Definition diff' (s1 s2: tree) : tree :=
   match compare_height s1 s1 s2 s2 with
      | Lt => filter' (fun k => negb (member k s2)) s1
      | Gt => fold' _ delete s2 s1
      | Eq => linear_diff s1 s2
    end.

(* Specifications: *)
Lemma diff_valid: forall s1 s2, valid s1 -> valid s2 -> valid (diff' s1 s2).