End AlwaysInject.
Notation alwsafe_sc s p scs := (always_sc s p scs (fun _ _ => True)).
Notation alwsafe s p := (always s p (fun _ _ => True)).
Module AlwaysInductiveInv.
Section AlwaysInductiveInv.
Variable pr : protocol.
(* Decompose the initial protocol *)
Notation l := (plab pr).
Notation coh := (coh pr).
Variable I : dstatelet -> pred nid -> Prop.
Variable ii : InductiveInv pr I.
(* Tailored modal always-lemma *)
Variables (A : Type) (this: nid).
Notation V := (mkWorld pr).
Notation W := (mkWorld (ProtocolWithIndInv ii)).

(* Specifications: *)
Lemma alw_ind_inv (p : proc this V A)
(P : state -> proc this V A -> Prop) i :
i \In Coh W ->
always i p P ->
always i (WithInv pr I ii (erefl _) p)
(fun m q => m \In Coh W /\
((exists q', q = WithInv pr I ii (erefl _) q' /\ P m q') \/
(exists v', q = Ret v' /\ P m (Ret v')))).
Lemma aft_ind_inv (p : proc this V A) (P : A -> state -> Prop) i :
i \In Coh W ->
after i p P ->
after i (WithInv pr I ii (erefl _) p)
(fun v m => m \In Coh W /\ P v m).