| # buf2 = EB_PAGE_SIZE, LEB_SIZE = n0 + # buf0, LEB_SIZE = n1 + logoff0, avol[m5] = mapped(buf0), copy(buf0 + mkempbuf(n0), logoff0, buf2, 0, EB_PAGE_SIZE) ≠ emptypage, n1 ≠ 0, logoff0 < LEB_SIZE, m5 < # avol, ebm-vol-inv(avol), is-aligned(logoff0, EB_PAGE_SIZE), is-encoded(log, subarray(buf0, 0, logoff0)), is-encoded(log0, buf0), # buf0 ≤ LEB_SIZE, logoff0 ≤ # buf0, logoff0 + EB_PAGE_SIZE ≤ LEB_SIZE ⊦ [decode_ref_node#(EB_PAGE_SIZE, copy(avol[m5].data + mkempbuf(n0), logoff0, buf2, 0, EB_PAGE_SIZE); rnd; err0)] ( (err0 = ESUCCESS ∨ ⌊err0⌋ ) ∧ (err0 = ESUCCESS → is-encoded(rnd, subarray(avol[m5].data + mkempbuf(n0), logoff0, EB_PAGE_SIZE))) → ⟪if err0 = ESUCCESS then log := log + rnd.leb '; logoff := logoff0 + EB_PAGE_SIZE⟫ ( logoff ≤ LEB_SIZE ∧ is-aligned(logoff, EB_PAGE_SIZE) ∧ (err0 = ESUCCESS ∨ err0 = ENOENT ∨ ⌊err0⌋ ) ∧ avol[m5].mapped? ∧ (err0 = ESUCCESS → logoff ≤ # avol[m5].data ∧ is-encoded(log, subarray(avol[m5].data, 0, logoff))) ∧ (err0 = ENOENT → is-encoded(log, avol[m5].data)) ∧ LEB_SIZE < n1 + logoff)) |
# buf2 = EB_PAGE_SIZE, LEB_SIZE = n1 + logoff0, LEB_SIZE = n0 + # buf0, avol[m5] = mapped(buf0), m5 < # avol, logoff0 < LEB_SIZE, ebm-vol-inv(avol), is-aligned(logoff0, EB_PAGE_SIZE), is-encoded(log0, buf0), is-encoded(log, subarray(buf0, 0, logoff0)), logoff0 + EB_PAGE_SIZE ≤ LEB_SIZE, logoff0 ≤ # buf0, # buf0 ≤ LEB_SIZE ⊦ ∀ rnd, err0. (err0 = ESUCCESS ∨ ⌊err0⌋ ) ∧ (err0 = ESUCCESS → is-encoded(rnd, subarray(avol[m5].data + mkempbuf(n0), logoff0, EB_PAGE_SIZE))) → ⟪if err0 = ESUCCESS then log := log + rnd.leb '; logoff := logoff0 + EB_PAGE_SIZE⟫ ( logoff ≤ LEB_SIZE ∧ is-aligned(logoff, EB_PAGE_SIZE) ∧ (err0 = ESUCCESS ∨ err0 = ENOENT ∨ ⌊err0⌋ ) ∧ avol[m5].mapped? ∧ (err0 = ESUCCESS → logoff ≤ # avol[m5].data ∧ is-encoded(log, subarray(avol[m5].data, 0, logoff))) ∧ (err0 = ENOENT → is-encoded(log, avol[m5].data)) ∧ LEB_SIZE < n1 + logoff), copy(buf0 + mkempbuf(n0), logoff0, buf2, 0, EB_PAGE_SIZE) = emptypage, n1 = 0