Struct CountResource 

pub struct CountResource<T, const TOTAL: usize> { /* private fields */ }

An authoritative pool that stores and dispatches counted fractions.

The authority and every dispatched Count use the same [Loc]. The authority remains present and records the resource when the pool’s fraction reaches zero.

Implementations

impl<T, const TOTAL: usize> CountResource<T, TOTAL>

pub closed spec fn type_inv(self) -> bool

pub open spec fn wf(self) -> bool

{
    &&& TOTAL > 0
    &&& 0 <= self.frac() <= TOTAL
    &&& self.type_inv()

}

Type invariant.

pub open spec fn is_empty(self) -> bool

{ self.frac() == 0 }

Whether this CountResource has no fraction.

This does not imply Self::is_resource_vacant: it may have reached fraction zero because all of its fractions were split out.

pub open spec fn not_empty(self) -> bool

{ !self.is_empty() }

Whether the fraction stored in this CountResource is less than TOTAL.

pub open spec fn is_full(self) -> bool

{ self.frac() == TOTAL }

Whether this CountResource has the full fraction, i.e., TOTAL.

pub closed spec fn is_resource_vacant(self) -> bool

Whether the associated resource slot is vacant and can accept a new resource.

This state is produced by Self::take_resource and owns the underlying empty token needed by Self::put_resource. Resource vacancy implies Self::is_empty, but the converse does not hold when all fractions were removed using Self::split or Self::split_one.

pub proof fn lemma_resource_vacant_implies_empty(tracked &self)

requires

self.is_resource_vacant(),

ensures

self.is_empty(),

A resource-vacant CountResource has no fraction.

pub closed spec fn resource(self) -> T

Returns the value of type T stored in this CountResource.

pub open spec fn view(self) -> T

{ self.resource() }

Returns the value of type T stored in this CountResource. It is an alias of Self::resource.

pub closed spec fn frac(self) -> int

The fractions stored in this CountResource.

pub closed spec fn id(self) -> Loc

Returns the unique identifier.

pub proof fn arbitrary() -> tracked res : Self

requires

TOTAL > 0,

Create an arbitrary CountResource. Useful as a placeholder.

pub proof fn alloc(tracked value: T) -> tracked res : Self

requires

TOTAL > 0,

ensures

res.not_empty(),

res.is_full(),

!res.is_resource_vacant(),

res@ == value,

res.wf(),

Allocates a new CountResource with the given tracked object.

pub proof fn alloc_from_empty(tracked empty: EmptyCount<T, TOTAL>, tracked value: T) -> tracked res : Self

requires

TOTAL > 0,

ensures

res.is_full(),

!res.is_resource_vacant(),

res.id() == empty.id(),

res.view() == value,

res.wf(),

Allocates a new CountResource from an EmptyCount<T,TOTAL> with the given tracked object.

pub proof fn split_one(tracked &mut self) -> tracked res : Count<T, TOTAL>

requires

old(self).not_empty(),

ensures

final(self).id() == old(self).id(),

final(self).frac() + 1 == old(self).frac(),

final(self)@ == old(self)@,

res.frac() == 1,

res.id() == final(self).id(),

res.resource() == old(self)@,

!res.has_authority(),

old(self).frac() == 1 ==> final(self).is_empty(),

!final(self).is_resource_vacant(),

final(self).wf(),

Splits a Count with fraction 1.

pub proof fn split(tracked &mut self, n: int) -> tracked res : Count<T, TOTAL>

requires

1 <= n <= old(self).frac(),

ensures

final(self).id() == old(self).id(),

final(self).frac() + n == old(self).frac(),

final(self)@ == old(self)@,

res.frac() == n,

res.id() == final(self).id(),

res.resource() == old(self)@,

!res.has_authority(),

old(self).frac() == n ==> final(self).is_empty(),

!final(self).is_resource_vacant(),

final(self).wf(),

Splits a Count with the given fraction.

pub proof fn combine(tracked &mut self, tracked other: Count<T, TOTAL>)

requires

old(self).id() == other.id(),

ensures

old(self).frac() + other.frac() > TOTAL ==> false,

old(self).frac() + other.frac() <= TOTAL
    ==> {
        &&& final(self).id() == old(self).id()
        &&& final(self).resource() == other.resource()
        &&& final(self).frac() == old(self).frac() + other.frac()
        &&& !final(self).is_resource_vacant()
        &&& final(self).wf()
        &&& final(self)@ == old(self)@

    },

Combines a Count.

pub proof fn validate(tracked &self)

ensures

self.wf(),

CountResource satisfies the type invariant.

pub proof fn validate_with_frac(tracked &self, tracked frac: &Count<T, TOTAL>)

requires

self.id() == frac.id(),

ensures

self.resource() == frac.resource(),

A CountResource and a Count with the same id agree on the value.

Unlike Count::agree, this works even when the resource is empty (all fractions split out).

pub proof fn tracked_borrow(tracked &self) -> tracked res : &T

requires

!self.is_resource_vacant(),

returns

self.resource(),

Borrows the resource while the associated storage slot is occupied.

pub proof fn take_resource(tracked &mut self) -> tracked res : T

requires

self.is_full(),

ensures

final(self).is_empty(),

final(self).is_resource_vacant(),

final(self).id() == old(self).id(),

res == old(self).resource(),

final(self).wf(),

Takes the resource out and leaves this token ready to accept a new resource.

pub proof fn put_resource(tracked &mut self, tracked value: T)

requires

old(self).is_resource_vacant(),

ensures

final(self).is_full(),

!final(self).is_resource_vacant(),

final(self).id() == old(self).id(),

final(self).resource() == value,

final(self).wf(),

Puts a resource into a token returned to the empty state by take_resource.

pub proof fn update(tracked &mut self, tracked value: T) -> tracked res : T

requires

old(self).is_full(),

ensures

final(self).is_full(),

!final(self).is_resource_vacant(),

res == old(self)@,

final(self).id() == old(self).id(),

final(self).wf(),

Updates the resource stored in this CountResource and retunrs the old resource if it exists. The fraction must be full before the update.