Definition disj (s1 s2 : fmap) := 
  all (predC (fun x => x \in supp s2)) (supp s1).CoInductive disj_spec (s1 s2 : fmap) : bool -> Type :=
| disj_true of (forall x, x \in supp s1 -> x \notin supp s2) : 
    disj_spec s1 s2 true
| disj_false x of x \in supp s1 & x \in supp s2 : 
    disj_spec s1 s2 false.CoInductive disj_spec (s1 s2 : fmap) : bool -> Type :=
| disj_true of (forall x, x \in supp s1 -> x \notin supp s2) : 
    disj_spec s1 s2 true
| disj_false x of x \in supp s1 & x \in supp s2 : 
    disj_spec s1 s2 false.CoInductive disj_spec (s1 s2 : fmap) : bool -> Type :=
| disj_true of (forall x, x \in supp s1 -> x \notin supp s2) : 
    disj_spec s1 s2 true
| disj_false x of x \in supp s1 & x \in supp s2 : 
    disj_spec s1 s2 false.

Lemma disj_kfilt p1 p2 s1 s2 : disj s1 s2 -> disj (kfilter p1 s1) (kfilter p2 s2).