Definition ack_in_flight_to_primary (l : list packet) : nat :=
  length (filterMap
            (fun p => if msg_eq_dec (pBody p) ack
                   then if name_eq_dec (pDst p) primary
                        then Some tt else None
                   else None)
            l).

(* Specifications: *)
Lemma ack_in_flight_to_primary_app : forall xs ys, ack_in_flight_to_primary (xs ++ ys) = ack_in_flight_to_primary xs + ack_in_flight_to_primary ys.
Lemma inputs_eq_outputs_plus_inc_plus_ack : forall net tr, step_async_star (params := Counter_MultiParams) step_async_init net tr -> trace_inputs tr = trace_outputs tr + inc_in_flight_to_backup (nwPackets net) + ack_in_flight_to_primary (nwPackets net).
Theorem inputs_ge_outputs : forall net tr, step_async_star (params := Counter_MultiParams) step_async_init net tr -> trace_outputs tr <= trace_inputs tr.