SPECIFICATION SafetySpec

CHECK_DEADLOCK FALSE

\* Local contention: the global limit permits every worker-local slot.
CONSTANTS
    Jobs = {j1, j2}
    Workers = {w1, w2}
    InitialWorkers = {w1, w2}
    NoJob = NoJob
    NoWorker = NoWorker
    MaxAttempts = 1
    MaxProgress = 1
    LeaseLimit = 1
    LocalLimit = 1
    GlobalLimit = 3
    FaultsEnabled = FALSE
    FaultServices = {}

INVARIANTS
    TypeOK
    StateConsistency
    AtMostOneAuthoritativeAttempt
    FencingTokensUnique
    CommittedResultConsistent
    CancellationSafety
    PermitSafety
    QueueRecoverable
    AttemptIsolation
    ResumeValidity
    ZombieIsolation

PROPERTIES
    TerminalStateIsImmutable
    FencingTokensMonotonic
    CommitIsFencedCAS