Proof using rmri.
unfold msg_refined_raft_net_invariant_timeout, commit_invariant.
simpl. intuition.
- unfold commit_invariant_host in *.
simpl. intros.
repeat find_higher_order_rewrite.
update_destruct_simplify.
+ eapply handleTimeout_preserves_committed; eauto.
match goal with
| [ H : context [commitIndex] |- _ ] => erewrite handleTimeout_commitIndex in H by eauto
end.
match goal with
| [ H : context [log] |- _ ] => erewrite handleTimeout_log_same in H by eauto
end.
eapply lifted_committed_monotonic; [eauto|].
find_apply_lem_hyp handleTimeout_type_strong.
intuition; repeat find_rewrite; auto.
+ eapply handleTimeout_preserves_committed; eauto.
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
* eapply handleTimeout_preserves_committed; eauto.
simpl. intros. subst. auto.
* do_in_map.
subst. simpl in *.
unfold add_ghost_msg in *.
do_in_map.
subst. simpl in *.
find_eapply_lem_hyp handleTimeout_packets; eauto.
exfalso. eauto 10.
Qed.

(* Specifications: *)
Lemma committed_ext :
forall ps  st st' t e,
(forall h, st' h = st h) ->
committed (mkNetwork ps st) e t ->
committed (mkNetwork ps st') e t.