Checkpoint some progress. A spec for recover (quite different from FS.recover's spec) and a proof sketch for atomic_cp_recover using recover's spec.  The spec and proof reduce the number of distinct crash cases to 3.  Hopefully we can simplify the spec of file_copy to 3 crash conditions by transforming all crash conditions to one of the 3.
Checkpoint some progress. A spec for recover (quite different from FS.recover's spec) and a proof sketch for atomic_cp_recover using recover's spec.  The spec and proof reduce the number of distinct crash cases to 3.  Hopefully we can simplify the spec of file_copy to 3 crash conditions by transforming all crash conditions to one of the 3.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl