(* Fundamental liveness theorem.  A verified function, when started in a state satisfying its precondition, will halt in a state satisfying its postcondition. *)

Lemma verify_totally_correct : forall G A P Q psi l t x,
verify_prog psi G ->
G |-- funptr l A t P Q ->
forall r,
(forall n, P x (K.squash (n,psi),r)) ->
forall n c, proj1_sig t r n ->
psi#l = Some c ->
exists p', exists r',
stepstar (K.squash (n,psi)) p'
r ((c ;; instr_assert FF)::nil)
r' nil /\
Q x (p',r').