Proof using.
apply inductive_invariant_true_in_reachable. unfold inductive_invariant, inductive.
unfold sequence_sane. simpl in *. intuition.
match goal with
| [ H : step_dup _ _ _ |- _ ] =>
invcs H
end; try find_inversion.
- (* deliver case *)
unfold seq_num_net_handlers in *.
simpl in *.
do_in_app. intuition.
+ (* p is a new packet *)
do_in_map.
subst; simpl in *.
repeat break_match; try find_inversion; simpl in *; intuition.
eapply processPackets_correct; eauto.
+ (* p is an old packet *)
simpl in *.
repeat find_rewrite.
do_in_app.
repeat break_match; try find_inversion.
* rewrite <- e. intuition.
* apply processPackets_num_monotonic in Heqp0.
apply lt_le_trans with (m := (tdNum (nwState a (pDst p0)))); auto.
rewrite <- e. intuition.
* intuition.
* intuition.
- unfold seq_num_input_handlers in *. simpl in *. do_in_app. intuition.
+ do_in_map. subst; simpl in *.
repeat break_match; try find_inversion; simpl in *; intuition.
eapply processPackets_correct; eauto.
+ simpl in *.
repeat break_match; try find_inversion;
simpl in *; find_apply_lem_hyp processPackets_num_monotonic;
find_apply_hyp_hyp; try omega.
- in_crush; eauto with *.
Qed.
Definition sequence_seen (net : seq_num_network) :=
forall h h' n,
In n (assoc_default name_eq_dec (tdSeen (nwState net h')) h []) ->
n < (tdNum (nwState net h)).

(* Specifications: *)
Lemma reachable_seen :
true_in_reachable step_dup step_async_init sequence_seen.