Lustre source code that KIND doesn't seem to be able to prove