SPECIFICATION SafetySpec

CHECK_DEADLOCK TRUE

\* Worker can reach coordination and target while durable authority is cut.
\* Single worker: CrashWorker disabled (OtherCapacity); partitions only.
CONSTANTS
    Jobs = {j1}
    Workers = {w1}
    InitialWorkers = {w1}
    NoJob = NoJob
    NoWorker = NoWorker
    MaxAttempts = 2
    MaxProgress = 1
    LeaseLimit = 1
    LocalLimit = 1
    GlobalLimit = 1
    FaultsEnabled = TRUE
    FaultServices = {"Durable"}
    MaxCoordLosses = 0
    MaxPartitions = 2

INVARIANTS
    TypeOK
    StateConsistency
    AllocatedTokensUsed
    LiveProgressAligned
    AtMostOneLiveLeasePerJob
    AuthorityWellFormed
    CommittedResultConsistent
    CancellationSafety
    PermitSafety
    ResumeValidity
    StagingOwnership

PROPERTIES
    TerminalStateIsImmutable
    FencingTokensMonotonic
    CommitIsFencedCAS