bflipset-cons(bflipset, wlar) ⊦ bflipset-cons(bflipset ++ n, wlar) ↔ n < # wlar ∧ wlar[n].status = used