Local Fact full_dec_spec_rec1 i ln lc lt v :
v#>c = list_nat_bool ln ++ lc
-> Exists (fun x => length lt <= x) ln
-> exists w, (i,full_decoder i lt) // (i,v) ->> (q,w)
/\ forall z, z <> c -> z <> h -> z <> l -> v#>z = w#>z.
Local Fact full_dec_spec_rec2 i k lt v :
v#>c = list_repeat Zero (S k)
-> exists w, (i,full_decoder i lt) // (i,v) ->> (q,w)
/\ forall z, z <> c -> z <> h -> z <> l -> v#>z = w#>z.
(* Correctness lemma for the full decoder when then input encodes an invalid list of tiles *)

Theorem full_decoder_ko_spec i ln lc lt v :
v#>c = list_nat_bool ln ++ lc
-> (Exists (fun x => length lt <= x) ln
\/  Forall (fun x => x < length lt) ln
/\ exists k, lc = list_repeat Zero (S k))
->  exists w, (i,full_decoder i lt) // (i,v) ->> (q,w)
/\ forall z, z <> c -> z <> h -> z <> l -> v#>z = w#>z.