| lax.head = @(m0, m1), # buf1 + # buf0 < 2 * NODE_HEADER_SIZE + align↑(m, 2 * NODE_HEADER_SIZE), abs-nodes(buf0, n + # buf1, nd ' + x0, lax, weak), abs-padding(buf1), is-encoded(nodeheader(m, boolvar0), subarray(buf1 + buf0, 0, NODE_HEADER_SIZE)), NODE_HEADER_SIZE ≤ # buf1 + # buf0 ⊦ |
# buf1 + # buf0 < 2 * NODE_HEADER_SIZE + align↑(m, 2 * NODE_HEADER_SIZE), abs-nodes(buf0, n + # buf1, nd ' + x0, @(m0, m1) ' + lax0, weak), abs-padding(buf1), is-encoded(nodeheader(m, boolvar0), subarray(buf1, 0, NODE_HEADER_SIZE)), NODE_HEADER_SIZE ≤ # buf0 ⊦
Used simplifier rules: abs-nodes-first-adr-explicit: ⊦ abs-nodes(buf, m, a ' + x, lax, weak) → (lax.head = ladr ↔ (∃ lax0. lax = ladr + lax0));%abs-nodes-mkbuf0-empty-h: ⊦ abs-nodes(mkbuf(0), m, x, lax, weak) ↔ x = [] ∧ lax = [];%abs-nodes-headerspace: # buf ≠ 0 ⊦ abs-nodes(buf, m, x, lax, weak) → (NODE_HEADER_SIZE ≤ # buf + n ↔ NODE_HEADER_SIZE ≤ # buf);% ⊦ ladr ∈ ladr0 ' + lax ↔ ladr = ladr0 ∨ ladr ∈ lax; (s)% ⊦ # subarray(buf, m, n) = n; (s)%lfw-is-encoded-nodeheader-size: ⊦ is-encoded(ndhd, buf) → # buf = NODE_HEADER_SIZE; (forward) from specification abs-node%a: ⊦ (lax + lax0) + lax1 = lax + lax0 + lax1; from specification list[laddress-list]%in-14: ⊦ ladr ' + lax = lax0 → ladr ∈ lax0; (forward) from specification list[laddress-list]%n + m ≤ # buf ⊦ subarray(buf + buf0, n, m) = subarray(buf, n, m); (s)% ⊦ # buf < NODE_HEADER_SIZE → ¬ abs-padding(buf); (s)% ⊦ m ≤ n ↔ ¬ n < m; (ss)% ⊦ n + 0 = n; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ a ' + x ≠ []; (s)%append-a: ⊦ (buf + buf0) + buf1 = buf + buf0 + buf1; from specification array-splice[buffer]% ⊦ buf + mkbuf(0) = buf; (s)% ⊦ # buf = 0 ↔ buf = mkbuf(0); (s)% ⊦ ladr + lax = ladr ' + lax; (s)%a: ⊦ (x + y) + z = x + y + z; from specification list