Axiom HleafNodeConst: forall x p leafIdx lvl dt,
              isLeafNode x (writeToNode p leafIdx lvl dt) ->
              isLeafNode x p.

(* Specifications: *)
Lemma zero_sum: forall s memSz leafIdx lvl dt, match s with |(s', (l, p)) => init_invariant s memSz -> init_invariant (s', (popStash l dt, writeToNode p leafIdx lvl dt ) ) memSz end.
Lemma writeBacks_invariant_holds: forall leafIdx lvl memSz lIDs s, init_invariant s memSz -> forall u strm stsh ttr, (u, (strm, (stsh, ttr))) = runState (writeBacks leafIdx lIDs lvl) s -> init_invariant (strm, (stsh, ttr)) memSz.
Lemma access_rec_invariant_holds: forall (leafIdx: nat) (lIDs : list nat) (lvl:nat) (s : st_rand) (memSz : nat), init_invariant s memSz -> forall u strm stsh ttr, (u, (strm, (stsh, ttr))) = runState (access_rec leafIdx lIDs lvl) s -> init_invariant (strm, (stsh, ttr)) memSz.
Lemma get_random_nat_invariant_holds: forall s memSz, init_invariant s memSz -> let (_, oldTsPair) := runState (get_random_nat tt) s in init_invariant oldTsPair memSz.
Lemma init_invariantholds: forall (memSz : nat) (op : Op) (bID : nat) (dataN : option nat) (s0 : st_rand), init_invariant s0 memSz -> let (_, s) := runState (access op bID dataN) s0 in init_invariant s memSz.
Lemma zero_sum: forall s memSz leafIdx lvl dt, match s with |(s', (l, p)) => init_invariant s memSz -> init_invariant (s', (popStash l dt, writeToNode p leafIdx lvl dt ) ) memSz end.
Lemma writeBacks_invariant_holds: forall leafIdx lvl memSz lIDs s, init_invariant s memSz -> forall u strm stsh ttr, (u, (strm, (stsh, ttr))) = runState (writeBacks leafIdx lIDs lvl) s -> init_invariant (strm, (stsh, ttr)) memSz.
Lemma access_rec_invariant_holds: forall (leafIdx: nat) (lIDs : list nat) (lvl:nat) (s : st_rand) (memSz : nat), init_invariant s memSz -> forall u strm stsh ttr, (u, (strm, (stsh, ttr))) = runState (access_rec leafIdx lIDs lvl) s -> init_invariant (strm, (stsh, ttr)) memSz.
Lemma get_random_nat_invariant_holds: forall s memSz, init_invariant s memSz -> let (_, oldTsPair) := runState (get_random_nat tt) s in init_invariant oldTsPair memSz.
Lemma init_invariantholds: forall (memSz : nat) (op : Op) (bID : nat) (dataN : option nat) (s0 : st_rand), init_invariant s0 memSz -> let (_, s) := runState (access op bID dataN) s0 in init_invariant s memSz.