Change retag semantics! Don't prove anything about this crazy monster.
Things in the "logical" side of the model that could be made better:
- The invariant for one (sub-)resource should only talk about that resource.
To fix CallMapInv: replace set T by `gmap loc tag` indicating which locations are protected.
To fix TagMapInv: kill the "value" part of LMAP.
To fix LocMapInv: make it a `gmap loc tag` that all just have a singleton stack with that loc.
Then we can also make PrivLoc handle fairly uniformly locations that are "privatized" by being protected or by being local.
- heaplets need to map to *pairs of* scalars: left val, right val. Remove silly equality from LmapInv.
- lmap needs to become `gmap tag (ex (gset loc))` so that we can make local locations public and know that this does not de-privatize any other location.
or maybe instead just make it a different state that a tag can be in? pub, uniq, local? Seems more reasonable at this point.
- No need for (persistently) public call IDs. Still need to be able to pass
ownership of *all* tag protected by a call ID though, so
`gmap call_id (ex (gmap tag loc))` seems reasonable, or else `gmap call_id (prod frac (gmap tag (ex loc)))`.
