Proofs: Fusion tree
These are the human proofs of Fusion tree, at full length.
Fusion node rank by sketches is exact full
This proof shows: correctness, invariant, termination.
Fix a node with keys , positions and sketches as in the page. For -bit numbers , write , the highest position where they differ. Above they agree, and exactly when has 0 at .
Lemma 1. For keys of the node, .
Proof. Let , which is in . Each consecutive pair agrees above , so and agree above . At , the sequence is increasing and agrees above , so its bits at are a run of 0 then a run of 1, and some consecutive pair differs at ; so has 0 and has 1 at , and .
Lemma 2. If and a key differ and , then exactly when , and the sketches differ.
Proof. The sketch bits come from positions of in decreasing order. At the positions of above both agree; at they differ, in the same direction as and .
By Lemmas 1 and 2, the sketches of the keys are strictly increasing.
Lemma 3 (packed rank). For , PACKED-RANK.
Proof. has in each field, since . Field of is , and , so is the field-wise difference with no borrow between fields. Its bit is set exactly when . So has one bit for each with , and line L11 returns the count of the other keys.
Now let be a query that is not a key of the node. Let , so the keys with are those with the longest common prefix with ; call this set the block . Write for the bits of above .
Lemma 4. is a nonempty set of consecutive keys, and for each key , and . With the value of line L2, at least one of , (those that exist) is in , so line L3 picks , and .
Proof. is the set of keys whose bits above are and whose bit at is not that of ; since no key agrees with at and above (by the choice of ), is the set of keys with prefix , an interval of the sorted order, and it is nonempty. Take and . Then , and agrees with at all positions , so , which is in by Lemma 1. Since and agree at and above, Lemma 2 for shows that exactly when , which holds exactly when , that is, when is before the block. So the keys with sketch are all keys before the block and some keys of the block, which by the order of sketches are a prefix of the block. Hence where is the block. If then ; if then ; otherwise both are. Line L3 compares and as numbers; the smaller one has the lower top bit, so it picks a key with .
If is a key, then itself has the longest common prefix, and the same argument with (and ) shows that . Its sketch is not less than itself, so , which is what line L4 returns.
Lemma 5 (the corrected rank). Line L6 or L7 returns .
Proof. Let from Lemma 4.
Case bit of is 1. The keys of have prefix and bit 0 at , so they are all ; each other key is exactly when it is , where , because and agree above and the other keys differ from both above . So the number of keys is the number of keys . Now count by sketch. For , , so by Lemma 2 the sketch comparison with is strict and correct. For , (it has prefix , and is the largest number with that prefix), and : both agree at the positions of at and above, and below , has only ones. So , and by Lemma 3 with this is what line L6 computes.
Case bit of is 0. The keys of have bit 1 at , so they are all ; with , each other key is exactly when it is . So the number of keys (equal to the number , as is not a key) is the number of keys . For the sketch comparison is strict and correct as before. For , and , since has only zeros below . So , which line L7 computes by Lemma 3.
So NODE-PRED returns the index of the largest node key , or .
Theorem. PRED returns , or NIL.
Proof. Invariant of the loop of line L13: the answer is the larger of and the largest key in the subtree of (with NIL below every key), and every key of that subtree is larger than . At the root it holds with $best = $ NIL. In a node, by Lemma 5, (with the obvious meaning at the ends). If , the answer is (line L15). Otherwise, by (U1), the keys of the subtree of that are are , the subtrees , and the part of that is , and all the keys before are . So the best candidate outside is (line L16), every key of is larger than , and moving to keeps the invariant. The loop ends because the depth grows, and at $v = $ NIL the answer is .