Definition disj (s1 s2 : fmap) := 
  all (predC (fun x => x \in supp s2)) (supp s1).CoInductive disj_spec (s1 s2 : fmap) : bool -> Type :=
| disj_true of (forall x, x \in supp s1 -> x \notin supp s2) : 
    disj_spec s1 s2 true
| disj_false x of x \in supp s1 & x \in supp s2 : 
    disj_spec s1 s2 false.CoInductive disj_spec (s1 s2 : fmap) : bool -> Type :=
| disj_true of (forall x, x \in supp s1 -> x \notin supp s2) : 
    disj_spec s1 s2 true
| disj_false x of x \in supp s1 & x \in supp s2 : 
    disj_spec s1 s2 false.CoInductive disj_spec (s1 s2 : fmap) : bool -> Type :=
| disj_true of (forall x, x \in supp s1 -> x \notin supp s2) : 
    disj_spec s1 s2 true
| disj_false x of x \in supp s1 & x \in supp s2 : 
    disj_spec s1 s2 false.

Lemma in_disj_kfilt p1 p2 s : {in supp s, forall x, ~~ p1 x || ~~ p2 x} -> disj (kfilter p1 s) (kfilter p2 s).