Section Safety.
Variable CPROOF: CSL_proof.
Definition CS :=   CPROOF.(CSL_CS).
Definition V :=   CPROOF.(CSL_V).
Definition G :=   CPROOF.(CSL_G).
Definition ext_link :=   CPROOF.(CSL_ext_link).
Definition ext_link_inj :=   CPROOF.(CSL_ext_link_inj).
Definition prog :=   CPROOF.(CSL_prog).
Definition all_safe :=   CPROOF.(CSL_all_safe).
Definition init_mem_not_none :=   CPROOF.(CSL_init_mem_not_none).
Definition Jspec' := (@OK_spec (Concurrent_Espec unit CS ext_link)).
(* another, looser invariant to have more standard preservation statement *)
Definition inv Gamma n state :=
exists m, (n <= m)%nat /\ state_invariant(ge := globalenv prog) Jspec' Gamma m state.
Definition init_mem : { m | Genv.init_mem prog = Some m } := init_m prog init_mem_not_none.
Definition spr :=
semax_prog_rule'
(Concurrent_Espec unit CS ext_link) V G prog
(proj1_sig init_mem) 0 all_safe (proj2_sig init_mem).
Definition initial_corestate : corestate := projT1 (projT2 spr).
Definition initial_jm (n : nat) : juicy_mem := proj1_sig (snd (projT2 (projT2 spr)) n tt).
Definition initial_machine_state (n : nat) :=
@OrdinalPool.mk LocksAndResources (@JSem (globalenv prog))
(pos.mkPos (le_n 1))
(fun _ => Krun initial_corestate)
(fun _ => m_phi (initial_jm n))
(addressFiniteMap.AMap.empty _).
Definition NoExternal_Espec : external_specification mem external_function unit :=
Build_external_specification
_ _ _
(* no external calls from the machine *)
(fun _ => False)
(fun _ _ _ _ _ _ _ => False)
(fun _ _ _ _ _ _ _ => False)
(* when the machine is halted, it means no more schedule, there is nothing to check: *)
(fun _ _ _ => Logic.True).
Definition NoExternal_Hrel : nat -> mem -> mem -> Prop := fun _ _ _ => False.
(*  (* We state the theorem in terms of [safeN_] but because there are no external, this really just says that the initial state is "angelically safe" : for every schedule and every fuel n, there is a path either ending on an empty schedule or consuming all the fuel. *)
(* The following is a slightly stronger result, proving [jmsafe] i.e. a safety that universally quantifies over all schedule each time a part of the schedule is consumed *)
(* [jmsafe] is an intermediate result, we can probably prove [csafe] directly *)

Theorem safety_initial_state (sch : schedule) (n : nat) :
jm_csafe (sch, nil, initial_machine_state n) (proj1_sig init_mem) n.