Proof using.
intros.
induction H10.
- intuition.
-  match goal with [H : step_failure _ _ _ |- _ ] => invcs H end.
+ unfold RaftNetHandler in *. repeat break_let.
repeat find_inversion.
assert
(raft_intermediate_reachable
{|
nwPackets := (xs ++ ys) ++ (send_packets (pDst p) l0);
nwState := update name_eq_dec (nwState net) (pDst p) r
|}) by (eapply RIR_handleMessage; eauto; in_crush).
assert
(raft_intermediate_reachable
{|
nwPackets := ((xs ++ ys) ++ (send_packets (pDst p) l0)) ++
(send_packets (pDst p) l1) ;
nwState := (update name_eq_dec (update name_eq_dec (nwState net) (pDst p) r) (pDst p) r0)
|}) by (eapply RIR_doLeader; eauto;
[simpl in *; break_if; try congruence; eauto| in_crush]).
eapply_prop raft_net_invariant_do_generic_server. eauto.
eapply_prop raft_net_invariant_do_leader. eauto.
eapply raft_invariant_handle_message with (P := P); eauto using in_app_or.
auto.
simpl. break_if; intuition eauto.
eauto.
simpl. eapply in_app_or. auto.
simpl. break_if; congruence.
simpl. intros.
break_if; subst;
repeat rewrite update_same by auto;
repeat rewrite update_neq by auto; auto.
simpl. in_crush.
+ unfold RaftInputHandler in *. repeat break_let.
repeat find_inversion.
assert
(raft_intermediate_reachable
{|
nwPackets := nwPackets net ++ send_packets h l0;
nwState := update name_eq_dec (nwState net) h r |})
by (eapply RIR_handleInput; eauto; in_crush).
assert
(raft_intermediate_reachable
{|
nwPackets := ((nwPackets net ++ send_packets h l0) ++ send_packets h l2) ;
nwState := update name_eq_dec (update name_eq_dec (nwState net) h r) h r0
|})  by (eapply RIR_doLeader; eauto;
[simpl in *; break_if; try congruence; eauto| in_crush]).
eapply_prop raft_net_invariant_do_generic_server. eauto.
eapply_prop raft_net_invariant_do_leader. eauto.
eapply raft_invariant_handle_input with (P := P); eauto using in_app_or.
auto.
simpl. break_if; intuition eauto.
eauto.
simpl. eapply in_app_or.
auto.
simpl. break_if; congruence.
simpl. intros.
break_if; subst;
repeat rewrite update_same by auto;
repeat rewrite update_neq by auto; auto.
simpl. unfold send_packets.  intros. in_crush.
+ match goal with
| [ H : nwPackets ?net = _ |- _ {| nwPackets := ?ps ; nwState := ?st |} ] =>
assert (forall p, In p (nwPackets {| nwPackets := ps ; nwState := st |}) ->
In p (nwPackets net)) by (intros; simpl in *; find_rewrite; in_crush)
end.
eapply_prop raft_net_invariant_state_same_packet_subset; [|eauto|idtac|];
eauto.
+ match goal with
| [ H : nwPackets ?net = _ |- _ {| nwPackets := ?ps ; nwState := ?st |} ] =>
assert (forall p, In p (nwPackets {| nwPackets := ps ; nwState := st |}) ->
In p (nwPackets net)) by (intros; simpl in *; find_rewrite; in_crush)
end.
eapply_prop raft_net_invariant_state_same_packet_subset; [|eauto|idtac|];
eauto.
+ auto.
+ eapply_prop raft_net_invariant_reboot; eauto;
intros; simpl in *; repeat break_if; intuition; subst; intuition eauto.
- eapply raft_invariant_handle_input; eauto.
- eapply raft_invariant_handle_message; eauto.
- eapply_prop raft_net_invariant_do_leader; eauto.
- eapply_prop raft_net_invariant_do_generic_server; eauto.
Qed.

(* Specifications: *)
Lemma reboot_init_handlers :
forall h, reboot (init_handlers h) = init_handlers h.