Section safety_Clight.

(* we prove safety that preserves bounded memory*)
Lemma Initial_bounded_dry_safety:
forall (U : semax_invariant.schedule) (n : nat),
exists init_U init_tr init_st,
(semantics.initial_core (MachineSemantics U (Some ( getCurPerm (juicy_mem.m_dry (init_jmem n)), empty_map)))) 0 init_genv (juicy_mem.m_dry (init_jmem n)) init_point nil =
Some ((init_U, init_tr, init_st), None) /\
forall U',
new_valid_bound (mk_nstate (U', init_tr, init_st) (proj1_sig (init_mem CPROOF))) U' ->
safe_new_step_bound (globalenv prog) (U', init_tr, init_st)
(proj1_sig (init_mem CPROOF)).