(* Fundamental liveness theorem.  A verified function, when started in a state satisfying its precondition, will halt in a state satisfying its postcondition. *)

(* Weaker corollary: a program with a safe entry point will eventually halt. *)
Corollary verify_halts : forall t G psi l,
verify_prog psi G ->
G |-- funptr l unit t (fun _ => TT) (fun _ => TT) ->
forall r n c,
proj1_sig t r n ->
psi#l = Some c ->
eventually_halts (K.squash (n,psi)) r
((c ;; instr_assert FF)::nil).