Prove bounds.
Prove bounds.

Unfortunately, current automation doesn't work well for (word ^- $1).
That's why the proof for fshrink_ok is lengthy.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl