Witness Xyz must be a disappearing abstract variable or parameter in the INITIALISATION event
Rodin User’s Handbook v.2.8
Rodin User’s Handbook v.2.8
4.3.3 Witness Xyz must be a disappearing abstract variable or parameter in the INITIALISATION event
The witness is for the after value of the abstract variable, hence you should use the primed variable. The witness label should be Xyz’, and the predicate should refer to Xyz’ too.