Proof using cei.
unfold refined_raft_net_invariant_do_leader, prevLog_candidateEntriesTerm.
simpl. intros.
find_apply_hyp_hyp. break_or_hyp.
- find_apply_hyp_hyp.
eapply candidateEntriesTerm_ext; eauto.
eapply doLeader_preserves_candidateEntriesTerm; eauto.
- find_apply_lem_hyp in_map_iff. break_exists. break_and.
subst. simpl in *.
find_copy_eapply_lem_hyp doLeader_messages; eauto.
break_and. intuition.
+ omega.
+ break_exists. break_and.
red.
find_apply_lem_hyp candidate_entries_invariant.
unfold CandidateEntries, candidateEntries_host_invariant in *.
find_apply_lem_hyp findAtIndex_elim. break_and.
match goal with
| [ H : nwState ?net ?h = (?y, ?x) |- _ ] =>
replace (x) with (snd (nwState net h)) in * by (rewrite H; auto);
replace (y) with (fst (nwState net h)) in * by (rewrite H; auto)
end.
eapply_prop_hyp In In.
subst.
find_eapply_lem_hyp (doLeader_preserves_candidateEntries); eauto.
match goal with
| [ H : nwState ?net ?h = (?y, ?x) |- _ ] => clear H
end.
unfold candidateEntries in *. break_exists_exists.
find_higher_order_rewrite.
update_destruct_simplify; auto.
Qed.

(* Specifications: *)
Lemma doGenericServer_preserves_candidateEntriesTerm :
forall net gd d h os d' ms t,
nwState net h = (gd, d) ->
doGenericServer h d = (os, d', ms) ->
candidateEntriesTerm t (nwState net) ->
candidateEntriesTerm t (update name_eq_dec (nwState net) h (gd, d')).