Definition lifted_directly_committed (net : ghost_log_network) (e : entry) : Prop :=
    exists quorum,
      NoDup quorum /\
      length quorum > div2 (length nodes) /\
      (forall h, In h quorum -> In (eTerm e, e) (allEntries (fst (nwState net h)))).Definition lifted_committed (net : ghost_log_network) (e : entry) (t : term) : Prop :=
    exists h e',
      eTerm e' <= t /\
      lifted_directly_committed net e' /\
      eIndex e <= eIndex e' /\
      In e (log (snd (nwState net h))) /\ In e' (log (snd (nwState net h))).Definition commit_invariant_host (net : ghost_log_network) : Prop :=
    forall h e,
      In e (log (snd (nwState net h))) ->
      eIndex e <= commitIndex (snd (nwState net h)) ->
      lifted_committed net e (currentTerm (snd (nwState net h))).Definition commit_invariant_nw (net : ghost_log_network) : Prop :=
    forall p t lid pli plt es lci e,
      In p (nwPackets net) ->
      snd (pBody p) = AppendEntries t lid pli plt es lci ->
      In e (fst (pBody p)) ->
      eIndex e <= lci ->
      lifted_committed net e t.Definition commit_invariant (net : ghost_log_network) : Prop :=
    commit_invariant_host net /\
    commit_invariant_nw net.

(* Specifications: *)
Lemma commit_invariant_init : msg_refined_raft_net_invariant_init commit_invariant.
Lemma msg_lifted_lastApplied_le_commitIndex : forall net h, msg_refined_raft_intermediate_reachable net -> lastApplied (snd (nwState net h)) <= commitIndex (snd (nwState net h)).
Lemma lifted_directly_committed_directly_committed : forall net e, lifted_directly_committed net e -> directly_committed (mgv_deghost net) e.
Lemma directly_committed_lifted_directly_committed : forall net e, directly_committed (mgv_deghost net) e -> lifted_directly_committed net e.
Lemma lifted_committed_committed : forall net e t, lifted_committed net e t -> committed (mgv_deghost net) e t.
Lemma committed_lifted_committed : forall net e t, committed (mgv_deghost net) e t -> lifted_committed net e t.
Lemma msg_deghost_spec' : forall base multi ghost (net : @network (@mgv_refined_base_params base) (@mgv_refined_multi_params base multi ghost)) h, nwState (mgv_deghost net) h = nwState net h.
Lemma commit_invariant_lower_commit_recorded_committed : forall net : ghost_log_network, msg_refined_raft_intermediate_reachable net -> commit_invariant net -> commit_recorded_committed (mgv_deghost net).
Lemma handleClientRequest_currentTerm : forall h st client id c out st' ms, handleClientRequest h st client id c = (out, st', ms) -> currentTerm st' = currentTerm st.
Lemma handleClientRequest_commitIndex : forall h st client id c out st' ms, handleClientRequest h st client id c = (out, st', ms) -> commitIndex st' = commitIndex st.
Lemma directly_committed_allEntries_preserved : forall net net' e, directly_committed net e -> (forall h, In (eTerm e, e) (allEntries (fst (nwState net h))) -> In (eTerm e, e) (allEntries (fst (nwState net' h)))) -> directly_committed net' e.
Lemma update_elections_data_client_request_allEntries : forall h st client id c out st' ms, handleClientRequest h (snd st) client id c = (out, st', ms) -> allEntries (update_elections_data_client_request h st client id c) = allEntries (fst st) \/ (exists e : entry, eIndex e = S (maxIndex (log (snd st))) /\ eTerm e = currentTerm (snd st) /\ eClient e = client /\ eInput e = c /\ eId e = id /\ type (snd st) = Leader /\ allEntries (update_elections_data_client_request h st client id c) = (currentTerm st', e) :: allEntries (fst st)).
Lemma update_elections_data_client_request_allEntries_ind : forall {h st client id c out st' ps}, handleClientRequest h (snd st) client id c = (out, st', ps) -> forall (P : list (term * entry) -> Prop), P (allEntries (fst st)) -> (forall e, eIndex e = S (maxIndex (log (snd st))) -> eTerm e = currentTerm (snd st) -> eClient e = client -> eInput e = c -> eId e = id -> type (snd st) = Leader -> P ((currentTerm st', e) :: allEntries (fst st))) -> P (allEntries (update_elections_data_client_request h st client id c)).
Lemma update_elections_data_client_request_preserves_allEntries : forall h st client id c out st' ms t e, handleClientRequest h (snd st) client id c = (out, st', ms) -> In (t, e) (allEntries (fst st)) -> In (t, e) (allEntries (update_elections_data_client_request h st client id c)).
Lemma handleClientRequest_preservers_log : forall h st client id c out st' ms e, handleClientRequest h st client id c = (out, st', ms) -> In e (log st) -> In e (log st').
Lemma committed_log_allEntries_preserved : forall net net' e t, committed net e t -> (forall h e', In e' (log (snd (nwState net h))) -> In e' (log (snd (nwState net' h)))) -> (forall h e' t', In (t', e') (allEntries (fst (nwState net h))) -> In (t', e') (allEntries (fst (nwState net' h)))) -> committed net' e t.
Lemma lifted_committed_log_allEntries_preserved : forall net net' e t, lifted_committed net e t -> (forall h e', In e' (log (snd (nwState net h))) -> In e' (log (snd (nwState net' h)))) -> (forall h e' t', In (t', e') (allEntries (fst (nwState net h))) -> In (t', e') (allEntries (fst (nwState net' h)))) -> lifted_committed net' e t.
Lemma lift_max_index_sanity : forall (net : ghost_log_network) h, msg_refined_raft_intermediate_reachable net -> maxIndex_sanity (deghost (mgv_deghost net)) -> lastApplied (snd (nwState net h)) <= maxIndex (log (snd (nwState net h))) /\ commitIndex (snd (nwState net h)) <= maxIndex (log (snd (nwState net h))).
Lemma haveNewEntries_log : forall es st st', log st = log st' -> haveNewEntries st es = true -> haveNewEntries st' es = true.
Lemma hCR_preserves_committed : forall (net net' : ghost_log_network) h client id c out d l e t, handleClientRequest h (snd (nwState net h)) client id c = (out, d, l) -> (forall h', nwState net' h' = update name_eq_dec (nwState net) h (update_elections_data_client_request h (nwState net h) client id c, d) h') -> lifted_committed net e t -> lifted_committed net' e t.