proposition: Lemma ngs_range: forall i, 0 <= i < MAX_SPACES -> 0 <= nth_gen_size (Z.to_nat i) <= MAX_SPACE_SIZE.
proof: Proof. intros. unfold nth_gen_size. rewrite MAX_SPACES_eq in H. rewrite Z2Nat.id, NURSERY_SIZE_eq, Zbits.Zshiftl_mul_two_p, Z.mul_1_l, <- two_p_is_exp by lia. split. - cut (two_p (16 + i) > 0). 1: intros; lia. apply two_p_gt_ZERO. lia. - unfold MAX_SPACE_SIZE. rewrite Zbits.Zshiftl_mul_two_p by lia. rewrite two_p_is_exp by lia. rewrite Z.mul_1_l. match goal with |- two_p ?k * _ <= two_p ?m => change m with (k + (m-k)) end. rewrite two_p_is_exp by lia. simpl Z.sub. apply Z.mul_le_mono_pos_l. reflexivity. apply two_p_monotone. simpl. lia. Qed.
imports: Coq.ZArith.ZArith Coq.Program.Basics Coq.micromega.Lia compcert.lib.Integers compcert.common.Values VST.veric.base VST.veric.Clight_lemmas VST.veric.val_lemmas VST.veric.shares VST.msl.seplog VST.msl.shares VST.zlist.sublist VST.floyd.coqlib3 VST.floyd.functional_base VST.floyd.data_at_rec_lemmas VST.zlist.list_solver CertiGraph.lib.EquivDec_ext CertiGraph.lib.List_ext CertiGraph.graph.graph_model CertiGraph.graph.graph_gen