| # lpt = # avol, avol[n0] = mapped(buf0), m = buffered(n0).leb, buffered(n0).isbuf?, n0 < # avol, awbuf-inv(avol, buffered(n0)), n ≤ # buf, # buf0 + n ≤ LEB_SIZE, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ err0 = ESUCCESS, ∀ n1. n1 ≠ 0 → n1 < n → avol[m].mapped? ∧ m < # avol |
Used simplifier rules: ⊦ unmapped ≠ mapped(buf); (s)%fle: ⊦ m < n ∧ n ≤ n0 → m < n0; (forward) from specification nat%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic% ⊦ aleb.mapped? ↔ aleb ≠ unmapped; (ss)% ⊦ buffered(m).leb = m; (s)% ⊦ ⌊err⌋ → err ≠ ESUCCESS; (s)% ⊦ buffered(m).isbuf?; (s)