Section Always.
Variable this : nid.
Variable W : world.
Notation coherent := (Coh W).
Arguments proc [this W].
Fixpoint always_sc A (s1 : state) p scs (P : state -> proc A -> Prop) : Prop :=
s1 \In coherent /\
if scs is sc :: scs' then
forall s2, network_rely W this s1 s2 ->
[/\ safe p sc s2, P s2 p &
forall s3 q, @pstep this W A s2 p sc s3 q -> always_sc s3 q scs' P]
else forall s2, network_rely W this s1 s2 -> P s2 p.
Definition always A s (p : proc A) P := forall scs, always_sc s p scs P.
(* Some basic properties of the alwas predicate *)
(* The predicates, corresponding to weakest postconditions, necessary for defining safe executions of programs.  *)
Notation alwsafe_sc s p scs := (always_sc s p scs (fun _ _ => True)).
Notation alwsafe s p := (always s p (fun _ _ => True)).
Arguments alwA [A B s p P].
(* always commutes with implication, so we can weaken the postconditions *)
Arguments alwI [A s p P Q].
(* p2 is a process resulting from executing p1 *)
(* Now assume p2 is a return and p is its continuation, so we proceed until we reach the return *)
(* this suggest capturing the pattern by means of a new definition *)
Definition after A s (p : proc A) (P : A -> state -> Prop) :=
always s p (fun s2 p2 => forall v, p2 = Ret v -> P v s2).

Lemma aftI A s (p : proc A) (P : Prop) (Q : A -> state -> Prop) :
alwsafe s p ->
after s p (fun v s' => P -> Q v s') <->
(P -> after s p (fun v s' => Q v s')).