End ServerReceiveTransition.
Section ServerSendTransition.
Definition entry_finder (to : nid) msg :=
let: ans := head 0 msg in
fun e : perm =>
let: (n, _, args) := e in
[&& n == to, f args == Some ans &
msg == ans :: args].
Definition can_send (s : cstate) to msg :=
has (entry_finder to msg) s.
Definition ss_safe (this to : nid)
(d : dstatelet) (msg : seq nat) :=
to \in cls /\ this \in cs /\
exists (C : coh d),
has (entry_finder to msg) (getSt this C).

Lemma ss_safe_def this to d msg :
ss_safe this to d msg <->
exists b pf, @ss_step this to d msg pf = Some b.