| buf0 = buf, vtbl0 = vtbl, # buf ≥ # vtbl * (ENCODED_NAT_SIZE + ENCODED_VOLID_SIZE) + ENCODED_NAT_SIZE ⊦ ⟪encode_vtbl#(; vtbl, buf; err)⟫ ((err = ESUCCESS ∨ ⌊err⌋ ) ∧ # buf = # buf0 ∧ (err = ESUCCESS → is-encoded(vtbl0, buf))) |
buf0 = buf, vtbl0 = vtbl, # vtbl * (ENCODED_NAT_SIZE + ENCODED_VOLID_SIZE) + ENCODED_NAT_SIZE ≤ # buf ⊦ ⟪encode_vtbl#(; vtbl, buf; err)⟫ ((err = ESUCCESS ∨ ⌊err⌋ ) ∧ # buf = # buf0 ∧ (err = ESUCCESS → is-encoded(vtbl0, buf)))
Used simplifier rules: ⊦ n ≥ m ↔ m ≤ n; (s)