Section SendInvWrapper.
Variable st : send_trans coh.
Definition send_safeI this to d m :=
send_safe st this to d m /\ I d (nodes p d).
(* Inducitve step - prove that the invariant indeed holds *)
Definition S_inv := forall this to d msg (S : send_safe st this to d msg) b,
I d (nodes p d) -> Some b = send_step S ->
let: f' := upd this b (dstate d) in
let: s' := (post_msg (dsoup d) (Msg (TMsg (t_snd st) msg) this to true)).1 in
let: d' := DStatelet f' s' in
(forall z, z == this = false -> getLocal z d' = getLocal z d) ->
I d' (nodes p d').
Hypothesis HIstep : S_inv.

Lemma s_step_cohI : s_step_coh_t CohI (t_snd st) send_stepI.