Filnix wiki

stream_currentd w′ h

Explore proof 12 tactics

Initial goal

⊢

∀d : stream_token w w′ : libc_world h : gmappiece pval, libc_stream_atw′ token_handled = libc_stream_atw token_handled → libc_stream_statew′ token_handled = libc_stream_statew token_handled → stream_currentd w h → stream_currentd w′ h

intros d w w′ h Hlookup Hstate Hc

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

Hc :

⊢

stream_currentd w′ h

unfold stream_current in *

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

Hc :

match h !! PNametoken_keyd with

SomeVStreamp snapshot

⇒

p = token_handled ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

⊢

match h !! PNametoken_keyd with

SomeVStreamp snapshot

⇒

p = token_handled ∧ stream_observationw′ p snapshot

SomeVStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

None

⇒

True

⇒

False

destruct h !! PNametoken_keyd as v | ; | exact I

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

v :

Hc :

match v with

VStreamp snapshot

⇒

p = token_handled ∧ stream_observationw p snapshot

VStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⇒

False

⊢

match v with

VStreamp snapshot

⇒

p = token_handled ∧ stream_observationw′ p snapshot

VStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

⇒

False

destruct v ; try contradiction

2 open

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

p :

pending :

optionZ × listZ

Hc :

p = token_handled ∧ stream_observationw p pending

⊢

p = token_handled ∧ stream_observationw′ p pending

focused goal

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

p :

Hc :

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

–destruct Hc as → Hobs

2 open

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

pending :

optionZ × listZ

Hobs :

stream_observationw token_handled pending

⊢

token_handled = token_handled ∧ stream_observationw′ token_handled pending

deferred goal

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

p :

Hc :

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

split ; reflexivity |

2 open

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

pending :

optionZ × listZ

Hobs :

stream_observationw token_handled pending

⊢

stream_observationw′ token_handled pending

deferred goal

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

p :

Hc :

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

unfold stream_observation in *

2 open

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

pending :

optionZ × listZ

Hobs :

match pending with

Somepending, fifo

⇒

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

None

⇒

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

⊢

match pending with

Somepending₀, fifo

⇒

∃info : stream_info, libc_stream_atw′ token_handled = Someinfo ∧ stream_pendinginfo = pending₀ ∧ outstandingstream_protocolinfo = fifo

None

⇒

libc_stream_atw′ token_handled = None ∧ outstandinglibc_stream_statew′ token_handled = [ ]

deferred goal

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

p :

Hc :

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

destruct pending as physical fifo | ; rewrite Hlookup ; exact Hobs | rewrite Hstate ; exact Hobs

deferred goal

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

p :

Hc :

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw′ p = Someinfo

–destruct Hc as → Hopen

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

Hopen :

∃info : stream_info, libc_stream_atw token_handled = Someinfo

⊢

token_handled = token_handled ∧ ∃info : stream_info, libc_stream_atw′ token_handled = Someinfo

split ; reflexivity |

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

Hopen :

∃info : stream_info, libc_stream_atw token_handled = Someinfo

⊢

∃info : stream_info, libc_stream_atw′ token_handled = Someinfo

rewrite Hlookup

d :

w, w′ :

h :

gmappiece pval

Hlookup :

libc_stream_atw′ token_handled = libc_stream_atw token_handled

Hstate :

libc_stream_statew′ token_handled = libc_stream_statew token_handled

Hopen :

∃info : stream_info, libc_stream_atw token_handled = Someinfo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo

exact Hopen

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros d w w′ h Hlookup Hstate Hc

unfold stream_current in *

destruct h !! PNametoken_keyd as v | ; | exact I

destruct v ; try contradiction

–destruct Hc as → Hobs

split ; reflexivity |

unfold stream_observation in *

destruct pending as physical fifo | ; rewrite Hlookup ; exact Hobs | rewrite Hstate ; exact Hobs

–destruct Hc as → Hopen

split ; reflexivity |

rewrite Hlookup

exact Hopen

Keys below the codec key (-1) do not overlap locale categories. Actual freshness against other adapters is still required by allocation.

85Definition token_wfd : stream_token : Prop ≔

ptr_captoken_handled = Objtoken_based ∧ token_keyd < −1

88Definition stream_tokens_wirep out err b o m w h : gmappiece pval : Prop ≔

token_wfout ∧ token_wferr ∧ token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

97Lemma stream_closed_keys

∀ d pending fifo

closed_psd.*1 = stream_psd pending fifo.*1

Explore proof 1 tactics

Initial goal

⊢

∀d : stream_token pending : Z fifo : listZ, closed_psd.*1 = stream_psd pending fifo.*1

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

reflexivity

101Lemma stream_ps_agree

∀ m d pending fifo

all_agreem stream_psd pending fifo

Explore proof 3 tactics

Initial goal

⊢

∀m : mem d : stream_token pending : Z fifo : listZ, live_atm token_based token_regiond → all_agreem stream_psd pending fifo

intros

m :

d :

pending :

fifo :

listZ

H :

⊢

all_agreem stream_psd pending fifo

split ; exact H |

m :

d :

pending :

fifo :

listZ

H :

⊢

all_agreem PNametoken_keyd, VStreamtoken_handled Somepending, fifo

split ; exact I

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

split ; exact H |

split ; exact I

105Lemma closed_ps_agree

∀ m d

all_agreem closed_psd

Explore proof 3 tactics

Initial goal

⊢

∀m : mem d : stream_token, live_atm token_based token_regiond → all_agreem closed_psd

intros

m :

d :

H :

⊢

all_agreem closed_psd

split ; exact H |

m :

d :

H :

⊢

all_agreem PNametoken_keyd, VStreamtoken_handled None

split ; exact I

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

split ; exact H |

split ; exact I

109Lemma stream_open_current

∀ d w h pending fifo

∀l v, l, v ∈ stream_psd pending fifo → h !! l = Somev

∃info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

Explore proof 8 tactics

Initial goal

⊢

∀d : stream_token w : libc_world h : gmappiece pval pending : Z fifo : listZ, stream_currentd w h → ∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev → ∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

intros d w h pending fifo Hcurrent Howned

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

assert Hl : h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

2 open

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

⊢

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

focused goal

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

{apply Howned

2 open

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

⊢

PNametoken_keyd, VStreamtoken_handled Somepending, fifo ∈ stream_psd pending fifo

deferred goal

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

unfold stream_ps

2 open

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

⊢

PNametoken_keyd, VStreamtoken_handled Somepending, fifo ∈ PLivetoken_based, VLivetoken_regiond; PNametoken_keyd, VStreamtoken_handled Somepending, fifo

deferred goal

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

set_solver

deferred goal

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

unfold stream_current in Hcurrent

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Hcurrent :

match h !! PNametoken_keyd with

SomeVStreamp snapshot

⇒

p = token_handled ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

rewrite Hl in Hcurrent

d :

w :

h :

gmappiece pval

pending :

fifo :

listZ

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

Hcurrent :

token_handled = token_handled ∧ stream_observationw token_handled Somepending, fifo

⊢

∃info : stream_info, libc_stream_atw token_handled = Someinfo ∧ stream_pendinginfo = pending ∧ outstandingstream_protocolinfo = fifo

exact proj2Hcurrent

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros d w h pending fifo Hcurrent Howned

assert Hl : h !! PNametoken_keyd = SomeVStreamtoken_handled Somepending, fifo

{apply Howned

unfold stream_ps

set_solver

unfold stream_current in Hcurrent

rewrite Hl in Hcurrent

exact proj2Hcurrent

121Lemma stream_closed_current

∀ d w h

∀l v, l, v ∈ closed_psd → h !! l = Somev

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

Explore proof 8 tactics

Initial goal

⊢

∀d : stream_token w : libc_world h : gmappiece pval, stream_currentd w h → ∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev → libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

intros d w h Hcurrent Howned

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

assert Hl : h !! PNametoken_keyd = SomeVStreamtoken_handled None

2 open

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

⊢

h !! PNametoken_keyd = SomeVStreamtoken_handled None

focused goal

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled None

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

{apply Howned

2 open

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

⊢

PNametoken_keyd, VStreamtoken_handled None ∈ closed_psd

deferred goal

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled None

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

unfold closed_ps

2 open

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

⊢

PNametoken_keyd, VStreamtoken_handled None ∈ PLivetoken_based, VLivetoken_regiond; PNametoken_keyd, VStreamtoken_handled None

deferred goal

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled None

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

set_solver

deferred goal

d :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled None

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

unfold stream_current in Hcurrent

d :

w :

h :

gmappiece pval

Hcurrent :

match h !! PNametoken_keyd with

SomeVStreamp snapshot

⇒

p = token_handled ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled None

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

rewrite Hl in Hcurrent

d :

w :

h :

gmappiece pval

Howned :

∀l : piece v : pval, l, v ∈ closed_psd → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamtoken_handled None

Hcurrent :

token_handled = token_handled ∧ stream_observationw token_handled None

⊢

libc_stream_atw token_handled = None ∧ outstandinglibc_stream_statew token_handled = [ ]

exact proj2Hcurrent

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros d w h Hcurrent Howned

assert Hl : h !! PNametoken_keyd = SomeVStreamtoken_handled None

{apply Howned

unfold closed_ps

set_solver

unfold stream_current in Hcurrent

rewrite Hl in Hcurrent

exact proj2Hcurrent

132Lemma stream_permission_current

∀ d p w h

∀l v, l, v ∈ open_permission_psd p → h !! l = Somev

p = token_handled ∧ ∃info, libc_stream_atw p = Someinfo

Explore proof 12 tactics

Initial goal

⊢

∀d : stream_token p : ptr w : libc_world h : gmappiece pval, stream_currentd w h → ∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev → p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

intros d p w h Hcurrent Howned

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

assert Hl : h !! PNametoken_keyd = SomeVStreamOpenp

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

h !! PNametoken_keyd = SomeVStreamOpenp

focused goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

{apply Howned

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

PNametoken_keyd, VStreamOpenp ∈ open_permission_psd p

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

unfold open_permission_ps

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

PNametoken_keyd, VStreamOpenp ∈ PLivetoken_based, VLivetoken_regiond; PNametoken_keyd, VStreamOpenp

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

apply elem_of_cons

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

PNametoken_keyd, VStreamOpenp = PLivetoken_based, VLivetoken_regiond ∨ PNametoken_keyd, VStreamOpenp ∈ PNametoken_keyd, VStreamOpenp

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

right

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

PNametoken_keyd, VStreamOpenp ∈ PNametoken_keyd, VStreamOpenp

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

apply elem_of_cons

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

PNametoken_keyd, VStreamOpenp = PNametoken_keyd, VStreamOpenp ∨ PNametoken_keyd, VStreamOpenp ∈ [ ]

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

left

2 open

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

⊢

PNametoken_keyd, VStreamOpenp = PNametoken_keyd, VStreamOpenp

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

reflexivity

deferred goal

d :

p :

w :

h :

gmappiece pval

Hcurrent :

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

unfold stream_current in Hcurrent

d :

p :

w :

h :

gmappiece pval

Hcurrent :

match h !! PNametoken_keyd with

SomeVStreamp snapshot

⇒

p = token_handled ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

rewrite Hl in Hcurrent

d :

p :

w :

h :

gmappiece pval

Howned :

∀l : piece v : pval, l, v ∈ open_permission_psd p → h !! l = Somev

Hl :

h !! PNametoken_keyd = SomeVStreamOpenp

Hcurrent :

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

⊢

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

exact Hcurrent

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros d p w h Hcurrent Howned

assert Hl : h !! PNametoken_keyd = SomeVStreamOpenp

{apply Howned

unfold open_permission_ps

apply elem_of_cons

right

apply elem_of_cons

left

reflexivity

unfold stream_current in Hcurrent

rewrite Hl in Hcurrent

exact Hcurrent

143Lemma permission_selected

∀ out err p

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

Explore proof 3 tactics

Initial goal

⊢

∀out err : stream_token p : ptr, permission_descriptorout err p = out ∨ permission_descriptorout err p = err

intros

out, err :

p :

⊢

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

unfold permission_descriptor

out, err :

p :

⊢

same_filep token_handleout

→

out

else

err

out

∨

same_filep token_handleout

→

out

else

err

destruct same_filep token_handleout ; auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

unfold permission_descriptor

destruct same_filep token_handleout ; auto

Pure owned lookups already reject unknown and wrong-capability arguments, as required by HelloClose's pointer-universal premises.

149Lemma permission_known

∀ rep out err b o p m w h

stream_tokens_wirep out err b o m w h

∀l v, l, v ∈ permission_psout err p → h !! l = Somev

p = token_handlepermission_descriptorout err p ∧ p = token_handleout ∨ p = token_handleerr

Explore proof 7 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop out err : stream_token b o : Z p : ptr m : mem w : libc_world h : gmappiece pval, stream_tokens_wirep out err b o m w h → ∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev → p = token_handlepermission_descriptorout err p ∧ p = token_handleout ∨ p = token_handleerr

intros rep out err b o p m w h _ & _ & _ & _ & _ & _ & Ho & He & _ Hl

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

⊢

p = token_handlepermission_descriptorout err p ∧ p = token_handleout ∨ p = token_handleerr

assert Hc : stream_currentpermission_descriptorout err p w h

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

⊢

focused goal

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hc :

⊢

p = token_handlepermission_descriptorout err p ∧ p = token_handleout ∨ p = token_handleerr

{destruct permission_selectedout err p as → | → ; assumption

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hc :

⊢

p = token_handlepermission_descriptorout err p ∧ p = token_handleout ∨ p = token_handleerr

destruct stream_permission_current_ _ _ _ Hc Hl as Hp _

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hc :

Hp :

⊢

p = token_handlepermission_descriptorout err p ∧ p = token_handleout ∨ p = token_handleerr

split ; exact Hp |

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hc :

Hp :

⊢

p = token_handleout ∨ p = token_handleerr

rewrite Hp

rep :

mem → libc_world → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hc :

Hp :

⊢

token_handlepermission_descriptorout err p = token_handleout ∨ token_handlepermission_descriptorout err p = token_handleerr

destruct permission_selectedout err p as → | → ; auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep out err b o p m w h _ & _ & _ & _ & _ & _ & Ho & He & _ Hl

assert Hc : stream_currentpermission_descriptorout err p w h

{destruct permission_selectedout err p as → | → ; assumption

destruct stream_permission_current_ _ _ _ Hc Hl as Hp _

split ; exact Hp |

rewrite Hp

destruct permission_selectedout err p as → | → ; auto

Recording independently live handles and CURRENT observations preserves the complete entry envelope. It does not recover unavailable fragments or change the world interpretation used by an existing WP.

165Lemma stream_entry_frame

∀ rep out err b o m w h op oq ep eq

agreesm h

stream_tokens_wirep out err b o m w h

stream_observationw token_handleout Someop, oq

stream_observationw token_handleerr Someep, eq

let h′ ≔ overwritestream_psout op oq ++ stream_pserr ep eq h in

agreesm h′ ∧ stream_tokens_wirep out err b o m w h′

Proof 57 steps Qed

intros rep out err b o m w h op oq ep eq Ha Howf & Hewf & Hbase & Hkey & Hout & Herr & _ & _ & Hprivate Hol Hel Hoo Heo h′

assert Hdata : memory_keys_fromstream_data_heaptoken_baseout token_baseerr h' stream_data_heaptoken_baseout token_baseerr h

{intros l v Hl Hmem

apply stream_data_lookup in Hl as Hl & Hno & Hne

unfold h' in Hl

apply lookup_overwrite in Hl as Hin | _ Hold

–apply list_elem_of_In in Hin

cbn [ stream_ps app ] in Hin

destruct Hin as E | E | E | E | ; injection E as ← ← ; contradiction

–exists v

rewrite stream_data_lookup_ne ; assumption

split

{intros l v Hl

unfold h' in Hl

apply lookup_overwrite in Hl as Hin | _ Hold ; | exact Hal v Hold

eapply all_agree_elem ; | exact Hin

apply all_agree_app

split ; apply stream_ps_agree ; assumption

split ; exact Howf |

split ; exact Hewf |

split ; exact Hbase |

split ; exact Hkey |

split ; exact Hout |

split ; exact Herr |

split

{unfold stream_current , h'

cbn [ stream_ps app overwrite fst snd ]

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_eq

exact conjeq_refl Hoo

split

{unfold stream_current , h'

cbn [ stream_ps app overwrite fst snd ]

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_ne ; | congruence

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_eq

exact conjeq_refl Heo

intros d Hd

destruct Hprivated Hd as Hwi Hrel

split ; eapply errno_wi_heap ; eauto |

intros base l v Hin Hl Hmem

unfold h' in Hl

apply lookup_overwrite in Hl as Hnew | _ Hold ; | exact Hrelbase l v Hin Hold Hmem

apply list_elem_of_In in Hnew

cbn [ stream_ps app ] in Hnew

destruct Hnew as E | E | E | E | ; injection E as ← ← ; try contradiction

–intros E

subst base

eapply libc_handle_not_released ; exact proj1Hwi | left ; reflexivity | | exact Hin

rewrite Hout

exact proj1Howf

–intros E

subst base

eapply libc_handle_not_released ; exact proj1Hwi | right ; reflexivity | | exact Hin

rewrite Herr

exact proj1Hewf

Recording open-only permissions uses the same private/release frame as exact entry, but never installs an exact pending/FIFO observation.

212Lemma permission_entry_frame

∀ rep out err b o m w h

agreesm h

stream_tokens_wirep out err b o m w h

∃info, libc_stream_atw token_handleout = Someinfo

∃info, libc_stream_atw token_handleerr = Someinfo

let h′ ≔ overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h in

agreesm h′ ∧ stream_tokens_wirep out err b o m w h′

Proof 57 steps Qed

intros rep out err b o m w h Ha Howf & Hewf & Hbase & Hkey & Hout & Herr & _ & _ & Hprivate Hol Hel Hoo Heo h′

assert Hdata : memory_keys_fromstream_data_heaptoken_baseout token_baseerr h' stream_data_heaptoken_baseout token_baseerr h

{intros l v Hl Hmem

apply stream_data_lookup in Hl as Hl & Hno & Hne

unfold h' in Hl

apply lookup_overwrite in Hl as Hin | _ Hold

–apply list_elem_of_In in Hin

cbn [ open_permission_ps app ] in Hin

destruct Hin as E | E | E | E | ; injection E as ← ← ; contradiction

–exists v

rewrite stream_data_lookup_ne ; assumption

split

{intros l v Hl

unfold h' in Hl

apply lookup_overwrite in Hl as Hin | _ Hold ; | exact Hal v Hold

apply list_elem_of_In in Hin

cbn [ open_permission_ps app ] in Hin

destruct Hin as E | E | E | E | ; injection E as ← ← ; cbn [ agree_piece ] ; assumption || exact I

split ; exact Howf |

split ; exact Hewf |

split ; exact Hbase |

split ; exact Hkey |

split ; exact Hout |

split ; exact Herr |

split

{unfold stream_current , h'

cbn [ open_permission_ps app overwrite fst snd ]

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_eq

exact conjeq_refl Hoo

split

{unfold stream_current , h'

cbn [ open_permission_ps app overwrite fst snd ]

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_ne ; | congruence

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_eq

exact conjeq_refl Heo

intros d Hd

destruct Hprivated Hd as Hwi Hrel

split ; eapply errno_wi_heap ; eauto |

intros base l v Hin Hl Hmem

unfold h' in Hl

apply lookup_overwrite in Hl as Hnew | _ Hold ; | exact Hrelbase l v Hin Hold Hmem

apply list_elem_of_In in Hnew

cbn [ open_permission_ps app ] in Hnew

destruct Hnew as E | E | E | E | ; injection E as ← ← ; try contradiction

–intros E

subst base

eapply libc_handle_not_released ; exact proj1Hwi | left ; reflexivity | | exact Hin

rewrite Hout

exact proj1Howf

–intros E

subst base

eapply libc_handle_not_released ; exact proj1Hwi | right ; reflexivity | | exact Hin

rewrite Herr

exact proj1Hewf

Updating an unrelated ghost name changes no memory keys or stream lookups. Full-heap release separation remains intact.

261Lemma stream_tokens_name_update

∀ rep out err b o m w h key value

key ≠ token_keyout

key ≠ token_keyerr

stream_tokens_wirep out err b o m w h

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

Explore proof 28 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop out err : stream_token b o : Z m : mem w : libc_world h : gmappiece pval key : Z value : pval, key ≠ token_keyout → key ≠ token_keyerr → stream_tokens_wirep out err b o m w h → stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

intros rep out err b o m w h key value Hko Hke Howf & Hewf & Hbase & Hkey & Hout & Herr & Ho & He & Hprivate

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

assert Hmem : memory_keys_from<[PNamekey ≔ value]>h h

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

memory_keys_from<[PNamekey ≔ value]>h h

focused goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

{intros l v Hl Hmem

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

l :

v :

Hl :

<[PNamekey ≔ value]>h !! l = Somev

Hmem :

⊢

∃old : pval, h !! l = Someold

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

apply lookup_insert_Some in Hl as E _ | _ Hold ; subst l ; contradiction | eauto

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

assert Hdata : memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

⊢

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

focused goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

{intros l v Hl Hm

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

l :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h !! l = Somev

Hm :

⊢

∃old : pval, stream_data_heaptoken_baseout token_baseerr h !! l = Someold

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

apply stream_data_lookup in Hl as Hl & Hno & Hne

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

l :

v :

Hl :

<[PNamekey ≔ value]>h !! l = Somev

Hno :

l ≠ PLivetoken_baseout

Hne :

l ≠ PLivetoken_baseerr

Hm :

⊢

∃old : pval, stream_data_heaptoken_baseout token_baseerr h !! l = Someold

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

destruct Hmeml v Hl Hm as old Hold

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

l :

v :

Hl :

<[PNamekey ≔ value]>h !! l = Somev

Hno :

l ≠ PLivetoken_baseout

Hne :

l ≠ PLivetoken_baseerr

Hm :

old :

Hold :

h !! l = Someold

⊢

∃old₀ : pval, stream_data_heaptoken_baseout token_baseerr h !! l = Someold₀

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

exists old

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

l :

v :

Hl :

<[PNamekey ≔ value]>h !! l = Somev

Hno :

l ≠ PLivetoken_baseout

Hne :

l ≠ PLivetoken_baseerr

Hm :

old :

Hold :

h !! l = Someold

⊢

stream_data_heaptoken_baseout token_baseerr h !! l = Someold

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

rewrite stream_data_lookup_ne ; assumption

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_tokens_wirep out err b o m w <[PNamekey ≔ value]>h

split ; exact Howf |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

token_wferr ∧ token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w <[PNamekey ≔ value]>h ∧ stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split ; exact Hewf |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w <[PNamekey ≔ value]>h ∧ stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split ; exact Hbase |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w <[PNamekey ≔ value]>h ∧ stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split ; exact Hkey |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w <[PNamekey ≔ value]>h ∧ stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split ; exact Hout |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

libc_stderrw = token_handleerr ∧ stream_currentout w <[PNamekey ≔ value]>h ∧ stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split ; exact Herr |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_currentout w <[PNamekey ≔ value]>h ∧ stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_currentout w <[PNamekey ≔ value]>h

focused goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_currenterr w <[PNamekey ≔ value]>h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

{unfold stream_current in *

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

match h !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

He :

match h !! PNametoken_keyerr with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

match <[PNamekey ≔ value]>h !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

rewrite lookup_insert_ne ; exact Ho | congruence

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

split

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

stream_currenterr w <[PNamekey ≔ value]>h

focused goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

{unfold stream_current in *

2 open

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

match h !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

He :

match h !! PNametoken_keyerr with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

match <[PNamekey ≔ value]>h !! PNametoken_keyerr with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

rewrite lookup_insert_ne ; exact He | congruence

deferred goal

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

⊢

intros d Hd

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

d :

Hd :

d = out ∨ d = err

⊢

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

destruct Hprivated Hd as Hwi Hrel

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrel :

⊢

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h ∧ ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

split ; eapply errno_wi_heap ; eauto |

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrel :

⊢

ids_apartlibc_stream_releasesw token_handled <[PNamekey ≔ value]>h

intros base l v Hin Hl Hm

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrel :

base :

l :

v :

Hin :

Inbase libc_stream_releasesw token_handled

Hl :

<[PNamekey ≔ value]>h !! l = Somev

Hm :

⊢

piece_idl ≠ base

destruct Hmeml v Hl Hm as old Hold

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

key :

value :

Hko :

key ≠ token_keyout

Hke :

key ≠ token_keyerr

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hmem :

memory_keys_from<[PNamekey ≔ value]>h h

Hdata :

memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrel :

base :

l :

v :

Hin :

Inbase libc_stream_releasesw token_handled

Hl :

<[PNamekey ≔ value]>h !! l = Somev

Hm :

old :

Hold :

h !! l = Someold

⊢

piece_idl ≠ base

exact Hrelbase l old Hin Hold Hm

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep out err b o m w h key value Hko Hke Howf & Hewf & Hbase & Hkey & Hout & Herr & Ho & He & Hprivate

assert Hmem : memory_keys_from<[PNamekey ≔ value]>h h

{intros l v Hl Hmem

apply lookup_insert_Some in Hl as E _ | _ Hold ; subst l ; contradiction | eauto

assert Hdata : memory_keys_fromstream_data_heaptoken_baseout token_baseerr <[PNamekey ≔ value]>h stream_data_heaptoken_baseout token_baseerr h

{intros l v Hl Hm

apply stream_data_lookup in Hl as Hl & Hno & Hne

destruct Hmeml v Hl Hm as old Hold

exists old

rewrite stream_data_lookup_ne ; assumption

split ; exact Howf |

split ; exact Hewf |

split ; exact Hbase |

split ; exact Hkey |

split ; exact Hout |

split ; exact Herr |

split

{unfold stream_current in *

rewrite lookup_insert_ne ; exact Ho | congruence

split

{unfold stream_current in *

rewrite lookup_insert_ne ; exact He | congruence

intros d Hd

destruct Hprivated Hd as Hwi Hrel

split ; eapply errno_wi_heap ; eauto |

intros base l v Hin Hl Hm

destruct Hmeml v Hl Hm as old Hold

exact Hrelbase l old Hin Hold Hm

287Section snapshot_allocation

288Context `{!gen_heapGSpiece pval Σ}

290Lemma permission_entry_alloc

∀ rep out err b o m w h

agreesm h

stream_tokens_wirep out err b o m w h

∃info, libc_stream_atw token_handleout = Someinfo

∃info, libc_stream_atw token_handleerr = Someinfo

∀l v, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

gen_heap_interph ⇛ gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∗ ptsopen_permission_psout token_handleout ∗ ptsopen_permission_pserr token_handleerr ∗ ⌜agreesm overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∧ stream_tokens_wirep out err b o m w overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h⌝

Explore proof 14 tactics

Initial goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

⊢

agreesm h → stream_tokens_wirep out err b o m w h → live_atm token_baseout token_regionout → live_atm token_baseerr token_regionerr → ∃info : stream_info, libc_stream_atw token_handleout = Someinfo → ∃info : stream_info, libc_stream_atw token_handleerr = Someinfo → ∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None → gen_heap_interph ⇛ gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∗ ptsopen_permission_psout token_handleout ∗ ptsopen_permission_pserr token_handleerr ∗ ⌜agreesm overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∧ stream_tokens_wirep out err b o m w overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h⌝

intros Ha Hw Hol Hel Hoo Heo Hfresh

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

⊢

iIntros Hh

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Hh :

gen_heap_interph

∗

|⇛ gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∗ ptsopen_permission_psout token_handleout ∗ ptsopen_permission_pserr token_handleerr ∗ ⌜agreesm overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∧ stream_tokens_wirep out err b o m w overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h⌝

destruct Hw as Howf & Hewf & Hbase & Hkey & Hrest eqn: E

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interph

∗

iMod pts_alloch open_permission_psout token_handleout ++ open_permission_pserr token_handleerr with Hh as [Hh Hps]

3 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

base.NoDupopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr.*1

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Hps :

ptsopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr

∗

–clear - Hbase Hkey

3 open

out, err :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

⊢

base.NoDupopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr.*1

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Hps :

ptsopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr

∗

cbn [ open_permission_ps app fmap fst ]

3 open

out, err :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

⊢

base.NoDuplist_fmappiece × pval%type piece fst PLivetoken_baseout, VLivetoken_regionout :: PNametoken_keyout, VStreamOpentoken_handleout :: open_permission_pserr token_handleerr

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Hps :

ptsopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr

∗

repeat constructor ; set_solver

2 open

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Hps :

ptsopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr

∗

–exact Hfresh

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Hps :

ptsopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr

∗

–rewrite pts_app

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Hps :

ptsopen_permission_psout token_handleout ∗ ptsopen_permission_pserr token_handleerr

∗

iDestruct Hps as [Ho He]

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Ho :

ptsopen_permission_psout token_handleout

He :

ptsopen_permission_pserr token_handleerr

∗

iModIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

Ho :

ptsopen_permission_psout token_handleout

He :

ptsopen_permission_pserr token_handleerr

∗

gen_heap_interpoverwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∗ ptsopen_permission_psout token_handleout ∗ ptsopen_permission_pserr token_handleerr ∗ ⌜agreesm overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∧ stream_tokens_wirep out err b o m w overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h⌝

iFrame

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

∗

⌜agreesm overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∧ stream_tokens_wirep out err b o m w overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h⌝

iPureIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

∃info : stream_info, libc_stream_atw token_handleout = Someinfo

Heo :

∃info : stream_info, libc_stream_atw token_handleerr = Someinfo

Hfresh :

∀l : piece v : pval, l, v ∈ open_permission_psout token_handleout ++ open_permission_pserr token_handleerr → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

agreesm overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h ∧ stream_tokens_wirep out err b o m w overwriteopen_permission_psout token_handleout ++ open_permission_pserr token_handleerr h

eapply permission_entry_frame ; eauto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Ha Hw Hol Hel Hoo Heo Hfresh

iIntros Hh

destruct Hw as Howf & Hewf & Hbase & Hkey & Hrest eqn: E

iMod pts_alloch open_permission_psout token_handleout ++ open_permission_pserr token_handleerr with Hh as [Hh Hps]

–clear - Hbase Hkey

cbn [ open_permission_ps app fmap fst ]

repeat constructor ; set_solver

–exact Hfresh

–rewrite pts_app

iDestruct Hps as [Ho He]

iModIntro

iFrame

iPureIntro

eapply permission_entry_frame ; eauto

Fresh ghost recording is not native allocation: both live_at facts and both current observations are independent premises. Freshness is against the authoritative heap, so no existing life is duplicated.

320Lemma stream_entry_alloc

∀ rep out err b o m w h op oq ep eq

agreesm h

stream_tokens_wirep out err b o m w h

stream_observationw token_handleout Someop, oq

stream_observationw token_handleerr Someep, eq

∀l v, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

gen_heap_interph ⇛ gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h ∗ ptsstream_psout op oq ∗ ptsstream_pserr ep eq ∗ ⌜agreesm overwritestream_psout op oq ++ stream_pserr ep eq h ∧ stream_tokens_wirep out err b o m w overwritestream_psout op oq ++ stream_pserr ep eq h⌝

Explore proof 14 tactics

Initial goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

⊢

agreesm h → stream_tokens_wirep out err b o m w h → live_atm token_baseout token_regionout → live_atm token_baseerr token_regionerr → stream_observationw token_handleout Someop, oq → stream_observationw token_handleerr Someep, eq → ∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None → gen_heap_interph ⇛ gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h ∗ ptsstream_psout op oq ∗ ptsstream_pserr ep eq ∗ ⌜agreesm overwritestream_psout op oq ++ stream_pserr ep eq h ∧ stream_tokens_wirep out err b o m w overwritestream_psout op oq ++ stream_pserr ep eq h⌝

intros Ha Hw Hol Hel Hoo Heo Hfresh

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

⊢

iIntros Hh

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Hh :

gen_heap_interph

∗

|⇛ gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h ∗ ptsstream_psout op oq ∗ ptsstream_pserr ep eq ∗ ⌜agreesm overwritestream_psout op oq ++ stream_pserr ep eq h ∧ stream_tokens_wirep out err b o m w overwritestream_psout op oq ++ stream_pserr ep eq h⌝

destruct Hw as Howf & Hewf & Hbase & Hkey & Hrest eqn: E

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interph

∗

iMod pts_alloch stream_psout op oq ++ stream_pserr ep eq with Hh as [Hh Hps]

3 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

base.NoDupstream_psout op oq ++ stream_pserr ep eq.*1

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Hps :

ptsstream_psout op oq ++ stream_pserr ep eq

∗

–clear - Hbase Hkey

3 open

out, err :

op :

oq :

listZ

ep :

eq :

listZ

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

⊢

base.NoDupstream_psout op oq ++ stream_pserr ep eq.*1

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Hps :

ptsstream_psout op oq ++ stream_pserr ep eq

∗

cbn [ stream_ps app fmap fst ]

3 open

out, err :

op :

oq :

listZ

ep :

eq :

listZ

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

⊢

base.NoDuplist_fmappiece × pval%type piece fst PLivetoken_baseout, VLivetoken_regionout :: PNametoken_keyout, VStreamtoken_handleout Someop, oq :: stream_pserr ep eq

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Hps :

ptsstream_psout op oq ++ stream_pserr ep eq

∗

repeat constructor ; set_solver

2 open

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Hps :

ptsstream_psout op oq ++ stream_pserr ep eq

∗

–exact Hfresh

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Hps :

ptsstream_psout op oq ++ stream_pserr ep eq

∗

–rewrite pts_app

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Hps :

ptsstream_psout op oq ∗ ptsstream_pserr ep eq

∗

iDestruct Hps as [Ho He]

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Ho :

ptsstream_psout op oq

He :

ptsstream_pserr ep eq

∗

iModIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

Hh :

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h

Ho :

ptsstream_psout op oq

He :

ptsstream_pserr ep eq

∗

gen_heap_interpoverwritestream_psout op oq ++ stream_pserr ep eq h ∗ ptsstream_psout op oq ∗ ptsstream_pserr ep eq ∗ ⌜agreesm overwritestream_psout op oq ++ stream_pserr ep eq h ∧ stream_tokens_wirep out err b o m w overwritestream_psout op oq ++ stream_pserr ep eq h⌝

iFrame

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

∗

⌜agreesm overwritestream_psout op oq ++ stream_pserr ep eq h ∧ stream_tokens_wirep out err b o m w overwritestream_psout op oq ++ stream_pserr ep eq h⌝

iPureIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

rep :

mem → libc_world → Prop

out, err :

b, o :

m :

w :

h :

gmappiece pval

op :

oq :

listZ

ep :

eq :

listZ

Ha :

agreesm h

Hw :

stream_tokens_wirep out err b o m w h

Hol :

Hel :

Hoo :

stream_observationw token_handleout Someop, oq

Heo :

stream_observationw token_handleerr Someep, eq

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout op oq ++ stream_pserr ep eq → h !! l = None

Howf :

Hewf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hrest :

E :

Hw = conjHowf conjHewf conjHbase conjHkey Hrest

⊢

agreesm overwritestream_psout op oq ++ stream_pserr ep eq h ∧ stream_tokens_wirep out err b o m w overwritestream_psout op oq ++ stream_pserr ep eq h

eapply stream_entry_frame ; eauto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Ha Hw Hol Hel Hoo Heo Hfresh

iIntros Hh

destruct Hw as Howf & Hewf & Hbase & Hkey & Hrest eqn: E

iMod pts_alloch stream_psout op oq ++ stream_pserr ep eq with Hh as [Hh Hps]

–clear - Hbase Hkey

cbn [ stream_ps app fmap fst ]

repeat constructor ; set_solver

–exact Hfresh

–rewrite pts_app

iDestruct Hps as [Ho He]

iModIntro

iFrame

iPureIntro

eapply stream_entry_frame ; eauto

Callback entry allocates the reserved snapshot key, while retaining an already owned life piece. Neither the life nor a fresh ghost resource can be fabricated by the pure interpretation.

346Lemma stream_snapshot_alloc

∀ d pending fifo w h

h !! PNametoken_keyd = None

stream_observationw token_handled Somepending, fifo

gen_heap_interph ∗ ptsPLivetoken_based, VLivetoken_regiond ⇛ gen_heap_interp<[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h ∗ ptsstream_psd pending fifo ∗ ⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

Explore proof 13 tactics

Initial goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

⊢

h !! PNametoken_keyd = None → stream_observationw token_handled Somepending, fifo → gen_heap_interph ∗ ptsPLivetoken_based, VLivetoken_regiond ⇛ gen_heap_interp<[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h ∗ ptsstream_psd pending fifo ∗ ⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

intros Hfresh Hobs

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

⊢

iIntros [Hh Hlife]

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hh :

gen_heap_interph

Hlife :

∗

|⇛ gen_heap_interp<[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h ∗ ptsstream_psd pending fifo ∗ ⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

iMod gen_heap_alloc_ PNametoken_keyd VStreamtoken_handled Somepending, fifo with Hh as (Hh & Hname & _) ; exact Hfresh |

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hlife :

Hh :

gen_heap_interp<[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h

Hname :

pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo

∗

iModIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hlife :

Hh :

gen_heap_interp<[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h

Hname :

pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo

∗

gen_heap_interp<[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h ∗ ptsstream_psd pending fifo ∗ ⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

iSplitL Hh ; iExact Hh |

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hlife :

Hname :

pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo

∗

ptsstream_psd pending fifo ∗ ⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

iSplitL Hlife Hname

2 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hlife :

Hname :

pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo

∗

ptsstream_psd pending fifo

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

∗

⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

–rewrite / stream_ps / pts /=

2 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hlife :

pointstoPLivetoken_based DfracOwn1 VLivetoken_regiond ∗ emp

Hname :

pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo

∗

pointstoPLivetoken_based DfracOwn1 VLivetoken_regiond ∗ pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo ∗ emp

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

∗

⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

iDestruct Hlife as [Hlife _]

2 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

Hlife :

pointstoPLivetoken_based DfracOwn1 VLivetoken_regiond

Hname :

pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo

∗

pointstoPLivetoken_based DfracOwn1 VLivetoken_regiond ∗ pointstoPNametoken_keyd DfracOwn1 VStreamtoken_handled Somepending, fifo ∗ emp

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

∗

⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

iFrame

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

∗

⌜stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h⌝

–iPureIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

⊢

stream_currentd w <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h

unfold stream_current

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

⊢

match <[PNametoken_keyd ≔ VStreamtoken_handled Somepending, fifo]>h !! PNametoken_keyd with

SomeVStreamp snapshot

⇒

p = token_handled ∧ stream_observationw p snapshot

SomeVStreamOpenp

⇒

p = token_handled ∧ ∃info : stream_info, libc_stream_atw p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_eq

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

d :

pending :

fifo :

listZ

w :

h :

gmappiece pval

Hfresh :

h !! PNametoken_keyd = None

Hobs :

stream_observationw token_handled Somepending, fifo

⊢

token_handled = token_handled ∧ stream_observationw token_handled Somepending, fifo

exact conjeq_refl Hobs

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Hfresh Hobs

iIntros [Hh Hlife]

iMod gen_heap_alloc_ PNametoken_keyd VStreamtoken_handled Somepending, fifo with Hh as (Hh & Hname & _) ; exact Hfresh |

iModIntro

iSplitL Hh ; iExact Hh |

iSplitL Hlife Hname

–rewrite / stream_ps / pts /=

iDestruct Hlife as [Hlife _]

iFrame

–iPureIntro

unfold stream_current

rewrite lookup_insert_eq

exact conjeq_refl Hobs

The other registered stream keeps its observable state and private inventory. Distinct addresses rule out stdout-priority aliasing.

367Lemma stream_other_frame

∀ p q w w′

p = libc_stdoutw ∧ q = libc_stderrw ∨ p = libc_stderrw ∧ q = libc_stdoutw

ptr_addrlibc_stdoutw ≠ ptr_addrlibc_stderrw

libc_stream_framep w w′

libc_file_atw′ q = libc_file_atw q ∧ libc_stream_atw′ q = libc_stream_atw q ∧ libc_stream_statew′ q = libc_stream_statew q

Proof 38 steps Qed

intros p q w w′ Hwhich Hdistinct Hout & Herr & _ & _ & _ & _ & _ & _ & Hother

assert Hne : same_filelibc_stderrw libc_stdoutw = false

{unfold same_file

apply andb_false_iff

left

apply Z.eqb_neq

congruence

destruct Hwhich as → → | → →

–rewrite same_file_refl in Hother

destruct Hother as Hfile & Hopen & Hstate

assert Hlookup : libc_file_atw' libc_stderrw = libc_file_atw libc_stderrw

{unfold libc_file_at

rewrite Hout Herr Hne same_file_refl Hopen Hfile

reflexivity

assert Hprotocol : libc_stream_statew' libc_stderrw = libc_stream_statew libc_stderrw

{unfold libc_stream_state

rewrite Hout Herr Hne same_file_refl Hstate

reflexivity

split ; exact Hlookup |

split ; | exact Hprotocol

unfold libc_stream_at

rewrite Hlookup Hout Hprotocol

reflexivity

–rewrite Hne in Hother

destruct Hother as Hfile & Hopen & Hstate

assert Hlookup : libc_file_atw' libc_stdoutw = libc_file_atw libc_stdoutw

{unfold libc_file_at

rewrite Hout same_file_refl Hopen Hfile

reflexivity

assert Hprotocol : libc_stream_statew' libc_stdoutw = libc_stream_statew libc_stdoutw

{unfold libc_stream_state

rewrite Hout same_file_refl Hstate

reflexivity

split ; exact Hlookup |

split ; | exact Hprotocol

unfold libc_stream_at

rewrite Hlookup Hout Hprotocol

reflexivity

397Module LibcStreamAdapterOn R : Runtime LG : StreamFrameLogicR

398Module M ≔ LG.L.M

399Module T ≔ LibcStreamTokensOn R LG

Query contracts permit no allocation; in particular delegation cannot add a newly born release identity to either FILE.

403Lemma effects_no_alloc

∀ sources roots releases s m born s′ m′ born′

M.E.effectssources roots releases λ_ _ ⇒ False s m born s′ m′ born′

born′ = born

Explore proof 2 tactics

Initial goal

⊢

∀sources roots : listspan releases : listZ s : R.state m : mem born : listZ s′ : R.state m′ : mem born′ : listZ, M.E.effectssources roots releases λ_ _ : Z ⇒ False s m born s′ m′ born′ → born′ = born

intros sources roots releases s m born s′ m′ born′ He

sources, roots :

listspan

releases :

listZ

s :

R.state

m :

born :

listZ

s′ :

R.state

m′ :

born′ :

listZ

He :

M.E.effectssources roots releases λ_ _ : Z ⇒ False s m born s′ m′ born′

⊢

born′ = born

induction He ; reflexivity | exact IHHe | contradiction

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros sources roots releases s m born s′ m′ born′ He

induction He ; reflexivity | exact IHHe | contradiction

Both mirrors and both private-memory frames survive either query. No unchanged-memory premise rules out the native locking writes.

413Theorem query_frame

∀ rep requests wide out err b o d spec r args s m w trace ending s′ m′ w′ h

d = out ∨ d = err

spec = ferror_contractlibc_stream_modelrep requests wide ∨ spec = fpending_contractlibc_stream_modelrep requests wide

M.E.invokespec r args WPtrtoken_handled s m w trace ending s′ m′ w′

agreesm h

live_disjointm

R.readys m

stream_tokens_wirep out err b o m w h

agreesm′ h ∧ live_disjointm′ ∧ R.readys′ m′ ∧ stream_tokens_wirep out err b o m′ w′ h

Proof 65 steps Qed

intros rep requests wide out err b o d spec r args s m w trace ending s′ m′ w′ h Hd Hspec Hcall Ha Hdis Hr Houtwf & Herrwf & Hbase & Hkey & Hout & Herr & Houtcurrent & Herrcurrent & Hprivate

destruct Hprivated Hd as Hselected Hrelease

destruct T.query_framerep requests wide token_baseout token_baseerr token_handled b o spec r args s m w trace ending s' m' w' h Hspec Hcall Ha Hdis Hr Hselected as Ha′ & Hdis′ & Hr′ & Hselected′

split ; exact Ha' |

split ; exact Hdis' |

split ; exact Hr' |

destruct M.E.invoke_prefix_ _ _ _ _ _ _ _ _ _ _ _ _ Hcall as born & Hp

destruct M.E.prefix_preserve_ _ _ _ _ _ _ _ _ _ _ Hp Hr as _ Hpers

assert Hborn : born = [ ]

{destruct Hp as He _

destruct Hspec as → | → ; eapply effects_no_alloc ; exact He

subst born

assert Hprefix : query_prefixlibc_stream_modelrep requests wide WPtrtoken_handled m w [ ] trace m' w'

{destruct Hspec as → | → ; exact proj2Hp

destruct Hprefix as p & info & Hxs & Hinfo & Hopen & Hframe & Hdelegate & _

injection Hxs as ←

cbn [ stream_open stream_at stream_state_at stream_rep libc_stream_model ] in Hinfo , Hopen

assert Hready′ := proj1Hopen

assert Hdistinct : ptr_addrlibc_stdoutw ≠ ptr_addrlibc_stderrw

{destruct proj1Hselected as _ & _ & _ & _ & _ & _ & _ & _ & Hdistinct & _

exact Hdistinct

assert Hother : ∀q, q = out ∨ q = err → q ≠ d → libc_file_atw' token_handleq = libc_file_atw token_handleq ∧ libc_stream_atw' token_handleq = libc_stream_atw token_handleq ∧ libc_stream_statew' token_handleq = libc_stream_statew token_handleq

{intros q Hq Hne

apply stream_other_frame with p := token_handled ; | exact Hdistinct | exact Hframe

destruct Hd as → | → ; destruct Hq as → | → ; try contradiction ; left | right ; split ; congruence

assert Hchoice : ∀q, q = out ∨ q = err → q = d ∨ q ≠ d

{intros q Hq

destruct Hd as → | → ; destruct Hq as → | → ; try left ; reflexivity ; right ; intros Heq ; apply Hbase ; congruence

assert Hviews : ∀q, q = out ∨ q = err → libc_stream_atw' token_handleq = libc_stream_atw token_handleq ∧ libc_stream_statew' token_handleq = libc_stream_statew token_handleq

{intros q Hq

destruct Hchoiceq Hq as [ ->| Hne ]

–split ; rewrite Hinfo ; exact proj1proj2Hopen |

pose proof proj1proj2proj2Hopen as Hprotocol

change stream_protocolinfo = libc_stream_statew' token_handled in Hprotocol

rewrite <- Hprotocol

unfold libc_stream_at in Hinfo

destruct libc_file_atw token_handled ; injection Hinfo as ← ; reflexivity | discriminate

–exact proj2Hotherq Hq Hne

assert Hcurrent : ∀q, q = out ∨ q = err → stream_currentq w' h

{intros q Hq

assert Hc : stream_currentq w h by destruct Hq as → | → ; assumption

destruct Hviewsq Hq as Hlookup Hstate

eapply stream_current_views ; eauto

split ; exact Houtwf |

split ; exact Herrwf |

split ; exact Hbase |

split ; exact Hkey |

split ; rewrite proj1Hframe ; exact Hout |

split ; rewrite proj1proj2Hframe ; exact Herr |

split ; apply Hcurrent ; left ; reflexivity |

split ; apply Hcurrent ; right ; reflexivity |

intros q Hq

destruct Hchoiceq Hq as [ ->| Hne ]

–split ; exact Hselected' |

intros base l v Hin Hl Hmem

destruct proj2proj2Hdelegate base Hin as Hold | Hnil ; exact Hreleasebase l v Hold Hl Hmem | contradiction

–destruct Hotherq Hq Hne as Hfile _

destruct Hprivateq Hq as Hwi Hrel

assert Hroots : libc_stream_aux_rootsw' token_handleq = libc_stream_aux_rootsw token_handleq by unfold libc_stream_aux_roots ; rewrite Hfile ; reflexivity

assert Hrels : libc_stream_releasesw' token_handleq = libc_stream_releasesw token_handleq by unfold libc_stream_releases ; rewrite Hfile ; reflexivity

split ; | rewrite Hrels ; exact Hrel

+apply stream_data_agrees

exact Ha

+exact proj1proj2proj2proj2Hframe

Only an ordinary return establishes completed closure. Sample all four endpoint errno bytes, update the selected name, and retain the opposite snapshot and both native lives. This is a pure heap frame; updating an owned name in Iris still requires its points-to resource.

494Theorem close_frame

∀ rep requests wide out err b o d r args s m w trace values s′ m′ w′ h xs

d = out ∨ d = err

M.E.invokefclose_contractlibc_stream_modelrep requests wide r args WPtrtoken_handled s m w trace CallReturnvalues s′ m′ w′

agreesm h

live_disjointm

R.readys m

stream_tokens_wirep out err b o m w h

lengthxs = 4%nat

∀l v, l, v ∈ byte_psb o xs → h !! l = Somev

∃ys, lengthys = 4%nat ∧ byte_psb o ys.*1 = byte_psb o xs.*1 ∧ agreesm′ <[PNametoken_keyd ≔ VStreamtoken_handled None]>overwritebyte_psb o ys h ∧ live_disjointm′ ∧ R.readys′ m′ ∧ stream_tokens_wirep out err b o m′ w′ <[PNametoken_keyd ≔ VStreamtoken_handled None]>overwritebyte_psb o ys h

Proof 118 steps Qed

intros rep requests wide out err b o d r args s m w trace values s′ m′ w′ h xs Hd Hcall Ha Hdis Hr Houtwf & Herrwf & Hbase & Hkey & Hout & Herr & Houtcurrent & Herrcurrent & Hprivate Hlen Howned

destruct Hprivated Hd as Hselected Hrelease

destruct T.close_framerep requests wide token_baseout token_baseerr token_handled b o r args s m w trace CallReturnvalues s' m' w' h xs ltac:rewrite Hout ; exact proj1Houtwf ltac:rewrite Herr ; exact proj1Herrwf Hcall Ha Hdis Hr Hselected Hlen Howned as ys & Hys & Hkeys & Ha′ & Hdis′ & Hr′ & Hselected′

set h₀ := overwritebyte_psb o ys h in *

set h₁ := <[PNametoken_keyd ≔ VStreamtoken_handled None]>h0

assert Hkeys₀ : memory_keys_fromh0 h

{intros l v Hl Hmem

unfold h0 in Hl

destruct lookup_overwrite_ _ _ _ Hl as Hin | _ Hold ; | eauto

assert Hkey₀ : l ∈ byte_psb o xs.*1

{rewrite <- Hkeys

apply list_elem_of_fmap

exists l, v

auto

apply list_elem_of_fmap in Hkey0 as l₀ old & E & Hinold

simpl in E

subst l0

exists old

exact Hownedl old Hinold

assert Hkeys₁ : memory_keys_fromh1 h0

{intros l v Hl Hmem

unfold h1 in Hl

apply lookup_insert_Some in Hl as He Hv | _ Hold ; subst l ; contradiction | eauto

assert Hdata₁ : memory_keys_fromstream_data_heaptoken_baseout token_baseerr h1 stream_data_heaptoken_baseout token_baseerr h0

{intros l v Hl Hmem

apply stream_data_lookup in Hl as Hl & Hno & Hne

destruct Hkeys1l v Hl Hmem as old Hold

exists old

rewrite stream_data_lookup_ne ; assumption

assert Hdata₀ : memory_keys_fromstream_data_heaptoken_baseout token_baseerr h1 stream_data_heaptoken_baseout token_baseerr h

{intros l v Hl Hmem

apply stream_data_lookup in Hl as Hl & Hno & Hne

destruct Hkeys1l v Hl Hmem as old Hold

destruct Hkeys0l old Hold Hmem as entry Hentry

exists entry

rewrite stream_data_lookup_ne ; assumption

exists ys

split ; exact Hys |

split ; exact Hkeys |

split

{intros l v Hl

unfold h1 in Hl

apply lookup_insert_Some in Hl as He Hv | _ Hold ; subst l v ; exact I | exact Ha'l v Hold

split ; exact Hdis' |

split ; exact Hr' |

destruct M.E.invoke_prefix_ _ _ _ _ _ _ _ _ _ _ _ _ Hcall as born & Hp

destruct M.E.prefix_preserve_ _ _ _ _ _ _ _ _ _ _ Hp Hr as _ Hpers

destruct Hp as _ & p & info & final & Hxs & _ & _ & _ & Hready′ & Hframe & _

injection Hxs as ←

destruct T.EL.S.fclose_invocation_ _ _ _ _ _ _ _ _ _ _ _ _ Hcall as born₀ & p & info₀ & final₀ & n & Hxs & _ & Hsettle & Hstate & _ & Hclosed & _ | why & Hbad & _ ; | discriminate Hbad

injection Hxs as ←

change libc_stream_atw' token_handled = None in Hclosed

assert Hfifo : outstandinglibc_stream_statew' token_handled = [ ]

{change libc_stream_statew' token_handled = final0 in Hstate

rewrite Hstate

eapply stream_settlement_complete ; exact Hsettle

assert Hdistinct : ptr_addrlibc_stdoutw ≠ ptr_addrlibc_stderrw

{destruct proj1Hselected as _ & _ & _ & _ & _ & _ & _ & _ & Hdistinct & _

exact Hdistinct

assert Hchoice : ∀q, q = out ∨ q = err → q = d ∨ q ≠ d

{intros q Hq

destruct Hd as → | → ; destruct Hq as → | → ; try left ; reflexivity ; right ; intros Heq ; apply Hbase ; congruence

{intros q Hq Hne

apply stream_other_frame with p := token_handled ; | exact Hdistinct | exact Hframe

destruct Hd as → | → ; destruct Hq as → | → ; try contradiction ; left | right ; split ; congruence

assert Hcurrent : ∀q, q = out ∨ q = err → stream_currentq w' h1

{intros q Hq

destruct Hchoiceq Hq as [ ->| Hne ]

–unfold stream_current , h1

rewrite lookup_insert_eq

exact conjeq_refl conjHclosed Hfifo

–assert Hkeyne : token_keyd ≠ token_keyq

{destruct Hd as → | → ; destruct Hq as → | → ; congruence

assert Hc : stream_currentq w h by destruct Hq as → | → ; assumption

destruct Hotherq Hq Hne as _ & Hlookup & Hprotocol

pose proof stream_current_viewsq w w' h Hlookup Hprotocol Hc as Hafter

unfold stream_current in Hafter |- *

unfold h1

rewrite lookup_insert_ne ; | congruence

unfold h0

rewrite overwrite_out

+exact Hafter

+rewrite byte_ps_keys

intros Hin

apply list_elem_of_fmap in Hin as i & E & _

discriminate E

split ; exact Houtwf |

split ; exact Herrwf |

split ; exact Hbase |

split ; exact Hkey |

split ; rewrite proj1Hframe ; exact Hout |

split ; rewrite proj1proj2Hframe ; exact Herr |

split ; apply Hcurrent ; left ; reflexivity |

split ; apply Hcurrent ; right ; reflexivity |

intros q Hq

destruct Hchoiceq Hq as [ ->| Hne ]

–split ; eapply errno_wi_heap ; exact Hselected' | exact Hdata1 |

unfold libc_stream_at in Hclosed

unfold libc_stream_releases

destruct libc_file_atw' token_handled ; discriminate Hclosed |

intros base l v Hin

contradiction

–destruct Hotherq Hq Hne as Hfile _

destruct Hprivateq Hq as Hwi Hrel

assert Hroots : libc_stream_aux_rootsw' token_handleq = libc_stream_aux_rootsw token_handleq by unfold libc_stream_aux_roots ; rewrite Hfile ; reflexivity

assert Hrels : libc_stream_releasesw' token_handleq = libc_stream_releasesw token_handleq by unfold libc_stream_releases ; rewrite Hfile ; reflexivity

split

+eapply errno_wi_heap ; | exact Hdata0

∗apply stream_data_agrees

exact Ha

∗exact proj1proj2proj2proj2Hframe

+rewrite Hrels

intros base l v Hin Hl Hmem

destruct Hkeys1l v Hl Hmem as old Hold

destruct Hkeys0l old Hold Hmem as entry Hentry

exact Hrelbase l entry Hin Hentry Hmem

Token ownership plus the current world interpretation admits the concrete libc call; openness is not another consumer assumption.

616Theorem open_admitted

∀ rep requests wide out err b o d pending fifo m w h

d = out ∨ d = err

stream_tokens_wirep out err b o m w h

∀l v, l, v ∈ stream_psd pending fifo → h !! l = Somev

stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

Explore proof 6 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop requests : libc_world → ptr → Z → Z → Prop wide : libc_world → ptr → stream_state → stream_state → bool → Prop out err : stream_token b o : Z d : stream_token pending : Z fifo : listZ m : mem w : libc_world h : gmappiece pval, d = out ∨ d = err → stream_tokens_wirep out err b o m w h → ∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev → stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

intros rep requests wide out err b o d pending fifo m w h Hd _ & _ & _ & _ & _ & _ & Hout & Herr & Hprivate Howned

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

d :

pending :

fifo :

listZ

m :

w :

h :

gmappiece pval

Hd :

d = out ∨ d = err

Hout :

stream_currentout w h

Herr :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

pose proof proj1proj1Hprivated Hd as Hready

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

d :

pending :

fifo :

listZ

m :

w :

h :

gmappiece pval

Hd :

d = out ∨ d = err

Hout :

stream_currentout w h

Herr :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hready :

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

assert Hcurrent : stream_currentd w h by destruct Hd as → | → ; assumption

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

d :

pending :

fifo :

listZ

m :

w :

h :

gmappiece pval

Hd :

d = out ∨ d = err

Hout :

stream_currentout w h

Herr :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hready :

Hcurrent :

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

destruct stream_open_currentd w h pending fifo Hcurrent Howned as info & Hinfo & _

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

d :

pending :

fifo :

listZ

m :

w :

h :

gmappiece pval

Hd :

d = out ∨ d = err

Hout :

stream_currentout w h

Herr :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hready :

Hcurrent :

info :

Hinfo :

libc_stream_atw token_handled = Someinfo

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

unfold libc_stream_at in Hinfo

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

d :

pending :

fifo :

listZ

m :

w :

h :

gmappiece pval

Hd :

d = out ∨ d = err

Hout :

stream_currentout w h

Herr :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Howned :

∀l : piece v : pval, l, v ∈ stream_psd pending fifo → h !! l = Somev

Hready :

Hcurrent :

info :

Hinfo :

match libc_file_atw token_handled with

Somefile

⇒

Somestream_identifier ≔ if same_filetoken_handled libc_stdoutw then 1 else 2; stream_protocol ≔ libc_stream_statew token_handled; stream_pending ≔ file_pendingfile

None

⇒

None

Someinfo

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrtoken_handled m w

destruct libc_file_atw token_handled as file | eqn: Hfile ; eapply libc_stream_admitted ; eauto | discriminate

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep requests wide out err b o d pending fifo m w h Hd _ & _ & _ & _ & _ & _ & Hout & Herr & Hprivate Howned

pose proof proj1proj1Hprivated Hd as Hready

assert Hcurrent : stream_currentd w h by destruct Hd as → | → ; assumption

destruct stream_open_currentd w h pending fifo Hcurrent Howned as info & Hinfo & _

unfold libc_stream_at in Hinfo

destruct libc_file_atw token_handled as file | eqn: Hfile ; eapply libc_stream_admitted ; eauto | discriminate

This is pointer-universal admission from owned permission pieces, not an assumed choice of a registered handle.

632Theorem permission_admitted

∀ rep requests wide out err b o p m w h

stream_tokens_wirep out err b o m w h

∀l v, l, v ∈ permission_psout err p → h !! l = Somev

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

Explore proof 8 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop requests : libc_world → ptr → Z → Z → Prop wide : libc_world → ptr → stream_state → stream_state → bool → Prop out err : stream_token b o : Z p : ptr m : mem w : libc_world h : gmappiece pval, stream_tokens_wirep out err b o m w h → ∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev → stream_call_prelibc_stream_modelrep requests wide WPtrp m w

intros rep requests wide out err b o p m w h Hw Hl

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Hw :

stream_tokens_wirep out err b o m w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

pose proof permission_selectedout err p as Hd

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Hw :

stream_tokens_wirep out err b o m w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hd :

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

destruct Hw as _ & _ & _ & _ & _ & _ & Ho & He & Hprivate

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hd :

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

assert Hc : stream_currentpermission_descriptorout err p w h by destruct Hd as → | → ; assumption

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hd :

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

Hc :

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

destruct stream_permission_current_ _ _ _ Hc Hl as Hp info Hinfo

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hd :

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

Hc :

Hp :

info :

Hinfo :

libc_stream_atw p = Someinfo

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

pose proof proj1proj1Hprivate_ Hd as Hready

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hd :

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

Hc :

Hp :

info :

Hinfo :

libc_stream_atw p = Someinfo

Hready :

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

unfold libc_stream_at in Hinfo

rep :

mem → libc_world → Prop

requests :

libc_world → ptr → Z → Z → Prop

wide :

libc_world → ptr → stream_state → stream_state → bool → Prop

out, err :

b, o :

p :

m :

w :

h :

gmappiece pval

Ho :

stream_currentout w h

He :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err p → h !! l = Somev

Hd :

permission_descriptorout err p = out ∨ permission_descriptorout err p = err

Hc :

Hp :

info :

Hinfo :

match libc_file_atw p with

Somefile

⇒

Somestream_identifier ≔ if same_filep libc_stdoutw then 1 else 2; stream_protocol ≔ libc_stream_statew p; stream_pending ≔ file_pendingfile

None

⇒

None

Someinfo

Hready :

⊢

stream_call_prelibc_stream_modelrep requests wide WPtrp m w

destruct libc_file_atw p as file | eqn: Hfile ; eapply libc_stream_admitted ; eauto | discriminate

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep requests wide out err b o p m w h Hw Hl

pose proof permission_selectedout err p as Hd

destruct Hw as _ & _ & _ & _ & _ & _ & Ho & He & Hprivate

assert Hc : stream_currentpermission_descriptorout err p w h by destruct Hd as → | → ; assumption

destruct stream_permission_current_ _ _ _ Hc Hl as Hp info Hinfo

pose proof proj1proj1Hprivate_ Hd as Hready

unfold libc_stream_at in Hinfo

destruct libc_file_atw p as file | eqn: Hfile ; eapply libc_stream_admitted ; eauto | discriminate

The native representation's poll stability remains an explicit realization premise. Everything else follows from unchanged regions.

650Lemma errno_wi_safepoint

∀ rep p b o

∀s m s′ m′ w, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

LG.SafepointStablelibc_errno_wirep p b o

Explore proof 18 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop p : ptr b o : Z, ∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w → LG.SafepointStablelibc_errno_wirep p b o

intros rep p b o Hstable

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

⊢

LG.SafepointStablelibc_errno_wirep p b o

split

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

⊢

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world h : gmappiece pval, R.safepoints m s′ m′ → libc_errno_wirep p b o m w h → libc_errno_wirep p b o m′ w h

intros s m s′ m′ w h Hsp Hready & He & Hroots & Hrelease & Hoff

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

libc_errno_wirep p b o m′ w h

split ; eapply Hstable ; eauto |

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb ∧ roots_apartlibc_stream_aux_rootsw p h m′ ∧ ids_apartlibc_stream_releasesw p h ∧ pieces_offerrno_keysb o h m′ span_containserrno_spanb o

split ; exact He |

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

roots_apartlibc_stream_aux_rootsw p h m′ ∧ ids_apartlibc_stream_releasesw p h ∧ pieces_offerrno_keysb o h m′ span_containserrno_spanb o

split ; | split ; exact Hrelease |

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

roots_apartlibc_stream_aux_rootsw p h m′

focused goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

–intros root a Hin Hspan l & v & reg & Hl & Hmem & E Hlive & Hrange

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

False

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

apply Hrootsroot a Hin Hspan

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

owned_liveh m a

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

exists l, v, reg

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

h !! l = Somev ∧ mem_piecel ∧ live_atm piece_idl reg ∧ piece_idl ≤ a < r_endreg

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

split ; exact Hl |

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

mem_piecel ∧ live_atm piece_idl reg ∧ piece_idl ≤ a < r_endreg

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

split ; exact Hmem |

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

live_atm piece_idl reg ∧ piece_idl ≤ a < r_endreg

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

split ; | exact Hrange

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

live_atm piece_idl reg

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

split ; | exact Hlive

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

E :

object_regionpiece_idl m_regionsm′ = Somereg

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

⊢

object_regionpiece_idl m_regionsm = Somereg

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

rewrite R.collector_live_ _ _ _ Hsp in E

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

root :

a :

Hin :

Inroot libc_stream_aux_rootsw p

Hspan :

span_containsroot a

l :

v :

reg :

Hl :

h !! l = Somev

Hmem :

Hlive :

r_lifereg = Live

Hrange :

piece_idl ≤ a < r_endreg

E :

object_regionpiece_idl m_regionsm = Somereg

⊢

object_regionpiece_idl m_regionsm = Somereg

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

exact E

deferred goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

⊢

pieces_offerrno_keysb o h m′ span_containserrno_spanb o

–intros l v Hl Hnot

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

l :

v :

Hl :

h !! l = Somev

Hnot :

l ∉ errno_keysb o

⊢

match l with

PByteb₀ o₀ | PAuxb₀ o₀

⇒

∀reg : region, live_atm′ b₀ reg → 0 ≤ o₀ → b₀ + o₀ < r_endreg → ¬span_containserrno_spanb o b₀ + o₀

⇒

True

destruct l as base | base off | base off | key ; try exact I

2 open

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

base, off :

v :

Hl :

h !! PBytebase off = Somev

Hnot :

PBytebase off ∉ errno_keysb o

⊢

∀reg : region, live_atm′ base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_spanb o base + off

focused goal

rep :

mem → libc_world → Prop

p :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Hready :

He :

libc_errnow.1 = ptr_addr ≔ b + o; ptr_cap ≔ Objb

Hroots :

Hrelease :

Hoff :

pieces_offerrno_keysb o h m span_containserrno_spanb o

base, off :

v :

Hl :

h !! PAuxbase off = Somev

Hnot :

PAuxbase off ∉ errno_keysb o

⊢

∀reg : region, live_atm′ base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_spanb o base + off

all: intros reg E Hlive Ho Hend Hout ; rewrite R.collector_live_ _ _ _ Hsp in E ; exact Hoff_ v Hl Hnot reg conjE Hlive Ho Hend Hout

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep p b o Hstable

split

intros s m s′ m′ w h Hsp Hready & He & Hroots & Hrelease & Hoff

split ; eapply Hstable ; eauto |

split ; exact He |

split ; | split ; exact Hrelease |

–intros root a Hin Hspan l & v & reg & Hl & Hmem & E Hlive & Hrange

apply Hrootsroot a Hin Hspan

exists l, v, reg

split ; exact Hl |

split ; exact Hmem |

split ; | exact Hrange

split ; | exact Hlive

rewrite R.collector_live_ _ _ _ Hsp in E

exact E

–intros l v Hl Hnot

destruct l as base | base off | base off | key ; try exact I

all: intros reg E Hlive Ho Hend Hout ; rewrite R.collector_live_ _ _ _ Hsp in E ; exact Hoff_ v Hl Hnot reg conjE Hlive Ho Hend Hout

668Theorem tokens_safepoint

∀ rep out err b o

∀s m s′ m′ w, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

LG.SafepointStablestream_tokens_wirep out err b o

Explore proof 16 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop out err : stream_token b o : Z, ∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w → LG.SafepointStablestream_tokens_wirep out err b o

intros rep out err b o Hstable

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

⊢

LG.SafepointStablestream_tokens_wirep out err b o

split

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

⊢

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world h : gmappiece pval, R.safepoints m s′ m′ → stream_tokens_wirep out err b o m w h → stream_tokens_wirep out err b o m′ w h

intros s m s′ m′ w h Hsp Houtwf & Herrwf & Hbase & Hkey & Hout & Herr & Houtcurrent & Herrcurrent & Hprivate

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

stream_tokens_wirep out err b o m′ w h

split ; exact Houtwf |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

token_wferr ∧ token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Herrwf |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Hbase |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

token_keyout ≠ token_keyerr ∧ libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Hkey |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

libc_stdoutw = token_handleout ∧ libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Hout |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

libc_stderrw = token_handleerr ∧ stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Herr |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

stream_currentout w h ∧ stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Houtcurrent |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

stream_currenterr w h ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; exact Herrcurrent |

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

⊢

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

intros d Hd

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

d :

Hd :

d = out ∨ d = err

⊢

libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

destruct Hprivated Hd as Hwi Hrelease

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrelease :

⊢

libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

split ; | exact Hrelease

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrelease :

⊢

libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h

pose proof errno_wi_safepointrep token_handled b o Hstable as Hpoll

rep :

mem → libc_world → Prop

out, err :

b, o :

Hstable :

∀s : R.state m : mem s′ : R.state m′ : mem w : libc_world, R.safepoints m s′ m′ → libc_stream_readyrep m w → libc_stream_readyrep m′ w

s :

R.state

m :

s′ :

R.state

m′ :

w :

h :

gmappiece pval

Hsp :

R.safepoints m s′ m′

Houtwf :

Herrwf :

Hbase :

token_baseout ≠ token_baseerr

Hkey :

token_keyout ≠ token_keyerr

Hout :

Herr :

Houtcurrent :

stream_currentout w h

Herrcurrent :

stream_currenterr w h

Hprivate :

∀d : stream_token, d = out ∨ d = err → libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h ∧ ids_apartlibc_stream_releasesw token_handled h

d :

Hd :

d = out ∨ d = err

Hwi :

libc_errno_wirep token_handled b o m w stream_data_heaptoken_baseout token_baseerr h

Hrelease :

Hpoll :

LG.SafepointStablelibc_errno_wirep token_handled b o

⊢

libc_errno_wirep token_handled b o m′ w stream_data_heaptoken_baseout token_baseerr h

exact @LG.wi_safepoint_ _ Hpoll s m s′ m′ w _ Hsp Hwi

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep out err b o Hstable

split

intros s m s′ m′ w h Hsp Houtwf & Herrwf & Hbase & Hkey & Hout & Herr & Houtcurrent & Herrcurrent & Hprivate

split ; exact Houtwf |

split ; exact Herrwf |

split ; exact Hbase |

split ; exact Hkey |

split ; exact Hout |

split ; exact Herr |

split ; exact Houtcurrent |

split ; exact Herrcurrent |

intros d Hd

destruct Hprivated Hd as Hwi Hrelease

split ; | exact Hrelease

pose proof errno_wi_safepointrep token_handled b o Hstable as Hpoll

exact @LG.wi_safepoint_ _ Hpoll s m s′ m′ w _ Hsp Hwi

Discriminating world observations: physical pending is seven, the logical FIFO has two bytes, and a completed close consumes both.

686Module StreamTokenChecks

687Module F ≔ LibcStreamChecks

688Module A ≔ LibcStreamAdapterOn InterpRuntime StreamHandleChecks.LG

690Definition out ≔

mkStreamTokenfile_handleF.out_file 1024 mkRegion1024 1056 GlobalData Live −2

692Definition err ≔

mkStreamTokenfile_handleF.err_file 2048 mkRegion2048 2056 Stack Live −3

694Definition open_heap: gmappiece pval ≔

<[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap

698Example open_snapshots_current: stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap

Explore proof 10 tactics

Initial goal

⊢

stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap

unfold stream_current , open_heap

⊢

match <[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

∧

match <[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PNametoken_keyerr with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

cbn [ out err token_key ]

⊢

match <[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PName−2 with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

∧

match <[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PName−3 with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_eq

⊢

token_handleout = token_handleout ∧ stream_observationF.worldtrue token_handleout Some7, 65; 66

∧

match <[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PName−3 with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_ne ; | discriminate

⊢

token_handleout = token_handleout ∧ stream_observationF.worldtrue token_handleout Some7, 65; 66

∧

match <[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PName−3 with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_eq

⊢

token_handleout = token_handleout ∧ stream_observationF.worldtrue token_handleout Some7, 65; 66 ∧ token_handleerr = token_handleerr ∧ stream_observationF.worldtrue token_handleerr Some3, [ ]

split ; split ; reflexivity |

2 open

⊢

stream_observationF.worldtrue token_handleout Some7, 65; 66

focused goal

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

–exists mkStreamInfo1 mkStreamByteOriented 65; 66 true 7

2 open

⊢

libc_stream_atF.worldtrue token_handleout = Somestream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 ∧ stream_pendingstream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 = 7 ∧ outstandingstream_protocolstream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 = 65; 66

deferred goal

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

repeat split ; reflexivity

deferred goal

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

–exists mkStreamInfo2 stdout_initial 3

⊢

libc_stream_atF.worldtrue token_handleerr = Somestream_identifier ≔ 2; stream_protocol ≔ stdout_initial; stream_pending ≔ 3 ∧ stream_pendingstream_identifier ≔ 2; stream_protocol ≔ stdout_initial; stream_pending ≔ 3 = 3 ∧ outstandingstream_protocolstream_identifier ≔ 2; stream_protocol ≔ stdout_initial; stream_pending ≔ 3 = [ ]

repeat split ; reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current , open_heap

cbn [ out err token_key ]

rewrite lookup_insert_eq

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_eq

split ; split ; reflexivity |

–exists mkStreamInfo1 mkStreamByteOriented 65; 66 true 7

repeat split ; reflexivity

–exists mkStreamInfo2 stdout_initial 3

repeat split ; reflexivity

708Example stale_physical_count_rejected: ¬stream_currentout F.worldtrue <[PName−2 ≔ VStreamtoken_handleout Some2, 65; 66]>open_heap

Explore proof 7 tactics

Initial goal

⊢

¬stream_currentout F.worldtrue <[PName−2 ≔ VStreamtoken_handleout Some2, 65; 66]>open_heap

unfold stream_current

⊢

¬match <[PName−2 ≔ VStreamtoken_handleout Some2, 65; 66]>open_heap !! PNametoken_keyout with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

cbn [ out token_key ]

⊢

¬match <[PName−2 ≔ VStreamtoken_handleout Some2, 65; 66]>open_heap !! PName−2 with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

rewrite lookup_insert_eq

⊢

¬token_handleout = token_handleout ∧ stream_observationF.worldtrue token_handleout Some2, 65; 66

intros _ & info & Hinfo & Hpending & _

info :

Hinfo :

libc_stream_atF.worldtrue token_handleout = Someinfo

Hpending :

stream_pendinginfo = 2

⊢

False

change SomemkStreamInfo1 mkStreamByteOriented 65; 66 true 7 = Someinfo in Hinfo

info :

Hinfo :

Somestream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 = Someinfo

Hpending :

stream_pendinginfo = 2

⊢

False

injection Hinfo as ←

Hpending :

stream_pendingstream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 = 2

⊢

False

discriminate Hpending

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current

cbn [ out token_key ]

rewrite lookup_insert_eq

intros _ & info & Hinfo & Hpending & _

change SomemkStreamInfo1 mkStreamByteOriented 65; 66 true 7 = Someinfo in Hinfo

injection Hinfo as ←

discriminate Hpending

718Example stale_fifo_rejected: ¬stream_currentout F.worldtrue <[PName−2 ≔ VStreamtoken_handleout Some7, 66; 65]>open_heap

Explore proof 7 tactics

Initial goal

⊢

¬stream_currentout F.worldtrue <[PName−2 ≔ VStreamtoken_handleout Some7, 66; 65]>open_heap

unfold stream_current

⊢

¬match <[PName−2 ≔ VStreamtoken_handleout Some7, 66; 65]>open_heap !! PNametoken_keyout with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

cbn [ out token_key ]

⊢

¬match <[PName−2 ≔ VStreamtoken_handleout Some7, 66; 65]>open_heap !! PName−2 with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

rewrite lookup_insert_eq

⊢

¬token_handleout = token_handleout ∧ stream_observationF.worldtrue token_handleout Some7, 66; 65

intros _ & info & Hinfo & _ & Hfifo

info :

Hinfo :

libc_stream_atF.worldtrue token_handleout = Someinfo

Hfifo :

outstandingstream_protocolinfo = 66; 65

⊢

False

change SomemkStreamInfo1 mkStreamByteOriented 65; 66 true 7 = Someinfo in Hinfo

info :

Hinfo :

Somestream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 = Someinfo

Hfifo :

outstandingstream_protocolinfo = 66; 65

⊢

False

injection Hinfo as ←

Hfifo :

outstandingstream_protocolstream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7 = 66; 65

⊢

False

discriminate Hfifo

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current

cbn [ out token_key ]

rewrite lookup_insert_eq

intros _ & info & Hinfo & _ & Hfifo

change SomemkStreamInfo1 mkStreamByteOriented 65; 66 true 7 = Someinfo in Hinfo

injection Hinfo as ←

discriminate Hfifo

728Example completed_closed_snapshot: stream_currentout F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Explore proof 5 tactics

Initial goal

⊢

stream_currentout F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

unfold stream_current

⊢

match <[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldfalse p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldfalse p = Someinfo

None

⇒

True

⇒

False

cbn [ out token_key ]

⊢

match <[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PName−2 with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldfalse p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldfalse p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_eq

⊢

token_handleout = token_handleout ∧ stream_observationF.worldfalse token_handleout None

split ; reflexivity |

⊢

stream_observationF.worldfalse token_handleout None

split ; reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current

cbn [ out token_key ]

rewrite lookup_insert_eq

split ; reflexivity |

split ; reflexivity

736Example closed_token_rejected_while_open: ¬stream_currentout F.worldtrue <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Explore proof 5 tactics

Initial goal

⊢

¬stream_currentout F.worldtrue <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

unfold stream_current

⊢

¬match <[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PNametoken_keyout with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

cbn [ out token_key ]

⊢

¬match <[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PName−2 with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

rewrite lookup_insert_eq

⊢

¬token_handleout = token_handleout ∧ stream_observationF.worldtrue token_handleout None

intros _ & Hclosed & _

Hclosed :

libc_stream_atF.worldtrue token_handleout = None

⊢

False

discriminate Hclosed

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current

cbn [ out token_key ]

rewrite lookup_insert_eq

intros _ & Hclosed & _

discriminate Hclosed

744Example malformed_snapshot_rejected: ¬stream_currentout F.worldtrue <[PName−2 ≔ VNametoken_handleout 65]>open_heap

Explore proof 4 tactics

Initial goal

⊢

¬stream_currentout F.worldtrue <[PName−2 ≔ VNametoken_handleout 65]>open_heap

unfold stream_current

⊢

¬match <[PName−2 ≔ VNametoken_handleout 65]>open_heap !! PNametoken_keyout with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

cbn [ out token_key ]

⊢

¬match <[PName−2 ≔ VNametoken_handleout 65]>open_heap !! PName−2 with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldtrue p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo | None ⇒ True | _ ⇒ False end

rewrite lookup_insert_eq

⊢

¬False

exact λH ⇒ H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current

cbn [ out token_key ]

rewrite lookup_insert_eq

exact λH ⇒ H

The entire interpretation has an inhabitant with both open tokens, both native lives and owned errno, not merely each mirror alone.

750Lemma private_lookup

∀ l v

stream_data_heap1024 2048 open_heap !! l = Somev

HelloErrnoChecks.heap !! l = Somev

Explore proof 9 tactics

Initial goal

⊢

∀l : piece v : pval, mem_piecel → stream_data_heap1024 2048 open_heap !! l = Somev → HelloErrnoChecks.heap !! l = Somev

intros l v Hmem Hl

l :

v :

Hmem :

Hl :

stream_data_heap1024 2048 open_heap !! l = Somev

⊢

HelloErrnoChecks.heap !! l = Somev

apply stream_data_lookup in Hl as Hl & Hout & Herr

l :

v :

Hmem :

Hl :

open_heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

unfold open_heap in Hl

l :

v :

Hmem :

Hl :

<[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l ; contradiction |

l :

v :

Hmem :

Hl :

<[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l ; contradiction |

l :

v :

Hmem :

Hl :

StreamHandleChecks.heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

unfold StreamHandleChecks.heap in Hl

l :

v :

Hmem :

Hl :

<[PLive1024 ≔ VLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live]><[PLive2048 ≔ VLiver_base ≔ 2048; r_end ≔ 2056; r_kind ≔ Stack; r_life ≔ Live]>StreamHandleChecks.E.heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l ; contradiction |

l :

v :

Hmem :

Hl :

<[PLive2048 ≔ VLiver_base ≔ 2048; r_end ≔ 2056; r_kind ≔ Stack; r_life ≔ Live]>StreamHandleChecks.E.heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l ; contradiction |

l :

v :

Hmem :

Hl :

StreamHandleChecks.E.heap !! l = Somev

Hout :

l ≠ PLive1024

Herr :

l ≠ PLive2048

⊢

HelloErrnoChecks.heap !! l = Somev

exact Hl

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros l v Hmem Hl

apply stream_data_lookup in Hl as Hl & Hout & Herr

unfold open_heap in Hl

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l ; contradiction |

unfold StreamHandleChecks.heap in Hl

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l ; contradiction |

exact Hl

764Lemma full_wi

stream_tokens_wiλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

Explore proof 25 tactics

Initial goal

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

assert Hkeys : ∀l v, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

2 open

⊢

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

{intros l v Hl Hmem

2 open

l :

v :

Hl :

stream_data_heap1024 2048 open_heap !! l = Somev

Hmem :

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

apply private_lookupl v Hmem in Hl

2 open

l :

v :

Hl :

HelloErrnoChecks.heap !! l = Somev

Hmem :

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

unfold HelloErrnoChecks.heap in Hl

2 open

l :

v :

Hl :

list_to_mapbyte_ps5120 0 0; 0; 0; 0 !! l = Somev

Hmem :

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

apply elem_of_list_to_map_2 in Hl

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

Hmem :

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

change l ∈ byte_ps5120 0 0; 0; 0; 0.*1

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

Hmem :

⊢

l ∈ byte_ps5120 0 0; 0; 0; 0.*1

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

apply list_elem_of_fmap

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

Hmem :

⊢

∃x : piece × pval, l = x.1 ∧ x ∈ byte_ps5120 0 0; 0; 0; 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

exists l, v

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

Hmem :

⊢

l = l, v.1 ∧ l, v ∈ byte_ps5120 0 0; 0; 0; 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

auto

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

split ; split ; reflexivity | simpl ; lia |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

token_wferr ∧ token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; split ; reflexivity | simpl ; lia |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; discriminate |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; discriminate |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; reflexivity |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; reflexivity |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_currentout F.worldtrue open_heap ∧ stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; exact proj1open_snapshots_current |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_currenterr F.worldtrue open_heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

split ; exact proj2open_snapshots_current |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled open_heap

intros d → | →

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleout 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleout open_heap

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleerr 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleerr open_heap

all: split ; | intros base l v Hin ; change Inbase [ ] in Hin ; contradiction

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleout 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleerr 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr open_heap

all: split ; apply F.ready |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errnoF.worldtrue.1 = ptr_addr ≔ 5120 + 0; ptr_cap ≔ Obj5120 ∧ roots_apartlibc_stream_aux_rootsF.worldtrue token_handleout stream_data_heaptoken_baseout token_baseerr open_heap conversion_mem ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleout stream_data_heaptoken_baseout token_baseerr open_heap ∧ pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr open_heap conversion_mem span_containserrno_span5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errnoF.worldtrue.1 = ptr_addr ≔ 5120 + 0; ptr_cap ≔ Obj5120 ∧ roots_apartlibc_stream_aux_rootsF.worldtrue token_handleerr stream_data_heaptoken_baseout token_baseerr open_heap conversion_mem ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleerr stream_data_heaptoken_baseout token_baseerr open_heap ∧ pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr open_heap conversion_mem span_containserrno_span5120 0

all: split ; reflexivity |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

all: split ; intros root a Hin ; change Inroot [ ] in Hin ; contradiction |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

all: split ; intros base l v Hin ; change Inbase [ ] in Hin ; contradiction |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr open_heap conversion_mem span_containserrno_span5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr open_heap conversion_mem span_containserrno_span5120 0

all: intros l v Hl Hnot ; destruct l as base | base off | base off | key ; try exact I

4 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr open_heap !! PBytebase off = Somev

Hnot :

PBytebase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr open_heap !! PAuxbase off = Somev

Hnot :

PAuxbase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr open_heap !! PBytebase off = Somev

Hnot :

PBytebase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr open_heap !! PAuxbase off = Somev

Hnot :

PAuxbase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

all: exfalso ; apply Hnot ; eapply Hkeys ; exact Hl | exact I

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

assert Hkeys : ∀l v, stream_data_heap1024 2048 open_heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

{intros l v Hl Hmem

apply private_lookupl v Hmem in Hl

unfold HelloErrnoChecks.heap in Hl

apply elem_of_list_to_map_2 in Hl

change l ∈ byte_ps5120 0 0; 0; 0; 0.*1

apply list_elem_of_fmap

exists l, v

auto

split ; split ; reflexivity | simpl ; lia |

split ; discriminate |

split ; reflexivity |

split ; exact proj1open_snapshots_current |

split ; exact proj2open_snapshots_current |

intros d → | →

all: split ; | intros base l v Hin ; change Inbase [ ] in Hin ; contradiction

all: split ; apply F.ready |

all: split ; reflexivity |

all: split ; intros root a Hin ; change Inroot [ ] in Hin ; contradiction |

all: split ; intros base l v Hin ; change Inbase [ ] in Hin ; contradiction |

all: intros l v Hl Hnot ; destruct l as base | base off | base off | key ; try exact I

all: exfalso ; apply Hnot ; eapply Hkeys ; exact Hl | exact I

786Example full_open_admitted: stream_call_preF.model WPtrtoken_handleout conversion_mem F.worldtrue

Explore proof 15 tactics

Initial goal

⊢

stream_call_preF.model WPtrtoken_handleout conversion_mem F.worldtrue

eapply A.open_admitted with out := out err := err b := 5120 o := 0 pending := 7 fifo := 65; 66 h := open_heap ; left ; reflexivity | exact full_wi |

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 → open_heap !! l = Somev

intros l v Hin

l :

v :

Hin :

l, v ∈ stream_psout 7 65; 66

⊢

open_heap !! l = Somev

unfold stream_ps in Hin

l :

v :

Hin :

l, v ∈ PLivetoken_baseout, VLivetoken_regionout; PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

apply elem_of_cons in Hin as He | Hin

2 open

l :

v :

He :

l, v = PLivetoken_baseout, VLivetoken_regionout

⊢

open_heap !! l = Somev

focused goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

–injection He as He Hv

2 open

l :

v :

He :

l = PLive1024

Hv :

v = VLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live

⊢

open_heap !! l = Somev

deferred goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

subst l v

2 open

⊢

open_heap !! PLive1024 = SomeVLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live

deferred goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

unfold open_heap , StreamHandleChecks.heap

2 open

⊢

<[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]><[PLive1024 ≔ VLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live]><[PLive2048 ≔ VLiver_base ≔ 2048; r_end ≔ 2056; r_kind ≔ Stack; r_life ≔ Live]>StreamHandleChecks.E.heap !! PLive1024 = SomeVLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live

deferred goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

rewrite lookup_insert_ne ; | discriminate

2 open

⊢

<[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]><[PLive1024 ≔ VLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live]><[PLive2048 ≔ VLiver_base ≔ 2048; r_end ≔ 2056; r_kind ≔ Stack; r_life ≔ Live]>StreamHandleChecks.E.heap !! PLive1024 = SomeVLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live

deferred goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

rewrite lookup_insert_ne ; | discriminate

2 open

⊢

deferred goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

apply lookup_insert_eq

deferred goal

l :

v :

Hin :

l, v ∈ PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

–apply elem_of_cons in Hin as He | Hin ; | apply not_elem_of_nil in Hin ; contradiction

l :

v :

He :

l, v = PNametoken_keyout, VStreamtoken_handleout Some7, 65; 66

⊢

open_heap !! l = Somev

injection He as He Hv

l :

v :

agreesconversion_mem open_heap

He :

l = PName−2

Hv :

v = VStreamptr_addr ≔ 1024; ptr_cap ≔ Obj1024 Some7, 65; 66

⊢

open_heap !! l = Somev

subst l v

⊢

open_heap !! PName−2 = SomeVStreamptr_addr ≔ 1024; ptr_cap ≔ Obj1024 Some7, 65; 66

unfold open_heap

⊢

<[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! PName−2 = SomeVStreamptr_addr ≔ 1024; ptr_cap ≔ Obj1024 Some7, 65; 66

apply lookup_insert_eq

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

eapply A.open_admitted with out := out err := err b := 5120 o := 0 pending := 7 fifo := 65; 66 h := open_heap ; left ; reflexivity | exact full_wi |

intros l v Hin

unfold stream_ps in Hin

apply elem_of_cons in Hin as He | Hin

–injection He as He Hv

subst l v

unfold open_heap , StreamHandleChecks.heap

rewrite lookup_insert_ne ; | discriminate

apply lookup_insert_eq

–apply elem_of_cons in Hin as He | Hin ; | apply not_elem_of_nil in Hin ; contradiction

injection He as He Hv

subst l v

unfold open_heap

apply lookup_insert_eq

800Lemma open_heap_agrees

Explore proof 5 tactics

Initial goal

⊢

agreesconversion_mem open_heap

intros l v Hl

l :

v :

Hl :

open_heap !! l = Somev

⊢

unfold open_heap in Hl

l :

v :

Hl :

<[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! l = Somev

⊢

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l v ; exact I |

l :

v :

Hl :

<[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]>StreamHandleChecks.heap !! l = Somev

⊢

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l v ; exact I |

l :

v :

Hl :

StreamHandleChecks.heap !! l = Somev

⊢

exact StreamHandleChecks.heap_agreesl v Hl

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros l v Hl

unfold open_heap in Hl

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l v ; exact I |

exact StreamHandleChecks.heap_agreesl v Hl

An actual stderr query frames the paired interpretation even though stdout's physical count and outstanding FIFO differ from stderr's.

810Example stderr_query_preserves_pair: A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue ∧ stream_tokens_wiλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

Explore proof 10 tactics

Initial goal

⊢

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

assert Hcall : A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

2 open

⊢

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

focused goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

{apply StreamHandleChecks.C.fpending_unchanged with file := F.err_file

4 open

⊢

stream_query_abiL CVoid ArgP Const0

focused goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

focused goal

⊢

libc_file_atF.worldtrue token_handleerr = SomeF.err_file

deferred goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

–split ; left ; reflexivity |

4 open

⊢

∃v : value, ArgP Const0 = ArgP v

deferred goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

deferred goal

⊢

libc_file_atF.worldtrue token_handleerr = SomeF.err_file

deferred goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

exists Const0

4 open

⊢

ArgP Const0 = ArgP Const0

deferred goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

deferred goal

⊢

libc_file_atF.worldtrue token_handleerr = SomeF.err_file

deferred goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

reflexivity

3 open

deferred goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

deferred goal

⊢

libc_file_atF.worldtrue token_handleerr = SomeF.err_file

deferred goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

–apply F.ready

2 open

deferred goal

⊢

libc_file_atF.worldtrue token_handleerr = SomeF.err_file

deferred goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

–reflexivity

deferred goal

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

split ; exact Hcall |

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

destruct A.query_frameλ_ _ ⇒ True λ_ _ _ _ ⇒ False λ_ _ _ _ _ ⇒ False out err 5120 0 err _ _ _ _ _ _ _ _ _ _ _ open_heap or_introreq_refl or_introreq_refl Hcall open_heap_agrees HelloErrnoChecks.disjoint HelloErrnoChecks.ready full_wi as _ & _ & _ & Hw

Hcall :

A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

Hw :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

exact Hw

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

assert Hcall : A.M.E.invokefpending_contractF.model CVoid ArgP Const0 WPtrtoken_handleerr InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt3 InterpRuntime.start conversion_mem F.worldtrue

{apply StreamHandleChecks.C.fpending_unchanged with file := F.err_file

–split ; left ; reflexivity |

exists Const0

reflexivity

–apply F.ready

–reflexivity

split ; exact Hcall |

destruct A.query_frameλ_ _ ⇒ True λ_ _ _ _ ⇒ False λ_ _ _ _ _ ⇒ False out err 5120 0 err _ _ _ _ _ _ _ _ _ _ _ open_heap or_introreq_refl or_introreq_refl Hcall open_heap_agrees HelloErrnoChecks.disjoint HelloErrnoChecks.ready full_wi as _ & _ & _ & Hw

exact Hw

The other query contract and stdout selection use the same frame.

832Example stdout_error_preserves_pair: A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue ∧ stream_tokens_wiλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

Explore proof 10 tactics

Initial goal

⊢

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

assert Hcall : A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

2 open

⊢

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

focused goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

{apply StreamHandleChecks.C.ferror_unchanged with file := F.out_file

4 open

⊢

stream_query_abiW CVoid ArgP Const0

focused goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

focused goal

⊢

libc_file_atF.worldtrue token_handleout = SomeF.out_file

deferred goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

–split ; left ; reflexivity |

4 open

⊢

∃v : value, ArgP Const0 = ArgP v

deferred goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

deferred goal

⊢

libc_file_atF.worldtrue token_handleout = SomeF.out_file

deferred goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

exists Const0

4 open

⊢

ArgP Const0 = ArgP Const0

deferred goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

deferred goal

⊢

libc_file_atF.worldtrue token_handleout = SomeF.out_file

deferred goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

reflexivity

3 open

deferred goal

⊢

libc_stream_readyλ_ : mem _ : libc_world ⇒ True conversion_mem F.worldtrue

deferred goal

⊢

libc_file_atF.worldtrue token_handleout = SomeF.out_file

deferred goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

–apply F.ready

2 open

deferred goal

⊢

libc_file_atF.worldtrue token_handleout = SomeF.out_file

deferred goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

–reflexivity

deferred goal

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

split ; exact Hcall |

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

destruct A.query_frameλ_ _ ⇒ True λ_ _ _ _ ⇒ False λ_ _ _ _ _ ⇒ False out err 5120 0 out _ _ _ _ _ _ _ _ _ _ _ open_heap or_introleq_refl or_introleq_refl Hcall open_heap_agrees HelloErrnoChecks.disjoint HelloErrnoChecks.ready full_wi as _ & _ & _ & Hw

Hcall :

A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

Hw :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue open_heap

exact Hw

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

assert Hcall : A.M.E.invokeferror_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWInt1 InterpRuntime.start conversion_mem F.worldtrue

{apply StreamHandleChecks.C.ferror_unchanged with file := F.out_file

–split ; left ; reflexivity |

exists Const0

reflexivity

–apply F.ready

–reflexivity

split ; exact Hcall |

destruct A.query_frameλ_ _ ⇒ True λ_ _ _ _ ⇒ False λ_ _ _ _ _ ⇒ False out err 5120 0 out _ _ _ _ _ _ _ _ _ _ _ open_heap or_introleq_refl or_introleq_refl Hcall open_heap_agrees HelloErrnoChecks.disjoint HelloErrnoChecks.ready full_wi as _ & _ & _ & Hw

exact Hw

An actual authorized scalar write changes every errno byte, including the last one. It changes neither FILE storage nor locale strings.

855Definition changed_errno: mem ≔

store_bytesconversion_mem 5120 4 16909060

857Lemma changed_files_ready

libc_file_readychanged_errno mkPtr5120 Obj5120 F.out_file ∧ libc_file_readychanged_errno mkPtr5120 Obj5120 F.err_file

Explore proof 9 tactics

Initial goal

⊢

libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file ∧ libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

destruct F.files_ready as Hout Herr

Hout :

libc_file_readyconversion_mem ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file

Herr :

libc_file_readyconversion_mem ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

⊢

libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file ∧ libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

split ; clear Herr | clear Hout

2 open

Hout :

libc_file_readyconversion_mem ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file

⊢

libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file

focused goal

Herr :

libc_file_readyconversion_mem ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

⊢

libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

all: destruct Hout as Hnon & Hn & Hreg & Haccess & Hbytes & Hrest || destruct Herr as Hnon & Hn & Hreg & Haccess & Hbytes & Hrest

2 open

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.out_file + i < 256

Hrest :

0 ≤ file_pendingF.out_file < 2 ^ 64 ∧ Forallwritable_spanconversion_mem file_rootsF.out_file ∧ Forallλsource : span ⇒ readable_bytesconversion_mem span_ptrsource span_sizesource file_readsF.out_file ∧ ForallLocale.locale_heapconversion_mem file_ownedF.out_file ∧ file_errno_apartconversion_mem ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file

⊢

libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file

focused goal

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.err_file + i < 256

Hrest :

0 ≤ file_pendingF.err_file < 2 ^ 64 ∧ Forallwritable_spanconversion_mem file_rootsF.err_file ∧ Forallλsource : span ⇒ readable_bytesconversion_mem span_ptrsource span_sizesource file_readsF.err_file ∧ ForallLocale.locale_heapconversion_mem file_ownedF.err_file ∧ file_errno_apartconversion_mem ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

⊢

libc_file_readychanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

all: split ; exact Hnon |

2 open

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.out_file + i < 256

Hrest :

⊢

readable_byteschanged_errno file_handleF.out_file 1 ∧ 0 ≤ file_pendingF.out_file < 2 ^ 64 ∧ Forallwritable_spanchanged_errno file_rootsF.out_file ∧ Forallλsource : span ⇒ readable_byteschanged_errno span_ptrsource span_sizesource file_readsF.out_file ∧ ForallLocale.locale_heapchanged_errno file_ownedF.out_file ∧ file_errno_apartchanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.out_file

focused goal

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.err_file + i < 256

Hrest :

⊢

readable_byteschanged_errno file_handleF.err_file 1 ∧ 0 ≤ file_pendingF.err_file < 2 ^ 64 ∧ Forallwritable_spanchanged_errno file_rootsF.err_file ∧ Forallλsource : span ⇒ readable_byteschanged_errno span_ptrsource span_sizesource file_readsF.err_file ∧ ForallLocale.locale_heapchanged_errno file_ownedF.err_file ∧ file_errno_apartchanged_errno ptr_addr ≔ 5120; ptr_cap ≔ Obj5120 F.err_file

all: split ; | destruct Hrest as Hp & _ & _ & _ & Ha ; split ; exact Hp | ; split ; constructor | ; split ; constructor | ; split ; constructor | exact Ha

2 open

Hnon :

readable_byteschanged_errno file_handleF.out_file 1

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.out_file + i < 256

Hrest :

⊢

focused goal

Hnon :

readable_byteschanged_errno file_handleF.err_file 1

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.err_file + i < 256

Hrest :

⊢

all: split ; exact Hn |

2 open

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.out_file + i < 256

Hrest :

⊢

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionschanged_errno = Somereg ∧ r_lifereg = Live ∧ access_reschanged_errno ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok ∧ ∀i : Z, 0 ≤ i < 1 → 0 ≤ m_byteschanged_errno ptr_addrfile_handleF.out_file + i < 256

focused goal

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.err_file + i < 256

Hrest :

⊢

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionschanged_errno = Somereg ∧ r_lifereg = Live ∧ access_reschanged_errno ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok ∧ ∀i : Z, 0 ≤ i < 1 → 0 ≤ m_byteschanged_errno ptr_addrfile_handleF.err_file + i < 256

all: split ; exact Hreg |

2 open

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.out_file + i < 256

Hrest :

⊢

access_reschanged_errno ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok ∧ ∀i : Z, 0 ≤ i < 1 → 0 ≤ m_byteschanged_errno ptr_addrfile_handleF.out_file + i < 256

focused goal

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.err_file + i < 256

Hrest :

⊢

access_reschanged_errno ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok ∧ ∀i : Z, 0 ≤ i < 1 → 0 ≤ m_byteschanged_errno ptr_addrfile_handleF.err_file + i < 256

all: split ; exact Haccess |

2 open

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.out_file = Objbase ∨ ptr_capfile_handleF.out_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.out_file ptr_capfile_handleF.out_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.out_file + i < 256

Hrest :

⊢

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_byteschanged_errno ptr_addrfile_handleF.out_file + i < 256

focused goal

Hnon :

Hn :

0 ≤ 1 < 2 ^ 64

Hreg :

∃base : Z reg : region, ptr_capfile_handleF.err_file = Objbase ∨ ptr_capfile_handleF.err_file = Robase ∧ object_regionbase m_regionsconversion_mem = Somereg ∧ r_lifereg = Live

Haccess :

access_resconversion_mem ptr_addrfile_handleF.err_file ptr_capfile_handleF.err_file 1 Read 1 = Someok

Hbytes :

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_bytesconversion_mem ptr_addrfile_handleF.err_file + i < 256

Hrest :

⊢

∀i : Z, 0 ≤ i < 1 → 0 ≤ m_byteschanged_errno ptr_addrfile_handleF.err_file + i < 256

all: intros i Hi ; assert i = 0 as → by lia ; vm_compute ; split ; congruence

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

destruct F.files_ready as Hout Herr

split ; clear Herr | clear Hout

all: destruct Hout as Hnon & Hn & Hreg & Haccess & Hbytes & Hrest || destruct Herr as Hnon & Hn & Hreg & Haccess & Hbytes & Hrest

all: split ; exact Hnon |

all: split ; exact Hn |

all: split ; exact Hreg |

all: split ; exact Haccess |

all: intros i Hi ; assert i = 0 as → by lia ; vm_compute ; split ; congruence

874Lemma changed_ready

∀ opened

libc_stream_readyλ_ _ ⇒ True changed_errno F.worldopened

Proof 26 steps Qed

intros opened

destruct F.readyopened as Hrep & Hlocale & He & Hout & Herr & Hu & Hstatus & Hphase & Hdistinct & Hroots & _

split ; exact Hrep |

split

–destruct Hlocale as _ & _ & _ & _ & _ & Haligned

split ; exact I |

split ; constructor |

split

+intros category _

vm_compute

repeat split ; congruence

+split ; constructor |

split ; constructor | exact Haligned

–split ; exact He |

split ; exact Hout |

split ; exact Herr |

split ; exact Hu |

split ; exact Hstatus |

split ; exact Hphase |

split ; exact Hdistinct |

split ; exact Hroots |

split ; intros _ ; exact proj1changed_files_ready |

split ; intros _ ; exact proj2changed_files_ready |

intros p file Hfile base Hin

unfold libc_file_at in Hfile

destruct same_filep libc_stdoutF.worldopened ; destruct opened | destruct same_filep libc_stderrF.worldopened ; try discriminate ; injection Hfile as ← ; contradiction

The contract allows success or EOF after settling the old FIFO. Both controls use the supplied HelloClose machine, not F.M.

897Lemma changed_close

∀ n

n = 0 ∨ n = stream_eof

A.M.E.invokefclose_contractF.model CVoid ArgP Const0 WPtrtoken_handleout InterpRuntime.start conversion_mem F.worldtrue [ ] CallReturnWIntn InterpRuntime.start changed_errno F.worldfalse

Proof 51 steps Qed

intros n Hn

eapply A.M.E.invoke_normal with born := [ ]

–split ; left ; reflexivity |

exists Const0

reflexivity

–apply full_open_admitted

–split

+eapply A.M.E.effects_local ; apply local_store_bytes | constructor

intros a Ha

left

exists errno_span5120 0

split ; left ; reflexivity |

split

∗exact proj1proj2proj1proj2proj2F.readytrue

∗unfold span_contains , errno_span

simpl

lia

+exists token_handleout, mkStreamInfo1 mkStreamByteOriented 65; 66 true 7, mkStreamByteOriented [ ] true

split ; reflexivity |

split ; apply F.close_settles |

split ; reflexivity |

split ; apply changed_ready |

split ; apply F.close_frame |

split ; split ; intros root | split ; intros x ; contradiction |

split ; reflexivity |

split ; left ; reflexivity |

intros a Hin Houtside

reflexivity

–exists token_handleout, mkStreamInfo1 mkStreamByteOriented 65; 66 true 7, mkStreamByteOriented [ ] true, n

split ; reflexivity |

split ; apply F.close_settles |

split ; reflexivity |

split ; exact Hn |

split ; reflexivity |

split ; intros base |

split ; apply changed_ready |

split ; apply F.close_frame |

auto

–intros why Hbad

discriminate

–intros values Hvalues

injection Hvalues as ←

split

+exists WIntn

split ; reflexivity |

destruct Hn as → | → ; reflexivity

+repeat constructor

–intros status Hbad

discriminate

929Example completed_close_preserves_pair: ∀n, n = 0 ∨ n = stream_eof → ∃ys, ys = 4; 3; 2; 1 ∧ stream_tokens_wiλ_ _ ⇒ True out err 5120 0 changed_errno F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Explore proof 37 tactics

Initial goal

⊢

∀n : Z, n = 0 ∨ n = stream_eof → ∃ys : listZ, ys = 4; 3; 2; 1 ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

intros n Hn

n :

Hn :

n = 0 ∨ n = stream_eof

⊢

∃ys : listZ, ys = 4; 3; 2; 1 ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

destruct A.close_frameλ_ _ ⇒ True λ_ _ _ _ ⇒ False λ_ _ _ _ _ ⇒ False out err 5120 0 out _ _ _ _ _ _ _ _ _ _ open_heap 0; 0; 0; 0 or_introleq_refl changed_closen Hn open_heap_agrees HelloErrnoChecks.disjoint HelloErrnoChecks.ready full_wi eq_refl as ys & Hlen & Hkeys & Hagree & _ & _ & Hwi

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

⊢

∀l : piece v : pval, l, v ∈ byte_ps5120 0 0; 0; 0; 0 → open_heap !! l = Somev

focused goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

∃ys₀ : listZ, ys₀ = 4; 3; 2; 1 ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys₀ open_heap

–intros l v Hin

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

l :

v :

Hin :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

open_heap !! l = Somev

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

unfold open_heap , StreamHandleChecks.heap

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

l :

v :

Hin :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

pose proof MemLogic.byte_ps_elem_ _ _ _ _ Hin as i & x & Hi & El & Ev

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

l :

v :

Hin :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

i :

nat

x :

Hi :

0; 0; 0; 0 !! i = Somex

El :

l = PByte5120 0 + i

Ev :

v = VBytex

⊢

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

subst l v

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

rewrite lookup_insert_ne ; | discriminate

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

rewrite lookup_insert_ne ; | discriminate

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

rewrite lookup_insert_ne ; | discriminate

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

<[PLive2048 ≔ VLiver_base ≔ 2048; r_end ≔ 2056; r_kind ≔ Stack; r_life ≔ Live]>StreamHandleChecks.E.heap !! PByte5120 0 + i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

rewrite lookup_insert_ne ; | discriminate

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

StreamHandleChecks.E.heap !! PByte5120 0 + i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

unfold HelloErrnoChecks.heap

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

list_to_mapbyte_ps5120 0 0; 0; 0; 0 !! PByte5120 0 + i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

apply elem_of_list_to_map_1 ; | exact Hin

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

base.NoDupbyte_ps5120 0 0; 0; 0; 0.*1

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

change base.NoDupPByte5120 0; PByte5120 1; PByte5120 2; PByte5120 3

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

base.NoDupPByte5120 0; PByte5120 1; PByte5120 2; PByte5120 3

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

repeat apply base.NoDup_cons_2 ; set_solver |

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

i :

nat

x :

Hin :

PByte5120 0 + i, VBytex ∈ byte_ps5120 0 0; 0; 0; 0

Hi :

0; 0; 0; 0 !! i = Somex

⊢

base.NoDup[ ]

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

apply base.NoDup_nil_2

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

–exists ys

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

ys = 4; 3; 2; 1 ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

split ; | exact Hwi

n :

Hn :

n = 0 ∨ n = stream_eof

ys :

listZ

Hlen :

lengthys = 4%nat

Hkeys :

byte_ps5120 0 ys.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 ys open_heap

⊢

ys = 4; 3; 2; 1

destruct ys as | a | b | c | d rest ; try discriminate Hlen

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

rest :

listZ

Hlen :

lengtha :: b :: c :: d :: rest = 4%nat

Hkeys :

byte_ps5120 0 a :: b :: c :: d :: rest.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a :: b :: c :: d :: rest open_heap

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a :: b :: c :: d :: rest open_heap

⊢

a :: b :: c :: d :: rest = 4; 3; 2; 1

assert rest = [ ] as → by destruct rest ; reflexivity | discriminate Hlen

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

⊢

a; b; c; d = 4; 3; 2; 1

assert Hbyte : ∀i x, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

⊢

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

focused goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

{intros i x Hin

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

assert Hl : <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

3 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

⊢

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

focused goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

{rewrite lookup_insert_ne ; | discriminate

3 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

⊢

overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

change PByte5120 i, VBytex ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted in Hin

3 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted

⊢

overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

repeat apply elem_of_cons in Hin as E | Hin ; injection E as Ei Ex ; subst i x ; cbn [ byte_ps overwrite fst snd ] ; repeat rewrite lookup_insert_ne ; | discriminate ; apply lookup_insert_eq |

3 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ [ ]

⊢

overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

apply not_elem_of_nil in Hin

3 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

False

⊢

overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

contradiction

2 open

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

destruct Hagree_ _ Hl as _ Hvalue

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

Hvalue :

in_livechanged_errno 5120 i m_byteschanged_errno 5120 + i = x

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

destruct HvaluemkRegion5120 5128 Heap Live eq_refl eq_refl as _ & _ & Hv

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

Hvalue :

in_livechanged_errno 5120 i m_byteschanged_errno 5120 + i = x

Hv :

m_byteschanged_errno 5120 + i = x

⊢

x = m_byteschanged_errno 5120 + i

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

symmetry

2 open

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

i, x :

Hin :

PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

Hvalue :

in_livechanged_errno 5120 i m_byteschanged_errno 5120 + i = x

Hv :

m_byteschanged_errno 5120 + i = x

⊢

m_byteschanged_errno 5120 + i = x

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

exact Hv

deferred goal

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

⊢

a; b; c; d = 4; 3; 2; 1

assert Ha : a = 4 by apply Hbyte0 a ; change PByte5120 0, VBytea ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

Ha :

a = 4

⊢

a; b; c; d = 4; 3; 2; 1

assert Hb : b = 3 by apply Hbyte1 b ; change PByte5120 1, VByteb ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

Ha :

a = 4

Hb :

b = 3

⊢

a; b; c; d = 4; 3; 2; 1

assert Hc : c = 2 by apply Hbyte2 c ; change PByte5120 2, VBytec ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

Ha :

a = 4

Hb :

b = 3

Hc :

c = 2

⊢

a; b; c; d = 4; 3; 2; 1

assert Hd : d = 1 by apply Hbyte3 d ; change PByte5120 3, VByted ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

n :

Hn :

n = 0 ∨ n = stream_eof

a, b, c, d :

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap

Hkeys :

byte_ps5120 0 a; b; c; d.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

lengtha; b; c; d = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

Ha :

a = 4

Hb :

b = 3

Hc :

c = 2

Hd :

d = 1

⊢

a; b; c; d = 4; 3; 2; 1

subst

n :

Hn :

n = 0 ∨ n = stream_eof

Hwi :

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 changed_errno F.worldfalse <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 4; 3; 2; 1 open_heap

Hagree :

agreeschanged_errno <[PNametoken_keyout ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 4; 3; 2; 1 open_heap

Hkeys :

byte_ps5120 0 4; 3; 2; 1.*1 = byte_ps5120 0 0; 0; 0; 0.*1

Hlen :

length4; 3; 2; 1 = 4%nat

Hbyte :

∀i x : Z, PByte5120 i, VBytex ∈ byte_ps5120 0 4; 3; 2; 1 → x = m_byteschanged_errno 5120 + i

⊢

4; 3; 2; 1 = 4; 3; 2; 1

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros n Hn

destruct A.close_frameλ_ _ ⇒ True λ_ _ _ _ ⇒ False λ_ _ _ _ _ ⇒ False out err 5120 0 out _ _ _ _ _ _ _ _ _ _ open_heap 0; 0; 0; 0 or_introleq_refl changed_closen Hn open_heap_agrees HelloErrnoChecks.disjoint HelloErrnoChecks.ready full_wi eq_refl as ys & Hlen & Hkeys & Hagree & _ & _ & Hwi

–intros l v Hin

unfold open_heap , StreamHandleChecks.heap

pose proof MemLogic.byte_ps_elem_ _ _ _ _ Hin as i & x & Hi & El & Ev

subst l v

rewrite lookup_insert_ne ; | discriminate

unfold HelloErrnoChecks.heap

apply elem_of_list_to_map_1 ; | exact Hin

change base.NoDupPByte5120 0; PByte5120 1; PByte5120 2; PByte5120 3

repeat apply base.NoDup_cons_2 ; set_solver |

apply base.NoDup_nil_2

–exists ys

split ; | exact Hwi

destruct ys as | a | b | c | d rest ; try discriminate Hlen

assert rest = [ ] as → by destruct rest ; reflexivity | discriminate Hlen

assert Hbyte : ∀i x, PByte5120 i, VBytex ∈ byte_ps5120 0 a; b; c; d → x = m_byteschanged_errno 5120 + i

{intros i x Hin

assert Hl : <[PName−2 ≔ VStreamtoken_handleout None]>overwritebyte_ps5120 0 a; b; c; d open_heap !! PByte5120 i = SomeVBytex

{rewrite lookup_insert_ne ; | discriminate

change PByte5120 i, VBytex ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted in Hin

repeat apply elem_of_cons in Hin as E | Hin ; injection E as Ei Ex ; subst i x ; cbn [ byte_ps overwrite fst snd ] ; repeat rewrite lookup_insert_ne ; | discriminate ; apply lookup_insert_eq |

apply not_elem_of_nil in Hin

contradiction

destruct Hagree_ _ Hl as _ Hvalue

destruct HvaluemkRegion5120 5128 Heap Live eq_refl eq_refl as _ & _ & Hv

symmetry

exact Hv

assert Ha : a = 4 by apply Hbyte0 a ; change PByte5120 0, VBytea ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

assert Hb : b = 3 by apply Hbyte1 b ; change PByte5120 1, VByteb ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

assert Hc : c = 2 by apply Hbyte2 c ; change PByte5120 2, VBytec ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

assert Hd : d = 1 by apply Hbyte3 d ; change PByte5120 3, VByted ∈ PByte5120 0, VBytea; PByte5120 1, VByteb; PByte5120 2, VBytec; PByte5120 3, VByted ; apply list_elem_of_In ; simpl ; auto 10

subst

reflexivity

Updating only the stream name would leave stale owned errno. The last byte alone distinguishes that incorrect replacement.

985Example stale_errno_close_heap_rejected: ¬agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Explore proof 8 tactics

Initial goal

⊢

¬agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

intros Ha

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

⊢

False

assert Hl : <[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

2 open

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

⊢

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

focused goal

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

⊢

False

{unfold open_heap , StreamHandleChecks.heap , HelloErrnoChecks.heap

2 open

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

⊢

<[PName−2 ≔ VStreamtoken_handleout None]><[PName−2 ≔ VStreamtoken_handleout Some7, 65; 66]><[PName−3 ≔ VStreamtoken_handleerr Some3, [ ]]><[PLive1024 ≔ VLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live]><[PLive2048 ≔ VLiver_base ≔ 2048; r_end ≔ 2056; r_kind ≔ Stack; r_life ≔ Live]>list_to_mapbyte_ps5120 0 0; 0; 0; 0 !! PByte5120 3 = SomeVByte0

deferred goal

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

⊢

False

repeat rewrite lookup_insert_ne ; | discriminate

2 open

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

⊢

<[PByte5120 3%nat + 0, VByte0.1 ≔ PByte5120 3%nat + 0, VByte0.2]>∅ !! PByte5120 3 = SomeVByte0

deferred goal

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

⊢

False

apply lookup_insert_eq

deferred goal

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

⊢

False

destruct Ha_ _ Hl as _ Hbyte

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

Hbyte :

in_livechanged_errno 5120 3 m_byteschanged_errno 5120 + 3 = 0

⊢

False

destruct HbytemkRegion5120 5128 Heap Live eq_refl eq_refl as _ & _ & Hvalue

Ha :

agreeschanged_errno <[PName−2 ≔ VStreamtoken_handleout None]>open_heap

Hl :

<[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

Hbyte :

in_livechanged_errno 5120 3 m_byteschanged_errno 5120 + 3 = 0

Hvalue :

m_byteschanged_errno 5120 + 3 = 0

⊢

False

discriminate Hvalue

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Ha

assert Hl : <[PName−2 ≔ VStreamtoken_handleout None]>open_heap !! PByte5120 3 = SomeVByte0

{unfold open_heap , StreamHandleChecks.heap , HelloErrnoChecks.heap

repeat rewrite lookup_insert_ne ; | discriminate

apply lookup_insert_eq

destruct Ha_ _ Hl as _ Hbyte

destruct HbytemkRegion5120 5128 Heap Live eq_refl eq_refl as _ & _ & Hvalue

discriminate Hvalue

Entry begins with actual errno ownership, but no recorded FILE lives or observations. The observations are selected from the current world.

1000Lemma entry_keys

∀ l v

HelloErrnoChecks.heap !! l = Somev

∃i, l = PByte5120 i

Explore proof 5 tactics

Initial goal

⊢

∀l : piece v : pval, HelloErrnoChecks.heap !! l = Somev → ∃i : Z, l = PByte5120 i

intros l v Hl

l :

v :

Hl :

HelloErrnoChecks.heap !! l = Somev

⊢

∃i : Z, l = PByte5120 i

unfold HelloErrnoChecks.heap in Hl

l :

v :

Hl :

list_to_mapbyte_ps5120 0 0; 0; 0; 0 !! l = Somev

⊢

∃i : Z, l = PByte5120 i

apply elem_of_list_to_map_2 in Hl

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

∃i : Z, l = PByte5120 i

destruct MemLogic.byte_ps_elem_ _ _ _ _ Hl as i & x & _ & → & _

v :

i :

nat

Hl :

PByte5120 0 + i, v ∈ byte_ps5120 0 0; 0; 0; 0

x :

⊢

∃i₀ : Z, PByte5120 0 + i = PByte5120 i₀

eauto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros l v Hl

unfold HelloErrnoChecks.heap in Hl

apply elem_of_list_to_map_2 in Hl

destruct MemLogic.byte_ps_elem_ _ _ _ _ Hl as i & x & _ & → & _

eauto

1007Lemma entry_wi

stream_tokens_wiλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

Explore proof 29 tactics

Initial goal

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

assert Hkeys : ∀l v, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

2 open

⊢

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

{intros l v Hl _

2 open

l :

v :

Hl :

stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

apply stream_data_lookup in Hl as Hl _

2 open

l :

v :

Hl :

HelloErrnoChecks.heap !! l = Somev

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

unfold HelloErrnoChecks.heap in Hl

2 open

l :

v :

Hl :

list_to_mapbyte_ps5120 0 0; 0; 0; 0 !! l = Somev

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

apply elem_of_list_to_map_2 in Hl

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

l ∈ errno_keys5120 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

change l ∈ byte_ps5120 0 0; 0; 0; 0.*1

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

l ∈ byte_ps5120 0 0; 0; 0; 0.*1

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

apply list_elem_of_fmap

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

∃x : piece × pval, l = x.1 ∧ x ∈ byte_ps5120 0 0; 0; 0; 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

exists l, v

2 open

l :

v :

Hl :

l, v ∈ byte_ps5120 0 0; 0; 0; 0

⊢

l = l, v.1 ∧ l, v ∈ byte_ps5120 0 0; 0; 0; 0

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

auto

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap

split ; split ; reflexivity | simpl ; lia |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

token_wferr ∧ token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue HelloErrnoChecks.heap ∧ stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

split ; split ; reflexivity | simpl ; lia |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue HelloErrnoChecks.heap ∧ stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

split ; discriminate |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue HelloErrnoChecks.heap ∧ stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

split ; discriminate |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue HelloErrnoChecks.heap ∧ stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

split ; reflexivity |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue HelloErrnoChecks.heap ∧ stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

split ; reflexivity |

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_currentout F.worldtrue HelloErrnoChecks.heap ∧ stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

split

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_currentout F.worldtrue HelloErrnoChecks.heap

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_currenterr F.worldtrue HelloErrnoChecks.heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

{unfold stream_current

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

match HelloErrnoChecks.heap !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

destruct HelloErrnoChecks.heap !! PNametoken_keyout as v | eqn: E ; destruct entry_keys_ _ E as i Hbad ; discriminate Hbad | exact I

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

split

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

stream_currenterr F.worldtrue HelloErrnoChecks.heap

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled HelloErrnoChecks.heap

{unfold stream_current

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

match HelloErrnoChecks.heap !! PNametoken_keyerr with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

destruct HelloErrnoChecks.heap !! PNametoken_keyerr as v | eqn: E ; destruct entry_keys_ _ E as i Hbad ; discriminate Hbad | exact I

deferred goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

intros d → | →

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleout 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleout HelloErrnoChecks.heap

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleerr 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleerr HelloErrnoChecks.heap

all: split ; | intros base l v Hin ; change Inbase [ ] in Hin ; contradiction

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleout 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleerr 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap

all: split ; apply F.ready |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errnoF.worldtrue.1 = ptr_addr ≔ 5120 + 0; ptr_cap ≔ Obj5120 ∧ roots_apartlibc_stream_aux_rootsF.worldtrue token_handleout stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap conversion_mem ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleout stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap conversion_mem span_containserrno_span5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

libc_errnoF.worldtrue.1 = ptr_addr ≔ 5120 + 0; ptr_cap ≔ Obj5120 ∧ roots_apartlibc_stream_aux_rootsF.worldtrue token_handleerr stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap conversion_mem ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleerr stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap ∧ pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap conversion_mem span_containserrno_span5120 0

all: split ; reflexivity |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

all: split ; intros root a Hin ; change Inroot [ ] in Hin ; contradiction |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

all: split ; intros base l v Hin ; change Inbase [ ] in Hin ; contradiction |

2 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap conversion_mem span_containserrno_span5120 0

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

⊢

pieces_offerrno_keys5120 0 stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap conversion_mem span_containserrno_span5120 0

all: intros l v Hl Hnot ; destruct l as base | base off | base off | key ; try exact I

4 open

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap !! PBytebase off = Somev

Hnot :

PBytebase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap !! PAuxbase off = Somev

Hnot :

PAuxbase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap !! PBytebase off = Somev

Hnot :

PBytebase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

focused goal

Hkeys :

∀l : piece v : pval, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

base, off :

v :

Hl :

stream_data_heaptoken_baseout token_baseerr HelloErrnoChecks.heap !! PAuxbase off = Somev

Hnot :

PAuxbase off ∉ errno_keys5120 0

⊢

∀reg : region, live_atconversion_mem base reg → 0 ≤ off → base + off < r_endreg → ¬span_containserrno_span5120 0 base + off

all: exfalso ; apply Hnot ; eapply Hkeys ; exact Hl | exact I

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

assert Hkeys : ∀l v, stream_data_heap1024 2048 HelloErrnoChecks.heap !! l = Somev → mem_piecel → l ∈ errno_keys5120 0

{intros l v Hl _

apply stream_data_lookup in Hl as Hl _

unfold HelloErrnoChecks.heap in Hl

apply elem_of_list_to_map_2 in Hl

change l ∈ byte_ps5120 0 0; 0; 0; 0.*1

apply list_elem_of_fmap

exists l, v

auto

split ; split ; reflexivity | simpl ; lia |

split ; discriminate |

split ; reflexivity |

split

{unfold stream_current

destruct HelloErrnoChecks.heap !! PNametoken_keyout as v | eqn: E ; destruct entry_keys_ _ E as i Hbad ; discriminate Hbad | exact I

split

{unfold stream_current

destruct HelloErrnoChecks.heap !! PNametoken_keyerr as v | eqn: E ; destruct entry_keys_ _ E as i Hbad ; discriminate Hbad | exact I

intros d → | →

all: split ; | intros base l v Hin ; change Inbase [ ] in Hin ; contradiction

all: split ; apply F.ready |

all: split ; reflexivity |

all: split ; intros root a Hin ; change Inroot [ ] in Hin ; contradiction |

all: split ; intros base l v Hin ; change Inbase [ ] in Hin ; contradiction |

all: intros l v Hl Hnot ; destruct l as base | base off | base off | key ; try exact I

all: exfalso ; apply Hnot ; eapply Hkeys ; exact Hl | exact I

1034Lemma entry_fresh

∀ l v

l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

HelloErrnoChecks.heap !! l = None

Explore proof 6 tactics

Initial goal

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

intros l v Hin

l :

v :

Hin :

l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

⊢

HelloErrnoChecks.heap !! l = None

destruct HelloErrnoChecks.heap !! l as old | eqn: E ; | reflexivity

l :

v :

Hin :

l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

old :

E :

HelloErrnoChecks.heap !! l = Someold

⊢

Someold = None

destruct entry_keys_ _ E as i →

v :

i :

Hin :

PByte5120 i, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

old :

E :

HelloErrnoChecks.heap !! PByte5120 i = Someold

⊢

Someold = None

apply list_elem_of_In in Hin

v :

i :

Hin :

InPByte5120 i, v stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

old :

E :

HelloErrnoChecks.heap !! PByte5120 i = Someold

⊢

Someold = None

cbn [ stream_ps app out err token_base token_key ] in Hin

v :

i :

Hin :

InPByte5120 i, v PLive1024, VLivetoken_regionout :: PName−2, VStreamtoken_handleout Some7, 65; 66 :: stream_pserr 3 [ ]

old :

live_atconversion_mem token_baseout token_regionout

E :

HelloErrnoChecks.heap !! PByte5120 i = Someold

⊢

Someold = None

destruct Hin as Hbad | Hbad | Hbad | Hbad | ; discriminate Hbad

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros l v Hin

destruct HelloErrnoChecks.heap !! l as old | eqn: E ; | reflexivity

destruct entry_keys_ _ E as i →

apply list_elem_of_In in Hin

cbn [ stream_ps app out err token_base token_key ] in Hin

destruct Hin as Hbad | Hbad | Hbad | Hbad | ; discriminate Hbad

1043Section entry_iris

1044Context `{!gen_heapGSpiece pval Σ}

Both real tokens are produced while independently owned errno is retained. This is not just a construction of a pure endpoint map.

1048Example entry_produces_pair: gen_heap_interpHelloErrnoChecks.heap ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ⇛ ∃h, gen_heap_interph ∗ ptsstream_psout 7 65; 66 ∗ ptsstream_pserr 3 [ ] ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ∗ ⌜agreesconversion_mem h ∧ stream_tokens_wiλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue h⌝

Explore proof 13 tactics

Initial goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

gen_heap_interpHelloErrnoChecks.heap ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ⇛ ∃h : gmappiece pval, gen_heap_interph ∗ ptsstream_psout 7 65; 66 ∗ ptsstream_pserr 3 [ ] ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ∗ ⌜agreesconversion_mem h ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue h⌝

iIntros [Hh Herrno]

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hh :

gen_heap_interpHelloErrnoChecks.heap

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

∗

|⇛ ∃h : gmappiece pval, gen_heap_interph ∗ ptsstream_psout 7 65; 66 ∗ ptsstream_pserr 3 [ ] ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ∗ ⌜agreesconversion_mem h ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue h⌝

iMod stream_entry_allocλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap 7 65; 66 3 [ ] HelloErrnoChecks.heap_agrees entry_wi with Hh as (Hh & Ho & He & %Hnew)

6 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

live_atconversion_mem token_baseerr token_regionerr

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleout Some7, 65; 66

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

focused goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

agreesconversion_mem overwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue overwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

live_atconversion_mem token_baseerr token_regionerr

∗

–split ; reflexivity

5 open

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleout Some7, 65; 66

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

–split ; reflexivity

4 open

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleout Some7, 65; 66

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

–exists mkStreamInfo1 mkStreamByteOriented 65; 66 true 7

4 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

repeat split ; reflexivity

3 open

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

stream_observationF.worldtrue token_handleerr Some3, [ ]

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

–exists mkStreamInfo2 stdout_initial 3

3 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

repeat split ; reflexivity

2 open

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

⊢

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → HelloErrnoChecks.heap !! l = None

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

–exact entry_fresh

deferred goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

–iModIntro

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

∃h : gmappiece pval, gen_heap_interph ∗ ptsstream_psout 7 65; 66 ∗ ptsstream_pserr 3 [ ] ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ∗ ⌜agreesconversion_mem h ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue h⌝

iExists _

2 open

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

Herrno :

ptsbyte_ps5120 0 0; 0; 0; 0

Hh :

gen_heap_interpoverwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap

Ho :

ptsstream_psout 7 65; 66

He :

∗

gen_heap_interp?g ∗ ptsstream_psout 7 65; 66 ∗ ptsstream_pserr 3 [ ] ∗ ptsbyte_ps5120 0 0; 0; 0; 0 ∗ ⌜agreesconversion_mem ?g ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue ?g⌝

shelved goal

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

⊢

gmappiece pval

iFrame

Σ :

gFunctors

gen_heapGS₀ :

gen_heapGSpiece pval Σ

Hnew :

∗

⌜agreesconversion_mem overwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap ∧ stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue overwritestream_psout 7 65; 66 ++ stream_pserr 3 [ ] HelloErrnoChecks.heap⌝

done

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

iIntros [Hh Herrno]

iMod stream_entry_allocλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue HelloErrnoChecks.heap 7 65; 66 3 [ ] HelloErrnoChecks.heap_agrees entry_wi with Hh as (Hh & Ho & He & %Hnew)

–split ; reflexivity

–exists mkStreamInfo1 mkStreamByteOriented 65; 66 true 7

repeat split ; reflexivity

–exists mkStreamInfo2 stdout_initial 3

repeat split ; reflexivity

–exact entry_fresh

–iModIntro

iExists _

iFrame

done

An existing key cannot be freshly recorded, even if its native object is live and the caller has no fragment for the old value.

1071Example occupied_life_not_fresh: ¬∀l v, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → StreamHandleChecks.heap !! l = None

Explore proof 7 tactics

Initial goal

⊢

¬∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → StreamHandleChecks.heap !! l = None

intros Hfresh

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → StreamHandleChecks.heap !! l = None

⊢

False

specialize HfreshPLive1024 VLivetoken_regionout

Hfresh :

PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → StreamHandleChecks.heap !! PLive1024 = None

⊢

False

assert Hin : PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] by apply list_elem_of_In ; simpl ; auto

Hfresh :

PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → StreamHandleChecks.heap !! PLive1024 = None

Hin :

PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

⊢

False

specialize HfreshHin

Hfresh :

StreamHandleChecks.heap !! PLive1024 = None

Hin :

PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

⊢

False

unfold StreamHandleChecks.heap in Hfresh

Hfresh :

Hin :

PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

⊢

False

rewrite lookup_insert_eq in Hfresh

Hin :

PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

Hfresh :

SomeVLiver_base ≔ 1024; r_end ≔ 1056; r_kind ≔ GlobalData; r_life ≔ Live = None

⊢

False

discriminate Hfresh

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Hfresh

specialize HfreshPLive1024 VLivetoken_regionout

assert Hin : PLive1024, VLivetoken_regionout ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] by apply list_elem_of_In ; simpl ; auto

specialize HfreshHin

unfold StreamHandleChecks.heap in Hfresh

rewrite lookup_insert_eq in Hfresh

discriminate Hfresh

1083Example occupied_name_not_fresh: ¬∀l v, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → <[PName−2 ≔ VCodecTAtom"C"]>HelloErrnoChecks.heap !! l = None

Explore proof 6 tactics

Initial goal

⊢

¬∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → <[PName−2 ≔ VCodecTAtom"C"]>HelloErrnoChecks.heap !! l = None

intros Hfresh

Hfresh :

∀l : piece v : pval, l, v ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → <[PName−2 ≔ VCodecTAtom"C"]>HelloErrnoChecks.heap !! l = None

⊢

False

specialize HfreshPName−2 VStreamtoken_handleout Some7, 65; 66

Hfresh :

PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → <[PName−2 ≔ VCodecTAtom"C"]>HelloErrnoChecks.heap !! PName−2 = None

⊢

False

assert Hin : PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] by apply list_elem_of_In ; simpl ; auto

Hfresh :

PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] → <[PName−2 ≔ VCodecTAtom"C"]>HelloErrnoChecks.heap !! PName−2 = None

Hin :

PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

⊢

False

specialize HfreshHin

Hfresh :

<[PName−2 ≔ VCodecTAtom"C"]>HelloErrnoChecks.heap !! PName−2 = None

Hin :

PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

⊢

False

rewrite lookup_insert_eq in Hfresh

Hin :

PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ]

Hfresh :

SomeVCodecTAtom"C" = None

⊢

False

discriminate Hfresh

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Hfresh

specialize HfreshPName−2 VStreamtoken_handleout Some7, 65; 66

assert Hin : PName−2, VStreamtoken_handleout Some7, 65; 66 ∈ stream_psout 7 65; 66 ++ stream_pserr 3 [ ] by apply list_elem_of_In ; simpl ; auto

specialize HfreshHin

rewrite lookup_insert_eq in Hfresh

discriminate Hfresh

1094Example aliased_handles_rejected: ∀rep b o m w h, ¬stream_tokens_wirep out out b o m w h

Explore proof 3 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop b o : Z m : mem w : libc_world h : gmappiece pval, ¬stream_tokens_wirep out out b o m w h

intros rep b o m w h _ & _ & Hbad & _

rep :

mem → libc_world → Prop

b, o :

m :

w :

h :

gmappiece pval

Hbad :

token_baseout ≠ token_baseout

⊢

False

apply Hbad

rep :

mem → libc_world → Prop

b, o :

m :

w :

h :

gmappiece pval

Hbad :

token_baseout ≠ token_baseout

⊢

token_baseout = token_baseout

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep b o m w h _ & _ & Hbad & _

apply Hbad

reflexivity

1098Example completed_close_not_readmitted: ¬stream_call_preF.model WPtrtoken_handleout changed_errno F.worldfalse

Explore proof 3 tactics

Initial goal

⊢

¬stream_call_preF.model WPtrtoken_handleout changed_errno F.worldfalse

intros p & info & Hargs & _ & Hopen & _

p :

info :

Hargs :

WPtrtoken_handleout = WPtrp

Hopen :

stream_atF.model F.worldfalse p = Someinfo

⊢

False

injection Hargs as ←

info :

Hopen :

stream_atF.model F.worldfalse ptr_addr ≔ 1024; ptr_cap ≔ Obj1024 = Someinfo

⊢

False

discriminate Hopen

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros p & info & Hargs & _ & Hopen & _

injection Hargs as ←

discriminate Hopen

Open-only callback permissions use separate keys from the exact -2/-3 snapshots, codec -1, locale 0..12 and getopt 64. The fixture contains NO exact snapshot names; two interpretations must not be conjoined to hide stale observations after diagnostics.

1111Module StreamPermissionChecks

1112Module T ≔ StreamTokenChecks

1113Module F ≔ LibcStreamChecks

1114Module A ≔ T.A

1116Definition out ≔

mkStreamTokentoken_handleT.out token_baseT.out token_regionT.out −4

1117Definition err ≔

mkStreamTokentoken_handleT.err token_baseT.err token_regionT.err −5

1118Definition heap: gmappiece pval ≔

<[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap

1122Lemma memory_lookup

∀ l

heap !! l = T.open_heap !! l

Explore proof 3 tactics

Initial goal

⊢

∀l : piece, mem_piecel → heap !! l = T.open_heap !! l

intros l Hmem

l :

Hmem :

agreesconversion_mem heap

⊢

heap !! l = T.open_heap !! l

destruct l ; try contradiction

3 open

b :

Hmem :

mem_piecePLiveb

⊢

heap !! PLiveb = T.open_heap !! PLiveb

focused goal

b, o :

Hmem :

mem_piecePByteb o

⊢

heap !! PByteb o = T.open_heap !! PByteb o

focused goal

b, o :

Hmem :

mem_piecePAuxb o

⊢

heap !! PAuxb o = T.open_heap !! PAuxb o

all: unfold heap , T.open_heap ; repeat rewrite lookup_insert_ne ; | discriminate ; reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros l Hmem

destruct l ; try contradiction

all: unfold heap , T.open_heap ; repeat rewrite lookup_insert_ne ; | discriminate ; reflexivity

1128Lemma heap_agrees

Explore proof 5 tactics

Initial goal

⊢

agreesconversion_mem heap

intros l v Hl

l :

v :

Hl :

heap !! l = Somev

⊢

unfold heap in Hl

l :

v :

Hl :

<[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! l = Somev

⊢

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l v ; exact I |

l :

v :

Hl :

<[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! l = Somev

⊢

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l v ; exact I |

l :

v :

Hl :

StreamHandleChecks.heap !! l = Somev

⊢

exact StreamHandleChecks.heap_agreesl v Hl

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros l v Hl

unfold heap in Hl

apply lookup_insert_Some in Hl as He Hv | _ Hl ; subst l v ; exact I |

exact StreamHandleChecks.heap_agreesl v Hl

1136Lemma currents

stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap

Explore proof 10 tactics

Initial goal

⊢

stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap

unfold stream_current , heap

⊢

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

∧

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PNametoken_keyerr with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

cbn [ out err token_key ]

⊢

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PName−4 with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

∧

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PName−5 with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_eq

⊢

token_handleout = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue token_handleout = Someinfo

∧

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PName−5 with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_ne ; | discriminate

⊢

token_handleout = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue token_handleout = Someinfo

∧

match <[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PName−5 with

SomeVStreamp snapshot

⇒

p = token_handleerr ∧ stream_observationF.worldtrue p snapshot

SomeVStreamOpenp

⇒

p = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue p = Someinfo

None

⇒

True

⇒

False

rewrite lookup_insert_eq

⊢

token_handleout = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldtrue token_handleout = Someinfo ∧ token_handleerr = token_handleerr ∧ ∃info : stream_info, libc_stream_atF.worldtrue token_handleerr = Someinfo

split ; split ; reflexivity |

2 open

⊢

∃info : stream_info, libc_stream_atF.worldtrue token_handleout = Someinfo

focused goal

⊢

∃info : stream_info, libc_stream_atF.worldtrue token_handleerr = Someinfo

–exists mkStreamInfo1 mkStreamByteOriented 65; 66 true 7

2 open

⊢

libc_stream_atF.worldtrue token_handleout = Somestream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; stream_error ≔ true; stream_pending ≔ 7

deferred goal

⊢

∃info : stream_info, libc_stream_atF.worldtrue token_handleerr = Someinfo

reflexivity

deferred goal

⊢

∃info : stream_info, libc_stream_atF.worldtrue token_handleerr = Someinfo

–exists mkStreamInfo2 stdout_initial 3

⊢

libc_stream_atF.worldtrue token_handleerr = Somestream_identifier ≔ 2; stream_protocol ≔ stdout_initial; stream_pending ≔ 3

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

unfold stream_current , heap

cbn [ out err token_key ]

rewrite lookup_insert_eq

rewrite lookup_insert_ne ; | discriminate

rewrite lookup_insert_eq

split ; split ; reflexivity |

–exists mkStreamInfo1 mkStreamByteOriented 65; 66 true 7

reflexivity

–exists mkStreamInfo2 stdout_initial 3

reflexivity

1145Lemma full_wi

stream_tokens_wiλ_ _ ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

Explore proof 23 tactics

Initial goal

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

destruct T.full_wi as _ & _ & _ & _ & _ & _ & _ & _ & Hprivate

Hprivate :

∀d : stream_token, d = T.out ∨ d = T.err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap ∧ ids_apartlibc_stream_releasesT.F.worldtrue token_handled T.open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

assert Hdata : memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

2 open

Hprivate :

⊢

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

focused goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

{intros l v Hl Hmem

2 open

Hprivate :

l :

v :

Hl :

stream_data_heap1024 2048 heap !! l = Somev

Hmem :

⊢

∃old : pval, stream_data_heap1024 2048 T.open_heap !! l = Someold

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

apply stream_data_lookup in Hl as Hl & Ho & He

2 open

Hprivate :

l :

v :

Hl :

heap !! l = Somev

Ho :

l ≠ PLive1024

He :

l ≠ PLive2048

Hmem :

⊢

∃old : pval, stream_data_heap1024 2048 T.open_heap !! l = Someold

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

exists v

2 open

Hprivate :

l :

v :

Hl :

heap !! l = Somev

Ho :

l ≠ PLive1024

He :

l ≠ PLive2048

Hmem :

⊢

stream_data_heap1024 2048 T.open_heap !! l = Somev

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

rewrite stream_data_lookup_ne ; rewrite <- memory_lookup ; assumption | assumption | assumption

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_tokens_wiλ_ : mem _ : libc_world ⇒ True out err 5120 0 conversion_mem F.worldtrue heap

split ; split ; reflexivity | simpl ; lia |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

token_wferr ∧ token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; split ; reflexivity | simpl ; lia |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

token_baseout ≠ token_baseerr ∧ token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; discriminate |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

token_keyout ≠ token_keyerr ∧ libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; discriminate |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

libc_stdoutF.worldtrue = token_handleout ∧ libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; reflexivity |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

libc_stderrF.worldtrue = token_handleerr ∧ stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; reflexivity |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_currentout F.worldtrue heap ∧ stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; exact proj1currents |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

stream_currenterr F.worldtrue heap ∧ ∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

split ; exact proj2currents |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

∀d : stream_token, d = out ∨ d = err → libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handled 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handled heap

intros d → | →

2 open

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleout 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleout heap

focused goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleerr 5120 0 conversion_mem F.worldtrue stream_data_heaptoken_baseout token_baseerr heap ∧ ids_apartlibc_stream_releasesF.worldtrue token_handleerr heap

–destruct HprivateT.out or_introleq_refl as Hwi Hrel

2 open

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

Hwi :

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleT.out 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap

Hrel :

ids_apartlibc_stream_releasesT.F.worldtrue token_handleT.out T.open_heap

⊢

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

split ; eapply errno_wi_heap ; exact Hwi | exact Hdata |

2 open

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

Hwi :

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleT.out 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap

Hrel :

ids_apartlibc_stream_releasesT.F.worldtrue token_handleT.out T.open_heap

⊢

ids_apartlibc_stream_releasesF.worldtrue token_handleout heap

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

intros base l v Hin Hl Hmem

2 open

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

Hwi :

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleT.out 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap

Hrel :

ids_apartlibc_stream_releasesT.F.worldtrue token_handleT.out T.open_heap

base :

l :

v :

Hin :

Inbase libc_stream_releasesF.worldtrue token_handleout

Hl :

heap !! l = Somev

Hmem :

⊢

piece_idl ≠ base

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

apply Hrelbase l v Hin ; rewrite <- memory_lookup ; assumption | exact Hmem

deferred goal

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

⊢

–destruct HprivateT.err or_introreq_refl as Hwi Hrel

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

Hwi :

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleT.err 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap

Hrel :

ids_apartlibc_stream_releasesT.F.worldtrue token_handleT.err T.open_heap

⊢

split ; eapply errno_wi_heap ; exact Hwi | exact Hdata |

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

Hwi :

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleT.err 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap

Hrel :

ids_apartlibc_stream_releasesT.F.worldtrue token_handleT.err T.open_heap

⊢

ids_apartlibc_stream_releasesF.worldtrue token_handleerr heap

intros base l v Hin Hl Hmem

Hprivate :

Hdata :

memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

Hwi :

libc_errno_wiλ_ : mem _ : libc_world ⇒ True token_handleT.err 5120 0 conversion_mem T.F.worldtrue stream_data_heaptoken_baseT.out token_baseT.err T.open_heap

Hrel :

ids_apartlibc_stream_releasesT.F.worldtrue token_handleT.err T.open_heap

base :

l :

v :

Hin :

Inbase libc_stream_releasesF.worldtrue token_handleerr

Hl :

heap !! l = Somev

Hmem :

⊢

piece_idl ≠ base

apply Hrelbase l v Hin ; rewrite <- memory_lookup ; assumption | exact Hmem

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

destruct T.full_wi as _ & _ & _ & _ & _ & _ & _ & _ & Hprivate

assert Hdata : memory_keys_fromstream_data_heap1024 2048 heap stream_data_heap1024 2048 T.open_heap

{intros l v Hl Hmem

apply stream_data_lookup in Hl as Hl & Ho & He

exists v

rewrite stream_data_lookup_ne ; rewrite <- memory_lookup ; assumption | assumption | assumption

split ; split ; reflexivity | simpl ; lia |

split ; discriminate |

split ; reflexivity |

split ; exact proj1currents |

split ; exact proj2currents |

intros d → | →

–destruct HprivateT.out or_introleq_refl as Hwi Hrel

split ; eapply errno_wi_heap ; exact Hwi | exact Hdata |

intros base l v Hin Hl Hmem

apply Hrelbase l v Hin ; rewrite <- memory_lookup ; assumption | exact Hmem

–destruct HprivateT.err or_introreq_refl as Hwi Hrel

split ; eapply errno_wi_heap ; exact Hwi | exact Hdata |

intros base l v Hin Hl Hmem

apply Hrelbase l v Hin ; rewrite <- memory_lookup ; assumption | exact Hmem

Rejection follows from the PURE interface, without Iris falsehood.

1166Example unknown_argument_rejected: ∀rep b o m w h, stream_tokens_wirep out err b o m w h → ¬∀l v, l, v ∈ permission_psout err mkPtr3072 Obj3072 → h !! l = Somev

Explore proof 2 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop b o : Z m : mem w : libc_world h : gmappiece pval, stream_tokens_wirep out err b o m w h → ¬∀l : piece v : pval, l, v ∈ permission_psout err ptr_addr ≔ 3072; ptr_cap ≔ Obj3072 → h !! l = Somev

intros rep b o m w h Hw Hl

rep :

mem → libc_world → Prop

b, o :

m :

w :

h :

gmappiece pval

Hw :

stream_tokens_wirep out err b o m w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err ptr_addr ≔ 3072; ptr_cap ≔ Obj3072 → h !! l = Somev

⊢

False

destruct proj2permission_known_ _ _ _ _ _ _ _ _ Hw Hl as Hbad | Hbad ; discriminate Hbad

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep b o m w h Hw Hl

destruct proj2permission_known_ _ _ _ _ _ _ _ _ Hw Hl as Hbad | Hbad ; discriminate Hbad

1174Example wrong_capability_rejected: ∀rep b o m w h, stream_tokens_wirep out err b o m w h → ¬∀l v, l, v ∈ permission_psout err mkPtr1024 Ro1024 → h !! l = Somev

Explore proof 2 tactics

Initial goal

⊢

∀rep : mem → libc_world → Prop b o : Z m : mem w : libc_world h : gmappiece pval, stream_tokens_wirep out err b o m w h → ¬∀l : piece v : pval, l, v ∈ permission_psout err ptr_addr ≔ 1024; ptr_cap ≔ Ro1024 → h !! l = Somev

intros rep b o m w h Hw Hl

rep :

mem → libc_world → Prop

b, o :

m :

w :

stream_currentout changed_world heap

h :

gmappiece pval

Hw :

stream_tokens_wirep out err b o m w h

Hl :

∀l : piece v : pval, l, v ∈ permission_psout err ptr_addr ≔ 1024; ptr_cap ≔ Ro1024 → h !! l = Somev

⊢

False

destruct proj2permission_known_ _ _ _ _ _ _ _ _ Hw Hl as Hbad | Hbad ; discriminate Hbad

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros rep b o m w h Hw Hl

destruct proj2permission_known_ _ _ _ _ _ _ _ _ Hw Hl as Hbad | Hbad ; discriminate Hbad

A new pending count/FIFO invalidates the old exact snapshot, while the open-only permission is still current. This is a world-view control, not a native diagnostic execution.

1185Definition changed_world: libc_world ≔

mkLibcPayloadlibc_localefstF.worldtrue libc_stdiofstF.worldtrue libc_errnofstF.worldtrue mkLibcStreamsmkLibcFiletoken_handleout 9 [ ] [ ] [ ] F.err_file true stdout_initial libc_getoptfstF.worldtrue, mkShutdownHandlers 0 [ ] [ ] mkStreamByteOriented 65; 66; 67 true

1192Example open_permission_not_snapshot: stream_currentout changed_world heap ∧ ¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

Explore proof 14 tactics

Initial goal

⊢

stream_currentout changed_world heap ∧ ¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

split

2 open

⊢

focused goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

–unfold stream_current , heap

2 open

⊢

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PNametoken_keyout with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationchanged_world p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atchanged_world p = Someinfo

None

⇒

True

⇒

False

deferred goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

cbn [ out token_key ]

2 open

⊢

match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PName−4 with

SomeVStreamp snapshot

⇒

p = token_handleout ∧ stream_observationchanged_world p snapshot

SomeVStreamOpenp

⇒

p = token_handleout ∧ ∃info : stream_info, libc_stream_atchanged_world p = Someinfo

None

⇒

True

⇒

False

deferred goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

rewrite lookup_insert_eq

2 open

⊢

token_handleout = token_handleout ∧ ∃info : stream_info, libc_stream_atchanged_world token_handleout = Someinfo

deferred goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

split ; reflexivity |

2 open

⊢

∃info : stream_info, libc_stream_atchanged_world token_handleout = Someinfo

deferred goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

exists mkStreamInfo1 mkStreamByteOriented 65; 66; 67 true 9

2 open

⊢

libc_stream_atchanged_world token_handleout = Somestream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; 67; stream_error ≔ true; stream_pending ≔ 9

deferred goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

reflexivity

deferred goal

⊢

¬stream_currentout changed_world <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap

–unfold stream_current

⊢

¬match <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap !! PNametoken_keyout with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationchanged_world p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atchanged_world p = Someinfo | None ⇒ True | _ ⇒ False end

cbn [ out token_key ]

⊢

¬match <[PName−4 ≔ VStreamtoken_handleout Some7, 65; 66]>heap !! PName−4 with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationchanged_world p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atchanged_world p = Someinfo | None ⇒ True | _ ⇒ False end

rewrite lookup_insert_eq

⊢

¬token_handleout = token_handleout ∧ stream_observationchanged_world token_handleout Some7, 65; 66

intros _ & info & Hinfo & Hpending & _

info :

Hinfo :

libc_stream_atchanged_world token_handleout = Someinfo

Hpending :

stream_pendinginfo = 7

⊢

False

change SomemkStreamInfo1 mkStreamByteOriented 65; 66; 67 true 9 = Someinfo in Hinfo

info :

Hinfo :

Somestream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; 67; stream_error ≔ true; stream_pending ≔ 9 = Someinfo

Hpending :

stream_pendinginfo = 7

⊢

False

injection Hinfo as ←

Hpending :

stream_pendingstream_identifier ≔ 1; stream_protocol ≔ orientation ≔ ByteOriented; outstanding ≔ 65; 66; 67; stream_error ≔ true; stream_pending ≔ 9 = 7

⊢

False

discriminate Hpending

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

split

–unfold stream_current , heap

cbn [ out token_key ]

rewrite lookup_insert_eq

split ; reflexivity |

exists mkStreamInfo1 mkStreamByteOriented 65; 66; 67 true 9

reflexivity

–unfold stream_current

cbn [ out token_key ]

rewrite lookup_insert_eq

intros _ & info & Hinfo & Hpending & _

change SomemkStreamInfo1 mkStreamByteOriented 65; 66; 67 true 9 = Someinfo in Hinfo

injection Hinfo as ←

discriminate Hpending

1207Example closed_permission_rejected: ¬stream_currentout F.worldfalse heap

Explore proof 5 tactics

Initial goal

⊢

¬stream_currentout F.worldfalse heap

unfold stream_current , heap

⊢

¬match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PNametoken_keyout with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldfalse p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldfalse p = Someinfo | None ⇒ True | _ ⇒ False end

cbn [ out token_key ]

⊢

¬match <[PName−4 ≔ VStreamOpentoken_handleout]><[PName−5 ≔ VStreamOpentoken_handleerr]>StreamHandleChecks.heap !! PName−4 with SomeVStreamp snapshot ⇒ p = token_handleout ∧ stream_observationF.worldfalse p snapshot | SomeVStreamOpenp ⇒ p = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldfalse p = Someinfo | None ⇒ True | _ ⇒ False end

rewrite lookup_insert_eq

⊢

¬token_handleout = token_handleout ∧ ∃info : stream_info, libc_stream_atF.worldfalse token_handleout = Someinfo

intros _ & info & Hinfo

info :