(* In contrast, the following slight modification is
   safe.  We've inserted a lambda to make sure that
   the reference cell "inside" f isn't allocated until
   after polymorphic type instantiation.  This makes
   the expression a value, and allows us to apply
   the allp introduction rule with the
   value restriction.
 *)
Definition ok_program :=
  e_let
    (* f := *)
    (Lam
    ( e_let (* r := *) (New none) (* in *)
       (Lam (* x *)
          (Update (Var 1 (*r*))
             (*:=*) (App some (Var 0 (*x*)))
             (* ; *) (Var 1 (*r*))))))
    (* in *)
    ( e_let (* a := *) (App (App (Var 0 (*f*)) (Nat 0)) (Lam (Var 0))) (* in *)
     (e_let (* b := *) (App (App (Var 1 (*f*)) (Nat 0)) (Nat 5))       (* in *)
       (App (App (App out (Lam (Var 0))) (Deref (Var 1 (*a*)))) (Nat 42))
     )).

(* Specifications: *)
Lemma ok_program_types : Typ nil ok_program ty_nat.
Theorem ok_program_safe : safe_prog ok_program.