init with Charguéraud's System-Fsub defs & proofs