Local Open Scope nat_scope.
Definition control_as_safe {Espec: OracleKind} ge n ctl1 ctl2 :=
forall (ora : OK_ty) (ve : env) (te : temp_env) (m : juicy_mem) (n' : nat),
n' <= n ->
jsafeN (@OK_spec Espec) ge n' ora (State ve te ctl1) m ->
jsafeN (@OK_spec Espec) ge n' ora (State ve te ctl2) m.
Fixpoint prebreak_cont (k: cont) : cont :=
match k with
| Kloop1 s e3 :: k' => k
| Kseq s :: k' => prebreak_cont k'
| Kloop2 s e3 :: k' => k
| Kswitch :: k' => k
| _ =>  nil (* stuck *)
end.

Lemma control_as_safe_bupd {Espec: OracleKind}: forall ge n ctl1 ctl2, control_as_safe ge n ctl1 ctl2 ->
forall (ora : OK_ty) (ve : env) (te : temp_env) (m : juicy_mem) (n' : nat),
n' <= n ->
jm_bupd ora (jsafeN (@OK_spec Espec) ge n' ora (State ve te ctl1)) m ->
jm_bupd ora (jsafeN (@OK_spec Espec) ge n' ora (State ve te ctl2)) m.