Local Open Scope logic.
Declare Module Semax : SEMAX.
(* Remark:  "Declare Module" is a hack. We want to emphasize that the client proofs (in lseg.v, client_lemmas.v, and sample_program.v) can be done independently of the model.v that implements the Module Semax.  The correct way to do this in Coq is to use a parameterized Module (that is, a Functor), which is not difficult but in this example we wanted to avoid a heavyweight use of the module system. *)
Definition next e1 e2: mpred := !! (e1 > 0) && mapsto e1 e2.

(* Specifications: *)
Lemma next_gt_0:
forall x y, next x y = !! (x>0) && next x y.
Lemma next_neq_0: forall y, next 0 y |-- FF.   (* W1 *)
Definition listcons' (R: (adr * adr) -> mpred) (lp: adr * adr) : mpred :=
!! (fst lp <> snd lp) && EX tail:adr, next (fst lp) tail * |> R (tail, snd lp).