Strengthen JobProtocol model after independent review.

Replace tautological invariants with non-trivial ones, allow multi-shot
coordination loss and re-partition, fix reap/progress lifecycle, enable
deadlock checking via Done, and add stress and multi-shot TLC configs.

docs/protocol/Remora.cfg

@@ -1,8 +1,10 @@
 SPECIFICATION Spec
 
-CHECK_DEADLOCK FALSE
+CHECK_DEADLOCK TRUE
 
-\* Fault/recovery and temporal-property configuration.
+\* Fair Spec + liveness under coordination faults. Fault budgets are 1 so
+\* temporal checking finishes in minutes; multi-shot budgets are covered by
+\* RemoraMultiShot.cfg (safety-only).
 CONSTANTS
     Jobs = {j1}
     Workers = {w1, w2}
@@ -16,24 +18,26 @@ CONSTANTS
     GlobalLimit = 1
     FaultsEnabled = TRUE
     FaultServices = {"Coordination"}
+    MaxCoordLosses = 1
+    MaxPartitions = 1
 
 INVARIANTS
     TypeOK
     StateConsistency
-    AtMostOneAuthoritativeAttempt
-    FencingTokensUnique
+    AllocatedTokensUsed
+    LiveProgressAligned
+    AtMostOneLiveLeasePerJob
+    AuthorityWellFormed
     CommittedResultConsistent
     CancellationSafety
     PermitSafety
-    QueueRecoverable
-    AttemptIsolation
     ResumeValidity
-    ZombieIsolation
+    StagingOwnership
 
 PROPERTIES
     TerminalStateIsImmutable
     FencingTokensMonotonic
     CommitIsFencedCAS
-    AtLeastOnceDelivery
+    EventuallyDispatched
     EventuallyReaped
     EventuallyTerminal