Ltac Kind :=
  exploit safe_expr_kind; eauto; simpl; intros X; rewrite <- X in *; clear X.Ltac Rec HR kind C C' :=
  destruct (HR kind (fun x => C(C' x))) as [? | [C'' [a' [D [A B]]]]];
  [eauto | eauto | auto |
   right; exists (fun x => C'(C'' x)); exists a'; rewrite D; auto].Ltac Base :=
  right; exists (fun x => x); econstructor; split; [eauto | simpl; auto].

(* Specifications: *)
Lemma decompose_topexpr: forall a, safe (ExprState f a k e m) -> simple a = true \/ exists C, exists a', a = C a' /\ simple_side_effect a' /\ leftcontext RV RV C.
Lemma estep_simulation: forall S t S', estep S t S' -> plus Csem.step ge S t S'.
Lemma can_estep: forall f a k e m, safe (ExprState f a k e m) -> match a with Eval _ _ => False | _ => True end -> exists t, exists S, estep (ExprState f a k e m) t S.
Theorem step_simulation: forall S1 t S2, step S1 t S2 -> plus Csem.step ge S1 t S2.
Theorem progress: forall S, safe S -> (exists r, final_state S r) \/ (exists t, exists S', step S t S').
Lemma decompose_topexpr: forall a, safe (ExprState f a k e m) -> simple a = true \/ exists C, exists a', a = C a' /\ simple_side_effect a' /\ leftcontext RV RV C.
Lemma estep_simulation: forall S t S', estep S t S' -> plus Csem.step ge S t S'.
Lemma can_estep: forall f a k e m, safe (ExprState f a k e m) -> match a with Eval _ _ => False | _ => True end -> exists t, exists S, estep (ExprState f a k e m) t S.
Theorem step_simulation: forall S1 t S2, step S1 t S2 -> plus Csem.step ge S1 t S2.
Theorem progress: forall S, safe S -> (exists r, final_state S r) \/ (exists t, exists S', step S t S').