SPECIFICATION Spec INVARIANTS TypeOK ConfirmedRetention CHECK_DEADLOCK FALSE