Definition inc_in_flight_to_backup (l : list packet) : nat :=
  length (filterMap
            (fun p => if msg_eq_dec (pBody p) inc
                   then if name_eq_dec (pDst p) backup
                        then Some tt else None
                   else None)
            l).

(* Specifications: *)
Lemma inc_in_flight_to_backup_app : forall xs ys, inc_in_flight_to_backup (xs ++ ys) = inc_in_flight_to_backup xs + inc_in_flight_to_backup ys.
Lemma InputHandler_inc_in_flight_to_backup_preserved : forall h i d u o d' l, InputHandler h i d = (u, o, d', l) -> d' = d + inc_in_flight_to_backup (send_packets h l).
Lemma backup_plus_network_eq_primary : forall net tr, step_async_star (params := Counter_MultiParams) step_async_init net tr -> nwState net backup + inc_in_flight_to_backup (nwPackets net) = nwState net primary.
Theorem primary_ge_backup : forall net tr, step_async_star (params := Counter_MultiParams) step_async_init net tr -> nwState net backup <= nwState net primary.