End ServerReceiveTransition.
Section ServerSendTransition.
Definition entry_finder (to : nid) msg :=
let: ans := head 0 msg in
fun e : perm =>
let: (n, _, args) := e in
[&& n == to, f args == Some ans &
msg == ans :: args].
Definition can_send (s : cstate) to msg :=
has (entry_finder to msg) s.
Definition ss_safe (this to : nid)
(d : dstatelet) (msg : seq nat) :=
to \in cls /\ this \in cs /\
exists (C : coh d),
has (entry_finder to msg) (getSt this C).

(* Specifications: *)
Lemma ss_safe_coh this to d m : ss_safe this to d m -> coh d.
Lemma ss_safe_this this to d m :
ss_safe this to d m -> this \in cs.
Lemma ss_safe_def this to d msg :
ss_safe this to d msg <->
exists b pf, @ss_step this to d msg pf = Some b.