Section StateMachineSafetyProof.
Context {orig_base_params : BaseParams}.
Context {one_node_params : OneNodeParams orig_base_params}.
Context {raft_params : RaftParams orig_base_params}.
Context {rri : raft_refinement_interface}.
Context {si : sorted_interface}.
Context {lmi : log_matching_interface}.
Context {smspi : state_machine_safety'interface}.
Context {rlmli : refined_log_matching_lemmas_interface}.
Context {pllsi : prevLog_leader_sublog_interface}.
Context {ctgt0 : current_term_gt_zero_interface}.
Context {lalcii : lastApplied_le_commitIndex_interface}.
Context {miaei : match_index_all_entries_interface}.
Context {lhlli : leaders_have_leaderLogs_interface}.
Context {lci : leader_completeness_interface}.
Context {lsi : leader_sublog_interface}.
Context {taifoli : terms_and_indices_from_one_log_interface}.
Context {glci : ghost_log_correct_interface}.
Context {lphogli : log_properties_hold_on_ghost_logs_interface}.
Context {glemi : ghost_log_entries_match_interface}.
Context {tci : transitive_commit_interface}.
Context {tsi : term_sanity_interface}.
Context {lhllsi : leaders_have_leaderLogs_strong_interface}.
Context {ollpti : one_leaderLog_per_term_interface}.
Context {rmri : raft_msg_refinement_interface}.
Proof using.
intros.
unfold deghost in *. simpl in *. do_in_map.
subst. eexists; eauto.
Qed.
Proof using.
intros. unfold state_machine_safety in *. intuition.
- unfold state_machine_safety_host. intros.
do 2 eapply_prop_hyp commit_recorded_committed commit_recorded.
unfold state_machine_safety' in *. intuition. eauto.
- unfold state_machine_safety_nw. intros.
eapply_prop_hyp commit_recorded_committed commit_recorded.
unfold state_machine_safety', state_machine_safety_nw' in *. intuition.
find_apply_lem_hyp exists_deghost_packet. break_exists.
intuition. subst. simpl in *. repeat break_match. simpl in *.
subst. eapply_prop_hyp In In; repeat find_rewrite; simpl; eauto.
Qed.
Definition ghost_log_network : Type := @network _ raft_msg_refined_multi_params.
Definition ghost_log_packet : Type := @packet _ raft_msg_refined_multi_params.
Definition lifted_maxIndex_sanity (net : ghost_log_network) : Prop :=
(forall h,
lastApplied (snd (nwState net h)) <= maxIndex (log (snd (nwState net h)))) /\
(forall h, commitIndex (snd (nwState net h)) <= maxIndex (log (snd (nwState net h)))).
Proof using.
unfold msg_refined_raft_net_invariant_init, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; find_inversion; auto.
Qed.
Proof using.
intros.
destruct (log st') using (handleClientRequest_log_ind ltac:(eauto)).
- auto.
- simpl in *. break_and.
destruct (log st); simpl in *.
+ lia.
+ find_insterU. conclude_using eauto. intuition.
Qed.
Proof using si rri.
intros.
pose proof (lift_prop _ logs_sorted_invariant).
find_insterU. conclude_using eauto.
unfold logs_sorted, logs_sorted_host in *. break_and.
unfold deghost in *. simpl in *. break_match. eauto.
Qed.
Proof using rmri si rri.
intros net0 ??.
rewrite <- msg_deghost_spec with (net := net0).
eapply msg_lift_prop.
- auto using lifted_sorted_host.
- auto.
Qed.
Proof using rlmli.
intros. eapply entries_sorted_nw_invariant; eauto.
Qed.
Definition lifted_no_entries_past_current_term_host net :=
forall (h : name) e,
In e (log (snd (nwState net h))) ->
eTerm e <= currentTerm (snd (nwState net h)).
Proof using rmri tsi.
intros.
enough (no_entries_past_current_term_host (deghost (mgv_deghost net))) by
(unfold no_entries_past_current_term_host, lifted_no_entries_past_current_term_host, deghost, mgv_deghost in *;
simpl in *;
repeat break_match; simpl in *; auto).
apply msg_lift_prop_all_the_way; eauto.
intros.
eapply no_entries_past_current_term_invariant; eauto.
Qed.
Proof using rmri rri.
intros net0 ?.
rewrite deghost_spec.
rewrite msg_deghost_spec with (net := net0).
auto.
Qed.
Proof using rmri rri.
auto using simulation_1, msg_simulation_1.
Qed.
Proof using rmri si rri.
unfold msg_refined_raft_net_invariant_client_request, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
simpl. intros.
find_copy_apply_lem_hyp handleClientRequest_maxIndex.
- intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
+ erewrite handleClientRequest_lastApplied by eauto. eauto using le_trans.
+ erewrite handleClientRequest_commitIndex by eauto. eauto using le_trans.
- match goal with H : _ |- _ => rewrite all_the_way_deghost_spec with (net := net) in H end.
eapply handleClientRequest_logs_sorted; eauto.
* auto using all_the_way_simulation_1.
* apply logs_sorted_invariant. auto using all_the_way_simulation_1.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_timeout, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto;
erewrite handleTimeout_log_same by eauto.
- erewrite handleTimeout_lastApplied; eauto.
- erewrite handleTimeout_commitIndex; eauto.
Qed.
Proof using.
unfold handleAppendEntries, advanceCurrentTerm;
intros; repeat break_match; repeat find_inversion; simpl; auto.
Qed.
Proof using.
induction l1; intros; simpl in *; intuition.
destruct l2; intuition. simpl in *.
specialize (H0 e). conclude H0 intuition. intuition.
Qed.
Proof using.
intros.
destruct (max a (min b c)) using (Max.max_case _ _); intuition.
Qed.
Proof using.
unfold deghost.
simpl. intuition.
apply in_map_iff.
eexists; eauto.
Qed.
Proof using.
unfold mgv_deghost.
simpl. intuition.
apply in_map_iff.
eexists; eauto.
Qed.
Proof using.
unfold deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold mgv_deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold mgv_deghost_packet.
simpl. auto.
Qed.
Proof using rmri si rri.
intros.
eapply (handleAppendEntries_logs_sorted _ (deghost_packet (mgv_deghost_packet p))).
- eauto using all_the_way_simulation_1.
- apply lift_prop.
+ apply logs_sorted_invariant.
+ auto using msg_simulation_1.
- rewrite <- all_the_way_deghost_spec.
rewrite pDst_deghost_packet.
rewrite pDst_mgv_deghost_packet.
eauto.
- rewrite pBody_deghost_packet.
rewrite pBody_mgv_deghost_packet.
auto.
- apply in_ghost_packet. apply in_mgv_ghost_packet. auto.
Qed.
Proof using.
unfold contiguous_range_exact_lo.
intuition.
Qed.
Proof using.
unfold contiguous_range_exact_lo.
intuition.
Qed.
Proof using rri.
unfold state_machine_safety, state_machine_safety_nw.
intuition.
match goal with
| [ H : _ |- _ ] => eapply H with (p := deghost_packet p)
end.
- auto using in_ghost_packet.
- rewrite pBody_deghost_packet. eauto.
- rewrite deghost_spec. eauto.
- auto.
Qed.
Proof using rmri rri.
intros net0;intros.
eapply lifted_sms_nw.
- eauto.
- eauto using in_mgv_ghost_packet.
- rewrite pBody_mgv_deghost_packet. eauto.
- rewrite msg_deghost_spec with (net := net0). eauto.
- auto.
Qed.
Proof using rri.
unfold commit_recorded.
intros.
rewrite deghost_spec.
auto.
Qed.
Proof using rmri rri.
unfold commit_recorded.
intros net0;intros.
rewrite deghost_spec.
rewrite msg_deghost_spec with (net := net0).
auto.
Qed.
Definition lifted_entries_contiguous (net : ghost_log_network) : Prop :=
forall h, contiguous_range_exact_lo (log (snd (nwState net h))) 0.
Proof using rmri rlmli.
unfold lifted_entries_contiguous.
intros.
pose proof (msg_lift_prop _ entries_contiguous_invariant _ ltac:(eauto) h).
find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Definition lifted_entries_contiguous_nw (net : ghost_log_network) : Prop :=
forall p t n pli plt es ci,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
contiguous_range_exact_lo es pli.
Proof using rmri rlmli.
unfold lifted_entries_contiguous_nw.
intros.
pose proof msg_lift_prop _ entries_contiguous_nw_invariant _ ltac:(eauto) (mgv_deghost_packet p).
match goal with
| [ H : context [In] |- _ ] => eapply H
end.
- auto using in_mgv_ghost_packet.
- rewrite pBody_mgv_deghost_packet. eauto.
Qed.
Definition lifted_entries_gt_0 (net : ghost_log_network) : Prop :=
forall h e,
In e (log (snd (nwState net h))) -> eIndex e > 0.
Proof using rmri rlmli.
unfold lifted_entries_gt_0.
intros.
pose proof msg_lift_prop _ entries_gt_0_invariant _ ltac:(eauto).
unfold entries_gt_0 in *.
match goal with
| [ H : _ |- _ ] => eapply H; eauto
end.
rewrite msg_deghost_spec.
eauto.
Qed.
Proof using rmri rlmli si rri.
unfold lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intros.
intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite handleAppendEntries_lastApplied by eauto.
assert (sorted (log d)) by (eauto using lifted_handleAppendEntries_logs_sorted).
match goal with
| _ : handleAppendEntries ?h ?s ?t ?n ?pli ?plt ?es ?ci = (?s', ?m) |- _ =>
pose proof handleAppendEntries_log_detailed
h s t n pli plt es ci s' m
end.
intuition; repeat find_rewrite.
+ eauto.
+ subst.
destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
assert (exists x, eIndex x = maxIndex (log d) /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
eapply contiguous_range_exact_lo_elim_lt.
* eapply lifted_entries_contiguous_nw_invariant; eauto.
* auto.
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. break_and.
eapply findAtIndex_None; [|eauto| |]; eauto.
apply msg_lifted_sorted_host; auto.
+ subst.
destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
left; repeat find_rewrite; auto using lt_le_weak].
intuition.
* subst.
assert (0 < eIndex x) by (eapply lifted_entries_contiguous_invariant; eauto).
lia.
* destruct (log d); intuition. simpl in *.
intuition; subst; auto.
find_apply_hyp_hyp. lia.
+ destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p)))) pli); intuition;
[eapply le_trans; [| apply sorted_maxIndex_app]; auto;
break_exists; break_and;
erewrite maxIndex_removeAfterIndex by (eauto; apply msg_lifted_sorted_host; auto);
auto|]; [idtac].
destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
assert (exists x, eIndex x = maxIndex es /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
destruct es.
* simpl in *. intuition.
* simpl.  subst.
{ eapply le_lt_trans with (m := eIndex x).
- lia.
- eapply contiguous_range_exact_lo_elim_lt.
+ eapply lifted_entries_contiguous_nw_invariant; eauto.
+ intuition.
}
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. intuition.
match goal with
| H : findAtIndex _ _ = None |- _ =>
eapply @findAtIndex_None with (x := x) in H
end; eauto.
* congruence.
* apply msg_lifted_sorted_host. auto.
+   destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_copy_apply_lem_hyp maxIndex_non_empty.
break_exists. intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
left; repeat find_rewrite; auto using lt_le_weak].
match goal with
| _ : In ?x es, _ : maxIndex es = eIndex ?x |- _ =>
assert (pli < eIndex x)
by ( eapply contiguous_range_exact_lo_elim_lt; eauto;
eapply lifted_entries_contiguous_nw_invariant; eauto)
end.
intuition.
match goal with
| H : _ = _ ++ _ |- _ => symmetry in H
end.
destruct es; intuition;
simpl in *;
intuition; subst_max; intuition;
repeat clean;
match goal with
| _ : eIndex ?x' = eIndex ?x, H : context [eIndex ?x'] |- _ =>
specialize (H x); conclude H ltac:(apply in_app_iff; auto)
end; intuition.
- assert (sorted (log d)) by (eauto using lifted_handleAppendEntries_logs_sorted).
match goal with
| _ : handleAppendEntries ?h ?s ?t ?n ?pli ?plt ?es ?ci = (?s', ?m) |- _ =>
pose proof handleAppendEntries_log_detailed
h s t n pli plt es ci s' m
end.
intuition; repeat find_rewrite; try apply max_min_thing;
match goal with
| H : context [ lastApplied _ ] |- _ => clear H
end.
+ eauto.
+ subst.
destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
assert (exists x, eIndex x = maxIndex (log d) /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
eapply contiguous_range_exact_lo_elim_lt.
* eapply lifted_entries_contiguous_nw_invariant; eauto.
* auto.
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. intuition.
find_eapply_lem_hyp findAtIndex_None; eauto.
apply msg_lifted_sorted_host. auto.
+ subst.
destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
right; repeat find_rewrite; intuition].
intuition.
* subst.
assert (0 < eIndex x) by (eapply lifted_entries_contiguous_invariant; eauto).
lia.
* destruct (log d); intuition. simpl in *.
intuition; subst; auto.
find_apply_hyp_hyp. lia.
+ destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p)))) pli); intuition;
[eapply le_trans; [| apply sorted_maxIndex_app]; auto;
break_exists; intuition;
erewrite maxIndex_removeAfterIndex; eauto; apply msg_lifted_sorted_host; auto|]; [idtac].
destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
assert (exists x, eIndex x = maxIndex es /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
destruct es.
* simpl in *. intuition.
* simpl.  subst.
{ eapply le_lt_trans with (m := eIndex x).
- lia.
- eapply contiguous_range_exact_lo_elim_lt.
+ eapply lifted_entries_contiguous_nw_invariant; eauto.
+ intuition.
}
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. intuition.
match goal with
| H : findAtIndex _ _ = None |- _ =>
eapply @findAtIndex_None with (x := x) in H
end; eauto.
* congruence.
* apply msg_lifted_sorted_host; auto.
+ destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_copy_apply_lem_hyp maxIndex_non_empty.
break_exists. intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
right; repeat find_rewrite; intuition].
match goal with
| _ : In ?x es, _ : maxIndex es = eIndex ?x |- _ =>
assert (pli < eIndex x)
by (eapply contiguous_range_exact_lo_elim_lt; eauto;
eapply lifted_entries_contiguous_nw_invariant; eauto)
end.
intuition.
* match goal with
| H : _ = _ ++ _ |- _ => symmetry in H
end.
destruct es; intuition;
simpl in *;
intuition; subst_max; intuition;
repeat clean;
match goal with
| _ : eIndex ?x' = eIndex ?x, H : context [eIndex ?x'] |- _ =>
specialize (H x); conclude H ltac:(apply in_app_iff; auto)
end; intuition.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_append_entries_reply,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite handleAppendEntriesReply_same_lastApplied by eauto.
erewrite handleAppendEntriesReply_same_log by eauto.
auto.
- erewrite handleAppendEntriesReply_same_commitIndex by eauto.
erewrite handleAppendEntriesReply_same_log by eauto.
auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_request_vote,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite handleRequestVote_same_log by eauto.
erewrite handleRequestVote_same_lastApplied by eauto.
auto.
- erewrite handleRequestVote_same_log by eauto.
erewrite handleRequestVote_same_commitIndex by eauto.
auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_request_vote_reply,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- rewrite handleRequestVoteReply_same_log.
rewrite handleRequestVoteReply_same_lastApplied.
auto.
- rewrite handleRequestVoteReply_same_log.
rewrite handleRequestVoteReply_same_commitIndex.
auto.
Qed.
Proof using.
unfold doLeader.
intros.
repeat break_match; repeat find_inversion; auto.
Qed.
Proof using.
induction l; intros.
- auto.
- simpl. apply IHl. apply Max.max_case_strong; lia.
Qed.
Proof using.
intros. apply fold_left_maximum_le'.
auto.
Qed.
Proof using.
induction l; intros.
- auto.
- simpl in *. revert H.
repeat (apply Max.max_case_strong; intros).
+ eauto.
+ assert (a = y) by lia. subst_max. eauto.
+ subst x. pose proof (fold_left_maximum_le l a).
assert (fold_left max l a = a) by lia.
eauto.
+ subst x.
pose proof (fold_left_maximum_le l a).
assert (fold_left max l a = a) by lia.
assert (a = y) by lia.
subst. auto.
Qed.
Proof using.
induction l; simpl.
- auto.
- intros.
specialize (IHl (max x a)).
intuition.
+ revert H.
apply Max.max_case_strong; intuition.
intuition eauto using fold_left_maxmimum_increase_init.
+ break_exists. break_and. eauto.
Qed.
Proof using.
intros.
destruct (fold_left_maximum_cases l x).
- find_rewrite. auto.
- break_exists. break_and. find_rewrite. eauto.
Qed.
Proof using.
unfold doLeader.
intros.
repeat break_match; repeat find_inversion; simpl; auto;
apply fold_left_maximum_ind; auto.
- intros. do_in_map. find_apply_lem_hyp filter_In.
subst. break_and.
apply maxIndex_is_max; eauto using findGtIndex_in.
- intros. do_in_map. find_apply_lem_hyp filter_In.
break_and. subst.
apply maxIndex_is_max; eauto using findGtIndex_in.
Qed.
Proof using rmri si rri.
unfold msg_refined_raft_net_invariant_do_leader,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite doLeader_same_log by eauto.
erewrite doLeader_same_lastApplied by eauto.
repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. auto.
- repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. simpl in *.
erewrite doLeader_same_commitIndex; eauto.
find_eapply_lem_hyp (msg_lifted_sorted_host net h0).
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
find_rewrite. auto.
Qed.
Proof using.
unfold doGenericServer.
intros.
repeat break_match; repeat find_inversion; simpl.
- do_bool.
revert Heqb.
eapply applyEntries_spec_ind; eauto.
- do_bool.
revert Heqb.
eapply applyEntries_spec_ind; eauto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_do_generic_server,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; find_higher_order_rewrite; update_destruct_simplify; auto;
erewrite doGenericServer_log by eauto.
- repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
repeat find_rewrite. simpl in *.
find_apply_lem_hyp doGenericServer_lastApplied.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
intuition; repeat find_rewrite; auto.
- repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. simpl in *.
erewrite doGenericServer_commitIndex by eauto.
auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_state_same_packet_subset,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; find_reverse_higher_order_rewrite; auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_reboot,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
unfold reboot.
intuition; find_higher_order_rewrite; update_destruct_simplify; auto with *;
repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end;
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *;
simpl in *;
repeat find_rewrite; simpl in *;
auto.
Qed.
Definition lifted_directly_committed (net : ghost_log_network) (e : entry) : Prop :=
exists quorum,
NoDup quorum /\
length quorum > div2 (length nodes) /\
(forall h, In h quorum -> In (eTerm e, e) (allEntries (fst (nwState net h)))).
Definition lifted_committed (net : ghost_log_network) (e : entry) (t : term) : Prop :=
exists h e',
eTerm e' <= t /\
lifted_directly_committed net e' /\
eIndex e <= eIndex e' /\
In e (log (snd (nwState net h))) /\ In e' (log (snd (nwState net h))).
Definition commit_invariant_host (net : ghost_log_network) : Prop :=
forall h e,
In e (log (snd (nwState net h))) ->
eIndex e <= commitIndex (snd (nwState net h)) ->
lifted_committed net e (currentTerm (snd (nwState net h))).
Definition commit_invariant_nw (net : ghost_log_network) : Prop :=
forall p t lid pli plt es lci e,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t lid pli plt es lci ->
In e (fst (pBody p)) ->
eIndex e <= lci ->
lifted_committed net e t.
Definition commit_invariant (net : ghost_log_network) : Prop :=
commit_invariant_host net /\
commit_invariant_nw net.
Proof using.
unfold msg_refined_raft_net_invariant_init, commit_invariant.
split.
- unfold commit_invariant_host, commit_recorded_committed, commit_recorded, committed. simpl.
intuition.
- unfold commit_invariant_nw; simpl; intuition.
Qed.
Proof using rmri lalcii rri.
intros.
pose proof (lift_prop _ (lastApplied_le_commitIndex_invariant)).
find_apply_lem_hyp msg_simulation_1.
find_apply_hyp_hyp.
unfold lastApplied_le_commitIndex in *.
match goal with
| [ H : _ |- _ ] => specialize (H h)
end.
find_rewrite_lem deghost_spec.
find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Proof using rmri.
unfold lifted_directly_committed, directly_committed.
intuition.
break_exists_exists.
intuition.
rewrite msg_deghost_spec. auto.
Qed.
Proof using rmri.
unfold lifted_directly_committed, directly_committed.
intuition.
break_exists_exists.
intuition.
find_apply_hyp_hyp.
find_rewrite_lem msg_deghost_spec. auto.
Qed.
Proof using rmri.
unfold lifted_committed, committed.
intros.
break_exists_exists.
rewrite msg_deghost_spec.
intuition auto using lifted_directly_committed_directly_committed.
Qed.
Proof using rmri.
unfold lifted_committed, committed.
intros.
break_exists_exists.
find_rewrite_lem msg_deghost_spec.
intuition auto using directly_committed_lifted_directly_committed.
Qed.
Proof using.
unfold mgv_deghost.
intros.
simpl.
destruct net. auto.
Qed.
Proof using rmri lalcii rri.
unfold commit_invariant, commit_recorded_committed, commit_recorded, commit_invariant_host.
intuition;
repeat find_rewrite_lem deghost_spec;
repeat find_rewrite_lem msg_deghost_spec';
rewrite msg_deghost_spec';
apply lifted_committed_committed; auto.
eauto using le_trans, msg_lifted_lastApplied_le_commitIndex.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; repeat find_inversion; auto.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; repeat find_inversion; auto.
Qed.
Proof using.
unfold directly_committed.
intuition.
break_exists_exists.
intuition.
Qed.
Proof using.
intros.
unfold update_elections_data_client_request.
repeat break_match; repeat find_inversion; auto.
simpl.
find_copy_apply_lem_hyp handleClientRequest_log.
intuition.
- repeat find_rewrite. do_bool. lia.
- right.  break_exists_exists. intuition.
congruence.
Qed.
Proof using.
intros.
find_apply_lem_hyp update_elections_data_client_request_allEntries.
intuition.
- find_rewrite. auto.
- break_exists. intuition.
repeat find_rewrite.  auto.
Qed.
Proof using.
intros.
match goal with
| [ |- context [ allEntries ?x ] ] =>
destruct (allEntries x)
using (update_elections_data_client_request_allEntries_ind ltac:(eauto))
end; intuition.
Qed.
Proof using.
intros.
destruct (log st') using (handleClientRequest_log_ind ltac:(eauto)); intuition.
Qed.
Proof using.
unfold committed.
intros.
break_exists_exists.
intuition.
eapply directly_committed_allEntries_preserved; eauto.
Qed.
Proof using rmri.
intros.
find_apply_lem_hyp lifted_committed_committed.
find_eapply_lem_hyp committed_log_allEntries_preserved; eauto.
apply committed_lifted_committed.
eapply committed_log_allEntries_preserved; eauto;
intros;
repeat find_rewrite_lem msg_deghost_spec;
rewrite msg_deghost_spec; auto.
Qed.
Proof using rmri rri.
intros.
match goal with
| [ H : _, H' : _ |- _ ] => apply H in H'; clear H
end.
unfold maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex in *.
break_and.
repeat match goal with
| [ H : _ |- _ ] => specialize (H h)
end.
repeat find_rewrite_lem deghost_spec.
repeat find_rewrite_lem msg_deghost_spec'.
auto.
Qed.
Proof using.
unfold haveNewEntries.
intros.
find_rewrite. auto.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; simpl; eauto.
- intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using handleClientRequest_preservers_log.
- intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
Qed.
Proof using.
unfold not_empty.
intros.
break_match; congruence.
Qed.
Proof using.
unfold haveNewEntries.
intros.
do_bool. split.
- auto using not_empty_intro.
- break_match; auto.
apply Bool.negb_true_iff.
do_bool. intuition eauto.
Qed.
Definition lifted_prevLog_leader_sublog (net : network) : Prop :=
forall leader p t leaderId prevLogIndex prevLogTerm entries leaderCommit,
type (snd (nwState net leader)) = Leader ->
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t leaderId prevLogIndex prevLogTerm entries leaderCommit ->
currentTerm (snd (nwState net leader)) = prevLogTerm ->
0 < prevLogIndex ->
0 < prevLogTerm ->
exists ple, eIndex ple = prevLogIndex /\
eTerm ple = prevLogTerm /\
In ple (log (snd (nwState net leader))).
Proof using rmri pllsi rri.
intros.
pose proof (msg_lift_prop _ (lift_prop _ prevLog_leader_sublog_invariant)).
find_insterU. conclude_using eauto.
unfold prevLog_leader_sublog, lifted_prevLog_leader_sublog in *.
intros.
find_apply_lem_hyp in_mgv_ghost_packet.
find_apply_lem_hyp in_ghost_packet.
unfold deghost in *. simpl in *. break_match. simpl in *. subst.
specialize (H0 leader).
destruct (nwState leader). simpl in *.
eauto.
Qed.
Proof using rmri rri.
unfold msg_refined_raft_net_invariant_client_request, commit_invariant.
intros. split.
- { unfold commit_invariant_host in *. break_and.
unfold commit_recorded_committed, commit_recorded in *.
intros. simpl in *.
repeat find_higher_order_rewrite.
rewrite update_fun_comm with (f := snd).
repeat match goal with H : _ |- _ => rewrite update_fun_comm with (f := snd) in H end.
simpl in *.
repeat match goal with
| [H : _ |- _] => rewrite (update_fun_comm _ raft_data _) in H
end.
rewrite (update_fun_comm  _ raft_data).
rewrite update_nop_ext' by (now erewrite <- handleClientRequest_currentTerm by eauto).
match goal with
| [H : _ |- _] => rewrite update_nop_ext' in H
by (now erewrite <- handleClientRequest_commitIndex by eauto)
end.
update_destruct_simplify.
- find_copy_apply_lem_hyp handleClientRequest_log.
break_and. break_or_hyp.
+ repeat find_rewrite.
eapply lifted_committed_log_allEntries_preserved; eauto.
* simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; repeat find_rewrite; auto.
* simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
+ break_exists. break_and. repeat find_rewrite.
simpl in *.
match goal with
| [ H : _ \/ In _ _ |- _ ] => invc H
end.
* find_eapply_lem_hyp (lift_max_index_sanity net h0); auto.
break_and. simpl in *. lia.
* { eapply lifted_committed_log_allEntries_preserved; eauto.
- simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; repeat find_rewrite; auto.
find_reverse_rewrite.
eapply handleClientRequest_preservers_log; eauto.
- simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
}
- eapply lifted_committed_log_allEntries_preserved; eauto.
+ simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; repeat find_rewrite; eauto using handleClientRequest_preservers_log.
+ simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
}
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
+ eapply hCR_preserves_committed; eauto. simpl. subst. auto.
+ unfold send_packets in *.
do_in_map.
unfold add_ghost_msg in *.
do_in_map.
subst. simpl in *.
exfalso. eapply handleClientRequest_no_append_entries; eauto 10.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; eauto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ now erewrite handleTimeout_log_same by eauto.
+ auto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ now rewrite update_elections_data_timeout_allEntries.
+ auto.
Qed.
Proof using.
unfold lifted_committed.
intros.
break_exists_exists.
intuition.
Qed.
Proof using rmri.
unfold msg_refined_raft_net_invariant_timeout, commit_invariant.
simpl. intuition.
- unfold commit_invariant_host in *.
simpl. intros.
repeat find_higher_order_rewrite.
update_destruct_simplify.
+ eapply handleTimeout_preserves_committed; eauto.
match goal with
| [ H : context [commitIndex] |- _ ] => erewrite handleTimeout_commitIndex in H by eauto
end.
match goal with
| [ H : context [log] |- _ ] => erewrite handleTimeout_log_same in H by eauto
end.
eapply lifted_committed_monotonic; [eauto|].
find_apply_lem_hyp handleTimeout_type_strong.
intuition; repeat find_rewrite; auto.
+ eapply handleTimeout_preserves_committed; eauto.
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
* eapply handleTimeout_preserves_committed; eauto.
simpl. intros. subst. auto.
* do_in_map.
subst. simpl in *.
unfold add_ghost_msg in *.
do_in_map.
subst. simpl in *.
find_eapply_lem_hyp handleTimeout_packets; eauto.
exfalso. eauto 10.
Qed.
Proof using.
unfold committed, directly_committed.
simpl. intros.
break_exists_exists.
find_higher_order_rewrite.
intuition.
break_exists_exists.  intuition.
find_higher_order_rewrite. auto.
Qed.
Proof using rmri.
intros.
apply committed_lifted_committed.
find_apply_lem_hyp lifted_committed_committed.
unfold mgv_deghost in *.
eauto using committed_ext.
Qed.
Definition lifted_state_machine_safety_nw' net :=
forall p t leaderId prevLogIndex prevLogTerm entries leaderCommit e t',
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t leaderId prevLogIndex prevLogTerm
entries leaderCommit ->
lifted_committed net e t' ->
t >= t' ->
(prevLogIndex > eIndex e \/
(prevLogIndex = eIndex e /\ prevLogTerm = eTerm e) \/
eIndex e > maxIndex entries \/
In e entries).
Proof using rmri smspi.
intros.
unfold lifted_state_machine_safety_nw'.
intros.
find_apply_lem_hyp lifted_committed_committed.
find_apply_lem_hyp in_mgv_ghost_packet.
match goal with
| _ : snd (pBody ?p) = ?x |- _ =>
assert (pBody (@mgv_deghost_packet _ _ ghost_log_params p) = x)
by (rewrite pBody_mgv_deghost_packet; auto)
end.
eapply state_machine_safety'_invariant; eauto.
eapply msg_lift_prop; eauto.
Qed.
Proof using rmri rlmli.
intros.
find_apply_lem_hyp in_mgv_ghost_packet.
match goal with
| _ : snd (pBody ?p) = ?x |- _ =>
assert (pBody (@mgv_deghost_packet _ _ ghost_log_params p) = x)
by (rewrite pBody_mgv_deghost_packet; auto)
end.
find_eapply_lem_hyp entries_sorted_nw_invariant; eauto.
eapply msg_lift_prop; eauto.
Qed.
Proof using.
unfold update_elections_data_appendEntries.
intros. break_let. break_match; auto.
break_if; auto.
simpl. intuition.
Qed.
Proof using rmri tci.
intros net0;intros.
apply committed_lifted_committed.
find_apply_lem_hyp lifted_committed_committed.
repeat match goal with
| H : _ |- _ =>
rewrite <- msg_deghost_spec with (net := net0) in H
end.
eapply transitive_commit_invariant; eauto.
eapply msg_lift_prop; eauto.
Qed.
Proof using rmri tsi rlmli smspi si rri.
intros.
unfold lifted_committed in *.
break_exists_name host. break_exists_name e'.
exists host, e'.
intuition.
- (* directly committed doesn't change *)
unfold lifted_directly_committed in *.
break_exists_exists; intuition.
find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_appendEntries_preserves_allEntries'.
- (* e is still around *)
find_higher_order_rewrite.
update_destruct_simplify; simpl in *; eauto.
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto).
find_eapply_lem_hyp handleAppendEntries_log_detailed. intuition; repeat find_rewrite; eauto.
+ (* pli = 0, no entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x > 0) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ (* pli = 0, bad entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex x > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; lia.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x0 > 0) by lia.
enough (eIndex x0 > pli) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition; try lia;
enough (pli < eIndex maxEntry) by lia;
eapply lifted_entries_contiguous_nw_invariant; eauto.
- find_higher_order_rewrite.
update_destruct_simplify; simpl in *; eauto.
assert (lifted_committed net e' (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto).
find_eapply_lem_hyp handleAppendEntries_log_detailed. intuition; repeat find_rewrite; eauto.
+ (* pli = 0, no entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e' > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x > 0) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e' <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ (* pli = 0, bad entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e' > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex x > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; lia.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x0 > 0) by lia.
enough (eIndex x0 > pli) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e' <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition; try lia;
enough (pli < eIndex maxEntry) by lia;
eapply lifted_entries_contiguous_nw_invariant; eauto.
Qed.
Proof using.
intros.
unfold handleAppendEntries, advanceCurrentTerm in *.
repeat break_match; find_inversion; simpl in *;
do_bool; auto.
Qed.
Proof using.
intros. unfold handleAppendEntries in *.
break_if; [find_inversion; subst; eauto|].
break_if;
[do_bool; break_if; find_inversion; subst;
try find_apply_lem_hyp haveNewEntries_true;
simpl in *; intuition eauto using advanceCurrentTerm_log, advanceCurrentTerm_commitIndex, some_none, advanceCurrentTerm_term|].
simpl in *. intuition eauto using advanceCurrentTerm_log, advanceCurrentTerm_commitIndex.
break_match; [|find_inversion; subst; eauto].
break_if; [find_inversion; subst; eauto|].
break_if; [|find_inversion; subst; eauto using advanceCurrentTerm_log, advanceCurrentTerm_commitIndex].
find_inversion; subst; simpl in *.
right. right.
find_apply_lem_hyp findAtIndex_elim.
intuition; do_bool; find_apply_lem_hyp haveNewEntries_true;
intuition eauto using advanceCurrentTerm_term; congruence.
Qed.
Definition lifted_entries_gt_0_nw (net : ghost_log_network) : Prop :=
forall p t n pli plt es ci e,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
In e es ->
eIndex e > 0.
Proof using rmri rlmli.
unfold lifted_entries_gt_0_nw.
intros.
pose proof msg_lift_prop _ entries_gt_0_nw_invariant _ ltac:(eauto).
unfold entries_gt_0_nw in *.
find_apply_lem_hyp in_mgv_ghost_packet.
match goal with
| [ H : _ |- _ ] => eapply H; eauto
end.
Qed.
Definition lifted_entries_sorted_nw' (net : ghost_log_network) :=
forall p t n pli plt es ci,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
sorted es.
Proof using rmri rlmli.
intros.
pose proof msg_lift_prop _ entries_sorted_nw_invariant.
find_copy_apply_hyp_hyp.
unfold entries_sorted_nw, lifted_entries_sorted_nw' in *.
intros.
find_apply_lem_hyp in_mgv_ghost_packet.
eapply_prop_hyp In In; eauto.
Qed.

Lemma commit_invariant_append_entries :
forall xs p ys (net : ghost_log_network) st' ps' gd d m t n pli plt es ci,
handleAppendEntries (pDst p) (snd (nwState net (pDst p))) t n pli plt es ci = (d, m) ->
gd = update_elections_data_appendEntries (pDst p) (nwState net (pDst p)) t n pli plt es ci ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
commit_invariant net ->
msg_refined_raft_intermediate_reachable net ->
lifted_maxIndex_sanity net ->
nwPackets net = xs ++ p :: ys ->
(forall h, st' h = update name_eq_dec (nwState net) (pDst p) (gd, d) h) ->
(forall p', In p' ps' ->
In p' (xs ++ ys) \/ p' = mkPacket (pDst p) (pSrc p)
(write_ghost_log (pDst p) (gd, d), m)) ->
commit_invariant (mkNetwork ps' st').