(* Fundamental liveness theorem.  A verified function, when started in a state satisfying its precondition, will halt in a state satisfying its postcondition. *)

Lemma verify_totally_correct : forall t G A P Q psi l x
(HQ:forall x, boxy K.expandM (Q x)),
verify_prog t G psi G ->
G |-- funptr l A P Q ->
forall r,
(forall n, P x (K.squash (n,psi),(r#(L 0) <- (value_label l),t))) ->
exists n, exists p', exists r',
stepstar t (K.squash (n,psi)) p'
r ((instr_getlabel l (L 0) ;; instr_call (L 0) ;; instr_return ;; instr_nil _)::nil)
r' nil /\
Q x (p',(r',t)).