(* Verifying function bodies and entire programs *)
Definition verify_prog (t:terminationMeasure) (G:pred world) (psi:program K.assert) (G':pred world) :=
forall n r,
agedfrom (K.squash (n,psi),(r,t)) && |>(box K.expandM (closed G))
|-- box K.expandM (closed G').

(* Specifications: *)
Lemma verify_complete : forall G G' psi t,
G' |-- G ->
verify_prog t G psi G' ->
forall n r, G' (K.squash (n,psi),(r,t)).
Lemma verify_func : forall psi l (G:pred world) (A:Type) (P Q:A -> pred world) i t,
psi#l = Some i ->
(forall a p r t', termMeasure_incr t t' -> proj1_sig (P a) (p,(r,t')) -> exists n, t l r = Some n) ->
(forall a n,
let Pr  := P a && store_op (fun r' => t l r' = Some n) in
let Pr' a' := P a' && store_op (fun r' => exists n', t l r' = Some n' /\ n' < n) in
hoare t n (funptr l A Pr' Q && G) (Q a) Pr i FF) ->
verify_prog t  G psi G ->
verify_prog t (funptr l A P Q && G) psi (funptr l A P Q && G).
Lemma end_assert_lemma : forall Q t n p p' r r' stk,
stepN n t p p' r (stk++(instr_assert Q ;; instr_return ;; instr_nil _) :: nil) r' nil ->
stepstar t p p' r (stk++(instr_return ;; instr_nil _) :: nil) r' nil /\ proj1_sig Q (p',(r',t)).