| apebs[m1] = mkpeb(aehdr, avhdr, buf, m2, boolvar), subarray(apebs, 0, m + 1)[m1] = mkpeb(aehdr0, avhdr0, buf0, m3, boolvar0), m1 + 1 < # apebs, m1 < m, m < # apebs, m1 < # apebs, valid-eraseq-stronger(subarray(apebs, 0, m), q0), ∀ v, m0. (valid-peb(v, m0, mkpeb(aehdr, avhdr, buf, m2, boolvar)) ↔ lref = v × m0) ∧ (lref = v × m0 → avhdr.sqn ≠ valid-sqns(v, m0, apebs, m).max), ∀ m, apebs. m < # apebs ∧ valid-eraseq-stronger(subarray(apebs, 0, m), q0) → (valid-eraseq-stronger(subarray(apebs, 0, m + 1), q0 + eq-entry(m, none) ') ↔ ¬ valid-peb(apebs[m])) ⊦ ¬ m1 ∈ q0 + eq-entry(m, none) ' ∧ (∀ v, m0. (valid-peb(v, m0, subarray(apebs, 0, m + 1)[m1]) ↔ lref = v × m0) ∧ (lref = v × m0 → avhdr0.sqn ≠ (valid-sqns(v, m0, apebs, m) ∪ (valid-peb(v, m0, apebs[m]) ⊃ {apebs[m].vidhdr.sqn} ;∅)).max)) ∧ valid-eraseq-stronger(subarray(apebs, 0, m + 1), q0 + eq-entry(m, none) ') ↔ ¬ valid-peb(apebs[m]), m1 ∈ q0 |
subarray(apebs, 0, m + 1)[m1] = mkpeb(aehdr0, avhdr0, buf0, m3, boolvar0), apebs[m1] = mkpeb(aehdr, avhdr, buf, m2, boolvar), m1 < # apebs, m < # apebs, m1 < m, m1 + 1 < # apebs, valid-eraseq-stronger(subarray(apebs, 0, m), q0), ∀ m, apebs. m < # apebs ∧ valid-eraseq-stronger(subarray(apebs, 0, m), q0) → (valid-eraseq-stronger(subarray(apebs, 0, m + 1), q0 + eq-entry(m, none) ') ↔ ¬ valid-peb(apebs[m])), ∀ v, m0. (valid-peb(v, m0, mkpeb(aehdr, avhdr, buf, m2, boolvar)) ↔ lref = v × m0) ∧ (lref = v × m0 → avhdr.sqn ≠ valid-sqns(v, m0, apebs, m).max) ⊦ ¬ m1 ∈ q0 + eq-entry(m, none) ' ∧ (∀ v, m0. (valid-peb(v, m0, mkpeb(aehdr0, avhdr0, buf0, m3, boolvar0)) ↔ lref = v × m0) ∧ (lref = v × m0 → avhdr0.sqn ≠ (valid-sqns(v, m0, apebs, m) ∪ (valid-peb(v, m0, apebs[m]) ⊃ {apebs[m].vidhdr.sqn} ;∅)).max)) ∧ valid-eraseq-stronger(subarray(apebs, 0, m + 1), q0 + eq-entry(m, none) ') ↔ ¬ valid-peb(apebs[m]), m1 ∈ q0