use vstd::prelude::*;
verus! {
pub open spec fn set_if(before: bool, after: bool, selected: bool) -> bool {
after == if selected { true } else { before }
}
pub proof fn selected_unset_rejected(before: bool)
ensures !set_if(before, false, true),
{
}
pub open spec fn clear_if(before: bool, after: bool, selected: bool) -> bool {
after == if selected { false } else { before }
}
}