Inductive match_specs: forall (p: program) (G: funspecs), Prop :=
| match_specs_nil: match_specs nil nil
| match_specs_cons: forall i vars f p' P G',
not (In i (map (@fst _ _) p')) ->
match_specs p' G' ->
typecheck vars f = true ->
match_specs ((i,(vars,f))::p') ((i,P)::G').

(* Specifications: *)
Lemma match_specs_boundary:
forall p G i,
match_specs p G -> i >= boundary p -> table_get G i = None.
Lemma funassert_e:  forall G i f,
table_get G i = Some f ->
funassert G |-- cont f i.
Lemma funassert_make_world: forall p G n,
app_pred (funassert G) (make_world G (initial_heap p) n).
Lemma cohere_make_world:
forall p G n,
match_specs p G ->
app_pred (cohere (initial_heap p)) (make_world G (initial_heap p) n).
Lemma funassert_get:
forall G v nP,  funassert  G && cont nP v |--
EX P':assert, (ALL vl:list adr, |> ! (call nP vl <=> call (fst nP,P') vl)) && !! (table_get G v = Some (fst nP,P')).
Lemma cont_core: forall P i w, app_pred (cont P i) w <-> app_pred (cont P i) (core w).
Lemma funassert_core: forall G w, app_pred (funassert G) w <-> app_pred (funassert G) (core w).
Program Definition allocpool (b: adr) : pred rmap :=
fun w => b>0 /\ forall i, if lt_dec i b then identity (w @ i) else w @ i = YES pfullshare (VAL 0) NoneP.