persistent_array.coma

module M_implementation__impl_Clone_for_PersistentArray_T__clone (* <implementation::PersistentArray<T> as std::clone::Clone> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use seq.Seq
  use map.Map
  use map.Const
  use creusot.prelude.Any
  use int.Int
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = { f0: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  type t_Rc_NonAtomicInvariant_PA_T_Global
  
  type t_PersistentArray_T = {
    permcell: t_Rc_PermCell_Inner_T_Global;
    frag: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T;
    inv: t_Rc_NonAtomicInvariant_PA_T_Global }
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate invariant_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Rc_PermCell_Inner_T_Global) =
    invariant_ref_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_PermCell_Inner_T_Global
  
  let rec clone_Rc_PermCell_Inner_T_Global (self_: t_Rc_PermCell_Inner_T_Global)
    (return (x: t_Rc_PermCell_Inner_T_Global)) =
    {[@stop_split] [@expl:clone 'self_' type invariant] inv_ref_Rc_PermCell_Inner_T_Global self_}
    any
    [ return (result: t_Rc_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:clone_Rc_PermCell_Inner_T_Global ensures] ([@stop_split] [@expl:clone result type invariant] inv_Rc_PermCell_Inner_T_Global result)
      /\ ([@stop_split] [@expl:clone ensures] result = self_)}
      (! return {result}) ]
  
  let rec deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:deref ensures] result = self}
      (! return {result}) ]
  
  type t_Id
  
  function id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id =
    id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_FMap_PermCell_Inner_T_Ag_Seq_T = None | Some t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_T
  
  type t_Ag_Seq_T = { f0'0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None'0 | Some'0 t_Ag_Seq_T
  
  type t_Option_Option_Ag_Seq_T = None'1 | Some'1 t_Option_Ag_Seq_T
  
  type tup2_Option_Ag_Seq_T_Option_Ag_Seq_T = { f0'1: t_Option_Ag_Seq_T; f1'1: t_Option_Ag_Seq_T }
  
  function map_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (f: Map.map t_Ag_Seq_T t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T
   = match self with
      | None'0 -> None'1
      | Some'0 x -> Some'1 (Map.get f x)
      end
  
  function op_Ag_Seq_T (self: t_Ag_Seq_T) (other: t_Ag_Seq_T) : t_Option_Ag_Seq_T = if self.f0'0 = other.f0'0 then
      Some'0 self
    else
      None'0
  
  
  function commutative_Ag_Seq_T (a: t_Ag_Seq_T) (b: t_Ag_Seq_T) : ()
  
  axiom commutative_Ag_Seq_T_spec: forall a: t_Ag_Seq_T, b: t_Ag_Seq_T. op_Ag_Seq_T a b = op_Ag_Seq_T b a
  
  function op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = other } with
      | {f0'1 = None'0} -> Some'1 other
      | {f1'1 = None'0} -> Some'1 self
      | {f0'1 = Some'0 x; f1'1 = Some'0 y} -> map_Option_Ag_Seq_T (op_Ag_Seq_T x y) (fun (z: t_Ag_Seq_T) -> Some'0 z)
      end
  
  function commutative_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) : ()
  
  axiom commutative_Option_Ag_Seq_T_spec: forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
      = op_Option_Ag_Seq_T b a
  
  type t_PermCell_Inner_T
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  function total_op_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom total_op_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T. (forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
          <> None'1)
      -> (forall k: t_PermCell_Inner_T. Some'1 (get_PermCell_Inner_T (total_op_PermCell_Inner_T self other) k)
        = op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k))
  
  function op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   = if forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
      <> None'1 then
      Some (total_op_PermCell_Inner_T self other)
    else
      None
  
  
  function commutative_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom commutative_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
      = op_FMap_PermCell_Inner_T_Ag_Seq_T b a
  
  function len_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : int
  
  axiom len_PermCell_Inner_T_spec: forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. len_PermCell_Inner_T self >= 0
  
  constant empty_PermCell_Inner_T : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom empty_PermCell_Inner_T_spec: len_PermCell_Inner_T empty_PermCell_Inner_T = 0
  
  axiom empty_PermCell_Inner_T_spec'0: to_mapping_PermCell_Inner_T empty_PermCell_Inner_T = Const.const (None'0)
  
  constant unit_FMap_PermCell_Inner_T_Ag_Seq_T: t_FMap_PermCell_Inner_T_Ag_Seq_T = empty_PermCell_Inner_T
  
  axiom unit_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall x: t_FMap_PermCell_Inner_T_Ag_Seq_T [op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T]. op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T
      = Some x
  
  function factor_Ag_Seq_T (self: t_Ag_Seq_T) (factor: t_Ag_Seq_T) : t_Option_Ag_Seq_T = op_Ag_Seq_T self factor
  
  axiom factor_Ag_Seq_T_spec: forall self: t_Ag_Seq_T, factor: t_Ag_Seq_T. match factor_Ag_Seq_T self factor with
        | Some'0 c -> op_Ag_Seq_T factor c = Some'0 self
        | None'0 -> forall c: t_Ag_Seq_T. op_Ag_Seq_T factor c <> Some'0 self
        end
  
  function factor_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (factor: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = factor } with
      | {f0'1 = x; f1'1 = None'0} -> Some'1 x
      | {f0'1 = None'0} -> None'1
      | {f0'1 = Some'0 x; f1'1 = Some'0 y} -> match factor_Ag_Seq_T x y with
        | Some'0 z -> Some'1 (Some'0 z)
        | None'0 -> if x = y then Some'1 (None'0) else None'1
        end
      end
  
  axiom factor_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, factor: t_Option_Ag_Seq_T. match factor_Option_Ag_Seq_T self factor with
        | Some'1 c -> op_Option_Ag_Seq_T factor c = Some'1 self
        | None'1 -> forall c: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T factor c <> Some'1 self
        end
  
  predicate incl_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) =
    factor_Option_Ag_Seq_T other self <> None'1
  
  function incl_transitive_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) : ()
  
  axiom incl_transitive_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T. incl_Option_Ag_Seq_T a b
      -> incl_Option_Ag_Seq_T b c -> incl_Option_Ag_Seq_T a c
  
  function associative_some_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (ab: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_some_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, ab: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = Some'1 ab -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = op_Option_Ag_Seq_T ab c
  
  function associative_none_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_none_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = None'1 -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = None'1
  
  function incl_op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) (comb: t_Option_Ag_Seq_T) : ()
  
  axiom incl_op_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, other: t_Option_Ag_Seq_T, comb: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T self other
        = Some'1 comb -> incl_Option_Ag_Seq_T self comb
  
  type tup2_PermCell_Inner_T_Ag_Seq_T = { f0'2: t_PermCell_Inner_T; f1'2: t_Ag_Seq_T }
  
  function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T [@inline:trivial] (self: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) (a: tup2_PermCell_Inner_T_Ag_Seq_T) : t_Option_Ag_Seq_T
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T
  
  function filter_map_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom filter_map_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T. forall k: t_PermCell_Inner_T [get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k]. get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k
        = match get_PermCell_Inner_T self k with
          | None'0 -> None'0
          | Some'0 v -> index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T f { f0'2 = k; f1'2 = v }
          end
  
  function factor_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (factor: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    if forall k: t_PermCell_Inner_T. incl_Option_Ag_Seq_T (get_PermCell_Inner_T factor k) (get_PermCell_Inner_T self k) then
      let res = filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f0'2 = k; f1'2 = vo} = __0 in match factor_Option_Ag_Seq_T (Some'0 vo) (get_PermCell_Inner_T factor k) with
        | Some'1 r -> r
        | None'1 -> None'0
        end) in Some res
    else
      None
  
  
  axiom factor_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, factor: t_FMap_PermCell_Inner_T_Ag_Seq_T. match factor_FMap_PermCell_Inner_T_Ag_Seq_T self factor with
        | Some c -> op_FMap_PermCell_Inner_T_Ag_Seq_T factor c = Some self
        | None -> forall c: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T factor c <> Some self
        end
  
  predicate incl_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    factor_FMap_PermCell_Inner_T_Ag_Seq_T other self <> None
  
  function incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T. incl_FMap_PermCell_Inner_T_Ag_Seq_T a b
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T b c -> incl_FMap_PermCell_Inner_T_Ag_Seq_T a c
  
  function associative_some_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (ab: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_some_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, ab: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = Some ab
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some bc
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = op_FMap_PermCell_Inner_T_Ag_Seq_T ab c
  
  function associative_none_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_none_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = None -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some bc -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = None
  
  function incl_op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) (comb: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_op_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T, comb: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T self other
        = Some comb -> incl_FMap_PermCell_Inner_T_Ag_Seq_T self comb
  
  predicate rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    match a with
      | Some a'0 -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f a'0
      | None -> true
      end
  
  function rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a unit_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (None) f
  
  function rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f1: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f2: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f1: t_FMap_PermCell_Inner_T_Ag_Seq_T, f2: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f1
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f2 f1 -> rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f2
  
  function auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self) (frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  function val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
   = val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0)
  
  function core_Ag_Seq_T (self: t_Ag_Seq_T) : t_Option_Ag_Seq_T = Some'0 self
  
  function core_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    Some (filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f1'2 = v} = __0 in core_Ag_Seq_T v))
  
  function core_total_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f1'2 = v} = __0 in core_Ag_Seq_T v)
  
  axiom core_total_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. core_FMap_PermCell_Inner_T_Ag_Seq_T self
      = Some (core_total_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  let rec core_FMap_PermCell_Inner_T_Ag_Seq_T'0 (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:core_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:core ensures #0] id_FMap_PermCell_Inner_T_Ag_Seq_T result
        = id_FMap_PermCell_Inner_T_Ag_Seq_T self)
      /\ ([@stop_split] [@expl:core ensures #1] view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T result
      = core_total_FMap_PermCell_Inner_T_Ag_Seq_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self))}
      (! return {result}) ]
  
  let rec new_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:new ensures] result = x}
      (! return {result}) ]
  
  predicate inv_Rc_NonAtomicInvariant_PA_T_Global (_1: t_Rc_NonAtomicInvariant_PA_T_Global)
  
  predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  let rec deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global self}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  let rec clone_Rc_NonAtomicInvariant_PA_T_Global (self_: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:clone 'self_' type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:clone_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:clone result type invariant] inv_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:clone ensures] result = self_)}
      (! return {result}) ]
  
  let rec new_Rc_NonAtomicInvariant_PA_T_Global (x: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x'0: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:new 'x' type invariant] inv_Rc_NonAtomicInvariant_PA_T_Global x}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:new_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  type t_NonAtomicInvariant_PA_T
  
  function public_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Id
  
  function view_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global) : t_NonAtomicInvariant_PA_T
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  function namespace_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Namespace
  
  predicate invariant_PersistentArray_T (self: t_PersistentArray_T) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.frag = public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv)
    /\ get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell)
      <> None'0
    /\ namespace_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) = Namespace_PARRAY 0
  
  predicate inv_PersistentArray_T (_1: t_PersistentArray_T)
  
  axiom inv_axiom [@rewrite]: forall x: t_PersistentArray_T [inv_PersistentArray_T x]. inv_PersistentArray_T x
      = (invariant_PersistentArray_T x
      /\ inv_Rc_PermCell_Inner_T_Global x.permcell /\ inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global x.inv)
  
  predicate invariant_ref_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) = inv_PersistentArray_T self
  
  meta "rewrite_def" predicate invariant_ref_PersistentArray_T
  
  predicate inv_ref_PersistentArray_T [@inline:trivial] (_1: t_PersistentArray_T) = invariant_ref_PersistentArray_T _1
  
  meta "rewrite_def" predicate inv_ref_PersistentArray_T
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some'0 x -> x
      | None'0 -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function view_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) : Seq.seq t_T =
    (unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell))).f0'0
  
  meta "rewrite_def" function view_PersistentArray_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec clone_PersistentArray_T (self: t_PersistentArray_T) (return (x: t_PersistentArray_T)) =
    {[@stop_split] [@expl:clone 'self' type invariant] inv_ref_PersistentArray_T self}
    (! bb0
    [ bb0 = s0
      [ s0 = clone_Rc_PermCell_Inner_T_Global {self.permcell}
          (fun (_x: t_Rc_PermCell_Inner_T_Global) -> [ &_4 <- _x ] s1)
      | s1 = deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {self.frag}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_9 <- _x ] s2)
      | s2 = core_FMap_PermCell_Inner_T_Ag_Seq_T'0 {_9}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_7 <- _x ] s3)
      | s3 = new_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {_7}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_6 <- _x ] s4)
      | s4 = deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global {self.inv}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_14 <- _x ] s5)
      | s5 = clone_Rc_NonAtomicInvariant_PA_T_Global {_14}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_12 <- _x ] s6)
      | s6 = new_Rc_NonAtomicInvariant_PA_T_Global {_12}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_11 <- _x ] s7)
      | s7 = [ &_ret <- { permcell = _4; frag = _6; inv = _11 } ] s8
      | s8 = return {_ret} ] ]
    [ & _ret: t_PersistentArray_T = Any.any_l ()
    | & self: t_PersistentArray_T = self
    | & _4: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _6: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _7: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _9: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _11: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & _12: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & _14: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l () ])
    [ return (result: t_PersistentArray_T) ->
    {[@stop_split] [@expl:clone_PersistentArray_T ensures] ([@stop_split] [@expl:clone result type invariant] inv_PersistentArray_T result)
      /\ ([@stop_split] [@expl:clone ensures] view_PersistentArray_T result = view_PersistentArray_T self)}
      (! return {result}) ]
end
module M_implementation__impl_PersistentArray_T__new (* implementation::PersistentArray<T> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use seq.Seq
  use creusot.int.UInt64
  use map.Map
  use map.Const
  use creusot.prelude.MutBorrow
  use creusot.prelude.Any
  use int.Int
  
  type t_Vec_T_Global
  
  type t_T
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_T_Global (self: t_Vec_T_Global) : Seq.seq t_T
  
  axiom view_Vec_T_Global_spec: forall self: t_Vec_T_Global. Seq.length (view_Vec_T_Global self)
      <= UInt64.t'int const_MAX
  
  type t_Ag_Seq_T = { f0: Seq.seq t_T }
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_Inner_T = Direct t_Vec_T_Global | Link UInt64.t t_T t_Rc_PermCell_Inner_T_Global
  
  type t_PermCell_Inner_T
  
  type t_Perm_PermCell_Inner_T
  
  type tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global = {
    f0'0: t_PermCell_Inner_T;
    f1'0: t_Perm_PermCell_Inner_T }
  
  predicate inv_T (_1: t_T)
  
  predicate invariant_ref_T [@inline:trivial] (self: t_T) = inv_T self
  
  meta "rewrite_def" predicate invariant_ref_T
  
  predicate inv_ref_T [@inline:trivial] (_1: t_T) = invariant_ref_T _1
  
  meta "rewrite_def" predicate inv_ref_T
  
  predicate invariant_Seq_T [@inline:trivial] (self: Seq.seq t_T) =
    forall i: int. 0 <= i /\ i < Seq.length self -> inv_ref_T (Seq.get self i)
  
  meta "rewrite_def" predicate invariant_Seq_T
  
  predicate inv_Seq_T [@inline:trivial] (_1: Seq.seq t_T) = invariant_Seq_T _1
  
  meta "rewrite_def" predicate inv_Seq_T
  
  predicate invariant_Vec_T_Global (self: t_Vec_T_Global) = inv_Seq_T (view_Vec_T_Global self)
  
  predicate inv_Vec_T_Global (_1: t_Vec_T_Global)
  
  axiom inv_axiom: forall x: t_Vec_T_Global [inv_Vec_T_Global x]. inv_Vec_T_Global x -> invariant_Vec_T_Global x
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate inv_Inner_T (_1: t_Inner_T)
  
  axiom inv_axiom'0 [@rewrite]: forall x: t_Inner_T [inv_Inner_T x]. inv_Inner_T x
      = match x with
        | Direct f0'1 -> inv_Vec_T_Global f0'1
        | Link index value next -> inv_T value /\ inv_Rc_PermCell_Inner_T_Global next
        end
  
  function ward_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_PermCell_Inner_T
  
  function val_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_Inner_T
  
  function view_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    val_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Perm_PermCell_Inner_T
  
  function view_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    view_Perm_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Box_Perm_PermCell_Inner_T_Global
  
  let rec new_Inner_T (value: t_Inner_T) (return (x: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global)) =
    {[@stop_split] [@expl:new 'value' type invariant] inv_Inner_T value}
    any
    [ return (result: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:new_Inner_T ensures] ([@stop_split] [@expl:new ensures #0] result.f0'0
        = ward_PermCell_Inner_T result.f1'0)
      /\ ([@stop_split] [@expl:new ensures #1] view_Box_Perm_PermCell_Inner_T_Global result.f1'0 = value)}
      (! return {result}) ]
  
  type t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  predicate inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  axiom inv_axiom'1:
    forall x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x]. inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
      -> invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
  
  predicate invariant_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" predicate invariant_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_FMap_PermCell_Inner_T_Ag_Seq_T = None | Some t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_Ag_Seq_T = None'0 | Some'0 t_Ag_Seq_T
  
  type t_Option_Option_Ag_Seq_T = None'1 | Some'1 t_Option_Ag_Seq_T
  
  type tup2_Option_Ag_Seq_T_Option_Ag_Seq_T = { f0'1: t_Option_Ag_Seq_T; f1'1: t_Option_Ag_Seq_T }
  
  function map_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (f: Map.map t_Ag_Seq_T t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T
   = match self with
      | None'0 -> None'1
      | Some'0 x -> Some'1 (Map.get f x)
      end
  
  function op_Ag_Seq_T (self: t_Ag_Seq_T) (other: t_Ag_Seq_T) : t_Option_Ag_Seq_T = if self.f0 = other.f0 then
      Some'0 self
    else
      None'0
  
  
  function commutative_Ag_Seq_T (a: t_Ag_Seq_T) (b: t_Ag_Seq_T) : ()
  
  axiom commutative_Ag_Seq_T_spec: forall a: t_Ag_Seq_T, b: t_Ag_Seq_T. op_Ag_Seq_T a b = op_Ag_Seq_T b a
  
  function op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = other } with
      | {f0'1 = None'0} -> Some'1 other
      | {f1'1 = None'0} -> Some'1 self
      | {f0'1 = Some'0 x; f1'1 = Some'0 y} -> map_Option_Ag_Seq_T (op_Ag_Seq_T x y) (fun (z: t_Ag_Seq_T) -> Some'0 z)
      end
  
  function commutative_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) : ()
  
  axiom commutative_Option_Ag_Seq_T_spec: forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
      = op_Option_Ag_Seq_T b a
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  function total_op_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom total_op_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T. (forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
          <> None'1)
      -> (forall k: t_PermCell_Inner_T. Some'1 (get_PermCell_Inner_T (total_op_PermCell_Inner_T self other) k)
        = op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k))
  
  function op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   = if forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
      <> None'1 then
      Some (total_op_PermCell_Inner_T self other)
    else
      None
  
  
  function commutative_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom commutative_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
      = op_FMap_PermCell_Inner_T_Ag_Seq_T b a
  
  function len_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : int
  
  axiom len_PermCell_Inner_T_spec: forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. len_PermCell_Inner_T self >= 0
  
  constant empty_PermCell_Inner_T : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom empty_PermCell_Inner_T_spec: len_PermCell_Inner_T empty_PermCell_Inner_T = 0
  
  axiom empty_PermCell_Inner_T_spec'0: to_mapping_PermCell_Inner_T empty_PermCell_Inner_T = Const.const (None'0)
  
  constant unit_FMap_PermCell_Inner_T_Ag_Seq_T: t_FMap_PermCell_Inner_T_Ag_Seq_T = empty_PermCell_Inner_T
  
  axiom unit_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall x: t_FMap_PermCell_Inner_T_Ag_Seq_T [op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T]. op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T
      = Some x
  
  let rec alloc_FMap_PermCell_Inner_T_Ag_Seq_T (return (x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:alloc_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:alloc result type invariant] inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T result)
      /\ ([@stop_split] [@expl:alloc ensures] view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T result
      = unit_FMap_PermCell_Inner_T_Ag_Seq_T)}
      (! return {result}) ]
  
  predicate invariant_ref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_ref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_ref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  let rec deref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self}
    any
    [ return (result: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:deref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  type t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  let rec id_ghost_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Id)) =
    {[@stop_split] [@expl:id_ghost 'self' type invariant] inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self}
    any
    [ return (result: t_Id) -> {[@stop_split] [@expl:id_ghost ensures] result = id_FMap_PermCell_Inner_T_Ag_Seq_T self}
      (! return {result}) ]
  
  type t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = { f0'2: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  type t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function factor_Ag_Seq_T (self: t_Ag_Seq_T) (factor: t_Ag_Seq_T) : t_Option_Ag_Seq_T = op_Ag_Seq_T self factor
  
  axiom factor_Ag_Seq_T_spec: forall self: t_Ag_Seq_T, factor: t_Ag_Seq_T. match factor_Ag_Seq_T self factor with
        | Some'0 c -> op_Ag_Seq_T factor c = Some'0 self
        | None'0 -> forall c: t_Ag_Seq_T. op_Ag_Seq_T factor c <> Some'0 self
        end
  
  function factor_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (factor: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = factor } with
      | {f0'1 = x; f1'1 = None'0} -> Some'1 x
      | {f0'1 = None'0} -> None'1
      | {f0'1 = Some'0 x; f1'1 = Some'0 y} -> match factor_Ag_Seq_T x y with
        | Some'0 z -> Some'1 (Some'0 z)
        | None'0 -> if x = y then Some'1 (None'0) else None'1
        end
      end
  
  axiom factor_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, factor: t_Option_Ag_Seq_T. match factor_Option_Ag_Seq_T self factor with
        | Some'1 c -> op_Option_Ag_Seq_T factor c = Some'1 self
        | None'1 -> forall c: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T factor c <> Some'1 self
        end
  
  predicate incl_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) =
    factor_Option_Ag_Seq_T other self <> None'1
  
  function incl_transitive_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) : ()
  
  axiom incl_transitive_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T. incl_Option_Ag_Seq_T a b
      -> incl_Option_Ag_Seq_T b c -> incl_Option_Ag_Seq_T a c
  
  function associative_some_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (ab: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_some_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, ab: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = Some'1 ab -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = op_Option_Ag_Seq_T ab c
  
  function associative_none_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_none_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = None'1 -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = None'1
  
  function incl_op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) (comb: t_Option_Ag_Seq_T) : ()
  
  axiom incl_op_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, other: t_Option_Ag_Seq_T, comb: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T self other
        = Some'1 comb -> incl_Option_Ag_Seq_T self comb
  
  type tup2_PermCell_Inner_T_Ag_Seq_T = { f0'3: t_PermCell_Inner_T; f1'3: t_Ag_Seq_T }
  
  function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T [@inline:trivial] (self: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) (a: tup2_PermCell_Inner_T_Ag_Seq_T) : t_Option_Ag_Seq_T
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T
  
  function filter_map_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom filter_map_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T. forall k: t_PermCell_Inner_T [get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k]. get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k
        = match get_PermCell_Inner_T self k with
          | None'0 -> None'0
          | Some'0 v -> index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T f { f0'3 = k; f1'3 = v }
          end
  
  function factor_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (factor: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    if forall k: t_PermCell_Inner_T. incl_Option_Ag_Seq_T (get_PermCell_Inner_T factor k) (get_PermCell_Inner_T self k) then
      let res = filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f0'3 = k; f1'3 = vo} = __0 in match factor_Option_Ag_Seq_T (Some'0 vo) (get_PermCell_Inner_T factor k) with
        | Some'1 r -> r
        | None'1 -> None'0
        end) in Some res
    else
      None
  
  
  axiom factor_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, factor: t_FMap_PermCell_Inner_T_Ag_Seq_T. match factor_FMap_PermCell_Inner_T_Ag_Seq_T self factor with
        | Some c -> op_FMap_PermCell_Inner_T_Ag_Seq_T factor c = Some self
        | None -> forall c: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T factor c <> Some self
        end
  
  predicate incl_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    factor_FMap_PermCell_Inner_T_Ag_Seq_T other self <> None
  
  function incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T. incl_FMap_PermCell_Inner_T_Ag_Seq_T a b
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T b c -> incl_FMap_PermCell_Inner_T_Ag_Seq_T a c
  
  function associative_some_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (ab: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_some_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, ab: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = Some ab
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some bc
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = op_FMap_PermCell_Inner_T_Ag_Seq_T ab c
  
  function associative_none_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_none_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = None -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some bc -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = None
  
  function incl_op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) (comb: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_op_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T, comb: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T self other
        = Some comb -> incl_FMap_PermCell_Inner_T_Ag_Seq_T self comb
  
  predicate rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    match a with
      | Some a'0 -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f a'0
      | None -> true
      end
  
  function rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a unit_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (None) f
  
  function rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f1: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f2: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f1: t_FMap_PermCell_Inner_T_Ag_Seq_T, f2: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f1
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f2 f1 -> rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f2
  
  function auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self) (frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  function val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
   = val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0'2)
  
  function id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T'0 (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id =
    id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0'2
  
  let rec new_unit_FMap_PermCell_Inner_T_Ag_Seq_T (id: t_Id) (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:new_unit ensures] view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T result
        = unit_FMap_PermCell_Inner_T_Ag_Seq_T
      /\ id_FMap_PermCell_Inner_T_Ag_Seq_T'0 result = id}
      (! return {result}) ]
  
  let rec new_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:new ensures] result = x}
      (! return {result}) ]
  
  predicate invariant_refmut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current
    /\ inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_refmut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_refmut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_refmut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate invariant_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current /\ inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  let rec deref_mut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
    (self: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:deref_mut 'self' type invariant] inv_refmut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self}
    any
    [ return (result: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:deref_mut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:deref_mut result type invariant] inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T result)
      /\ ([@stop_split] [@expl:deref_mut ensures] result = self)}
      (! return {result}) ]
  
  let rec deref_mut_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T
    (self: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:deref_mut ensures] result = self}
      (! return {result}) ]
  
  type t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T = { f0'4: t_PermCell_Inner_T; f1'4: t_Ag_Seq_T }
  
  predicate premise_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T) (from_auth: t_FMap_PermCell_Inner_T_Ag_Seq_T) (_3: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    get_PermCell_Inner_T from_auth self.f0'4 = None'0
  
  meta "rewrite_def" predicate premise_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T
  
  type tup2_FMap_PermCell_Inner_T_Ag_Seq_T_FMap_PermCell_Inner_T_Ag_Seq_T = {
    f0'5: t_FMap_PermCell_Inner_T_Ag_Seq_T;
    f1'5: t_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  predicate contains_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) =
    get_PermCell_Inner_T self k <> None'0
  
  meta "rewrite_def" predicate contains_PermCell_Inner_T
  
  function insert_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) (v: t_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom insert_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, k: t_PermCell_Inner_T, v: t_Ag_Seq_T. to_mapping_PermCell_Inner_T (insert_PermCell_Inner_T self k v)
      = Map.set (to_mapping_PermCell_Inner_T self) k (Some'0 v)
  
  axiom insert_PermCell_Inner_T_spec'0:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, k: t_PermCell_Inner_T, v: t_Ag_Seq_T. len_PermCell_Inner_T (insert_PermCell_Inner_T self k v)
      = (if contains_PermCell_Inner_T self k then len_PermCell_Inner_T self else len_PermCell_Inner_T self + 1)
  
  function update_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T) (from_auth: t_FMap_PermCell_Inner_T_Ag_Seq_T) (from_frag: t_FMap_PermCell_Inner_T_Ag_Seq_T) : tup2_FMap_PermCell_Inner_T_Ag_Seq_T_FMap_PermCell_Inner_T_Ag_Seq_T
   = { f0'5 = insert_PermCell_Inner_T from_auth self.f0'4 self.f1'4;
       f1'5 = insert_PermCell_Inner_T from_frag self.f0'4 self.f1'4 }
  
  meta "rewrite_def" function update_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T
  
  let rec update_FMap_PermCell_Inner_T_Ag_Seq_T (self: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (frag: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (upd: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T) (return (x: ())) =
    {[@stop_split] [@expl:update_FMap_PermCell_Inner_T_Ag_Seq_T requires] ([@stop_split] [@expl:update 'self' type invariant] inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)
    /\ ([@stop_split] [@expl:update requires #0] id_FMap_PermCell_Inner_T_Ag_Seq_T self.current
      = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag.current)
    /\ ([@stop_split] [@expl:update requires #1] premise_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T upd (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current) (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag.current))}
    any
    [ return (result: ()) ->
    {[@stop_split] [@expl:update_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:update ensures #0] id_FMap_PermCell_Inner_T_Ag_Seq_T self.current
        = id_FMap_PermCell_Inner_T_Ag_Seq_T self.final)
      /\ ([@stop_split] [@expl:update ensures #1] id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag.current
        = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag.final)
      /\ ([@stop_split] [@expl:update ensures #2] incl_FMap_PermCell_Inner_T_Ag_Seq_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag.current) (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current))
      /\ ([@stop_split] [@expl:update ensures #3] { f0'5 = view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.final;
                                                    f1'5 = view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag.final }
      = update_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T upd (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current) (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag.current))}
      (! return {result}) ]
  
  predicate resolve_refmut_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate resolve_refmut_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate resolve_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  let rec new_unit (x: ()) (return (x'0: ())) = any
    [ return (result: ()) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  type t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Option_Box_Perm_PermCell_Inner_T_Global = None'2 | Some'2 t_Perm_PermCell_Inner_T
  
  function to_mapping_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : Map.map t_PermCell_Inner_T t_Option_Box_Perm_PermCell_Inner_T_Global
  
  function get_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Option_Box_Perm_PermCell_Inner_T_Global
   = Map.get (to_mapping_Snapshot_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_Snapshot_PermCell_Inner_T
  
  predicate ext_eq_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (other: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) =
    forall k: t_PermCell_Inner_T. get_Snapshot_PermCell_Inner_T self k = get_Snapshot_PermCell_Inner_T other k
  
  axiom ext_eq_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, other: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global. ext_eq_Snapshot_PermCell_Inner_T self other
      = (self = other)
  
  function len_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : int
  
  axiom len_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global. len_Snapshot_PermCell_Inner_T self
      >= 0
  
  constant empty_Snapshot_PermCell_Inner_T : t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  axiom empty_Snapshot_PermCell_Inner_T_spec: len_Snapshot_PermCell_Inner_T empty_Snapshot_PermCell_Inner_T = 0
  
  axiom empty_Snapshot_PermCell_Inner_T_spec'0: to_mapping_Snapshot_PermCell_Inner_T empty_Snapshot_PermCell_Inner_T
    = Const.const (None'2)
  
  predicate is_empty_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) =
    ext_eq_Snapshot_PermCell_Inner_T self empty_Snapshot_PermCell_Inner_T
  
  let rec new_Snapshot_PermCell_Inner_T
    (return (x: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:new ensures] is_empty_Snapshot_PermCell_Inner_T result}
      (! return {result}) ]
  
  let rec deref_mut_Ghost_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)
    (return (x: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:deref_mut ensures] result = self}
      (! return {result}) ]
  
  let rec into_inner_Box_Perm_PermCell_Inner_T_Global (self: t_Perm_PermCell_Inner_T)
    (return (x: t_Perm_PermCell_Inner_T)) = any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:into_inner ensures] result = self}
      (! return {result}) ]
  
  predicate contains_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) =
    get_Snapshot_PermCell_Inner_T self k <> None'2
  
  meta "rewrite_def" predicate contains_Snapshot_PermCell_Inner_T
  
  function insert_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) (v: t_Perm_PermCell_Inner_T) : t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  axiom insert_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T, v: t_Perm_PermCell_Inner_T. to_mapping_Snapshot_PermCell_Inner_T (insert_Snapshot_PermCell_Inner_T self k v)
      = Map.set (to_mapping_Snapshot_PermCell_Inner_T self) k (Some'2 v)
  
  axiom insert_Snapshot_PermCell_Inner_T_spec'0:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T, v: t_Perm_PermCell_Inner_T. len_Snapshot_PermCell_Inner_T (insert_Snapshot_PermCell_Inner_T self k v)
      = (if contains_Snapshot_PermCell_Inner_T self k then
        len_Snapshot_PermCell_Inner_T self
      else
        len_Snapshot_PermCell_Inner_T self + 1
      )
  
  let rec insert_ghost_Snapshot_PermCell_Inner_T
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T)
    (value: t_Perm_PermCell_Inner_T) (return (x: t_Option_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:insert_ghost_Snapshot_PermCell_Inner_T ensures] ([@stop_split] [@expl:insert_ghost ensures #0] self.final
        = insert_Snapshot_PermCell_Inner_T self.current key value)
      /\ ([@stop_split] [@expl:insert_ghost ensures #1] result = get_Snapshot_PermCell_Inner_T self.current key)}
      (! return {result}) ]
  
  predicate resolve_ref_Inner_T [@inline:trivial] (_1: t_Inner_T) = true
  
  meta "rewrite_def" predicate resolve_ref_Inner_T
  
  predicate resolve_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) =
    resolve_ref_Inner_T (val_PermCell_Inner_T self)
  
  meta "rewrite_def" predicate resolve_Perm_PermCell_Inner_T
  
  predicate resolve_Perm_PermCell_Inner_T'0 (_1: t_Perm_PermCell_Inner_T)
  
  axiom resolve_axiom:
    forall x: t_Perm_PermCell_Inner_T [resolve_Perm_PermCell_Inner_T'0 x]. resolve_Perm_PermCell_Inner_T'0 x
      -> resolve_Perm_PermCell_Inner_T x
  
  predicate resolve_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Perm_PermCell_Inner_T) =
    resolve_Perm_PermCell_Inner_T'0 _1
  
  meta "rewrite_def" predicate resolve_Box_Perm_PermCell_Inner_T_Global
  
  predicate resolve_Option_Box_Perm_PermCell_Inner_T_Global (_1: t_Option_Box_Perm_PermCell_Inner_T_Global)
  
  axiom resolve_axiom'0 [@rewrite]:
    forall x: t_Option_Box_Perm_PermCell_Inner_T_Global [resolve_Option_Box_Perm_PermCell_Inner_T_Global x]. resolve_Option_Box_Perm_PermCell_Inner_T_Global x
      = match x with
        | None'2 -> true
        | Some'2 x0 -> resolve_Box_Perm_PermCell_Inner_T_Global x0
        end
  
  predicate resolve_refmut_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  let rec into_inner_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
    (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)
    (return (x: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:into_inner ensures] result = self}
      (! return {result}) ]
  
  let rec into_inner_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:into_inner 'self' type invariant] inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self}
    any
    [ return (result: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:into_inner_Authority_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:into_inner result type invariant] inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T result)
      /\ ([@stop_split] [@expl:into_inner ensures] result = self)}
      (! return {result}) ]
  
  type t_PA_T = {
    perms: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global;
    auth: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T;
    depth: Map.map t_PermCell_Inner_T int }
  
  predicate inv_PA_T (_1: t_PA_T)
  
  axiom inv_axiom'2 [@rewrite]: forall x: t_PA_T [inv_PA_T x]. inv_PA_T x
      = inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x.auth
  
  predicate invariant_Ghost_PA_T [@inline:trivial] (self: t_PA_T) = inv_PA_T self
  
  meta "rewrite_def" predicate invariant_Ghost_PA_T
  
  predicate inv_Ghost_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_Ghost_PA_T _1
  
  meta "rewrite_def" predicate inv_Ghost_PA_T
  
  let rec new_PA_T (x: t_PA_T) (return (x'0: t_PA_T)) = {[@stop_split] [@expl:new 'x' type invariant] inv_PA_T x}
    any
    [ return (result: t_PA_T) ->
    {[@stop_split] [@expl:new_PA_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_PA_T result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  type t_NonAtomicInvariant_PA_T
  
  predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool [@inline:trivial] (self: Map.map t_Perm_PermCell_Inner_T bool) (a: t_Perm_PermCell_Inner_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool
  
  function such_that_Box_Perm_PermCell_Inner_T_Global (p: Map.map t_Perm_PermCell_Inner_T bool) : t_Perm_PermCell_Inner_T
  
  axiom such_that_Box_Perm_PermCell_Inner_T_Global_spec:
    forall p: Map.map t_Perm_PermCell_Inner_T bool. (exists x: t_Perm_PermCell_Inner_T. index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p x)
      -> index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p (such_that_Box_Perm_PermCell_Inner_T_Global p)
  
  function unwrap_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) : t_Perm_PermCell_Inner_T
   = match self with
      | Some'2 x -> x
      | None'2 -> such_that_Box_Perm_PermCell_Inner_T_Global (fun (__0: t_Perm_PermCell_Inner_T) -> true)
      end
  
  function lookup_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = unwrap_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_Snapshot_PermCell_Inner_T
  
  function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = lookup_Snapshot_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some'0 x -> x
      | None'0 -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function lookup_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Ag_Seq_T
   = unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_PermCell_Inner_T
  
  function index_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (key: t_PermCell_Inner_T) : t_Ag_Seq_T
   = lookup_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  function index_Mapping_PermCell_Inner_T_Int [@inline:trivial] (self: Map.map t_PermCell_Inner_T int) (a: t_PermCell_Inner_T) : int
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_PermCell_Inner_T_Int
  
  predicate partial_invariant_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.auth = id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
        /\ contains_Snapshot_PermCell_Inner_T self.perms pc
      -> ward_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc)
        = pc
      /\ match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc) with
        | Direct v -> (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0
        = view_Vec_T_Global v
        | Link index value next -> contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)
        /\ index_Mapping_PermCell_Inner_T_Int self.depth pc
          > index_Mapping_PermCell_Inner_T_Int self.depth (view_Rc_PermCell_Inner_T_Global next)
        /\ UInt64.t'int index
          < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0
        /\ (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0
        = Seq.set (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0 (UInt64.t'int index) value
        end)
  
  meta "rewrite_def" predicate partial_invariant_T
  
  predicate protocol_PA_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    partial_invariant_T self id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
      = contains_Snapshot_PermCell_Inner_T self.perms pc)
  
  meta "rewrite_def" predicate protocol_PA_T
  
  function public_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Id
  
  function namespace_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Namespace
  
  let rec new_PA_T'0 (value: t_PA_T) (public: t_Id) (namespace: t_Namespace) (return (x: t_NonAtomicInvariant_PA_T)) =
    {[@stop_split] [@expl:new_PA_T requires] ([@stop_split] [@expl:new 'value' type invariant] inv_Ghost_PA_T value)
    /\ ([@stop_split] [@expl:new requires] protocol_PA_T value public)}
    any
    [ return (result: t_NonAtomicInvariant_PA_T) ->
    {[@stop_split] [@expl:new_PA_T ensures] ([@stop_split] [@expl:new ensures #0] public_PA_T result = public)
      /\ ([@stop_split] [@expl:new ensures #1] namespace_PA_T result = namespace)}
      (! return {result}) ]
  
  let rec into_inner_NonAtomicInvariant_PA_T (self: t_NonAtomicInvariant_PA_T) (return (x: t_NonAtomicInvariant_PA_T)) =
    any
    [ return (result: t_NonAtomicInvariant_PA_T) -> {[@stop_split] [@expl:into_inner ensures] result = self}
      (! return {result}) ]
  
  type t_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Rc_NonAtomicInvariant_PA_T_Global (_1: t_Rc_NonAtomicInvariant_PA_T_Global)
  
  function view_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global) : t_NonAtomicInvariant_PA_T
  
  let rec new_NonAtomicInvariant_PA_T (value: t_NonAtomicInvariant_PA_T)
    (return (x: t_Rc_NonAtomicInvariant_PA_T_Global)) = any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:new_NonAtomicInvariant_PA_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:new ensures] view_Rc_NonAtomicInvariant_PA_T_Global result = value)}
      (! return {result}) ]
  
  predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  let rec new_Rc_NonAtomicInvariant_PA_T_Global (x: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x'0: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:new 'x' type invariant] inv_Rc_NonAtomicInvariant_PA_T_Global x}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:new_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  let rec new_PermCell_Inner_T (value: t_PermCell_Inner_T) (return (x: t_Rc_PermCell_Inner_T_Global)) = any
    [ return (result: t_Rc_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:new_PermCell_Inner_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Rc_PermCell_Inner_T_Global result)
      /\ ([@stop_split] [@expl:new ensures] view_Rc_PermCell_Inner_T_Global result = value)}
      (! return {result}) ]
  
  type t_PersistentArray_T = {
    permcell: t_Rc_PermCell_Inner_T_Global;
    frag: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T;
    inv: t_Rc_NonAtomicInvariant_PA_T_Global }
  
  predicate invariant_PersistentArray_T (self: t_PersistentArray_T) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T'0 self.frag = public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv)
    /\ get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell)
      <> None'0
    /\ namespace_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) = Namespace_PARRAY 0
  
  predicate inv_PersistentArray_T (_1: t_PersistentArray_T)
  
  axiom inv_axiom'3 [@rewrite]: forall x: t_PersistentArray_T [inv_PersistentArray_T x]. inv_PersistentArray_T x
      = (invariant_PersistentArray_T x
      /\ inv_Rc_PermCell_Inner_T_Global x.permcell /\ inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global x.inv)
  
  function view_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) : Seq.seq t_T =
    (unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell))).f0
  
  meta "rewrite_def" function view_PersistentArray_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec new_T (v: t_Vec_T_Global) (return (x: t_PersistentArray_T)) =
    {[@stop_split] [@expl:new 'v' type invariant] inv_Vec_T_Global v}
    (! bb0
    [ bb0 = s0
      [ s0 = [ &new_ag <- { f0 = view_Vec_T_Global v } ] s1
      | s1 = [ &_10 <- Direct v ] s2
      | s2 = new_Inner_T {_10}
          (fun (_x: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global) -> [ &_9 <- _x ] s3)
      | s3 = [ &permcell'0 <- _9.f0'0 ] s4
      | s4 = [ &perm <- _9.f1'0 ] s5
      | s5 = alloc_FMap_PermCell_Inner_T_Ag_Seq_T
          (fun (_x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &auth'0 <- _x ] s6)
      | s6 = deref_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T {auth'0}
          (fun (_x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_17 <- _x ] s7)
      | s7 = id_ghost_FMap_PermCell_Inner_T_Ag_Seq_T {_17} (fun (_x: t_Id) -> [ &_15 <- _x ] s8)
      | s8 = new_unit_FMap_PermCell_Inner_T_Ag_Seq_T {_15}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_14 <- _x ] s9)
      | s9 = new_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {_14}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &frag'0 <- _x ] s10)
      | s10 = MutBorrow.borrow_mut <t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T> {auth'0}
          (fun (_bor: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_23 <- _bor ] -{inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _bor.final}-
            [ &auth'0 <- _bor.final ] s11)
        [ _ck -> (! {[@expl:type invariant] inv_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T auth'0} any) ]
      | s11 = deref_mut_Ghost_Authority_FMap_PermCell_Inner_T_Ag_Seq_T {_23}
          (fun (_x: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_22 <- _x ] s12)
      | s12 = MutBorrow.borrow_mut <t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T> {frag'0}
          (fun (_bor: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_27 <- _bor ] [ &frag'0 <- _bor.final ] s13)
      | s13 = MutBorrow.borrow_final <t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T> {_27.current} {MutBorrow.get_id _27}
          (fun (_bor: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_26 <- _bor ] [ &_27 <- { _27 with current = _bor.final } ] s14)
      | s14 = deref_mut_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {_26}
          (fun (_x: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_25 <- _x ] s15)
      | s15 = [ &_28 <- { f0'4 = ward_PermCell_Inner_T perm; f1'4 = new_ag } ] s16
      | s16 = MutBorrow.borrow_final <t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T> {_22.current} {MutBorrow.get_id _22}
          (fun (_bor: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_21 <- _bor ] -{inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _bor.final}-
            [ &_22 <- { _22 with current = _bor.final } ] s17)
        [ _ck -> (! {[@expl:type invariant] inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _22.current} any) ]
      | s17 = MutBorrow.borrow_final <t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T> {_25.current} {MutBorrow.get_id _25}
          (fun (_bor: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_24 <- _bor ] [ &_25 <- { _25 with current = _bor.final } ] s18)
      | s18 = update_FMap_PermCell_Inner_T_Ag_Seq_T {_21} {_24} {_28} (fun (_x: ()) -> [ &_20 <- _x ] s19)
      | s19 = -{resolve_refmut_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T _27}- s20
      | s20 = -{resolve_refmut_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T _25}- s21
      | s21 = s22 [ _ck -> (! {[@expl:type invariant] inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _22} any) ]
      | s22 = -{resolve_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _22}- s23
      | s23 = new_unit {_20} (fun (_x: ()) -> [ &_19 <- _x ] s24)
      | s24 = new_Snapshot_PermCell_Inner_T
          (fun (_x: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) -> [ &perms'0 <- _x ] s25)
      | s25 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global> {perms'0}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_39 <- _bor ] [ &perms'0 <- _bor.final ] s26)
      | s26 = deref_mut_Ghost_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global {_39}
          (fun (_x: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_38 <- _x ] s27)
      | s27 = into_inner_Box_Perm_PermCell_Inner_T_Global {perm}
          (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_43 <- _x ] s28)
      | s28 = MutBorrow.borrow_final <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global> {_38.current}
          {MutBorrow.get_id _38}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_37 <- _bor ] [ &_38 <- { _38 with current = _bor.final } ] s29)
      | s29 = insert_ghost_Snapshot_PermCell_Inner_T {_37} {ward_PermCell_Inner_T perm} {_43}
          (fun (_x: t_Option_Box_Perm_PermCell_Inner_T_Global) -> [ &_36 <- _x ] s30)
      | s30 = -{resolve_Option_Box_Perm_PermCell_Inner_T_Global _36}- s31
      | s31 = -{resolve_refmut_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global _38}- s32
      | s32 = into_inner_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global {perms'0}
          (fun (_x: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) -> [ &_48 <- _x ] s33)
      | s33 = into_inner_Authority_FMap_PermCell_Inner_T_Ag_Seq_T {auth'0}
          (fun (_x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_50 <- _x ] s34)
      | s34 = [ &_47 <- { perms = _48; auth = _50; depth = fun (__0: t_PermCell_Inner_T) -> 0 } ] s35
      | s35 = new_PA_T {_47} (fun (_x: t_PA_T) -> [ &_46 <- _x ] s36)
      | s36 = new_PA_T'0 {_46} {id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0} {Namespace_PARRAY 0}
          (fun (_x: t_NonAtomicInvariant_PA_T) -> [ &na_inv <- _x ] s37)
      | s37 = into_inner_NonAtomicInvariant_PA_T {na_inv} (fun (_x: t_NonAtomicInvariant_PA_T) -> [ &_59 <- _x ] s38)
      | s38 = new_NonAtomicInvariant_PA_T {_59} (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_34 <- _x ] s39)
      | s39 = new_Rc_NonAtomicInvariant_PA_T_Global {_34}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &inv'0 <- _x ] s40)
      | s40 = new_PermCell_Inner_T {permcell'0} (fun (_x: t_Rc_PermCell_Inner_T_Global) -> [ &_61 <- _x ] s41)
      | s41 = [ &_ret <- { permcell = _61; frag = frag'0; inv = inv'0 } ] s42
      | s42 = return {_ret} ] ]
    [ & _ret: t_PersistentArray_T = Any.any_l ()
    | & v: t_Vec_T_Global = v
    | & new_ag: t_Ag_Seq_T = Any.any_l ()
    | & permcell'0: t_PermCell_Inner_T = Any.any_l ()
    | & perm: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _9: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _10: t_Inner_T = Any.any_l ()
    | & auth'0: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & frag'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _14: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _15: t_Id = Any.any_l ()
    | & _17: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _19: () = Any.any_l ()
    | & _20: () = Any.any_l ()
    | & _21: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _22: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _23: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _24: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _25: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _26: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _27: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _28: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & inv'0: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & _34: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & perms'0: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _36: t_Option_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _37: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _38: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _39: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _43: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & na_inv: t_NonAtomicInvariant_PA_T = Any.any_l ()
    | & _46: t_PA_T = Any.any_l ()
    | & _47: t_PA_T = Any.any_l ()
    | & _48: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _50: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _59: t_NonAtomicInvariant_PA_T = Any.any_l ()
    | & _61: t_Rc_PermCell_Inner_T_Global = Any.any_l () ])
    [ return (result: t_PersistentArray_T) ->
    {[@stop_split] [@expl:new_T ensures] ([@stop_split] [@expl:new result type invariant] inv_PersistentArray_T result)
      /\ ([@stop_split] [@expl:new ensures] view_PersistentArray_T result = view_Vec_T_Global v)}
      (! return {result}) ]
end
module M_implementation__impl_PersistentArray_T__set (* implementation::PersistentArray<T> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use seq.Seq
  use map.Map
  use map.Const
  use creusot.int.UInt64
  use creusot.prelude.MutBorrow
  use creusot.prelude.Any
  use set.Set
  use int.Int
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = { f0: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  type t_Rc_NonAtomicInvariant_PA_T_Global
  
  type t_PersistentArray_T = {
    permcell: t_Rc_PermCell_Inner_T_Global;
    frag: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T;
    inv: t_Rc_NonAtomicInvariant_PA_T_Global }
  
  type t_T
  
  type t_Ag_Seq_T = { f0'0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None | Some t_Ag_Seq_T
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some x -> x
      | None -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PermCell_Inner_T
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  type t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_FMap_PermCell_Inner_T_Ag_Seq_T = None'0 | Some'0 t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_Option_Ag_Seq_T = None'1 | Some'1 t_Option_Ag_Seq_T
  
  type tup2_Option_Ag_Seq_T_Option_Ag_Seq_T = { f0'1: t_Option_Ag_Seq_T; f1'1: t_Option_Ag_Seq_T }
  
  function map_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (f: Map.map t_Ag_Seq_T t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T
   = match self with
      | None -> None'1
      | Some x -> Some'1 (Map.get f x)
      end
  
  function op_Ag_Seq_T (self: t_Ag_Seq_T) (other: t_Ag_Seq_T) : t_Option_Ag_Seq_T = if self.f0'0 = other.f0'0 then
      Some self
    else
      None
  
  
  function commutative_Ag_Seq_T (a: t_Ag_Seq_T) (b: t_Ag_Seq_T) : ()
  
  axiom commutative_Ag_Seq_T_spec: forall a: t_Ag_Seq_T, b: t_Ag_Seq_T. op_Ag_Seq_T a b = op_Ag_Seq_T b a
  
  function op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = other } with
      | {f0'1 = None} -> Some'1 other
      | {f1'1 = None} -> Some'1 self
      | {f0'1 = Some x; f1'1 = Some y} -> map_Option_Ag_Seq_T (op_Ag_Seq_T x y) (fun (z: t_Ag_Seq_T) -> Some z)
      end
  
  function commutative_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) : ()
  
  axiom commutative_Option_Ag_Seq_T_spec: forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
      = op_Option_Ag_Seq_T b a
  
  function total_op_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom total_op_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T. (forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
          <> None'1)
      -> (forall k: t_PermCell_Inner_T. Some'1 (get_PermCell_Inner_T (total_op_PermCell_Inner_T self other) k)
        = op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k))
  
  function op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   = if forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
      <> None'1 then
      Some'0 (total_op_PermCell_Inner_T self other)
    else
      None'0
  
  
  function commutative_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom commutative_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
      = op_FMap_PermCell_Inner_T_Ag_Seq_T b a
  
  function len_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : int
  
  axiom len_PermCell_Inner_T_spec: forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. len_PermCell_Inner_T self >= 0
  
  constant empty_PermCell_Inner_T : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom empty_PermCell_Inner_T_spec: len_PermCell_Inner_T empty_PermCell_Inner_T = 0
  
  axiom empty_PermCell_Inner_T_spec'0: to_mapping_PermCell_Inner_T empty_PermCell_Inner_T = Const.const (None)
  
  constant unit_FMap_PermCell_Inner_T_Ag_Seq_T: t_FMap_PermCell_Inner_T_Ag_Seq_T = empty_PermCell_Inner_T
  
  axiom unit_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall x: t_FMap_PermCell_Inner_T_Ag_Seq_T [op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T]. op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T
      = Some'0 x
  
  function factor_Ag_Seq_T (self: t_Ag_Seq_T) (factor: t_Ag_Seq_T) : t_Option_Ag_Seq_T = op_Ag_Seq_T self factor
  
  axiom factor_Ag_Seq_T_spec: forall self: t_Ag_Seq_T, factor: t_Ag_Seq_T. match factor_Ag_Seq_T self factor with
        | Some c -> op_Ag_Seq_T factor c = Some self
        | None -> forall c: t_Ag_Seq_T. op_Ag_Seq_T factor c <> Some self
        end
  
  function factor_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (factor: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = factor } with
      | {f0'1 = x; f1'1 = None} -> Some'1 x
      | {f0'1 = None} -> None'1
      | {f0'1 = Some x; f1'1 = Some y} -> match factor_Ag_Seq_T x y with
        | Some z -> Some'1 (Some z)
        | None -> if x = y then Some'1 (None) else None'1
        end
      end
  
  axiom factor_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, factor: t_Option_Ag_Seq_T. match factor_Option_Ag_Seq_T self factor with
        | Some'1 c -> op_Option_Ag_Seq_T factor c = Some'1 self
        | None'1 -> forall c: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T factor c <> Some'1 self
        end
  
  predicate incl_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) =
    factor_Option_Ag_Seq_T other self <> None'1
  
  function incl_transitive_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) : ()
  
  axiom incl_transitive_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T. incl_Option_Ag_Seq_T a b
      -> incl_Option_Ag_Seq_T b c -> incl_Option_Ag_Seq_T a c
  
  function associative_some_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (ab: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_some_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, ab: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = Some'1 ab -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = op_Option_Ag_Seq_T ab c
  
  function associative_none_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_none_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = None'1 -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = None'1
  
  function incl_op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) (comb: t_Option_Ag_Seq_T) : ()
  
  axiom incl_op_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, other: t_Option_Ag_Seq_T, comb: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T self other
        = Some'1 comb -> incl_Option_Ag_Seq_T self comb
  
  type tup2_PermCell_Inner_T_Ag_Seq_T = { f0'2: t_PermCell_Inner_T; f1'2: t_Ag_Seq_T }
  
  function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T [@inline:trivial] (self: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) (a: tup2_PermCell_Inner_T_Ag_Seq_T) : t_Option_Ag_Seq_T
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T
  
  function filter_map_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom filter_map_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T. forall k: t_PermCell_Inner_T [get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k]. get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k
        = match get_PermCell_Inner_T self k with
          | None -> None
          | Some v -> index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T f { f0'2 = k; f1'2 = v }
          end
  
  function factor_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (factor: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    if forall k: t_PermCell_Inner_T. incl_Option_Ag_Seq_T (get_PermCell_Inner_T factor k) (get_PermCell_Inner_T self k) then
      let res = filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f0'2 = k; f1'2 = vo} = __0 in match factor_Option_Ag_Seq_T (Some vo) (get_PermCell_Inner_T factor k) with
        | Some'1 r -> r
        | None'1 -> None
        end) in Some'0 res
    else
      None'0
  
  
  axiom factor_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, factor: t_FMap_PermCell_Inner_T_Ag_Seq_T. match factor_FMap_PermCell_Inner_T_Ag_Seq_T self factor with
        | Some'0 c -> op_FMap_PermCell_Inner_T_Ag_Seq_T factor c = Some'0 self
        | None'0 -> forall c: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T factor c
          <> Some'0 self
        end
  
  predicate incl_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    factor_FMap_PermCell_Inner_T_Ag_Seq_T other self <> None'0
  
  function incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T. incl_FMap_PermCell_Inner_T_Ag_Seq_T a b
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T b c -> incl_FMap_PermCell_Inner_T_Ag_Seq_T a c
  
  function associative_some_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (ab: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_some_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, ab: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = Some'0 ab
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some'0 bc
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = op_FMap_PermCell_Inner_T_Ag_Seq_T ab c
  
  function associative_none_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_none_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = None'0 -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some'0 bc -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = None'0
  
  function incl_op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) (comb: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_op_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T, comb: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T self other
        = Some'0 comb -> incl_FMap_PermCell_Inner_T_Ag_Seq_T self comb
  
  predicate rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    match a with
      | Some'0 a'0 -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f a'0
      | None'0 -> true
      end
  
  function rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a unit_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (None'0) f
  
  function rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f1: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f2: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f1: t_FMap_PermCell_Inner_T_Ag_Seq_T, f2: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f1
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f2 f1 -> rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f2
  
  function auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self) (frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  function val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
   = val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0)
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  function view_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) : Seq.seq t_T =
    (unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell))).f0'0
  
  meta "rewrite_def" function view_PersistentArray_T
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate invariant_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Rc_PermCell_Inner_T_Global) =
    invariant_ref_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_PermCell_Inner_T_Global
  
  let rec clone_Rc_PermCell_Inner_T_Global (self_: t_Rc_PermCell_Inner_T_Global)
    (return (x: t_Rc_PermCell_Inner_T_Global)) =
    {[@stop_split] [@expl:clone 'self_' type invariant] inv_ref_Rc_PermCell_Inner_T_Global self_}
    any
    [ return (result: t_Rc_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:clone_Rc_PermCell_Inner_T_Global ensures] ([@stop_split] [@expl:clone result type invariant] inv_Rc_PermCell_Inner_T_Global result)
      /\ ([@stop_split] [@expl:clone ensures] result = self_)}
      (! return {result}) ]
  
  type t_Vec_T_Global
  
  type t_Inner_T = Direct t_Vec_T_Global | Link UInt64.t t_T t_Rc_PermCell_Inner_T_Global
  
  type t_Perm_PermCell_Inner_T
  
  type tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global = {
    f0'3: t_PermCell_Inner_T;
    f1'3: t_Perm_PermCell_Inner_T }
  
  predicate inv_T (_1: t_T)
  
  predicate invariant_ref_T [@inline:trivial] (self: t_T) = inv_T self
  
  meta "rewrite_def" predicate invariant_ref_T
  
  predicate inv_ref_T [@inline:trivial] (_1: t_T) = invariant_ref_T _1
  
  meta "rewrite_def" predicate inv_ref_T
  
  predicate invariant_Seq_T [@inline:trivial] (self: Seq.seq t_T) =
    forall i: int. 0 <= i /\ i < Seq.length self -> inv_ref_T (Seq.get self i)
  
  meta "rewrite_def" predicate invariant_Seq_T
  
  predicate inv_Seq_T [@inline:trivial] (_1: Seq.seq t_T) = invariant_Seq_T _1
  
  meta "rewrite_def" predicate inv_Seq_T
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_T_Global (self: t_Vec_T_Global) : Seq.seq t_T
  
  axiom view_Vec_T_Global_spec: forall self: t_Vec_T_Global. Seq.length (view_Vec_T_Global self)
      <= UInt64.t'int const_MAX
  
  predicate invariant_Vec_T_Global (self: t_Vec_T_Global) = inv_Seq_T (view_Vec_T_Global self)
  
  predicate inv_Vec_T_Global (_1: t_Vec_T_Global)
  
  axiom inv_axiom: forall x: t_Vec_T_Global [inv_Vec_T_Global x]. inv_Vec_T_Global x -> invariant_Vec_T_Global x
  
  predicate inv_Inner_T (_1: t_Inner_T)
  
  axiom inv_axiom'0 [@rewrite]: forall x: t_Inner_T [inv_Inner_T x]. inv_Inner_T x
      = match x with
        | Direct f0'4 -> inv_Vec_T_Global f0'4
        | Link index value next -> inv_T value /\ inv_Rc_PermCell_Inner_T_Global next
        end
  
  function ward_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_PermCell_Inner_T
  
  function val_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_Inner_T
  
  function view_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    val_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Perm_PermCell_Inner_T
  
  function view_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    view_Perm_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Box_Perm_PermCell_Inner_T_Global
  
  let rec new_Inner_T (value: t_Inner_T) (return (x: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global)) =
    {[@stop_split] [@expl:new 'value' type invariant] inv_Inner_T value}
    any
    [ return (result: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:new_Inner_T ensures] ([@stop_split] [@expl:new ensures #0] result.f0'3
        = ward_PermCell_Inner_T result.f1'3)
      /\ ([@stop_split] [@expl:new ensures #1] view_Box_Perm_PermCell_Inner_T_Global result.f1'3 = value)}
      (! return {result}) ]
  
  type t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PA_T = {
    perms: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global;
    auth: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T;
    depth: Map.map t_PermCell_Inner_T int }
  
  predicate invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  predicate inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  axiom inv_axiom'1:
    forall x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x]. inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
      -> invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
  
  predicate inv_PA_T (_1: t_PA_T)
  
  axiom inv_axiom'2 [@rewrite]: forall x: t_PA_T [inv_PA_T x]. inv_PA_T x
      = inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x.auth
  
  predicate invariant_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) =
    inv_PA_T self.current /\ inv_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_PA_T
  
  predicate inv_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_PA_T
  
  predicate invariant_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_Ghost_refmut_PA_T
  
  predicate inv_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_Ghost_refmut_PA_T
  
  predicate invariant_ref_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_Ghost_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_refmut_PA_T
  
  predicate inv_ref_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_ref_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_refmut_PA_T
  
  predicate invariant_ref_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_refmut_PA_T
  
  predicate inv_ref_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_ref_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_refmut_PA_T
  
  let rec deref_Ghost_refmut_PA_T (self: MutBorrow.t t_PA_T) (return (x: MutBorrow.t t_PA_T)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_refmut_PA_T self}
    any
    [ return (result: MutBorrow.t t_PA_T) ->
    {[@stop_split] [@expl:deref_Ghost_refmut_PA_T ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_refmut_PA_T result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  type closure0 = { c0: t_PersistentArray_T; c1: t_PermCell_Inner_T; c2: t_Perm_PermCell_Inner_T; c3: t_Ag_Seq_T }
  
  let rec deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:deref ensures] result = self}
      (! return {result}) ]
  
  predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T'0 (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id =
    id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0
  
  function view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  let rec frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (frag'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) (return (x: ())) =
    {[@stop_split] [@expl:frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T requires] ([@stop_split] [@expl:frag_lemma 'self' type invariant] inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)
    /\ ([@stop_split] [@expl:frag_lemma requires] id_FMap_PermCell_Inner_T_Ag_Seq_T self
    = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0)}
    any
    [ return (result: ()) ->
    {[@stop_split] [@expl:frag_lemma ensures] incl_FMap_PermCell_Inner_T_Ag_Seq_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0) (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)}
      (! return {result}) ]
  
  predicate invariant_refmut_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t (MutBorrow.t t_PA_T)) =
    inv_Ghost_refmut_PA_T self.current /\ inv_Ghost_refmut_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Ghost_refmut_PA_T
  
  predicate inv_refmut_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) =
    invariant_refmut_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_Ghost_refmut_PA_T
  
  predicate invariant_refmut_refmut_PA_T [@inline:trivial] (self: MutBorrow.t (MutBorrow.t t_PA_T)) =
    inv_refmut_PA_T self.current /\ inv_refmut_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_refmut_PA_T
  
  predicate inv_refmut_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) =
    invariant_refmut_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_refmut_PA_T
  
  let rec deref_mut_Ghost_refmut_PA_T (self: MutBorrow.t (MutBorrow.t t_PA_T))
    (return (x: MutBorrow.t (MutBorrow.t t_PA_T))) =
    {[@stop_split] [@expl:deref_mut 'self' type invariant] inv_refmut_Ghost_refmut_PA_T self}
    any
    [ return (result: MutBorrow.t (MutBorrow.t t_PA_T)) ->
    {[@stop_split] [@expl:deref_mut_Ghost_refmut_PA_T ensures] ([@stop_split] [@expl:deref_mut result type invariant] inv_refmut_refmut_PA_T result)
      /\ ([@stop_split] [@expl:deref_mut ensures] result = self)}
      (! return {result}) ]
  
  type t_Option_refmut_Box_Perm_PermCell_Inner_T_Global = None'2 | Some'2 (MutBorrow.t t_Perm_PermCell_Inner_T)
  
  type t_Option_Box_Perm_PermCell_Inner_T_Global = None'3 | Some'3 t_Perm_PermCell_Inner_T
  
  function to_mapping_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : Map.map t_PermCell_Inner_T t_Option_Box_Perm_PermCell_Inner_T_Global
  
  function get_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Option_Box_Perm_PermCell_Inner_T_Global
   = Map.get (to_mapping_Snapshot_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_Snapshot_PermCell_Inner_T
  
  predicate contains_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) =
    get_Snapshot_PermCell_Inner_T self k <> None'3
  
  meta "rewrite_def" predicate contains_Snapshot_PermCell_Inner_T
  
  predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool [@inline:trivial] (self: Map.map t_Perm_PermCell_Inner_T bool) (a: t_Perm_PermCell_Inner_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool
  
  function such_that_Box_Perm_PermCell_Inner_T_Global (p: Map.map t_Perm_PermCell_Inner_T bool) : t_Perm_PermCell_Inner_T
  
  axiom such_that_Box_Perm_PermCell_Inner_T_Global_spec:
    forall p: Map.map t_Perm_PermCell_Inner_T bool. (exists x: t_Perm_PermCell_Inner_T. index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p x)
      -> index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p (such_that_Box_Perm_PermCell_Inner_T_Global p)
  
  function unwrap_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) : t_Perm_PermCell_Inner_T
   = match self with
      | Some'3 x -> x
      | None'3 -> such_that_Box_Perm_PermCell_Inner_T_Global (fun (__0: t_Perm_PermCell_Inner_T) -> true)
      end
  
  function lookup_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = unwrap_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_Snapshot_PermCell_Inner_T
  
  function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = lookup_Snapshot_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  function len_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : int
  
  axiom len_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global. len_Snapshot_PermCell_Inner_T self
      >= 0
  
  let rec get_mut_ghost_Snapshot_PermCell_Inner_T
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T)
    (return (x: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:get_mut_ghost_Snapshot_PermCell_Inner_T ensures] ([@stop_split] [@expl:get_mut_ghost ensures #0] if contains_Snapshot_PermCell_Inner_T self.current key then
          match result with
            | None'2 -> false
            | Some'2 r -> contains_Snapshot_PermCell_Inner_T self.final key
            /\ index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.current key = r.current
            /\ index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.final key = r.final
            end
        else
          result = None'2 /\ self.current = self.final
        )
      /\ ([@stop_split] [@expl:get_mut_ghost ensures #1] forall k: t_PermCell_Inner_T. k <> key
          -> get_Snapshot_PermCell_Inner_T self.current k = get_Snapshot_PermCell_Inner_T self.final k)
      /\ ([@stop_split] [@expl:get_mut_ghost ensures #2] len_Snapshot_PermCell_Inner_T self.current
      = len_Snapshot_PermCell_Inner_T self.final)}
      (! return {result}) ]
  
  predicate resolve_refmut_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: MutBorrow.t t_Perm_PermCell_Inner_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Box_Perm_PermCell_Inner_T_Global
  
  predicate resolve_refmut_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_refmut_PA_T
  
  let rec elim_Some (_x: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global)
    (return (f0'4: MutBorrow.t t_Perm_PermCell_Inner_T)) = any
    [ _k (f0'4: MutBorrow.t t_Perm_PermCell_Inner_T) -> {Some'2 f0'4 = _x} (! return {f0'4})
    | _chk -> (! {[@expl:elim Some] match _x with
        | Some'2 _ -> true
        | _ -> false
        end}
      any) ]
  
  let rec deref_Ghost_Box_Perm_PermCell_Inner_T_Global (self: t_Perm_PermCell_Inner_T)
    (return (x: t_Perm_PermCell_Inner_T)) = any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:deref ensures] result = self}
      (! return {result}) ]
  
  predicate is_disjoint_PermCell_Inner_T [@inline:trivial] (self: t_PermCell_Inner_T) (_self_val: t_Inner_T) (other: t_PermCell_Inner_T) (_other_val: t_Inner_T) =
    self <> other
  
  meta "rewrite_def" predicate is_disjoint_PermCell_Inner_T
  
  let rec disjoint_lemma_PermCell_Inner_T (self: MutBorrow.t t_Perm_PermCell_Inner_T) (other: t_Perm_PermCell_Inner_T)
    (return (x: ())) = any
    [ return (result: ()) ->
    {[@stop_split] [@expl:disjoint_lemma_PermCell_Inner_T ensures] ([@stop_split] [@expl:disjoint_lemma ensures #0] is_disjoint_PermCell_Inner_T (ward_PermCell_Inner_T self.current) (val_PermCell_Inner_T self.current) (ward_PermCell_Inner_T other) (val_PermCell_Inner_T other))
      /\ ([@stop_split] [@expl:disjoint_lemma ensures #1] self.current = self.final)}
      (! return {result}) ]
  
  let rec into_inner_Box_Perm_PermCell_Inner_T_Global (self: t_Perm_PermCell_Inner_T)
    (return (x: t_Perm_PermCell_Inner_T)) = any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:into_inner ensures] result = self}
      (! return {result}) ]
  
  function insert_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) (v: t_Perm_PermCell_Inner_T) : t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  axiom insert_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T, v: t_Perm_PermCell_Inner_T. to_mapping_Snapshot_PermCell_Inner_T (insert_Snapshot_PermCell_Inner_T self k v)
      = Map.set (to_mapping_Snapshot_PermCell_Inner_T self) k (Some'3 v)
  
  axiom insert_Snapshot_PermCell_Inner_T_spec'0:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T, v: t_Perm_PermCell_Inner_T. len_Snapshot_PermCell_Inner_T (insert_Snapshot_PermCell_Inner_T self k v)
      = (if contains_Snapshot_PermCell_Inner_T self k then
        len_Snapshot_PermCell_Inner_T self
      else
        len_Snapshot_PermCell_Inner_T self + 1
      )
  
  let rec insert_ghost_Snapshot_PermCell_Inner_T
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T)
    (value: t_Perm_PermCell_Inner_T) (return (x: t_Option_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:insert_ghost_Snapshot_PermCell_Inner_T ensures] ([@stop_split] [@expl:insert_ghost ensures #0] self.final
        = insert_Snapshot_PermCell_Inner_T self.current key value)
      /\ ([@stop_split] [@expl:insert_ghost ensures #1] result = get_Snapshot_PermCell_Inner_T self.current key)}
      (! return {result}) ]
  
  predicate resolve_ref_Inner_T [@inline:trivial] (_1: t_Inner_T) = true
  
  meta "rewrite_def" predicate resolve_ref_Inner_T
  
  predicate resolve_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) =
    resolve_ref_Inner_T (val_PermCell_Inner_T self)
  
  meta "rewrite_def" predicate resolve_Perm_PermCell_Inner_T
  
  predicate resolve_Perm_PermCell_Inner_T'0 (_1: t_Perm_PermCell_Inner_T)
  
  axiom resolve_axiom:
    forall x: t_Perm_PermCell_Inner_T [resolve_Perm_PermCell_Inner_T'0 x]. resolve_Perm_PermCell_Inner_T'0 x
      -> resolve_Perm_PermCell_Inner_T x
  
  predicate resolve_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Perm_PermCell_Inner_T) =
    resolve_Perm_PermCell_Inner_T'0 _1
  
  meta "rewrite_def" predicate resolve_Box_Perm_PermCell_Inner_T_Global
  
  predicate resolve_Option_Box_Perm_PermCell_Inner_T_Global (_1: t_Option_Box_Perm_PermCell_Inner_T_Global)
  
  axiom resolve_axiom'0 [@rewrite]:
    forall x: t_Option_Box_Perm_PermCell_Inner_T_Global [resolve_Option_Box_Perm_PermCell_Inner_T_Global x]. resolve_Option_Box_Perm_PermCell_Inner_T_Global x
      = match x with
        | None'3 -> true
        | Some'3 x0 -> resolve_Box_Perm_PermCell_Inner_T_Global x0
        end
  
  function index_Mapping_PermCell_Inner_T_Int [@inline:trivial] (self: Map.map t_PermCell_Inner_T int) (a: t_PermCell_Inner_T) : int
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_PermCell_Inner_T_Int
  
  let rec id_ghost_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Id)) =
    {[@stop_split] [@expl:id_ghost 'self' type invariant] inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self}
    any
    [ return (result: t_Id) -> {[@stop_split] [@expl:id_ghost ensures] result = id_FMap_PermCell_Inner_T_Ag_Seq_T self}
      (! return {result}) ]
  
  let rec new_unit_FMap_PermCell_Inner_T_Ag_Seq_T (id: t_Id) (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:new_unit ensures] view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T result
        = unit_FMap_PermCell_Inner_T_Ag_Seq_T
      /\ id_FMap_PermCell_Inner_T_Ag_Seq_T'0 result = id}
      (! return {result}) ]
  
  type t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T = { f0'4: t_PermCell_Inner_T; f1'4: t_Ag_Seq_T }
  
  predicate invariant_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current /\ inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate premise_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T) (from_auth: t_FMap_PermCell_Inner_T_Ag_Seq_T) (_3: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    get_PermCell_Inner_T from_auth self.f0'4 = None
  
  meta "rewrite_def" predicate premise_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T
  
  type tup2_FMap_PermCell_Inner_T_Ag_Seq_T_FMap_PermCell_Inner_T_Ag_Seq_T = {
    f0'5: t_FMap_PermCell_Inner_T_Ag_Seq_T;
    f1'5: t_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  predicate contains_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) =
    get_PermCell_Inner_T self k <> None
  
  meta "rewrite_def" predicate contains_PermCell_Inner_T
  
  function insert_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) (v: t_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom insert_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, k: t_PermCell_Inner_T, v: t_Ag_Seq_T. to_mapping_PermCell_Inner_T (insert_PermCell_Inner_T self k v)
      = Map.set (to_mapping_PermCell_Inner_T self) k (Some v)
  
  axiom insert_PermCell_Inner_T_spec'0:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, k: t_PermCell_Inner_T, v: t_Ag_Seq_T. len_PermCell_Inner_T (insert_PermCell_Inner_T self k v)
      = (if contains_PermCell_Inner_T self k then len_PermCell_Inner_T self else len_PermCell_Inner_T self + 1)
  
  function update_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T) (from_auth: t_FMap_PermCell_Inner_T_Ag_Seq_T) (from_frag: t_FMap_PermCell_Inner_T_Ag_Seq_T) : tup2_FMap_PermCell_Inner_T_Ag_Seq_T_FMap_PermCell_Inner_T_Ag_Seq_T
   = { f0'5 = insert_PermCell_Inner_T from_auth self.f0'4 self.f1'4;
       f1'5 = insert_PermCell_Inner_T from_frag self.f0'4 self.f1'4 }
  
  meta "rewrite_def" function update_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T
  
  let rec update_FMap_PermCell_Inner_T_Ag_Seq_T (self: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (frag'0: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (upd: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T) (return (x: ())) =
    {[@stop_split] [@expl:update_FMap_PermCell_Inner_T_Ag_Seq_T requires] ([@stop_split] [@expl:update 'self' type invariant] inv_refmut_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)
    /\ ([@stop_split] [@expl:update requires #0] id_FMap_PermCell_Inner_T_Ag_Seq_T self.current
      = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0.current)
    /\ ([@stop_split] [@expl:update requires #1] premise_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T upd (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current) (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0.current))}
    any
    [ return (result: ()) ->
    {[@stop_split] [@expl:update_FMap_PermCell_Inner_T_Ag_Seq_T ensures] ([@stop_split] [@expl:update ensures #0] id_FMap_PermCell_Inner_T_Ag_Seq_T self.current
        = id_FMap_PermCell_Inner_T_Ag_Seq_T self.final)
      /\ ([@stop_split] [@expl:update ensures #1] id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0.current
        = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0.final)
      /\ ([@stop_split] [@expl:update ensures #2] incl_FMap_PermCell_Inner_T_Ag_Seq_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0.current) (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current))
      /\ ([@stop_split] [@expl:update ensures #3] { f0'5 = view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.final;
                                                    f1'5 = view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0.final }
      = update_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T upd (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.current) (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0.current))}
      (! return {result}) ]
  
  predicate resolve_refmut_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate resolve_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_PA_T
  
  predicate resolve_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = resolve_refmut_PA_T _1
  
  meta "rewrite_def" predicate resolve_Ghost_refmut_PA_T
  
  let rec new_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:new ensures] result = x}
      (! return {result}) ]
  
  type t_NonAtomicInvariant_PA_T
  
  function public_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Id
  
  function view_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global) : t_NonAtomicInvariant_PA_T
  
  function namespace_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Namespace
  
  predicate invariant_PersistentArray_T (self: t_PersistentArray_T) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T'0 self.frag = public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv)
    /\ get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell)
      <> None
    /\ namespace_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) = Namespace_PARRAY 0
  
  predicate inv_Rc_NonAtomicInvariant_PA_T_Global (_1: t_Rc_NonAtomicInvariant_PA_T_Global)
  
  predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_PersistentArray_T (_1: t_PersistentArray_T)
  
  axiom inv_axiom'3 [@rewrite]: forall x: t_PersistentArray_T [inv_PersistentArray_T x]. inv_PersistentArray_T x
      = (invariant_PersistentArray_T x
      /\ inv_Rc_PermCell_Inner_T_Global x.permcell /\ inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global x.inv)
  
  predicate invariant_ref_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) = inv_PersistentArray_T self
  
  meta "rewrite_def" predicate invariant_ref_PersistentArray_T
  
  predicate inv_ref_PersistentArray_T [@inline:trivial] (_1: t_PersistentArray_T) = invariant_ref_PersistentArray_T _1
  
  meta "rewrite_def" predicate inv_ref_PersistentArray_T
  
  predicate inv_closure0 [@inline:trivial] (_1: closure0) =
    let {c0 = x0; c1 = x1; c2 = x2; c3 = x3} = _1 in inv_ref_PersistentArray_T x0
  
  meta "rewrite_def" predicate inv_closure0
  
  let rec closure0 [@coma:extspec] (self: closure0) (pa: MutBorrow.t t_PA_T)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:closure0 requires] ([@stop_split] [@expl:closure 'self' type invariant] inv_closure0 self)
    /\ ([@stop_split] [@expl:closure 'pa' type invariant] inv_Ghost_refmut_PA_T pa)}
    bb0
    [ bb0 = s0
      [ s0 = deref_Ghost_refmut_PA_T {pa} (fun (_x: MutBorrow.t t_PA_T) -> [ &_6 <- _x ] s1)
      | s1 = [ &_11 <- self.c0.frag ] s2
      | s2 = deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {_11}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_9 <- _x ] s3)
      | s3 = frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T {_6.current.auth} {_9} (fun (_x: ()) -> [ &_4 <- _x ] s4)
      | s4 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_16 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s5) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s5 = deref_mut_Ghost_refmut_PA_T {_16} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_15 <- _x ] s6)
      | s6 = [ &_18 <- self.c1 ] s7
      | s7 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global>
          {_15.current.current.perms}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_14 <- _bor ]
            [ &_15 <- { _15 with current = { _15.current with current = { _15.current.current with perms = _bor.final } } } ]
            s8)
      | s8 = get_mut_ghost_Snapshot_PermCell_Inner_T {_14} {_18}
          (fun (_x: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global) -> [ &_13 <- _x ] s9)
      | s9 = any
        [ br0 -> {_13 = None'2} (! bb11)
        | br1 (x0: MutBorrow.t t_Perm_PermCell_Inner_T) -> {_13 = Some'2 x0} (! bb8) ] ]
    | bb11 = s0
      [ s0 = -{match _13 with
          | Some'2 x -> resolve_refmut_Box_Perm_PermCell_Inner_T_Global x
          | _ -> true
          end}-
        s1
      | s1 = s2 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _15} any) ]
      | s2 = -{resolve_refmut_refmut_PA_T _15}- s3
      | s3 = bb12 ]
    | bb8 = s0
      [ s0 = elim_Some {_13} (fun (r0: MutBorrow.t t_Perm_PermCell_Inner_T) -> [ &other <- r0 ] s1)
      | s1 = [ &_29 <- self.c2 ] s2
      | s2 = deref_Ghost_Box_Perm_PermCell_Inner_T_Global {_29} (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_27 <- _x ] s3)
      | s3 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {other.current} {MutBorrow.get_id other}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_25 <- _bor ] [ &other <- { other with current = _bor.final } ] s4)
      | s4 = disjoint_lemma_PermCell_Inner_T {_25} {_27} (fun (_x: ()) -> [ &_24 <- _x ] s5)
      | s5 = -{resolve_refmut_Box_Perm_PermCell_Inner_T_Global other}- s6
      | s6 = s7 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _15} any) ]
      | s7 = -{resolve_refmut_refmut_PA_T _15}- s8
      | s8 = {[@expl:assertion] false} s9
      | s9 = bb12 ]
    | bb12 = s0
      [ s0 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_34 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s1) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s1 = deref_mut_Ghost_refmut_PA_T {_34} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_33 <- _x ] s2)
      | s2 = into_inner_Box_Perm_PermCell_Inner_T_Global {self.c2}
          (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_38 <- _x ] s3)
      | s3 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global>
          {_33.current.current.perms}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_32 <- _bor ]
            [ &_33 <- { _33 with current = { _33.current with current = { _33.current.current with perms = _bor.final } } } ]
            s4)
      | s4 = insert_ghost_Snapshot_PermCell_Inner_T {_32} {self.c1} {_38}
          (fun (_x: t_Option_Box_Perm_PermCell_Inner_T_Global) -> [ &_31 <- _x ] s5)
      | s5 = -{resolve_Option_Box_Perm_PermCell_Inner_T_Global _31}- s6
      | s6 = s7 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _33} any) ]
      | s7 = -{resolve_refmut_refmut_PA_T _33}- s8
      | s8 =
        [ &_40 <- Map.set pa.current.depth self.c1 (index_Mapping_PermCell_Inner_T_Int pa.current.depth (view_Rc_PermCell_Inner_T_Global self.c0.permcell)
        + 1) ] s9
      | s9 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_46 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s10) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s10 = deref_mut_Ghost_refmut_PA_T {_46} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_45 <- _x ] s11)
      | s11 = [ &_45 <- { _45 with current = { _45.current with current = { _45.current.current with depth = _40 } } } ]
        s12
      | s12 = s13 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _45} any) ]
      | s13 = -{resolve_refmut_refmut_PA_T _45}- s14
      | s14 = deref_Ghost_refmut_PA_T {pa} (fun (_x: MutBorrow.t t_PA_T) -> [ &_50 <- _x ] s15)
      | s15 = id_ghost_FMap_PermCell_Inner_T_Ag_Seq_T {_50.current.auth} (fun (_x: t_Id) -> [ &_48 <- _x ] s16)
      | s16 = new_unit_FMap_PermCell_Inner_T_Ag_Seq_T {_48}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &frag'0 <- _x ] s17)
      | s17 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_55 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s18) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s18 = deref_mut_Ghost_refmut_PA_T {_55} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_54 <- _x ] s19)
      | s19 = MutBorrow.borrow_mut <t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T> {frag'0}
          (fun (_bor: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_57 <- _bor ] [ &frag'0 <- _bor.final ] s20)
      | s20 = [ &_58 <- { f0'4 = self.c1; f1'4 = self.c3 } ] s21
      | s21 = MutBorrow.borrow_mut <t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T> {_54.current.current.auth}
          (fun (_bor: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_53 <- _bor ] -{inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _bor.final}-
            [ &_54 <- { _54 with current = { _54.current with current = { _54.current.current with auth = _bor.final } } } ]
            s22)
        [ _ck -> (! {[@expl:type invariant] inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _54.current.current.auth}
          any) ]
      | s22 = MutBorrow.borrow_final <t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T> {_57.current} {MutBorrow.get_id _57}
          (fun (_bor: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
            [ &_56 <- _bor ] [ &_57 <- { _57 with current = _bor.final } ] s23)
      | s23 = update_FMap_PermCell_Inner_T_Ag_Seq_T {_53} {_56} {_58} (fun (_x: ()) -> [ &_52 <- _x ] s24)
      | s24 = -{resolve_refmut_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T _57}- s25
      | s25 = s26 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _54} any) ]
      | s26 = -{resolve_refmut_refmut_PA_T _54}- s27
      | s27 = s28 [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s28 = -{resolve_Ghost_refmut_PA_T pa}- s29
      | s29 = new_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {frag'0}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_ret <- _x ] s30)
      | s30 = return {_ret} ] ]
    [ & _ret: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & self: closure0 = self
    | & pa: MutBorrow.t t_PA_T = pa
    | & _4: () = Any.any_l ()
    | & _6: MutBorrow.t t_PA_T = Any.any_l ()
    | & _9: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _11: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _13: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _14: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _15: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _16: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _18: t_PermCell_Inner_T = Any.any_l ()
    | & other: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _24: () = Any.any_l ()
    | & _25: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _27: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _29: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _31: t_Option_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _32: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _33: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _34: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _38: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _40: Map.map t_PermCell_Inner_T int = Any.any_l ()
    | & _45: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _46: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & frag'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _48: t_Id = Any.any_l ()
    | & _50: MutBorrow.t t_PA_T = Any.any_l ()
    | & _52: () = Any.any_l ()
    | & _53: MutBorrow.t t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _54: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _55: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _56: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _57: MutBorrow.t t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _58: t_FMapInsertLocalUpdate_PermCell_Inner_T_Ag_Seq_T = Any.any_l () ]
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> return {result} ]
  
  meta "rewrite_def" predicate closure0'pre
  
  meta "rewrite_def" predicate closure0'post'return
  
  type t_Tokens
  
  predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  type tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0 = {
    f0'6: t_Rc_NonAtomicInvariant_PA_T_Global;
    f1'6: t_Tokens;
    f2'6: closure0 }
  
  predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate invariant_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_ref_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate precondition_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) =
    let self_ = args in inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate precondition_deref
  
  predicate postcondition_once_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (result: t_NonAtomicInvariant_PA_T) =
    let self_ = args in result = view_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate postcondition_once_deref
  
  predicate resolve_deref [@inline:trivial] (_1: ()) = true
  
  meta "rewrite_def" predicate resolve_deref
  
  predicate postcondition_mut_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (result_state: ()) (result: t_NonAtomicInvariant_PA_T) =
    let self_ = args in result = view_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate postcondition_mut_deref
  
  function fn_mut_once_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom fn_mut_once_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res: t_NonAtomicInvariant_PA_T. postcondition_once_deref self args res
      = (exists res_state: (). postcondition_mut_deref self args res_state res /\ resolve_deref res_state)
  
  predicate hist_inv_deref [@inline:trivial] (self: ()) (result_state: ()) = true
  
  meta "rewrite_def" predicate hist_inv_deref
  
  function hist_inv_trans_deref (self: ()) (b: ()) (c: ()) : ()
  
  axiom hist_inv_trans_deref_spec: forall self: (), b: (), c: (). hist_inv_deref self b
      -> hist_inv_deref b c -> hist_inv_deref self c
  
  function hist_inv_refl_deref (self: ()) : ()
  
  axiom hist_inv_refl_deref_spec: forall self: (). hist_inv_deref self self
  
  function postcondition_mut_hist_inv_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res_state: ()) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom postcondition_mut_hist_inv_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res_state: (), res: t_NonAtomicInvariant_PA_T. postcondition_mut_deref self args res_state res
      -> hist_inv_deref self res_state
  
  function fn_hist_inv_deref (self: ()) (res_state: ()) : ()
  
  axiom fn_hist_inv_deref_spec: forall self: (), res_state: (). hist_inv_deref self res_state = (self = res_state)
  
  predicate postcondition_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (result: t_NonAtomicInvariant_PA_T) =
    let self_ = args in result = view_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate postcondition_deref
  
  function fn_once_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom fn_once_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res: t_NonAtomicInvariant_PA_T. postcondition_once_deref self args res
      = (postcondition_deref self args res /\ resolve_deref self)
  
  function fn_mut_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res_state: ()) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom fn_mut_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res_state: (), res: t_NonAtomicInvariant_PA_T. postcondition_mut_deref self args res_state res
      = (postcondition_deref self args res /\ self = res_state)
  
  type tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0 = {
    f0'7: t_NonAtomicInvariant_PA_T;
    f1'7: t_Tokens;
    f2'7: closure0 }
  
  predicate contains_Namespace [@inline:trivial] (self: Set.set t_Namespace) (e: t_Namespace) = Set.mem e self
  
  meta "rewrite_def" predicate contains_Namespace
  
  function namespaces (self: t_Tokens) : Set.set t_Namespace
  
  predicate contains (self: t_Tokens) (namespace: t_Namespace) = contains_Namespace (namespaces self) namespace
  
  function lookup_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Ag_Seq_T
   = unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_PermCell_Inner_T
  
  function index_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (key: t_PermCell_Inner_T) : t_Ag_Seq_T
   = lookup_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate partial_invariant_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.auth = id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
        /\ contains_Snapshot_PermCell_Inner_T self.perms pc
      -> ward_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc)
        = pc
      /\ match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc) with
        | Direct v -> (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0'0
        = view_Vec_T_Global v
        | Link index value next -> contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)
        /\ index_Mapping_PermCell_Inner_T_Int self.depth pc
          > index_Mapping_PermCell_Inner_T_Int self.depth (view_Rc_PermCell_Inner_T_Global next)
        /\ UInt64.t'int index
          < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0'0
        /\ (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0'0
        = Seq.set (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0'0 (UInt64.t'int index) value
        end)
  
  meta "rewrite_def" predicate partial_invariant_T
  
  predicate protocol_PA_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    partial_invariant_T self id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
      = contains_Snapshot_PermCell_Inner_T self.perms pc)
  
  meta "rewrite_def" predicate protocol_PA_T
  
  predicate precondition_closure0 [@inline:trivial] (self: closure0) (args: MutBorrow.t t_PA_T) =
    let pa = args in closure0'pre self pa
  
  meta "rewrite_def" predicate precondition_closure0
  
  predicate postcondition_once_closure0 [@inline:trivial] (self: closure0) (args: MutBorrow.t t_PA_T) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let pa = args in closure0'post'return self pa result
  
  meta "rewrite_def" predicate postcondition_once_closure0
  
  function fin_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) : t_PA_T = self.final
  
  meta "rewrite_def" function fin_Ghost_refmut_PA_T
  
  predicate precondition_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) =
    let {f0'7 = self'0; f1'7 = tokens; f2'7 = f} = args in inv_closure0 f
    /\ contains tokens (namespace_PA_T self'0)
    /\ (forall t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0) /\ inv_Ghost_refmut_PA_T t
      -> precondition_closure0 f t
      /\ (forall res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_once_closure0 f t res
        -> protocol_PA_T (fin_Ghost_refmut_PA_T t) (public_PA_T self'0)))
  
  meta "rewrite_def" predicate precondition_open
  
  function new_ref_NonAtomicInvariant_PA_T (x: t_NonAtomicInvariant_PA_T) : t_NonAtomicInvariant_PA_T
  
  axiom new_ref_NonAtomicInvariant_PA_T_spec: forall x: t_NonAtomicInvariant_PA_T. new_ref_NonAtomicInvariant_PA_T x = x
  
  predicate precondition_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) =
    let {f0'6 = self'0; f1'6 = tokens; f2'6 = f} = args in inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global self'0
    /\ inv_closure0 f
    /\ precondition_deref () self'0
    /\ (forall this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      -> precondition_open () { f0'7 = new_ref_NonAtomicInvariant_PA_T this; f1'7 = tokens; f2'7 = f })
  
  meta "rewrite_def" predicate precondition_open'0
  
  let rec deref_Rc_NonAtomicInvariant_PA_T_Global (self_: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_NonAtomicInvariant_PA_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_}
    any
    [ return (result: t_NonAtomicInvariant_PA_T) -> {[@stop_split] [@expl:deref ensures] result
      = view_Rc_NonAtomicInvariant_PA_T_Global self_}
      (! return {result}) ]
  
  let rec open_Ghost_ref_NonAtomicInvariant_PA_T (self: t_NonAtomicInvariant_PA_T) (tokens: t_Tokens) (f: closure0)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:open_Ghost_ref_NonAtomicInvariant_PA_T requires] ([@stop_split] [@expl:open 'f' type invariant] inv_closure0 f)
    /\ ([@stop_split] [@expl:open requires #0] contains tokens (namespace_PA_T self))
    /\ ([@stop_split] [@expl:open requires #1] forall t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self)
        /\ inv_Ghost_refmut_PA_T t
      -> precondition_closure0 f t
      /\ (forall res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_once_closure0 f t res
        -> protocol_PA_T (fin_Ghost_refmut_PA_T t) (public_PA_T self)))}
    any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:open ensures] exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self)
        /\ postcondition_once_closure0 f t result}
      (! return {result}) ]
  
  predicate postcondition_once_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let {f0'7 = self'0; f1'7 = tokens; f2'7 = f} = args in exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0)
      /\ postcondition_once_closure0 f t result
  
  meta "rewrite_def" predicate postcondition_once_open
  
  predicate resolve_open [@inline:trivial] (_1: ()) = true
  
  meta "rewrite_def" predicate resolve_open
  
  predicate postcondition_mut_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (result_state: ()) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let {f0'7 = self'0; f1'7 = tokens; f2'7 = f} = args in exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0)
      /\ postcondition_once_closure0 f t result
  
  meta "rewrite_def" predicate postcondition_mut_open
  
  function fn_mut_once_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom fn_mut_once_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_once_open self args res
      = (exists res_state: (). postcondition_mut_open self args res_state res /\ resolve_open res_state)
  
  predicate hist_inv_open [@inline:trivial] (self: ()) (result_state: ()) = true
  
  meta "rewrite_def" predicate hist_inv_open
  
  function hist_inv_trans_open (self: ()) (b: ()) (c: ()) : ()
  
  axiom hist_inv_trans_open_spec: forall self: (), b: (), c: (). hist_inv_open self b
      -> hist_inv_open b c -> hist_inv_open self c
  
  function hist_inv_refl_open (self: ()) : ()
  
  axiom hist_inv_refl_open_spec: forall self: (). hist_inv_open self self
  
  function postcondition_mut_hist_inv_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res_state: ()) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom postcondition_mut_hist_inv_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res_state: (), res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_mut_open self args res_state res
      -> hist_inv_open self res_state
  
  function fn_hist_inv_open (self: ()) (res_state: ()) : ()
  
  axiom fn_hist_inv_open_spec: forall self: (), res_state: (). hist_inv_open self res_state = (self = res_state)
  
  predicate postcondition_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let {f0'7 = self'0; f1'7 = tokens; f2'7 = f} = args in exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0)
      /\ postcondition_once_closure0 f t result
  
  meta "rewrite_def" predicate postcondition_open
  
  function fn_once_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom fn_once_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_once_open self args res
      = (postcondition_open self args res /\ resolve_open self)
  
  function fn_mut_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res_state: ()) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom fn_mut_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res_state: (), res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_mut_open self args res_state res
      = (postcondition_open self args res /\ self = res_state)
  
  let rec open_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (tokens: t_Tokens) (f: closure0) (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:open_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global requires] ([@stop_split] [@expl:open 'self' type invariant] inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global self)
    /\ ([@stop_split] [@expl:open 'f' type invariant] inv_closure0 f)
    /\ ([@stop_split] [@expl:open requires #0] precondition_deref () self)
    /\ ([@stop_split] [@expl:open requires #1] forall this: t_NonAtomicInvariant_PA_T. postcondition_deref () self this
      -> precondition_open () { f0'7 = new_ref_NonAtomicInvariant_PA_T this; f1'7 = tokens; f2'7 = f })}
    any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:open ensures] exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self this
        /\ postcondition_open () { f0'7 = new_ref_NonAtomicInvariant_PA_T this; f1'7 = tokens; f2'7 = f } result}
      (! return {result}) ]
  
  function new_ref_Rc_NonAtomicInvariant_PA_T_Global (x: t_Rc_NonAtomicInvariant_PA_T_Global) : t_Rc_NonAtomicInvariant_PA_T_Global
  
  axiom new_ref_Rc_NonAtomicInvariant_PA_T_Global_spec:
    forall x: t_Rc_NonAtomicInvariant_PA_T_Global. new_ref_Rc_NonAtomicInvariant_PA_T_Global x = x
  
  predicate postcondition_once_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let {f0'6 = self'0; f1'6 = tokens; f2'6 = f} = args in exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      /\ postcondition_open () { f0'7 = new_ref_NonAtomicInvariant_PA_T this; f1'7 = tokens; f2'7 = f } result
  
  meta "rewrite_def" predicate postcondition_once_open'0
  
  predicate resolve_open'0 [@inline:trivial] (_1: ()) = true
  
  meta "rewrite_def" predicate resolve_open'0
  
  predicate postcondition_mut_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (result_state: ()) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let {f0'6 = self'0; f1'6 = tokens; f2'6 = f} = args in exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      /\ postcondition_open () { f0'7 = new_ref_NonAtomicInvariant_PA_T this; f1'7 = tokens; f2'7 = f } result
  
  meta "rewrite_def" predicate postcondition_mut_open'0
  
  function fn_mut_once_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom fn_mut_once_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_once_open'0 self args res
      = (exists res_state: (). postcondition_mut_open'0 self args res_state res /\ resolve_open'0 res_state)
  
  predicate hist_inv_open'0 [@inline:trivial] (self: ()) (result_state: ()) = true
  
  meta "rewrite_def" predicate hist_inv_open'0
  
  function hist_inv_trans_open'0 (self: ()) (b: ()) (c: ()) : ()
  
  axiom hist_inv_trans_open_spec'0: forall self: (), b: (), c: (). hist_inv_open'0 self b
      -> hist_inv_open'0 b c -> hist_inv_open'0 self c
  
  function hist_inv_refl_open'0 (self: ()) : ()
  
  axiom hist_inv_refl_open_spec'0: forall self: (). hist_inv_open'0 self self
  
  function postcondition_mut_hist_inv_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res_state: ()) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom postcondition_mut_hist_inv_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res_state: (), res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_mut_open'0 self args res_state res
      -> hist_inv_open'0 self res_state
  
  function fn_hist_inv_open'0 (self: ()) (res_state: ()) : ()
  
  axiom fn_hist_inv_open_spec'0: forall self: (), res_state: (). hist_inv_open'0 self res_state = (self = res_state)
  
  predicate postcondition_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) =
    let {f0'6 = self'0; f1'6 = tokens; f2'6 = f} = args in exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      /\ postcondition_open () { f0'7 = new_ref_NonAtomicInvariant_PA_T this; f1'7 = tokens; f2'7 = f } result
  
  meta "rewrite_def" predicate postcondition_open'0
  
  function fn_once_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom fn_once_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_once_open'0 self args res
      = (postcondition_open'0 self args res /\ resolve_open'0 self)
  
  function fn_mut_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res_state: ()) (res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom fn_mut_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res_state: (), res: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T. postcondition_mut_open'0 self args res_state res
      = (postcondition_open'0 self args res /\ self = res_state)
  
  let rec open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (tokens: t_Tokens) (f: closure0) (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) =
    {[@stop_split] [@expl:open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global requires] ([@stop_split] [@expl:open 'self' type invariant] inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global self)
    /\ ([@stop_split] [@expl:open 'f' type invariant] inv_closure0 f)
    /\ ([@stop_split] [@expl:open requires] precondition_open'0 () { f0'6 = new_ref_Rc_NonAtomicInvariant_PA_T_Global self;
                                                                     f1'6 = tokens;
                                                                     f2'6 = f })}
    any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) ->
    {[@stop_split] [@expl:open ensures] postcondition_open'0 () { f0'6 = new_ref_Rc_NonAtomicInvariant_PA_T_Global self;
                                                                  f1'6 = tokens;
                                                                  f2'6 = f } result}
      (! return {result}) ]
  
  let rec new_PermCell_Inner_T (value: t_PermCell_Inner_T) (return (x: t_Rc_PermCell_Inner_T_Global)) = any
    [ return (result: t_Rc_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:new_PermCell_Inner_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Rc_PermCell_Inner_T_Global result)
      /\ ([@stop_split] [@expl:new ensures] view_Rc_PermCell_Inner_T_Global result = value)}
      (! return {result}) ]
  
  let rec deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global self}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  let rec clone_Rc_NonAtomicInvariant_PA_T_Global (self_: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:clone 'self_' type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:clone_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:clone result type invariant] inv_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:clone ensures] result = self_)}
      (! return {result}) ]
  
  let rec new_Rc_NonAtomicInvariant_PA_T_Global (x: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x'0: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:new 'x' type invariant] inv_Rc_NonAtomicInvariant_PA_T_Global x}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:new_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec set_T (self: t_PersistentArray_T) (index: UInt64.t) (value: t_T) (tokens: t_Tokens)
    (return (x: t_PersistentArray_T)) =
    {[@stop_split] [@expl:set_T requires] ([@stop_split] [@expl:set 'self' type invariant] inv_ref_PersistentArray_T self)
    /\ ([@stop_split] [@expl:set 'value' type invariant] inv_T value)
    /\ ([@stop_split] [@expl:set requires #0] UInt64.t'int index < Seq.length (view_PersistentArray_T self))
    /\ ([@stop_split] [@expl:set requires #1] contains tokens (Namespace_PARRAY 0))}
    (! bb0
    [ bb0 = s0
      [ s0 = [ &new_ag <- { f0'0 = Seq.set (view_PersistentArray_T self) (UInt64.t'int index) value } ] s1
      | s1 = clone_Rc_PermCell_Inner_T_Global {self.permcell}
          (fun (_x: t_Rc_PermCell_Inner_T_Global) -> [ &_25 <- _x ] s2)
      | s2 = [ &_22 <- Link index value _25 ] s3
      | s3 = new_Inner_T {_22}
          (fun (_x: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global) -> [ &_21 <- _x ] s4)
      | s4 = [ &permcell'0 <- _21.f0'3 ] s5
      | s5 = [ &perm <- _21.f1'3 ] s6
      | s6 = [ &_30 <- { c0 = self; c1 = permcell'0; c2 = perm; c3 = new_ag } ] s7
      | s7 = open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global {self.inv} {tokens} {_30}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &frag'0 <- _x ] s8)
      | s8 = new_PermCell_Inner_T {permcell'0} (fun (_x: t_Rc_PermCell_Inner_T_Global) -> [ &_34 <- _x ] s9)
      | s9 = deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global {self.inv}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_40 <- _x ] s10)
      | s10 = clone_Rc_NonAtomicInvariant_PA_T_Global {_40}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_38 <- _x ] s11)
      | s11 = new_Rc_NonAtomicInvariant_PA_T_Global {_38}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_37 <- _x ] s12)
      | s12 = [ &_ret <- { permcell = _34; frag = frag'0; inv = _37 } ] s13
      | s13 = return {_ret} ] ]
    [ & _ret: t_PersistentArray_T = Any.any_l ()
    | & self: t_PersistentArray_T = self
    | & index: UInt64.t = index
    | & value: t_T = value
    | & tokens: t_Tokens = tokens
    | & new_ag: t_Ag_Seq_T = Any.any_l ()
    | & permcell'0: t_PermCell_Inner_T = Any.any_l ()
    | & perm: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _21: tup2_PermCell_Inner_T_Ghost_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _22: t_Inner_T = Any.any_l ()
    | & _25: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & frag'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _30: closure0 = Any.any_l ()
    | & _34: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _37: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & _38: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & _40: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l () ])
    [ return (result: t_PersistentArray_T) ->
    {[@stop_split] [@expl:set_T ensures] ([@stop_split] [@expl:set result type invariant] inv_PersistentArray_T result)
      /\ ([@stop_split] [@expl:set ensures] view_PersistentArray_T result
      = Seq.set (view_PersistentArray_T self) (UInt64.t'int index) value)}
      (! return {result}) ]
end
module M_implementation__impl_PersistentArray_T__get_immut (* implementation::PersistentArray<T> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use map.Map
  use set.Set
  use seq.Seq
  use creusot.int.UInt64
  use map.Const
  use creusot.prelude.Any
  use int.Int
  
  type t_Rc_NonAtomicInvariant_PA_T_Global
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = { f0: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  type t_PersistentArray_T = {
    permcell: t_Rc_PermCell_Inner_T_Global;
    frag: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T;
    inv: t_Rc_NonAtomicInvariant_PA_T_Global }
  
  predicate inv_Rc_NonAtomicInvariant_PA_T_Global (_1: t_Rc_NonAtomicInvariant_PA_T_Global)
  
  predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  let rec deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_Rc_NonAtomicInvariant_PA_T_Global)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global self}
    any
    [ return (result: t_Rc_NonAtomicInvariant_PA_T_Global) ->
    {[@stop_split] [@expl:deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  type t_NonAtomicInvariant_PA_T
  
  function view_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global) : t_NonAtomicInvariant_PA_T
  
  let rec deref_Rc_NonAtomicInvariant_PA_T_Global (self_: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_NonAtomicInvariant_PA_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_}
    any
    [ return (result: t_NonAtomicInvariant_PA_T) -> {[@stop_split] [@expl:deref ensures] result
      = view_Rc_NonAtomicInvariant_PA_T_Global self_}
      (! return {result}) ]
  
  type t_Tokens
  
  let rec deref_Ghost_ref_Tokens (self: t_Tokens) (return (x: t_Tokens)) = any
    [ return (result: t_Tokens) -> {[@stop_split] [@expl:deref ensures] result = self} (! return {result}) ]
  
  type t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PermCell_Inner_T
  
  type t_PA_T = {
    perms: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global;
    auth: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T;
    depth: Map.map t_PermCell_Inner_T int }
  
  predicate contains_Namespace [@inline:trivial] (self: Set.set t_Namespace) (e: t_Namespace) = Set.mem e self
  
  meta "rewrite_def" predicate contains_Namespace
  
  function namespaces (self: t_Tokens) : Set.set t_Namespace
  
  predicate contains (self: t_Tokens) (namespace: t_Namespace) = contains_Namespace (namespaces self) namespace
  
  function namespace_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Namespace
  
  predicate invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  predicate inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  axiom inv_axiom:
    forall x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x]. inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
      -> invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
  
  predicate inv_PA_T (_1: t_PA_T)
  
  axiom inv_axiom'0 [@rewrite]: forall x: t_PA_T [inv_PA_T x]. inv_PA_T x
      = inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x.auth
  
  predicate invariant_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_PA_T
  
  predicate inv_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_PA_T
  
  type t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_T
  
  type t_Ag_Seq_T = { f0'0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None | Some t_Ag_Seq_T
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  predicate contains_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) =
    get_PermCell_Inner_T self k <> None
  
  meta "rewrite_def" predicate contains_PermCell_Inner_T
  
  function view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Perm_PermCell_Inner_T
  
  type t_Option_Box_Perm_PermCell_Inner_T_Global = None'0 | Some'0 t_Perm_PermCell_Inner_T
  
  function to_mapping_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : Map.map t_PermCell_Inner_T t_Option_Box_Perm_PermCell_Inner_T_Global
  
  function get_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Option_Box_Perm_PermCell_Inner_T_Global
   = Map.get (to_mapping_Snapshot_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_Snapshot_PermCell_Inner_T
  
  predicate contains_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) =
    get_Snapshot_PermCell_Inner_T self k <> None'0
  
  meta "rewrite_def" predicate contains_Snapshot_PermCell_Inner_T
  
  function ward_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_PermCell_Inner_T
  
  predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool [@inline:trivial] (self: Map.map t_Perm_PermCell_Inner_T bool) (a: t_Perm_PermCell_Inner_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool
  
  function such_that_Box_Perm_PermCell_Inner_T_Global (p: Map.map t_Perm_PermCell_Inner_T bool) : t_Perm_PermCell_Inner_T
  
  axiom such_that_Box_Perm_PermCell_Inner_T_Global_spec:
    forall p: Map.map t_Perm_PermCell_Inner_T bool. (exists x: t_Perm_PermCell_Inner_T. index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p x)
      -> index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p (such_that_Box_Perm_PermCell_Inner_T_Global p)
  
  function unwrap_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) : t_Perm_PermCell_Inner_T
   = match self with
      | Some'0 x -> x
      | None'0 -> such_that_Box_Perm_PermCell_Inner_T_Global (fun (__0: t_Perm_PermCell_Inner_T) -> true)
      end
  
  function lookup_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = unwrap_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_Snapshot_PermCell_Inner_T
  
  function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = lookup_Snapshot_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Vec_T_Global
  
  type t_Inner_T = Direct t_Vec_T_Global | Link UInt64.t t_T t_Rc_PermCell_Inner_T_Global
  
  function val_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_Inner_T
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some x -> x
      | None -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function lookup_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Ag_Seq_T
   = unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_PermCell_Inner_T
  
  function index_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (key: t_PermCell_Inner_T) : t_Ag_Seq_T
   = lookup_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_PermCell_Inner_T_Ag_Seq_T
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_T_Global (self: t_Vec_T_Global) : Seq.seq t_T
  
  axiom view_Vec_T_Global_spec: forall self: t_Vec_T_Global. Seq.length (view_Vec_T_Global self)
      <= UInt64.t'int const_MAX
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  function index_Mapping_PermCell_Inner_T_Int [@inline:trivial] (self: Map.map t_PermCell_Inner_T int) (a: t_PermCell_Inner_T) : int
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_PermCell_Inner_T_Int
  
  predicate partial_invariant_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.auth = id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
        /\ contains_Snapshot_PermCell_Inner_T self.perms pc
      -> ward_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc)
        = pc
      /\ match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc) with
        | Direct v -> (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0'0
        = view_Vec_T_Global v
        | Link index value next -> contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)
        /\ index_Mapping_PermCell_Inner_T_Int self.depth pc
          > index_Mapping_PermCell_Inner_T_Int self.depth (view_Rc_PermCell_Inner_T_Global next)
        /\ UInt64.t'int index
          < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0'0
        /\ (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0'0
        = Seq.set (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0'0 (UInt64.t'int index) value
        end)
  
  meta "rewrite_def" predicate partial_invariant_T
  
  predicate protocol_PA_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    partial_invariant_T self id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
      = contains_Snapshot_PermCell_Inner_T self.perms pc)
  
  meta "rewrite_def" predicate protocol_PA_T
  
  function public_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Id
  
  let rec open_const_PA_T (self: t_NonAtomicInvariant_PA_T) (tokens: t_Tokens) (return (x: t_PA_T)) =
    {[@stop_split] [@expl:open_const requires] contains tokens (namespace_PA_T self)}
    any
    [ return (result: t_PA_T) ->
    {[@stop_split] [@expl:open_const_PA_T ensures] ([@stop_split] [@expl:open_const result type invariant] inv_ref_PA_T result)
      /\ ([@stop_split] [@expl:open_const ensures] protocol_PA_T result (public_PA_T self))}
      (! return {result}) ]
  
  predicate invariant_Ghost_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_ref_PA_T self
  
  meta "rewrite_def" predicate invariant_Ghost_ref_PA_T
  
  predicate inv_Ghost_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_Ghost_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_Ghost_ref_PA_T
  
  let rec new_ref_PA_T (x: t_PA_T) (return (x'0: t_PA_T)) =
    {[@stop_split] [@expl:new 'x' type invariant] inv_ref_PA_T x}
    any
    [ return (result: t_PA_T) ->
    {[@stop_split] [@expl:new_ref_PA_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_ref_PA_T result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  predicate invariant_ref_Ghost_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_Ghost_ref_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_ref_PA_T
  
  predicate inv_ref_Ghost_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_ref_Ghost_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_ref_PA_T
  
  predicate invariant_ref_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_ref_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_ref_PA_T
  
  predicate inv_ref_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_ref_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_ref_PA_T
  
  let rec deref_Ghost_ref_PA_T (self: t_PA_T) (return (x: t_PA_T)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_ref_PA_T self}
    any
    [ return (result: t_PA_T) ->
    {[@stop_split] [@expl:deref_Ghost_ref_PA_T ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_ref_PA_T result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  let rec deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:deref ensures] result = self}
      (! return {result}) ]
  
  predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T'0 (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id =
    id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0
  
  type t_Option_FMap_PermCell_Inner_T_Ag_Seq_T = None'1 | Some'1 t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_Option_Ag_Seq_T = None'2 | Some'2 t_Option_Ag_Seq_T
  
  type tup2_Option_Ag_Seq_T_Option_Ag_Seq_T = { f0'1: t_Option_Ag_Seq_T; f1'1: t_Option_Ag_Seq_T }
  
  function map_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (f: Map.map t_Ag_Seq_T t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T
   = match self with
      | None -> None'2
      | Some x -> Some'2 (Map.get f x)
      end
  
  function op_Ag_Seq_T (self: t_Ag_Seq_T) (other: t_Ag_Seq_T) : t_Option_Ag_Seq_T = if self.f0'0 = other.f0'0 then
      Some self
    else
      None
  
  
  function commutative_Ag_Seq_T (a: t_Ag_Seq_T) (b: t_Ag_Seq_T) : ()
  
  axiom commutative_Ag_Seq_T_spec: forall a: t_Ag_Seq_T, b: t_Ag_Seq_T. op_Ag_Seq_T a b = op_Ag_Seq_T b a
  
  function op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = other } with
      | {f0'1 = None} -> Some'2 other
      | {f1'1 = None} -> Some'2 self
      | {f0'1 = Some x; f1'1 = Some y} -> map_Option_Ag_Seq_T (op_Ag_Seq_T x y) (fun (z: t_Ag_Seq_T) -> Some z)
      end
  
  function commutative_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) : ()
  
  axiom commutative_Option_Ag_Seq_T_spec: forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
      = op_Option_Ag_Seq_T b a
  
  function total_op_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom total_op_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T. (forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
          <> None'2)
      -> (forall k: t_PermCell_Inner_T. Some'2 (get_PermCell_Inner_T (total_op_PermCell_Inner_T self other) k)
        = op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k))
  
  function op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   = if forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
      <> None'2 then
      Some'1 (total_op_PermCell_Inner_T self other)
    else
      None'1
  
  
  function commutative_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom commutative_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
      = op_FMap_PermCell_Inner_T_Ag_Seq_T b a
  
  function factor_Ag_Seq_T (self: t_Ag_Seq_T) (factor: t_Ag_Seq_T) : t_Option_Ag_Seq_T = op_Ag_Seq_T self factor
  
  axiom factor_Ag_Seq_T_spec: forall self: t_Ag_Seq_T, factor: t_Ag_Seq_T. match factor_Ag_Seq_T self factor with
        | Some c -> op_Ag_Seq_T factor c = Some self
        | None -> forall c: t_Ag_Seq_T. op_Ag_Seq_T factor c <> Some self
        end
  
  function factor_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (factor: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = factor } with
      | {f0'1 = x; f1'1 = None} -> Some'2 x
      | {f0'1 = None} -> None'2
      | {f0'1 = Some x; f1'1 = Some y} -> match factor_Ag_Seq_T x y with
        | Some z -> Some'2 (Some z)
        | None -> if x = y then Some'2 (None) else None'2
        end
      end
  
  axiom factor_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, factor: t_Option_Ag_Seq_T. match factor_Option_Ag_Seq_T self factor with
        | Some'2 c -> op_Option_Ag_Seq_T factor c = Some'2 self
        | None'2 -> forall c: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T factor c <> Some'2 self
        end
  
  predicate incl_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) =
    factor_Option_Ag_Seq_T other self <> None'2
  
  function incl_transitive_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) : ()
  
  axiom incl_transitive_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T. incl_Option_Ag_Seq_T a b
      -> incl_Option_Ag_Seq_T b c -> incl_Option_Ag_Seq_T a c
  
  function associative_some_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (ab: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_some_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, ab: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = Some'2 ab -> op_Option_Ag_Seq_T b c = Some'2 bc -> op_Option_Ag_Seq_T a bc = op_Option_Ag_Seq_T ab c
  
  function associative_none_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_none_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = None'2 -> op_Option_Ag_Seq_T b c = Some'2 bc -> op_Option_Ag_Seq_T a bc = None'2
  
  function incl_op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) (comb: t_Option_Ag_Seq_T) : ()
  
  axiom incl_op_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, other: t_Option_Ag_Seq_T, comb: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T self other
        = Some'2 comb -> incl_Option_Ag_Seq_T self comb
  
  type tup2_PermCell_Inner_T_Ag_Seq_T = { f0'2: t_PermCell_Inner_T; f1'2: t_Ag_Seq_T }
  
  function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T [@inline:trivial] (self: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) (a: tup2_PermCell_Inner_T_Ag_Seq_T) : t_Option_Ag_Seq_T
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T
  
  function filter_map_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom filter_map_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T. forall k: t_PermCell_Inner_T [get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k]. get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k
        = match get_PermCell_Inner_T self k with
          | None -> None
          | Some v -> index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T f { f0'2 = k; f1'2 = v }
          end
  
  function factor_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (factor: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    if forall k: t_PermCell_Inner_T. incl_Option_Ag_Seq_T (get_PermCell_Inner_T factor k) (get_PermCell_Inner_T self k) then
      let res = filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f0'2 = k; f1'2 = vo} = __0 in match factor_Option_Ag_Seq_T (Some vo) (get_PermCell_Inner_T factor k) with
        | Some'2 r -> r
        | None'2 -> None
        end) in Some'1 res
    else
      None'1
  
  
  axiom factor_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, factor: t_FMap_PermCell_Inner_T_Ag_Seq_T. match factor_FMap_PermCell_Inner_T_Ag_Seq_T self factor with
        | Some'1 c -> op_FMap_PermCell_Inner_T_Ag_Seq_T factor c = Some'1 self
        | None'1 -> forall c: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T factor c
          <> Some'1 self
        end
  
  predicate incl_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    factor_FMap_PermCell_Inner_T_Ag_Seq_T other self <> None'1
  
  function incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T. incl_FMap_PermCell_Inner_T_Ag_Seq_T a b
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T b c -> incl_FMap_PermCell_Inner_T_Ag_Seq_T a c
  
  function associative_some_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (ab: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_some_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, ab: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = Some'1 ab
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some'1 bc
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = op_FMap_PermCell_Inner_T_Ag_Seq_T ab c
  
  function associative_none_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_none_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = None'1 -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some'1 bc -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = None'1
  
  function incl_op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) (comb: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_op_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T, comb: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T self other
        = Some'1 comb -> incl_FMap_PermCell_Inner_T_Ag_Seq_T self comb
  
  type t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function len_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : int
  
  axiom len_PermCell_Inner_T_spec: forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. len_PermCell_Inner_T self >= 0
  
  constant empty_PermCell_Inner_T : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom empty_PermCell_Inner_T_spec: len_PermCell_Inner_T empty_PermCell_Inner_T = 0
  
  axiom empty_PermCell_Inner_T_spec'0: to_mapping_PermCell_Inner_T empty_PermCell_Inner_T = Const.const (None)
  
  constant unit_FMap_PermCell_Inner_T_Ag_Seq_T: t_FMap_PermCell_Inner_T_Ag_Seq_T = empty_PermCell_Inner_T
  
  axiom unit_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall x: t_FMap_PermCell_Inner_T_Ag_Seq_T [op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T]. op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T
      = Some'1 x
  
  predicate rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    match a with
      | Some'1 a'0 -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f a'0
      | None'1 -> true
      end
  
  function rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a unit_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (None'1) f
  
  function rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f1: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f2: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f1: t_FMap_PermCell_Inner_T_Ag_Seq_T, f2: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f1
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f2 f1 -> rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f2
  
  function auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self) (frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  function val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
   = val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0)
  
  let rec frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (frag'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) (return (x: ())) =
    {[@stop_split] [@expl:frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T requires] ([@stop_split] [@expl:frag_lemma 'self' type invariant] inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)
    /\ ([@stop_split] [@expl:frag_lemma requires] id_FMap_PermCell_Inner_T_Ag_Seq_T self
    = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0)}
    any
    [ return (result: ()) ->
    {[@stop_split] [@expl:frag_lemma ensures] incl_FMap_PermCell_Inner_T_Ag_Seq_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0) (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)}
      (! return {result}) ]
  
  let rec new_unit (x: ()) (return (x'0: ())) = any
    [ return (result: ()) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate invariant_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Rc_PermCell_Inner_T_Global) =
    invariant_ref_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_T (_1: t_T)
  
  predicate invariant_ref_T [@inline:trivial] (self: t_T) = inv_T self
  
  meta "rewrite_def" predicate invariant_ref_T
  
  predicate inv_ref_T [@inline:trivial] (_1: t_T) = invariant_ref_T _1
  
  meta "rewrite_def" predicate inv_ref_T
  
  let rec get_inner_immut_T (inner: t_Rc_PermCell_Inner_T_Global) (i: UInt64.t) (pa: t_PA_T) (return (x: t_T)) =
    {[@stop_split] [@expl:get_inner_immut_T requires] ([@stop_split] [@expl:get_inner_immut 'inner' type invariant] inv_ref_Rc_PermCell_Inner_T_Global inner)
    /\ ([@stop_split] [@expl:get_inner_immut 'pa' type invariant] inv_Ghost_ref_PA_T pa)
    /\ ([@stop_split] [@expl:get_inner_immut requires #0] exists p: t_Id. protocol_PA_T pa p)
    /\ ([@stop_split] [@expl:get_inner_immut requires #1] contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.auth) (view_Rc_PermCell_Inner_T_Global inner))
    /\ ([@stop_split] [@expl:get_inner_immut requires #2] UInt64.t'int i
    < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.auth) (view_Rc_PermCell_Inner_T_Global inner)).f0'0)}
    any
    [ return (result: t_T) ->
    {[@stop_split] [@expl:get_inner_immut_T ensures] ([@stop_split] [@expl:get_inner_immut result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:get_inner_immut ensures] result
      = Seq.get (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.auth) (view_Rc_PermCell_Inner_T_Global inner)).f0'0 (UInt64.t'int i))}
      (! return {result}) ]
  
  predicate invariant_PersistentArray_T (self: t_PersistentArray_T) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T'0 self.frag = public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv)
    /\ get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell)
      <> None
    /\ namespace_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) = Namespace_PARRAY 0
  
  predicate inv_PersistentArray_T (_1: t_PersistentArray_T)
  
  axiom inv_axiom'1 [@rewrite]: forall x: t_PersistentArray_T [inv_PersistentArray_T x]. inv_PersistentArray_T x
      = (invariant_PersistentArray_T x
      /\ inv_Rc_PermCell_Inner_T_Global x.permcell /\ inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global x.inv)
  
  predicate invariant_ref_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) = inv_PersistentArray_T self
  
  meta "rewrite_def" predicate invariant_ref_PersistentArray_T
  
  predicate inv_ref_PersistentArray_T [@inline:trivial] (_1: t_PersistentArray_T) = invariant_ref_PersistentArray_T _1
  
  meta "rewrite_def" predicate inv_ref_PersistentArray_T
  
  function view_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) : Seq.seq t_T =
    (unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell))).f0'0
  
  meta "rewrite_def" function view_PersistentArray_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec get_immut_T (self: t_PersistentArray_T) (index: UInt64.t) (tokens: t_Tokens) (return (x: t_T)) =
    {[@stop_split] [@expl:get_immut_T requires] ([@stop_split] [@expl:get_immut 'self' type invariant] inv_ref_PersistentArray_T self)
    /\ ([@stop_split] [@expl:get_immut requires #0] contains tokens (Namespace_PARRAY 0))
    /\ ([@stop_split] [@expl:get_immut requires #1] UInt64.t'int index < Seq.length (view_PersistentArray_T self))}
    (! bb0
    [ bb0 = s0
      [ s0 = deref_Ghost_Rc_NonAtomicInvariant_PA_T_Global {self.inv}
          (fun (_x: t_Rc_NonAtomicInvariant_PA_T_Global) -> [ &_17 <- _x ] s1)
      | s1 = deref_Rc_NonAtomicInvariant_PA_T_Global {_17} (fun (_x: t_NonAtomicInvariant_PA_T) -> [ &_15 <- _x ] s2)
      | s2 = deref_Ghost_ref_Tokens {tokens} (fun (_x: t_Tokens) -> [ &_20 <- _x ] s3)
      | s3 = open_const_PA_T {_15} {_20} (fun (_x: t_PA_T) -> [ &_13 <- _x ] s4)
      | s4 = new_ref_PA_T {_13} (fun (_x: t_PA_T) -> [ &pa <- _x ] s5)
      | s5 = deref_Ghost_ref_PA_T {pa} (fun (_x: t_PA_T) -> [ &_25 <- _x ] s6)
      | s6 = [ &_30 <- self.frag ] s7
      | s7 = deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {_30}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_28 <- _x ] s8)
      | s8 = frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T {_25.auth} {_28} (fun (_x: ()) -> [ &_23 <- _x ] s9)
      | s9 = new_unit {_23} (fun (_x: ()) -> [ &_22 <- _x ] s10)
      | s10 = [ &_33 <- self.permcell ] s11
      | s11 = get_inner_immut_T {_33} {index} {pa} (fun (_x: t_T) -> [ &_31 <- _x ] s12)
      | s12 = [ &_ret <- _31 ] s13
      | s13 = return {_ret} ] ]
    [ & _ret: t_T = Any.any_l ()
    | & self: t_PersistentArray_T = self
    | & index: UInt64.t = index
    | & tokens: t_Tokens = tokens
    | & pa: t_PA_T = Any.any_l ()
    | & _13: t_PA_T = Any.any_l ()
    | & _15: t_NonAtomicInvariant_PA_T = Any.any_l ()
    | & _17: t_Rc_NonAtomicInvariant_PA_T_Global = Any.any_l ()
    | & _20: t_Tokens = Any.any_l ()
    | & _22: () = Any.any_l ()
    | & _23: () = Any.any_l ()
    | & _25: t_PA_T = Any.any_l ()
    | & _28: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _30: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _31: t_T = Any.any_l ()
    | & _33: t_Rc_PermCell_Inner_T_Global = Any.any_l () ])
    [ return (result: t_T) ->
    {[@stop_split] [@expl:get_immut_T ensures] ([@stop_split] [@expl:get_immut result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:get_immut ensures] result = Seq.get (view_PersistentArray_T self) (UInt64.t'int index))}
      (! return {result}) ]
end
module M_implementation__impl_PersistentArray_T__get_inner_immut (* implementation::PersistentArray<T> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use map.Map
  use creusot.int.UInt64
  use seq.Seq
  use creusot.prelude.Any
  use int.Int
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_PermCell_Inner_T
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate invariant_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Rc_PermCell_Inner_T_Global) =
    invariant_ref_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_PermCell_Inner_T_Global
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  let rec deref_Rc_PermCell_Inner_T_Global (self_: t_Rc_PermCell_Inner_T_Global) (return (x: t_PermCell_Inner_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Rc_PermCell_Inner_T_Global self_}
    any
    [ return (result: t_PermCell_Inner_T) -> {[@stop_split] [@expl:deref ensures] result
      = view_Rc_PermCell_Inner_T_Global self_}
      (! return {result}) ]
  
  type t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PA_T = {
    perms: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global;
    auth: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T;
    depth: Map.map t_PermCell_Inner_T int }
  
  predicate invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  predicate inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  axiom inv_axiom:
    forall x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x]. inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
      -> invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
  
  predicate inv_PA_T (_1: t_PA_T)
  
  axiom inv_axiom'0 [@rewrite]: forall x: t_PA_T [inv_PA_T x]. inv_PA_T x
      = inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x.auth
  
  predicate invariant_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_PA_T
  
  predicate inv_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_PA_T
  
  predicate invariant_Ghost_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_ref_PA_T self
  
  meta "rewrite_def" predicate invariant_Ghost_ref_PA_T
  
  predicate inv_Ghost_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_Ghost_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_Ghost_ref_PA_T
  
  predicate invariant_ref_Ghost_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_Ghost_ref_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_ref_PA_T
  
  predicate inv_ref_Ghost_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_ref_Ghost_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_ref_PA_T
  
  predicate invariant_ref_ref_PA_T [@inline:trivial] (self: t_PA_T) = inv_ref_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_ref_PA_T
  
  predicate inv_ref_ref_PA_T [@inline:trivial] (_1: t_PA_T) = invariant_ref_ref_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_ref_PA_T
  
  let rec deref_Ghost_ref_PA_T (self: t_PA_T) (return (x: t_PA_T)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_ref_PA_T self}
    any
    [ return (result: t_PA_T) ->
    {[@stop_split] [@expl:deref_Ghost_ref_PA_T ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_ref_PA_T result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  type t_Perm_PermCell_Inner_T
  
  type t_Option_ref_Box_Perm_PermCell_Inner_T_Global = None | Some t_Perm_PermCell_Inner_T
  
  type t_Option_Box_Perm_PermCell_Inner_T_Global = None'0 | Some'0 t_Perm_PermCell_Inner_T
  
  function map_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) (f: Map.map t_Perm_PermCell_Inner_T t_Perm_PermCell_Inner_T) : t_Option_ref_Box_Perm_PermCell_Inner_T_Global
   = match self with
      | None'0 -> None
      | Some'0 x -> Some (Map.get f x)
      end
  
  function to_mapping_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : Map.map t_PermCell_Inner_T t_Option_Box_Perm_PermCell_Inner_T_Global
  
  function get_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Option_Box_Perm_PermCell_Inner_T_Global
   = Map.get (to_mapping_Snapshot_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_Snapshot_PermCell_Inner_T
  
  let rec get_ghost_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)
    (key: t_PermCell_Inner_T) (return (x: t_Option_ref_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_ref_Box_Perm_PermCell_Inner_T_Global) -> {[@stop_split] [@expl:get_ghost ensures] result
      = map_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self key) (fun (v: t_Perm_PermCell_Inner_T) -> v)}
      (! return {result}) ]
  
  let rec unwrap_ref_Box_Perm_PermCell_Inner_T_Global (self_: t_Option_ref_Box_Perm_PermCell_Inner_T_Global)
    (return (x: t_Perm_PermCell_Inner_T)) = {[@stop_split] [@expl:unwrap requires] self_ <> None}
    any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:unwrap ensures] Some result = self_}
      (! return {result}) ]
  
  let rec new_ref_Perm_PermCell_Inner_T (x: t_Perm_PermCell_Inner_T) (return (x'0: t_Perm_PermCell_Inner_T)) = any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  type t_Vec_T_Global
  
  type t_T
  
  type t_Inner_T = Direct t_Vec_T_Global | Link UInt64.t t_T t_Rc_PermCell_Inner_T_Global
  
  function ward_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_PermCell_Inner_T
  
  predicate inv_T (_1: t_T)
  
  predicate invariant_ref_T [@inline:trivial] (self: t_T) = inv_T self
  
  meta "rewrite_def" predicate invariant_ref_T
  
  predicate inv_ref_T [@inline:trivial] (_1: t_T) = invariant_ref_T _1
  
  meta "rewrite_def" predicate inv_ref_T
  
  predicate invariant_Seq_T [@inline:trivial] (self: Seq.seq t_T) =
    forall i: int. 0 <= i /\ i < Seq.length self -> inv_ref_T (Seq.get self i)
  
  meta "rewrite_def" predicate invariant_Seq_T
  
  predicate inv_Seq_T [@inline:trivial] (_1: Seq.seq t_T) = invariant_Seq_T _1
  
  meta "rewrite_def" predicate inv_Seq_T
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_T_Global (self: t_Vec_T_Global) : Seq.seq t_T
  
  axiom view_Vec_T_Global_spec: forall self: t_Vec_T_Global. Seq.length (view_Vec_T_Global self)
      <= UInt64.t'int const_MAX
  
  predicate invariant_Vec_T_Global (self: t_Vec_T_Global) = inv_Seq_T (view_Vec_T_Global self)
  
  predicate inv_Vec_T_Global (_1: t_Vec_T_Global)
  
  axiom inv_axiom'1: forall x: t_Vec_T_Global [inv_Vec_T_Global x]. inv_Vec_T_Global x -> invariant_Vec_T_Global x
  
  predicate inv_Inner_T (_1: t_Inner_T)
  
  axiom inv_axiom'2 [@rewrite]: forall x: t_Inner_T [inv_Inner_T x]. inv_Inner_T x
      = match x with
        | Direct f0 -> inv_Vec_T_Global f0
        | Link index value next -> inv_T value /\ inv_Rc_PermCell_Inner_T_Global next
        end
  
  predicate invariant_ref_Inner_T [@inline:trivial] (self: t_Inner_T) = inv_Inner_T self
  
  meta "rewrite_def" predicate invariant_ref_Inner_T
  
  predicate inv_ref_Inner_T [@inline:trivial] (_1: t_Inner_T) = invariant_ref_Inner_T _1
  
  meta "rewrite_def" predicate inv_ref_Inner_T
  
  function val_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_Inner_T
  
  function view_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    val_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Perm_PermCell_Inner_T
  
  let rec borrow_Inner_T (self: t_PermCell_Inner_T) (perm: t_Perm_PermCell_Inner_T) (return (x: t_Inner_T)) =
    {[@stop_split] [@expl:borrow requires] self = ward_PermCell_Inner_T perm}
    any
    [ return (result: t_Inner_T) ->
    {[@stop_split] [@expl:borrow_Inner_T ensures] ([@stop_split] [@expl:borrow result type invariant] inv_ref_Inner_T result)
      /\ ([@stop_split] [@expl:borrow ensures] result = view_Perm_PermCell_Inner_T perm)}
      (! return {result}) ]
  
  let rec elim_Link (_x: t_Inner_T) (return (index: UInt64.t) (value: t_T) (next: t_Rc_PermCell_Inner_T_Global)) = any
    [ _k (index: UInt64.t) (value: t_T) (next: t_Rc_PermCell_Inner_T_Global) -> {Link index value next = _x}
      (! return {index} {value} {next})
    | _chk -> (! {[@expl:elim Link] match _x with
        | Link _ _ _ -> true
        | _ -> false
        end}
      any) ]
  
  let rec elim_Direct (_x: t_Inner_T) (return (f0: t_Vec_T_Global)) = any
    [ _k (f0: t_Vec_T_Global) -> {Direct f0 = _x} (! return {f0})
    | _chk -> (! {[@expl:elim Direct] match _x with
        | Direct _ -> true
        | _ -> false
        end}
      any) ]
  
  predicate invariant_ref_Vec_T_Global [@inline:trivial] (self: t_Vec_T_Global) = inv_Vec_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Vec_T_Global
  
  predicate inv_ref_Vec_T_Global [@inline:trivial] (_1: t_Vec_T_Global) = invariant_ref_Vec_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Vec_T_Global
  
  predicate in_bounds_usize [@inline:trivial] (self: UInt64.t) (seq: Seq.seq t_T) = UInt64.t'int self < Seq.length seq
  
  meta "rewrite_def" predicate in_bounds_usize
  
  predicate has_value_usize [@inline:trivial] (self: UInt64.t) (seq: Seq.seq t_T) (out: t_T) =
    Seq.get seq (UInt64.t'int self) = out
  
  meta "rewrite_def" predicate has_value_usize
  
  let rec index_Vec_T_Global (self_: t_Vec_T_Global) (ix: UInt64.t) (return (x: t_T)) =
    {[@stop_split] [@expl:index_Vec_T_Global requires] ([@stop_split] [@expl:index 'self_' type invariant] inv_ref_Vec_T_Global self_)
    /\ ([@stop_split] [@expl:index requires] in_bounds_usize ix (view_Vec_T_Global self_))}
    any
    [ return (result: t_T) ->
    {[@stop_split] [@expl:index_Vec_T_Global ensures] ([@stop_split] [@expl:index result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:index ensures] has_value_usize ix (view_Vec_T_Global self_) result)}
      (! return {result}) ]
  
  type t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Ag_Seq_T = { f0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None'1 | Some'1 t_Ag_Seq_T
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  predicate contains_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) =
    get_PermCell_Inner_T self k <> None'1
  
  meta "rewrite_def" predicate contains_PermCell_Inner_T
  
  function view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate contains_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) =
    get_Snapshot_PermCell_Inner_T self k <> None'0
  
  meta "rewrite_def" predicate contains_Snapshot_PermCell_Inner_T
  
  predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool [@inline:trivial] (self: Map.map t_Perm_PermCell_Inner_T bool) (a: t_Perm_PermCell_Inner_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool
  
  function such_that_Box_Perm_PermCell_Inner_T_Global (p: Map.map t_Perm_PermCell_Inner_T bool) : t_Perm_PermCell_Inner_T
  
  axiom such_that_Box_Perm_PermCell_Inner_T_Global_spec:
    forall p: Map.map t_Perm_PermCell_Inner_T bool. (exists x: t_Perm_PermCell_Inner_T. index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p x)
      -> index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p (such_that_Box_Perm_PermCell_Inner_T_Global p)
  
  function unwrap_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) : t_Perm_PermCell_Inner_T
   = match self with
      | Some'0 x -> x
      | None'0 -> such_that_Box_Perm_PermCell_Inner_T_Global (fun (__0: t_Perm_PermCell_Inner_T) -> true)
      end
  
  function lookup_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = unwrap_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_Snapshot_PermCell_Inner_T
  
  function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = lookup_Snapshot_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some'1 x -> x
      | None'1 -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function lookup_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Ag_Seq_T
   = unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_PermCell_Inner_T
  
  function index_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (key: t_PermCell_Inner_T) : t_Ag_Seq_T
   = lookup_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function index_Mapping_PermCell_Inner_T_Int [@inline:trivial] (self: Map.map t_PermCell_Inner_T int) (a: t_PermCell_Inner_T) : int
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_PermCell_Inner_T_Int
  
  predicate partial_invariant_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.auth = id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
        /\ contains_Snapshot_PermCell_Inner_T self.perms pc
      -> ward_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc)
        = pc
      /\ match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc) with
        | Direct v -> (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0
        = view_Vec_T_Global v
        | Link index value next -> contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)
        /\ index_Mapping_PermCell_Inner_T_Int self.depth pc
          > index_Mapping_PermCell_Inner_T_Int self.depth (view_Rc_PermCell_Inner_T_Global next)
        /\ UInt64.t'int index
          < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0
        /\ (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0
        = Seq.set (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0 (UInt64.t'int index) value
        end)
  
  meta "rewrite_def" predicate partial_invariant_T
  
  predicate protocol_PA_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    partial_invariant_T self id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
      = contains_Snapshot_PermCell_Inner_T self.perms pc)
  
  meta "rewrite_def" predicate protocol_PA_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec get_inner_immut_T (inner: t_Rc_PermCell_Inner_T_Global) (i: UInt64.t) (pa: t_PA_T) (return (x: t_T)) =
    {[@stop_split] [@expl:get_inner_immut_T requires] ([@stop_split] [@expl:get_inner_immut 'inner' type invariant] inv_ref_Rc_PermCell_Inner_T_Global inner)
    /\ ([@stop_split] [@expl:get_inner_immut 'pa' type invariant] inv_Ghost_ref_PA_T pa)
    /\ ([@stop_split] [@expl:get_inner_immut requires #0] exists p: t_Id. protocol_PA_T pa p)
    /\ ([@stop_split] [@expl:get_inner_immut requires #1] contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.auth) (view_Rc_PermCell_Inner_T_Global inner))
    /\ ([@stop_split] [@expl:get_inner_immut requires #2] UInt64.t'int i
    < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.auth) (view_Rc_PermCell_Inner_T_Global inner)).f0)}
    (! bb0
    [ bb0 = s0
      [ s0 = deref_Rc_PermCell_Inner_T_Global {inner} (fun (_x: t_PermCell_Inner_T) -> [ &_20 <- _x ] s1)
      | s1 = deref_Ghost_ref_PA_T {pa} (fun (_x: t_PA_T) -> [ &_27 <- _x ] s2)
      | s2 = [ &_30 <- view_Rc_PermCell_Inner_T_Global inner ] s3
      | s3 = get_ghost_Snapshot_PermCell_Inner_T {_27.perms} {_30}
          (fun (_x: t_Option_ref_Box_Perm_PermCell_Inner_T_Global) -> [ &_25 <- _x ] s4)
      | s4 = unwrap_ref_Box_Perm_PermCell_Inner_T_Global {_25} (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_24 <- _x ] s5)
      | s5 = new_ref_Perm_PermCell_Inner_T {_24} (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_22 <- _x ] s6)
      | s6 = borrow_Inner_T {_20} {_22} (fun (_x: t_Inner_T) -> [ &_18 <- _x ] s7)
      | s7 = any
        [ br0 (x0: t_Vec_T_Global) -> {_18 = Direct x0} (! bb13)
        | br1 (x0: UInt64.t) (x1: t_T) (x2: t_Rc_PermCell_Inner_T_Global) -> {_18 = Link x0 x1 x2} (! bb12) ] ]
    | bb12 = s0
      [ s0 = elim_Link {_18}
          (fun (rindex: UInt64.t) (rvalue: t_T) (rnext: t_Rc_PermCell_Inner_T_Global) -> [ &index <- rindex ] s1)
      | s1 = [ &index'0 <- index ] s2
      | s2 = elim_Link {_18}
          (fun (rindex: UInt64.t) (rvalue: t_T) (rnext: t_Rc_PermCell_Inner_T_Global) -> [ &value <- rvalue ] s3)
      | s3 = [ &_46 <- i = index'0 ] s4
      | s4 = any [ br0 -> {_46 = false} (! bb11) | br1 -> {_46} (! bb15) ] ]
    | bb15 = s0 [ s0 = [ &_17 <- value ] s1 | s1 = bb18 ]
    | bb11 = s0
      [ s0 = elim_Link {_18}
          (fun (rindex: UInt64.t) (rvalue: t_T) (rnext: t_Rc_PermCell_Inner_T_Global) -> [ &next <- rnext ] s1)
      | s1 = get_inner_immut_T {next} {i} {pa} (fun (_x: t_T) -> [ &_51 <- _x ] s2)
      | s2 = [ &_50 <- _51 ] s3
      | s3 = [ &_17 <- _50 ] s4
      | s4 = bb18 ]
    | bb13 = s0
      [ s0 = elim_Direct {_18} (fun (r0: t_Vec_T_Global) -> [ &v <- r0 ] s1)
      | s1 = index_Vec_T_Global {v} {i} (fun (_x: t_T) -> [ &_39 <- _x ] s2)
      | s2 = [ &_38 <- _39 ] s3
      | s3 = [ &_17 <- _38 ] s4
      | s4 = bb18 ]
    | bb18 = s0 [ s0 = [ &_ret <- _17 ] s1 | s1 = return {_ret} ] ]
    [ & _ret: t_T = Any.any_l ()
    | & inner: t_Rc_PermCell_Inner_T_Global = inner
    | & i: UInt64.t = i
    | & pa: t_PA_T = pa
    | & _17: t_T = Any.any_l ()
    | & _18: t_Inner_T = Any.any_l ()
    | & _20: t_PermCell_Inner_T = Any.any_l ()
    | & _22: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _24: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _25: t_Option_ref_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _27: t_PA_T = Any.any_l ()
    | & _30: t_PermCell_Inner_T = Any.any_l ()
    | & v: t_Vec_T_Global = Any.any_l ()
    | & _38: t_T = Any.any_l ()
    | & _39: t_T = Any.any_l ()
    | & index: UInt64.t = Any.any_l ()
    | & index'0: UInt64.t = Any.any_l ()
    | & value: t_T = Any.any_l ()
    | & _46: bool = Any.any_l ()
    | & next: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _50: t_T = Any.any_l ()
    | & _51: t_T = Any.any_l () ])
    [ return (result: t_T) ->
    {[@stop_split] [@expl:get_inner_immut_T ensures] ([@stop_split] [@expl:get_inner_immut result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:get_inner_immut ensures] result
      = Seq.get (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.auth) (view_Rc_PermCell_Inner_T_Global inner)).f0 (UInt64.t'int i))}
      (! return {result}) ]
end
module M_implementation__impl_PersistentArray_T__get (* implementation::PersistentArray<T> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use creusot.prelude.MutBorrow
  use map.Map
  use creusot.int.UInt64
  use seq.Seq
  use map.Const
  use creusot.slice.Slice64
  use creusot.prelude.Any
  use set.Set
  use int.Int
  
  type t_NonAtomicInvariant_PA_T
  
  type t_Id
  
  function public_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Id
  
  type t_Rc_NonAtomicInvariant_PA_T_Global
  
  function view_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global) : t_NonAtomicInvariant_PA_T
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = { f0: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  type t_PersistentArray_T = {
    permcell: t_Rc_PermCell_Inner_T_Global;
    frag: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T;
    inv: t_Rc_NonAtomicInvariant_PA_T_Global }
  
  type t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PermCell_Inner_T
  
  type t_PA_T = {
    perms: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global;
    auth: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T;
    depth: Map.map t_PermCell_Inner_T int }
  
  predicate invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  predicate inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  axiom inv_axiom:
    forall x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x]. inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
      -> invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
  
  predicate inv_PA_T (_1: t_PA_T)
  
  axiom inv_axiom'0 [@rewrite]: forall x: t_PA_T [inv_PA_T x]. inv_PA_T x
      = inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x.auth
  
  predicate invariant_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) =
    inv_PA_T self.current /\ inv_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_PA_T
  
  predicate inv_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_PA_T
  
  predicate invariant_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_Ghost_refmut_PA_T
  
  predicate inv_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_Ghost_refmut_PA_T
  
  predicate invariant_ref_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_Ghost_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_refmut_PA_T
  
  predicate inv_ref_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_ref_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_refmut_PA_T
  
  predicate invariant_ref_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_ref_refmut_PA_T
  
  predicate inv_ref_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_ref_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_ref_refmut_PA_T
  
  let rec deref_Ghost_refmut_PA_T (self: MutBorrow.t t_PA_T) (return (x: MutBorrow.t t_PA_T)) =
    {[@stop_split] [@expl:deref 'self' type invariant] inv_ref_Ghost_refmut_PA_T self}
    any
    [ return (result: MutBorrow.t t_PA_T) ->
    {[@stop_split] [@expl:deref_Ghost_refmut_PA_T ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_refmut_PA_T result)
      /\ ([@stop_split] [@expl:deref ensures] result = self)}
      (! return {result}) ]
  
  type closure0 = { c0: t_PersistentArray_T; c1: t_Id; c2: UInt64.t }
  
  let rec deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)
    (return (x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T)) = any
    [ return (result: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> {[@stop_split] [@expl:deref ensures] result = self}
      (! return {result}) ]
  
  predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" predicate invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) =
    invariant_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T _1
  
  meta "rewrite_def" predicate inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T'0 (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id =
    id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_FMap_PermCell_Inner_T_Ag_Seq_T = None | Some t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_T
  
  type t_Ag_Seq_T = { f0'0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None'0 | Some'0 t_Ag_Seq_T
  
  type t_Option_Option_Ag_Seq_T = None'1 | Some'1 t_Option_Ag_Seq_T
  
  type tup2_Option_Ag_Seq_T_Option_Ag_Seq_T = { f0'1: t_Option_Ag_Seq_T; f1'1: t_Option_Ag_Seq_T }
  
  function map_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (f: Map.map t_Ag_Seq_T t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T
   = match self with
      | None'0 -> None'1
      | Some'0 x -> Some'1 (Map.get f x)
      end
  
  function op_Ag_Seq_T (self: t_Ag_Seq_T) (other: t_Ag_Seq_T) : t_Option_Ag_Seq_T = if self.f0'0 = other.f0'0 then
      Some'0 self
    else
      None'0
  
  
  function commutative_Ag_Seq_T (a: t_Ag_Seq_T) (b: t_Ag_Seq_T) : ()
  
  axiom commutative_Ag_Seq_T_spec: forall a: t_Ag_Seq_T, b: t_Ag_Seq_T. op_Ag_Seq_T a b = op_Ag_Seq_T b a
  
  function op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = other } with
      | {f0'1 = None'0} -> Some'1 other
      | {f1'1 = None'0} -> Some'1 self
      | {f0'1 = Some'0 x; f1'1 = Some'0 y} -> map_Option_Ag_Seq_T (op_Ag_Seq_T x y) (fun (z: t_Ag_Seq_T) -> Some'0 z)
      end
  
  function commutative_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) : ()
  
  axiom commutative_Option_Ag_Seq_T_spec: forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
      = op_Option_Ag_Seq_T b a
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  function total_op_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom total_op_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T. (forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
          <> None'1)
      -> (forall k: t_PermCell_Inner_T. Some'1 (get_PermCell_Inner_T (total_op_PermCell_Inner_T self other) k)
        = op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k))
  
  function op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   = if forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
      <> None'1 then
      Some (total_op_PermCell_Inner_T self other)
    else
      None
  
  
  function commutative_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom commutative_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
      = op_FMap_PermCell_Inner_T_Ag_Seq_T b a
  
  function factor_Ag_Seq_T (self: t_Ag_Seq_T) (factor: t_Ag_Seq_T) : t_Option_Ag_Seq_T = op_Ag_Seq_T self factor
  
  axiom factor_Ag_Seq_T_spec: forall self: t_Ag_Seq_T, factor: t_Ag_Seq_T. match factor_Ag_Seq_T self factor with
        | Some'0 c -> op_Ag_Seq_T factor c = Some'0 self
        | None'0 -> forall c: t_Ag_Seq_T. op_Ag_Seq_T factor c <> Some'0 self
        end
  
  function factor_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (factor: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = factor } with
      | {f0'1 = x; f1'1 = None'0} -> Some'1 x
      | {f0'1 = None'0} -> None'1
      | {f0'1 = Some'0 x; f1'1 = Some'0 y} -> match factor_Ag_Seq_T x y with
        | Some'0 z -> Some'1 (Some'0 z)
        | None'0 -> if x = y then Some'1 (None'0) else None'1
        end
      end
  
  axiom factor_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, factor: t_Option_Ag_Seq_T. match factor_Option_Ag_Seq_T self factor with
        | Some'1 c -> op_Option_Ag_Seq_T factor c = Some'1 self
        | None'1 -> forall c: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T factor c <> Some'1 self
        end
  
  predicate incl_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) =
    factor_Option_Ag_Seq_T other self <> None'1
  
  function incl_transitive_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) : ()
  
  axiom incl_transitive_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T. incl_Option_Ag_Seq_T a b
      -> incl_Option_Ag_Seq_T b c -> incl_Option_Ag_Seq_T a c
  
  function associative_some_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (ab: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_some_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, ab: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = Some'1 ab -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = op_Option_Ag_Seq_T ab c
  
  function associative_none_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_none_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = None'1 -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = None'1
  
  function incl_op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) (comb: t_Option_Ag_Seq_T) : ()
  
  axiom incl_op_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, other: t_Option_Ag_Seq_T, comb: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T self other
        = Some'1 comb -> incl_Option_Ag_Seq_T self comb
  
  type tup2_PermCell_Inner_T_Ag_Seq_T = { f0'2: t_PermCell_Inner_T; f1'2: t_Ag_Seq_T }
  
  function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T [@inline:trivial] (self: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) (a: tup2_PermCell_Inner_T_Ag_Seq_T) : t_Option_Ag_Seq_T
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T
  
  function filter_map_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom filter_map_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T. forall k: t_PermCell_Inner_T [get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k]. get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k
        = match get_PermCell_Inner_T self k with
          | None'0 -> None'0
          | Some'0 v -> index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T f { f0'2 = k; f1'2 = v }
          end
  
  function factor_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (factor: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    if forall k: t_PermCell_Inner_T. incl_Option_Ag_Seq_T (get_PermCell_Inner_T factor k) (get_PermCell_Inner_T self k) then
      let res = filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f0'2 = k; f1'2 = vo} = __0 in match factor_Option_Ag_Seq_T (Some'0 vo) (get_PermCell_Inner_T factor k) with
        | Some'1 r -> r
        | None'1 -> None'0
        end) in Some res
    else
      None
  
  
  axiom factor_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, factor: t_FMap_PermCell_Inner_T_Ag_Seq_T. match factor_FMap_PermCell_Inner_T_Ag_Seq_T self factor with
        | Some c -> op_FMap_PermCell_Inner_T_Ag_Seq_T factor c = Some self
        | None -> forall c: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T factor c <> Some self
        end
  
  predicate incl_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    factor_FMap_PermCell_Inner_T_Ag_Seq_T other self <> None
  
  function incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T. incl_FMap_PermCell_Inner_T_Ag_Seq_T a b
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T b c -> incl_FMap_PermCell_Inner_T_Ag_Seq_T a c
  
  function associative_some_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (ab: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_some_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, ab: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = Some ab
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some bc
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = op_FMap_PermCell_Inner_T_Ag_Seq_T ab c
  
  function associative_none_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_none_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = None -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some bc -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = None
  
  function incl_op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) (comb: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_op_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T, comb: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T self other
        = Some comb -> incl_FMap_PermCell_Inner_T_Ag_Seq_T self comb
  
  type t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function len_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : int
  
  axiom len_PermCell_Inner_T_spec: forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. len_PermCell_Inner_T self >= 0
  
  constant empty_PermCell_Inner_T : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom empty_PermCell_Inner_T_spec: len_PermCell_Inner_T empty_PermCell_Inner_T = 0
  
  axiom empty_PermCell_Inner_T_spec'0: to_mapping_PermCell_Inner_T empty_PermCell_Inner_T = Const.const (None'0)
  
  constant unit_FMap_PermCell_Inner_T_Ag_Seq_T: t_FMap_PermCell_Inner_T_Ag_Seq_T = empty_PermCell_Inner_T
  
  axiom unit_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall x: t_FMap_PermCell_Inner_T_Ag_Seq_T [op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T]. op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T
      = Some x
  
  predicate rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    match a with
      | Some a'0 -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f a'0
      | None -> true
      end
  
  function rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a unit_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (None) f
  
  function rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f1: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f2: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f1: t_FMap_PermCell_Inner_T_Ag_Seq_T, f2: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f1
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f2 f1 -> rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f2
  
  function auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self) (frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  function val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
   = val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0)
  
  function view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  let rec frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
    (frag'0: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) (return (x: ())) =
    {[@stop_split] [@expl:frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T requires] ([@stop_split] [@expl:frag_lemma 'self' type invariant] inv_ref_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)
    /\ ([@stop_split] [@expl:frag_lemma requires] id_FMap_PermCell_Inner_T_Ag_Seq_T self
    = id_FMap_PermCell_Inner_T_Ag_Seq_T'0 frag'0)}
    any
    [ return (result: ()) ->
    {[@stop_split] [@expl:frag_lemma ensures] incl_FMap_PermCell_Inner_T_Ag_Seq_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T frag'0) (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self)}
      (! return {result}) ]
  
  let rec new_unit (x: ()) (return (x'0: ())) = any
    [ return (result: ()) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  predicate invariant_refmut_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t (MutBorrow.t t_PA_T)) =
    inv_Ghost_refmut_PA_T self.current /\ inv_Ghost_refmut_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Ghost_refmut_PA_T
  
  predicate inv_refmut_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) =
    invariant_refmut_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_Ghost_refmut_PA_T
  
  predicate invariant_refmut_refmut_PA_T [@inline:trivial] (self: MutBorrow.t (MutBorrow.t t_PA_T)) =
    inv_refmut_PA_T self.current /\ inv_refmut_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_refmut_PA_T
  
  predicate inv_refmut_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) =
    invariant_refmut_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_refmut_PA_T
  
  let rec deref_mut_Ghost_refmut_PA_T (self: MutBorrow.t (MutBorrow.t t_PA_T))
    (return (x: MutBorrow.t (MutBorrow.t t_PA_T))) =
    {[@stop_split] [@expl:deref_mut 'self' type invariant] inv_refmut_Ghost_refmut_PA_T self}
    any
    [ return (result: MutBorrow.t (MutBorrow.t t_PA_T)) ->
    {[@stop_split] [@expl:deref_mut_Ghost_refmut_PA_T ensures] ([@stop_split] [@expl:deref_mut result type invariant] inv_refmut_refmut_PA_T result)
      /\ ([@stop_split] [@expl:deref_mut ensures] result = self)}
      (! return {result}) ]
  
  predicate resolve_refmut_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_refmut_PA_T
  
  predicate resolve_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_PA_T
  
  let rec new_refmut_PA_T (x: MutBorrow.t t_PA_T) (return (x'0: MutBorrow.t t_PA_T)) =
    {[@stop_split] [@expl:new 'x' type invariant] inv_refmut_PA_T x}
    any
    [ return (result: MutBorrow.t t_PA_T) ->
    {[@stop_split] [@expl:new_refmut_PA_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_refmut_PA_T result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate invariant_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Rc_PermCell_Inner_T_Global) =
    invariant_ref_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_PermCell_Inner_T_Global
  
  predicate contains_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) =
    get_PermCell_Inner_T self k <> None'0
  
  meta "rewrite_def" predicate contains_PermCell_Inner_T
  
  type t_Perm_PermCell_Inner_T
  
  type t_Option_Box_Perm_PermCell_Inner_T_Global = None'2 | Some'2 t_Perm_PermCell_Inner_T
  
  function to_mapping_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : Map.map t_PermCell_Inner_T t_Option_Box_Perm_PermCell_Inner_T_Global
  
  function get_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Option_Box_Perm_PermCell_Inner_T_Global
   = Map.get (to_mapping_Snapshot_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_Snapshot_PermCell_Inner_T
  
  predicate contains_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) =
    get_Snapshot_PermCell_Inner_T self k <> None'2
  
  meta "rewrite_def" predicate contains_Snapshot_PermCell_Inner_T
  
  function ward_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_PermCell_Inner_T
  
  predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool [@inline:trivial] (self: Map.map t_Perm_PermCell_Inner_T bool) (a: t_Perm_PermCell_Inner_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool
  
  function such_that_Box_Perm_PermCell_Inner_T_Global (p: Map.map t_Perm_PermCell_Inner_T bool) : t_Perm_PermCell_Inner_T
  
  axiom such_that_Box_Perm_PermCell_Inner_T_Global_spec:
    forall p: Map.map t_Perm_PermCell_Inner_T bool. (exists x: t_Perm_PermCell_Inner_T. index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p x)
      -> index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p (such_that_Box_Perm_PermCell_Inner_T_Global p)
  
  function unwrap_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) : t_Perm_PermCell_Inner_T
   = match self with
      | Some'2 x -> x
      | None'2 -> such_that_Box_Perm_PermCell_Inner_T_Global (fun (__0: t_Perm_PermCell_Inner_T) -> true)
      end
  
  function lookup_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = unwrap_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_Snapshot_PermCell_Inner_T
  
  function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = lookup_Snapshot_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Vec_T_Global
  
  type t_Inner_T = Direct t_Vec_T_Global | Link UInt64.t t_T t_Rc_PermCell_Inner_T_Global
  
  function val_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_Inner_T
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some'0 x -> x
      | None'0 -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function lookup_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Ag_Seq_T
   = unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_PermCell_Inner_T
  
  function index_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (key: t_PermCell_Inner_T) : t_Ag_Seq_T
   = lookup_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_PermCell_Inner_T_Ag_Seq_T
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_T_Global (self: t_Vec_T_Global) : Seq.seq t_T
  
  axiom view_Vec_T_Global_spec: forall self: t_Vec_T_Global. Seq.length (view_Vec_T_Global self)
      <= UInt64.t'int const_MAX
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  function index_Mapping_PermCell_Inner_T_Int [@inline:trivial] (self: Map.map t_PermCell_Inner_T int) (a: t_PermCell_Inner_T) : int
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_PermCell_Inner_T_Int
  
  predicate partial_invariant_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.auth = id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
        /\ contains_Snapshot_PermCell_Inner_T self.perms pc
      -> ward_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc)
        = pc
      /\ match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc) with
        | Direct v -> (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0'0
        = view_Vec_T_Global v
        | Link index value next -> contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)
        /\ index_Mapping_PermCell_Inner_T_Int self.depth pc
          > index_Mapping_PermCell_Inner_T_Int self.depth (view_Rc_PermCell_Inner_T_Global next)
        /\ UInt64.t'int index
          < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0'0
        /\ (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0'0
        = Seq.set (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0'0 (UInt64.t'int index) value
        end)
  
  meta "rewrite_def" predicate partial_invariant_T
  
  function fin_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) : t_PA_T = self.final
  
  meta "rewrite_def" function fin_Ghost_refmut_PA_T
  
  let rec reroot_T (cur: t_Rc_PermCell_Inner_T_Global) (auth_id: t_Id) (pa: MutBorrow.t t_PA_T) (return (x: ())) =
    {[@stop_split] [@expl:reroot_T requires] ([@stop_split] [@expl:reroot 'cur' type invariant] inv_ref_Rc_PermCell_Inner_T_Global cur)
    /\ ([@stop_split] [@expl:reroot 'pa' type invariant] inv_Ghost_refmut_PA_T pa)
    /\ ([@stop_split] [@expl:reroot requires #0] partial_invariant_T pa.current auth_id)
    /\ ([@stop_split] [@expl:reroot requires #1] contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.current.auth) (view_Rc_PermCell_Inner_T_Global cur))
    /\ ([@stop_split] [@expl:reroot requires #2] forall id: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.current.auth) id
        /\ index_Mapping_PermCell_Inner_T_Int pa.current.depth id
        <= index_Mapping_PermCell_Inner_T_Int pa.current.depth (view_Rc_PermCell_Inner_T_Global cur)
      -> contains_Snapshot_PermCell_Inner_T pa.current.perms id)}
    any
    [ return (result: ()) ->
    {[@stop_split] [@expl:reroot_T ensures] ([@stop_split] [@expl:reroot ensures #0] partial_invariant_T (fin_Ghost_refmut_PA_T pa) auth_id)
      /\ ([@stop_split] [@expl:reroot ensures #1] (fin_Ghost_refmut_PA_T pa).auth = pa.current.auth)
      /\ ([@stop_split] [@expl:reroot ensures #2] forall id: t_PermCell_Inner_T. index_Mapping_PermCell_Inner_T_Int pa.current.depth id
            > index_Mapping_PermCell_Inner_T_Int pa.current.depth (view_Rc_PermCell_Inner_T_Global cur)
          -> get_Snapshot_PermCell_Inner_T pa.current.perms id
            = get_Snapshot_PermCell_Inner_T (fin_Ghost_refmut_PA_T pa).perms id
          /\ index_Mapping_PermCell_Inner_T_Int pa.current.depth id
          = index_Mapping_PermCell_Inner_T_Int (fin_Ghost_refmut_PA_T pa).depth id)
      /\ ([@stop_split] [@expl:reroot ensures #3] forall id: t_PermCell_Inner_T. contains_Snapshot_PermCell_Inner_T (fin_Ghost_refmut_PA_T pa).perms id
          = contains_Snapshot_PermCell_Inner_T pa.current.perms id)
      /\ ([@stop_split] [@expl:reroot ensures #4] match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global (fin_Ghost_refmut_PA_T pa).perms (view_Rc_PermCell_Inner_T_Global cur)) with
        | Direct _ -> true
        | Link _ _ _ -> false
        end)}
      (! return {result}) ]
  
  let rec into_inner_refmut_PA_T (self: MutBorrow.t t_PA_T) (return (x: MutBorrow.t t_PA_T)) =
    {[@stop_split] [@expl:into_inner 'self' type invariant] inv_Ghost_refmut_PA_T self}
    any
    [ return (result: MutBorrow.t t_PA_T) ->
    {[@stop_split] [@expl:into_inner_refmut_PA_T ensures] ([@stop_split] [@expl:into_inner result type invariant] inv_refmut_PA_T result)
      /\ ([@stop_split] [@expl:into_inner ensures] result = self)}
      (! return {result}) ]
  
  type t_Option_ref_Box_Perm_PermCell_Inner_T_Global = None'3 | Some'3 t_Perm_PermCell_Inner_T
  
  function map_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) (f: Map.map t_Perm_PermCell_Inner_T t_Perm_PermCell_Inner_T) : t_Option_ref_Box_Perm_PermCell_Inner_T_Global
   = match self with
      | None'2 -> None'3
      | Some'2 x -> Some'3 (Map.get f x)
      end
  
  let rec get_ghost_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global)
    (key: t_PermCell_Inner_T) (return (x: t_Option_ref_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_ref_Box_Perm_PermCell_Inner_T_Global) -> {[@stop_split] [@expl:get_ghost ensures] result
      = map_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self key) (fun (v: t_Perm_PermCell_Inner_T) -> v)}
      (! return {result}) ]
  
  let rec unwrap_ref_Box_Perm_PermCell_Inner_T_Global (self_: t_Option_ref_Box_Perm_PermCell_Inner_T_Global)
    (return (x: t_Perm_PermCell_Inner_T)) = {[@stop_split] [@expl:unwrap requires] self_ <> None'3}
    any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:unwrap ensures] Some'3 result = self_}
      (! return {result}) ]
  
  let rec new_ref_Perm_PermCell_Inner_T (x: t_Perm_PermCell_Inner_T) (return (x'0: t_Perm_PermCell_Inner_T)) = any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  let rec deref_Rc_PermCell_Inner_T_Global (self_: t_Rc_PermCell_Inner_T_Global) (return (x: t_PermCell_Inner_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Rc_PermCell_Inner_T_Global self_}
    any
    [ return (result: t_PermCell_Inner_T) -> {[@stop_split] [@expl:deref ensures] result
      = view_Rc_PermCell_Inner_T_Global self_}
      (! return {result}) ]
  
  predicate inv_T (_1: t_T)
  
  predicate invariant_ref_T [@inline:trivial] (self: t_T) = inv_T self
  
  meta "rewrite_def" predicate invariant_ref_T
  
  predicate inv_ref_T [@inline:trivial] (_1: t_T) = invariant_ref_T _1
  
  meta "rewrite_def" predicate inv_ref_T
  
  predicate invariant_Seq_T [@inline:trivial] (self: Seq.seq t_T) =
    forall i: int. 0 <= i /\ i < Seq.length self -> inv_ref_T (Seq.get self i)
  
  meta "rewrite_def" predicate invariant_Seq_T
  
  predicate inv_Seq_T [@inline:trivial] (_1: Seq.seq t_T) = invariant_Seq_T _1
  
  meta "rewrite_def" predicate inv_Seq_T
  
  predicate invariant_Vec_T_Global (self: t_Vec_T_Global) = inv_Seq_T (view_Vec_T_Global self)
  
  predicate inv_Vec_T_Global (_1: t_Vec_T_Global)
  
  axiom inv_axiom'1: forall x: t_Vec_T_Global [inv_Vec_T_Global x]. inv_Vec_T_Global x -> invariant_Vec_T_Global x
  
  predicate inv_Inner_T (_1: t_Inner_T)
  
  axiom inv_axiom'2 [@rewrite]: forall x: t_Inner_T [inv_Inner_T x]. inv_Inner_T x
      = match x with
        | Direct f0'3 -> inv_Vec_T_Global f0'3
        | Link index value next -> inv_T value /\ inv_Rc_PermCell_Inner_T_Global next
        end
  
  predicate invariant_ref_Inner_T [@inline:trivial] (self: t_Inner_T) = inv_Inner_T self
  
  meta "rewrite_def" predicate invariant_ref_Inner_T
  
  predicate inv_ref_Inner_T [@inline:trivial] (_1: t_Inner_T) = invariant_ref_Inner_T _1
  
  meta "rewrite_def" predicate inv_ref_Inner_T
  
  function view_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    val_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Perm_PermCell_Inner_T
  
  let rec borrow_Inner_T (self: t_PermCell_Inner_T) (perm: t_Perm_PermCell_Inner_T) (return (x: t_Inner_T)) =
    {[@stop_split] [@expl:borrow requires] self = ward_PermCell_Inner_T perm}
    any
    [ return (result: t_Inner_T) ->
    {[@stop_split] [@expl:borrow_Inner_T ensures] ([@stop_split] [@expl:borrow result type invariant] inv_ref_Inner_T result)
      /\ ([@stop_split] [@expl:borrow ensures] result = view_Perm_PermCell_Inner_T perm)}
      (! return {result}) ]
  
  let rec elim_Direct (_x: t_Inner_T) (return (f0'3: t_Vec_T_Global)) = any
    [ _k (f0'3: t_Vec_T_Global) -> {Direct f0'3 = _x} (! return {f0'3})
    | _chk -> (! {[@expl:elim Direct] match _x with
        | Direct _ -> true
        | _ -> false
        end}
      any) ]
  
  predicate invariant_ref_Vec_T_Global [@inline:trivial] (self: t_Vec_T_Global) = inv_Vec_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Vec_T_Global
  
  predicate inv_ref_Vec_T_Global [@inline:trivial] (_1: t_Vec_T_Global) = invariant_ref_Vec_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Vec_T_Global
  
  predicate invariant_slice_T (self: Slice64.slice t_T) = inv_Seq_T (Slice64.view self)
  
  predicate inv_slice_T [@inline:trivial] (_1: Slice64.slice t_T) = invariant_slice_T _1
  
  meta "rewrite_def" predicate inv_slice_T
  
  predicate invariant_ref_slice_T [@inline:trivial] (self: Slice64.slice t_T) = inv_slice_T self
  
  meta "rewrite_def" predicate invariant_ref_slice_T
  
  predicate inv_ref_slice_T [@inline:trivial] (_1: Slice64.slice t_T) = invariant_ref_slice_T _1
  
  meta "rewrite_def" predicate inv_ref_slice_T
  
  let rec deref_Vec_T_Global (self_: t_Vec_T_Global) (return (x: Slice64.slice t_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Vec_T_Global self_}
    any
    [ return (result: Slice64.slice t_T) ->
    {[@stop_split] [@expl:deref_Vec_T_Global ensures] ([@stop_split] [@expl:deref result type invariant] inv_ref_slice_T result)
      /\ ([@stop_split] [@expl:deref ensures] Slice64.view result = view_Vec_T_Global self_)}
      (! return {result}) ]
  
  predicate in_bounds_usize [@inline:trivial] (self: UInt64.t) (seq: Seq.seq t_T) = UInt64.t'int self < Seq.length seq
  
  meta "rewrite_def" predicate in_bounds_usize
  
  predicate has_value_usize [@inline:trivial] (self: UInt64.t) (seq: Seq.seq t_T) (out: t_T) =
    Seq.get seq (UInt64.t'int self) = out
  
  meta "rewrite_def" predicate has_value_usize
  
  let rec get_unchecked_T (self_: Slice64.slice t_T) (ix: UInt64.t) (return (x: t_T)) =
    {[@stop_split] [@expl:get_unchecked_T requires] ([@stop_split] [@expl:get_unchecked 'self_' type invariant] inv_ref_slice_T self_)
    /\ ([@stop_split] [@expl:get_unchecked requires] in_bounds_usize ix (Slice64.view self_))}
    any
    [ return (result: t_T) ->
    {[@stop_split] [@expl:get_unchecked_T ensures] ([@stop_split] [@expl:get_unchecked result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:get_unchecked ensures] has_value_usize ix (Slice64.view self_) result)}
      (! return {result}) ]
  
  function namespace_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Namespace
  
  predicate invariant_PersistentArray_T (self: t_PersistentArray_T) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T'0 self.frag = public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv)
    /\ get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell)
      <> None'0
    /\ namespace_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) = Namespace_PARRAY 0
  
  predicate inv_Rc_NonAtomicInvariant_PA_T_Global (_1: t_Rc_NonAtomicInvariant_PA_T_Global)
  
  predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_PersistentArray_T (_1: t_PersistentArray_T)
  
  axiom inv_axiom'3 [@rewrite]: forall x: t_PersistentArray_T [inv_PersistentArray_T x]. inv_PersistentArray_T x
      = (invariant_PersistentArray_T x
      /\ inv_Rc_PermCell_Inner_T_Global x.permcell /\ inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global x.inv)
  
  predicate invariant_ref_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) = inv_PersistentArray_T self
  
  meta "rewrite_def" predicate invariant_ref_PersistentArray_T
  
  predicate inv_ref_PersistentArray_T [@inline:trivial] (_1: t_PersistentArray_T) = invariant_ref_PersistentArray_T _1
  
  meta "rewrite_def" predicate inv_ref_PersistentArray_T
  
  predicate inv_closure0 [@inline:trivial] (_1: closure0) =
    let {c0 = x0; c1 = x1; c2 = x2} = _1 in inv_ref_PersistentArray_T x0
  
  meta "rewrite_def" predicate inv_closure0
  
  let rec closure0 [@coma:extspec] (self: closure0) (pa: MutBorrow.t t_PA_T) (return (x: t_T)) =
    {[@stop_split] [@expl:closure0 requires] ([@stop_split] [@expl:closure 'self' type invariant] inv_closure0 self)
    /\ ([@stop_split] [@expl:closure 'pa' type invariant] inv_Ghost_refmut_PA_T pa)}
    bb0
    [ bb0 = s0
      [ s0 = deref_Ghost_refmut_PA_T {pa} (fun (_x: MutBorrow.t t_PA_T) -> [ &_6 <- _x ] s1)
      | s1 = [ &_11 <- self.c0.frag ] s2
      | s2 = deref_Ghost_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T {_11}
          (fun (_x: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) -> [ &_9 <- _x ] s3)
      | s3 = frag_lemma_FMap_PermCell_Inner_T_Ag_Seq_T {_6.current.auth} {_9} (fun (_x: ()) -> [ &_4 <- _x ] s4)
      | s4 = new_unit {_4} (fun (_x: ()) -> [ &_3 <- _x ] s5)
      | s5 = [ &_14 <- self.c0.permcell ] s6
      | s6 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_22 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s7) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s7 = deref_mut_Ghost_refmut_PA_T {_22} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_21 <- _x ] s8)
      | s8 = MutBorrow.borrow_final <MutBorrow.t t_PA_T> {_21.current} {MutBorrow.get_id _21}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_20 <- _bor ] -{inv_refmut_PA_T _bor.final}-
            [ &_21 <- { _21 with current = _bor.final } ] s9)
        [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _21.current} any) ]
      | s9 = MutBorrow.borrow_mut <t_PA_T> {_20.current.current}
          (fun (_bor: MutBorrow.t t_PA_T) ->
            [ &_19 <- _bor ] -{inv_PA_T _bor.final}-
            [ &_20 <- { _20 with current = { _20.current with current = _bor.final } } ] s10)
        [ _ck -> (! {[@expl:type invariant] inv_PA_T _20.current.current} any) ]
      | s10 = s11 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _21} any) ]
      | s11 = -{resolve_refmut_refmut_PA_T _21}- s12
      | s12 = s13 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _20} any) ]
      | s13 = -{resolve_refmut_refmut_PA_T _20}- s14
      | s14 = MutBorrow.borrow_final <t_PA_T> {_19.current} {MutBorrow.get_id _19}
          (fun (_bor: MutBorrow.t t_PA_T) ->
            [ &_18 <- _bor ] -{inv_PA_T _bor.final}-
            [ &_19 <- { _19 with current = _bor.final } ] s15)
        [ _ck -> (! {[@expl:type invariant] inv_PA_T _19.current} any) ]
      | s15 = s16 [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _19} any) ]
      | s16 = -{resolve_refmut_PA_T _19}- s17
      | s17 = MutBorrow.borrow_final <t_PA_T> {_18.current} {MutBorrow.get_id _18}
          (fun (_bor: MutBorrow.t t_PA_T) ->
            [ &_17 <- _bor ] -{inv_PA_T _bor.final}-
            [ &_18 <- { _18 with current = _bor.final } ] s18)
        [ _ck -> (! {[@expl:type invariant] inv_PA_T _18.current} any) ]
      | s18 = new_refmut_PA_T {_17} (fun (_x: MutBorrow.t t_PA_T) -> [ &_16 <- _x ] s19)
      | s19 = s20 [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _18} any) ]
      | s20 = -{resolve_refmut_PA_T _18}- s21
      | s21 = reroot_T {_14} {self.c1} {_16} (fun (_x: ()) -> [ &_12 <- _x ] s22)
      | s22 = into_inner_refmut_PA_T {pa} (fun (_x: MutBorrow.t t_PA_T) -> [ &_28 <- _x ] s23)
      | s23 = s24 [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _28} any) ]
      | s24 = -{resolve_refmut_PA_T _28}- s25
      | s25 = [ &_31 <- view_Rc_PermCell_Inner_T_Global self.c0.permcell ] s26
      | s26 = get_ghost_Snapshot_PermCell_Inner_T {_28.current.perms} {_31}
          (fun (_x: t_Option_ref_Box_Perm_PermCell_Inner_T_Global) -> [ &_26 <- _x ] s27)
      | s27 = unwrap_ref_Box_Perm_PermCell_Inner_T_Global {_26}
          (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_25 <- _x ] s28)
      | s28 = new_ref_Perm_PermCell_Inner_T {_25} (fun (_x: t_Perm_PermCell_Inner_T) -> [ &perm <- _x ] s29)
      | s29 = deref_Rc_PermCell_Inner_T_Global {self.c0.permcell} (fun (_x: t_PermCell_Inner_T) -> [ &_39 <- _x ] s30)
      | s30 = borrow_Inner_T {_39} {perm} (fun (_x: t_Inner_T) -> [ &_37 <- _x ] s31)
      | s31 = any
        [ br0 (x0: t_Vec_T_Global) -> {_37 = Direct x0} (! bb16)
        | br1 (x0: UInt64.t) (x1: t_T) (x2: t_Rc_PermCell_Inner_T_Global) -> {_37 = Link x0 x1 x2} (! bb17) ] ]
    | bb17 = {false} any
    | bb16 = s0
      [ s0 = elim_Direct {_37} (fun (r0: t_Vec_T_Global) -> [ &arr <- r0 ] s1)
      | s1 = deref_Vec_T_Global {arr} (fun (_x: Slice64.slice t_T) -> [ &_44 <- _x ] s2)
      | s2 = get_unchecked_T {_44} {self.c2} (fun (_x: t_T) -> [ &_ret <- _x ] s3)
      | s3 = return {_ret} ] ]
    [ & _ret: t_T = Any.any_l ()
    | & self: closure0 = self
    | & pa: MutBorrow.t t_PA_T = pa
    | & _3: () = Any.any_l ()
    | & _4: () = Any.any_l ()
    | & _6: MutBorrow.t t_PA_T = Any.any_l ()
    | & _9: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _11: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = Any.any_l ()
    | & _12: () = Any.any_l ()
    | & _14: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _16: MutBorrow.t t_PA_T = Any.any_l ()
    | & _17: MutBorrow.t t_PA_T = Any.any_l ()
    | & _18: MutBorrow.t t_PA_T = Any.any_l ()
    | & _19: MutBorrow.t t_PA_T = Any.any_l ()
    | & _20: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _21: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _22: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & perm: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _25: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _26: t_Option_ref_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _28: MutBorrow.t t_PA_T = Any.any_l ()
    | & _31: t_PermCell_Inner_T = Any.any_l ()
    | & arr: t_Vec_T_Global = Any.any_l ()
    | & _37: t_Inner_T = Any.any_l ()
    | & _39: t_PermCell_Inner_T = Any.any_l ()
    | & _44: Slice64.slice t_T = Any.any_l () ]
    [ return (result: t_T) -> {[@stop_split] [@expl:closure result type invariant] inv_ref_T result} return {result} ]
  
  meta "rewrite_def" predicate closure0'pre
  
  meta "rewrite_def" predicate closure0'post'return
  
  type t_Tokens
  
  predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  type tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0 = {
    f0'3: t_Rc_NonAtomicInvariant_PA_T_Global;
    f1'3: t_Tokens;
    f2'3: closure0 }
  
  predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_ref_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate invariant_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_ref_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate precondition_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) =
    let self_ = args in inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate precondition_deref
  
  predicate postcondition_once_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (result: t_NonAtomicInvariant_PA_T) =
    let self_ = args in result = view_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate postcondition_once_deref
  
  predicate resolve_deref [@inline:trivial] (_1: ()) = true
  
  meta "rewrite_def" predicate resolve_deref
  
  predicate postcondition_mut_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (result_state: ()) (result: t_NonAtomicInvariant_PA_T) =
    let self_ = args in result = view_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate postcondition_mut_deref
  
  function fn_mut_once_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom fn_mut_once_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res: t_NonAtomicInvariant_PA_T. postcondition_once_deref self args res
      = (exists res_state: (). postcondition_mut_deref self args res_state res /\ resolve_deref res_state)
  
  predicate hist_inv_deref [@inline:trivial] (self: ()) (result_state: ()) = true
  
  meta "rewrite_def" predicate hist_inv_deref
  
  function hist_inv_trans_deref (self: ()) (b: ()) (c: ()) : ()
  
  axiom hist_inv_trans_deref_spec: forall self: (), b: (), c: (). hist_inv_deref self b
      -> hist_inv_deref b c -> hist_inv_deref self c
  
  function hist_inv_refl_deref (self: ()) : ()
  
  axiom hist_inv_refl_deref_spec: forall self: (). hist_inv_deref self self
  
  function postcondition_mut_hist_inv_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res_state: ()) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom postcondition_mut_hist_inv_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res_state: (), res: t_NonAtomicInvariant_PA_T. postcondition_mut_deref self args res_state res
      -> hist_inv_deref self res_state
  
  function fn_hist_inv_deref (self: ()) (res_state: ()) : ()
  
  axiom fn_hist_inv_deref_spec: forall self: (), res_state: (). hist_inv_deref self res_state = (self = res_state)
  
  predicate postcondition_deref [@inline:trivial] (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (result: t_NonAtomicInvariant_PA_T) =
    let self_ = args in result = view_Rc_NonAtomicInvariant_PA_T_Global self_
  
  meta "rewrite_def" predicate postcondition_deref
  
  function fn_once_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom fn_once_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res: t_NonAtomicInvariant_PA_T. postcondition_once_deref self args res
      = (postcondition_deref self args res /\ resolve_deref self)
  
  function fn_mut_deref (self: ()) (args: t_Rc_NonAtomicInvariant_PA_T_Global) (res_state: ()) (res: t_NonAtomicInvariant_PA_T) : ()
  
  axiom fn_mut_deref_spec:
    forall self: (), args: t_Rc_NonAtomicInvariant_PA_T_Global, res_state: (), res: t_NonAtomicInvariant_PA_T. postcondition_mut_deref self args res_state res
      = (postcondition_deref self args res /\ self = res_state)
  
  type tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0 = {
    f0'4: t_NonAtomicInvariant_PA_T;
    f1'4: t_Tokens;
    f2'4: closure0 }
  
  predicate contains_Namespace [@inline:trivial] (self: Set.set t_Namespace) (e: t_Namespace) = Set.mem e self
  
  meta "rewrite_def" predicate contains_Namespace
  
  function namespaces (self: t_Tokens) : Set.set t_Namespace
  
  predicate contains (self: t_Tokens) (namespace: t_Namespace) = contains_Namespace (namespaces self) namespace
  
  predicate protocol_PA_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    partial_invariant_T self id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
      = contains_Snapshot_PermCell_Inner_T self.perms pc)
  
  meta "rewrite_def" predicate protocol_PA_T
  
  predicate precondition_closure0 [@inline:trivial] (self: closure0) (args: MutBorrow.t t_PA_T) =
    let pa = args in closure0'pre self pa
  
  meta "rewrite_def" predicate precondition_closure0
  
  predicate postcondition_once_closure0 [@inline:trivial] (self: closure0) (args: MutBorrow.t t_PA_T) (result: t_T) =
    let pa = args in closure0'post'return self pa result
  
  meta "rewrite_def" predicate postcondition_once_closure0
  
  predicate precondition_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) =
    let {f0'4 = self'0; f1'4 = tokens; f2'4 = f} = args in inv_closure0 f
    /\ contains tokens (namespace_PA_T self'0)
    /\ (forall t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0) /\ inv_Ghost_refmut_PA_T t
      -> precondition_closure0 f t
      /\ (forall res: t_T. postcondition_once_closure0 f t res
        -> protocol_PA_T (fin_Ghost_refmut_PA_T t) (public_PA_T self'0)))
  
  meta "rewrite_def" predicate precondition_open
  
  function new_ref_NonAtomicInvariant_PA_T (x: t_NonAtomicInvariant_PA_T) : t_NonAtomicInvariant_PA_T
  
  axiom new_ref_NonAtomicInvariant_PA_T_spec: forall x: t_NonAtomicInvariant_PA_T. new_ref_NonAtomicInvariant_PA_T x = x
  
  predicate precondition_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) =
    let {f0'3 = self'0; f1'3 = tokens; f2'3 = f} = args in inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global self'0
    /\ inv_closure0 f
    /\ precondition_deref () self'0
    /\ (forall this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      -> precondition_open () { f0'4 = new_ref_NonAtomicInvariant_PA_T this; f1'4 = tokens; f2'4 = f })
  
  meta "rewrite_def" predicate precondition_open'0
  
  let rec deref_Rc_NonAtomicInvariant_PA_T_Global (self_: t_Rc_NonAtomicInvariant_PA_T_Global)
    (return (x: t_NonAtomicInvariant_PA_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Rc_NonAtomicInvariant_PA_T_Global self_}
    any
    [ return (result: t_NonAtomicInvariant_PA_T) -> {[@stop_split] [@expl:deref ensures] result
      = view_Rc_NonAtomicInvariant_PA_T_Global self_}
      (! return {result}) ]
  
  let rec open_Ghost_ref_NonAtomicInvariant_PA_T (self: t_NonAtomicInvariant_PA_T) (tokens: t_Tokens) (f: closure0)
    (return (x: t_T)) =
    {[@stop_split] [@expl:open_Ghost_ref_NonAtomicInvariant_PA_T requires] ([@stop_split] [@expl:open 'f' type invariant] inv_closure0 f)
    /\ ([@stop_split] [@expl:open requires #0] contains tokens (namespace_PA_T self))
    /\ ([@stop_split] [@expl:open requires #1] forall t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self)
        /\ inv_Ghost_refmut_PA_T t
      -> precondition_closure0 f t
      /\ (forall res: t_T. postcondition_once_closure0 f t res
        -> protocol_PA_T (fin_Ghost_refmut_PA_T t) (public_PA_T self)))}
    any
    [ return (result: t_T) ->
    {[@stop_split] [@expl:open_Ghost_ref_NonAtomicInvariant_PA_T ensures] ([@stop_split] [@expl:open result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:open ensures] exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self)
        /\ postcondition_once_closure0 f t result)}
      (! return {result}) ]
  
  predicate postcondition_once_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (result: t_T) =
    let {f0'4 = self'0; f1'4 = tokens; f2'4 = f} = args in inv_ref_T result
    /\ (exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0)
      /\ postcondition_once_closure0 f t result)
  
  meta "rewrite_def" predicate postcondition_once_open
  
  predicate resolve_open [@inline:trivial] (_1: ()) = true
  
  meta "rewrite_def" predicate resolve_open
  
  predicate postcondition_mut_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (result_state: ()) (result: t_T) =
    let {f0'4 = self'0; f1'4 = tokens; f2'4 = f} = args in inv_ref_T result
    /\ (exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0)
      /\ postcondition_once_closure0 f t result)
  
  meta "rewrite_def" predicate postcondition_mut_open
  
  function fn_mut_once_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res: t_T) : ()
  
  axiom fn_mut_once_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res: t_T. postcondition_once_open self args res
      = (exists res_state: (). postcondition_mut_open self args res_state res /\ resolve_open res_state)
  
  predicate hist_inv_open [@inline:trivial] (self: ()) (result_state: ()) = true
  
  meta "rewrite_def" predicate hist_inv_open
  
  function hist_inv_trans_open (self: ()) (b: ()) (c: ()) : ()
  
  axiom hist_inv_trans_open_spec: forall self: (), b: (), c: (). hist_inv_open self b
      -> hist_inv_open b c -> hist_inv_open self c
  
  function hist_inv_refl_open (self: ()) : ()
  
  axiom hist_inv_refl_open_spec: forall self: (). hist_inv_open self self
  
  function postcondition_mut_hist_inv_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res_state: ()) (res: t_T) : ()
  
  axiom postcondition_mut_hist_inv_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res_state: (), res: t_T. postcondition_mut_open self args res_state res
      -> hist_inv_open self res_state
  
  function fn_hist_inv_open (self: ()) (res_state: ()) : ()
  
  axiom fn_hist_inv_open_spec: forall self: (), res_state: (). hist_inv_open self res_state = (self = res_state)
  
  predicate postcondition_open [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (result: t_T) =
    let {f0'4 = self'0; f1'4 = tokens; f2'4 = f} = args in inv_ref_T result
    /\ (exists t: MutBorrow.t t_PA_T. protocol_PA_T t.current (public_PA_T self'0)
      /\ postcondition_once_closure0 f t result)
  
  meta "rewrite_def" predicate postcondition_open
  
  function fn_once_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res: t_T) : ()
  
  axiom fn_once_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res: t_T. postcondition_once_open self args res
      = (postcondition_open self args res /\ resolve_open self)
  
  function fn_mut_open (self: ()) (args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0) (res_state: ()) (res: t_T) : ()
  
  axiom fn_mut_open_spec:
    forall self: (), args: tup3_Ghost_ref_NonAtomicInvariant_PA_T_Ghost_Tokens_closure0, res_state: (), res: t_T. postcondition_mut_open self args res_state res
      = (postcondition_open self args res /\ self = res_state)
  
  let rec open_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (tokens: t_Tokens) (f: closure0) (return (x: t_T)) =
    {[@stop_split] [@expl:open_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global requires] ([@stop_split] [@expl:open 'self' type invariant] inv_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global self)
    /\ ([@stop_split] [@expl:open 'f' type invariant] inv_closure0 f)
    /\ ([@stop_split] [@expl:open requires #0] precondition_deref () self)
    /\ ([@stop_split] [@expl:open requires #1] forall this: t_NonAtomicInvariant_PA_T. postcondition_deref () self this
      -> precondition_open () { f0'4 = new_ref_NonAtomicInvariant_PA_T this; f1'4 = tokens; f2'4 = f })}
    any
    [ return (result: t_T) ->
    {[@stop_split] [@expl:open_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:open result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:open ensures] exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self this
        /\ postcondition_open () { f0'4 = new_ref_NonAtomicInvariant_PA_T this; f1'4 = tokens; f2'4 = f } result)}
      (! return {result}) ]
  
  function new_ref_Rc_NonAtomicInvariant_PA_T_Global (x: t_Rc_NonAtomicInvariant_PA_T_Global) : t_Rc_NonAtomicInvariant_PA_T_Global
  
  axiom new_ref_Rc_NonAtomicInvariant_PA_T_Global_spec:
    forall x: t_Rc_NonAtomicInvariant_PA_T_Global. new_ref_Rc_NonAtomicInvariant_PA_T_Global x = x
  
  predicate postcondition_once_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (result: t_T) =
    let {f0'3 = self'0; f1'3 = tokens; f2'3 = f} = args in inv_ref_T result
    /\ (exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      /\ postcondition_open () { f0'4 = new_ref_NonAtomicInvariant_PA_T this; f1'4 = tokens; f2'4 = f } result)
  
  meta "rewrite_def" predicate postcondition_once_open'0
  
  predicate resolve_open'0 [@inline:trivial] (_1: ()) = true
  
  meta "rewrite_def" predicate resolve_open'0
  
  predicate postcondition_mut_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (result_state: ()) (result: t_T) =
    let {f0'3 = self'0; f1'3 = tokens; f2'3 = f} = args in inv_ref_T result
    /\ (exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      /\ postcondition_open () { f0'4 = new_ref_NonAtomicInvariant_PA_T this; f1'4 = tokens; f2'4 = f } result)
  
  meta "rewrite_def" predicate postcondition_mut_open'0
  
  function fn_mut_once_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res: t_T) : ()
  
  axiom fn_mut_once_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res: t_T. postcondition_once_open'0 self args res
      = (exists res_state: (). postcondition_mut_open'0 self args res_state res /\ resolve_open'0 res_state)
  
  predicate hist_inv_open'0 [@inline:trivial] (self: ()) (result_state: ()) = true
  
  meta "rewrite_def" predicate hist_inv_open'0
  
  function hist_inv_trans_open'0 (self: ()) (b: ()) (c: ()) : ()
  
  axiom hist_inv_trans_open_spec'0: forall self: (), b: (), c: (). hist_inv_open'0 self b
      -> hist_inv_open'0 b c -> hist_inv_open'0 self c
  
  function hist_inv_refl_open'0 (self: ()) : ()
  
  axiom hist_inv_refl_open_spec'0: forall self: (). hist_inv_open'0 self self
  
  function postcondition_mut_hist_inv_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res_state: ()) (res: t_T) : ()
  
  axiom postcondition_mut_hist_inv_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res_state: (), res: t_T. postcondition_mut_open'0 self args res_state res
      -> hist_inv_open'0 self res_state
  
  function fn_hist_inv_open'0 (self: ()) (res_state: ()) : ()
  
  axiom fn_hist_inv_open_spec'0: forall self: (), res_state: (). hist_inv_open'0 self res_state = (self = res_state)
  
  predicate postcondition_open'0 [@inline:trivial] (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (result: t_T) =
    let {f0'3 = self'0; f1'3 = tokens; f2'3 = f} = args in inv_ref_T result
    /\ (exists this: t_NonAtomicInvariant_PA_T. postcondition_deref () self'0 this
      /\ postcondition_open () { f0'4 = new_ref_NonAtomicInvariant_PA_T this; f1'4 = tokens; f2'4 = f } result)
  
  meta "rewrite_def" predicate postcondition_open'0
  
  function fn_once_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res: t_T) : ()
  
  axiom fn_once_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res: t_T. postcondition_once_open'0 self args res
      = (postcondition_open'0 self args res /\ resolve_open'0 self)
  
  function fn_mut_open'0 (self: ()) (args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0) (res_state: ()) (res: t_T) : ()
  
  axiom fn_mut_open_spec'0:
    forall self: (), args: tup3_Ghost_ref_Rc_NonAtomicInvariant_PA_T_Global_Ghost_Tokens_closure0, res_state: (), res: t_T. postcondition_mut_open'0 self args res_state res
      = (postcondition_open'0 self args res /\ self = res_state)
  
  let rec open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global)
    (tokens: t_Tokens) (f: closure0) (return (x: t_T)) =
    {[@stop_split] [@expl:open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global requires] ([@stop_split] [@expl:open 'self' type invariant] inv_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global self)
    /\ ([@stop_split] [@expl:open 'f' type invariant] inv_closure0 f)
    /\ ([@stop_split] [@expl:open requires] precondition_open'0 () { f0'3 = new_ref_Rc_NonAtomicInvariant_PA_T_Global self;
                                                                     f1'3 = tokens;
                                                                     f2'3 = f })}
    any
    [ return (result: t_T) ->
    {[@stop_split] [@expl:open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global ensures] ([@stop_split] [@expl:open result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:open ensures] postcondition_open'0 () { f0'3 = new_ref_Rc_NonAtomicInvariant_PA_T_Global self;
                                                                       f1'3 = tokens;
                                                                       f2'3 = f } result)}
      (! return {result}) ]
  
  function view_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) : Seq.seq t_T =
    (unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell))).f0'0
  
  meta "rewrite_def" function view_PersistentArray_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec get_T (self: t_PersistentArray_T) (index: UInt64.t) (tokens: t_Tokens) (return (x: t_T)) =
    {[@stop_split] [@expl:get_T requires] ([@stop_split] [@expl:get 'self' type invariant] inv_ref_PersistentArray_T self)
    /\ ([@stop_split] [@expl:get requires #0] contains tokens (Namespace_PARRAY 0))
    /\ ([@stop_split] [@expl:get requires #1] UInt64.t'int index < Seq.length (view_PersistentArray_T self))}
    (! bb0
    [ bb0 = s0
      [ s0 = [ &auth_id <- public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) ] s1
      | s1 = [ &_18 <- { c0 = self; c1 = auth_id; c2 = index } ] s2
      | s2 = open_ref_Ghost_Rc_NonAtomicInvariant_PA_T_Global {self.inv} {tokens} {_18}
          (fun (_x: t_T) -> [ &_15 <- _x ] s3)
      | s3 = [ &_ret <- _15 ] s4
      | s4 = return {_ret} ] ]
    [ & _ret: t_T = Any.any_l ()
    | & self: t_PersistentArray_T = self
    | & index: UInt64.t = index
    | & tokens: t_Tokens = tokens
    | & auth_id: t_Id = Any.any_l ()
    | & _15: t_T = Any.any_l ()
    | & _18: closure0 = Any.any_l () ])
    [ return (result: t_T) ->
    {[@stop_split] [@expl:get_T ensures] ([@stop_split] [@expl:get result type invariant] inv_ref_T result)
      /\ ([@stop_split] [@expl:get ensures] result = Seq.get (view_PersistentArray_T self) (UInt64.t'int index))}
      (! return {result}) ]
end
module M_implementation__impl_PersistentArray_T__reroot (* implementation::PersistentArray<T> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use creusot.prelude.MutBorrow
  use map.Map
  use creusot.int.UInt64
  use seq.Seq
  use int.MinMax
  use creusot.prelude.Any
  use int.Int
  
  type t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  type t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PermCell_Inner_T
  
  type t_PA_T = {
    perms: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global;
    auth: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T;
    depth: Map.map t_PermCell_Inner_T int }
  
  predicate invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  predicate inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (_1: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T)
  
  axiom inv_axiom:
    forall x: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T [inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x]. inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
      -> invariant_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x
  
  predicate inv_PA_T (_1: t_PA_T)
  
  axiom inv_axiom'0 [@rewrite]: forall x: t_PA_T [inv_PA_T x]. inv_PA_T x
      = inv_Authority_FMap_PermCell_Inner_T_Ag_Seq_T x.auth
  
  predicate invariant_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) =
    inv_PA_T self.current /\ inv_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_PA_T
  
  predicate inv_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_PA_T
  
  predicate invariant_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) = inv_refmut_PA_T self
  
  meta "rewrite_def" predicate invariant_Ghost_refmut_PA_T
  
  predicate inv_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = invariant_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_Ghost_refmut_PA_T
  
  predicate invariant_refmut_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t (MutBorrow.t t_PA_T)) =
    inv_Ghost_refmut_PA_T self.current /\ inv_Ghost_refmut_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Ghost_refmut_PA_T
  
  predicate inv_refmut_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) =
    invariant_refmut_Ghost_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_Ghost_refmut_PA_T
  
  predicate invariant_refmut_refmut_PA_T [@inline:trivial] (self: MutBorrow.t (MutBorrow.t t_PA_T)) =
    inv_refmut_PA_T self.current /\ inv_refmut_PA_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_refmut_PA_T
  
  predicate inv_refmut_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) =
    invariant_refmut_refmut_PA_T _1
  
  meta "rewrite_def" predicate inv_refmut_refmut_PA_T
  
  let rec deref_mut_Ghost_refmut_PA_T (self: MutBorrow.t (MutBorrow.t t_PA_T))
    (return (x: MutBorrow.t (MutBorrow.t t_PA_T))) =
    {[@stop_split] [@expl:deref_mut 'self' type invariant] inv_refmut_Ghost_refmut_PA_T self}
    any
    [ return (result: MutBorrow.t (MutBorrow.t t_PA_T)) ->
    {[@stop_split] [@expl:deref_mut_Ghost_refmut_PA_T ensures] ([@stop_split] [@expl:deref_mut result type invariant] inv_refmut_refmut_PA_T result)
      /\ ([@stop_split] [@expl:deref_mut ensures] result = self)}
      (! return {result}) ]
  
  type t_Rc_PermCell_Inner_T_Global
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  type t_Perm_PermCell_Inner_T
  
  type t_Option_Box_Perm_PermCell_Inner_T_Global = None | Some t_Perm_PermCell_Inner_T
  
  function to_mapping_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : Map.map t_PermCell_Inner_T t_Option_Box_Perm_PermCell_Inner_T_Global
  
  function len_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) : int
  
  axiom len_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global. len_Snapshot_PermCell_Inner_T self
      >= 0
  
  function get_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Option_Box_Perm_PermCell_Inner_T_Global
   = Map.get (to_mapping_Snapshot_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_Snapshot_PermCell_Inner_T
  
  predicate contains_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) =
    get_Snapshot_PermCell_Inner_T self k <> None
  
  meta "rewrite_def" predicate contains_Snapshot_PermCell_Inner_T
  
  function remove_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  axiom remove_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T. to_mapping_Snapshot_PermCell_Inner_T (remove_Snapshot_PermCell_Inner_T self k)
      = Map.set (to_mapping_Snapshot_PermCell_Inner_T self) k (None)
  
  axiom remove_Snapshot_PermCell_Inner_T_spec'0:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T. len_Snapshot_PermCell_Inner_T (remove_Snapshot_PermCell_Inner_T self k)
      = (if contains_Snapshot_PermCell_Inner_T self k then
        len_Snapshot_PermCell_Inner_T self - 1
      else
        len_Snapshot_PermCell_Inner_T self
      )
  
  let rec remove_ghost_Snapshot_PermCell_Inner_T
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T)
    (return (x: t_Option_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:remove_ghost_Snapshot_PermCell_Inner_T ensures] ([@stop_split] [@expl:remove_ghost ensures #0] self.final
        = remove_Snapshot_PermCell_Inner_T self.current key)
      /\ ([@stop_split] [@expl:remove_ghost ensures #1] result = get_Snapshot_PermCell_Inner_T self.current key)}
      (! return {result}) ]
  
  predicate resolve_refmut_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t (MutBorrow.t t_PA_T)) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_refmut_PA_T
  
  let rec unwrap_Box_Perm_PermCell_Inner_T_Global (self_: t_Option_Box_Perm_PermCell_Inner_T_Global)
    (return (x: t_Perm_PermCell_Inner_T)) = {[@stop_split] [@expl:unwrap requires] self_ <> None}
    any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:unwrap ensures] Some result = self_}
      (! return {result}) ]
  
  let rec new_Box_Perm_PermCell_Inner_T_Global (x: t_Perm_PermCell_Inner_T) (return (x'0: t_Perm_PermCell_Inner_T)) =
    any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate invariant_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self
  
  meta "rewrite_def" predicate invariant_ref_Rc_PermCell_Inner_T_Global
  
  predicate inv_ref_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Rc_PermCell_Inner_T_Global) =
    invariant_ref_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_ref_Rc_PermCell_Inner_T_Global
  
  let rec deref_Rc_PermCell_Inner_T_Global (self_: t_Rc_PermCell_Inner_T_Global) (return (x: t_PermCell_Inner_T)) =
    {[@stop_split] [@expl:deref 'self_' type invariant] inv_ref_Rc_PermCell_Inner_T_Global self_}
    any
    [ return (result: t_PermCell_Inner_T) -> {[@stop_split] [@expl:deref ensures] result
      = view_Rc_PermCell_Inner_T_Global self_}
      (! return {result}) ]
  
  let rec deref_mut_Ghost_Box_Perm_PermCell_Inner_T_Global (self: MutBorrow.t t_Perm_PermCell_Inner_T)
    (return (x: MutBorrow.t t_Perm_PermCell_Inner_T)) = any
    [ return (result: MutBorrow.t t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:deref_mut ensures] result = self}
      (! return {result}) ]
  
  predicate resolve_refmut_Ghost_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: MutBorrow.t t_Perm_PermCell_Inner_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Ghost_Box_Perm_PermCell_Inner_T_Global
  
  predicate resolve_refmut_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: MutBorrow.t t_Perm_PermCell_Inner_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Box_Perm_PermCell_Inner_T_Global
  
  predicate resolve_refmut_Perm_PermCell_Inner_T [@inline:trivial] (_1: MutBorrow.t t_Perm_PermCell_Inner_T) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Perm_PermCell_Inner_T
  
  let rec new_refmut_Perm_PermCell_Inner_T (x: MutBorrow.t t_Perm_PermCell_Inner_T)
    (return (x'0: MutBorrow.t t_Perm_PermCell_Inner_T)) = any
    [ return (result: MutBorrow.t t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:new ensures] result = x}
      (! return {result}) ]
  
  type t_Vec_T_Global
  
  type t_T
  
  type t_Inner_T = Direct t_Vec_T_Global | Link UInt64.t t_T t_Rc_PermCell_Inner_T_Global
  
  function ward_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_PermCell_Inner_T
  
  predicate inv_T (_1: t_T)
  
  predicate invariant_ref_T [@inline:trivial] (self: t_T) = inv_T self
  
  meta "rewrite_def" predicate invariant_ref_T
  
  predicate inv_ref_T [@inline:trivial] (_1: t_T) = invariant_ref_T _1
  
  meta "rewrite_def" predicate inv_ref_T
  
  predicate invariant_Seq_T [@inline:trivial] (self: Seq.seq t_T) =
    forall i: int. 0 <= i /\ i < Seq.length self -> inv_ref_T (Seq.get self i)
  
  meta "rewrite_def" predicate invariant_Seq_T
  
  predicate inv_Seq_T [@inline:trivial] (_1: Seq.seq t_T) = invariant_Seq_T _1
  
  meta "rewrite_def" predicate inv_Seq_T
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_T_Global (self: t_Vec_T_Global) : Seq.seq t_T
  
  axiom view_Vec_T_Global_spec: forall self: t_Vec_T_Global. Seq.length (view_Vec_T_Global self)
      <= UInt64.t'int const_MAX
  
  predicate invariant_Vec_T_Global (self: t_Vec_T_Global) = inv_Seq_T (view_Vec_T_Global self)
  
  predicate inv_Vec_T_Global (_1: t_Vec_T_Global)
  
  axiom inv_axiom'1: forall x: t_Vec_T_Global [inv_Vec_T_Global x]. inv_Vec_T_Global x -> invariant_Vec_T_Global x
  
  predicate inv_Inner_T (_1: t_Inner_T)
  
  axiom inv_axiom'2 [@rewrite]: forall x: t_Inner_T [inv_Inner_T x]. inv_Inner_T x
      = match x with
        | Direct f0 -> inv_Vec_T_Global f0
        | Link index value next -> inv_T value /\ inv_Rc_PermCell_Inner_T_Global next
        end
  
  predicate invariant_refmut_Inner_T [@inline:trivial] (self: MutBorrow.t t_Inner_T) =
    inv_Inner_T self.current /\ inv_Inner_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_Inner_T
  
  predicate inv_refmut_Inner_T [@inline:trivial] (_1: MutBorrow.t t_Inner_T) = invariant_refmut_Inner_T _1
  
  meta "rewrite_def" predicate inv_refmut_Inner_T
  
  function fin_Ghost_refmut_Perm_PermCell_Inner_T [@inline:trivial] (self: MutBorrow.t t_Perm_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = self.final
  
  meta "rewrite_def" function fin_Ghost_refmut_Perm_PermCell_Inner_T
  
  function val_PermCell_Inner_T (self: t_Perm_PermCell_Inner_T) : t_Inner_T
  
  function view_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) : t_Inner_T =
    val_PermCell_Inner_T self
  
  meta "rewrite_def" function view_Perm_PermCell_Inner_T
  
  let rec borrow_mut_Inner_T (self: t_PermCell_Inner_T) (perm: MutBorrow.t t_Perm_PermCell_Inner_T)
    (return (x: MutBorrow.t t_Inner_T)) = {[@stop_split] [@expl:borrow_mut requires] self
    = ward_PermCell_Inner_T perm.current}
    any
    [ return (result: MutBorrow.t t_Inner_T) ->
    {[@stop_split] [@expl:borrow_mut_Inner_T ensures] ([@stop_split] [@expl:borrow_mut result type invariant] inv_refmut_Inner_T result)
      /\ ([@stop_split] [@expl:borrow_mut ensures #0] self
        = ward_PermCell_Inner_T (fin_Ghost_refmut_Perm_PermCell_Inner_T perm))
      /\ ([@stop_split] [@expl:borrow_mut ensures #1] result.current = view_Perm_PermCell_Inner_T perm.current)
      /\ ([@stop_split] [@expl:borrow_mut ensures #2] result.final
      = view_Perm_PermCell_Inner_T (fin_Ghost_refmut_Perm_PermCell_Inner_T perm))}
      (! return {result}) ]
  
  predicate resolve_refmut_Inner_T [@inline:trivial] (_1: MutBorrow.t t_Inner_T) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Inner_T
  
  let rec into_inner_Box_Perm_PermCell_Inner_T_Global (self: t_Perm_PermCell_Inner_T)
    (return (x: t_Perm_PermCell_Inner_T)) = any
    [ return (result: t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:into_inner ensures] result = self}
      (! return {result}) ]
  
  function insert_Snapshot_PermCell_Inner_T (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) (v: t_Perm_PermCell_Inner_T) : t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  axiom insert_Snapshot_PermCell_Inner_T_spec:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T, v: t_Perm_PermCell_Inner_T. to_mapping_Snapshot_PermCell_Inner_T (insert_Snapshot_PermCell_Inner_T self k v)
      = Map.set (to_mapping_Snapshot_PermCell_Inner_T self) k (Some v)
  
  axiom insert_Snapshot_PermCell_Inner_T_spec'0:
    forall self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global, k: t_PermCell_Inner_T, v: t_Perm_PermCell_Inner_T. len_Snapshot_PermCell_Inner_T (insert_Snapshot_PermCell_Inner_T self k v)
      = (if contains_Snapshot_PermCell_Inner_T self k then
        len_Snapshot_PermCell_Inner_T self
      else
        len_Snapshot_PermCell_Inner_T self + 1
      )
  
  let rec insert_ghost_Snapshot_PermCell_Inner_T
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T)
    (value: t_Perm_PermCell_Inner_T) (return (x: t_Option_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:insert_ghost_Snapshot_PermCell_Inner_T ensures] ([@stop_split] [@expl:insert_ghost ensures #0] self.final
        = insert_Snapshot_PermCell_Inner_T self.current key value)
      /\ ([@stop_split] [@expl:insert_ghost ensures #1] result = get_Snapshot_PermCell_Inner_T self.current key)}
      (! return {result}) ]
  
  predicate resolve_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_PA_T
  
  predicate resolve_Ghost_refmut_PA_T [@inline:trivial] (_1: MutBorrow.t t_PA_T) = resolve_refmut_PA_T _1
  
  meta "rewrite_def" predicate resolve_Ghost_refmut_PA_T
  
  let rec new_Option_Box_Perm_PermCell_Inner_T_Global (x: t_Option_Box_Perm_PermCell_Inner_T_Global)
    (return (x'0: t_Option_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_Box_Perm_PermCell_Inner_T_Global) -> {[@stop_split] [@expl:new ensures] result = x}
      (! return {result}) ]
  
  predicate resolve_ref_Inner_T [@inline:trivial] (_1: t_Inner_T) = true
  
  meta "rewrite_def" predicate resolve_ref_Inner_T
  
  predicate resolve_Perm_PermCell_Inner_T [@inline:trivial] (self: t_Perm_PermCell_Inner_T) =
    resolve_ref_Inner_T (val_PermCell_Inner_T self)
  
  meta "rewrite_def" predicate resolve_Perm_PermCell_Inner_T
  
  predicate resolve_Perm_PermCell_Inner_T'0 (_1: t_Perm_PermCell_Inner_T)
  
  axiom resolve_axiom:
    forall x: t_Perm_PermCell_Inner_T [resolve_Perm_PermCell_Inner_T'0 x]. resolve_Perm_PermCell_Inner_T'0 x
      -> resolve_Perm_PermCell_Inner_T x
  
  predicate resolve_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Perm_PermCell_Inner_T) =
    resolve_Perm_PermCell_Inner_T'0 _1
  
  meta "rewrite_def" predicate resolve_Box_Perm_PermCell_Inner_T_Global
  
  predicate resolve_Option_Box_Perm_PermCell_Inner_T_Global (_1: t_Option_Box_Perm_PermCell_Inner_T_Global)
  
  axiom resolve_axiom'0 [@rewrite]:
    forall x: t_Option_Box_Perm_PermCell_Inner_T_Global [resolve_Option_Box_Perm_PermCell_Inner_T_Global x]. resolve_Option_Box_Perm_PermCell_Inner_T_Global x
      = match x with
        | None -> true
        | Some x0 -> resolve_Box_Perm_PermCell_Inner_T_Global x0
        end
  
  predicate resolve_Ghost_Option_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (_1: t_Option_Box_Perm_PermCell_Inner_T_Global) =
    resolve_Option_Box_Perm_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate resolve_Ghost_Option_Box_Perm_PermCell_Inner_T_Global
  
  let rec elim_Link (_x: t_Inner_T) (return (index: UInt64.t) (value: t_T) (next: t_Rc_PermCell_Inner_T_Global)) = any
    [ _k (index: UInt64.t) (value: t_T) (next: t_Rc_PermCell_Inner_T_Global) -> {Link index value next = _x}
      (! return {index} {value} {next})
    | _chk -> (! {[@expl:elim Link] match _x with
        | Link _ _ _ -> true
        | _ -> false
        end}
      any) ]
  
  let rec new_refmut_PA_T (x: MutBorrow.t t_PA_T) (return (x'0: MutBorrow.t t_PA_T)) =
    {[@stop_split] [@expl:new 'x' type invariant] inv_refmut_PA_T x}
    any
    [ return (result: MutBorrow.t t_PA_T) ->
    {[@stop_split] [@expl:new_refmut_PA_T ensures] ([@stop_split] [@expl:new result type invariant] inv_Ghost_refmut_PA_T result)
      /\ ([@stop_split] [@expl:new ensures] result = x)}
      (! return {result}) ]
  
  type t_Id
  
  let rec clone_Rc_PermCell_Inner_T_Global (self_: t_Rc_PermCell_Inner_T_Global)
    (return (x: t_Rc_PermCell_Inner_T_Global)) =
    {[@stop_split] [@expl:clone 'self_' type invariant] inv_ref_Rc_PermCell_Inner_T_Global self_}
    any
    [ return (result: t_Rc_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:clone_Rc_PermCell_Inner_T_Global ensures] ([@stop_split] [@expl:clone result type invariant] inv_Rc_PermCell_Inner_T_Global result)
      /\ ([@stop_split] [@expl:clone ensures] result = self_)}
      (! return {result}) ]
  
  predicate invariant_refmut_Rc_PermCell_Inner_T_Global [@inline:trivial] (self: MutBorrow.t t_Rc_PermCell_Inner_T_Global) =
    inv_Rc_PermCell_Inner_T_Global self.current /\ inv_Rc_PermCell_Inner_T_Global self.final
  
  meta "rewrite_def" predicate invariant_refmut_Rc_PermCell_Inner_T_Global
  
  predicate inv_refmut_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: MutBorrow.t t_Rc_PermCell_Inner_T_Global) =
    invariant_refmut_Rc_PermCell_Inner_T_Global _1
  
  meta "rewrite_def" predicate inv_refmut_Rc_PermCell_Inner_T_Global
  
  let rec replace_Rc_PermCell_Inner_T_Global (dest: MutBorrow.t t_Rc_PermCell_Inner_T_Global)
    (src: t_Rc_PermCell_Inner_T_Global) (return (x: t_Rc_PermCell_Inner_T_Global)) =
    {[@stop_split] [@expl:replace_Rc_PermCell_Inner_T_Global requires] ([@stop_split] [@expl:replace 'dest' type invariant] inv_refmut_Rc_PermCell_Inner_T_Global dest)
    /\ ([@stop_split] [@expl:replace 'src' type invariant] inv_Rc_PermCell_Inner_T_Global src)}
    any
    [ return (result: t_Rc_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:replace_Rc_PermCell_Inner_T_Global ensures] ([@stop_split] [@expl:replace result type invariant] inv_Rc_PermCell_Inner_T_Global result)
      /\ ([@stop_split] [@expl:replace ensures #0] dest.final = src)
      /\ ([@stop_split] [@expl:replace ensures #1] result = dest.current)}
      (! return {result}) ]
  
  predicate resolve_refmut_Rc_PermCell_Inner_T_Global [@inline:trivial] (_1: MutBorrow.t t_Rc_PermCell_Inner_T_Global) =
    _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Rc_PermCell_Inner_T_Global
  
  type t_Option_refmut_Box_Perm_PermCell_Inner_T_Global = None'0 | Some'0 (MutBorrow.t t_Perm_PermCell_Inner_T)
  
  predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool [@inline:trivial] (self: Map.map t_Perm_PermCell_Inner_T bool) (a: t_Perm_PermCell_Inner_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool
  
  function such_that_Box_Perm_PermCell_Inner_T_Global (p: Map.map t_Perm_PermCell_Inner_T bool) : t_Perm_PermCell_Inner_T
  
  axiom such_that_Box_Perm_PermCell_Inner_T_Global_spec:
    forall p: Map.map t_Perm_PermCell_Inner_T bool. (exists x: t_Perm_PermCell_Inner_T. index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p x)
      -> index_Mapping_Box_Perm_PermCell_Inner_T_Global_bool p (such_that_Box_Perm_PermCell_Inner_T_Global p)
  
  function unwrap_Option_Box_Perm_PermCell_Inner_T_Global (self: t_Option_Box_Perm_PermCell_Inner_T_Global) : t_Perm_PermCell_Inner_T
   = match self with
      | Some x -> x
      | None -> such_that_Box_Perm_PermCell_Inner_T_Global (fun (__0: t_Perm_PermCell_Inner_T) -> true)
      end
  
  function lookup_Snapshot_PermCell_Inner_T [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (k: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = unwrap_Option_Box_Perm_PermCell_Inner_T_Global (get_Snapshot_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_Snapshot_PermCell_Inner_T
  
  function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global [@inline:trivial] (self: t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T) : t_Perm_PermCell_Inner_T
   = lookup_Snapshot_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global
  
  let rec get_mut_ghost_Snapshot_PermCell_Inner_T
    (self: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) (key: t_PermCell_Inner_T)
    (return (x: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global)) = any
    [ return (result: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global) ->
    {[@stop_split] [@expl:get_mut_ghost_Snapshot_PermCell_Inner_T ensures] ([@stop_split] [@expl:get_mut_ghost ensures #0] if contains_Snapshot_PermCell_Inner_T self.current key then
          match result with
            | None'0 -> false
            | Some'0 r -> contains_Snapshot_PermCell_Inner_T self.final key
            /\ index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.current key = r.current
            /\ index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.final key = r.final
            end
        else
          result = None'0 /\ self.current = self.final
        )
      /\ ([@stop_split] [@expl:get_mut_ghost ensures #1] forall k: t_PermCell_Inner_T. k <> key
          -> get_Snapshot_PermCell_Inner_T self.current k = get_Snapshot_PermCell_Inner_T self.final k)
      /\ ([@stop_split] [@expl:get_mut_ghost ensures #2] len_Snapshot_PermCell_Inner_T self.current
      = len_Snapshot_PermCell_Inner_T self.final)}
      (! return {result}) ]
  
  let rec unwrap_refmut_Box_Perm_PermCell_Inner_T_Global (self_: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global)
    (return (x: MutBorrow.t t_Perm_PermCell_Inner_T)) = {[@stop_split] [@expl:unwrap requires] self_ <> None'0}
    any
    [ return (result: MutBorrow.t t_Perm_PermCell_Inner_T) -> {[@stop_split] [@expl:unwrap ensures] Some'0 result
      = self_}
      (! return {result}) ]
  
  predicate resolve_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate resolve_refmut_usize [@inline:trivial] (_1: MutBorrow.t UInt64.t) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_usize
  
  predicate invariant_refmut_T [@inline:trivial] (self: MutBorrow.t t_T) = inv_T self.current /\ inv_T self.final
  
  meta "rewrite_def" predicate invariant_refmut_T
  
  predicate inv_refmut_T [@inline:trivial] (_1: MutBorrow.t t_T) = invariant_refmut_T _1
  
  meta "rewrite_def" predicate inv_refmut_T
  
  predicate resolve_refmut_T [@inline:trivial] (_1: MutBorrow.t t_T) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_T
  
  let rec elim_Direct (_x: t_Inner_T) (return (f0: t_Vec_T_Global)) = any
    [ _k (f0: t_Vec_T_Global) -> {Direct f0 = _x} (! return {f0})
    | _chk -> (! {[@expl:elim Direct] match _x with
        | Direct _ -> true
        | _ -> false
        end}
      any) ]
  
  predicate invariant_refmut_Vec_T_Global [@inline:trivial] (self: MutBorrow.t t_Vec_T_Global) =
    inv_Vec_T_Global self.current /\ inv_Vec_T_Global self.final
  
  meta "rewrite_def" predicate invariant_refmut_Vec_T_Global
  
  predicate inv_refmut_Vec_T_Global [@inline:trivial] (_1: MutBorrow.t t_Vec_T_Global) =
    invariant_refmut_Vec_T_Global _1
  
  meta "rewrite_def" predicate inv_refmut_Vec_T_Global
  
  predicate in_bounds_usize [@inline:trivial] (self: UInt64.t) (seq: Seq.seq t_T) = UInt64.t'int self < Seq.length seq
  
  meta "rewrite_def" predicate in_bounds_usize
  
  predicate has_value_usize [@inline:trivial] (self: UInt64.t) (seq: Seq.seq t_T) (out: t_T) =
    Seq.get seq (UInt64.t'int self) = out
  
  meta "rewrite_def" predicate has_value_usize
  
  predicate resolve_elswhere_usize [@inline:trivial] (self: UInt64.t) (old': Seq.seq t_T) (fin: Seq.seq t_T) =
    forall i: int. 0 <= i /\ i <> UInt64.t'int self /\ i < Seq.length old' -> Seq.get old' i = Seq.get fin i
  
  meta "rewrite_def" predicate resolve_elswhere_usize
  
  let rec index_mut_Vec_T_Global (self_: MutBorrow.t t_Vec_T_Global) (ix: UInt64.t) (return (x: MutBorrow.t t_T)) =
    {[@stop_split] [@expl:index_mut_Vec_T_Global requires] ([@stop_split] [@expl:index_mut 'self_' type invariant] inv_refmut_Vec_T_Global self_)
    /\ ([@stop_split] [@expl:index_mut requires] in_bounds_usize ix (view_Vec_T_Global self_.current))}
    any
    [ return (result: MutBorrow.t t_T) ->
    {[@stop_split] [@expl:index_mut_Vec_T_Global ensures] ([@stop_split] [@expl:index_mut result type invariant] inv_refmut_T result)
      /\ ([@stop_split] [@expl:index_mut ensures #0] has_value_usize ix (view_Vec_T_Global self_.current) result.current)
      /\ ([@stop_split] [@expl:index_mut ensures #1] has_value_usize ix (view_Vec_T_Global self_.final) result.final)
      /\ ([@stop_split] [@expl:index_mut ensures #2] resolve_elswhere_usize ix (view_Vec_T_Global self_.current) (view_Vec_T_Global self_.final))
      /\ ([@stop_split] [@expl:index_mut ensures #3] Seq.length (view_Vec_T_Global self_.final)
      = Seq.length (view_Vec_T_Global self_.current))}
      (! return {result}) ]
  
  let rec swap_T (x: MutBorrow.t t_T) (y: MutBorrow.t t_T) (return (x'0: ())) =
    {[@stop_split] [@expl:swap_T requires] ([@stop_split] [@expl:swap 'x' type invariant] inv_refmut_T x)
    /\ ([@stop_split] [@expl:swap 'y' type invariant] inv_refmut_T y)}
    any
    [ return (result: ()) -> {[@stop_split] [@expl:swap_T ensures] ([@stop_split] [@expl:swap ensures #0] x.final
        = y.current)
      /\ ([@stop_split] [@expl:swap ensures #1] y.final = x.current)}
      (! return {result}) ]
  
  predicate resolve_refmut_Vec_T_Global [@inline:trivial] (_1: MutBorrow.t t_Vec_T_Global) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Vec_T_Global
  
  let rec swap_Inner_T (x: MutBorrow.t t_Inner_T) (y: MutBorrow.t t_Inner_T) (return (x'0: ())) =
    {[@stop_split] [@expl:swap_Inner_T requires] ([@stop_split] [@expl:swap 'x' type invariant] inv_refmut_Inner_T x)
    /\ ([@stop_split] [@expl:swap 'y' type invariant] inv_refmut_Inner_T y)}
    any
    [ return (result: ()) -> {[@stop_split] [@expl:swap_Inner_T ensures] ([@stop_split] [@expl:swap ensures #0] x.final
        = y.current)
      /\ ([@stop_split] [@expl:swap ensures #1] y.final = x.current)}
      (! return {result}) ]
  
  let rec new_unit (x: ()) (return (x'0: ())) = any
    [ return (result: ()) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Ag_Seq_T = { f0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None'1 | Some'1 t_Ag_Seq_T
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  predicate contains_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) =
    get_PermCell_Inner_T self k <> None'1
  
  meta "rewrite_def" predicate contains_PermCell_Inner_T
  
  function view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Authority_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some'1 x -> x
      | None'1 -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function lookup_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Ag_Seq_T
   = unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T self k)
  
  meta "rewrite_def" function lookup_PermCell_Inner_T
  
  function index_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (key: t_PermCell_Inner_T) : t_Ag_Seq_T
   = lookup_PermCell_Inner_T self key
  
  meta "rewrite_def" function index_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function index_Mapping_PermCell_Inner_T_Int [@inline:trivial] (self: Map.map t_PermCell_Inner_T int) (a: t_PermCell_Inner_T) : int
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_PermCell_Inner_T_Int
  
  predicate partial_invariant_T [@inline:trivial] (self: t_PA_T) (id: t_Id) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.auth = id
    /\ (forall pc: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc
        /\ contains_Snapshot_PermCell_Inner_T self.perms pc
      -> ward_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc)
        = pc
      /\ match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global self.perms pc) with
        | Direct v -> (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0
        = view_Vec_T_Global v
        | Link index value next -> contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)
        /\ index_Mapping_PermCell_Inner_T_Int self.depth pc
          > index_Mapping_PermCell_Inner_T_Int self.depth (view_Rc_PermCell_Inner_T_Global next)
        /\ UInt64.t'int index
          < Seq.length (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0
        /\ (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) pc).f0
        = Seq.set (index_FMap_PermCell_Inner_T_Ag_Seq_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T self.auth) (view_Rc_PermCell_Inner_T_Global next)).f0 (UInt64.t'int index) value
        end)
  
  meta "rewrite_def" predicate partial_invariant_T
  
  function fin_Ghost_refmut_PA_T [@inline:trivial] (self: MutBorrow.t t_PA_T) : t_PA_T = self.final
  
  meta "rewrite_def" function fin_Ghost_refmut_PA_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec reroot_T (cur: t_Rc_PermCell_Inner_T_Global) (auth_id: t_Id) (pa: MutBorrow.t t_PA_T) (return (x: ())) =
    {[@stop_split] [@expl:reroot_T requires] ([@stop_split] [@expl:reroot 'cur' type invariant] inv_ref_Rc_PermCell_Inner_T_Global cur)
    /\ ([@stop_split] [@expl:reroot 'pa' type invariant] inv_Ghost_refmut_PA_T pa)
    /\ ([@stop_split] [@expl:reroot requires #0] partial_invariant_T pa.current auth_id)
    /\ ([@stop_split] [@expl:reroot requires #1] contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.current.auth) (view_Rc_PermCell_Inner_T_Global cur))
    /\ ([@stop_split] [@expl:reroot requires #2] forall id: t_PermCell_Inner_T. contains_PermCell_Inner_T (view_Authority_FMap_PermCell_Inner_T_Ag_Seq_T pa.current.auth) id
        /\ index_Mapping_PermCell_Inner_T_Int pa.current.depth id
        <= index_Mapping_PermCell_Inner_T_Int pa.current.depth (view_Rc_PermCell_Inner_T_Global cur)
      -> contains_Snapshot_PermCell_Inner_T pa.current.perms id)}
    (! bb0
    [ bb0 = s0
      [ s0 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_31 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s1) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s1 = deref_mut_Ghost_refmut_PA_T {_31} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_30 <- _x ] s2)
      | s2 = [ &_33 <- view_Rc_PermCell_Inner_T_Global cur ] s3
      | s3 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global>
          {_30.current.current.perms}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_29 <- _bor ]
            [ &_30 <- { _30 with current = { _30.current with current = { _30.current.current with perms = _bor.final } } } ]
            s4)
      | s4 = remove_ghost_Snapshot_PermCell_Inner_T {_29} {_33}
          (fun (_x: t_Option_Box_Perm_PermCell_Inner_T_Global) -> [ &_28 <- _x ] s5)
      | s5 = s6 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _30} any) ]
      | s6 = -{resolve_refmut_refmut_PA_T _30}- s7
      | s7 = unwrap_Box_Perm_PermCell_Inner_T_Global {_28} (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_27 <- _x ] s8)
      | s8 = new_Box_Perm_PermCell_Inner_T_Global {_27} (fun (_x: t_Perm_PermCell_Inner_T) -> [ &perm_cur <- _x ] s9)
      | s9 = deref_Rc_PermCell_Inner_T_Global {cur} (fun (_x: t_PermCell_Inner_T) -> [ &_40 <- _x ] s10)
      | s10 = MutBorrow.borrow_mut <t_Perm_PermCell_Inner_T> {perm_cur}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) -> [ &_48 <- _bor ] [ &perm_cur <- _bor.final ] s11)
      | s11 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_48.current} {MutBorrow.get_id _48}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_47 <- _bor ] [ &_48 <- { _48 with current = _bor.final } ] s12)
      | s12 = deref_mut_Ghost_Box_Perm_PermCell_Inner_T_Global {_47}
          (fun (_x: MutBorrow.t t_Perm_PermCell_Inner_T) -> [ &_46 <- _x ] s13)
      | s13 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_46.current} {MutBorrow.get_id _46}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_45 <- _bor ] [ &_46 <- { _46 with current = _bor.final } ] s14)
      | s14 = -{resolve_refmut_Ghost_Box_Perm_PermCell_Inner_T_Global _48}- s15
      | s15 = -{resolve_refmut_Box_Perm_PermCell_Inner_T_Global _46}- s16
      | s16 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_45.current} {MutBorrow.get_id _45}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_44 <- _bor ] [ &_45 <- { _45 with current = _bor.final } ] s17)
      | s17 = -{resolve_refmut_Perm_PermCell_Inner_T _45}- s18
      | s18 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_44.current} {MutBorrow.get_id _44}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_43 <- _bor ] [ &_44 <- { _44 with current = _bor.final } ] s19)
      | s19 = new_refmut_Perm_PermCell_Inner_T {_43}
          (fun (_x: MutBorrow.t t_Perm_PermCell_Inner_T) -> [ &_42 <- _x ] s20)
      | s20 = -{resolve_refmut_Perm_PermCell_Inner_T _44}- s21
      | s21 = borrow_mut_Inner_T {_40} {_42} (fun (_x: MutBorrow.t t_Inner_T) -> [ &_38 <- _x ] s22)
      | s22 = MutBorrow.borrow_final <t_Inner_T> {_38.current} {MutBorrow.get_id _38}
          (fun (_bor: MutBorrow.t t_Inner_T) ->
            [ &bor_cur <- _bor ] -{inv_Inner_T _bor.final}-
            [ &_38 <- { _38 with current = _bor.final } ] s23)
        [ _ck -> (! {[@expl:type invariant] inv_Inner_T _38.current} any) ]
      | s23 = s24 [ _ck -> (! {[@expl:type invariant] inv_refmut_Inner_T _38} any) ]
      | s24 = -{resolve_refmut_Inner_T _38}- s25
      | s25 = any
        [ br0 (x0: t_Vec_T_Global) -> {bor_cur.current = Direct x0} (! bb10)
        | br1 (x0: UInt64.t) (x1: t_T) (x2: t_Rc_PermCell_Inner_T_Global) -> {bor_cur.current = Link x0 x1 x2}
          (! bb17) ] ]
    | bb10 = s0
      [ s0 = s1 [ _ck -> (! {[@expl:type invariant] inv_refmut_Inner_T bor_cur} any) ]
      | s1 = -{resolve_refmut_Inner_T bor_cur}- s2
      | s2 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_54 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s3) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s3 = deref_mut_Ghost_refmut_PA_T {_54} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_53 <- _x ] s4)
      | s4 = into_inner_Box_Perm_PermCell_Inner_T_Global {perm_cur}
          (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_58 <- _x ] s5)
      | s5 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global>
          {_53.current.current.perms}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_52 <- _bor ]
            [ &_53 <- { _53 with current = { _53.current with current = { _53.current.current with perms = _bor.final } } } ]
            s6)
      | s6 = insert_ghost_Snapshot_PermCell_Inner_T {_52} {view_Rc_PermCell_Inner_T_Global cur} {_58}
          (fun (_x: t_Option_Box_Perm_PermCell_Inner_T_Global) -> [ &_51 <- _x ] s7)
      | s7 = s8 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _53} any) ]
      | s8 = -{resolve_refmut_refmut_PA_T _53}- s9
      | s9 = s10 [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s10 = -{resolve_Ghost_refmut_PA_T pa}- s11
      | s11 = new_Option_Box_Perm_PermCell_Inner_T_Global {_51}
          (fun (_x: t_Option_Box_Perm_PermCell_Inner_T_Global) -> [ &_50 <- _x ] s12)
      | s12 = -{resolve_Ghost_Option_Box_Perm_PermCell_Inner_T_Global _50}- s13
      | s13 = return {_ret} ]
    | bb17 = s0
      [ s0 = elim_Link {bor_cur.current}
          (fun (rindex: UInt64.t) (rvalue: t_T) (rnext: t_Rc_PermCell_Inner_T_Global) ->
            MutBorrow.borrow_mut <t_Rc_PermCell_Inner_T_Global> {rnext}
              (fun (_bor: MutBorrow.t t_Rc_PermCell_Inner_T_Global) ->
                [ &next <- _bor ] -{inv_Rc_PermCell_Inner_T_Global _bor.final}-
                [ &bor_cur <- { bor_cur with current = Link rindex rvalue _bor.final } ] s1)
            [ _ck -> (! {[@expl:type invariant] inv_Rc_PermCell_Inner_T_Global rnext} any) ])
      | s1 = elim_Link {bor_cur.current}
          (fun (rindex: UInt64.t) (rvalue: t_T) (rnext: t_Rc_PermCell_Inner_T_Global) ->
            MutBorrow.borrow_mut <t_T> {rvalue}
              (fun (_bor: MutBorrow.t t_T) ->
                [ &value <- _bor ] -{inv_T _bor.final}-
                [ &bor_cur <- { bor_cur with current = Link rindex _bor.final rnext } ] s2)
            [ _ck -> (! {[@expl:type invariant] inv_T rvalue} any) ])
      | s2 = elim_Link {bor_cur.current}
          (fun (rindex: UInt64.t) (rvalue: t_T) (rnext: t_Rc_PermCell_Inner_T_Global) ->
            MutBorrow.borrow_mut <UInt64.t> {rindex}
              (fun (_bor: MutBorrow.t UInt64.t) ->
                [ &index <- _bor ] [ &bor_cur <- { bor_cur with current = Link _bor.final rvalue rnext } ] s3))
      | s3 = [ &_66 <- next ] s4
      | s4 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_74 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s5) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s5 = deref_mut_Ghost_refmut_PA_T {_74} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_73 <- _x ] s6)
      | s6 = MutBorrow.borrow_final <MutBorrow.t t_PA_T> {_73.current} {MutBorrow.get_id _73}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_72 <- _bor ] -{inv_refmut_PA_T _bor.final}-
            [ &_73 <- { _73 with current = _bor.final } ] s7)
        [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _73.current} any) ]
      | s7 = MutBorrow.borrow_mut <t_PA_T> {_72.current.current}
          (fun (_bor: MutBorrow.t t_PA_T) ->
            [ &_71 <- _bor ] -{inv_PA_T _bor.final}-
            [ &_72 <- { _72 with current = { _72.current with current = _bor.final } } ] s8)
        [ _ck -> (! {[@expl:type invariant] inv_PA_T _72.current.current} any) ]
      | s8 = s9 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _73} any) ]
      | s9 = -{resolve_refmut_refmut_PA_T _73}- s10
      | s10 = s11 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _72} any) ]
      | s11 = -{resolve_refmut_refmut_PA_T _72}- s12
      | s12 = MutBorrow.borrow_final <t_PA_T> {_71.current} {MutBorrow.get_id _71}
          (fun (_bor: MutBorrow.t t_PA_T) ->
            [ &_70 <- _bor ] -{inv_PA_T _bor.final}-
            [ &_71 <- { _71 with current = _bor.final } ] s13)
        [ _ck -> (! {[@expl:type invariant] inv_PA_T _71.current} any) ]
      | s13 = s14 [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _71} any) ]
      | s14 = -{resolve_refmut_PA_T _71}- s15
      | s15 = MutBorrow.borrow_final <t_PA_T> {_70.current} {MutBorrow.get_id _70}
          (fun (_bor: MutBorrow.t t_PA_T) ->
            [ &_69 <- _bor ] -{inv_PA_T _bor.final}-
            [ &_70 <- { _70 with current = _bor.final } ] s16)
        [ _ck -> (! {[@expl:type invariant] inv_PA_T _70.current} any) ]
      | s16 = new_refmut_PA_T {_69} (fun (_x: MutBorrow.t t_PA_T) -> [ &_68 <- _x ] s17)
      | s17 = s18 [ _ck -> (! {[@expl:type invariant] inv_refmut_PA_T _70} any) ]
      | s18 = -{resolve_refmut_PA_T _70}- s19
      | s19 = reroot_T {_66.current} {auth_id} {_68} (fun (_x: ()) -> [ &_64 <- _x ] s20)
      | s20 = clone_Rc_PermCell_Inner_T_Global {cur} (fun (_x: t_Rc_PermCell_Inner_T_Global) -> [ &_77 <- _x ] s21)
      | s21 = MutBorrow.borrow_final <t_Rc_PermCell_Inner_T_Global> {next.current} {MutBorrow.get_id next}
          (fun (_bor: MutBorrow.t t_Rc_PermCell_Inner_T_Global) ->
            [ &_76 <- _bor ] -{inv_Rc_PermCell_Inner_T_Global _bor.final}-
            [ &next <- { next with current = _bor.final } ] s22)
        [ _ck -> (! {[@expl:type invariant] inv_Rc_PermCell_Inner_T_Global next.current} any) ]
      | s22 = replace_Rc_PermCell_Inner_T_Global {_76} {_77}
          (fun (_x: t_Rc_PermCell_Inner_T_Global) -> [ &next'0 <- _x ] s23)
      | s23 = s24 [ _ck -> (! {[@expl:type invariant] inv_refmut_Rc_PermCell_Inner_T_Global next} any) ]
      | s24 = -{resolve_refmut_Rc_PermCell_Inner_T_Global next}- s25
      | s25 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_87 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s26) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s26 = deref_mut_Ghost_refmut_PA_T {_87} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_86 <- _x ] s27)
      | s27 = [ &_89 <- view_Rc_PermCell_Inner_T_Global next'0 ] s28
      | s28 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global>
          {_86.current.current.perms}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_85 <- _bor ]
            [ &_86 <- { _86 with current = { _86.current with current = { _86.current.current with perms = _bor.final } } } ]
            s29)
      | s29 = get_mut_ghost_Snapshot_PermCell_Inner_T {_85} {_89}
          (fun (_x: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global) -> [ &_84 <- _x ] s30)
      | s30 = unwrap_refmut_Box_Perm_PermCell_Inner_T_Global {_84}
          (fun (_x: MutBorrow.t t_Perm_PermCell_Inner_T) -> [ &_83 <- _x ] s31)
      | s31 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_83.current} {MutBorrow.get_id _83}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_82 <- _bor ] [ &_83 <- { _83 with current = _bor.final } ] s32)
      | s32 = s33 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _86} any) ]
      | s33 = -{resolve_refmut_refmut_PA_T _86}- s34
      | s34 = -{resolve_refmut_Box_Perm_PermCell_Inner_T_Global _83}- s35
      | s35 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_82.current} {MutBorrow.get_id _82}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_81 <- _bor ] [ &_82 <- { _82 with current = _bor.final } ] s36)
      | s36 = -{resolve_refmut_Perm_PermCell_Inner_T _82}- s37
      | s37 = MutBorrow.borrow_final <t_Perm_PermCell_Inner_T> {_81.current} {MutBorrow.get_id _81}
          (fun (_bor: MutBorrow.t t_Perm_PermCell_Inner_T) ->
            [ &_80 <- _bor ] [ &_81 <- { _81 with current = _bor.final } ] s38)
      | s38 = new_refmut_Perm_PermCell_Inner_T {_80}
          (fun (_x: MutBorrow.t t_Perm_PermCell_Inner_T) -> [ &perm_next <- _x ] s39)
      | s39 = -{resolve_refmut_Perm_PermCell_Inner_T _81}- s40
      | s40 = s41 [ _ck -> (! {[@expl:type invariant] inv_Rc_PermCell_Inner_T_Global next'0} any) ]
      | s41 = -{resolve_Rc_PermCell_Inner_T_Global next'0}- s42
      | s42 = deref_Rc_PermCell_Inner_T_Global {next'0} (fun (_x: t_PermCell_Inner_T) -> [ &_96 <- _x ] s43)
      | s43 = borrow_mut_Inner_T {_96} {perm_next} (fun (_x: MutBorrow.t t_Inner_T) -> [ &_94 <- _x ] s44)
      | s44 = MutBorrow.borrow_final <t_Inner_T> {_94.current} {MutBorrow.get_id _94}
          (fun (_bor: MutBorrow.t t_Inner_T) ->
            [ &bor_next <- _bor ] -{inv_Inner_T _bor.final}-
            [ &_94 <- { _94 with current = _bor.final } ] s45)
        [ _ck -> (! {[@expl:type invariant] inv_Inner_T _94.current} any) ]
      | s45 = s46 [ _ck -> (! {[@expl:type invariant] inv_refmut_Inner_T _94} any) ]
      | s46 = -{resolve_refmut_Inner_T _94}- s47
      | s47 = any
        [ br0 (x0: t_Vec_T_Global) -> {bor_next.current = Direct x0} (! bb32)
        | br1 (x0: UInt64.t) (x1: t_T) (x2: t_Rc_PermCell_Inner_T_Global) -> {bor_next.current = Link x0 x1 x2}
          (! bb30) ] ]
    | bb30 = s0
      [ s0 = s1 [ _ck -> (! {[@expl:type invariant] inv_refmut_Inner_T bor_next} any) ]
      | s1 = -{resolve_refmut_Inner_T bor_next}- s2
      | s2 = -{resolve_refmut_usize index}- s3
      | s3 = s4 [ _ck -> (! {[@expl:type invariant] inv_refmut_T value} any) ]
      | s4 = -{resolve_refmut_T value}- s5
      | s5 = {false} any ]
    | bb32 = s0
      [ s0 = elim_Direct {bor_next.current}
          (fun (r0: t_Vec_T_Global) ->
            MutBorrow.borrow_mut <t_Vec_T_Global> {r0}
              (fun (_bor: MutBorrow.t t_Vec_T_Global) ->
                [ &arr <- _bor ] -{inv_Vec_T_Global _bor.final}-
                [ &bor_next <- { bor_next with current = Direct _bor.final } ] s1)
            [ _ck -> (! {[@expl:type invariant] inv_Vec_T_Global r0} any) ])
      | s1 = MutBorrow.borrow_final <t_Vec_T_Global> {arr.current} {MutBorrow.get_id arr}
          (fun (_bor: MutBorrow.t t_Vec_T_Global) ->
            [ &_106 <- _bor ] -{inv_Vec_T_Global _bor.final}-
            [ &arr <- { arr with current = _bor.final } ] s2)
        [ _ck -> (! {[@expl:type invariant] inv_Vec_T_Global arr.current} any) ]
      | s2 = -{resolve_refmut_usize index}- s3
      | s3 = index_mut_Vec_T_Global {_106} {index.current} (fun (_x: MutBorrow.t t_T) -> [ &_105 <- _x ] s4)
      | s4 = MutBorrow.borrow_final <t_T> {_105.current} {MutBorrow.get_id _105}
          (fun (_bor: MutBorrow.t t_T) ->
            [ &_104 <- _bor ] -{inv_T _bor.final}-
            [ &_105 <- { _105 with current = _bor.final } ] s5)
        [ _ck -> (! {[@expl:type invariant] inv_T _105.current} any) ]
      | s5 = MutBorrow.borrow_final <t_T> {_104.current} {MutBorrow.get_id _104}
          (fun (_bor: MutBorrow.t t_T) ->
            [ &_103 <- _bor ] -{inv_T _bor.final}-
            [ &_104 <- { _104 with current = _bor.final } ] s6)
        [ _ck -> (! {[@expl:type invariant] inv_T _104.current} any) ]
      | s6 = MutBorrow.borrow_final <t_T> {value.current} {MutBorrow.get_id value}
          (fun (_bor: MutBorrow.t t_T) ->
            [ &_108 <- _bor ] -{inv_T _bor.final}-
            [ &value <- { value with current = _bor.final } ] s7)
        [ _ck -> (! {[@expl:type invariant] inv_T value.current} any) ]
      | s7 = swap_T {_103} {_108} (fun (_x: ()) -> [ &_102 <- _x ] s8)
      | s8 = s9 [ _ck -> (! {[@expl:type invariant] inv_refmut_T _105} any) ]
      | s9 = -{resolve_refmut_T _105}- s10
      | s10 = s11 [ _ck -> (! {[@expl:type invariant] inv_refmut_T _104} any) ]
      | s11 = -{resolve_refmut_T _104}- s12
      | s12 = s13 [ _ck -> (! {[@expl:type invariant] inv_refmut_Vec_T_Global arr} any) ]
      | s13 = -{resolve_refmut_Vec_T_Global arr}- s14
      | s14 = s15 [ _ck -> (! {[@expl:type invariant] inv_refmut_T value} any) ]
      | s15 = -{resolve_refmut_T value}- s16
      | s16 = MutBorrow.borrow_final <t_Inner_T> {bor_next.current} {MutBorrow.get_id bor_next}
          (fun (_bor: MutBorrow.t t_Inner_T) ->
            [ &_110 <- _bor ] -{inv_Inner_T _bor.final}-
            [ &bor_next <- { bor_next with current = _bor.final } ] s17)
        [ _ck -> (! {[@expl:type invariant] inv_Inner_T bor_next.current} any) ]
      | s17 = MutBorrow.borrow_final <t_Inner_T> {bor_cur.current} {MutBorrow.get_id bor_cur}
          (fun (_bor: MutBorrow.t t_Inner_T) ->
            [ &_111 <- _bor ] -{inv_Inner_T _bor.final}-
            [ &bor_cur <- { bor_cur with current = _bor.final } ] s18)
        [ _ck -> (! {[@expl:type invariant] inv_Inner_T bor_cur.current} any) ]
      | s18 = swap_Inner_T {_110} {_111} (fun (_x: ()) -> [ &_109 <- _x ] s19)
      | s19 = s20 [ _ck -> (! {[@expl:type invariant] inv_refmut_Inner_T bor_next} any) ]
      | s20 = -{resolve_refmut_Inner_T bor_next}- s21
      | s21 = s22 [ _ck -> (! {[@expl:type invariant] inv_refmut_Inner_T bor_cur} any) ]
      | s22 = -{resolve_refmut_Inner_T bor_cur}- s23
      | s23 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_117 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s24) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s24 = deref_mut_Ghost_refmut_PA_T {_117} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_116 <- _x ] s25)
      | s25 = into_inner_Box_Perm_PermCell_Inner_T_Global {perm_cur}
          (fun (_x: t_Perm_PermCell_Inner_T) -> [ &_121 <- _x ] s26)
      | s26 = MutBorrow.borrow_mut <t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global>
          {_116.current.current.perms}
          (fun (_bor: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global) ->
            [ &_115 <- _bor ]
            [ &_116 <- { _116 with current = { _116.current with current = { _116.current.current with perms = _bor.final } } } ]
            s27)
      | s27 = insert_ghost_Snapshot_PermCell_Inner_T {_115} {view_Rc_PermCell_Inner_T_Global cur} {_121}
          (fun (_x: t_Option_Box_Perm_PermCell_Inner_T_Global) -> [ &_114 <- _x ] s28)
      | s28 = -{resolve_Option_Box_Perm_PermCell_Inner_T_Global _114}- s29
      | s29 = s30 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _116} any) ]
      | s30 = -{resolve_refmut_refmut_PA_T _116}- s31
      | s31 =
        [ &new_d <- MinMax.min (Map.get pa.current.depth (view_Rc_PermCell_Inner_T_Global cur)) (Map.get pa.current.depth (view_Rc_PermCell_Inner_T_Global next'0)
        - 1) ] s32
      | s32 = [ &_128 <- Map.set pa.current.depth (view_Rc_PermCell_Inner_T_Global cur) new_d ] s33
      | s33 = MutBorrow.borrow_mut <MutBorrow.t t_PA_T> {pa}
          (fun (_bor: MutBorrow.t (MutBorrow.t t_PA_T)) ->
            [ &_134 <- _bor ] -{inv_Ghost_refmut_PA_T _bor.final}-
            [ &pa <- _bor.final ] s34) [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s34 = deref_mut_Ghost_refmut_PA_T {_134} (fun (_x: MutBorrow.t (MutBorrow.t t_PA_T)) -> [ &_133 <- _x ] s35)
      | s35 =
        [ &_133 <- { _133 with current = { _133.current with current = { _133.current.current with depth = _128 } } } ]
        s36
      | s36 = s37 [ _ck -> (! {[@expl:type invariant] inv_refmut_refmut_PA_T _133} any) ]
      | s37 = -{resolve_refmut_refmut_PA_T _133}- s38
      | s38 = s39 [ _ck -> (! {[@expl:type invariant] inv_Ghost_refmut_PA_T pa} any) ]
      | s39 = -{resolve_Ghost_refmut_PA_T pa}- s40
      | s40 = new_unit {_113} (fun (_x: ()) -> [ &_112 <- _x ] s41)
      | s41 = return {_ret} ] ]
    [ & _ret: () = Any.any_l ()
    | & cur: t_Rc_PermCell_Inner_T_Global = cur
    | & auth_id: t_Id = auth_id
    | & pa: MutBorrow.t t_PA_T = pa
    | & perm_cur: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _27: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _28: t_Option_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _29: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _30: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _31: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _33: t_PermCell_Inner_T = Any.any_l ()
    | & bor_cur: MutBorrow.t t_Inner_T = Any.any_l ()
    | & _38: MutBorrow.t t_Inner_T = Any.any_l ()
    | & _40: t_PermCell_Inner_T = Any.any_l ()
    | & _42: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _43: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _44: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _45: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _46: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _47: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _48: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _50: t_Option_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _51: t_Option_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _52: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _53: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _54: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _58: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & next: MutBorrow.t t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & value: MutBorrow.t t_T = Any.any_l ()
    | & index: MutBorrow.t UInt64.t = Any.any_l ()
    | & _64: () = Any.any_l ()
    | & _66: MutBorrow.t t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _68: MutBorrow.t t_PA_T = Any.any_l ()
    | & _69: MutBorrow.t t_PA_T = Any.any_l ()
    | & _70: MutBorrow.t t_PA_T = Any.any_l ()
    | & _71: MutBorrow.t t_PA_T = Any.any_l ()
    | & _72: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _73: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _74: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & next'0: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _76: MutBorrow.t t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & _77: t_Rc_PermCell_Inner_T_Global = Any.any_l ()
    | & perm_next: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _80: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _81: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _82: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _83: MutBorrow.t t_Perm_PermCell_Inner_T = Any.any_l ()
    | & _84: t_Option_refmut_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _85: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _86: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _87: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _89: t_PermCell_Inner_T = Any.any_l ()
    | & bor_next: MutBorrow.t t_Inner_T = Any.any_l ()
    | & _94: MutBorrow.t t_Inner_T = Any.any_l ()
    | & _96: t_PermCell_Inner_T = Any.any_l ()
    | & arr: MutBorrow.t t_Vec_T_Global = Any.any_l ()
    | & _102: () = Any.any_l ()
    | & _103: MutBorrow.t t_T = Any.any_l ()
    | & _104: MutBorrow.t t_T = Any.any_l ()
    | & _105: MutBorrow.t t_T = Any.any_l ()
    | & _106: MutBorrow.t t_Vec_T_Global = Any.any_l ()
    | & _108: MutBorrow.t t_T = Any.any_l ()
    | & _109: () = Any.any_l ()
    | & _110: MutBorrow.t t_Inner_T = Any.any_l ()
    | & _111: MutBorrow.t t_Inner_T = Any.any_l ()
    | & _112: () = Any.any_l ()
    | & _113: () = Any.any_l ()
    | & _114: t_Option_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _115: MutBorrow.t t_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global = Any.any_l ()
    | & _116: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _117: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _121: t_Perm_PermCell_Inner_T = Any.any_l ()
    | & new_d: int = Any.any_l ()
    | & _128: Map.map t_PermCell_Inner_T int = Any.any_l ()
    | & _133: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l ()
    | & _134: MutBorrow.t (MutBorrow.t t_PA_T) = Any.any_l () ])
    [ return (result: ()) ->
    {[@stop_split] [@expl:reroot_T ensures] ([@stop_split] [@expl:reroot ensures #0] partial_invariant_T (fin_Ghost_refmut_PA_T pa) auth_id)
      /\ ([@stop_split] [@expl:reroot ensures #1] (fin_Ghost_refmut_PA_T pa).auth = pa.current.auth)
      /\ ([@stop_split] [@expl:reroot ensures #2] forall id: t_PermCell_Inner_T. index_Mapping_PermCell_Inner_T_Int pa.current.depth id
            > index_Mapping_PermCell_Inner_T_Int pa.current.depth (view_Rc_PermCell_Inner_T_Global cur)
          -> get_Snapshot_PermCell_Inner_T pa.current.perms id
            = get_Snapshot_PermCell_Inner_T (fin_Ghost_refmut_PA_T pa).perms id
          /\ index_Mapping_PermCell_Inner_T_Int pa.current.depth id
          = index_Mapping_PermCell_Inner_T_Int (fin_Ghost_refmut_PA_T pa).depth id)
      /\ ([@stop_split] [@expl:reroot ensures #3] forall id: t_PermCell_Inner_T. contains_Snapshot_PermCell_Inner_T (fin_Ghost_refmut_PA_T pa).perms id
          = contains_Snapshot_PermCell_Inner_T pa.current.perms id)
      /\ ([@stop_split] [@expl:reroot ensures #4] match val_PermCell_Inner_T (index_FMap_Snapshot_PermCell_Inner_T_Box_Perm_PermCell_Inner_T_Global (fin_Ghost_refmut_PA_T pa).perms (view_Rc_PermCell_Inner_T_Global cur)) with
        | Direct _ -> true
        | Link _ _ _ -> false
        end)}
      (! return {result}) ]
end
module M_testing
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use creusot.slice.Slice64
  use creusot.int.Int32
  use seq.Seq
  use creusot.int.UInt64
  use creusot.prelude.MutBorrow
  use set.Set
  use creusot.prelude.Any
  use int.Int
  
  type t_Vec_i32_Global
  
  constant const_MAX: UInt64.t = (18446744073709551615: UInt64.t)
  
  function view_Vec_i32_Global (self: t_Vec_i32_Global) : Seq.seq Int32.t
  
  axiom view_Vec_i32_Global_spec: forall self: t_Vec_i32_Global. Seq.length (view_Vec_i32_Global self)
      <= UInt64.t'int const_MAX
  
  function view_Box_slice_i32_Global [@inline:trivial] (self: Slice64.slice Int32.t) : Seq.seq Int32.t =
    Slice64.view self
  
  meta "rewrite_def" function view_Box_slice_i32_Global
  
  let rec into_vec_i32 (self_: Slice64.slice Int32.t) (return (x: t_Vec_i32_Global)) = any
    [ return (result: t_Vec_i32_Global) -> {[@stop_split] [@expl:into_vec ensures] view_Vec_i32_Global result
      = view_Box_slice_i32_Global self_}
      (! return {result}) ]
  
  type t_PersistentArray_i32
  
  predicate invariant_PersistentArray_i32 (self: t_PersistentArray_i32)
  
  predicate inv_PersistentArray_i32 (_1: t_PersistentArray_i32)
  
  axiom inv_axiom: forall x: t_PersistentArray_i32 [inv_PersistentArray_i32 x]. inv_PersistentArray_i32 x
      -> invariant_PersistentArray_i32 x
  
  function view_PersistentArray_i32 (self: t_PersistentArray_i32) : Seq.seq Int32.t
  
  let rec new_i32 (v: t_Vec_i32_Global) (return (x: t_PersistentArray_i32)) = any
    [ return (result: t_PersistentArray_i32) ->
    {[@stop_split] [@expl:new_i32 ensures] ([@stop_split] [@expl:new result type invariant] inv_PersistentArray_i32 result)
      /\ ([@stop_split] [@expl:new ensures] view_PersistentArray_i32 result = view_Vec_i32_Global v)}
      (! return {result}) ]
  
  type t_Tokens
  
  let rec deref_mut_Ghost_Tokens (self: MutBorrow.t t_Tokens) (return (x: MutBorrow.t t_Tokens)) = any
    [ return (result: MutBorrow.t t_Tokens) -> {[@stop_split] [@expl:deref_mut ensures] result = self}
      (! return {result}) ]
  
  let rec reborrow (self: MutBorrow.t t_Tokens) (return (x: t_Tokens)) = any
    [ return (result: t_Tokens) -> {[@stop_split] [@expl:reborrow ensures] result = self.current
      /\ self.final = self.current}
      (! return {result}) ]
  
  predicate resolve_refmut_Tokens [@inline:trivial] (_1: MutBorrow.t t_Tokens) = _1.final = _1.current
  
  meta "rewrite_def" predicate resolve_refmut_Tokens
  
  let rec new_Tokens (x: t_Tokens) (return (x'0: t_Tokens)) = any
    [ return (result: t_Tokens) -> {[@stop_split] [@expl:new ensures] result = x} (! return {result}) ]
  
  predicate invariant_ref_PersistentArray_i32 [@inline:trivial] (self: t_PersistentArray_i32) =
    inv_PersistentArray_i32 self
  
  meta "rewrite_def" predicate invariant_ref_PersistentArray_i32
  
  predicate inv_ref_PersistentArray_i32 [@inline:trivial] (_1: t_PersistentArray_i32) =
    invariant_ref_PersistentArray_i32 _1
  
  meta "rewrite_def" predicate inv_ref_PersistentArray_i32
  
  predicate contains_Namespace [@inline:trivial] (self: Set.set t_Namespace) (e: t_Namespace) = Set.mem e self
  
  meta "rewrite_def" predicate contains_Namespace
  
  function namespaces (self: t_Tokens) : Set.set t_Namespace
  
  predicate contains (self: t_Tokens) (namespace: t_Namespace) = contains_Namespace (namespaces self) namespace
  
  let rec set_i32 (self: t_PersistentArray_i32) (index: UInt64.t) (value: Int32.t) (tokens: t_Tokens)
    (return (x: t_PersistentArray_i32)) =
    {[@stop_split] [@expl:set_i32 requires] ([@stop_split] [@expl:set 'self' type invariant] inv_ref_PersistentArray_i32 self)
    /\ ([@stop_split] [@expl:set requires #0] UInt64.t'int index < Seq.length (view_PersistentArray_i32 self))
    /\ ([@stop_split] [@expl:set requires #1] contains tokens (Namespace_PARRAY 0))}
    any
    [ return (result: t_PersistentArray_i32) ->
    {[@stop_split] [@expl:set_i32 ensures] ([@stop_split] [@expl:set result type invariant] inv_PersistentArray_i32 result)
      /\ ([@stop_split] [@expl:set ensures] view_PersistentArray_i32 result
      = Seq.set (view_PersistentArray_i32 self) (UInt64.t'int index) value)}
      (! return {result}) ]
  
  predicate resolve_PersistentArray_i32 (_1: t_PersistentArray_i32)
  
  predicate resolve_Tokens (_1: t_Tokens)
  
  predicate resolve_Ghost_Tokens [@inline:trivial] (_1: t_Tokens) = resolve_Tokens _1
  
  meta "rewrite_def" predicate resolve_Ghost_Tokens
  
  let rec clone_PersistentArray_i32 (self: t_PersistentArray_i32) (return (x: t_PersistentArray_i32)) =
    {[@stop_split] [@expl:clone 'self' type invariant] inv_ref_PersistentArray_i32 self}
    any
    [ return (result: t_PersistentArray_i32) ->
    {[@stop_split] [@expl:clone_PersistentArray_i32 ensures] ([@stop_split] [@expl:clone result type invariant] inv_PersistentArray_i32 result)
      /\ ([@stop_split] [@expl:clone ensures] view_PersistentArray_i32 result = view_PersistentArray_i32 self)}
      (! return {result}) ]
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  let rec testing (tokens: t_Tokens) (return (x: ())) =
    {[@stop_split] [@expl:testing requires] contains tokens (Namespace_PARRAY 0)}
    (! bb0
    [ bb0 = s0
      [ s0 = any
        [ any_ (__arr_temp: Slice64.array Int32.t) -> (! -{Seq.get __arr_temp.Slice64.elts 0 = (1: Int32.t)
          /\ Seq.get __arr_temp.Slice64.elts 1 = (2: Int32.t)
          /\ Seq.get __arr_temp.Slice64.elts 2 = (3: Int32.t)
          /\ Seq.get __arr_temp.Slice64.elts 3 = (4: Int32.t) /\ Seq.length __arr_temp.Slice64.elts = 4}-
          [ &_8 <- __arr_temp ] s1) ]
      | s1 = into_vec_i32 {_8} (fun (_x: t_Vec_i32_Global) -> [ &_5 <- _x ] s2)
      | s2 = new_i32 {_5} (fun (_x: t_PersistentArray_i32) -> [ &a <- _x ] s3)
      | s3 = MutBorrow.borrow_mut <t_Tokens> {tokens}
          (fun (_bor: MutBorrow.t t_Tokens) -> [ &_15 <- _bor ] [ &tokens <- _bor.final ] s4)
      | s4 = deref_mut_Ghost_Tokens {_15} (fun (_x: MutBorrow.t t_Tokens) -> [ &_14 <- _x ] s5)
      | s5 = MutBorrow.borrow_final <t_Tokens> {_14.current} {MutBorrow.get_id _14}
          (fun (_bor: MutBorrow.t t_Tokens) -> [ &_13 <- _bor ] [ &_14 <- { _14 with current = _bor.final } ] s6)
      | s6 = reborrow {_13} (fun (_x: t_Tokens) -> [ &_12 <- _x ] s7)
      | s7 = -{resolve_refmut_Tokens _14}- s8
      | s8 = new_Tokens {_12} (fun (_x: t_Tokens) -> [ &_11 <- _x ] s9)
      | s9 = set_i32 {a} {(1: UInt64.t)} {(42: Int32.t)} {_11} (fun (_x: t_PersistentArray_i32) -> [ &a2 <- _x ] s10)
      | s10 = s11 [ _ck -> (! {[@expl:type invariant] inv_PersistentArray_i32 a2} any) ]
      | s11 = -{resolve_PersistentArray_i32 a2}- s12
      | s12 = MutBorrow.borrow_mut <t_Tokens> {tokens}
          (fun (_bor: MutBorrow.t t_Tokens) -> [ &_22 <- _bor ] [ &tokens <- _bor.final ] s13)
      | s13 = deref_mut_Ghost_Tokens {_22} (fun (_x: MutBorrow.t t_Tokens) -> [ &_21 <- _x ] s14)
      | s14 = MutBorrow.borrow_final <t_Tokens> {_21.current} {MutBorrow.get_id _21}
          (fun (_bor: MutBorrow.t t_Tokens) -> [ &_20 <- _bor ] [ &_21 <- { _21 with current = _bor.final } ] s15)
      | s15 = reborrow {_20} (fun (_x: t_Tokens) -> [ &_19 <- _x ] s16)
      | s16 = -{resolve_refmut_Tokens _21}- s17
      | s17 = new_Tokens {_19} (fun (_x: t_Tokens) -> [ &_18 <- _x ] s18)
      | s18 = set_i32 {a} {(0: UInt64.t)} {(50: Int32.t)} {_18} (fun (_x: t_PersistentArray_i32) -> [ &a3 <- _x ] s19)
      | s19 = -{resolve_Ghost_Tokens tokens}- s20
      | s20 = s21 [ _ck -> (! {[@expl:type invariant] inv_PersistentArray_i32 a3} any) ]
      | s21 = -{resolve_PersistentArray_i32 a3}- s22
      | s22 = s23 [ _ck -> (! {[@expl:type invariant] inv_PersistentArray_i32 a} any) ]
      | s23 = -{resolve_PersistentArray_i32 a}- s24
      | s24 = clone_PersistentArray_i32 {a} (fun (_x: t_PersistentArray_i32) -> [ &a4 <- _x ] s25)
      | s25 = s26 [ _ck -> (! {[@expl:type invariant] inv_PersistentArray_i32 a4} any) ]
      | s26 = -{resolve_PersistentArray_i32 a4}- s27
      | s27 = [ &a_model <- Seq.create 4 [|(1: Int32.t);(2: Int32.t);(3: Int32.t);(4: Int32.t)|] ] s28
      | s28 = [ &a2_model <- Seq.create 4 [|(1: Int32.t);(42: Int32.t);(3: Int32.t);(4: Int32.t)|] ] s29
      | s29 = [ &a3_model <- Seq.create 4 [|(50: Int32.t);(2: Int32.t);(3: Int32.t);(4: Int32.t)|] ] s30
      | s30 = {[@expl:assertion] view_PersistentArray_i32 a = a_model} s31
      | s31 = {[@expl:assertion] view_PersistentArray_i32 a2 = a2_model} s32
      | s32 = {[@expl:assertion] view_PersistentArray_i32 a3 = a3_model} s33
      | s33 = {[@expl:assertion] view_PersistentArray_i32 a4 = a_model} s34
      | s34 = return {_ret} ] ]
    [ & _ret: () = Any.any_l ()
    | & tokens: t_Tokens = tokens
    | & a: t_PersistentArray_i32 = Any.any_l ()
    | & _5: t_Vec_i32_Global = Any.any_l ()
    | & _8: Slice64.array Int32.t = Any.any_l ()
    | & a2: t_PersistentArray_i32 = Any.any_l ()
    | & _11: t_Tokens = Any.any_l ()
    | & _12: t_Tokens = Any.any_l ()
    | & _13: MutBorrow.t t_Tokens = Any.any_l ()
    | & _14: MutBorrow.t t_Tokens = Any.any_l ()
    | & _15: MutBorrow.t t_Tokens = Any.any_l ()
    | & a3: t_PersistentArray_i32 = Any.any_l ()
    | & _18: t_Tokens = Any.any_l ()
    | & _19: t_Tokens = Any.any_l ()
    | & _20: MutBorrow.t t_Tokens = Any.any_l ()
    | & _21: MutBorrow.t t_Tokens = Any.any_l ()
    | & _22: MutBorrow.t t_Tokens = Any.any_l ()
    | & a4: t_PersistentArray_i32 = Any.any_l ()
    | & a_model: Seq.seq Int32.t = Any.any_l ()
    | & a2_model: Seq.seq Int32.t = Any.any_l ()
    | & a3_model: Seq.seq Int32.t = Any.any_l () ]) [ return (result: ()) -> (! return {result}) ]
end
module M_implementation__impl_Clone_for_PersistentArray_T__clone__refines (* <implementation::PersistentArray<T> as std::clone::Clone> *)
  type namespace_other
  
  type t_Namespace = Namespace_PARRAY int | Other namespace_other
  
  use seq.Seq
  use map.Map
  use map.Const
  use int.Int
  
  type t_Rc_PermCell_Inner_T_Global
  
  type t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T = { f0: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T }
  
  type t_Rc_NonAtomicInvariant_PA_T_Global
  
  type t_PersistentArray_T = {
    permcell: t_Rc_PermCell_Inner_T_Global;
    frag: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T;
    inv: t_Rc_NonAtomicInvariant_PA_T_Global }
  
  type t_Id
  
  function id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id
  
  function id_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Id =
    id_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0
  
  type t_NonAtomicInvariant_PA_T
  
  function public_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Id
  
  function view_Rc_NonAtomicInvariant_PA_T_Global (self: t_Rc_NonAtomicInvariant_PA_T_Global) : t_NonAtomicInvariant_PA_T
  
  type t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_PermCell_Inner_T
  
  type t_T
  
  type t_Ag_Seq_T = { f0'0: Seq.seq t_T }
  
  type t_Option_Ag_Seq_T = None | Some t_Ag_Seq_T
  
  function to_mapping_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : Map.map t_PermCell_Inner_T t_Option_Ag_Seq_T
  
  function get_PermCell_Inner_T [@inline:trivial] (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (k: t_PermCell_Inner_T) : t_Option_Ag_Seq_T
   = Map.get (to_mapping_PermCell_Inner_T self) k
  
  meta "rewrite_def" function get_PermCell_Inner_T
  
  type t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_FMap_PermCell_Inner_T_Ag_Seq_T = None'0 | Some'0 t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  type t_Option_Option_Ag_Seq_T = None'1 | Some'1 t_Option_Ag_Seq_T
  
  type tup2_Option_Ag_Seq_T_Option_Ag_Seq_T = { f0'1: t_Option_Ag_Seq_T; f1'1: t_Option_Ag_Seq_T }
  
  function map_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (f: Map.map t_Ag_Seq_T t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T
   = match self with
      | None -> None'1
      | Some x -> Some'1 (Map.get f x)
      end
  
  function op_Ag_Seq_T (self: t_Ag_Seq_T) (other: t_Ag_Seq_T) : t_Option_Ag_Seq_T = if self.f0'0 = other.f0'0 then
      Some self
    else
      None
  
  
  function commutative_Ag_Seq_T (a: t_Ag_Seq_T) (b: t_Ag_Seq_T) : ()
  
  axiom commutative_Ag_Seq_T_spec: forall a: t_Ag_Seq_T, b: t_Ag_Seq_T. op_Ag_Seq_T a b = op_Ag_Seq_T b a
  
  function op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = other } with
      | {f0'1 = None} -> Some'1 other
      | {f1'1 = None} -> Some'1 self
      | {f0'1 = Some x; f1'1 = Some y} -> map_Option_Ag_Seq_T (op_Ag_Seq_T x y) (fun (z: t_Ag_Seq_T) -> Some z)
      end
  
  function commutative_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) : ()
  
  axiom commutative_Option_Ag_Seq_T_spec: forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
      = op_Option_Ag_Seq_T b a
  
  function total_op_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom total_op_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T. (forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
          <> None'1)
      -> (forall k: t_PermCell_Inner_T. Some'1 (get_PermCell_Inner_T (total_op_PermCell_Inner_T self other) k)
        = op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k))
  
  function op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   = if forall k: t_PermCell_Inner_T. op_Option_Ag_Seq_T (get_PermCell_Inner_T self k) (get_PermCell_Inner_T other k)
      <> None'1 then
      Some'0 (total_op_PermCell_Inner_T self other)
    else
      None'0
  
  
  function commutative_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom commutative_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
      = op_FMap_PermCell_Inner_T_Ag_Seq_T b a
  
  function len_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) : int
  
  axiom len_PermCell_Inner_T_spec: forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T. len_PermCell_Inner_T self >= 0
  
  constant empty_PermCell_Inner_T : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom empty_PermCell_Inner_T_spec: len_PermCell_Inner_T empty_PermCell_Inner_T = 0
  
  axiom empty_PermCell_Inner_T_spec'0: to_mapping_PermCell_Inner_T empty_PermCell_Inner_T = Const.const (None)
  
  constant unit_FMap_PermCell_Inner_T_Ag_Seq_T: t_FMap_PermCell_Inner_T_Ag_Seq_T = empty_PermCell_Inner_T
  
  axiom unit_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall x: t_FMap_PermCell_Inner_T_Ag_Seq_T [op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T]. op_FMap_PermCell_Inner_T_Ag_Seq_T x unit_FMap_PermCell_Inner_T_Ag_Seq_T
      = Some'0 x
  
  function factor_Ag_Seq_T (self: t_Ag_Seq_T) (factor: t_Ag_Seq_T) : t_Option_Ag_Seq_T = op_Ag_Seq_T self factor
  
  axiom factor_Ag_Seq_T_spec: forall self: t_Ag_Seq_T, factor: t_Ag_Seq_T. match factor_Ag_Seq_T self factor with
        | Some c -> op_Ag_Seq_T factor c = Some self
        | None -> forall c: t_Ag_Seq_T. op_Ag_Seq_T factor c <> Some self
        end
  
  function factor_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (factor: t_Option_Ag_Seq_T) : t_Option_Option_Ag_Seq_T =
    match { f0'1 = self; f1'1 = factor } with
      | {f0'1 = x; f1'1 = None} -> Some'1 x
      | {f0'1 = None} -> None'1
      | {f0'1 = Some x; f1'1 = Some y} -> match factor_Ag_Seq_T x y with
        | Some z -> Some'1 (Some z)
        | None -> if x = y then Some'1 (None) else None'1
        end
      end
  
  axiom factor_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, factor: t_Option_Ag_Seq_T. match factor_Option_Ag_Seq_T self factor with
        | Some'1 c -> op_Option_Ag_Seq_T factor c = Some'1 self
        | None'1 -> forall c: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T factor c <> Some'1 self
        end
  
  predicate incl_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) =
    factor_Option_Ag_Seq_T other self <> None'1
  
  function incl_transitive_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) : ()
  
  axiom incl_transitive_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T. incl_Option_Ag_Seq_T a b
      -> incl_Option_Ag_Seq_T b c -> incl_Option_Ag_Seq_T a c
  
  function associative_some_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (ab: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_some_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, ab: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = Some'1 ab -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = op_Option_Ag_Seq_T ab c
  
  function associative_none_Option_Ag_Seq_T (a: t_Option_Ag_Seq_T) (b: t_Option_Ag_Seq_T) (c: t_Option_Ag_Seq_T) (bc: t_Option_Ag_Seq_T) : ()
  
  axiom associative_none_Option_Ag_Seq_T_spec:
    forall a: t_Option_Ag_Seq_T, b: t_Option_Ag_Seq_T, c: t_Option_Ag_Seq_T, bc: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T a b
        = None'1 -> op_Option_Ag_Seq_T b c = Some'1 bc -> op_Option_Ag_Seq_T a bc = None'1
  
  function incl_op_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) (other: t_Option_Ag_Seq_T) (comb: t_Option_Ag_Seq_T) : ()
  
  axiom incl_op_Option_Ag_Seq_T_spec:
    forall self: t_Option_Ag_Seq_T, other: t_Option_Ag_Seq_T, comb: t_Option_Ag_Seq_T. op_Option_Ag_Seq_T self other
        = Some'1 comb -> incl_Option_Ag_Seq_T self comb
  
  type tup2_PermCell_Inner_T_Ag_Seq_T = { f0'2: t_PermCell_Inner_T; f1'2: t_Ag_Seq_T }
  
  function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T [@inline:trivial] (self: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) (a: tup2_PermCell_Inner_T_Ag_Seq_T) : t_Option_Ag_Seq_T
   = Map.get self a
  
  meta "rewrite_def" function index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T
  
  function filter_map_PermCell_Inner_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom filter_map_PermCell_Inner_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, f: Map.map tup2_PermCell_Inner_T_Ag_Seq_T t_Option_Ag_Seq_T. forall k: t_PermCell_Inner_T [get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k]. get_PermCell_Inner_T (filter_map_PermCell_Inner_T self f) k
        = match get_PermCell_Inner_T self k with
          | None -> None
          | Some v -> index_Mapping_tup2_PermCell_Inner_T_Ag_Seq_T_Option_Ag_Seq_T f { f0'2 = k; f1'2 = v }
          end
  
  function factor_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (factor: t_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    if forall k: t_PermCell_Inner_T. incl_Option_Ag_Seq_T (get_PermCell_Inner_T factor k) (get_PermCell_Inner_T self k) then
      let res = filter_map_PermCell_Inner_T self (fun (__0: tup2_PermCell_Inner_T_Ag_Seq_T) -> let {f0'2 = k; f1'2 = vo} = __0 in match factor_Option_Ag_Seq_T (Some vo) (get_PermCell_Inner_T factor k) with
        | Some'1 r -> r
        | None'1 -> None
        end) in Some'0 res
    else
      None'0
  
  
  axiom factor_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, factor: t_FMap_PermCell_Inner_T_Ag_Seq_T. match factor_FMap_PermCell_Inner_T_Ag_Seq_T self factor with
        | Some'0 c -> op_FMap_PermCell_Inner_T_Ag_Seq_T factor c = Some'0 self
        | None'0 -> forall c: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T factor c
          <> Some'0 self
        end
  
  predicate incl_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    factor_FMap_PermCell_Inner_T_Ag_Seq_T other self <> None'0
  
  function incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_transitive_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T. incl_FMap_PermCell_Inner_T_Ag_Seq_T a b
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T b c -> incl_FMap_PermCell_Inner_T_Ag_Seq_T a c
  
  function associative_some_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (ab: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_some_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, ab: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = Some'0 ab
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some'0 bc
      -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = op_FMap_PermCell_Inner_T_Ag_Seq_T ab c
  
  function associative_none_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_FMap_PermCell_Inner_T_Ag_Seq_T) (b: t_FMap_PermCell_Inner_T_Ag_Seq_T) (c: t_FMap_PermCell_Inner_T_Ag_Seq_T) (bc: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom associative_none_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_FMap_PermCell_Inner_T_Ag_Seq_T, b: t_FMap_PermCell_Inner_T_Ag_Seq_T, c: t_FMap_PermCell_Inner_T_Ag_Seq_T, bc: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T a b
        = None'0 -> op_FMap_PermCell_Inner_T_Ag_Seq_T b c = Some'0 bc -> op_FMap_PermCell_Inner_T_Ag_Seq_T a bc = None'0
  
  function incl_op_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_FMap_PermCell_Inner_T_Ag_Seq_T) (other: t_FMap_PermCell_Inner_T_Ag_Seq_T) (comb: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom incl_op_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_FMap_PermCell_Inner_T_Ag_Seq_T, other: t_FMap_PermCell_Inner_T_Ag_Seq_T, comb: t_FMap_PermCell_Inner_T_Ag_Seq_T. op_FMap_PermCell_Inner_T_Ag_Seq_T self other
        = Some'0 comb -> incl_FMap_PermCell_Inner_T_Ag_Seq_T self comb
  
  predicate rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) =
    match a with
      | Some'0 a'0 -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f a'0
      | None'0 -> true
      end
  
  function rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_unit_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a unit_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_none_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (None'0) f
  
  function rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T) (f1: t_FMap_PermCell_Inner_T_Ag_Seq_T) (f2: t_FMap_PermCell_Inner_T_Ag_Seq_T) : ()
  
  axiom rel_mono_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall a: t_Option_FMap_PermCell_Inner_T_Ag_Seq_T, f1: t_FMap_PermCell_Inner_T_Ag_Seq_T, f2: t_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f1
      -> incl_FMap_PermCell_Inner_T_Ag_Seq_T f2 f1 -> rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T a f2
  
  function auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_Option_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
  
  axiom frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T_spec:
    forall self: t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T. rel_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (auth_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self) (frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self)
  
  function val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T [@inline:trivial] (self: t_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T) : t_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
   = val_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self
  
  meta "rewrite_def" function view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T
  
  function view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T (self: t_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T) : t_FMap_PermCell_Inner_T_Ag_Seq_T
   =
    frag_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T (view_Resource_View_AuthViewRel_FMap_PermCell_Inner_T_Ag_Seq_T self.f0)
  
  function view_Rc_PermCell_Inner_T_Global (self: t_Rc_PermCell_Inner_T_Global) : t_PermCell_Inner_T
  
  function namespace_PA_T (self: t_NonAtomicInvariant_PA_T) : t_Namespace
  
  predicate invariant_PersistentArray_T (self: t_PersistentArray_T) =
    id_FMap_PermCell_Inner_T_Ag_Seq_T self.frag = public_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv)
    /\ get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell)
      <> None
    /\ namespace_PA_T (view_Rc_NonAtomicInvariant_PA_T_Global self.inv) = Namespace_PARRAY 0
  
  predicate inv_Rc_PermCell_Inner_T_Global (_1: t_Rc_PermCell_Inner_T_Global)
  
  predicate inv_Rc_NonAtomicInvariant_PA_T_Global (_1: t_Rc_NonAtomicInvariant_PA_T_Global)
  
  predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (self: t_Rc_NonAtomicInvariant_PA_T_Global) =
    inv_Rc_NonAtomicInvariant_PA_T_Global self
  
  meta "rewrite_def" predicate invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global [@inline:trivial] (_1: t_Rc_NonAtomicInvariant_PA_T_Global) =
    invariant_Ghost_Rc_NonAtomicInvariant_PA_T_Global _1
  
  meta "rewrite_def" predicate inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global
  
  predicate inv_PersistentArray_T (_1: t_PersistentArray_T)
  
  axiom inv_axiom [@rewrite]: forall x: t_PersistentArray_T [inv_PersistentArray_T x]. inv_PersistentArray_T x
      = (invariant_PersistentArray_T x
      /\ inv_Rc_PermCell_Inner_T_Global x.permcell /\ inv_Ghost_Rc_NonAtomicInvariant_PA_T_Global x.inv)
  
  predicate invariant_ref_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) = inv_PersistentArray_T self
  
  meta "rewrite_def" predicate invariant_ref_PersistentArray_T
  
  predicate inv_ref_PersistentArray_T [@inline:trivial] (_1: t_PersistentArray_T) = invariant_ref_PersistentArray_T _1
  
  meta "rewrite_def" predicate inv_ref_PersistentArray_T
  
  predicate index_Mapping_Ag_Seq_T_bool [@inline:trivial] (self: Map.map t_Ag_Seq_T bool) (a: t_Ag_Seq_T) =
    Map.get self a
  
  meta "rewrite_def" predicate index_Mapping_Ag_Seq_T_bool
  
  function such_that_Ag_Seq_T (p: Map.map t_Ag_Seq_T bool) : t_Ag_Seq_T
  
  axiom such_that_Ag_Seq_T_spec:
    forall p: Map.map t_Ag_Seq_T bool. (exists x: t_Ag_Seq_T. index_Mapping_Ag_Seq_T_bool p x)
      -> index_Mapping_Ag_Seq_T_bool p (such_that_Ag_Seq_T p)
  
  function unwrap_Option_Ag_Seq_T (self: t_Option_Ag_Seq_T) : t_Ag_Seq_T = match self with
      | Some x -> x
      | None -> such_that_Ag_Seq_T (fun (__0: t_Ag_Seq_T) -> true)
      end
  
  function view_PersistentArray_T [@inline:trivial] (self: t_PersistentArray_T) : Seq.seq t_T =
    (unwrap_Option_Ag_Seq_T (get_PermCell_Inner_T (view_Fragment_FMap_PermCell_Inner_T_Ag_Seq_T self.frag) (view_Rc_PermCell_Inner_T_Global self.permcell))).f0'0
  
  meta "rewrite_def" function view_PersistentArray_T
  
  meta "compute_max_steps" 1000000
  
  meta "select_lsinst" "all"
  
  goal refines: forall self_: t_PersistentArray_T. inv_ref_PersistentArray_T self_
      -> inv_ref_PersistentArray_T self_
      /\ (forall result: t_PersistentArray_T. inv_PersistentArray_T result
          /\ view_PersistentArray_T result = view_PersistentArray_T self_ -> inv_PersistentArray_T result)
end