Program Definition guards (n:nat) (X:pred world) (stk:stack) : pred world :=
  fun prt =>
    match prt with (p,(r,t)) =>

      forall p',
        necR p p' ->
        X (p',(r,t)) ->
        safe t p' r stk /\
        (level p' >= n -> eventually_halts t p' r stk)
  end.Program Definition term_guards (t:store -> option nat) (n:nat) (X:pred world) (stk:stack) : pred world :=
  fun prt =>
    match prt with (p,(r,t')) =>

      forall p',
        necR p p' ->
        X (p',(r,t')) ->
        exists n',
          t r = Some n' /\
          safe t' p' r stk /\
          (level p' >= (n'+n) -> eventually_halts t' p' r stk)
  end.

(* Specifications: *)
Lemma boxy_funptr : forall l A P Q, boxy K.expandM (funptr l A P Q).
Lemma hoare_weaken_time : forall t x x' G R P i Q, x <= x' -> hoare t x G R P i Q -> hoare t x' G R P i Q.
Lemma hoare_ex_pre : forall t x G R T P i Q, (forall z:T, hoare t x G R (P z) i Q) -> hoare t x G R (exp P) i Q.
Lemma hoare_return : forall t (G R:pred world), hoare t 0 G R R instr_return FF.
Lemma hoare_getlabel : forall t l v (G R P:pred world), hoare t 0 G R (box (setM v (value_label l)) P) (instr_getlabel l v) P.