| aubifs_replaylog#(AX, FI, RO, FO, FS, LOG, CSYNCED; ERR, RI) {while ERR = ESUCCESS ∧ AX ≠ [] do {/* (replaylog-prog : invariant (ERR = ESUCCESS ∨ ⌊ERR⌋ ) ∧ (ERR = ESUCCESS → (∃ ax0. AX` = ax0 + AX ∧ replay-safe(AX, FS, RI) ∧ RI = replay-log(ax0, FS`, RI`))) wfbound # AX) */; let ADR = AX.head in aubifs_replayone#(ADR, FI, RO, FO, FS, LOG, CSYNCED; ERR, RI); AX := AX.tail} } |