x1 -- x2 = false))%type.

Lemma sep_inR x V1 V2 : separation V1 V2 -> x \notin V1 -> x \in V2.
Proof. move => sepV. by case/setUP : (sepV.1 x) => ->. Qed.

Lemma sep_inL x V1 V2 : separation V1 V2 -> x \notin V2 -> x \in V1.
Proof. move => sepV. by case/setUP : (sepV.1 x) => ->. Qed.

Definition proper_separation V1 V2 := separation V1 V2 /\ exists x y, x \notin V2 /\ y \notin V1.

Lemma separate_nonadjacent x y : x != y -> ~~ x -- y -> proper_separation [set~ x] [set~ y].
Proof.
  move => xDy xNy. split; last by exists y; exists x; rewrite !inE !eqxx.
  split => [z | x1 x2].
  - rewrite !inE -negb_and. by apply: contraNN xDy => /andP[/eqP->/eqP->].
  - rewrite !inE !negbK sg_sym => /eqP-> /eqP->. by rewrite (negbTE xNy).
Qed.

Lemma separation_separates x y V1 V2:
  separation V1 V2 -> x \notin V2 -> y \notin V1 -> separates x y (V1 :&: V2).
Proof.
  move => sepV Hx Hy. split; rewrite ?inE ?negb_and ?Hx ?Hy //.
  move => p.
  case: (@split_at_first G (mem V2) x y p y) => // ; rewrite ?(sep_inR sepV) //.
  move => z [p1 [p2 [H1 H2 H3]]]. rewrite inE in H2.
  exists z; rewrite ?H1 !inE ?H2 // andbT.
  case: (@splitR G x z p1) => [|z0 [p1' [z0z H4]]].
  { by apply: contraTneq H2 => <-. }
  apply: contraTT (z0z) => Hz1. rewrite sepV ?inE //.
  apply: contraTN (z0z) => H0. by rewrite [z0]H3 ?sgP // H4 !inE.
Qed.

Lemma proper_vseparator V1 V2 :
  proper_separation V1 V2 -> vseparator (V1 :&: V2).
Proof.
  case => Hsep [x] [y] [Hx Hy]. exists x. exists y. exact: separation_separates.
Qed.

Lemma vseparator_separation S :
  vseparator S -> exists V1 V2, proper_separation V1 V2 /\ S = V1 :&: V2.
Proof.
  case => x1 [x2] [S1 S2 P12].
  set U := locked [set x | connect (restrict [predC S] sedge) x1 x].
  set V1 := U :|: S. set V2 := ~: U. exists V1; exists V2.
  have D : x1 != x2.
  { apply/negP => /eqP A. subst x2. case: (P12 (idp x1)) => ?.
    rewrite mem_idp => /eqP-> ?. contrab. }
  have HU x : x \in U -> x \notin S.
  { rewrite /U -lock inE srestrict_sym. case/connectP => [[/= _ <- //|/= y p]].
    rewrite inE /=. by case: (x \in S). }
  split; first split; first split.
  - move => x. rewrite !inE. by case: (x \in U).
  - move => u v. rewrite !inE !(negb_or,negb_and,negbK) => [Hu] /andP [Hv1 Hv2].
    apply: contraNF Hv1 => uv. move: (Hu). rewrite /U -lock !inE => H.
    apply: connect_trans H _. apply: connect1. by rewrite /= !inE HU.
  - exists x1; exists x2; split.
    + suff H: (x1 \in U) by rewrite !inE H.
      by rewrite /U -lock inE connect0.
    + rewrite !inE negb_or S2 (_ : x2 \notin U = true) //.
      apply: contraTN isT. rewrite /U -lock inE => /uPathRP.
      case => [//|p Ip /subsetP subS].
      case: (P12 p) => z /subS. rewrite inE /= => *. contrab.
  - apply/setP => x. rewrite !inE. case E: (x \in U) => //=.
    by rewrite (negbTE (HU _ _)).
Qed.

Definition vseparatorb U := [exists x, exists y, separatesb x y U].

Lemma vseparatorP U : reflect (vseparator U) (vseparatorb U).
Proof. rewrite /vseparator /vseparatorb.
  apply: (iffP existsP).
  - move => [x /existsP [y /separatesP H]]. exists x; exists y; done.
  - move => [x [y H]]. exists x. apply /existsP. exists y. by apply /separatesP.
Qed.

Lemma minimal_separation x y : x != y -> ~~ x -- y ->
  exists V1 V2, proper_separation V1 V2 /\ smallest vseparator (V1 :&: V2).
Proof.
  move => xDy xNy.
  move/proper_vseparator/vseparatorP : (separate_nonadjacent xDy xNy) => sep.
  case (ex_smallest (fun S => #|S|) sep) => U /vseparatorP sepU HU {sep xDy xNy}.
  move: (vseparator_separation sepU) => [V1 [V2 [ps UV]]].
  exists V1; exists V2. repeat split => //; rewrite -UV // => V /vseparatorP. exact: HU.
Qed.

Lemma separation_sym V1 V2 : separation V1 V2 <-> separation V2 V1.
Proof.
  wlog suff W : V1 V2 / separation V1 V2 -> separation V2 V1. { split; exact: W. }
  move => sepV. split => [x|x1 x2 A B]; by rewrite 1?setUC 1?sgP sepV.
Qed.

Lemma proper_separation_symmetry V1 V2 :
  proper_separation V1 V2 <-> proper_separation V2 V1.
Proof. rewrite /proper_separation separation_sym. by firstorder. Qed.

Lemma svseparator_neighbours V1 V2 s :
  proper_separation V1 V2 -> smallest vseparator (V1 :&: V2) ->
  s \in V1 :&: V2 -> exists x1 x2, [/\ x1 \notin V2, x2 \notin V1, s -- x1 & s -- x2].
Proof.
  wlog: V1 V2 / [forall x1, (x1 \notin V2) ==> ~~ s -- x1].
  { move => H ps ss sS.
    case (boolP [forall x1, (x1 \notin V2) ==> ~~ s -- x1]).
    - move => HH. apply (H V1 V2) => //.
    - move => /forall_inPn [x1 x1V /negPn sx1].
      case (boolP [forall x, (x \notin V1) ==> ~~ s -- x]).
      + move => HH. rewrite setIC in sS ss. case (H V2 V1) => //.
        * by apply proper_separation_symmetry.
        * move => y [z [? ? ? ?]]. exists z; exists y. split; done.
      + move => /forall_inPn [x2 x2V sx2].
        exists x1; exists x2. split => //; by apply negbNE. }
  move => /forall_inP Hwlog [sepV [x1] [x2] [x1V12 x2V21]] smallS sS.
  pose S' := V1 :&: V2:\ s.
  suff: vseparator S'.
  - move => sS'. case: (below_smallest (V := S') smallS) => //.
    by rewrite /S' (cardsD1 s (V1 :&: V2)) sS.
  - (* cant use vseparator S, because the two vertices could be both in V2 *)
    exists x1; exists x2. split; try by rewrite /S' notinD.
    + move => p.
      case: (@split_at_first G (mem V2) x1 x2 p x2) => //.
      { by rewrite (sep_inR sepV x2V21). }
      move => z [p1 [p2 [H1 H2 H3]]]. rewrite inE in H2.
      exists z; first by rewrite H1 !inE.
      case: (@splitR G x1 z p1).
      { apply: contraTN isT => /eqP ?. subst x1; contrab. }
      move => z0 [p' [z0z Hp']].
      have z0V1: z0 \notin V2.
      { apply: contraTN (z0z) => ?. by rewrite [z0]H3 ?sgP // Hp' !inE. }
      rewrite !inE H2 andbT. apply/andP; split.
      * apply: contraTN (z0z) => /eqP->. by rewrite sgP Hwlog.
      * apply: contraTT (z0z) => ?. by rewrite sepV.
Qed.

Note: This generalizes the corresponding lemma on checkpoints
Lemma avoid_nonseperator U x y : ~ vseparator U -> x \notin U -> y \notin U ->
  exists2 p : Path x y, irred p & [disjoint p & U].
Proof.
  move => nsep_u xU yU.
  case: (altP (x =P y)) => [?|A];first subst y.
  - exists (idp x); first exact: irred_idp.
    rewrite (@eq_disjoint1 _ x) // => y. by rewrite mem_idp.
  - have/separatesNE/uPathRP : ~ separates x y U by apply vseparatorNE.
    case => // p irr_p. rewrite -disjoint_subset. by exists p.
Qed.

Lemma svseparator_uniq x y S:
  smallest vseparator S -> separates x y S -> S != set0 ->
  exists2 p : Path x y, irred p & exists! z, z \in p /\ z \in S.
Proof.
  (* Since S != set0G is connected. Assume every path needs to
  visit at least two distinct vertices fro S. Thus, there exists a
  vertex in S, say s, such that every xy-path through s must
  vist another node. Then S :\ s separates x and y,
  contradiction. *)

Abort.

Lemma separation_connected_same_component V1 V2:
  separation V1 V2 -> forall x0 x, x0 \notin V2 ->
  connect (restrict [predC (V1:&:V2)] sedge) x0 x -> x \notin V2.
Proof.
  set S := V1 :&: V2.
  move => sepV x0 x x0NV2.
  case: (boolP (x0==x)) => [/eqP ? | x0x]; first by subst x0.
  move => /(PathRP x0x) [p /subsetP Hp].
  case: (boolP(x \in V2)) => // xV2.
  case: (@split_at_first G (mem V2) x0 x p x) => //.
    move => z [p1 [p2 [H1 H2 H3]]]. rewrite inE /= in H2.
  case: (altP (x0 =P z)) => ?; first by subst x0; contrab.
  case: (@splitR G x0 z p1) => [|z0 [p1' [z0z H4]]] //.
  apply: contraTT (z0z) => _. rewrite sepV //.
  + apply: contraTN (z0z) => z0V2. by rewrite [z0]H3 ?sgP // H4 !inE.
  + have ? : (z \notin S) by apply: Hp; rewrite H1 !inE. by subst S; set_tac.
Qed.

End VSeparator.

Arguments separator : clear implicits.
Arguments separatorb : clear implicits.

Lemma connector_nodes (T : finType) (e1 e2 : rel T) (A B : {set T}) :
  forall s (p : 'I_s -> pathS (DiGraph e1)) (q : 'I_s -> pathS (DiGraph e2)),
  (forall i, nodes (tagged (p i)) = nodes (tagged (q i)) :> seq T) ->
  @connector (DiGraph e1) A B s p -> @connector (DiGraph e2) A B s q.
Proof.
  set G1 := DiGraph e1. set G2 := DiGraph e2.
  move => s p q Epq [C1 C2 C3 C4].
  have Spq : forall i, [set x in p i] = [set x in q i].
  { move => i. apply/setP => z. by rewrite !inE !mem_path Epq. }
  split.
  - move => i /=. rewrite irredE -Epq -(@irredE G1). exact: C1.
  - move => i /=. rewrite -Spq C2. f_equal.
    move: (Epq i). case: (p i) => [[x y] pi]. case: (q i) => [[x' y'] qi].
    rewrite /fst /=. rewrite !nodesE. by case.
  - move => i /=. rewrite -Spq C3. f_equal.
    move: (Epq i). case: (p i) => [[x y] pi]. case: (q i) => [[x' y'] qi].
    rewrite /lst /= in pi qi *. rewrite !nodesE => [[E1 E2]].
    by rewrite -(path_last pi) -(path_last qi) /= E2 E1.
  - move => i j /C4. by rewrite -!Spq.
Qed.

Lemma del_edge_connector (G : diGraph) (a b : G) (A B : {set G}) s (p : 'I_s -> pathS (del_edge a b)) :
  @connector (del_edge a b) A B s p -> connector A B (fun i : 'I_s => del_edge_liftS (p i)).
Proof.
  destruct G. apply: connector_nodes => i.
  case: (p i) => [[x y] pi] /=. by rewrite !nodesE.
Qed.

Menger's Theorem


Theorem Menger (G : diGraph) (A B : {set G}) s :
  (forall S, separator G A B S -> s <= #|S|) -> exists (p : 'I_s -> pathS G), connector A B p.
Proof.
  move: G s A B. apply: (nat_size_ind (f := num_edges)) => G IH s A B min_s.
  case: (boolP [exists x : G, exists y : G, x -- y]) => [E|E0]; last first.
  - suff Hs : s <= #|A :&: B|.
    { case: (trivial_connector A B) => p. exact: sub_connector. }
    apply: min_s. apply: separatorI => a b p aA bB. case: (altP (a =P b)) => [?|aDb].
    + subst b. exists a => //. by set_tac.
    + move/existsPn : E0 => /(_ a). case: (splitL p aDb) => x [ax] _.
      move/existsPn => /(_ x). by rewrite ax.
  - case/existsP : E => x /existsP [y xy].
    pose G' := del_edge x y.
    have HG' : num_edges G' < num_edges G by exact: card_del_edge.
    move/(_ _ HG' s) in IH.
    case: (boolP [exists S : {set G'}, separatorb G' A B S && (#|S| < s)]); last first.
    { move/exists_inPn => Hs. case: (IH A B) => [S sepS|p conn_p].
      - rewrite leqNgt Hs //. exact/separatorP.
      - exists (fun i : 'I_s => del_edge_liftS (p i)). exact: del_edge_connector. }
    case/exists_inP => S /separatorP sepS ltn_s.
    pose P := x |: S.
    have xP : x \in P by rewrite /P; set_tac.
    pose Q := y |: S.
    have yQ : y \in Q by rewrite /Q; set_tac.
    have [sep_G_P sep_G_Q] : separator G A B P /\ separator G A B Q.
    { have Hp (a b : G) (p : Path a b) :
        irred p -> a \in A -> b \in B -> (x \in p /\ y \in p) \/ exists2 s, s \in S & s \in p.
      { move => Ip aA bB. case: (del_edge_path_case x y Ip).
        - move => [p1] [p2] [H1 H2 H3]. left.
          rewrite !mem_path H1 !mem_cat. by rewrite -!(@mem_path G') !inE.
        - move => [p1 Ep]. right. case/sepS : (p1) => // z Z1 Z2. exists z => //.
          by rewrite (@mem_path G) Ep -(@mem_path G'). }
      split; apply: separatorI => a b p Ip aA bB.
      all: case: (Hp _ _ _ Ip aA bB) => [[xp yp]|[s0 in_S in_p]].
      all: solve [by exists x | by exists y | exists s0; rewrite /P /Q; set_tac]. }
    have lift_AP T : separator G' A P T -> separator G A B T.
    { move => sepT. apply/separatorI => a b p Ip aA bB.
      case: (del_edge_path_case x y Ip).
      - move => [p1] [p2] [E Nx Ny]. case/sepT : (p1) => // t T1 T2.
        exists t => //. by rewrite mem_path E mem_cat -(@mem_path G') T2.
      - case. case => p' Ip' /= E. case/sep_G_P : (p) => // z zP zp.
        have zp' : z \in p' by rewrite (@mem_path G') -E -(@mem_path G).
        case: (split_at_first (D := G') zP zp') => u [p1] [p2] [E' uP ?].
        case/sepT : (p1) => // t tT tp1. exists t => //.
        by rewrite mem_path E -(@mem_path G') E' mem_pcat tp1. }
    have lift_QB T : separator G' Q B T -> separator G A B T.
    { (* same as above -- generalize? *)
      move => sepT. apply/separatorI => a b p Ip aA bB.
      case/sep_G_Q : (p) => // z zP zp. case: (del_edge_path_case x y Ip).
      - move => [p1] [p2] [E Nx Ny]. case/sepT : (p2) => // t T1 T2.
        exists t => //. by rewrite mem_path E mem_cat -(@mem_path G') T2.
      - case. case => p' Ip' /= E.
        have zp' : z \in p' by rewrite (@mem_path G') -E -(@mem_path G).
        case: (split_at_first (D := G') zP zp') => u [p1] [p2] [E' uP ?].
        case/sepT : (p2) => // t tT tp1. exists t => //.
        by rewrite mem_path E -(@mem_path G') E' mem_pcat tp1. }
    have size_AP T : separator G' A P T -> s <= #|T|. move/lift_AP. exact: min_s.
    have size_QB T : separator G' Q B T -> s <= #|T|. move/lift_QB. exact: min_s.
    have card_S u : separator G A B (u |: S) -> u \notin S /\ s = #|u |: S|.
    { move => HS.
      have Hu : u \notin S.
      { apply: contraTN ltn_s => uS. by rewrite -leqNgt min_s // -(setU1_mem uS). }
      split => //. apply: esym. apply/eqP.
      by rewrite eqn_leq min_s // andbT cardsU1 Hu /= add1n. }
    case: (IH _ _ size_AP) => X (* /del_edge_connector *) conn_X.
    case: (IH _ _ size_QB) => Y (* /del_edge_connector *) conn_Y.
    have [i Hi] : exists j, lst (X j) = x.
    { suff : x \in codom (fun j => lst (X j)) by case/mapP => j _ ->; exists j.
      apply: inj_card_onto_pred xP.
      - exact: lst_inj conn_X.
      - exact: connector_lst conn_X.
      - rewrite card_ord. by apply card_S. }
    have xB : x \notin B.
    { move: (connector_fst conn_X i) => HA.
      move: (conn_end conn_X i). rewrite Hi => HP.
      case: (card_S _ sep_G_P) => xS _. apply: contraNN xS => xB.
      have [u U1 U2] : exists2 u, u \in S & u \in X i.
      { rewrite -Hi in xB. case: (X i) HA xB => [[a b] /= p]. exact: sepS. }
      move/setP/(_ u)/esym : HP. by rewrite !inE U1 U2 orbT /= => /eqP <-. }
    move/del_edge_connector : (conn_X) => conn_X'.
    move/del_edge_connector : (conn_Y) => conn_Y'.
    case: (altP (x =P y)) => [?|xDy].
    { subst y. apply: connector_cat conn_X' conn_Y' => //. by apply esym,card_S. }
    have [j jP] : exists i : 'I_s, fst (Y i) = y :> G.
    { suff : y \in codom (fun j => fst (Y j)) by case/mapP => j _ ->; exists j.
      apply: inj_card_onto_pred (_ : y \in Q).
      - exact: fst_inj conn_Y.
      - exact: connector_fst conn_Y.
      - rewrite card_ord. by apply card_S.
      - by rewrite !inE eqxx. }
    case: (connector_extend (G := G) (i := j) _ _ xy xB conn_Y') => //.
    + move => {j jP}.
      apply/negP => /bigcupP [j] _. rewrite inE mem_del_edge_liftS => xYj.
      case EYj : (Y j) => [[u v] /= p]. rewrite -/(PathS p) in EYj.
      have Ip : irred p. { move: (conn_irred conn_Y j). by rewrite EYj. }
      have xp : x \in p by rewrite EYj in xYj.
      case/(isplitP Ip) def_p : _ / xp => [p1 p2 Ip1 Ip2 I].
      case EXi : (X i) => [[a x'] /= q]. rewrite -/(PathS q) in EXi.
      have ? : x' = x by rewrite -Hi EXi. subst x'.
      case: (sepS a v (pcat q p2)) => [||t t_in_S].
      * move: (connector_fst conn_X i). by rewrite EXi.
      * move: (connector_lst conn_Y j). by rewrite EYj.
      * rewrite inE. case/orP => Ht.
        -- move: (t_in_S).
           rewrite [t](connector_right conn_X (i := i)) ?EXi ?inE ?t_in_S /lst //=.
           apply/negP. by apply card_S.
        -- move: (t_in_S). apply/negP. rewrite [t]I //; first by apply card_S.
           rewrite [t](connector_left conn_Y (i := j)) ?inE ?t_in_S //.
           ++ rewrite EYj /fst /=. by rewrite (@path_begin G').
           ++ by rewrite EYj -[_ \in _]/(t \in p) def_p inE Ht.
    + by case: (Y j) jP => [[a b] p].
    + move => Y'. rewrite [_ |: _](_ : _ = P) => [conn_xY|].
      * apply: connector_cat conn_X' conn_xY => //. by apply esym,card_S.
      * apply/setP => u. rewrite /Q setU1K //. by apply card_S.
Qed.

Independent Path Corollaries

Vertex version


Corollary theta (G : diGraph) (x y : G) s :
  ~~ x -- y -> x != y ->
  (forall S, separates x y S -> s <= #|S|) ->
  exists p : 'I_s -> IPath x y, forall i j : 'I_s, i != j -> independent (p i) (p j).
Proof.
  move => xNy xDy min_s.
  pose G' := digraph.induced (~: [set x;y]).
  pose A := [set z : G' | x -- val z].
  pose B := [set z : G' | val z -- y].
  (* Every AB-separator also separates x and y *)
  have sepAB S : separator G' A B S -> separates x y [set val x | x in S].
  { move => sepS. apply: separatesI; split.
    - apply/negP. case/imsetP => x' _ E. move: (valP x'). by rewrite !inE -E eqxx.
    - apply/negP. case/imsetP => y' _ E. move: (valP y'). by rewrite !inE -E eqxx orbT.
    - move => p Ip. case: (splitL p xDy) => a [xA] [p'] [Ep _].
      have aDy : (a != y) by apply: contraNneq xNy => <-.
      case: (splitR p' aDy) => b [q] [By] Ep'.
      have Hq : {subset q <= ~: [set x;y]}.
      { subst. rewrite irred_edgeL irred_edgeR mem_pcat_edgeR (negbTE xDy) /= in Ip.
        case/and3P : Ip => I1 I2 _ u. rewrite inE.
        apply: contraTN. case/setU1P => [->//|]. by move/set1P->. }
      have [Ha Hb] : a \in ~: [set x;y] /\ b \in ~: [set x;y] by split; apply: Hq.
      case: (@digraph.Path_to_induced G (~: [set x;y]) (Sub a Ha) (Sub b Hb) q Hq) => q' Eq.
      case: (sepS _ _ q'); rewrite ?inE // => s0 in_S in_q'.
      exists (val s0); last exact: mem_imset. subst.
      by rewrite !inE [_ \in q]mem_path -Eq map_f. }
  have min_s' S : separator G' A B S -> s <= #|S|.
  { move => HS.
    rewrite -[#|S|](_ : #|[set val x | x in S]| = _) ?min_s ?card_imset //.
    + exact: sepAB.
    + exact: val_inj. }
  have [p conn_p] := Menger min_s'.
  have xA (i : 'I_s) : x -- val (fst (p i)).
  { move: (connector_fst conn_p i). by rewrite inE. }
  have By (i : 'I_s) : val (lst (p i)) -- y.
  { move: (connector_lst conn_p i). by rewrite inE. }
  have X (i : 'I_s) : { pi : @IPath G x y | interior pi = [set val x | x in p i] }.
  { case def_pi : (p i) => [[a b] /= pi]. rewrite -/(PathS pi) in def_pi *.
    case: (digraph.Path_from_induced pi) => pi' P1 P2.
    have [? ?] : a = fst (p i) /\ b = lst (p i) by rewrite def_pi.
    subst.
    set q := (pcat (edgep (xA i)) (pcat pi' (edgep (By i)))).
    have Iq : irred q.
    { rewrite /q irred_edgeL irred_edgeR mem_pcat_edgeR negb_or xDy /=. apply/and3P;split.
      - apply/negP => /P1. by rewrite !inE eqxx.
      - apply/negP => /P1. by rewrite !inE eqxx orbT.
      - rewrite irredE P2 map_inj_uniq; last exact: val_inj.
        move: (conn_irred conn_p i). by rewrite -(@irredE G') [in irred _]def_pi. }
    exists (Sub q Iq).
    apply/setP => u. apply/setDP/imsetP => [[U1 U2]|].
    - move: (U2) U1. rewrite 4!inE negb_or mem_pcat_edgeL mem_pcat_edgeR => /andP [/negbTE-> /negbTE->] /=.
      by rewrite mem_path P2 => /mapP.
    - case => u' => U1' U2'. rewrite -in_setC U2' (valP u') !inE [_ \in pi'](_ : _ = true) //.
      rewrite mem_path P2 mem_map //. exact: val_inj. }
  exists (fun i => sval (X i)).
  + move => i j iDj. apply/disjointP => u. rewrite (svalP (X i)) (svalP (X j)).
    case/imsetP => u1 UP1 UE1. case/imsetP => u2 UP2 UE2.
    have ? : u1 = u2 by apply: val_inj; congruence.
    subst u2. by rewrite [i](connector_eq conn_p UP1 UP2) eqxx in iDj.
Qed.

In addition to the independent paths, we also get a function providing a default vertex on each path
Fact theta_vertices (G : diGraph) (x y : G) s (p : 'I_s -> IPath x y) :
  x != y -> ~~ x -- y ->
  exists (f : 'I_s -> G), forall i, f i \in interior (p i).
Proof.
  move => xDy xNy.
  suff S i : { s | s \in interior (p i) }.
  { exists (fun i => val (S i)) => i. exact: (svalP (S i)). }
  case: (set_0Vmem (interior (p i))) => [I0|//].
  exfalso. case: (interior0E xDy (valP (p i)) I0) => xy.
  by rewrite xy in xNy.
Qed.

Edge Version


Corollary independent_walks L (G : graph L) (a b : G) n :
  a != b -> (forall E, eseparates a b E -> n <= #|E|) ->
  exists2 W : 'I_n -> seq (edge G),
    forall i, walk a b (W i) & forall i j, i != j -> [disjoint W i & W j].
Proof.
  move => aDb min_sep.
  pose A := [set e : line_graph G | source e == a].
  pose B := [set e : line_graph G | target e == b].
  have sep E : separator _ A B E -> n <= #|E|.
  { move => sep_E. apply: min_sep => w walk_w.
    have Nw : ~~ nilp w. { case: w walk_w => //=. by rewrite (negbTE aDb). }
    case: (line_of_walk walk_w Nw) => e1 [e2] [p] [P1 P2 P3].
    case: (sep_E _ _ p) => [||e in_E in_p]; rewrite ?inE ?P1 ?P2 //.
    exists e => //. by rewrite mem_path P3 in in_p. }
  case: (Menger sep) => X con_X. pose W i := nodes (tagged (X i)). exists W.
  - move => i. rewrite /W.
    case: (X i) (connector_fst con_X i) (connector_lst con_X i) => [[e1 e2] /= p].
    rewrite /fst/lst/= !inE => /eqP<- /eqP <-. exact: walk_of_line.
  - move => i j iDj. apply/disjointP => e. rewrite /W -!(@mem_path (line_graph G)).
    move => in_i in_j. move/(_ i j e in_i in_j) : (connector_eq con_X) => E.
    by rewrite E eqxx in iDj.
Qed.

Hall's Marriage Theorem

Neighboorhoods and bipartitions are the same for digraphs and simple graphs

Definition N (G : diGraph) (A : {set G}) :=
  [set y in ~: A | [exists x in A, x -- y]].

Definition bipartition (G : diGraph) (A : {set G}) :=
  forall x y : G, x -- y -> (x \in A) = (y \notin A).

The (natural) notion of a matching on digraphs - a set of ordered pairs - is not a resonable notion of matching on simple graphs, where we should use unordered pairs. Hence, we have two separate definitions

Definition dimatching (G : diGraph) (M : {set G * G}) :=
    (forall e, e \in M -> e.1 -- e.2)
  /\ {in M &, forall e1 e2 x, x \in [set e1.1;e1.2] -> x \in [set e2.1 ; e2.2] -> e1 = e2}.

Definition edges (G : sgraph) := [set [set x;y] | x in G, y in G & x -- y].

Lemma edgesP (G : sgraph) (e : {set G}) :
  reflect (exists x y, e = [set x;y] /\ x -- y) (e \in edges G).
Proof.
  apply: (iffP imset2P) => [[x y]|[x] [y] [E xy]].
  - rewrite !inE /= => _ xy ->. by exists x; exists y.
  - exists x y => //. by rewrite inE.
Qed.

Definition matching (G : sgraph) (M : {set {set G}}) :=
  {subset M <= edges G} /\
  {in M&, forall (e1 e2 : {set G}) (x:G), x \in e1 -> x \in e2 -> e1 = e2}.

Lemma connectorC_edge (G : diGraph) (A : {set G}) n (p : 'I_n -> pathS G) i :
  connector A (~: A) p ->
  exists fl : fst (p i) -- lst (p i), p i = PathS (edgep fl).
Proof.
  move => conn_p.
  case def_q : (p i) => [[a b] /= q]. rewrite -/(PathS q) in def_q *.
  case: (irred_is_edge q).
  - move: (conn_irred conn_p i). by rewrite def_q.
  - case: (altP (a =P b)) => // ?; subst.
    move: (connector_fst conn_p i) (connector_lst conn_p i).
    by rewrite def_q !inE => ->.
  - move => z zq. rewrite !inE. case: (boolP (z \in A)) => [zA|zNA].
    + by rewrite [z](connector_left conn_p (i := i)) ?def_q // eqxx.
    + by rewrite {2}[z](connector_right conn_p (i := i)) ?def_q ?inE // eqxx.
  - move => ab ->. by exists ab.
Qed.

Definition dimatching_of (G : diGraph) n (p : 'I_n -> pathS G) :=
  [set (fst (p i),lst (p i)) | i : 'I_n].

Lemma connector_dimatching (G : diGraph) (A : {set G} ) n (p : 'I_n -> pathS G) :
  connector A (~:A) p -> dimatching (dimatching_of p).
Proof.
  move => con_p. split.
  + move => e. case/imsetP => i _ -> /=.
    by case: (connectorC_edge i con_p).
  + move => [a b] [a' b'] /imsetP [i _ [-> ->]] /imsetP [j _ [-> ->]] /= x /set2P [->|->].
    * case/set2P; by [move/(fst_inj con_p) -> | move/(fst_lst_eq con_p) ->].
    * case/set2P; by [move/(lst_inj con_p) -> | move/esym/(fst_lst_eq con_p) ->].
Qed.

Lemma card_dimatching_of (G : diGraph) A B n (p : 'I_n -> pathS G) :
  connector A B p -> #|dimatching_of p| = n.
Proof.
  move => con_p. rewrite /dimatching_of card_imset ?card_ord // => i j.
  case. by move/(fst_inj con_p).
Qed.

Definition matching_of (G : diGraph) (M' : {set G * G}) :=
  [set [set e.1;e.2] | e in M'].

Lemma matching_of_dimatching (G : sgraph) (A : {set G}) M :
  dimatching M -> @matching G (matching_of M).
Proof.
  move => [M1 M2]. split.
  - move => e. case/imsetP => x /M1 ? ?. apply/edgesP. by exists x.1; exists x.2.
  - move => e1 e2 /imsetP [x X1 X2] /imsetP [y Y1 Y2] z. subst e1 e2.
    move => Z1 Z2. by rewrite (M2 x y X1 Y1 z Z1 Z2).
Qed.

Lemma card_matching_of (G : diGraph) (M : {set G * G}) :
  dimatching M -> #|matching_of M| = #|M|.
Proof.
  move => [? dim_M]. rewrite /matching_of card_in_imset //.
  move => e1 e2 /= inM1 inM2 E. apply dim_M with e1.1 => //.
  all: by rewrite -?E !inE eqxx.
Qed.

Theorem diHall (G : diGraph) A :
  bipartition A -> (forall S : {set G}, S \subset A -> #|S| <= #|N S|) ->
  exists M, dimatching M /\ A = [set x.1 | x in M].
Proof.
  move => bip_A N_A.
  have sep_A S : separator G A (~:A) S -> #|A| <= #|S|.
  { move => sep_S. rewrite -[#|A|](cardsID S).
    apply: (@leq_trans (#|A :&: S| + #|N (A :\: S)|)).
    - by rewrite leq_add2l N_A // subsetDl.
    - rewrite -cardsUI [X in _ + X]eq_card0 ?addn0.
      + apply: subset_leq_card. rewrite subUset subsetIr.
        apply/subsetP => z. rewrite !inE negb_and negbK. case: (boolP (z \in S)) => //=.
        move => zS /andP [zA /exists_inP [x /setDP [xA xS] xz]].
        move: (sep_S _ _ (edgep xz)). rewrite xA inE zA. case => // s sS.
        rewrite mem_edgep => /orP[]/eqP ?; subst; by contrab.
      + move => z. rewrite !inE. case: (boolP (z \in A)) => //=.
        apply: contraTF => /and3P[_ _ /exists_inP [x /setDP [xA xS] xz]].
        by rewrite -(bip_A _ _ xz). }
  case: (Menger sep_A) => p con_p. clear sep_A bip_A.
  exists (dimatching_of p). split; first exact: connector_dimatching con_p.
  apply/setP => a. apply/idP/imsetP => [inA|[x]].
  + move: (inj_card_onto_pred (f := fun i => fst (p i)) (P := (mem A))) => /=.
    case/(_ _ _ _ _ inA)/Wrap => //.
    * apply: fst_inj con_p.
    * apply: connector_fst con_p.
    * by rewrite card_ord.
    * case/mapP => i _ ->. exists (fst (p i),lst (p i)) => //. by rewrite mem_imset.
  + case/imsetP => i _ -> /= ->. apply: connector_fst. exact: con_p.
Qed.

Theorem Hall (G : sgraph) A :
  bipartition A -> (forall S : {set G}, S \subset A -> #|S| <= #|N S|) ->
  exists M, matching M /\ A \subset cover M.
Proof.
  move => bip_A N_A. case: (@diHall G A) => [//|//|M' [M1 M2]].
  - case: M1 => M1 M1'. exists (matching_of M').
    split; first exact: matching_of_dimatching.
    rewrite M2. apply/subsetP => a. case/imsetP => e E1 E2. apply/bigcupP.
    exists [set e.1; e.2]; last by rewrite E2 !inE eqxx. exact: mem_imset.
Qed.

König's Theorem


Section vcover.
Variables (G : sgraph) (V :{set G}).

Definition vcover := [forall x, forall (y | x -- y), (x \in V) || (y \in V)].

Lemma vcoverP : reflect (forall x y, x -- y -> (x \in V) \/ (y \in V)) vcover.
Proof.
  apply: (equivP idP).
  rewrite /vcover -(rwP forallP).
  setoid_rewrite <- (rwP forall_inP).
  by setoid_rewrite <- (rwP orP).
Qed.

The x0 is needed to ensure that G is inhabited. Otherwise, {set G} -> G is empty as well.
Lemma matching_cover_map (x0 : G) M :
  matching M -> vcover ->
  exists2 f : {set G} -> G, (forall e : {set G}, e \in M -> f e \in V :&: e) & {in M&, injective f}.
Proof.
  move => [M1 M2] cover_V.
  pose f (A : {set G}) := if [pick x | x \in V :&: A] is Some x then x else x0.
  have fP e : e \in M -> f e \in V :&: e.
  { move/M1. case/edgesP => x [y] [E xy].
    rewrite /f. case: pickP => [//|].
    case/(vcoverP cover_V) : xy => xV;
    [move/(_ x)|move/(_ y)]; by rewrite E !inE xV eqxx ?orbT. }
  exists f => // e1 e2 eM1 eM2.
  move: (eM1) (eM2) => /fP /setIP [V1 E1] /fP /setIP [V2 E2] E.
  apply M2 with (f e1) => //. by rewrite E.
Qed.

Lemma cover_matching (M :{set {set G}}) :
  matching M -> vcover -> #|M| <= #|V|.
Proof.
  move => [M1 M2] cover_V.
  wlog [x0] : / inhabited G.
  { move => W. case: (set_0Vmem M) => [->|[e /M1]]; first by rewrite cards0.
    case/edgesP => x _. exact: W. }
  case: (matching_cover_map x0 (conj M1 M2) cover_V) => f F1 F2.
  have f_V e : e \in M -> f e \in V by move/F1 => /setIP[].
  rewrite -(card_in_image F2). apply: subset_leq_card.
  apply/subsetP => y /mapP [x Hx ->]. apply: f_V. by rewrite mem_enum in Hx.
Qed.

Proposition min_max_cover (M : {set {set G}}) :
  vcover -> matching M -> #|M| = #|V| -> V \subset cover M.
Proof.
  move => cov_V match_V MV.
  wlog [x0] : / inhabited G.
  { move => W. case: (set_0Vmem V) => [-> //|[x _]]; first by rewrite sub0set.
    exact: W. }
  case: (matching_cover_map x0 match_V cov_V) => f F1 F2.
  pose f' (e : { e | e \in M}) := f (val e).
  have inj_f' : injective f'.
  { case => e1 M1. case => e2 M2. rewrite /f' /= => E.
    apply/eqP. change (e1 == e2). by rewrite (F2 _ _ M1 M2 E). }
  move: (inj_card_onto_pred (P := (mem V)) inj_f') => /=. case/(_ _ _)/Wrap.
  - case => e inM. by case/setIP : (F1 _ inM).
  - by rewrite card_sig.
  - move => X. apply/subsetP => v vV. case/mapP : (X _ vV) => /= [[e inM] _ E].
    apply/bigcupP. exists e => //. rewrite E /f' /=. by case/setIP : (F1 _ inM).
Qed.

End vcover.
Prenex Implicits vcover.
Prenex Implicits matching.

Lemma bip_separation_vcover (G : sgraph) (A S : {set G}) :
  bipartition A -> separator G A (~: A) S -> vcover S.
Proof.
  move => bip_A sep_S. apply/vcoverP => x y xy.
  wlog/andP [xA yNA] : x y xy / (x \in A) && (y \notin A).
  { move: (bip_A x y xy). case: (boolP (y \in A)) => /= yA xA; last by apply.
    rewrite or_comm. apply; by rewrite 1?sgP ?xA ?yA. }
  move: (sep_S _ _ (edgep xy)). rewrite xA inE yNA. case => // s sS.
  rewrite mem_edgep => /orP [/eqP<-|/eqP<-]; by tauto.
Qed.

Lemma min_vcover_matching (G : sgraph) (A V : {set G}) :
  bipartition A -> smallest vcover V ->
  exists2 M, @matching G M & #|V| = #|M|.
Proof.
  move => bip_A [cover_V min_V].
  have sep_A S : separator G A (~:A) S -> #|V| <= #|S|.
  { move/bip_separation_vcover => /(_ bip_A). exact: min_V. }
  case: (Menger sep_A) => p conn_p.
  move/connector_dimatching : (conn_p) => dim_M.
  exists (matching_of (dimatching_of p)). exact: matching_of_dimatching.
  by rewrite card_matching_of // (card_dimatching_of conn_p).
Qed.

Theorem Konig (G : sgraph) (A V : {set G}) (M : {set {set G}}) :
  bipartition A -> smallest vcover V -> largest matching M -> #|V| = #|M|.
Proof.
  move => bip_A [cov_V min_V] [match_M max_M]. apply/eqP.
  rewrite eqn_leq cover_matching // andbT.
  case: (min_vcover_matching (V := V) bip_A _) => // M' H ->. exact: max_M.
Qed.