pub proof fn mut_ref_slice_len_eq<T>(tracked slice: &&mut [T])
old(*slice).len() == final(*slice).len(),