Checkpoint progress on fgrow_ok.
Checkpoint progress on fgrow_ok.

Two questions:

fgrow'_ok requires BALLOC.rep in its precondition, but File.rep
never talks about of the block allocator.  Probably we need to add
BALLOC.rep to File.rep.

The postcondition of fgrow'_ok and fshrink'_ok turns out needs
to be stronger.  We want to say that all inodes in ilist', execpt for
the one at inum which we have changed, remain the same as in ilist.
Otherwise the key part of proof in fgrow_ok cannot go through.
Maybe RecArray has a lemma for this, but I didn't figure out which one.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl