End Act.
(* Sequential composition *)
Section Bind.
Variable this : nid.
Variable W : world.
Variables (A B : Type).
Section Prog.
Variables (T : prog W A this) (K : A -> prog W B this).
Definition bnd_set t :=
t = Unfinished \/ exists t', t \In pcat t' K /\ t' \In T.
Definition bnd_prog := @Prog _ _ _ bnd_set (or_introl (erefl _)).
End Prog.
Variables (e1 : DT this W A) (e2 : A -> DT this W B).
(* First command spec *)
Notation s1 := (spec_of e1).
(* Continuation spec *)
Notation s2 := (fun x => spec_of (e2 x)).
Definition bind_s : spec B :=
(fun i => s1.1 i /\ forall x s, s1.2 i x s -> (s2 x).1 s,
fun i y m => exists x s, s1.2 i x s /\ (s2 x).2 s y m).

(* Specifications: *)
(* [Ensuring effects execute exactly once]:  DiSeL code is extracted to effectful OCaml programs, which means that evaluating an expression twice is not equivalent to evaluating it once. Below, it is essential to write `let y := e2 x in ...` so that the effects of e2 are executed once rather than twice. This is hard to see because it *looks* like `y` is only used once, but, in fact, it is used another time in an implicit argument which boils down to `spec_of y`.  Eventually, we may want to find a way to not extract the `spec_of` part of `DT`, which is essentially a dependent pair. But for now, we will put up with this hack. *)
Lemma bind_has_spec :
bnd_prog (code_of e1) (fun x => let y := e2 x in code_of y) \In has_spec this W bind_s.