MapDomain.TimedSourceinclude Lattice.S with type t := tinclude Lattice.PO with type t := twiden x y assumes leq x y. Solvers guarantee this by calling widen old (join old new).
If leq x y = false, then pretty_diff () (x, y) should explain why.