Definition inc_in_flight_to_backup (l : list packet) : nat :=
length (filterMap
(fun p => if msg_eq_dec (pBody p) inc
then if name_eq_dec (pDst p) backup
then Some tt else None
else None)
l).

(* Specifications: *)
Lemma inc_in_flight_to_backup_app :
forall xs ys,
inc_in_flight_to_backup (xs ++ ys) = inc_in_flight_to_backup xs + inc_in_flight_to_backup ys.
Lemma inc_in_flight_to_backup_cons_primary_dst :
forall p,
pDst p = primary ->
inc_in_flight_to_backup [p] = 0.
Lemma inc_in_flight_to_backup_nil :
inc_in_flight_to_backup [] = 0.
Lemma InputHandler_inc_in_flight_to_backup_preserved :
forall h i d u o d' l,
InputHandler h i d = (u, o, d', l) ->
d' = d + inc_in_flight_to_backup (send_packets h l).
Lemma NetHandler_inc_in_flight_to_backup_preserved :
forall p d u o d' l,
NetHandler (pDst p) (pBody p) d = (u, o, d', l) ->
d' + inc_in_flight_to_backup (send_packets (pDst p) l) = d + inc_in_flight_to_backup [p].
Lemma InputHandler_backup_no_msgs :
forall i d u o d' l,
InputHandler backup i d = (u, o, d', l) ->
l = [].
Lemma cons_is_app :
forall A (x : A) xs,
x :: xs = [x] ++ xs.
Lemma backup_plus_network_eq_primary :
forall net tr,
step_async_star (params := Counter_MultiParams) step_async_init net tr ->
nwState net backup + inc_in_flight_to_backup (nwPackets net) = nwState net primary.
Theorem primary_ge_backup :
forall net tr,
step_async_star (params := Counter_MultiParams) step_async_init net tr ->
nwState net backup <= nwState net primary.