Section extensions.
(* Lemma safe_seq_skip {Espec: OracleKind} ge n ora ve te k m : jsafeN OK_spec ge n ora (State ve te k) m -> jsafeN OK_spec ge n ora (State ve te (Kseq Sskip :: k)) m.  Lemma safe_seq_skip' {Espec: OracleKind} ge n ora ve te k m : jsafeN OK_spec ge n ora (State ve te (Kseq Sskip :: k)) m -> jsafeN OK_spec ge n ora (State ve te k) m. *)
Local Open Scope nat_scope.
Definition control_as_safex {Espec: OracleKind} ge c1 k1 c2 k2 :=
forall (ora : OK_ty) f (ve : env) (te : temp_env) (m : juicy_mem),
jsafeN (@OK_spec Espec) ge (level m) ora (State f c1 k1 ve te) m ->
jsafeN (@OK_spec Espec) ge (level m) ora (State f c2 k2 ve te) m.
Definition control_as_safe {Espec: OracleKind} ge ctl1 ctl2 :=
match ctl1, ctl2 with
| Kseq c1 k1, Kseq c2 k2 =>
control_as_safex ge c1 k1 c2 k2
| Kseq c1 k1, Kloop1 _ _ _ =>
control_as_safex ge c1 k1 Sskip ctl2
| Kseq c1 k1, Kloop2 body incr k2 =>
control_as_safex ge c1 k1 (Sloop body incr) k2
| Kseq c1 k1, Kstop =>
control_as_safex ge c1 k1 (Sreturn None) Kstop
| Kseq c1 k1, Kcall _ _ _ _ _ =>
control_as_safex ge c1 k1 (Sreturn None) ctl2
| Kseq _ _, _ =>
False
| Kloop1 _ _ _, Kseq c2 k2 =>
control_as_safex ge Sskip ctl1 c2 k2
| Kloop1 _ _ _, Kloop1 _ _ _ =>
control_as_safex ge Sskip ctl1 Sskip ctl2
| Kloop1 _ _ _, Kloop2 body incr k2 =>
control_as_safex ge Sskip ctl1 (Sloop body incr) k2
| Kloop1 _ _ _, _ =>
False
| Kloop2 b1 i1 k1, Kseq c2 k2 =>
control_as_safex ge (Sloop b1 i1) k1 c2 k2
| Kloop2 b1 i1 k1, Kloop1 _ _ _ =>
control_as_safex ge (Sloop b1 i1) k1 Sskip ctl2
| Kloop2 b1 i1 k1, Kloop2 b2 i2 k2 =>
control_as_safex ge (Sloop b1 i1) k1 (Sloop b2 i2) k2
| Kloop2 _ _ _, _ =>
False
| Kstop, Kseq c2 k2 =>
control_as_safex ge (Sreturn None) Kstop c2 k2
| Kcall _ _ _ _ _, Kseq c2 k2=>
control_as_safex ge (Sreturn None) ctl1 c2 k2
| _, _ => ctl1 = ctl2
end.
Fixpoint prebreak_cont (k: cont) : cont :=
match k with
| Kloop1 s e3 k' => k
| Kseq s k' => prebreak_cont k'
| Kloop2 s e3 k' => k
| Kswitch k' => k
| _ =>  Kstop (* stuck *)
end.

Lemma assert_safe_adj:
forall {Espec: OracleKind} ge f ve te k k' rho,
control_as_safe ge k k' ->
assert_safe Espec ge f ve te (Cont k) rho
|-- assert_safe Espec ge f ve te (Cont k') rho.