Strengthen JobProtocol model after independent review.

Replace tautological invariants with non-trivial ones, allow multi-shot
coordination loss and re-partition, fix reap/progress lifecycle, enable
deadlock checking via Done, and add stress and multi-shot TLC configs.

docs/protocol/RemoraFencing.cfg

@@ -1,8 +1,9 @@
 SPECIFICATION SafetySpec
 
-CHECK_DEADLOCK FALSE
+CHECK_DEADLOCK TRUE
 
 \* Repeated fencing with delayed outcomes, lease loss, and replacement.
+\* MaxAttempts=3 stresses token replacement; fault budgets kept at 1 for TLC size.
 CONSTANTS
     Jobs = {j1}
     Workers = {w1, w2}
@@ -16,19 +17,21 @@ CONSTANTS
     GlobalLimit = 1
     FaultsEnabled = TRUE
     FaultServices = {"Coordination"}
+    MaxCoordLosses = 1
+    MaxPartitions = 1
 
 INVARIANTS
     TypeOK
     StateConsistency
-    AtMostOneAuthoritativeAttempt
-    FencingTokensUnique
+    AllocatedTokensUsed
+    LiveProgressAligned
+    AtMostOneLiveLeasePerJob
+    AuthorityWellFormed
     CommittedResultConsistent
     CancellationSafety
     PermitSafety
-    QueueRecoverable
-    AttemptIsolation
     ResumeValidity
-    ZombieIsolation
+    StagingOwnership
 
 PROPERTIES
     TerminalStateIsImmutable