Definition filter' (f: key -> bool) (s: tree) : tree :=
let nl := filter_aux f s 1%positive nil in fst (treeify_g (fst nl) (snd nl)).

(* Specifications: *)
Lemma filter_valid: forall f s, valid s -> valid (filter' f s).
Lemma linear_inter_aux_lemma:
forall s1 s2 lo hi,
searchtree lo hi s1 -> searchtree lo hi s2 ->
forall n l n0 l0,
(n,l) = (linear_inter_aux (s1, s2) (n0,l0)) ->
match hi, l0 with None, _::_ => False | _,_ => True end ->
HdRel' Kle hi l0 ->
Sorted K.lt l0 ->
S (length l0) = nat_of_P n0 ->
(Sorted K.lt l /\ S (length l) = nat_of_P n
/\ forall x, InA K.eq x l <-> interp s1 x /\ interp s2 x \/ InA K.eq x l0).
Lemma linear_inter_valid: forall s1 s2 : tree,
valid s1 -> valid s2 -> valid (linear_inter s1 s2).
Lemma linear_union_aux_lemma:
forall s1 s2 lo hi,
searchtree lo hi s1 -> searchtree lo hi s2 ->
forall n l n0 l0,
(n,l) = (linear_union_aux (s1, s2) (n0,l0)) ->
match hi, l0 with None, _::_ => False | _,_ => True end ->
HdRel' Kle hi l0 ->
Sorted K.lt l0 ->
S (length l0) = nat_of_P n0 ->
(Sorted K.lt l /\ S (length l) = nat_of_P n
/\ forall x, InA K.eq x l <-> interp s1 x \/ interp s2 x \/ InA K.eq x l0).
Lemma linear_union_valid: forall s1 s2 : tree,
valid s1 -> valid s2 -> valid (linear_union s1 s2).
Lemma linear_diff_aux_lemma:
forall s1 s2 lo hi,
searchtree lo hi s1 -> searchtree lo hi s2 ->
forall n l n0 l0,
(n,l) = (linear_diff_aux (s1, s2) (n0,l0)) ->
match hi, l0 with None, _::_ => False | _,_ => True end ->
HdRel' Kle hi l0 ->
Sorted K.lt l0 ->
S (length l0) = nat_of_P n0 ->
(Sorted K.lt l /\ S (length l) = nat_of_P n
/\ forall x, InA K.eq x l <-> interp s1 x /\ ~interp s2 x \/ InA K.eq x l0).
Lemma linear_diff_valid: forall s1 s2 : tree,
valid s1 -> valid s2 -> valid (linear_diff s1 s2).