Ltac do_le_antisym :=
    match goal with
    | [ H : ?x <= ?y, H' : ?y <= ?x |- _ ] =>
      assert (x = y) by auto using Nat.le_antisymm
    end.

(* Specifications: *)
Lemma votes_correct_timeout : refined_raft_net_invariant_timeout votes_correct.
Lemma votes_correct_append_entries : refined_raft_net_invariant_append_entries votes_correct.
Lemma votes_correct_append_entries_reply : refined_raft_net_invariant_append_entries_reply votes_correct.
Lemma votes_correct_request_vote : refined_raft_net_invariant_request_vote votes_correct.
Lemma votes_correct_request_vote_reply : refined_raft_net_invariant_request_vote_reply votes_correct.
Lemma votes_correct_do_leader : refined_raft_net_invariant_do_leader votes_correct.
Lemma votes_correct_do_generic_server : refined_raft_net_invariant_do_generic_server votes_correct.
Lemma votes_correct_state_same_packet_subset : refined_raft_net_invariant_state_same_packet_subset votes_correct.
Lemma votes_correct_reboot : refined_raft_net_invariant_reboot votes_correct.
Theorem votes_correct_init : refined_raft_net_invariant_init votes_correct.
Theorem votes_correct_invariant : forall net, refined_raft_intermediate_reachable net -> votes_correct net.