Definition init_mem : { m | Genv.init_mem prog = Some m } := init_m prog init_mem_not_none.
Definition spr :=
semax_prog_rule'
(Concurrent_Espec unit CS ext_link) V G prog
(proj1_sig init_mem) 0 all_safe (proj2_sig init_mem).
Definition initial_corestate : corestate := projT1 (projT2 spr).
Definition initial_jm (n : nat) : juicy_mem := proj1_sig (snd (projT2 (projT2 spr)) n tt).
Definition initial_machine_state (n : nat) :=
@OrdinalPool.mk LocksAndResources (@JSem (globalenv prog))
(pos.mkPos (le_n 1))
(fun _ => Krun initial_corestate)
(fun _ => m_phi (initial_jm n))
(addressFiniteMap.AMap.empty _).
Definition NoExternal_Espec : external_specification mem external_function unit :=
Build_external_specification
_ _ _
(* no external calls from the machine *)
(fun _ => False)
(fun _ _ _ _ _ _ _ => False)
(fun _ _ _ _ _ _ _ => False)
(* when the machine is halted, it means no more schedule, there is nothing to check: *)
(fun _ _ _ => Logic.True).
Definition NoExternal_Hrel : nat -> mem -> mem -> Prop := fun _ _ _ => False.
(*  (* We state the theorem in terms of [safeN_] but because there are no external, this really just says that the initial state is "angelically safe" : for every schedule and every fuel n, there is a path either ending on an empty schedule or consuming all the fuel. *)

(* Specifications: *)
Theorem safe_initial_state : forall sch r n genv_symb,
safeN_
(G := genv)
(C := schedule * list _ * ThreadPool.t)
(M := mem)
(Z := unit)
(genv_symb := genv_symb)
(Hrel := NoExternal_Hrel)
(JuicyMachine.MachineSemantics sch r)
NoExternal_Espec
(globalenv prog)
n
tt
(sch, nil, initial_machine_state n)
(proj1_sig init_mem).