End R.
(** Exported interface, wrapping the [ok] invariant in a dependent type. *)
Definition t := { r: R.t | R.ok r }.
Program Definition In (x: Z) (s: t) := R.In x s.
Program Definition empty : t := R.Nil.
Next Obligation. constructor. Qed.

(* Specifications: *)
Theorem In_empty: forall x, ~(In x empty).
Program Definition interval (l h: Z) : t :=
if zlt l h then R.Cons l h R.Nil else R.Nil.