| # buf = n0 + 2 * NODE_HEADER_SIZE, buf0 = buf, is-aligned(# buf, 2 * NODE_HEADER_SIZE), NODE_HEADER_SIZE ≤ # buf ⊦ ∀ buf, err. (err = ESUCCESS ∨ ⌊err⌋ ) ∧ # buf = # buf0 ∧ subarray(buf, NODE_HEADER_SIZE, # buf - NODE_HEADER_SIZE) = subarray(buf0, NODE_HEADER_SIZE, # buf - NODE_HEADER_SIZE) ∧ (err = ESUCCESS → is-encoded(nodeheader(n0, true), subarray(buf, 0, NODE_HEADER_SIZE))) → ⟪buf := copy(validtrailer, 0, buf, # buf - NODE_HEADER_SIZE, NODE_HEADER_SIZE)⟫ ((err = ESUCCESS ∨ ⌊err⌋ ) ∧ # buf = # buf0 ∧ (err = ESUCCESS → abs-padding(buf))), buf = mkbuf(0) |
# buf1 = # buf, # buf = n0 + 2 * NODE_HEADER_SIZE, subarray(buf1, NODE_HEADER_SIZE, # buf - NODE_HEADER_SIZE) = subarray(buf, NODE_HEADER_SIZE, # buf - NODE_HEADER_SIZE), buf ≠ mkbuf(0), is-aligned(# buf, 2 * NODE_HEADER_SIZE), NODE_HEADER_SIZE ≤ # buf, err = ESUCCESS → is-encoded(nodeheader(n0, true), subarray(buf1, 0, NODE_HEADER_SIZE)), err = ESUCCESS ∨ ⌊err⌋ ⊦ ⟪buf1 := copy(validtrailer, 0, buf1, # buf1 - NODE_HEADER_SIZE, NODE_HEADER_SIZE)⟫ ((err = ESUCCESS ∨ ⌊err⌋ ) ∧ # buf1 = # buf ∧ (err = ESUCCESS → abs-padding(buf1)))