| m0 < # buf0 + # buf1, # buf0 ≤ m0 + 1 → datasize(buf1, m0 + 1 - # buf0) = 0, ∀ buf0, buf1. m0 ≤ # buf0 + # buf1 ∧ (# buf0 ≤ m0 → datasize(buf1, m0 - # buf0) = 0) → datasize(buf0 + buf1, m0) = datasize(buf0, min(m0, # buf0)) ⊦ m0 + 1 = datasize(buf0, (m0 + 1 < # buf0 ⊃ m0 + 1;# buf0)), (buf0 + buf1)[m0] = empty |
m0 < # buf0 + # buf1, # buf0 ≤ m0 + 1 → datasize(buf1, m0 + 1 - # buf0) = 0, ∀ buf0, buf1. m0 ≤ # buf0 + # buf1 ∧ (# buf0 ≤ m0 → datasize(buf1, m0 - # buf0) = 0) → datasize(buf0 + buf1, m0) = datasize(buf0, min(m0, # buf0)) ⊦ m0 + 1 = datasize(buf0, (m0 + 1 < # buf0 ⊃ m0 + 1;# buf0)), (buf0 + buf1)[m0] = empty