Proof using rri.
intros.
apply refined_raft_net_invariant; auto.
- apply leaderLogs_currentTerm_sanity_init.
- apply leaderLogs_currentTerm_sanity_client_request.
- apply leaderLogs_currentTerm_sanity_timeout.
- apply leaderLogs_currentTerm_sanity_append_entries.
- apply leaderLogs_currentTerm_sanity_append_entries_reply.
- apply leaderLogs_currentTerm_sanity_request_vote.
- apply leaderLogs_currentTerm_sanity_request_vote_reply.
- apply leaderLogs_currentTerm_sanity_do_leader.
- apply leaderLogs_currentTerm_sanity_do_generic_server.
- apply leaderLogs_currentTerm_sanity_state_same_packet_subset.
- apply leaderLogs_currentTerm_sanity_reboot.
Qed.
Ltac ctsc_start :=
red; unfold leaderLogs_currentTerm_sanity_candidate; simpl; intros.
Ltac ctsc_start_update :=
ctsc_start;
repeat find_higher_order_rewrite; update_destruct; rewrite_update; [|eauto].

(* Specifications: *)
Lemma leaderLogs_currentTerm_sanity_candidate_unchanged :
forall net st' h gd d ps',
leaderLogs_currentTerm_sanity_candidate net ->
(forall h' : Net.name, st' h' = update name_eq_dec (nwState net) h (gd, d) h') ->
leaderLogs gd = leaderLogs (fst (nwState net h)) ->
currentTerm d >= currentTerm (snd (nwState net h)) ->
(type d = type (snd (nwState net h)) \/ type d <> Candidate) ->
leaderLogs_currentTerm_sanity_candidate {| nwPackets := ps'; nwState := st' |}.