ensures

States a postcondition, checked on every return: ensures cond, "message".

Inside the clause, result is the value being returned and old(e) is the value e had on entry. Contextual: only a keyword after the signature.

fn abs(int n) -> int
    ensures result >= 0
{
    if n < 0 {
        return -n;
    }
    return n;
}

See also#

• fn: Declares a function, a method, or (written in an expression) an anonymous function.
• let: Declares a mutable local variable.
• const: Declares a binding that cannot be reassigned: a local, a module constant, or a class field that is set only by new.
• static: Declares a module-level or class-level slot shared by the whole program, or a method without self.
• readonly: A read-only view of a value: nothing reachable through it can be changed.
• if: Runs a block when a bool condition is true.
• else: Introduces the branch of an if that runs when its condition is false (or its pattern does not match).
• while: Repeats a block while a bool condition is true.