proposition: Lemma format_sequence_refined_correct {cache : Cache} {S V1 V2 T : Type} {P : CacheDecode -> Prop} {P_inv1 P_inv2 : (CacheDecode -> Prop) -> Prop} (P_inv_pf : cache_inv_Property P (fun P => P_inv1 P /\ P_inv2 P)) (monoid : Monoid T) (f : S -> V1) (Source_Predicate : S -> Prop) (View_Predicate1 : V1 -> Prop) (View_Predicate2 : V2 -> Prop) (format1 : FormatM V1 T) (format2 subformat : FormatM S T ) (view_format : FormatM V2 T) (view : S -> V2 -> Prop) (decode1 : DecodeM (V1 * T) T) (decode_1_OK : cache_inv_Property P P_inv1 -> CorrectDecoder monoid View_Predicate1 View_Predicate1 eq format1 decode1 P format1) (View_Predicate_OK : forall s, Source_Predicate s -> View_Predicate1 (f s)) (decode2 : V1 -> DecodeM (V2 * T) T) (decode2_pf : forall v1 : V1, cache_inv_Property P P_inv2 -> View_Predicate1 v1 -> CorrectRefinedDecoder monoid (fun s => Source_Predicate s /\ IsProj f v1 s) View_Predicate2 view format2 subformat (decode2 v1) P view_format) : CorrectRefinedDecoder monoid Source_Predicate View_Predicate2 view (format1 ◦ f ++ format2) (format1 ◦ f ++ subformat) (sequence_Decode decode1 decode2) P (Compose_Format format1 (fun _ _ => True) ++ view_format)%format.
proof: Proof. eapply sequence_Compose_format_decode_refined_correct'; try eassumption. intros; subst; eauto. Qed.
imports: Coq.ZArith.ZArith Fiat.Common Fiat.Computation.Notations Fiat.Narcissus.Common.Specs Fiat.Narcissus.Common.WordFacts Fiat.Computation.Refinements.General Fiat.Narcissus.BaseFormats