| # wlar1 = # wlar, # apebs1 = # wlar, # apebs = # wlar, err = ESUCCESS, free-ecs(wlar) = ∅, q = eq-entry(m, lref) ' + q1, vtblpnum = m, m < # wlar, bflipset-cons(bflipset, wlar), id(apebs1, apebs, mapped-pebs(vols)), id○(apebs1, apebs, m), id○(wlar1, wlar, m), ubi-io-inv(apebs), ubi-io-inv(apebs1), unique-sqns(apebs), valid-ebatbl(apebs, wlar, vols, vtblpnum0), valid-eraseq(eq-entry(m, lref) ' + q1), valid-eraseq(wlar, eq-entry(m, lref) ' + q1), valid-eraseq(apebs, eq-entry(m, lref) ' + q1), valid-global-sqn(apebs, sqnum), valid-vtbl(apebs, vols, wlar, vtblpnum0), valid-wl(apebs, wlar), err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(wlar1, eq-entry(m, lref) ' + q1) ∧ valid-eraseq(apebs1, eq-entry(m, lref) ' + q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err = ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q1) ∧ valid-eraseq(wlar1, q1) ∧ valid-eraseq(apebs1, q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err = ESUCCESS ∨ ⌊err⌋ ⊦ ⟪if wlar1[vtblpnum].status ≠ free then err := ENOSPC⟫ ( (err = ESUCCESS ∨ ⌊err⌋ ) ∧ ( err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q.tail) ∧ valid-eraseq(wlar1, q.tail) ∧ valid-eraseq(apebs1, q.tail) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0)) ∧ q.tail.lebrefs ⊆ (eq-entry(m, lref) ' + q1).lebrefs ∧ ( err = ESUCCESS → vtblpnum < # wlar ∧ wlar1[vtblpnum].status = free ∧ ( apebs = apebs1 ∧ wlar = wlar1 ∧ eq-entry(m, lref) ' + q1 = q.tail ∨ id○(apebs, apebs1, vtblpnum) ∧ id○(wlar, wlar1, vtblpnum) ∧ eq-entry(m, lref) ' + q1 ≠ [] ∧ eq-entry(m, lref) ' + q1 = eq-entry(vtblpnum, (eq-entry(m, lref) ' + q1).head.lebref) ' + q.tail) ∧ unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q.tail) ∧ valid-eraseq(wlar1, q.tail) ∧ valid-eraseq(apebs1, q.tail) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0))), wlar1[m].status = used, q = [], vtblpnum0 = m, vtblpnum0 ∈ q1, VTBL_VOLID ∈ vols |
# apebs = # wlar, # apebs1 = # wlar, # wlar1 = # wlar, err = ESUCCESS, free-ecs(wlar) = ∅, q = eq-entry(m, lref) ' + q1, vtblpnum = m, vtblpnum < # wlar1, m < # wlar, bflipset-cons(bflipset, wlar), id(apebs1, apebs, mapped-pebs(vols)), id○(wlar1, wlar, m), id○(apebs1, apebs, m), ubi-io-inv(apebs1), ubi-io-inv(apebs), unique-sqns(apebs), valid-ebatbl(apebs, wlar, vols, vtblpnum0), valid-eraseq(apebs, eq-entry(m, lref) ' + q1), valid-eraseq(wlar, eq-entry(m, lref) ' + q1), valid-eraseq(eq-entry(m, lref) ' + q1), valid-global-sqn(apebs, sqnum), valid-vtbl(apebs, vols, wlar, vtblpnum0), valid-wl(apebs, wlar), err = ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q1) ∧ valid-eraseq(wlar1, q1) ∧ valid-eraseq(apebs1, q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(wlar1, eq-entry(m, lref) ' + q1) ∧ valid-eraseq(apebs1, eq-entry(m, lref) ' + q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err = ESUCCESS ∨ ⌊err⌋ ⊦ ⟪err := ENOSPC⟫ ( (err = ESUCCESS ∨ ⌊err⌋ ) ∧ ( err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q.tail) ∧ valid-eraseq(wlar1, q.tail) ∧ valid-eraseq(apebs1, q.tail) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0)) ∧ q.tail.lebrefs ⊆ (eq-entry(m, lref) ' + q1).lebrefs ∧ ( err = ESUCCESS → vtblpnum < # wlar ∧ wlar1[vtblpnum].status = free ∧ ( apebs = apebs1 ∧ wlar = wlar1 ∧ eq-entry(m, lref) ' + q1 = q.tail ∨ id○(apebs, apebs1, vtblpnum) ∧ id○(wlar, wlar1, vtblpnum) ∧ eq-entry(m, lref) ' + q1 ≠ [] ∧ eq-entry(m, lref) ' + q1 = eq-entry(vtblpnum, (eq-entry(m, lref) ' + q1).head.lebref) ' + q.tail) ∧ unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q.tail) ∧ valid-eraseq(wlar1, q.tail) ∧ valid-eraseq(apebs1, q.tail) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0))), wlar1[m].status = used, wlar1[vtblpnum].status = free, q = [], vtblpnum0 = m, VTBL_VOLID ∈ vols, vtblpnum0 ∈ q1
# apebs = # wlar, # apebs1 = # wlar, # wlar1 = # wlar, wlar1[vtblpnum].status = free, err = ESUCCESS, free-ecs(wlar) = ∅, q = eq-entry(m, lref) ' + q1, vtblpnum = m, vtblpnum < # wlar1, m < # wlar, bflipset-cons(bflipset, wlar), id(apebs1, apebs, mapped-pebs(vols)), id○(wlar1, wlar, m), id○(apebs1, apebs, m), ubi-io-inv(apebs1), ubi-io-inv(apebs), unique-sqns(apebs), valid-ebatbl(apebs, wlar, vols, vtblpnum0), valid-eraseq(apebs, eq-entry(m, lref) ' + q1), valid-eraseq(wlar, eq-entry(m, lref) ' + q1), valid-eraseq(eq-entry(m, lref) ' + q1), valid-global-sqn(apebs, sqnum), valid-vtbl(apebs, vols, wlar, vtblpnum0), valid-wl(apebs, wlar), err = ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q1) ∧ valid-eraseq(wlar1, q1) ∧ valid-eraseq(apebs1, q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(wlar1, eq-entry(m, lref) ' + q1) ∧ valid-eraseq(apebs1, eq-entry(m, lref) ' + q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err = ESUCCESS ∨ ⌊err⌋ ⊦ ⟪skip⟫ ( (err = ESUCCESS ∨ ⌊err⌋ ) ∧ ( err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q.tail) ∧ valid-eraseq(wlar1, q.tail) ∧ valid-eraseq(apebs1, q.tail) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0)) ∧ q.tail.lebrefs ⊆ (eq-entry(m, lref) ' + q1).lebrefs ∧ ( err = ESUCCESS → vtblpnum < # wlar ∧ wlar1[vtblpnum].status = free ∧ ( apebs = apebs1 ∧ wlar = wlar1 ∧ eq-entry(m, lref) ' + q1 = q.tail ∨ id○(apebs, apebs1, vtblpnum) ∧ id○(wlar, wlar1, vtblpnum) ∧ eq-entry(m, lref) ' + q1 ≠ [] ∧ eq-entry(m, lref) ' + q1 = eq-entry(vtblpnum, (eq-entry(m, lref) ' + q1).head.lebref) ' + q.tail) ∧ unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q.tail) ∧ valid-eraseq(wlar1, q.tail) ∧ valid-eraseq(apebs1, q.tail) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0))), wlar1[m].status = used, q = [], vtblpnum0 = m, VTBL_VOLID ∈ vols, vtblpnum0 ∈ q1
# apebs = # wlar, # apebs1 = # wlar, # wlar1 = # wlar, err = ESUCCESS, free-ecs(wlar) = ∅, q = eq-entry(m, lref) ' + q1, vtblpnum = m, m < # wlar, bflipset-cons(bflipset, wlar), id(apebs1, apebs, mapped-pebs(vols)), id○(wlar1, wlar, m), id○(apebs1, apebs, m), ubi-io-inv(apebs1), ubi-io-inv(apebs), unique-sqns(apebs), valid-ebatbl(apebs, wlar, vols, vtblpnum0), valid-eraseq(apebs, eq-entry(m, lref) ' + q1), valid-eraseq(wlar, eq-entry(m, lref) ' + q1), valid-eraseq(eq-entry(m, lref) ' + q1), valid-global-sqn(apebs, sqnum), valid-vtbl(apebs, vols, wlar, vtblpnum0), valid-wl(apebs, wlar), err = ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(q1) ∧ valid-eraseq(wlar1, q1) ∧ valid-eraseq(apebs1, q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err ≠ ESUCCESS → unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum) ∧ valid-wl(apebs1, wlar1) ∧ valid-eraseq(wlar1, eq-entry(m, lref) ' + q1) ∧ valid-eraseq(apebs1, eq-entry(m, lref) ' + q1) ∧ bflipset-cons(bflipset, wlar1) ∧ valid-ebatbl(apebs1, wlar1, vols, vtblpnum0) ∧ valid-vtbl(apebs1, vols, wlar1, vtblpnum0), err = ESUCCESS ∨ ⌊err⌋ ⊦ wlar1[m].status = used, q = [], vtblpnum0 = m, vtblpnum < # wlar1, VTBL_VOLID ∈ vols, vtblpnum0 ∈ q1