End INVARIANT6_bis.
(* The first optimisation rule is reorganising the diffusion tree in such a way that I can no longer prove ancestor_not_reflexive as before.  First, I have to prove a stronger property, from which I can derive ancestor_not_reflexive.  I introduce a new ancestor relationship, very similar to the one by Jean in machine0. The parent relation is defined by any inc_dec message in the channel as opposed to the first one!  I call this relation mul_ancestor, because a site may have multiple direct parents.  I can now prove that mul_ancestor_not_reflexive, from which I derive ancestor_not_reflexive. *)
Section MUL.
Variable c0 : Config.
(* s1 is parent of s0 *)
Inductive mul_parent : Site -> Site -> Prop :=
mul_parent_intro :
forall s1 s0 : Site,
rt c0 s0 = true ->
In_queue Message (inc_dec s1) (bm c0 s0 owner) -> mul_parent s1 s0.
(* s1 is ancestor of s0 *)
Inductive mul_ancestor : Site -> Site -> Prop :=
| mul_short : forall s1 s0 : Site, mul_parent s1 s0 -> mul_ancestor s1 s0
| mul_long :
forall s2 s1 s0 : Site,
mul_ancestor s2 s1 -> mul_parent s1 s0 -> mul_ancestor s2 s0.
End MUL.
Section MUL2.

Lemma mul_ancestor_does_not_join :
forall (c0 : Config) (s2 s3 s4 : Site),
legal c0 ->
legal (rec_copy2_trans c0 s2) ->
mul_ancestor (rec_copy2_trans c0 s2) s3 s4 ->
rt c0 s2 = false ->
first Message (bm c0 owner s2) = value Message copy -> s3 <> s2.