| (buf0 + buf1)[m0] = empty, m0 + 1 < # buf0, m0 < # buf0 + # buf1, ∀ buf0, buf1. m0 ≤ # buf0 + # buf1 ∧ (# buf0 ≤ m0 → datasize(buf1, m0 - # buf0) = 0) → datasize(buf0 + buf1, m0) = datasize(buf0, min(m0, # buf0)) ⊦ buf0[m0] = empty, datasize(buf0, m0) = m0 + 1 |
(buf0 + buf1)[m0] = empty, m0 < # buf0 + # buf1, m0 + 1 < # buf0, ∀ buf0, buf1. m0 ≤ # buf0 + # buf1 ∧ (# buf0 ≤ m0 → datasize(buf1, m0 - # buf0) = 0) → datasize(buf0 + buf1, m0) = datasize(buf0, min(m0, # buf0)) ⊦ buf0[m0] = empty, datasize(buf0, m0) = m0 + 1