End EvalThrow.
(* specialized versions of do lemmas, to handle ghost variables. *)
Section EvalGhost.
Variables (A B C : Type) (t : C) (p : C -> Pred heap) (q : C -> post A).
Variables (s1 : A -> spec B) (s2 : exn -> spec B) (i j : heap) (P : Pred heap).

Lemma val_gh (r : cont A) :
let: s := (fun i => exists x, i \In p x,
fun y i m => forall x, i \In p x -> q x y i m) in
(forall x m, q t (Val x) i m -> def (m :+ j) -> r (Val x) (m :+ j)) ->
(forall e m, q t (Exn e) i m -> def (m :+ j) -> r (Exn e) (m :+ j)) ->
i \In p t ->
verify s (i :+ j) r.