Fixpoint only_once (x : E) (l : list E) {struct l} : Prop :=
  match l with
  | nil => False
  | y :: l' =>
      if eq_E_dec x y then ~ In x l' else only_once x l'
  end.Definition list_of_elements (l : list E) := forall x : E, only_once x l.

(* Specifications: *)
Lemma only_once_in : forall (l : list E) (x : E), only_once x l -> In x l.
Lemma equality_from_membership : forall (x y : E) (l : list E), In y l -> ~ In x l -> x <> y.