Next Obligation.
destruct (R.In_ok_union _ (proj2_sig s1) _ (proj2_sig s2)). auto.
Qed.

(* Specifications: *)
Theorem In_union: forall x s1 s2, In x (union s1 s2) <-> In x s1 \/ In x s2.
Program Definition mem (x: Z) (s: t) := R.mem x s.
Theorem mem_spec: forall x s, mem x s = true <-> In x s.
Program Definition contains (l h: Z) (s: t) :=
if zlt l h then R.contains l h s else true.
Theorem contains_spec:
forall l h s, contains l h s = true <-> (forall x, l <= x < h -> In x s).