| # buf = NODE_HEADER_SIZE, is-encoded(nd, subarray(buf0, 0, node-size-headerless(nd))), is-encoded(nodeheader(node-size-headerless(nd), false), buf), range=(buf + buf0, NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE), validtrailer, 0, NODE_HEADER_SIZE), node-size-headerless(nd) ≤ # buf0, NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE) ≤ # buf0, # buf ≤ 2 * NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE), 2 * NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE) ≤ # buf + # buf0 ⊦ ∃ buf2, buf3. buf + subarray(buf0, 0, 2 * NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE) - # buf) = buf2 + buf3 + validtrailer ∧ is-encoded(nodeheader(node-size-headerless(nd), false), buf2) ∧ is-encoded(nd, subarray(buf3, 0, node-size-headerless(nd))) ∧ # buf3 = align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE) |
# buf = NODE_HEADER_SIZE, is-encoded(nd, subarray(buf0, 0, node-size-headerless(nd))), is-encoded(nodeheader(node-size-headerless(nd), false), buf), range=(buf + buf0, NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE), validtrailer, 0, NODE_HEADER_SIZE), node-size-headerless(nd) ≤ # buf0, NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE) ≤ # buf0 ⊦ ∃ buf2, buf3. buf + subarray(buf0, 0, 2 * NODE_HEADER_SIZE + align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE) - NODE_HEADER_SIZE) = buf2 + buf3 + validtrailer ∧ is-encoded(nodeheader(node-size-headerless(nd), false), buf2) ∧ is-encoded(nd, subarray(buf3, 0, node-size-headerless(nd))) ∧ # buf3 = align↑(node-size-headerless(nd), 2 * NODE_HEADER_SIZE)
Used simplifier rules: ⊦ m0 * 1 = m0; (s)%m2 ≠ 0 ⊦ (* m2) * m + n ≤ m + n0 ↔ (m2 - 1) * m + n ≤ n0; (s)%mult-c: ⊦ m * n = n * m; from specification nat-mult%mult-a: ⊦ m0 * m * n = (m0 * m) * n; from specification nat-mult%m1 ≠ 0 ⊦ m ≤ (* m1) * m + n0; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m ≤ m + n; (s)%let: ⊦ n ≤ n0 ∧ n0 ≤ n1 → n ≤ n1; (forward) from specification nat