(*+ Collection of disjoint maps *)
(** For the proof of composition of safety, we need to maintain the invariants "all the maps are disjoint*" which is why we need this section.  * pairwise-disjointness is equivalent to arbitrary disjointness because the permissions are "set-theoretical" *)
Definition sameperms (m n : map) := forall x, m x = None <-> n x = None.

Lemma selfjoins_swapped {A} {m1 m2 : A -> map} (Adec:forall x y:A,{x=y}+{x<>y})
i j (J:selfjoins m1) e a b c d :
swapped m1 m2 i j a b c d ->
join a b e ->
join c d e ->
selfjoins m2.