docs/editor.md

+Here we collect some information on how to set up your editor to properly input
+and output the unicode characters used throughout Iris.
+
+If you really want to, you can also avoid having to type unicode characters by
+importing `iris.bi.ascii`.  That enables parsing-only ASCII alternatives to many
+unicode notations. (Feel free to report an issue when you notice that a notation
+is missing.)  The easiest way to learn the ASCII syntax is to
+[read this file](../iris/bi/ascii.v).
+Note however that this will make your code harder to read and work on for Iris
+developers that are used to our default unicode notation---generally, our
+recommendation is to use the unicode syntax whenever possible. In particular,
+Unicode syntax is required for MRs to Iris itself and other Iris-managed
+repositories.
+
+## General: Unicode Fonts
+
+Most editors will just use system fonts for rendering unicode characters and do
+not need further configuration once the fonts are installed.  Here are some
+combinations of fonts that are known to give readable results (i.e., each of
+these sets of fonts covers all the required characters):
+
+* Fira Mono, DejaVu Mono, Symbola
+
+## Emacs
+
+### Unicode Input
+
+First, install `math-symbol-lists` by doing `M-x package-install math-symbol-lists`.
+
+Next, add the following to your `~/.emacs` to configure an input method based
+on the math symbol list, and with some custom aliases for symbols used a lot in Iris:
+```
+;; Input of unicode symbols
+(require 'math-symbol-lists)
+; Automatically use math input method for Coq files
+(add-hook 'coq-mode-hook (lambda () (set-input-method "math")))
+; Input method for the minibuffer
+(defun my-inherit-input-method ()
+  "Inherit input method from `minibuffer-selected-window'."
+  (let* ((win (minibuffer-selected-window))
+         (buf (and win (window-buffer win))))
+    (when buf
+      (activate-input-method (buffer-local-value 'current-input-method buf)))))
+(add-hook 'minibuffer-setup-hook #'my-inherit-input-method)
+; Define the actual input method
+(quail-define-package "math" "UTF-8" "Ω" t)
+(quail-define-rules ; add whatever extra rules you want to define here...
+ ("\\fun"    ?λ)
+ ("\\mult"   ?⋅)
+ ("\\ent"    ?⊢)
+ ("\\valid"  ?✓)
+ ("\\diamond" ?◇)
+ ("\\box"    ?□)
+ ("\\bbox"   ?■)
+ ("\\later"  ?▷)
+ ("\\pred"   ?φ)
+ ("\\and"    ?∧)
+ ("\\or"     ?∨)
+ ("\\comp"   ?∘)
+ ("\\ccomp"  ?◎)
+ ("\\all"    ?∀)
+ ("\\ex"     ?∃)
+ ("\\to"     ?→)
+ ("\\sep"    ?∗)
+ ("\\lc"     ?⌜)
+ ("\\rc"     ?⌝)
+ ("\\Lc"     ?⎡)
+ ("\\Rc"     ?⎤)
+ ("\\lam"    ?λ)
+ ("\\empty"  ?∅)
+ ("\\Lam"    ?Λ)
+ ("\\Sig"    ?Σ)
+ ("\\-"      ?∖)
+ ("\\aa"     ?●)
+ ("\\af"     ?◯)
+ ("\\auth"   ?●)
+ ("\\frag"   ?◯)
+ ("\\iff"    ?↔)
+ ("\\gname"  ?γ)
+ ("\\incl"   ?≼)
+ ("\\latert" ?▶)
+ ("\\update" ?⇝)
+
+ ;; accents (for iLöb)
+ ("\\\"o" ?ö)
+
+ ;; subscripts and superscripts
+ ("^^+" ?⁺) ("__+" ?₊) ("^^-" ?⁻)
+ ("__0" ?₀) ("__1" ?₁) ("__2" ?₂) ("__3" ?₃) ("__4" ?₄)
+ ("__5" ?₅) ("__6" ?₆) ("__7" ?₇) ("__8" ?₈) ("__9" ?₉)
+
+ ("__a" ?ₐ) ("__e" ?ₑ) ("__h" ?ₕ) ("__i" ?ᵢ) ("__k" ?ₖ)
+ ("__l" ?ₗ) ("__m" ?ₘ) ("__n" ?ₙ) ("__o" ?ₒ) ("__p" ?ₚ)
+ ("__r" ?ᵣ) ("__s" ?ₛ) ("__t" ?ₜ) ("__u" ?ᵤ) ("__v" ?ᵥ) ("__x" ?ₓ)
+)
+(mapc (lambda (x)
+        (if (cddr x)
+            (quail-defrule (cadr x) (car (cddr x)))))
+      ; need to reverse since different emacs packages disagree on whether
+      ; the first or last entry should take priority...
+      ; see <https://mattermost.mpi-sws.org/iris/pl/46onxnb3tb8ndg8b6h1z1f7tny> for discussion
+      (reverse (append math-symbol-list-basic math-symbol-list-extended)))
+```
+
+### Font Configuration
+
+Even when usable fonts are installed, Emacs tends to pick bad fonts for some
+symbols like universal and existential quantifiers.  The following configuration
+results in a decent choice for the symbols used in Iris:
+
+```
+;; Fonts
+(set-face-attribute 'default nil :height 110) ; height is in 1/10pt
+(dolist (ft (fontset-list))
+  ; Main font
+  (set-fontset-font ft 'unicode (font-spec :name "Monospace"))
+  ; Fallback font
+  ; Appending to the 'unicode list makes emacs unbearably slow.
+  ;(set-fontset-font ft 'unicode (font-spec :name "DejaVu Sans Mono") nil 'append)
+  (set-fontset-font ft nil (font-spec :name "DejaVu Sans Mono"))
+)
+; Fallback-fallback font
+; If we 'append this to all fontsets, it picks Symbola even for some cases where DejaVu could
+; be used. Adding it only to the "t" table makes it Do The Right Thing (TM).
+(set-fontset-font t nil (font-spec :name "Symbola"))
+```
+
+### Automated Indentation
+
+The default indentation configuration of company-coq is not compatible with the Iris syntax.
+As a result, automatic indentation will indent lines incorrectly.
+
+To solve some of these indentation errors you can add the following line to your Emacs
+initialisation file:
+```
+(setq coq-smie-user-tokens
+   '(("," . ":=")
+	("∗" . "->")
+	("-∗" . "->")
+	("∗-∗" . "->")
+	("==∗" . "->")
+	("=∗" . "->") 			;; Hack to match ={E1,E2}=∗
+	("|==>" . ":=")
+	("⊢" . "->")
+	("⊣⊢" . "->")
+	("↔" . "->")
+	("←" . "<-")
+	("→" . "->")
+	("=" . "->")
+	("==" . "->")
+	("/\\" . "->")
+	("⋅" . "->")
+	(":>" . ":=")
+	("by" . "now")
+	("forall" . "now")              ;; NB: this breaks current ∀ indentation.
+   ))
+```
+This will let the indentation strategy treat the Iris symbols (e.g. `-∗`) similar to the
+closely related Coq symbols (e.g. `->`).
+Note that `->` is used in many places, as its indentation behaviour is:
+```
+  P ->
+  Q
+```
+This is the indentation behaviour is what we want, e.g. for `∗`:
+```
+  P ∗
+  Q
+```
+Note that this configuration has some caveats.
+Notably, the change to `forall` (which gives good behavior to e.g.
+`iInduction xs as [|x xs IHxs] forall (ys).`), now gives the following indentation
+behavior to universal quantification:
+```
+  ∀ x,
+  P x
+```
+This is not what we want; the second line should be indented by 2 spaces.
+
+## CoqIDE 8.9 and earlier on Linux (ibus-m17n)
+
+On Linux with old versions of CoqIDE you can use the Intelligent
+Input Bus (IBus) framework to input Unicode symbols. First, install `ibus-m17n`
+via your system's package manager. Next, create a file `~/.m17n.d/coq.mim` to
+configure an input method based on the math symbol list, and with some custom
+aliases for symbols used a lot in Iris as defined [here](ibus).
+
+To use this input method, you should:
+
+1. Enable the "Coq" input using your system settings or using the IBus
+   configuration tool. The Coq input method typically appears in the category
+   "other".
+2. On some systems: In CoqIDE, you have to enable the input method by performing
+   a right click on the text area, and selecting "System (IBus)" under "input
+   method".
+
+## CoqIDE 8.10+ Unicode input
+
+Instead of configuring the input system-wide, you can use CoqIDE's support for
+inputting Unicode symbols (introduced in Coq v8.10). To input a symbol, type a
+LaTeX-like escape sequence, for example `\alpha` and then type
+`<Shift>-<Space>`, which will expand it into `α`. Expansion will work on a
+prefix of the command as well. You can also customize the expansion keyboard
+shortcut, which is under Tools/LaTeX-to-unicode.
+
+This system is configurable by adding a Unicode bindings file with additional
+expansion sequences. On Linux this file should go in
+`~/.config/coq/coqide.bindings` while on macOS it should go in
+`~/Library/Application Support/Coq/coqide.bindings` (or under `$XDG_CONFIG_HOME`
+if you have that set).
+
+Here is a `coqide.bindings` file for a variety of symbols used in Iris:
+
+```
+# LaTeX-like sequences are natively supported (eg, \forall, \mapsto)
+# Iris-specific abbreviations
+\fun            λ
+\mult           ⋅ 1
+\ent            ⊢ 1
+\valid          ✓
+\diamond        ◇
+\box            □ 1
+\bbox           ■
+\later          ▷
+\pred           φ
+\and            ∧
+\or             ∨
+\comp           ∘ 1
+\ccomp          ◎
+\all            ∀
+\ex             ∃
+\to             →
+\sep            ∗
+\lc             ⌜ 1
+\rc             ⌝ 1
+\Lc             ⎡ 1
+\Rc             ⎤ 1
+\lam            λ
+\empty          ∅
+\Lam            Λ
+\Sig            Σ
+\-              ∖ 1
+\aa             ● 1
+\af             ◯ 1
+\auth           ●
+\frag           ◯
+\iff            ↔ 1
+\gname          γ
+\incl           ≼
+\latert         ▶
+\update         ⇝
+# accents
+\"o             ö
+\Lob            Löb
+# subscripts and superscripts
+\^+             ⁺
+\_+             ₊
+\^-             ⁻
+\_0             ₀
+\_1             ₁
+\_2             ₂
+\_3             ₃
+\_4             ₄
+\_5             ₅
+\_6             ₆
+\_7             ₇
+\_8             ₈
+\_9             ₉
+\_a             ₐ
+\_e             ₑ
+\_h             ₕ
+\_i             ᵢ
+\_k             ₖ
+\_l             ₗ
+\_m             ₘ
+\_n             ₙ
+\_o             ₒ
+\_p             ₚ
+\_r             ᵣ
+\_s             ₛ
+\_t             ₜ
+\_u             ᵤ
+\_v             ᵥ
+\_x             ₓ
+```
+
+## Visual Studio Code
+
+### VSCoq setup
+
+The recommended extension as of December 2019 is [Maxime Dénès's
+VSCoq](https://marketplace.visualstudio.com/items?itemName=maximedenes.vscoq).
+Press `Ctrl Shift P` or `Cmd Shift P` and then type "coq" to see the list of Coq
+commands and keyboard shortcuts.
+
+### Font setup
+
+To use unicode you need a font that supports all the symbols, such as [Fira
+Code](https://github.com/tonsky/FiraCode/wiki/Installing). Download and install
+the font, and in VS Code press `Cmd ,` or `Ctrl ,` to go to the settings, search
+for "font", and use "FiraCode-Retina" on macOS or "Fira Code Retina" on Linux as the font-family and optionally enable
+ligatures.
+
+### Unicode input setup
+
+Install the [Generic input method
+extension](https://marketplace.visualstudio.com/items?itemName=mr-konn.generic-input-method).
+To insert a symbol, type the code for a symbol such as `\to` and then press
+`Space` or `Tab`. To enable Iris unicode input support, open your user settings,
+press `Cmd ,` or `Ctrl ,`, type "generic-input-methods.input-methods", and then
+click on "Edit in settings.json" and add the contents of [this file](vscode).
+
+## Vim
+
+The [Coqtail](https://github.com/whonore/coqtail) plugin can be used to develop Coq code in `vim` (install it with your favorite plugin manager).
+Follow the installation instructions in Coqtail's README to setup your keybinds and find out about its usage.
+
+### Unicode support
+For Unicode support, make sure that your terminal emulator supports Unicode and configure it to use a font with Unicode support.
+
+For entering Unicode symbols, one option is the plugin [latex-unicoder](https://github.com/joom/latex-unicoder.vim).
+Install it with your favorite plugin manager.
+To enter a Unicode symbol, hit `C-l` in normal or insert mode. For more details on the usage, see its README.
+
+latex-unicoder comes with a large set of pre-configured symbols known from LaTeX, but you can also add your own by adding (and adapting) the following to your `.vimrc`:
+```
+let g:unicode_map = {
+  \ "\\fun"     :   "λ",
+  \ "\\mult"    :   "⋅",
+  \ "\\ent"     :   "⊢",
+  \ "\\valid"   :   "✓",
+  \ "\\diamond" :   "◇",
+  \ "\\box"     :   "□",
+  \ "\\bbox"   	:   "■",
+  \ "\\later"  	:   "▷",
+  \ "\\pred"   	:   "φ",
+  \ "\\and"    	:   "∧",
+  \ "\\or"     	:   "∨",
+  \ "\\comp"   	:   "∘",
+  \ "\\ccomp"  	:   "◎",
+  \ "\\all"    	:   "∀",
+  \ "\\ex"     	:   "∃",
+  \ "\\to"     	:   "→",
+  \ "\\sep"    	:   "∗",
+  \ "\\lc"     	:   "⌜",
+  \ "\\rc"     	:   "⌝",
+  \ "\\Lc"     	:   "⎡",
+  \ "\\Rc"     	:   "⎤",
+  \ "\\lam"    	:   "λ",
+  \ "\\empty"  	:   "∅",
+  \ "\\Lam"    	:   "Λ",
+  \ "\\Sig"    	:   "Σ",
+  \ "\\-"      	:   "∖",
+  \ "\\aa"     	:   "●",
+  \ "\\af"     	:   "◯",
+  \ "\\auth"   	:   "●",
+  \ "\\frag"   	:   "◯",
+  \ "\\iff"    	:   "↔",
+  \ "\\gname"  	:   "γ",
+  \ "\\incl"   	:   "≼",
+  \ "\\latert" 	:   "▶",
+  \ "\\update" 	:   "⇝",
+  \ "\\\"o"     :   "ö",
+  \ "_a"        :   "ₐ",
+  \ "_e"        :   "ₑ",
+  \ "_h"        :   "ₕ",
+  \ "_i"        :   "ᵢ",
+  \ "_k"        :   "ₖ",
+  \ "_l"        :   "ₗ",
+  \ "_m"        :   "ₘ",
+  \ "_n"        :   "ₙ",
+  \ "_o"        :   "ₒ",
+  \ "_p"        :   "ₚ",
+  \ "_r"        :   "ᵣ",
+  \ "_s"        :   "ₛ",
+  \ "_t"        :   "ₜ",
+  \ "_u"        :   "ᵤ",
+  \ "_v"        :   "ᵥ",
+  \ "_x"        :   "ₓ",
+\ }
+```
+
+
+Alternatively, you can use snippets using [UltiSnips](https://github.com/SirVer/ultisnips).
+
+Install it with your favorite plugin manager, and register a completion key in your configuration:
+```
+let g:UltiSnipsExpandTrigger="<c-l>"
+```
+To insert a unicode character, type its trigger word, such as `\forall` or `->`, and then press `<c-l>` while still in insert mode.
+
+To register most common unicode characters, put [this file](vim_ultisnips) either at `~/.vim/UltiSnips/coq_unicode.snippets` or `~/.config/nvim/UltiSnips/coq_unicode.snippets`, depending on your preferred variant of Vim.

docs/encodings.tex

-% !TEX root = ./appendix.tex
-
-\section{Monoid constructions}
-
-We will use the notation $\mcarp{M} \eqdef |M| \setminus \{\mzero_M\}$ for the carrier of monoid $M$ without zero. When we define a carrier, a zero element is always implicitly added (we do not explicitly give it), and all cases of multiplication that are not defined (including those involving a zero element) go to that element.
-
-To disambiguate which monoid an element is part of, we use the notation $a : M$ to denote an $a$ s.t.\ $a \in |M|$.
-
-When defining a monoid, we will show some \emph{frame-preserving updates} $\melt \mupd \meltsB$ that it supports.
-Remember that
-\[
-	\melt \mupd \meltsB \eqdef \always\All \melt_f. \melt \sep \melt_f \Ra \Exists \meltB \in \meltsB. \meltB \sep \melt_f.
-\]
-The rule \ruleref{FpUpd} (and, later, \ruleref{GhostUpd}) allows us to use such updates in Hoare proofs.
-The following principles generally hold for frame-preserving updates.
-\begin{mathpar}
-	\infer{
-		\melt \mupd \meltsB
-	}{
-		\melt \mupd \meltsB \cup \meltsB'
-	}
-	\and
-	\infer{
-		\melt \mupd \meltsB
-	}{
-		\melt \mtimes \melt_f \mupd \{ \meltB \mtimes \melt_f \mid \meltB \in \meltsB \}
-	}
-\end{mathpar}
-
-Some of our constructions require or preserve \emph{cancellativity}:
-\[
-	\text{$\monoid$ cancellative} \eqdef
-	\All \melt_f, \melt, \meltB \in \mcar{\monoid}. \melt_f \mtimes \melt = \melt_f \mtimes \meltB \neq \mzero \Ra \melt = \meltB
-\]
-
-
-\subsection{Exclusive monoid}
-
-Given a set $X$, we define a monoid such that at most one $x \in X$ can be owned.
-Let $\exm{X}$ be the monoid with carrier $X \uplus \{ \munit \}$ and multiplication
-\[
-\melt \cdot \meltB \;\eqdef\;
-\begin{cases}
-  \melt & \mbox{if } \meltB = \munit \\
-  \meltB & \mbox{if } \melt = \munit
-\end{cases}
-\]
-
-The frame-preserving update
-\begin{mathpar}
-\inferH{ExUpd}
-  {x \in X}
-  {x \mupd \melt}
-\end{mathpar}
-is easily shown, as the only possible frame for $x$ is $\munit$.
-
-Exclusive monoids are cancellative.
-\begin{proof}[Proof of cancellativity]
-If $\melt_f = \munit$, then the statement is trivial.
-If $\melt_f \neq \munit$, then we must have $\melt = \meltB = \munit$, as otherwise one of the two products would be $\mzero$.
-\end{proof}
-
-\subsection{Agreement monoid}
-
-Given a set $X$, we define a monoid such that everybody agrees on which $x \in X$ has been chosen.
-Let $\agm{X}$ be the monoid with carrier $X \uplus \{ \munit \}$ and multiplication
-\[
-\melt \cdot \meltB \;\eqdef\;
-\begin{cases}
-\melt & \mbox{if } \meltB = \munit \lor \melt = \meltB \\
-\meltB & \mbox{if } \melt = \munit
-\end{cases}
-\]
-
-Agreement monoids are cancellative.
-\begin{proof}[Proof of cancellativity]
-	If $\melt_f = \munit$, then the statement is trivial.
-	If $\melt_f \neq \munit$, then if $\melt = \munit$, we must have $\meltB = \munit$ and we are done.
-	Similar so for $\meltB = \munit$.
-	So let $\melt \neq \munit \neq \meltB$ and $\melt_f \mtimes \melt = \melt_f \mtimes \meltB \neq \mzero$.
-	It follows immediately that $\melt = \melt_f = \meltB$.
-\end{proof}
-
-\subsection{Finite Powerset Monoid}
-
-Given an infinite set $X$, we define a monoid $\textmon{PowFin}$ with carrier $\mathcal{P}^{\textrm{fin}}(X)$ as follows:
-\[
-\melt \cdot \meltB \;\eqdef\; \melt \cup \meltB \quad \mbox{if } \melt \cap \meltB = \emptyset
-\]
-
-We obtain:
-\begin{mathpar}
-	\inferH{PowFinUpd}{}
-		{\emptyset \mupd \{ \{x\} \mid x \in X  \}}
-\end{mathpar}
-
-\begin{proof}[Proof of \ruleref{PowFinUpd}]
-	Assume some frame $\melt_f \sep \emptyset$. Since $\melt_f$ is finite and $X$ is infinite, there exists an $x \notin \melt_f$.
-	Pick that for the result.
-\end{proof}
-
-The powerset monoids is cancellative.
-\begin{proof}[Proof of cancellativity]
-	Let $\melt_f \mtimes \melt = \melt_f \mtimes \meltB \neq \mzero$.
-	So we have $\melt_f \sep \melt$ and $\melt_f \sep \meltB$, and we have to show $\melt = \meltB$.
-	Assume $x \in \melt$. Hence $x \in \melt_f \mtimes \melt$ and thus $x \in \melt_f \mtimes \meltB$.
-	By disjointness, $x \notin \melt_f$ and hence $x \in meltB$.
-	The other direction works the same way.
-\end{proof}
-
-\subsection{Product monoid}
-\label{sec:prodm}
-
-Given a family $(M_i)_{i \in I}$ of monoids ($I$ countable), we construct a product monoid.
-Let $\prod_{i \in I} M_i$ be the monoid with carrier $\prod_{i \in I} \mcarp{M_i}$ and point-wise multiplication, non-zero when \emph{all} individual multiplications are non-zero.
-For $f \in \prod_{i \in I} \mcarp{M_i}$, we write $f[i \mapsto a]$ for the disjoint union $f \uplus [i \mapsto a]$.
-
-Frame-preserving updates on the $M_i$ lift to the product:
-\begin{mathpar}
-  \inferH{ProdUpd}
-  {a \mupd_{M_i} B}
-  {f[i \mapsto a] \mupd \{ f[i \mapsto b] \mid b \in B\}}
-\end{mathpar}
-\begin{proof}[Proof of \ruleref{ProdUpd}]
-Assume some frame $g$ and let $c \eqdef g(i)$.
-Since $f[i \mapsto a] \sep g$, we get $f \sep g$ and $a \sep_{M_i} c$.
-Thus there exists $b \in B$ such that $b \sep_{M_i} c$.
-It suffices to show $f[i \mapsto b] \sep g$.
-Since multiplication is defined pointwise, this is the case if all components are compatible.
-For $i$, we know this from $b \sep_{M_i} c$.
-For all the other components, from $f \sep g$.
-\end{proof}
-
-If every $M_i$ is cancellative, then so is $\prod_{i \in I} M_i$.
-\begin{proof}[Proof of cancellativity]
-Let $\melt, \meltB, \melt_f \in \prod_{i \in I} \mcarp{M_i}$, and assume $\melt_f \mtimes \melt = \melt_f \mtimes \meltB \neq \mzero$.
-By the definition of multiplication, this means that for all $i \in I$ we have $\melt_f(i) \mtimes \melt(i) = \melt_f(i) \mtimes \meltB(i) \neq \mzero_{M_i}$.
-As all base monoids are cancellative, we obtain $\forall i \in I.\; \melt(i) = \meltB(i)$ from which we immediately get $\melt = \meltB$.
-\end{proof}
-
-\subsection{Fractional monoid}
-\label{sec:fracm}
-
-Given a monoid $M$, we define a monoid representing fractional ownership of some piece $\melt \in M$.
-The idea is to preserve all the frame-preserving update that $M$ could have, while additionally being able to do \emph{any} update if we own the full state (as determined by the fraction being $1$).
-Let $\fracm{M}$ be the monoid with carrier $(((0, 1] \cap \mathbb{Q}) \times M) \uplus \{\munit\}$ and multiplication
-\begin{align*}
- (q, a) \mtimes (q', a') &\eqdef (q + q', a \mtimes a') \qquad \mbox{if $q+q'\le 1$} \\
- (q, a) \mtimes \munit &\eqdef (q,a) \\
- \munit \mtimes (q,a) &\eqdef (q,a).
-\end{align*}
-
-We get the following frame-preserving update.
-\begin{mathpar}
-	\inferH{FracUpdFull}
-		{a, b \in M}
-		{(1, a) \mupd (1, b)}
-  \and\inferH{FracUpdLocal}
-	  {a \mupd_M B}
-	  {(q, a) \mupd \{q\} \times B}
-\end{mathpar}
-
-\begin{proof}[Proof of \ruleref{FracUpdFull}]
-Assume some $f \sep (1, a)$. This can only be $f = \munit$, so showing $f \sep (1, b)$ is trivial.
-\end{proof}
-
-\begin{proof}[Proof of \ruleref{FracUpdLocal}]
-	Assume some $f \sep (q, a)$. If $f = \munit$, then $f \sep (q, b)$ is trivial for any $b \in B$. Just pick the one we obtain by choosing $\munit_M$ as the frame for $a$.
-	
-	In the interesting case, we have $f = (q_f, a_f)$.
-	Obtain $b$ such that $b \in B \land b \sep a_f$.
-	Then $(q, b) \sep f$, and we are done.
-\end{proof}
-
-$\fracm{M}$ is cancellative if $M$ is cancellative.
-\begin{proof}[Proof of cancellativitiy]
-If $\melt_f = \munit$, we are trivially done.
-So let $\melt_f = (q_f, \melt_f')$.
-If $\melt = \munit$, then $\meltB = \munit$ as otherwise the fractions could not match up.
-Again, we are trivially done.
-Similar so for $\meltB = \munit$.
-So let $\melt = (q_a, \melt')$ and $\meltB = (q_b, \meltB')$.
-We have $(q_f + q_a, \melt_f' \mtimes \melt') = (q_f + q_b, \melt_f' \mtimes \meltB')$.
-We have to show $q_a = q_b$ and $\melt' = \meltB'$.
-The first is trivial, the second follows from cancellativitiy of $M$.
-\end{proof}
-
-\subsection{Finite partial function monoid}
-\label{sec:fpfunm}
-
-Given a countable set $X$ and a monoid $M$, we construct a monoid representing finite partial functions from $X$ to (non-unit, non-zero elements of) $M$.
-Let $\fpfunm{X}{M}$ be the product monoid $\prod_{x \in X} M$, as defined in \secref{sec:prodm} but restricting the carrier to functions $f$ where the set $\dom(f) \eqdef \{ x \mid f(x) \neq \munit_M \}$ is finite.
-This is well-defined as the set of these $f$ contains the unit and is closed under multiplication.
-(We identify finite partial functions from $X$ to $\mcarp{M}\setminus\{\munit_M\}$ and total functions from $X$ to $\mcarp{M}$ with finite $\munit_M$-support.)
-
-We use two frame-preserving updates:
-\begin{mathpar}
-  \inferH{FpFunAlloc}
-  {a \in \mcarp{M}}
-  {f \mupd \{ f[x \mapsto a] \mid x \notin \dom(f) \}}
-  \and
-  \inferH{FpFunUpd}
-  {a \mupd_M B}
-  {f[i \mapsto a] \mupd \{ f[i \mapsto b] \mid b \in B\}}
-\end{mathpar}
-Rule \ruleref{FpFunUpd} simply restates \ruleref{ProdUpd}.
-
-\begin{proof}[Proof of \ruleref{FpFunAlloc}]
-  Assume some $g \sep f$. Since $\dom(f \mtimes g)$ is finite, there will be some undefined element $x \notin \dom(f \mtimes g)$. Let $f' \eqdef f[x \mapsto a]$. This is compatible with $g$, so we are done.
-\end{proof}
-
-We write $[x \mapsto a]$ for the function mapping $x$ to $a$ and everything else in $X$ to $\munit$.
-
-%\subsection{Disposable monoid}
-%
-%Given a monoid $M$, we construct a monoid where, having full ownership of an element $\melt$ of $M$, one can throw it away, transitioning to a dead element.
-%Let \dispm{M} be the monoid with carrier $\mcarp{M} \uplus \{ \disposed \}$ and multiplication
-%% The previous unit must remain the unit of the new monoid, as is is always duplicable and hence we could not transition to \disposed if it were not composable with \disposed
-%\begin{align*}
-%  \melt \mtimes \meltB &\eqdef \melt \mtimes_M \meltB & \IF \melt \sep[M] \meltB \\
-%  \disposed \mtimes \disposed &\eqdef \disposed \\
-%  \munit_M \mtimes \disposed &\eqdef \disposed \mtimes \munit_M \eqdef \disposed
-%\end{align*}
-%The unit is the same as in $M$.
-%
-%The frame-preserving updates are
-%\begin{mathpar}
-% \inferH{DispUpd}
-%   {a \in \mcarp{M} \setminus \{\munit_M\} \and a \mupd_M B}
-%   {a \mupd B}
-% \and
-% \inferH{Dispose}
-%  {a \in \mcarp{M} \setminus \{\munit_M\} \and \All b \in \mcarp{M}. a \sep b \Ra b = \munit_M}
-%  {a \mupd \disposed}
-%\end{mathpar}
-%
-%\begin{proof}[Proof of \ruleref{DispUpd}]
-%Assume a frame $f$. If $f = \disposed$, then $a = \munit_M$, which is a contradiction.
-%Thus $f \in \mcarp{M}$ and we can use $a \mupd_M B$.
-%\end{proof}
-%
-%\begin{proof}[Proof of \ruleref{Dispose}]
-%The second premiss says that $a$ has no non-trivial frame in $M$. To show the update, assume a frame $f$ in $\dispm{M}$. Like above, we get $f \in \mcarp{M}$, and thus $f = \munit_M$. But $\disposed \sep \munit_M$ is trivial, so we are done.
-%\end{proof}
-
-\subsection{Authoritative monoid}\label{sec:auth}
-
-Given a monoid $M$, we construct a monoid modeling someone owning an \emph{authoritative} element $x$ of $M$, and others potentially owning fragments $\melt \le_M x$ of $x$.
-(If $M$ is an exclusive monoid, the construction is very similar to a half-ownership monoid with two asymmetric halves.)
-Let $\auth{M}$ be the monoid with carrier
-\[
-	\SET{ (x, \melt) }{ x \in \mcarp{\exm{\mcarp{M}}} \land \melt \in \mcarp{M} \land (x = \munit_{\exm{\mcarp{M}}} \lor \melt \leq_M x) }
-\]
-and multiplication
-\[
-(x, \melt) \mtimes (y, \meltB) \eqdef
-     (x \mtimes y, \melt \mtimes \meltB) \quad \mbox{if } x \sep y \land \melt \sep \meltB \land (x \mtimes y = \munit_{\exm{\mcarp{M}}} \lor \melt \mtimes \meltB \leq_M x \mtimes y)
-\]
-Note that $(\munit_{\exm{\mcarp{M}}}, \munit_M)$ is the unit and asserts no ownership whatsoever, but $(\munit_{M}, \munit_M)$ asserts that the authoritative element is $\munit_M$.
-
-Let $x, \melt \in \mcarp M$.
-We write $\authfull x$ for full ownership $(x, \munit_M):\auth{M}$ and $\authfrag \melt$ for fragmental ownership $(\munit_{\exm{\mcarp{M}}}, \melt)$ and $\authfull x , \authfrag \melt$ for combined ownership $(x, \melt)$.
-If $x$ or $a$ is $\mzero_{M}$, then the sugar denotes $\mzero_{\auth{M}}$.
-
-\ralf{This needs syncing with the Coq development.}
-The frame-preserving update involves a rather unwieldy side-condition:
-\begin{mathpar}
-	\inferH{AuthUpd}{
-		\All\melt_f\in\mcar{\monoid}. \melt\sep\meltB \land \melt\mtimes\melt_f \le \meltB\mtimes\melt_f \Ra \melt'\mtimes\melt_f \le \melt'\mtimes\meltB \and
-		\melt' \sep \meltB
-	}{
-		\authfull \melt \mtimes \meltB, \authfrag \melt \mupd \authfull \melt' \mtimes \meltB, \authfrag \melt'
-	}
-\end{mathpar}
-We therefore derive two special cases.
-
-\paragraph{Local frame-preserving updates.}
-
-\newcommand\authupd{f}%
-Following~\cite{scsl}, we say that $\authupd: \mcar{M} \ra \mcar{M}$ is \emph{local} if
-\[
-	\All a, b \in \mcar{M}. a \sep b \land \authupd(a) \neq \mzero \Ra \authupd(a \mtimes b) = \authupd(a) \mtimes b
-\]
-Then,
-\begin{mathpar}
-	\inferH{AuthUpdLocal}
-	{\text{$\authupd$ local} \and \authupd(\melt)\sep\meltB}
-	{\authfull \melt \mtimes \meltB, \authfrag \melt \mupd \authfull \authupd(\melt) \mtimes \meltB, \authfrag \authupd(\melt)}
-\end{mathpar}
-
-\paragraph{Frame-preserving updates on cancellative monoids.}
-
-Frame-preserving updates are also possible if we assume $M$ cancellative:
-\begin{mathpar}
- \inferH{AuthUpdCancel}
-  {\text{$M$ cancellative} \and \melt'\sep\meltB}
-  {\authfull \melt \mtimes \meltB, \authfrag \melt \mupd \authfull \melt' \mtimes \meltB, \authfrag \melt'}
-\end{mathpar}
-
-\subsection{Fractional heap monoid}
-\label{sec:fheapm}
-
-By combining the fractional, finite partial function, and authoritative monoids, we construct two flavors of heaps with fractional permissions and mention their important frame-preserving updates.
-Hereinafter, we assume the set $\textdom{Val}$ of values is countable.
-
-Given a set $Y$, define $\FHeap(Y) \eqdef \fpfunm{\textdom{Val}}{\fracm{Y}}$ representing a fractional heap with codomain $Y$.
-From \S\S\ref{sec:fracm} and~\ref{sec:fpfunm} we obtain the following frame-preserving updates as well as the fact that $\FHeap(Y)$ is cancellative.
-\begin{mathpar}
-	\axiomH{FHeapUpd}{h[x \mapsto (1, y)] \mupd h[x \mapsto (1, y')]} \and
-	\axiomH{FHeapAlloc}{h \mupd \{\, h[x \mapsto (1, y)] \mid x \in \textdom{Val} \,\}}
-\end{mathpar}
-We will write $qh$ with $h : \textsort{Val} \fpfn Y$ for the function in $\FHeap(Y)$ mapping every $x \in \dom(h)$ to $(q, h(x))$, and everything else to $\munit$.
-
-Define $\AFHeap(Y) \eqdef \auth{\FHeap(Y)}$ representing an authoritative fractional heap with codomain $Y$.
-We easily obtain the following frame-preserving updates.
-\begin{mathpar}
-	\axiomH{AFHeapUpd}{
-		(\authfull h[x \mapsto (1, y)], \authfrag [x \mapsto (1, y)]) \mupd (\authfull h[x \mapsto (1, y')], \authfrag [x \mapsto (1, y')])
-	}
-	\and
-	\inferH{AFHeapAdd}{
-		x \notin \dom(h)
-	}{
-		\authfull h \mupd (\authfull h[x \mapsto (q, y)], \authfrag [x \mapsto (q, y)])
-	}
-	\and
-	\axiomH{AFHeapRemove}{
-		(\authfull h[x \mapsto (q, y)], \authfrag [x \mapsto (q, y)]) \mupd \authfull h
-	}
-\end{mathpar}
-
-\subsection{STS with tokens monoid}
-\label{sec:stsmon}
-
-\ralf{This needs syncing with the Coq development.}
-
-Given a state-transition system~(STS) $(\STSS, \ra)$, a set of tokens $\STSS$, and a labeling $\STSL: \STSS \ra \mathcal{P}(\STST)$ of \emph{protocol-owned} tokens for each state, we construct a monoid modeling an authoritative current state and permitting transitions given a \emph{bound} on the current state and a set of \emph{locally-owned} tokens.
-
-The construction follows the idea of STSs as described in CaReSL \cite{caresl}.
-We first lift the transition relation to $\STSS \times \mathcal{P}(\STST)$ (implementing a \emph{law of token conservation}) and define upwards closure:
-\begin{align*}
- (s, T) \ra (s', T') \eqdef&\, s \ra s' \land \STSL(s) \uplus T = \STSL(s') \uplus T' \\
- \textsf{frame}(s, T) \eqdef&\, (s, \STST \setminus (\STSL(s) \uplus T)) \\
- \upclose(S, T) \eqdef&\, \SET{ s' \in \STSS}{\exists s \in S.\; \textsf{frame}(s, T) \ststrans \textsf{frame}(s', T) }
-\end{align*}
-
-\noindent
-We have
-\begin{quote}
-	If $(s, T) \ra (s', T')$\\
-	and $T_f \sep (T \uplus \STSL(s))$,\\
-	then $\textsf{frame}(s, T_f) \ra \textsf{frame}(s', T_f)$.
-\end{quote}
-\begin{proof}
-This follows directly by framing the tokens in $\STST \setminus (T_f \uplus T \uplus \STSL(s))$ around the given transition, which yields $(s, \STST \setminus (T_f \uplus \STSL{T}(s))) \ra (s', T' \uplus (\STST \setminus (T_f \uplus T \uplus \STSL{T}(s))))$.
-This is exactly what we have to show, since we know $\STSL(s) \uplus T = \STSL(s') \uplus T'$.
-\end{proof}
-
-Let $\STSMon{\STSS}$ be the monoid with carrier
-\[
-	\SET{ (s, S, T) \in \exm{\STSS} \times \mathcal{P}(\STSS) \times \mathcal{P}(\STST) }{ \begin{aligned} &(s = \munit \lor s \in S) \land \upclose(S, T) = S   \land{} \\& S \neq \emptyset \land \All s \in S. \STSL(s) \sep T  \end{aligned} }
-\]
-and multiplication
-\[
-	(s, S, T) \mtimes (s', S', T') \eqdef (s'' \eqdef s \mtimes_{\exm{\STSS}} s', S'' \eqdef S \cap S', T'' \eqdef T \cup T') \quad \text{if }\begin{aligned}[t] &(s = \munit \lor s' = \munit) \land T \sep T' \land{} \\& S'' \neq \emptyset \land (s'' \neq \munit \Ra s'' \in S'') \end{aligned}
-\]
-
-Some sugar makes it more convenient to assert being at least in a certain state and owning some tokens: $(s, T) : \STSMon{\STSS} \eqdef (\munit, \upclose(\{s\}, T), T) : \STSMon{\STSS}$, and
-$s : \STSMon{\STSS} \eqdef (s, \emptyset) : \STSMon{\STSS}$.
-
-We will need the following frame-preserving update.
-\begin{mathpar}
-	\inferH{StsStep}{(s, T) \ststrans (s', T')}
-	 {(s, S, T) \mupd (s', \upclose(\{s'\}, T'), T')}
-\end{mathpar}
-\begin{proof}[Proof of \ruleref{StsStep}]
-Assume some upwards-closed $S_f, T_f$ (the frame cannot be authoritative) s.t.\ $s \in S_f$ and $T_f \sep (T \uplus \STSL(s))$. We have to show that this frame combines with our final monoid element, which is the case if $s' \in S_f$ and $T_f \sep T'$.
-By upward-closedness, it suffices to show $\textsf{frame}(s, T_f) \ststrans \textsf{frame}(s', T_f)$.
-This follows by induction on the path $(s, T) \ststrans (s', T')$, and using the lemma proven above for each step.
-\end{proof}
-
-\section{Derived constructions}
-
-In this section we describe some constructions that we will use throughout the rest of the appendix.
-
-\subsection{Global monoid}
-
-Hereinafter we assume the global monoid (served up as a parameter to Iris) is obtained from a family of monoids $(M_i)_{i \in I}$ by first applying the construction for finite partial functions to each~(\Sref{sec:fpfunm}), and then applying the product construction~(\Sref{sec:prodm}):
-\[ M \eqdef \prod_{i \in I} \fpfunm{\textdom{GhName}}{M_i} \]
-We don't care so much about what concretely $\textdom{GhName}$ is, as long as it is countable and infinite.
-We write $\ownGhost{\gname}{\melt : M_i}$ (or just $\ownGhost{\gname}{\melt}$ if $M_i$ is clear from the context) for $\ownGGhost{[i \mapsto [\gname \mapsto \melt]]}$ when $\melt \in \mcarp {M_i}$, and for $\FALSE$ when $\melt = \mzero_{M_i}$.
-In other words, $\ownGhost{\gname}{\melt : M_i}$ asserts that in the current state of monoid $M_i$, the name $\gname$ is allocated and has at least value $\melt$.
-
-From~\ruleref{FpUpd} and the multiplications and frame-preserving updates in~\Sref{sec:prodm} and~\Sref{sec:fpfunm}, we have the following derived rules.
-\begin{mathpar}
-	\axiomH{NewGhost}{
-		\TRUE \vs \Exists\gname. \ownGhost\gname{\melt : M_i}
-	}
-	\and
-	\inferH{GhostUpd}
-    {\melt \mupd_{M_i} B}
-    {\ownGhost\gname{\melt : M_i} \vs \Exists \meltB\in B. \ownGhost\gname{\meltB : M_i}}
-  \and
-  \axiomH{GhostEq}
-    {\ownGhost\gname{\melt : M_i} * \ownGhost\gname{\meltB : M_i} \Lra \ownGhost\gname{\melt\mtimes\meltB : M_i}}
-
-  \axiomH{GhostUnit}
-    {\TRUE \Ra \ownGhost{\gname}{\munit : M_i}}
-
-  \axiomH{GhostZero}
-    {\ownGhost\gname{\mzero : M_i} \Ra \FALSE}
-
-  \axiomH{GhostTimeless}
-    {\timeless{\ownGhost\gname{\melt : M_i}}}
-\end{mathpar}
-
-\subsection{STSs with interpretation}\label{sec:stsinterp}
-
-Building on \Sref{sec:stsmon}, after constructing the monoid $\STSMon{\STSS}$ for a particular STS, we can use an invariant to tie an interpretation, $\pred : \STSS \to \Prop$, to the STS's current state, recovering CaReSL-style reasoning~\cite{caresl}.
-
-An STS invariant asserts authoritative ownership of an STS's current state and that state's interpretation:
-\begin{align*}
-  \STSInv(\STSS, \pred, \gname) \eqdef{}& \Exists s \in \STSS. \ownGhost{\gname}{(s, \STSS, \emptyset):\STSMon{\STSS}} * \pred(s) \\
-  \STS(\STSS, \pred, \gname, \iname) \eqdef{}& \knowInv{\iname}{\STSInv(\STSS, \pred, \gname)}
-\end{align*}
-
-We can specialize \ruleref{NewInv}, \ruleref{InvOpen}, and \ruleref{InvClose} to STS invariants:
-\begin{mathpar}
- \inferH{NewSts}
-  {\infinite(\mask)}
-  {\later\pred(s) \vs[\mask] \Exists \iname \in \mask, \gname.   \STS(\STSS, \pred, \gname, \iname) * \ownGhost{\gname}{(s, \STST \setminus \STSL(s)) : \STSMon{\STSS}}}
- \and
- \axiomH{StsOpen}
-  {  \STS(\STSS, \pred, \gname, \iname) \vdash \ownGhost{\gname}{(s_0, T) : \STSMon{\STSS}} \vsE[\{\iname\}][\emptyset] \Exists s\in \upclose(\{s_0\}, T). \later\pred(s) * \ownGhost{\gname}{(s, \upclose(\{s_0\}, T), T):\STSMon{\STSS}}}
- \and
- \axiomH{StsClose}
-  {  \STS(\STSS, \pred, \gname, \iname), (s, T) \ststrans (s', T')  \proves \later\pred(s') * \ownGhost{\gname}{(s, S, T):\STSMon{\STSS}} \vs[\emptyset][\{\iname\}] \ownGhost{\gname}{(s', T') : \STSMon{\STSS}} }
-\end{mathpar}
-\begin{proof}
-\ruleref{NewSts} uses \ruleref{NewGhost} to allocate $\ownGhost{\gname}{(s, \upclose(s, T), T) : \STSMon{\STSS}}$ where $T \eqdef \STST \setminus \STSL(s)$, and \ruleref{NewInv}.
-
-\ruleref{StsOpen} just uses \ruleref{InvOpen} and \ruleref{InvClose} on $\iname$, and the monoid equality $(s, \upclose(\{s_0\}, T), T) = (s, \STSS, \emptyset) \mtimes (\munit, \upclose(\{s_0\}, T), T)$.
-
-\ruleref{StsClose} applies \ruleref{StsStep} and \ruleref{InvClose}.
-\end{proof}
-
-Using these view shifts, we can prove STS variants of the invariant rules \ruleref{Inv} and \ruleref{VSInv}~(compare the former to CaReSL's island update rule~\cite{caresl}):
-\begin{mathpar}
- \inferH{Sts}
-  {\All s \in \upclose(\{s_0\}, T). \hoare{\later\pred(s) * P}{\expr}{\Ret \val. \Exists s', T'. (s, T) \ststrans (s', T') * \later\pred(s') * Q}[\mask]
-   \and \physatomic{\expr}}
-  {  \STS(\STSS, \pred, \gname, \iname) \vdash \hoare{\ownGhost{\gname}{(s_0, T):\STSMon{\STSS}} * P}{\expr}{\Ret \val. \Exists s', T'. \ownGhost{\gname}{(s', T'):\STSMon{\STSS}} * Q}[\mask \uplus \{\iname\}]}
- \and
- \inferH{VSSts}
-  {\forall s \in \upclose(\{s_0\}, T).\; \later\pred(s) * P \vs[\mask_1][\mask_2] \exists s', T'.\; (s, T) \ststrans (s', T') * \later\pred(s') * Q}
-  {  \STS(\STSS, \pred, \gname, \iname) \vdash \ownGhost{\gname}{(s_0, T):\STSMon{\STSS}} * P \vs[\mask_1 \uplus \{\iname\}][\mask_2 \uplus \{\iname\}] \Exists s', T'. \ownGhost{\gname}{(s', T'):\STSMon{\STSS}} * Q}
-\end{mathpar}
-
-\begin{proof}[Proof of \ruleref{Sts}]\label{pf:sts}
- We have to show
- \[\hoare{\ownGhost{\gname}{(s_0, T):\STSMon{\STSS}} * P}{\expr}{\Ret \val. \Exists s', T'. \ownGhost{\gname}{(s', T'):\STSMon{\STSS}} * Q}[\mask \uplus \{\iname\}]\]
- where $\val$, $s'$, $T'$ are free in $Q$.
- 
- First, by \ruleref{ACsq} with \ruleref{StsOpen} and \ruleref{StsClose} (after moving $(s, T) \ststrans (s', T')$ into the view shift using \ruleref{VSBoxOut}), it suffices to show
- \[\hoareV{\Exists s\in \upclose(\{s_0\}, T). \later\pred(s) * \ownGhost{\gname}{(s, \upclose(\{s_0\}, T), T)} * P}{\expr}{\Ret \val. \Exists s, T, S, s', T'. (s, T) \ststrans (s', T') * \later\pred(s') * \ownGhost{\gname}{(s, S, T):\STSMon{\STSS}} * Q(\val, s', T')}[\mask]\]
-
- Now, use \ruleref{Exist} to move the $s$ from the precondition into the context and use \ruleref{Csq} to (i)~fix the $s$ and $T$ in the postcondition to be the same as in the precondition, and (ii)~fix $S \eqdef \upclose(\{s_0\}, T)$.
- It remains to show:
- \[\hoareV{s\in \upclose(\{s_0\}, T) * \later\pred(s) * \ownGhost{\gname}{(s, \upclose(\{s_0\}, T), T)} * P}{\expr}{\Ret \val. \Exists s', T'. (s, T) \ststrans (s', T') * \later\pred(s') * \ownGhost{\gname}{(s, \upclose(\{s_0\}, T), T)} * Q(\val, s', T')}[\mask]\]
- 
- Finally, use \ruleref{BoxOut} to move $s\in \upclose(\{s_0\}, T)$ into the context, and \ruleref{Frame} on $\ownGhost{\gname}{(s, \upclose(\{s_0\}, T), T)}$:
- \[s\in \upclose(\{s_0\}, T) \vdash \hoare{\later\pred(s) * P}{\expr}{\Ret \val. \Exists s', T'. (s, T) \ststrans (s', T') * \later\pred(s') * Q(\val, s', T')}[\mask]\]
- 
- This holds by our premise.
-\end{proof}
-
-\begin{proof}[Proof of \ruleref{VSSts}]
-This is similar to above, so we only give the proof in short notation:
-
-\hproof{%
-	Context: $\knowInv\iname{\STSInv(\STSS, \pred, \gname)}$ \\
-	\pline[\mask_1 \uplus \{\iname\}]{
-		\ownGhost\gname{(s_0, T)} * P
-	} \\
-	\pline[\mask_1]{%
-		\Exists s. \later\pred(s) * \ownGhost\gname{(s, S, T)} * P
-	} \qquad by \ruleref{StsOpen} \\
-	Context: $s \in S \eqdef \upclose(\{s_0\}, T)$ \\
-	\pline[\mask_2]{%
-		 \Exists s', T'. \later\pred(s') * Q(s', T') * \ownGhost\gname{(s, S, T)}
-	} \qquad by premiss \\
-	Context: $(s, T) \ststrans (s', T')$ \\
-	\pline[\mask_2 \uplus \{\iname\}]{
-		\ownGhost\gname{(s', T')} * Q(s', T')
-	} \qquad by \ruleref{StsClose}
-}
-\end{proof}
-
-\subsection{Authoritative monoids with interpretation}\label{sec:authinterp}
-
-Building on \Sref{sec:auth}, after constructing the monoid $\auth{M}$ for a cancellative monoid $M$, we can tie an interpretation, $\pred : \mcarp{M} \to \Prop$, to the authoritative element of $M$, recovering reasoning that is close to the sharing rule in~\cite{krishnaswami+:icfp12}.
-
-Let $\pred_\bot$ be the extension of $\pred$ to $\mcar{M}$ with $\pred_\bot(\mzero) = \FALSE$.
-Now define
-\begin{align*}
-  \AuthInv(M, \pred, \gname) \eqdef{}& \exists \melt \in \mcar{M}.\; \ownGhost{\gname}{\authfull \melt:\auth{M}} * \pred_\bot(\melt) \\
-  \Auth(M, \pred, \gname, \iname) \eqdef{}& M~\textlog{cancellative} \land \knowInv{\iname}{\AuthInv(M, \pred, \gname)}
-\end{align*}
-
-The frame-preserving updates for $\auth{M}$ gives rise to the following view shifts:
-\begin{mathpar}
- \inferH{NewAuth}
-  {\infinite(\mask) \and M~\textlog{cancellative}}
-  {\later\pred_\bot(a) \vs[\mask] \exists \iname \in \mask, \gname.\; \Auth(M, \pred, \gname, \iname) * \ownGhost{\gname}{\authfrag a : \auth{M}}}
- \and
- \axiomH{AuthOpen}
-  {\Auth(M, \pred, \gname, \iname) \vdash \ownGhost{\gname}{\authfrag \melt : \auth{M}} \vsE[\{\iname\}][\emptyset] \exists \melt_f.\; \later\pred_\bot(\melt \mtimes \melt_f) * \ownGhost{\gname}{\authfull \melt \mtimes \melt_f, \authfrag a:\auth{M}}}
- \and
- \axiomH{AuthClose}
-  {\Auth(M, \pred, \gname, \iname) \vdash \later\pred_\bot(\meltB \mtimes \melt_f) * \ownGhost{\gname}{\authfull a \mtimes \melt_f, \authfrag a:\auth{M}} \vs[\emptyset][\{\iname\}] \ownGhost{\gname}{\authfrag \meltB : \auth{M}} }
-\end{mathpar}
-
-These view shifts in turn can be used to prove variants of the invariant rules:
-\begin{mathpar}
- \inferH{Auth}
-  {\forall \melt_f.\; \hoare{\later\pred_\bot(a \mtimes \melt_f) * P}{\expr}{\Ret\val. \exists \meltB.\; \later\pred_\bot(\meltB\mtimes \melt_f) * Q}[\mask]
-   \and \physatomic{\expr}}
-  {\Auth(M, \pred, \gname, \iname) \vdash \hoare{\ownGhost{\gname}{\authfrag a:\auth{M}} * P}{\expr}{\Ret\val. \exists \meltB.\; \ownGhost{\gname}{\authfrag \meltB:\auth{M}} * Q}[\mask \uplus \{\iname\}]}
- \and
- \inferH{VSAuth}
-  {\forall \melt_f.\; \later\pred_\bot(a \mtimes \melt_f) * P \vs[\mask_1][\mask_2] \exists \meltB.\; \later\pred_\bot(\meltB \mtimes \melt_f) * Q(\meltB)}
-  {\Auth(M, \pred, \gname, \iname) \vdash
-   \ownGhost{\gname}{\authfrag a:\auth{M}} * P \vs[\mask_1 \uplus \{\iname\}][\mask_2 \uplus \{\iname\}]
-   \exists \meltB.\; \ownGhost{\gname}{\authfrag \meltB:\auth{M}} * Q(\meltB)}
-\end{mathpar}
-
-
-\subsection{Ghost heap}
-\label{sec:ghostheap}%
-
-We define a simple ghost heap with fractional permissions.
-Some modules require a few ghost names per module instance to properly manage ghost state, but would like to expose to clients a single logical name (avoiding clutter).
-In such cases (\eg \Sref{sec:mcas}), we use these ghost heaps.
-
-We seek to implement the following interface:
-\newcommand{\GRefspecmaps}{\textsf{GMapsTo}}%
-\begin{align*}
- \exists& {\fgmapsto[]} : \textsort{Val} \times \mathbb{Q}_{>} \times \textsort{Val} \ra \textsort{Prop}.\;\\
-  & \All x, q, v. x \fgmapsto[q] v \Ra x \fgmapsto[q] v \land q \in (0, 1] \\
-  &\forall x, q_1, q_2, v, w.\; x \fgmapsto[q_1] v * x \fgmapsto[q_2] w \Leftrightarrow x \fgmapsto[q_1 + q_2] v * v = w\\
-  & \forall v.\; \TRUE \vs[\emptyset] \exists x.\; x \fgmapsto[1] v \\
-  & \forall x, v, w.\; x \fgmapsto[1] v \vs[\emptyset] x \fgmapsto[1] w
-\end{align*}
-We write $x \fgmapsto v$ for $\exists q.\; x \fgmapsto[q] v$ and $x \gmapsto v$ for $x \fgmapsto[1] v$.
-Note that $x \fgmapsto v$ is duplicable but cannot be boxed (as it depends on resources); \ie we have $x \fgmapsto v \Lra x \fgmapsto v * x \fgmapsto v$ but not $x \fgmapsto v \Ra \always x \fgmapsto v$.
-
-To implement this interface, allocate an instance $\gname_G$ of $\FHeap(\textdom{Val})$ and define
-\[
-	x \fgmapsto[q] v \eqdef
-	  \begin{cases}
-    	\ownGhost{\gname_G}{x \mapsto (q, v)} & \text{if $q \in (0, 1]$} \\
-    	\FALSE & \text{otherwise}
-    \end{cases}
-\]
-The view shifts in the specification follow immediately from \ruleref{GhostUpd} and the frame-preserving updates in~\Sref{sec:fheapm}.
-The first implication is immediate from the definition.
-The second implication follows by case distinction on $q_1 + q_2 \in (0, 1]$.
-

docs/equalities_and_entailments.md

+# Equalities in Iris
+
+Using std++ and Iris involves dealing with a few subtly different equivalence and equality
+relations, especially among propositions.
+This document summarizes these relations and the subtle distinctions among them.
+This is not a general introduction to Iris: instead, we discuss the different
+Iris equalities and the interface to their Coq implementation. In particular, we
+discuss:
+- Equality ("=") in the *on-paper* Iris metatheory
+- Coq's Leibniz equality (`=`) and std++'s setoid equivalence (`≡`);
+- Iris `n`-equivalence on OFEs (`≡{n}≡`);
+- Iris internal equality (`≡` in `bi_scope`);
+- Iris entailment and bi-entailment (`⊢`, `⊣⊢`).
+
+We use `code font` for Coq notation and "quotes" for paper notation.
+
+## Leibniz equality and setoids
+
+First off, in the metalogic (Coq) we have both the usual propositional (or
+Leibniz) equality `=`, and setoid equality `equiv` / `≡` (defined in `stdpp`).
+Both of these are metalogic connectives from the perspective of Iris, and as
+such are declared in Coq scope `stdpp_scope`.
+
+Setoid equality for a type `A` is defined by the instance of `Equiv A`.  This
+should be accompanied by an `Equivalence` instance which proves that the given
+relation indeed is an equivalence relation.  The handling of setoidsis based on
+Coq's
+[generalized rewriting](https://coq.inria.fr/refman/addendum/generalized-rewriting.html)
+facilities.
+
+Setoid equality can coincide with Leibniz equality, which is reflected by the
+`LeibnizEquiv` typeclass. We say that types with this property are "Leibniz
+types". `equivL` provides a convenient way to define a setoid with Leibniz
+equality. The tactics `fold_leibniz` and `unfold_leibniz` can be used to
+automatically turn all equalities of Leibniz types into `≡` or `=`.
+
+Given setoids `A` and `B` and a function `f : A → B`, an instance `Proper ((≡)
+==> (≡)) f` declares that `f` respects setoid equality, as usual in Coq. Such
+instances enable rewriting with setoid equalities.
+
+Here, stdpp adds the following facilities:
+- `solve_proper` for automating proofs of `Proper` instances.
+- `f_equiv` generalizes `f_equal` to setoids (and indeed arbitrary relations
+  registered with Coq's generalized rewriting). It will for instance turn the
+  goal `f a ≡ f b` into `a ≡ b` given an appropriate `Proper` instance (here,
+  `Proper ((≡) ==> (≡)) f`).
+
+## Defining Proper instances
+
+- For each function `f` that could be used in generalized rewriting (e.g., has
+  setoid, ofe, ordered arguments), there should be a `Params f n` instance. This
+  instance forces Coq's setoid rewriting mechanism not to rewrite in the first
+  `n` arguments of the function `f`. This significantly reduces backtracking
+  during `Proper` search and thus improves performance/avoids failing instance
+  searches that diverge. These first arguments typically include type variables
+  (`A : Type` or `B : A → Type`), type class parameters (`C A`), and Leibniz
+  arguments (`i : nat` or `i : Z`), so they cannot be rewritten or do not need
+  setoid rewriting.
+  Examples:
+  + For `cons : ∀ A, A → list A → list A` we have `Params (@cons) 1`,
+    indicating that the type argument named `A` is not up to rewriting.
+  + For `replicate : ∀ A, nat → A → list A` we have `Params (@replicate) 2`
+    indicating that the type argument `A` is not up to rewriting and that the
+    `nat`-typed argument also does not show up as rewriteable in the `Proper`
+    instance (because rewriting with `=` doesn't need such an instance).
+  + For `lookup : ∀ {Lookup K A M}, K → M → option A` we have
+    `Params (@lookup) 5`: there are 3 Type parameters, 1 type class, and a key
+    (which is Leibniz for all instances).
+- Consequenently, `Proper .. f` instances are always written in such a way
+  that `f` is partially applied with the first `n` arguments from `Params f n`.
+  Note that implicit arguments count here.
+  Further note that `Proper` instances never start with `(=) ==>`.
+  Examples:
+  + `Proper ((≡@{A}) ==> (≡@{list A}) ==> (≡@{list A})) cons`,
+    where `cons` is `@cons A`, matching the 1 in `Params`.
+  + `Proper ((≡@{A}) ==> (≡@{list A})) (replicate n)`,
+    where `replicate n` is `@replicate A n`.
+  + `Proper ((≡@{M}) ==> (≡@{option A})) (lookup k)`,
+    where `lookup k` is `@lookup K A M _ k`, so 5 parameters are fixed, matching
+    the `Params` instance.
+- Lemmas about higher-order functions often need `Params` premises.
+  These are also written using the convention above. Example:
+  ```coq
+  Lemma set_fold_ind `{FinSet A C} {B} (P : B → C → Prop) (f : A → B → B) (b : B) :
+    (∀ x, Proper ((≡) ==> impl) (P x)) → ...
+  ```
+- For premises involving predicates (such as `P` in `set_fold_ind` above), we
+  always write the weakest `Proper`: that is, use `impl` instead of `iff` (and
+  in Iris, write `(⊢)` instead of `(⊣⊢)`). For "simple" `P`s, there should be
+  instances to solve both `impl` and `iff` using `solve_proper`, and for more
+  complicated cases where `solve_proper` fails, an `impl` is much easier to
+  prove by hand than an `iff`.
+
+## Equivalences on OFEs
+
+On paper, OFEs involve two relations, equality "=" and distance "=_n". In Coq,
+equality "=" is formalized as setoid equality, written `≡` or `equiv`, as before;
+distance "=_n" is formalized as relation `dist n`, also written `≡{n}≡`.
+Tactics `solve_proper` and `f_equiv` also support distance. There is no
+correspondence to Coq's `=` on paper.
+
+Some OFE constructors choose interesting equalities.
+- `discreteO` constructs discrete OFEs (where distance coincides with setoid equality).
+- `leibnizO` constructs discrete OFEs (like `discreteO`) but using `equivL`, so
+  that both distance and setoid equality coincide with Leibniz equality. This
+  should only be used for types that do not have a setoid equality registered.
+
+Given OFEs `A` and `B`, non-expansive functions from `A` to `B` are functions
+`f : A → B` with a proof of `NonExpansive f` (which is notation for `∀ n, Proper
+(dist n ==> dist n) f`).
+
+The type `A -n> B` packages a function with a non-expansiveness proof. This is
+useful because `A -n> B` is itself an OFE, but should be avoided whenever
+possible as it requires the caller to specifically package up function and proof
+(which works particularly badly for lambda expressions).
+
+When an OFE structure on a function type is required but the domain is discrete,
+one can use the type `A -d> B`.  This has the advantage of not bundling any
+proofs, i.e., this is notation for a plain Coq function type. See the
+`discrete_fun` documentation in [`iris.algebra.ofe`](../iris/algebra/ofe.v)
+for further details.
+
+In both OFE function spaces (`A -n> B` and `A -d> B`), setoid equality is
+defined to be pointwise equality, so that functional extensionality holds for `≡`.
+
+## Inside the Iris logic
+
+Next, we introduce notions internal to the Iris logic. Such notions often
+overload symbols used for external notions; however, those overloaded notations
+are declared in scope `bi_scope`. When writing `(P)%I`, notations in `P` are
+resolved in `bi_scope`; this is done implicitly for the arguments of all
+variants of Iris entailments.
+
+The Iris logic has an internal concept of equality: if `a` and `b` are Iris
+terms of type `A`, then their internal equality is written (on paper) "a =_A b";
+in Coq, that's written `(a ≡@{A} b)%I` (notation for `bi_internal_eq` in scope
+`bi_scope`). You can leave away the `@{A}` to let Coq infer the type.
+
+As shown in the Iris appendix, an internal equality `(a ≡ b)%I` is interpreted using
+OFE distance at the current step-index. Many types have `_equivI` lemmas
+characterizing internal equality on them. For instance, if `f, g : A -d> B`,
+lemma `discrete_fun_equivI` shows that `(f ≡ g)%I` is equivalent to
+`(∀ x, f x ≡ g x)%I`.
+
+An alternative to internal equality is to embed Coq equality into the Iris logic
+using `⌜ _ ⌝%I`.  For discrete types, `(a ≡ b)%I` is equivalent to `⌜a ≡ b⌝%I`,
+and the latter can be moved into the Coq context, making proofs more convenient.
+For types with Leibniz equality, we can even equivalently write `⌜a = b⌝%I`, so
+no `Proper` is needed for rewriting.  Note that there is no on-paper equivalent
+to using these embedded Coq equalities for types that are not discrete/Leibniz.
+
+## Relations among Iris propositions
+
+In this section, we discuss relations among internal propositions, and in particular equality/equivalence of propositions themselves.
+Even though some of these notes generalize to all internal logics (other
+`bi`s), we focus on Iris propositions (`iProp`), to discuss both their proof
+theory and their model.
+As Iris propositions form a separation logic, we assume some familiarity with
+separation logics, connectives such as `-∗`, `∗`, `emp` and `→`, and the idea
+that propositions in separation logics are interpreted with predicates over
+resources (see for instance Sec. 2.1 of the MoSEL paper).
+
+In the metalogic, Iris defines the entailment relation between uniform
+predicates: intuitively, `P` entails `Q` (written `P ⊢ Q`) means that `P`
+implies `Q` on _every_ resource and at all step-indices (for details see Iris appendix [Sec. 6]).
+Entailment `P ⊢ Q` is distinct from the magic wand, `(P -∗ Q)%I`: the former is
+a Coq-level statement of type `Prop`, the latter an Iris-level statement of type
+`iProp`.  However, the two are closely related: `P ⊢ Q` is equivalent to `emp ⊢
+P -∗ Q` (per Iris lemmas `entails_wand` and `wand_entails`).  Iris also defines
+a "unary" form of entailment, `⊢ P`, which is short for `emp ⊢ P`.
+We can also use bi-entailment `P ⊣⊢ Q` to express that both `P ⊢ Q` and `Q ⊢ P` hold.
+
+On paper, uniform predicates are defined by quotienting by an equivalence
+relation ([Iris appendix, Sec. 3.3]); in Coq, that relation is chosen as the
+setoid equivalent for the type of Iris propositions.
+This equivalence is actually equivalent to bi-entailment, per lemma `equiv_spec`:
+```coq
+Lemma equiv_spec P Q : P ≡ Q ↔ (P ⊢ Q) ∧ (Q ⊢ P).
+```
+Relying on this equivalence, bi-entailment `P ⊣⊢ Q` is defined as notation for `≡`.
+
+## Internal equality of Iris propositions
+
+Inside the logic, we can use internal equality `(≡)%I` on any type, including
+propositions themselves.  However, there is a pitfall here: internal equality
+`≡` is in general strictly stronger than `∗-∗` (the bidirectional version of the
+magic wand), because `Q1 ≡ Q2` means that `Q1` and `Q2` are equivalent
+_independently of the available resources_. This makes `≡` even stronger than `□
+(_ ∗-∗ _)`, because `□` does permit the usage of some resources (namely, the RA
+core of the available resources can still be used).
+
+The two notions of internal equivalence and equality of propositions are related
+by the following law of propositional extensionality:
+```coq
+Lemma prop_ext P Q : P ≡ Q ⊣⊢ ■ (P ∗-∗ Q).
+```
+This uses the plainly modality `■` to reflect that equality corresponds to
+equivalence without any resources available: `■ R` says that `R` holds
+independent of any resources that we might own (but still taking into account
+the current step-index).

docs/heap_lang.md

+# HeapLang overview
+
+HeapLang is the example language that gets shipped with Iris.  It is not the
+only language you can reason about with Iris, but meant as a reasonable demo
+language for simple examples.
+
+## Language
+
+HeapLang is a lambda-calculus with operations to allocate individual locations,
+`load`, `store`, `CmpXchg` (compare-and-exchange) and `FAA` (fetch-and-add). Moreover,
+it has a `fork` construct to spawn new threads.  In terms of values, we have
+integers, booleans, unit, heap locations, as well as (binary) sums and products.
+
+Recursive functions are the only binders, so the sum elimination (`Case`)
+expects both branches to be of function type and passes them the data component
+of the sum.
+
+For technical reasons, the only terms that are considered values are those that
+begin with the `Val` expression former.  This means that, for example, `Pair
+(Val a) (Val b)` is *not* a value -- it reduces to `Val (PairV a b)`, which is.
+This leads to some administrative redexes, and to a distinction between "value
+pairs", "value sums", "value closures" and their "expression" counterparts.
+
+However, this also makes values syntactically uniform, which we exploit in the
+definition of substitution which just skips over `Val` terms, because values
+should be closed and hence not affected by substitution.  As a consequence, we
+can entirely avoid even talking about "closed terms", that notion just does not
+have to come up anywhere.  We also exploit this when writing specifications,
+because we can just write lemmas involving terms of the form `Val ?v` and Coq
+can determine `?v` by unification (because all values start with the `Val`
+constructor).
+
+## Notation
+
+Notation for writing HeapLang terms is defined in
+[`notation.v`](../iris_heap_lang/notation.v).  There are two scopes, `%E` for
+expressions and `%V` for values.  For example, `(a, b)%E` is an expression pair
+and `(a, b)%V` a value pair.  The `e` of a `WP e {{ Q }}` is implicitly in `%E`
+scope.
+
+We define a whole lot of short-hands, such as non-recursive functions (`λ:`),
+let-bindings, sequential composition, and a more conventional `match:` that has
+binders in both branches.
+
+The widely used `#` is a short-hand to turn a basic literal (an integer, a
+location, a boolean literal or a unit value) into a value.  Since values coerce
+to expressions, `#` is widely used whenever a Coq value needs to be placed into
+a HeapLang term.
+
+## Tactics
+
+HeapLang comes with a bunch of tactics that facilitate stepping through HeapLang
+programs as part of proving a weakest precondition.  All of these tactics assume
+that the current goal is of the shape `WP e @ E {{ Q }}`.
+
+Tactics to take one or more pure program steps:
+
+- `wp_pure pat credit:"H"`: Perform one pure reduction step. `pat` optionally
+  defines the pattern that the redex has to match; it defaults to `_` (any
+  redex). The `credit:` argument is optional, too; when present, a later credit
+  will be generated in a fresh hypothesis named `"H"`.
+  Pure steps are defined by the `PureExec` typeclass and include beta reduction,
+  projections, constructors, as well as unary and binary arithmetic operators.
+- `wp_pures`: Perform as many pure reduction steps as possible. This
+  tactic will **not** reduce lambdas/recs that are hidden behind a definition.
+  If the computation reaches a value, the `WP` will be entirely removed and the
+  postcondition becomes the new goal.
+- `wp_rec`, `wp_lam`: Perform a beta reduction.  Unlike `wp_pure`, this will
+  also reduce lambdas that are hidden behind a definition.
+- `wp_let`, `wp_seq`: Reduce a let-binding or a sequential composition.
+- `wp_proj`: Reduce a projection.
+- `wp_if_true`, `wp_if_false`, `wp_if`: Reduce a conditional expression. The
+  discriminant must already be `true` or `false`.
+- `wp_unop`, `wp_binop`, `wp_op`: Reduce a unary, binary or either kind of
+  arithmetic operator.
+- `wp_case`, `wp_match`: Reduce `Case`/`match:` constructs.
+- `wp_inj`, `wp_pair`, `wp_closure`: Reduce constructors that turn expression
+  sums/pairs/closures into their value counterpart.
+
+Tactics for the heap:
+
+- `wp_alloc l as "H"`: Reduce an allocation instruction and call the new
+  location `l` (in the Coq context) and the points-to assertion `H` (in the
+  spatial context).  You can leave out the `as "H"` to introduce it as an
+  anonymous assertion, which is equivalent to `as "?"`.
+- `wp_load`: Reduce a load operation.  This automatically finds the points-to
+  assertion in the spatial context, and fails if it cannot be found.
+- `wp_store`: Reduce a store operation.  This automatically finds the points-to
+  assertion in the spatial context, and fails if it cannot be found.
+- `wp_cmpxchg_suc`, `wp_cmpxchg_fail`: Reduce a succeeding/failing CmpXchg.  This
+  automatically finds the points-to assertion.  It also automatically tries to
+  solve the (in)equality to show that the CmpXchg succeeds/fails, and opens a new
+  goal if it cannot prove this goal.
+- `wp_cmpxchg as H1 | H2`: Reduce a CmpXchg, performing a case distinction over whether
+  it succeeds or fails.  This automatically finds the points-to assertion.  The
+  proof of equality in the first new subgoal will be called `H1`, and the proof
+  of the inequality in the second new subgoal will be called `H2`.
+- `wp_faa`: Reduce a FAA.  This automatically finds the points-to assertion.
+
+Further tactics:
+
+- `wp_bind pat`: Apply the bind rule to "focus" the term matching `pat`.  For
+  example, `wp_bind (!_)%E` focuses a load operation.  This is useful in
+  particular when accessing invariants, which is only possible when the `WP` in
+  the goal is for a single, atomic operation -- `wp_bind` can be used to bring
+  the goal into the right shape.
+- `wp_apply pm_trm as (x1 ... xn) "ipat1 ... ipatn"`:
+  Apply a lemma whose conclusion is a `WP`, automatically applying `wp_bind` as
+  needed. The `as` clause is optional and can be used to introduce the
+  postcondition; this works particularly well for Texan triples. See the
+  [ProofMode docs](./proof_mode.md) for an explanation of `pm_trm` and `ipat`.
+- `wp_smart_apply pm_trm as (x1 ... xn) "ipat1 ... ipatn"`:
+  like `wp_apply`, but also performs pure reduction steps to reveal a redex that
+  matches `pm_trm`. To be precise, if applying the lemma fails, `wp_smart_apply`
+  will perform a step of pure reduction (via `wp_pure`), and repeat. (This means
+  that `wp_smart_apply` is not the same as `wp_pures; wp_apply`.)
+
+There is no tactic for `Fork`, just do `wp_apply wp_fork`.
+
+To verify a recursive function, use `iLöb`.  Make sure you do `wp_pures` before
+running `iLöb`; otherwise the induction hypothesis will likely not be applicable
+when you need it.  (This makes sure that all administrative redexes are reduced
+in your induction hypothesis, just like we state our `WP` specifications with
+all of the redexes reduced.)
+
+## Notation and lemmas for derived notions involving a thunk
+
+Sometimes, it is useful to define a derived notion in HeapLang that involves
+thunks.  For example, the parallel composition `e1 ||| e2` is definable in
+HeapLang, but that requires thunking `e1` and `e2` before passing them to
+`par`. (This is defined in [`par.v`](../iris_heap_lang/lib/par.v).)  However,
+this is somewhat subtle because of the distinction between expression lambdas
+and value lambdas.
+
+The normal `e1 ||| e2` notation uses expression lambdas, because clearly we want
+`e1` and `e2` to behave normal under substitution (which they would not in a
+value lambda).  However, the *specification* for parallel composition should use
+value lambdas, because prior to applying it the term will be reduced as much as
+possible to achieve a normal form.  To facilitate this, we define a copy of the
+`e1 ||| e2` notation in the value scope that uses value lambdas.
+This is not actually a value, but we still put it in the value scope to
+differentiate from the other notation that uses expression lambdas.  (In the
+future, we might decide to add a separate scope for this.)  Then, we write the
+canonical specification using the notation in the value scope.
+
+This works very well for non-recursive notions.  For `while` loops, the
+situation is unfortunately more complex and proving the desired specification
+will likely be more involved than expected, see this [discussion].
+
+[discussion]: https://gitlab.mpi-sws.org/iris/iris/merge_requests/210#note_32842

docs/ibus

+;; Usage: copy to ~/.m17n.d/coq.mim
+
+(input-method t coq)
+(description "Input method for Coq")
+(title "Coq")
+
+(map (trans
+
+;; Standard LaTeX math notations
+  ("\\forall"         "∀")
+  ("\\exists"         "∃")
+  ("\\lam"            "λ")
+  ("\\not"            "¬")
+  ("\\/"              "∨")
+  ("/\\"              "∧")
+  ("->"               "→")
+  ("<->"              "↔")
+  ("\\<-"             "←") ;; we add a backslash because the plain <- is used for the rewrite tactic
+  ("\\=="             "≡")
+  ("\\/=="            "≢")
+  ("/="               "≠")
+  ("<="               "≤")
+  ("\\in"             "∈")
+  ("\\notin"          "∉")
+  ("\\cup"            "∪")
+  ("\\cap"            "∩")
+  ("\\setminus"       "∖")
+  ("\\subset"         "⊂")
+  ("\\subseteq"       "⊆")
+  ("\\sqsubseteq"     "⊑")
+  ("\\sqsubseteq"     "⊑")
+  ("\\notsubseteq"    "⊈")
+  ("\\meet"           "⊓")
+  ("\\join"           "⊔")
+  ("\\top"            "⊤")
+  ("\\bottom"         "⊥")
+  ("\\vdash"          "⊢")
+  ("\\dashv"          "⊣")
+  ("\\Vdash"          "⊨")
+  ("\\infty"          "∞")
+  ("\\comp"           "∘")
+  ("\\prf"            "↾")
+  ("\\bind"           "≫=")
+  ("\\mapsto"         "↦")
+  ("\\hookrightarrow" "↪")
+  ("\\uparrow"        "↑")
+
+;; Iris specific
+  ("\\fun"            "λ")
+  ("\\mult"           "⋅")
+  ("\\ent"            "⊢")
+  ("\\valid"          "✓")
+  ("\\diamond"        "◇")
+  ("\\box"            "□")
+  ("\\bbox"           "■")
+  ("\\later"          "▷")
+  ("\\pred"           "φ")
+  ("\\and"            "∧")
+  ("\\or"             "∨")
+  ("\\comp"           "∘")
+  ("\\ccomp"          "◎")
+  ("\\all"            "∀")
+  ("\\ex"             "∃")
+  ("\\to"             "→")
+  ("\\sep"            "∗")
+  ("\\lc"             "⌜")
+  ("\\rc"             "⌝")
+  ("\\Lc"             "⎡")
+  ("\\Rc"             "⎤")
+  ("\\empty"          "∅")
+  ("\\Lam"            "Λ")
+  ("\\Sig"            "Σ")
+  ("\\-"              "∖")
+  ("\\aa"             "●")
+  ("\\af"             "◯")
+  ("\\auth"           "●")
+  ("\\frag"           "◯")
+  ("\\iff"            "↔")
+  ("\\gname"          "γ")
+  ("\\incl"           "≼")
+  ("\\latert"         "▶")
+  ("\\update"         "⇝")
+  ("\\bind"           "≫=")
+
+;; accents (for iLöb)
+  ("\\\"o" "ö")
+
+;; subscripts and superscripts
+  ("^^+" "⁺") ("__+" "₊") ("^^-" "⁻")
+  ("__0" "₀") ("__1" "₁") ("__2" "₂") ("__3" "₃") ("__4" "₄")
+  ("__5" "₅") ("__6" "₆") ("__7" "₇") ("__8" "₈") ("__9" "₉")
+
+  ("__a" "ₐ") ("__e" "ₑ") ("__h" "ₕ") ("__i" "ᵢ") ("__k" "ₖ")
+  ("__l" "ₗ") ("__m" "ₘ") ("__n" "ₙ") ("__o" "ₒ") ("__p" "ₚ")
+  ("__r" "ᵣ") ("__s" "ₛ") ("__t" "ₜ") ("__u" "ᵤ") ("__v" "ᵥ") ("__x" "ₓ")
+
+;; Greek alphabet
+  ("\\Alpha"  "Α")   ("\\alpha"  "α")
+  ("\\Beta"   "Β")   ("\\beta"   "β")
+  ("\\Gamma"  "Γ")   ("\\gamma"  "γ")
+  ("\\Delta"  "Δ")   ("\\delta"  "δ")
+  ("\\Epsilon"  "Ε") ("\\epsilon"  "ε")
+  ("\\Zeta"   "Ζ")   ("\\zeta"   "ζ")
+  ("\\Eta"  "Η")     ("\\eta"  "η")
+  ("\\Theta"  "Θ")   ("\\theta"  "θ")
+  ("\\Iota"   "Ι")   ("\\iota"   "ι")
+  ("\\Kappa"  "Κ")   ("\\kappa"  "κ")
+  ("\\Lamda"  "Λ")   ("\\lamda"  "λ")
+  ("\\Lambda"   "Λ") ("\\lambda"   "λ")
+  ("\\Mu"   "Μ")     ("\\mu"   "μ")
+  ("\\Nu"   "Ν")     ("\\nu"   "ν")
+  ("\\Xi"   "Ξ")     ("\\xi"   "ξ")
+  ("\\Omicron"  "Ο") ("\\omicron"  "ο")
+  ("\\Pi"   "Π")     ("\\pi"   "π")
+  ("\\Rho"  "Ρ")     ("\\rho"  "ρ")
+  ("\\Sigma"  "Σ")   ("\\sigma"  "σ")
+  ("\\Tau"  "Τ")     ("\\tau"  "τ")
+  ("\\Upsilon"  "Υ") ("\\upsilon"  "υ")
+  ("\\Phi"  "Φ")     ("\\phi"  "φ")
+  ("\\Chi"  "Χ")     ("\\chi"  "χ")
+  ("\\Psi"  "Ψ")     ("\\psi"  "ψ")
+  ("\\Omega"  "Ω")   ("\\omega"  "ω")
+))
+(state (init (trans)))

docs/iris.tex

-\documentclass[10pt]{article}
-\usepackage{lmodern}
-\usepackage[T1]{fontenc}
-\usepackage[utf8]{inputenc}
-
-\newif\ifslow\slowfalse %\slowtrue
-\ifslow
-	\usepackage[english]{babel}
-	\usepackage[babel=true]{microtype}
-\fi
-\usepackage[top=1in, bottom=1in, left=1.25in, right=1.25in]{geometry}
-
-\usepackage[backend=biber]{biblatex}
-\bibliography{bib}
-
-\input{setup}
-
-\begin{document}
-
-\title{\bfseries The Iris Documentation}
-
-%FIXME any better way to do this?
-\author{%
- Ralf Jung \\ MPI-SWS \& Saarland University \\ jung@mpi-sws.org \and
- David Swasey \\ MPI-SWS \\ swasey@mpi-sws.org \andcr
- Filip Sieczkowski \\ Aarhus University \\ filips@cs.au.dk \and
- Kasper Svendsen \\ Aarhus University \\ ksvendsen@cs.au.dk \and
- Aaron Turon \\ Mozilla Research \\ aturon@mozilla.com \andcr
- Lars Birkedal \\ Aarhus University \\ birkedal@cs.au.dk \and
- Derek Dreyer \\ MPI-SWS \\ dreyer@mpi-sws.org}
-
-\def\andcr{\end{tabular}\\\begin{tabular}[t]{c}}% see \@maketitle in article.cls and \and in latex.ltx
-\maketitle
-\let\andcr\relax%
-
-\thispagestyle{empty}
-
-%\clearpage
-\tableofcontents
-
-\clearpage\begingroup
-\input{algebra}
-\endgroup\clearpage\begingroup
-\input{constructions}
-\endgroup\clearpage\begingroup
-\input{logic}
-\endgroup\clearpage\begingroup
-\input{model}
-\endgroup\clearpage\begingroup
-\input{derived}
-\endgroup\clearpage\begingroup
-\printbibliography
-
-\end{document}

docs/logic.tex

-
-\section{Parameters to the logic}
-
-\begin{itemize}
-% \item A set \textdom{Exp} of \emph{expressions} (metavariable $\expr$) with a
-%   subset \textdom{Val} of values ($\val$).  We assume that if $\expr$ is an
-%   expression then so is $\fork{\expr}$.  We moreover assume a value
-%   \textsf{fRet} (giving the intended return value of a fork), and we assume that
-%   \begin{align*}
-%     \fork{\expr} &\notin \textdom{Val} \\
-%     \fork{\expr_1} = \fork{\expr_2} &\implies \expr_1 = \expr_2
-%   \end{align*}
-\item A set $\textdom{Ectx}$ of \emph{evaluation contexts} ($\ectx$) that includes the empty context $[\; ]$,
-  a plugging operation $\ectx[\expr]$ that produces an expression, and context composition $\circ$
-  satisfying the following axioms:
-  \begin{align*}
-    [\; ][ \expr ] &= \expr \\
-    \ectx_1[\ectx_2[\expr]] &= (\ectx_1 \circ \ectx_2) [\expr] \\
-    \ectx_1[\expr] = \ectx_2[\expr] &\implies \ectx_1 = \ectx_2 \\
-    \ectx[\expr_1] = \ectx[\expr_2] &\implies \expr_1 = \expr_2 \\
-    \ectx_1 \circ \ectx_2 = [\; ] &\implies \ectx_1 = \ectx_2 = [\; ] \\
-    \ectx[\expr] \in \textdom{Val} &\implies \ectx = [\;] \\
-%    \ectx[\expr] = \fork{\expr'} &\implies \ectx = [\;]
-  \end{align*}
-
-\item A set \textdom{State} of shared machine states (\eg heaps), metavariable $\state$.
-\item An \emph{atomic stepping relation} \[
-  (- \step -) \subseteq (\textdom{State} \times \textdom{Exp}) \times (\textdom{State} \times \textdom{Exp})
-\]
-and notions of an expression to be \emph{reducible} or \emph{stuck}, such that
-\begin{align*}
-  \textlog{reducible}(\expr) &\iff \Exists \state, \expr_2, \state_2. \cfg{\state}{\expr} \step \cfg{\state_2}{\expr_2} \\
-%  \textlog{stuck}(\expr) &\iff \All \ectx, \expr'. \expr = \ectx[\expr'] \implies
-   \lnot \textlog{reducible}(\expr')
-\end{align*}
-and the following hold
-% \begin{align*}
-% &\textlog{stuck}(\fork{\expr})& \\
-%  &\textlog{stuck}(\val)&\\
-%  &\ectx[\expr] = \ectx'[\expr'] \implies \textlog{reducible}(\expr') \implies
-%   \expr \notin \textdom{Val} \implies \Exists \ectx''. \ectx' = \ectx \circ \ectx'' &\mbox{(step-by-value)} \\
-%  &\ectx[\expr] = \ectx'[\fork{\expr'}] \implies
-%   \expr \notin \textdom{Val} \implies \Exists \ectx''. \ectx' = \ectx \circ \ectx'' &\mbox{(fork-by-value)} \\
-% \end{align*}
-
-\item A predicate \textlog{atomic} on expressions satisfying
-  \begin{align*}
-   &\textlog{atomic}(\expr) \implies \textlog{reducible}(\expr) &\\
-   &\textlog{atomic}(\expr) \implies \cfg{\state}{\expr} \step \cfg{\state_2}{\expr_2} \implies \expr_2 \in \textdom{Val} &\mbox{(atomic-step)}
-  \end{align*}
-
-
-\item A commutative monoid with zero, $M$.
-That is, a set $\mcar{M}$ with two distinguished elements $\mzero$ (zero, undefined) and $\munit$ (one, unit) and an operation $\mtimes$ (times, combine) such that
-\begin{align*}
- \melt \mtimes \meltB &= \meltB \mtimes \melt \\
- \munit \mtimes \melt &= \melt \\
- (\melt \mtimes \meltB) \mtimes \meltC &= \melt \mtimes (\meltB \mtimes \meltC) \\
- \mzero \mtimes \melt &= \mzero \\
- \mzero &\neq \munit
-\end{align*}
-Let $\mcarp{M} \eqdef |\monoid| \setminus \{\mzero\}$.
-
-\item Arbitrary additional types and terms.
-\end{itemize}
-
-\section{The concurrent language}
-
-\paragraph{Machine syntax}
-\[
-	\tpool \in \textdom{ThreadPool} \eqdef \mathbb{N} \fpfn \textdom{Exp}
-\]
-
-\judgment{Machine reduction} {\cfg{\state}{\tpool} \step
-  \cfg{\state'}{\tpool'}}
-\begin{mathpar}
-\infer
-  {\cfg{\state}{\expr} \step \cfg{\state'}{\expr'}}
-  {\cfg{\state}{\tpool [i \mapsto \ectx[\expr]]} \step
-     \cfg{\state'}{\tpool [i \mapsto \ectx[\expr']]}}
-% \and
-% \infer
-%   {}
-%   {\cfg{\state}{\tpool [i \mapsto \ectx[\fork{\expr}]]} \step
-%     \cfg{\state}{\tpool [i \mapsto \ectx[\textsf{fRet}]] [j \mapsto \expr]}}
-\end{mathpar}
-
-\section{Syntax}
-
-\subsection{Grammar}\label{sec:grammar}
-
-\paragraph{Signatures.}
-We use a signature to account syntactically for the logic's parameters.
-A \emph{signature} $\Sig = (\SigType, \SigFn)$ comprises a set
-\[
-	\SigType \supseteq \{ \textsort{Val}, \textsort{Exp}, \textsort{Ectx}, \textsort{State}, \textsort{Monoid}, \textsort{InvName}, \textsort{InvMask}, \Prop \}
-\]
-of base types (or base \emph{sorts}) and a set $\SigFn$ of typed function symbols.
-This means that each function symbol has an associated \emph{arity} comprising a natural number $n$ and an ordered list of $n+1$ base types.
-We write
-\[
-	\sigfn : \type_1, \dots, \type_n \to \type_{n+1} \in \SigFn
-\]
-to express that $\sigfn$ is a function symbol with the indicated arity.
-\dave{Say something not-too-shabby about adequacy: We don't spell out what it means.}
-
-\paragraph{Syntax.}
-Iris syntax is built up from a signature $\Sig$ and a countably infinite set $\textdom{Var}$ of variables (ranged over by metavariables $x$, $y$, $z$):
-
-\begin{align*}
-  \term, \prop, \pred ::={}&
-      x \mid
-      \sigfn(\term_1, \dots, \term_n) \mid
-      \unitval \mid
-      (\term, \term) \mid
-      \pi_i\; \term \mid
-      \Lam x.\term \mid
-      \term\;\term  \mid
-      \mzero \mid
-      \munit \mid
-      \term \mtimes \term \mid
-\\&
-    \FALSE \mid
-    \TRUE \mid
-    \term =_\sort \term \mid
-    \prop \Ra \prop \mid
-    \prop \land \prop \mid
-    \prop \lor \prop \mid
-    \prop * \prop \mid
-    \prop \wand \prop \mid
-\\&
-    \MU \var. \pred  \mid
-    \Exists \var:\sort. \prop \mid
-    \All \var:\sort. \prop \mid
-\\&
-    \knowInv{\term}{\prop} \mid
-    \ownGGhost{\term} \mid
-    \ownPhys{\term} \mid
-    \always\prop \mid
-    {\later\prop} \mid
-    \pvsA{\prop}{\term}{\term} \mid
-    \dynA{\term}{\pred}{\term} \mid
-    \timeless{\prop}
-\\[0.4em]
-  \sort ::={}&
-      \type \mid
-      \unitsort \mid
-      \sort \times \sort \mid
-      \sort \to \sort
-\end{align*}
-Recursive predicates must be \emph{guarded}: in $\MU \var. \pred$, the variable $\var$ can only appear under the later $\later$ modality.
-
-\paragraph{Metavariable conventions.}
-We introduce additional metavariables ranging over terms and generally let the choice of metavariable indicate the term's sort:
-\[
-\begin{array}{r|l}
- \text{metavariable} & \text{sort} \\\hline
-  \term, \termB & \text{arbitrary} \\
-  \val, \valB & \textsort{Val} \\
-  \expr & \textsort{Exp} \\
-  \ectx & \textsort{Ectx} \\
-  \state & \textsort{State} \\
-\end{array}
-\qquad\qquad
-\begin{array}{r|l}
- \text{metavariable} & \text{sort} \\\hline
-  \iname & \textsort{InvName} \\
-  \mask & \textsort{InvMask} \\
-  \melt, \meltB & \textsort{Monoid} \\
-  \prop, \propB, \propC & \Prop \\
-  \pred, \predB, \predC & \sort\to\Prop \text{ (when $\sort$ is clear from context)} \\
-\end{array}
-\]
-
-\paragraph{Variable conventions.}
-We often abuse notation, using the preceding \emph{term} meta-variables to range over (bound) \emph{variables}.
-We omit type annotations in binders, when the type is clear from context.
-
-
-\subsection{Types}\label{sec:types}
-
-Iris terms are simply-typed.
-The judgment $\vctx \proves_\Sig \wtt{\term}{\sort}$ expresses that, in signature $\Sig$ and variable context $\vctx$, the term $\term$ has sort $\sort$.
-In giving the rules for this judgment, we omit the signature (which does not change).
-
-A variable context, $\vctx = x_1:\sort_1, \dots, x_n:\sort_n$, declares a list of variables and their sorts.
-In writing $\vctx, x:\sort$, we presuppose that $x$ is not already declared in $\vctx$.
-
-\judgment{Well-typed terms}{\vctx \proves_\Sig \wtt{\term}{\sort}}
-\begin{mathparpagebreakable}
-%%% variables and function symbols
-	\axiom{x : \sort \proves \wtt{x}{\sort}}
-\and
-	\infer{\vctx \proves \wtt{\term}{\sort}}
-		{\vctx, x:\sort' \proves \wtt{\term}{\sort}}
-\and
-	\infer{\vctx, x:\sort', y:\sort' \proves \wtt{\term}{\sort}}
-		{\vctx, x:\sort' \proves \wtt{\term[x/y]}{\sort}}
-\and
-	\infer{\vctx_1, x:\sort', y:\sort'', \vctx_2 \proves \wtt{\term}{\sort}}
-		{\vctx_1, x:\sort'', y:\sort', \vctx_2 \proves \wtt{\term[y/x,x/y]}{\sort}}
-\and
-	\infer{
-		\vctx \proves \wtt{\term_1}{\type_1} \and
-		\cdots \and
-		\vctx \proves \wtt{\term_n}{\type_n} \and
-		\sigfn : \type_1, \dots, \type_n \to \type_{n+1} \in \SigFn
-	}{
-		\vctx \proves \wtt {\sigfn(\term_1, \dots, \term_n)} {\type_{n+1}}
-	}
-%%% products
-\and
-	\axiom{\vctx \proves \wtt{\unitval}{\unitsort}}
-\and
-	\infer{\vctx \proves \wtt{\term}{\sort_1} \and \vctx \proves \wtt{\termB}{\sort_2}}
-		{\vctx \proves \wtt{(\term,\termB)}{\sort_1 \times \sort_2}}
-\and
-	\infer{\vctx \proves \wtt{\term}{\sort_1 \times \sort_2} \and i \in \{1, 2\}}
-		{\vctx \proves \wtt{\pi_i\,\term}{\sort_i}}
-%%% functions
-\and
-	\infer{\vctx, x:\sort \proves \wtt{\term}{\sort'}}
-		{\vctx \proves \wtt{\Lam x. \term}{\sort \to \sort'}}
-\and
-	\infer
-	{\vctx \proves \wtt{\term}{\sort \to \sort'} \and \wtt{\termB}{\sort}}
-	{\vctx \proves \wtt{\term\;\termB}{\sort'}}
-%%% monoids
-\and
-	\axiom{\vctx \proves \wtt{\mzero}{\textsort{Monoid}}}
-\and
-	\axiom{\vctx \proves \wtt{\munit}{\textsort{Monoid}}}
-\and
-	\infer{\vctx \proves \wtt{\melt}{\textsort{Monoid}} \and \vctx \proves \wtt{\meltB}{\textsort{Monoid}}}
-		{\vctx \proves \wtt{\melt \mtimes \meltB}{\textsort{Monoid}}}
-%%% props and predicates
-\\
-	\axiom{\vctx \proves \wtt{\FALSE}{\Prop}}
-\and
-	\axiom{\vctx \proves \wtt{\TRUE}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\term}{\sort} \and \vctx \proves \wtt{\termB}{\sort}}
-		{\vctx \proves \wtt{\term =_\sort \termB}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop} \and \vctx \proves \wtt{\propB}{\Prop}}
-		{\vctx \proves \wtt{\prop \Ra \propB}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop} \and \vctx \proves \wtt{\propB}{\Prop}}
-		{\vctx \proves \wtt{\prop \land \propB}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop} \and \vctx \proves \wtt{\propB}{\Prop}}
-		{\vctx \proves \wtt{\prop \lor \propB}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop} \and \vctx \proves \wtt{\propB}{\Prop}}
-		{\vctx \proves \wtt{\prop * \propB}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop} \and \vctx \proves \wtt{\propB}{\Prop}}
-		{\vctx \proves \wtt{\prop \wand \propB}{\Prop}}
-\and
-	\infer{
-		\vctx, \var:\sort\to\Prop \proves \wtt{\pred}{\sort\to\Prop} \and
-		\text{$\var$ is guarded in $\pred$}
-	}{
-		\vctx \proves \wtt{\MU \var. \pred}{\sort\to\Prop}
-	}
-\and
-	\infer{\vctx, x:\sort \proves \wtt{\prop}{\Prop}}
-		{\vctx \proves \wtt{\Exists x:\sort. \prop}{\Prop}}
-\and
-	\infer{\vctx, x:\sort \proves \wtt{\prop}{\Prop}}
-		{\vctx \proves \wtt{\All x:\sort. \prop}{\Prop}}
-\and
-	\infer{
-		\vctx \proves \wtt{\prop}{\Prop} \and
-		\vctx \proves \wtt{\iname}{\textsort{InvName}}
-	}{
-		\vctx \proves \wtt{\knowInv{\iname}{\prop}}{\Prop}
-	}
-\and
-	\infer{\vctx \proves \wtt{\melt}{\textsort{Monoid}}}
-		{\vctx \proves \wtt{\ownGGhost{\melt}}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\state}{\textsort{State}}}
-		{\vctx \proves \wtt{\ownPhys{\state}}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop}}
-		{\vctx \proves \wtt{\always\prop}{\Prop}}
-\and
-	\infer{\vctx \proves \wtt{\prop}{\Prop}}
-		{\vctx \proves \wtt{\later\prop}{\Prop}}
-\and
-	\infer{
-		\vctx \proves \wtt{\prop}{\Prop} \and
-		\vctx \proves \wtt{\mask}{\textsort{InvMask}} \and
-		\vctx \proves \wtt{\mask'}{\textsort{InvMask}}
-	}{
-		\vctx \proves \wtt{\pvsA{\prop}{\mask}{\mask'}}{\Prop}
-	}
-\and
-	\infer{
-		\vctx \proves \wtt{\expr}{\textsort{Exp}} \and
-		\vctx \proves \wtt{\pred}{\textsort{Val} \to \Prop} \and
-		\vctx \proves \wtt{\mask}{\textsort{InvMask}}
-	}{
-		\vctx \proves \wtt{\dynA{\expr}{\pred}{\mask}}{\Prop}
-	}
-\and
-	\infer{
-		\vctx \proves \wtt{\prop}{\Prop}
-	}{
-		\vctx \proves \wtt{\timeless{\prop}}{\Prop}
-	}
-\end{mathparpagebreakable}
-
-
-\section{Base logic}
-
-The judgment $\vctx \mid \pfctx \proves \prop$ says that with free variables $\vctx$, proposition $\prop$ holds whenever all assumptions $\pfctx$ hold.
-We implicitly assume that an arbitrary variable context, $\vctx$, is added to every constituent of the rules.
-Axioms $\prop \Ra \propB$ stand for judgments $\vctx \mid \cdot \proves \prop \Ra \propB$ with no assumptions.
-(Bi-implications are analogous.)
-
-% \subsubsection{Judgments}
-% 
-% Proof rules implicitly assume well-sortedness.  
-
-% e\subsection{Laws of intuitionistic higher-order logic with guarded recursion over a simply-typed lambda calculus}\label{sec:HOL}
-
-This is entirely standard.
-
-Soundness follows from the theorem that ${\cal U}(\any, \textdom{Prop})
-: {\cal U}^{\textrm{op}} \to \textrm{Poset}$ is a hyperdoctrine. 
-
-\begin{mathpar}
-\inferH{Asm}
-  {\prop \in \pfctx}
-  {\pfctx \proves \prop}
-\and
-\inferH{Eq}
-  {\pfctx \proves \prop(\term) \\ \pfctx \proves \term = \term'}
-  {\pfctx \proves \prop(\term')}
-\and
-\infer[$\wedge$I]
-  {\pfctx \proves \prop \\ \pfctx \proves \propB}
-  {\pfctx \proves \prop \wedge \propB}
-\and
-\infer[$\wedge$EL]
-  {\pfctx \proves \prop \wedge \propB}
-  {\pfctx \proves \prop}
-\and
-\infer[$\wedge$ER]
-  {\pfctx \proves \prop \wedge \propB}
-  {\pfctx \proves \propB}
-\and
-\infer[$\vee$E]
-  {\pfctx \proves \prop \vee \propB \\
-   \pfctx, \prop \proves \propC \\
-   \pfctx, \propB \proves \propC}
-  {\pfctx \proves \propC}
-\and
-\infer[$\vee$IL]
-  {\pfctx \proves \prop }
-  {\pfctx \proves \prop \vee \propB}
-\and
-\infer[$\vee$IR]
-  {\pfctx \proves \propB}
-  {\pfctx \proves \prop \vee \propB}
-\and
-\infer[$\Ra$I]
-  {\pfctx, \prop \proves \propB}
-  {\pfctx \proves \prop \Ra \propB}
-\and
-\infer[$\Ra$E]
-  {\pfctx \proves \prop \Ra \propB \\ \pfctx \proves \prop}
-  {\pfctx \proves \propB}
-\and
-\infer[$\forall_1$I]
-  {\pfctx, x : \sort \proves \prop}
-  {\pfctx \proves \forall x: \sort.\; \prop}
-\and
-\infer[$\forall_1$E]
-  {\pfctx \proves \forall X \in \sort.\; \prop \\
-   \pfctx \proves \term: \sort}
-  {\pfctx \proves \prop[\term/X]}
-\and
-\infer[$\exists_1$E]
-  {\pfctx \proves \exists X\in \sort.\; \prop \\
-   \pfctx, X : \sort, \prop \proves \propB}
-  {\pfctx \proves \propB}
-\and
-\infer[$\exists_1$I]
-  {\pfctx \proves \prop[\term/X] \\
-   \pfctx \proves \term: \sort}
-  {\pfctx \proves \exists X: \sort. \prop}
-\and
-\infer[$\forall_2$I]
-  {\pfctx, \var: \Pred(\sort) \proves \prop}
-  {\pfctx \proves \forall \var\in \Pred(\sort).\; \prop}
-\and
-\infer[$\forall_2$E]
-  {\pfctx \proves \forall \var. \prop \\
-   \pfctx \proves \propB: \Prop}
-  {\pfctx \proves \prop[\propB/\var]}
-\and
-\infer[$\exists_2$E]
-  {\pfctx \proves \exists \var \in \Pred(\sort).\prop \\
-   \pfctx, \var : \Pred(\sort), \prop \proves \propB}
-  {\pfctx \proves \propB}
-\and
-\infer[$\exists_2$I]
-  {\pfctx \proves \prop[\propB/\var] \\
-   \pfctx \proves \propB: \Prop}
-  {\pfctx \proves \exists \var. \prop}
-\and
-\inferB[Elem]
-  {\pfctx \proves \term \in (X \in \sort). \prop}
-  {\pfctx \proves \prop[\term/X]}
-\and
-\inferB[Elem-$\mu$]
-  {\pfctx \proves \term \in (\mu\var \in \Pred(\sort). \pred)}
-  {\pfctx \proves \term \in \pred[\mu\var \in \Pred(\sort). \pred/\var]}
-\end{mathpar}
-
-\subsection{Axioms from the logic of (affine) bunched implications}
-\begin{mathpar}
-\begin{array}{rMcMl}
-  \prop * \propB &\Lra& \propB * \prop \\
-  (\prop * \propB) * \propC &\Lra& \prop * (\propB * \propC) \\
-  \prop * \propB &\Ra& \prop
-\end{array}
-\and
-\begin{array}{rMcMl}
-  (\prop \vee \propB) * \propC &\Lra& 
-    (\prop * \propC) \vee (\propB * \propC)  \\
-  (\prop \wedge \propB) * \propC &\Ra& 
-    (\prop * \propC) \wedge (\propB * \propC)  \\
-  (\Exists x. \prop) * \propB &\Lra& \Exists x. (\prop * \propB) \\
-  (\All x. \prop) * \propB &\Ra& \All x. (\prop * \propB) 
-\end{array}
-\and
-\infer
-  {\pfctx, \prop_1 \proves \propB_1 \and
-   \pfctx, \prop_2 \proves \propB_2}
-  {\pfctx, \prop_1 * \prop_2 \proves \propB_1 * \propB_2}
-\and
-\infer
-  {\pfctx, \prop * \propB \proves \propC}
-  {\pfctx, \prop \proves \propB \wand \propC}
-\and
-\infer
-  {\pfctx, \prop \proves \propB \wand \propC}
-  {\pfctx, \prop * \propB \proves \propC}
-\end{mathpar}
-
-\subsection{Laws for ghosts and physical resources}
-
-\begin{mathpar}
-\begin{array}{rMcMl}
-\ownGGhost{\melt} * \ownGGhost{\meltB} &\Lra&  \ownGGhost{\melt \mtimes \meltB} \\
-\TRUE &\Ra&  \ownGGhost{\munit}\\
-\ownGGhost{\mzero} &\Ra& \FALSE\\
-\multicolumn{3}{c}{\timeless{\ownGGhost{\melt}}}
-\end{array}
-\and
-\begin{array}{c}
-\ownPhys{\state} * \ownPhys{\state'} \Ra \FALSE \\
-\timeless{\ownPhys{\state}}
-\end{array}
-\end{mathpar}
-
-\subsection{Laws for the later modality}\label{sec:later}
-
-\begin{mathpar}
-\inferH{Mono}
-  {\pfctx \proves \prop}
-  {\pfctx \proves \later{\prop}}
-\and
-\inferhref{L{\"o}b}{Loeb}
-  {\pfctx, \later{\prop} \proves \prop}
-  {\pfctx \proves \prop}
-\and
-\begin{array}[b]{rMcMl}
-  \later{\always{\prop}} &\Lra& \always{\later{\prop}} \\
-  \later{(\prop \wedge \propB)} &\Lra& \later{\prop} \wedge \later{\propB}  \\
-  \later{(\prop \vee \propB)} &\Lra& \later{\prop} \vee \later{\propB} \\
-\end{array}
-\and
-\begin{array}[b]{rMcMl}
-  \later{\All x.\prop} &\Lra& \All x. \later\prop \\
-  \later{\Exists x.\prop} &\Lra& \Exists x. \later\prop \\
-  \later{(\prop * \propB)} &\Lra& \later\prop * \later\propB
-\end{array}
-\end{mathpar}
-
-\subsection{Laws for the always modality}\label{sec:always}
-
-\begin{mathpar}
-\axiomH{Necessity}
-  {\always{\prop} \Ra \prop}
-\and
-\inferhref{$\always$I}{AlwaysIntro}
-  {\always{\pfctx} \proves \prop}
-  {\always{\pfctx} \proves \always{\prop}}
-\and
-\begin{array}[b]{rMcMl}
-  \always(\term =_\sort \termB) &\Lra& \term=_\sort \termB \\
-  \always{\prop} * \propB &\Lra& \always{\prop} \land \propB \\
-  \always{(\prop \Ra \propB)} &\Ra& \always{\prop} \Ra \always{\propB} \\
-\end{array}
-\and
-\begin{array}[b]{rMcMl}
-  \always{(\prop \land \propB)} &\Lra& \always{\prop} \land \always{\propB} \\
-  \always{(\prop \lor \propB)} &\Lra& \always{\prop} \lor \always{\propB} \\
-  \always{\All x. \prop} &\Lra& \All x. \always{\prop} \\
-  \always{\Exists x. \prop} &\Lra& \Exists x. \always{\prop} \\
-\end{array}
-\end{mathpar}
-Note that $\always$ binds more tightly than $*$, $\land$, $\lor$, and $\Ra$.
-
-\section{Program logic}\label{sec:proglog}
-
-Hoare triples and view shifts are syntactic sugar for weakest (liberal) preconditions and primitive view shifts, respectively:
-\[
-\hoare{\prop}{\expr}{\Ret\val.\propB}[\mask] \eqdef \always{(\prop \Ra \dynA{\expr}{\lambda\Ret\val.\propB}{\mask})}
-\qquad\qquad
-\begin{aligned}
-\prop \vs[\mask_1][\mask_2] \propB &\eqdef \always{(\prop \Ra \pvsA{\propB}{\mask_1}{\mask_2})} \\
-\prop \vsE[\mask_1][\mask_2] \propB &\eqdef \prop \vs[\mask_1][\mask_2] \propB \land \propB \vs[\mask2][\mask_1] \prop
-\end{aligned}
-\]
-We write just one mask for a view shift when $\mask_1 = \mask_2$.
-The convention for omitted masks is generous:
-An omitted $\mask$ is $\top$ for Hoare triples and $\emptyset$ for view shifts.
-
-% PDS: We're repeating ourselves. We gave Γ conventions and we're about to give Θ conventions. Also, the scope of "Below" is unclear.
-% Below, we implicitly assume the same context for all judgements which don't have an explicit context at \emph{all} pre-conditions \emph{and} the conclusion.
-
-Henceforward, we implicitly assume a proof context, $\pfctx$, is added to every constituent of the rules.
-Generally, this is an arbitrary proof context.
-We write $\provesalways$ to denote judgments that can only be extended with a boxed proof context.
-
-\ralf{Give the actual base rules from the Coq development instead}
-
-\subsection{Hoare triples}
-\begin{mathpar}
-\inferH{Ret}
-  {}
-  {\hoare{\TRUE}{\valB}{\Ret\val. \val = \valB}[\mask]}
-\and
-\inferH{Bind}
-  {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask] \\
-   \All \val. \hoare{\propB}{K[\val]}{\Ret\valB.\propC}[\mask]}
-  {\hoare{\prop}{K[\expr]}{\Ret\valB.\propC}[\mask]}
-\and
-\inferH{Csq}
-  {\prop \vs \prop' \\
-    \hoare{\prop'}{\expr}{\Ret\val.\propB'}[\mask] \\   
-   \All \val. \propB' \vs \propB}
-  {\hoare{\prop}{\expr}{\Ret\val.\propB}[\mask]}
-\and
-\inferH{Frame}
-  {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask]}
-  {\hoare{\prop * \propC}{\expr}{\Ret\val. \propB * \propC}[\mask \uplus \mask']}
-\and
-\inferH{AFrame}
-  {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask] \and \text{$\expr$ not a value}
-  }
-  {\hoare{\prop * \later\propC}{\expr}{\Ret\val. \propB * \propC}[\mask \uplus \mask']}
-% \and
-% \inferH{Fork}
-%   {\hoare{\prop}{\expr}{\Ret\any. \TRUE}[\top]}
-%   {\hoare{\later\prop * \later\propB}{\fork{\expr}}{\Ret\val. \val = \textsf{fRet} \land \propB}[\mask]}
-\and
-\inferH{ACsq}
-  {\prop \vs[\mask \uplus \mask'][\mask] \prop' \\
-    \hoare{\prop'}{\expr}{\Ret\val.\propB'}[\mask] \\   
-   \All\val. \propB' \vs[\mask][\mask \uplus \mask'] \propB \\
-   \physatomic{\expr}
-  }
-  {\hoare{\prop}{\expr}{\Ret\val.\propB}[\mask \uplus \mask']}
-\end{mathpar}
-
-\subsection{View shifts}
-
-\begin{mathpar}
-\inferH{NewInv}
-  {\infinite(\mask)}
-  {\later{\prop} \vs[\mask] \exists \iname\in\mask.\; \knowInv{\iname}{\prop}}
-\and
-\inferH{FpUpd}
-  {\melt \mupd \meltsB}
-  {\ownGGhost{\melt} \vs \exists \meltB \in \meltsB.\; \ownGGhost{\meltB}}
-\and
-\inferH{VSTrans}
-  {\prop \vs[\mask_1][\mask_2] \propB \and \propB \vs[\mask_2][\mask_3] \propC \and \mask_2 \subseteq \mask_1 \cup \mask_3}
-  {\prop \vs[\mask_1][\mask_3] \propC}
-\and
-\inferH{VSImp}
-  {\always{(\prop \Ra \propB)}}
-  {\prop \vs[\emptyset] \propB}
-\and
-\inferH{VSFrame}
-  {\prop \vs[\mask_1][\mask_2] \propB}
-  {\prop * \propC \vs[\mask_1 \uplus \mask'][\mask_2 \uplus \mask'] \propB * \propC}
-\and
-\inferH{VSTimeless}
-  {\timeless{\prop}}
-  {\later \prop \vs \prop}
-\and
-\axiomH{InvOpen}
-  {\knowInv{\iname}{\prop} \proves \TRUE \vs[\{ \iname \} ][\emptyset] \later \prop}
-\and
-\axiomH{InvClose}
-  {\knowInv{\iname}{\prop} \proves \later \prop \vs[\emptyset][\{ \iname \} ] \TRUE }
-\end{mathpar}
-
-\vspace{5pt}
-Note that $\timeless{\prop}$ means that $\prop$ does not depend on the step index.
-Furthermore, $$\melt \mupd \meltsB \eqdef \always{\All \melt_f. \melt \sep \melt_f \Ra \Exists \meltB \in \meltsB. \meltB \sep \melt_f}$$
-
-\subsection{Derived rules}
-
-\paragraph{Derived structural rules.}
-The following are easily derived by unfolding the sugar for Hoare triples and view shifts.
-\begin{mathpar}
-\inferHB{Disj}
-  {\hoare{\prop}{\expr}{\Ret\val.\propC}[\mask] \and \hoare{\propB}{\expr}{\Ret\val.\propC}[\mask]}
-  {\hoare{\prop \lor \propB}{\expr}{\Ret\val.\propC}[\mask]}
-\and
-\inferHB{VSDisj}
-  {\prop \vs[\mask_1][\mask_2] \propC \and \propB \vs[\mask_1][\mask_2] \propC}
-  {\prop \lor \propB \vs[\mask_1][\mask_2] \propC}
-\and
-\inferHB{Exist}
-  {\All \var. \hoare{\prop}{\expr}{\Ret\val.\propB}[\mask]}
-  {\hoare{\Exists \var. \prop}{\expr}{\Ret\val.\propB}[\mask]}
-\and
-\inferHB{VSExist}
-  {\All \var. (\prop \vs[\mask_1][\mask_2] \propB)}
-  {(\Exists \var. \prop) \vs[\mask_1][\mask_2] \propB}
-\and
-\inferHB{BoxOut}
-  {\always\propB \provesalways \hoare{\prop}{\expr}{\Ret\val.\propC}[\mask]}
-  {\hoare{\prop \land \always{\propB}}{\expr}{\Ret\val.\propC}[\mask]}
-\and
-\inferHB{VSBoxOut}
-  {\always\propB \provesalways \prop \vs[\mask_1][\mask_2] \propC}
-  {\prop \land \always{\propB} \vs[\mask_1][\mask_2] \propC}
- \and
-\inferH{False}
-  {}
-  {\hoare{\FALSE}{\expr}{\Ret \val. \prop}[\mask]}
-\and
-\inferH{VSFalse}
-  {}
-  {\FALSE \vs[\mask_1][\mask_2] \prop }
-\end{mathpar}
-The proofs all follow the same pattern, so we only show two of them in detail.
-\begin{proof}[Proof of \ruleref{Exist}]
-	After unfolding the syntactic sugar for Hoare triples and removing the boxes from premise and conclusion, our goal becomes
-	\[
-		(\Exists \var. \prop(\var)) \Ra \dynA{\expr}{\Lam\val. \propB}{\mask}
-	\]
-	(remember that $\var$ is free in $\prop$) and the premise reads
-	\[
-		\All \var. \prop(\var) \Ra \dynA{\expr}{\Lam\val. \propB}{\mask}.
-	\]
-	Let $\var$ be given and assume $\prop(\var)$.
-	To show $\dynA{\expr}{\Lam\val. \propB}{\mask}$, apply the premise to $\var$ and $\prop(\var)$.
- 
-	For the other direction, assume
-	\[
-		\hoare{\Exists \var. \prop(\var)}{\expr}{\Ret\val. \propB}[\mask]
-	\]
-	and let $\var$ be given.
-	We have to show $\hoare{\prop(\var)}{\expr}{\Ret\val. \propB}[\mask]$.
-	This trivially follows from \ruleref{Csq} with $\prop(\var) \Ra \Exists \var. \prop(\var)$.
-\end{proof}
-
-\begin{proof}[Proof of \ruleref{BoxOut}]
-  After unfolding the syntactic sugar for Hoare triples, our goal becomes
-  \begin{equation}\label{eq:boxin:goal}
-    \always\pfctx \proves \always\bigl(\prop\land\always \propB \Ra \dynA{\expr}{\Lam\val. \propC}{\mask}\bigr)
-  \end{equation}
-  while our premise reads
-  \begin{equation}\label{eq:boxin:as}
-    \always\pfctx, \always\propB \proves \always(\prop \Ra \dynA{\expr}{\Lam\val. \propC}{\mask})
-  \end{equation}
-  By the introduction rules for $\always$ and implication, it suffices to show
-  \[  (\always\pfctx), \prop,\always \propB \proves \dynA{\expr}{\Lam\val. \propC}{\mask} \]
-  By modus ponens and \ruleref{Necessity}, it suffices to show~\eqref{eq:boxin:as}, which is exactly our assumption.
-  
-  For the other direction, assume~\eqref{eq:boxin:goal}. We have to show~\eqref{eq:boxin:as}. By \ruleref{AlwaysIntro} and implication introduction, it suffices to show
-  \[  (\always\pfctx), \prop,\always \propB \proves \dynA{\expr}{\Lam\val. \propC}{\mask} \]
-  which easily follows from~\eqref{eq:boxin:goal}.
-\end{proof}
-
-\paragraph{Derived rules for invariants.}
-Invariants can be opened around atomic expressions and view shifts.
-
-\begin{mathpar}
-\inferH{Inv}
-  {\hoare{\later{\propC} * \prop }
-          {\expr}
-          {\Ret\val. \later{\propC} * \propB }[\mask]
-          \and \physatomic{\expr}
-  }
-  {\knowInv{\iname}{\propC} \proves \hoare{\prop}
-          {\expr}
-          {\Ret\val. \propB}[\mask \uplus \{ \iname \}]
-  }
-\and
-\inferH{VSInv}
-  {\later{\prop} * \propB \vs[\mask_1][\mask_2] \later{\prop} * \propC}
-  {\knowInv{\iname}{\prop} \proves \propB \vs[\mask_1 \uplus \{ \iname \}][\mask_2 \uplus \{ \iname \}] \propC}
-\end{mathpar}
-
-\begin{proof}[Proof of \ruleref{Inv}]
-  Use \ruleref{ACsq} with $\mask_1 \eqdef \mask \cup \{\iname\}$, $\mask_2 \eqdef \mask$.
-  The view shifts are obtained by \ruleref{InvOpen} and \ruleref{InvClose} with framing of $\mask$ and $\prop$ or $\propB$, respectively.
-\end{proof}
-
-\begin{proof}[Proof of \ruleref{VSInv}]
-Analogous to the proof of \ruleref{Inv}, using \ruleref{VSTrans} instead of \ruleref{ACsq}.
-\end{proof}
-
-\subsubsection{Unsound rules}
-
-Some rule suggestions (or rather, wishes) keep coming up, which are unsound. We collect them here.
-\begin{mathpar}
-	\infer
-	{P \vs Q}
-	{\later P \vs \later Q}
-	\and
-	\infer
-	{\later(P \vs Q)}
-	{\later P \vs \later Q}
-\end{mathpar}
-
-Of course, the second rule implies the first, so let's focus on that.
-Since implications work under $\later$, from $\later P$ we can get $\later \pvs{Q}$.
-If we now try to prove $\pvs{\later Q}$, we will be unable to establish world satisfaction in the new world:
-We have no choice but to use $\later \pvs{Q}$ at one step index below what we are operating on (because we have it under a $\later$).
-We can easily get world satisfaction for that lower step-index (by downwards-closedness of step-indexed predicates).
-We can, however, not make much use of the world satisfaction that we get out, becaase it is one step-index too low.
-
-\subsection{Adequacy}
-
-The adequacy statement reads as follows:
-\begin{align*}
- &\All \mask, \expr, \val, \pred, i, \state, \state', \tpool'.
- \\&( \proves \hoare{\ownPhys\state}{\expr}{x.\; \pred(x)}[\mask]) \implies
- \\&\cfg{\state}{[i \mapsto \expr]} \step^\ast
-     \cfg{\state'}{[i \mapsto \val] \uplus \tpool'} \implies
-     \\&\pred(\val)
-\end{align*}
-where $\pred$ can mention neither resources nor invariants.
-
-\subsection{Axiom lifting}\label{sec:lifting}
-
-The following lemmas help in proving axioms for a particular language.
-The first applies to expressions with side-effects, and the second to side-effect-free expressions.
-\dave{Update the others, and the example, wrt the new treatment of $\predB$.}
-\begin{align*}
- &\All \expr, \state, \pred, \prop, \propB, \mask. \\
- &\textlog{reducible}(e) \implies \\
- &(\All \expr', \state'. \cfg{\state}{\expr} \step \cfg{\state'}{\expr'} \implies \pred(\expr', \state')) \implies \\
- &{} \proves \bigl( (\All \expr', \state'. \pred (\expr', \state') \Ra \hoare{\prop}{\expr'}{\Ret\val. \propB}[\mask]) \Ra \hoare{ \later \prop * \ownPhys{\state} }{\expr}{\Ret\val. \propB}[\mask] \bigr) \\
- \quad\\
- &\All \expr, \pred, \prop, \propB, \mask. \\
- &\textlog{reducible}(e) \implies \\
- &(\All \state, \expr_2, \state_2. \cfg{\state}{\expr} \step \cfg{\state_2}{\expr_2} \implies \state_2 = \state \land \pred(\expr_2)) \implies \\
- &{} \proves \bigl( (\All \expr'. \pred(\expr') \Ra \hoare{\prop}{\expr'}{\Ret\val. \propB}[\mask]) \Ra \hoare{\later\prop}{\expr}{\Ret\val. \propB}[\mask] \bigr)
-\end{align*}
-Note that $\pred$ is a meta-logic predicate---it does not depend on any world or resources being owned.
-
-The following specializations cover all cases of a heap-manipulating lambda calculus like $F_{\mu!}$.
-\begin{align*}
- &\All \expr, \expr', \prop, \propB, \mask. \\
- &\textlog{reducible}(e) \implies \\
- &(\All \state, \expr_2, \state_2. \cfg{\state}{\expr} \step \cfg{\state_2}{\expr_2} \implies \state_2 = \state \land \expr_2 = \expr') \implies \\
- &{} \proves (\hoare{\prop}{\expr'}{\Ret\val. \propB}[\mask] \Ra \hoare{\later\prop}{\expr}{\Ret\val. \propB}[\mask] ) \\
- \quad \\
- &\All \expr, \state, \pred, \mask. \\
- &\textlog{atomic}(e) \implies \\
- &\bigl(\All \expr_2, \state_2. \cfg{\state}{\expr} \step \cfg{\state_2}{\expr_2} \implies \pred(\expr_2, \state_2)\bigr) \implies \\
- &{} \proves (\hoare{ \ownPhys{\state} }{\expr}{\Ret\val. \Exists\state'. \ownPhys{\state'} \land \pred(\val, \state') }[\mask] )
-\end{align*}
-The first is restricted to deterministic pure reductions, like $\beta$-reduction.
-The second is suited to proving triples for (possibly non-deterministic) atomic expressions; for example, with $\expr \eqdef \;!\ell$ (dereferencing $\ell$) and $\state \eqdef h \mtimes \ell \mapsto \valB$ and $\pred(\val, \state') \eqdef \state' = (h \mtimes \ell \mapsto \valB) \land \val = \valB$, one obtains the axiom $\All h, \ell, \valB. \hoare{\ownPhys{h \mtimes \ell \mapsto \valB}}{!\ell}{\Ret\val. \val = \valB \land \ownPhys{h \mtimes \ell \mapsto \valB} }$.
-%Axioms for CAS-like operations can be obtained by first deriving rules for the two possible cases, and then using the disjunction rule.
-
-%%% Local Variables:
-%%% mode: latex
-%%% TeX-master: "iris"
-%%% End:

docs/mathpartir.sty

-%  Mathpartir --- Math Paragraph for Typesetting Inference Rules
-%
-%  Copyright (C) 2001, 2002, 2003, 2004, 2005 Didier Rmy
-%
-%  Author         : Didier Remy 
-%  Version        : 1.2.0
-%  Bug Reports    : to author
-%  Web Site       : http://pauillac.inria.fr/~remy/latex/
-% 
-%  Mathpartir is free software; you can redistribute it and/or modify
-%  it under the terms of the GNU General Public License as published by
-%  the Free Software Foundation; either version 2, or (at your option)
-%  any later version.
-%  
-%  Mathpartir is distributed in the hope that it will be useful,
-%  but WITHOUT ANY WARRANTY; without even the implied warranty of
-%  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-%  GNU General Public License for more details 
-%  (http://pauillac.inria.fr/~remy/license/GPL).
-%
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%  File mathpartir.sty (LaTeX macros)
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-\NeedsTeXFormat{LaTeX2e}
-\ProvidesPackage{mathpartir}
-    [2005/12/20 version 1.2.0 Math Paragraph for Typesetting Inference Rules]
-
-%%
-
-%% Identification
-%% Preliminary declarations
-
-\RequirePackage {keyval}
-
-%% Options
-%% More declarations
-
-%% PART I: Typesetting maths in paragraphe mode
-
-%% \newdimen \mpr@tmpdim
-%% Dimens are a precious ressource. Uses seems to be local.
-\let \mpr@tmpdim \@tempdima
-
-% To ensure hevea \hva compatibility, \hva should expands to nothing 
-% in mathpar or in inferrule
-\let \mpr@hva \empty
-
-%% normal paragraph parametters, should rather be taken dynamically
-\def \mpr@savepar {%
-  \edef \MathparNormalpar
-     {\noexpand \lineskiplimit \the\lineskiplimit
-      \noexpand \lineskip \the\lineskip}%
-  }
-
-\def \mpr@rulelineskip {\lineskiplimit=0.3em\lineskip=0.2em plus 0.1em}
-\def \mpr@lesslineskip {\lineskiplimit=0.6em\lineskip=0.5em plus 0.2em}
-\def \mpr@lineskip  {\lineskiplimit=1.2em\lineskip=1.2em plus 0.2em}
-\let \MathparLineskip \mpr@lineskip
-\def \mpr@paroptions {\MathparLineskip}
-\let \mpr@prebindings \relax
-
-\newskip \mpr@andskip \mpr@andskip 2em plus 0.5fil minus 0.5em
-
-\def \mpr@goodbreakand
-   {\hskip -\mpr@andskip  \penalty -1000\hskip \mpr@andskip}
-\def \mpr@and {\hskip \mpr@andskip}
-\def \mpr@andcr {\penalty 50\mpr@and}
-\def \mpr@cr {\penalty -10000\mpr@and}
-\def \mpr@eqno #1{\mpr@andcr #1\hskip 0em plus -1fil \penalty 10}
-
-\def \mpr@bindings {%
-  \let \and \mpr@andcr
-  \let \par \mpr@andcr
-  \let \\\mpr@cr
-  \let \eqno \mpr@eqno
-  \let \hva \mpr@hva
-  } 
-\let \MathparBindings \mpr@bindings
-
-% \@ifundefined {ignorespacesafterend}
-%    {\def \ignorespacesafterend {\aftergroup \ignorespaces}
-
-\newenvironment{mathpar}[1][]
-  {$$\mpr@savepar \parskip 0em \hsize \linewidth \centering
-     \vbox \bgroup \mpr@prebindings \mpr@paroptions #1\ifmmode $\else
-     \noindent $\displaystyle\fi
-     \MathparBindings}
-  {\unskip \ifmmode $\fi\egroup $$\ignorespacesafterend}
-
-\newenvironment{mathparpagebreakable}[1][]
-  {\begingroup 
-   \par
-   \mpr@savepar \parskip 0em \hsize \linewidth \centering
-      \mpr@prebindings \mpr@paroptions #1%
-      \vskip \abovedisplayskip \vskip -\lineskip%
-     \ifmmode  \else  $\displaystyle\fi
-     \MathparBindings
-  }
-  {\unskip
-   \ifmmode $\fi \par\endgroup
-   \vskip \belowdisplayskip
-   \noindent
-  \ignorespacesafterend}
-
-% \def \math@mathpar #1{\setbox0 \hbox {$\displaystyle #1$}\ifnum
-%     \wd0 < \hsize  $$\box0$$\else \bmathpar #1\emathpar \fi}
-
-%%% HOV BOXES
-
-\def \mathvbox@ #1{\hbox \bgroup \mpr@normallineskip 
-  \vbox \bgroup \tabskip 0em \let \\ \cr
-  \halign \bgroup \hfil $##$\hfil\cr #1\crcr \egroup \egroup
-  \egroup}
-
-\def \mathhvbox@ #1{\setbox0 \hbox {\let \\\qquad $#1$}\ifnum \wd0 < \hsize
-      \box0\else \mathvbox {#1}\fi}
-
-
-%% Part II -- operations on lists
-
-\newtoks \mpr@lista
-\newtoks \mpr@listb
-
-\long \def\mpr@cons #1\mpr@to#2{\mpr@lista {\\{#1}}\mpr@listb \expandafter
-{#2}\edef #2{\the \mpr@lista \the \mpr@listb}}
-
-\long \def\mpr@snoc #1\mpr@to#2{\mpr@lista {\\{#1}}\mpr@listb \expandafter
-{#2}\edef #2{\the \mpr@listb\the\mpr@lista}}
-
-\long \def \mpr@concat#1=#2\mpr@to#3{\mpr@lista \expandafter {#2}\mpr@listb
-\expandafter {#3}\edef #1{\the \mpr@listb\the\mpr@lista}}
-
-\def \mpr@head #1\mpr@to #2{\expandafter \mpr@head@ #1\mpr@head@ #1#2}
-\long \def \mpr@head@ #1#2\mpr@head@ #3#4{\def #4{#1}\def#3{#2}}
-
-\def \mpr@flatten #1\mpr@to #2{\expandafter \mpr@flatten@ #1\mpr@flatten@ #1#2}
-\long \def \mpr@flatten@ \\#1\\#2\mpr@flatten@ #3#4{\def #4{#1}\def #3{\\#2}}
-
-\def \mpr@makelist #1\mpr@to #2{\def \mpr@all {#1}%
-   \mpr@lista {\\}\mpr@listb \expandafter {\mpr@all}\edef \mpr@all {\the
-   \mpr@lista \the \mpr@listb \the \mpr@lista}\let #2\empty 
-   \def \mpr@stripof ##1##2\mpr@stripend{\def \mpr@stripped{##2}}\loop
-     \mpr@flatten \mpr@all \mpr@to \mpr@one
-     \expandafter \mpr@snoc \mpr@one \mpr@to #2\expandafter \mpr@stripof
-     \mpr@all \mpr@stripend  
-     \ifx \mpr@stripped \empty \let \mpr@isempty 0\else \let \mpr@isempty 1\fi
-     \ifx 1\mpr@isempty
-   \repeat
-}
-
-\def \mpr@rev #1\mpr@to #2{\let \mpr@tmp \empty
-   \def \\##1{\mpr@cons ##1\mpr@to \mpr@tmp}#1\let #2\mpr@tmp}
-
-%% Part III -- Type inference rules
-
-\newif \if@premisse
-\newbox \mpr@hlist
-\newbox \mpr@vlist
-\newif \ifmpr@center \mpr@centertrue
-\def \mpr@htovlist {%
-   \setbox \mpr@hlist
-      \hbox {\strut
-             \ifmpr@center \hskip -0.5\wd\mpr@hlist\fi
-             \unhbox \mpr@hlist}%
-   \setbox \mpr@vlist
-      \vbox {\if@premisse  \box \mpr@hlist \unvbox \mpr@vlist
-             \else \unvbox \mpr@vlist \box \mpr@hlist
-             \fi}%
-}
-% OLD version
-% \def \mpr@htovlist {%
-%    \setbox \mpr@hlist
-%       \hbox {\strut \hskip -0.5\wd\mpr@hlist \unhbox \mpr@hlist}%
-%    \setbox \mpr@vlist
-%       \vbox {\if@premisse  \box \mpr@hlist \unvbox \mpr@vlist
-%              \else \unvbox \mpr@vlist \box \mpr@hlist
-%              \fi}%
-% }
-
-\def \mpr@item #1{$\displaystyle #1$}
-\def \mpr@sep{2em}
-\def \mpr@blank { }
-\def \mpr@hovbox #1#2{\hbox
-  \bgroup
-  \ifx #1T\@premissetrue
-  \else \ifx #1B\@premissefalse
-  \else
-     \PackageError{mathpartir}
-       {Premisse orientation should either be T or B}
-       {Fatal error in Package}%
-  \fi \fi
-  \def \@test {#2}\ifx \@test \mpr@blank\else
-  \setbox \mpr@hlist \hbox {}%
-  \setbox \mpr@vlist \vbox {}%
-  \if@premisse \let \snoc \mpr@cons \else \let \snoc \mpr@snoc \fi
-  \let \@hvlist \empty \let \@rev \empty
-  \mpr@tmpdim 0em
-  \expandafter \mpr@makelist #2\mpr@to \mpr@flat
-  \if@premisse \mpr@rev \mpr@flat \mpr@to \@rev \else \let \@rev \mpr@flat \fi
-  \def \\##1{%
-     \def \@test {##1}\ifx \@test \empty
-        \mpr@htovlist
-        \mpr@tmpdim 0em %%% last bug fix not extensively checked
-     \else
-      \setbox0 \hbox{\mpr@item {##1}}\relax
-      \advance \mpr@tmpdim by \wd0
-      %\mpr@tmpdim 1.02\mpr@tmpdim
-      \ifnum \mpr@tmpdim < \hsize
-         \ifnum \wd\mpr@hlist > 0
-           \if@premisse
-             \setbox \mpr@hlist 
-                \hbox {\unhbox0 \hskip \mpr@sep \unhbox \mpr@hlist}%
-           \else
-             \setbox \mpr@hlist
-                \hbox {\unhbox \mpr@hlist  \hskip \mpr@sep \unhbox0}%
-           \fi
-         \else 
-         \setbox \mpr@hlist \hbox {\unhbox0}%
-         \fi
-      \else
-         \ifnum \wd \mpr@hlist > 0
-            \mpr@htovlist 
-            \mpr@tmpdim \wd0
-         \fi
-         \setbox \mpr@hlist \hbox {\unhbox0}%
-      \fi
-      \advance \mpr@tmpdim by \mpr@sep
-   \fi
-   }%
-   \@rev
-   \mpr@htovlist
-   \ifmpr@center \hskip \wd\mpr@vlist\fi \box \mpr@vlist
-   \fi
-   \egroup
-}
-
-%%% INFERENCE RULES
-
-\@ifundefined{@@over}{%
-    \let\@@over\over % fallback if amsmath is not loaded
-    \let\@@overwithdelims\overwithdelims
-    \let\@@atop\atop \let\@@atopwithdelims\atopwithdelims
-    \let\@@above\above \let\@@abovewithdelims\abovewithdelims
-  }{}
-
-%% The default
-
-\def \mpr@@fraction #1#2{\hbox {\advance \hsize by -0.5em
-    $\displaystyle {#1\mpr@over #2}$}}
-\def \mpr@@nofraction #1#2{\hbox {\advance \hsize by -0.5em
-    $\displaystyle {#1\@@atop #2}$}}
-
-\let \mpr@fraction \mpr@@fraction
-
-%% A generic solution to arrow
-
-\def \mpr@make@fraction #1#2#3#4#5{\hbox {%
-     \def \mpr@tail{#1}%
-     \def \mpr@body{#2}%
-     \def \mpr@head{#3}%
-     \setbox1=\hbox{$#4$}\setbox2=\hbox{$#5$}%
-     \setbox3=\hbox{$\mkern -3mu\mpr@body\mkern -3mu$}%
-     \setbox3=\hbox{$\mkern -3mu \mpr@body\mkern -3mu$}%
-     \dimen0=\dp1\advance\dimen0 by \ht3\relax\dp1\dimen0\relax
-     \dimen0=\ht2\advance\dimen0 by \dp3\relax\ht2\dimen0\relax
-     \setbox0=\hbox {$\box1 \@@atop \box2$}%
-     \dimen0=\wd0\box0
-     \box0 \hskip -\dimen0\relax
-     \hbox to \dimen0 {$%
-       \mathrel{\mpr@tail}\joinrel
-       \xleaders\hbox{\copy3}\hfil\joinrel\mathrel{\mpr@head}%
-     $}}}
-
-%% Old stuff should be removed in next version
-\def \mpr@@nothing #1#2
-    {$\lower 0.01pt \mpr@@nofraction {#1}{#2}$}
-\def \mpr@@reduce #1#2{\hbox
-    {$\lower 0.01pt \mpr@@fraction {#1}{#2}\mkern -15mu\rightarrow$}}
-\def \mpr@@rewrite #1#2#3{\hbox
-    {$\lower 0.01pt \mpr@@fraction {#2}{#3}\mkern -8mu#1$}}
-\def \mpr@infercenter #1{\vcenter {\mpr@hovbox{T}{#1}}}
-
-\def \mpr@empty {}
-\def \mpr@inferrule
-  {\bgroup
-     \ifnum \linewidth<\hsize \hsize \linewidth\fi
-     \mpr@rulelineskip
-     \let \and \qquad
-     \let \hva \mpr@hva
-     \let \@rulename \mpr@empty
-     \let \@rule@options \mpr@empty
-     \let \mpr@over \@@over
-     \mpr@inferrule@}
-\newcommand {\mpr@inferrule@}[3][]
-  {\everymath={\displaystyle}%       
-   \def \@test {#2}\ifx \empty \@test
-      \setbox0 \hbox {$\vcenter {\mpr@hovbox{B}{#3}}$}%
-   \else 
-   \def \@test {#3}\ifx \empty \@test
-      \setbox0 \hbox {$\vcenter {\mpr@hovbox{T}{#2}}$}%
-   \else
-   \setbox0 \mpr@fraction {\mpr@hovbox{T}{#2}}{\mpr@hovbox{B}{#3}}%
-   \fi \fi
-   \def \@test {#1}\ifx \@test\empty \box0
-   \else \vbox 
-%%% Suggestion de Francois pour les etiquettes longues
-%%%   {\hbox to \wd0 {\RefTirName {#1}\hfil}\box0}\fi
-      {\hbox {\RefTirName {#1}}\box0}\fi
-   \egroup}
-
-\def \mpr@vdotfil #1{\vbox to #1{\leaders \hbox{$\cdot$} \vfil}}
-
-% They are two forms
-% \inferrule [label]{[premisses}{conclusions}
-% or
-% \inferrule* [options]{[premisses}{conclusions}
-%
-% Premisses and conclusions are lists of elements separated by \\
-% Each \\ produces a break, attempting horizontal breaks if possible, 
-% and  vertical breaks if needed. 
-% 
-% An empty element obtained by \\\\ produces a vertical break in all cases. 
-%
-% The former rule is aligned on the fraction bar. 
-% The optional label appears on top of the rule
-% The second form to be used in a derivation tree is aligned on the last
-% line of its conclusion
-% 
-% The second form can be parameterized, using the key=val interface. The
-% folloiwng keys are recognized:
-%       
-%  width                set the width of the rule to val
-%  narrower             set the width of the rule to val\hsize
-%  before               execute val at the beginning/left
-%  lab                  put a label [Val] on top of the rule
-%  lskip                add negative skip on the right
-%  left                 put a left label [Val]
-%  Left                 put a left label [Val],  ignoring its width 
-%  right                put a right label [Val]
-%  Right                put a right label [Val], ignoring its width
-%  leftskip             skip negative space on the left-hand side
-%  rightskip            skip negative space on the right-hand side
-%  vdots                lift the rule by val and fill vertical space with dots
-%  after                execute val at the end/right
-%  
-%  Note that most options must come in this order to avoid strange
-%  typesetting (in particular  leftskip must preceed left and Left and
-%  rightskip must follow Right or right; vdots must come last 
-%  or be only followed by rightskip. 
-%  
-
-%% Keys that make sence in all kinds of rules
-\def \mprset #1{\setkeys{mprset}{#1}}
-\define@key {mprset}{andskip}[]{\mpr@andskip=#1}
-\define@key {mprset}{lineskip}[]{\lineskip=#1}
-\define@key {mprset}{flushleft}[]{\mpr@centerfalse}
-\define@key {mprset}{center}[]{\mpr@centertrue}
-\define@key {mprset}{rewrite}[]{\let \mpr@fraction \mpr@@rewrite}
-\define@key {mprset}{atop}[]{\let \mpr@fraction \mpr@@nofraction}
-\define@key {mprset}{myfraction}[]{\let \mpr@fraction #1}
-\define@key {mprset}{fraction}[]{\def \mpr@fraction {\mpr@make@fraction #1}}
-\define@key {mprset}{sep}{\def\mpr@sep{#1}}
-
-\newbox \mpr@right
-\define@key {mpr}{flushleft}[]{\mpr@centerfalse}
-\define@key {mpr}{center}[]{\mpr@centertrue}
-\define@key {mpr}{rewrite}[]{\let \mpr@fraction \mpr@@rewrite}
-\define@key {mpr}{myfraction}[]{\let \mpr@fraction #1}
-\define@key {mpr}{fraction}[]{\def \mpr@fraction {\mpr@make@fraction #1}}
-\define@key {mpr}{left}{\setbox0 \hbox {$\TirName {#1}\;$}\relax
-     \advance \hsize by -\wd0\box0}
-\define@key {mpr}{width}{\hsize #1}
-\define@key {mpr}{sep}{\def\mpr@sep{#1}}
-\define@key {mpr}{before}{#1}
-\define@key {mpr}{lab}{\let \RefTirName \TirName \def \mpr@rulename {#1}}
-\define@key {mpr}{Lab}{\let \RefTirName \TirName \def \mpr@rulename {#1}}
-\define@key {mpr}{narrower}{\hsize #1\hsize}
-\define@key {mpr}{leftskip}{\hskip -#1}
-\define@key {mpr}{reduce}[]{\let \mpr@fraction \mpr@@reduce}
-\define@key {mpr}{rightskip}
-  {\setbox \mpr@right \hbox {\unhbox \mpr@right \hskip -#1}}
-\define@key {mpr}{LEFT}{\setbox0 \hbox {$#1$}\relax
-     \advance \hsize by -\wd0\box0}
-\define@key {mpr}{left}{\setbox0 \hbox {$\TirName {#1}\;$}\relax
-     \advance \hsize by -\wd0\box0}
-\define@key {mpr}{Left}{\llap{$\TirName {#1}\;$}}
-\define@key {mpr}{right}
-  {\setbox0 \hbox {$\;\TirName {#1}$}\relax \advance \hsize by -\wd0
-   \setbox \mpr@right \hbox {\unhbox \mpr@right \unhbox0}}
-\define@key {mpr}{RIGHT}
-  {\setbox0 \hbox {$#1$}\relax \advance \hsize by -\wd0
-   \setbox \mpr@right \hbox {\unhbox \mpr@right \unhbox0}}
-\define@key {mpr}{Right}
-  {\setbox \mpr@right \hbox {\unhbox \mpr@right \rlap {$\;\TirName {#1}$}}}
-\define@key {mpr}{vdots}{\def \mpr@vdots {\@@atop \mpr@vdotfil{#1}}}
-\define@key {mpr}{after}{\edef \mpr@after {\mpr@after #1}}
-
-\newcommand \mpr@inferstar@ [3][]{\setbox0
-  \hbox {\let \mpr@rulename \mpr@empty \let \mpr@vdots \relax
-         \setbox \mpr@right \hbox{}%
-         $\setkeys{mpr}{#1}%
-          \ifx \mpr@rulename \mpr@empty \mpr@inferrule {#2}{#3}\else
-          \mpr@inferrule [{\mpr@rulename}]{#2}{#3}\fi
-          \box \mpr@right \mpr@vdots$}
-  \setbox1 \hbox {\strut}
-  \@tempdima \dp0 \advance \@tempdima by -\dp1
-  \raise \@tempdima \box0}
-
-\def \mpr@infer {\@ifnextchar *{\mpr@inferstar}{\mpr@inferrule}}
-\newcommand \mpr@err@skipargs[3][]{}
-\def \mpr@inferstar*{\ifmmode 
-    \let \@do \mpr@inferstar@
-  \else 
-    \let \@do \mpr@err@skipargs
-    \PackageError {mathpartir}
-      {\string\inferrule* can only be used in math mode}{}%
-  \fi \@do}
-
-
-%%% Exports
-
-% Envirnonment mathpar
-
-\let \inferrule \mpr@infer
-
-% make a short name \infer is not already defined
-\@ifundefined {infer}{\let \infer \mpr@infer}{}
-
-\def \TirNameStyle #1{\small \textsc{#1}}
-\def \tir@name #1{\hbox {\small \TirNameStyle{#1}}}
-\let \TirName \tir@name
-\let \DefTirName \TirName
-\let \RefTirName \TirName
-
-%%% Other Exports
-
-% \let \listcons \mpr@cons
-% \let \listsnoc \mpr@snoc
-% \let \listhead \mpr@head
-% \let \listmake \mpr@makelist
-
-
-
-
-\endinput

docs/model.tex

-\section{Model and semantics}
-
-The semantics closely follows the ideas laid out in~\cite{catlogic}.
-We just repeat some of the most important definitions here.
-
-An \emph{ordered family of equivalence relations} (o.f.e.\@) is a pair
-$(X,(\nequiv{n})_{n\in\mathbb{N}})$, with $X$ a set, and each $\nequiv{n}$ 
-an equivalence relation over $X$ satisfying
-\begin{itemize}
-	\item $\All x,x'. x \nequiv{0} x',$
-	\item $\All x,x',n. x \nequiv{n+1} x' \implies x \nequiv{n} x',$
-	\item $\All x,x'. (\All n. x\nequiv{n} x') \implies x = x'.$
-\end{itemize}
-\a
-Let $(X,(\nequivset{n}{X})_{n\in\mathbb{N}})$ and
-$(Y,(\nequivset{n}{Y})_{n\in\mathbb{N}})$ be o.f.e.'s. A function $f:
-X\to Y$ is \emph{non-expansive} if,   for all $x$, $x'$ and $n$,
-\[
-x \nequivset{n}{X} x' \implies 
-fx \nequivset{n}{Y} f x'.
-\]
-Let $(X,(\nequiv{n})_{n\in\mathbb{N}})$ be an o.f.e.
-A sequence $(x_i)_{i\in\mathbb{N}}$ of elements in $X$ is a
-\emph{chain} (aka \emph{Cauchy sequence}) if
-\[
-\All k. \Exists n. \All i,j\geq n. x_i \nequiv{k} x_j.
-\]
-A \emph{limit} of a chain $(x_i)_{i\in\mathbb{N}}$ is an element
-$x\in X$ such that
-\[
-\All n. \Exists k. \All i\geq k. x_i \nequiv{n} x.
-\]
-An o.f.e.\ $(X,(\nequiv{n})_{n\in\mathbb{N}})$ is \emph{complete} 
-if all chains have a limit.
-A complete o.f.e.\ is called a c.o.f.e.\ (pronounced ``coffee'').
-When the family of equivalence relations is clear from context we
-simply
-write $X$ for a c.o.f.e.\ $(X,(\nequiv{n})_{n\in\mathbb{N}})$.
-
-
-Let $\cal U$ be the category of c.o.f.e.'s and nonexpansive maps.
-
-Products and function spaces are defined as follows.
-For c.o.f.e.'s $(X,(\nequivset{n}{X})_{n\in\mathbb{N}})$ and
-$(Y,(\nequivset{n}{Y})_{n\in\mathbb{N}})$, their product 
-is 
-$(X\times Y, (\nequiv{n})_{n\in\mathbb{N}}),$
-where
-\[
-(x,y) \nequiv{n} (x',y') \iff
-x \nequiv{n} x' \land
-y \nequiv{n} y'.
-\]
-The function space is
-\[
-(\{\, f : X\to Y \mid f \text{ is non-expansive}\,\}, (\nequiv{n})_{n\in\mathbb{N}}),
-\]
-where
-\[
-f \nequiv{n} g \iff
-\All x. f(x)  \nequiv{n}  g(x).
-\]
-
-For a c.o.f.e.\ $(X,(\nequiv{n}_{n\in\mathbb{N}}))$, 
-$\latert (X,(\nequiv{n}_{n\in\mathbb{N}}))$ is the c.o.f.e.\@
-$(X,(\nequivB{n}_{n\in\mathbb{N}}))$,  where
-\[
-x \nequivB{n} x' \iff \begin{cases}
-\top	&\IF n=0 \\
-x \nequiv{n-1} x' &\IF n>0
-\end{cases}
-\]
-
-(Sidenote: $\latert$ extends to a functor on $\cal U$ by the identity
-action on morphisms).
-
-
-\subsection{Semantic structures: propositions}
-\ralf{This needs to be synced with the Coq development again.}
-
-\[
-\begin{array}[t]{rcl}
-%  \protStatus &::=& \enabled \ALT \disabled \\[0.4em]
-\textdom{Res} &\eqdef&
-\{\, \rs = (\pres, \ghostRes) \mid
-\pres \in \textdom{State} \uplus \{\munit\} \land \ghostRes \in \mcarp{\monoid} \,\} \\[0.5em]
-(\pres, \ghostRes) \rtimes
-(\pres', \ghostRes') &\eqdef&
-\begin{cases}
-(\pres, \ghostRes \mtimes \ghostRes')  & \mbox{if $\pres' = \munit$ and $\ghostRes \mtimes \ghostRes' \neq \mzero$} \\
-(\pres', \ghostRes \mtimes \ghostRes') & \mbox{if $\pres = \munit$ and $\ghostRes \mtimes \ghostRes' \neq \mzero$}
-\end{cases}
-\\[0.5em]
-%
-\rs \leq \rs' & \eqdef &
-\Exists \rs''. \rs' = \rs \rtimes \rs''\\[1em]
-%
-\UPred(\textdom{Res}) &\eqdef& 
-\{\, p \subseteq \mathbb{N} \times \textdom{Res} \mid
-\All (k,\rs) \in p.
-\All j\leq k.
-\All \rs' \geq \rs.
-(j,\rs')\in p \,\}\\[0.5em]
-\restr{p}{k} &\eqdef& 
-\{\, (j, \rs) \in p \mid j < k \,\}\\[0.5em]
-p \nequiv{n} q & \eqdef & \restr{p}{n} = \restr{q}{n}\\[1em]
-%
-\textdom{PreProp} & \cong  &
-\latert\big( \textdom{World} \monra \UPred(\textdom{Res})
-\big)\\[0.5em]
-%
-\textdom{World} & \eqdef &
-\mathbb{N} \fpfn \textdom{PreProp}\\[0.5em]
-%
-w \nequiv{n} w' & \eqdef & 
-n = 0 \lor
-\bigl(\dom(w) = \dom(w') \land \All i\in\dom(w). w(i) \nequiv{n} w'(i)\bigr)
-\\[0.5em]
-%
-w \leq w' & \eqdef & 
-\dom(w) \subseteq \dom(w') \land \All i \in \dom(w). w(i) = w'(i) 
-\\[0.5em]
-%
-\textdom{Prop} & \eqdef & \textdom{World} \monra \UPred(\textdom{Res})
-\end{array}
-\]
-
-For $p,q\in\UPred(\textdom{Res})$ with $p \nequiv{n} q$ defined
-as above, $\UPred(\textdom{Res})$ is a 
-c.o.f.e.
-
-$\textdom{Prop}$ is a c.o.f.e., which exists by America and Rutten's theorem~\cite{America-Rutten:JCSS89}.
-We do not need to consider how the object is constructed. 
-We only need the isomorphism, given by maps
-\begin{align*}
-	\wIso &: \latert \bigl(World \monra \UPred(\textdom{Res})\bigr) \to \textdom{PreProp} \\
-	\wIso^{-1} &: \textdom{PreProp} \to \latert \bigl(World \monra \UPred(\textdom{Res})\bigr)
-\end{align*}
-which are inverses to each other. 
-Note: this is an isomorphism in $\cal U$, i.e., $\wIso$ and
-$\wIso^{-1}$ are both non-expansive.
-
-$\textdom{World}$ is a c.o.f.e.\ with the family of equivalence
-relations defined as shown above.
-
-\subsection{Semantic structures: types and environments}
-
-For a set $X$, write $\Delta X$ for the discrete c.o.f.e.\ with $x \nequiv{n}
-x'$ iff $n = 0$ or $x = x'$
-\[
-\begin{array}[t]{@{}l@{\ }c@{\ }l@{}}
-\Sem{\textsort{Unit}} &\eqdef& \Delta \{ \star \} \\
-\Sem{\textsort{InvName}} &\eqdef& \Delta \mathbb{N}  \\
-\Sem{\textsort{InvMask}} &\eqdef& \Delta \pset{\mathbb{N}} \\
-\Sem{\textsort{Monoid}} &\eqdef& \Delta |\monoid|
-\end{array}
-\qquad\qquad
-\begin{array}[t]{@{}l@{\ }c@{\ }l@{}}
-\Sem{\textsort{Val}} &\eqdef& \Delta \textdom{Val} \\
-\Sem{\textsort{Exp}} &\eqdef& \Delta \textdom{Exp} \\
-\Sem{\textsort{Ectx}} &\eqdef& \Delta \textdom{Ectx} \\
-\Sem{\textsort{State}} &\eqdef& \Delta \textdom{State} \\
-\end{array}
-\qquad\qquad
-\begin{array}[t]{@{}l@{\ }c@{\ }l@{}}
-\Sem{\sort \times \sort'} &\eqdef& \Sem{\sort} \times \Sem{\sort} \\
-\Sem{\sort \to \sort'} &\eqdef& \Sem{\sort} \to \Sem{\sort} \\
-\Sem{\Prop} &\eqdef& \textdom{Prop} \\
-\end{array}
-\]
-
-The balance of our signature $\Sig$ is interpreted as follows.
-For each base type $\type$ not covered by the preceding table, we pick an object $X_\type$ in $\cal U$ and define
-\[
-\Sem{\type} \eqdef X_\type
-\]
-For each function symbol $\sigfn : \type_1, \dots, \type_n \to \type_{n+1} \in \SigFn$, we pick an arrow $\Sem{\sigfn} : \Sem{\type_1} \times \dots \times \Sem{\type_n} \to \Sem{\type_{n+1}}$ in $\cal U$.
-
-An environment $\vctx$ is interpreted as the set of
-maps $\rho$, with $\dom(\rho) = \dom(\vctx)$ and
-$\rho(x)\in\Sem{\vctx(x)}$,
-and 
-$\rho\nequiv{n} \rho' \iff n=0 \lor \bigl(\dom(\rho)=\dom(\rho') \land
-\All x\in\dom(\rho). \rho(x) \nequiv{n} \rho'(x)\bigr)$.
-
-\ralf{Re-check all the following definitions with the Coq development.}
-%\typedsection{Validity}{valid : \pset{\textdom{Prop}} \in Sets}
-%
-%\begin{align*}
-%valid(p) &\iff \All n \in \mathbb{N}. \All \rs \in \textdom{Res}. \All W \in \textdom{World}. (n, \rs) \in p(W)
-%\end{align*}
-
-\typedsection{Later modality}{\later : \textdom{Prop} \to \textdom{Prop} \in {\cal U}}
-
-\begin{align*}
-	\later p &\eqdef \Lam W. \{\, (n + 1, r) \mid (n, r) \in p(W) \,\} \cup \{\, (0, r) \mid r \in \textdom{Res} \,\}
-\end{align*}
-\begin{lem}
-	$\later{}$ is well-defined: $\later {p}$ is a valid proposition (this amounts to showing non-expansiveness), and $\later{}$ itself is a \emph{contractive} map.
-\end{lem}
-
-\typedsection{Always modality}{\always{} : \textdom{Prop} \to \textdom{Prop} \in {\cal U}}
-
-\begin{align*}
-	\always{p} \eqdef \Lam W. \{\, (n, r) \mid (n, \munit) \in p(W) \,\}
-\end{align*}
-\begin{lem}
-	$\always{}$ is well-defined: $\always{p}$ is a valid proposition (this amounts to showing non-expansiveness), and $\always{}$ itself is a non-expansive map.
-\end{lem}
-
-% PDS: p \Rightarrow q not defined.
-%\begin{lem}\label{lem:always-impl-valid}
-%\begin{align*}
-%&\forall p, q \in \textdom{Prop}.~\\
-%&\qquad
-%  (\forall n \in \mathbb{N}.~\forall \rs \in \textdom{Res}.~\forall W \in \textdom{World}.~(n, \rs) \in p(W) \Rightarrow (n, \rs) \in q(W)) \Leftrightarrow~valid(\always{(p \Rightarrow q)})
-%\end{align*}
-%\end{lem}
-
-\typedsection{Invariant definition}{inv : \Delta(\mathbb{N}) \times \textdom{Prop} \to \textdom{Prop} \in {\cal U}}
-\begin{align*}
-	\mathit{inv}(\iota, p) &\eqdef \Lam W. \{\, (n, r) \mid \iota\in\dom(W) \land W(\iota) \nequiv{n+1}_{\textdom{PreProp}} \wIso(p) \,\}
-\end{align*}
-\begin{lem}
-	$\mathit{inv}$ is well-defined: $\mathit{inv}(\iota, p)$ is a valid proposition (this amounts to showing non-expansiveness), and $\mathit{inv}$ itself is a non-expansive map.
-\end{lem}
-
-\typedsection{World satisfaction}{\fullSat{-}{-}{-}{-} : 
-	\textdom{State} \times
-	\pset{\mathbb{N}} \times
-	\textdom{Res} \times
-	\textdom{World} \to \psetdown{\mathbb{N}} \in {\cal U}}
-\ralf{Make this Dave-compatible: Explicitly compose all the things in $s$}
-\begin{align*}
-	\fullSat{\state}{\mask}{\rs}{W} &=
-	\begin{aligned}[t]
-		\{\, n + 1 \in \mathbb{N} \mid &\Exists  \rsB:\mathbb{N} \fpfn \textdom{Res}. (\rs \rtimes \rsB).\pres = \state \land{}\\
-		&\quad \All \iota \in \dom(W). \iota \in \dom(W) \leftrightarrow \iota \in \dom(\rsB) \land {}\\
-		&\quad\quad \iota \in \mask \ra (n, \rsB(\iota)) \in \wIso^{-1}(W(\iota))(W) \,\} \cup \{ 0 \}
-	\end{aligned}
-\end{align*}
-\begin{lem}\label{lem:fullsat-nonexpansive}
-	$\fullSat{-}{-}{-}{-}$ is well-defined: It maps into $\psetdown{\mathbb{N}}$. (There is no need for it to be a non-expansive map, it doesn't itself live in $\cal U$.)
-\end{lem}
-
-\begin{lem}\label{lem:fullsat-weaken-mask}
-	\begin{align*}
-		\MoveEqLeft
-		\All \state \in \Delta(\textdom{State}).
-		\All \mask_1, \mask_2 \in \Delta(\pset{\mathbb{N}}).
-		\All \rs, \rsB \in \Delta(\textdom{Res}).
-		\All W \in \textdom{World}. \\&
-		\mask_1 \subseteq \mask_2 \implies (\fullSat{\state}{\mask_2}{\rs}{W}) \subseteq (\fullSat{\state}{\mask_1}{\rs}{W})
-	\end{align*}
-\end{lem}
-
-\begin{lem}\label{lem:nequal_ext_world}
-	\begin{align*}
-		&
-		\All n \in \mathbb{N}.
-		\All W_1, W_1', W_2 \in \textdom{World}.
-		W_1 \nequiv{n} W_2 \land W_1 \leq W_1' \implies \Exists W_2' \in \textdom{World}. W_1' \nequiv{n} W_2' \land W_2 \leq W_2'
-	\end{align*}
-\end{lem}
-
-\typedsection{Timeless}{\textit{timeless} : \textdom{Prop} \to \textdom{Prop}}
-
-\begin{align*}
-	\textit{timeless}(p) \eqdef 
-	\begin{aligned}[t]
-		\Lam W.
-		\{\, (n, r) &\mid \All W' \geq W. \All k \leq n. \All r' \in \textdom{Res}. \\
-		&\qquad
-		k > 0 \land (k - 1, r') \in p(W') \implies (k, r') \in p(W') \,\}
-	\end{aligned}
-\end{align*}
-
-\begin{lem}
-	\textit{timeless} is well-defined: \textit{timeless}(p) is a valid proposition, and \textit{timeless} itself is a non-expansive map.
-\end{lem}
-
-% PDS: \Ra undefined.
-%\begin{lem}
-%\begin{align*}
-%&
-%  \All p \in \textdom{Prop}.
-%  \All \mask \in \pset{\mathbb{N}}.
-%valid(\textit{timeless}(p) \Ra (\later p \vs[\mask][\mask] p))
-%\end{align*}
-%\end{lem}
-
-\typedsection{View-shift}{\mathit{vs} : \Delta(\pset{\mathbb{N}}) \times \Delta(\pset{\mathbb{N}}) \times \textdom{Prop} \to \textdom{Prop} \in {\cal U}}
-\begin{align*}
-	\mathit{vs}_{\mask_1}^{\mask_2}(q) &= \Lam W.
-	\begin{aligned}[t]
-		\{\, (n, \rs) &\mid \All W_F \geq W. \All \rs_F, \mask_F, \state. \All k \leq n.\\
-		&\qquad 
-		k \in (\fullSat{\state}{\mask_1 \cup \mask_F}{\rs \rtimes \rs_F}{W_F}) \land k > 0 \land \mask_F \sep (\mask_1 \cup \mask_2) \implies{} \\
-		&\qquad
-		\Exists W' \geq W_F. \Exists \rs'. k \in (\fullSat{\state}{\mask_2 \cup \mask_F}{\rs' \rtimes \rs_F}{W'}) \land (k, \rs') \in q(W')
-		\,\}
-	\end{aligned}
-\end{align*}
-\begin{lem}
-	$\mathit{vs}$ is well-defined: $\mathit{vs}_{\mask_1}^{\mask_2}(q)$ is a valid proposition, and $\mathit{vs}$ is a non-expansive map.
-\end{lem}
-
-
-%\begin{lem}\label{lem:prim_view_shift_trans}
-%\begin{align*}
-%\MoveEqLeft
-%  \All \mask_1, \mask_2, \mask_3 \in \Delta(\pset{\mathbb{N}}).
-%  \All p, q \in \textdom{Prop}. \All W \in \textdom{World}.
-%  \All n \in \mathbb{N}.\\
-%&
-%  \mask_2 \subseteq \mask_1 \cup \mask_3 \land
-%  \bigl(\All W' \geq W. \All r \in \textdom{Res}. \All k \leq n. (k, r) \in p(W') \implies (k, r) \in vs_{\mask_2}^{\mask_3}(q)(W')\bigr) \\
-%&\qquad
-%  {}\implies \All r \in \textdom{Res}. (n, r) \in vs_{\mask_1}^{\mask_2}(p)(W) \implies (n, r) \in vs_{\mask_1}^{\mask_3}(q)(W)
-%\end{align*}
-%\end{lem}
-
-% PDS: E_1 ==>> E_2 undefined.
-%\begin{lem}
-%\begin{align*}
-%&
-%  \forall \mask_1, \mask_2, \mask_3 \in \Delta(\pset{\mathbb{N}}).~
-%  \forall p_1, p_2, p_3 \in \textdom{Prop}.~\\
-%&\qquad
-%  \mask_2 \subseteq \mask_1 \cup \mask_3 \Rightarrow
-%  valid(((p_1 \vs[\mask_1][\mask_2] p_2) \land (p_2 \vs[\mask_2][\mask_3] p_3)) \Rightarrow (p_1 \vs[\mask_1][\mask_3] p_3))
-%\end{align*}
-%\end{lem}
-
-%\begin{lem}
-%\begin{align*}
-%\MoveEqLeft
-%  \All \iota \in \mathbb{N}.
-%  \All p \in \textdom{Prop}.
-%  \All W \in \textdom{World}.
-%  \All \rs \in \textdom{Res}.
-%  \All n \in \mathbb{N}. \\
-%&
-%  (n, \rs) \in inv(\iota, p)(W) \implies (n, \rs) \in vs_{\{ \iota \}}^{\emptyset}(\later p)(W)
-%\end{align*}
-%\end{lem}
-
-% PDS: * undefined.
-%\begin{lem}
-%\begin{align*}
-%&
-%  \forall \iota \in \mathbb{N}.~
-%  \forall p \in \textdom{Prop}.~
-%  \forall W \in \textdom{World}.~
-%  \forall \rs \in \textdom{Res}.~
-%  \forall n \in \mathbb{N}.~\\
-%&\qquad
-%  (n, \rs) \in (inv(\iota, p) * \later p)(W) \Rightarrow (n, \rs) \in vs^{\{ \iota \}}_{\emptyset}(\top)(W)
-%\end{align*}
-%\end{lem}
-
-% \begin{lem}
-% \begin{align*}
-% &
-%   \forall \mask_1, \mask_2 \in \Delta(\pset{\mathbb{N}}).~
-%   valid(\bot \vs[\mask_1][\mask_2] \bot)
-% \end{align*}
-% \end{lem}
-
-% PDS: E_1 ==>> E_2 undefined.
-%\begin{lem}
-%\begin{align*}
-%&
-%  \forall p, q \in \textdom{Prop}.~
-%  \forall \mask \in \pset{\mathbb{N}}.~
-%valid(\always{(p \Rightarrow q)} \Rightarrow (p \vs[\mask][\mask] q))
-%\end{align*}
-%\end{lem}
-
-% PDS: E # E' and E_1 ==>> E_2 undefined.
-%\begin{lem}
-%\begin{align*}
-%&
-%  \forall p_1, p_2, p_3 \in \textdom{Prop}.~
-%  \forall \mask_1, \mask_2, \mask \in \pset{\mathbb{N}}.~
-%valid(\mask \sep \mask_1 \Ra \mask \sep \mask_2 \Ra (p_1 \vs[\mask_1][\mask_2] p_2) \Rightarrow (p_1 * p_3 \vs[\mask_1 \cup \mask][\mask_2 \cup \mask] p_2 * p_3))
-%\end{align*}
-%\end{lem}
-
-\typedsection{Weakest precondition}{\mathit{wp} : \Delta(\pset{\mathbb{N}}) \times \Delta(\textdom{Exp}) \times (\Delta(\textdom{Val}) \to \textdom{Prop}) \to \textdom{Prop} \in {\cal U}}
-
-% \begin{align*}
-% 	\mathit{wp}_\mask(\expr, q) &\eqdef \Lam W.
-% 	\begin{aligned}[t]
-% 		\{\, (n, \rs) &\mid \All W_F \geq W; k \leq n; \rs_F; \state; \mask_F \sep \mask. k > 0 \land k \in (\fullSat{\state}{\mask \cup \mask_F}{\rs \rtimes \rs_F}{W_F}) \implies{}\\
-% 		&\qquad
-% 		(\expr \in \textdom{Val} \implies \Exists W' \geq W_F. \Exists \rs'. \\
-% 		&\qquad\qquad
-% 		k \in (\fullSat{\state}{\mask \cup \mask_F}{\rs' \rtimes \rs_F}{W'}) \land (k, \rs') \in q(\expr)(W'))~\land \\
-% 		&\qquad
-% 		(\All\ectx,\expr_0,\expr'_0,\state'. \expr = \ectx[\expr_0] \land \cfg{\state}{\expr_0} \step \cfg{\state'}{\expr'_0} \implies \Exists W' \geq W_F. \Exists \rs'. \\
-% 		&\qquad\qquad
-% 		k - 1 \in (\fullSat{\state'}{\mask \cup \mask_F}{\rs' \rtimes \rs_F}{W'}) \land (k-1, \rs') \in wp_\mask(\ectx[\expr_0'], q)(W'))~\land \\
-% 		&\qquad
-% 		(\All\ectx,\expr'. \expr = \ectx[\fork{\expr'}] \implies \Exists W' \geq W_F. \Exists \rs', \rs_1', \rs_2'. \\
-% 		&\qquad\qquad
-% 		k - 1 \in (\fullSat{\state}{\mask \cup \mask_F}{\rs' \rtimes \rs_F}{W'}) \land \rs' = \rs_1' \rtimes \rs_2'~\land \\
-% 		&\qquad\qquad
-% 		(k-1, \rs_1') \in \mathit{wp}_\mask(\ectx[\textsf{fRet}], q)(W') \land
-% 		(k-1, \rs_2') \in \mathit{wp}_\top(\expr', \Lam\any. \top)(W'))
-% 		\,\}
-% 	\end{aligned}
-% \end{align*}
-\begin{lem}
-	$\mathit{wp}$ is well-defined: $\mathit{wp}_{\mask}(\expr, q)$ is a valid proposition, and $\mathit{wp}$ is a non-expansive map. Besides, the dependency on the recursive occurrence is contractive, so $\mathit{wp}$ has a fixed-point.
-\end{lem}
-
-\begin{lem}
-	$\mathit{wp}$ on values and non-mask-changing $\mathit{vs}$ agree:
-	\[ \mathit{wp}_\mask(\val, q) = \mathit{vs}_{\mask}^{\mask}(q \: \val)  \]
-\end{lem}
-
-\typedsection{Interpretation of terms}{\Sem{\vctx \proves \term : \sort} : \Sem{\vctx} \to \Sem{\sort} \in {\cal U}}
-
-%A term $\vctx \proves \term : \sort$ is interpreted as a non-expansive map from $\Sem{\vctx}$ to $\Sem{\sort}$.
-
-\begin{align*}
-	\Sem{\vctx \proves x : \sort}_\gamma &= \gamma(x) \\
-	\Sem{\vctx \proves \sigfn(\term_1, \dots, \term_n) : \type_{n+1}}_\gamma &= \Sem{\sigfn}(\Sem{\vctx \proves \term_1 : \type_1}_\gamma, \dots, \Sem{\vctx \proves \term_n : \type_n}_\gamma) \ \WHEN \sigfn : \type_1, \dots, \type_n \to \type_{n+1} \in \SigFn \\
-	\Sem{\vctx \proves \Lam x. \term : \sort \to \sort'}_\gamma &=
-	\Lam v : \Sem{\sort}. \Sem{\vctx, x : \sort \proves \term : \sort'}_{\gamma[x \mapsto v]} \\
-	\Sem{\vctx \proves \term~\termB : \sort'}_\gamma &=
-	\Sem{\vctx \proves \term : \sort \to \sort'}_\gamma(\Sem{\vctx \proves \termB : \sort}_\gamma) \\
-	\Sem{\vctx \proves \unitval : \unitsort}_\gamma &= \star \\
-	\Sem{\vctx \proves (\term_1, \term_2) : \sort_1 \times \sort_2}_\gamma &= (\Sem{\vctx \proves \term_1 : \sort_1}_\gamma, \Sem{\vctx \proves \term_2 : \sort_2}_\gamma) \\
-	\Sem{\vctx \proves \pi_i~\term : \sort_1}_\gamma &= \pi_i(\Sem{\vctx \proves \term : \sort_1 \times \sort_2}_\gamma)
-\end{align*}
-%
-\begin{align*}
-	\Sem{\vctx \proves \mzero : \textsort{Monoid}}_\gamma &= \mzero \\
-	\Sem{\vctx \proves \munit : \textsort{Monoid}}_\gamma &= \munit \\
-	\Sem{\vctx \proves \melt \mtimes \meltB : \textsort{Monoid}}_\gamma &=
-	\Sem{\vctx \proves \melt : \textsort{Monoid}}_\gamma \mtimes \Sem{\vctx \proves \meltB : \textsort{Monoid}}_\gamma
-\end{align*}
-%
-\begin{align*}
-	\Sem{\vctx \proves t =_\sort u : \Prop}_\gamma &=
-	\Lam W. \{\, (n, r) \mid \Sem{\vctx \proves t : \sort}_\gamma \nequiv{n+1} \Sem{\vctx \proves u : \sort}_\gamma \,\} \\
-	\Sem{\vctx \proves \FALSE : \Prop}_\gamma &= \Lam W. \emptyset \\
-	\Sem{\vctx \proves \TRUE : \Prop}_\gamma &= \Lam W. \mathbb{N} \times \textdom{Res} \\
-	\Sem{\vctx \proves P \land Q : \Prop}_\gamma &=
-	\Lam W. \Sem{\vctx \proves P : \Prop}_\gamma(W) \cap \Sem{\vctx \proves Q : \Prop}_\gamma(W) \\
-	\Sem{\vctx \proves P \lor Q : \Prop}_\gamma &=
-	\Lam W. \Sem{\vctx \proves P : \Prop}_\gamma(W) \cup \Sem{\vctx \proves Q : \Prop}_\gamma(W) \\
-	\Sem{\vctx \proves P \Ra Q : \Prop}_\gamma &=
-	\Lam W. \begin{aligned}[t]
-		\{\, (n, r) &\mid \All n' \leq n. \All W' \geq W. \All r' \geq r. \\
-		&\qquad
-		(n', r') \in \Sem{\vctx \proves P : \Prop}_\gamma(W')~ \\
-		&\qquad 
-		\implies (n', r') \in \Sem{\vctx \proves Q : \Prop}_\gamma(W') \,\}
-	\end{aligned} \\
-	\Sem{\vctx \proves \All x : \sort. P : \Prop}_\gamma &=
-	\Lam W. \{\, (n, r) \mid \All v \in \Sem{\sort}. (n, r) \in \Sem{\vctx, x : \sort \proves P : \Prop}_{\gamma[x \mapsto v]}(W) \,\} \\
-	\Sem{\vctx \proves \Exists x : \sort. P : \Prop}_\gamma &=
-	\Lam W. \{\, (n, r) \mid \Exists v \in \Sem{\sort}. (n, r) \in \Sem{\vctx, x : \sort \proves P : \Prop}_{\gamma[x \mapsto v]}(W) \,\}
-\end{align*}
-%
-\begin{align*}
-	\Sem{\vctx \proves \always{\prop} : \Prop}_\gamma &= \always{\Sem{\vctx \proves \prop : \Prop}_\gamma} \\
-	\Sem{\vctx \proves \later{\prop} : \Prop}_\gamma &= \later \Sem{\vctx \proves \prop : \Prop}_\gamma\\
-	\Sem{\vctx \proves \MU x. \pred : \sort \to \Prop}_\gamma &=
-	\mathit{fix}(\Lam v : \Sem{\sort \to \Prop}. \Sem{\vctx, x : \sort \to \Prop \proves \pred : \sort \to \Prop}_{\gamma[x \mapsto v]}) \\
-	\Sem{\vctx \proves \prop * \propB : \Prop}_\gamma &=
-	\begin{aligned}[t]
-		\Lam W. \{\, (n, r) &\mid \Exists r_1, r_2. r = r_1 \bullet r_2 \land{} \\
-		&\qquad
-		(n, r_1) \in \Sem{\vctx \proves \prop : \Prop}_\gamma \land{} \\
-		&\qquad
-		(n, r_2) \in \Sem{\vctx \proves \propB : \Prop}_\gamma \,\}
-	\end{aligned} \\
-	\Sem{\vctx \proves \prop \wand \propB : \Prop}_\gamma &=
-	\begin{aligned}[t]
-		\Lam W. \{\, (n, r) &\mid \All n' \leq n. \All W' \geq W. \All r'. \\
-		&\qquad
-		(n', r') \in \Sem{\vctx \proves \prop : \Prop}_\gamma(W') \land r \sep r' \\
-		&\qquad
-		\implies (n', r \bullet r') \in \Sem{\vctx \proves \propB : \Prop}_\gamma(W')
-		\}
-	\end{aligned} \\
-	\Sem{\vctx \proves \knowInv{\iname}{\prop} : \Prop}_\gamma &=
-	inv(\Sem{\vctx \proves \iname : \textsort{InvName}}_\gamma, \Sem{\vctx \proves \prop : \Prop}_\gamma) \\
-	\Sem{\vctx \proves \ownGGhost{\melt} : \Prop}_\gamma &=
-	\Lam W. \{\, (n, \rs) \mid \rs.\ghostRes \geq \Sem{\vctx \proves \melt : \textsort{Monoid}}_\gamma \,\} \\
-	\Sem{\vctx \proves \ownPhys{\state} : \Prop}_\gamma &=
-	\Lam W. \{\, (n, \rs) \mid \rs.\pres = \Sem{\vctx \proves \state : \textsort{State}}_\gamma \,\}
-\end{align*}
-%
-\begin{align*}
-	\Sem{\vctx \proves \pvsA{\prop}{\mask_1}{\mask_2} : \Prop}_\gamma &=
-	\textdom{vs}^{\Sem{\vctx \proves \mask_2 : \textsort{InvMask}}_\gamma}_{\Sem{\vctx \proves \mask_1 : \textsort{InvMask}}_\gamma}(\Sem{\vctx \proves \prop : \Prop}_\gamma) \\
-	\Sem{\vctx \proves \dynA{\expr}{\pred}{\mask} : \Prop}_\gamma &=
-	\textdom{wp}_{\Sem{\vctx \proves \mask : \textsort{InvMask}}_\gamma}(\Sem{\vctx \proves \expr : \textsort{Exp}}_\gamma, \Sem{\vctx \proves \pred : \textsort{Val} \to \Prop}_\gamma) \\
-	\Sem{\vctx \proves \wtt{\timeless{\prop}}{\Prop}}_\gamma &=
-	\textdom{timeless}(\Sem{\vctx \proves \prop : \Prop}_\gamma)
-\end{align*}
-
-\typedsection{Interpretation of entailment}{\Sem{\vctx \mid \pfctx \proves \prop} : 2 \in \mathit{Sets}}
-
-\[
-\Sem{\vctx \mid \pfctx \proves \propB} \eqdef
-\begin{aligned}[t]
-\MoveEqLeft
-\forall n \in \mathbb{N}.\;
-\forall W \in \textdom{World}.\;
-\forall \rs \in \textdom{Res}.\; 
-\forall \gamma \in \Sem{\vctx},\;
-\\&
-\bigl(\All \propB \in \pfctx. (n, \rs) \in \Sem{\vctx \proves \propB : \Prop}_\gamma(W)\bigr)
-\implies (n, \rs) \in \Sem{\vctx \proves \prop : \Prop}_\gamma(W)
-\end{aligned}
-\]
-
-%%% Local Variables:
-%%% mode: latex
-%%% TeX-master: "iris"
-%%% End:

docs/proof_guide.md

+# Iris Proof Guide
+
+This work-in-progress document serves to explain how Iris proofs are typically
+carried out in Coq: what are the common patterns and conventions, what are the
+common pitfalls.  This complements the tactic documentation for the
+[proof mode](./proof_mode.md) and [HeapLang](./heap_lang.md).
+
+## Order of `Requires`
+
+In Coq, declarations in modules imported later may override the
+previous definition. Therefore, in order to make sure the most
+relevant declarations and notations always take priority, we recommend
+importing dependencies from the furthest to the closest.
+
+In particular, when importing Iris, Stdpp and Coq stdlib modules, we
+recommend importing in the following order:
+- Coq
+- stdpp
+- iris.algebra
+- iris.bi
+- iris.proofmode
+- iris.base_logic
+- iris.program_logic
+- iris.heap_lang
+
+## Resolving mask mismatches
+
+Sometimes, `fupd` masks are not exactly what they need to be to make progress.
+There are two situations to distinguish here.
+
+#### Eliminating a [fupd] with a mask smaller than the current one
+
+When your goal is `|={E,_}=> _` and you want to do `iMod` on an `|={E',_}=> _`, Coq will complain even if `E' ⊆ E`.
+To resolve this, you first need to explicitly weaken your mask from `E` to `E'` by doing:
+```coq
+iMod (fupd_mask_subseteq E') as "Hclose".
+{ (* Resolve subset sidecondition. *) }
+```
+Later, you can `iMod "Hclose" as "_"` to restore the mask back from `E'` to `E`.
+
+Notice that this will make the invariants in `E' ∖ E` unavailable until you use `Hclose`.
+Usually this is not a problem, but there are theoretical situations where using `fupd_mask_subseteq` like this can prevent you from proving a goal.
+In that case, you will have to experiment with rules like `fupd_mask_frame`, but those are not very convenient to use.
+
+#### Introducing a [fupd] when the masks are not yet the same
+
+When your goal is `|={E,E'}=> _` and you want to do `iModIntro`, Coq will complain even if `E' ⊆ E`.
+This arises, for example, in clients of TaDA-style logically atomic specifications.
+To resolve this, do:
+```coq
+iApply fupd_mask_intro.
+{ (* Resolve subset sidecondition. *) }
+iIntros "Hclose".
+```
+Later, you can `iMod "Hclose" as "_"` to restore the mask back from `E'` to `E`.
+
+## Canonical structures and type classes
+
+In Iris, we use both canonical structures and type classes, and some careful
+tweaking is necessary to make the two work together properly.  The details of
+this still need to be written up properly, but here is some background material:
+
+* [Type Classes for Mathematics in Type Theory](http://www.eelis.net/research/math-classes/mscs.pdf)
+* [Canonical Structures for the working Coq user](https://hal.inria.fr/hal-00816703v1/document)
+
+## Implicit generalization
+
+We often use the implicit generalization feature of Coq, triggered by a backtick:
+`` `{!term A B}`` means that an implicit argument of type `term A B` is added,
+and if any of the identifiers that are used here is not yet bound, it gets added
+as well.  Usually, `term` will be some existing type class or similar, and we
+use this syntax to also generalize over `A` and `B`; then the above is
+equivalent to `{A B} {Hterm: term A B}`.  The `!` in front of the term disables
+an even stronger form of generalization, where if `term` is a type class then
+all missing arguments get implicitly generalized as well.  This is sometimes
+useful, e.g. we can write `` `{Countable C}`` instead of `` `{!EqDecision C,
+!Countable C}``.  However, generally it is more important to be aware of the
+assumptions you are making, so implicit generalization without `!` should be
+avoided.
+
+## Type class resolution control
+
+When you are writing a module that exports some Iris term for others to use
+(e.g., `join_handle` in the [spawn module](../iris_heap_lang/lib/spawn.v)), be
+sure to mark these terms as opaque for type class search at the *end* of your
+module (and outside any section):
+```coq
+Typeclasses Opaque join_handle.
+```
+This makes sure that the proof mode does not "look into" your definition when it
+is used by clients.
+
+## Library type class assumptions
+
+When a parameterized library needs to make some type class assumptions about its
+parameters, it is convenient to add those to the `libG` class that the library
+will likely need anyway (see the [resource algebra docs](resource_algebras.md)
+for further details on `libG` classes).  For example, the STS library is
+parameterized by an STS and assumes that the STS state space is inhabited:
+```coq
+Class stsG Σ (sts : stsT) := {
+  #[local] sts_inG :: inG Σ (stsR sts);
+  sts_inhabited :> Inhabited (sts.state sts);
+}.
+```
+In this case, the `Instance` for this `libG` class has more than just a `subG`
+assumption:
+```coq
+Instance subG_stsΣ Σ sts :
+  subG (stsΣ sts) Σ → Inhabited (sts.state sts) → stsG Σ sts.
+Proof. solve_inG. Qed.
+```
+
+One subtle detail here is that the `subG` assumption comes first in
+`subG_stsΣ`, i.e., it appears before the `Inhabited`.  This is important because
+otherwise, `sts_inhabited` and `subG_stsΣ` form an instance cycle that makes
+type class search diverge.
+
+## Notations
+
+Notations starting with `(` or `{` should be left at their default level (`0`),
+and inner subexpressions that are bracketed by delimiters should be left at
+their default level (`200`).
+
+Moreover, correct parsing of notations sometimes relies on Coq's automatic
+left-factoring, which can require coordinating levels of certain "conflicting"
+notations and their subexpressions.  For instance, to disambiguate `(⊢@{ PROP
+})` and `(⊢@{ PROP } P)`, Coq must factor out a nonterminal for `⊢@{ PROP }`,
+but it can only do so if all occurrences of `⊢@{ PROP }` agree on the
+precedences for all subexpressions. This also requires using the same
+tokenization in all cases, i.e., the notation has to consistently be declared as
+`(⊢@{` or `('⊢@{'`, but not a mixture of the two. The latter form of using
+explicit tokenization with `'` is preferred to avoid relying on Coq's default.
+
+For details, consult [the Coq manual](https://coq.inria.fr/refman/user-extensions/syntax-extensions.html#simple-factorization-rules).
+
+## Naming conventions for variables/arguments/hypotheses
+
+### small letters
+
+* a : A = cmra or ofe
+* b : B = cmra or ofe
+* c
+* d
+* e : expr = expressions
+* f = some generic function
+* g = some generic function
+* h : heap
+* i
+* j
+* k
+* l
+* m* = prefix for option ("maybe")
+* n
+* o
+* p
+* q
+* r : iRes = (global) resources inside the Iris model
+* s = state (STSs)
+* s = stuckness bits
+* t
+* u
+* v : val = values of language
+* w
+* x
+* y
+* z 
+
+### capital letters
+
+* A : Type, cmra or ofe
+* B : Type, cmra or ofe
+* C
+* D
+* E : coPset = mask of fancy update or WP
+* F = a functor
+* G
+* H = hypotheses
+* I = indexing sets
+* J
+* K : ectx = evaluation contexts
+* K = keys of a map
+* L
+* M = maps / global CMRA
+* N : namespace
+* O 
+* P : uPred, iProp or Prop
+* Q : uPred, iProp or Prop
+* R : uPred, iProp or Prop
+* S : set state = state sets in STSs
+* T : set token = token sets in STSs
+* U
+* V
+* W
+* X : sets
+* Y : sets
+* Z : sets
+
+### small greek letters
+
+* γ : gname = name of ghost state instance
+* σ : state = state of language
+* φ : Prop = pure proposition embedded into uPred or iProp
+
+### capital greek letters
+
+* Φ : general predicate (in uPred, iProp or Prop)
+* Ψ : general predicate (in uPred, iProp or Prop)
+
+## Naming conventions for algebraic classes
+
+### Suffixes
+
+* O: OFEs
+* R: cameras
+* UR: unital cameras or resources algebras
+* F: functors (can be combined with all of the above, e.g. OF is an OFE functor)
+* G: global camera functor management (typeclass; see the [resource algebra docs](resource_algebras.md))
+* GS: global singleton (a `*G` type class with extra data that needs to be unique in a proof)
+* GpreS: collecting preconditions to instantiate the corresponding `*GS`
+* I: bunched implication logic (of type `bi`)
+* SI: step-indexed bunched implication logic (of type `sbi`)
+* T: canonical structures for algebraic classes (for example ofe for OFEs, cmra for cameras)
+* Σ: global camera functor management (`gFunctors`; see the [resource algebra docs](resource_algebras.md))

docs/proof_mode.md

+Tactic overview
+===============
+
+This reference manual defines a few different syntaxes that are used
+pervasively. These are defined in dedicated sections in this manual.
+
+- An "[introduction pattern][ipat]" `ipat` like `"H"` or `"[H1 H2]"` is used to
+  _destruct_ a hypothesis (sometimes called _eliminating_ a hypothesis). This is
+  directly used by `iDestruct` and `iIntros`, but many tactics also integrate
+  support for `ipat`s to combine some other work with destructing, such as
+  `iMod`. The name "introduction pattern" comes from a similar term in Coq which
+  is used in tactics like `destruct` and `intros`.
+- A "[selection pattern][selpat]" `selpat` like `"H1 H2"` or `"#"` names a collection of
+  hypotheses. Most commonly used in `iFrame`.
+- A "[specialization pattern][spat]" `spat` like `H` or `[$H1 H2]` is used to specialize
+  a wand to some hypotheses along with specifying framing. Commonly used as part
+  of proof mode terms (described just below).
+- A "[proof mode term][pm-trm]" `pm_trm` like `lemma with spat` or `"H" $! x with spat`
+  allows to specialize a wand (which can be either a Gallina lemma or a
+  hypothesis) on the fly, as an argument to `iDestruct` for example.
+
+Many of the tactics below apply to more goals than described in this document
+since the behavior of these tactics can be tuned via instances of the type
+classes in the file [proofmode/classes](../iris/proofmode/classes.v). Most notably, many
+of the tactics can be applied when the connective to be introduced or to be eliminated
+appears under a later, an update modality, or in the conclusion of a
+weakest precondition.
+
+[ipat]: #introduction-patterns-ipat
+[selpat]: #selection-patterns-selpat
+[spat]: #specialization-patterns-spat
+[pm-trm]: #proof-mode-terms-pm_trm
+
+Starting and stopping the proof mode
+------------------------------------
+
+- `iStartProof` : start the proof mode by turning a Coq goal into a proof
+  mode entailment. This tactic is performed implicitly by all proof mode tactics
+  described in this file, and thus should generally not be used by hand.
+  + `iStartProof PROP` : explicitly specify which BI logic `PROP : bi` should be
+    used. This is useful to drop down in a layered logic, e.g. to drop down from
+    `monPred PROP` to `PROP`.
+- `iStopProof` : turn the proof-mode entailment into an ordinary Coq goal
+  `big star of context ⊢ proof mode goal`.
+
+Applying hypotheses and lemmas
+------------------------------
+
+- `iExact "H"`  : finish the goal if the conclusion matches the hypothesis `H`
+- `iAssumption` : finish the goal if the conclusion matches any hypothesis in
+  either the proofmode or the Coq context. Only hypotheses in the Coq context
+  that are _syntactically_ of the shape `⊢ P` are recognized by this tactic
+  (this means that assumptions of the shape `P ⊢ Q` are not recognized).
+- `iApply pm_trm` : match the conclusion of the current goal against the
+  conclusion of `pm_trm` and generates goals for the premises of `pm_trm`. See
+  [proof mode terms][pm-trm] below.
+  If the applied term has more premises than given specialization patterns, the
+  pattern is extended with `[] ... []`. As a consequence, all unused spatial
+  hypotheses move to the last premise.
+
+Context management
+------------------
+
+- `iIntros (x1 ... xn) "ipat1 ... ipatn"` : introduce universal quantifiers
+  using Coq introduction patterns `x1 ... xn` and implications/wands using proof
+  mode [introduction patterns][ipat] `ipat1 ... ipatn`.
+- `iClear (x1 ... xn) "selpat"` : clear the hypotheses given by the [selection
+  pattern][selpat] `selpat` and the Coq level hypotheses/variables `x1 ... xn`.
+- `iClear select (pat)%I` : clear the last hypothesis of the intuitionistic
+  or spatial context that matches pattern `pat`.
+- `iRevert (x1 ... xn) "selpat"` : revert the hypotheses given by the [selection
+  pattern][selpat] `selpat` into wands, and the Coq level hypotheses/variables
+  `x1 ... xn` into universal quantifiers. Intuitionistic hypotheses are wrapped
+  into the intuitionistic modality.
+- `iRevert select (pat)%I` : revert the last hypothesis of the intuitionistic
+  or spatial context that matches pattern `pat`.
+- `iRename "H1" into "H2"` : rename the hypothesis `H1` into `H2`.
+- `iRename select (pat)%I into "H"` : rename the last hypothesis of the
+  intuitionistic or spatial context that matches pattern `pat` into `H`. This
+  is particularly useful to give a name to an anonymous hypothesis.
+- `iSpecialize pm_trm` : instantiate universal quantifiers and eliminate
+  implications/wands of a hypothesis `pm_trm`. See [proof mode terms][pm-trm] below.
+- `iSpecialize pm_trm as #` : instantiate universal quantifiers and eliminate
+  implications/wands of a hypothesis `pm_trm` whose conclusion is persistent.
+  All hypotheses can be used for proving the premises of `pm_trm`, as well as
+  for the resulting main goal.
+- `iPoseProof pm_trm as (x1 ... xn) "ipat"` : put `pm_trm` into the context and
+  destruct it using the [introduction pattern][ipat] `ipat`. This tactic is
+  essentially the same as `iDestruct` with the difference that `pm_trm` is not
+  thrown away if possible.
+- `iAssert (P)%I with "spat" as "H"` : generate a new subgoal `P` and add the
+  hypothesis `P` to the current goal as `H`. The [specialization pattern][spat] `spat`
+  specifies which hypotheses will be consumed by proving `P`.
+  + `iAssert (P)%I with "spat" as "ipat"` : like the above, but immediately destruct
+    the generated hypothesis using the [introduction pattern][ipat] `ipat`. If `ipat`
+    is "intuitionistic" (most commonly, it starts with `#` or `%`), then all spatial
+    hypotheses are available in both the subgoal for `P` as well as the current
+    goal. An `ipat` is considered intuitionistic if all branches start with a
+    `#` (which causes `P` to be moved to the intuitionistic context) or with a
+    `%` (which causes `P` to be moved to the pure Coq context).
+  + `iAssert (P)%I as %cpat` : assert `P` and destruct it using the Coq introduction
+    pattern `cpat`. All hypotheses can be used for proving `P` as well as for
+    proving the current goal.
+- `iSelect (pat)%I tac` : run the tactic `tac H`, where `H` is the name of the
+  last hypothesis in the intuitionistic or spatial hypothesis context that
+  matches pattern `pat`. There is no backtracking to select the next hypothesis
+  in case `tac H` fails.
+
+Introduction of logical connectives
+-----------------------------------
+
+- `iPureIntro` : turn a pure goal, typically of the form `⌜φ⌝`, into a Coq
+  goal. This tactic also works for goals of the shape `a ≡ b` on discrete
+  OFEs, and `✓ a` on discrete cameras.
+- `iLeft` : prove a disjunction `P ∨ Q` by proving the left side `P`.
+- `iRight` : prove a disjunction `P ∨ Q` by proving the right side `Q`.
+- `iSplitL "H1 ... Hn"` : split a conjunction `P ∗ Q` into two proofs. The
+  hypotheses `H1 ... Hn` are used for the left conjunct, and the remaining ones
+  for the right conjunct. Intuitionistic hypotheses are always available in both
+  proofs. Also works on `P ∧ Q`, although in that case you can use `iSplit` and
+  retain all the hypotheses in both goals.
+- `iSplitR "H0 ... Hn"` : symmetric version of the above, using the hypotheses
+  `H1 ... Hn` for the right conjunct. Note that the goals are still ordered
+  left-to-right; you can use `iSplitR "..."; last
+  first` to reverse the generated goals.
+- `iSplit` : split a conjunction `P ∧ Q` into two goals. Also works for
+  separating conjunction `P ∗ Q` provided one of the operands is persistent (and both
+  proofs may use the entire spatial context).
+- `iExists t1, .., tn` : provide a witness for an existential quantifier `∃ x, ...`. `t1
+  ... tn` can also be underscores, which are turned into evars. (In fact they
+  can be arbitrary terms with holes, or `open_constr`s, and all of the
+  holes will be turned into evars.)
+
+Elimination of logical connectives
+----------------------------------
+
+- `iExFalso` : change the goal to proving `False`.
+- `iDestruct` is an important enough tactic to describe several special cases:
+  + `iDestruct "H1" as (x1 ... xn) "H2"` : eliminate a series of existential
+    quantifiers in hypothesis `H1` using Coq introduction patterns `x1 ... xn`
+    and name the resulting hypothesis `H2`. The Coq introduction patterns can
+    also be used for pure conjunctions; for example we can destruct
+    `∃ x, ⌜v = x⌝ ∗ l ↦ x` using `iDestruct "H" as (x Heq) "H"` to immediately
+    put `Heq: v = x` in the Coq context. This variant of the tactic will always
+    throw away the original hypothesis `H1`.
+  + `iDestruct pm_trm as "ipat"` : specialize the [proof-mode term][pm-trm] (see
+    below) and destruct it using the [introduction pattern][ipat] `ipat`. If
+    `pm_trm` starts with a hypothesis, and that hypothesis resides in the
+    intuitionistic context, it will not be thrown away.
+  + `iDestruct pm_trm as (x1 ... xn) "ipat"` : combine the above, first
+    specializing `pm_trm`, then eliminating existential quantifiers (and pure
+    conjuncts) with `x1 ... xn`, and finally destructing the resulting term
+    using the [introduction pattern][ipat] `ipat`.
+  + `iDestruct pm_trm as %cpat` : destruct the pure conclusion of a term
+    `pr_trm` using the Coq introduction pattern `cpat`. When using this tactic,
+    all hypotheses can be used for proving the premises of `pm_trm`, as well as
+    for proving the resulting goal.
+  + `iDestruct num as (x1 ... xn) "ipat"` / `iDestruct num as %cpat` :
+    introduce `num : nat` hypotheses and destruct the last introduced hypothesis.
+  + `iDestruct select (pat)%I as ...` is the same as `iDestruct "H" as ...`,
+    where `H` is the name of the last hypothesis of the intuitionistic or
+    spatial context matching pattern `pat`.
+
+  In case all branches of `ipat` start with a `#` (which causes the hypothesis
+  to be moved to the intuitionistic context), with an `%` (which causes the
+  hypothesis to be moved to the pure Coq context), or with an `->`/`<-` (which
+  performs a rewrite), then one can use all hypotheses for proving the premises
+  of `pm_trm`, as well as for proving the resulting goal. Note that in this case
+  the hypotheses still need to be subdivided among the spatial premises.
+
+Separation logic-specific tactics
+---------------------------------
+
+- `iFrame (t1 .. tn) "selpat"` : cancel the Coq terms (or Coq hypotheses)
+  `t1 ... tn` and Iris hypotheses given by [`selpat`][selpat] in the goal. The constructs
+  of the selection pattern have the following meaning:
+  + `%` : repeatedly frame hypotheses from the Coq context.
+  + `#` : repeatedly frame hypotheses from the intuitionistic context.
+  + `∗` : frame as much of the spatial context as possible. (N.B: this
+          is the unicode symbol `∗`, not the regular asterisk `*`.)
+  Notice that framing spatial hypotheses makes them disappear, but framing Coq
+  or intuitionistic hypotheses does not make them disappear.
+  This tactic solves the goal if everything in the conclusion has been framed.
+- `iFrame select (pat)%I` : cancel the last hypothesis of the intuitionistic
+  of spatial context that matches pattern `pat`.
+- `iCombine "H1 H2" as "ipat"` : combine `H1 : P1` and `H2 : P2` into `H: P1 ∗
+  P2` or something simplified but equivalent, then `destruct` the combined
+  hypothesis using `ipat`. Some examples of simplifications `iCombine` knows
+  about are to combine `own γ x` and `own γ y` into `own γ (x ⋅ y)`, and to
+  combine `l ↦{1/2} v` and `l ↦{1/2} v` into `l ↦ v`.
+- `iCombine "H1 H2" gives "ipat"` : from `H1 : P1` and `H2 : P2`, find
+  persistent consequences of `P1 ∗ P2`, then `destruct` this consequence with
+  `ipat`. Some examples of persistent consequences `iCombine` knows about are
+  that `own γ x` and `own γ y` gives `✓ (x ⋅ y)`, and that
+  `l ↦{#q1} v1` and `l ↦{#q2} v2` gives `⌜(q1 + q2 ≤ 1) ∧ v1 = v2⌝`.
+- `iCombine "H1 H2" as "ipat1" gives "ipat2"` combines the two functionalities
+  of `iCombine` described above.
+- `iAccu` : solve a goal that is an evar by instantiating it with all
+  hypotheses from the spatial context joined together with a separating
+  conjunction (or `emp` in case the spatial context is empty). Not commonly
+  used, but can be extremely useful when combined with automation.
+
+Modalities
+----------
+
+- `iModIntro` : introduce a modality in the goal. The type class `FromModal` is
+  used to specify which modalities this tactic should introduce, and how
+  introducing that modality affects the hypotheses. Instances of
+  that type class include: later, except 0, basic update and fancy update,
+  intuitionistically, persistently, affinely, plainly, absorbingly, objectively,
+  and subjectively.
+  + `iModIntro mod` (rarely used): introduce a specific modality named by
+  `mod`,  which is a term pattern (i.e., a term with holes as underscores).
+  `iModIntro mod` will find a subterm matching `mod`, and try introducing its
+  topmost modality. For instance, if the goal is `⎡|==> P⎤`, using `iModIntro
+  ⎡|==> P⎤%I` or `iModIntro ⎡_⎤%I` would introduce `⎡_⎤` and produce goal `|==>
+  P`, while `iModIntro (|==> _)%I` would introduce `|==>` and produce goal
+  `⎡P⎤`.
+  + `iNext` : an alias of `iModIntro (▷^_ _)` (that is, introduce the later
+    modality). This eliminates a later in the goal, and in exchange also strips
+    one later from all the hypotheses.
+  + `iNext n` : an alias of `iModIntro (▷^n _)` (that is, introduce the `▷^n`
+    modality).
+  + `iAlways` : a deprecated alias of `iModIntro` (intended to introduce the `□`
+    modality).
+- `iMod pm_trm as (x1 ... xn) "ipat"` : eliminate a modality `pm_trm` that is
+  an instance of the `ElimModal` type class, and destruct the resulting
+  hypothesis using `ipat`. Instances include: later, except 0,
+  basic update `|==>` and fancy update `|={E}=>`.
+  + `iMod "H"` : equivalent to `iMod "H" as "H"` (eliminates the modality and
+    keeps the name of the hypothesis).
+  + `iMod pm_trm` : equivalent to `iMod pm_term as "?"` (the resulting
+    hypothesis will be introduced anonymously).
+
+Induction
+---------
+
+- `iLöb as "IH"` : perform Löb induction by
+  generating a hypothesis `IH : ▷ goal`.
+  + `iLöb as "IH" forall (x1 ... xn) "selpat"` : perform Löb induction,
+  generalizing over the Coq level variables `x1 ... xn`, the hypotheses given by
+  the selection pattern `selpat`, and the spatial context as usual.
+- `iInduction x as cpat` : perform induction on the Coq term `x`. The
+  Coq introduction pattern `cpat` is used to name the introduced variables,
+  including the induction hypotheses which are introduced into the proof mode
+  context. Note that induction hypotheses should not be put into string
+  quotation marks `".."`, e.g., use `iInduction n as [|n IH]` to perform
+  induction on a natural number `n`. An implementation caveat is that the names
+  of the induction hypotheses should be fresh in both the Coq context and the
+  proof mode context.
+  + `iInduction x as cpat forall (x1 ... xn) "selpat"` : perform induction,
+    generalizing over the Coq level variables `x1 ... xn`, the hypotheses given by
+    the selection pattern `selpat`, and the spatial context.
+  + `iInduction x as cpat using t` : perform induction using the induction
+    scheme `t`. Common examples of induction schemes are `map_ind`, `set_ind_L`,
+    and `gmultiset_ind` for `gmap`, `gset`, and `gmultiset`.
+  + `iInduction x as cpat using t forall (x1 ... xn) "selpat"` : the above
+    variants combined.
+  + `iInduction x as cpat "IH" "selpat"` : ignore the names of the induction
+    hypotheses from `cpat` and call them `IH`, `IH1`, `IH2`, etc. Here "IH" is
+    a string (in string quotation marks). This is *legacy* syntax that might be
+    deprecated in the future. Similar legacy syntax exists for all variants above.
+
+Rewriting / simplification
+--------------------------
+
+- `iRewrite pm_trm` / `iRewrite pm_trm in "H"` : rewrite using an internal
+  equality in the proof mode goal / hypothesis `H`.
+- `iRewrite -pm_trm` / `iRewrite -pm_trm in "H"` : rewrite in reverse direction
+  using an internal equality in the proof mode goal / hypothesis `H`.
+- `iEval (tac)` / `iEval (tac) in "selpat"` : perform a tactic `tac`
+  on the proof mode goal / hypotheses given by the selection pattern
+  `selpat`. Using `%` as part of the selection pattern is unsupported.
+  The tactic `tac` should be a reduction or rewriting tactic like
+  `simpl`, `cbv`, `lazy`, `rewrite` or `setoid_rewrite`. The `iEval`
+  tactic is implemented by running `tac` on `?evar ⊢ P` / `P ⊢ ?evar`
+  where `P` is the proof goal / a hypothesis given by `selpat`. After
+  running `tac`, `?evar` is unified with the resulting `P`, which in
+  turn becomes the new proof mode goal / a hypothesis given by
+  `selpat`. Note that parentheses around `tac` are needed.
+- `iSimpl` / `iSimpl in "selpat"` : perform `simpl` on the proof mode
+  goal / hypotheses given by the selection pattern `selpat`. This is a
+  shorthand for `iEval (simpl)`.
+- `iUnfold xs` / `iUnfold xs in "selpat"` : perform `unfold xs` on the proof
+  mode goal / hypotheses given by the selection pattern `selpat`. This is a
+  shorthand for `iEval (unfold xs)`. Similar to Coq's `unfold`, the argument
+  `xs` should be a comma-separated non-empty list.
+
+Iris
+----
+
+- `iInv H as (x1 ... xn) "ipat"` : open an invariant in hypothesis H. The result
+  is destructed using the Coq intro patterns `x1 ... xn` (for existential
+  quantifiers) and then the proof mode [introduction pattern][ipat] `ipat`.
+  + `iInv H with "selpat" as (x1 ... xn) "ipat" "Hclose"` : generate an update
+  for closing the invariant and put it in a hypothesis named `Hclose`.
+  + `iInv H with "selpat" as (x1 ... xn) "ipat"` : supply a selection pattern
+  `selpat`, which is used for any auxiliary assertions needed to open the
+  invariant (e.g. for cancelable or non-atomic invariants).
+  + `iInv N as (x1 ... xn) "ipat"` : identify the invariant to be opened with a
+    namespace `N` rather than giving a specific hypothesis.
+  + `iInv S with "selpat" as (x1 ... xn) "ipat" "Hclose"` : combine all the
+    above, where `S` is either a proof-mode identifier or a namespace.
+
+Miscellaneous
+-------------
+
+- The tactic `done` of [std++](https://gitlab.mpi-sws.org/iris/stdpp/-/blob/master/theories/tactics.v)
+  (which solves "trivial" goals using `intros`, `reflexivity`, `symmetry`,
+  `eassumption`, `trivial`, `split`, `discriminate`, `contradiction`, etc.) is
+  extended so that it also, among other things:
+  + performs `iAssumption`,
+  + introduces `∀`, `→`, and `-∗` in the proof mode,
+  + introduces pure goals `⌜ φ ⌝` using `iPureIntro` and calls `done` on `φ`, and,
+  + solves other trivial proof mode goals, such as `emp`, `x ≡ x`, big operators
+    over the empty list/map/set/multiset.
+
+  (Note that ssreflect also has a `done` tactic. Although Iris uses ssreflect,
+  it overrides ssreflect's `done` tactic with std++'s.)
+- The proof mode adds hints to the core `eauto` database so that `eauto`
+  automatically introduces: conjunctions and disjunctions, universal and
+  existential quantifiers, implications and wand, plainness, persistence, later
+  and update modalities, and pure connectives.
+
+Selection patterns (`selpat`)
+=============================
+
+Selection patterns are used to select hypotheses in the tactics `iRevert`,
+`iClear`, `iFrame`, `iLöb` and `iInduction`. The proof mode supports the
+following _selection patterns_:
+
+- `H` : select the hypothesis named `H`.
+- `%` : select the entire pure/Coq context.
+- `#` : select the entire intuitionistic context.
+- `∗` : select the entire spatial context. (N.B: this
+        is the unicode symbol `∗`, not the regular asterisk `*`.)
+
+Introduction patterns (`ipat`)
+==============================
+
+Introduction patterns are used to perform introductions and eliminations of
+multiple connectives on the fly. The proof mode supports the following
+_introduction patterns_:
+
+- `H` : create a hypothesis named `H`.
+- `?` : create an anonymous hypothesis.
+- `_` : clear the hypothesis.
+- `$` : frame the hypothesis in the goal.
+- `[ipat1 ipat2]` : (separating) conjunction elimination. In order to destruct
+  conjunctions `P ∧ Q` in the spatial context, one of the following conditions
+  should hold:
+  + Either the proposition `P` or `Q` should be persistent.
+  + Either `ipat1` or `ipat2` should be `_`, which results in one of the
+    conjuncts to be thrown away.
+- `[%x ipat]`/`[% ipat]` : existential elimination, naming the witness `x` or
+  keeping it anonymous. Falls back to (separating) conjunction elimination in
+  case the hypothesis is not an existential, so this pattern also works for
+  (separating) conjunctions with a pure left-hand side.
+- `(pat1 & pat2 & ... & patn)` : syntactic sugar for `[pat1 [pat2 .. patn ..]]`
+  to destruct nested (separating) conjunctions.
+- `[ipat1|ipat2]` : disjunction elimination.
+- `[]` : false elimination.
+- `%H` : move the hypothesis to the pure Coq context, and name it `H`.
+- `%` : move the hypothesis to the pure Coq context (anonymously). Note that if
+  `%` is followed by an identifier, and not another token, a space is needed
+  to disambiguate from `%H` above.
+- `->` and `<-` : rewrite using a pure Coq equality
+- `# ipat` : move the hypothesis into the intuitionistic context. The tactic
+  will fail if the hypothesis is not intuitionistic. On success, the tactic will
+  strip any number of intuitionistic and persistence modalities. If the
+  hypothesis is already in the intuitionistic context, the tactic will still
+  strip intuitionistic and persistence modalities (it is a no-op if the
+  hypothesis does not contain such modalities).
+- `-# ipat` (uncommon) : move the hypothesis into the spatial context. This can
+  move a hypothesis from the intuitionistic context to the spatial context, or
+  can explicitly specify the spatial context when the intuitionistic context
+  could be used (e.g., because a hypothesis was proven without using spatial
+  hypotheses). If the hypothesis is already in the spatial context, the tactic
+  is a no-op. If the hypothesis is not affine, an `<affine>` modality is added
+  to the hypothesis.
+- `> ipat` : eliminate a modality (if the goal permits); commonly used to strip
+  a later from the hypothesis when it is timeless and the goal is either a `WP`
+  or an update modality `|={E}=>`.
+
+Apart from this, there are the following introduction patterns that can only
+appear at the top level:
+
+- `{selpat}` : clear the hypotheses given by the selection pattern `selpat`.
+  Items of the selection pattern can be prefixed with `$`, which cause them to
+  be framed instead of cleared.
+- `!%` : introduce a pure goal (and leave the proof mode).
+- `!>` : introduce a modality by calling `iModIntro`.
+- `!#` : introduce a modality by calling `iModIntro` (deprecated).
+- `/=` : perform `simpl`.
+- `//` : perform `try done` on all goals.
+- `//=` : syntactic sugar for `/= //`
+- `*` : introduce all universal quantifiers. (N.B.: this is the asterisk `*` and
+  not the separating conjunction `∗`)
+- `**` : introduce all universal quantifiers, as well as all arrows and wands.
+
+For example, given:
+
+        ∀ x, <affine> ⌜ x = 0 ⌝ ⊢
+          □ (P → False ∨ □ (Q ∧ ▷ R) -∗
+          P ∗ ▷ (R ∗ Q ∧ ⌜ x = pred 2 ⌝)).
+
+You can write
+
+        iIntros (x Hx) "!> $ [[] | #[HQ HR]] /= !>".
+
+which results in:
+
+        x : nat
+        Hx : x = 0
+        ______________________________________(1/1)
+        "HQ" : Q
+        "HR" : R
+        --------------------------------------□
+        R ∗ Q ∧ x = 1
+
+
+Specialization patterns (`spat`)
+================================
+
+Since we are reasoning in a spatial logic, when eliminating a lemma or
+hypothesis of type ``P_0 -∗ ... -∗ P_n -∗ R``, one has to specify how the
+hypotheses are split between the premises. The proof mode supports the following
+_specialization patterns_ to express splitting of hypotheses:
+
+- `H` : use the hypothesis `H`, which should match the premise exactly. If `H` is
+  spatial, it will be consumed.
+- `(H spat1 .. spatn)` : first recursively specialize the hypothesis `H` using
+  the specialization patterns `spat1 .. spatn`, and finally use the result of
+  the specialization of `H`, which should match the premise exactly. If `H` is
+  spatial, it will be consumed.
+- `[H1 .. Hn]` and `[H1 .. Hn //]` : generate a goal for the premise with the
+  (spatial) hypotheses `H1 ... Hn` and all intuitionistic hypotheses. The
+  spatial hypotheses among `H1 ... Hn` will be consumed, and will not be
+  available for subsequent goals. Hypotheses prefixed with a `$` will be framed
+  in the goal for the premise. The pattern can be terminated with a `//`, which
+  causes `done` to be called to close the goal (after framing).
+- `[-H1 ... Hn]` and `[-H1 ... Hn //]` : the negated forms of the above
+  patterns, where the goal for the premise will have all spatial premises except
+  `H1 .. Hn`.
+- `[> H1 ... Hn]` and `[> H1 ... Hn //]` : like the above patterns, but these
+  patterns can only be used if the goal is a modality `M`, in which case
+  the goal for the premise will be wrapped in the modality `M`.
+- `[> -H1 ... Hn]` and `[> -H1 ... Hn //]` : the negated forms of the above
+  patterns.
+- `[# $H1 .. $Hn]` and `[# $H1 .. $Hn //]` : generate a goal for a persistent
+  premise in which all hypotheses are available. This pattern does not consume
+  any hypotheses; all hypotheses are available in the goal for the premise as
+  well in the subsequent goal. The hypotheses `$H1 ... $Hn` will be framed in
+  the goal for the premise. These patterns can be terminated with a `//`, which
+  causes `done` to be called to close the goal (after framing).
+- `[%]` and `[% //]` : generate a Coq goal for a pure premise. This pattern
+  does not consume any hypotheses. The pattern can be terminated with a `//`
+  which causes `done` to be called to close the goal.
+- `[$]` : solve the premise by framing. It will first repeatedly frame and
+  consume the spatial hypotheses, and then repeatedly frame the intuitionistic
+  hypotheses. Spatial hypotheses that are not framed are carried over to the
+  subsequent goal.
+- `[> $]` : like the above pattern, but this pattern can only be used if the
+  goal is a modality `M`, in which case the goal for the premise will be wrapped
+  in the modality `M` before framing.
+- `[# $]` : solve the persistent premise by framing. It will first repeatedly
+  frame the spatial hypotheses, and then repeatedly frame the intuitionistic
+  hypotheses. This pattern does not consume any hypotheses.
+
+For example, given:
+
+        H : □ P -∗ P 2 -∗ R -∗ x = 0 -∗ Q1 ∗ Q2
+
+One can write:
+
+        iDestruct ("H" with "[#] [H1 $H2] [$] [% //]") as "[H4 H5]".
+
+
+Proof mode terms (`pm_trm`)
+===========================
+
+Many of the proof mode tactics (such as `iDestruct`, `iApply`, `iRewrite`) can
+take both hypotheses and lemmas, and allow one to instantiate universal
+quantifiers and implications/wands of these hypotheses/lemmas on the fly.
+
+The syntax for the arguments of these tactics, called _proof mode terms_, is:
+
+        (H $! t1 ... tn with "spat1 .. spatn")
+
+Here, `H` can be either a hypothesis or a Coq lemma whose conclusion is
+of the shape `P ⊢ Q`. In the above, `t1 ... tn` are arbitrary Coq terms used
+for instantiation of universal quantifiers, and `spat1 .. spatn` are
+[specialization patterns][spat] to eliminate implications and wands.
+
+Proof mode terms can be written down using the following shorthand syntaxes, too:
+
+        (H with "spat1 .. spatn")
+        (H $! t1 ... tn)
+        H
+
+HeapLang tactics
+================
+
+If you came here looking for the `wp_` tactics, those are described in the
+[HeapLang documentation](./heap_lang.md).

docs/resource_algebras.md

+## Global resource algebra management
+
+The type of Iris propositions `iProp Σ` is parameterized by a *global* list `Σ:
+gFunctors` of resource algebras that the proof may use.  (Actually this list
+contains functors instead of resource algebras, but you only need to worry about
+that when dealing with higher-order ghost state -- see "Camera functors" below.)
+
+In our proofs, we always keep the `Σ` universally quantified to enable composition of proofs.
+Each proof just assumes that some particular resource algebras are contained in that global list.
+This is expressed via the `inG Σ R` typeclass, which roughly says that `R ∈ Σ`
+("`R` is in the `G`lobal list of RAs `Σ` -- hence the `G`).
+
+Libraries typically bundle the `inG` they need in a `libG` typeclass, so they do
+not have to expose to clients what exactly their resource algebras are. For
+example, in the [one-shot example](../tests/one_shot.v), we have:
+```coq
+Class one_shotG Σ := { one_shot_inG : inG Σ one_shotR }.
+Local Existing Instances one_shot_inG.
+```
+Here, the projection `one_shot_inG` is registered as an instance for type-class
+resolution. If you need several resource algebras, just add more `inG` fields.
+If you are using another module as part of yours, add a field like
+`one_shot_other : otherG Σ`. All of these fields should be added to the
+`Local Existing Instances` command.
+
+The code above enables these typeclass instances only in the surrounding file
+where they are used to define the new abstractions by the library. The
+interface of these abstractions will only depend on the `one_shotG` class.
+Since `one_shot_inG` will be hidden from clients, they will not accidentally
+rely on it in their code.
+
+Having defined the type class, we need to provide a way to instantiate it.  This
+is an important step, as not every resource algebra can actually be used: if
+your resource algebra refers to `Σ`, the definition becomes recursive.  That is
+actually legal under some conditions (see "Camera functors" below), but for now
+we will ignore that case.  We have to define a list that contains all the
+resource algebras we need:
+```coq
+Definition one_shotΣ : gFunctors := #[GFunctor one_shotR].
+```
+This time, there is no `Σ` in the context, so we cannot accidentally introduce a
+bad dependency.  If you are using another module as part of yours, add their
+`somethingΣ` to yours, as in `#[GFunctor one_shotR; somethingΣ]`.  (The
+`#[F1; F2; ...]` syntax *appends* the functor lists `F1`, `F2`, ... to each
+other; together with a coercion from a single functor to a singleton list, this
+means lists can be nested arbitrarily.)
+
+Now we can define the one and only instance that our type class will ever need:
+```coq
+Instance subG_one_shotΣ {Σ} : subG one_shotΣ Σ → one_shotG Σ.
+Proof. solve_inG. Qed.
+```
+The `subG` assumption here says that the list `one_shotΣ` is a sublist of the
+global list `Σ`.  Typically, this should be the only assumption your instance
+needs, showing that the assumptions of the module (and all the modules it
+uses internally) can trivially be satisfied by picking the right `Σ`.
+
+Now you can add `one_shotG` as an assumption to all your module definitions and
+proofs.  We typically use a section for this:
+```coq
+Section proof.
+Context `{!heapGS Σ, !one_shotG Σ}.
+```
+Notice that besides our own assumptions `one_shotG`, we also assume `heapGS`,
+which are assumptions that every HeapLang proof makes (they are related to
+defining the `↦` connective as well as the basic Iris infrastructure for
+invariants and WP).  For this purpose, `heapGS` contains not only assumptions
+about `Σ`, it also contains some ghost names to refer to particular ghost state
+(see "global ghost state instances" below).
+
+The backtick (`` ` ``) is used to make anonymous assumptions and to automatically
+generalize the `Σ`.  When adding assumptions with backtick, you should most of
+the time also add a `!` in front of every assumption.  If you do not then Coq
+will also automatically generalize all indices of type-classes that you are
+assuming.  This can easily lead to making more assumptions than you are aware
+of, and often it leads to duplicate assumptions which breaks type class
+resolutions.
+
+## Resource algebra combinators
+
+Defining a new resource algebra `one_shotR` for each new proof and verifying all
+the algebra laws would be quite cumbersome, so instead Iris provides a rich set
+of resource algebra combinators that one can use to build up the desired
+resource algebras. For example, `one_shotR` is defined as follows:
+
+```coq
+Definition one_shotR := csumR (exclR unitO) (agreeR ZO).
+```
+
+The suffixes `R` and `O` indicate that we are not working on the level of Coq
+types here, but on the level of `R`esource algebras and `O`FEs,
+respectively. Unfortunately this means we cannot use Coq's usual type notation
+(such as `*` for products and `()` for the unit type); we have to spell out the
+underlying OFE or resource algebra names instead.
+
+## Obtaining a closed proof
+
+To obtain a closed Iris proof, i.e., a proof that does not make assumptions like
+`inG`, you have to assemble a list of functors of all the involved modules,
+and if your proof relies on some singleton (most do, at least indirectly; also
+see the next section), you have to call the respective initialization or
+adequacy lemma.  [For example](../tests/one_shot.v):
+```coq
+Section client.
+  Context `{!heapGS Σ, !one_shotG Σ, !spawnG Σ}.
+
+  Lemma client_safe : WP client {{ _, True }}%I.
+  (* ... *)
+End client.
+
+(** Assemble all functors needed by the [client_safe] proof. *)
+Definition clientΣ : gFunctors := #[ heapΣ; one_shotΣ; spawnΣ ].
+
+(** Apply [heap_adequacy] with this list of all functors. *)
+Lemma client_adequate σ : adequate NotStuck client σ (λ _ _, True).
+Proof. apply (heap_adequacy clientΣ)=> ?. apply client_safe. Qed.
+```
+
+## Advanced topic: Ghost state singletons
+
+Some Iris modules involve a form of "global state".  For example, defining the
+`↦` for HeapLang involves a piece of ghost state that matches the current
+physical heap.  The `gname` of that ghost state must be picked once when the
+proof starts, and then globally known everywhere.  Hence `gen_heapGS`, the type
+class for the generalized heap module, bundles the usual `inG` assumptions
+together with the `gname`:
+```coq
+Class gen_heapGpreS (L V : Type) (Σ : gFunctors) `{Countable L} := {
+  #[local] gen_heapGpreS_heap :: ghost_mapG Σ L V;
+}.
+
+Class gen_heapGS (L V : Type) (Σ : gFunctors) `{Countable L} := GenHeapGS {
+  #[local] gen_heap_inG :: gen_heapGpreS L V Σ;
+  gen_heap_name : gname;
+}.
+```
+The trailing `S` here is for "singleton", because the idea is that only one
+instance of `gen_heapGS` ever exists. This is important, since two instances
+might have different `gname`s, so `↦` based on these two distinct instances
+would be incompatible with each other.
+
+The `gen_heapGpreS` typeclass (without the singleton data) is relevant for
+initialization, i.e., to create an instance of `gen_heapGS`. This is happening as
+part of [`heap_adequacy`](../iris_heap_lang/adequacy.v) using the
+initialization lemma for `gen_heapGS` from
+[`gen_heap_init`](../iris/base_logic/lib/gen_heap.v):
+```coq
+Lemma gen_heap_init `{gen_heapGpreS L V Σ} σ :
+  (|==> ∃ _ : gen_heapGS L V Σ, gen_heap_ctx σ)%I.
+```
+These lemmas themselves only make assumptions the way normal modules (those
+without global state) do. Just like in the normal case, `somethingGpreS` type
+classes have an `Instance` showing that a `subG` is enough to instantiate them:
+```coq
+Global Instance subG_gen_heapGpreS {Σ L V} `{Countable L} :
+  subG (gen_heapΣ L V) Σ → gen_heapGpreS L V Σ.
+Proof. solve_inG. Qed.
+```
+The initialization lemma then shows that the `somethingGpreS` type class is
+enough to create an instance of the main `somethingGS` class *below a view
+shift*.  This is written with an existential quantifier in the lemma because the
+statement after the view shift (`gen_heap_ctx σ` in this case) depends on having
+an instance of `gen_heapGS` in the context.
+
+Given that these global ghost state instances are singletons, they must be
+assumed explicitly everywhere.  Bundling `heapGS` in a (non-singleton) module
+type class like `one_shotG` would lose track of the fact that there exists just
+one `heapGS` instance that is shared by everyone.
+
+## Advanced topic: Camera functors and higher-order ghost state
+
+As we already alluded to, `Σ` actually consists of functors, not resource
+algebras. This enables you to use *higher-order ghost state*: ghost state that
+recursively refers to `iProp`.
+
+**Background: Iris Model.** To understand how this works, we have to dig a bit
+into the model of Iris. In Iris, the type of propositions `iProp` is described
+by the solution to the recursive domain equation:
+
+```coq
+iProp ≅ uPred (F (iProp))
+```
+
+Here, `uPred M` describes "propositions with resources of type `M`".  The
+peculiar aspect of this definition is that the notion of resources can itself
+refer to the set propositions that we are just defining; that dependency is
+expressed by `F`.  `F` is a user-chosen locally contractive bifunctor from COFEs
+to unital Cameras (a step-indexed generalization of unital resource
+algebras). Having just a single fixed `F` would however be rather inconvenient,
+so instead we have a list `Σ`, and then we define the global functor `F_global`
+roughly as follows:
+
+```coq
+F_global X := Π_{F ∈ Σ} gmap nat (F X)
+```
+
+In other words, each functor in `Σ` is applied to the recursive argument `X`,
+wrapped in a finite partial function, and then we take a big product of all of
+that.  The product ensures that all `F ∈ Σ` are available, and the `gmap` is
+needed to provide the proof rule `own_alloc`, which lets you create new
+instances of the given type of resource any time.
+
+However, this on its own would be too restrictive, as it requires all
+occurrences of `X` to be in positive positions (otherwise the functor laws
+would not hold for `F`).  To mitigate this, we instead work with "bifunctors":
+functors that take two arguments, `X` and `X⁻`, where `X⁻` is used for
+negative positions.  This leads us to the following domain equation:
+
+```coq
+iProp ≅ uPred (F_global (iProp,iProp))
+F_global (X,X⁻) := Π_{F ∈ Σ} gmap nat (F (X,X⁻))
+```
+
+To make this equation well-defined, the bifunctors `F ∈ Σ` need to be "contractive".
+For further details, see §7.4 of
+[The Iris Documentation](http://plv.mpi-sws.org/iris/appendix-3.3.pdf); here we
+describe the user-side Coq aspects of this approach.
+
+Below, when we say "functor", we implicitly mean "bifunctor".
+
+**Higher-order ghost state.** To use higher-order ghost state, you need to give
+a functor whose "hole" will later be filled with `iProp` itself. For example,
+let us say you would like to have ghost state of type `gmap K (agree (nat *
+later iProp))`, using the "type-level" `later` operator which ensures
+contractivity.  Then you will have to define a functor such as:
+
+```coq
+F (X,X⁻) := gmap K (agree (nat * ▶ X))
+```
+
+To make it convenient to construct such functors and prove their contractivity,
+we provide a number of abstractions:
+
+- [`oFunctor`](../iris/algebra/ofe.v): functors from COFEs to OFEs.
+- [`rFunctor`](../iris/algebra/cmra.v): functors from COFEs to cameras.
+- [`urFunctor`](../iris/algebra/cmra.v): functors from COFEs to unital
+  cameras.
+
+Besides, there are the classes `oFunctorContractive`, `rFunctorContractive`, and
+`urFunctorContractive` which describe the subset of the above functors that are
+contractive.
+
+To compose these functors, we provide a number of combinators, e.g.:
+
+- `constOF (A : ofe) : oFunctor            := λ (B,B⁻), A `
+- `idOF : oFunctor                         := λ (B,B⁻), B`
+- `prodOF (F1 F2 : oFunctor) : oFunctor    := λ (B,B⁻), F1 (B,B⁻) * F2 (B,B⁻)`
+- `ofe_morOF (F1 F2 : oFunctor) : oFunctor := λ (B,B⁻), F1 (B⁻,B) -n> F2 (B,B⁻)`
+- `laterOF (F : oFunctor) : oFunctor       := λ (B,B⁻), later (F (B,B⁻))`
+- `agreeRF (F : oFunctor) : rFunctor       := λ (B,B⁻), agree (F (B,B⁻))`
+- `gmapURF K (F : rFunctor) : urFunctor    := λ (B,B⁻), gmap K (F (B,B⁻))`
+
+Note in particular how the functor for the function space, `ofe_morOF`, swaps
+`B` and `B⁻` for the functor `F1` describing the domain.  This reflects the fact
+that that functor is used in a negative position.
+
+Using these combinators, one can easily construct bigger functors in point-free
+style and automatically infer their contractivity, e.g:
+
+```coq
+F := gmapURF K (agreeRF (prodOF (constOF natO) (laterOF idOF)))
+```
+
+which effectively defines the desired example functor
+`F := λ (B,B⁻), gmap K (agree (nat * later B))`.
+
+To make it a little bit more convenient to write down such functors, we make
+the constant functors (`constOF`, `constRF`, and `constURF`) a coercion, and
+provide the usual notation for products, etc. So the above functor can be
+written as follows:
+
+```coq
+F := gmapRF K (agreeRF (natO * ▶ ∙))
+```
+
+Basically, the functor can be written "as if" you were writing a resource
+algebra, except that there need to be extra "F" suffixes to indicate that we are
+working with functors, and the desired recursive `iProp` is replaced by the
+"hole" `∙`.
+
+Putting it all together, the `libG` typeclass and `libΣ` list of functors for
+your example would look as follows:
+
+```coq
+Class libG Σ :=
+  { #[local] lib_inG :: inG Σ (gmapR K (agreeR (prodO natO (laterO (iPropO Σ))))) }.
+
+Definition libΣ : gFunctors := #[GFunctor (gmapRF K (agreeRF (natO * ▶ ∙)))].
+Instance subG_libΣ {Σ} : subG libΣ Σ → libG Σ.
+Proof. solve_inG. Qed.
+```
+
+It is instructive to remove the `▶` and see what happens: the `libG` class still
+works just fine, but `libΣ` complains that the functor is not contractive. This
+demonstrates the importance of always defining a `libΣ` alongside the `libG` and
+proving their relation.

docs/style_guide.md

+# Iris proof style
+
+**Warning:** this document is still in development and rather incomplete.
+If you run across a question of style (for example, something comes
+up in an MR) and it's not on this list, please do reach out to us on Mattermost
+so we can add it.
+
+## Basic syntax
+
+### Binders
+
+This applies to Context, Implicit Types, and definitions.
+
+- **Put a space on both sides of the colon.**
+
+  Good: `(a : B)` <br>
+  Bad: `(a:B)`, `(a: B)`
+
+- **Prefer `(a : B)` to `a : B`.** (TODO)
+
+
+### Patterns
+
+#### Disjunctions & branches
+
+- **Always mark the disjuncts when destructuring a disjunctive pattern, even if you don't bind anything, to indicate that the proof branches.**
+
+  Good:
+  ```coq
+  Lemma foo : ∀ b : bool, b = true ∨ b = false.
+  Proof.
+    intros [|].
+    ...
+  ```
+
+  Bad:
+  ```coq
+  Lemma foo : ∀ b : bool, b = true ∨ b = false.
+  Proof.
+    intros [].
+    ...
+  ```
+
+#### Uncategorized
+
+- **Use `"[H1 H2]"` when possible otherwise do `"(H1 & H2 & H3)"`.** (TODO)
+
+### Unicode
+
+- **Always use Unicode variants of forall, exists, ->, <=, >=.**
+
+  Good: `∀ ∃ → ≤ ≥`<br>
+  Bad: `forall exists -> <= >=`
+
+### Equivalent vernacular commands
+
+- **Use `Context`, never `Variable`.**
+
+- **Use `Implicit Types`, never `Implicit Type`.** (TODO)
+
+- **Use `Lemma`, not `Theorem` (or the other variants: `Fact`, `Corollary`, `Remark`)**.
+
+- **Always add `Global` or `Local` to `Hint`, `Arguments`, and `Instance`.** (TODO)
+
+### `Require`
+
+- **Never put `Require` in the middle of a file.** All `Require` must be at the top.
+If you only want to *import* a certain module in some specific place (for instance, in a `Section` or other `Module`), you can do something like:
+
+  ```coq
+  From lib Require component.
+  
+  (* ... *)
+  
+  Import component.
+  ```
+
+### Ltac
+
+- **Prefer `first [ t1 | fail 1 "..." ]` to `t1 || fail "..."`.** This is better because the latter will fail if `t1` doesn't make progress. See https://gitlab.mpi-sws.org/iris/iris/-/issues/216. Note that `first [ t1 | fail "..."]` is simply incorrect; the failure message will never show up and will be replaced with a generic failure.
+
+### Coqdoc comments
+
+- **Module-level comments (covering the entire file) go at the top of the file, before the `Require`.**
+
+### Uncategorized
+
+- **Indent the body of a match by one space.**
+
+  Good:
+  ```coq
+  match foo with
+  | Some x =>
+     long line here using 
+  ```
+  
+  *RJ*: This is odd, usually everything is in (multiples of) 2 spaces, I think.
+  
+  *Tej*: https://gitlab.mpi-sws.org/iris/iris/-/blob/920bc3d97b8830139045e1780f2aff4d05b910cd/iris_heap_lang/proofmode.v#L194
+
+- **Avoid using the extra square brackets around an Ltac match.**
+
+  Good:
+  ```coq
+  match goal with
+  | |- ?g => idtac g
+  
+  ```
+  
+  Bad:
+  ```coq
+  match goal with
+  | [ |- ?g ] => idtac g
+  
+  ```
+
+- **Use coqdoc syntax in comments for Coq identifiers and inline code, e.g. `[cmraT]`.**
+
+- **Put proofs either all on one line (`Proof. reflexivity. Qed.`) or split up the usual way with indentation.**
+
+  Bad:
+  
+  ```coq
+  Lemma foo : 2 + 2 = 4 ∧ 1 + 2 = 3.
+  Proof. split.
+    - reflexivity.
+    - done.
+  Qed.
+  ```
+
+- **Put the entire theorem statement on one line or one premise per line, indented by 2 spaces.**
+
+  Bad:
+  
+  ```coq
+  Lemma foo x y z :
+      x < y → y < z →
+      x < z.
+  ```
+  
+  Good:
+  
+  ```coq
+  Lemma foo x y z : x < y → y < z → x < z.
+  ```
+  
+  Good: (particularly if premises are longer)
+  
+  ```coq
+  Lemma foo x y z :
+    x < y →
+    y < z →
+    x < z.
+  ```
+
+- **If the parameters before the `:` become too long, indent later lines by 4 spaces and always have a newline after `:`.**
+
+  Bad:
+  
+  ```coq
+  Lemma foo (very_long_name : has_a_very_long_type)
+  (even_longer_name : has_an_even_longer_type) : x < y → y < z →
+    x < z.
+  ```
+  
+  Good:
+  
+  ```coq
+  Lemma foo (very_long_name : has_a_very_long_type)
+      (even_longer_name : has_an_even_longer_type) :
+    x < y → y < z → x < z.
+  ```
+
+- **For definitions that don't fit into one line, put `:=` before the linebreak, not after.**
+
+  Bad:
+  
+  ```coq
+  Definition foo (arg1 arg2 arg3 : name_of_the_type)
+    := the body that is very long.
+  ```
+  
+  Good:
+  
+  ```coq
+  Definition foo (arg1 arg2 arg3 : name_of_the_type) :=
+    the body that is very long.
+  ```
+
+- **For tests with output put `Check "theorem name in a string"` before it so that the output from different tests is separated.**
+
+- **For long `t1; t2; t3` and `t; [t1 | t2 | t3]` split them like this, and indent by 2 spaces.**
+
+  Good:
+  ```coq
+  t;
+    [t1
+    |t2
+    |t3].
+  ```
+  
+  ```coq
+  t;
+    t1;
+    t2.
+  ```
+
+
+
+## File organization
+theories/algebra is for primitive ofe/RA/CMRA constructions
+theories/algebra/lib is for derived constructions
+theories/base_logic/lib is for constructions in the base logic (using own)
+
+## Naming
+* `*_ctx` for persistent facts (often an invariant) needed by everything in a library
+* `*_interp` for a function from some representation to iProp
+* If you have lemma `foo` which is an iff and you want single direction versions, name them `foo_1` (forward) and `foo_2` (backward)
+* If you have a lemma `foo` parametrized by an equivalence relation, you might want a version specialized to Leibniz equality for better rewrite support; name that version `foo_L` and state it with plain equality (e.g., `dom_empty_L` in stdpp). You might take an assumption `LeibnizEquiv A` if the original version took an equivalence (say the OFE equivalence) to assume that the provided equivalence is plain equality.
+* Lower-case theorem names, lower-case types, upper-case constructors
+* **TODO:** how should `f (g x) = f' (g' x)` be named?
+* `list_lookup_insert` is named by context (the type involved), then the two functions outside-in on the left-hand-side, so it has the type `lookup (insert …) = …` where the `insert` is on a list. Notations mean it doesn’t actually look like this and the insert is textually first.
+* Operations that "extract" from the data structure (`lookup`, `elem_of`, ...) should come before operations that "alter" the data structure (`filter`, `insert`, `union`, `fmap`). For example, use `map_lookup_filter` instead of `map_filter_lookup`.
+* Injectivity theorems are instances of `Inj` and then are used with `inj`
+* Suffixes `_l` and `_r` when we have binary `op x y` and a theorem related to the left or right. For example, `sep_mono_l` says bi_sep is monotonic in its left argument (holding the right constant).
+* Suffix `'` (prime) is used when `foo'` is a corollary of `foo`. Try to avoid
+  these since the name doesn't convey how `foo'` is related to `foo`.
+* Given a polymorphic function/relation `f` (e.g., `eq`, `equiv`, `subseteq`), the instance of type `A` is called `A_f_instance`, and we add a lemma `A_f` that characterizes the instance. In case of many instances, this lemma is proved by unfolding the definition of the instance, e.g., `frac_op`, `frac_valid`. However, in some cases, e.g., `list_eq`, `map_eq`, `set_eq` this lemma might require non-trivial proof work.
+* For lemmas involving modalities, we usually follow this naming scheme:
+    ```
+    M1_into_M2: M1 P ⊢ M2 P
+    M1_M2_elim: M1 (M2 P) ⊣⊢ M1 P
+    M1_elim_M2: M1 (M2 P) ⊣⊢ M2 P
+    M1_M2: M1 (M2 P) ⊣⊢ M2 (M1 P)
+    ```
+* Monotonicity lemmas where the relation can be ambiguous are called `<f>_<relation>_mono`, e.g. `Some_included_mono`.
+* For lemmas `f x = g ...` that give a definition of function `f` in terms of `g`, we use `f_as_g`. For example, `map_compose_as_omap : m ∘ₘ n = omap (m !!.) n`.
+
+### Naming algebra libraries
+
+**TODO:** describe any conclusions we came to with the `mono_nat` library
+
+## Parameter order and implicitness for lemmas
+
+* Parameter order is usually from more higher-order to less higher-order (types, functions, plain values), and otherwise follows the order in which variables appear in the lemma statement.
+* In new lemmas, arguments should be marked as implicit when they can be inferred by unification in all intended usage scenarios. (If an argument can *sometimes* be inferred, we do not have a clear guideline yet -- consider on a case-by-case basis, for now.)
+
+## Lemma statements
+
+### Iris lemmas: `-∗` vs `⊢`
+
+* For low-level lemmas, in particular if there is a high likelihood someone would want to rewrite with it / use them in non-proofmode goals (e.g. modality intro rules), use `⊢`
+  * `P ⊢ |==£> P`
+  * `(|==£> |==£> P) ⊢ |==£> P`
+  * `▷ own γ a ⊢ ◇ ∃ b, own γ b ∧ ▷ (a ≡ b)`
+  * `(P -∗ Q) i ⊢ (P i -∗ Q i)`
+* If a lemma is a Coq implication of Iris entailments (where the entailments are visible, not hidden behind e.g. `Persistent`), then use `⊢`
+  * `(P1 ⊢ P2) → recv l P1 ⊢ recv l P2`
+* Else use -∗
+  * `a1 ⋅ a2 ~~> a' → own γ a1 -∗ own γ a2 ==∗ own γ a'` (curried and hence not rewrite-friendly)
+
+## Metavariables
+**TODO:** move these to the right place
+
+* `P` `Q` for bi:PROP (or specifically `iProp Σ`)
+* `Φ` and `Ψ` for (?A -> iProp), like postconditions
+* `φ` and `ψ` for `Prop`
+* `A` `B` for types, ofeT, or cmraT
+
+Suffixes like O, R, UR (already documented)

docs/vim_ultisnips

+snippet \forall "" i
+∀
+endsnippet
+snippet \exists "" i
+∃
+endsnippet
+snippet \lam "" i
+λ
+endsnippet
+snippet \not "" i
+¬
+endsnippet
+snippet \lor "" i
+∨
+endsnippet
+snippet \land "" i
+∧
+endsnippet
+snippet \/ "" i
+∨
+endsnippet
+snippet /\ "" i
+∧
+endsnippet
+snippet \rightarrow "" i
+→
+endsnippet
+snippet \implies "" i
+→
+endsnippet
+snippet -> "" i
+→
+endsnippet
+snippet \iff "" i
+↔
+endsnippet
+snippet <-> "" i
+↔
+endsnippet
+snippet \<- "" i
+←
+endsnippet
+snippet \cong "" i
+≡
+endsnippet
+snippet \== "" i
+≡
+endsnippet
+snippet \/== "" i
+≢
+endsnippet
+snippet \neq "" i
+≠
+endsnippet
+snippet /= "" i
+≠
+endsnippet
+snippet \less "" i
+≤
+endsnippet
+snippet \le "" i
+≤
+endsnippet
+snippet <= "" i
+≤
+endsnippet
+snippet \in "" i
+∈
+endsnippet
+snippet \notin "" i
+∉
+endsnippet
+snippet \cup "" i
+∪
+endsnippet
+snippet \cap "" i
+∩
+endsnippet
+snippet \setminus "" i
+∖
+endsnippet
+snippet \subset "" i
+⊂
+endsnippet
+snippet \subseteq "" i
+⊆
+endsnippet
+snippet \sqsubseteq "" i
+⊑
+endsnippet
+snippet \sqsubseteq "" i
+⊑
+endsnippet
+snippet \notsubseteq "" i
+⊈
+endsnippet
+snippet \meet "" i
+⊓
+endsnippet
+snippet \join "" i
+⊔
+endsnippet
+snippet \true "" i
+⊤
+endsnippet
+snippet \top "" i
+⊤
+endsnippet
+snippet \false "" i
+⊥
+endsnippet
+snippet \bottom "" i
+⊥
+endsnippet
+snippet \vdash "" i
+⊢
+endsnippet
+snippet \dashv "" i
+⊣
+endsnippet
+snippet \vDash "" i
+⊨
+endsnippet
+snippet \Vdash
+⊩
+endsnippet
+snippet \infty "" i
+∞
+endsnippet
+snippet \comp "" i
+∘
+endsnippet
+snippet \prf "" i
+↾
+endsnippet
+snippet \bind "" i
+≫=
+endsnippet
+snippet \mapsto "" i
+↦
+endsnippet
+snippet \hookrightarrow "" i
+↪
+endsnippet
+snippet \up "" i
+↑
+endsnippet
+snippet \uparrow "" i
+↑
+endsnippet
+
+snippet \fun "" i
+λ
+endsnippet
+snippet \mult "" i
+⋅
+endsnippet
+snippet \ent "" i
+⊢
+endsnippet
+snippet \valid "" i
+✓
+endsnippet
+snippet \diamond "" i
+◇
+endsnippet
+snippet \box "" i
+□
+endsnippet
+snippet \bbox "" i
+■
+endsnippet
+snippet \eval "" i
+▷
+endsnippet
+snippet \rhd "" i
+▷
+endsnippet
+snippet \later "" i
+▷
+endsnippet
+snippet \pred "" i
+φ
+endsnippet
+snippet \and "" i
+∧
+endsnippet
+snippet \or "" i
+∨
+endsnippet
+snippet \circ "" i
+∘
+endsnippet
+snippet \comp "" i
+∘
+endsnippet
+snippet \ccomp "" i
+◎
+endsnippet
+snippet \pound "" i
+£
+endsnippet
+snippet \all "" i
+∀
+endsnippet
+snippet \ex "" i
+∃
+endsnippet
+snippet \to "" i
+→
+endsnippet
+snippet \ast "" i
+∗
+endsnippet
+snippet \sep "" i
+∗
+endsnippet
+snippet \ulc "" i
+⌜
+endsnippet
+snippet \urc "" i
+⌝
+endsnippet
+snippet \lc "" i
+⌜
+endsnippet
+snippet \rc "" i
+⌝
+endsnippet
+snippet \Lc "" i
+⎡
+endsnippet
+snippet \Rc "" i
+⎤
+endsnippet
+snippet \varnothing "" i
+∅
+endsnippet
+snippet \empty "" i
+∅
+endsnippet
+snippet \Lam "" i
+Λ
+endsnippet
+snippet \Sig "" i
+Σ
+endsnippet
+snippet \- "" i
+∖
+endsnippet
+snippet \aa "" i
+●
+endsnippet
+snippet \af "" i
+◯
+endsnippet
+snippet \auth "" i
+●
+endsnippet
+snippet \frag "" i
+◯
+endsnippet
+snippet \iff "" i
+↔
+endsnippet
+snippet \gname "" i
+γ
+endsnippet
+snippet \incl "" i
+≼
+endsnippet
+snippet \latert "" i
+▶
+endsnippet
+snippet \update "" i
+⇝
+endsnippet
+snippet \bind "" i
+≫=
+endsnippet
+
+
+snippet ^^+ "" i
+⁺
+endsnippet
+snippet __+ "" i
+₊
+endsnippet
+snippet ^^- "" i
+⁻
+endsnippet
+snippet __0 "" i
+₀
+endsnippet
+snippet __1 "" i
+₁
+endsnippet
+snippet __2 "" i
+₂
+endsnippet
+snippet __3 "" i
+₃
+endsnippet
+snippet __4 "" i
+₄
+endsnippet
+snippet __5 "" i
+₅
+endsnippet
+snippet __6 "" i
+₆
+endsnippet
+snippet __7 "" i
+₇
+endsnippet
+snippet __8 "" i
+₈
+endsnippet
+snippet __9 "" i
+₉
+endsnippet
+
+snippet __a "" i
+ₐ
+endsnippet
+snippet __e "" i
+ₑ
+endsnippet
+snippet __h "" i
+ₕ
+endsnippet
+snippet __i "" i
+ᵢ
+endsnippet
+snippet __k "" i
+ₖ
+endsnippet
+snippet __l "" i
+ₗ
+endsnippet
+snippet __m "" i
+ₘ
+endsnippet
+snippet __n "" i
+ₙ
+endsnippet
+snippet __o "" i
+ₒ
+endsnippet
+snippet __p "" i
+ₚ
+endsnippet
+snippet __r "" i
+ᵣ
+endsnippet
+snippet __s "" i
+ₛ
+endsnippet
+snippet __t "" i
+ₜ
+endsnippet
+snippet __u "" i
+ᵤ
+endsnippet
+snippet __v "" i
+ᵥ
+endsnippet
+snippet __x "" i
+ₓ
+endsnippet
+
+snippet \Alpha "" i
+Α
+endsnippet
+snippet \alpha "" i
+α
+endsnippet
+snippet \Beta "" i
+Β
+endsnippet
+snippet \beta "" i
+β
+endsnippet
+snippet \Gamma "" i
+Γ
+endsnippet
+snippet \gamma "" i
+γ
+endsnippet
+snippet \Delta "" i
+Δ
+endsnippet
+snippet \delta "" i
+δ
+endsnippet
+snippet \Epsilon "" i
+Ε
+endsnippet
+snippet \epsilon "" i
+ε
+endsnippet
+snippet \Zeta "" i
+Ζ
+endsnippet
+snippet \zeta "" i
+ζ
+endsnippet
+snippet \Eta "" i
+Η
+endsnippet
+snippet \eta "" i
+η
+endsnippet
+snippet \Theta "" i
+Θ
+endsnippet
+snippet \theta "" i
+θ
+endsnippet
+snippet \Iota "" i
+Ι
+endsnippet
+snippet \iota "" i
+ι
+endsnippet
+snippet \Kappa "" i
+Κ
+endsnippet
+snippet \kappa "" i
+κ
+endsnippet
+snippet \Lamda "" i
+Λ
+endsnippet
+snippet \lamda "" i
+λ
+endsnippet
+snippet \Lambda "" i
+Λ
+endsnippet
+snippet \lambda "" i
+λ
+endsnippet
+snippet \Mu "" i
+Μ
+endsnippet
+snippet \mu "" i
+μ
+endsnippet
+snippet \Nu "" i
+Ν
+endsnippet
+snippet \nu "" i
+ν
+endsnippet
+snippet \Xi "" i
+Ξ
+endsnippet
+snippet \xi "" i
+ξ
+endsnippet
+snippet \Omicron "" i
+Ο
+endsnippet
+snippet \omicron "" i
+ο
+endsnippet
+snippet \Pi "" i
+Π
+endsnippet
+snippet \pi "" i
+π
+endsnippet
+snippet \Rho "" i
+Ρ
+endsnippet
+snippet \rho "" i
+ρ
+endsnippet
+snippet \Sigma "" i
+Σ
+endsnippet
+snippet \sigma "" i
+σ
+endsnippet
+snippet \Tau "" i
+Τ
+endsnippet
+snippet \tau "" i
+τ
+endsnippet
+snippet \Upsilon "" i
+Υ
+endsnippet
+snippet \upsilon "" i
+υ
+endsnippet
+snippet \Phi "" i
+Φ
+endsnippet
+snippet \phi "" i
+ϕ
+endsnippet
+snippet \varphi "" i
+φ
+endsnippet
+snippet \Chi "" i
+Χ
+endsnippet
+snippet \chi "" i
+χ
+endsnippet
+snippet \Psi "" i
+Ψ
+endsnippet
+snippet \psi "" i
+ψ
+endsnippet
+snippet \Omega "" i
+Ω
+endsnippet
+snippet \omega "" i
+ω
+endsnippet

docs/vscode

+  "generic-input-methods.input-methods": [
+        {
+            "name": "Iris Math",
+            "commandName": "text.math",
+            "languages": [
+                "coq"
+            ],
+            "triggers": [
+                "\\"
+            ],
+            "dictionary": [
+                // Standard LaTeX math notations
+                { "label": "forall", "body": "∀", "description": "∀" },
+                { "label": "exists", "body": "∃", "description": "∃" },
+                { "label": "lam", "body": "λ", "description": "λ" },
+                { "label": "not", "body": "¬", "description": "¬" },
+                { "label": "->", "body": "→", "description": "→" },
+                { "label": "<->", "body": "↔", "description": "↔" },
+                { "label": "<-", "body": "←", "description": "←" },
+                { "label": "==", "body": "≡", "description": "≡" },
+                { "label": "/==", "body": "≢", "description": "≢" },
+                { "label": "/=", "body": "≠", "description": "≠" },
+                { "label": "neq", "body": "≠", "description": "≠" },
+                { "label": "nequiv", "body": "≢", "description": "≢" },
+                { "label": "<=", "body": "≤", "description": "≤" },
+                { "label": "leq", "body": "≤", "description": "≤" },
+                { "label": "in", "body": "∈", "description": "∈" },
+                { "label": "notin", "body": "∉", "description": "∉" },
+                { "label": "cup", "body": "∪", "description": "∪" },
+                { "label": "cap", "body": "∩", "description": "∩" },
+                { "label": "setminus", "body": "∖", "description": "∖" },
+                { "label": "subset", "body": "⊂", "description": "⊂" },
+                { "label": "subseteq", "body": "⊆", "description": "⊆" },
+                { "label": "sqsubseteq", "body": "⊑", "description": "⊑" },
+                { "label": "sqsubseteq", "body": "⊑", "description": "⊑" },
+                { "label": "notsubseteq", "body": "⊈", "description": "⊈" },
+                { "label": "meet", "body": "⊓", "description": "⊓" },
+                { "label": "join", "body": "⊔", "description": "⊔" },
+                { "label": "top", "body": "⊤", "description": "⊤" },
+                { "label": "bottom", "body": "⊥", "description": "⊥" },
+                { "label": "vdash", "body": "⊢", "description": "⊢" },
+                { "label": "|-", "body": "⊢", "description": "⊢" },
+                { "label": "dashv", "body": "⊣", "description": "⊣" },
+                { "label": "Vdash", "body": "⊨", "description": "⊨" },
+                { "label": "infty", "body": "∞", "description": "∞" },
+                { "label": "comp", "body": "∘", "description": "∘" },
+                { "label": "prf", "body": "↾", "description": "↾" },
+                { "label": "bind", "body": "≫=", "description": "≫=" },
+                { "label": "mapsto", "body": "↦", "description": "↦" },
+                { "label": "hookrightarrow", "body": "↪", "description": "↪" },
+                { "label": "uparrow", "body": "↑", "description": "↑" },
+
+                // Iris specific
+                { "label": "fun", "body": "λ", "description": "λ" },
+                { "label": "mult", "body": "⋅", "description": "⋅" },
+                { "label": "ent", "body": "⊢", "description": "⊢" },
+                { "label": "valid", "body": "✓", "description": "✓" },
+                { "label": "diamond", "body": "◇", "description": "◇" },
+                { "label": "box", "body": "□", "description": "□" },
+                { "label": "bbox", "body": "■", "description": "■" },
+                { "label": "later", "body": "▷", "description": "▷" },
+                { "label": "pred", "body": "φ", "description": "φ" },
+                { "label": "and", "body": "∧", "description": "∧" },
+                { "label": "or", "body": "∨", "description": "∨" },
+                { "label": "comp", "body": "∘", "description": "∘" },
+                { "label": "ccomp", "body": "◎", "description": "◎" },
+                { "label": "all", "body": "∀", "description": "∀" },
+                { "label": "ex", "body": "∃", "description": "∃" },
+                { "label": "to", "body": "→", "description": "→" },
+                { "label": "sep", "body": "∗", "description": "∗" },
+                { "label": "star", "body": "∗", "description": "∗" },
+                { "label": "lc", "body": "⌜", "description": "⌜" },
+                { "label": "rc", "body": "⌝", "description": "⌝" },
+                { "label": "Lc", "body": "⎡", "description": "⎡" },
+                { "label": "Rc", "body": "⎤", "description": "⎤" },
+                { "label": "empty", "body": "∅", "description": "∅" },
+                { "label": "Lam", "body": "Λ", "description": "Λ" },
+                { "label": "Sig", "body": "Σ", "description": "Σ" },
+                { "label": "-", "body": "∖", "description": "∖" },
+                { "label": "aa", "body": "●", "description": "●" },
+                { "label": "af", "body": "◯", "description": "◯" },
+                { "label": "auth", "body": "●", "description": "●" },
+                { "label": "frag", "body": "◯", "description": "◯" },
+                { "label": "iff", "body": "↔", "description": "↔" },
+                { "label": "gname", "body": "γ", "description": "γ" },
+                { "label": "incl", "body": "≼", "description": "≼" },
+                { "label": "latert", "body": "▶", "description": "▶" },
+                { "label": "update", "body": "⇝", "description": "⇝" },
+                { "label": "bind", "body": "≫=", "description": "≫=" },
+
+                // accents (for iLöb)
+                { "label": "\"o", "body": "ö", "description": "ö" },
+
+                // subscripts and superscripts
+                { "label": "^^+", "body": "⁺", "description": "⁺" },
+                { "label": "__+", "body": "₊", "description": "₊" },
+                { "label": "^^-", "body": "⁻", "description": "⁻" },
+                { "label": "__0", "body": "₀", "description": "₀" },
+                { "label": "__1", "body": "₁", "description": "₁" },
+                { "label": "__2", "body": "₂", "description": "₂" },
+                { "label": "__3", "body": "₃", "description": "₃" },
+                { "label": "__4", "body": "₄", "description": "₄" },
+                { "label": "__5", "body": "₅", "description": "₅" },
+                { "label": "__6", "body": "₆", "description": "₆" },
+                { "label": "__7", "body": "₇", "description": "₇" },
+                { "label": "__8", "body": "₈", "description": "₈" },
+                { "label": "__9", "body": "₉", "description": "₉" },
+                { "label": "__a", "body": "ₐ", "description": "ₐ" },
+                { "label": "__e", "body": "ₑ", "description": "ₑ" },
+                { "label": "__h", "body": "ₕ", "description": "ₕ" },
+                { "label": "__i", "body": "ᵢ", "description": "ᵢ" },
+                { "label": "__k", "body": "ₖ", "description": "ₖ" },
+                { "label": "__l", "body": "ₗ", "description": "ₗ" },
+                { "label": "__m", "body": "ₘ", "description": "ₘ" },
+                { "label": "__n", "body": "ₙ", "description": "ₙ" },
+                { "label": "__o", "body": "ₒ", "description": "ₒ" },
+                { "label": "__p", "body": "ₚ", "description": "ₚ" },
+                { "label": "__r", "body": "ᵣ", "description": "ᵣ" },
+                { "label": "__s", "body": "ₛ", "description": "ₛ" },
+                { "label": "__t", "body": "ₜ", "description": "ₜ" },
+                { "label": "__u", "body": "ᵤ", "description": "ᵤ" },
+                { "label": "__v", "body": "ᵥ", "description": "ᵥ" },
+                { "label": "__x", "body": "ₓ", "description": "ₓ" },
+
+                // Greek alphabet
+                { "label": "Alpha", "body": "Α", "description": "Α" },
+                { "label": "alpha", "body": "α", "description": "α" },
+                { "label": "Beta", "body": "Β", "description": "Β" },
+                { "label": "beta", "body": "β", "description": "β" },
+                { "label": "Gamma", "body": "Γ", "description": "Γ" },
+                { "label": "gamma", "body": "γ", "description": "γ" },
+                { "label": "Delta", "body": "Δ", "description": "Δ" },
+                { "label": "delta", "body": "δ", "description": "δ" },
+                { "label": "Epsilon", "body": "Ε", "description": "Ε" },
+                { "label": "epsilon", "body": "ε", "description": "ε" },
+                { "label": "Zeta", "body": "Ζ", "description": "Ζ" },
+                { "label": "zeta", "body": "ζ", "description": "ζ" },
+                { "label": "Eta", "body": "Η", "description": "Η" },
+                { "label": "eta", "body": "η", "description": "η" },
+                { "label": "Theta", "body": "Θ", "description": "Θ" },
+                { "label": "theta", "body": "θ", "description": "θ" },
+                { "label": "Iota", "body": "Ι", "description": "Ι" },
+                { "label": "iota", "body": "ι", "description": "ι" },
+                { "label": "Kappa", "body": "Κ", "description": "Κ" },
+                { "label": "kappa", "body": "κ", "description": "κ" },
+                { "label": "Lamda", "body": "Λ", "description": "Λ" },
+                { "label": "lamda", "body": "λ", "description": "λ" },
+                { "label": "Lambda", "body": "Λ", "description": "Λ" },
+                { "label": "lambda", "body": "λ", "description": "λ" },
+                { "label": "Mu", "body": "Μ", "description": "Μ" },
+                { "label": "mu", "body": "μ", "description": "μ" },
+                { "label": "Nu", "body": "Ν", "description": "Ν" },
+                { "label": "nu", "body": "ν", "description": "ν" },
+                { "label": "Xi", "body": "Ξ", "description": "Ξ" },
+                { "label": "xi", "body": "ξ", "description": "ξ" },
+                { "label": "Omicron", "body": "Ο", "description": "Ο" },
+                { "label": "omicron", "body": "ο", "description": "ο" },
+                { "label": "Pi", "body": "Π", "description": "Π" },
+                { "label": "pi", "body": "π", "description": "π" },
+                { "label": "Rho", "body": "Ρ", "description": "Ρ" },
+                { "label": "rho", "body": "ρ", "description": "ρ" },
+                { "label": "Sigma", "body": "Σ", "description": "Σ" },
+                { "label": "sigma", "body": "σ", "description": "σ" },
+                { "label": "Tau", "body": "Τ", "description": "Τ" },
+                { "label": "tau", "body": "τ", "description": "τ" },
+                { "label": "Upsilon", "body": "Υ", "description": "Υ" },
+                { "label": "upsilon", "body": "υ", "description": "υ" },
+                { "label": "Phi", "body": "Φ", "description": "Φ" },
+                { "label": "phi", "body": "φ", "description": "φ" },
+                { "label": "Chi", "body": "Χ", "description": "Χ" },
+                { "label": "chi", "body": "χ", "description": "χ" },
+                { "label": "Psi", "body": "Ψ", "description": "Ψ" },
+                { "label": "psi", "body": "ψ", "description": "ψ" },
+                { "label": "Omega", "body": "Ω", "description": "Ω" },
+                { "label": "omega", "body": "ω", "description": "ω" }
+            ]
+        }
+    ]

dune

+(env
+ (_ ; Applies to all profiles (dev, release, ...).
+  (coq
+   (flags ; Configure the coqc flags.
+    (:standard ; Keeping the default flags.
+     ; Add custom flags (to be kept in sync with _CoqProject).
+     -w -notation-overridden
+     -w -redundant-canonical-projection
+     -w -unknown-warning
+     -w -argument-scope-delimiter
+     -w -notation-incompatible-prefix
+)))))

dune-project

+(lang dune 3.8)
+(using coq 0.8)

heap_lang/derived.v

-From heap_lang Require Export lifting.
-Import uPred.
-
-(** Define some derived forms, and derived lemmas about them. *)
-Notation Lam x e := (Rec "" x e).
-Notation Let x e1 e2 := (App (Lam x e2) e1).
-Notation Seq e1 e2 := (Let "" e1 e2).
-Notation LamV x e := (RecV "" x e).
-Notation LetCtx x e2 := (AppRCtx (LamV x e2)).
-Notation SeqCtx e2 := (LetCtx "" e2).
-Notation Skip := (Seq (Lit LitUnit) (Lit LitUnit)).
-
-Section derived.
-Context {Σ : iFunctor}.
-Implicit Types P Q : iProp heap_lang Σ.
-Implicit Types Φ : val → iProp heap_lang Σ.
-
-(** Proof rules for the sugar *)
-Lemma wp_lam' E x ef e v Φ :
-  to_val e = Some v →
-  ▷ || subst ef x v @ E {{ Φ }} ⊑ || App (Lam x ef) e @ E {{ Φ }}.
-Proof. intros. by rewrite -wp_rec' ?subst_empty. Qed.
-
-Lemma wp_let' E x e1 e2 v Φ :
-  to_val e1 = Some v →
-  ▷ || subst e2 x v @ E {{ Φ }} ⊑ || Let x e1 e2 @ E {{ Φ }}.
-Proof. apply wp_lam'. Qed.
-
-Lemma wp_seq E e1 e2 Φ :
-  || e1 @ E {{ λ _, ▷ || e2 @ E {{ Φ }} }} ⊑ || Seq e1 e2 @ E {{ Φ }}.
-Proof.
-  rewrite -(wp_bind [LetCtx "" e2]). apply wp_mono=>v.
-  by rewrite -wp_let' //= ?to_of_val ?subst_empty.
-Qed.
-
-Lemma wp_skip E Φ : ▷ Φ (LitV LitUnit) ⊑ || Skip @ E {{ Φ }}.
-Proof. rewrite -wp_seq -wp_value // -wp_value //. Qed.
-
-Lemma wp_le E (n1 n2 : Z) P Φ :
-  (n1 ≤ n2 → P ⊑ ▷ Φ (LitV (LitBool true))) →
-  (n2 < n1 → P ⊑ ▷ Φ (LitV (LitBool false))) →
-  P ⊑ || BinOp LeOp (Lit (LitInt n1)) (Lit (LitInt n2)) @ E {{ Φ }}.
-Proof.
-  intros. rewrite -wp_bin_op //; [].
-  destruct (bool_decide_reflect (n1 ≤ n2)); by eauto with omega.
-Qed.
-
-Lemma wp_lt E (n1 n2 : Z) P Φ :
-  (n1 < n2 → P ⊑ ▷ Φ (LitV (LitBool true))) →
-  (n2 ≤ n1 → P ⊑ ▷ Φ (LitV (LitBool false))) →
-  P ⊑ || BinOp LtOp (Lit (LitInt n1)) (Lit (LitInt n2)) @ E {{ Φ }}.
-Proof.
-  intros. rewrite -wp_bin_op //; [].
-  destruct (bool_decide_reflect (n1 < n2)); by eauto with omega.
-Qed.
-
-Lemma wp_eq E (n1 n2 : Z) P Φ :
-  (n1 = n2 → P ⊑ ▷ Φ (LitV (LitBool true))) →
-  (n1 ≠ n2 → P ⊑ ▷ Φ (LitV (LitBool false))) →
-  P ⊑ || BinOp EqOp (Lit (LitInt n1)) (Lit (LitInt n2)) @ E {{ Φ }}.
-Proof.
-  intros. rewrite -wp_bin_op //; [].
-  destruct (bool_decide_reflect (n1 = n2)); by eauto with omega.
-Qed.
-End derived.

heap_lang/heap.v

-From heap_lang Require Export lifting.
-From algebra Require Import upred_big_op.
-From program_logic Require Export invariants ghost_ownership.
-From program_logic Require Import ownership auth.
-Import uPred.
-(* TODO: The entire construction could be generalized to arbitrary languages that have
-   a finmap as their state. Or maybe even beyond "as their state", i.e. arbitrary
-   predicates over finmaps instead of just ownP. *)
-
-Definition heapRA := mapRA loc (exclRA (leibnizC val)).
-
-Class heapG Σ := HeapG {
-  heap_inG : inG heap_lang Σ (authRA heapRA);
-  heap_name : gname
-}.
-Instance heap_authG `{i : heapG Σ} : authG heap_lang Σ heapRA :=
-  {| auth_inG := heap_inG |}.
-
-Definition to_heap : state → heapRA := fmap Excl.
-Definition of_heap : heapRA → state := omap (maybe Excl).
-
-Definition heap_mapsto `{heapG Σ} (l : loc) (v: val) : iPropG heap_lang Σ :=
-  auth_own heap_name {[ l := Excl v ]}.
-Definition heap_inv `{i : heapG Σ} (h : heapRA) : iPropG heap_lang Σ :=
-  ownP (of_heap h).
-Definition heap_ctx `{i : heapG Σ} (N : namespace) : iPropG heap_lang Σ :=
-  auth_ctx heap_name N heap_inv.
-
-Notation "l ↦ v" := (heap_mapsto l v) (at level 20) : uPred_scope.
-
-Section heap.
-  Context {Σ : iFunctorG}.
-  Implicit Types N : namespace.
-  Implicit Types P Q : iPropG heap_lang Σ.
-  Implicit Types Φ : val → iPropG heap_lang Σ.
-  Implicit Types σ : state.
-  Implicit Types h g : heapRA.
-
-  (** Conversion to heaps and back *)
-  Global Instance of_heap_proper : Proper ((≡) ==> (=)) of_heap.
-  Proof. by intros ??; fold_leibniz=>->. Qed.
-  Lemma from_to_heap σ : of_heap (to_heap σ) = σ.
-  Proof.
-    apply map_eq=>l. rewrite lookup_omap lookup_fmap. by case (σ !! l).
-  Qed.
-  Lemma to_heap_valid σ : ✓ to_heap σ.
-  Proof. intros n l. rewrite lookup_fmap. by case (σ !! l). Qed.
-  Lemma of_heap_insert l v h : of_heap (<[l:=Excl v]> h) = <[l:=v]> (of_heap h).
-  Proof. by rewrite /of_heap -(omap_insert _ _ _ (Excl v)). Qed.
-  Lemma to_heap_insert l v σ : to_heap (<[l:=v]> σ) = <[l:=Excl v]> (to_heap σ).
-  Proof. by rewrite /to_heap -fmap_insert. Qed.
-  Lemma of_heap_None h l :
-    ✓ h → of_heap h !! l = None → h !! l = None ∨ h !! l ≡ Some ExclUnit.
-  Proof.
-    move=> /(_ O l). rewrite /of_heap lookup_omap.
-    by case: (h !! l)=> [[]|]; auto.
-  Qed.
-  Lemma heap_singleton_inv_l h l v :
-    ✓ ({[l := Excl v]} ⋅ h) → h !! l = None ∨ h !! l ≡ Some ExclUnit.
-  Proof.
-    move=> /(_ O l). rewrite lookup_op lookup_singleton.
-    by case: (h !! l)=> [[]|]; auto.
-  Qed.
-
-  (** Allocation *)
-  Lemma heap_alloc E N σ :
-    authG heap_lang Σ heapRA → nclose N ⊆ E →
-    ownP σ ⊑ (|={E}=> ∃ _ : heapG Σ, heap_ctx N ∧ Π★{map σ} heap_mapsto).
-  Proof.
-    intros. rewrite -{1}(from_to_heap σ). etransitivity.
-    { rewrite [ownP _]later_intro.
-      apply (auth_alloc (ownP ∘ of_heap) E N (to_heap σ)); last done.
-      apply to_heap_valid. }
-    apply pvs_mono, exist_elim=> γ.
-    rewrite -(exist_intro (HeapG _ _ γ)); apply and_mono_r.
-    induction σ as [|l v σ Hl IH] using map_ind.
-    { rewrite big_sepM_empty; apply True_intro. }
-    rewrite to_heap_insert big_sepM_insert //.
-    rewrite (map_insert_singleton_op (to_heap σ));
-      last rewrite lookup_fmap Hl; auto.
-    by rewrite auto_own_op IH.
-  Qed.
-
-  Context `{heapG Σ}.
-
-  (** Propers *)
-  Global Instance heap_inv_proper : Proper ((≡) ==> (≡)) heap_inv.
-  Proof. intros h1 h2. by fold_leibniz=> ->. Qed.
-
-  (** General properties of mapsto *)
-  Lemma heap_mapsto_disjoint l v1 v2 : (l ↦ v1 ★ l ↦ v2)%I ⊑ False.
-  Proof.
-    rewrite /heap_mapsto -auto_own_op auto_own_valid map_op_singleton.
-    rewrite map_validI (forall_elim l) lookup_singleton.
-    by rewrite option_validI excl_validI.
-  Qed.
-
-  (** Weakest precondition *)
-  Lemma wp_alloc N E e v P Φ :
-    to_val e = Some v → nclose N ⊆ E →
-    P ⊑ heap_ctx N →
-    P ⊑ (▷ ∀ l, l ↦ v -★ Φ (LocV l)) →
-    P ⊑ || Alloc e @ E {{ Φ }}.
-  Proof.
-    rewrite /heap_ctx /heap_inv /heap_mapsto=> ?? Hctx HP.
-    transitivity (|={E}=> auth_own heap_name ∅ ★ P)%I.
-    { by rewrite -pvs_frame_r -(auth_empty _ E) left_id. }
-    apply wp_strip_pvs, (auth_fsa heap_inv (wp_fsa (Alloc e)))
-      with N heap_name ∅; simpl; eauto with I.
-    rewrite -later_intro. apply sep_mono_r,forall_intro=> h; apply wand_intro_l.
-    rewrite -assoc left_id; apply const_elim_sep_l=> ?.
-    rewrite {1}[(▷ownP _)%I]pvs_timeless pvs_frame_r; apply wp_strip_pvs.
-    rewrite /wp_fsa -(wp_alloc_pst _ (of_heap h)) //.
-    apply sep_mono_r; rewrite HP; apply later_mono.
-    apply forall_mono=> l; apply wand_intro_l.
-    rewrite always_and_sep_l -assoc; apply const_elim_sep_l=> ?.
-    rewrite -(exist_intro (op {[ l := Excl v ]})).
-    repeat erewrite <-exist_intro by apply _; simpl.
-    rewrite -of_heap_insert left_id right_id !assoc.
-    apply sep_mono_l.
-    rewrite -(map_insert_singleton_op h); last by apply of_heap_None.
-    rewrite const_equiv ?left_id; last by apply (map_insert_valid h).
-    apply later_intro.
-  Qed.
-
-  Lemma wp_load N E l v P Φ :
-    nclose N ⊆ E →
-    P ⊑ heap_ctx N →
-    P ⊑ (▷ l ↦ v ★ ▷ (l ↦ v -★ Φ v)) →
-    P ⊑ || Load (Loc l) @ E {{ Φ }}.
-  Proof.
-    rewrite /heap_ctx /heap_inv /heap_mapsto=>HN ? HPΦ.
-    apply (auth_fsa' heap_inv (wp_fsa _) id)
-      with N heap_name {[ l := Excl v ]}; simpl; eauto with I.
-    rewrite HPΦ{HPΦ}; apply sep_mono_r, forall_intro=> h; apply wand_intro_l.
-    rewrite -assoc; apply const_elim_sep_l=> ?.
-    rewrite {1}[(▷ownP _)%I]pvs_timeless pvs_frame_r; apply wp_strip_pvs.
-    rewrite -(wp_load_pst _ (<[l:=v]>(of_heap h))) ?lookup_insert //.
-    rewrite const_equiv // left_id.
-    rewrite -(map_insert_singleton_op h); last by eapply heap_singleton_inv_l.
-    rewrite -of_heap_insert.
-    apply sep_mono_r, later_mono, wand_intro_l. by rewrite -later_intro.
-  Qed.
-
-  Lemma wp_store N E l v' e v P Φ :
-    to_val e = Some v → nclose N ⊆ E → 
-    P ⊑ heap_ctx N →
-    P ⊑ (▷ l ↦ v' ★ ▷ (l ↦ v -★ Φ (LitV LitUnit))) →
-    P ⊑ || Store (Loc l) e @ E {{ Φ }}.
-  Proof.
-    rewrite /heap_ctx /heap_inv /heap_mapsto=>? HN ? HPΦ.
-    apply (auth_fsa' heap_inv (wp_fsa _) (alter (λ _, Excl v) l))
-      with N heap_name {[ l := Excl v' ]}; simpl; eauto with I.
-    rewrite HPΦ{HPΦ}; apply sep_mono_r, forall_intro=> h; apply wand_intro_l.
-    rewrite -assoc; apply const_elim_sep_l=> ?.
-    rewrite {1}[(▷ownP _)%I]pvs_timeless pvs_frame_r; apply wp_strip_pvs.
-    rewrite -(wp_store_pst _ (<[l:=v']>(of_heap h))) ?lookup_insert //.
-    rewrite /heap_inv alter_singleton insert_insert.
-    rewrite -!(map_insert_singleton_op h); try by eapply heap_singleton_inv_l.
-    rewrite -!of_heap_insert const_equiv;
-      last (split; [naive_solver|by eapply map_insert_valid, cmra_valid_op_r]).
-    apply sep_mono_r, later_mono, wand_intro_l. by rewrite left_id -later_intro.
-  Qed.
-
-  Lemma wp_cas_fail N E l v' e1 v1 e2 v2 P Φ :
-    to_val e1 = Some v1 → to_val e2 = Some v2 → v' ≠ v1 →
-    nclose N ⊆ E →
-    P ⊑ heap_ctx N →
-    P ⊑ (▷ l ↦ v' ★ ▷ (l ↦ v' -★ Φ (LitV (LitBool false)))) →
-    P ⊑ || Cas (Loc l) e1 e2 @ E {{ Φ }}.
-  Proof.
-    rewrite /heap_ctx /heap_inv /heap_mapsto=>??? HN ? HPΦ.
-    apply (auth_fsa' heap_inv (wp_fsa _) id)
-      with N heap_name {[ l := Excl v' ]}; simpl; eauto 10 with I.
-    rewrite HPΦ{HPΦ}; apply sep_mono_r, forall_intro=> h; apply wand_intro_l.
-    rewrite -assoc; apply const_elim_sep_l=> ?.
-    rewrite {1}[(▷ownP _)%I]pvs_timeless pvs_frame_r; apply wp_strip_pvs.
-    rewrite -(wp_cas_fail_pst _ (<[l:=v']>(of_heap h))) ?lookup_insert //.
-    rewrite const_equiv // left_id.
-    rewrite -(map_insert_singleton_op h); last by eapply heap_singleton_inv_l.
-    rewrite -of_heap_insert.
-    apply sep_mono_r, later_mono, wand_intro_l. by rewrite -later_intro.
-  Qed.
-
-  Lemma wp_cas_suc N E l e1 v1 e2 v2 P Φ :
-    to_val e1 = Some v1 → to_val e2 = Some v2 →
-    nclose N ⊆ E →
-    P ⊑ heap_ctx N →
-    P ⊑ (▷ l ↦ v1 ★ ▷ (l ↦ v2 -★ Φ (LitV (LitBool true)))) →
-    P ⊑ || Cas (Loc l) e1 e2 @ E {{ Φ }}.
-  Proof.
-    rewrite /heap_ctx /heap_inv /heap_mapsto=> ?? HN ? HPΦ.
-    apply (auth_fsa' heap_inv (wp_fsa _) (alter (λ _, Excl v2) l))
-      with N heap_name {[ l := Excl v1 ]}; simpl; eauto 10 with I.
-    rewrite HPΦ{HPΦ}; apply sep_mono_r, forall_intro=> h; apply wand_intro_l.
-    rewrite -assoc; apply const_elim_sep_l=> ?.
-    rewrite {1}[(▷ownP _)%I]pvs_timeless pvs_frame_r; apply wp_strip_pvs.
-    rewrite -(wp_cas_suc_pst _ (<[l:=v1]>(of_heap h))) ?lookup_insert //.
-    rewrite /heap_inv alter_singleton insert_insert.
-    rewrite -!(map_insert_singleton_op h); try by eapply heap_singleton_inv_l.
-    rewrite -!of_heap_insert const_equiv;
-      last (split; [naive_solver|by eapply map_insert_valid, cmra_valid_op_r]).
-    apply sep_mono_r, later_mono, wand_intro_l. by rewrite left_id -later_intro.
-  Qed.
-End heap.

heap_lang/lang.v

-From program_logic Require Export language.
-From prelude Require Export strings.
-From prelude Require Import gmap.
-
-Module heap_lang.
-Open Scope Z_scope.
-
-(** Expressions and vals. *)
-Definition loc := positive. (* Really, any countable type. *)
-
-Inductive base_lit : Set :=
-  | LitInt (n : Z) | LitBool (b : bool) | LitUnit.
-Inductive un_op : Set :=
-  | NegOp | MinusUnOp.
-Inductive bin_op : Set :=
-  | PlusOp | MinusOp | LeOp | LtOp | EqOp.
-
-Inductive expr :=
-  (* Base lambda calculus *)
-  | Var (x : string)
-  | Rec (f x : string) (e : expr)
-  | App (e1 e2 : expr)
-  (* Base types and their operations *)
-  | Lit (l : base_lit)
-  | UnOp (op : un_op) (e : expr)
-  | BinOp (op : bin_op) (e1 e2 : expr)
-  | If (e0 e1 e2 : expr)
-  (* Products *)
-  | Pair (e1 e2 : expr)
-  | Fst (e : expr)
-  | Snd (e : expr)
-  (* Sums *)
-  | InjL (e : expr)
-  | InjR (e : expr)
-  | Case (e0 : expr) (x1 : string) (e1 : expr) (x2 : string) (e2 : expr)
-  (* Concurrency *)
-  | Fork (e : expr)
-  (* Heap *)
-  | Loc (l : loc)
-  | Alloc (e : expr)
-  | Load (e : expr)
-  | Store (e1 : expr) (e2 : expr)
-  | Cas (e0 : expr) (e1 : expr) (e2 : expr).
-
-Inductive val :=
-  | RecV (f x : string) (e : expr) (* e should be closed *)
-  | LitV (l : base_lit)
-  | PairV (v1 v2 : val)
-  | InjLV (v : val)
-  | InjRV (v : val)
-  | LocV (l : loc).
-
-Delimit Scope lang_scope with L.
-Bind Scope lang_scope with expr val.
-
-Fixpoint of_val (v : val) : expr :=
-  match v with
-  | RecV f x e => Rec f x e
-  | LitV l => Lit l
-  | PairV v1 v2 => Pair (of_val v1) (of_val v2)
-  | InjLV v => InjL (of_val v)
-  | InjRV v => InjR (of_val v)
-  | LocV l => Loc l
-  end.
-Fixpoint to_val (e : expr) : option val :=
-  match e with
-  | Rec f x e => Some (RecV f x e)
-  | Lit l => Some (LitV l)
-  | Pair e1 e2 => v1 ← to_val e1; v2 ← to_val e2; Some (PairV v1 v2)
-  | InjL e => InjLV <$> to_val e
-  | InjR e => InjRV <$> to_val e
-  | Loc l => Some (LocV l)
-  | _ => None
-  end.
-
-(** The state: heaps of vals. *)
-Definition state := gmap loc val.
-
-(** Evaluation contexts *)
-Inductive ectx_item :=
-  | AppLCtx (e2 : expr)
-  | AppRCtx (v1 : val)
-  | UnOpCtx (op : un_op)
-  | BinOpLCtx (op : bin_op) (e2 : expr)
-  | BinOpRCtx (op : bin_op) (v1 : val)
-  | IfCtx (e1 e2 : expr)
-  | PairLCtx (e2 : expr)
-  | PairRCtx (v1 : val)
-  | FstCtx
-  | SndCtx
-  | InjLCtx
-  | InjRCtx
-  | CaseCtx (x1 : string) (e1 : expr) (x2 : string) (e2 : expr)
-  | AllocCtx
-  | LoadCtx
-  | StoreLCtx (e2 : expr)
-  | StoreRCtx (v1 : val)
-  | CasLCtx (e1 : expr)  (e2 : expr)
-  | CasMCtx (v0 : val) (e2 : expr)
-  | CasRCtx (v0 : val) (v1 : val).
-
-Notation ectx := (list ectx_item).
-
-Definition fill_item (Ki : ectx_item) (e : expr) : expr :=
-  match Ki with
-  | AppLCtx e2 => App e e2
-  | AppRCtx v1 => App (of_val v1) e
-  | UnOpCtx op => UnOp op e
-  | BinOpLCtx op e2 => BinOp op e e2
-  | BinOpRCtx op v1 => BinOp op (of_val v1) e
-  | IfCtx e1 e2 => If e e1 e2
-  | PairLCtx e2 => Pair e e2
-  | PairRCtx v1 => Pair (of_val v1) e
-  | FstCtx => Fst e
-  | SndCtx => Snd e
-  | InjLCtx => InjL e
-  | InjRCtx => InjR e
-  | CaseCtx x1 e1 x2 e2 => Case e x1 e1 x2 e2
-  | AllocCtx => Alloc e
-  | LoadCtx => Load e
-  | StoreLCtx e2 => Store e e2
-  | StoreRCtx v1 => Store (of_val v1) e
-  | CasLCtx e1 e2 => Cas e e1 e2
-  | CasMCtx v0 e2 => Cas (of_val v0) e e2
-  | CasRCtx v0 v1 => Cas (of_val v0) (of_val v1) e
-  end.
-Definition fill (K : ectx) (e : expr) : expr := fold_right fill_item e K.
-
-(** Substitution *)
-(** We have [subst e "" v = e] to deal with anonymous binders *)
-Fixpoint subst (e : expr) (x : string) (v : val) : expr :=
-  match e with
-  | Var y => if decide (x = y ∧ x ≠ "") then of_val v else Var y
-  | Rec f y e => Rec f y (if decide (x ≠ f ∧ x ≠ y) then subst e x v else e)
-  | App e1 e2 => App (subst e1 x v) (subst e2 x v)
-  | Lit l => Lit l
-  | UnOp op e => UnOp op (subst e x v)
-  | BinOp op e1 e2 => BinOp op (subst e1 x v) (subst e2 x v)
-  | If e0 e1 e2 => If (subst e0 x v) (subst e1 x v) (subst e2 x v)
-  | Pair e1 e2 => Pair (subst e1 x v) (subst e2 x v)
-  | Fst e => Fst (subst e x v)
-  | Snd e => Snd (subst e x v)
-  | InjL e => InjL (subst e x v)
-  | InjR e => InjR (subst e x v)
-  | Case e0 x1 e1 x2 e2 =>
-     Case (subst e0 x v)
-       x1 (if decide (x ≠ x1) then subst e1 x v else e1)
-       x2 (if decide (x ≠ x2) then subst e2 x v else e2)
-  | Fork e => Fork (subst e x v)
-  | Loc l => Loc l
-  | Alloc e => Alloc (subst e x v)
-  | Load e => Load (subst e x v)
-  | Store e1 e2 => Store (subst e1 x v) (subst e2 x v)
-  | Cas e0 e1 e2 => Cas (subst e0 x v) (subst e1 x v) (subst e2 x v)
-  end.
-
-(** The stepping relation *)
-Definition un_op_eval (op : un_op) (l : base_lit) : option base_lit :=
-  match op, l with
-  | NegOp, LitBool b => Some (LitBool (negb b))
-  | MinusUnOp, LitInt n => Some (LitInt (- n))
-  | _, _ => None
-  end.
-
-Definition bin_op_eval (op : bin_op) (l1 l2 : base_lit) : option base_lit :=
-  match op, l1, l2 with
-  | PlusOp, LitInt n1, LitInt n2 => Some $ LitInt (n1 + n2)
-  | MinusOp, LitInt n1, LitInt n2 => Some $ LitInt (n1 - n2)
-  | LeOp, LitInt n1, LitInt n2 => Some $ LitBool $ bool_decide (n1 ≤ n2)
-  | LtOp, LitInt n1, LitInt n2 => Some $ LitBool $ bool_decide (n1 < n2)
-  | EqOp, LitInt n1, LitInt n2 => Some $ LitBool $ bool_decide (n1 = n2)
-  | _, _, _ => None
-  end.
-
-Inductive head_step : expr -> state -> expr -> state -> option expr -> Prop :=
-  | BetaS f x e1 e2 v2 σ :
-     to_val e2 = Some v2 →
-     head_step (App (Rec f x e1) e2) σ
-       (subst (subst e1 f (RecV f x e1)) x v2) σ None
-  | UnOpS op l l' σ :
-     un_op_eval op l = Some l' → 
-     head_step (UnOp op (Lit l)) σ (Lit l') σ None
-  | BinOpS op l1 l2 l' σ :
-     bin_op_eval op l1 l2 = Some l' → 
-     head_step (BinOp op (Lit l1) (Lit l2)) σ (Lit l') σ None
-  | IfTrueS e1 e2 σ :
-     head_step (If (Lit $ LitBool true) e1 e2) σ e1 σ None
-  | IfFalseS e1 e2 σ :
-     head_step (If (Lit $ LitBool false) e1 e2) σ e2 σ None
-  | FstS e1 v1 e2 v2 σ :
-     to_val e1 = Some v1 → to_val e2 = Some v2 →
-     head_step (Fst (Pair e1 e2)) σ e1 σ None
-  | SndS e1 v1 e2 v2 σ :
-     to_val e1 = Some v1 → to_val e2 = Some v2 →
-     head_step (Snd (Pair e1 e2)) σ e2 σ None
-  | CaseLS e0 v0 x1 e1 x2 e2 σ :
-     to_val e0 = Some v0 →
-     head_step (Case (InjL e0) x1 e1 x2 e2) σ (subst e1 x1 v0) σ None
-  | CaseRS e0 v0 x1 e1 x2 e2 σ :
-     to_val e0 = Some v0 →
-     head_step (Case (InjR e0) x1 e1 x2 e2) σ (subst e2 x2 v0) σ None
-  | ForkS e σ:
-     head_step (Fork e) σ (Lit LitUnit) σ (Some e)
-  | AllocS e v σ l :
-     to_val e = Some v → σ !! l = None →
-     head_step (Alloc e) σ (Loc l) (<[l:=v]>σ) None
-  | LoadS l v σ :
-     σ !! l = Some v →
-     head_step (Load (Loc l)) σ (of_val v) σ None
-  | StoreS l e v σ :
-     to_val e = Some v → is_Some (σ !! l) →
-     head_step (Store (Loc l) e) σ (Lit LitUnit) (<[l:=v]>σ) None
-  | CasFailS l e1 v1 e2 v2 vl σ :
-     to_val e1 = Some v1 → to_val e2 = Some v2 →
-     σ !! l = Some vl → vl ≠ v1 →
-     head_step (Cas (Loc l) e1 e2) σ (Lit $ LitBool false) σ None
-  | CasSucS l e1 v1 e2 v2 σ :
-     to_val e1 = Some v1 → to_val e2 = Some v2 →
-     σ !! l = Some v1 →
-     head_step (Cas (Loc l) e1 e2) σ (Lit $ LitBool true) (<[l:=v2]>σ) None.
-
-(** Atomic expressions *)
-Definition atomic (e: expr) : Prop :=
-  match e with
-  | Alloc e => is_Some (to_val e)
-  | Load e => is_Some (to_val e)
-  | Store e1 e2 => is_Some (to_val e1) ∧ is_Some (to_val e2)
-  | Cas e0 e1 e2 => is_Some (to_val e0) ∧ is_Some (to_val e1) ∧ is_Some (to_val e2)
-  | _ => False
-  end.
-
-(** Close reduction under evaluation contexts.
-We could potentially make this a generic construction. *)
-Inductive prim_step
-    (e1 : expr) (σ1 : state) (e2 : expr) (σ2: state) (ef: option expr) : Prop :=
-  Ectx_step K e1' e2' :
-    e1 = fill K e1' → e2 = fill K e2' →
-    head_step e1' σ1 e2' σ2 ef → prim_step e1 σ1 e2 σ2 ef.
-
-(** Basic properties about the language *)
-Lemma to_of_val v : to_val (of_val v) = Some v.
-Proof. by induction v; simplify_option_eq. Qed.
-
-Lemma of_to_val e v : to_val e = Some v → of_val v = e.
-Proof.
-  revert v; induction e; intros; simplify_option_eq; auto with f_equal.
-Qed.
-
-Instance: Inj (=) (=) of_val.
-Proof. by intros ?? Hv; apply (inj Some); rewrite -!to_of_val Hv. Qed.
-
-Instance fill_item_inj Ki : Inj (=) (=) (fill_item Ki).
-Proof. destruct Ki; intros ???; simplify_eq/=; auto with f_equal. Qed.
-
-Instance ectx_fill_inj K : Inj (=) (=) (fill K).
-Proof. red; induction K as [|Ki K IH]; naive_solver. Qed.
-
-Lemma fill_app K1 K2 e : fill (K1 ++ K2) e = fill K1 (fill K2 e).
-Proof. revert e; induction K1; simpl; auto with f_equal. Qed.
-
-Lemma fill_val K e : is_Some (to_val (fill K e)) → is_Some (to_val e).
-Proof.
-  intros [v' Hv']; revert v' Hv'.
-  induction K as [|[]]; intros; simplify_option_eq; eauto.
-Qed.
-
-Lemma fill_not_val K e : to_val e = None → to_val (fill K e) = None.
-Proof. rewrite !eq_None_not_Some; eauto using fill_val. Qed.
-
-Lemma values_head_stuck e1 σ1 e2 σ2 ef :
-  head_step e1 σ1 e2 σ2 ef → to_val e1 = None.
-Proof. destruct 1; naive_solver. Qed.
-
-Lemma values_stuck e1 σ1 e2 σ2 ef : prim_step e1 σ1 e2 σ2 ef → to_val e1 = None.
-Proof. intros [??? -> -> ?]; eauto using fill_not_val, values_head_stuck. Qed.
-
-Lemma atomic_not_val e : atomic e → to_val e = None.
-Proof. destruct e; naive_solver. Qed.
-
-Lemma atomic_fill K e : atomic (fill K e) → to_val e = None → K = [].
-Proof.
-  rewrite eq_None_not_Some.
-  destruct K as [|[]]; naive_solver eauto using fill_val.
-Qed.
-
-Lemma atomic_head_step e1 σ1 e2 σ2 ef :
-  atomic e1 → head_step e1 σ1 e2 σ2 ef → is_Some (to_val e2).
-Proof. destruct 2; simpl; rewrite ?to_of_val; naive_solver. Qed.
-
-Lemma atomic_step e1 σ1 e2 σ2 ef :
-  atomic e1 → prim_step e1 σ1 e2 σ2 ef → is_Some (to_val e2).
-Proof.
-  intros Hatomic [K e1' e2' -> -> Hstep].
-  assert (K = []) as -> by eauto 10 using atomic_fill, values_head_stuck.
-  naive_solver eauto using atomic_head_step.
-Qed.
-
-Lemma head_ctx_step_val Ki e σ1 e2 σ2 ef :
-  head_step (fill_item Ki e) σ1 e2 σ2 ef → is_Some (to_val e).
-Proof. destruct Ki; inversion_clear 1; simplify_option_eq; eauto. Qed.
-
-Lemma fill_item_no_val_inj Ki1 Ki2 e1 e2 :
-  to_val e1 = None → to_val e2 = None →
-  fill_item Ki1 e1 = fill_item Ki2 e2 → Ki1 = Ki2.
-Proof.
-  destruct Ki1, Ki2; intros; try discriminate; simplify_eq/=;
-    repeat match goal with
-    | H : to_val (of_val _) = None |- _ => by rewrite to_of_val in H
-    end; auto.
-Qed.
-
-(* When something does a step, and another decomposition of the same expression
-has a non-val [e] in the hole, then [K] is a left sub-context of [K'] - in
-other words, [e] also contains the reducible expression *)
-Lemma step_by_val K K' e1 e1' σ1 e2 σ2 ef :
-  fill K e1 = fill K' e1' → to_val e1 = None → head_step e1' σ1 e2 σ2 ef →
-  K `prefix_of` K'.
-Proof.
-  intros Hfill Hred Hnval; revert K' Hfill.
-  induction K as [|Ki K IH]; simpl; intros K' Hfill; auto using prefix_of_nil.
-  destruct K' as [|Ki' K']; simplify_eq/=.
-  { exfalso; apply (eq_None_not_Some (to_val (fill K e1)));
-      eauto using fill_not_val, head_ctx_step_val. }
-  cut (Ki = Ki'); [naive_solver eauto using prefix_of_cons|].
-  eauto using fill_item_no_val_inj, values_head_stuck, fill_not_val.
-Qed.
-
-Lemma alloc_fresh e v σ :
-  let l := fresh (dom _ σ) in
-  to_val e = Some v → head_step (Alloc e) σ (Loc l) (<[l:=v]>σ) None.
-Proof. by intros; apply AllocS, (not_elem_of_dom (D:=gset _)), is_fresh. Qed.
-
-Lemma subst_empty e v : subst e "" v = e.
-Proof. induction e; simpl; repeat case_decide; intuition auto with f_equal. Qed.
-End heap_lang.
-
-(** Language *)
-Program Canonical Structure heap_lang : language := {|
-  expr := heap_lang.expr; val := heap_lang.val; state := heap_lang.state;
-  of_val := heap_lang.of_val; to_val := heap_lang.to_val;
-  atomic := heap_lang.atomic; prim_step := heap_lang.prim_step;
-|}.
-Solve Obligations with eauto using heap_lang.to_of_val, heap_lang.of_to_val,
-  heap_lang.values_stuck, heap_lang.atomic_not_val, heap_lang.atomic_step.
-
-Global Instance heap_lang_ctx K : LanguageCtx heap_lang (heap_lang.fill K).
-Proof.
-  split.
-  - eauto using heap_lang.fill_not_val.
-  - intros ????? [K' e1' e2' Heq1 Heq2 Hstep].
-    by exists (K ++ K') e1' e2'; rewrite ?heap_lang.fill_app ?Heq1 ?Heq2.
-  - intros e1 σ1 e2 σ2 ? Hnval [K'' e1'' e2'' Heq1 -> Hstep].
-    destruct (heap_lang.step_by_val
-      K K'' e1 e1'' σ1 e2'' σ2 ef) as [K' ->]; eauto.
-    rewrite heap_lang.fill_app in Heq1; apply (inj _) in Heq1.
-    exists (heap_lang.fill K' e2''); rewrite heap_lang.fill_app; split; auto.
-    econstructor; eauto.
-Qed.
-
-Global Instance heap_lang_ctx_item Ki :
-  LanguageCtx heap_lang (heap_lang.fill_item Ki).
-Proof.
-  change (LanguageCtx heap_lang (heap_lang.fill [Ki])).
-  by apply _.
-Qed.