End INVARIANT6_bis.
(* The first optimisation rule is reorganising the diffusion tree in such a way that I can no longer prove ancestor_not_reflexive as before.  First, I have to prove a stronger property, from which I can derive ancestor_not_reflexive.  I introduce a new ancestor relationship, very similar to the one by Jean in machine0. The parent relation is defined by any inc_dec message in the channel as opposed to the first one!  I call this relation mul_ancestor, because a site may have multiple direct parents.  I can now prove that mul_ancestor_not_reflexive, from which I derive ancestor_not_reflexive. *)
Section MUL.
Variable c0 : Config.
(* s1 is parent of s0 *)
Inductive mul_parent : Site -> Site -> Prop :=
mul_parent_intro :
forall s1 s0 : Site,
rt c0 s0 = true ->
In_queue Message (inc_dec s1) (bm c0 s0 owner) -> mul_parent s1 s0.
(* s1 is ancestor of s0 *)
Inductive mul_ancestor : Site -> Site -> Prop :=
| mul_short : forall s1 s0 : Site, mul_parent s1 s0 -> mul_ancestor s1 s0
| mul_long :
forall s2 s1 s0 : Site,
mul_ancestor s2 s1 -> mul_parent s1 s0 -> mul_ancestor s2 s0.
End MUL.
Section MUL2.

(* Specifications: *)
Lemma in_queue_post :
forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message),
m1 <> m2 ->
In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2) ->
In_queue Message m1 (b s1 s2).
Lemma in_queue_collect :
forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message),
In_queue Message m1 (Collect_message Message b s3 s4 s1 s2) ->
In_queue Message m1 (b s1 s2).
Lemma mul_parent_does_not_join :
forall (c0 : Config) (s2 s3 s4 : Site),
legal c0 ->
legal (rec_copy2_trans c0 s2) ->
mul_parent (rec_copy2_trans c0 s2) s3 s4 ->
rt c0 s2 = false ->
first Message (bm c0 owner s2) = value Message copy -> s3 <> s2.
Lemma mul_ancestor_does_not_join :
forall (c0 : Config) (s2 s3 s4 : Site),
legal c0 ->
legal (rec_copy2_trans c0 s2) ->
mul_ancestor (rec_copy2_trans c0 s2) s3 s4 ->
rt c0 s2 = false ->
first Message (bm c0 owner s2) = value Message copy -> s3 <> s2.
Lemma mul_parent_does_not_join2 :
forall (c0 : Config) (s1 s2 s3 s4 : Site),
legal c0 ->
legal (rec_copy3_trans c0 s1 s2) ->
mul_parent (rec_copy3_trans c0 s1 s2) s3 s4 ->
rt c0 s2 = false ->
first Message (bm c0 s1 s2) = value Message copy -> s3 <> s2.
Lemma mul_ancestor_does_not_join2 :
forall (c0 : Config) (s1 s2 s3 s4 : Site),
legal c0 ->
legal (rec_copy3_trans c0 s1 s2) ->
mul_ancestor (rec_copy3_trans c0 s1 s2) s3 s4 ->
rt c0 s2 = false ->
first Message (bm c0 s1 s2) = value Message copy -> s3 <> s2.
Lemma mul_ancestor_not_reflexive :
forall c : Config,
legal c -> forall s1 s2 : Site, mul_ancestor c s1 s2 -> s1 <> s2.
Lemma not_in_queue_input :
forall (q : queue Message) (m1 m : Message),
~ In_queue Message m1 (input Message m q) -> ~ In_queue Message m1 q.
Lemma same_parent :
forall (c : Config) (s2 s5 s6 : Site),
parent c s5 s6 -> parent c s2 s6 -> s2 = s5.
Lemma ancestor_is_mul_ancestor :
forall (c : Config) (s1 s2 : Site), ancestor c s1 s2 -> mul_ancestor c s1 s2.