Proof using nisi rri.
intros.
eapply lift_prop; eauto using nextIndex_safety_invariant.
Qed.

Lemma nextIndex_sanity :
forall net h h',
refined_raft_intermediate_reachable net ->
type (snd (nwState net h)) = Leader ->
pred (getNextIndex (snd (nwState net h)) h') <> 0 ->
exists e,
findAtIndex (log (snd (nwState net h))) (pred (getNextIndex (snd (nwState net h)) h')) = Some e.