Proof using.
unfold PB_input_handler. intros.
pb_unfold.
repeat break_match; repeat find_inversion; intuition eauto.
rewrite app_nil_r. simpl. find_apply_lem_hyp null_sound. find_rewrite.
simpl. left. intuition. eexists. eauto.
Qed.
Definition PB_net (dst src : name) (m : msg) : PB_data ->
list PB_output * PB_data * list (name * msg) :=
fun x => runGenHandler_ignore x (
match dst, m with
| Primary, Ack => d <- get ;;
match queue d with
| [] => nop
| x :: xs => match xs with
| [] => nop
| y :: ys =>
send (Backup, BackItUp y)
end ;;
let (os, st') := handler x (state d) in
write_output (RequestResponse x os) ;;
set_state st' ;;
set_queue xs
end
| Backup, BackItUp i => d <- get ;;
set_state (snd (handler i (state d))) ;;
send (Primary, Ack)
| _, _ => nop
end).

(* Specifications: *)
Lemma PB_net_defn :
forall dst src m d os d' ms,
PB_net dst src m d = (os, d', ms) ->
(os = [] /\ d' = d /\ ms = []) \/
(dst = Primary /\ m = Ack /\ (
(queue d = [] /\ os = [] /\ ms = [] /\ d' = d) \/
(exists h t, queue d = h :: t /\
queue d' = t /\
((t = [] /\ ms = []) \/
(exists y ys,
t = y :: ys /\
ms = [(Backup, BackItUp y)])) /\
let (us, st') := handler h (state d) in
os = [RequestResponse h us] /\
state d' = st'))) \/
(dst = Backup /\ ms = [(Primary, Ack)] /\ queue d' = queue d /\ os = [] /\
(exists i, m = BackItUp i /\
state d' = snd (handler i (state d)))).