Definition no_msg_from_to from to (d : soup) :=
forall i tms b,
find i d = Some (Msg tms from to b) -> b = false.

(* Specifications: *)
Lemma no_msg_from_to_consume from to s i:
valid s ->
no_msg_from_to from to s ->
no_msg_from_to from to (consume_msg s i).
Lemma msg_spec_consume s from to tg cnt cnt' i :
valid s ->
find i s = Some {| content := TMsg tg cnt';
from := from; to := to; active := true |} ->
msg_spec from to tg cnt s ->
no_msg_from_to from to (consume_msg s i).
Lemma msg_specE_consume s pt from to to' tg cnt i m :
valid s ->
find i s =
Some {| content := m; from := from; to := to'; active := true |} ->
(pt != from) || (to != to') ->
msg_spec pt to tg cnt s ->
msg_spec pt to tg cnt (consume_msg s i).
Lemma msg_specE_consume1 s pt from to to' tg cnt i m :
valid s ->
find i s =
Some {| content := m; from := from; to := to'; active := true |} ->
(pt != from) ->
msg_spec pt to tg cnt s ->
msg_spec pt to tg cnt (consume_msg s i).
Lemma msg_specE_consume2 s pt from to to' tg cnt i m :
valid s ->
find i s =
Some {| content := m; from := from; to := to'; active := true |} ->
(to != to') ->
msg_spec pt to tg cnt s ->
msg_spec pt to tg cnt (consume_msg s i).