(* In contrast, the following slight modification is safe.  We've inserted a lambda to make sure that the reference cell "inside" f isn't allocated until after polymorphic type instantiation.  This makes the expression a value, and allows us to apply the allp introduction rule with the value restriction. *)
(* f := *)
(*:=*) (App some (Var 0 (*x*))) (* ; *) (Var 1 (*r*)))))) (* in *)

(* Specifications: *)
Lemma ok_program_types :
Typ nil ok_program ty_nat.
Theorem ok_program_safe :
safe_prog ok_program.