now end;
then a := k does_not_destroy intloc 0 by Def4;
hence a := k is good by Def5; :: thesis: verum