□ (Outf = Outf' ∧ Inpf = Inpf'), m ≤ n0, ¬ Ry(m)(S', S''), GInv(S') → GInv(S''), ∀ m. m ≤ n0 + 1 → Ry(m)(S', S'') ⊦