End LG_TYPE.
(* And here is an implementation of the LG module, satisfying this module type. *)
Module LG <: LG_TYPE.
(* This is an _internal_ definition, not meant to be mentioned in proofs about _clients_ of the LG module.  It describes "known to be initialized" global LG data. *)
Definition data_ok (n: Z) (gv: globals) : mpred :=
!! (0 <= n <= Int.max_signed) &&
data_at Ews tint (Vint (Int.repr n)) (gv _LG_n) *
data_at Ews (Tstruct _foo noattr) (Vint Int.one, Vint (Int.repr n)) (gv _LG_foo).
(* This is an externally visible definition, describing global LG data whether initialized or not. *)
Definition data (n: Z) (gv: globals) : mpred :=
data_ok n gv ||
(!! (n=3) &&
data_at Ews tint (Vint (Int.repr n)) (gv _LG_n) *
data_at Ews (Tstruct _foo noattr) (Vint Int.zero, Vundef) (gv _LG_foo)).
(*  This describes the extern global variables of the LG.c file, as they would appear as processed by CompCert and Floyd. *)
Definition initialized_globals (gv: globals) :=
!! (headptr (gv _LG_n)) &&
!! (headptr (gv _LG_foo)) &&
mapsto Ews tuint (offset_val 4 (gv _LG_foo))
(Vint (Int.repr 0)) *
data_at Ews tuint (Vint (Int.repr 0)) (gv _LG_foo) *
data_at Ews tuint (Vint (Int.repr 3)) (gv _LG_n).

(*  This lemma packages up the extern global variables of LG.c into the client-visible [data] abstraction.  It's a bit clumsy and verbose; it would be better to have better proof automation support for this kind of thing. *)
Lemma initial:
forall gv, initialized_globals gv |-- data 3 gv.