SPECIFICATION SafetySpec

CHECK_DEADLOCK TRUE

\* Combined contention: both local and deployment-wide limits constrain work.
\* Shrunk from 3 jobs to 2 so TLC finishes in minutes; Local=1 and Global=2
\* still force both limiters to bind under two live workers.
CONSTANTS
    Jobs = {j1, j2}
    Workers = {w1, w2}
    InitialWorkers = {w1, w2}
    NoJob = NoJob
    NoWorker = NoWorker
    MaxAttempts = 1
    MaxProgress = 1
    LeaseLimit = 1
    LocalLimit = 1
    GlobalLimit = 2
    FaultsEnabled = FALSE
    FaultServices = {}
    MaxCoordLosses = 0
    MaxPartitions = 0

INVARIANTS
    TypeOK
    StateConsistency
    AllocatedTokensUsed
    LiveProgressAligned
    AtMostOneLiveLeasePerJob
    AuthorityWellFormed
    CommittedResultConsistent
    CancellationSafety
    PermitSafety
    ResumeValidity
    StagingOwnership

PROPERTIES
    TerminalStateIsImmutable
    FencingTokensMonotonic
    CommitIsFencedCAS