Section inner.
Variable client : clientId.
Variables id : nat.
Variable out : output.
Proof using.
unfold in_output_trace.
intros.
destruct (find (fun p => match snd p with
| inr l => match find (is_client_response client id out) l with
| Some x => true
| None => false
end
| _ => false
end) tr) eqn:?.
- find_apply_lem_hyp find_some. break_and.
repeat break_match; try discriminate.
find_apply_lem_hyp find_some. break_and.
unfold is_client_response, in_output_list in *.
break_match; try discriminate. break_if; try discriminate. do_bool. break_and. do_bool. subst.
left. exists l, (fst p). clean.
break_and. do_bool.
break_if; try congruence. subst. intuition.
find_reverse_rewrite.
rewrite <- surjective_pairing.
auto.
- right. intro. break_exists. break_and.
eapply find_none in Heqo; eauto.
simpl in *. break_match; try discriminate.
unfold in_output_list in *. break_exists.
find_eapply_lem_hyp find_none; eauto.
simpl in *. find_apply_lem_hyp Bool.andb_false_elim.
break_if; repeat (intuition; do_bool).
break_if; congruence.
Qed.
Proof using.
intros. unfold in_output_trace in *.
break_exists_exists.
intuition. do_in_app; intuition.
exfalso. eauto.
Qed.
Proof using.
intros.
unfold in_output_list in *.
break_exists; do_in_app; intuition eauto.
Qed.
Proof using.
intuition.
Qed.
Proof using.
intros. unfold doLeader, advanceCommitIndex in *.
repeat break_match; find_inversion; intuition eauto using key_in_output_list_empty.
Qed.

Lemma handleInput_key_in_output_list :
forall st h i os st' m,
handleInput h i st = (os, st', m) ->
~ in_output_list client id out os.