Set Bullet Behavior "Strict Subproofs".
Instance CompSpecs : compspecs. make_compspecs prog. Defined.
Definition Vprog : varspecs. mk_varspecs prog. Defined.
Definition tqueue := Tstruct _queue noattr.
Definition tqueue_t := Tstruct _queue_t noattr.
Definition MAX := 10.
(* Ghost histories in the style of History-based Verification of Functional Behaviour of Concurrent Programs, Blom, Huisman, and Zharieva-Stojanovski (VerCors) Twente tech report, 2015 *)
Inductive hist_el {A} := QAdd (p : val) (v : A) | QRem (p : val) (v : A).
Notation hist A := (list (@hist_el A)).
Fixpoint consistent {A} (h : hist A) a b :=
match h with
| [] => a = b
| QAdd p v :: h' => consistent h' (a ++ [(p, v)]) b
| QRem p v :: h' => match a with [] => False | v' :: q' => v' = (p, v) /\ consistent h' q' b end
end.
Notation feasible h := (exists b, consistent h [] b).
Parameter ghost : forall (sh : share) {t} (f : share * hist t) (p : val), mpred.
(*Parameter ghost_factory : mpred.  Axiom ghost_alloc : forall Espec D P Q R C P', semax(Espec := Espec) D (PROPx P (LOCALx Q (SEPx (ghost_factory :: R)))) C P' -> semax D (PROPx P (LOCALx Q (SEPx R))) C P'. Axiom new_ghost : forall Espec D P Q R C P' t v, semax(Espec := Espec) D (PROPx P (LOCALx Q (SEPx (ghost_factory :: (EX p : val, ghost Tsh t v p) :: R)))) C P' -> semax D (PROPx P (LOCALx Q (SEPx (ghost_factory :: R)))) C P'. Axiom alloc_conflict : ghost_factory * ghost_factory |-- FF.*)
(* In effect, we want two different ways of splitting/combining history shares. One combines the histories as well; the other guarantees injectivity on histories. *)

(* This is definitely unsound, since we can repeat it. *)
Axiom new_ghost : forall {CS : compspecs} {Espec : OracleKind} D P Q R C P' t' t v p,
semax D (PROPx P (LOCALx Q (SEPx (ghost Tsh (Tsh, ([] : hist t')) p :: data_at Tsh t v p :: R)))) C P' ->
semax D (PROPx P (LOCALx Q (SEPx (data_at Tsh t v p :: R)))) C P'.