revert s; induction k; intros s.
- destruct s; solveeq.
- destruct s.
+ solveeq.
+ destruct (eval k s1) eqn:Hs1.
* destruct (eval_lambda Hs1); subst t. {
destruct (eval k s2) eqn:Hs2.
- destruct (eval_lambda Hs2); subst t.
eapply eqTrans.
eapply E_rec_app_Sn_1 with (s1 := tenc x) (t1 := tenc ( x0));
eauto with cbv...
rewrite IHk, Hs1. symmetry. solveeq.
rewrite IHk, Hs2. symmetry. solveeq.
assert (Subst (tenc x) Zero (tenc (lambda x0)) ≡ tenc (subst x 0 (lambda x0))).
change Zero with (enc 0). eapply Subst_correct.
rewrite H, IHk. simpl. now rewrite Hs1, Hs2.
-  rewrite E_rec_app_Sn_3 with (t1 := tenc x); eauto with cbv...
simpl. rewrite Hs1, Hs2. reflexivity.
rewrite IHk. rewrite Hs1. symmetry. solveeq.
rewrite IHk. rewrite Hs2. symmetry. solveeq.
}
* simpl. rewrite Hs1. eapply E_rec_app_Sn_2.
change none with (oenc (None)). rewrite <- Hs1. eapply IHk.
+ solveeq.
Qed.

(** ** Class of total procedures is unrecognisable *)
Lemma totality : ~ recognisable (fun s => proc s /\ forall t, eva(s (tenc t))).