(* The following is a slightly stronger result, proving [jmsafe] i.e. a safety that universally quantifies over all schedule each time a part of the schedule is consumed *)

(* [jmsafe] is an intermediate result, we can probably prove [csafe] directly *)
Theorem safety_initial_state (sch : schedule) (n : nat) :
jm_csafe (sch, nil, initial_machine_state n) (proj1_sig init_mem) n.