Definition filter' (f: key -> bool) (s: tree) : tree :=
  let nl := filter_aux f s 1%positive nil in fst (treeify_g (fst nl) (snd nl)).

(* Specifications: *)
Lemma filter_valid: forall f s, valid s -> valid (filter' f s).
Lemma linear_inter_aux_lemma: forall s1 s2 lo hi, searchtree lo hi s1 -> searchtree lo hi s2 -> forall n l n0 l0, (n,l) = (linear_inter_aux (s1, s2) (n0,l0)) -> match hi, l0 with None, _::_ => False | _,_ => True end -> HdRel' Kle hi l0 -> Sorted K.lt l0 -> S (length l0) = nat_of_P n0 -> (Sorted K.lt l /\ S (length l) = nat_of_P n /\ forall x, InA K.eq x l <-> interp s1 x /\ interp s2 x \/ InA K.eq x l0).
Lemma linear_inter_valid: forall s1 s2 : tree, valid s1 -> valid s2 -> valid (linear_inter s1 s2).
Lemma linear_union_aux_lemma: forall s1 s2 lo hi, searchtree lo hi s1 -> searchtree lo hi s2 -> forall n l n0 l0, (n,l) = (linear_union_aux (s1, s2) (n0,l0)) -> match hi, l0 with None, _::_ => False | _,_ => True end -> HdRel' Kle hi l0 -> Sorted K.lt l0 -> S (length l0) = nat_of_P n0 -> (Sorted K.lt l /\ S (length l) = nat_of_P n /\ forall x, InA K.eq x l <-> interp s1 x \/ interp s2 x \/ InA K.eq x l0).
Lemma linear_union_valid: forall s1 s2 : tree, valid s1 -> valid s2 -> valid (linear_union s1 s2).
Lemma linear_diff_aux_lemma: forall s1 s2 lo hi, searchtree lo hi s1 -> searchtree lo hi s2 -> forall n l n0 l0, (n,l) = (linear_diff_aux (s1, s2) (n0,l0)) -> match hi, l0 with None, _::_ => False | _,_ => True end -> HdRel' Kle hi l0 -> Sorted K.lt l0 -> S (length l0) = nat_of_P n0 -> (Sorted K.lt l /\ S (length l) = nat_of_P n /\ forall x, InA K.eq x l <-> interp s1 x /\ ~interp s2 x \/ InA K.eq x l0).
Lemma linear_diff_valid: forall s1 s2 : tree, valid s1 -> valid s2 -> valid (linear_diff s1 s2).