rewrite U_rec. intros H0.
assert (eva (C (H (tenc s)))) by
now eapply app_eva in H0 as [[[H % app_eva ?] %app_eva ?] %app_eva ?].
eapply C_sound in H1 as [n H1 % H_inv].
destruct (eval n s) eqn:Eq; try congruence. eapply eval_evaluates in Eq. firstorder. value.
eapply H_test.
Qed.

Lemma U_eva s : eva s <-> eva (U (tenc s)).