pub proof fn lemma_usize_log2_bounds(x: usize)
0 <= log(2, x as int) <= usize::BITS,
0 <= x.ilog2() <= usize::BITS,