| # avol = # avol0, m0 < # avol0, m0 < # avol0 ∧ avol[m0].mapped? → # avol[m0].data ≤ LEB_SIZE ∧ is-aligned(# avol[m0].data, EB_PAGE_SIZE), ∀ m. m < # avol0 → (avol[m].mapped? → avol0[m] = avol[m]) ∧ (avol[m] = unmapped ∧ avol0[m].mapped? → # avol0[m].data ≤ LEB_SIZE ∧ is-aligned(# avol0[m].data, EB_PAGE_SIZE)) ⊦ (avol[m, unmapped][m0].mapped? → avol0[m0] = avol[m0]) ∧ (avol[m, unmapped][m0] = unmapped ∧ avol0[m0].mapped? → # avol0[m0].data ≤ LEB_SIZE ∧ is-aligned(# avol0[m0].data, EB_PAGE_SIZE)) |
# avol = # avol0, m0 < # avol0, avol[m0].mapped? → # avol[m0].data ≤ LEB_SIZE ∧ is-aligned(# avol[m0].data, EB_PAGE_SIZE), ∀ m. m < # avol0 → (avol[m].mapped? → avol0[m] = avol[m]) ∧ (avol[m] = unmapped ∧ avol0[m].mapped? → # avol0[m].data ≤ LEB_SIZE ∧ is-aligned(# avol0[m].data, EB_PAGE_SIZE)) ⊦ (avol[m, unmapped][m0].mapped? → avol0[m0] = avol[m0]) ∧ (avol[m, unmapped][m0] = unmapped ∧ avol0[m0].mapped? → # avol0[m0].data ≤ LEB_SIZE ∧ is-aligned(# avol0[m0].data, EB_PAGE_SIZE))