ofe.v 48.1 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
Robbert Krebbers's avatar
Robbert Krebbers committed
3

4
(** This files defines (a shallow embedding of) the category of OFEs:
5
6
7
8
9
10
11
12
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
    This makes writing such functions much easier. It turns out that it many 
    cases, we do not even need non-expansiveness.
*)

Robbert Krebbers's avatar
Robbert Krebbers committed
13
14
(** Unbundeled version *)
Class Dist A := dist : nat  relation A.
15
Instance: Params (@dist) 3.
16
17
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
18
Hint Extern 0 (_ {_} _) => reflexivity.
19
Hint Extern 0 (_ {_} _) => symmetry; assumption.
20
21
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
22

23
Tactic Notation "ofe_subst" ident(x) :=
24
  repeat match goal with
25
  | _ => progress simplify_eq/=
26
27
28
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
29
Tactic Notation "ofe_subst" :=
30
  repeat match goal with
31
  | _ => progress simplify_eq/=
32
33
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
34
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
35

36
Set Primitive Projections.
37
Record OfeMixin A `{Equiv A, Dist A} := {
38
  mixin_equiv_dist x y : x  y   n, x {n} y;
39
  mixin_dist_equivalence n : Equivalence (dist n);
40
  mixin_dist_S n x y : x {S n} y  x {n} y
Robbert Krebbers's avatar
Robbert Krebbers committed
41
}.
42
Unset Primitive Projections.
Robbert Krebbers's avatar
Robbert Krebbers committed
43
44

(** Bundeled version *)
45
46
47
48
49
Structure ofeT := OfeT' {
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
  ofe_mixin : OfeMixin ofe_car;
50
  _ : Type
Robbert Krebbers's avatar
Robbert Krebbers committed
51
}.
52
53
54
55
56
57
58
59
60
Arguments OfeT' _ {_ _} _ _.
Notation OfeT A m := (OfeT' A m A).
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
61

62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
different places (see for example the constructors [CMRAT] and [UCMRAT] in the
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

87
(** Lifting properties from the mixin *)
88
89
Section ofe_mixin.
  Context {A : ofeT}.
90
  Implicit Types x y : A.
91
  Lemma equiv_dist x y : x  y   n, x {n} y.
92
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
93
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
94
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
95
  Lemma dist_S n x y : x {S n} y  x {n} y.
96
97
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
98

Robbert Krebbers's avatar
Robbert Krebbers committed
99
100
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption.

101
(** Discrete OFEs and Timeless elements *)
Ralf Jung's avatar
Ralf Jung committed
102
(* TODO: On paper, We called these "discrete elements". I think that makes
Ralf Jung's avatar
Ralf Jung committed
103
   more sense. *)
104
105
106
Class Timeless {A : ofeT} (x : A) := timeless y : x {0} y  x  y.
Arguments timeless {_} _ {_} _ _.
Hint Mode Timeless + ! : typeclass_instances.
107
Instance: Params (@Timeless) 1.
108

109
Class Discrete (A : ofeT) := discrete_timeless (x : A) :> Timeless x.
110
Hint Mode Discrete ! : typeclass_instances.
111
112
113
114
115
116
117
118
119

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

120
Program Definition chain_map {A B : ofeT} (f : A  B)
121
    `{!NonExpansive f} (c : chain A) : chain B :=
122
123
124
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

125
126
127
128
129
130
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
131

132
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
133
134
135
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

136
137
138
139
140
141
142
143
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
144
(** General properties *)
145
Section ofe.
146
  Context {A : ofeT}.
147
  Implicit Types x y : A.
148
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
149
150
  Proof.
    split.
151
152
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
153
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
154
  Qed.
155
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
156
157
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
158
159
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
160
  Qed.
161
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
162
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
163
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
164
165
166
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
167
168
169
  Global Instance Timeless_proper : Proper (() ==> iff) (@Timeless A).
  Proof. intros x y Hxy. rewrite /Timeless. by setoid_rewrite Hxy. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
170
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
171
  Proof. induction 2; eauto using dist_S. Qed.
172
173
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
174
175
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
176
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
177
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
178
179
180
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
181
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
182
  Qed.
183

184
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
185
186
187
188
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
    apply chain_cauchy. omega.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
189

190
191
  Lemma timeless_iff n (x : A) `{!Timeless x} y : x  y  x {n} y.
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
192
    split; intros; auto. apply (timeless _), dist_le with n; auto with lia.
193
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
194
195
196
197
  Lemma timeless_iff_0 n (x : A) `{!Timeless x} y : x {0} y  x {n} y.
  Proof.
    split=> ?. by apply equiv_dist, (timeless _). eauto using dist_le with lia.
  Qed.
198
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
199

200
(** Contractive functions *)
201
Definition dist_later `{Dist A} (n : nat) (x y : A) : Prop :=
202
  match n with 0 => True | S n => x {n} y end.
203
Arguments dist_later _ _ !_ _ _ /.
204

205
Global Instance dist_later_equivalence (A : ofeT) n : Equivalence (@dist_later A _ n).
206
207
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

208
209
210
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

211
212
213
214
215
216
217
218
219
220
221
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

222
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
223

224
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
225
226
Proof. by intros n y1 y2. Qed.

227
Section contractive.
228
  Local Set Default Proof Using "Type*".
229
230
231
232
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
233
  Proof. by apply (_ : Contractive f). Qed.
234
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
235
  Proof. intros. by apply (_ : Contractive f). Qed.
236

237
238
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
239
240
241
242
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

243
244
Ltac f_contractive :=
  match goal with
Robbert Krebbers's avatar
Robbert Krebbers committed
245
246
247
  | |- ?f _ {_} ?f _ => simple apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (_ ==> dist_later _ ==> _) f)
248
249
  end;
  try match goal with
250
  | |- @dist_later ?A _ ?n ?x ?y =>
251
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
252
  end;
Robbert Krebbers's avatar
Robbert Krebbers committed
253
  try simple apply reflexivity.
254

Robbert Krebbers's avatar
Robbert Krebbers committed
255
256
Ltac solve_contractive :=
  solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
257

Robbert Krebbers's avatar
Robbert Krebbers committed
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
(** Limit preserving predicates *)
Class LimitPreserving `{!Cofe A} (P : A  Prop) : Prop :=
  limit_preserving (c : chain A) : ( n, P (c n))  P (compl c).
Hint Mode LimitPreserving + + ! : typeclass_instances.

Section limit_preserving.
  Context `{Cofe A}.
  (* These are not instances as they will never fire automatically...
     but they can still be helpful in proving things to be limit preserving. *)

  Lemma limit_preserving_ext (P Q : A  Prop) :
    ( x, P x  Q x)  LimitPreserving P  LimitPreserving Q.
  Proof. intros HP Hlimit c ?. apply HP, Hlimit=> n; by apply HP. Qed.

  Global Instance limit_preserving_const (P : Prop) : LimitPreserving (λ _, P).
  Proof. intros c HP. apply (HP 0). Qed.

  Lemma limit_preserving_timeless (P : A  Prop) :
    Proper (dist 0 ==> impl) P  LimitPreserving P.
  Proof. intros PH c Hc. by rewrite (conv_compl 0). Qed.

  Lemma limit_preserving_and (P1 P2 : A  Prop) :
    LimitPreserving P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof. intros Hlim1 Hlim2 c Hc. split. apply Hlim1, Hc. apply Hlim2, Hc. Qed.

  Lemma limit_preserving_impl (P1 P2 : A  Prop) :
    Proper (dist 0 ==> impl) P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof.
    intros Hlim1 Hlim2 c Hc HP1. apply Hlim2=> n; apply Hc.
    eapply Hlim1, HP1. apply dist_le with n; last lia. apply (conv_compl n).
  Qed.

  Lemma limit_preserving_forall {B} (P : B  A  Prop) :
    ( y, LimitPreserving (P y)) 
    LimitPreserving (λ x,  y, P y x).
  Proof. intros Hlim c Hc y. by apply Hlim. Qed.
End limit_preserving.

Robbert Krebbers's avatar
Robbert Krebbers committed
298
(** Fixpoint *)
299
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
300
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
301
Next Obligation.
302
  intros A ? f ? n.
303
  induction n as [|n IH]=> -[|i] //= ?; try omega.
304
305
  - apply (contractive_0 f).
  - apply (contractive_S f), IH; auto with omega.
Robbert Krebbers's avatar
Robbert Krebbers committed
306
Qed.
307

308
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
309
  `{!Contractive f} : A := compl (fixpoint_chain f).
310
311
312
Definition fixpoint_aux : seal (@fixpoint_def). by eexists. Qed.
Definition fixpoint {A AC AiH} f {Hf} := unseal fixpoint_aux A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := seal_eq fixpoint_aux.
Robbert Krebbers's avatar
Robbert Krebbers committed
313
314

Section fixpoint.
315
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
316

317
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
318
  Proof.
319
320
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
321
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
322
  Qed.
323
324
325

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
326
327
328
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
329
330
  Qed.

331
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
332
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
333
  Proof.
334
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
335
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
336
337
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
338
  Qed.
339
340
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
341
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
342
343

  Lemma fixpoint_ind (P : A  Prop) :
344
    Proper (() ==> impl) P 
345
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
346
    LimitPreserving P 
347
348
349
350
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
Robbert Krebbers's avatar
Robbert Krebbers committed
351
352
    { intros n. rewrite /chcar. induction n as [|n IH]=> -[|i] //=;
        eauto using contractive_0, contractive_S with omega. }
353
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
Robbert Krebbers's avatar
Robbert Krebbers committed
354
355
356
357
    assert (f fp2  fp2).
    { apply equiv_dist=>n. rewrite /fp2 (conv_compl n) /= /chcar.
      induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S. }
    rewrite -(fixpoint_unique fp2) //.
Robbert Krebbers's avatar
Robbert Krebbers committed
358
    apply Hlim=> n /=. by apply Nat_iter_ind.
359
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
360
361
End fixpoint.

Robbert Krebbers's avatar
Robbert Krebbers committed
362

363
364
365
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
366

367
Section fixpointK.
368
  Local Set Default Proof Using "Type*".
369
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
393
394

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
395
  Local Existing Instance f_proper.
396

397
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
398
  Proof.
399
400
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
401
402
  Qed.

403
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
404
  Proof.
405
406
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
407
408
  Qed.

409
  Section fixpointK_ne.
410
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
411
    Context {g_ne : NonExpansive g}.
412

413
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
414
    Proof.
415
416
417
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
418
419
    Qed.

420
421
422
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
423
424
425
426

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
427
    LimitPreserving P 
Ralf Jung's avatar
Ralf Jung committed
428
429
    P (fixpointK k f).
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
430
    intros. rewrite /fixpointK. apply fixpoint_ind; eauto.
Robbert Krebbers's avatar
Robbert Krebbers committed
431
    intros; apply Nat_iter_ind; auto.
Ralf Jung's avatar
Ralf Jung committed
432
  Qed.
433
End fixpointK.
434

Robbert Krebbers's avatar
Robbert Krebbers committed
435
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
436
Section fixpointAB.
437
438
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
480
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
481

Ralf Jung's avatar
Ralf Jung committed
482
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
514
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
515

516
(** Function space *)
517
(* We make [ofe_fun] a definition so that we can register it as a canonical
518
structure. *)
519
Definition ofe_fun (A : Type) (B : ofeT) := A  B.
520

521
522
523
524
525
Section ofe_fun.
  Context {A : Type} {B : ofeT}.
  Instance ofe_fun_equiv : Equiv (ofe_fun A B) := λ f g,  x, f x  g x.
  Instance ofe_fun_dist : Dist (ofe_fun A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_fun_ofe_mixin : OfeMixin (ofe_fun A B).
526
527
528
529
530
531
532
533
534
535
  Proof.
    split.
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
    - intros n; split.
      + by intros f x.
      + by intros f g ? x.
      + by intros f g h ?? x; trans (g x).
    - by intros n f g ? x; apply dist_S.
  Qed.
536
  Canonical Structure ofe_funC := OfeT (ofe_fun A B) ofe_fun_ofe_mixin.
537

538
539
540
541
542
543
544
545
546
  Program Definition ofe_fun_chain `(c : chain ofe_funC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Global Program Instance ofe_fun_cofe `{Cofe B} : Cofe ofe_funC :=
    { compl c x := compl (ofe_fun_chain c x) }.
  Next Obligation. intros ? n c x. apply (conv_compl n (ofe_fun_chain c x)). Qed.
End ofe_fun.

Arguments ofe_funC : clear implicits.
547
Notation "A -c> B" :=
548
549
  (ofe_funC A B) (at level 99, B at level 200, right associativity).
Instance ofe_fun_inhabited {A} {B : ofeT} `{Inhabited B} :
550
551
  Inhabited (A -c> B) := populate (λ _, inhabitant).

552
(** Non-expansive function space *)
553
554
Record ofe_mor (A B : ofeT) : Type := CofeMor {
  ofe_mor_car :> A  B;
555
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
556
557
}.
Arguments CofeMor {_ _} _ {_}.
558
559
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
560

561
562
563
564
Notation "'λne' x .. y , t" :=
  (@CofeMor _ _ (λ x, .. (@CofeMor _ _ (λ y, t) _) ..) _)
  (at level 200, x binder, y binder, right associativity).

565
566
567
568
569
570
571
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
572
573
  Proof.
    split.
574
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
575
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
576
    - intros n; split.
577
578
      + by intros f x.
      + by intros f g ? x.
579
      + by intros f g h ?? x; trans (g x).
580
    - by intros n f g ? x; apply dist_S.
581
  Qed.
582
583
584
585
586
587
588
589
590
591
592
  Canonical Structure ofe_morC := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.

  Program Definition ofe_mor_chain (c : chain ofe_morC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morC := λ c,
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
Jacques-Henri Jourdan's avatar
Typo    
Jacques-Henri Jourdan committed
593
  Global Program Instance ofe_mor_cofe `{Cofe B} : Cofe ofe_morC :=
594
595
596
597
598
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
599

600
601
602
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
603
604
605
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
606
  Proof. done. Qed.
607
End ofe_mor.
608

609
Arguments ofe_morC : clear implicits.
610
Notation "A -n> B" :=
611
612
  (ofe_morC A B) (at level 99, B at level 200, right associativity).
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
613
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
614

615
(** Identity and composition and constant function *)
Robbert Krebbers's avatar
Robbert Krebbers committed
616
617
Definition cid {A} : A -n> A := CofeMor id.
Instance: Params (@cid) 1.
618
Definition cconst {A B : ofeT} (x : B) : A -n> B := CofeMor (const x).
619
Instance: Params (@cconst) 2.
620

Robbert Krebbers's avatar
Robbert Krebbers committed
621
622
623
624
625
Definition ccompose {A B C}
  (f : B -n> C) (g : A -n> B) : A -n> C := CofeMor (f  g).
Instance: Params (@ccompose) 3.
Infix "◎" := ccompose (at level 40, left associativity).
Lemma ccompose_ne {A B C} (f1 f2 : B -n> C) (g1 g2 : A -n> B) n :
626
  f1 {n} f2  g1 {n} g2  f1  g1 {n} f2  g2.
Robbert Krebbers's avatar
Robbert Krebbers committed
627
Proof. by intros Hf Hg x; rewrite /= (Hg x) (Hf (g2 x)). Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
628

Ralf Jung's avatar
Ralf Jung committed
629
(* Function space maps *)
630
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
631
  (h : A -n> B) : A' -n> B' := g  h  f.
632
633
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
634
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
635

636
637
Definition ofe_morC_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := CofeMor (ofe_mor_map f g).
638
639
Instance ofe_morC_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morC_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
640
Proof.
641
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
642
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
643
644
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
645
(** unit *)
646
647
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
648
  Definition unit_ofe_mixin : OfeMixin unit.
649
  Proof. by repeat split; try exists 0. Qed.
650
  Canonical Structure unitC : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
651

652
653
  Global Program Instance unit_cofe : Cofe unitC := { compl x := () }.
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
654
655

  Global Instance unit_discrete_cofe : Discrete unitC.
Robbert Krebbers's avatar
Robbert Krebbers committed
656
  Proof. done. Qed.
657
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
658
659

(** Product *)
660
Section product.
661
  Context {A B : ofeT}.
662
663
664

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
665
666
667
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
668
  Definition prod_ofe_mixin : OfeMixin (A * B).
669
670
  Proof.
    split.
671
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
672
      rewrite !equiv_dist; naive_solver.
673
674
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
675
  Qed.
676
677
678
679
680
681
682
683
684
  Canonical Structure prodC : ofeT := OfeT (A * B) prod_ofe_mixin.

  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodC :=
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

685
686
687
  Global Instance prod_timeless (x : A * B) :
    Timeless (x.1)  Timeless (x.2)  Timeless x.
  Proof. by intros ???[??]; split; apply (timeless _). Qed.
688
689
  Global Instance prod_discrete_cofe : Discrete A  Discrete B  Discrete prodC.
  Proof. intros ?? [??]; apply _. Qed.
690
691
692
693
694
End product.

Arguments prodC : clear implicits.
Typeclasses Opaque prod_dist.

695
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
696
697
698
699
700
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
Definition prodC_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodC A B -n> prodC A' B' := CofeMor (prod_map f g).
701
702
703
Instance prodC_map_ne {A A' B B'} :
  NonExpansive2 (@prodC_map A A' B B').
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
704

705
706
(** Functors *)
Structure cFunctor := CFunctor {
707
  cFunctor_car : ofeT  ofeT  ofeT;
708
709
  cFunctor_map {A1 A2 B1 B2} :
    ((A2 -n> A1) * (B1 -n> B2))  cFunctor_car A1 B1 -n> cFunctor_car A2 B2;
710
711
  cFunctor_ne {A1 A2 B1 B2} :
    NonExpansive (@cFunctor_map A1 A2 B1 B2);
712
  cFunctor_id {A B : ofeT} (x : cFunctor_car A B) :
713
714
715
716
717
    cFunctor_map (cid,cid) x  x;
  cFunctor_compose {A1 A2 A3 B1 B2 B3}
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
    cFunctor_map (fg, g'f') x  cFunctor_map (g,g') (cFunctor_map (f,f') x)
}.
718
Existing Instance cFunctor_ne.
719
720
Instance: Params (@cFunctor_map) 5.

721
722
723
Delimit Scope cFunctor_scope with CF.
Bind Scope cFunctor_scope with cFunctor.

724
725
726
Class cFunctorContractive (F : cFunctor) :=
  cFunctor_contractive A1 A2 B1 B2 :> Contractive (@cFunctor_map F A1 A2 B1 B2).

727
Definition cFunctor_diag (F: cFunctor) (A: ofeT) : ofeT := cFunctor_car F A A.
728
729
Coercion cFunctor_diag : cFunctor >-> Funclass.

730
Program Definition constCF (B : ofeT) : cFunctor :=
731
732
  {| cFunctor_car A1 A2 := B; cFunctor_map A1 A2 B1 B2 f := cid |}.
Solve Obligations with done.
733
Coercion constCF : ofeT >-> cFunctor.
734

735
Instance constCF_contractive B : cFunctorContractive (constCF B).
736
Proof. rewrite /cFunctorContractive; apply _. Qed.
737
738
739
740

Program Definition idCF : cFunctor :=
  {| cFunctor_car A1 A2 := A2; cFunctor_map A1 A2 B1 B2 f := f.2 |}.
Solve Obligations with done.
741
Notation "∙" := idCF : cFunctor_scope.
742

743
744
745
746
747
Program Definition prodCF (F1 F2 : cFunctor) : cFunctor := {|
  cFunctor_car A B := prodC (cFunctor_car F1 A B) (cFunctor_car F2 A B);
  cFunctor_map A1 A2 B1 B2 fg :=
    prodC_map (cFunctor_map F1 fg) (cFunctor_map F2 fg)
|}.
748
749
750
Next Obligation.
  intros ?? A1 A2 B1 B2 n ???; by apply prodC_map_ne; apply cFunctor_ne.
Qed.
751
752
753
754
755
Next Obligation. by intros F1 F2 A B [??]; rewrite /= !cFunctor_id. Qed.
Next Obligation.
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [??]; simpl.
  by rewrite !cFunctor_compose.
Qed.
756
Notation "F1 * F2" := (prodCF F1%CF F2%CF) : cFunctor_scope.
757

758
759
760
761
762
763
764
765
Instance prodCF_contractive F1 F2 :
  cFunctorContractive F1  cFunctorContractive F2 
  cFunctorContractive (prodCF F1 F2).
Proof.
  intros ?? A1 A2 B1 B2 n ???;
    by apply prodC_map_ne; apply cFunctor_contractive.
Qed.

766
767
768
Instance compose_ne {A} {B B' : ofeT} (f : B -n> B') :
  NonExpansive (compose f : (A -c> B)  A -c> B').
Proof. intros n g g' Hf x; simpl. by rewrite (Hf x). Qed.
769

770
Definition ofe_funC_map {A B B'} (f : B -n> B') : (A -c> B) -n> (A -c> B') :=
771
  @CofeMor (_ -c> _) (_ -c> _) (compose f) _.
772
773
774
Instance ofe_funC_map_ne {A B B'} :
  NonExpansive (@ofe_funC_map A B B').
Proof. intros n f f' Hf g x. apply Hf. Qed.
775

776
777
778
Program Definition ofe_funCF (T : Type) (F : cFunctor) : cFunctor := {|
  cFunctor_car A B := ofe_funC T (cFunctor_car F A B);
  cFunctor_map A1 A2 B1 B2 fg := ofe_funC_map (cFunctor_map F fg)
779
780
|}.
Next Obligation.
781
  intros ?? A1 A2 B1 B2 n ???; by apply ofe_funC_map_ne; apply cFunctor_ne.
782
783
784
785
786
787
Qed.
Next Obligation. intros F1 F2 A B ??. by rewrite /= /compose /= !cFunctor_id. Qed.
Next Obligation.
  intros T F A1 A2 A3 B1 B2 B3 f g f' g' ??; simpl.
  by rewrite !cFunctor_compose.
Qed.
788
Notation "T -c> F" := (ofe_funCF T%type F%CF) : cFunctor_scope.
789

790
791
Instance ofe_funCF_contractive (T : Type) (F : cFunctor) :
  cFunctorContractive F  cFunctorContractive (ofe_funCF T F).
792
793
Proof.
  intros ?? A1 A2 B1 B2 n ???;
794
    by apply ofe_funC_map_ne; apply cFunctor_contractive.
795
796
Qed.

797
Program Definition ofe_morCF (F1 F2 : cFunctor) : cFunctor := {|
798
  cFunctor_car A B := cFunctor_car F1 B A -n> cFunctor_car F2 A B;
Ralf Jung's avatar
Ralf Jung committed
799
  cFunctor_map A1 A2 B1 B2 fg :=
800
    ofe_morC_map (cFunctor_map F1 (fg.2, fg.1)) (cFunctor_map F2 fg)
Ralf Jung's avatar
Ralf Jung committed
801
|}.
802
803
Next Obligation.
  intros F1 F2 A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
804
  apply ofe_morC_map_ne; apply cFunctor_ne; split; by apply Hfg.