(** Exported interface, wrapping the [ok] invariant in a dependent type. *)

Definition t := { r: R.t | R.ok r }.Program Definition In (x: Z) (s: t) := R.In x s.Program Definition empty : t := R.Nil.

(* Specifications: *)
Theorem In_empty: forall x, ~(In x empty).
Theorem In_empty: forall x, ~(In x empty).