(*      semax vars G (fun s => call P (map s vars)) f -> *)
Definition program_proved (p: program) :=
exists G, semax_func G p G
/\ table_get G 0 = Some  (0::nil, lift1 allocpool (eval (Var 0))).

Axiom semax_load:  forall x y z c vars G P,
expcheck vars y = true ->
semax (vs_add x vars) G P c ->
semax vars G ((lift2 mapsto (eval y) (lift0 z) * TT) && |> subst' x (lift0 z) P)
(Do x := Mem y ; c).